Function at 0x7ff71cd91cc
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x7ff71cee2b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
mov eax, edx
mov rsi, r8
and eax, 0x400
mov r14d, edx
mov r12d, ecx
lea rdi, [rsp + 0x40]
mov r15, rbx
mov dword [rsp + 0x30], eax
je 0x7ff71cd9227
cmp dword [r8 + 0x14], ebx
jne 0x7ff71cd9227
mov eax, 0x11a
jmp 0x7ff71cd951b
cmp qword [r8 + 8], rbx
je 0x7ff71cd9516
cmp dword [r8 + 0x10], ebx
je 0x7ff71cd9516
cmp eax, ebx
je 0x7ff71cd924f
bt edx, 8
jae 0x7ff71cd924f
mov eax, 0x11c
jmp 0x7ff71cd951b
bt edx, 0xb
jae 0x7ff71cd92e2
cmp r12d, 0xffffffff
jne 0x7ff71cd9269
mov eax, 0x117
jmp 0x7ff71cd951b
lea rbp, [0x7ff71ceee40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp r12d, ebx
jbe 0x7ff71cd92cd
cmp r12d, dword [0x7ff71cf0984]
jae 0x7ff71cd92cd
mov rax, qword [0x7ff71cf0e38]
mov rdx, qword [rax + r12*8]
cmp rdx, rbx
je 0x7ff71cd92cd
mov r8, qword [rdx + 8]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, dword [rsi + 0x10]
jb 0x7ff71cd92b9
mov edi, 0x10c
jmp 0x7ff71cd92d2
mov edx, dword [rsi + 0x10]
mov rcx, qword [rsi + 8]
call fcn.7ff71cc4024
cmp eax, ebx
jl 0x7ff71cd92b2
mov edi, ebx
jmp 0x7ff71cd92d2
mov edi, 0x107
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
jmp 0x7ff71cd951b
bt edx, 9
jb 0x7ff71cd940e
cmp r12d, 0xffffffff
je 0x7ff71cd9302
cmp dword [r8 + 0x18], ebx
jne 0x7ff71cd9302
mov eax, 0x11f
jmp 0x7ff71cd951b
test edx, 0x500
jne 0x7ff71cd9314
mov eax, 0x111
jmp 0x7ff71cd951b
lea rax, str.system.ini
lea r9, [rsp + 0x40]
lea r8, [0x7ff71cf0e58]
mov qword [rsp + 0x28], rax
lea rcx, str.MCI32
xor edx, edx
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebp, ebx
and r14d, 0x100
mov eax, dword [rsp + 0x30]
cmp r14d, ebx
je 0x7ff71cd937d
cmp word [rdi], bx
je 0x7ff71cd93b5
cmp r12d, 0xffffffff
je 0x7ff71cd936d
mov rcx, rdi
call fcn.7ff71cd9024
cmp eax, dword [rsi + 0x18]
jne 0x7ff71cd936f
inc ebp
movzx eax, word [rdi]
add rdi, 2
cmp ax, bx
jne 0x7ff71cd936f
jmp 0x7ff71cd934c
cmp eax, ebx
je 0x7ff71cd9350
cmp ebp, dword [rsi + 0x14]
je 0x7ff71cd93d3
cmp word [rdi], bx
je 0x7ff71cd921d
mov r15, rdi
cmp r12d, 0xffffffff
je 0x7ff71cd93a5
mov rcx, rdi
call fcn.7ff71cd9024
cmp eax, dword [rsi + 0x18]
jne 0x7ff71cd93a7
inc ebp
movzx eax, word [rdi]
add rdi, 2
cmp ax, bx
jne 0x7ff71cd93a7
jmp 0x7ff71cd934c
mov rax, qword [rsi + 8]
cmp rax, rbx
je 0x7ff71cd9516
cmp dword [rsi + 0x10], 4
jb 0x7ff71cd9516
mov dword [rax], ebp
jmp 0x7ff71cd950f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, dword [rsi + 0x10]
jae 0x7ff71cd9516
mov edx, dword [rsi + 0x10]
mov rcx, qword [rsi + 8]
mov r8, r15
call fcn.7ff71cc4024
mov edi, 0x10c
cmp eax, ebx
cmovl ebx, edi
mov eax, ebx
jmp 0x7ff71cd951b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r15d, eax
cmp r12d, 0xffffffff
je 0x7ff71cd9426
cmp dword [rsi + 0x18], ebx
je 0x7ff71cd92f8
test r14d, 0x500
je 0x7ff71cd930a
lea rbp, [0x7ff71ceee40]
mov edi, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [0x7ff71cf0984]
mov edx, 1
cmp r9d, edx
jbe 0x7ff71cd949c
mov rcx, qword [0x7ff71cf0e38]
add rcx, 8
mov r8, qword [rcx]
cmp r8, rbx
je 0x7ff71cd9491
cmp r12d, 0xffffffff
jne 0x7ff71cd9475
cmp qword [r8 + 0x58], r15
je 0x7ff71cd9484
mov eax, dword [rsi + 0x18]
cmp dword [r8 + 0x38], eax
jne 0x7ff71cd9486
cmp qword [r8 + 0x58], r15
jne 0x7ff71cd9486
inc edi
cmp dword [rsp + 0x30], ebx
je 0x7ff71cd9491
cmp edi, dword [rsi + 0x14]
je 0x7ff71cd94be
inc edx
add rcx, 8
cmp edx, r9d
jb 0x7ff71cd9461
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rsp + 0x30], ebx
je 0x7ff71cd94f7
cmp qword [rsi + 8], rbx
je 0x7ff71cd921d
mov qword [rsi + 8], rbx
jmp 0x7ff71cd921d
mov rdi, qword [r8]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, dword [rsi + 0x10]
jae 0x7ff71cd92b2
mov edx, dword [rsi + 0x10]
mov r8, qword [r8]
mov rcx, qword [rsi + 8]
call fcn.7ff71cc4024
mov edi, 0x10c
cmp eax, ebx
cmovl ebx, edi
jmp 0x7ff71cd92c9
bt r14d, 8
jae 0x7ff71cd9516
mov rax, qword [rsi + 8]
cmp rax, rbx
je 0x7ff71cd9516
cmp dword [rsi + 0x10], 4
jb 0x7ff71cd9516
mov dword [rax], edi
mov eax, 0x80000
jmp 0x7ff71cd951b
mov eax, 0x10c
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.7ff71cc11f0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret