Function at 0x18003f250
Capabilities:
Enumerate disk volumes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
movaps xmmword [rsp + 0x530], xmm6
mov rax, qword [0x1800bf580]
xor rax, rsp
mov qword [rbp + 0x420], rax
xor ebx, ebx
mov qword [rsp + 0x48], r9
lea r13d, [r8 + 0x1e0]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x38], ebx
mov eax, r8d
mov dword [rsp + 0x58], eax
mov rsi, rcx
mov dword [rsp + 0x50], eax
lea r11d, [rbx + 0x6b]
mov dword [rsp + 0x70], r13d
lea r10d, [rbx + 0x73]
lea r15, [0x180000000]
mov r14d, r8d
cmp r8d, r13d
jae 0x18003fc57
movzx eax, word [rsp + 0x34]
lea r8d, [rbx + 0x33]
mov edi, dword [rsp + 0x58]
mov edx, 0x5774
movzx r12d, word [rsp + 0x34]
mov r9d, 0x7365
movsd xmm6, qword [rsp + 0x60]
mov dword [rsp + 0x54], eax
nop word [rax + rax]
cmp r14d, 0x118
ja 0x18003f455
je 0x18003f446
lea eax, [r14 - 0xc]
cmp eax, 0xfc
ja case.0x18003f479.303
movzx eax, byte [r15 + rax + 0x3ffdc]
mov ecx, dword [r15 + rax*4 + 0x3ffac]
add rcx, r15
jmp rcx
mov dword [rbp + 0x1ac], 0x33
jmp case.0x18003f479.303
mov word [rbp + 0x18c], dx
mov byte [rbp + 0x18e], bl
jmp case.0x18003f479.303
mov r8d, 5
mov dword [rbp + 0x1a0], 0x6b
lea rdx, [0x18009bb2c]
lea rcx, [rbp + 0x1a2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + 0x1ac], bx
mov r8d, 0x33
mov edx, 0x5774
mov r9d, 0x7365
lea r10d, [r8 + 0x40]
lea r11d, [r8 + 0x38]
jmp case.0x18003f479.303
mov byte [rbp + 0x18c], bl
jmp case.0x18003f479.303
movzx eax, word [0x18009bbee]
mov word [rbp + 0x180], ax
movzx eax, byte [0x18009bbf0]
mov byte [rbp + 0x182], al
jmp case.0x18003f479.303
mov dword [rbp + 0x183], 0x73736563
mov dword [rbp + 0x187], 0x654e3233
jmp case.0x18003f479.303
cmp byte [0x1800bf730], bl
je 0x18003f410
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x78]
xorps xmm6, xmm6
sub rax, qword [0x1800bf748]
cvtsi2sd xmm6, rax
jmp 0x18003f384
call qword [0x1800bf770]
sub eax, dword [0x1800bf740]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
jmp 0x18003f384
cmp byte [0x1800bf659], bl
je 0x18003fb7b
mov rax, qword [rsi + 0x278]
mov qword [rsp + 0x40], rax
jmp case.0x18003f479.303
mov dword [rbp + 0x1ae], 0x2e0032
jmp case.0x18003f479.303
lea eax, [r14 - 0x127]
cmp eax, 0x60
ja case.0x18003f479.303
movzx eax, byte [r15 + rax + 0x40100]
mov ecx, dword [r15 + rax*4 + 0x400dc]
add rcx, r15
jmp rcx
mov eax, 0x5a
cmp eax, 0x5a
je 0x18003fb9c
add eax, 0xa32
cmp eax, 0xa32
jbe 0x18003f480
mov byte [rbp + 0x18b], 0x78
jmp case.0x18003f479.303
mov dword [rsp + 0x7c], 2
mov byte [rsp + 0x30], 1
jmp case.0x18003f479.303
mov dword [rsp + 0x78], 3
mov qword [rbp - 0x80], 0xffffffffffffffff
jmp case.0x18003f479.303
mov eax, dword [0x18009bbbc]
mov dword [rbp + 0x1b2], eax
movzx eax, word [0x18009bbc0]
mov word [rbp + 0x1b6], ax
mov word [rbp + 0x1b8], bx
mov dword [rbp + 0x190], 0x636f7250
jmp case.0x18003f479.303
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r8d, 0x33
mov dword [rsp + 0x74], ebx
mov qword [rbp - 0x80], rax
mov edx, 0x5774
mov r9d, 0x7365
lea r10d, [r8 + 0x40]
lea r11d, [r8 + 0x38]
cmp rax, 0xffffffffffffffff
jne case.0x18003f479.303
mov byte [rsp + 0x30], bl
jmp case.0x18003f479.303
xor edx, edx
lea rcx, [rbp + 0x310]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x200]
mov edx, 2
lea rax, [rbp + 0x310]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18003f570
cmp qword [rsi + 0x10], 0x35
mov eax, dword [rax]
mov dword [rcx], eax
jb 0x18003f794
mov r13d, ebx
nop word [rax + rax]
cmp r13d, 0xd8
ja case.0x18003f604.10
mov eax, r13d
movzx eax, byte [r15 + rax + 0x40190]
