Function at 0x1400c3df0
Capabilities:
Check if file exists
Delete directory
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes
Get thread local storage value
Read file on windows
Resolve function by parsing pe exports
Timestomp file

Disassembly:
push rbp
mov eax, 0x2288
push rdi
push rsi
push rbx
call fcn.1401be370
sub rsp, rax
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x2278], rax
xor eax, eax
mov rdi, rcx
lea rbx, [rsp + 0x270]
call fcn.1400b9ca0
mov r9d, 0xffffffff
mov rdx, rdi
mov rcx, rbx
mov r8d, 0x1000
mov ebp, eax
call fcn.1400bb020
test eax, eax
js 0x1400c3c10
mov r9d, ebp
mov r8d, 0x102
mov edx, eax
mov rcx, rbx
call fcn.1400bc630
test eax, eax
js 0x1400c3c1e
mov edx, 1
je 0x1400c3b4c
lea edx, [rax - 1]
movsxd rdx, edx
movzx ecx, word [rsp + rdx*2 + 0x270]
lea edx, [rax + 1]
cmp ecx, 0x2f
je 0x1400c3b4c
cmp ecx, 0x5c
je 0x1400c3b4c
movsxd rcx, eax
mov r9d, 0x5c
mov word [rsp + rcx*2 + 0x270], r9w
lea ecx, [rax + 2]
mov eax, edx
mov edx, ecx
cdqe
mov ecx, 0x2a
movsxd rdx, edx
xor r8d, r8d
mov word [rsp + rax*2 + 0x270], cx
mov rcx, rbx
mov word [rsp + rdx*2 + 0x270], r8w
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c3c38
mov ecx, 0x1020
call fcn.1400a5fa0
lea rdx, [rsp + 0x4c]
lea rcx, [0x1400c3940]
mov r8d, 0x30c
mov rbx, rax
lea rax, [0x1400c3a60]
movq xmm0, rcx
movq xmm1, rax
mov qword [rbx + 0x10], rdi
lea rcx, [rbx + 0x1d]
mov dword [rbx + 0x18], 0
punpcklqdq xmm0, xmm1
movups xmmword [rbx], xmm0
call fcn.1400bb580
mov eax, dword [rsp + 0x20]
test ah, 4
jne 0x1400c3c00
test al, 0x10
sete al
add eax, 1
mov byte [rbx + 0x1c], al
mov rax, qword [rsp + 0x2278]
sub rax, qword [rsi]
jne 0x1400c3c6b
mov rax, rbx
add rsp, 0x2288
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp dword [rsp + 0x44], 0xa000000c
jne 0x1400c3bd9
mov byte [rbx + 0x1c], 3
jmp 0x1400c3be4
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
je 0x1400c3c28
xor ebx, ebx
jmp 0x1400c3be4
call rbx
xor ebx, ebx
mov dword [rax], 0x26
jmp 0x1400c3be4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x14
cmp eax, 0x10b
jne 0x1400c3c60
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
xor ebx, ebx
jmp 0x1400c3be4
mov ecx, eax
call fcn.1400b95f0
mov ebx, eax
jmp 0x1400c3c4a
call fcn.1401be670
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [rcx + 0x10]
mov rax, qword [rax + 0x20]
test rax, rax
je 0x1400c3cb0
lea rdx, [rax + 0x62]
movq xmm0, rax
movq xmm1, rdx
punpcklqdq xmm0, xmm1
movups xmmword [rcx + 0x10], xmm0
mov rax, rdx
ret
xor edx, edx
jmp 0x1400c3ca3
push r15
mov eax, 0x23d8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401be370
sub rsp, rax
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x23c8], rax
xor eax, eax
mov dword [r8], 0
mov rdi, rdx
mov rsi, rcx
mov rbp, r8
lea r13, [rdi + 0x63]
lea rbx, [rsp + 0xb0]
call fcn.1400b9ca0
movzx r9d, word [rdi + 0x60]
mov rdx, r13
mov rcx, rbx
mov r8d, 0x1000
mov r12d, eax
call fcn.1400bb020
test eax, eax
js 0x1400c43b0
mov r9d, r12d
mov r8d, 0x102
mov edx, eax
mov rcx, rbx
call fcn.1400bc630
test eax, eax
js 0x1400c437b
je 0x1400c42f8
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov r8d, 7
mov rcx, rbx
mov dword [rsp + 0x28], 0x2000000
mov edx, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x1400c4400
movzx edi, word [rdi + 0x60]
lea rax, [rsi + 0x38]
mov rcx, rax
mov qword [rsp + 0x78], rax
lea rdx, [rdi + 0x69]
call fcn.140134ec0
mov r9, rdi
mov r8, r13
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.1400c3d40
lea rax, [rsi + 0x60]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4000
mov byte [r15 + 0x62], 1
mov rcx, qword [rsp + 0x70]
lea r14, [r15 + 0x20]
mov word [r15 + 0x10], dx
xor edx, edx
mov qword [r15 + 0x20], 0
mov dword [r15 + 0x28], 1
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.ntdll.dll_NtQueryDirectoryFile]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0x10000
mov qword [rsp + 0x88], rax
call rax
mov edx, eax
test eax, eax
js 0x1400c4330
mov qword [rsp + 0x98], r13
mov r12, qword [rsp + 0x80]
lea rsi, [rsp + 0x20b0]
movabs rbp, 0xfe624e212ac18000
movabs rdi, 0xd6bf94d5e57a42bd
mov qword [rsp + 0x38], 0
lea rbx, [r12 + 0x44]
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov r8, rbx
mov dword [rsp + 0x28], 0x30c
mov qword [rsp + 0x20], rsi
mov r9d, dword [r12 + 0x3c]
shr r9d, 1
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400c44b0
movsxd r9, eax
lea rdx, [r9 + 0x69]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x68], r9
call fcn.140134ec0
mov r9, qword [rsp + 0x68]
mov r8, rsi
mov rdx, r15
mov rcx, rax
mov r13, rax
call fcn.1400c3d40
mov ecx, dword [r12 + 0x38]
mov qword [r13 + 0x20], 0
mov dword [r13 + 0x28], 1
test ch, 4
jne 0x1400c4210
mov dword [r13 + 0x14], 0
mov edx, dword [r12 + 0x40]
mov r8, rsi
call fcn.1400c15f0
mov word [r13 + 0x10], ax
and ax, 0xf000
cmp ax, 0x8000
je 0x1400c41f8
cmp ax, 0x4000
je 0x1400c4388
mov byte [r13 + 0x62], 3
mov edx, 0x1000
cmp ax, 0xa000
jne 0x1400c41fd
mov qword [r13 + 0x28], rdx
mov rcx, qword [r12 + 0x10]
add rcx, rbp
mov rax, rcx
imul rdi
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
mov qword [r13 + 0x30], rdx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [r13 + 0x38], ecx
mov rcx, qword [r12 + 0x18]
add rcx, rbp
mov rax, rcx
imul rdi
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
mov qword [r13 + 0x40], rdx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [r13 + 0x48], ecx
mov rcx, qword [r12 + 8]
add rcx, rbp
mov rax, rcx
imul rdi
mov rax, rcx
sar rax, 0x3f
add rdx, rcx
sar rdx, 0x17
sub rdx, rax
mov eax, dword [r12 + 0x40]
mov qword [r13 + 0x50], rdx
imul rdx, rdx, 0x989680
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [r13 + 0x58], ecx
test eax, eax
jne 0x1400c42d0
mov eax, dword [r12]
mov qword [r14], r13
test eax, eax
jne 0x1400c42c0
mov rax, qword [rsp + 0x80]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 0x10000
call rax
mov edx, eax
test eax, eax
jns 0x1400c43a0
mov r13, qword [rsp + 0x98]
cmp eax, 0x80000006
jne 0x1400c4340
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [0x140207460]
mov rax, qword [rsp + 0x23c8]
sub rax, qword [rsi]
jne 0x1400c44e4
mov rax, r15
add rsp, 0x23d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov byte [r13 + 0x62], 2
mov rdx, qword [r12 + 0x28]
jmp 0x1400c4085
mov edx, dword [r12 + 0x40]
mov dword [r13 + 0x14], edx
cmp edx, 0xa000000c
jne 0x1400c404c
movzx r8d, word [r15 + 0x60]
movzx eax, word [r13 + 0x60]
lea eax, [r8 + rax + 1]
cmp eax, 0x30a
jg 0x1400c404c
call fcn.1400c1210
test eax, eax
je 0x1400c42ab
movzx r8d, word [r15 + 0x60]
lea rdx, [r15 + 0x63]
mov rcx, rsi
mov dword [rsp + 0x68], r8d
call sub.msvcrt.dll_memcpy
mov r9d, dword [rsp + 0x68]
lea rdx, [r13 + 0x63]
movzx eax, r9w
mov r9, rax
mov byte [rsp + rax + 0x20b0], 0x2f
movzx r8d, word [r13 + 0x60]
add r9, 1
lea rcx, [rsi + r9]
mov qword [rsp + 0x68], r9
call sub.msvcrt.dll_memcpy
mov r9, qword [rsp + 0x68]
movzx eax, word [r13 + 0x60]
lea rcx, [r9 + 0x23d0]
lea r9, [rsp + rcx]
mov byte [rax + r9 - 0x320], 0
mov edx, dword [r12 + 0x40]
mov ecx, dword [r12 + 0x38]
jmp 0x1400c404c
add r12, rax
lea r14, [r13 + 0x20]
jmp 0x1400c3fb1
call fcn.1400c5250
test eax, eax
je 0x1400c4132
mov edx, dword [r12 + 0x3c]
lea r8, [r13 + 0x10]
mov rcx, rbx
shr edx, 1
call fcn.1400c52d0
jmp 0x1400c4132
mov rdx, rbx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea edx, [rax - 1]
cmp edx, 0xffe
jbe 0x1400c3e80
mov ebx, 0x26
test eax, eax
je 0x1400c44d0
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], ebx
jmp 0x1400c437b
cmp eax, 0xc000000d
je 0x1400c448b
nop dword [rax + rax]
movabs rax, 0x1ffffffff
movabs rcx, 0x100000000
and rax, qword [0x1401c45d8]
cmp rax, rcx
jne 0x1400c43d0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r15 + 0x18]
test rax, rax
cmove rax, r15
lock sub dword [rax + 0x28], 1
xor r15d, r15d
jmp 0x1400c41c3
mov byte [r13 + 0x62], 1
mov rdx, qword [r12 + 0x28]
jmp 0x1400c4085
mov r12, qword [rsp + 0x80]
jmp 0x1400c42c3
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 0x22
jne 0x1400c437b
call rbx
mov dword [rax], 0x26
jmp 0x1400c437b
mov dword [rsp + 0x20], edx
lea r9, str.fscache:_status__ld__unable_to_query_directory_contents__s_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x15a
mov qword [rsp + 0x28], r13
lea rcx, str.compat_win32_fscache.c
call fcn.14008dc10
jmp 0x1400c4360
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x14
mov dword [rbp], 1
cmp eax, 0x10b
jne 0x1400c4480
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
movabs rdx, 0x100000000
mov dword [rax], ebx
movabs rax, 0x1ffffffff
and rax, qword [0x1401c45d8]
cmp rax, rdx
je 0x1400c437b
call rsi
mov qword [rsp + 0x28], r13
lea r9, str.fscache:_error__d___s_n
lea r8, str.GIT_TRACE_FSCACHE
mov eax, dword [rax]
mov edx, 0x122
lea rcx, str.compat_win32_fscache.c
mov dword [rsp + 0x20], eax
call fcn.14008dc10
jmp 0x1400c437b
mov ecx, eax
call fcn.1400b95f0
mov ebx, eax
jmp 0x1400c4419
mov dword [rsp + 0x68], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [rsp + 0x68]
test al, 0x10
mov eax, 0x10b
cmove edx, eax
jmp 0x1400c4340
call qword [sym.imp.msvcrt.dll__errno]
mov edx, 0x68
mov r9, 0xffffffffffffffff
mov dword [rax], 0x22
jmp 0x1400c3ffc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b95f0
mov ebx, eax
jmp 0x1400c4322
call fcn.1401be670
nop
nop word [rax + rax]
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, qword [0x140207460]
xor r8d, r8d
add dword [rcx + 0x58], 1
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
xor eax, eax
lea r12, [rcx + 8]
mov rsi, rcx
mov rdi, rdx
mov rcx, r12
call fcn.14001fa30
mov rbx, rax
test rax, rax
je 0x1400c45e8
cmp word [rax + 0x10], 0
jne 0x1400c45d0
xor ebx, ebx
mov rax, qword [rsp + 0x28]
sub rax, qword [rbp]
jne 0x1400c46a9
mov rax, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [rdi + 0x18]
test rdx, rdx
jne 0x1400c457b
nop dword [rax]
mov rdx, rdi
lea r8, [rsp + 0x24]
mov rcx, rsi
call fcn.1400c3df0
mov rbx, rax
test rax, rax
je 0x1400c4640
add dword [rsi + 0x5c], 1
mov rsi, qword [rax + 0x18]
test rsi, rsi
cmove rsi, rax
nop dword [rax + rax]
mov rdx, rsi
mov rcx, r12
call fcn.14001fb20
mov rsi, qword [rsi + 0x20]
test rsi, rsi
jne 0x1400c45a8
cmp qword [rdi + 0x18], 0
jne 0x1400c4620
cmp word [rbx + 0x10], 0
je 0x1400c4605
nop word [rax + rax]
mov rax, qword [rbx + 0x18]
test rax, rax
cmove rax, rbx
lock add dword [rax + 0x28], 1
jmp 0x1400c4542
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x1400c4578
xor r8d, r8d
mov rcx, r12
call fcn.14001fa30
test rax, rax
je 0x1400c4568
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 2
jmp 0x1400c4540
xor r8d, r8d
mov rdx, rdi
mov rcx, r12
call fcn.14001fa30
mov rbx, rax
test rax, rax
jne 0x1400c45c3
jmp 0x1400c4605
mov edx, dword [rsp + 0x24]
test edx, edx
je 0x1400c4540
mov rdi, qword [rdi + 0x18]
test rdi, rdi
je 0x1400c4540
movzx r13d, word [rdi + 0x60]
mov r14, qword [rdi + 0x18]
lea rcx, [rsi + 0x38]
lea rdx, [r13 + 0x69]
call fcn.140134ec0
mov rdx, r14
mov r9, r13
lea r8, [rdi + 0x63]
mov rcx, rax
mov rbx, rax
call fcn.1400c3d40
xor eax, eax
mov rdx, rbx
mov rcx, r12
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 1
mov word [rbx + 0x10], ax
call fcn.14001fb20
jmp 0x1400c4540
call fcn.1401be670
nop
nop
push r15
mov eax, 0x3118
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401be370
sub rsp, rax
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x3108], rax
xor eax, eax
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1400c46fd
