Function at 0x18001a180
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x180072270]
xor rax, rsp
mov qword [rbp + 0x108], rax
movzx eax, byte [rsp + 0x40]
lea r13d, [rcx + 0x1c2]
mov r10, qword [rbp - 0x40]
mov r11, rdx
mov r9d, dword [rsp + 0x60]
cmp ecx, r13d
movzx ebx, byte [rsp + 0x40]
mov r15d, ecx
mov qword [rbp - 0x50], rdx
mov edx, ecx
mov dword [rbp - 0x54], ecx
mov dword [rbp - 0x70], ecx
mov ecx, dword [rsp + 0x60]
mov byte [rsp + 0x4d], al
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x44], ecx
mov qword [rbp - 0x68], r8
mov dword [rbp - 0x5c], r13d
mov qword [rsp + 0x68], r10
mov dword [rsp + 0x50], r9d
jae 0x18001a79a
movzx edx, byte [rsp + 0x40]
mov r12d, dword [rsp + 0x58]
movzx r14d, byte [rsp + 0x40]
mov edi, dword [rsp + 0x58]
mov esi, dword [rbp - 0x80]
mov dword [rsp + 0x7c], eax
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x60], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x74], eax
movzx eax, byte [rsp + 0x40]
mov dword [rsp + 0x78], eax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x4c], al
mov dword [rsp + 0x48], edx
nop word [rax + rax]
cmp r15d, 0x37
ja 0x18001a57e
je 0x18001a2ae
cmp r15d, 0x19
jne case.default.0x18001a5b5
cmp qword [r8 + 0x18], 8
mov rcx, r8
jb 0x18001a273
mov rcx, qword [r8]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r10, rax
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x4c], 1
jmp 0x18001a5d3
mov byte [rsp + 0x4d], 1
cmp r10, 0xffffffffffffffff
jne 0x18001a577
xor r8d, r8d
mov r13d, r8d
cmp r13d, 9
ja case.default.0x18001a2e2
lea r9, [0x180000000]
mov eax, r13d
mov ecx, dword [r9 + rax*4 + 0x1b1d4]
add rcx, r9
jmp rcx
movups xmm0, xmmword [str._5026_2C56CN]
mov dl, 1
movups xmmword [rbp + 0xf8], xmm0
jmp 0x18001a544
mov byte [rsp + 0x41], 1
jmp case.default.0x18001a2e2
lea r9, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
lea r9, [rbp + 0x38]
mov dword [rbp - 0x80], eax
lea r8, [rbp - 0x20]
mov edx, r12d
lea rcx, [rbp + 0xf8]
mov esi, eax
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov edx, dword [rsp + 0x48]
xor r8d, r8d
mov dword [rbp - 0x7c], eax
jmp case.default.0x18001a2e2
mov qword [rbp + 0x38], r8
jmp case.default.0x18001a2e2
cmp byte [rsp + 0x41], 0
je 0x18001a3bd
mov ebx, 0x120
cmp ebx, 0x120
je 0x18001a3a7
cmp ebx, 0x29a0
je 0x18001a38c
cmp ebx, 0x5220
je 0x18001a379
cmp ebx, 0x7aa0
jne 0x18001a3ab
mov rcx, qword [rbp + 0x58]
jmp 0x18001a37d
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x18001a3ab
call sub.RPCRT4.dll_MesHandleFree
xor r8d, r8d
jmp 0x18001a3ab
lea r8, [rbp + 0x58]
mov edx, r12d
lea rcx, [rbp + 0xf8]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rbp - 0x7c], eax
xor r8d, r8d
jmp 0x18001a3ab
mov qword [rbp + 0x58], r8
add ebx, 0x2880
cmp ebx, 0xa200
jbe 0x18001a353
mov edx, dword [rsp + 0x48]
test dl, dl
je 0x18001a4f5
mov r15d, 0x112
nop dword [rax + rax]
cmp r15d, 0x112
je 0x18001a4b2
cmp r15d, 0x8182
jne 0x18001a4d4
cmp qword [rbp - 0x10], 0
je 0x18001a4d4
mov esi, 0xd2
nop word [rax + rax]
mov eax, esi
sub eax, 0xd2
je 0x18001a482
cmp eax, 0x56
jne 0x18001a49b
test edi, edi
movzx eax, r14b
mov ecx, r8d
cmove ecx, eax
movzx r14d, cl
test cl, cl
je 0x18001a477
mov ebx, 0xd6
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xd5
je 0x18001a45c
cmp eax, 1
jne 0x18001a46d
mov qword [rbp + 0x28], r8
xor edx, edx
lea r8, [rbp + 0x28]
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp + 0x30]
mov edi, eax
test rcx, rcx
jne 0x18001a465
jmp 0x18001a46a
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x18001a46d
call sub.RPCRT4.dll_MesHandleFree
xor r8d, r8d
dec ebx
cmp ebx, 0xd4
ja 0x18001a430
mov rcx, qword [rbp - 0x10]
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001a49b
mov qword [rbp + 0x30], r8
lea r9, [rbp + 0x30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r14b, 1
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov edi, eax
add esi, 0x56
mov r8d, 0
cmp esi, 0x17e
jb 0x18001a400
jmp 0x18001a4d4
mov qword [rbp - 0x10], r8
xor edx, edx
lea r8, [rbp - 0x10]
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp - 0x48]
mov dword [rbp - 0x80], eax
test rcx, rcx
je 0x18001a4d4
call sub.RPCRT4.dll_MesHandleFree
add r15d, 0x8070
mov r8d, 0
cmp r15d, 0x100e0
jbe 0x18001a3d0
mov esi, dword [rbp - 0x80]
mov edx, dword [rsp + 0x48]
xor bl, bl
xor r8d, r8d
jmp case.default.0x18001a2e2
lea rax, [rbp + 0xf8]
mov r12, 0xffffffffffffffff
nop word [rax + rax]
inc r12
cmp byte [rax + r12], 0
jne 0x18001a510
jmp case.default.0x18001a2e2
mov qword [rbp - 0x48], r8
jmp case.default.0x18001a2e2
mov dword [rbp - 0x20], r8d
jmp case.default.0x18001a2e2
cmp dword [rbp - 0x7c], 0
mov ecx, r8d
movzx eax, byte [rsp + 0x41]
cmove ecx, eax
movzx edx, dl
test esi, esi
mov byte [rsp + 0x41], cl
cmovne edx, r8d
mov dword [rsp + 0x48], edx
inc r13d
lea eax, [r13 + 0x118]
cmp eax, 0x122
jb 0x18001a2c3
mov r15d, dword [rbp - 0x70]
mov r13d, dword [rbp - 0x5c]
mov ecx, dword [rsp + 0x44]
mov r8, qword [rbp - 0x68]
mov r10, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x50]
xor eax, eax
mov dword [rbp - 0x58], eax
jmp case.default.0x18001a5b5
cmp r15d, 0x15f
ja 0x18001a745
je 0x18001a723
lea eax, [r15 - 0x55]
cmp eax, 0xf2
ja case.default.0x18001a5b5
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x1b22c]
mov ecx, dword [rdx + rax*4 + 0x1b1fc]
add rcx, rdx
jmp rcx
mov r8d, 0xa
lea rdx, [rbp + 0xf2]
lea ecx, [r8 - 6]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
mov r10, qword [rsp + 0x68]
mov r8, qword [rbp - 0x68]
mov r9d, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
mov r11, qword [rbp - 0x50]
add r15d, 0x1e
mov dword [rbp - 0x70], r15d
cmp r15d, r13d
jae 0x18001a7c1
mov edx, dword [rsp + 0x48]
jmp 0x18001a250
lea r9, [rbp - 8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rsp + 0x7c], eax
jmp 0x18001a5ce
mov eax, dword [r8 + 0x24]
sub eax, dword [0x180091544]
mov dword [rbp - 0x78], eax
mov eax, dword [r8 + 0x28]
sub eax, dword [0x180091548]
mov dword [rbp - 0x74], eax
jmp case.0x18001a5b5.86
mov eax, dword [str.SAVE6]
mov dword [rbp + 0xed], eax
movzx eax, word [0x18006661c]
mov word [rbp + 0xf1], ax
jmp case.0x18001a5b5.86
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp - 8], rax
jmp case.0x18001a5b5.86
lea r9, [rbp + 0x40]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x60], eax
jmp 0x18001a5ce
movzx eax, word [0x180066620]
mov dword [rbp + 0xe8], 0x5f5649
mov word [rbp + 0xeb], ax
movzx eax, byte [0x180066622]
mov byte [rbp + 0xed], al
jmp case.0x18001a5b5.86
xor edx, edx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x74], eax
jmp 0x18001a5ce
mov byte [rsp + 0x78], 1
jmp case.0x18001a5b5.86
mov edx, dword [rsp + 0x74]
xor r8d, r8d
mov rcx, r11
call fcn.18005b7b0
jmp 0x18001a5ce
mov eax, dword [rbp - 0x78]
lea r8, [rbp - 0x18]
lea rdx, [rsp + 0x58]
mov dword [rbp - 0x18], eax
mov ecx, 0x13
call fcn.1800117b0
mov dword [rsp + 0x70], eax
lea r8, [rbp + 0x18]
mov eax, dword [rbp - 0x74]
lea rdx, [rsp + 0x58]
mov ecx, 0x13
mov dword [rbp + 0x18], eax
call fcn.1800117b0
mov r8, qword [rbp - 0x68]
mov ecx, dword [rsp + 0x70]
mov r10, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x50]
sub ecx, dword [r8 + 0x48]
sub ecx, eax
mov dword [rsp + 0x44], ecx
jmp case.default.0x18001a5b5
mov eax, dword [rbp - 0x78]
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x58]
mov dword [rbp - 0x28], eax
mov ecx, 0x13
call fcn.1800117b0
mov dword [rsp + 0x70], eax
jmp 0x18001a5ce
cmp r15d, 0x17d
jne case.default.0x18001a5b5
mov eax, dword [rbp - 0x74]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x60], eax
mov ecx, 0x13
call fcn.1800117b0
mov ecx, dword [rsp + 0x44]
mov r9d, eax
add r9d, dword [rsp + 0x70]
mov eax, 0
mov r8, qword [rbp - 0x68]
test ecx, ecx
mov r10, qword [rsp + 0x68]
cmovs ecx, eax
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x44], ecx
jmp case.default.0x18001a5b5
mov esi, dword [rsp + 0x60]
mov dword [rbp - 0x60], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x74], eax
movzx eax, byte [rsp + 0x40]
mov dword [rsp + 0x78], eax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x4c], al
mov dword [rsp + 0x7c], esi
jmp 0x18001a7c8
mov edx, dword [rbp - 0x54]
mov esi, dword [rsp + 0x7c]
imul eax, edx, 0x5f6
mov edi, edx
mov dword [rsp + 0x70], edx
mov dword [rsp + 0x58], eax
cmp edx, eax
ja case.0x18001a2e2.9
movzx edx, byte [rsp + 0x40]
mov r13d, dword [rsp + 0x58]
mov r14d, dword [rsp + 0x58]
mov r12d, dword [rsp + 0x58]
mov r15d, dword [rsp + 0x58]
mov dword [rsp + 0x48], edx
mov qword [rbp + 0x70], r13
mov qword [rbp], r14
nop word [rax + rax]
cmp edi, 0x65d6
ja 0x18001b033
je 0x18001b01e
cmp edi, 0xabe
ja 0x18001a932
je 0x18001a8eb
mov eax, edi
sub eax, 0x19
je 0x18001a8ae
sub eax, 0xd4
je 0x18001a889
cmp eax, 0x36
jne 0x18001b13e
mov eax, ecx
imul eax, dword [0x180091c60]
cdq
movzx edx, dx
add eax, edx
sar eax, 0x10
mov ecx, eax
cmp eax, 0x10
mov eax, 0x10
cmovle ecx, eax
mov eax, r9d
cdq
mov dword [rbp - 0x34], ecx
idiv ecx
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
add eax, 0x83
mov dword [r8 + 0x34], eax
jmp 0x18001b13e
xor eax, eax
xor r8d, r8d
lock cmpxchg qword [0x180072340], r8
mov qword [rbp + 8], rax
lea rax, [rbp + 0xe8]
mov qword [rbp + 0x98], rax
jmp 0x18001b13e
cmp qword [r11 + 0x18], 0x10
mov rdx, r11
jb 0x18001a8bb
mov rdx, qword [r11]
mov r8d, dword [rsp + 0x74]
lea r9, [rbp - 0x58]
xor eax, eax
mov rcx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x50]
jmp 0x18001b13e
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x4c]
xor r8d, r8d
cmp dword [rbp - 0x60], r8d
mov ecx, r8d
mov edx, dword [rsp + 0x48]
mov r10, qword [rsp + 0x68]
cmove ecx, eax
movzx eax, byte [rsp + 0x4d]
test esi, esi
mov r9d, dword [rsp + 0x50]
mov byte [rsp + 0x4c], cl
mov ecx, r8d
cmove ecx, eax
mov byte [rsp + 0x4d], cl
mov ecx, dword [rsp + 0x44]
jmp 0x18001b13e
cmp edi, 0x1563
je 0x18001ac02
cmp edi, 0x2008
je 0x18001a97f
cmp edi, 0x2aad
jne 0x18001b13e
movzx eax, bl
mov rcx, qword [rbp + 0x108]
xor rcx, rsp
call fcn.18005e580
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp byte [rsp + 0x4c], 0
je 0x18001a9cd
mov ebx, 0x7c
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x7b
je 0x18001a9b8
cmp eax, 1
jne 0x18001a9c6
xor eax, eax
lea r8, [rbp + 0x48]
xor edx, edx
mov qword [rbp + 0x48], rax
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp + 0x40]
mov dword [rbp - 0x60], eax
jmp 0x18001a9bc
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x18001a9c6
call sub.RPCRT4.dll_MesHandleFree
dec ebx
cmp ebx, 0x7a
ja 0x18001a990
cmp byte [rsp + 0x4d], 0
je 0x18001abe9
mov r14d, 0x12c
xor r13d, r13d
mov dword [rbp - 0x70], r14d
mov eax, r14d
sub eax, 0x12b
je 0x18001aa12
cmp eax, 1
jne 0x18001abc9
lea r8, [rbp + 0x60]
mov qword [rbp + 0x60], r13
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov dword [rsp + 0x7c], eax
jmp 0x18001abc9
cmp qword [rbp - 8], 0
je 0x18001abbb
movzx r14d, byte [rsp + 0x40]
xor edx, edx
mov edi, edx
lea esi, [rdx + 9]
nop word [rax + rax]
cmp edi, 8
ja case.default.0x18001aa4d
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0x1b320]
add rcx, r8
jmp rcx
mov eax, 0x72
mov word [rbp + 0xc0], ax
mov eax, 0x3c
mov word [rbp + 0xc1], ax
jmp case.default.0x18001aa4d
mov dword [rbp + 0xc2], 0x6177656e
jmp case.default.0x18001aa4d
test r12d, r12d
movzx eax, r14b
mov ecx, edx
cmove ecx, eax
movzx r14d, cl
test cl, cl
je case.default.0x18001aa4d
mov ebx, 0x42
mov eax, ebx
sub eax, 0x40
je 0x18001aad3
sub eax, 1
