Function at 0x180009490
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov dword [rax + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x438]
sub rsp, 0x4f8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
mov rbx, r8
mov r9d, ecx
xor r10d, r10d
mov qword [rbp + 0x20], r10
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], r10b
lea eax, [rcx - 0xe]
mov dword [rbp + 0x458], eax
lea r11, [0x180000000]
cmp ecx, eax
jbe 0x180009a70
lea r14d, [rcx - 0xfd]
mov dword [rsp + 0x48], r14d
lea r8d, [r10 + 0x69]
lea r9d, [r10 + 0x49]
xorps xmm9, xmm9
movsd xmm7, qword [0x180057a88]
movsd xmm6, qword [0x180057a50]
movsd xmm10, qword [0x180057a38]
mov r12, qword [rbp - 0x60]
mov r15d, dword [rbp + 0x440]
mov eax, dword [rbp + 0x440]
mov qword [rsp + 0x70], rax
mov ebx, dword [rsp + 0x40]
mov rsi, qword [rbp + 0x458]
mov r13d, dword [rbp + 0x440]
mov edi, dword [rbp + 0x440]
movss xmm11, dword [rbp + 0x440]
mov ecx, dword [rbp + 0x458]
cmp r14d, 0x1d
ja case.default.0x180009589
mov ecx, dword [r11 + r14*4 + 0xa3c4]
add rcx, r11
jmp rcx
mov dword [rbp - 0x20], 0xbdcccccd
mov dword [rbp - 0x1c], 0xbdcccccd
mov dword [rbp - 0x18], 0xbdcccccd
mov qword [rbp - 0x60], 0
movss xmm11, dword [0x180057aac]
mov r12, qword [rbp - 0x60]
jmp case.0x180009589.2
mov dword [rbp - 0x70], 0x3f800000
mov dword [rbp - 0x6c], 0x3f800000
mov dword [rbp - 0x68], 0x3f800000
mov dword [rbp - 0x10], 0x3dcccccd
mov dword [rbp - 0xc], 0x3dcccccd
mov dword [rbp - 8], 0x3dcccccd
jmp case.0x180009589.2
mov ecx, 0x66
call fcn.1800058a0
test al, al
je 0x180009b1c
mov rax, qword [rbp + 0x450]
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x18000960f
mov rdx, qword [rax]
mov r9, qword [rbp + 0x448]
mov r9, qword [r9 + 0x80]
lea r8, [rbp + 0x10]
mov ecx, 0x55
call fcn.180003b40
mov r14d, 0x29
cmp r14d, 0x29
ja case.0x180009657.2
mov eax, r14d
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0xa47c]
mov ecx, dword [rdx + rax*4 + 0xa43c]
add rcx, rdx
jmp rcx
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x13]
lea r8, [rsp + 0x58]
xor edx, edx
lea ecx, [rax + 0x2d]
call fcn.180019870
mov qword [rbp - 0x38], rax
jmp case.0x180009657.2
mov rax, qword [rbp + 0x448]
movsd xmm0, qword [rax]
mulsd xmm0, xmm7
cvttsd2si r15, xmm0
mov eax, 0x51eb851f
mul r15d
shr edx, 5
imul eax, edx, 0x64
sub r15d, eax
mov r8d, 0xa
lea rdx, [rbp + 0x10]
mov ecx, dword [rsp + 0x70]
call fcn.18004004c
jmp case.0x180009657.2
mov rax, qword [rbp + 0x448]
cvttsd2si rax, qword [rax]
mov qword [rsp + 0x70], rax
jmp case.0x180009657.2
mov byte [rsi], 0x2e
inc rsi
cmp r15d, 0xa
jae 0x1800096e1
mov byte [rsi], 0x30
inc rsi
mov r8d, 0xa
mov rdx, rsi
mov ecx, r15d
call fcn.18004004c
jmp case.0x180009657.2
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdx, qword [rbp + 0x10]
xor r9d, r9d
mov r8d, dword [rbp + 0x20]
mov rax, qword [rbp + 0x448]
mov rcx, qword [rax]
call qword [rbp - 0x38]
mov r13d, eax
jmp case.0x180009657.2
