Function at 0x18000b4a0
Capabilities:
Create thread
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xaf0]
sub rsp, 0xbf0
movzx ebx, byte [rbp + 0xb30]
mov r10, rdx
imul edi, ecx, 0x5af
xor edx, edx
mov esi, ecx
mov byte [rsp + 0x41], bl
mov r15, r8
mov r8d, dword [rbp + 0xb30]
mov dword [rsp + 0x44], r8d
cmp ecx, edi
mov dword [rbp - 0x80], edi
mov rcx, qword [rbp + 0xb48]
mov qword [rsp + 0x58], rcx
ja 0x18000be9f
movzx eax, byte [rbp + 0xb30]
movzx r14d, byte [rbp + 0xb30]
movzx r12d, byte [rbp + 0xb30]
mov r13d, dword [rbp + 0xb30]
mov byte [rsp + 0x40], al
mov eax, dword [rbp + 0xb30]
mov qword [rbp - 0x30], rax
movzx eax, byte [rbp + 0xb30]
mov byte [rbp + 0xb48], al
mov r11d, 0x74
lea r9d, [r11 + 1]
cmp esi, 0x5622
ja 0x18000b77a
je 0x18000b761
cmp esi, 0xe1
ja 0x18000b6aa
je 0x18000b69e
mov eax, esi
sub eax, 0x59
je 0x18000b66d
sub eax, 0x3f
je 0x18000b597
movzx r9d, byte [rbp + 0xb48]
cmp eax, 0x17
jne 0x18000bdd0
mov byte [rbp - 0x50], 0
jmp 0x18000bdd0
mov ecx, dword [r15]
cmp ecx, 9
jbe 0x18000b60d
nop
mov r8, qword [r10 + 0x10]
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
mov rdx, qword [r10 + 0x18]
add eax, eax
sub ecx, eax
cmp r8, rdx
jae 0x18000b5de
lea rax, [r8 + 1]
mov qword [r10 + 0x10], rax
mov rax, r10
cmp rdx, 0x10
jb 0x18000b5d2
mov rax, qword [r10]
mov byte [rax + r8], cl
mov byte [rax + r8 + 1], 0
jmp 0x18000b5f8
xor r8d, r8d
movzx r9d, cl
mov rcx, r10
lea edx, [r8 + 1]
call fcn.180001d60
mov r10, qword [rbp + 0xb38]
mov eax, 0xcccccccd
mul dword [r15]
mov ecx, edx
shr ecx, 3
mov dword [r15], ecx
cmp ecx, 9
ja 0x18000b5a0
mov r8, qword [r10 + 0x10]
mov rdx, qword [r10 + 0x18]
cmp r8, rdx
jae 0x18000b649
lea rax, [r8 + 1]
mov qword [r10 + 0x10], rax
mov rax, r10
cmp rdx, 0x10
jb 0x18000b62e
mov rax, qword [r10]
mov byte [rax + r8], cl
xor edx, edx
mov rcx, qword [rsp + 0x58]
mov byte [rax + r8 + 1], 0
mov r8d, dword [rsp + 0x44]
jmp 0x18000bdc8
xor r8d, r8d
movzx r9d, cl
mov rcx, r10
lea edx, [r8 + 1]
call fcn.180001d60
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov rcx, qword [rsp + 0x58]
jmp 0x18000bdc8
mov qword [rsp + 0x28], rdx
lea r8, [0x18000d960]
mov dword [rsp + 0x20], edx
mov r9, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov rcx, qword [rsp + 0x58]
mov qword [r15], rax
jmp 0x18000bdc8
mov dword [rbp - 0x18], 0x5f5348
jmp 0x18000bdc8
cmp esi, 0x2212
je 0x18000b724
cmp esi, 0x42fe
je 0x18000b6cd
cmp esi, 0x43cb
jne 0x18000bdc8
mov al, 1
jmp 0x18000bcbd
mov r8d, 4
lea rdx, [0x180027bee]
lea rcx, [rbp - 0x50]
call fcn.18001d320
mov r8d, 4
lea rdx, [0x180027c04]
lea rcx, [rbp - 0x4c]
call fcn.18001d4d0
mov r8d, 3
mov byte [rbp - 0x48], 0
lea rdx, [0x180027c3d]
lea rcx, [rbp - 0x50]
call fcn.18001d320
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov rcx, qword [rsp + 0x58]
jmp 0x18000bdc8
cmp qword [r15], 0
je 0x18000be98
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x78]
mov rdx, r15
mov dword [rsp + 0x78], 1
xor r8d, r8d
mov ecx, 0x13f
call fcn.180013650
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov rcx, qword [rsp + 0x58]
jmp 0x18000bdc8
movzx eax, word [0x180027bc4]
mov word [rbp - 0x15], ax
mov eax, 0x6e
mov word [rbp - 0x13], ax
jmp 0x18000bdc8
cmp esi, 0x155e5
ja 0x18000b89e
je 0x18000b83c
cmp esi, 0x854d
je 0x18000b82a
cmp esi, 0xab63
je 0x18000b7dd
movzx r9d, byte [rbp + 0xb48]
cmp esi, 0x100a4
jne 0x18000bdd0
mov eax, 0x6f
mov word [rbp - 0x6c], ax
mov eax, 0x77
mov word [rbp - 0x6b], ax
mov eax, 0x68
mov word [rbp - 0x6a], ax
mov eax, 0x65
mov word [rbp - 0x69], ax
jmp 0x18000bdd0
movzx eax, word [0x180027bd0]
movsd xmm0, qword [str.dingClear]
mov word [rbp - 0xa], ax
movzx eax, word [0x180027bd4]
mov word [rbp - 9], ax
movzx eax, byte [0x180027bd6]
mov byte [rbp - 7], al
mov eax, 0x2f
mov word [rbp - 0x70], ax
mov eax, 0x61
mov word [rbp - 0x6f], ax
mov eax, 0x7272
mov word [rbp - 0x6e], ax
movsd qword [rbp - 0x12], xmm0
jmp 0x18000bdc8
mov eax, 0x706d
mov byte [rbp - 0x43], 0
mov word [rbp - 0x45], ax
jmp 0x18000bdc8
cmp qword [r15 + 0x18], 8
mov eax, 0x7b
mov dword [rbp - 0x68], 0x206461
mov rcx, r15
mov word [rbp - 0x65], ax
jb 0x18000b859
mov rcx, qword [r15]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r8d, dword [rsp + 0x44]
mov r9b, 1
mov byte [rbp + 0xb48], r9b
mov rcx, rax
mov qword [rsp + 0x58], rax
xor edx, edx
jmp 0x18000bdd0
cmp esi, 0x1ab26
je 0x18000b918
cmp esi, 0x20067
je 0x18000b8e3
cmp esi, 0x255a8
jne 0x18000bdc8
mov dword [rbp + 0x20], edx
mov rcx, r10
mov dword [rbp + 0x24], edx
mov edx, r8d
xor r8d, r8d
call fcn.1800183d0
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov rcx, qword [rsp + 0x58]
mov qword [rbp + 0x70], rdx
jmp 0x18000bdc8
lea rdx, [rbp - 0x18]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x18000b8f0
xor edx, edx
mov qword [rbp - 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rsp + 0x58]
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x44], eax
jmp 0x18000bdc8
mov byte [rsp + 0x40], 1
cmp rcx, 0xffffffffffffffff
jne 0x18000bdba
mov edi, 0xc4
nop dword [rax]
cmp edi, 0x6f04
ja 0x18000bb62
je 0x18000bb32
cmp edi, 0x37e4
ja 0x18000ba82
je 0x18000ba5f
cmp edi, 0x1c54
ja 0x18000b9d5
je 0x18000b9c7
cmp edi, 0xc4
je 0x18000b9a0
cmp edi, 0x9f4
je 0x18000b996
cmp edi, 0x1324
jne 0x18000bd95
mov eax, 0x6174
mov dword [rbp + 8], 0x6e6f4374
mov word [rbp + 0xc], ax
mov dword [rbp + 0xe], 0x656e69
jmp 0x18000bd95
mov word [rbp + 7], r9w
jmp 0x18000bd95
mov eax, 0x56
mov word [rbp], ax
mov eax, 0x53
mov word [rbp + 1], ax
mov eax, 0x6f
mov word [rbp + 6], ax
mov dword [rbp + 2], 0x79614c47
jmp 0x18000bd95
mov eax, 0x2e72
mov word [rbp + 0x11], ax
jmp 0x18000bd95
cmp edi, 0x2584
je 0x18000ba32
cmp edi, 0x2eb4
jne 0x18000bd95
mov eax, 0x6d76
mov byte [rsp + 0x64], 0
mov r8d, 2
mov word [rsp + 0x62], ax
lea rdx, [0x180027981]
lea rcx, [rsp + 0x64]
call fcn.18001d4d0
mov r8d, 5
mov byte [rsp + 0x66], 0
lea rdx, [0x180027993]
lea rcx, [rsp + 0x66]
call fcn.18001d4d0
xor edx, edx
jmp 0x18000bd8f
mov eax, 0x47
mov byte [rsp + 0x62], 0
mov word [rbp + 0x13], ax
mov eax, 0x65
mov word [rbp + 0x14], ax
mov eax, 0x6c6c
mov word [rsp + 0x60], ax
mov dword [rbp + 0x15], 0x644974
jmp 0x18000bd95
mov r8d, 4
mov byte [rsp + 0x6b], 0
lea rdx, [0x18002793e]
lea rcx, [rsp + 0x60]
call fcn.18001d320
xor edx, edx
jmp 0x18000bd8f
cmp edi, 0x4114
je 0x18000bb20
cmp edi, 0x4a44
je 0x18000baeb
cmp edi, 0x5374
je 0x18000bacf
cmp edi, 0x5ca4
je 0x18000babc
cmp edi, 0x65d4
jne 0x18000bd95
mov word [rbp + 0x40], r11w
jmp 0x18000bd95
mov dword [rbp + 0x38], 0x6f0043
mov dword [rbp + 0x3c], 0x6e0075
jmp 0x18000bd95
mov eax, 0x6b
mov dword [rbp + 0x2e], 0x4c005f
mov word [rbp + 0x36], ax
mov dword [rbp + 0x32], 0x63006f
jmp 0x18000bd95
mov r8d, 2
lea rdx, [0x180027891]
lea rcx, [rsp + 0x73]
call fcn.18001d4d0
mov r11d, 0x74
mov byte [rsp + 0x75], 0
mov word [rbp + 0x2c], r11w
xor edx, edx
mov dword [rbp + 0x28], 0x650073
jmp 0x18000bd95
mov dword [rsp + 0x6f], 0x6c2e6372
mov byte [rsp + 0x73], 0
jmp 0x18000bd95
movzx eax, word [0x180027a50]
movsd xmm0, qword [0x180027a48]
mov word [rbp + 0x80], ax
mov eax, 0x65
mov word [rbp + 0x82], ax
mov word [rbp + 0x42], dx
movsd qword [rbp + 0x78], xmm0
jmp 0x18000bd95
cmp edi, 0xa624
ja 0x18000bc86
je 0x18000bc70
cmp edi, 0x7834
je 0x18000bc64
cmp edi, 0x8164
je 0x18000bc1f
cmp edi, 0x8a94
je 0x18000bbfb
cmp edi, 0x93c4
je 0x18000bbde
cmp edi, 0x9cf4
jne 0x18000bd95
mov r8d, 2
lea rdx, [0x1800278bc]
lea rcx, [rbp + 0xa4]
call fcn.18001d114
xor edx, edx
lea rax, [rbp]
mov r14b, 1
mov word [rbp + 0xa8], dx
mov qword [rbp - 0x28], rax
movzx r12d, r14b
jmp 0x18000bd8f
mov r8d, 4
lea rdx, [0x1800279dc]
lea rcx, [rbp + 0x78]
call fcn.18001d0cc
xor edx, edx
jmp 0x18000bd8f
mov word [rbp + 0x92], dx
lea rcx, [rbp + 0x78]
lea rdx, [0x180027b6a]
mov r8d, 5
call fcn.18001d0cc
xor edx, edx
jmp 0x18000bd8f
movsd xmm0, qword [0x180027a72]
lea rcx, [rbp + 0x8e]
movzx eax, word [0x180027a7a]
mov r8d, 2
mov word [rbp + 0x8e], dx
lea rdx, [0x180027ade]
movsd qword [rbp + 0x84], xmm0
mov word [rbp + 0x8c], ax
call fcn.18001d114
xor edx, edx
jmp 0x18000bd8f
mov word [rbp + 0x84], dx
jmp 0x18000bd95
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], edx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x78], rdx
jmp 0x18000bd95
cmp edi, 0xaf54
je 0x18000bd69
cmp edi, 0xb884
je 0x18000bd3e
cmp edi, 0xc1b4
je 0x18000bcf7
cmp edi, 0xcae4
je 0x18000bcd8
cmp edi, 0xd414
jne 0x18000bd95
movzx eax, bl
mov rbx, qword [rsp + 0xc40]
add rsp, 0xbf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r12b, r12b
je 0x18000bcec
mov rcx, qword [rbp - 0x38]
call sub.RPCRT4.dll_MesHandleFree
xor edx, edx
lea r11d, [rdx + 0x74]
xor bl, bl
mov byte [rsp + 0x41], bl
jmp 0x18000bd95
lea rax, [rbp + 0x2d0]
mov r9d, 0x104
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x28]
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0x78]
mov qword [rsp + 0x20], rax
lea rcx, str.IMAGE_GATHER4_C_L_O_V4_V1
call qword [sym.imp.KERNEL32.dll_SearchPathW]
xor edx, edx
movzx eax, r12b
test r13d, r13d
mov ecx, edx
cmove ecx, eax
movzx r12d, cl
jmp 0x18000bd8f
lea r8, [rbp - 0x38]
lea rdx, [rsp + 0x4c]
lea rcx, [rbp - 0x20]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov r13d, eax
test r14b, r14b
je 0x18000ba2b
mov rcx, qword [rbp - 0x78]
call sub.RPCRT4.dll_MesHandleFree
xor edx, edx
jmp 0x18000bd8f
mov dword [rsp + 0x4c], edx
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x28]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
xor edx, edx
movzx r14d, r14b
test eax, eax
mov qword [rbp - 0x38], rdx
cmovne r14d, edx
mov r11d, 0x74
add edi, 0x930
mov r9d, 0x75
cmp edi, 0xdc80
jbe 0x18000b930
mov edi, dword [rbp - 0x80]
mov r8d, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x70]
mov dword [rbp - 0x60], edx
mov qword [rbp + 0xb8], rax
movzx r9d, byte [rbp + 0xb48]
imul eax, dword [rbp + 0xb30], 0x61
mov r10, qword [rbp + 0xb38]
add esi, eax
cmp esi, edi
jbe 0x18000b53f
movzx r11d, byte [rsp + 0x40]
mov esi, dword [rbp + 0xb30]
lea edx, [rsi + 0xa05]
mov dword [rsp + 0x48], edx
cmp esi, edx
jae case.0x18000bfd8.0
movzx edx, word [rbp + 0xb30]
mov r13, qword [rbp + 0xb48]
movzx r12d, byte [rbp + 0xb30]
mov edi, dword [rbp + 0xb30]
mov r15, qword [rbp + 0xb48]
movzx r14d, byte [rsp + 0x42]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x4c], edx
nop word [rax + rax]
cmp esi, 0x2e2
ja 0x18000c0ef
je 0x18000b6c6
cmp esi, 0x18c
ja 0x18000bf57
je 0x18000bf14
mov eax, esi
sub eax, 0xaf
je 0x18000bf09
sub eax, 0x32
je 0x18000beca
cmp eax, 0x79
jne 0x18000c43c
lea r8d, [rax - 0x77]
lea rdx, [0x180027d5f]
lea rcx, [rbp - 0x42]
call fcn.18001d4d0
jmp 0x18000c426
xor al, al
jmp 0x18000bcbd
movzx r11d, byte [rbp + 0xb30]
movzx r9d, byte [rbp + 0xb30]
mov eax, dword [rbp + 0xb30]
mov byte [rsp + 0x40], r11b
mov byte [rbp + 0xb48], r9b
mov qword [rbp - 0x30], rax
jmp 0x18000bdee
xor eax, eax
mov rdx, r10
cmp qword [r10 + 0x18], 0x10
mov qword [rbp + 0x68], rax
jb 0x18000bedd
mov rdx, qword [r10]
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rbp - 0x30]
lea r9, [rbp + 0x70]
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x18]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rsp + 0x78], eax
jmp 0x18000c426
mov word [rbp - 0x43], 0x52
jmp 0x18000c43c
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x24]
lea rcx, [rbp + 0xb8]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov rcx, qword [rsp + 0x58]
mov dword [rbp - 0x80], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edx, eax
movzx eax, byte [rbp + 0xb48]
cmp dword [rsp + 0x78], edx
cmove edx, eax
movzx r9d, dl
mov byte [rbp + 0xb48], dl
jmp 0x18000c42e
mov eax, esi
sub eax, 0x205
je 0x18000c0db
sub eax, 0x32
je 0x18000bf9e
cmp eax, 0x79
jne 0x18000c43c
mov eax, 0x65
mov dword [rbp + 0x4a], 0x6c0073
mov word [rbp + 0x4e], ax
mov eax, 0x2e
mov word [rbp + 0x58], ax
mov dword [rbp + 0x50], 0x790061
mov dword [rbp + 0x54], 0x320033
jmp 0x18000c43c
xor edx, edx
movzx eax, r11b
cmp dword [rbp - 0x80], edx
mov ecx, edx
cmove ecx, eax
mov byte [rsp + 0x40], cl
cmp r8d, dword [rbp - 0x60]
je 0x18000c00d
mov esi, 6
nop dword [rax + rax]
cmp esi, 6
ja case.default.0x18000bfd8
lea rdx, [0x180000000]
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0xc468]
add rcx, rdx
jmp rcx
mov byte [rsp + 0x50], 1
mov qword [rbp - 0x78], 0xffffffffffffffff
xor edx, edx
mov r10, qword [rbp + 0xb38]
dec esi
lea eax, [rsi + 0xf0]
cmp eax, 0xef
ja 0x18000bfc0
mov esi, dword [rbp + 0xb30]
movzx r9d, byte [rbp + 0xb48]
test r9b, r9b
je 0x18000c046
mov qword [rbp - 0x58], rdx
lea r8, [rbp - 0x58]
mov edx, dword [rbp - 0x30]
lea rcx, [rbp - 0x18]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp + 0x70]
mov dword [rsp + 0x78], eax
test rcx, rcx
je 0x18000c038
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18000c046
call sub.RPCRT4.dll_MesHandleFree
cmp byte [rsp + 0x40], 0
je 0x18000c426
mov rcx, qword [rbp + 0x68]
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18000c426
xor bl, bl
mov byte [rsp + 0x41], bl
jmp case.0x18000bfd8.2
mov rcx, qword [rbp - 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
jne 0x18000c091
mov byte [rsp + 0x50], al
mov edx, 1
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
jmp case.0x18000bfd8.2
cmp byte [rsp + 0x50], 0
je 0x18000c0ae
mov rcx, qword [rbp - 0x78]
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymFunctionTableAccess64]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov edx, 1
lea ecx, [rdx + 0x7e]
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
jmp case.0x18000bfd8.2
xor edx, edx
mov rax, r10
mov qword [r10 + 0x10], rdx
cmp qword [r10 + 0x18], 0x10
jb 0x18000c0d4
mov rax, qword [r10]
mov byte [rax], dl
jmp case.default.0x18000bfd8
mov eax, 0x73
mov word [rbp - 0x40], 0x74
mov word [rbp + 0x48], ax
jmp 0x18000c43c
cmp esi, 0x55c
ja 0x18000c1a8
je 0x18000c152
cmp esi, 0x35b
je 0x18000c133
cmp esi, 0x406
je 0x18000c127
cmp esi, 0x4b1
jne 0x18000c440
mov edx, 0x100
mov dword [rsp + 0x4c], edx
jmp 0x18000c440
mov r12b, 1
movzx r14d, r12b
jmp 0x18000c440
mov r10d, 0x64
mov dword [rbp + 0x5c], 0x6c006c
mov word [rbp + 0x5a], r10w
xor r10d, r10d
mov word [rbp + 0x60], r10w
jmp 0x18000c440
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
movsx ecx, word [rsp + 0x4c]
xor r9d, r9d
mov qword [rbp - 0x28], rax
xor edx, edx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edx, 0x8a
lea r8, [rbp + 0x48]
mov r13, rax
lea ecx, [rdx + 0x2d]
call fcn.180006fd0
mov qword [rbp + 0xb0], rax
jmp 0x18000c426
cmp esi, 0x607
je 0x18000c1fe
cmp esi, 0x6b2
je 0x18000c1d5
cmp esi, 0x75d
jne 0x18000c440
call qword [rbp + 0xb0]
cmp eax, 1
sete al
jmp 0x18000bcbd
test r14b, r14b
je 0x18000c440
mov rcx, qword [rbp - 0x28]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000c420
xor r10d, r10d
movzx eax, r14b
mov ecx, r10d
cmp qword [rbp - 0x28], rcx
cmovne ecx, eax
test r13, r13
movzx r14d, cl
mov byte [rsp + 0x42], cl
movzx eax, r12b
mov ecx, r10d
cmovne ecx, eax
movzx r12d, cl
test cl, cl
je 0x18000c437
movzx ebx, byte [rsp + 0x51]
mov esi, 0x119
nop word [rax + rax]
cmp esi, 0x25d
ja 0x18000c352
je 0x18000c310
mov eax, esi
sub eax, 0x119
je 0x18000c2d8
sub eax, 0x51
je 0x18000c2bc
sub eax, 0x51
je 0x18000c291
cmp eax, 0x51
jne 0x18000c3f8
lea r8d, [rax - 0x50]
lea rdx, [0x180027c84]
lea rcx, [rsp + 0x60]
call fcn.18001d320
mov word [rsp + 0x6c], 0x32
mov bl, 1
jmp 0x18000c3f8
mov eax, 0x3334
mov byte [rsp + 0x6b], 0
mov word [rsp + 0x66], ax
movzx eax, word [0x180027c6b]
mov word [rsp + 0x68], ax
movzx eax, byte [0x180027c6d]
mov byte [rsp + 0x6a], al
jmp 0x18000c3f8
mov r8d, 3
lea rdx, [0x180027ca0]
lea rcx, [rsp + 0x60]
call fcn.18001d320
jmp 0x18000c3f8
mov r8d, 2
lea rdx, [0x180027cb3]
lea rcx, [rsp + 0x60]
call fcn.18001d4d0
mov r8d, 1
mov byte [rsp + 0x62], 0
lea rdx, [0x180027d47]
lea rcx, [rsp + 0x60]
call fcn.18001d320
jmp 0x18000c3f8
lea rax, [rsp + 0x60]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18000c320
movsx rax, dx
xor r9d, r9d
mov edx, 0xf001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x38], r10d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
jmp 0x18000c3f8
mov eax, esi
sub eax, 0x2ae
je 0x18000c3f4
sub eax, 0x51
je 0x18000c3c3
cmp eax, 0x51
jne 0x18000c3f8
test bl, bl
je 0x18000c3a1
lea r8, [rbp - 0x58]
mov qword [rbp - 0x58], r10
mov edx, edi
lea rcx, [rsp + 0x60]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x18000c393
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18000c3a1
call sub.RPCRT4.dll_MesHandleFree
test r12b, r12b
je 0x18000c3f8
mov rcx, r15
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000c3f8
lea r9, [rbp - 0x20]
mov edx, edi
lea r8, [rbp - 0x38]
lea rcx, [rsp + 0x60]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov r14d, eax
test r15, r15
jne 0x18000c3eb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12b, r12b
test r14d, r14d
je 0x18000c3f8
xor bl, bl
jmp 0x18000c3f8
mov qword [rbp - 0x20], r10
mov edx, dword [rsp + 0x4c]
add esi, 0x51
mov r10d, 0
cmp esi, 0x3a1
jb 0x18000c240
movzx r14d, byte [rsp + 0x42]
mov byte [rsp + 0x51], bl
movzx ebx, byte [rsp + 0x41]
mov esi, dword [rbp + 0xb30]
movzx r9d, byte [rbp + 0xb48]
mov edx, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x48]
add esi, 0xab
mov dword [rbp + 0xb30], esi
cmp esi, eax
jae case.0x18000bfd8.0
mov r10, qword [rbp + 0xb38]
movzx r11d, byte [rsp + 0x40]
jmp 0x18000be40