Function at 0x140011d10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov r14, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov edi, r15d
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [r14]
add rbx, 0x468
mov qword [rsp + 0x48], rbx
mov rcx, rbx
call fcn.14003438c
test eax, eax
je 0x140011d8f
mov ecx, eax
call fcn.140033e48
nop
mov rax, qword [r14]
mov rdx, qword [rax + 0x538]
mov rcx, qword [rax + 0x540]
sub rcx, rdx
sar rcx, 5
cmp rcx, 2
jae 0x140011dd0
mov rcx, rbx
call fcn.1400343b0
test eax, eax
je 0x140011dc1
mov ecx, eax
call fcn.140033e48
nop
inc edi
cmp edi, 0x12c
jl 0x140011d61
jmp 0x140012581
add rdx, 0x20
lea rcx, [rbp - 0x68]
call fcn.140012e20
nop
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r15w
mov r8d, 5
lea rdx, str.flxgq
lea rcx, [rbp - 0x48]
call fcn.140002170
nop
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], r15w
mov r8d, 5
lea rdi, [0x1400909f0]
mov rdx, rdi
lea rcx, [rbp - 8]
call fcn.140002170
nop
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r15w
mov r8d, 4
lea rdx, str.DXTD
lea rcx, [rbp - 0x28]
call fcn.140002170
nop
mov rax, qword [r14]
mov rcx, qword [rax + 0x558]
lea r8, [rcx + 8]
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
lea rdx, [rbp + 0x18]
mov rcx, qword [rcx]
call fcn.14000e440
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140011ec4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ebf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125c4
call fcn.1400357d4
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r15w
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x140011f16
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125ca
call fcn.1400357d4
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], r15w
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r8, qword [rbp - 0x68]
mov r12, qword [rbp + 0x30]
mov r13, qword [rbp + 0x18]
cmp qword [rbp - 0x58], 1
jne 0x140012126
mov edx, 1
lea rcx, [0x140090c74]
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140012126
add rcx, 2
sub rdx, 1
jne 0x140011f60
lea rdx, [rbp + 0x18]
cmp r12, 8
cmovae rdx, r13
mov r9, qword [rbp + 0x28]
cmp r9, 5
jne 0x140011fac
mov rcx, r9
sub rdx, rdi
movzx eax, word [rdi]
cmp word [rdx + rdi], ax
jne 0x140011fac
add rdi, 2
sub rcx, 1
jne 0x140011f94
jmp 0x1400123be
lea r8, [rbp + 0x18]
cmp r12, 8
cmovae r8, r13
lea r10, str.false
cmp r9, 5
jne 0x140011fe9
mov rdx, r9
mov rcx, r10
sub r8, r10
nop
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140011fe9
add rcx, 2
sub rdx, 1
jne 0x140011fd0
jmp 0x1400123be
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r15w
mov r8d, 5
mov rdx, r10
lea rcx, [rsp + 0x78]
call fcn.140002170
nop
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r15w
mov r8d, 4
lea rdx, str.DXTD
lea rcx, [rsp + 0x58]
call fcn.140002170
mov rax, qword [r14]
mov rcx, qword [rax + 0x558]
mov r9, qword [rcx]
cmp qword [r9 + 0x18], 8
jb 0x140012052
mov r9, qword [r9]
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae r8, qword [rsp + 0x78]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
add rcx, 8
cmp qword [rcx + 0x18], 8
jb 0x140012081
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400120c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400120c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125d0
call fcn.1400357d4
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r15w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400123be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400123b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125be
jmp 0x1400123b9
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r15w
mov r8d, 4
lea rdx, str.DXTD
lea rcx, [rsp + 0x78]
call fcn.140002170
mov rax, qword [r14]
mov rcx, qword [rax + 0x558]
mov r9, qword [rcx]
cmp qword [r9 + 0x18], 8
jb 0x140012167
mov r9, qword [r9]
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r8, qword [rbp - 0x68]
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
add rcx, 8
cmp qword [rcx + 0x18], 8
jb 0x140012193
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x1400121db
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400121d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125d6
call fcn.1400357d4
nop
movdqa xmm0, xmmword [0x1400971c0]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r15w
mov dword [rsp + 0x30], 3
mov rdx, qword [rbp - 0x58]
add rdx, 0x1c
lea rcx, [rsp + 0x58]
call fcn.140002e70
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1c
jb 0x140012254
lea rsi, [rcx + 0x1c]
mov qword [rsp + 0x68], rsi
lea rdi, [rsp + 0x58]
cmp rdx, 8
cmovae rdi, qword [rsp + 0x58]
lea rcx, [rdi + rcx*2]
mov r8d, 0x38
lea rdx, str.https:__flingtrainer.com_cn_
call fcn.140053e40
mov word [rdi + rsi*2], r15w
jmp 0x140012273
mov qword [rsp + 0x20], 0x1c
lea r9, str.https:__flingtrainer.com_cn_
mov edx, 0x1c
lea rcx, [rsp + 0x58]
call fcn.1400032f0
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r9, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x58]
mov r15, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x1400122d0
lea rax, [r15 + rsi]
mov qword [rsp + 0x68], rax
lea rdi, [rsp + 0x58]
cmp rcx, 8
cmovae rdi, qword [rsp + 0x58]
lea r8, [rsi + rsi]
lea rcx, [rdi + r15*2]
mov rdx, r9
call fcn.140053e40
lea rax, [r15 + rsi]
xor r15d, r15d
mov word [rdi + rax*2], r15w
jmp 0x1400122e5
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1400032f0
xor r15d, r15d
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x140012335
lea rsi, [rcx + 5]
mov qword [rsp + 0x68], rsi
lea rdi, [rsp + 0x58]
cmp rdx, 8
cmovae rdi, qword [rsp + 0x58]
lea rcx, [rdi + rcx*2]
mov r8d, 0xa
lea rdx, [0x140090c78]
call fcn.140053e40
mov word [rdi + rsi*2], r15w
lea rax, [rsp + 0x58]
jmp 0x140012354
mov qword [rsp + 0x20], 5
lea r9, [0x140090c78]
mov edx, 5
lea rcx, [rsp + 0x58]
call fcn.1400032f0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rbp - 0x48]
call fcn.140001f20
movups xmmword [rbp - 0x48], xmm6
movups xmmword [rbp - 0x38], xmm7
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400123be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400123b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125dc
call fcn.1400357d4
lea rdi, [0x1400b0b60]
mov qword [rsp + 0x50], rdi
mov rcx, rdi
call fcn.14003438c
test eax, eax
je 0x1400123de
mov ecx, eax
call fcn.140033e48
nop
mov rcx, qword [r14]
mov dword [rsp + 0x38], 0xa
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x30]
mov r8d, 4
lea rdx, [rsp + 0x38]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov r8d, 7
lea rdx, str.CHADURL
lea rcx, [rsp + 0x78]
call fcn.140002320
lea rdx, [rsp + 0x78]
mov rcx, qword [r14]
call fcn.14000c2d0
mov rcx, qword [r14]
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x30], 1
jne 0x14001248f
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x78]
call fcn.140012e20
mov rdx, rax
mov rcx, qword [r14]
call fcn.14000c390
nop
mov rcx, rdi
call fcn.1400343b0
test eax, eax
je 0x1400124a3
mov ecx, eax
call fcn.140033e48
nop
cmp r12, 8
jb 0x1400124df
lea rdx, [r12*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400124d6
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125e2
mov rcx, r13
call fcn.1400357d4
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140012520
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001251a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125e8
call fcn.1400357d4
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14001255c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012557
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400125b8
call fcn.1400357d4
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r15w
mov rcx, rbx
call fcn.1400343b0
test eax, eax
je 0x140012581
mov ecx, eax
call fcn.140033e48
nop
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.1400357b0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140056d64
nop
call fcn.140056d64
nop
call fcn.140056d64
nop
call fcn.140056d64
nop
call fcn.140056d64
nop
call fcn.140056d64
int3
call fcn.140056d64
nop
call fcn.140056d64
nop
call fcn.140056d64
int3