Function at 0x14002a690
Capabilities:
Create directory
Delete file
Set file attributes
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
movaps xmmword [rsp + 0x210], xmm8
movaps xmmword [rsp + 0x200], xmm7
movaps xmmword [rsp + 0x1f0], xmm6
mov rdi, r8
mov byte [rsp + 0xe8], dl
mov rsi, rcx
mov dword [rsp + 0xdc], r9d
lea rcx, [0x1402884e8]
call fcn.140070b30
movzx eax, byte [0x1402885d0]
test al, al
je 0x14002c9ca
mov eax, dword [0x140288a48]
movabs r12, 0x730065006c0063
cmp eax, dword [rsp + 0xdc]
mov qword [rsp + 0xe0], rsi
jbe 0x14002a720
lea rcx, str.exception_at_keyindex
mov dl, 1
call fcn.140012160
jmp 0x14002a912
movzx esi, byte [0x140288308]
mov ecx, esi
and cl, 1
je 0x14002a737
mov rsi, qword [0x140288310]
jmp 0x14002a73a
shr rsi, 1
lea rbx, [rsi + 0x13]
movabs rax, 0x7fffffffffffffef
cmp rbx, rax
ja 0x14002ca06
cmp rbx, 0xa
ja 0x14002a772
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add bl, bl
mov byte [rsp + 0x40], bl
xor eax, eax
jmp 0x14002a7ab
mov r14, rbx
or r14, 7
inc r14
js 0x14002ca40
lea rcx, [r14 + r14]
call fcn.14006fb50
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movzx ecx, byte [0x140288308]
and cl, 1
mov ebx, r14d
test bl, 1
lea r14, [rsp + 0x42]
cmovne r14, rax
test cl, cl
je 0x14002a7c4
mov rdx, qword [0x140288318]
jmp 0x14002a7cb
lea rdx, [0x14028830a]
lea r8, [rsi + rsi]
mov rcx, r14
call sub.msvcrt.dll_memmove
mov qword [r14 + rsi*2 + 0x1e], r12
movups xmm0, xmmword [str.programdata_secles]
movups xmmword [r14 + rsi*2], xmm0
movdqu xmm0, xmmword [0x1401f58ce]
movdqu xmmword [r14 + rsi*2 + 0x10], xmm0
mov word [r14 + rsi*2 + 0x26], 0
lea rdx, str.posi.txt
lea rcx, [rsp + 0x40]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x1b0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x1a0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x1a0], 1
lea r14, [rsp + 0x1a2]
mov rcx, r14
je 0x14002a856
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14002a8c3
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0xdc]
lea r9, [rsp + 0x180]
mov rcx, r15
mov r8d, 4
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x1a0], 1
je 0x14002a8d5
mov r14, qword [rsp + 0x1b0]
mov rcx, r14
call fcn.14004c5f0
test byte [rsp + 0x1a0], 1
je 0x14002a8f4
mov rcx, qword [rsp + 0x1b0]
call fcn.14006fbd0
test byte [rsp + 0x40], 1
je 0x14002a905
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
mov eax, dword [rsp + 0xdc]
mov dword [0x140288a48], eax
mov rax, qword [0x1402897d8]
mov rcx, qword [0x1402897c8]
lea rdx, [rcx + rax]
add rdx, 0x3fffffff
add rcx, rax
cmovns rdx, rcx
sar rdx, 0x1e
lea rcx, [rsp + 0xa0]
call fcn.1400733c0
lea rdx, str.GB_disk_r_n
lea rcx, [rsp + 0xa0]
call fcn.140071fd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x100], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rax, qword [0x1402897e0]
mov rcx, qword [0x1402897d0]
lea rdx, [rcx + rax]
add rdx, 0x3fffffff
add rcx, rax
cmovns rdx, rcx
sar rdx, 0x1e
lea rcx, [rsp + 0x60]
call fcn.1400733c0
movzx r8d, byte [rsp + 0x60]
test r8b, 1
je 0x14002a9c6
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
jmp 0x14002a9ce
shr r8, 1
lea rdx, [rsp + 0x61]
lea rcx, [rsp + 0xf0]
call fcn.140071800
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x40], xmm0
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, str.GB_network
lea rcx, [rsp + 0x40]
call fcn.140071fd0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x190], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x180], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x40], 1
jne 0x14002aa76
test byte [rsp + 0x60], 1
jne 0x14002aa87
test byte [rsp + 0xf0], 1
jne 0x14002aa9b
test byte [rsp + 0xa0], 1
je 0x14002aa60
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
movzx esi, byte [0x140288308]
mov eax, esi
and al, 1
je 0x14002aab4
mov rsi, qword [0x140288310]
jmp 0x14002aab7
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
je 0x14002aa3f
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xf0], 1
je 0x14002aa49
mov rcx, qword [rsp + 0x100]
call fcn.14006fbd0
test byte [rsp + 0xa0], 1
jne 0x14002aa53
jmp 0x14002aa60
shr rsi, 1
lea rbx, [rsi + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14002c9fc
cmp rbx, 0xa
ja 0x14002aaf2
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add bl, bl
mov byte [rsp + 0x40], bl
xor r15d, r15d
jmp 0x14002ab2d
mov r14, rbx
or r14, 7
inc r14
js 0x14002ca10
lea rcx, [r14 + r14]
call fcn.14006fb50
mov r15, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r14d
test bl, 1
lea r14, [rsp + 0x42]
cmove r15, r14
test al, al
je 0x14002ab46
mov rdx, qword [0x140288318]
jmp 0x14002ab4d
lea rdx, [0x14028830a]
lea r8, [rsi + rsi]
mov rcx, r15
call sub.msvcrt.dll_memmove
mov qword [r15 + rsi*2 + 0x1e], r12
movups xmm6, xmmword [str.programdata_secles]
movups xmmword [r15 + rsi*2], xmm6
movups xmm7, xmmword [0x1401f58ce]
movups xmmword [r15 + rsi*2 + 0x10], xmm7
mov word [r15 + rsi*2 + 0x26], 0
lea rdx, [0x1401fa8ee]
lea rcx, [rsp + 0x40]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x170], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x160], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx r12d, byte [rsp + 0x180]
test r12b, 1
mov rsi, qword [rsp + 0xe0]
je 0x14002abe2
mov r13, qword [rsp + 0x190]
mov r12, qword [rsp + 0x188]
jmp 0x14002abed
shr r12, 1
lea r13, [rsp + 0x181]
test byte [rsp + 0x160], 1
lea r15, [rsp + 0x162]
mov rcx, r15
je 0x14002ac0a
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14002ac6f
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xf0]
mov rcx, rbp
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x160], 1
je 0x14002ac81
mov r15, qword [rsp + 0x170]
mov rcx, r15
call fcn.14004c5f0
test byte [rsp + 0x160], 1
je 0x14002aca0
mov rcx, qword [rsp + 0x170]
call fcn.14006fbd0
test byte [rsp + 0x40], 1
je 0x14002acb1
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
mov byte [rsp + 0xf0], 4
lea rdx, [rsp + 0xf1]
mov byte [rsp + 0xf3], 0
cmp byte [rsp + 0xe8], 0x73
lea rax, [0x14028844a]
lea rcx, [0x140288448]
cmove rcx, rax
movzx eax, word [rcx]
mov word [rsp + 0xf1], ax
mov r8d, 2
mov rcx, rsi
call fcn.140071800
mov r15, qword [0x140285258]
lea rax, [0x140285250]
cmp r15, rax
je 0x14002af61
lea r13, [rsp + 0x1ba]
lea r12, [rsp + 0x1b8]
jmp 0x14002ad53
mov rcx, r15
call fcn.14006fbd0
mov r15, rsi
lea rax, [0x140285250]
cmp rsi, rax
mov rsi, qword [rsp + 0xe0]
je 0x14002af61
movzx ebp, byte [r15 + 0x10]
test bpl, 1
je 0x14002ad70
mov rbx, qword [r15 + 0x20]
mov rbp, qword [r15 + 0x18]
jmp 0x14002ad77
lea rbx, [r15 + 0x11]
shr rbp, 1
movabs rax, 0x7fffffffffffffef
cmp rbp, rax
ja 0x14002c95e
cmp rbp, 0xb
jae 0x14002adb0
lea eax, [rbp + rbp]
mov byte [rsp + 0x1b8], al
mov rax, r13
mov rdx, r13
test rbp, rbp
jne 0x14002ade5
jmp 0x14002af00
mov rsi, rbp
or rsi, 7
inc rsi
js 0x14002c96b
lea rcx, [rsi + rsi]
call fcn.14006fb50
mov qword [rsp + 0x1c8], rax
or rsi, 1
mov qword [rsp + 0x1b8], rsi
mov qword [rsp + 0x1c0], rbp
lea rcx, [rbx + rbp]
cmp rbp, 0x10
jb 0x14002ae05
cmp rax, rcx
jae 0x14002aea0
lea rdx, [rax + rbp*2]
cmp rbx, rdx
jae 0x14002aea0
mov rdx, rax
mov r8, rbx
add ebp, ebx
sub ebp, r8d
mov rax, r8
not rax
add rax, rcx
and rbp, 7
je 0x14002ae34
nop
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rbp
jne 0x14002ae20
cmp rax, 7
jb 0x14002af00
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002ae40
jmp 0x14002af00
mov r9, rbp
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [rbx + r9]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbx + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbx + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002aec0
cmp rbp, r9
jne 0x14002ae0b
nop
mov word [rdx], 0
mov rcx, r12
call fcn.140014020
mov ebp, eax
test byte [rsp + 0x1b8], 1
je 0x14002af26
mov rcx, qword [rsp + 0x1c8]
call fcn.14006fbd0
mov rsi, qword [r15 + 8]
test bpl, bpl
jne 0x14002ad38
mov rax, qword [r15]