xor eax, eax
mov ebx, eax
mov dword [rsp + 0x40], eax
jmp case.0x180009657.2
movabs rax, 0x320033005f0032
mov qword [rsp + 0x5c], rax
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x64], rax
jmp case.0x180009657.2
mov rax, qword [rbp + 0x448]
movsd xmm0, qword [rax]
addsd xmm0, xmm6
movsd qword [rax], xmm0
jmp case.0x180009657.2
lea rcx, [rbp + 0x10]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x180009774
lea rsi, [rbp + 0x10]
add rsi, rax
jmp case.0x180009657.2
mov r8, qword [rbp + 0x448]
add r8, 0x10
lea r9, [rbp + 0x10]
mov edx, 0xd8
lea rcx, [rbp + 0x48]
call fcn.1800293f0
test eax, eax
je case.0x180009657.2
mov ebx, eax
mov dword [rsp + 0x40], eax
mov byte [rsp + 0x50], al
mov r14d, dword [rsp + 0x48]
jmp 0x180009a2a
xor eax, eax
mov word [rsp + 0x58], ax
lea r8d, [rax + 2]
lea rdx, [0x180057728]
lea rcx, [rsp + 0x58]
call fcn.18003f900
jmp case.0x180009657.2
cmp r13d, 0xffffffff
je 0x180009804
mov byte [rsp + 0x40], 1
mov ebx, dword [rsp + 0x40]
jmp case.0x180009657.2
xor eax, eax
mov word [rsp + 0x6c], ax
dec r14d
lea eax, [r14 + 0x77]
cmp eax, 0x8e
jbe case.0x180009657.0
jmp 0x180009631
mov byte [rsp + 0x40], 0
mov ebx, dword [rsp + 0x40]
mov eax, ebx
mov byte [rsp + 0x50], al
mov r14d, dword [rsp + 0x48]
jmp 0x180009a2a
lea r8, [rbp + 0x110]
mov edx, 0x23
lea rcx, [rbp - 0x70]
call fcn.180033130
mov ecx, 0xbe
mov rdx, qword [rbp - 0x70]
nop dword [rax + rax]
mov eax, ecx
sub eax, 0xbe
je 0x180009879
cmp eax, 2
jne 0x18000985f
mov rax, rdx
mov rdx, r12
mov qword [rbp - 0x70], rdx
mov r12, rax
mov qword [rbp - 0x60], rax
dec ecx
cmp ecx, 0xbc
ja 0x180009840
test edi, edi
jne 0x1800098e4
lea rbx, str.MP4S_MPEG_4_Visual_MS_MPEG_4_v3_Microsoft_MPEG_4__Windows_Media_7.0_____YUV_4:2:0
jmp 0x180009b26
movss xmm0, dword [rbp - 0x70]
subss xmm0, dword [rbp - 0x60]
comiss xmm9, xmm0
jbe 0x180009890
xorps xmm0, xmmword [0x180057bb0]
cvtss2sd xmm0, xmm0
comisd xmm10, xmm0
jbe 0x18000986d
movss xmm0, dword [rbp - 0x6c]
subss xmm0, dword [rbp - 0x5c]
comiss xmm9, xmm0
jbe 0x1800098b2
xorps xmm0, xmmword [0x180057bb0]
cvtss2sd xmm0, xmm0
comisd xmm10, xmm0
jbe 0x18000986d
movss xmm0, dword [rbp - 0x68]
subss xmm0, xmm11
comiss xmm9, xmm0
jbe 0x1800098d4
xorps xmm0, xmmword [0x180057bb0]
cvtss2sd xmm0, xmm0
comisd xmm10, xmm0
jbe 0x18000986d
mov edi, 1
xor r10d, r10d
mov qword [rsp + 0x50], r10
jmp 0x180009a2d
movsd xmm0, qword [0x180056ff2]
movsd qword [rbp + 0x98], xmm0
movzx eax, word [0x180056ffa]
mov word [rbp + 0xa0], ax
mov word [rbp + 0xa2], r10w
jmp case.0x180009589.2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x110]
mov ecx, 0xbf
call fcn.180003b40
jmp 0x180009a2a
mov word [rbp + 0x56], r8w
jmp case.0x180009589.2
mov dword [rbp + 0x80], 0x49
jmp case.0x180009589.2
mov eax, dword [0x180057064]
mov dword [rbp + 0x50], eax
movzx eax, word [0x180057068]
mov word [rbp + 0x54], ax
jmp case.0x180009589.2
mov r8d, 1
lea rdx, str.Suspend_widget_state_is_change_...
lea rcx, [rbp + 0x82]
call fcn.18003f948
xor eax, eax
mov word [rbp + 0x84], ax
lea r8d, [rax + 5]
lea rdx, [0x1800570de]
lea rcx, [rbp + 0x84]
call fcn.18003f948
jmp 0x180009a2a
mov r8d, 0xa7
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x150]
call fcn.18002d000
mov r8, rax
mov edx, 0xf6
lea rcx, [rbp + 0x110]
call fcn.1800227a0
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x150]
mov ecx, 0x105
call fcn.18001a5a0
mov r8, rax
mov edx, 0xf6
lea rcx, [rbp + 0x110]
call fcn.1800227a0
jmp 0x180009a2a
mov word [rbp + 0x8e], r10w
mov r8d, 4
lea rdx, [0x180057104]
lea rcx, [rbp + 0x80]
call fcn.18003f900
mov eax, 0x57
mov word [rbp + 0x96], ax
xor r10d, r10d
mov rdx, qword [rbp + 0x448]
mov r8d, 0x69
lea r9d, [r8 - 0x20]
lea r11, [0x180000000]
mov ecx, dword [rbp + 0x458]
dec r14d
mov dword [rsp + 0x48], r14d
lea eax, [r14 + 0xfd]
cmp eax, ecx
ja 0x180009574
mov r9d, dword [rbp + 0x440]
mov rbx, qword [rbp + 0x450]
lea r8d, [r9 + 0x8c0]
mov dword [rsp + 0x40], r8d
cmp r9d, r8d
jae case.0x180009f9c.22
movzx r14d, byte [rbp + 0x440]
mov r15, qword [rbp + 0x458]
mov r12d, dword [rbp + 0x440]
mov esi, dword [rbp + 0x440]
mov r13d, dword [rbp + 0x440]
mov r11d, 0x6f
cmp r9d, 0x56c
ja 0x180009ed6
je 0x180009e43
cmp r9d, 0x2ec
ja 0x180009be1
je 0x180009bd0
cmp r9d, 0x10c
je 0x180009bb3
cmp r9d, 0x1ac
je 0x180009b95
cmp r9d, 0x24c
jne 0x18000a391
lea r8d, [r11 - 0x6b]
lea rdx, [0x180057186]
lea rcx, [rbp + 0x68]
call fcn.18003f948
xor r10d, r10d
mov word [rbp + 0x70], r10w
jmp 0x18000a385
mov byte [rsp + 0x50], 0
mov rbx, qword [rsp + 0x50]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x180009b61
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009b5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a3bb
call fcn.18003ae74
mov rax, rbx
lea r11, [rsp + 0x4f8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm9, xmmword [r11 - 0x38]
movaps xmm10, xmmword [r11 - 0x48]
movaps xmm11, xmmword [r11 - 0x58]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, dword [0x1800571ba]
mov dword [rbp + 0x62], eax
movzx eax, word [0x1800571be]
mov word [rbp + 0x66], ax
mov word [rbp + 0x68], r10w
jmp 0x18000a391
movsd xmm0, qword [0x180057120]
movsd qword [rbp + 0x58], xmm0
movzx eax, word [0x180057128]
mov word [rbp + 0x60], ax
jmp 0x18000a391
mov dword [rbp + 0x70], 0x700065
mov word [rbp + 0x74], r10w
jmp 0x18000a391
cmp r9d, 0x38c
je 0x180009e32
cmp r9d, 0x42c
je 0x180009c0e
cmp r9d, 0x4cc
jne 0x18000a391
mov dword [rsp + 0x7c], r10d
jmp 0x18000a391
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x180009c1b
mov rcx, qword [rdx]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x40], rax
mov byte [rsp + 0x46], 1
cmp rax, 0xffffffffffffffff
jne 0x18000a382
mov edi, 0xc
nop word [rax + rax]
cmp edi, 0xc
ja case.default.0x180009c78
mov ecx, edi
lea rdx, [0x180000000]
mov eax, dword [rdx + rcx*4 + 0xa4a8]
add rax, rdx
jmp rax
mov dword [rsp + 0x62], 0x4e5f34
mov eax, 0x6f
