Function at 0x180035320
Capabilities:
Get file size
Move file
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1800737f8]
xor rax, rsp
mov qword [rbp + 0x18], rax
xor ebx, ebx
mov qword [rsp + 0x78], rdx
mov r11, rdx
mov qword [rsp + 0x60], r8
lea edx, [r9 + 0x19]
mov qword [rbp - 0x60], rcx
mov dword [rbp - 0x6c], r9d
mov r10, r8
mov dword [rsp + 0x50], edx
mov r8, rcx
lea edi, [rbx + 0x65]
mov r14d, r9d
lea rcx, [0x180000000]
mov r13d, r9d
cmp r9d, edx
jae 0x1800358a9
mov r15, qword [rsp + 0x78]
lea r12d, [r9 - 0x9f]
mov r9, qword [rsp + 0x78]
mov rdi, qword [rbp - 0x80]
mov rsi, qword [rbp - 0x80]
mov r14, qword [rbp - 0x80]
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r15
nop
cmp r12d, 0x7f
ja case.0x1800353d4.22
movzx eax, byte [rcx + r12 + 0x36104]
mov ecx, dword [rcx + rax*4 + 0x360a8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor edx, edx
mov ecx, 0xfe
call fcn.180021ae0
jmp 0x180035806
mov r8d, 2
lea rdx, [0x180066e84]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180035806
mov rsi, r11
mov r14, rbx
jmp case.0x1800353d4.22
test r10, r10
jne case.0x1800353d4.22
mov rax, rbx
jmp 0x180035b14
cmp byte [r11], bl
je 0x180035474
mov r15d, 0x3f
nop word [rax + rax]
cmp r15d, 0x3f
je 0x180035441
cmp r15d, 0x303c
je 0x180035417
jmp 0x18003545b
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, r10
lea ecx, [rdx + 0x2c]
call fcn.18002cce0
mov r10, qword [rsp + 0x60]
add r15d, 0x2ffd
cmp r15d, 0x5ffa
jbe 0x180035430
mov edx, dword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov qword [rsp + 0x68], r10
jmp case.0x1800353d4.22
mov rax, qword [r8]
cmp r14, rax
jae 0x1800354cd
nop word [rax + rax]
mov edx, 0xc5
mov ecx, edx
sub ecx, 0xc5
je 0x1800354a9
cmp ecx, 1
jne 0x1800354ba
inc r14
jmp 0x1800354ba
movzx ecx, byte [rsi]
cmp byte [rdi], cl
jne 0x180035842
inc rdi
inc rsi
inc edx
cmp edx, 0xc7
jb 0x180035495
cmp r14, rax
jb 0x180035490
mov edx, dword [rsp + 0x50]
mov qword [rsp + 0x68], rbx
jmp case.0x1800353d4.22
mov eax, 0x65
mov byte [rbp - 0x35], 0x64
mov word [rbp - 0x34], ax
jmp case.0x1800353d4.22
mov rax, qword [r10]
mov qword [rsp + 0x68], rax
jmp case.0x1800353d4.22
lea rax, [rbp - 0x78]
mov qword [rsp + 0x70], 2
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 2
call fcn.18005f180
mov ecx, 3
mov qword [rsp + 0x70], 3
lea rax, [rbp - 0x78]
mov rdx, r15
mov r8d, 0xbb
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
call fcn.18005f180
jmp 0x180035806
test r10, r10
je 0x180035559
test r11, r11
jne 0x180035575
mov eax, 0x11f
nop
cmp eax, 0x11f
je 0x18003584a
add eax, 0x78
cmp eax, 0x197
jb 0x180035560
mov rdi, r10
jmp case.0x1800353d4.22
mov eax, 0x20
lea rdx, [0x180066e90]
mov word [rbp - 0x33], ax
lea rcx, [rbp - 0x38]
mov eax, 0x6b
mov word [rbp - 0x32], ax
lea r8d, [rax - 0x66]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180035806
movzx eax, word [0x1800655e4]
mov word [rbp - 0x37], ax
movzx eax, byte [0x1800655e6]
mov byte [rbp - 0x35], al
jmp case.0x1800353d4.22
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], 4
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 4
call fcn.18005f180
mov r9, r15
mov qword [rsp + 0x48], 1
lea r8, [rsp + 0x48]
mov edx, 0xd7
lea rcx, [rbp - 0x78]
call fcn.18002fee0
mov r8, qword [rbp - 0x78]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rdx, r15
mov qword [rsp + 0x48], 2
mov ecx, 0x88
call fcn.180016bb0
mov r9, rax
mov qword [rsp + 0x48], rax
jmp 0x18003580b
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf1
call fcn.180021380
mov edx, dword [rsp + 0x50]
mov rcx, rax
mov r10, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
jmp 0x180035819
mov r8d, 2
lea rdx, [0x180066e98]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x72
mov word [rbp - 0x2a], ax
movzx eax, word [0x180066ea0]
mov word [rbp - 0x29], ax
movzx eax, byte [0x180066ea2]
mov byte [rbp - 0x27], al
jmp 0x180035806
cmp qword [r9 + 0x18], rbx
jne 0x18003585d
mov r9, qword [r9 + 0x20]
mov qword [rsp + 0x48], r9
test r9, r9
je 0x1800356cf
cmp qword [r9 + 8], 3
je case.0x1800353d4.22
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Extensions_Panel_Cogwheel_Button
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x8f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180044d60
xor r8d, r8d
xor ecx, ecx
lea edx, [r8 + 0x27]
call fcn.1800163d0
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov r8d, pe_nt_image_headers64
call fcn.180013b40
jmp 0x180035806
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov r8d, 0xc1
call fcn.18003ff30
jmp 0x180035806
cmp qword [r9 + 8], 2
jne 0x180035883
cmp qword [r9 + 0x10], rbx
je case.0x1800353d4.22
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Refresh_token_request_completed.
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp - 0x78], rbx
mov ecx, 1
mov qword [rsp + 0x70], 1
jmp 0x18003552e
mov r8, qword [r10 + 8]
test r8, r8
je case.0x1800353d4.22
mov r15, rbx
cmp qword [r10 + 0x20], rbx
jbe 0x1800357f4
nop dword [rax + rax]
mov r8, qword [r10 + 8]
mov rax, qword [r8 + r15*8]
test rax, rax
je 0x1800357eb
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, rax
lea ecx, [rdx + 0x2c]
call fcn.18002cce0
mov r10, qword [rsp + 0x60]
mov r8, qword [r10 + 8]
inc r15
cmp r15, qword [r10 + 0x20]
jb 0x1800357c0
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea ecx, [rdx + 0x2c]
call fcn.18002cce0
mov r9, qword [rsp + 0x48]
mov edx, dword [rsp + 0x50]
mov r10, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
inc r13d
inc r12d
cmp r13d, edx
jae 0x1800358bf
mov r8, qword [rbp - 0x60]
lea rcx, [0x180000000]
mov r11, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
jmp 0x1800353b0
sub rax, r14
jmp 0x180035b14
cmp r10, r11
je 0x180035417
mov eax, 1
jmp 0x180035b14
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__builtin_ia32_cvttpd2dq512_mask
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.LP_IDbkEvaluator::getLinkUnitIds
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x78]
mov r9, qword [rsp + 0x78]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r9
jmp 0x1800358c8
mov r14d, dword [rbp - 0x6c]
mov edi, 0x65
imul eax, r14d, 0x1db
mov esi, r14d
mov dword [rsp + 0x70], eax
cmp r14d, eax
ja case.0x1800353d4.3
mov r13, qword [rbp - 0x80]
mov edx, 0x74
mov r15, qword [rbp - 0x80]
mov r14d, dword [rsp + 0x70]
mov r12, qword [rbp - 0x80]
lea r8d, [rdx - 0xd]
nop dword [rax]
cmp esi, 0x3758
ja 0x180035cab
je 0x180035c71
cmp esi, 0x1c08
ja 0x180035bab
je 0x180035b7c
cmp esi, 0xe60
ja 0x1800359f1
je 0x1800359b7
mov eax, esi
sub eax, 0xb8
je 0x180035986
sub eax, 0x19
je 0x180035966
cmp eax, 0x19
jne 0x180035fc4
mov eax, dword [str.g_OK_]
mov dword [rbp - 0x27], eax
movzx eax, word [0x1800670c8]
mov word [rbp - 0x23], ax
jmp 0x180035fc4
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
lea edx, [r9 + 0x70]
call fcn.18003b1d0
jmp 0x180035fb1
cmp qword [r9 + 8], 3
je 0x180035fc4
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._Z23convert_ushort3_sat_rtzDv3_s
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x1800359cb
cmp qword [rax + 8], 2
je 0x180035fc4
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.ProcessInertiaInteractionContext
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp esi, 0x1054
je 0x180035b68
cmp esi, 0x1248
jne 0x180035fc4
cmp qword [r10 + 0x18], 8
mov rcx, r10
jb 0x180035a16
mov rcx, qword [r10]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180035fb1
mov edi, 0xa
nop
cmp edi, 0x1522
ja 0x180035ad4
je 0x180035acf
cmp edi, 0xa
je 0x180035ab3
cmp edi, 0x550
je 0x180035a98
cmp edi, 0xa96
je 0x180035a87
cmp edi, 0xfdc
jne 0x180035b51
mov dword [rbp - 0x15], 0x42383231
jmp 0x180035b51
mov eax, 0x5f76
mov byte [rbp - 0x15], bl
mov word [rbp - 0x17], ax
jmp 0x180035b51
mov eax, dword [0x18006708c]
mov dword [rbp - 0x1c], eax
movzx eax, byte [0x180067090]
mov byte [rbp - 0x18], al
mov byte [rbp - 0x17], bl
jmp 0x180035b51
mov r8d, 4
lea rdx, str.V6_vdmpyhsat_128B
lea rcx, [rbp - 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180035b51
mov byte [rbp - 0x11], bl
jmp 0x180035b51
cmp edi, 0x1a68
je 0x180035b4e
cmp edi, 0x1fae
je 0x180035b3b
cmp edi, 0x24f4
jne 0x180035b51
xor r9d, r9d
mov dword [rsp + 0x20], 2
xor r8d, r8d
lea rdx, str.r_separator_
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
mov byte [rsp + 0x68], bl
mov rax, qword [rsp + 0x68]
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1800604b0
mov rbx, qword [rsp + 0x160]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], ebx
mov rcx, r15
call sub.IMM32.dll_ImmGetCandidateListCountW
jmp 0x180035b51
mov r15, rbx
add edi, 0x546
cmp edi, 0x2a30
jbe 0x180035a50
jmp 0x180035fb1
xor edx, edx
xor ecx, ecx
mov r8d, 0x11e
call fcn.180021e20
jmp 0x180035fb1
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x180036009
cmp qword [rax + 8], 4
jne 0x180036009
cmp qword [r9 + 0x20], rbx
jne 0x180035fe3
mov r9, rax
mov qword [rsp + 0x48], rax
jmp 0x180035fc4
cmp esi, 0x1fd7
je 0x180035c3f
cmp esi, 0x23a6
je 0x180035c33
cmp esi, 0x29b0
je 0x180035c02
cmp esi, 0x2f5a
je 0x180035be7
cmp esi, 0x3504
jne 0x180035fc4
mov r12, rbx
mov qword [rbp - 0x58], rbx
jmp 0x180035fc4
xor edx, edx
lea ecx, [rdx + 0x4e]
call fcn.1800220a0
mov edx, 0x5c
xor ecx, ecx
call fcn.180053050
jmp 0x180035fb1
cmp qword [r9 + 8], 4
je 0x180035fc4
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.ULONG_IDirect3DDevice9::AddRef__
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp - 0x80], rbx
mov dword [rbp - 0x70], ebx
jmp 0x180035fc4
xor edx, edx
mov ecx, 0x82
call fcn.180050d10
xor r8d, r8d
xor edx, edx
mov ecx, 0x112
call fcn.1800225d0
mov r9d, 0xb8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180035320
jmp 0x180035fb1
cmp qword [r9 + 0x10], rbx
jne 0x18003602f
cmp qword [r9 + 0x18], rbx
je 0x180035fc4
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.REMOTE_GRACEFUL_SHUTDOWN_SUCCEED
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp esi, 0x691e
ja 0x180035e0e
je 0x180035dfd
cmp esi, 0x4e60
ja 0x180035dc0
je 0x180035da0
cmp esi, 0x3edd
je 0x180035d76
cmp esi, 0x4500
je 0x180035d3a
cmp esi, 0x4662
jne 0x180035fc4
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
mov edi, eax
mov edx, eax
mov dword [rbp - 0x64], edi
call fcn.18004ed30
mov rax, qword [rsp + 0x78]
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x180035d20
mov rdx, qword [rax]
lea r9, [rbp - 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x180035fb1
mov rax, qword [r9 + 0x20]
test rax, rax
je 0x180036055
cmp qword [rax + 8], 3
jne 0x180036055
mov r9d, 0xba
mov byte [rsp + 0x58], 1
lea r8, [rsp + 0x58]
xor edx, edx
call fcn.1800401b0
mov rcx, rax
mov qword [rsp + 0x40], rax
jmp 0x180035fb6
mov edx, 0x5c
xor ecx, ecx
call fcn.180040810
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8d, edi
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call fcn.180036a00
jmp 0x180035fb1
xor r8d, r8d
xor edx, edx
mov ecx, 0xdc
call fcn.18005c700
mov edx, 0x1d
xor ecx, ecx
call fcn.18004b1f0
jmp 0x180035fb1
cmp esi, 0x57c0
je 0x180035df5
cmp esi, 0x5de3
jne 0x180035fc4
mov r9d, 0x4e
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800503b0
xor edx, edx
lea ecx, [rdx + 0x6a]
call fcn.18001efc0
jmp 0x180035fb1
mov dword [rbp - 0x60], ebx
jmp 0x180035fc4
mov rcx, r13
mov dword [rbp - 0x68], ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180035fb1
cmp esi, 0x6d66
je 0x180035f95
cmp esi, 0x7a7c
je 0x180035e91
cmp esi, 0x7ce9
je 0x180036080
cmp esi, 0x8bda
je 0x180035ecf
cmp esi, 0x9d38
jne 0x180035fc4
mov edi, 0x46
nop dword [rax + rax]
cmp edi, 0x46
je 0x180035e72
cmp edi, 0x2990
je 0x180035e6b
cmp edi, 0x52da
je case.0x1800353d4.3
jmp 0x180035e7e
mov byte [rsp + 0x68], 1
jmp 0x180035e7e
lea rdx, [rbp - 0x68]
mov rcx, r12
call sub.IMM32.dll_ImmGetCandidateListCountW
add edi, 0x294a
cmp edi, 0x7bde
jbe 0x180035e50
mov edx, 0x74
mov eax, dword [rbp - 0x64]
mov r14d, 1
cmp eax, dword [rbp - 0x70]
je 0x180035f81
mov edi, 7
nop dword [rax + rax]
cmp edi, 7
ja case.default.0x180035ecd
lea r9, [0x180000000]
mov eax, edi
mov ecx, dword [r9 + rax*4 + 0x36184]
add rcx, r9
jmp rcx
mov rdx, qword [rbp - 0x58]
lea r9, [rbp - 0x48]
mov rcx, qword [rbp - 0x80]
xor r8d, r8d
mov dword [rsp + 0x20], r14d
call sub.ADVAPI32.dll_LsaRemoveAccountRights
jmp 0x180035fb1
mov dword [rbp + 0xc], 0x6e006f
mov word [rbp + 0x10], bx
jmp case.default.0x180035ecd
mov word [rbp - 0xc], dx
mov dword [rbp - 0xa], 0x4d005f
jmp case.default.0x180035ecd
mov dword [rbp - 0x10], 0x650067
jmp case.default.0x180035ecd
mov rcx, qword [rsp + 0x78]
mov rax, rcx
mov qword [rcx + 0x10], rbx
cmp qword [rcx + 0x18], 0x10
jb 0x180035f26
mov rax, qword [rcx]
mov byte [rax], bl
jmp case.default.0x180035ecd
mov dword [rbp + 2], 0x420065
mov dword [rbp + 6], 0x740075
mov word [rbp + 0xa], dx
jmp case.default.0x180035ecd
xor r9d, r9d
lea r8, [rbp - 0x10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
jmp case.default.0x180035ecd
mov dword [rbp - 6], 0x640069
mov dword [rbp - 2], 0x6c0064
dec edi
mov edx, 0x74
lea eax, [rdi + 0xec]
cmp eax, 0xeb
ja 0x180035eb0
mov r9d, dword [rbp - 0x60]
lea r8, [rbp - 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteA]
jmp 0x180035fb1
xor edx, edx
mov ecx, 0x123
call fcn.1800248e0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x26]
call fcn.180017730
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov edx, 0x74
lea r8d, [rdx - 0xd]
imul eax, dword [rbp - 0x6c], 0x13
add esi, eax
cmp esi, dword [rsp + 0x70]
ja case.0x1800353d4.3
mov r10, qword [rsp + 0x60]
mov edi, 0x65
jmp 0x180035900
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.IV__INTERLOCKEDCOMPAREEXCHANGE16
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.All_pending_breakpoints_cleared.
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Error_when_write_Display_device
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Check_failed:_wheel_scrolling_.
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x28], 0x71
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call fcn.180043e70
mov dword [rsp + 0x68], ebx
jmp case.0x1800353d4.3