je 0x18001aaaf
cmp eax, 1
jne 0x18001aae3
mov qword [rbp + 0x50], rdx
jmp 0x18001aae3
lea r8, [rbp + 0x50]
mov edx, r15d
lea rcx, [rbp + 0xb8]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp + 0x90]
mov r12d, eax
test rcx, rcx
jne 0x18001aadc
jmp 0x18001aae1
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x18001aae3
call sub.RPCRT4.dll_MesHandleFree
xor edx, edx
dec ebx
cmp ebx, 0x3f
ja 0x18001aa98
jmp case.default.0x18001aa4d
mov eax, 0x7473
mov dword [rbp + 0xbd], 0x65726f
mov word [rbp + 0xbb], ax
jmp case.default.0x18001aa4d
mov r14b, 1
lea rax, [rbp + 0xb8]
mov r15, 0xffffffffffffffff
nop dword [rax + rax]
inc r15
cmp byte [rax + r15], 0
jne 0x18001ab20
jmp case.default.0x18001aa4d
mov dword [rbp - 0x5c], edx
lea r9, [rbp + 0x90]
mov qword [rbp + 0x90], rdx
lea r8, [rbp - 0x5c]
mov edx, r15d
lea rcx, [rbp + 0xb8]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov r12d, eax
jmp case.default.0x18001aa4d
mov eax, 0x62
mov word [rbp + 0xc6], ax
mov eax, 0x73
mov word [rbp + 0xc7], ax
jmp case.default.0x18001aa4d
mov eax, 0x50
mov word [rbp + 0xb8], ax
mov eax, 0x53
mov word [rbp + 0xb9], ax
mov eax, 0x5f
mov word [rbp + 0xba], ax
jmp case.default.0x18001aa4d
mov rcx, qword [rbp - 8]
call sub.RPCRT4.dll_MesHandleFree
inc edi
mov edx, 0
sub rsi, 1
jne 0x18001aa30
mov byte [rsp + 0x40], r14b
xor r13d, r13d
mov r14d, dword [rbp - 0x70]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x18001abc9
call sub.RPCRT4.dll_MesHandleFree
dec r14d
mov dword [rbp - 0x70], r14d
cmp r14d, 0x12a
ja 0x18001a9e5
mov r13, qword [rbp + 0x70]
mov r14, qword [rbp]
mov edi, dword [rsp + 0x70]
mov edx, dword [rsp + 0x48]
mov bl, 1
mov ecx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x50]
jmp 0x18001b13e
mov eax, dword [rsp + 0x74]
cmp eax, dword [rbp - 0x58]
je 0x18001b13e
mov esi, 0x1b
cmp esi, 0x1b
ja case.0x18001ac31.9
lea r8, [0x180000000]
mov eax, esi
mov ecx, dword [r8 + rax*4 + 0x1b344]
add rcx, r8
jmp rcx
mov byte [rsp + 0x41], 1
jmp case.0x18001ac31.9
mov r8d, 1
lea rdx, [0x18006663b]
lea rcx, [rbp + 0xb2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, dword [rsp + 0x48]
mov byte [rbp + 0xb3], 0x35
jmp case.0x18001ac31.9
mov eax, 0x2b
mov word [rbp + 0xe5], ax
jmp case.0x18001ac31.9
mov eax, 0x70
mov word [rbp + 0xe2], ax
jmp case.0x18001ac31.9
mov eax, 0x70
mov word [rbp + 0xde], ax
mov eax, 0x7020
mov word [rbp + 0xdf], ax
jmp case.0x18001ac31.9
mov r8d, 2
mov byte [rbp + 0xab], 0
lea rdx, [0x180066669]
lea rcx, [rbp + 0xab]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, dword [rsp + 0x48]
mov byte [rbp + 0xad], 0
jmp case.0x18001ac31.9
movzx eax, byte [rsp + 0x54]
xor r8d, r8d
cmp dword [rbp + 0x20], r8d
mov ecx, r8d
cmove ecx, eax
mov byte [rsp + 0x54], cl
test dl, dl
je case.0x18001ac31.9
mov edi, 0x46
nop word [rax + rax]
mov eax, edi
sub eax, 0x43
je 0x18001ad3a
sub eax, 1
je 0x18001ad34
sub eax, 1
je 0x18001ad1c
cmp eax, 1
jne 0x18001ad4b
mov qword [rbp + 0x68], r8
jmp 0x18001ad4b
lea r8, [rbp + 0x68]
mov edx, r13d
lea rcx, [rbp + 0xa8]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rbp - 0x78], eax
jmp 0x18001ad48
mov rcx, qword [rbp + 0x78]
jmp 0x18001ad3e
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x18001ad4b
call sub.RPCRT4.dll_MesHandleFree
xor r8d, r8d
dec edi
cmp edi, 0x42
ja 0x18001ad00
mov edx, dword [rsp + 0x48]
jmp case.0x18001ac31.9
mov eax, 0x70
mov word [rbp + 0xd0], ax
mov eax, 0x7033
mov word [rbp + 0xd5], ax
mov dword [rbp + 0xd1], 0x70367035
jmp case.0x18001ac31.9
movzx eax, byte [rsp + 0x41]
xor r8d, r8d
cmp dword [rbp - 0x74], r8d
mov ecx, r8d
mov qword [rbp + 0x10], r8
cmove ecx, eax
mov byte [rsp + 0x41], cl
jmp case.0x18001ac31.9
xor eax, eax
mov r13, 0xffffffffffffffff
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0xa8]
nop dword [rax + rax]
inc r13
cmp byte [rax + r13], 0
jne 0x18001adc0
mov qword [rbp + 0x70], r13
lea rax, [rbp + 0xd0]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x18001ade0
mov qword [rbp], r14
jmp case.0x18001ac31.9
mov eax, 0x70
mov dl, 1
mov word [rbp + 0xe6], ax
mov byte [rsp + 0x54], dl
jmp 0x18001afec
mov eax, 0x3a
mov word [rbp + 0xdb], ax
jmp case.0x18001ac31.9
mov eax, 0x70
mov word [rbp + 0xdc], ax
mov eax, 0x27
mov word [rbp + 0xdd], ax
jmp case.0x18001ac31.9
mov eax, 0x70
mov word [rbp + 0xe4], ax
jmp case.0x18001ac31.9
mov byte [rbp + 0xb4], 0
jmp case.0x18001ac31.9
xor eax, eax
mov qword [rbp + 0x78], rax
jmp case.0x18001ac31.9
mov eax, 0x3c
mov word [rbp + 0xd7], ax
mov dword [rbp + 0xd8], 0x703970
jmp case.0x18001ac31.9
lea r9, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov edx, dword [rsp + 0x48]
mov dword [rbp - 0x74], eax
jmp case.0x18001ac31.9
mov r8d, 1
lea rdx, [0x18006668d]
lea rcx, [rbp + 0xa8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov edx, dword [rsp + 0x48]
mov eax, 0x6275
mov word [rbp + 0xa9], ax
jmp case.0x18001ac31.9
mov byte [rbp + 0xa8], 0
jmp case.0x18001ac31.9
mov eax, 0x2e
mov word [rbp + 0xe3], ax
jmp case.0x18001ac31.9
xor r8d, r8d
mov rax, r11
mov qword [r11 + 0x10], r8
cmp qword [r11 + 0x18], 0x10
jb 0x18001aefa
mov rax, qword [r11]
mov byte [rax], r8b
mov dword [rbp - 0x80], r8d
mov dword [rbp - 0x7c], r8d
jmp case.0x18001ac31.9
mov eax, 0x2d
mov word [rbp + 0xe1], ax
jmp case.0x18001ac31.9
mov r8d, 5
lea rdx, [0x1800666c4]
lea rcx, [rbp + 0xa8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov edx, dword [rsp + 0x48]
jmp case.0x18001ac31.9
lea r9, [rbp + 0x78]
mov edx, r13d
lea r8, [rbp - 0x80]
lea rcx, [rbp + 0xa8]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
lea r9, [rbp + 0x10]
mov dword [rbp - 0x78], eax
lea r8, [rbp - 0x7c]
mov edx, r14d
lea rcx, [rbp + 0xd0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov edx, dword [rsp + 0x48]
