Function at 0x1400a4cdc
Capabilities:
Get common file path
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x398
mov r13, rcx
lea rcx, [rax - 0x2f0]
mov r15, r9
call fcn.14005c96c
xor ebp, ebp
lea rcx, [rsp + 0x100]
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xf8], rbp
mov word [rsp + 0x88], bp
call fcn.14005ce30
lea rcx, [rsp + 0x3e8]
call fcn.140054c14
lea rax, [rsp + 0x100]
mov ebx, ebp
mov qword [rsp + 0x150], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x120], rbp
mov qword [rsp + 0x128], rbp
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x138], rbp
mov dword [rsp + 0xb4], eax
mov qword [rsp + 0x140], rbp
mov qword [rsp + 0x148], rbp
mov dword [rsp + 0xb0], 2
mov dword [rsp + 0x5c], ebp
mov r14d, ebp
mov dword [rsp + 0x50], ebx
mov edi, ebp
mov dword [rsp + 0xc0], ebp
mov dword [rsp + 0xa0], ebp
mov r12d, ebp
mov dword [rsp + 0x90], ebp
mov dword [rsp + 0xc4], ebp
mov esi, ebp
lea r10d, [rbp + 9]
xor r8d, r8d
mov r9d, 0x20
mov rax, qword [rsp + 0x3e8]
mov ecx, 0x2a
lea edx, [rcx + 3]
cmp cx, word [rax]
je 0x1400a4e01
lea ecx, [rdx + 2]
cmp cx, word [rax]
je 0x1400a4e01
cmp dx, word [rax]
jne 0x1400a528e
cmp dx, word [rax]
jne 0x1400a4e34
cmp dx, word [rax + 2]
jne 0x1400a4e34
movzx ecx, word [rax + 4]
cmp r10w, cx
ja 0x1400a4e20
cmp cx, 0xd
jbe 0x1400a538f
cmp r9w, cx
je 0x1400a538f
cmp cx, r8w
je 0x1400a538f
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140109e5c]
mov r8d, 2
call fcn.14005f1a8
xor ecx, ecx
cmp al, cl
je 0x1400a4e61
and r14d, 0xfffffffe
or r14d, 6
jmp 0x1400a537d
mov r11, qword [rsp + 0x3e8]
lea rcx, [0x140109e58]
mov r8d, 3
lea rdx, [r11 + 2]
call fcn.14005615c
xor ecx, ecx
cmp al, cl
je 0x1400a4e8f
add r11, 8
lea r14d, [rcx + 6]
jmp 0x1400a4eb3
lea rdx, [r11 + 2]
lea rcx, str.delims:
mov r8d, 7
call fcn.14005615c
xor ebx, ebx
cmp al, bl
je 0x1400a4f38
add r11, 0x10
mov eax, 0xa
lea rcx, [rsp + 0x3e8]
mov rdx, r13
mov qword [rsp + 0x3e8], r11
or r14d, eax
call fcn.140095180
mov rbx, qword [rsp + 0x3e8]
movzx eax, word [rbx]
mov word [rsp + 0x88], ax
xor r8d, r8d
movzx eax, word [rbx]
mov r10d, 9
cmp ax, r8w
je 0x1400a4f22
lea ecx, [r10 + 0x17]
cmp r10w, ax
ja 0x1400a4f08
cmp ax, 0xd
jbe 0x1400a4f22
cmp cx, ax
je 0x1400a4f22
add rbx, 2
mov qword [rsp + 0x3e8], rbx
mov ax, word [rbx]
cmp ax, r8w
jne 0x1400a4efc
lea rcx, [rsp + 0x3e8]
call fcn.140054c14
mov ebx, dword [rsp + 0x50]
jmp 0x1400a4dd5
lea rdx, [rsp + 0x3e8]
lea rcx, [0x1401021cc]
or r8d, 0xffffffff
call fcn.14005f144
cmp al, bl
jne 0x1400a5371
lea rdx, [rsp + 0x3e8]
lea rcx, [0x1400fea78]
or r8d, 0xffffffff
call fcn.14005f144
cmp al, bl
jne 0x1400a5371
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140107f0c]
mov r8d, 1
call fcn.14005f1a8
cmp al, bl
jne 0x1400a536b
lea rdx, [rsp + 0x3e8]
lea rcx, [0x1401093f0]
mov r8d, 2
call fcn.14005f144
cmp al, bl
jne 0x1400a536b
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140109e4c]
mov r8d, 3
call fcn.14005f144
cmp al, bl
je 0x1400a4fe4
mov esi, 1
jmp 0x1400a5379
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140102274]
mov r8d, 3
call fcn.14005f144
cmp al, bl
je 0x1400a5012
mov dword [rsp + 0xc0], 1
jmp 0x1400a5379
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140109e48]
mov r8d, 3
call fcn.14005f144
cmp al, bl
je 0x1400a5038
mov r12d, 1
jmp 0x1400a505c
lea rdx, [rsp + 0x3e8]
lea rcx, str.qu
mov r8d, 4
call fcn.14005f144
cmp al, bl
je 0x1400a5069
mov r12d, 2
mov dword [rsp + 0x90], r12d
jmp 0x1400a5379
lea rdx, [rsp + 0x3e8]
lea rcx, str.off
mov r8d, 4
call fcn.14005f144
cmp al, bl
je 0x1400a5097
mov dword [rsp + 0xc4], 1
jmp 0x1400a5379
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140109e34]
mov r8d, 2
call fcn.14005f144
cmp al, bl
je 0x1400a50c5
mov ebx, dword [rsp + 0x50]
or ebx, 0x10
mov dword [rsp + 0x50], ebx
jmp 0x1400a537d
mov r11, qword [rsp + 0x3e8]
lea rcx, [0x140109e30]
mov r8d, 3
mov rdx, r11
call fcn.14005615c
cmp al, bl
je 0x1400a5117
mov ebx, dword [rsp + 0x50]
add r11, 6
lea rdx, [rsp + 0xb4]
or ebx, 0x10
lea rcx, [rsp + 0x3e8]
mov qword [rsp + 0x3e8], r11
mov dword [rsp + 0x50], ebx
call fcn.14006b2e8
jmp 0x1400a537d
lea rdx, [rsp + 0x3e8]
lea rcx, str._O:N
mov r8d, 4
call fcn.14005f144
cmp al, bl
je 0x1400a5147
mov ebx, dword [rsp + 0x50]
mov r9d, 0x20
mov edi, r9d
jmp 0x1400a5383
lea rdx, [rsp + 0x3e8]
lea rcx, str._O:_N
mov r8d, 5
call fcn.14005f144
cmp al, bl
je 0x1400a516f
mov edi, 0x60
jmp 0x1400a5379
lea rdx, [rsp + 0x3e8]
lea rcx, str.cur
mov r8d, 4
call fcn.14005f144
cmp al, bl
je 0x1400a519d
mov dword [rsp + 0xa0], 1
jmp 0x1400a5379
mov rbx, qword [rsp + 0x3e8]
lea rcx, str._size:
mov r8d, 6
mov rdx, rbx
call fcn.14005615c
xor r8d, r8d
cmp al, r8b
je 0x1400a527c
lea rax, [rbx + 0xc]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
call fcn.1400628dc
mov r11, qword [rsp + 0x78]
xor eax, eax
cmp word [r11], ax
je 0x1400a4ee6
lea edx, [rax + 9]
cmp dx, word [r11]
ja 0x1400a5202
cmp word [r11], 0xd
jbe 0x1400a5232
mov ecx, 0x20
cmp cx, word [r11]
je 0x1400a5237
add r11, 2
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], r11
call fcn.1400628dc
mov r11, qword [rsp + 0x78]
xor eax, eax
lea edx, [rax + 9]
mov ecx, 0x20
cmp word [r11], ax
je 0x1400a4ee6
cmp dx, word [r11]
ja 0x1400a5252
cmp word [r11], 0xd
jbe 0x1400a4ee6
cmp cx, word [r11]
je 0x1400a4ee6
add r11, 2
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], r11
call fcn.1400628dc
jmp 0x1400a4ee6
mov eax, 0x2a
cmp ax, word [rbx]
je 0x1400a4ee9
mov ebx, dword [rsp + 0x50]
mov al, bl
lea rcx, [rsp + 0xd8]
and al, 0x10
neg al
sbb eax, eax
or ebx, edi
and eax, esi
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x78], eax
cdqe
or qword [rsp + 0x148], rax
call fcn.14005c96c
lea rbx, [0x1400fd538]
lea rcx, [rsp + 0xc8]
mov rdx, rbx
call fcn.1400671f0
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.1400671f0
lea rcx, [rsp + 0x98]
mov rdx, rbx
call fcn.1400671f0
mov rdi, qword [rsp + 0x3e8]
xor esi, esi
cmp r12d, esi
je 0x1400a545d
cmp r14d, 1
jne 0x1400a545d
lea rcx, [rsp + 0x68]
call fcn.14005c96c
mov r8, qword [rsp + 0x3e8]
lea ebx, [rsi + 0x2c]
lea r15d, [rsi + 0x22]
movzx eax, word [r8]
cmp r15w, ax
jne 0x1400a53ad
add r8, 2
lea rcx, [rsp + 0x3e8]
mov edx, r15d
mov qword [rsp + 0x3e8], r8
call fcn.1400da4f4
mov rcx, qword [rsp + 0x3e8]
cmp word [rcx], si
je 0x1400a53e4
add rcx, 2
mov qword [rsp + 0x3e8], rcx
jmp 0x1400a53e4
or r14d, 5
jmp 0x1400a5379
and r14d, 0xfffffffd
or r14d, 1
mov ebx, dword [rsp + 0x50]
mov r9d, 0x20
xor r8d, r8d
lea r10d, [r8 + 9]
jmp 0x1400a4ddb
add rax, 4
lea rcx, [rsp + 0x3e8]
mov qword [rsp + 0x3e8], rax
call fcn.140054c14
jmp 0x1400a528e
cmp ax, si
je 0x1400a53e4
mov ecx, 0x20
lea edx, [rcx - 0x17]
cmp bx, ax
je 0x1400a53e4
cmp dx, ax
ja 0x1400a53ca
cmp ax, 0xd
jbe 0x1400a53e4
cmp cx, ax
je 0x1400a53e4
add r8, 2
mov qword [rsp + 0x3e8], r8
mov ax, word [r8]
cmp ax, si
jne 0x1400a53ba
lea rcx, [rsp + 0x3e8]
call fcn.140054c14
mov r8, qword [rsp + 0x3e8]
cmp word [r8], si
je 0x1400a5409
cmp bx, word [r8]
jne 0x1400a5326
sub r8, rdi
lea rcx, [rsp + 0x68]
mov rdx, rdi
sar r8, 1
call fcn.14005cbd4
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0xe8]
xor r9d, r9d
mov rcx, r13
mov byte [rsp + 0x20], 1
call fcn.140071328
mov r11, qword [rsp + 0xe8]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0xf8], r11
call fcn.140054c44
mov r15, qword [rsp + 0x3f8]
jmp 0x1400a547d
mov ebx, 0x2c
lea rdx, [rsp + 0x3e8]
lea rcx, [rsp + 0xe8]
mov r8d, ebx
mov r9b, 1
call fcn.1400747d0
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xf8]
xor r8d, r8d
call fcn.1400604ac
mov r11, qword [rsp + 0xd8]
mov edi, 0x5c
mov qword [rsp + 0x68], r11
cmp r14d, esi
jne 0x1400a5531
movzx eax, word [r11]
cmp ax, si
je 0x1400a5531
mov ecx, 9
cmp cx, ax
ja 0x1400a54c9
cmp ax, 0xd
jbe 0x1400a5531
mov ecx, 0x20
cmp cx, ax
je 0x1400a5531
mov ecx, 0x40
cmp cx, ax
jne 0x1400a54ea
mov dword [rsp + 0xb0], 1
jmp 0x1400a5523
mov ecx, 0x24
cmp cx, ax
jne 0x1400a5501
mov dword [rsp + 0xb0], 3
jmp 0x1400a5523
cmp di, ax
jne 0x1400a5514
cmp di, word [r11 + 2]
je 0x1400a552e
or dword [rsp + 0x5c], 1
jmp 0x1400a5523
mov ecx, 0x21
cmp cx, ax
jne 0x1400a5531
or dword [rsp + 0x5c], 2
add r11, 2
mov qword [rsp + 0x68], r11
jmp 0x1400a54b0
mov bpl, 1
lea rcx, [rsp + 0x68]
call fcn.140054c14
mov r12d, r14d
and r12d, 1
jne 0x1400a5550
mov rcx, qword [rsp + 0x68]
call fcn.14001a310
jmp 0x1400a5555
mov rax, qword [rsp + 0x68]
cmp dword [rsp + 0x5c], esi
jne 0x1400a5586
cmp r14d, esi
jne 0x1400a558b
cmp bpl, sil
jne 0x1400a558b
cmp di, word [rax]
jne 0x1400a5570
cmp di, word [rax + 2]
je 0x1400a558b
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.14001a76c
jmp 0x1400a559b
add rax, 2
cmp word [rax], di
je 0x1400a5582
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140067270
mov rcx, qword [rsp + 0x3e8]
cmp bx, word [rcx]
jne 0x1400a55ea
add rcx, 2
lea rdx, [rsp + 0x3e8]
mov r8d, ebx
mov qword [rsp + 0x3e8], rcx
lea rcx, [rsp + 0xe8]
mov r9b, 1
call fcn.1400747d0
lea rdx, [rsp + 0xc8]
xor r8d, r8d
mov rcx, rax
call fcn.1400604ac
mov rcx, qword [rsp + 0x3e8]
cmp r14d, esi
jne 0x1400a5637
cmp bx, word [rcx]
jne 0x1400a5637
add rcx, 2
lea rdx, [rsp + 0x3e8]
mov r8d, ebx
mov qword [rsp + 0x3e8], rcx
lea rcx, [rsp + 0xe8]
mov r9b, 1
call fcn.1400747d0
lea rdx, [rsp + 0x120]
movzx r8d, bx
mov rcx, rax
call fcn.140060784
mov rcx, qword [rsp + 0x3e8]
mov rax, qword [rsp + 0x120]
mov rdx, 0xfffffffffffffff8
cmp rax, rsi
cmovle rax, rdx
mov qword [rsp + 0x120], rax
cmp word [rcx], bx
je 0x1400a56c4
lea rcx, [rsp + 0x98]
call fcn.140054c44
lea rcx, [rsp + 0x80]
call fcn.140054c44
lea rcx, [rsp + 0xc8]
call fcn.140054c44
lea rcx, [rsp + 0xd8]
call fcn.140054c44
lea rcx, [rsp + 0x100]
call fcn.140072f34
lea rcx, [rsp + 0x100]
call fcn.140054c44
lea rcx, [rsp + 0xe8]
call fcn.140054c44
movabs rax, 1
jmp 0x1400a61fe
add rcx, 2
mov qword [rsp + 0x3e8], rcx
lea rcx, [rsp + 0x3e8]
call fcn.140054c14
mov rdx, qword [rsp + 0x3e8]
lea rcx, [rsp + 0x98]
call fcn.140067308
mov rbp, qword [rsp + 0x98]
mov eax, 0x2a
cmp word [rbp], ax
jne 0x1400a570d
mov bl, 1
cmp word [rbp + 2], si
je 0x1400a5710
mov bl, sil
lea rcx, [rsp + 0x158]
mov byte [rsp + 0x58], bl
call fcn.14005c96c
mov rdi, qword [rsp + 0xc8]
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rsi
cmp bl, sil
jne 0x1400a574e
lea rcx, [rsp + 0x158]
mov rdx, rdi
call fcn.140067308
mov qword [rsp + 0xd0], rsi
cmp r15, rsi
je 0x1400a5760
mov r15, qword [r15]
jmp 0x1400a5763
mov r15, rsi
mov qword [rsp + 0x68], r15
cmp word [rbp], si
jne 0x1400a5797
cmp r15, rsi
je 0x1400a5797
movzx eax, word [r15]
cmp word [r13 + 0x96], ax
jne 0x1400a5797
mov rdx, qword [rsp + 0x3f8]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
call fcn.14005b67c
lea rcx, [rsp + 0x118]
mov edx, 0x32a
call fcn.14005c9e0
mov rbx, qword [rsp + 0x118]
mov r10, qword [rsp + 0x3e0]
xor r11d, r11d
lea rax, [rbx + 4]
mov qword [rsp + 0xb8], rax
mov eax, 0x8b
mov qword [rsp + 0xa8], r11
and word [r10 + 0xc8], ax
mov r13d, r11d
mov dword [rsp + 0x54], r11d
mov dword [rsp + 0x70], r11d
lea ecx, [rax + 0x75]
cmp word [rbp], r11w
jne 0x1400a580a
cmp r15, r11
je 0x1400a580a
movzx eax, word [r15]
mov r15d, ecx
cmp word [r10 + 0x96], ax
je 0x1400a580d
mov r15d, r11d
cmp word [rdi], r11w
je 0x1400a582e
mov rax, qword [rsp + 0x98]
cmp word [rax], r11w
jne 0x1400a582e
mov dword [rsp + 0x60], 1
cmp r15d, r11d
je 0x1400a5833
mov dword [rsp + 0x60], r11d
mov rcx, qword [rsp + 0x80]
mov ebp, r14d
mov qword [rsp + 0xe0], r11
and ebp, 4
mov r8, rcx
mov qword [rsp + 0x3e8], rcx
je 0x1400a5903
lea rcx, [0x14011cf88]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x3e0]
xor eax, eax
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.1400174d4
xor ecx, ecx
cmp rax, rcx
jne 0x1400a58a6
lea ebx, [rcx + 2]
lea rcx, [0x14011cf88]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400a612b
mov r8, qword [rax + 0x18]
mov rdx, qword [rax + 8]
movabs rcx, 0x1fffffffffffffff
shr r8, 1
and r8, rcx
lea rcx, [rsp + 0xe0]
call fcn.14005cbd4
mov r11, qword [rsp + 0xe0]
lea rcx, [0x14011cf88]
mov qword [rsp + 0x3e8], r11
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x80]
mov r10, qword [rsp + 0x3e0]
xor r11d, r11d
movsxd r13, r15d
test r14b, 2
je 0x1400a5ab4
movzx eax, word [r8]
mov qword [rsp + 0xb8], r11
cmp ax, r11w
je 0x1400a5a99
mov rsi, qword [rsp + 0x400]
mov r14, qword [rsp + 0x68]
mov r12w, word [rsp + 0x88]
mov r15, qword [rsp + 0x3f0]
mov ebp, 0xfeff
test byte [r10 + 0xc8], 0xef
jne 0x1400a5a99
mov r9, r8
cmp r12w, r11w
je 0x1400a597b
lea rcx, [rsp + 0x3e8]
movzx edx, r12w
call fcn.1400da4f4
mov r8, qword [rsp + 0x3e8]
jmp 0x1400a59a7
cmp ax, r11w
je 0x1400a59a7
mov ecx, 0xa
cmp ax, 0xd
je 0x1400a59a7
cmp ax, cx
je 0x1400a59a7
add r8, 2
mov qword [rsp + 0x3e8], r8
mov ax, word [r8]
cmp ax, r11w
jne 0x1400a5986
movzx ebx, word [r8]
mov word [r8], r11w
mov rdx, rdi
mov r8, r9
mov rcx, r10
call fcn.14005be18
mov r8, qword [rsp + 0x3e8]
xor r11d, r11d
cmp r12w, r11w
jne 0x1400a59e5
cmp bx, 0xd
jne 0x1400a59e5
lea eax, [r11 + 0xa]
cmp ax, word [r8 + 2]
jne 0x1400a59eb
add r8, 4
jmp 0x1400a59ef
cmp bx, r11w
je 0x1400a59f7
add r8, 2
mov qword [rsp + 0x3e8], r8
inc dword [rsp + 0x54]
cmp r13, r11
je 0x1400a5a35
mov rcx, qword [rsp + 0x3e0]
lea rax, [r14 + 2]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0xd0], rax
lea rax, [0x1400fd538]
xor r9d, r9d
mov rdx, r15
mov qword [rsp + 0x20], rax
call fcn.14009d1b8
jmp 0x1400a5a5b
mov rdx, qword [rsp + 0x98]
cmp word [rdx], r11w
je 0x1400a5a66
mov rcx, qword [rsp + 0x3e0]
xor r9d, r9d
mov r8, r15
mov qword [rsp + 0x20], rsi
call fcn.140046a0c
mov r8, qword [rsp + 0x3e8]
xor r11d, r11d
mov r10, qword [rsp + 0x3e0]
mov ecx, pe_nt_image_headers64
movzx eax, word [r10 + 0xc8]
test cx, ax
je 0x1400a5a8b
and ax, bp
mov word [r10 + 0xc8], ax
mov ax, word [r8]
cmp ax, r11w
jne 0x1400a5949
lea rcx, [rsp + 0xb8]
call fcn.140054c44
mov r13d, dword [rsp + 0x54]
mov ebx, dword [rsp + 0x70]
jmp 0x1400a612b
cmp r12d, r11d
je 0x1400a5cb2
cmp ebp, r11d
je 0x1400a5ad7
lea rcx, [rsp + 0x3e8]
call fcn.140054c14
mov r8, qword [rsp + 0x3e8]
movsxd rcx, dword [rsp + 0x90]
movzx eax, word [r8]
mov qword [rsp + 0x78], r11
mov rbp, rcx
lea ebx, [rcx - 1]
cmp ax, r11w
je 0x1400a5ca8
mov rsi, qword [rsp + 0x400]
mov r14, qword [rsp + 0x68]
mov r12d, 0xfeff
test byte [r10 + 0xc8], 0xef
jne 0x1400a5ca8
mov rdx, r8
mov ecx, r11d
cmp rbp, r11
je 0x1400a5b8c
mov r9d, 0x22
cmp r9w, ax
jne 0x1400a5b8c
movsxd rax, ebx
lea rdx, [r8 + rax*2]
add r8, 2
mov qword [rsp + 0x3e8], r8
movzx eax, word [r8]
cmp ax, r11w
je 0x1400a5bc4
cmp r9w, ax
jne 0x1400a5b37
movzx eax, word [r8 + 2]
cmp ax, r11w
je 0x1400a5b7c
mov r10d, 9
cmp r10w, ax
ja 0x1400a5b70
cmp ax, 0xd
jbe 0x1400a5b7c
mov r10d, 0x20
cmp r10w, ax
jne 0x1400a5b37
add r8, 2
mov ecx, ebx
mov qword [rsp + 0x3e8], r8
jmp 0x1400a5bc4
cmp ax, r11w
je 0x1400a5bc4
mov r9d, 0x20
lea r10d, [r9 - 0x17]
cmp r10w, ax
ja 0x1400a5ba8
cmp ax, 0xd
jbe 0x1400a5bc4
cmp r9w, ax
je 0x1400a5bc4
add r8, 2
mov qword [rsp + 0x3e8], r8
mov ax, word [r8]
cmp ax, r11w
jne 0x1400a5b9c
movsxd rax, ecx
lea rcx, [rsp + 0x78]
add rax, rax
sub r8, rax
sub r8, rdx
sar r8, 1
call fcn.14005cbd4
lea rcx, [rsp + 0x3e8]
call fcn.140054c14
mov r15, qword [rsp + 0x3e0]
mov r8, qword [rsp + 0x78]
mov rcx, r15
mov rdx, rdi
call fcn.14005be18
inc dword [rsp + 0x54]
xor r11d, r11d
cmp r13, r11
je 0x1400a5c43
mov rdx, qword [rsp + 0x3f0]
lea rax, [r14 + 2]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0xd0], rax
lea rax, [0x1400fd538]
xor r9d, r9d
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14009d1b8
jmp 0x1400a5c69
mov rdx, qword [rsp + 0x98]
cmp word [rdx], r11w
je 0x1400a5c6c
mov r8, qword [rsp + 0x3f0]
xor r9d, r9d
mov rcx, r15
mov qword [rsp + 0x20], rsi
call fcn.140046a0c
xor r11d, r11d
mov r10, qword [rsp + 0x3e0]
mov ecx, pe_nt_image_headers64
movzx eax, word [r10 + 0xc8]
test cx, ax
je 0x1400a5c92
and ax, r12w
mov word [r10 + 0xc8], ax
mov r8, qword [rsp + 0x3e8]
mov ax, word [r8]
cmp ax, r11w
jne 0x1400a5b0b
lea rcx, [rsp + 0x78]
jmp 0x1400a5aa1
call fcn.14001a310
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140067270
mov r11, qword [rsp + 0x80]
xor ecx, ecx
cmp word [r11], cx
je 0x1400a6126
mov r12d, dword [rsp + 0x5c]
movzx r13d, cx
mov r14b, cl
cmp r12d, ecx
je 0x1400a5d9e
cmp dword [rsp + 0xa0], ecx
je 0x1400a5d36
mov word [rsp + 0x180], cx
lea rdx, [rsp + 0x180]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13w, word [rsp + 0x180]
cmp r13w, 0x61
jb 0x1400a5d34
cmp r13w, 0x7a
ja 0x1400a5d34
mov eax, 0xffdf
and r13w, ax
xor ecx, ecx
lea rsi, [rbx + 4]
mov rdx, rsi
mov word [rsi + 2], cx
mov word [rsi], cx
mov word [rbx + 2], cx
mov word [rbx], cx
mov ecx, 0x324
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ecx, ecx
and r12b, 2
mov rbp, rsi
mov rbx, rsi
cmp word [rsi], cx
je 0x1400a5d82
mov rcx, rbx
mov rbp, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rbx + rcx*2 + 2]
xor ecx, ecx
cmp word [rbx], cx
jne 0x1400a5d67
cmp r12b, cl
mov r12, qword [rsp + 0x400]
cmovne rsi, rbp
mov rbp, qword [rsp + 0xb8]
jmp 0x1400a5fa7
mov rax, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xb8]
mov r12, qword [rsp + 0x400]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa8], r11
cmp r15d, ecx
jne 0x1400a5de4
mov rax, qword [rsp + 0x98]
cmp word [rax], cx
jne 0x1400a5de4
mov eax, dword [rsp + 0x60]
cmp eax, ecx
je 0x1400a611b
cmp dword [rsp + 0xc0], ecx
je 0x1400a5e0f
movzx ecx, word [r11]
xor eax, eax
cmp cx, ax
je 0x1400a5e0f
cmp word [r11 + 2], 0x3a
jne 0x1400a5e0f
call fcn.1400e0aa0
xor ecx, ecx
cmp eax, ecx
je 0x1400a5f9d
lea rcx, [rsp + 0x90]
call fcn.14005c96c
mov rcx, qword [rsp + 0xa8]
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x90]
xor r14d, r14d
mov qword [rsp + 0xb8], r14
call fcn.1400caa74
mov r8, qword [rsp + 0x90]
cmp dword [rsp + 0xc4], r14d
je 0x1400a5e6c
mov rax, qword [rsp + 0xb8]
sub rax, r8
sar rax, 1
mov qword [rsp + 0x138], rax
cmp dword [rsp + 0x78], r14d
je 0x1400a5f04
mov ebx, 8
mov rcx, rbx
call fcn.1400e1978
cmp rax, r14
je 0x1400a5e9b
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140067250
jmp 0x1400a5e9e
mov rax, r14
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x170], rax
mov dword [rsp + 0x20], ebx
call fcn.14005ccbc
cmp dword [rsp + 0x5c], r14d
je 0x1400a5efc
cmp word [rsi], r14w
je 0x1400a5efc
lea rcx, [rsp + 0x90]
mov r14b, 1
call fcn.140054c44
xor ecx, ecx
jmp 0x1400a5fa7
mov r8, qword [rsp + 0x90]
mov eax, dword [rsp + 0xb4]
mov rbx, qword [rsp + 0x3e0]
mov r9, qword [rsp + 0x3f0]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
mov ecx, r15d
or ecx, dword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
or ecx, dword [rsp + 0xb0]
lea rdx, [rsp + 0x158]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400a41e4
mov ecx, pe_nt_image_headers64
add dword [rsp + 0x54], eax
movzx eax, word [rbx + 0xc8]
test cx, ax
je 0x1400a5f8e
mov ecx, 0xfeff
and ax, cx
mov word [rbx + 0xc8], ax
lea rcx, [rsp + 0x90]
call fcn.140054c44
xor ecx, ecx
cmp dword [rsp + 0x5c], ecx
je 0x1400a6077
movsxd rbx, dword [rsp + 0xa0]
cmp word [rsi], cx
je 0x1400a6077
lea rax, [rsp + 0x120]
cmp qword [rax], rcx
je 0x1400a6077
mov rax, qword [rsp + 0x3e0]
test byte [rax + 0xc8], 0xef
jne 0x1400a6077
lea rcx, [rsp + 0xa8]
mov rdx, rsi
call fcn.140067308
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0xa8]
call fcn.14005caa8
xor ecx, ecx
cmp rbx, rcx
jne 0x1400a6057
test byte [rsp + 0x5c], 2
je 0x1400a602d
sub rsi, 2
cmp rsi, rbp
jbe 0x1400a6040
lea rax, [rsi - 2]
cmp word [rax], cx
je 0x1400a6040
mov rsi, rax
cmp rax, rbp
ja 0x1400a601a
jmp 0x1400a6040
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
xor ecx, ecx
cdqe
lea rsi, [rsi + rax*2]
mov r11, qword [rsp + 0xa8]
cmp r13w, word [r11]
jne 0x1400a5dc6
jmp 0x1400a5faf
mov rax, qword [rsp + 0xa8]
mov dword [rsp + 0xa0], ecx
mov word [rax], r13w
mov r11, qword [rsp + 0xa8]
jmp 0x1400a5dc6
cmp r14b, cl
je 0x1400a5aa6
mov rbx, qword [rsp + 0x98]
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0x100]
mov r9d, 8
xor ecx, ecx
call fcn.14005cdcc
or r15d, dword [rsp + 0x50]
mov r9, qword [rsp + 0x3f0]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x400]
or r15d, dword [rsp + 0xb0]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0x3e0]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xb4]
lea rdx, [rsp + 0x158]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.1400a41e4
mov r13d, dword [rsp + 0x54]
add r13d, eax
jmp 0x1400a5aab
mov r13d, dword [rsp + 0x54]
mov ebx, dword [rsp + 0x70]
jmp 0x1400a612f
mov r13d, ecx
mov ebx, ecx
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x3e0]
mov edx, 0x8b
and word [rcx + 0xc8], dx
xor edx, edx
cmp byte [rsp + 0x58], dl
je 0x1400a615d
mov r8, qword [rsp + 0x158]
mov rdx, rdi
call fcn.14005be18
jmp 0x1400a616c
cmp eax, edx
je 0x1400a616c
mov r8, rdi
mov edx, r13d
call fcn.14005f9f4
lea rcx, [rsp + 0xe0]
call fcn.140054c44
lea rcx, [rsp + 0xa8]
call fcn.140054c44
lea rcx, [rsp + 0x118]
call fcn.140054c44
lea rcx, [rsp + 0x158]
call fcn.140054c44
lea rcx, [rsp + 0x98]
call fcn.140054c44
lea rcx, [rsp + 0x80]
call fcn.140054c44
lea rcx, [rsp + 0xc8]
call fcn.140054c44
lea rcx, [rsp + 0xd8]
call fcn.140054c44
lea rcx, [rsp + 0x100]
call fcn.140072f34
lea rcx, [rsp + 0x100]
call fcn.140054c44
lea rcx, [rsp + 0xe8]
call fcn.140054c44
movsxd rax, ebx
add rsp, 0x398
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret