Function at 0x1400253ac
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
xor r12d, r12d
mov rcx, r8
mov ebp, r12d
mov rdi, r8
mov r14d, 1
call fcn.140046e70
test eax, eax
je 0x14002572f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov ebx, 8
mov rcx, rax
mov edx, ebx
lea r8d, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14002542e
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x1400255cd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, 0x10000
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x140025418
lea r15, str.CompressionExclusionList
mov dword [rsi], 5
mov qword [rsi + 8], r15
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, 0x50
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [rsi + 0x10], rax
mov eax, r12d
mov dword [rsp + 0x24], eax
cmp dword [rsi], r12d
jbe 0x1400256fc
mov ecx, eax
mov r9, rdi
mov r13d, eax
mov r8d, 0x8000
mov ebx, r12d
mov rdx, rbp
shl r13, 4
mov rcx, qword [r15 + rcx*8]
add r13, qword [rsi + 0x10]
mov dword [rsp + 0x98], ebx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
nop dword [rax + rax]
mov dword [rsp + 0x20], eax
mov r15d, eax
mov rcx, rbp
mov r8d, eax
test eax, eax
je 0x140025528
or r9, 0xffffffffffffffff
cmp word [rcx], r12w
je 0x140025521
mov rdx, r9
inc rdx
cmp word [rcx + rdx*2], r12w
jne 0x1400254f2
or eax, 0xffffffff
sub eax, edx
add r8d, eax
mov rax, r9
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140025507
lea rcx, [rcx + rax*2]
add ebx, r14d
add rcx, 2
test r8d, r8d
jne 0x1400254e9
mov dword [rsp + 0x98], ebx
mov dword [r13], ebx
shl rbx, 3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [r13 + 8], rax
test rax, rax
je 0x140025418
xor edx, edx
mov rdi, rbp
test r15d, r15d
je 0x140025690
or r8, 0xffffffffffffffff
cmp word [rdi], dx
je 0x140025690
cmp r12d, dword [rsp + 0x98]
jae 0x1400255ca
cmp word [rdi], 0x5c
mov r15d, r12d
jne 0x1400255dd
mov rcx, qword [rsp + 0x80]
mov rdx, rdi
call fcn.140048584
mov rcx, rax
xor edx, edx
mov rax, qword [r13 + 8]
mov qword [rax + r15*8], rcx
mov rax, qword [r13 + 8]
cmp qword [rax + r15*8], rdx
jne 0x14002564e
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor r12d, r12d
mov rcx, rsi
call fcn.140025748
mov r14d, r12d
jmp 0x140025707
mov rbx, r8
inc rbx
cmp word [rdi + rbx*2], dx
jne 0x1400255e0
lea rbx, [rbx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [r13 + 8]
mov qword [rax + r15*8], rcx
mov rax, qword [r13 + 8]
mov rcx, qword [rax + r15*8]
xor eax, eax
test rcx, rcx
je 0x1400255b9
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], ax
jne 0x140025632
add rdx, r14
mov r8, rdi
call fcn.1400035ec
xor edx, edx
mov ebx, eax
test eax, eax
js 0x1400256b6
add r12d, r14d
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp word [rdi + rcx*2], dx
jne 0x140025658
mov r15d, dword [rsp + 0x20]
or eax, 0xffffffff
sub eax, ecx
add r15d, eax
mov rax, r8
mov dword [rsp + 0x20], r15d
inc rax
cmp word [rdi + rax*2], dx
jne 0x140025676
lea rdi, [rdi + rax*2]
add rdi, 2
test r15d, r15d
jne 0x140025572
mov eax, dword [rsp + 0x24]
add eax, r14d
mov dword [rsp + 0x24], eax
cmp eax, dword [rsi]
jae 0x1400256fc
mov rdi, qword [rsp + 0x90]
lea r15, str.CompressionExclusionList
xor r12d, r12d
jmp 0x1400254a1
mov ecx, ebx
bt ebx, 0x1c
jae 0x1400256e3
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, 0x13d
je 0x1400256f5
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x1400256f5
and ecx, 0x1fff0000
movzx eax, bx
cmp ecx, 0x70000
cmove ebx, eax
mov ecx, ebx
jmp 0x1400255be
mov rax, qword [rsp + 0x88]
mov qword [rax], rsi
test rbp, rbp
je 0x14002572c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, r14d
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret