Function at 0x1400239b0
Capabilities:
Enumerate files on windows
Get disk information
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x518
mov qword [rsp + 0x268], r8
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x2c], ecx
mov qword [rsp + 0x108], r9
mov eax, dword [0x1402d7298]
cmp eax, dword [rsp + 0x2c]
jge 0x140023a73
xor edi, edi
lea r14, [rsp + 0x2a2]
mov r15, qword [sym.imp.KERNEL32.DLL_Sleep]
lea rsi, str.stock_at_DN_check_at
lea rbx, [rsp + 0x2a0]
jmp 0x140023a1e
mov eax, dword [0x1402d7298]
inc edi
cmp eax, dword [rsp + 0x2c]
jge 0x140023a73
mov ecx, 0x3e8
call r15
cmp edi, 0x258
jb 0x140023a10
mov rcx, rbx
mov rdx, rsi
mov r8, qword [rsp + 0x68]
call fcn.140013830
test byte [rsp + 0x2a0], 1
mov rcx, r14
je 0x140023a53
mov rcx, qword [rsp + 0x2b0]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x2a0], 1
je 0x140023a10
mov rcx, qword [rsp + 0x2b0]
call fcn.140073240
jmp 0x140023a10
mov eax, dword [0x1402d7298]
cmp eax, dword [rsp + 0x2c]
jne 0x14002534c
movabs r13, 0x7fffffffffffffef
movabs rdi, 0x1fffffffffffffff
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2a0], xmm0
mov qword [rsp + 0x2b0], 0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
xor ebp, ebp
lea rbx, [rsp + 0x30]
jmp 0x140023b3a
mov qword [rdx], rsi
add rdx, 8
mov qword [rsp + 0xb8], rdx
inc ebp
cmp ebp, 7
je 0x1400242e4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x2a8]
cmp rax, qword [rsp + 0x2b0]
jae 0x140023bc0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140023ba9
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rdx + 8]
mov r10, qword [r8]
mov qword [r10 + 8], r9
mov r9, qword [rdx + 8]
mov qword [r9], r10
mov r9, qword [rax]
mov qword [r9 + 8], r8
mov qword [r8], r9
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rsp + 0x2a8], rax
jmp 0x140023c40
lea rcx, [rsp + 0x2a0]
mov rdx, rbx
call fcn.140047490
cmp qword [rsp + 0x40], 0
je 0x140023c40
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x40], 0
cmp rsi, rbx
je 0x140023c40
nop word cs:[rax + rax]
mov r14, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
call fcn.140257dd0
mov qword [rsi + 0x10], 0
mov rcx, rsi
call fcn.140073240
mov rsi, r14
cmp r14, rbx
jne 0x140023c10
nop word cs:[rax + rax]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0x60]
jae 0x140023cc0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140023ca9
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rdx + 8]
mov r10, qword [r8]
mov qword [r10 + 8], r9
mov r9, qword [rdx + 8]
mov qword [r9], r10
mov r9, qword [rax]
mov qword [r9 + 8], r8
mov qword [r8], r9
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rsp + 0x58], rax
jmp 0x140023d30
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140047490
cmp qword [rsp + 0x40], 0
je 0x140023d30
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x40], 0
cmp rsi, rbx
je 0x140023d30
nop
mov r14, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
call fcn.140257dd0
mov qword [rsi + 0x10], 0
mov rcx, rsi
call fcn.140073240
mov rsi, r14
cmp r14, rbx
jne 0x140023d00
nop word cs:[rax + rax]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x78]
cmp rax, qword [rsp + 0x80]
jae 0x140023db0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140023d9c
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rdx + 8]
mov r10, qword [r8]
mov qword [r10 + 8], r9
mov r9, qword [rdx + 8]
mov qword [r9], r10
mov r9, qword [rax]
mov qword [r9 + 8], r8
mov qword [r8], r9
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [rsp + 0x78], rax
jmp 0x140023e20
lea rcx, [rsp + 0x70]
mov rdx, rbx
call fcn.140047490
cmp qword [rsp + 0x40], 0
je 0x140023e20
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x40], 0
cmp rsi, rbx
je 0x140023e20
nop
mov r14, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
call fcn.140257dd0
mov qword [rsi + 0x10], 0
mov rcx, rsi
call fcn.140073240
mov rsi, r14
cmp r14, rbx
jne 0x140023df0
nop word cs:[rax + rax]
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
mov qword [rax], 0
mov rdx, qword [rsp + 0x138]
mov rax, qword [rsp + 0x140]
cmp rdx, rax
jae 0x140023e60
mov qword [rdx], rsi
add rdx, 8
mov qword [rsp + 0x138], rdx
jmp 0x140023fbb
mov rcx, qword [rsp + 0x130]
mov r14, rdx
sub r14, rcx
mov r12, r14
sar r12, 3
lea r8, [r12 + 1]
cmp r8, rdi
ja 0x14002798e
sub rax, rcx
lea r9, [r13 + 9]
mov r15, rax
shr r15, 2
cmp r15, r8
cmovbe r15, r8
cmp rax, r9
cmovae r15, rdi
test r15, r15
je 0x140023ecc
cmp r15, rdi
ja 0x1400279a0
lea rcx, [r15*8]
call fcn.1400731c0
mov rcx, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x138]
jmp 0x140023ece
xor eax, eax
lea r8, [rax + r12*8]
mov qword [rax + r12*8], rsi
mov r10, rdx
sub r10, rcx
je 0x140023f8d
add r10, 0xfffffffffffffff8
cmp r10, 0x98
jae 0x140023ef4
mov r9, rdx
jmp 0x140023f70
add r14, rax
mov r9, rdx
sub r9, r14
cmp r9, 0x20
jae 0x140023f08
mov r9, rdx
jmp 0x140023f70
shr r10, 3
inc r10
mov r11, r10
and r11, 0xfffffffffffffffc
lea rsi, [r11*8]
sub r8, rsi
mov r9, rdx
sub r9, rsi
lea rsi, [rax + r12*8]
add rsi, 0xfffffffffffffff0
mov r14, r11
neg r14
xor r13d, r13d
nop dword [rax + rax]
movups xmm0, xmmword [rdx + r13*8 - 0x20]
movups xmm1, xmmword [rdx + r13*8 - 0x10]
movups xmmword [rsi + r13*8], xmm1
movups xmmword [rsi + r13*8 - 0x10], xmm0
add r13, 0xfffffffffffffffc
cmp r14, r13
jne 0x140023f40
cmp r10, r11
movabs r13, 0x7fffffffffffffef
je 0x140023f85
nop
mov rdx, qword [r9 - 8]
add r9, 0xfffffffffffffff8
mov qword [r8 - 8], rdx
add r8, 0xfffffffffffffff8
cmp r9, rcx
jne 0x140023f70
mov rcx, qword [rsp + 0x130]
lea rdx, [rax + r15*8]
lea rax, [rax + r12*8]
add rax, 8
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rdx
test rcx, rcx
je 0x140023fbb
call fcn.140073240
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
mov qword [rax], 0
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa0]
cmp rdx, rax
jae 0x140024000
mov qword [rdx], rsi
add rdx, 8
mov qword [rsp + 0x98], rdx
jmp 0x14002415b
mov rcx, qword [rsp + 0x90]
mov r12, rdx
sub r12, rcx
mov r14, r12
sar r14, 3
lea r8, [r14 + 1]
cmp r8, rdi
ja 0x140027974
sub rax, rcx
lea r9, [r13 + 9]
mov r15, rax
shr r15, 2
cmp r15, r8
cmovbe r15, r8
cmp rax, r9
cmovae r15, rdi
test r15, r15
je 0x14002406b
cmp r15, rdi
ja 0x1400279a5
lea rcx, [r15*8]
call fcn.1400731c0
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
jmp 0x14002406d
xor eax, eax
lea r8, [rax + r14*8]
mov qword [rax + r14*8], rsi
mov r10, rdx
sub r10, rcx
je 0x14002412d
add r10, 0xfffffffffffffff8
cmp r10, 0x98
jae 0x140024093
mov r9, rdx
jmp 0x140024110
add r12, rax
mov r9, rdx
sub r9, r12
cmp r9, 0x20
jae 0x1400240a7
mov r9, rdx
jmp 0x140024110
shr r10, 3
inc r10
mov r11, r10
and r11, 0xfffffffffffffffc
lea rsi, [r11*8]
sub r8, rsi
mov r9, rdx
sub r9, rsi
lea rsi, [rax + r14*8]
add rsi, 0xfffffffffffffff0
mov r12, r11
neg r12
xor r13d, r13d
nop word [rax + rax]
movups xmm0, xmmword [rdx + r13*8 - 0x20]
movups xmm1, xmmword [rdx + r13*8 - 0x10]
movups xmmword [rsi + r13*8], xmm1
movups xmmword [rsi + r13*8 - 0x10], xmm0
add r13, 0xfffffffffffffffc
cmp r12, r13
jne 0x1400240e0
cmp r10, r11
movabs r13, 0x7fffffffffffffef
je 0x140024125
nop
mov rdx, qword [r9 - 8]
add r9, 0xfffffffffffffff8
mov qword [r8 - 8], rdx
add r8, 0xfffffffffffffff8
cmp r9, rcx
jne 0x140024110
mov rcx, qword [rsp + 0x90]
lea rdx, [rax + r15*8]
lea rax, [rax + r14*8]
add rax, 8
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rdx
test rcx, rcx
je 0x14002415b
call fcn.140073240
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
mov qword [rax], 0
mov rdx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0xc0]
cmp rdx, rax
jb 0x140023b20
mov rcx, qword [rsp + 0xb0]
mov r12, rdx
sub r12, rcx
mov r14, r12
sar r14, 3
lea r8, [r14 + 1]
cmp r8, rdi
ja 0x140027981
sub rax, rcx
lea r9, [r13 + 9]
mov r15, rax
shr r15, 2
cmp r15, r8
cmovbe r15, r8
cmp rax, r9
cmovae r15, rdi
test r15, r15
je 0x1400241f3
cmp r15, rdi
ja 0x14002799b
lea rcx, [r15*8]
call fcn.1400731c0
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
jmp 0x1400241f5
xor eax, eax
lea r8, [rax + r14*8]
mov qword [rax + r14*8], rsi
mov r10, rdx
sub r10, rcx
je 0x1400242ad
add r10, 0xfffffffffffffff8
cmp r10, 0x98
jae 0x14002421b
mov r9, rdx
jmp 0x140024290
add r12, rax
mov r9, rdx
sub r9, r12
cmp r9, 0x20
jae 0x14002422f
mov r9, rdx
jmp 0x140024290
shr r10, 3
inc r10
mov r11, r10
and r11, 0xfffffffffffffffc
lea rsi, [r11*8]
sub r8, rsi
mov r9, rdx
sub r9, rsi
lea rsi, [rax + r14*8]
add rsi, 0xfffffffffffffff0
mov r12, r11
neg r12
xor r13d, r13d
nop
movups xmm0, xmmword [rdx + r13*8 - 0x20]
movups xmm1, xmmword [rdx + r13*8 - 0x10]
movups xmmword [rsi + r13*8], xmm1
movups xmmword [rsi + r13*8 - 0x10], xmm0
add r13, 0xfffffffffffffffc
cmp r12, r13
jne 0x140024260
cmp r10, r11
movabs r13, 0x7fffffffffffffef
je 0x1400242a5
nop
mov rdx, qword [r9 - 8]
add r9, 0xfffffffffffffff8
mov qword [r8 - 8], rdx
add r8, 0xfffffffffffffff8
cmp r9, rcx
jne 0x140024290
mov rcx, qword [rsp + 0xb0]
lea rdx, [rax + r15*8]
lea rax, [rax + r14*8]
add rax, 8
mov qword [rsp + 0xb0], r8
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rdx
test rcx, rcx
je 0x140023b2f
call fcn.140073240
jmp 0x140023b2f
lea rcx, [0x1402d72a0]
call fcn.1400741a0
mov rsi, qword [0x1402da2e8]
cmp rsi, qword [0x1402da2f0]
je 0x14002431d
lea rdx, [rsp + 0x2a0]
mov rcx, rsi
call fcn.140047890
add rsi, 0x18
mov qword [0x1402da2e8], rsi
jmp 0x140024331
lea rcx, [0x1402da2e0]
lea rdx, [rsp + 0x2a0]
call fcn.1400476e0
mov rsi, qword [0x1402da348]
cmp rsi, qword [0x1402da350]
je 0x140024406
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x138]
mov rax, qword [rsp + 0x130]
mov r14, rcx
sub r14, rax
sub rcx, rax
je 0x140024447
js 0x1400279f7
call fcn.1400731c0
sar r14, 3
mov qword [rsi], rax
mov qword [rsi + 8], rax
lea rcx, [rax + r14*8]
mov qword [rsi + 0x10], rcx
mov r9, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x138]
cmp r9, rcx
je 0x14002441c
mov r10, rcx
sub r10, r9
add r10, 0xfffffffffffffff8
cmp r10, 0x38
jb 0x140024421
mov rdx, rax
sub rdx, r9
cmp rdx, 0x20
jb 0x140024421
shr r10, 3
inc r10
mov r11, r10
and r11, 0xfffffffffffffffc
lea r8, [r9 + r11*8]
lea rdx, [rax + r11*8]
xor r14d, r14d
nop word [rax + rax]
movups xmm0, xmmword [r9 + r14*8]
movups xmm1, xmmword [r9 + r14*8 + 0x10]
movups xmmword [rax + r14*8], xmm0
movups xmmword [rax + r14*8 + 0x10], xmm1
add r14, 4
cmp r11, r14
jne 0x1400243e0
cmp r10, r11
jne 0x140024430
jmp 0x140024443
lea rcx, [0x1402da340]
lea rdx, [rsp + 0x130]
call fcn.140047c30
jmp 0x140024452
mov rdx, rax
jmp 0x140024443
mov r8, r9
mov rdx, rax
nop word [rax + rax]
mov rax, qword [r8]
mov qword [rdx], rax
add r8, 8
add rdx, 8
cmp r8, rcx
jne 0x140024430
mov qword [rsi + 8], rdx
add rsi, 0x18
mov qword [0x1402da348], rsi
mov rsi, qword [0x1402da360]
cmp rsi, qword [0x1402da368]
je 0x140024526
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
mov r14, rcx
sub r14, rax
sub rcx, rax
je 0x140024567
js 0x1400279ff
call fcn.1400731c0
sar r14, 3
mov qword [rsi], rax
mov qword [rsi + 8], rax
lea rcx, [rax + r14*8]
mov qword [rsi + 0x10], rcx
mov r9, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
cmp r9, rcx
je 0x14002453c
mov r10, rcx
sub r10, r9
add r10, 0xfffffffffffffff8
cmp r10, 0x38
jb 0x140024541
mov rdx, rax
sub rdx, r9
cmp rdx, 0x20
jb 0x140024541
shr r10, 3
inc r10
mov r11, r10
and r11, 0xfffffffffffffffc
lea r8, [r9 + r11*8]
lea rdx, [rax + r11*8]
xor r14d, r14d
nop dword [rax + rax]
movups xmm0, xmmword [r9 + r14*8]
movups xmm1, xmmword [r9 + r14*8 + 0x10]
movups xmmword [rax + r14*8], xmm0
movups xmmword [rax + r14*8 + 0x10], xmm1
add r14, 4
cmp r11, r14
jne 0x140024500
cmp r10, r11
jne 0x140024550
jmp 0x140024563
lea rcx, [0x1402da358]
lea rdx, [rsp + 0x90]
call fcn.140047c30
jmp 0x140024572
mov rdx, rax
jmp 0x140024563
mov r8, r9
mov rdx, rax
nop word [rax + rax]
mov rax, qword [r8]
mov qword [rdx], rax
add r8, 8
add rdx, 8
cmp r8, rcx
jne 0x140024550
mov qword [rsi + 8], rdx
add rsi, 0x18
mov qword [0x1402da360], rsi
mov rsi, qword [0x1402da378]
cmp rsi, qword [0x1402da380]
je 0x140024646
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0xb0]
mov r14, rcx
sub r14, rax
sub rcx, rax
je 0x140024687
js 0x140027a07
call fcn.1400731c0
sar r14, 3
mov qword [rsi], rax
mov qword [rsi + 8], rax
lea rcx, [rax + r14*8]
mov qword [rsi + 0x10], rcx
mov r9, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
cmp r9, rcx
je 0x14002465c
mov r10, rcx
sub r10, r9
add r10, 0xfffffffffffffff8
cmp r10, 0x38
jb 0x140024661
mov rdx, rax
sub rdx, r9
cmp rdx, 0x20
jb 0x140024661
shr r10, 3
inc r10
mov r11, r10
and r11, 0xfffffffffffffffc
lea r8, [r9 + r11*8]
lea rdx, [rax + r11*8]
xor r14d, r14d
nop dword [rax + rax]
movups xmm0, xmmword [r9 + r14*8]
movups xmm1, xmmword [r9 + r14*8 + 0x10]
movups xmmword [rax + r14*8], xmm0
movups xmmword [rax + r14*8 + 0x10], xmm1
add r14, 4
cmp r11, r14
jne 0x140024620
cmp r10, r11
jne 0x140024670
jmp 0x140024683
lea rcx, [0x1402da370]
lea rdx, [rsp + 0xb0]
call fcn.140047c30
jmp 0x140024692
mov rdx, rax
jmp 0x140024683
mov r8, r9
mov rdx, rax
nop word [rax + rax]
mov rax, qword [r8]
mov qword [rdx], rax
add r8, 8
add rdx, 8
cmp r8, rcx
jne 0x140024670
mov qword [rsi + 8], rdx
add rsi, 0x18
mov qword [0x1402da378], rsi
mov rsi, qword [0x1402da318]
cmp rsi, qword [0x1402da320]
je 0x1400246bc
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140047890
add rsi, 0x18
mov qword [0x1402da318], rsi
jmp 0x1400246cd
lea rcx, [0x1402da310]
lea rdx, [rsp + 0x50]
call fcn.1400476e0
mov rsi, qword [0x1402da330]
cmp rsi, qword [0x1402da338]
je 0x1400246f7
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140047890
add rsi, 0x18
mov qword [0x1402da330], rsi
jmp 0x140024708
lea rcx, [0x1402da328]
lea rdx, [rsp + 0x70]
call fcn.1400476e0
cmp byte [0x1402dab00], 0
jne 0x140024e92
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0
mov rax, qword [0x1402da488]
cmp rax, qword [0x1402da490]
jae 0x14002478f
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140024782
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rdx + 8]
mov r10, qword [r8]
mov qword [r10 + 8], r9
mov r9, qword [rdx + 8]
mov qword [r9], r10
mov r9, qword [rax]
mov qword [r9 + 8], r8
mov qword [r8], r9
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [0x1402da488], rax
jmp 0x140024805
lea rcx, [0x1402da480]
lea rsi, [rsp + 0x30]
mov rdx, rsi
call fcn.140047490
cmp qword [rsp + 0x40], 0
je 0x140024805
mov rax, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [r14]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x40], 0
cmp r14, rsi
je 0x140024805
nop word cs:[rax + rax]
mov r15, qword [r14 + 8]
mov rcx, qword [r14 + 0x10]
call fcn.140257dd0
mov qword [r14 + 0x10], 0
mov rcx, r14
call fcn.140073240
mov r14, r15
cmp r15, rsi
jne 0x1400247e0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0
mov rax, qword [0x1402da488]
cmp rax, qword [0x1402da490]
jae 0x14002487f
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140024872
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rdx + 8]
mov r10, qword [r8]
mov qword [r10 + 8], r9
mov r9, qword [rdx + 8]
mov qword [r9], r10
mov r9, qword [rax]
mov qword [r9 + 8], r8
mov qword [r8], r9
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [0x1402da488], rax
jmp 0x1400248f5
lea rcx, [0x1402da480]
lea rsi, [rsp + 0x30]
mov rdx, rsi
call fcn.140047490
cmp qword [rsp + 0x40], 0
je 0x1400248f5
mov rax, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [r14]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x40], 0
cmp r14, rsi
je 0x1400248f5
nop word cs:[rax + rax]
mov r15, qword [r14 + 8]
mov rcx, qword [r14 + 0x10]
call fcn.140257dd0
mov qword [r14 + 0x10], 0
mov rcx, r14
call fcn.140073240
mov r14, r15
cmp r15, rsi
jne 0x1400248d0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0
mov rax, qword [0x1402da488]
cmp rax, qword [0x1402da490]
jae 0x14002496f
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140024962
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rdx + 8]
mov r10, qword [r8]
mov qword [r10 + 8], r9
mov r9, qword [rdx + 8]
mov qword [r9], r10
mov r9, qword [rax]
mov qword [r9 + 8], r8
mov qword [r8], r9
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [0x1402da488], rax
jmp 0x1400249e5
lea rcx, [0x1402da480]
lea rsi, [rsp + 0x30]
mov rdx, rsi
call fcn.140047490
cmp qword [rsp + 0x40], 0
je 0x1400249e5
mov rax, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [r14]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x40], 0
cmp r14, rsi
je 0x1400249e5
nop word cs:[rax + rax]
mov r15, qword [r14 + 8]
mov rcx, qword [r14 + 0x10]
call fcn.140257dd0
mov qword [r14 + 0x10], 0
mov rcx, r14
call fcn.140073240
mov r14, r15
cmp r15, rsi
jne 0x1400249c0
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
mov qword [rax], 0
mov rdx, qword [0x1402da518]
mov rax, qword [0x1402da520]
cmp rdx, rax
jae 0x140024a1f
mov qword [rdx], rsi
add rdx, 8
mov qword [0x1402da518], rdx
jmp 0x140024b6b
mov rcx, qword [0x1402da510]
mov r15, rdx
sub r15, rcx
mov r14, r15
sar r14, 3
lea r8, [r14 + 1]
cmp r8, rdi
ja 0x140027a3a
sub rax, rcx
lea r9, [r13 + 9]
mov r12, rax
shr r12, 2
cmp r12, r8
cmovbe r12, r8
cmp rax, r9
cmovae r12, rdi
test r12, r12
je 0x140024a87
cmp r12, rdi
ja 0x140027a5e
lea rcx, [r12*8]
call fcn.1400731c0
mov rdx, qword [0x1402da518]
mov rcx, qword [0x1402da510]
jmp 0x140024a89
xor eax, eax
lea r9, [rax + r14*8]
lea r8, [rax + r12*8]
mov qword [rax + r14*8], rsi
lea r10, [rax + r14*8]
add r10, 8
mov rsi, rdx
sub rsi, rcx
je 0x140024b4c
add rsi, 0xfffffffffffffff8
cmp rsi, 0x98
jae 0x140024abb
mov r11, rdx
jmp 0x140024b30
add r15, rax
mov r11, rdx
sub r11, r15
cmp r11, 0x20
jae 0x140024acf
mov r11, rdx
jmp 0x140024b30
shr rsi, 3
inc rsi
mov r15, rsi
and r15, 0xfffffffffffffffc
lea r12, [r15*8]
sub r9, r12
mov r11, rdx
sub r11, r12
lea rax, [rax + r14*8]
add rax, 0xfffffffffffffff0
mov r14, r15
neg r14
xor r12d, r12d
nop
movups xmm0, xmmword [rdx + r12*8 - 0x20]
movups xmm1, xmmword [rdx + r12*8 - 0x10]
movups xmmword [rax + r12*8], xmm1
movups xmmword [rax + r12*8 - 0x10], xmm0
add r12, 0xfffffffffffffffc
cmp r14, r12
jne 0x140024b00
cmp rsi, r15
je 0x140024b45
nop word cs:[rax + rax]
mov rax, qword [r11 - 8]
add r11, 0xfffffffffffffff8
mov qword [r9 - 8], rax
add r9, 0xfffffffffffffff8
cmp r11, rcx
jne 0x140024b30
mov rcx, qword [0x1402da510]
mov qword [0x1402da510], r9
mov qword [0x1402da518], r10
mov qword [0x1402da520], r8
test rcx, rcx
je 0x140024b6b
call fcn.140073240
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
mov qword [rax], 0
mov rdx, qword [0x1402da518]
mov rax, qword [0x1402da520]
cmp rdx, rax
jae 0x140024ba5
mov qword [rdx], rsi
add rdx, 8
mov qword [0x1402da518], rdx
jmp 0x140024cfb
mov rcx, qword [0x1402da510]
mov r15, rdx
sub r15, rcx
mov r14, r15
sar r14, 3
lea r8, [r14 + 1]
cmp r8, rdi
ja 0x140027a46
sub rax, rcx
lea r9, [r13 + 9]
mov r12, rax
shr r12, 2
cmp r12, r8
cmovbe r12, r8
cmp rax, r9
cmovae r12, rdi
test r12, r12
je 0x140024c0d
cmp r12, rdi
ja 0x140027a63
lea rcx, [r12*8]
call fcn.1400731c0
mov rdx, qword [0x1402da518]
mov rcx, qword [0x1402da510]
jmp 0x140024c0f
xor eax, eax
lea r9, [rax + r14*8]
lea r8, [rax + r12*8]
mov qword [rax + r14*8], rsi
lea r10, [rax + r14*8]
add r10, 8
mov rsi, rdx
sub rsi, rcx
je 0x140024cdc
add rsi, 0xfffffffffffffff8
cmp rsi, 0x98
jae 0x140024c41
mov r11, rdx
jmp 0x140024cc0
add r15, rax
mov r11, rdx
sub r11, r15
cmp r11, 0x20
jae 0x140024c55
mov r11, rdx
jmp 0x140024cc0
shr rsi, 3
inc rsi
mov r15, rsi
and r15, 0xfffffffffffffffc
lea r12, [r15*8]
sub r9, r12
mov r11, rdx
sub r11, r12
lea rax, [rax + r14*8]
add rax, 0xfffffffffffffff0
mov r14, r15
neg r14
xor r12d, r12d
nop word cs:[rax + rax]
movups xmm0, xmmword [rdx + r12*8 - 0x20]
movups xmm1, xmmword [rdx + r12*8 - 0x10]
movups xmmword [rax + r12*8], xmm1
movups xmmword [rax + r12*8 - 0x10], xmm0
add r12, 0xfffffffffffffffc
cmp r14, r12
jne 0x140024c90
cmp rsi, r15
je 0x140024cd5
nop word cs:[rax + rax]
mov rax, qword [r11 - 8]
add r11, 0xfffffffffffffff8
mov qword [r9 - 8], rax
add r9, 0xfffffffffffffff8
cmp r11, rcx
jne 0x140024cc0
mov rcx, qword [0x1402da510]
mov qword [0x1402da510], r9
mov qword [0x1402da518], r10
mov qword [0x1402da520], r8
test rcx, rcx
je 0x140024cfb
call fcn.140073240
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
mov qword [rax], 0
mov rdx, qword [0x1402da518]
mov rax, qword [0x1402da520]
cmp rdx, rax
jae 0x140024d35
mov qword [rdx], rsi
add rdx, 8
mov qword [0x1402da518], rdx
jmp 0x140024e8b
mov rcx, qword [0x1402da510]
mov r15, rdx
sub r15, rcx
mov r14, r15
sar r14, 3
lea r8, [r14 + 1]
cmp r8, rdi
ja 0x140027a52
sub rax, rcx
lea r9, [r13 + 9]
mov r12, rax
shr r12, 2
cmp r12, r8
cmovbe r12, r8
cmp rax, r9
cmovae r12, rdi
test r12, r12
je 0x140024d9d
cmp r12, rdi
ja 0x140027a68
lea rcx, [r12*8]
call fcn.1400731c0
mov rdx, qword [0x1402da518]
mov rcx, qword [0x1402da510]
jmp 0x140024d9f
xor eax, eax
lea r9, [rax + r14*8]
lea r8, [rax + r12*8]
mov qword [rax + r14*8], rsi
lea r10, [rax + r14*8]
add r10, 8
mov rsi, rdx
sub rsi, rcx
je 0x140024e6c
add rsi, 0xfffffffffffffff8
cmp rsi, 0x98
jae 0x140024dd1
mov r11, rdx
jmp 0x140024e50
add r15, rax
mov r11, rdx
sub r11, r15
cmp r11, 0x20
jae 0x140024de5
mov r11, rdx
jmp 0x140024e50
shr rsi, 3
inc rsi
mov r15, rsi
and r15, 0xfffffffffffffffc
lea r12, [r15*8]
sub r9, r12
mov r11, rdx
sub r11, r12
lea rax, [rax + r14*8]
add rax, 0xfffffffffffffff0
mov r14, r15
neg r14
xor r12d, r12d
nop word cs:[rax + rax]
movups xmm0, xmmword [rdx + r12*8 - 0x20]
movups xmm1, xmmword [rdx + r12*8 - 0x10]
movups xmmword [rax + r12*8], xmm1
movups xmmword [rax + r12*8 - 0x10], xmm0
add r12, 0xfffffffffffffffc
cmp r14, r12
jne 0x140024e20
cmp rsi, r15
je 0x140024e65
nop word cs:[rax + rax]
mov rax, qword [r11 - 8]
add r11, 0xfffffffffffffff8
mov qword [r9 - 8], rax
add r9, 0xfffffffffffffff8
cmp r11, rcx
jne 0x140024e50
mov rcx, qword [0x1402da510]
mov qword [0x1402da510], r9
mov qword [0x1402da518], r10
mov qword [0x1402da520], r8
test rcx, rcx
je 0x140024e8b
call fcn.140073240
mov byte [0x1402dab00], 1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0
mov rax, qword [0x1402da488]
cmp rax, qword [0x1402da490]
jae 0x140024f0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140024eff
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rdx + 8]
mov r10, qword [r8]
mov qword [r10 + 8], r9
mov r9, qword [rdx + 8]
mov qword [r9], r10
mov r9, qword [rax]
mov qword [r9 + 8], r8
mov qword [r8], r9
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov qword [rax + 0x10], rcx
add rax, 0x18
mov qword [0x1402da488], rax
jmp 0x140024f85
lea rcx, [0x1402da480]
lea rsi, [rsp + 0x30]
mov rdx, rsi
call fcn.140047490
cmp qword [rsp + 0x40], 0
je 0x140024f85
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [rbx]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x40], 0
cmp rbx, rsi
je 0x140024f85
nop word cs:[rax + rax]
mov r14, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
call fcn.140257dd0
mov qword [rbx + 0x10], 0
mov rcx, rbx
call fcn.140073240
mov rbx, r14
cmp r14, rsi
jne 0x140024f60
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
mov qword [rax], 0
mov rdx, qword [0x1402da518]
mov rax, qword [0x1402da520]
cmp rdx, rax
jae 0x140024fbf
mov qword [rdx], rsi
add rdx, 8
mov qword [0x1402da518], rdx
jmp 0x14002510b
mov rcx, qword [0x1402da510]
mov r14, rdx
sub r14, rcx
mov rbx, r14
sar rbx, 3
lea r8, [rbx + 1]
cmp r8, rdi
ja 0x1400279eb
sub rax, rcx
add r13, 9
mov r15, rax
shr r15, 2
cmp r15, r8
cmovbe r15, r8
cmp rax, r13
cmovae r15, rdi
test r15, r15
je 0x140025027
cmp r15, rdi
ja 0x140027a0f
lea rcx, [r15*8]
call fcn.1400731c0
mov rdx, qword [0x1402da518]
mov rcx, qword [0x1402da510]
jmp 0x140025029
xor eax, eax
lea r9, [rax + rbx*8]
lea r8, [rax + r15*8]
mov qword [rax + rbx*8], rsi
lea r10, [rax + rbx*8]
add r10, 8
mov rsi, rdx
sub rsi, rcx
je 0x1400250ec
add rsi, 0xfffffffffffffff8
cmp rsi, 0x98
jae 0x14002505b
mov r11, rdx
jmp 0x1400250d0
add r14, rax
mov r11, rdx
sub r11, r14
cmp r11, 0x20
jae 0x14002506f
mov r11, rdx
jmp 0x1400250d0
shr rsi, 3
inc rsi
mov rdi, rsi
and rdi, 0xfffffffffffffffc
lea r14, [rdi*8]
sub r9, r14
mov r11, rdx
sub r11, r14
lea rax, [rax + rbx*8]
add rax, 0xfffffffffffffff0
mov rbx, rdi
neg rbx
xor r14d, r14d
nop
movups xmm0, xmmword [rdx + r14*8 - 0x20]
movups xmm1, xmmword [rdx + r14*8 - 0x10]
movups xmmword [rax + r14*8], xmm1
movups xmmword [rax + r14*8 - 0x10], xmm0
add r14, 0xfffffffffffffffc
cmp rbx, r14
jne 0x1400250a0
cmp rsi, rdi
je 0x1400250e5
nop word cs:[rax + rax]
mov rax, qword [r11 - 8]
add r11, 0xfffffffffffffff8
mov qword [r9 - 8], rax
add r9, 0xfffffffffffffff8
cmp r11, rcx
jne 0x1400250d0
mov rcx, qword [0x1402da510]
mov qword [0x1402da510], r9
mov qword [0x1402da518], r10
mov qword [0x1402da520], r8
test rcx, rcx
je 0x14002510b
call fcn.140073240
lock inc dword [0x1402d7298]
lea rcx, [0x1402d72a0]
call fcn.1400741d0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140025138
mov qword [rsp + 0xb8], rcx
call fcn.140073240
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x1400251d6
mov rbx, qword [rsp + 0x78]
mov rcx, rdi
cmp rbx, rdi
jne 0x140025165
jmp 0x1400251cc
cmp rbx, rdi
je 0x1400251c7
mov rax, rbx
add rbx, 0xffffffffffffffe8
cmp qword [rax - 8], 0
je 0x140025160
mov rcx, qword [rax - 0x18]
mov rsi, qword [rax - 0x10]
mov rdx, qword [rcx + 8]
mov r8, qword [rsi]
mov qword [r8 + 8], rdx
mov rcx, qword [rcx + 8]
mov qword [rcx], r8
mov qword [rax - 8], 0
cmp rsi, rbx
je 0x140025160
nop word [rax + rax]
mov r14, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
call fcn.140257dd0
mov qword [rsi + 0x10], 0
mov rcx, rsi
call fcn.140073240
mov rsi, r14
cmp r14, rbx
jne 0x1400251a0
jmp 0x140025160
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x78], rdi
call fcn.140073240
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140025276
mov rbx, qword [rsp + 0x58]
mov rcx, rdi
cmp rbx, rdi
jne 0x140025205
jmp 0x14002526c
cmp rbx, rdi
je 0x140025267
mov rax, rbx
add rbx, 0xffffffffffffffe8
cmp qword [rax - 8], 0
je 0x140025200
mov rcx, qword [rax - 0x18]
mov rsi, qword [rax - 0x10]
mov rdx, qword [rcx + 8]
mov r8, qword [rsi]
mov qword [r8 + 8], rdx
mov rcx, qword [rcx + 8]
mov qword [rcx], r8
mov qword [rax - 8], 0
cmp rsi, rbx
je 0x140025200
nop word [rax + rax]
mov r14, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
call fcn.140257dd0
mov qword [rsi + 0x10], 0
mov rcx, rsi
call fcn.140073240
mov rsi, r14
cmp r14, rbx
jne 0x140025240
jmp 0x140025200
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rdi
call fcn.140073240