mov eax, dword [rax]
test eax, eax
jg 0x1400c4730
mov rax, qword [rsp + 0x3108]
sub rax, qword [rdi]
jne 0x1400c4924
mov rdx, rsi
mov rcx, rbx
add rsp, 0x3118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400c16c0
movsx eax, byte [rbx]
cmp eax, 0x2f
je 0x1400c46fd
cmp eax, 0x5c
je 0x1400c46fd
mov rcx, rbx
call fcn.1400c3650
mov dword [rsp + 0x2c], eax
test eax, eax
jne 0x1400c46fd
add dword [r12 + 0x50], 1
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov ecx, eax
test eax, eax
je 0x1400c48a0
movsxd rdx, eax
movsx edx, byte [rbx + rdx - 1]
cmp edx, 0x2f
je 0x1400c4890
cmp edx, 0x5c
je 0x1400c4890
movsxd r13, ecx
mov rax, r13
nop dword [rax]
movsx edx, byte [rbx + rax - 1]
cmp edx, 0x2f
je 0x1400c48b0
cmp edx, 0x5c
je 0x1400c48b0
sub rax, 1
test eax, eax
jne 0x1400c4788
mov r14, rbx
xor r9d, r9d
lea rbp, [rsp + 0x30]
mov r8, rbx
xor edx, edx
mov rcx, rbp
lea r15, [rsp + 0x1098]
call fcn.1400c3d40
mov r9, r13
mov r8, r14
mov rdx, rbp
mov rcx, r15
call fcn.1400c3d40
mov rcx, r12
mov rdx, r15
call 0x1400c44f0
mov r12, rax
test rax, rax
je 0x1400c490b
mov rax, qword [rax + 0x28]
movzx edx, word [r12 + 0x10]
cmp rax, 0x1000
je 0x1400c48c8
mov qword [rsi + 0x18], rax
mov rax, qword [r12 + 0x18]
xor ecx, ecx
xor r8d, r8d
movdqu xmm0, xmmword [r12 + 0x30]
movdqu xmm1, xmmword [r12 + 0x40]
mov word [rsi + 4], cx
test rax, rax
movdqu xmm2, xmmword [r12 + 0x50]
mov word [rsi + 0xc], r8w
cmove rax, r12
mov dword [rsi], 0
mov dword [rsi + 0x10], 0
mov dword [rsi + 8], 1
mov word [rsi + 6], dx
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
movups xmmword [rsi + 0x40], xmm2
lock sub dword [rax + 0x28], 1
mov rax, qword [rsp + 0x3108]
sub rax, qword [rdi]
jne 0x1400c4924
mov eax, dword [rsp + 0x2c]
add rsp, 0x3118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, eax
sub ecx, 1
jne 0x1400c477f
nop dword [rax + rax]
mov r14, rbx
xor r13d, r13d
xor r9d, r9d
jmp 0x1400c47ad
sub ecx, eax
lea r14, [rbx + rax]
sub eax, 1
movsxd r13, ecx
movsxd r9, eax
jmp 0x1400c47ad
mov ecx, edx
and cx, 0xf000
cmp cx, 0xa000
jne 0x1400c4805
lea rdx, [rsp + 0x2100]
mov r8d, 0xfff
mov rcx, rbx
call fcn.1400bf130
test eax, eax
jle 0x1400c48fb
cdqe
mov qword [r12 + 0x28], rax
movzx edx, word [r12 + 0x10]
mov rax, qword [r12 + 0x28]
jmp 0x1400c4805
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rsp + 0x2c], 0xffffffff
mov dword [rax], 2
jmp 0x1400c4861
call fcn.1401be670
nop
nop word [rax + rax]
push rbp
mov eax, 0x1098
push rdi
push rsi
push rbx
call fcn.1401be370
sub rsp, rax
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x1088], rax
xor eax, eax
mov rdi, rcx
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400c4972
mov eax, dword [rax]
test eax, eax
jg 0x1400c49a0
mov rax, qword [rsp + 0x1088]
sub rax, qword [rsi]
jne 0x1400c4a74
mov rcx, rdi
add rsp, 0x1098
pop rbx
pop rsi
pop rdi