mov word [rsp + 0x65], ax
xor r10d, r10d
dec edi
lea eax, [rdi + 0x11e]
cmp eax, 0x11d
ja 0x180009c60
jmp 0x18000a385
mov byte [rbp + 0x458], 1
jmp case.default.0x180009c78
call qword [sym.imp.WINMM.dll_mixerGetNumDevs]
mov dword [rbp - 0x30], eax
xor r10d, r10d
mov qword [rbp + 0x30], r10
jmp 0x180009c8f
mov eax, 0x73
mov word [rsp + 0x69], ax
jmp case.default.0x180009c78
mov dword [rsp + 0x66], 0x676552
jmp case.default.0x180009c78
mov dword [rsp + 0x58], 0x525343
mov eax, 0x5f
mov word [rsp + 0x5b], ax
jmp case.default.0x180009c78
mov dword [rsp + 0x5c], 0x63724141
mov eax, 0x68
mov word [rsp + 0x60], ax
mov eax, 0x36
mov word [rsp + 0x61], ax
jmp case.default.0x180009c78
lea rax, [rsp + 0x58]
mov qword [rbp - 0x20], rax
jmp case.default.0x180009c78
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x2c]
lea rcx, [rbp - 0x20]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov dword [rbp - 0x28], eax
xor r10d, r10d
mov edx, r10d
movzx ecx, r14b
cmp dword [rbp - 0x30], r10d
cmovne edx, ecx
movzx r14d, dl
jmp 0x180009c8f
mov byte [rsp + 0x50], 0
jmp case.default.0x180009c78
mov r14b, 1
xor r10d, r10d
mov dword [rbp - 0x2c], r10d
jmp 0x180009c8f
xor r10d, r10d
mov ecx, r10d
movzx eax, byte [rbp + 0x458]
cmp dword [rbp - 0x28], r10d
cmove ecx, eax
mov byte [rbp + 0x458], cl
cmp cl, r10b
je 0x180009d86
mov rcx, qword [rbp + 0x30]
call sub.RPCRT4.dll_MesHandleFree
xor r10d, r10d
test r14b, r14b
je 0x180009c8f
mov ebx, 0xbe
mov eax, ebx
sub eax, 0xbb
je 0x180009dd8
sub eax, 1
je 0x180009dbe
sub eax, 1
je 0x180009db6
cmp eax, 1
jne 0x180009e0c
mov r15, r10
mov dword [rsp + 0x78], r10d
jmp 0x180009e0c
mov r12d, 0x80000000
jmp 0x180009e0c
mov r8d, r12d
lea rdx, [rsp + 0x78]
mov rcx, r15
call qword [sym.imp.WINMM.dll_mixerGetID]
test eax, eax
je 0x180009e0c
xor r14b, r14b
jmp 0x180009e0c
test r14b, r14b
je 0x180009e0c
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
mov ecx, dword [rsp + 0x78]
mov r8d, 0x30
lea rdx, [rbp + 0xd8]
call qword [sym.imp.WINMM.dll_mixerGetDevCapsA]
dec ebx
cmp ebx, 0xba
mov r10d, 0
ja 0x180009d94
movzx ecx, byte [rbp + 0x458]
mov byte [rbp + 0x458], cl
jmp 0x180009c8f
mov dword [rbp + 0x74], 0x680074
mov word [rbp + 0x78], r10w
jmp 0x18000a391
mov qword [rbp + 0x40], r10
xor edx, edx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x48], eax
mov ecx, eax
mov r8, qword [rbx + 0x10]
cmp rcx, r8
ja 0x180009e7c
mov qword [rbx + 0x10], rcx
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180009e73
mov rdx, qword [rbx]
mov byte [rdx + rcx], 0
jmp 0x18000a382
mov rdi, rcx
sub rdi, r8
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, r8
cmp rdi, rax
ja 0x180009ebb
mov qword [rbx + 0x10], rcx
mov rax, rbx
cmp rdx, 0x10
jb 0x180009ea1
mov rax, qword [rbx]
lea rbx, [rax + r8]
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.18003c990
mov byte [rdi + rbx], 0
jmp 0x18000a382
mov byte [rsp + 0x20], 0
mov r9, rdi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.180002040
jmp 0x18000a382
cmp r9d, 0x7ec
ja 0x18000a300
je 0x180009f56
cmp r9d, 0x60c
je 0x180009f3e
cmp r9d, 0x6ac
je 0x180009f13
cmp r9d, 0x74c
jne 0x18000a391
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000a382
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180009f20
mov rdx, qword [rbx]
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x7c]
mov r8d, dword [rsp + 0x48]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x18000a382
lea r9, [rbp + 0x40]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x78], eax
jmp 0x18000a382
mov ecx, r10d
movzx eax, byte [rsp + 0x46]
cmp dword [rbp - 0x78], 0
cmove ecx, eax
mov byte [rsp + 0x46], cl
mov eax, dword [rsp + 0x48]
cmp eax, dword [rsp + 0x7c]
je 0x18000a391
mov edi, r10d
mov dword [rbp - 0x7c], r10d
nop
cmp edi, 0x16
ja case.0x180009f9c.14
mov eax, edi
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0xa4dc]
add rcx, rdx
jmp rcx
mov eax, 0x53
mov word [rbp - 0x4a], ax
jmp case.0x180009f9c.14
lea rax, [rsp + 0x58]
mov qword [rbp + 0x48], rax
jmp case.0x180009f9c.14
mov ecx, r10d
movzx eax, byte [rsp + 0x44]
cmp dword [rbp], 0
cmove ecx, eax
mov byte [rsp + 0x44], cl
mov ecx, r10d
movzx eax, byte [rsp + 0x45]
cmp dword [rbp - 0x24], 0
cmove ecx, eax
mov byte [rsp + 0x45], cl
cmp byte [rsp + 0x44], 0
je case.0x180009f9c.14
mov rcx, qword [rbp + 0x38]
call sub.RPCRT4.dll_MesHandleFree
jmp case.0x180009f9c.14
mov qword [rbp + 0x38], r10
mov qword [rsp + 0x70], r10
jmp case.0x180009f9c.14
mov qword [rbp - 0x60], 0xffffffffffffffff
jmp case.0x180009f9c.14
mov r8d, 2
lea rdx, [0x180054ef0]
lea rcx, [rsp + 0x5a]
call fcn.18003fd90
mov r8d, 2
lea rdx, [0x1800571c8]
lea rcx, [rsp + 0x58]
call fcn.18003fbe0
jmp case.0x180009f9c.14
mov byte [rsp + 0x45], 1
jmp case.0x180009f9c.14
mov byte [rsp + 0x58], 0
jmp case.0x180009f9c.14
mov eax, 0x5a
mov word [rbp - 0x49], ax
jmp case.0x180009f9c.14
mov dword [rbp + 4], r10d
mov dword [rbp - 0x80], r10d
mov qword [rbx + 0x10], r10
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18000a082
mov rax, qword [rbx]
mov byte [rax], 0
jmp case.0x180009f9c.14
mov r8d, 0xa
lea rdx, [rbp - 0x48]
lea ecx, [r8 - 8]
call fcn.1800400ac
mov r8d, 0xa
lea rdx, [rbp - 0x47]
lea ecx, [r8 + 0x2e]
call fcn.18004004c
jmp case.0x180009f9c.14
lea rax, [rbp - 0x50]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18000a0c0
mov dword [rbp + 8], 2
jmp case.0x180009f9c.14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rax
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x80]
mov edx, esi
lea rcx, [rbp - 0x50]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rbp - 0x24], eax
jmp case.0x180009f9c.14
mov dword [rbp - 0x50], 0x485356
mov r8d, 2
lea rdx, [0x1800571cc]
lea rcx, [rbp - 0x4d]
call fcn.18003fd90
movzx eax, word [0x1800571d0]
mov word [rbp - 0x4c], ax
movzx eax, byte [0x1800571d2]
mov byte [rbp - 0x4a], al
jmp case.0x180009f9c.14
lea rcx, [rsp + 0x58]
dec rcx