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140025290
mov qword [rsp + 0x98], rcx
call fcn.140073240
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x1400252aa
mov qword [rsp + 0x138], rcx
call fcn.140073240
mov rdi, qword [rsp + 0x2a0]
test rdi, rdi
je 0x14002534c
mov rbx, qword [rsp + 0x2a8]
mov rcx, rdi
cmp rbx, rdi
jne 0x1400252d5
jmp 0x14002533f
cmp rbx, rdi
je 0x140025337
mov rax, rbx
add rbx, 0xffffffffffffffe8
cmp qword [rax - 8], 0
je 0x1400252d0
mov rcx, qword [rax - 0x18]
mov rsi, qword [rax - 0x10]
mov rdx, qword [rcx + 8]
mov r8, qword [rsi]
mov qword [r8 + 8], rdx
mov rcx, qword [rcx + 8]
mov qword [rcx], r8
mov qword [rax - 8], 0
cmp rsi, rbx
je 0x1400252d0
nop word [rax + rax]
mov r14, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
call fcn.140257dd0
mov qword [rsi + 0x10], 0
mov rcx, rsi
call fcn.140073240
mov rsi, r14
cmp r14, rbx
jne 0x140025310
jmp 0x1400252d0
mov rcx, qword [rsp + 0x2a0]
mov qword [rsp + 0x2a8], rdi
call fcn.140073240
mov qword [rsp + 0x100], 0
cmp qword [rsp + 0x108], 0
mov r15, qword [rsp + 0x68]
je 0x1400253c3
lea rsi, [rsp + 0x500]
mov rcx, rsi
mov rdx, r15
call fcn.140075840
mov rdx, qword [rsp + 0x580]
mov r8, qword [rsp + 0x108]
mov rcx, rsi
call fcn.140059e60
mov qword [rsp + 0x100], rax
test byte [rsp + 0x500], 1
je 0x1400253ba
mov rcx, qword [rsp + 0x510]
call fcn.140073240
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x1400271fb
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x90]
mov r8d, 4
mov rdx, r15
mov r9, 0xffffffffffffffff
call fcn.140075cf0
movzx r9d, byte [rsp + 0x90]
mov r8, r9
shr r8, 1
and r9b, 1
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
lea rsi, [rsp + 0x92]
mov rax, rcx
cmove rax, rsi
mov r11, rdx
cmove r11, r8
test r11, r11
jle 0x14002546e
lea r10, [rax + r11*2]
xor ebx, ebx
xor edi, edi
nop word cs:[rax + rax]
cmp word [rax + rbx*2], 0x3a
je 0x140025455
add rdi, 0xfffffffffffffffe
inc rbx
cmp r11, rbx
jne 0x140025440
jmp 0x140025464
lea rbx, [r11 + r11]
add rbx, rdi
je 0x140025464
cmp rdi, 2
jne 0x1400254bf
cmp r11, 4
jge 0x1400255d2
test r9b, r9b
cmove rcx, rsi
cmovne r8, rdx
lea rax, [rcx + r8*2]
mov rdx, rax
test r8, r8
jle 0x1400254a2
mov rdx, rcx
nop dword [rax + rax]
cmp word [rdx], 0x5c
je 0x1400254a2
add rdx, 2
dec r8
jne 0x140025490
mov rdx, rax
mov r8, rdx
sub r8, rcx
shr r8, 1
cmp rdx, rax
mov rax, 0xffffffffffffffff
cmovne rax, r8
mov word [rcx + rax*2], 0x2d
mov byte [rsp + 0x2b], 0
lea r13, [r15 + 2]
test byte [r15], 1
mov rcx, r13
je 0x1400254d5
mov rcx, qword [r15 + 0x10]
test byte [0x1402da388], 1
je 0x1400254e7
mov rdx, qword [0x1402da398]
jmp 0x1400254ee
lea rdx, [0x1402da38a]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1400254fd
mov byte [rsp + 0x2b], 1
movzx eax, byte [rsp + 0x90]
test al, 1
je 0x14002551b
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
jmp 0x140025521
shr rax, 1
mov rcx, rsi
test rax, rax
mov qword [rsp + 0xe8], r13
jle 0x140025988
xor edx, edx
mov r8, rax
nop word [rax + rax]
cmp word [rcx + rdx], 0x3a
je 0x140025555
add rdx, 2
dec r8
jne 0x140025540
jmp 0x140025988
add rax, rax
cmp rax, rdx
je 0x140025988
cmp rdx, 0xfffffffffffffffe
je 0x140025988
lea rcx, [rsp + 0x130]
call fcn.140059fb0
movzx eax, byte [rsp + 0x90]
mov rcx, rax
shr rcx, 1
test al, 1
cmovne rsi, qword [rsp + 0xa0]
cmovne rcx, qword [rsp + 0x98]
cmp rcx, 2
jne 0x14002564b
movsx esi, byte [rsi]
add esi, 0xffffff9f
mov edx, 1
mov ecx, esi
shl edx, cl
lea rcx, [rsp + 0x130]
xor r8d, r8d
call fcn.14005a380
test al, al
jne 0x14002583c
xor esi, esi
jmp 0x140025889
lea rdi, [rax + r11*2]
add rdi, 0xfffffffffffffffe
mov rbx, rax
add r11, 0xfffffffffffffffd
je 0x14002546e
xor r14d, r14d
nop word [rax + rax]
cmp word [rbx + r14], 0x55
je 0x140025606
add r14, 2
dec r11
jne 0x1400255f0
jmp 0x14002546e
cmp word [rbx + r14 + 2], 0x4e
jne 0x140025625
cmp word [rbx + r14 + 4], 0x43
jne 0x140025625
cmp word [rbx + r14 + 6], 0x5c
je 0x1400278d1
mov r15, rdi
sub r15, rbx
add rbx, r14
add rbx, 2
sub r15, r14
mov r11, r15
shr r11, 1
cmp r15, 8
mov r15, qword [rsp + 0x68]
jge 0x1400255dd
jmp 0x14002546e
movabs rdi, 0x7fffffffffffffef
movzx r14d, byte [r15]
mov eax, r14d
and al, 1
je 0x140025666
mov r14, qword [r15 + 8]
jmp 0x140025669
shr r14, 1
lea rbx, [r14 + 1]
cmp rbx, rdi
ja 0x140027a72
cmp rbx, 0xa
ja 0x140025697
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
add bl, bl
mov byte [rsp + 0x50], bl
xor esi, esi
jmp 0x1400256d6
mov r15, rbx
or r15, 7
inc r15
js 0x140027a89
lea rcx, [r15 + r15]
call fcn.1400731c0
mov rsi, rax
or r15, 1
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx]
and al, 1
mov ebx, r15d
mov r15, rcx
test bl, 1
lea rbx, [rsp + 0x52]
cmove rsi, rbx
mov rdx, r13
test al, al
je 0x1400256ed
mov rdx, qword [r15 + 0x10]
lea r8, [r14 + r14]
mov rcx, rsi
call sub.msvcrt.dll_memmove
mov dword [rsi + r14*2], 0x5c
test byte [rsp + 0x50], 1
je 0x14002570d
mov rbx, qword [rsp + 0x60]
lea rdx, [rsp + 0x2a0]
mov rcx, rbx
mov r8d, 0x12c
call qword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointW]
test byte [rsp + 0x50], 1
je 0x140025735
mov rcx, qword [rsp + 0x60]
call fcn.140073240
lea rsi, [rsp + 0x2a0]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov word [rsp + rax*2 + 0x29e], 0
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, rdi
ja 0x140027a7c
mov rsi, rax
cmp rax, 0xa
ja 0x14002577d
lea eax, [rsi + rsi]
mov byte [rsp + 0x118], al
lea rbx, [rsp + 0x11a]
jmp 0x1400257b5
mov rdi, rsi
or rdi, 7
inc rdi
js 0x140027a8e
lea rcx, [rdi + rdi]
call fcn.1400731c0
mov rbx, rax
mov qword [rsp + 0x128], rax
or rdi, 1
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0x2a0]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov word [rbx + rsi*2], 0
lea rcx, [rsp + 0x288]
lea rdx, [rsp + 0x90]
call fcn.140075840
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x118]
lea r8, [rsp + 0x288]
xor r9d, r9d
call fcn.140059fe0
mov ebx, eax
test byte [rsp + 0x288], 1
je 0x14002581f
mov rcx, qword [rsp + 0x298]
call fcn.140073240
test byte [rsp + 0x118], 1
je 0x140025836
mov rcx, qword [rsp + 0x128]
call fcn.140073240
xor esi, esi
test bl, bl
je 0x140025889
mov edi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x270]
mov rdx, r15
call fcn.140075840
lea rdx, [rsp + 0x130]
lea r9, [rsp + 0x270]
mov ecx, edi
mov r8d, esi
call fcn.140020780
mov rbx, rax
mov sil, 1
test byte [rsp + 0x270], 1
je 0x14002588b
mov rcx, qword [rsp + 0x280]
call fcn.140073240
jmp 0x14002588b
xor ebx, ebx
mov rdi, qword [rsp + 0x248]
test rdi, rdi
je 0x1400258e2
mov rax, qword [rsp + 0x250]
mov rcx, rdi
cmp rax, rdi
jne 0x1400258b8
jmp 0x1400258d5
mov rax, r14
cmp r14, rdi
je 0x1400258cd
lea r14, [rax - 0x18]
test byte [rax - 0x18], 1
je 0x1400258b0
mov rcx, qword [rax - 8]
call fcn.140073240
jmp 0x1400258b0
mov rcx, qword [rsp + 0x248]
mov qword [rsp + 0x250], rdi
call fcn.140073240
cmp rbx, 0x1f
setb al
xor sil, 1
or sil, al
jne 0x140025988
cmp byte [rsp + 0x2b], 0
jne 0x140027195
movabs r12, 0x7fffffffffffffef
movzx edx, byte [r15]
mov r13, rdx
shr r13, 1
mov ebp, edx
and bpl, 1
mov r9, qword [r15 + 8]
mov rdi, r9
cmove rdi, r13
lea rsi, [rdi + 0x29]
cmp rsi, r12
ja 0x140027a93
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov r14d, 0x90
add r14, qword [rcx + rax*8]
cmp rsi, 0xa
ja 0x14002739e
mov qword [rsp + 0xe0], rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2a0], xmm0
mov qword [rsp + 0x2b0], 0
add sil, sil
mov byte [rsp + 0x2a0], sil
xor ebx, ebx
jmp 0x1400273fb
cmp byte [rsp + 0x2b], 0
jne 0x140025fc0
movabs r12, 0x7fffffffffffffef
movzx edi, byte [r15]
mov eax, edi
and al, 1
je 0x1400259ad
mov rdi, qword [r15 + 8]
jmp 0x1400259b0
shr rdi, 1
lea rbx, [rdi + 0x20]
cmp rbx, r12
ja 0x1400279aa
cmp rbx, 0xa
ja 0x1400259e7
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2a0], xmm0
mov qword [rsp + 0x2b0], 0
add bl, bl
mov byte [rsp + 0x2a0], bl
xor esi, esi
jmp 0x140025a28
mov r14, rbx
or r14, 7
inc r14
js 0x140027a14
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rsi, rax
or r14, 1
mov qword [rsp + 0x2a0], r14
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2a8], rbx
movzx eax, byte [r15]
and al, 1
mov ebx, r14d
test bl, 1
lea rbx, [rsp + 0x2a2]
cmove rsi, rbx
mov rdx, r13
test al, al
je 0x140025a42
mov rdx, qword [r15 + 0x10]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.WindowsSystem32KernelBase.dll]
movups xmmword [rsi + rdi*2], xmm0
movups xmm0, xmmword [0x14025d698]
movups xmmword [rsi + rdi*2 + 0x10], xmm0
movups xmm0, xmmword [0x14025d6a8]
movups xmmword [rsi + rdi*2 + 0x20], xmm0
movups xmm0, xmmword [0x14025d6b8]
movups xmmword [rsi + rdi*2 + 0x30], xmm0
mov word [rsi + rdi*2 + 0x40], 0
test byte [rsp + 0x2a0], 1
je 0x140025a96
mov rbx, qword [rsp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov esi, eax
test byte [rsp + 0x2a0], 1
je 0x140025ab8
mov rcx, qword [rsp + 0x2b0]
call fcn.140073240
xor r15d, r15d
cmp esi, 0xffffffff
setne bpl
mov rax, qword [rsp + 0x68]
movzx edi, byte [rax]
mov ecx, edi
and cl, 1
je 0x140025ad7
mov rdi, qword [rax + 8]
jmp 0x140025ada
shr rdi, 1
lea r14, [rdi + 0x1c]
cmp r14, r12
ja 0x1400279b7
cmp r14, 0xa
ja 0x140025b13
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2a0], xmm0
mov qword [rsp + 0x2b0], 0
add r14b, r14b
mov byte [rsp + 0x2a0], r14b
xor ebx, ebx
jmp 0x140025b63
mov r12, r14
or r12, 7
inc r12
js 0x140027a19
lea rcx, [r12 + r12]
call fcn.1400731c0
mov rbx, rax
or r12, 1
mov qword [rsp + 0x2a0], r12
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2a8], r14
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax]
and cl, 1
mov r14d, r12d
movabs r12, 0x7fffffffffffffef
test r14b, 1
lea r14, [rsp + 0x2a2]
cmove rbx, r14
mov rdx, r13
test cl, cl
je 0x140025b83
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 0x10]
lea r8, [rdi + rdi]
mov rcx, rbx
call sub.msvcrt.dll_memmove
movabs rax, 0x6c006c0064002e
mov qword [rbx + rdi*2 + 0x30], rax
movups xmm0, xmmword [str.WindowsSystem32user32.dll]
movups xmmword [rbx + rdi*2], xmm0
movups xmm0, xmmword [0x14025d6da]
movups xmmword [rbx + rdi*2 + 0x10], xmm0
movups xmm0, xmmword [0x14025d6ea]
movups xmmword [rbx + rdi*2 + 0x20], xmm0
mov word [rbx + rdi*2 + 0x38], 0
test byte [rsp + 0x2a0], 1
je 0x140025bda
mov r14, qword [rsp + 0x2b0]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ebx, eax
mov r15b, bpl
test byte [rsp + 0x2a0], 1
je 0x140025bff
mov rcx, qword [rsp + 0x2b0]
call fcn.140073240
xor ebp, ebp
cmp esi, 0xffffffff
setne bpl
inc ebp
cmp ebx, 0xffffffff
cmove ebp, r15d
mov r15, qword [rsp + 0x68]
movzx edi, byte [r15]
mov ecx, edi
and cl, 1
je 0x140025c27
mov rdi, qword [r15 + 8]
jmp 0x140025c2a
shr rdi, 1
lea rbx, [rdi + 0x10]
cmp rbx, r12
ja 0x1400279c4
cmp rbx, 0xa
ja 0x140025c61
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2a0], xmm0
mov qword [rsp + 0x2b0], 0
add bl, bl
mov byte [rsp + 0x2a0], bl
xor esi, esi
jmp 0x140025ca3
mov r14, rbx
or r14, 7
inc r14
js 0x140027a1e
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rsi, rax
or r14, 1
mov qword [rsp + 0x2a0], r14
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2a8], rbx
movzx ecx, byte [r15]
and cl, 1
mov ebx, r14d
test bl, 1
lea rbx, [rsp + 0x2a2]
cmove rsi, rbx
mov rdx, r13
test cl, cl
je 0x140025cbd
mov rdx, qword [r15 + 0x10]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.Windowswin.ini]
movups xmmword [rsi + rdi*2], xmm0
movups xmm0, xmmword [0x14025d714]
movups xmmword [rsi + rdi*2 + 0x10], xmm0
mov word [rsi + rdi*2 + 0x20], 0
test byte [rsp + 0x2a0], 1
je 0x140025cf9
mov rbx, qword [rsp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov esi, eax
test byte [rsp + 0x2a0], 1
je 0x140025d1b
mov rcx, qword [rsp + 0x2b0]
call fcn.140073240
xor r14d, r14d
cmp esi, 0xffffffff
setne al
movzx edi, byte [r15]
mov ecx, edi
and cl, 1
je 0x140025d35
mov rdi, qword [r15 + 8]
jmp 0x140025d38
shr rdi, 1
lea rbx, [rdi + 0x13]
cmp rbx, r12
ja 0x1400279d1
cmp rbx, 0xa
mov byte [rsp + 0xe0], al
ja 0x140025d76
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2a0], xmm0
mov qword [rsp + 0x2b0], 0
add bl, bl
mov byte [rsp + 0x2a0], bl
xor esi, esi
jmp 0x140025db8
mov r12, rbx
or r12, 7
inc r12
js 0x140027a23
lea rcx, [r12 + r12]
call fcn.1400731c0
mov rsi, rax
or r12, 1
mov qword [rsp + 0x2a0], r12
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2a8], rbx
movzx ecx, byte [r15]
and cl, 1
mov ebx, r12d
test bl, 1
lea rbx, [rsp + 0x2a2]
cmove rsi, rbx
mov rdx, r13
test cl, cl
je 0x140025dd2
mov rdx, qword [r15 + 0x10]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movabs rax, 0x72006500730055
mov qword [rsi + rdi*2 + 0x1e], rax
movups xmm0, xmmword [str.usersDefault_User]
movups xmmword [rsi + rdi*2], xmm0
movups xmm0, xmmword [0x14025d736]
movups xmmword [rsi + rdi*2 + 0x10], xmm0
mov word [rsi + rdi*2 + 0x26], 0
test byte [rsp + 0x2a0], 1
je 0x140025e1d
mov rbx, qword [rsp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov esi, eax
test byte [rsp + 0x2a0], 1
je 0x140025e3f
mov rcx, qword [rsp + 0x2b0]
call fcn.140073240
xor r12d, r12d
cmp esi, 0xffffffff
setne r13b
movzx edi, byte [r15]
mov ecx, edi
and cl, 1
je 0x140025e5a
mov rdi, qword [r15 + 8]
jmp 0x140025e5d
shr rdi, 1
lea r15, [rdi + 0x29]
movabs rax, 0x7fffffffffffffef
cmp r15, rax
ja 0x1400279de
cmp r15, 0xa
ja 0x140025ea0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x2a0], xmm0
mov qword [rsp + 0x2b0], 0
add r15b, r15b
mov byte [rsp + 0x2a0], r15b
xor esi, esi
jmp 0x140025ee6
mov rbx, r15
or rbx, 7
inc rbx
js 0x140027a35
lea rcx, [rbx + rbx]
call fcn.1400731c0
mov rsi, rax
or rbx, 1
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2a8], r15
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax]
and cl, 1
mov r15d, ebx
test r15b, 1
lea rbx, [rsp + 0x2a2]
cmove rsi, rbx
mov rdx, qword [rsp + 0xe8]
test cl, cl
mov r15, qword [rsp + 0x68]
je 0x140025f0b
mov rdx, qword [r15 + 0x10]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataMicrosoftWindowsSystemData]
movups xmmword [rsi + rdi*2], xmm0
movups xmm0, xmmword [0x14025d75e]
movups xmmword [rsi + rdi*2 + 0x10], xmm0
movups xmm0, xmmword [0x14025d76e]
movups xmmword [rsi + rdi*2 + 0x20], xmm0
movups xmm0, xmmword [0x14025d77e]
movups xmmword [rsi + rdi*2 + 0x30], xmm0
movups xmm0, xmmword [0x14025d78e]
movups xmmword [rsi + rdi*2 + 0x40], xmm0
mov dword [rsi + rdi*2 + 0x50], 0x61
test byte [rsp + 0x2a0], 1
je 0x140025f6c
mov rbx, qword [rsp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov esi, eax
movzx eax, byte [rsp + 0xe0]
mov r14b, al
add ebp, r14d
mov r12b, r13b
add r12d, ebp
test byte [rsp + 0x2a0], 1
je 0x140025fa2
mov rcx, qword [rsp + 0x2b0]
call fcn.140073240
xor eax, eax
cmp esi, 0xffffffff
setne al
add r12d, eax
cmp r12d, 3
mov r13, qword [rsp + 0xe8]
jbe 0x140025fc0
mov byte [rsp + 0x2b], 1
test byte [r15], 1
mov rcx, r13
je 0x140025fcd
mov rcx, qword [r15 + 0x10]
test byte [0x1402da388], 1
je 0x140025fdf
mov rdx, qword [0x1402da398]
jmp 0x140025fe6
lea rdx, [0x1402da38a]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400260a0
cmp byte [rsp + 0x2b], 0
je 0x1400260a0
lea rdx, str.treating_path
lea rcx, [rsp + 0x130]
mov r8, r15
call fcn.140013830
lea rdx, str.as_windows_drive
lea rcx, [rsp + 0x130]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2b0], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x2a0], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x2a0], 1
je 0x140026063
mov rcx, qword [rsp + 0x2b0]
jmp 0x14002606b
lea rcx, [rsp + 0x2a2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x2a0], 1
je 0x140026089
mov rcx, qword [rsp + 0x2b0]
call fcn.140073240
test byte [rsp + 0x130], 1
je 0x1400260a0
mov rcx, qword [rsp + 0x140]
call fcn.140073240
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140075840
lea rdx, [0x14025cc70]
lea rcx, [rsp + 0x50]
call fcn.140076360
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
test byte [rsp + 0x50], 1
lea rcx, [rsp + 0x52]
je 0x140026101
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140026388
lea r14, [rsp + 0x2cc]
lea r15, [rsp + 0x2a0]
mov rbx, qword [sym.imp.KERNEL32.DLL_FindNextFileW]
lea r12, [0x14025cc76]
nop word [rax + rax]
mov r13d, dword [rsp + 0x2a0]
mov eax, dword [rsp + 0x2bc]
shl rax, 0x20
mov ecx, dword [rsp + 0x2c0]
or rcx, rax
mov eax, dword [rsp + 0x2c4]
mov dword [rsp + 0x130], r13d
mov qword [rsp + 0x138], rcx
mov dword [rsp + 0x140], eax
mov rcx, r14
call sub.msvcrt.dll_wcslen
lea rbp, [rax + rax]
add rbp, 2
nop dword [rax + rax]
mov rcx, rbp
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140026190
mov rdi, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x148], rdi
test r13b, 0x10
jne 0x140026230
mov ecx, 0x30
call fcn.1400731c0
mov rcx, qword [rsp + 0x148]
mov qword [rax + 0x28], rcx
mov qword [rsp + 0x148], 0
mov ecx, dword [rsp + 0x140]
mov dword [rax + 0x20], ecx
mov rcx, qword [rsp + 0x138]
mov qword [rax + 0x18], rcx
mov ecx, dword [rsp + 0x130]
mov dword [rax + 0x10], ecx
lea rcx, [rsp + 0x70]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rsp + 0x70], rax
inc qword [rsp + 0x80]
jmp 0x1400262f0
mov rcx, rdi
mov rdx, r12
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400262f0
mov rcx, qword [rsp + 0x148]
lea rdx, [0x14025cc7a]
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400262f0
mov rax, qword [rsp + 0xb8]
cmp rax, qword [rsp + 0xc0]
jae 0x1400262d3
mov dword [rax], 0
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
mov qword [rax + 0x18], 0
mov rcx, qword [rsp + 0x148]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x148], 0
mov ecx, dword [rsp + 0x140]
mov dword [rax + 0x10], ecx
mov rcx, qword [rsp + 0x138]
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x130]
mov dword [rax], ecx
add rax, 0x20
mov qword [rsp + 0xb8], rax
jmp 0x1400262f0
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x130]
call fcn.140047f10
nop dword [rax + rax]
mov rcx, rsi
mov rdx, r15
call rbx
mov edi, eax
mov rcx, qword [rsp + 0x148]
call fcn.140257dd0
test edi, edi
jne 0x140026140
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r15, qword [rsp + 0x68]
lea r12, [rsp + 0x70]
cmp eax, 0x12
je 0x14002643d
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, [rsp + 0xc8]
mov edx, eax
call fcn.140076dc0
lea rdx, [0x14025cc80]
lea rcx, [rsp + 0xc8]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x40], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx r8d, byte [rsp + 0x50]
test r8b, 1
je 0x1400263b3
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
jmp 0x1400263bb
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
lea r12, [rsp + 0x70]
jne 0x140026446
movzx edi, byte [r15]
mov eax, edi
and al, 1
je 0x140027210
mov rdi, qword [r15 + 8]
jmp 0x140027213
shr r8, 1
lea rdx, [rsp + 0x52]
lea rcx, [rsp + 0x30]
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x140], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x130], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x130], 1
je 0x1400263fe
mov rcx, qword [rsp + 0x140]
jmp 0x140026406
lea rcx, [rsp + 0x132]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x130], 1
jne 0x1400264ba
test byte [rsp + 0x30], 1
jne 0x1400264d2
test byte [rsp + 0xc8], 1
je 0x14002643d
mov rcx, qword [rsp + 0xd8]
call fcn.140073240
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_FindClose]
movzx ecx, byte [rsp + 0x50]
test cl, 1
je 0x140026457
mov rax, qword [rsp + 0x58]
jmp 0x14002645d
mov rax, rcx
shr rax, 1
lea rdx, [rax - 1]
test cl, 1
jne 0x140026473
add dl, dl
mov byte [rsp + 0x50], dl
lea rcx, [rsp + 0x52]
jmp 0x14002647d
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rdx
mov word [rcx + rax*2 - 2], 0
mov r13, qword [rsp + 0x78]
cmp r13, r12
je 0x140026b70
lea rsi, str.bootmgr
mov rbp, qword [sym.imp.msvcrt.dll__wcsicmp]
lea rdi, str.bootnxt
lea rbx, str.bootmgr.efi
lea r14, str.BOOTSECT.BAK
jmp 0x14002655d
mov rcx, qword [rsp + 0x140]
call fcn.140073240
test byte [rsp + 0x30], 1
je 0x140026426
mov rcx, qword [rsp + 0x40]
call fcn.140073240
test byte [rsp + 0xc8], 1
jne 0x140026430
jmp 0x14002643d
lea rcx, [rdi + 0x78]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov qword [rax + 8], rcx
mov rcx, qword [rdi + 0x78]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdi + 0x78], rax
add rdi, 0x88
mov rbp, qword [sym.imp.msvcrt.dll__wcsicmp]
inc qword [rdi]
mov rcx, rsi
call fcn.1400741d0
mov r15, qword [rsp + 0x68]
mov rcx, r14
call fcn.140257dd0
lea rsi, str.bootmgr
lea rdi, str.bootnxt
lea rbx, str.bootmgr.efi
lea r14, str.BOOTSECT.BAK
mov r13, qword [r13 + 8]
cmp r13, r12
je 0x140026b70
mov rcx, qword [r13 + 0x28]
mov rdx, rsi
call rbp
test eax, eax
je 0x140026550
mov rcx, qword [r13 + 0x28]
mov rdx, rdi
call rbp
test eax, eax
je 0x140026550
mov rcx, qword [r13 + 0x28]
mov rdx, rbx
call rbp
test eax, eax
je 0x140026550
mov rcx, qword [r13 + 0x28]
mov rdx, r14
call rbp
test eax, eax
je 0x140026550
mov rcx, qword [r13 + 0x28]
lea rdx, str.pagefile.sys
call rbp
test eax, eax
je 0x140026550
mov rcx, qword [r13 + 0x28]
lea rdx, str.swapfile.sys
call rbp
test eax, eax
je 0x140026550
mov rcx, qword [r13 + 0x28]
lea rdx, str.hiberfil.sys
call rbp
test eax, eax
je 0x140026550
mov rdi, qword [r13 + 0x28]
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov rbp, rax
movsxd rcx, ebp
lea rdx, [rdi + rcx*2]
add rdx, 2
dec rcx
nop word cs:[rax + rax]
mov r15, rcx
sub rcx, 1
jb 0x140026609
lea rsi, [rdx - 2]
cmp word [rdx - 4], 0x2e
mov rdx, rsi
jne 0x1400265f0
jmp 0x14002660c
mov rsi, rdi
movzx r12d, byte [rsp + 0x50]
test r12b, 1
mov qword [rsp + 0xe0], rdi
je 0x140026627
mov rbx, qword [rsp + 0x58]
jmp 0x14002662d
mov rbx, r12
shr rbx, 1
shl rbp, 0x20
cdqe
add rax, rbx
lea rdi, [rax + rax]
add rdi, 2
nop
mov rcx, rdi
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140026640
mov r14, rax
lea rdx, [rsp + 0x52]
test r12b, 1
je 0x140026660
mov rdx, qword [rsp + 0x60]
lea r8, [rbx + rbx]
mov rcx, r14
call sub.msvcrt.dll_memcpy
lea rcx, [r14 + rbx*2]
movabs rax, 0x100000000
add rbp, rax
sar rbp, 0x1f
mov rdx, qword [rsp + 0xe0]
mov r8, rbp
call sub.msvcrt.dll_memcpy
test r15, r15
mov r15, qword [rsp + 0x68]
lea r12, [rsp + 0x70]
mov rbp, qword [sym.imp.msvcrt.dll__wcsicmp]
je 0x140026709
mov rdi, qword [0x1402d7308]
mov rbx, qword [0x1402d7310]
cmp rdi, rbx
je 0x1400266d9
nop word [rax + rax]
mov rcx, qword [rdi]
mov rdx, rsi
call rbp
test eax, eax
je 0x14002652c
add rdi, 8
cmp rdi, rbx
jne 0x1400266c0
mov rdi, qword [0x1402d72a8]
mov rbx, qword [0x1402d72b0]
cmp rdi, rbx
je 0x140026709
nop dword [rax]
mov rcx, qword [rdi]
mov rdx, rsi
call rbp
test eax, eax
je 0x140026810
add rdi, 8
cmp rdi, rbx
jne 0x1400266f0
mov rax, qword [r13 + 0x18]
cmp rax, 0x1f400001
jb 0x140026960
mov rdi, qword [0x1402db840]
mov rbx, qword [0x1402db848]
cmp rdi, rbx
je 0x14002674d
nop dword [rax]
mov rcx, qword [rdi]
mov rdx, rsi
call rbp
test eax, eax
je 0x140026ac0
add rdi, 8
cmp rdi, rbx
jne 0x140026730
mov rax, qword [r13 + 0x18]
cmp rax, 0x5dc00001
jb 0x14002689d
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da340]
lea rax, [rax + rax*2]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x18]
mov rcx, rsi
call fcn.1400741a0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rdi, qword [rcx + rax*8]
mov r15, qword [rsp + 0x580]
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov rbp, rax
shl rbp, 0x20
movabs rax, 0x100000000
add rbp, rax
sar rbp, 0x1f
nop word cs:[rax + rax]
mov rcx, rbp
call sub.msvcrt.dll_malloc
test rax, rax
je 0x1400267c0
mov rbx, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov ecx, 0x20
call fcn.1400731c0
lea rcx, [rdi + 0x48]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov qword [rax + 8], rcx
mov rcx, qword [rdi + 0x48]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdi + 0x48], rax
add rdi, 0x58
jmp 0x140026515
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da340]
lea rax, [rax + rax*2]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x28]
mov rcx, rsi
call fcn.1400741a0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rdi, qword [rcx + rax*8]
mov r15, qword [rsp + 0x580]
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov rbp, rax
shl rbp, 0x20
movabs rax, 0x100000000
add rbp, rax
sar rbp, 0x1f
nop dword [rax]
mov rcx, rbp
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140026870
mov rbx, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov ecx, 0x20
call fcn.1400731c0
jmp 0x1400264ef
cmp rax, 0x25800001
jb 0x140026960
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da340]
lea rax, [rax + rax*2]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call fcn.1400741a0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rdi, qword [rcx + rax*8]
mov r15, qword [rsp + 0x580]
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov rbp, rax
shl rbp, 0x20
movabs rax, 0x100000000
add rbp, rax
sar rbp, 0x1f
nop word cs:[rax + rax]
mov rcx, rbp
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140026910
mov rbx, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov ecx, 0x20
call fcn.1400731c0
lea rcx, [rdi + 0x30]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov qword [rax + 8], rcx
mov rcx, qword [rdi + 0x30]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdi + 0x30], rax
add rdi, 0x40
jmp 0x140026515
movsxd rcx, dword [rsp + 0x2c]
mov rdx, qword [0x1402da340]
lea rcx, [rcx + rcx*2]
mov rcx, qword [rdx + rcx*8]
cmp rax, 0x3fffff
ja 0x140026a1a
mov rsi, qword [rcx]
mov rcx, rsi
call fcn.1400741a0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rdi, qword [rcx + rax*8]
mov r15, qword [rsp + 0x580]
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov rbp, rax
shl rbp, 0x20
movabs rax, 0x100000000
add rbp, rax
sar rbp, 0x1f
nop word [rax + rax]
mov rcx, rbp
call sub.msvcrt.dll_malloc
test rax, rax
je 0x1400269d0
mov rbx, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov ecx, 0x20
call fcn.1400731c0
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov qword [rax + 8], rdi
mov rcx, qword [rdi]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdi], rax
add rdi, 0x10
jmp 0x140026515
mov rsi, qword [rcx + 8]
mov rcx, rsi
call fcn.1400741a0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rdi, qword [rcx + rax*8]
mov r15, qword [rsp + 0x580]
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov rbp, rax
shl rbp, 0x20
movabs rax, 0x100000000
add rbp, rax
sar rbp, 0x1f
nop word cs:[rax + rax]
mov rcx, rbp
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140026a70
mov rbx, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov ecx, 0x20
call fcn.1400731c0
lea rcx, [rdi + 0x18]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov qword [rax + 8], rcx
mov rcx, qword [rdi + 0x18]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdi + 0x18], rax
add rdi, 0x28
jmp 0x140026515
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da340]
lea rax, [rax + rax*2]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 0x20]
mov rcx, rsi
call fcn.1400741a0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rdi, qword [rcx + rax*8]
mov r15, qword [rsp + 0x580]
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov rbp, rax
shl rbp, 0x20
movabs rax, 0x100000000
add rbp, rax
sar rbp, 0x1f
nop dword [rax]
mov rcx, rbp
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140026b20
mov rbx, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov ecx, 0x20
call fcn.1400731c0
lea rcx, [rdi + 0x60]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r15
mov qword [rax + 8], rcx
mov rcx, qword [rdi + 0x60]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdi + 0x60], rax
add rdi, 0x70
jmp 0x140026515
cmp qword [rsp + 0x80], 0
je 0x140026bcd
mov rax, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x80], 0
cmp rsi, r12
je 0x140026bcd
nop dword [rax + rax]
mov rdi, qword [rsi + 8]
mov rcx, qword [rsi + 0x28]
call fcn.140257dd0
mov rcx, rsi
call fcn.140073240
mov rsi, rdi
cmp rdi, r12
jne 0x140026bb0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da340]
lea rax, [rax + rax*2]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x30]
call fcn.1400741a0
mov r12, qword [rsp + 0xe8]
movsxd rcx, dword [rsp + 0x2c]
mov rax, qword [0x1402da2e0]
lea rcx, [rcx + rcx*2]
test byte [r15], 1
je 0x140026c0c
mov r12, qword [r15 + 0x10]
mov rdi, qword [rax + rcx*8]
mov r14, qword [rsp + 0x580]
test r12, r12
je 0x140026c60
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov rbx, rax
shl rbx, 0x20
movabs rax, 0x100000000
add rbx, rax
sar rbx, 0x1f
nop dword [rax]
mov rcx, rbx
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140026c40
mov rsi, rax
mov rcx, rax
mov rdx, r12
mov r8, rbx
call sub.msvcrt.dll_memcpy
jmp 0x140026c62
xor esi, esi
mov ecx, 0x20
call fcn.1400731c0
lea r12, [rsp + 0x70]
lea rcx, [rdi + 0x90]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
mov qword [rax + 8], rcx
mov rcx, qword [rdi + 0x90]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdi + 0x90], rax
inc qword [rdi + 0xa0]
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da340]
lea rax, [rax + rax*2]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x30]
call fcn.1400741d0
mov dword [rsp + 0xf8], 0
mov dword [rsp + 0xf0], 0
mov rax, qword [rsp + 0xb8]
sub rax, qword [rsp + 0xb0]
shr rax, 5
mov dword [rsp + 0x114], eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x150], 0
mov ecx, 0x60
call fcn.1400731c0
lea rcx, [0x14025fc38]
mov qword [rax], rcx
lea rcx, [rsp + 0xf8]
mov qword [rax + 8], rcx
lea rcx, [rsp + 0x114]
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0xb0]
mov qword [rax + 0x18], rcx
lea rcx, [rsp + 0xf0]
mov qword [rax + 0x20], rcx
lea rcx, [rsp + 0x2b]
mov qword [rax + 0x28], rcx
lea rcx, [rsp + 0x50]
mov qword [rax + 0x30], rcx
lea rcx, [rsp + 0x108]
mov qword [rax + 0x38], rcx
lea rcx, [rsp + 0x100]
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], r15
lea rcx, [rsp + 0x580]
mov qword [rax + 0x50], rcx
lea rcx, [rsp + 0x2c]
mov qword [rax + 0x58], rcx
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0xc8]
lea rsi, [rsp + 0x130]
mov rdx, rsi
call fcn.140028140
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
jae 0x140026de0
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov qword [rsp + 0xc8], 0
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x140026df2
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xc8]
call fcn.140036680
lea rdi, [rsp + 0xc8]
mov rcx, rdi
call fcn.140077da0
lea rdx, [rsp + 0x130]
mov rcx, rdi
call fcn.140028140
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
jae 0x140026e40
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov qword [rsp + 0xc8], 0
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x140026e52
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xc8]
call fcn.140036680
lea rdi, [rsp + 0xc8]
mov rcx, rdi
call fcn.140077da0
lea rdx, [rsp + 0x130]
mov rcx, rdi
call fcn.140028140
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
jae 0x140026ea0
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov qword [rsp + 0xc8], 0
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x140026eb2
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xc8]
call fcn.140036680
lea rdi, [rsp + 0xc8]
mov rcx, rdi
call fcn.140077da0
lea rdx, [rsp + 0x130]
mov rcx, rdi
call fcn.140028140
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
jae 0x140026f00
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov qword [rsp + 0xc8], 0
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x140026f12
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xc8]
call fcn.140036680
lea rdi, [rsp + 0xc8]
mov rcx, rdi
call fcn.140077da0
lea rdx, [rsp + 0x130]
mov rcx, rdi
call fcn.140028140
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
jae 0x140026f60
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov qword [rsp + 0xc8], 0
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x140026f72
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xc8]
call fcn.140036680
lea rdi, [rsp + 0xc8]
mov rcx, rdi
call fcn.140077da0
lea rdx, [rsp + 0x130]
mov rcx, rdi
call fcn.140028140
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
jae 0x140026fc0
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov qword [rsp + 0xc8], 0
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x140026fd2
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xc8]
call fcn.140036680
lea rdi, [rsp + 0xc8]
mov rcx, rdi
call fcn.140077da0
lea rbx, [rsp + 0x130]
mov rcx, rdi
mov rdx, rbx
call fcn.140028140
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
jae 0x140027023
mov rcx, qword [rsp + 0xc8]
mov qword [rax], rcx
mov qword [rsp + 0xc8], 0
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x140027035
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xc8]
call fcn.140036680
lea rcx, [rsp + 0xc8]
call fcn.140077da0
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
jmp 0x140027054
add r14, 8
cmp r14, rdi
je 0x14002706f
mov rcx, r14
call fcn.14009c250
test al, al
jne 0x140027050
mov rcx, r14
call fcn.140077dc0
jmp 0x140027050
mov rcx, qword [rsp + 0x150]
cmp rcx, rbx
je 0x14002708d
test rcx, rcx
je 0x14002709e
mov rax, qword [rcx]
add rax, 0x28
mov rbx, rcx
jmp 0x140027099
mov rax, qword [rsp + 0x130]
add rax, 0x20
mov rcx, rbx
call qword [rax]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400270e0
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
cmp rsi, rdi
je 0x1400270d6
nop word cs:[rax + rax]
add rsi, 0xfffffffffffffff8
mov rcx, rsi
call fcn.140077da0
cmp rsi, rdi
jne 0x1400270c0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.140073240
mov rsi, qword [rsp + 0xb0]
test rsi, rsi
je 0x140027127
mov rdi, qword [rsp + 0xb8]
mov rcx, rsi
cmp rdi, rsi
je 0x14002711a
nop dword [rax]
mov rcx, qword [rdi - 8]
add rdi, 0xffffffffffffffe0
call fcn.140257dd0
cmp rdi, rsi
jne 0x140027100
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rsi
call fcn.140073240
cmp qword [rsp + 0x80], 0
je 0x14002717d
mov rax, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rax + 8]
mov rdx, qword [rsi]
mov qword [rdx + 8], rcx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov qword [rsp + 0x80], 0
cmp rsi, r12
je 0x14002717d
nop
mov rdi, qword [rsi + 8]
mov rcx, qword [rsi + 0x28]
call fcn.140257dd0
mov rcx, rsi
call fcn.140073240
mov rsi, rdi
cmp rdi, r12
jne 0x140027160
test byte [rsp + 0x50], 1
je 0x14002718e
mov rcx, qword [rsp + 0x60]
call fcn.140073240
cmp byte [rsp + 0x2b], 0
je 0x1400271e4
mov ecx, 8
call fcn.1400731c0
mov rsi, rax
lea rdx, [0x14001e230]
lea r8, [rsp + 0x2c]
mov rcx, rax
mov r9, r15
call fcn.1400282a0
mov ecx, 0x18
call fcn.1400731c0
mov qword [rax + 0x10], rsi
mov rdx, qword [rsp + 0x268]
mov qword [rax + 8], rdx
mov rcx, qword [rdx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdx], rax
inc qword [rdx + 0x10]
test byte [rsp + 0x90], 1
je 0x1400271fb
mov rcx, qword [rsp + 0xa0]
call fcn.140073240
nop
add rsp, 0x518
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
shr rdi, 1
lea rbx, [rdi + 1]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x140027a28
cmp rbx, 0xa
ja 0x140027254
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
add bl, bl
mov byte [rsp + 0x130], bl
xor esi, esi
jmp 0x140027295
mov r14, rbx
or r14, 7
inc r14
js 0x140027a6d
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rsi, rax
or r14, 1
mov qword [rsp + 0x130], r14
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x138], rbx
movzx eax, byte [r15]
and al, 1
mov ebx, r14d
test bl, 1
lea rbx, [rsp + 0x132]
cmove rsi, rbx
mov rdx, r13
test al, al
je 0x1400272af
mov rdx, qword [r15 + 0x10]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
mov dword [rsi + rdi*2], 0x5c
test byte [rsp + 0x130], 1
je 0x1400272d4
mov rbx, qword [rsp + 0x140]
mov rcx, rbx
call fcn.14004e0c0
test byte [rsp + 0x130], 1
je 0x1400272f3
mov rcx, qword [rsp + 0x140]
call fcn.140073240
test byte [rsp + 0x50], 1
lea rcx, [rsp + 0x52]
je 0x140027304
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140026446
lea rdx, str.error_at_exploreing
lea rcx, [rsp + 0x130]
mov r8, r15
call fcn.140013830
test byte [rsp + 0x130], 1
je 0x140027347
mov rcx, qword [rsp + 0x140]
jmp 0x14002734f
lea rcx, [rsp + 0x132]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x130], 1
je 0x14002736d
mov rcx, qword [rsp + 0x140]
call fcn.140073240
lea rcx, [rsp + 0xb0]
call fcn.140028250
lea rcx, [rsp + 0x70]
call fcn.14001e1c0
test byte [rsp + 0x50], 1
je 0x1400271e4
mov rcx, qword [rsp + 0x60]
call fcn.140073240
jmp 0x1400271e4
mov r15, rsi
or r15, 7
inc r15
js 0x140027ac1
lea rcx, [r15 + r15]
call fcn.1400731c0
mov rbx, rax
or r15, 1
mov qword [rsp + 0x2a0], r15
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2a8], rsi
mov rax, qword [rsp + 0x68]
movzx r13d, byte [rax]
mov ebp, r13d
and bpl, 1
mov r9, qword [rax + 8]
mov qword [rsp + 0xe0], r13
shr r13, 1
mov esi, r15d
mov r15, rax
test sil, 1
lea rax, [rsp + 0x2a2]
cmove rbx, rax
mov rsi, qword [r15 + 0x10]
lea r8, [rdi + rdi]
test bpl, bpl
mov rdx, rsi
cmove rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x260], r9
mov r15, r9
cmove r15, r13
mov rcx, rbx
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.programdatamicrosoftwindows_systemdata]
movups xmmword [rbx + rdi*2], xmm0
movups xmm0, xmmword [0x14025d5c0]
movups xmmword [rbx + rdi*2 + 0x10], xmm0
movups xmm0, xmmword [0x14025d5d0]
movups xmmword [rbx + rdi*2 + 0x20], xmm0
movups xmm0, xmmword [0x14025d5e0]
movups xmmword [rbx + rdi*2 + 0x30], xmm0
movups xmm0, xmmword [0x14025d5f0]
movups xmmword [rbx + rdi*2 + 0x40], xmm0
mov dword [rbx + rdi*2 + 0x50], 0x61
lea rdi, [r15 + 0x19]
cmp rdi, r12
ja 0x140027aa0
cmp rdi, 0xa
ja 0x1400274bd
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
add dil, dil
mov byte [rsp + 0x130], dil
xor ebx, ebx
mov rcx, qword [rsp + 0x260]
jmp 0x140027525
mov r12, rdi
or r12, 7
inc r12
js 0x140027ac6
lea rcx, [r12 + r12]
call fcn.1400731c0
mov rbx, rax
or r12, 1
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x138], rdi
mov rax, qword [rsp + 0x68]
movzx r13d, byte [rax]
mov ebp, r13d
and bpl, 1
mov rcx, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0xe0], r13
shr r13, 1
mov edi, r12d
movabs r12, 0x7fffffffffffffef
test dil, 1
lea rdi, [rsp + 0x132]
cmove rbx, rdi
lea r8, [r15 + r15]
test bpl, bpl
mov rdx, rsi
cmove rdx, qword [rsp + 0xe8]
cmovne r13, rcx
mov rcx, rbx
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.program_fileswindows_nt]
movups xmmword [rbx + r15*2], xmm0
movups xmm0, xmmword [0x14025d614]
movups xmmword [rbx + r15*2 + 0x10], xmm0
movups xmm0, xmmword [0x14025d624]
movups xmmword [rbx + r15*2 + 0x20], xmm0
mov dword [rbx + r15*2 + 0x30], 0x74
lea r15, [r13 + 0x16]
cmp r15, r12
ja 0x140027aad
cmp r15, 0xa
ja 0x1400275b3
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
add r15b, r15b
mov byte [rsp + 0x50], r15b
xor ebx, ebx
jmp 0x1400275ff
mov r12, r15
or r12, 7
inc r12
js 0x140027acb
lea rcx, [r12 + r12]
call fcn.1400731c0
mov rbx, rax
or r12, 1
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], r15
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax]
mov qword [rsp + 0xe0], rcx
mov ebp, ecx
and bpl, 1
mov rsi, qword [rax + 0x10]
mov r15d, r12d
test r15b, 1
lea r15, [rsp + 0x52]
cmove rbx, r15
test bpl, bpl
cmove rsi, qword [rsp + 0xe8]
mov r8, r13
add r8, r13
mov rcx, rbx
mov rdx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [0x14025d654]
movups xmmword [rbx + r13*2 + 0x1c], xmm0
movups xmm0, xmmword [0x14025d648]
movups xmmword [rbx + r13*2 + 0x10], xmm0
movups xmm0, xmmword [str.windowsmicrosoft.net]
movups xmmword [rbx + r13*2], xmm0
mov word [rbx + r13*2 + 0x2c], 0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rax, qword [rcx + rax*8]
mov r13, qword [rax + 0x98]
xor ebp, ebp
cmp r13, r14
je 0x140027710
mov r12, qword [sym.imp.msvcrt.dll__wcsicmp]
nop word cs:[rax + rax]
test byte [rsp + 0x2a0], 1
lea rdx, [rsp + 0x2a2]
je 0x1400276aa
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [r13 + 0x10]
call r12
mov esi, eax
test byte [rsp + 0x130], 1
mov rdx, rdi
je 0x1400276c8
mov rdx, qword [rsp + 0x140]
mov rcx, qword [r13 + 0x10]
call r12
mov ebx, eax
test byte [rsp + 0x50], 1
mov rdx, r15
je 0x1400276e0
mov rdx, qword [rsp + 0x60]
mov rcx, qword [r13 + 0x10]
call r12
mov ecx, ebp
xor ebp, ebp
test ebx, ebx
sete bpl
cmp esi, 1
adc ecx, 0
cmp eax, 1
adc ebp, ecx
mov r13, qword [r13 + 8]
cmp r13, r14
jne 0x140027690
mov r15, qword [rsp + 0x68]
movzx eax, byte [r15]
jmp 0x14002771d
mov r15, qword [rsp + 0x68]
mov rax, qword [rsp + 0xe0]
mov ecx, eax
and cl, 1
mov r12, qword [rsp + 0xe8]
je 0x140027732
mov rdi, qword [r15 + 8]
jmp 0x140027737
shr al, 1
movzx edi, al
lea rbx, [rdi + 0x10]
movabs rax, 0x7fffffffffffffef
cmp rbx, rax
ja 0x140027ab7
cmp rbx, 0xa
ja 0x140027772
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
add bl, bl
mov byte [rsp + 0x70], bl
xor esi, esi
jmp 0x1400277ae
mov r14, rbx
or r14, 7
inc r14
js 0x140027ad0
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rsi, rax
or r14, 1
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], rbx
movzx ecx, byte [r15]
and cl, 1
mov ebx, r14d
test bl, 1
lea rbx, [rsp + 0x72]
cmove rsi, rbx
test cl, cl
je 0x1400277c2
mov r12, qword [r15 + 0x10]
lea r8, [rdi + rdi]
mov rcx, rsi
mov rdx, r12
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [0x14025d676]
movups xmmword [rsi + rdi*2 + 0x10], xmm0
movups xmm0, xmmword [str.windowswin.ini]
movups xmmword [rsi + rdi*2], xmm0
mov word [rsi + rdi*2 + 0x20], 0
movsxd rax, dword [rsp + 0x2c]
mov rcx, qword [0x1402da2e0]
lea rax, [rax + rax*2]
mov rsi, qword [rcx + rax*8]
mov rdi, qword [rsi + 8]
cmp rdi, rsi
je 0x140027848
mov r14, qword [sym.imp.msvcrt.dll__wcsicmp]
nop word cs:[rax + rax]
test byte [rsp + 0x70], 1
mov rdx, rbx
je 0x140027832
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rdi + 0x10]
call r14
cmp eax, 1
adc ebp, 0
mov rdi, qword [rdi + 8]
cmp rdi, rsi
jne 0x140027820
cmp ebp, 3
jle 0x14002789e
mov byte [rsp + 0x2b], 1
test byte [rsp + 0x70], 1
je 0x1400278a5
mov rcx, qword [rsp + 0x80]
call fcn.140073240
test byte [rsp + 0x50], 1
je 0x1400278ac
mov rcx, qword [rsp + 0x60]
call fcn.140073240
test byte [rsp + 0x130], 1
je 0x1400278b6
mov rcx, qword [rsp + 0x140]
call fcn.140073240
test byte [rsp + 0x2a0], 1
je 0x14002718e
jmp 0x1400278c4
test byte [rsp + 0x70], 1
jne 0x140027859
test byte [rsp + 0x50], 1
jne 0x14002786d
test byte [rsp + 0x130], 1
jne 0x140027881
test byte [rsp + 0x2a0], 1
je 0x14002718e
mov rcx, qword [rsp + 0x2b0]
jmp 0x140027189
lea r11, [rbx + r14]
cmp r11, r10
je 0x14002546e
sub rax, rbx
add rax, 0xfffffffffffffffe
cmp rax, r14
je 0x14002546e
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x2a0]
lea rdx, [rsp + 0x90]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140075cf0
test byte [rsp + 0x90], 1
je 0x140027934
mov rcx, qword [rsp + 0xa0]
call fcn.140073240
mov rcx, qword [rsp + 0x2b0]
mov qword [rsp + 0xa0], rcx
movups xmm0, xmmword [rsp + 0x2a0]
movaps xmmword [rsp + 0x90], xmm0
movzx r8d, byte [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov r9d, r8d
and r9b, 1
shr r8, 1
jmp 0x14002546e
lea rcx, [rsp + 0x90]
call fcn.140035a10
lea rcx, [rsp + 0xb0]
call fcn.140035a10
lea rcx, [rsp + 0x130]
call fcn.140035a10
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x2a0]
call fcn.140002b00
lea rcx, [rsp + 0x2a0]
call fcn.140002b00
lea rcx, [rsp + 0x2a0]
call fcn.140002b00
lea rcx, [rsp + 0x2a0]
call fcn.140002b00
lea rcx, [rsp + 0x2a0]
call fcn.140002b00
lea rcx, [0x1402da510]
call fcn.140035a10
mov rcx, rsi
call fcn.140035a10
mov rcx, rsi
call fcn.140035a10
mov rcx, rsi
call fcn.140035a10
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x130]
call fcn.140002b00
call fcn.140002ba0
lea rcx, [0x1402da510]
call fcn.140035a10
lea rcx, [0x1402da510]
call fcn.140035a10
lea rcx, [0x1402da510]
call fcn.140035a10
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x50]
call fcn.140002b00
lea rcx, [rsp + 0x118]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x2a0]
call fcn.140002b00
lea rcx, [rsp + 0x130]
call fcn.140002b00
lea rcx, [rsp + 0x50]
call fcn.140002b00
lea rcx, [rsp + 0x70]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
jmp 0x140027e63
mov rdi, rax
jmp 0x140028032
test byte [rsp + 0x90], 1
je 0x140028049
mov rcx, qword [rsp + 0xa0]
call fcn.140073240
mov rcx, rdi
call fcn.14009d370
int3