pop rbp
jmp 0x1400c3aa0
movsx eax, byte [rdi]
cmp eax, 0x2f
je 0x1400c4972
cmp eax, 0x5c
je 0x1400c4972
mov rcx, rdi
call fcn.1400c3650
test eax, eax
jne 0x1400c4972
add dword [rbx + 0x54], 1
mov rcx, rdi
call sub.msvcrt.dll_strlen
cmp eax, 1
je 0x1400c4a40
xor r9d, r9d
test eax, eax
jne 0x1400c4a45
lea rbp, [rsp + 0x20]
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.1400c3d40
mov rcx, rbx
mov rdx, rbp
call 0x1400c44f0
mov rbx, rax
test rax, rax
je 0x1400c4a70
mov ecx, 0x20
lea rdi, [0x1400c3c80]
call fcn.1400a5fa0
lea rdx, [0x1400c3dc0]
movq xmm0, rdi
movq xmm1, rdx
mov qword [rax + 0x10], rbx
punpcklqdq xmm0, xmm1
movups xmmword [rax], xmm0
mov rdx, qword [rsp + 0x1088]
sub rdx, qword [rsi]
jne 0x1400c4a74
add rsp, 0x1098
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp byte [rdi], 0x2e
je 0x1400c4a5c
movsxd r9, eax
movsx edx, byte [rdi + r9 - 1]
cmp edx, 0x2f
je 0x1400c4a5c
cmp edx, 0x5c
jne 0x1400c49d1
sub eax, 1
movsxd r9, eax
jmp 0x1400c49d1
xor eax, eax
jmp 0x1400c4a23
call fcn.1401be670
nop
nop word [rax + rax]
push r14
mov eax, 0x2100
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1401be370
sub rsp, rax
mov rbp, qword [0x140207460]
mov rax, qword [rbp]
mov qword [rsp + 0x20f8], rax
xor eax, eax
mov rdi, rcx
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
je 0x1400c4acd
mov eax, dword [rax]
mov rcx, qword [rdi + 0x10]
test eax, eax
jg 0x1400c4b00
mov rax, qword [rsp + 0x20f8]
sub rax, qword [rbp]
jne 0x1400c4c22
mov rcx, rdi
add rsp, 0x2100
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.1400bf3a0
movsx eax, byte [rcx]
cmp eax, 0x2f
je 0x1400c4acd
cmp eax, 0x5c
je 0x1400c4acd
call fcn.1400c3650
test eax, eax
jne 0x1400c4acd
mov rax, qword [rdi + 8]
add dword [rsi + 0x50], 1
mov r8, qword [rdi + 0x10]
mov edx, eax
test eax, eax
je 0x1400c4bf0
movsxd rcx, eax
movsx ecx, byte [r8 + rcx - 1]
cmp ecx, 0x2f
je 0x1400c4be0
cmp ecx, 0x5c
je 0x1400c4be0
movsxd r13, edx
mov rbx, r13
nop dword [rax]
movsx eax, byte [r8 + rbx - 1]
cmp eax, 0x2f
je 0x1400c4c00
cmp eax, 0x5c
je 0x1400c4c00
sub rbx, 1
test ebx, ebx
jne 0x1400c4b50
xor ebx, ebx
xor r9d, r9d
lea r14, [rsp + 0x20]
xor edx, edx
lea r12, [rsp + 0x1088]
mov rcx, r14
call fcn.1400c3d40
add rbx, qword [rdi + 0x10]
mov rdx, r14
mov rcx, r12
mov r9, r13
mov r8, rbx
call fcn.1400c3d40
mov rdx, r12
mov rcx, rsi
call 0x1400c44f0
test rax, rax
je 0x1400c4c18
cmp dword [rax + 0x14], 0xa0000003
sete al
movzx eax, al
mov rdx, qword [rsp + 0x20f8]
sub rdx, qword [rbp]
jne 0x1400c4c22
add rsp, 0x2100
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, eax
sub edx, 1
jne 0x1400c4b47
nop dword [rax + rax]
xor ebx, ebx
xor r13d, r13d
xor r9d, r9d
jmp 0x1400c4b75
sub edx, ebx
lea r9d, [rbx - 1]
movsxd r13, edx
movsxd r9, r9d
jmp 0x1400c4b75
mov rcx, rdi
call fcn.1400bf3a0
jmp 0x1400c4bbe
call fcn.1401be670
nop
nop dword [rax + rax]