Function at 0x180018468
Capabilities:
Get disk information
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x140
mov rbx, r8
mov r8, qword [rcx + 0x10]
xor ebp, ebp
mov rax, rdx
mov rdi, rcx
mov qword [rcx + 8], rdx
test r8, r8
je 0x1800184ac
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1800184ac
mov qword [rdi + 0x10], rbp
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.180031c3c
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x1800184da
lea rdx, str.Error_ExpandCSIDLandEnvironment____s_n
mov r8, rbx
mov ecx, 0xd9
call fcn.180030818
jmp 0x180018ce7
lea rdx, [0x18003a400]
mov r8, rax
mov ecx, 0xdc
call fcn.180030818
mov rcx, qword [rdi + 0x10]
mov esi, 0x2e
mov edx, esi
call qword [sym.imp.msvcrt.dll_wcsrchr]
lea r13d, [rsi - 0x28]
test rax, rax
je 0x180018599
mov rcx, qword [rdi + 0x10]
mov edx, esi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcslen]
lea r12, [0x18003c970]
mov rcx, r12
mov rbx, rax
call qword [sym.imp.msvcrt.dll_wcslen]
cmp rbx, rax
jb 0x18001859d
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, qword [rdi + 0x10]
mov edx, esi
mov rbx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov r8, rbx
lea rdx, [rax + 2]
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
je 0x180018599
lea rcx, [0x18003c978]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, qword [rdi + 0x10]
mov edx, esi
mov rbx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
lea rcx, [0x18003c978]
lea rdx, [rax + 2]
mov r8, rbx
call qword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jne 0x18001859d
mov dword [rdi + 0x18], r13d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, qword [rdi + 8]
mov r12d, 8
lea r8, [rax + rax + 2]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180018ce7
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
lea r8, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdx, str.desktop.ini
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x18001861e
lea rdx, str.iconcache.dat
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x1800186d5
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rbp
mov esi, 0x80
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1800186c9
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800186d5
lea rdx, str.WriteFile_desktop.ini_n
mov ecx, 0x100
call fcn.180030818
lea rcx, str._.ShellClassInfo__r_nUICLSID7BD29E00_76C1_11CF_9DD0_00A0C9034933_r_n
mov dword [rsp + 0x170], ebp
call qword [sym.imp.msvcrt.dll_strlen]
lea r9, [rsp + 0x170]
lea rdx, str._.ShellClassInfo__r_nUICLSID7BD29E00_76C1_11CF_9DD0_00A0C9034933_r_n
mov rcx, rsi
mov r8, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
jmp 0x1800186cf
mov dword [rdi + 0x18], esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, dword [rdi + 0x18]
lea rdx, str.dwStreamsFileAttribute__0x_08X_n
mov ecx, 0x10f
call fcn.180030818
mov rcx, qword [rdi + 0x80]
lea rbx, str._HeapFree__NULL_n
test rcx, rcx
je 0x180018744
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0x80]
test r8, r8
je 0x180018737
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180018744
mov qword [rdi + 0x80], rbp
jmp 0x180018744
mov rdx, rbx
mov ecx, 0x112
call fcn.180030818
mov rcx, qword [rdi + 8]
mov esi, 0x28
mov edx, r12d
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x80], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0x88]
test rcx, rcx
je 0x1800187b6
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0x88]
test r8, r8
je 0x1800187a9
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1800187b6
mov qword [rdi + 0x88], rbp
jmp 0x1800187b6
mov rdx, rbx
mov ecx, 0x116
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x88], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0x90]
test rcx, rcx
je 0x180018823
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0x90]
test r8, r8
je 0x180018816
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180018823
mov qword [rdi + 0x90], rbp
jmp 0x180018823
mov rdx, rbx
mov ecx, 0x11a
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x90], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0x98]
test rcx, rcx
je 0x180018890
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0x98]
test r8, r8
je 0x180018883
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180018890
mov qword [rdi + 0x98], rbp
jmp 0x180018890
mov rdx, rbx
mov ecx, 0x11e
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x98], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0xa0]
test rcx, rcx
je 0x1800188fd
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0xa0]
test r8, r8
je 0x1800188f0
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1800188fd
mov qword [rdi + 0xa0], rbp
jmp 0x1800188fd
mov rdx, rbx
mov ecx, 0x122
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0xa0], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0xb8]
test rcx, rcx
je 0x18001896a
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0xb8]
test r8, r8
je 0x18001895d
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x18001896a
mov qword [rdi + 0xb8], rbp
jmp 0x18001896a
mov rdx, rbx
mov ecx, 0x126
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0xb8], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x1800189d7
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0xa8]
test r8, r8
je 0x1800189ca
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1800189d7
mov qword [rdi + 0xa8], rbp
jmp 0x1800189d7
mov rdx, rbx
mov ecx, 0x12a
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0xa8], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0xb0]
test rcx, rcx
je 0x180018a44
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0xb0]
test r8, r8
je 0x180018a37
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180018a44
mov qword [rdi + 0xb0], rbp
jmp 0x180018a44
mov rdx, rbx
mov ecx, 0x12e
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0xb0], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0xc0]
test rcx, rcx
je 0x180018ab1
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0xc0]
test r8, r8
je 0x180018aa4
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180018ab1
mov qword [rdi + 0xc0], rbp
jmp 0x180018ab1
mov rdx, rbx
mov ecx, 0x132
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0xc0], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0xc8]
test rcx, rcx
je 0x180018b1e
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0xc8]
test r8, r8
je 0x180018b11
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180018b1e
mov qword [rdi + 0xc8], rbp
jmp 0x180018b1e
mov rdx, rbx
mov ecx, 0x136
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0xc8], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
je 0x180018b8b
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0xd0]
test r8, r8
je 0x180018b7e
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180018b8b
mov qword [rdi + 0xd0], rbp
jmp 0x180018b8b
mov rdx, rbx
mov ecx, 0x13a
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0xd0], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 0xd8]
test rcx, rcx
je 0x180018bf8
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rdi + 0xd8]
test r8, r8
je 0x180018beb
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x180018bf8
mov qword [rdi + 0xd8], rbp
jmp 0x180018bf8
mov rdx, rbx
mov ecx, 0x13e
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rsi
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0xd8], rax
test rax, rax
je 0x180018ce7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [rdi + 8]
mov r14d, 0x800
mov r8d, r14d
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180018ce7
mov rax, qword [rdi + 0x10]
mov esi, 0x400
lea r8, str._c:_
movzx r9d, word [rax]
mov edx, esi
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__snwprintf]
lea r13d, [rsi - 1]
cmp eax, r13d
ja 0x180018cd8
mov dword [rsp + 0x38], 0xff
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x178]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x180018cd8
lea r8, [rsp + 0x40]
lea rdx, str.Format___s_n
mov ecx, 0x158
call fcn.180030818
test dword [rsp + 0x178], 0x40000
jne 0x180018d05
lea rdx, str._NO_FILE_NAMED_STREAMS__n
mov ecx, 0x15b
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor al, al
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
lea rdx, str.FILE_NAMED_STREAMS_n
mov ecx, 0x15f
call fcn.180030818
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 8]
mov r8, r14
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180018ce7
mov r9, qword [rdi + 0x10]
lea rax, str.1DC12691_2B24_2265_435D_735D3B118A70
lea r12, str._s:_s
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180018cd8
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
mov r14d, 4
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x180018cd8
mov r9, qword [rdi + 0x10]
lea rax, str.6CEE6FE1_10A2_4C33_7E7F_855A51733C77
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180018df8
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x180018e16
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180018ce7
mov r9, qword [rdi + 0x10]
lea rax, str.31AC34A1_2DE2_36AC_1F6E_86F43772841F
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180018e69
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x180018e88
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.3CDC155D_398A_646E_1021_23047D9B4366
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180018edb
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x180018f07
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.81A03BF8_60AA_4A56_253C_449121D61CAF
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180018f5a
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x180018f90
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x58]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.28E74BDA_4327_31B0_17B9_56A66A818C1D
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180018fe3
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x180019023
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.8E9810C5_3014_4678_27EE_3B7A7AC346AF
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180019076
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x1800190c0
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x60]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.119D263D_68FC_1942_3CA3_46B23FA652A0
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180019113
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x180019167
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x50]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.629336E3_58D6_633B_5182_576588CF702A
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x1800191ba
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x20], rax
cmp rax, 0xffffffffffffffff
jne 0x180019218
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x28]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.56594FEA_5774_746D_4496_6361266C40D0
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x18001926b
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x1800192d3
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x20]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.4A3130BD_2608_730F_31A7_86D16CE66100
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x180019326
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x180019398
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x68]
jmp 0x180018e0b
mov r9, qword [rdi + 0x10]
lea rax, str.831511FA_190D_5D85_8A4A_279F2F592CC7
mov r8, r12
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snwprintf]
cmp eax, r13d
ja 0x1800194fa
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rdi + 8]
xor edx, edx
mov qword [rdi + 0x78], rax
mov r8, rbx
cmp rax, 0xffffffffffffffff
jne 0x18001946b
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x70]
jmp 0x180018e0b
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [rdi + 0x40]
lea r8, [rdi + 0xe0]
mov rcx, rdi
call fcn.180019508
test al, al
je 0x180018ce7
mov rdx, qword [rdi + 0x58]
lea r8, [rdi + 0xf8]
mov rcx, rdi
call fcn.180019508
test al, al
je 0x180018ce7
mov rdx, qword [rdi + 0x48]
lea r8, [rdi + 0x110]
mov rcx, rdi
call fcn.180019508
test al, al
je 0x180018ce7
mov rdx, qword [rdi + 0x50]
lea r8, [rdi + 0x128]
mov rcx, rdi
call fcn.180019508
test al, al
je 0x180018ce7
mov rdx, qword [rdi + 0x60]
lea r8, [rdi + 0x140]
mov rcx, rdi
call fcn.180019508
test al, al
setne al
jmp 0x180018ce9
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
jmp 0x1800193f8