Function at 0x180069440
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov eax, r8d
mov qword [rbp - 0x68], rdx
lea ebx, [r8 + 0xb]
mov dword [rbp - 0x80], eax
mov r13d, r8d
mov qword [rbp - 0x70], rcx
xor r8d, r8d
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x44], ebx
mov r10, rcx
cmp eax, ebx
jae 0x180069e0f
mov r8, qword [rsp + 0x68]
lea edi, [rax - 0x9c]
movzx eax, byte [rsp + 0x42]
movzx ecx, byte [rsp + 0x42]
mov ebx, dword [rsp + 0x48]
movzx esi, byte [rsp + 0x42]
mov r15d, dword [rsp + 0x48]
movzx r14d, byte [rsp + 0x42]
mov r12d, dword [rsp + 0x48]
mov byte [rsp + 0x41], al
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x78], r8
mov byte [rsp + 0x40], cl
mov qword [rsp + 0x70], rbx
lea r11, [0x180000000]
mov r9d, 0x64
cmp edi, 0x14
ja case.default.0x180069504
mov ecx, dword [r11 + rdi*4 + 0x6a42c]
add rcx, r11
jmp rcx
mov rax, qword [rdx]
mov rcx, qword [rax + 0x20]
test byte [rcx + 0x64], 1
je 0x180069b25
mov eax, dword [r10]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x50], eax
xor edx, edx
mov dword [rsp + 0x58], 3
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], pe_nt_image_headers64
call fcn.1800b5810
test eax, eax
jne 0x180069b25
mov rax, qword [rbp - 0x70]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x58], 5
xor edx, edx
mov dword [rsp + 0x20], pe_nt_image_headers64
lea rcx, [rsp + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
call fcn.1800b5810
test eax, eax
jne 0x180069b25
mov rax, qword [rbp - 0x70]
lea r9, [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x58], 7
xor edx, edx
mov dword [rsp + 0x20], pe_nt_image_headers64
lea rcx, [rsp + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
call fcn.1800b5810
test eax, eax
jne 0x180069b25
mov rdx, qword [rbp - 0x68]
mov r10, qword [rbp - 0x70]
mov r8, qword [rsp + 0x78]
mov dword [rsp + 0x64], eax
jmp case.0x180069504.2
mov eax, 0x7961
mov word [rbp + 0x129], ax
jmp case.0x180069504.2
mov eax, 0x6e61
mov dword [rbp + 0x116], 0x6c5f6465
mov word [rbp + 0x11a], ax
jmp case.0x180069504.2
cmp qword [rdx + 0x18], 8
mov rcx, rdx
jb 0x180069605
mov rcx, qword [rdx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rbp - 0x68]
mov r9b, 1
mov r10, qword [rbp - 0x70]
mov r8, rax
mov qword [rsp + 0x78], rax
movzx r11d, r9b
mov eax, dword [rsp + 0x44]
mov byte [rsp + 0x41], r9b
mov byte [rsp + 0x40], r9b
jmp 0x180069a68
mov dword [rbp + 0x12b], 0x646564
mov dword [rbp + 0x12e], 0x6d6c69
jmp case.0x180069504.2
mov eax, 0x7567
mov word [rbp + 0x11c], ax
jmp case.0x180069504.2
mov eax, 0x61
mov word [rbp + 0x11e], ax
mov eax, 0x4b
mov word [rbp + 0x128], ax
mov dword [rbp + 0x11f], 0x736567
jmp case.0x180069504.2
cmp r8, 0xffffffffffffffff
jne case.0x180069504.2
xor r8d, r8d
mov edi, r8d
mov dword [rbp - 0x5c], r8d
nop
cmp edi, 9
ja case.default.0x1800696d2
mov eax, edi
mov ecx, dword [r11 + rax*4 + 0x6a480]
add rcx, r11
jmp rcx
mov r8d, 2
lea rdx, [0x1800cca31]
lea rcx, [rbp + 0xdf]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0xe1], 0x65
xor r8d, r8d
lea r11, [0x180000000]
inc edi
mov dword [rbp - 0x5c], edi
lea eax, [rdi + 0xc7]
cmp eax, 0xd1
jb 0x1800696c0
mov edi, dword [rsp + 0x58]
mov r13d, dword [rsp + 0x50]
mov rdx, qword [rbp - 0x68]
mov r10, qword [rbp - 0x70]
mov r8, qword [rsp + 0x78]
jmp case.0x180069504.2
mov byte [rbp + 0xe2], 0
jmp case.default.0x1800696d2
mov r8d, 4
lea rdx, [0x1800cca53]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 4
mov byte [rbp + 0xd4], 0
lea rdx, [0x1800cca79]
lea rcx, [rbp + 0xd4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0xd8], 0
jmp 0x1800696f5
lea rax, [rbp + 0xd0]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180069790
mov qword [rsp + 0x70], rbx
call qword [sym.imp.WINMM.dll_mixerGetNumDevs]
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test eax, eax
jne 0x1800696f8
mov byte [rsp + 0x43], al
jmp 0x1800696f8
mov r8d, 2
mov byte [rbp + 0xdb], 0
lea rdx, [0x1800ccabd]
lea rcx, [rbp + 0xdb]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0xdd], 0
jmp 0x1800696f5
mov byte [rsp + 0x42], 1
mov byte [rsp + 0x43], 1
jmp case.default.0x1800696d2
movzx eax, word [0x1800cce17]
mov word [rbp + 0xd8], ax
movzx eax, byte [0x1800cce19]
mov byte [rbp + 0xda], al
jmp case.default.0x1800696d2
mov eax, 0x6365
mov byte [rbp + 0xdf], 0
mov word [rbp + 0xdd], ax
jmp case.default.0x1800696d2
mov qword [rbp - 0x30], r8
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x40]
mov edx, ebx
lea rcx, [rbp + 0xd0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
movzx edx, byte [rsp + 0x43]
mov dword [rsp + 0x60], eax
test dl, dl
je 0x1800696f5
mov r13d, 0xe9
mov ecx, r13d
sub ecx, 0xe9
je 0x180069a16
sub ecx, 0x56
je 0x180069997
cmp ecx, 0x56
jne 0x180069976
test dl, dl
je 0x180069976
mov edi, 0x33
nop
mov eax, edi
sub eax, 0x2f
je 0x180069956
sub eax, 1
je 0x1800698f7
sub eax, 1
je 0x1800698c9
sub eax, 1
je 0x1800698bc
cmp eax, 1
jne 0x180069966
movzx r14d, al
jmp 0x180069966
mov qword [rbp - 0x50], 0
jmp 0x180069966
xorps xmm0, xmm0
lea r9, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r12d, 0x30
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
test eax, eax
je 0x180069966
xor r14b, r14b
jmp 0x180069966
test r14b, r14b
je 0x180069966
mov ebx, 0xc7
mov eax, ebx
sub eax, 0xc7
je 0x180069941
sub eax, 0x5d
je 0x180069924
cmp eax, 0x5d
jne 0x180069949
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x180069949
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180069949
lea r8, [rbp - 0x78]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x180069949
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180069949
mov qword [rbp - 0x78], 0
add ebx, 0x5d
cmp ebx, 0x1de
jb 0x180069901
jmp 0x180069966
mov ecx, dword [rbp - 0x60]
lea rdx, [rbp - 0x18]
mov r8d, r12d
call qword [sym.imp.WINMM.dll_mixerGetDevCapsA]
dec edi
cmp edi, 0x2e
ja 0x180069890
movzx edx, byte [rsp + 0x43]
xor r8d, r8d
add r13d, 0x56
cmp r13d, 0x1eb
jb 0x180069861
mov rbx, qword [rsp + 0x70]
mov edi, dword [rbp - 0x5c]
jmp 0x1800696f8
mov r8d, dword [rbp - 0x48]
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WINMM.dll_mixerGetID]
test eax, eax
je 0x180069971
mov ebx, 0x10d
cmp ebx, 0x10d
je 0x1800699f5
cmp ebx, 0x1b2
je 0x1800699d3
cmp ebx, 0x257
jne 0x1800699fe
xor dl, dl
mov byte [rsp + 0x43], dl
jmp 0x180069a03
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
test eax, eax
je 0x1800699e5
xor sil, sil
jmp 0x1800699fe
test sil, sil
je 0x1800699fe
mov ecx, r15d
call qword [sym.imp.WINMM.dll_timeEndPeriod]
jmp 0x1800699fe
mov sil, 1
mov r15d, 0x64
movzx edx, byte [rsp + 0x43]
add ebx, 0xa5
cmp ebx, 0x2fc
jb 0x1800699b3
jmp 0x180069976
xor r8d, r8d
mov dword [rbp - 0x48], 0x80000000
mov qword [rsp + 0x68], r8
mov dword [rbp - 0x60], r8d
jmp 0x180069979
mov dword [rbp + 0x131], 0x696d65
jmp case.0x180069504.2
mov eax, 0x74
mov word [rbp + 0x110], r9w
mov word [rbp + 0x115], ax
mov dword [rbp + 0x111], 0x63657465
mov eax, dword [rsp + 0x44]
movzx r11d, byte [rsp + 0x40]
movzx r9d, byte [rsp + 0x41]
inc r13d
inc edi
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x58], edi
cmp r13d, eax
jb 0x1800694e3
mov eax, dword [rbp - 0x80]
xor r8d, r8d
mov rdi, qword [rsp + 0x78]
lea r13d, [rax + 0x5dc]
cmp eax, r13d
jae case.0x180069504.1
mov ebx, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x48]
mov r14d, dword [rsp + 0x48]
mov esi, dword [rsp + 0x48]
mov r12d, dword [rsp + 0x48]
mov qword [rsp + 0x70], rbx
movabs rcx, 0x63006e0065
mov edx, 0x65
cmp eax, 0x396
ja 0x180069f4e
je 0x180069f0b
cmp eax, 0x21f
ja 0x180069e60
je 0x180069e4d
sub eax, 0xa8
je 0x180069e3d
sub eax, 0x7d
je 0x180069e34
cmp eax, 0x7d
jne 0x18006a359
lea rax, [rbp + 0x110]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180069b12
mov qword [rsp + 0x70], rbx
jmp 0x18006a359
mov eax, 1
jmp 0x18006a3de
cmp dword [rsp + 0x60], 0
movzx r14d, byte [rsp + 0x42]
je 0x180069bc7
movzx esi, byte [rsp + 0x42]
mov ebx, r8d
mov edi, 6
nop dword [rax]
cmp ebx, 5
ja case.default.0x180069b62
mov eax, ebx
mov ecx, dword [r11 + rax*4 + 0x6a4a8]
add rcx, r11
jmp rcx
mov dword [rbp + 0x106], 0x3e0065
jmp case.default.0x180069b62
movsd xmm0, qword [0x1800ccace]
lea rdx, [0x1800ccb0e]
movzx eax, word [0x1800ccad6]
lea rcx, [rbp + 0xfc]
mov word [rbp + 0xfc], r8w
mov r8d, 5
movsd qword [rbp + 0xf2], xmm0
mov word [rbp + 0xfa], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor r8d, r8d
inc ebx
lea r11, [0x180000000]
sub rdi, 1
jne 0x180069b50
mov rbx, qword [rsp + 0x70]
test r14b, r14b
je 0x180069e05
movzx r15d, byte [rsp + 0x42]
lea r12, str.Ouguiya_na_Marat
movzx esi, byte [rsp + 0x42]
mov r14d, 0xb2
mov edi, dword [rsp + 0x48]
nop dword [rax]
mov eax, r14d
sub eax, 0xae
je 0x180069d7e
sub eax, 1
je 0x180069d3a
sub eax, 1
je 0x180069d1c
sub eax, 1
je 0x180069cf8
cmp eax, 1
jne 0x180069df0
movzx r15d, al
mov qword [rsp + 0x78], r8
movzx esi, al
mov qword [rsp + 0x68], r12
jmp 0x180069df0
mov word [rbp + 0x10a], r8w
mov sil, 1
mov qword [rbp - 0x78], r8
jmp case.default.0x180069b62
test sil, sil
je 0x180069c5f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r8d, r8d
xor r14b, r14b
jmp case.default.0x180069b62
xor r9d, r9d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0xe8]
mov qword [rsp + 0x30], r8
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea edx, [r9 + 1]
lea r8d, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
je 0x180069bb0
xor sil, sil
jmp 0x180069bb0
mov word [rbp + 0xe8], r8w
lea rdx, [0x1800ccb58]
mov r8d, 2
lea rcx, [rbp + 0xe8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, dword [0x1800ccb78]
xor r8d, r8d
mov dword [rbp + 0xec], eax
movzx eax, word [0x1800ccb7c]
mov word [rbp + 0xf0], ax
mov word [rbp + 0xf2], r8w
jmp case.default.0x180069b62
mov qword [rbp - 0x50], r8
lea rcx, [rbp + 0xd0]
lea r8, [rsp + 0x78]
mov edx, ebx
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
xor r8d, r8d
mov dword [rsp + 0x60], r8d
jmp 0x180069df0
lea r9, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
xor r8d, r8d
mov edi, eax
mov qword [rbp - 0x68], r8
jmp 0x180069df0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x180069d48
call sub.RPCRT4.dll_MesHandleFree
xor eax, eax
lea r8, [rbp - 0x68]
mov ecx, eax
lea rdx, [rsp + 0x60]
movzx eax, r15b
test edi, edi
cmove ecx, eax
movzx r15d, cl
lea rcx, [rsp + 0x68]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
test eax, eax
movzx esi, sil
mov r8d, 0
cmovne esi, r8d
jmp 0x180069df0
test r15b, r15b
je 0x180069dd0
mov ebx, 0x3c
cmp ebx, 0x3c
je 0x180069d9b
cmp ebx, 0x960
jne 0x180069dbc
mov rcx, qword [rbp - 0x78]
jmp 0x180069db2
mov qword [rbp - 0x78], r8
xor edx, edx
lea r8, [rbp - 0x78]
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x50]
mov edi, eax
test rcx, rcx
je 0x180069dbc
call sub.RPCRT4.dll_MesHandleFree
add ebx, 0x924
mov r8d, 0
cmp ebx, 0x1248
jbe 0x180069d88
test sil, sil
je 0x180069dde
mov rcx, qword [rbp - 0x68]
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180069ded
call sub.RPCRT4.dll_MesHandleFree
xor r8d, r8d
mov rbx, qword [rsp + 0x70]
dec r14d
cmp r14d, 0xad
ja 0x180069bf0
mov byte [rsp + 0x64], 0
jmp case.0x180069504.1
mov rdi, qword [rsp + 0x68]
movzx r9d, byte [rsp + 0x42]
movzx r11d, byte [rsp + 0x42]
mov qword [rsp + 0x78], rdi
mov byte [rsp + 0x41], r9b
mov byte [rsp + 0x40], r11b
jmp 0x180069a8a
mov dword [rbp - 0x58], r8d
jmp 0x18006a359
lea rax, [rbp + 0x128]
mov qword [rbp - 0x20], rax
jmp 0x18006a359
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
jmp 0x18006a34d
sub eax, 0x29c
je 0x180069e7d
cmp eax, 0x7d
jne 0x18006a359
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x28], r8
jmp 0x18006a359
mov rdx, qword [r10 + 0x10]
mov ecx, r15d
mov dword [rbp - 0x44], r8d
mov dword [rsp + 0x48], r8d
cmp rcx, rdx
ja 0x180069eac
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x180069ea3
mov rax, qword [r10]
mov byte [rax + rcx], 0
jmp 0x18006a359
mov r8, qword [r10 + 0x18]
mov rdi, rcx
mov rax, r8
sub rdi, rdx
sub rax, rdx
cmp rdi, rax
ja 0x180069ef0
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp r8, 0x10
jb 0x180069ed1
mov rax, qword [r10]
lea rbx, [rax + rdx]
mov r8, rdi
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
mov rbx, qword [rsp + 0x70]
jmp 0x18006a34d
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, r10
call fcn.180031f20
jmp 0x18006a34d
xor edx, edx
mov rcx, r10
call fcn.180033550
mov rdx, rax
lea r9, [rbp - 0x58]
xor eax, eax
mov r8d, r15d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea r9, [rbp - 0x38]
mov edx, ebx
lea r8, [rbp - 0x44]
lea rcx, [rbp + 0x110]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rsp + 0x60], eax
jmp 0x18006a34d
sub eax, 0x413
je 0x18006a338
sub eax, 0x7d
je 0x18006a32d
sub eax, 0x7d
je 0x18006a2ff
sub eax, 0x7d
je 0x18006a040
cmp eax, 0x7d
jne 0x18006a359
test r9b, r9b
je 0x18006a3c7
mov r13d, dword [rsp + 0x48]
lea r15d, [rax - 0x56]
mov r12d, dword [rsp + 0x48]
movzx r14d, byte [rsp + 0x42]
mov edi, dword [rsp + 0x48]
mov rsi, qword [rbp - 0x20]
mov eax, r15d
sub eax, 0x27
je 0x18006a41f
sub eax, 0x4b
je 0x18006a408
cmp eax, 0x4b
jne 0x18006a3b0
cmp dword [rsp + 0x60], 0
lea r9, [rsp + 0x68]
mov ecx, r8d
movzx eax, r14b
cmovne ecx, eax
mov r8d, r13d
lea rax, [rbp - 0x44]
movzx r14d, cl
mov rcx, qword [rbp - 0x38]
mov edx, r12d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call sub.RPCRT4.dll_MesBufferHandleReset
test r14b, r14b
je 0x18006a39f
mov ebx, 0x19
mov eax, ebx
sub eax, 0x17
je 0x18006a37f
sub eax, 1
je 0x18006a378
cmp eax, 1
jne 0x18006a38f
xor eax, eax
lea rcx, [rbp + 0x24]
xor edx, edx
mov r8d, 0xa8
mov esi, eax
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x20], 0xac
jmp 0x18006a38f
cmp r15d, dword [rbp - 0x58]
je 0x18006a359
mov ebx, 0x89
nop
cmp ebx, 0x4df
ja 0x18006a1e3
je 0x18006a1a8
cmp ebx, 0x2b4
ja 0x18006a179
je 0x18006a15a
cmp ebx, 0x89
je 0x18006a14d
cmp ebx, 0x142
je 0x18006a10b
cmp ebx, 0x1fb
jne 0x18006a2dc
mov r8d, 2
lea rdx, [0x1800cce90]
lea rcx, [rbp + 0xec]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rbp + 0xe8]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18006a0c0
mov eax, dword [0x1800cce94]
mov edx, 0x65
mov dword [rcx], eax
movabs rcx, 0x63006e0065
mov eax, dword [0x1800cce98]
mov dword [rbp + 0xf0], 0x52
mov dword [rbp + 0xf2], eax
movzx eax, word [0x1800cce9c]
mov word [rbp + 0xf6], ax
jmp 0x18006a2dc
lea rcx, [rbp + 0xe8]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18006a120
mov eax, dword [0x1800cced0]
mov dword [rcx], eax
movzx eax, word [0x1800cced4]
mov word [rcx + 4], ax
movabs rcx, 0x63006e0065
jmp 0x18006a2dc
mov word [rbp + 0xe8], r8w
jmp 0x18006a2dc
mov eax, dword [0x1800ccea0]
mov dword [rbp + 0xf6], eax
movzx eax, word [0x1800ccea4]
mov word [rbp + 0xfa], ax
jmp 0x18006a2dc
cmp ebx, 0x36d
je 0x18006a19c
cmp ebx, 0x426
jne 0x18006a2dc
mov dword [rbp + 0x100], 0x65
jmp 0x18006a2dc
mov qword [rbp + 0xfa], rcx
jmp 0x18006a2dc
mov eax, dword [0x1800ccec8]
movups xmm0, xmmword [str.Done.__Res_lt___d]
mov dword [rbp + 0x158], eax
movups xmm1, xmmword [0x1800cceb8]
movzx eax, word [0x1800ccecc]
movups xmmword [rbp + 0x138], xmm0
mov word [rbp + 0x15c], ax
movups xmmword [rbp + 0x148], xmm1
jmp 0x18006a2dc
cmp ebx, 0x87c
ja 0x18006a2c1
je 0x18006a28a
cmp ebx, 0x651
je 0x18006a273
cmp ebx, 0x70a
je 0x18006a242
cmp ebx, 0x7c3
jne 0x18006a2dc
lea r8, [rbp - 0x48]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
movabs rcx, 0x63006e0065
mov dword [rbp + 0xd0], 0x18
mov edx, 0x65
jmp 0x18006a2dc
mov qword [r10 + 0x10], r8
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18006a253
mov rax, qword [r10]
mov byte [rax], 0
xorps xmm0, xmm0
xor eax, eax
mov qword [rsp + 0x68], r8
mov qword [rbp + 0xe0], rax
mov esi, r8d
movups xmmword [rbp + 0xd0], xmm0
jmp 0x18006a2dc
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp + 8], rax
movups xmmword [rbp - 8], xmm0
lea r14d, [rax + 1]
jmp 0x18006a2dc
lea rax, [rbp + 0xd0]
mov r9d, esi
mov r8d, r14d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x138]
call qword [sym.imp.ADVAPI32.dll_DuplicateEncryptionInfoFile]
movabs rcx, 0x63006e0065
mov edx, 0x65
jmp 0x18006a2dc
cmp ebx, 0x935
je 0x18006a2d7
cmp ebx, 0x9ee
je case.0x180069504.1
jmp 0x18006a2dc
mov byte [rsp + 0x64], 0
mov r10, qword [rbp - 0x70]
add ebx, 0xb9
mov r8d, 0
cmp ebx, 0xaa7
jb 0x18006a050
mov rbx, qword [rsp + 0x70]
jmp 0x18006a34d
cmp dword [rsp + 0x60], 0
mov ecx, r8d
movzx eax, r9b
cmove ecx, eax
movzx eax, r11b
movzx r9d, cl
mov byte [rsp + 0x41], cl
test r12d, r12d
mov ecx, r8d
cmove ecx, eax
movzx r11d, cl
mov byte [rsp + 0x40], cl
jmp 0x18006a359
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18006a34d
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov r12d, eax
movzx r9d, byte [rsp + 0x41]
movzx r11d, byte [rsp + 0x40]
mov eax, dword [rbp - 0x80]
add eax, 0x7d
mov dword [rbp - 0x80], eax
cmp eax, r13d
jae case.0x180069504.1
mov r10, qword [rbp - 0x70]
xor r8d, r8d
mov rdi, qword [rsp + 0x78]
jmp 0x180069ab6
mov edi, 0x80000000
jmp 0x18006a38f
mov r8d, edi
lea rdx, [rbp + 0x20]
mov rcx, rsi
call qword [sym.imp.WINMM.dll_mixerGetLineInfoA]
dec ebx
cmp ebx, 0x16
ja 0x18006a002
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18006a3ad
call sub.RPCRT4.dll_MesHandleFree
xor r8d, r8d
add r15d, 0x4b
cmp r15d, 0x108
jb 0x180069fa2
movzx r11d, byte [rsp + 0x40]
test r11b, r11b
je 0x18006a3d5
mov rcx, qword [rbp - 0x28]
call sub.RPCRT4.dll_MesHandleFree
mov byte [rsp + 0x64], 1
mov eax, dword [rsp + 0x64]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1800c0ae0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r13d, r8d
call qword [sym.imp.WINMM.dll_mixerGetNumDevs]
xor r8d, r8d
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], r8
jmp 0x18006a3b0
mov r12d, 1
movzx r14d, r12b
jmp 0x18006a3b0