Function at 0x180005cc0
Capabilities:
Get file size
Manipulate user privileges
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
movaps xmmword [rsp + 0x170], xmm6
mov rax, qword [0x180080a28]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r12, qword [rbp + 0xe0]
lea r14d, [rcx + 0xd]
mov qword [rbp - 0x80], r9
mov r11, r8
mov r13, qword [rbp - 0x80]
mov r15, r9
mov rax, qword [rbp - 0x80]
mov r10d, ecx
mov qword [rbp - 0x58], r8
mov esi, ecx
mov r8, qword [rbp - 0x80]
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x48], rdx
mov dword [rsp + 0x64], ecx
cmp ecx, r14d
jae 0x180005ff9
lea edi, [rcx - 0x7a]
mov qword [rsp + 0x70], rax
mov rcx, qword [rbp - 0x80]
mov ebx, 0x36
mov eax, dword [rbp - 0x68]
mov qword [rbp - 0x28], rcx
mov dword [rsp + 0x60], eax
mov r10d, 0x34
lea r9d, [r10 + 0x2d]
cmp edi, 0x51
ja case.0x180005d84.2
lea rcx, [0x180000000]
movzx eax, byte [rcx + rdi + 0x6d50]
mov ecx, dword [rcx + rax*4 + 0x6d18]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, dword [r15]
lea rcx, [rbp - 0x68]
mov r8, r11
mov dword [rbp - 0x68], eax
mov edx, 0x2c
call fcn.18005d040
mov r8, qword [rbp - 0x20]
mov r13, rax
mov qword [rbp - 0x38], rax
jmp case.0x180005d84.2
xor eax, eax
mov qword [r12 + 4], rax
mov dword [r12], eax
jmp case.0x180005d84.2
test rdx, rdx
jne 0x180005e19
xor ecx, ecx
lea rax, str.fwkSetObserver
mov qword [rsp + 0x58], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x50], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x48], rcx
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x68], ecx
call fcn.18002b8a0
mov r8, qword [rbp - 0x20]
mov r11, qword [rbp - 0x58]
cmp dword [r11], 1
je case.0x180005d84.2
mov dword [rsp + 0x78], ILFindLastID
jmp case.0x180006b88.0
mov r9, qword [r11 + 8]
sub r9, qword [r15 + 8]
mov r10, qword [r11]
sub r10, qword [r15]
mov qword [rbp - 0x28], r10
mov qword [rsp + 0x70], r9
jmp 0x180005fdf
test r15, r15
jne 0x180005ea4
xor ecx, ecx
lea rax, str.search.htmlcustom
mov qword [rsp + 0x58], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x50], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x48], rcx
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x68], ecx
call fcn.18002b8a0
mov r8, qword [rbp - 0x20]
test r12, r12
jne case.0x180005d84.2
lea rax, str.n_diliyle_e
xor ecx, ecx
lea rdx, [0x180077149]
mov qword [rsp + 0x58], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x50], rcx
xor r8d, r8d
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x68], ecx
call fcn.18002b8a0
mov r8, qword [rbp - 0x20]
jmp case.0x180005d84.2
mov ecx, dword [r11 + 8]
mov r9, qword [rsp + 0x70]
mov dword [rsp + 0x60], ecx
jmp 0x180005fe3
test r11, r11
jne case.0x180005d84.2
lea rax, str.Parsing_config_file
jmp 0x180005eb4
mov word [rbp + 8], r9w
mov dword [rbp + 0xa], 0x720061
jmp case.0x180005d84.2
mov dword [rsp + 0x78], 1
jmp case.0x180005d84.2
cmp dword [r11 + 0x181c], 0x1000
jb 0x180005f9e
mov ebx, 0xb1
nop dword [rax]
mov eax, ebx
sub eax, 0xb1
je 0x180005f74
cmp eax, 3
je case.0x180006b88.0
jmp 0x180005f86
lea rcx, str.VSGLayoutObject.CopyFieldsFrom
call fcn.180071d80
xor eax, eax
mov dword [rsp + 0x78], eax
add ebx, 3
cmp ebx, 0xb7
jb 0x180005f60
mov r8, qword [rbp - 0x20]
mov ebx, 0x36
mov r11, qword [rbp - 0x58]
movsxd rcx, dword [r11 + 0x181c]
movzx eax, byte [r15]
mov byte [rcx + r11 + 0x81c], al
inc dword [r11 + 0x181c]
jmp case.0x180005d84.2
mov r8, qword [r11 + 0x10]
sub r8, qword [r15 + 0x10]
mov qword [rbp - 0x20], r8
jmp case.0x180005d84.2
mov word [rbp + 0x14], r10w
jmp case.0x180005d84.2
mov dword [rbp + 0xe], 0x680063
mov word [rbp + 0x12], bx
mov r9, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x60]
mov r11, qword [rbp - 0x58]
inc esi
inc edi
cmp esi, r14d
jae 0x18000600f
mov rdx, qword [rbp - 0x48]
jmp 0x180005d51
mov r9, qword [rbp - 0x80]
mov ecx, dword [rbp - 0x68]
mov qword [rsp + 0x70], r9
mov qword [rbp - 0x28], rax
mov dword [rsp + 0x60], ecx
jmp 0x180006014
mov r10d, dword [rsp + 0x64]
imul eax, r10d, 0x730
mov edi, r10d
mov edx, 0x66
mov dword [rbp - 0x78], eax
mov esi, dword [rbp - 0x78]
cmp r10d, eax
ja 0x1800066b8
mov rbx, qword [rbp - 0x80]
xorps xmm6, xmm6
mov rdx, qword [rbp - 0x80]
mov r14d, dword [rbp - 0x50]
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x70], rdx
movabs rax, 0x6900570068
cmp edi, 0x45c8
ja 0x18000640f
je 0x1800063b4
cmp edi, 0xba
ja 0x180006218
je 0x180006203
mov eax, edi
sub eax, 0x7a
je 0x1800061f6
sub eax, 0x10
je 0x180006182
sub eax, 0x10
je 0x1800060a6
cmp eax, 0x10
jne 0x18000664f
mov eax, dword [r15 + 8]
mov dword [rsp + 0x68], eax
jmp 0x18000664f
mov eax, dword [r11 + 4]
lea rcx, [rbp - 0x60]
xor r9d, r9d
mov dword [rbp - 0x60], eax
xor r8d, r8d
lea edx, [r9 + 0x69]
call fcn.1800084d0
test eax, eax
je 0x1800060e2
mov eax, dword [r15 + 4]
lea rcx, [rbp - 0x60]
xor r9d, r9d
mov dword [rbp - 0x60], eax
xor r8d, r8d
lea edx, [r9 + 0x69]
call fcn.1800084d0
test eax, eax
jne 0x18000610d
mov ecx, reloc.SHELL32.dll_ILAppendID
mov eax, ecx
sub eax, 0x9a
je 0x1800060fb
cmp eax, 1
je case.0x180006b88.0
jmp 0x180006103
mov dword [rsp + 0x78], reloc.SHELL32.dll_ILFindLastID
inc ecx
cmp ecx, 0x9c
jb 0x1800060e7
mov rax, qword [rbp - 0x58]
mov rcx, qword [r15 + 8]
mov rax, qword [rax + 8]
mov r8, qword [rcx + 8]
mov rdx, qword [rax + 8]
sub r8, rdx
movzx ecx, byte [rdx]
movzx eax, byte [rdx + r8]
sub ecx, eax
jne 0x180006137
inc rdx
test eax, eax
jne 0x180006124
test ecx, ecx
je 0x180006618
mov ecx, 0xfe
nop dword [rax]
nop dword [rax + rax]
mov eax, ecx
sub eax, 0xfd
je case.0x180006b88.0
cmp eax, 1
jne 0x18000616a
mov dword [rsp + 0x78], ILFindLastID
dec ecx
cmp ecx, 0xfc
ja 0x180006150
mov rdx, qword [rbp - 0x70]
mov r10d, dword [rsp + 0x64]
jmp 0x18000664f
test r13, r13
je 0x18000618e
cmp dword [r13], 5
je 0x1800061e9
mov ebx, 0xba
mov eax, ebx
sub eax, 0xba
je 0x1800061a7
cmp eax, 0x3e
je case.0x180006b88.0
jmp 0x1800061d5
test r13, r13
je 0x1800061b2
mov eax, dword [r13]
jmp 0x1800061b7
mov eax, 0xa
movsxd rdx, eax
lea rcx, str.Granulerate_denominator
lea rax, [0x180000000]
mov rdx, qword [rax + rdx*8 + 0x80210]
call fcn.180071d80
add ebx, 0x3e
cmp ebx, 0x136
jb 0x180006193
mov rdx, qword [rbp - 0x70]
mov r10d, dword [rsp + 0x64]
mov eax, dword [r13 + 0x10]
mov dword [r12], eax
jmp 0x18000664f
lea rdx, [r8 + r9]
mov qword [rbp - 0x70], rdx
jmp 0x18000664f
mov eax, 0x2d
mov dword [rbp + 0x18], 0x620063
mov word [rbp + 0x16], ax
jmp 0x18000664f
cmp edi, 0xca
je case.0x180006b88.0
cmp edi, 0x3748
je 0x18000623d
cmp edi, 0x3e88
je 0x180006646
jmp 0x18000664f
test rdx, rdx
jne 0x18000664f
mov ebx, 0x1a
nop dword [rax + rax]
cmp ebx, 0xeba
ja 0x18000634f
je 0x180006328
cmp ebx, 0x1a
je 0x180006322
cmp ebx, 0x3c2
je 0x180006302
cmp ebx, 0x76a
je 0x1800062c9
cmp ebx, 0xb12
jne 0x180006394
movsd xmm0, qword [str.mati]
lea rdx, [0x1800792c4]
movzx eax, word [0x1800792c0]
lea rcx, [rbp + 0x52]
mov r8d, 3
movsd qword [rbp + 0x4a], xmm0
mov word [rbp + 0x52], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movabs rax, 0x6900570068
jmp 0x180006394
lea rcx, [rbp + 0x38]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800062d1
movzx eax, word [0x1800792d8]
movsd xmm0, qword [str.hAni]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
movabs rax, 0x6900570068
jmp 0x180006394
mov eax, dword [0x1800792b0]
mov dword [rbp + 0x3e], eax
movzx eax, word [0x1800792b4]
mov word [rbp + 0x42], ax
movabs rax, 0x6900570068
jmp 0x180006394
mov qword [rbp + 0x38], rax
jmp 0x180006394
lea rcx, [rbp + 0x38]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180006330
mov eax, dword [0x18007727c]
mov dword [rcx], eax
movabs rax, 0x6900570068
jmp 0x180006394
cmp ebx, 0x160a
je 0x18000638d
cmp ebx, 0x19b2
je 0x18000636d
cmp ebx, 0x1d5a
je case.0x180006b88.0
jmp 0x180006394
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RemoveUsersFromEncryptedFile]
movabs rax, 0x6900570068
movsd qword [rsp + 0x78], xmm6
jmp 0x180006394
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
add ebx, 0x3a8
cmp ebx, 0x20e8
jbe 0x180006250
mov rdx, qword [rbp - 0x70]
mov r10d, dword [rsp + 0x64]
jmp 0x18000664f
xor r9d, r9d
xor r8d, r8d
mov edx, SHSetInstanceExplorer
xor ecx, ecx
call fcn.18004f620
mov qword [rbp - 0x40], rax
test rax, rax
jne 0x180006618
mov ecx, 0x20
cmp ecx, 0x20
je 0x1800063eb
cmp ecx, 0xd0
je case.0x180006b88.0
jmp 0x1800063f3
mov dword [rsp + 0x78], ILFindLastID
add ecx, 0xb0
cmp ecx, 0x180
jb 0x1800063d8
mov rdx, qword [rbp - 0x70]
mov r10d, dword [rsp + 0x64]
jmp 0x18000664f
cmp edi, 0x8af6
ja 0x1800065af
je 0x18000654d
cmp edi, 0x4d08
je 0x180006457
cmp edi, 0x5448
je 0x18000644b
cmp edi, 0x7c86
jne 0x18000664f
mov eax, dword [r13 + 0x18]
mov dword [r12 + 8], eax
jmp 0x18000664f
mov dword [rbp + 0x1c], 0x2d007a
jmp 0x18000664f
mov rdx, r15
cmp ecx, dword [rsp + 0x68]
jne 0x180006487
mov dword [r12 + 8], ecx
mov r9d, 0x54
mov rcx, r11
mov r8, r12
call fcn.18002c7e0
mov rdx, qword [rbp - 0x70]
mov r14d, eax
mov r10d, dword [rsp + 0x64]
jmp 0x18000664f
xor eax, eax
mov r9d, 0x142
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, r11
mov qword [rsp + 0x20], rax
call fcn.18003f0a0
cmp eax, 0xffffffff
jne 0x1800064fb
mov r13d, dword [rsp + 0x68]
mov ebx, 0xb2
mov eax, ebx
sub eax, 0xb2
je 0x1800064da
cmp eax, 1
jne 0x1800064df
mov r9, qword [rbp - 0x58]
mov r8, r15
mov edx, 0x94
mov rcx, r12
call fcn.180057660
mov r14d, eax
jmp 0x1800064df
mov dword [r12 + 8], r13d
inc ebx
cmp ebx, 0xb4
jb 0x1800064b3
mov r13, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x70]
mov r10d, dword [rsp + 0x64]
jmp 0x18000664f
mov r13d, dword [rsp + 0x60]
mov ebx, 0x10b
mov eax, ebx
sub eax, 0x10a
je 0x18000651a
cmp eax, 1
jne 0x180006531
mov dword [r12 + 8], r13d
jmp 0x180006531
mov r8, qword [rbp - 0x58]
mov r9, r15
mov edx, 0x94
mov rcx, r12
call fcn.180057660
mov r14d, eax
dec ebx
cmp ebx, 0x109
ja 0x180006505
mov r13, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x70]
mov r10d, dword [rsp + 0x64]
jmp 0x18000664f
lea rcx, [rbp - 0x10]
call qword [0x1800831a0]
mov esi, eax
test eax, eax
je 0x180006618
mov ebx, 0x125
nop word [rax + rax]
mov ecx, ebx
sub ecx, 0x124
je 0x180006674
cmp ecx, 1
jne 0x180006597
mov rcx, qword [rbp - 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa4
call fcn.180046c90
dec ebx
cmp ebx, 0x123
ja 0x180006570
mov rdx, qword [rbp - 0x70]
mov r10d, dword [rsp + 0x64]
jmp 0x18000664f
cmp edi, 0x9966
je 0x18000662e
cmp edi, 0xa7d6
je 0x180006623
cmp edi, 0xd024
jne 0x18000664f
mov rdx, qword [r11 + 8]
mov r8d, reloc.SHELL32.dll_ILFindLastID
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rdx + 0x10]
call qword [0x180083210]
mov esi, eax
test eax, eax
jne 0x18000667d
mov rax, qword [rbp - 0x58]
lea rdx, [r15 + 0x10]
mov r9, qword [rbp - 0x10]
mov r8, rbx
mov dword [rsp + 0x20], 1
mov rcx, qword [rax + 0x28]
call qword [0x1800832e0]
mov esi, eax
test eax, eax
jne 0x18000667d
mov rdx, qword [rbp - 0x70]
mov r10d, dword [rsp + 0x64]
jmp 0x18000664f
mov eax, 0x6f
mov word [rbp + 0x20], ax
jmp 0x18000664f
mov eax, 0xdc
cmp eax, 0xdc
je 0x1800066ae
add eax, 0x422c
cmp eax, 0x422c
jbe 0x180006633
mov eax, dword [r13 + 0x14]
mov dword [r12 + 4], eax
imul eax, r10d, 0x73
add edi, eax
cmp edi, dword [rbp - 0x78]
ja 0x18000669f
mov rbx, qword [rbp - 0x40]
mov ecx, dword [rsp + 0x60]
mov r8, qword [rbp - 0x20]