mov ecx, dword [r15 + rax*4 + 0x40164]
add rcx, r15
jmp rcx
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov rcx, qword [rsi + 0x10]
mov word [rsp + 0x34], ax
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], bl
cmp rcx, 0x11
jb 0x18003ffa3
add rcx, 0xffffffffffffffef
mov r14d, 0x24
cmp rcx, r14
cmovb r14, rcx
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x18003f64f
mov rcx, qword [rsi]
lea r15, [rcx + 0x11]
cmp r14, 0xf
ja 0x18003f676
mov r8, r14
mov qword [rbp - 0x60], r14
mov rdx, r15
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x70], bl
jmp 0x18003f715
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x18003ff97
mov rsi, r14
or rsi, 0xf
cmp rsi, rax
jbe 0x18003f69a
mov rsi, rax
jmp 0x18003f6a7
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18003f6e0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003ff9d
mov rcx, rax
call fcn.1800930c8
test rax, rax
je 0x18003fc22
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18003f6f2
test rcx, rcx
je 0x18003f6ef
call fcn.1800930c8
mov rdi, rax
jmp 0x18003f6f2
mov rdi, rbx
mov r8, r14
mov qword [rbp - 0x60], r14
mov rdx, r15
mov qword [rbp - 0x58], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rsp + 0x68]
mov byte [rdi + r14], bl
mov qword [rbp - 0x70], rdi
mov edi, dword [rsp + 0x38]
lea rdx, [rbp - 0x70]
or edi, 1
lea rcx, [0x1800bf4b8]
mov dword [rsp + 0x38], edi
call fcn.180003be0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18003f76b
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f766
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fc22
call fcn.180093104
mov qword [rsp + 0x60], rbx
lea r15, [0x180000000]
add r13d, 0x18
lea eax, [r13 + 0xc]
cmp eax, 0xfc
jb 0x18003f5e0
mov r14d, dword [rsp + 0x50]
mov r13d, dword [rsp + 0x70]
mov edi, 0x190
jmp 0x18003f384
mov eax, 0x6f
mov word [rbp + 0x152], ax
mov eax, 0x61
mov word [rbp + 0x153], ax
mov eax, 0x67
mov dword [rbp + 0x154], 0x6e6964
mov word [rbp + 0x157], ax
jmp case.0x18003f604.10
mov eax, 0x63
mov dword [rbp + 0x14e], 0x207373
mov word [rbp + 0x14b], ax
mov eax, 0x616c
mov word [rbp + 0x14c], ax
mov eax, 0x6c
mov word [rbp + 0x151], ax
jmp case.0x18003f604.10
mov eax, 0x75
mov word [rbp + 0x144], ax
jmp case.0x18003f604.10
mov eax, 0x2074
mov word [rbp + 0x149], ax
jmp case.0x18003f604.10
mov eax, 0x636e
mov word [rbp + 0x142], ax
jmp case.0x18003f604.10
mov eax, 0x63
mov word [rbp + 0x140], ax
mov eax, 0x6f
mov word [rbp + 0x141], ax
jmp case.0x18003f604.10
mov r14d, 0xb
mov dword [rsp + 0x54], 0x3039
cmp qword [rsi + 0x10], r14
mov r15, rsi
mov qword [rbp - 0x58], 0xf
cmovb r14, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov byte [rbp - 0x70], bl
jb 0x18003f880
mov r15, qword [rsi]
cmp r14, 0xf
ja 0x18003f8a3
mov r8, r14
mov qword [rbp - 0x60], r14
mov rdx, r15
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x70], bl
jmp 0x18003f942
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x18003ff97
mov rsi, r14
or rsi, 0xf
cmp rsi, rax
jbe 0x18003f8c7
mov rsi, rax
jmp 0x18003f8d4
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18003f90d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003ff9d
mov rcx, rax
call fcn.1800930c8
test rax, rax
je 0x18003fc22
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18003f91f
test rcx, rcx
je 0x18003f91c
call fcn.1800930c8
mov rdi, rax
jmp 0x18003f91f
mov rdi, rbx
mov r8, r14
mov qword [rbp - 0x60], r14
mov rdx, r15
mov qword [rbp - 0x58], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rsp + 0x68]
mov byte [rdi + r14], bl
mov qword [rbp - 0x70], rdi
mov edi, dword [rsp + 0x38]
lea rdx, [rbp - 0x70]
or edi, 2
lea rcx, [0x1800bf4d8]
mov dword [rsp + 0x38], edi
call fcn.180003be0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18003f998
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f993
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fc22
call fcn.180093104
mov rax, qword [rsi + 0x10]
mov r12d, 0xd431
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], bl
cmp rax, 0xb
jb 0x18003ffa3
add rax, 0xfffffffffffffff5
mov r14d, 6
cmp rax, r14
cmovb r14, rax
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x18003f9d5
mov rax, qword [rsi]
lea r15, [rax + 0xb]
cmp r14, 0xf
ja 0x18003f9fc
mov r8, r14
mov qword [rbp - 0x60], r14
mov rdx, r15
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x70], bl
jmp 0x18003fa9f
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x18003ff97
mov rsi, r14
or rsi, 0xf
cmp rsi, rax
jbe 0x18003fa20
mov rsi, rax
jmp 0x18003fa2d
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18003fa66
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18003ff9d
mov rcx, rax
call fcn.1800930c8
test rax, rax
je 0x18003fc22
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18003fa78
test rcx, rcx
je 0x18003fa75
call fcn.1800930c8
mov rdi, rax
jmp 0x18003fa78
mov rdi, rbx
mov r8, r14
mov qword [rbp - 0x60], r14
mov rdx, r15
mov qword [rbp - 0x58], rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rsp + 0x68]
mov byte [rdi + r14], bl
mov qword [rbp - 0x70], rdi
mov edi, dword [rsp + 0x38]
or edi, 4
lea rdx, [rbp - 0x70]
lea rcx, [0x1800bf4f8]
mov dword [rsp + 0x38], edi
call fcn.180003be0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18003f770
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003faf0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003fc22
call fcn.180093104
jmp 0x18003f770
mov eax, 0x72
mov word [rbp + 0x145], ax
mov word [rbp + 0x146], ax
mov eax, 0x65
mov word [rbp + 0x147], ax
mov eax, 0x6e
mov word [rbp + 0x148], ax
jmp case.0x18003f604.10
mov dword [rbp + 0x194], 0x737365
mov word [rbp + 0x197], r8w
jmp case.0x18003f479.303
mov word [rbp + 0x19c], r10w
mov word [rbp + 0x19d], dx
mov dword [rbp + 0x198], 0x72694632
mov byte [rbp + 0x19f], bl
add r14d, 0x18
mov dword [rsp + 0x50], r14d
cmp r14d, r13d
jae 0x18003fc4e
lea r15, [0x180000000]
jmp 0x18003f300
xor edx, edx
mov ecx, 0x10001
call fcn.18003cff0
mov rax, rbx
jmp 0x18003fbf0
mulsd xmm6, qword [0x1800bf738]
movsd qword [rsp + 0x40], xmm6
jmp case.0x18003fcb1.18
mov edx, dword [rsp + 0x78]
lea rax, [rsp + 0x74]
mov ecx, dword [rsp + 0x7c]
lea r9, [rbp - 0x50]
mov qword [rsp + 0x28], rbx
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_SaferGetPolicyInformation]
cmp byte [rsp + 0x30], bl
je 0x18003fbe7
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp + 0x200]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_FindNextVolumeA]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov byte [rsp + 0x40], bl
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.1800938b0
mov rbx, qword [rsp + 0x588]
movaps xmm6, xmmword [rsp + 0x530]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, dword [rsp + 0x54]
lea r8, [rsp + 0x60]
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
movzx ecx, word [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov byte [rsp + 0x40], 1
jmp case.0x18003fcb1.18
mov eax, dword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
lea esi, [rax + 0x13]
cmp eax, esi
jae case.0x18003fcb1.18
mov r14, qword [rsp + 0x60]
lea edi, [rax - 0x70]
mov r12, qword [rsp + 0x60]
mov edx, 0x74
mov r15, qword [rsp + 0x60]
mov r10d, 0x6c65
mov r13, qword [rsp + 0x68]
lea r11d, [rdx - 0x42]
lea r8d, [rdx - 0xc]
nop dword [rax + rax]
cmp edi, 0x12
ja case.default.0x18003fcb1
lea rcx, [0x180000000]
mov ecx, dword [rcx + rdi*4 + 0x4026c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, 0x70
mov dword [rbp + 0x170], 0x616e53
mov word [rbp + 0x173], ax
mov eax, 0x73
mov word [rbp + 0x174], ax
jmp case.default.0x18003fcb1
mov word [rbp + 0x164], dx
jmp case.default.0x18003fcb1
lea rax, [rbp + 0x180]
mov dword [rsp + 0x28], 0x96
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call fcn.1800295d0
mov r14, rax
mov dword [rsp + 0x28], 0x96
lea rax, [rbp + 0x190]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x1e0]
xor ecx, ecx
call fcn.1800295d0
mov r12, rax
mov dword [rsp + 0x28], 0x96
lea rax, [rbp + 0x160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x1c0]
xor ecx, ecx
call fcn.1800295d0
mov r8, qword [rsp + 0x48]
mov r9d, 0x11a
xor edx, edx
mov qword [rsp + 0x28], rbx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov r15, rax
call fcn.180018cc0
jmp 0x18003ff6c
mov dword [rbp + 0x1c6], 0x65006e
mov dword [rbp + 0x1ca], 0x33006c
jmp case.default.0x18003fcb1
mov r8d, 1
mov word [rbp + 0x1f6], bx
lea rdx, [0x18009bc46]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov dword [rbp + 0x160], 0x61657243
jmp 0x18003ff6c
mov rax, qword [r13 + 0x260]
cmp rax, 0xffffffffffffffff
jne 0x18003fdf9
xor edx, edx
lea ecx, [rax + 3]
call r15
mov qword [r13 + 0x260], rax
cmp rax, 0xffffffffffffffff
je 0x18003fbe7
lea rdx, [r13 + 0x28]
mov rcx, rax
cmp byte [r13 + 0x284], bl
je 0x18003fe15
mov byte [r13 + 0x284], bl
call r12
jmp 0x18003fe18
call r14
test eax, eax
je 0x18003fbe7
mov r9, qword [rsp + 0x48]
lea rax, [r13 + 0x54]
mov qword [r9], rax
jmp 0x18003ff71
mov eax, 0x64
mov dword [rbp + 0x1ce], 0x2e0032
mov word [rbp + 0x1d2], ax
mov dword [rbp + 0x1d4], 0x6c006c
jmp case.default.0x18003fcb1
mov eax, 0x6c
mov dword [rbp + 0x165], 0x6f6f5465
mov word [rbp + 0x169], ax
mov word [rbp + 0x16a], r8w
jmp case.default.0x18003fcb1
mov word [rbp + 0x1e2], bx
jmp case.default.0x18003fcb1
mov dword [rbp + 0x1c2], 0x720065
jmp case.default.0x18003fcb1
mov eax, 0x6b
mov word [rbp + 0x1e0], ax
jmp case.default.0x18003fcb1
mov eax, dword [r13 + 0x30]
mov dword [r9 + 0x18], eax
mov eax, dword [r13 + 0x48]
mov dword [r9 + 0x1c], eax
mov eax, dword [r13 + 0x44]
mov dword [r9 + 0x20], eax
jmp case.default.0x18003fcb1
mov eax, 0x6f
mov word [rbp + 0x175], r8w
mov word [rbp + 0x176], ax
mov eax, 0x6b
mov word [rbp + 0x1c0], ax
mov word [rbp + 0x177], dx
jmp case.default.0x18003fcb1
mov word [rbp + 0x16b], r10w
mov dword [rbp + 0x16d], 0x323370
jmp case.default.0x18003fcb1
mov byte [rsp + 0x40], 1
jmp case.default.0x18003fcb1
mov word [rbp + 0x1d8], bx
jmp case.default.0x18003fcb1
mov eax, dword [0x18009bc7e]
mov dword [rbp + 0x1e2], eax
movzx eax, word [0x18009bc82]
mov word [rbp + 0x1e6], ax
mov eax, dword [0x18009bd0c]
mov dword [rbp + 0x1e8], eax
movzx eax, word [0x18009bd10]
mov word [rbp + 0x1ec], ax
mov word [rbp + 0x1ee], bx
jmp case.default.0x18003fcb1
mov r8d, 4
lea rdx, [0x18009bd38]
lea rcx, [rbp + 0x1ee]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r9, qword [rsp + 0x48]
mov r11d, 0x32
mov r10d, 0x6c65
lea r8d, [r11 + 0x36]
lea edx, [r11 + 0x42]
inc edi
lea eax, [rdi + 0x70]
cmp eax, esi
jb 0x18003fc90
jmp case.0x18003fcb1.18
call fcn.18003a870
int3
call fcn.18003a730
int3
call fcn.18003a8b0
int3