Function at 0x18002ac10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movzx r13d, r8b
mov byte [rsp + 0x44], r8b
mov r12, rdx
mov rax, rcx
mov qword [rsp + 0xb8], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x110], xmm1
xor ebx, ebx
mov qword [rsp + 0x120], rbx
mov dword [rsp + 0x108], ebx
mov qword [rsp + 0x48], rbx
cmp rcx, 0xffffffffffffffff
jne 0x18002acb7
mov eax, 0xc00000ef
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.18005e1d0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test r12, r12
jne 0x18002acc3
mov eax, 0xc00000f0
jmp 0x18002ac8a
mov esi, 0x100000
cmp byte [0x18009b380], 0
je 0x18002ad02
mov eax, 0xa47
lea rbx, str.E:_buildsARK23181_2_trufos_dll_rebcmd.c
mov qword [rsp + 0x28], rbx
mov word [rsp + 0x20], ax
xor r9d, r9d
mov r8d, 0x4352413a
mov edx, esi
lea rcx, [0x18009cc40]
call fcn.18004b960
xor ebx, ebx
jmp 0x18002ad1b
mov r8, rsi
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
mov rdi, rax
test rax, rax
jne 0x18002ad31
mov ebx, 0xc000009a
mov dword [rsp + 0x40], ebx
jmp 0x18002d137
mov qword [rsp + 0x120], rdi
mov ecx, dword [r12 + 0x1c]
test ecx, ecx
je 0x18002cbb0
sub ecx, 1
je 0x18002c290
sub ecx, 1
je 0x18002b7bd
sub ecx, 1
je 0x18002b15d
cmp ecx, 1
je 0x18002ad74
mov ebx, 0xe8000011
mov dword [rsp + 0x40], ebx
jmp 0x18002d137
lea r14, [r12 + 0x26]
mov qword [rsp + 0xc8], r14
movzx r15d, word [r12 + 0x24]
mov word [rsp + 0xc2], r15w
mov word [rsp + 0xc0], r15w
lea rdx, str._t_cmdRegDeleteKey:
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002adf3
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x95
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
mov r8d, r10d
mov dword [rsp + 0x50], r10d
test r13b, r13b
je 0x18002ae60
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002ae52
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0x50], r8d
jmp 0x18002ae20
mov dword [r9], ecx
jmp 0x18002ae94
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002ae8d
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdi + rdx], cl
inc r8d
mov dword [rsp + 0x50], r8d
jmp 0x18002ae60
mov eax, ecx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
add rdi, rcx
jne 0x18002aebe
mov ebx, 0xc00000ef
jmp 0x18002aed9
mov r8d, r15d
test r13b, r13b
je 0x18002aecb
cmp esi, r15d
jmp 0x18002aed2
mov eax, r15d
shr eax, 1
cmp esi, eax
jae 0x18002af19
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x97
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov edx, r10d
mov dword [rsp + 0x54], edx
test r13b, r13b
je 0x18002af50
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002af45
mov eax, edx
lea rcx, [rax + rax]
movzx eax, word [rcx + r14]
mov word [rcx + rdi], ax
inc edx
mov dword [rsp + 0x54], edx
jmp 0x18002af25
mov dword [r9], r8d
jmp 0x18002af6e
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002af6b
mov ecx, edx
movzx eax, byte [r14 + rcx*2]
mov byte [rdi + rcx], al
inc edx
mov dword [rsp + 0x54], edx
jmp 0x18002af50
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, [0x1800918a4]
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002afd9
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x98
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002aff8
mov ebx, 0xc00000ef
jmp 0x18002b016
movzx ecx, word [rsp + 0x110]
test r13b, r13b
je 0x18002b009
cmp esi, ecx
jmp 0x18002b00f
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002b056
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x99
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x58], r10d
test r13b, r13b
je 0x18002b0a0
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002b096
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0x58], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002b063
movzx eax, cx
jmp 0x18002b0d3
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002b0ce
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdi + rdx], cl
inc r8d
mov dword [rsp + 0x58], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002b0a0
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov ebx, r10d
mov dword [rsp + 0x40], ebx
sub esi, dword [rsp + 0x108]
mov r8d, 0x100000
sub r8d, esi
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x108]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002d137
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rax - 0x17100000]
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x9a
jmp 0x18002d11b
lea r14, [r12 + 0x28]
mov qword [rsp + 0xc8], r14
movzx r15d, word [r12 + 0x24]
mov word [rsp + 0xc2], r15w
mov word [rsp + 0xc0], r15w
lea r13, [r12 + 0x28]
add r13, r15
mov qword [rsp + 0xe0], r13
movzx r12d, word [r12 + 0x26]
mov word [rsp + 0xda], r12w
mov word [rsp + 0xd8], r12w
lea rdx, str._t_cmdRegDeleteValue:_KeyName_
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002b204
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x8c
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r11, [rsp + 0x108]
movzx r9d, byte [rsp + 0x44]
mov r8d, r10d
mov dword [rsp + 0x5c], r10d
test r9b, r9b
je 0x18002b270
nop word [rax + rax]
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002b262
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0x5c], r8d
jmp 0x18002b230
mov dword [r11], ecx
jmp 0x18002b2a4
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002b29d
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x5c], r8d
jmp 0x18002b270
mov eax, ecx
shr eax, 1
mov dword [r11], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r11, [rsp + 0x108]
add rdi, rcx
jne 0x18002b2ce
mov ebx, 0xc00000ef
jmp 0x18002b2e9
mov r8d, r15d
test r9b, r9b
je 0x18002b2db
cmp esi, r15d
jmp 0x18002b2e2
mov eax, r15d
shr eax, 1
cmp esi, eax
jae 0x18002b329
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x8e
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
movzx r15d, r9b
mov edx, r10d
mov dword [rsp + 0x60], edx
test r9b, r9b
je 0x18002b365
nop dword [rax]
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002b360
mov eax, edx
lea rcx, [rax + rax]
movzx eax, word [rcx + r14]
mov word [rcx + rdi], ax
inc edx
mov dword [rsp + 0x60], edx
jmp 0x18002b340
mov dword [r11], r8d
jmp 0x18002b383
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002b380
mov ecx, edx
movzx eax, byte [r14 + rcx*2]
mov byte [rdi + rcx], al
inc edx
mov dword [rsp + 0x60], edx
jmp 0x18002b365
mov dword [r11], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, str._ValueName_
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002b3ee
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x8f
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002b40d
mov ebx, 0xc00000ef
jmp 0x18002b42b
movzx ecx, word [rsp + 0x110]
test r15b, r15b
je 0x18002b41e
cmp esi, ecx
jmp 0x18002b424
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002b46b
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x90
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x64], r10d
test r15b, r15b
je 0x18002b4c0
nop dword [rax + rax]
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002b4b3
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0x64], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002b480
movzx eax, cx
jmp 0x18002b4f3
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002b4ee
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdi + rdx], cl
inc r8d
mov dword [rsp + 0x64], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002b4c0
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
add rdi, rcx
jne 0x18002b520
mov ebx, 0xc00000ef
jmp 0x18002b53b
mov r8d, r12d
test r15b, r15b
je 0x18002b52d
cmp esi, r12d
jmp 0x18002b534
mov eax, r12d
shr eax, 1
cmp esi, eax
jae 0x18002b57b
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x91
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov edx, r10d
mov dword [rsp + 0x68], edx
test r15b, r15b
je 0x18002b5b0
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002b5a7
mov eax, edx
lea rcx, [rax + rax]
movzx eax, word [rcx + r13]
mov word [rcx + rdi], ax
inc edx
mov dword [rsp + 0x68], edx
jmp 0x18002b587
mov dword [r9], r8d
jmp 0x18002b5cf
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002b5cc
mov ecx, edx
movzx eax, byte [r13 + rcx*2]
mov byte [rdi + rcx], al
inc edx
mov dword [rsp + 0x68], edx
jmp 0x18002b5b0
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, [0x1800918a4]
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002b63a
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x92
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002b659
mov ebx, 0xc00000ef
jmp 0x18002b677
movzx ecx, word [rsp + 0x110]
test r15b, r15b
je 0x18002b66a
cmp esi, ecx
jmp 0x18002b670
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002b6b7
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x93
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x6c], r10d
test r15b, r15b
je 0x18002b700
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002b6f7
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0x6c], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002b6c4
movzx eax, cx
jmp 0x18002b733
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002b72e
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdi + rdx], cl
inc r8d
mov dword [rsp + 0x6c], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002b700
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov ebx, r10d
mov dword [rsp + 0x40], ebx
sub esi, dword [rsp + 0x108]
mov r8d, 0x100000
sub r8d, esi
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x108]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002d137
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rax - 0x17100000]
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x94
jmp 0x18002d11b
mov qword [rsp + 0x138], rbx
lea r14, [r12 + 0x30]
mov qword [rsp + 0xc8], r14
movzx r15d, word [r12 + 0x24]
mov word [rsp + 0xc2], r15w
mov word [rsp + 0xc0], r15w
lea r13, [r12 + 0x30]
add r13, r15
mov qword [rsp + 0xe0], r13
movzx eax, word [r12 + 0x26]
mov word [rsp + 0x46], ax
mov word [rsp + 0xda], ax
mov word [rsp + 0xd8], ax
mov eax, dword [r12 + 0x28]
mov dword [rsp + 0x30], eax
lea rax, str._ValueType___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
lea r8, [rsp + 0x138]
lea edx, [r9 + 0x64]
lea rcx, [rsp + 0x140]
call fcn.180026050
mov r9d, eax
test eax, eax
je 0x18002b897
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002b889
test byte [rcx + 0x1c], 1
je 0x18002b889
cmp byte [rcx + 0x19], 2
jb 0x18002b889
mov edx, 0x7d
lea r8, [0x1800919f8]
mov rcx, qword [rcx + 0x10]
call fcn.180001270
mov ebx, 0xc0000001
mov dword [rsp + 0x40], ebx
jmp 0x18002d137
lea rdx, str._t_cmdRegModifyValue:_KeyName_
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002b8f1
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x7e
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r11, [rsp + 0x108]
movzx r9d, byte [rsp + 0x44]
mov r8d, r10d
mov dword [rsp + 0x70], r10d
test r9b, r9b
je 0x18002b960
nop word [rax + rax]
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002b952
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0x70], r8d
jmp 0x18002b920
mov dword [r11], ecx
jmp 0x18002b994
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002b98d
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x70], r8d
jmp 0x18002b960
mov eax, ecx
shr eax, 1
mov dword [r11], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r11, [rsp + 0x108]
add rdi, rcx
jne 0x18002b9be
mov ebx, 0xc00000ef
jmp 0x18002b9d9
mov r8d, r15d
test r9b, r9b
je 0x18002b9cb
cmp esi, r15d
jmp 0x18002b9d2
mov eax, r15d
shr eax, 1
cmp esi, eax
jae 0x18002ba19
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x80
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
movzx r15d, r9b
mov edx, r10d
mov dword [rsp + 0x74], edx
test r9b, r9b
je 0x18002ba55
nop dword [rax]
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002ba50
mov eax, edx
lea rcx, [rax + rax]
movzx eax, word [rcx + r14]
mov word [rcx + rdi], ax
inc edx
mov dword [rsp + 0x74], edx
jmp 0x18002ba30
mov dword [r11], r8d
jmp 0x18002ba73
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002ba70
mov ecx, edx
movzx eax, byte [r14 + rcx*2]
mov byte [rcx + rdi], al
inc edx
mov dword [rsp + 0x74], edx
jmp 0x18002ba55
mov dword [r11], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, str._ValueName_
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002bade
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x81
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002bafd
mov ebx, 0xc00000ef
jmp 0x18002bb1b
movzx ecx, word [rsp + 0x110]
test r15b, r15b
je 0x18002bb0e
cmp esi, ecx
jmp 0x18002bb14
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002bb5b
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x82
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x78], r10d
test r15b, r15b
je 0x18002bbb0
nop dword [rax + rax]
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002bba3
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0x78], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002bb70
movzx eax, cx
jmp 0x18002bbe3
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002bbde
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x78], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002bbb0
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
add rdi, rcx
jne 0x18002bc10
mov ebx, 0xc00000ef
jmp 0x18002bc2e
movzx r8d, word [rsp + 0x46]
test r15b, r15b
je 0x18002bc20
cmp esi, r8d
jmp 0x18002bc27
mov eax, r8d
shr eax, 1
cmp esi, eax
jae 0x18002bc6e
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x83
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov edx, r10d
mov dword [rsp + 0x7c], edx
test r15b, r15b
je 0x18002bca5
nop word [rax + rax]
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002bca0
mov eax, edx
lea rcx, [rax + rax]
movzx eax, word [rcx + r13]
mov word [rdi + rcx], ax
inc edx
mov dword [rsp + 0x7c], edx
jmp 0x18002bc80
mov dword [r9], r8d
jmp 0x18002bcc4
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002bcc1
mov ecx, edx
movzx eax, byte [r13 + rcx*2]
mov byte [rcx + rdi], al
inc edx
mov dword [rsp + 0x7c], edx
jmp 0x18002bca5
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002bd30
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x84
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002bd4f
mov ebx, 0xc00000ef
jmp 0x18002bd6d
movzx ecx, word [rsp + 0x110]
test r15b, r15b
je 0x18002bd60
cmp esi, ecx
jmp 0x18002bd66
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002bdad
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x85
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x80], r10d
test r15b, r15b
je 0x18002be00
nop dword [rax]
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002bdf6
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rax + rdx]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0x80], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002bdc0
movzx eax, cx
jmp 0x18002be36
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002be31
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x80], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002be00
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, str._Data_
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002bea4
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x86
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002bec3
mov ebx, 0xc00000ef
jmp 0x18002bee1
movzx ecx, word [rsp + 0x110]
test r15b, r15b
je 0x18002bed4
cmp esi, ecx
jmp 0x18002beda
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002bf21
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x87
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x84], r10d
test r15b, r15b
je 0x18002bf70
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002bf67
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rax + rdx]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0x84], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002bf31
movzx eax, cx
jmp 0x18002bfa6
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002bfa1
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x84], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002bf70
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
movzx r8d, word [r12 + 0x26]
movzx ecx, word [r12 + 0x24]
add r8, r12
add rcx, 0x30
add r8, rcx
mov qword [rsp + 0x118], r8
movzx ecx, word [r12 + 0x2c]
mov word [rsp + 0x112], cx
mov word [rsp + 0x110], cx
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002c00a
mov ebx, 0xc00000ef
jmp 0x18002c017
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002c057
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x88
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov edx, r10d
mov dword [rsp + 0xd0], edx
movzx eax, cx
shr eax, 1
cmp edx, eax
jae 0x18002c088
mov ecx, edx
movzx eax, byte [r8 + rcx*2]
mov byte [rcx + rdi], al
inc edx
mov r8, qword [rsp + 0x118]
movzx ecx, word [rsp + 0x110]
jmp 0x18002c05a
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, [0x1800918a4]
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002c0fb
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x89
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002c11a
mov ebx, 0xc00000ef
jmp 0x18002c138
movzx ecx, word [rsp + 0x110]
test r15b, r15b
je 0x18002c12b
cmp esi, ecx
jmp 0x18002c131
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002c178
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x8a
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x88], r10d
test r15b, r15b
je 0x18002c1d0
nop dword [rax + rax]
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002c1c6
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rax + rdx]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0x88], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002c190
movzx eax, cx
jmp 0x18002c206
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002c201
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x88], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002c1d0
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov ebx, r10d
mov dword [rsp + 0x40], ebx
sub esi, dword [rsp + 0x108]
mov r8d, 0x100000
sub r8d, esi
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x108]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002d137
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rax - 0x17100000]
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x8b
jmp 0x18002d11b
lea rax, [r12 + 0x2a]
mov qword [rsp + 0x130], rax
movzx eax, word [r12 + 0x24]
mov word [rsp + 0x12a], ax
mov word [rsp + 0x128], ax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x128]
call fcn.180042180
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002c30b
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x71
lea r9, str.TrfGetVolInfoObjectFromVolumeGUID
jmp 0x18002d122
movzx ecx, word [r12 + 0x24]
lea r13, [r12 + 0x2a]
add r13, rcx
mov qword [rsp + 0x100], r13
movzx eax, word [r12 + 0x26]
mov word [rsp + 0x46], ax
mov word [rsp + 0xfa], ax
mov word [rsp + 0xf8], ax
movzx r15d, word [r12 + 0x28]
lea rax, [r12 + r15]
lea r14, [rcx + 0x2a]
add r14, rax
mov qword [rsp + 0xf0], r14
mov word [rsp + 0xea], r15w
mov word [rsp + 0xe8], r15w
lea rdx, str._t_cmdFileCopy:
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002c3c1
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x72
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
movzx r12d, byte [rsp + 0x44]
mov r8d, r10d
mov dword [rsp + 0x8c], r10d
test r12b, r12b
je 0x18002c430
nop word [rax + rax]
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002c425
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0x8c], r8d
jmp 0x18002c3f0
mov dword [r9], ecx
jmp 0x18002c467
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002c460
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x8c], r8d
jmp 0x18002c430
mov eax, ecx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r11, [rsp + 0x108]
mov r9, qword [rsp + 0x48]
add r9, 0x30
add rdi, rcx
jne 0x18002c49a
mov ebx, 0xc00000ef
jmp 0x18002c4ba
test r9, r9
jne 0x18002c4a6
mov ebx, 0xc00000f1
jmp 0x18002c4ba
movzx eax, word [r9]
test r12b, r12b
jne 0x18002c4b1
shr eax, 1
cmp esi, eax
jae 0x18002c4fa
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x74
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x90], r10d
test r12b, r12b
je 0x18002c542
nop word [rax + rax]
movzx ecx, word [r9]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002c53d
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [r9 + 8]
movzx ecx, word [rdx + rax]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0x90], r8d
jmp 0x18002c510
mov dword [r11], ecx
jmp 0x18002c56b
movzx eax, word [r9]
shr eax, 1
cmp r8d, eax
jae 0x18002c568
mov edx, r8d
mov rax, qword [r9 + 8]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x90], r8d
jmp 0x18002c542
mov dword [r11], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
add rdi, rcx
jne 0x18002c595
mov ebx, 0xc00000ef
jmp 0x18002c5b0
mov r8d, r15d
test r12b, r12b
je 0x18002c5a2
cmp esi, r15d
jmp 0x18002c5a9
mov eax, r15d
shr eax, 1
cmp esi, eax
jae 0x18002c5f0
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x75
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov edx, r10d
mov dword [rsp + 0x94], edx
test r12b, r12b
je 0x18002c630
nop
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002c623
mov eax, edx
lea rcx, [rax + rax]
movzx eax, word [rcx + r14]
mov word [rdi + rcx], ax
inc edx
mov dword [rsp + 0x94], edx
jmp 0x18002c600
mov dword [r9], r8d
jmp 0x18002c651
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002c64e
mov ecx, edx
movzx eax, byte [r14 + rcx*2]
mov byte [rcx + rdi], al
inc edx
mov dword [rsp + 0x94], edx
jmp 0x18002c630
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, str.___
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002c6bc
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x76
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002c6db
mov ebx, 0xc00000ef
jmp 0x18002c6f9
movzx ecx, word [rsp + 0x110]
test r12b, r12b
je 0x18002c6ec
cmp esi, ecx
jmp 0x18002c6f2
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002c739
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x77
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x98], r10d
test r12b, r12b
je 0x18002c790
nop dword [rax]
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002c786
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0x98], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002c750
movzx eax, cx
jmp 0x18002c7c6
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002c7c1
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x98], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002c790
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r11, [rsp + 0x108]
mov r9, qword [rsp + 0x48]
add r9, 0x30
add rdi, rcx
jne 0x18002c7fc
mov ebx, 0xc00000ef
jmp 0x18002c81c
test r9, r9
jne 0x18002c808
mov ebx, 0xc00000f1
jmp 0x18002c81c
movzx eax, word [r9]
test r12b, r12b
jne 0x18002c813
shr eax, 1
cmp esi, eax
jae 0x18002c85c
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x78
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0x9c], r10d
test r12b, r12b
je 0x18002c8a2
nop dword [rax]
movzx ecx, word [r9]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002c89d
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [r9 + 8]
movzx ecx, word [rdx + rax]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0x9c], r8d
jmp 0x18002c870
mov dword [r11], ecx
jmp 0x18002c8cb
movzx eax, word [r9]
shr eax, 1
cmp r8d, eax
jae 0x18002c8c8
mov edx, r8d
mov rax, qword [r9 + 8]
movzx ecx, byte [rax + rdx*2]
mov byte [rdx + rdi], cl
inc r8d
mov dword [rsp + 0x9c], r8d
jmp 0x18002c8a2
mov dword [r11], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
add rdi, rcx
jne 0x18002c8f5
mov ebx, 0xc00000ef
jmp 0x18002c913
movzx r8d, word [rsp + 0x46]
test r12b, r12b
je 0x18002c905
cmp esi, r8d
jmp 0x18002c90c
mov eax, r8d
shr eax, 1
cmp esi, eax
jae 0x18002c953
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x79
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov edx, r10d
mov dword [rsp + 0xa0], edx
test r12b, r12b
je 0x18002c990
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002c985
mov eax, edx
lea rcx, [rax + rax]
movzx eax, word [rcx + r13]
mov word [rdi + rcx], ax
inc edx
mov dword [rsp + 0xa0], edx
jmp 0x18002c962
mov dword [r9], r8d
jmp 0x18002c9b2
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002c9af
mov ecx, edx
movzx eax, byte [r13 + rcx*2]
mov byte [rcx + rdi], al
inc edx
mov dword [rsp + 0xa0], edx
jmp 0x18002c990
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, [0x1800918a4]
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002ca1d
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x7a
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002ca3c
mov ebx, 0xc00000ef
jmp 0x18002ca5a
movzx ecx, word [rsp + 0x110]
test r12b, r12b
je 0x18002ca4d
cmp esi, ecx
jmp 0x18002ca53
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002ca9a
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x7b
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0xa4], r10d
test r12b, r12b
je 0x18002caf0
nop word [rax + rax]
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002cae6
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdi + rdx], cx
inc r8d
mov dword [rsp + 0xa4], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002cab0
movzx eax, cx
jmp 0x18002cb26
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002cb21
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdi + rdx], cl
inc r8d
mov dword [rsp + 0xa4], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002caf0
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov ebx, r10d
mov dword [rsp + 0x40], ebx
sub esi, dword [rsp + 0x108]
mov r8d, 0x100000
sub r8d, esi
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x108]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002d137
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rax - 0x17100000]
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x7c
jmp 0x18002d11b
movzx eax, word [r12 + 0x28]
lea rcx, [r12 + 0x2a]
add rcx, rax
mov qword [rsp + 0x130], rcx
movzx eax, word [r12 + 0x24]
mov word [rsp + 0x12a], ax
mov word [rsp + 0x128], ax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x128]
call fcn.180042180
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002cc34
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x69
lea r9, str.TrfGetVolInfoObjectFromVolumeGUID
jmp 0x18002d122
lea r14, [r12 + 0x2a]
mov qword [rsp + 0xf0], r14
movzx r15d, word [r12 + 0x28]
mov word [rsp + 0xea], r15w
mov word [rsp + 0xe8], r15w
lea rdx, str._t_cmdFileDelete:
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002ccb3
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x6a
lea r9, str.UstrInitStatic
jmp 0x18002d122
lea r9, [rsp + 0x108]
xor r10d, r10d
mov r8d, r10d
mov dword [rsp + 0xa8], r10d
test r13b, r13b
je 0x18002cd10
nop
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002cd05
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0xa8], r8d
jmp 0x18002ccd0
mov dword [r9], ecx
jmp 0x18002cd47
movzx ecx, word [rsp + 0x110]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002cd40
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdi + rdx], cl
inc r8d
mov dword [rsp + 0xa8], r8d
jmp 0x18002cd10
mov eax, ecx
shr eax, 1
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r11, [rsp + 0x108]
mov r9, qword [rsp + 0x48]
add r9, 0x30
add rdi, rcx
jne 0x18002cd7a
mov ebx, 0xc00000ef
jmp 0x18002cd9a
test r9, r9
jne 0x18002cd86
mov ebx, 0xc00000f1
jmp 0x18002cd9a
movzx eax, word [r9]
test r13b, r13b
jne 0x18002cd91
shr eax, 1
cmp esi, eax
jae 0x18002cdda
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x6c
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0xac], r10d
test r13b, r13b
je 0x18002ce22
nop word [rax + rax]
movzx ecx, word [r9]
mov eax, ecx
shr eax, 1
cmp r8d, eax
jae 0x18002ce1d
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [r9 + 8]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0xac], r8d
jmp 0x18002cdf0
mov dword [r11], ecx
jmp 0x18002ce4b
movzx eax, word [r9]
shr eax, 1
cmp r8d, eax
jae 0x18002ce48
mov edx, r8d
mov rax, qword [r9 + 8]
movzx ecx, byte [rax + rdx*2]
mov byte [rdi + rdx], cl
inc r8d
mov dword [rsp + 0xac], r8d
jmp 0x18002ce22
mov dword [r11], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
sub esi, ecx
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
add rdi, rcx
jne 0x18002ce75
mov ebx, 0xc00000ef
jmp 0x18002ce90
mov r8d, r15d
test r13b, r13b
je 0x18002ce82
cmp esi, r15d
jmp 0x18002ce89
mov eax, r15d
shr eax, 1
cmp esi, eax
jae 0x18002ced0
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x6d
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov edx, r10d
mov dword [rsp + 0xb0], edx
test r13b, r13b
je 0x18002cf10
nop
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002cf03
mov eax, edx
lea rcx, [rax + rax]
movzx eax, word [rcx + r14]
mov word [rcx + rdi], ax
inc edx
mov dword [rsp + 0xb0], edx
jmp 0x18002cee0
mov dword [r9], r8d
jmp 0x18002cf31
mov eax, r8d
shr eax, 1
cmp edx, eax
jae 0x18002cf2e
mov ecx, edx
movzx eax, byte [r14 + rcx*2]
mov byte [rdi + rcx], al
inc edx
mov dword [rsp + 0xb0], edx
jmp 0x18002cf10
mov dword [r9], eax
mov dword [rsp + 0x40], r10d
mov ecx, dword [rsp + 0x108]
add rdi, rcx
sub esi, ecx
lea rdx, [0x1800918a4]
lea rcx, [rsp + 0x110]
call fcn.18004a590
mov ebx, eax
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x18002cf9c
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x6e
lea r9, str.UstrInitStatic
jmp 0x18002d122
xor r10d, r10d
mov dword [rsp + 0x108], r10d
lea r9, [rsp + 0x108]
test rdi, rdi
jne 0x18002cfbb
mov ebx, 0xc00000ef
jmp 0x18002cfd9
movzx ecx, word [rsp + 0x110]
test r13b, r13b
je 0x18002cfcc
cmp esi, ecx
jmp 0x18002cfd2
mov eax, ecx
shr eax, 1
cmp esi, eax
jae 0x18002d019
mov ebx, 0xc0000023
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x6f
lea r9, str.TrfWriteUstToBuffer
jmp 0x18002d122
mov r8d, r10d
mov dword [rsp + 0xb4], r10d
test r13b, r13b
je 0x18002d070
nop dword [rax]
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002d066
mov eax, r8d
lea rdx, [rax + rax]
mov rax, qword [rsp + 0x118]
movzx ecx, word [rdx + rax]
mov word [rdx + rdi], cx
inc r8d
mov dword [rsp + 0xb4], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002d030
movzx eax, cx
jmp 0x18002d0a6
movzx eax, cx
shr eax, 1
cmp r8d, eax
jae 0x18002d0a1
mov edx, r8d
mov rax, qword [rsp + 0x118]
movzx ecx, byte [rax + rdx*2]
mov byte [rdi + rdx], cl
inc r8d
mov dword [rsp + 0xb4], r8d
movzx ecx, word [rsp + 0x110]
jmp 0x18002d070
movzx eax, cx
shr eax, 1
mov dword [r9], eax
mov ebx, r10d
mov dword [rsp + 0x40], ebx
sub esi, dword [rsp + 0x108]
mov r8d, 0x100000
sub r8d, esi
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x108]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18002d137
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [rax - 0x17100000]
mov dword [rsp + 0x40], ebx
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002d137
test byte [rcx + 0x1c], 1
je 0x18002d137
cmp byte [rcx + 0x19], 2
jb 0x18002d137
mov edx, 0x70
lea r9, [0x180090950]
mov dword [rsp + 0x20], ebx
lea r8, [0x1800919f8]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
nop
cmp qword [rsp + 0x120], 0
je 0x18002d1a3
cmp byte [0x18009b380], 0
je 0x18002d179
mov r9d, 0xc7a
lea rax, str.E:_buildsARK23181_2_trufos_dll_rebcmd.c
mov qword [rsp + 0x20], rax
mov r8d, 0x4352413a
lea rdx, [rsp + 0x120]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x18002d197
mov r8, qword [rsp + 0x120]
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [rsp + 0x120], 0
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18002d1c2
mov qword [rsp + 0x138], rax
lea rcx, [rsp + 0x138]
call fcn.18004f370
mov eax, ebx
jmp 0x18002ac8a