nop word [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18000a150
movzx eax, word [0x1800571d4]
mov word [rcx], ax
mov word [rsp + 0x5e], r11w
mov byte [rsp + 0x5f], 0x6e
jmp case.0x180009f9c.14
lea rcx, [rsp + 0x58]
dec rcx
nop dword [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18000a180
movzx eax, word [0x1800571d8]
mov word [rcx], ax
movzx eax, byte [0x1800571da]
mov byte [rcx + 2], al
jmp case.0x180009f9c.14
lea rcx, [rbp - 0x50]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18000a1b0
mov eax, dword [str.rrik]
mov dword [rcx], eax
movzx eax, byte [0x1800571e0]
mov byte [rcx + 4], al
mov byte [rsp + 0x44], 1
jmp case.0x180009f9c.14
mov eax, dword [str.s_0x]
mov dword [rsp + 0x63], eax
movzx eax, word [0x1800571ec]
mov word [rsp + 0x67], ax
mov eax, 0x29
mov word [rsp + 0x69], ax
jmp case.0x180009f9c.14
movzx eax, word [0x180052a2c]
mov word [rsp + 0x60], ax
mov eax, 0x25
mov word [rsp + 0x62], ax
jmp case.0x180009f9c.14
cmp byte [rsp + 0x45], 0
je 0x18000a295
mov ebx, 0x85
mov edi, dword [rbp + 0xc]
cmp ebx, 0x85
je 0x18000a279
cmp ebx, 0x31e0
je 0x18000a250
cmp ebx, 0x633b
jne 0x18000a281
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18000a281
call sub.RPCRT4.dll_MesHandleFree
xor r10d, r10d
jmp 0x18000a281
mov qword [rbp - 0x10], r10
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
lea r9, [rbp - 0x10]
mov r8d, r13d
mov edx, edi
mov rcx, qword [rsp + 0x70]
call sub.RPCRT4.dll_MesBufferHandleReset
xor r10d, r10d
jmp 0x18000a281
mov edi, 1
mov r13d, r10d
add ebx, 0x315b
cmp ebx, 0x9411
jbe 0x18000a224
mov dword [rbp + 0xc], edi
mov edi, dword [rbp - 0x7c]
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0xb0]
mov edx, dword [rbp + 8]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
mov byte [rsp + 0x50], 0
jmp case.0x180009f9c.14
lea r8, [rbp + 0x38]
lea rdx, [rbp + 4]
lea rcx, [rbp + 0x48]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov dword [rbp], eax
inc edi
mov dword [rbp - 0x7c], edi
lea ecx, [rdi + 0x79]
cmp ecx, 0x90
mov rbx, qword [rbp + 0x450]
mov r10d, 0
lea r11d, [r10 + 0x6f]
jb 0x180009f80
jmp 0x18000a385
cmp r9d, 0x88c
je 0x18000a318
cmp r9d, 0x92c
je case.0x180009f9c.22
jmp 0x18000a391
cmp byte [rsp + 0x46], 0
je 0x18000a365
mov ebx, 0x46
mov eax, ebx
sub eax, 0x45
je 0x18000a34a
cmp eax, 1
jne 0x18000a358
mov qword [rbp - 0x38], r10
lea r8, [rbp - 0x38]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov dword [rbp - 0x78], eax
mov rcx, qword [rbp + 0x40]
jmp 0x18000a34e
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18000a358
call sub.RPCRT4.dll_MesHandleFree
dec ebx
cmp ebx, 0x44
mov r10d, 0
ja 0x18000a324
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov byte [rsp + 0x50], 1
xor r10d, r10d
mov r8d, dword [rsp + 0x40]
mov r9d, dword [rbp + 0x440]
add r9d, 0xa0
mov dword [rbp + 0x440], r9d
cmp r9d, r8d
jae case.0x180009f9c.22
mov rdx, qword [rbp + 0x448]
mov rbx, qword [rbp + 0x450]
jmp 0x180009aa8
call fcn.18003f694
int3