mov qword [rax + 8], rsi
mov rcx, qword [r15 + 8]
mov qword [rcx], rax
dec qword [0x140285260]
test byte [r15 + 0x10], 1
je 0x14002ad30
mov rcx, qword [r15 + 0x20]
call fcn.14006fbd0
jmp 0x14002ad30
mov byte [rsp + 0x1d0], 8
mov dword [rsp + 0x1d1], 0x6379626b
mov byte [rsp + 0x1d5], 0
mov r9d, dword [rsp + 0xdc]
lea rdx, [rsp + 0x1d0]
mov rcx, rsi
movzx r8d, byte [rsp + 0xe8]
call fcn.14001a5b0
mov ebp, eax
test byte [rsp + 0x1d0], 1
movabs r12, 0x730065006c0063
je 0x14002afc0
mov rcx, qword [rsp + 0x1e0]
call fcn.14006fbd0
test bpl, bpl
je 0x14002afd1
test byte [rsi], 1
jne 0x14002b017
mov word [rsi], 0
jmp 0x14002b026
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
movzx eax, byte [rdi]
test al, 1
je 0x14002b414
mov rax, qword [rdi + 8]
test rax, rax
je 0x14002b420
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call fcn.140072d10
jmp 0x14002b784
mov rax, qword [rsi + 0x10]
mov byte [rax], 0
mov qword [rsi + 8], 0
mov rbp, qword [0x140285258]
lea rax, [0x140285250]
cmp rbp, rax
je 0x14002b3f6
lea rax, [rdi + 2]
mov qword [rsp + 0xe8], rax
lea r15, [rsp + 0xa2]
lea r12, [rsp + 0x40]
lea r13, [0x1401f55f2]
lea rsi, [rsp + 0x80]
xorps xmm8, xmm8
jmp 0x14002b084
mov rbp, qword [rbp + 8]
lea rax, [0x140285250]
cmp rbp, rax
je 0x14002b3f6
lea rdx, [rbp + 0x10]
mov rcx, r12
call fcn.140071170
movzx r14d, byte [rsp + 0x40]
test r14b, 1
je 0x14002b0b0
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
jmp 0x14002b0b8
shr r14, 1
lea rbx, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp r14, rax
ja 0x14002c970
cmp r14, 0xb
jae 0x14002b100
lea eax, [r14 + r14]
mov byte [rsp + 0x80], al
lea rdx, [rsp + 0x82]
mov rax, rdx
test r14, r14
jne 0x14002b163
jmp 0x14002b280
mov qword [rsp + 0xe0], rbp
mov rbp, rdi
mov rdi, rsi
mov rsi, r13
mov r13, r12
mov r12, r15
mov r15, r14
or r15, 7
inc r15
js 0x14002c9b1
lea rcx, [r15 + r15]
call fcn.14006fb50
mov qword [rsp + 0x90], rax
or r15, 1
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], r14
mov r15, r12
mov r12, r13
mov r13, rsi
mov rsi, rdi
mov rdi, rbp
mov rbp, qword [rsp + 0xe0]
lea rcx, [rbx + r14]
cmp r14, 0x10
jb 0x14002b183
cmp rax, rcx
jae 0x14002b220
lea rdx, [rax + r14*2]
cmp rbx, rdx
jae 0x14002b220
mov rdx, rax
mov r8, rbx
add r14d, ebx
sub r14d, r8d
mov rax, r8
not rax
add rax, rcx
and r14, 7
je 0x14002b1b4
nop
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec r14
jne 0x14002b1a0
cmp rax, 7
jb 0x14002b280
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002b1c0
jmp 0x14002b280
mov r9, r14
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [rbx + r9]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbx + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbx + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002b240
cmp r14, r9
jne 0x14002b189
nop
mov word [rdx], 0
mov rcx, rsi
mov rdx, r13
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0xc0]
lea rdx, str.secles
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
movzx r8d, byte [rdi]
test r8b, 1
je 0x14002b300
mov rdx, qword [rdi + 0x10]
mov r8, qword [rdi + 8]
jmp 0x14002b30b
shr r8, 1
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
mov rcx, r15
je 0x14002b34f
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test byte [rsp + 0xa0], 1
jne 0x14002b390
test byte [rsp + 0x60], 1
jne 0x14002b3a4
test byte [rsp + 0xc0], 1
jne 0x14002b3b8
test byte [rsp + 0x80], 1
jne 0x14002b3cf
test byte [rsp + 0x40], 1
je 0x14002b070
jmp 0x14002b3e7
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
je 0x14002b366
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xc0], 1
je 0x14002b370
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
test byte [rsp + 0x80], 1
je 0x14002b37a
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
test byte [rsp + 0x40], 1
je 0x14002b070
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
jmp 0x14002b070
movzx ebx, byte [0x140288308]
mov ecx, ebx
and cl, 1
je 0x14002b4d8
mov rbx, qword [0x140288310]
jmp 0x14002b4db
shr rax, 1
test rax, rax
jne 0x14002b002
mov qword [rsp + 0x108], 0
lea rcx, [rsp + 0x40]
call fcn.14005e7e0
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x108]
mov r8d, 8
call fcn.14005e7f0
mov rcx, qword [rsp + 0x108]
movabs rdx, 0xfd53d5aa95466a5f
mov rax, rcx
mul rdx
shr rdx, 0x2b
movabs rax, 0x8159b108e38
imul rax, rdx
neg rax
lea rdx, [rcx + rax]
inc rdx
mov qword [rsp + 0x108], rdx
movsx eax, byte [rsp + 0xe8]
mov byte [rsp + 0x60], 2
mov word [rsp + 0x62], ax
mov word [rsp + 0x64], 0
lea rcx, [rsp + 0xc0]
call fcn.140073c90
movzx r8d, byte [rsp + 0xc0]
test r8b, 1
je 0x14002b6a4
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x14002b6af
shr rbx, 1
movabs r15, 0x730065006c0063
lea rsi, [rbx + 0x13]
movabs rax, 0x7fffffffffffffef
cmp rsi, rax
ja 0x14002ca29
cmp rsi, 0xa
ja 0x14002b52a
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
add sil, sil
mov byte [rsp + 0xa0], sil
xor eax, eax
jmp 0x14002b56c
mov r14, rsi
or r14, 7
inc r14
js 0x14002ca4f
lea rcx, [r14 + r14]
call fcn.14006fb50
or r14, 1
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], rsi
movzx ecx, byte [0x140288308]
and cl, 1
mov esi, r14d
test sil, 1
lea rsi, [rsp + 0xa2]
cmovne rsi, rax
test cl, cl
je 0x14002b589
mov rdx, qword [0x140288318]
jmp 0x14002b590
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rsi
call sub.msvcrt.dll_memmove
mov qword [rsi + rbx*2 + 0x1e], r15
movups xmmword [rsi + rbx*2], xmm6
movups xmmword [rsi + rbx*2 + 0x10], xmm7
mov word [rsi + rbx*2 + 0x26], 0
movzx r8d, byte [rdi]
test r8b, 1
je 0x14002b5c5
mov r8, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
jmp 0x14002b5cc
add rdi, 2
shr r8, 1
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x40], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x40], 1
je 0x14002b60d
mov rcx, qword [rsp + 0x50]
jmp 0x14002b612
lea rcx, [rsp + 0x42]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test byte [rsp + 0x40], 1
jne 0x14002b68b
test byte [rsp + 0xa0], 1
jne 0x14002c923
test byte [rsp + 0xf0], 1
jne 0x14002c93e
test byte [rsp + 0x180], 1
je 0x14002b652
mov rcx, qword [rsp + 0x190]
call fcn.14006fbd0
lea rcx, [0x1402884e8]
call fcn.140070b60
movaps xmm6, xmmword [rsp + 0x1f0]
movaps xmm7, xmmword [rsp + 0x200]
movaps xmm8, xmmword [rsp + 0x210]
add rsp, 0x228
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
test byte [rsp + 0xa0], 1
je 0x14002b62d
jmp 0x14002c923
shr r8, 1
lea rdx, [rsp + 0xc2]
lea rcx, [rsp + 0x60]
call fcn.140072750
movzx ebx, byte [rax]
movzx esi, byte [rax + 1]
movzx ebp, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x88], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x80], rcx
mov r15, qword [rax + 0x10]
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
je 0x14002b705
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
mov byte [rsp + 0xa0], bl
mov byte [rsp + 0xa1], sil
mov word [rsp + 0xa2], bp
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xa4], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0xac], eax
mov qword [rsp + 0xb0], r15
test byte [rsp + 0xc0], 1
je 0x14002b759
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
je 0x14002b76a
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.140072d10
lea rcx, [rsp + 0x40]
call fcn.14005e440
movzx esi, byte [0x140288308]
mov eax, esi
and al, 1
je 0x14002b79a
mov rsi, qword [0x140288310]
jmp 0x14002b79d
shr rsi, 1
lea rbx, [rsi + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14002ca15
cmp rbx, 0xa
ja 0x14002b7d7
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add bl, bl
mov byte [rsp + 0x40], bl
xor edi, edi
jmp 0x14002b812
mov r15, rbx
or r15, 7
inc r15
js 0x14002ca45
lea rcx, [r15 + r15]
call fcn.14006fb50
mov rdi, rax
or r15, 1
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r15d
test bl, 1
cmove rdi, r14
test al, al
je 0x14002b826
mov rdx, qword [0x140288318]
jmp 0x14002b82d
lea rdx, [0x14028830a]
lea r8, [rsi + rsi]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov qword [rdi + rsi*2 + 0x1e], r12
movups xmmword [rdi + rsi*2], xmm6
movups xmmword [rdi + rsi*2 + 0x10], xmm7
mov word [rdi + rsi*2 + 0x26], 0
test byte [rsp + 0x40], 1
je 0x14002b85a
mov r14, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test byte [rsp + 0x40], 1
je 0x14002b874
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
movzx esi, byte [0x140288308]
mov eax, esi
and al, 1
je 0x14002b88a
mov rsi, qword [0x140288310]
jmp 0x14002b88d
shr rsi, 1
lea rbx, [rsi + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14002ca1f
cmp rbx, 0xa
ja 0x14002b8c7
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add bl, bl
mov byte [rsp + 0x40], bl
xor edi, edi
jmp 0x14002b902
mov r14, rbx
or r14, 7
inc r14
js 0x14002ca4a
lea rcx, [r14 + r14]
call fcn.14006fb50
mov rdi, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r14d
test bl, 1
lea rbx, [rsp + 0x42]
cmove rdi, rbx
test al, al
je 0x14002b91b
mov rdx, qword [0x140288318]
jmp 0x14002b922
lea rdx, [0x14028830a]
lea r8, [rsi + rsi]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov qword [rdi + rsi*2 + 0x1e], r12
movups xmmword [rdi + rsi*2], xmm6
movups xmmword [rdi + rsi*2 + 0x10], xmm7
mov word [rdi + rsi*2 + 0x26], 0
test byte [rsp + 0x40], 1
je 0x14002b94f
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov rsi, qword [rsp + 0xe0]
test byte [rsp + 0x40], 1
je 0x14002b973
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
mov r13, qword [0x140285258]
lea rax, [0x140285250]
cmp r13, rax
je 0x14002c63d
lea rbx, [0x1401f55f2]
lea r14, [rsp + 0x80]
xorps xmm8, xmm8
lea r15, str.secles
lea r12, [rsp + 0xc0]
jmp 0x14002b9c4
mov r13, qword [r13 + 8]
lea rax, [0x140285250]
cmp r13, rax
je 0x14002c1b2
lea rdx, [r13 + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140071170
movzx edi, byte [rsp + 0x40]
test dil, 1
je 0x14002b9f0
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
jmp 0x14002b9f8
shr rdi, 1
lea rbp, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002c98a
cmp rdi, 0xb
jae 0x14002ba30
lea eax, [rdi + rdi]
mov byte [rsp + 0x80], al
lea rdx, [rsp + 0x82]
mov rax, rdx
test rdi, rdi
jne 0x14002ba6d
jmp 0x14002bb90
mov rsi, rdi
or rsi, 7
inc rsi
js 0x14002c9c0
lea rcx, [rsi + rsi]
call fcn.14006fb50
mov qword [rsp + 0x90], rax
or rsi, 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov rsi, qword [rsp + 0xe0]
lea rcx, [rdi + rbp]
cmp rdi, 0x10
jb 0x14002ba8d
cmp rax, rcx
jae 0x14002bb30
lea rdx, [rax + rdi*2]
cmp rbp, rdx
jae 0x14002bb30
mov rdx, rax
mov r8, rbp
add edi, ebp
sub edi, r8d
mov rax, r8
not rax
add rax, rcx
and rdi, 7
je 0x14002bac4
nop word [rax + rax]
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rdi
jne 0x14002bab0
cmp rax, 7
jb 0x14002bb90
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002bad0
jmp 0x14002bb90
mov r9, rdi
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [r9 + rbp]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbp + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbp + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002bb50
cmp rdi, r9
jne 0x14002ba93
nop
mov word [rdx], 0
mov rcx, r14
mov rdx, rbx
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
mov rcx, r12
mov rdx, r15
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x14002bc00
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test byte [rsp + 0x60], 1
jne 0x14002bc50
test byte [rsp + 0xc0], 1
jne 0x14002bc64
test byte [rsp + 0x80], 1
je 0x14002bc2e
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
movzx edi, byte [rsp + 0x40]
test dil, 1
je 0x14002bc80
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
jmp 0x14002bc88
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xc0], 1
je 0x14002bc17
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
test byte [rsp + 0x80], 1
jne 0x14002bc21
jmp 0x14002bc2e
shr rdi, 1
lea rbp, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002c997
cmp rdi, 0xb
jae 0x14002bcc0
lea eax, [rdi + rdi]
mov byte [rsp + 0x80], al
lea rdx, [rsp + 0x82]
mov rax, rdx
test rdi, rdi
jne 0x14002bcfd
jmp 0x14002be20
mov rsi, rdi
or rsi, 7
inc rsi
js 0x14002c9bb
lea rcx, [rsi + rsi]
call fcn.14006fb50
mov qword [rsp + 0x90], rax
or rsi, 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov rsi, qword [rsp + 0xe0]
lea rcx, [rdi + rbp]
cmp rdi, 0x10
jb 0x14002bd1d
cmp rax, rcx
jae 0x14002bdc0
lea rdx, [rax + rdi*2]
cmp rbp, rdx
jae 0x14002bdc0
mov rdx, rax
mov r8, rbp
add edi, ebp
sub edi, r8d
mov rax, r8
not rax
add rax, rcx
and rdi, 7
je 0x14002bd54
nop word [rax + rax]
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rdi
jne 0x14002bd40
cmp rax, 7
jb 0x14002be20
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002bd60
jmp 0x14002be20
mov r9, rdi
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [r9 + rbp]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbp + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbp + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002bde0
cmp rdi, r9
jne 0x14002bd23
nop
mov word [rdx], 0
mov rcx, r14
mov rdx, rbx
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
mov rcx, r12
mov rdx, r15
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x14002be90
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x60], 1
jne 0x14002bee0
test byte [rsp + 0xc0], 1
jne 0x14002bef4
test byte [rsp + 0x80], 1
je 0x14002bec0
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
movzx edi, byte [rsp + 0x40]
test dil, 1
je 0x14002bf10
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
jmp 0x14002bf18
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xc0], 1
je 0x14002bea9
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
test byte [rsp + 0x80], 1
jne 0x14002beb3
jmp 0x14002bec0
shr rdi, 1
lea rbp, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002c97d
cmp rdi, 0xb
jae 0x14002bf50
lea eax, [rdi + rdi]
mov byte [rsp + 0x80], al
lea rdx, [rsp + 0x82]
mov rax, rdx
test rdi, rdi
jne 0x14002bf8d
jmp 0x14002c0b0
mov rsi, rdi
or rsi, 7
inc rsi
js 0x14002c9b6
lea rcx, [rsi + rsi]
call fcn.14006fb50
mov qword [rsp + 0x90], rax
or rsi, 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov rsi, qword [rsp + 0xe0]
lea rcx, [rdi + rbp]
cmp rdi, 0x10
jb 0x14002bfad
cmp rax, rcx
jae 0x14002c050
lea rdx, [rax + rdi*2]
cmp rbp, rdx
jae 0x14002c050
mov rdx, rax
mov r8, rbp
add edi, ebp
sub edi, r8d
mov rax, r8
not rax
add rax, rcx
and rdi, 7
je 0x14002bfe4
nop word [rax + rax]
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rdi
jne 0x14002bfd0
cmp rax, 7
jb 0x14002c0b0
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002bff0
jmp 0x14002c0b0
mov r9, rdi
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [r9 + rbp]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbp + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbp + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002c070
cmp rdi, r9
jne 0x14002bfb3
nop
mov word [rdx], 0
mov rcx, r14
mov rdx, rbx
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
mov rcx, r12
mov rdx, r15
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x14002c120
mov rcx, qword [rsp + 0x70]
mov edx, 2
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test byte [rsp + 0x60], 1
jne 0x14002c160
test byte [rsp + 0xc0], 1
jne 0x14002c174
test byte [rsp + 0x80], 1
jne 0x14002c18b
test byte [rsp + 0x40], 1
je 0x14002b9b0
jmp 0x14002c1a3
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xc0], 1
je 0x14002c13c
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
test byte [rsp + 0x80], 1
je 0x14002c146
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
test byte [rsp + 0x40], 1
je 0x14002b9b0
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
jmp 0x14002b9b0
mov r12, qword [0x140285258]
lea rax, [0x140285250]
cmp r12, rax
je 0x14002c63d
lea r13, [rsi + 1]
lea rbp, [rsp + 0x142]
lea rbx, [0x1401f55f2]
xorps xmm8, xmm8
jmp 0x14002c205
mov r12, qword [r12 + 8]
lea rax, [0x140285250]
cmp r12, rax
je 0x14002c63d
lea rdx, [r12 + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140071170
movzx edi, byte [rsp + 0x40]
test dil, 1
je 0x14002c230
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
jmp 0x14002c238
shr rdi, 1
lea rsi, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002c9a4
cmp rdi, 0xb
jae 0x14002c270
lea eax, [rdi + rdi]
mov byte [rsp + 0x108], al
lea rdx, [rsp + 0x10a]
mov rax, rdx
test rdi, rdi
jne 0x14002c2a5
jmp 0x14002c3c0
mov r14, rdi
or r14, 7
inc r14
js 0x14002c9c5
lea rcx, [r14 + r14]
call fcn.14006fb50
mov qword [rsp + 0x118], rax
or r14, 1
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x110], rdi
lea rcx, [rsi + rdi]
cmp rdi, 0x10
jb 0x14002c2c5
cmp rax, rcx
jae 0x14002c360
lea rdx, [rax + rdi*2]
cmp rsi, rdx
jae 0x14002c360
mov rdx, rax
mov r8, rsi
add edi, esi
sub edi, r8d
mov rax, r8
not rax
add rax, rcx
and rdi, 7
je 0x14002c2f4
nop
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rdi
jne 0x14002c2e0
cmp rax, 7
jb 0x14002c3c0
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002c300
jmp 0x14002c3c0
mov r9, rdi
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [rsi + r9]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rsi + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002c380
cmp rdi, r9
jne 0x14002c2cb
nop
mov word [rdx], 0
lea rcx, [rsp + 0x108]
mov rdx, rbx
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x80]
lea rdx, str.secles
call fcn.140072e90
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0xc0]
mov rdx, rbx
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
movzx r8d, byte [rsp + 0xa0]
test r8b, 1
je 0x14002c490
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xa8]
jmp 0x14002c49b
shr r8, 1
lea rdx, [rsp + 0xa2]
lea rcx, [rsp + 0x60]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x150], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x140], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
movzx edi, byte [rsi]
test dil, 1
je 0x14002c4e0
mov r14, qword [rsi + 0x10]
mov rdi, qword [rsi + 8]
jmp 0x14002c4e6
shr rdi, 1
mov r14, r13
test byte [rsp + 0x140], 1
mov rcx, rbp
je 0x14002c4fb
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14002c560
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r8d, edi
lea r9, [rsp + 0x1ec]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x140], 1
mov rcx, rbp
je 0x14002c575
mov rcx, qword [rsp + 0x150]
call fcn.14004c5f0
test byte [rsp + 0x140], 1
jne 0x14002c5c0
test byte [rsp + 0x60], 1
jne 0x14002c5d4
test byte [rsp + 0xc0], 1
jne 0x14002c5e8
test byte [rsp + 0x80], 1
jne 0x14002c5ff
test byte [rsp + 0x108], 1
jne 0x14002c616
test byte [rsp + 0x40], 1
je 0x14002c1f0
jmp 0x14002c62e
mov rcx, qword [rsp + 0x150]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
je 0x14002c58b
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xc0], 1
je 0x14002c595
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
test byte [rsp + 0x80], 1
je 0x14002c59f
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
test byte [rsp + 0x108], 1
je 0x14002c5a9
mov rcx, qword [rsp + 0x118]
call fcn.14006fbd0
test byte [rsp + 0x40], 1
je 0x14002c1f0
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
jmp 0x14002c1f0
movzx esi, byte [0x140288308]
mov ecx, esi
and cl, 1
je 0x14002c654
mov rsi, qword [0x140288310]
jmp 0x14002c657
shr rsi, 1
movabs r14, 0x730065006c0063
lea rdi, [rsi + 0x13]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002ca36
cmp rdi, 0xa
ja 0x14002c69d
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
add dil, dil
mov byte [rsp + 0x60], dil
xor eax, eax
jmp 0x14002c6d5
mov rbx, rdi
or rbx, 7
inc rbx
js 0x14002ca54
lea rcx, [rbx + rbx]
call fcn.14006fb50
or rbx, 1
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rdi
movzx ecx, byte [0x140288308]
and cl, 1
mov edi, ebx
test dil, 1
lea rdi, [rsp + 0x62]
cmovne rdi, rax
test cl, cl
je 0x14002c6ef
mov rdx, qword [0x140288318]
jmp 0x14002c6f6
lea rdx, [0x14028830a]
lea r8, [rsi + rsi]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov qword [rdi + rsi*2 + 0x1e], r14
movups xmmword [rdi + rsi*2], xmm6
movups xmmword [rdi + rsi*2 + 0x10], xmm7
mov word [rdi + rsi*2 + 0x26], 0
lea rdx, [0x1401f55f2]
lea rcx, [rsp + 0x60]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x40], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx r8d, byte [rsp + 0xa0]
test r8b, 1
mov rsi, qword [rsp + 0xe0]
je 0x14002c774
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xa8]
jmp 0x14002c77f
shr r8, 1
lea rdx, [rsp + 0xa2]
lea rcx, [rsp + 0x40]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x130], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x120], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx ebx, byte [rsi]
lea r12, [rsi + 1]
test bl, 1
je 0x14002c7c8
mov r14, qword [rsi + 0x10]
mov rbx, qword [rsi + 8]
jmp 0x14002c7ce
shr rbx, 1
mov r14, r12
test byte [rsp + 0x120], 1
lea rdi, [rsp + 0x122]
mov rcx, rdi
je 0x14002c7eb
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14002c850
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc0]
mov rcx, r15
mov rdx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x120], 1
je 0x14002c862
mov rdi, qword [rsp + 0x130]
mov rcx, rdi
call fcn.14004c5f0
test byte [rsp + 0x120], 1
jne 0x14002c89a
test byte [rsp + 0x40], 1
jne 0x14002c8ae
test byte [rsp + 0x60], 1
je 0x14002c88c
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
movzx ecx, byte [rsi]
test cl, 1
je 0x14002c8c1
mov rax, qword [rsi + 8]
jmp 0x14002c8c7
mov rcx, qword [rsp + 0x130]
call fcn.14006fbd0
test byte [rsp + 0x40], 1
je 0x14002c87b
mov rcx, qword [rsp + 0x50]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
jne 0x14002c882
jmp 0x14002c88c
mov rax, rcx
shr rax, 1
dec rax
test cl, 1
jne 0x14002c8d9
lea ecx, [rax + rax]
mov byte [rsi], cl
mov rcx, r12
jmp 0x14002c8e1
mov rcx, qword [rsi + 0x10]
mov qword [rsi + 8], rax
mov byte [rcx + rax], 0
movzx ecx, byte [rsi]
test cl, 1
je 0x14002c8f3
mov rax, qword [rsi + 8]
jmp 0x14002c8f9
mov rax, rcx
shr rax, 1
dec rax
test cl, 1
jne 0x14002c908
lea ecx, [rax + rax]
mov byte [rsi], cl
jmp 0x14002c910
mov r12, qword [rsi + 0x10]
mov qword [rsi + 8], rax
mov byte [r12 + rax], 0
test byte [rsp + 0xa0], 1
je 0x14002b62d
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0xf0], 1
je 0x14002b63b
mov rcx, qword [rsp + 0x100]
call fcn.14006fbd0
test byte [rsp + 0x180], 1
jne 0x14002b645
jmp 0x14002b652
lea rcx, [rsp + 0x1b8]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x80]
call fcn.140002ec0
lea rcx, [rsp + 0x80]
call fcn.140002ec0
lea rcx, [rsp + 0x80]
call fcn.140002ec0
lea rcx, [rsp + 0x80]
call fcn.140002ec0
lea rcx, [rsp + 0x108]
call fcn.140002ec0
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
lea rcx, [0x1402885d0]
call fcn.14006e284
test eax, eax
je 0x14002a6ec
mov eax, dword [rsp + 0xdc]
mov dword [0x140288a48], eax
lea rcx, [0x1402885d0]
call fcn.14006e35f
jmp 0x14002a6ec
lea rcx, [rsp + 0x40]
call fcn.140002ec0
lea rcx, [rsp + 0x40]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x40]
call fcn.140002ec0
lea rcx, [rsp + 0x40]
call fcn.140002ec0
lea rcx, [rsp + 0xa0]
call fcn.140002ec0
lea rcx, [rsp + 0x60]
call fcn.140002ec0
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
mov rsi, rax
test byte [rsp + 0xc0], 1
je 0x14002cbf2
mov rcx, qword [rsp + 0xd0]
jmp 0x14002cbed
call fcn.14006fbd0
test byte [rsp + 0x60], 1
je 0x14002cf38
mov rcx, qword [rsp + 0x70]
jmp 0x14002cf33
call fcn.14006fbd0
test byte [rsp + 0xa0], 1
je 0x14002cf54
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
jmp 0x14002cf54
test byte [rsp + 0xf0], 1
je 0x14002cf6b
mov rcx, qword [rsp + 0x100]
call fcn.14006fbd0
test byte [rsp + 0x180], 1
je 0x14002cf82
mov rcx, qword [rsp + 0x190]
call fcn.14006fbd0
lea rcx, [0x1402884e8]
call fcn.140070b60
mov rcx, rsi
call fcn.14009a110
int3