Function at 0x18000b1b0
Capabilities:
Acquire credentials from windows credential manager
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rbp + 0x290], rax
lea r12d, [rdx + 0xc]
mov qword [rbp - 0x78], r8
xor r11d, r11d
mov dword [rbp - 0x70], edx
mov qword [rbp - 0x10], rcx
mov r10, r8
lea rdi, [0x180000000]
mov r13, rcx
mov r15d, edx
cmp edx, r12d
jae 0x18000b46d
mov rsi, qword [rbp - 8]
lea r14d, [rdx - 0x121]
movabs rdx, 0x5f007300720065
lea r8d, [r11 + 0x65]
lea r9d, [r11 + 0x78]
nop dword [rax + rax]
cmp r14d, 0x1b
ja case.0x18000b245.2
mov ecx, dword [rdi + r14*4 + 0xbf7c]
add rcx, rdi
jmp rcx
mov r8, r13
mov edx, 0x1a
mov rcx, r10
call fcn.1800566a0
mov r10, qword [rbp - 0x78]
mov r8d, 0x65
mov rsi, rax
movabs rdx, 0x5f007300720065
xor r11d, r11d
lea r9d, [r8 + 0x13]
jmp case.0x18000b245.2
mov rdx, r10
mov ecx, 0xef
call fcn.18006f9c0
mov r10, qword [rbp - 0x78]
mov r8d, 0x65
movabs rdx, 0x5f007300720065
xor r11d, r11d
lea r9d, [r8 + 0x13]
jmp case.0x18000b245.2
mov eax, dword [r10 + 0x18]
add dword [r13 + 0x18], eax
mov eax, dword [r10 + 0x1c]
add dword [r13 + 0x1c], eax
mov eax, dword [r10 + 0x20]
add dword [r13 + 0x20], eax
jmp case.0x18000b245.2
mov eax, dword [r10 + 0xc]
add dword [r13 + 0xc], eax
mov eax, dword [r10 + 0x10]
add dword [r13 + 0x10], eax
mov eax, dword [r10 + 0x14]
add dword [r13 + 0x14], eax
jmp case.0x18000b245.2
mov edi, 0x81
cmp edi, 0x81
je 0x18000b2fd
cmp edi, 0x50a0
jne 0x18000b33c
mov al, 1
jmp 0x18000b992
mov ebx, 0xdd
mov eax, ebx
sub eax, 0xdb
je 0x18000b33c
cmp eax, 2
jne 0x18000b332
mov r9d, 0xea
mov qword [rbp - 0x48], 1
mov r8, r13
mov qword [rbp - 0x50], rsi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.1800196e0
inc ebx
cmp ebx, 0xdf
jb 0x18000b302
add edi, 0x501f
cmp edi, 0xa03e
jbe 0x18000b2e6
xor r11d, r11d
lea rdi, [0x180000000]
movsd xmm0, qword [0x1800b5558]
lea rdx, [0x1800b55b0]
movzx eax, word [0x1800b5560]
lea rcx, [rbp + 0x108]
mov r8d, 4
movsd qword [rbp + 0x108], xmm0
mov word [rbp + 0x110], ax
mov word [rbp + 0x112], r11w
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r10, qword [rbp - 0x78]
mov r8d, 0x65
movabs rdx, 0x5f007300720065
xor r11d, r11d
lea r9d, [r8 + 0x13]
jmp case.0x18000b245.2
movsd xmm0, qword [0x1800b5650]
movzx eax, word [0x1800b5658]
movsd qword [rbp + 0x126], xmm0
mov word [rbp + 0x12e], ax
mov word [rbp + 0x130], r11w
jmp case.0x18000b245.2
mov dword [rbp + 0x138], 0x780065
jmp case.0x18000b245.2
mov qword [rbp + 0x130], rdx
mov word [rbp + 0x138], r11w
jmp case.0x18000b245.2
mov dword [rbp + 0x11a], 0x740061
mov word [rbp + 0x11e], r11w
jmp case.0x18000b245.2
mov r8d, 4
lea rdx, [0x1800b5686]
lea rcx, [rbp + 0x11e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r10, qword [rbp - 0x78]
mov r8d, 0x65
movabs rdx, 0x5f007300720065
xor r11d, r11d
lea r9d, [r8 + 0x13]
jmp case.0x18000b245.2
mov eax, dword [r10]
add dword [r13], eax
mov eax, dword [r10 + 4]
add dword [r13 + 4], eax
mov eax, dword [r10 + 8]
add dword [r13 + 8], eax
inc r15d
inc r14d
cmp r15d, r12d
jb 0x18000b230
mov edx, dword [rbp - 0x70]
movzx ebx, byte [rbp - 0x80]
lea ecx, [rdx + 0x65c]
mov dword [rbp - 0x6c], ecx
cmp edx, ecx
jae case.0x18000ba8c.0
movzx esi, byte [rbp - 0x80]
mov r12d, dword [rbp - 0x60]
mov r15d, dword [rbp - 0x60]
movzx r14d, byte [rbp - 0x80]
mov dword [rbp - 0x64], esi
movabs r9, 0x6b73616d20746e
mov r8d, 0x69
cmp edx, 0x2e9
ja 0x18000b957
je 0x18000b8b2
mov eax, edx
sub eax, 0x12d
je 0x18000b86c
sub eax, 0xc
je 0x18000b853
sub eax, 0x88
je 0x18000b500
sub eax, 0xc
je 0x18000b4ee
cmp eax, 0x88
jne 0x18000bf3a
mov qword [rbp + 0x20], r11
jmp 0x18000bf3a
mov rdx, r13
mov ecx, 0xef
call fcn.18006f9c0
jmp 0x18000bf2d
cmp qword [rbp - 0x40], 0xffffffffffffffff
jne 0x18000b847
mov esi, 0x16
cmp esi, 0x16
ja case.0x18000b525.8
mov eax, esi
mov ecx, dword [rdi + rax*4 + 0xbfec]
add rcx, rdi
jmp rcx
mov word [rbp + 0xa9], 0x32
jmp case.0x18000b525.8
mov eax, dword [str.hine]
mov dword [rbp + 0x97], eax
movzx eax, byte [0x1800b56a8]
mov word [rbp + 0xc8], r8w
mov byte [rbp + 0x9b], al
mov qword [rbp + 0xc9], r9
jmp case.0x18000b525.8
mov eax, PathMakeUniqueName
mov word [rbp + 0xd4], ax
mov eax, dword [0x1800b56bf]
mov dword [rbp + 0xa0], eax
movzx eax, byte [0x1800b56c3]
mov byte [rbp + 0xa4], al
jmp case.0x18000b525.8
xor eax, eax
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], eax
cmp byte [rbp - 0x80], al
je 0x18000b621
mov r13d, dword [rbp - 0x38]
mov edi, 0xeb
mov eax, edi
sub eax, 0xeb
je 0x18000b5fb
sub eax, 0x50
je 0x18000b5f2
sub eax, 0x50
je 0x18000b5cf
cmp eax, 0x50
jne 0x18000b601
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18000b601
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18000b601
mov rcx, qword [rbp - 0x50]
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
mov r8d, r12d
mov dword [rsp + 0x20], r15d
mov edx, r13d
call sub.RPCRT4.dll_MesBufferHandleReset
jmp 0x18000b601
mov r12d, r11d
mov qword [rbp + 0x10], r11
jmp 0x18000b601
mov r13d, 1
add edi, 0x50
mov r11d, 0
cmp edi, 0x22b
jb 0x18000b5a7
mov dword [rbp - 0x38], r13d
lea rdi, [0x180000000]
mov r13, qword [rbp - 0x10]
mov r9d, dword [rbp - 0x34]
lea rax, [rbp + 0x60]
mov r8d, dword [rbp - 0x30]
lea rcx, [rbp - 0x48]
mov edx, dword [rbp - 0x2c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAceEx]
mov r8d, 0x69
movabs r9, 0x6b73616d20746e
jmp case.0x18000b525.8
mov qword [rbp - 0x50], r11
jmp case.0x18000b525.8
mov dword [rbp - 0x34], r11d
jmp case.0x18000b525.8
mov eax, dword [str.PU_ma]
mov dword [rbp + 0x91], eax
movzx eax, word [0x1800b56d0]
mov word [rbp + 0x95], ax
jmp case.0x18000b525.8
mov eax, 0x53
lea rdx, [0x1800b56d4]
lea rcx, [rbp + 0xd1]
mov word [rbp + 0xd0], ax
lea r8d, [rax - 0x4f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18000b63f
lea r9, [rbp - 0x50]
mov edx, r15d
lea r8, [rbp - 0x5c]
lea rcx, [rbp + 0x80]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov r8d, 0x69
movabs r9, 0x6b73616d20746e
test eax, eax
je case.0x18000b525.8
mov byte [rbp - 0x80], 0
jmp case.0x18000b525.8
mov byte [rbp + 0xa5], 0
jmp case.0x18000b525.8
mov byte [rbp + 0xa5], 0x71
jmp case.0x18000b525.8
mov dword [rbp - 0x5c], r11d
mov dword [rbp - 0x30], 4
jmp case.0x18000b525.8
movzx eax, word [0x1800a5320]
lea rdx, [0x1800a77bc]
mov r8d, 2
mov word [rbp + 0x87], ax
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x6e
mov word [rbp + 0x89], ax
jmp 0x18000b63f
movzx eax, word [0x1800b56d8]
mov word [rbp + 0x8a], ax
movzx eax, word [0x1800a5320]
mov word [rbp + 0x8c], ax
jmp case.0x18000b525.8
mov byte [rbp - 0x80], 1
mov qword [rbp - 0x48], r11
jmp case.0x18000b525.8
mov eax, 8
mov r15, 0xffffffffffffffff
mov word [rbp - 0x46], ax
lea rax, [rbp + 0x80]
nop dword [rax]
inc r15
cmp byte [rax + r15], 0
jne 0x18000b790
jmp case.0x18000b525.8
mov byte [rbp + 0x8d], 0x25
mov dword [rbp + 0x8e], 0x432064
jmp case.0x18000b525.8
mov dword [rbp - 0x2c], r11d
jmp case.0x18000b525.8
mov r8d, 5
lea rdx, str.Runn
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp + 0x84], 0x676e69
jmp 0x18000b63f
lea rcx, [rbp + 0x80]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000b7f0
movzx eax, word [0x1800a813c]
mov word [rcx], ax
jmp case.0x18000b525.8
movzx eax, word [0x1800b56ef]
mov word [rbp + 0xa6], ax
movzx eax, byte [0x1800b56f1]
mov byte [rbp + 0xa8], al
mov byte [rbp + 0xa9], 0
dec esi
mov r11d, 0
lea eax, [rsi + 0xe4]
cmp eax, 0xe3
ja 0x18000b510
mov ecx, dword [rbp - 0x6c]
mov edx, dword [rbp - 0x70]
mov r14b, 1
mov dword [rbp - 0x58], r11d
jmp 0x18000bf36
mov eax, dword [r10 + 0x24]
add dword [r13 + 0x24], eax
mov eax, dword [r10 + 0x28]
add dword [r13 + 0x28], eax
mov dword [r13 + 0x2c], r11d
jmp 0x18000bf3a
cmp qword [r13 + 0x18], 8
mov rcx, r13
mov word [rbp + 0x13c], r11w
jb 0x18000b882
mov rcx, qword [r13]
mov qword [rsp + 0x30], r11
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp - 0x40], rax
jmp 0x18000bf2d
mov rcx, qword [rbp - 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp - 0x68], eax
call qword [sym.imp.WINMM.dll_mixerGetNumDevs]
mov r10, qword [rbp - 0x78]
mov ecx, dword [rbp - 0x68]
mov dword [rbp - 0x60], eax
mov r8, qword [r10 + 0x10]
cmp rcx, r8
ja 0x18000b8fd
mov qword [r10 + 0x10], rcx
mov rdx, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18000b8eb
mov rdx, qword [r10]
mov byte [rdx + rcx], 0
xor r11d, r11d
mov ecx, dword [rbp - 0x6c]
mov edx, dword [rbp - 0x70]
jmp 0x18000bf3a
mov rdx, qword [r10 + 0x18]
mov rsi, rcx
mov rax, rdx
sub rsi, r8
sub rax, r8
cmp rsi, rax
ja 0x18000b93c
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp rdx, 0x10
jb 0x18000b922
mov rax, qword [r10]
lea rdi, [rax + r8]
xor edx, edx
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rsi], 0
jmp 0x18000bf2d
mov r9, rsi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rsi
mov rcx, r10
call fcn.180002d20
jmp 0x18000bf2d
cmp edx, 0x37d
je 0x18000bf07
cmp edx, 0x411
je 0x18000bef0
cmp edx, 0x4a5
je 0x18000ba52
cmp edx, 0x539
je 0x18000b9bc
cmp edx, 0x5cd
jne 0x18000bf3a
movzx eax, bl
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r14b, r14b
je 0x18000ba3a
mov r13, qword [rbp + 0x18]
mov ebx, 0x84
nop word [rax + rax]
cmp ebx, 0x84
je 0x18000ba02
cmp ebx, 0x107
jne 0x18000ba1e
mov r8d, 0x80000000
mov dword [rbp + 0x80], 0x1c
lea rdx, [rbp + 0x80]
mov rcx, r13
call qword [sym.imp.WINMM.dll_mixerGetLineControlsA]
jmp 0x18000ba1e
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
mov r13, r11
mov dword [rbp + 0x98], eax
add ebx, 0x83
mov r11d, 0
cmp ebx, 0x18a
jb 0x18000b9d0
mov qword [rbp + 0x18], r13
mov r13, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x108]
call qword [sym.imp.GDI32.dll_CopyEnhMetaFileW]
mov bl, 1
jmp 0x18000bf2d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x68]
cmp eax, dword [rbp - 0x58]
je 0x18000bf2d
mov edi, 0x1b
nop dword [rax]
cmp edi, 0x1b
ja case.0x18000ba8c.8
lea rdx, [0x180000000]
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0xc048]
add rcx, rdx
jmp rcx
mov eax, dword [0x1800b56fc]
mov dword [rbp + 0xec], eax
movzx eax, word [0x1800b5700]
mov word [rbp + 0xf0], ax
jmp case.0x18000ba8c.8
mov r8d, 5
lea rdx, [0x1800b5730]
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movsd xmm0, qword [0x1800b57e6]
movzx eax, word [0x1800b57ee]
movsd qword [rbp + 0x14a], xmm0
mov word [rbp + 0x152], ax
jmp case.0x18000ba8c.8
xor eax, eax
xorps xmm0, xmm0
xor r11d, r11d
mov qword [rbp + 0x58], rax
mov dword [rbp - 0x18], r11d
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
jmp 0x18000bc83
xor ecx, ecx
lea rdx, [0x1800b5842]
mov word [rbp + 0x16a], cx
lea r8d, [rcx + 5]
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.0x18000ba8c.8
lea rcx, [rbp + 0xb0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000bb40
movzx eax, word [0x1800b24f8]
mov sil, 1
mov word [rcx], ax
mov dword [rbp - 0x64], esi
jmp case.0x18000ba8c.8
mov eax, dword [0x1800b5a84]
mov dword [rbp + 0x154], eax
movzx eax, word [0x1800b5a88]
mov word [rbp + 0x158], ax
jmp case.0x18000ba8c.8
xor r11d, r11d
mov dword [rbp - 0x24], 0x2000000
mov dword [rbp - 0x28], r11d
mov dword [rbp - 0x1c], r11d
jmp 0x18000bc83
test sil, sil
je case.0x18000ba8c.8
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_CredFree]
jmp case.0x18000ba8c.8
xor ecx, ecx
lea rax, [rbp + 8]
mov qword [rsp + 0x78], rax
lea r9, [rbp + 0x80]
lea rax, [rbp + 4]
xor edx, edx
mov qword [rsp + 0x70], rax
lea r8, [rbp + 0xd8]
lea rax, [rbp]
mov qword [rsp + 0x68], rax
mov eax, dword [rbp - 0x20]
mov dword [rsp + 0x60], eax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x28]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], rax
mov eax, dword [rbp - 0x28]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x24]
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultListAndAuditAlarmW]
xor bl, bl
jmp case.0x18000ba8c.8
movabs rax, 0x740072006f
mov qword [rbp + 0x92], rax
jmp case.0x18000ba8c.8
mov eax, dword [str.Shape]
lea rdx, [0x1800b5ad8]
mov dword [rbp + 0xb5], eax
mov r8d, 2
movzx eax, word [0x1800b5ad4]
mov word [rbp + 0xb9], ax
movzx eax, byte [0x1800b5ad6]
mov byte [rbp + 0xbb], al
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r11d, r11d
mov r10, qword [rbp - 0x78]
dec edi
lea eax, [rdi + 0x87]
cmp eax, 0x86
ja 0x18000ba70
mov ecx, dword [rbp - 0x6c]
mov edx, dword [rbp - 0x70]
jmp 0x18000bf3a
xor r11d, r11d
mov word [rbp + 0x154], r11w
jmp 0x18000bc83
xor ecx, ecx
lea rdx, [0x1800b5b16]
mov word [rbp + 0x15a], cx
lea r8d, [rcx + 5]
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 3
lea rdx, [0x1800b5b2c]
lea rcx, [rbp + 0x164]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18000ba8c.8
mov r8d, 1
lea rdx, [0x1800a82cc]
jmp 0x18000bc73
movsd xmm0, qword [str.mm12]
mov eax, 0x69
mov dword [rbp + 0xfc], eax
movzx eax, word [0x1800b5b70]
mov word [rbp + 0x106], ax
movsd qword [rbp + 0xfe], xmm0
jmp case.0x18000ba8c.8
movzx eax, word [0x1800b5b74]
mov word [rbp + 0xb1], ax
mov eax, 0x69
mov word [rbp + 0xb3], ax
mov eax, 0x63
mov word [rbp + 0xb4], ax
jmp case.0x18000ba8c.8
movabs rax, 0x610061005f
mov qword [rbp + 0xe2], rax
mov eax, 0x63
mov dword [rbp + 0xe8], 0x72
mov dword [rbp + 0xea], eax
jmp case.0x18000ba8c.8
mov r10, qword [rbp - 0x78]
xor r11d, r11d
xorps xmm0, xmm0
mov rax, r10
movups xmmword [rbp + 0x28], xmm0
mov qword [r10 + 0x10], r11
cmp qword [r10 + 0x18], 0x10
jb 0x18000bda4
mov rax, qword [r10]
mov byte [rax], r11b
movups xmmword [rbp + 0x70], xmm0
jmp 0x18000bc87
mov edx, dword [rbp - 0x18]
lea r9, [rbp - 8]
xor ecx, ecx
lea r8, [rbp - 0x1c]
mov dword [rbp - 0x20], ecx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_CredEnumerateA]
mov dword [rbp - 0x14], eax
jmp case.0x18000ba8c.8
mov eax, dword [0x1800b5b78]
lea rdx, str.add_
mov dword [rbp + 0xf0], eax
lea rcx, [rbp + 0xf4]
movzx eax, word [0x1800b5b7c]
mov r8d, 5
mov word [rbp + 0xf4], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18000ba8c.8
movsd xmm0, qword [str.view]
lea rdx, [0x1800b5b9c]
movzx eax, word [0x1800b5b98]
lea rcx, [rbp + 0x90]
mov r8d, 2
movsd qword [rbp + 0x88], xmm0
mov word [rbp + 0x90], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18000ba8c.8
mov eax, dword [0x1800b5ba0]
mov dword [rbp + 0xd8], eax
movabs rax, 0x7000750078
mov qword [rbp + 0xdc], rax
jmp case.0x18000ba8c.8
mov byte [rbp + 0xb0], 0
lea rdx, [0x1800b5ba8]
mov r8d, 1
jmp 0x18000bc73
movzx eax, word [0x1800b5bac]
mov word [rbp + 0xbd], ax
movzx eax, word [0x1800b5bb0]
mov word [rbp + 0xbf], ax
movzx eax, byte [0x1800b5bb2]
mov byte [rbp + 0xc1], al
jmp case.0x18000ba8c.8
mov eax, 0x40
mov word [rbp + 0x80], ax
movabs rax, 0x2d006f002d
mov qword [rbp + 0x82], rax
jmp case.0x18000ba8c.8
cmp dword [rbp - 0x14], 0
mov r11d, 0
movzx esi, sil
cmove esi, r11d
mov dword [rbp - 0x64], esi
jmp 0x18000bc83
cmp dword [rbp - 0x60], 0
mov ecx, r11d
movzx eax, r14b
cmovne ecx, eax
movzx r14d, cl
mov ecx, dword [rbp - 0x6c]
jmp 0x18000bf3a
xor edx, edx
mov rcx, r10
call fcn.180004290
mov r8d, dword [rbp - 0x68]
lea r9, [rbp - 0x58]
xor ecx, ecx
mov rdx, rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rbp - 0x6c]
xor r11d, r11d
mov edx, dword [rbp - 0x70]
mov r10, qword [rbp - 0x78]
add edx, 0x94
mov dword [rbp - 0x70], edx
cmp edx, ecx
jae case.0x18000ba8c.0
mov esi, dword [rbp - 0x64]
lea rdi, [0x180000000]
jmp 0x18000b496
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.dbghelp.dll_SearchTreeForFile]
xor al, al
jmp 0x18000b992