mov dword [rbp + 0x20], eax
jmp case.0x18001ac31.9
cmp byte [rsp + 0x41], 0
je 0x18001afdd
mov edi, 0xc
xor r14d, r14d
mov eax, edi
sub eax, 0xa
je 0x18001afbd
sub eax, 1
je 0x18001afa1
cmp eax, 1
jne 0x18001afce
mov qword [rbp + 0x88], r14
jmp 0x18001afce
lea r8, [rbp + 0x88]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rbp + 0x80]
mov dword [rbp - 0x74], eax
jmp 0x18001afc4
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x18001afce
call sub.RPCRT4.dll_MesHandleFree
dec edi
cmp edi, 9
ja 0x18001af87
mov r14, qword [rbp]
mov edx, dword [rsp + 0x48]
cmp dword [rbp - 0x78], 0
mov eax, 0
movzx edx, dl
cmovne edx, eax
mov dword [rsp + 0x48], edx
mov r11, qword [rbp - 0x50]
dec esi
lea eax, [rsi + 0x10b]
cmp eax, 0x10a
ja 0x18001ac14
mov edi, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x50]
jmp 0x18001b13e
cmp qword [rbp + 8], 0
je case.0x18001a2e2.9
xor eax, eax
mov dword [rbp - 0x38], eax
jmp 0x18001b13e
cmp edi, 0x19491
ja 0x18001b0e7
je 0x18001b0b7
cmp edi, 0x7d0a
je 0x18001b0a1
cmp edi, 0xcabf
je 0x18001b08b
cmp edi, 0x12fa8
jne 0x18001b13e
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x98]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x50]
mov dword [rbp - 0x30], eax
jmp 0x18001b13e
xor r8d, r8d
mov eax, r8d
xchg qword [0x180072340], rax
mov qword [rbp - 0x40], r8
jmp 0x18001b13e
mov eax, 0x10000
cdq
idiv dword [rbp - 0x34]
mov edx, dword [rsp + 0x48]
mov dword [r8 + 0x38], eax
jmp 0x18001b13e
mov rax, qword [rbp + 8]
lea rdx, [rbp + 0xa0]
mov ecx, 0x128
mov qword [rbp + 0xa0], rax
call fcn.18000da50
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x50]
jmp 0x18001b13e
cmp edi, 0x1f97a
je 0x18001b125
cmp edi, 0x25e63
jne 0x18001b13e
cmp byte [rsp + 0x78], 0
je 0x18001b107
mov rcx, qword [rbp - 0x40]
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x50]
jmp 0x18001b13e
mov eax, dword [rsp + 0x78]
mov r8d, 0
cmp dword [rbp - 0x30], 0
movzx eax, al
cmovne eax, r8d
mov dword [rsp + 0x78], eax
imul eax, dword [rbp - 0x54], 0x6d
add edi, eax
mov dword [rsp + 0x70], edi
cmp edi, dword [rsp + 0x58]
ja case.0x18001a2e2.9
mov r8, qword [rbp - 0x68]
mov r11, qword [rbp - 0x50]
mov esi, dword [rsp + 0x7c]
jmp 0x18001a810
cmp byte [rsp + 0x54], 0
je 0x18001b1cb
mov edi, dword [rsp + 0x58]
mov ebx, 0x43
mov esi, dword [rsp + 0x58]
mov eax, ebx
sub eax, 0x41
je 0x18001b196
sub eax, 1
je 0x18001b18c
cmp eax, 1
jne 0x18001b1c4
mov esi, eax
jmp 0x18001b1c4
xor eax, eax
mov edi, eax
mov qword [rbp - 0x48], rax
jmp 0x18001b1c4
mov rcx, qword [rbp + 0x10]
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x48]
mov r8d, edi
mov dword [rsp + 0x20], r14d
mov edx, esi
call sub.RPCRT4.dll_MesBufferHandleReset
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x18001b1c4
call sub.RPCRT4.dll_MesHandleFree
dec ebx
cmp ebx, 0x40
ja 0x18001b177
xor al, al
jmp 0x18001a955