mov r9, qword [rsp + 0x70]
mov r11, qword [rbp - 0x58]
jmp 0x180006049
mov dword [rsp + 0x78], esi
jmp case.0x180006b88.0
mov ebx, dword [rbp - 0x78]
mov edi, ILAppendID
mov r14, qword [rbp - 0x48]
dec edi
mov r13, qword [rbp - 0x70]
mov edx, 0x66
mov r15, qword [rbp - 0x40]
mov r10d, dword [rsp + 0x64]
jmp 0x1800066ce
mov r15, qword [rbp - 0x40]
mov edx, 0x66
mov r13, qword [rbp - 0x70]
jmp 0x1800066c4
mov dword [rsp + 0x78], r14d
jmp case.0x180006b88.0
mov r15, qword [rbp - 0x80]
mov r13, qword [rbp - 0x80]
mov qword [rbp - 0x40], r15
mov ebx, dword [rbp - 0x78]
mov edi, r10d
mov r14, qword [rbp - 0x48]
lea eax, [r10 - 0xd]
cmp edi, eax
jbe 0x18000690e
lea eax, [rdi - 0x7a]
cmp eax, 0x40
ja case.0x180006701.123
lea r8, [0x180000000]
movzx eax, byte [r8 + rax + 0x6ddc]
mov ecx, dword [r8 + rax*4 + 0x6da4]
add rcx, r8
jmp rcx
mov rcx, qword [rbp - 0x10]
call qword [0x1800831b0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa4
mov rcx, r15
call fcn.180046c90
mov r10d, dword [rsp + 0x64]
dec edi
mov r15, qword [rbp - 0x40]
mov edx, 0x66
jmp 0x1800066ce
mov r15, qword [rbp - 0x40]
dec edi
mov r10d, dword [rsp + 0x64]
mov edx, 0x66
mov dword [rbp + 0x28], 0x740065
jmp 0x1800066ce
mov rcx, qword [rbp - 0x10]
call qword [0x180083220]
mov r15, qword [rbp - 0x40]
dec edi
mov r10d, dword [rsp + 0x64]
mov ebx, eax
mov edx, 0x66
jmp 0x1800066ce
mov r15, qword [rbp - 0x40]
dec edi
mov r10d, dword [rsp + 0x64]
mov edx, 0x66
mov dword [rbp + 0x2c], 0x62002d
jmp 0x1800066ce
mov r15, qword [rbp - 0x40]
dec edi
mov r10d, dword [rsp + 0x64]
mov edx, 0x66
mov dword [rbp + 0x24], 0x730066
jmp 0x1800066ce
mov r15, qword [rbp - 0x40]
dec edi
mov r10d, dword [rsp + 0x64]
mov word [rbp + 0x22], dx
mov edx, 0x66
jmp 0x1800066ce
mov r15, qword [rbp - 0x40]
mov edi, ILAppendID
mov r10d, dword [rsp + 0x64]
dec edi
mov dword [r14], ebx
mov edx, 0x66
jmp 0x1800066ce
mov rcx, qword [r15]
call qword [0x180083220]
mov rcx, qword [r15]
mov edx, ebx
sub edx, eax
add rdx, r12
call qword [0x180083228]
mov esi, eax
test eax, eax
jne 0x18000685f
mov r15, qword [rbp - 0x40]
lea edx, [rax + 0x66]
mov r10d, dword [rsp + 0x64]
dec edi
jmp 0x1800066ce
mov r15, qword [rbp - 0x40]
dec edi
mov r10d, dword [rsp + 0x64]
mov edx, 0x66
mov dword [rsp + 0x78], esi
jmp 0x1800066ce
mov r15, qword [rbp - 0x40]
xor eax, eax
mov r10d, dword [rsp + 0x64]
mov esi, eax
dec edi
lea edx, [rax + 0x66]
jmp 0x1800066ce
mov rdx, qword [rbp - 0x48]
cmp dword [rdx], ebx
jae 0x18000688b
mov ecx, 0x49
nop dword [rax]
mov eax, ecx
sub eax, 0x49
je 0x180006879
cmp eax, 0x50
jne 0x180006880
mov r14, rdx
mov r15, qword [rbp - 0x40]
mov edi, ILAppendID
mov r10d, dword [rsp + 0x64]
dec edi
mov edx, 0x66
jmp 0x1800066ce
mov dword [rdx], ebx
mov esi, 6
add ecx, 0x50
cmp ecx, 0xe9
jb 0x180006850
xor ecx, ecx
mov eax, ebx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
mov qword [rsp + 0x40], r12
xor r8d, r8d
mov qword [rsp + 0x38], rcx
xor edx, edx
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x1e8
call fcn.180033a80
mov r14, qword [rbp - 0x48]
mov r15, qword [rbp - 0x40]
dec edi
mov r10d, dword [rsp + 0x64]
mov edx, 0x66
jmp 0x1800066ce
xorps xmm1, xmm1
mov rax, r13
sub rax, qword [rbp - 0x28]
xorps xmm0, xmm0
cvtsi2sd xmm0, r13
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x18007b7c0]
divsd xmm1, xmm0
movsd qword [rsp + 0x78], xmm1
jmp case.0x180006b88.0
mov ebx, dword [rsp + 0x64]
lea edi, [rbx + 0x666]
mov dword [rsp + 0x60], edi
cmp ebx, edi
jae case.0x180006b88.0
mov r13, qword [rbp - 0x80]
mov ecx, 0x73
mov esi, dword [rbp - 0x50]
mov r14d, dword [rbp - 0x50]
mov r15, qword [rbp - 0x80]
mov r12, qword [rbp - 0x80]
mov edi, dword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
cmp ebx, 0x42c
ja 0x180006ac5
je 0x180006a9b
cmp ebx, 0x234
ja 0x18000699b
je 0x180006a35
mov eax, ebx
sub eax, 0xba
je 0x18000698b
sub eax, 0x7e
je 0x180006980
cmp eax, 0x7e
je 0x180006b20
jmp 0x180006a31
xor eax, eax
mov word [rbp + 0x36], ax
jmp 0x180006a31
mov dword [rbp + 0x30], 0x740069
mov word [rbp + 0x34], cx
jmp 0x180006a31
cmp ebx, 0x2b2
je 0x180006a94
cmp ebx, 0x3ae
jne 0x180006a35
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r10, qword [rbp - 0x80]
mov ecx, eax
mov dword [rsp + 0x68], eax
mov rdx, qword [r10 + 0x10]
cmp rcx, rdx
ja 0x1800069ea
mov qword [r10 + 0x10], rcx
mov rdx, r10
cmp qword [r10 + 0x18], 0x10
jb 0x1800069e2
mov rdx, qword [r10]
mov byte [rdx + rcx], 0
mov edi, eax
jmp 0x180006a2c
mov r8, qword [r10 + 0x18]
mov rdi, rcx
mov rax, r8
sub rdi, rdx
sub rax, rdx
cmp rdi, rax
ja 0x180006a78
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp r8, 0x10
jb 0x180006a0f
mov rax, qword [r10]
lea rbx, [rax + rdx]
mov r8, rdi
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
mov edi, dword [rsp + 0x68]
mov ebx, dword [rsp + 0x64]
mov ecx, 0x73
mov eax, dword [rsp + 0x60]
add ebx, 0x7e
mov dword [rsp + 0x64], ebx
cmp ebx, eax
jb 0x180006944
mov rax, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180072740
mov rbx, qword [rsp + 0x1c0]
movaps xmm6, xmmword [rsp + 0x170]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, r10
call fcn.180003070
mov edi, dword [rsp + 0x68]
jmp 0x180006a2c
xor edx, edx
mov dword [rbp - 0x2c], edx
jmp 0x180006a35
mov rcx, qword [rbp - 0x80]
xor edx, edx
call fcn.180004630
mov rdx, rax
lea r9, [rbp - 0x2c]
xor eax, eax
mov r8d, edi
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x180006a2c
mov eax, ebx
sub eax, 0x4aa
je 0x180006d07
sub eax, 0x7e
je 0x180006cf9
sub eax, 0x7e
je 0x180006c47
sub eax, 0x7e
je 0x180006bec
cmp eax, 0x7e
jne 0x180006a31
mov ecx, reloc.SHELL32.dll_ILAppendID
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x99
je case.0x180006b88.0
cmp eax, 1
jne 0x180006b16
mov byte [rsp + 0x78], al
dec ecx
cmp ecx, 0x98
ja 0x180006b00
mov rax, qword [rbp - 0x58]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x180006b31
mov rcx, qword [rax]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180006a2c
mov ebx, 6
nop dword [rax]
cmp ebx, 6
ja case.default.0x180006b88
lea rax, [0x180000000]
mov ecx, ebx
mov edx, dword [rax + rcx*4 + 0x6e20]
add rdx, rax
jmp rdx
mov eax, dword [rbp - 0x78]
lea r9, [rbp - 8]
mov rdx, qword [rbp - 0x28]
xor r8d, r8d
mov rcx, qword [rbp - 0x40]
mov dword [rsp + 0x20], eax
call sub.ADVAPI32.dll_LsaRemoveAccountRights
jmp case.default.0x180006b88
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], rax
jmp case.default.0x180006b88
mov edx, dword [rbp - 0x60]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov dword [rbp - 0x78], 1
jmp case.default.0x180006b88
mov byte [rsp + 0x78], 0
jmp case.default.0x180006b88
xor eax, eax
mov qword [rbp - 0x40], rax
jmp case.default.0x180006b88
xor eax, eax
mov dword [rbp - 0x60], eax
dec ebx
lea eax, [rbx + 0x3f]
cmp eax, 0x3e
ja 0x180006b70
jmp 0x180006a28
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 8]
call qword [sym.imp.SHELL32.dll_SHIsFileAvailableOffline]
cmp qword [rbp - 0x48], 0
jne 0x180006a2c
mov ebx, 0x46
nop word [rax + rax]
mov eax, ebx
sub eax, 0x44
je 0x180006c2f
sub eax, 1
je 0x180006c28
cmp eax, 1
jne 0x180006c3b
xor eax, eax
mov dword [rbp - 0x68], eax
jmp 0x180006c3b
mov esi, 0x200
jmp 0x180006c3b
mov edx, esi
lea rcx, [rbp - 0x68]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
dec ebx
cmp ebx, 0x43
ja 0x180006c10
jmp 0x180006a28
lea rcx, [rbp - 0x30]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov qword [rbp - 0x48], rax
cmp edi, dword [rbp - 0x2c]
je 0x180006a2c
mov ebx, 0x1b
cmp ebx, 0x143
ja 0x180006cb3
je 0x180006ce5
mov ecx, ebx
sub ecx, 0x1b
je 0x180006cac
sub ecx, 0x4a
je 0x180006ca5
sub ecx, 0x4a
je 0x180006c89
cmp ecx, 0x4a
jne 0x180006ce5
lea r14d, [rcx - 0x49]
jmp 0x180006ce5
mov r10, qword [rbp - 0x80]
xor eax, eax
mov qword [r10 + 0x10], rax
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x180006ca0
mov rax, qword [r10]
mov byte [rax], 0
jmp 0x180006ce5
xor eax, eax
mov r15d, eax
jmp 0x180006ce5
xor eax, eax
mov r12d, eax
jmp 0x180006ce5
mov eax, ebx
sub eax, 0x18d
je 0x180006cd3
sub eax, 0x4a
je 0x180006ccc
cmp eax, 0x4a
je case.0x180006b88.0
jmp 0x180006ce5
mov byte [rsp + 0x78], 0
jmp 0x180006ce5
mov r9d, r14d
lea r8, [rbp - 0x20]
mov rdx, r15
mov rcx, r12
call sub.ADVAPI32.dll_LsaAddAccountRights
add ebx, 0x4a
cmp ebx, 0x26b
jb 0x180006c63
jmp 0x180006a28
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180006a2c
xor eax, eax
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], al
mov dword [rbp - 0x50], eax
jmp 0x180006a31