Function at 0x1400613d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov ebx, dword [rcx + 0x168]
mov rsi, rcx
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
mov eax, ebx
and eax, 3
cmp eax, 3
je 0x140060e00
lea rdx, [0x140226cc8]
mov edx, dword [rdx + rax*4]
mov eax, edx
and eax, 0xfffffffd
or eax, 4
test bl, 8
cmovne edx, eax
mov eax, ebx
and eax, 0x10000000
cmp eax, 1
mov eax, ebx
sbb r8d, r8d
and eax, 0x700
and r8d, 7
cmp eax, 0x300
je 0x140061040
jle 0x140060e30
cmp eax, 0x600
je 0x140061030
jg 0x140060fe8
cmp eax, 0x400
je 0x140061050
mov dword [rsp + 0x48], 1
cmp eax, 0x500
jne 0x140060e00
nop word [rax + rax]
test bh, 1
je 0x140060e52
mov eax, edi
not eax
and eax, dword [rsi + 0x158]
and eax, 0x80
mov edi, eax
mov ecx, eax
mov r15d, eax
mov r14d, eax
neg edi
mov edi, eax
mov r13d, eax
sbb r12d, r12d
add r12d, 0x20000081
neg edi
mov edi, eax
sbb ebp, ebp
add ebp, 0x28000081
neg edi
sbb edi, edi
add edi, 0x30000081
neg ecx
mov ecx, eax
sbb r11d, r11d
add r11d, 0x10000081
neg ecx
mov ecx, eax
sbb r10d, r10d
add r10d, 0x8000081
neg ecx
sbb ecx, ecx
add ecx, 0x20000181
neg r15d
sbb r15d, r15d
add r15d, 0x28000181
neg r14d
sbb r14d, r14d
add r14d, 0x30000181
mov dword [rsp + 0x44], r14d
mov r14d, eax
neg r14d
mov r14d, eax
sbb r9d, r9d
add r9d, 0x10000181
neg r14d
sbb r14d, r14d
mov dword [rsp + 0x40], r9d
mov r9d, eax
add r14d, 0x8000181
neg r9d
sbb r9d, r9d
add r9d, 0x181
neg r13d
sbb r13d, r13d
add r13d, 0x24000181
mov dword [rsp + 0x5c], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x2c000181
mov dword [rsp + 0x58], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x34000181
mov dword [rsp + 0x54], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x14000181
mov dword [rsp + 0x50], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0xc000181
mov dword [rsp + 0x4c], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x4000181
neg eax
sbb eax, eax
add eax, 0x81
jmp 0x140060ec8
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 0x100
je 0x140060fd8
cmp eax, 0x200
je 0x140061030
test eax, eax
jne 0x140060e00
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x44], 0x30000180
mov r12d, 0x20000080
mov ebp, 0x28000080
mov edi, 0x30000080
mov dword [rsp + 0x40], 0x10000180
mov r11d, 0x10000080
mov r10d, 0x8000080
mov ecx, 0x20000180
mov dword [rsp + 0x5c], 0x24000180
mov r15d, 0x28000180
mov r14d, 0x8000180
mov r9d, 0x180
mov dword [rsp + 0x58], 0x2c000180
mov r13d, 0x4000180
mov eax, pe_nt_image_headers64
mov dword [rsp + 0x54], 0x34000180
mov dword [rsp + 0x50], 0x14000180
mov dword [rsp + 0x4c], 0xc000180
test bl, 0x40
je 0x140060f02
mov edi, dword [rsp + 0x54]
mov r11d, dword [rsp + 0x50]
mov r9d, r13d
mov eax, r13d
mov r12d, dword [rsp + 0x5c]
mov ebp, dword [rsp + 0x58]
or edx, 0x10000
mov r10d, dword [rsp + 0x4c]
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], r11d
mov ecx, r12d
mov r15d, ebp
mov r14d, r10d
test bh, 0x10
jne 0x140060f1c
mov dword [rsp + 0x44], edi
mov ecx, r12d
mov r15d, ebp
mov r14d, r10d
mov dword [rsp + 0x40], r11d
mov r9d, eax
mov eax, ebx
and eax, 0x30
cmp eax, 0x10
je 0x140061010
cmp eax, 0x20
je 0x140061000
test eax, eax
jne 0x140060e00
test ebx, 0x2000000
je 0x140060f57
test dl, 4
je 0x140060f54
test dl, 2
je 0x140060e00
and edx, 0xfffffffb
mov r9d, ecx
mov eax, ebx
and eax, 0xc000000
lea ecx, [rax - 0x4000000]
and ecx, 0xf8000000
je 0x140061020
test eax, eax
jne 0x140060e00
mov eax, dword [rsp + 0x48]
or r9d, 0x2000000
mov rcx, qword [rsi + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r9d
xor r9d, r9d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140061060
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
test eax, eax
js 0x1400610a0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x140060e15
mov dword [rsp + 0x48], 4
jmp 0x140060cb0
cmp eax, 0x700
jne 0x140060e00
mov dword [rsp + 0x48], 1
jmp 0x140060cb0
mov ecx, r15d
mov r9d, r14d
jmp 0x140060f3b
mov ecx, dword [rsp + 0x44]
mov r9d, dword [rsp + 0x40]
jmp 0x140060f3b
or r9d, 0x80000000
jmp 0x140060f78
mov dword [rsp + 0x48], 5
jmp 0x140060cb0
mov dword [rsp + 0x48], 2
jmp 0x140060cb0
mov dword [rsp + 0x48], 3
jmp 0x140060cb0
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x50
jne 0x140061080
and ebx, 0x500
cmp ebx, 0x100
je 0x140061107
call rdi
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x140060e15
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x18
jne 0x1400610e0
mov qword [rsi + 0x88], 0xfffffffffffff01e
mov dword [rsi + 0x14c], 4
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
je 0x140061121
call rbx
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x1400610c0
mov qword [rsi + 0x88], 0xfffffffffffff01c
mov dword [rsi + 0x14c], 0x50
jmp 0x140060e15
mov dword [rsi + 0x14c], 0xfffff002
mov ecx, 0xfffff002
call fcn.1400605f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x1400610c0
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov r14, qword [rbx + 0x180]
cmp ecx, 0xffffffff
je 0x140061330
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400613a0
cmp r14, 0xffffffffffffffff
jne 0x140061260
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
xor r14d, r14d
xor esi, esi
lea r13, [rsp + 0x44]
jmp 0x140061205
add r14, 1
cmp r14d, dword [rbx + 0x170]
jae 0x14006123e
mov rax, r14
mov r9, r13
mov rcx, rbp
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
call r12
add esi, dword [rsp + 0x44]
mov edi, eax
test eax, eax
jne 0x1400611f8
or edi, esi
je 0x140061350
mov eax, esi
mov qword [rbx + 0x88], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
pxor xmm0, xmm0
xor edx, edx
movaps xmmword [rsp + 0x50], xmm0
mov r9d, 1
xor r15d, r15d
xor esi, esi
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
lea r13, [rsp + 0x44]
movaps xmmword [rsp + 0x60], xmm0
call rax
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1400612c1
add r15, 1
cmp r15d, dword [rbx + 0x170]
jae 0x140061370
mov eax, esi
mov r9, r13
mov rcx, rbp
add rax, r14
mov qword [rsp + 0x60], rax
mov rax, r15
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call r12
add esi, dword [rsp + 0x44]
mov r10d, eax
test eax, eax
jne 0x1400612b0
test edi, edi
je 0x140061236
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r10d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbp
call rax
mov edi, dword [rsp + 0x30]
or edi, esi
jne 0x14006123e
jmp 0x140061350
mov qword [rbx + 0x88], 0xfffffffffffff00d
mov dword [rbx + 0x14c], 6
jmp 0x140061247
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x140061380
mov qword [rbx + 0x88], 0
jmp 0x140061247
test edi, edi
je 0x14006123e
jmp 0x140061306
mov dword [rbx + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061247
mov dword [rbx + 0x14c], 6
mov ecx, 6
call fcn.1400605f0
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061247
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov r14, qword [rbx + 0x180]
cmp ecx, 0xffffffff
je 0x140061560
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400615b8
cmp r14, 0xffffffffffffffff
jne 0x140061490
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
xor r14d, r14d
xor esi, esi
lea r13, [rsp + 0x44]
jmp 0x140061435
add r14, 1
cmp r14d, dword [rbx + 0x170]
jae 0x14006146e
mov rax, r14
mov r9, r13
mov rcx, rbp
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
call r12
add esi, dword [rsp + 0x44]
mov edi, eax
test eax, eax
jne 0x140061428
or edi, esi
je 0x140061580
mov eax, esi
mov qword [rbx + 0x88], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
pxor xmm0, xmm0
xor edx, edx
movaps xmmword [rsp + 0x50], xmm0
mov r9d, 1
xor r15d, r15d
xor esi, esi
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
lea r13, [rsp + 0x44]
movaps xmmword [rsp + 0x60], xmm0
call rax
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1400614f1
add r15, 1
cmp r15d, dword [rbx + 0x170]
jae 0x1400615a8
mov eax, esi
mov r9, r13
mov rcx, rbp
add rax, r14
mov qword [rsp + 0x60], rax
mov rax, r15
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call r12
add esi, dword [rsp + 0x44]
mov r10d, eax
test eax, eax
jne 0x1400614e0
test edi, edi
je 0x140061466
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r10d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbp
call rax
mov edi, dword [rsp + 0x30]
or edi, esi
jne 0x14006146e
jmp 0x140061580
mov qword [rbx + 0x88], 0xfffffffffffff00d
mov dword [rbx + 0x14c], 6
jmp 0x140061477
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061477
test edi, edi
je 0x14006146e
jmp 0x140061536
mov dword [rbx + 0x14c], 6
mov ecx, 6
call fcn.1400605f0
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061477
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc0
xor r9d, r9d
mov r8d, 7
mov edx, 0x10180
mov rsi, rcx
mov rcx, qword [rcx + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400617b0
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1400617e0
mov eax, dword [rsp + 0x80]
test al, 0x10
je 0x1400616da
test ah, 4
je 0x1400617f0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140060920
test eax, eax
js 0x140061808
mov eax, dword [rsp + 0x80]
mov rdi, qword [0x1402341d0]
mov r10, qword [rdi]
test al, 1
jne 0x140061738
lea r12, [rsp + 0x50]
lea rbp, [rsp + 0x40]
mov byte [rsp + 0x50], 1
mov r8, r12
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x20], 0xd
mov r9d, 1
call qword [rdi]
test eax, eax
js 0x140061785
mov qword [rsi + 0x40], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
and eax, 0xffffffde
pxor xmm0, xmm0
lea r12, [rsp + 0x50]
mov rcx, rbx
or eax, 0x20
lea rbp, [rsp + 0x40]
movaps xmmword [rsp + 0x50], xmm0
mov r8, r12
movaps xmmword [rsp + 0x60], xmm0
mov r9d, 0x28
mov rdx, rbp
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x70], eax
call r10
test eax, eax
jns 0x1400616f2
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x14006171c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rsi + 0x88], rax
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140061790
mov dword [rsi + 0x14c], 5
mov ecx, 5
jmp 0x140061798
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x5b8
jne 0x140061821
mov ecx, 5
mov eax, 5
mov dword [rsi + 0x14c], eax
jmp 0x140061798
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14, rcx
mov rcx, qword [rcx + 0x150]
call sub.msvcrt.dll_wcslen
mov rdx, qword [r14 + 0x150]
cmp rax, 5
ja 0x1400618e8
mov qword [r14 + 0x88], 0xfffffffffffff019
mov dword [r14 + 0x14c], 0x57
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rdx + rax*2 - 0xc]
mov r8d, 6
lea rdx, str.XXXXXX
mov rcx, rdi
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x1400618bc
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140061b70
lea rax, [rsp + 0x48]
mov rbp, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov r13, qword [sym.imp.msvcrt.dll__wmkdir]
mov esi, 0x7fff
mov qword [rsp + 0x38], rax
mov r12, qword [sym.imp.msvcrt.dll__errno]
movabs rbx, 0x8421084210842109
jmp 0x140061a97
mov r15, qword [rsp + 0x48]
lea rcx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov rdx, r15
shr rdx, 1
mov rax, rdx
mul rbx
mov r9, rdx
shr rdx, 5
mov rax, rdx
shr r9, 4
mul rbx
mov r10, rdx
shr rdx, 5
mov rax, rdx
shr r10, 4
mul rbx
mov rax, r9
shl rax, 5
sub rax, r9
add rax, rax
mov r11, rdx
shr rdx, 5
sub r15, rax
mov rax, r10
shr r11, 4
shl rax, 5
sub rax, r10
add rax, rax
sub r9, rax
mov rax, r11
shl rax, 5
movzx r9d, word [rcx + r9*2]
sub rax, r11
add rax, rax
sub r10, rax
mov rax, rdx
mul rbx
movzx r10d, word [rcx + r10*2]
mov r8, rdx
shr r8, 4
mov rax, r8
shl rax, 5
sub rax, r8
add rax, rax
sub r11, rax
movzx eax, word [rcx + r11*2]
shl rax, 0x10
or rax, r10
shl rax, 0x10
or rax, r9
movzx r9d, word [rcx + r15*2]
shl rax, 0x10
shr rdx, 5
or rax, r9
mov qword [rdi], rax
mov rax, rdx
mul rbx
mov r9, rdx
shr rdx, 5
shr r9, 4
mov rax, r9
shl rax, 5
sub rax, r9
add rax, rax
sub r8, rax
mov rax, rdx
mul rbx
shr rdx, 4
mov rax, rdx
mov qword [rsp + 0x48], rdx
shl rax, 5
sub rax, rdx
add rax, rax
sub r9, rax
movzx eax, word [rcx + r9*2]
movzx ecx, word [rcx + r8*2]
shl eax, 0x10
or eax, ecx
mov rcx, qword [r14 + 0x150]
mov dword [rdi + 8], eax
call r13
test eax, eax
je 0x140061b19
call r12
cmp dword [rax], 0x11
jne 0x140061b58
sub esi, 1
je 0x140061adf
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov edx, 8
call rbp
test eax, eax
jne 0x140061960
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [r14 + 0x14c], ecx
call fcn.1400605f0
mov rcx, qword [rsp + 0x40]
xor edx, edx
cdqe
mov qword [r14 + 0x88], rax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400618d2
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [r14 + 0x88], 0xffffffffffffffff
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [r14 + 0x14c], ecx
call fcn.1400605f0
cdqe
mov qword [r14 + 0x88], rax
jmp 0x1400618d2
mov rbx, qword [r14 + 0x98]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov r8d, 6
lea rcx, [rbx + rax - 6]
call sub.msvcrt.dll_wcstombs
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov qword [r14 + 0x88], 0
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400618d2
mov qword [r14 + 0x88], 0xffffffffffffffff
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
jmp 0x140061ab8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14 + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [r14 + 0x88], rax
jmp 0x1400618d2
push r15
mov eax, 0x20a8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400c97d0
sub rsp, rax
xor r9d, r9d
mov r8d, 7
mov edx, 0x100001
mov rdi, rcx
mov rcx, qword [rcx + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140061fc0
lea rax, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x80], rax
lea r12, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [0x140234190]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x20], r12
call qword [rax]
cmp eax, 0xc000000d
je 0x140061fe1
xor r14d, r14d
xor ebp, ebp
xor r13d, r13d
test eax, eax
js 0x140062075
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x20f0], rdi
mov qword [rsp + 0x88], r12
mov r13, qword [rsp + 0x80]
xor ebx, ebx
nop dword [rax + rax]
add r13, rbx
mov r9d, dword [r13 + 0x3c]
mov ebx, dword [r13]
shr r9d, 1
jmp 0x140061cc4
cmp word [r13 + r9*2 + 0x3e], 0
lea rax, [r9 - 1]
jne 0x140061dc0
mov r9, rax
test r9, r9
jne 0x140061cb0
test rbx, rbx
jne 0x140061ca0
mov rax, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], rax
mov rax, qword [0x140234190]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x2000
call qword [rax]
test eax, eax
jne 0x140061f4f
cmp qword [rsp + 0x98], 0
jne 0x140061c8e
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
mov eax, 0x80000005
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rdi + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rdi + 0x88], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140062067
nop dword [rax]
sub r14, 1
mov rcx, qword [r13 + r14*8]
call fcn.140082d30
test r14, r14
jne 0x140061d88
mov rcx, r13
call fcn.140082d30
nop
add rsp, 0x20a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r9, 1
je 0x140061f08
cmp r9, 2
jne 0x140061dde
cmp dword [r13 + 0x40], 0x2e002e
je 0x140061cc9
lea r12, [r13 + 0x40]
mov dword [rsp + 0x64], r9d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov r8, r12
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rsi, rdi
test rdi, rdi
je 0x140062006
cmp r14, rbp
jb 0x140061f30
test rbp, rbp
je 0x140061f20
add rbp, rbp
lea rdx, [rbp*8]
mov rcx, qword [rsp + 0x68]
call fcn.140082d70
mov r15, rax
test rax, rax
je 0x140062055
lea rcx, [rdi + 8]
call fcn.140082d10
mov r11, rax
test rax, rax
je 0x14006201e
lea rax, [r14 + 1]
mov qword [r15 + r14*8], r11
xor edx, edx
mov r9d, dword [rsp + 0x64]
mov qword [rsp + 0x70], rax
lea rax, [r11 + 4]
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140062043
mov r11, qword [rsp + 0x68]
mov edx, 6
mov byte [r11 + rdi + 4], 0
mov eax, dword [r13 + 0x38]
test al, 0x40
je 0x140061ef8
mov dword [r11], edx
mov r14, qword [rsp + 0x70]
mov qword [rsp + 0x68], r15
test rbx, rbx
jne 0x140061ca0
jmp 0x140061cce
test ah, 4
je 0x140061f40
mov edx, 3
jmp 0x140061ed7
cmp word [r13 + 0x40], 0x2e
jne 0x140061dde
jmp 0x140061cc9
mov edx, 0x100
mov ebp, 0x20
jmp 0x140061e46
mov r15, qword [rsp + 0x68]
jmp 0x140061e5c
xor edx, edx
test al, 0x10
setne dl
add edx, 1
jmp 0x140061ed7
jns 0x140061c8e
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
cmp eax, 0x80000006
jne 0x140061d50
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x90], r13
test r13, r13
je 0x140061f8b
or dword [rdi + 0x148], 8
mov qword [rdi + 0x88], r14
cmp r14, 0xffffffffffffffff
jne 0x1400620a1
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rdi + 0x14c], ecx
call fcn.1400605f0
cdqe
mov qword [rdi + 0x88], rax
jmp 0x1400620a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x14c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rdi + 0x88], rax
jmp 0x140061da4
mov qword [rdi + 0x88], 0xfffffffffffff02c
mov rcx, qword [rsp + 0x78]
mov dword [rdi + 0x14c], 0x10b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140061da4
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140061d5b
mov rdi, qword [rsp + 0x20f0]
mov qword [rdi + 0x88], 0xfffffffffffff027
mov r13, r15
mov dword [rdi + 0x14c], 0xe
jmp 0x140061d71
mov rdi, qword [rsp + 0x20f0]
mov r14, qword [rsp + 0x70]
mov r13, r15
jmp 0x140062013
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
mov r15, r13
jmp 0x140062026
test r13, r13
je 0x140061da4
jmp 0x140061d9b
cmp eax, 0x80000006
jne 0x140061d50
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x90], 0
mov qword [rdi + 0x88], 0
mov dword [rdi + 0x170], 0
jmp 0x140061da4
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rbx, rcx
lea rcx, [rcx - 0x120]
cmp dword [rbx - 0xb0], 0x1e
ja case.0x1400620ea.0
mov eax, dword [rbx - 0xb0]
lea rdx, [0x140226c4c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x30]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140062150
nop dword [rax + rax]
mov qword [rbx - 0x98], 0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062190
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne case.0x1400620ea.26
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620ea.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062190
cmp ecx, 2
jle case.0x1400620ea.26
call qword [sym.imp.msvcrt.dll__close]
cmp eax, 0xffffffff
jne case.0x1400620ea.26
nop dword [rax + rax]
mov qword [rbx - 0x98], 0xfffffffffffff00d
mov dword [rbx + 0x2c], 6
jmp case.0x1400620ea.0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061640
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062150
xor r8d, r8d
lea rdx, [rbx - 0x90]
mov rcx, rax
call fcn.140060920
test eax, eax
jne 0x140063000
or dword [rbx + 0x28], 8
mov qword [rbx - 0x98], 0
mov rcx, rsi
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 0x48]
mov r12, qword [rbx + 0x30]
mov r13, qword [rbx + 0x40]
mov esi, dword [0x140217200]
mov rdi, qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
test al, 2
je 0x1400622b4
jmp 0x140063139
call rbp
cmp eax, 0x57
jne 0x14006328d
and esi, 2
je 0x1400632a5
mov eax, dword [rbx + 0x48]
mov r12, qword [rbx + 0x30]
mov dword [0x140217200], 0
mov r13, qword [rbx + 0x40]
mov esi, eax
and esi, 2
jne 0x140063139
and eax, 1
mov rdx, r12
mov rcx, r13
or esi, eax
mov r8d, esi
call rdi
test al, al
je 0x140062280
jmp case.0x1400620ea.26
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wmkdir]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x1400620ea.0
nop dword [rax]
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x2c], ecx
call fcn.1400605f0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620ea.0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wrmdir]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x1400620ea.0
jmp 0x1400622f0
xor r8d, r8d
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
jne case.0x1400620ea.26
jmp 0x140062150
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061ba0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061890
mov r8d, dword [rbx + 0x48]
test r8b, 4
je 0x140063020
mov qword [rbx - 0x98], 0xfffffffffffff02a
mov dword [rbx + 0x2c], 0x32
jmp case.0x1400620ea.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062190
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReOpenFile]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062150
mov rcx, rax
mov rax, qword [0x1402341a0]
lea rbp, [rsp + 0x80]
lea rdi, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r9d, 0x28
mov r8, rbp
mov rdx, rdi
call qword [rax]
test eax, eax
js 0x140063058
mov r12, qword [0x1402341d0]
mov eax, dword [rsp + 0xa0]
mov r10, qword [r12]
test al, 0x20
jne 0x1400632ac
or eax, 0x20
mov r9d, 0x28
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0xa0], eax
mov rcx, rsi
mov dword [rsp + 0x20], 4
call r10
test eax, eax
js 0x140063058
mov eax, dword [rsp + 0xa0]
mov r13d, 1
mov edx, eax
or eax, 1
mov r9d, 0x28
mov r8, rbp
and edx, 0xfffffffe
test byte [rbx + 0x38], 0x80
mov rcx, rsi
mov dword [rsp + 0x20], 4
cmovne eax, edx
mov rdx, rdi
mov dword [rsp + 0xa0], eax
call qword [r12]
test eax, eax
js 0x140063058
test r13d, r13d
je 0x1400624ed
mov eax, dword [rsp + 0xa0]
mov edx, pe_nt_image_headers64
mov r8, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov r9d, 0x28
and eax, 0xffffffdf
cmove eax, edx
mov rdx, rdi
mov dword [rsp + 0xa0], eax
call qword [r12]
test eax, eax
js 0x140063058
mov qword [rbx - 0xe0], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x1400620ea.0
mov edx, dword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wchmod]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x1400620ea.0
jmp 0x1400622f0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140062150
test byte [rbx + 0x38], 2
je case.0x1400620ea.26
and eax, 0x11
cmp eax, 1
jne case.0x1400620ea.26
mov dword [rbx + 0x2c], 0xfffff030
mov ecx, 0xfffff030
call fcn.1400605f0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620ea.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062190
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140063089
movsd xmm2, qword [0x140226d18]
movsd xmm3, qword [rbx + 0x38]
movsd xmm0, qword [0x140226d20]
movsd xmm1, qword [rbx + 0x40]
mulsd xmm3, xmm2
comisd xmm3, xmm0
cvttsd2si rax, xmm3
jb 0x1400625d6
subsd xmm3, xmm0
cvttsd2si rax, xmm3
btc rax, 0x3f
mulsd xmm1, xmm2
movabs rdx, 0x19db1ded53e8000
add rax, rdx
mov qword [rsp + 0x60], rax
comisd xmm1, xmm0
cvttsd2si rax, xmm1
jb 0x140062605
subsd xmm1, xmm0
cvttsd2si rax, xmm1
btc rax, 0x3f
movabs rdx, 0x19db1ded53e8000
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x60]
add rax, rdx
xor edx, edx
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne case.0x1400620ea.26
jmp 0x140062150
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, 0x100
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062150
movsd xmm2, qword [0x140226d18]
movsd xmm3, qword [rbx + 0x38]
movsd xmm0, qword [0x140226d20]
movsd xmm1, qword [rbx + 0x40]
mulsd xmm3, xmm2
comisd xmm3, xmm0
cvttsd2si rax, xmm3
jb 0x1400626b5
subsd xmm3, xmm0
cvttsd2si rax, xmm3
btc rax, 0x3f
mulsd xmm1, xmm2
movabs rdx, 0x19db1ded53e8000
add rax, rdx
mov qword [rsp + 0x60], rax
comisd xmm1, xmm0
cvttsd2si rax, xmm1
jb 0x1400626e4
subsd xmm1, xmm0
cvttsd2si rax, xmm1
btc rax, 0x3f
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x60]
mov rcx, rsi
movabs rdx, 0x19db1ded53e8000
add rax, rdx
xor edx, edx
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x140063000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx - 0x98], 0
jmp case.0x1400620ea.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062190
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 8
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov rcx, rax
mov rax, qword [rbx + 0x60]
mov dword [rsp + 0x20], 0x14
mov qword [rsp + 0x60], rax
mov rax, qword [0x1402341d0]
call qword [rax]
mov ecx, eax
xor eax, eax
test ecx, ecx
jns 0x140062162
mov rax, qword [0x1402341f0]
call qword [rax]
jmp 0x140062156
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062190
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140063089
mov rcx, rax
lea rbp, [rsp + 0x50]
lea rsi, [rbx - 0x80]
mov rax, qword [0x1402341a0]
mov rdx, rbp
mov dword [rsp + 0x20], 0x12
mov r9d, 0x68
lea r8, [rsp + 0x80]
call qword [rax]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400637cb
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x1400632e0
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400637cb
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x14006327b
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x48], r8
movabs r8, 0xd6bf94d5e57a42bd
cmove rax, rcx
pxor xmm0, xmm0
movabs rcx, 0xfe624e212ac18000
mov qword [rbx - 0x40], 0x1000
add r9, rcx
mov qword [rbx - 0x30], 0
mov qword [rbx - 0x78], rax
mov rax, r9
mul r8
mov qword [rbx - 0x58], 0
mov qword [rbx - 0x28], 0
mov qword [rbx - 0x90], rsi
shr rdx, 0x17
movups xmmword [rbx - 0x68], xmm0
mov dword [rbx - 0x20], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
mov qword [rbx - 0x98], 0
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0x1c], r9d
mov r9, qword [rsp + 0x98]
add r9, rcx
mov rax, r9
mul r8
shr rdx, 0x17
mov dword [rbx - 0x10], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0xc], r9d
mov r9, qword [rsp + 0x90]
add r9, rcx
add rcx, qword [rsp + 0x80]
mov rax, r9
mul r8
mov rax, rcx
shr rdx, 0x17
mov dword [rbx - 0x18], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
mul r8
mov rax, qword [rsp + 0xc0]
imul r9d, r9d, 0x64
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rdx, 0x17
mov dword [rbx - 8], edx
movsxd rdx, edx
shr rax, 9
imul rdx, rdx, 0x989680
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov dword [rbx - 0x14], r9d
mov qword [rbx - 0x70], rax
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [rbx - 4], ecx
jmp case.0x1400620ea.0
mov rsi, qword [rbx + 0x30]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x1400629d8
cmp word [rsi + rax*2 - 4], 0x3a
lea rdx, [rax + rax]
je 0x1400629d8
lea rdx, [rsi + rdx - 2]
movzx eax, word [rdx]
cmp ax, 0x5c
je 0x1400632ca
cmp ax, 0x2f
je 0x1400632ca
nop word [rax + rax]
mov rcx, qword [rbx + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov r8d, 7
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062150
mov r14, qword [0x1402341a0]
lea r12, [rsp + 0x50]
lea rbp, [rsp + 0x80]
mov dword [rsp + 0x20], 0x12
mov rdx, r12
mov r9d, 0x68
mov r8, rbp
mov rcx, rax
call qword [r14]
lea rdi, [rbx - 0x80]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400630cd
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x140063082
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400630cd
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
mov qword [rbx - 0x78], 0
test dh, 4
jne 0x1400630a8
test dl, 0x10
je 0x1400632b4
mov qword [rbx - 0x48], 0
mov eax, 0x4000
mov rcx, rax
or rax, 0x1b6
or rcx, 0x124
and edx, 1
cmovne rax, rcx
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x78], rax
pxor xmm0, xmm0
movabs r8, 0xfe624e212ac18000
movabs rcx, 0xd6bf94d5e57a42bd
mov qword [rbx - 0x40], 0x1000
add r9, r8
mov qword [rbx - 0x30], 0
mov rax, r9
mov qword [rbx - 0x58], 0
mul rcx
mov qword [rbx - 0x28], 0
mov qword [rbx - 0x90], rdi
movups xmmword [rbx - 0x68], xmm0
shr rdx, 0x17
mov dword [rbx - 0x20], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0x1c], r9d
mov r9, qword [rsp + 0x98]
add r9, r8
mov rax, r9
mul rcx
shr rdx, 0x17
mov dword [rbx - 0x10], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0xc], r9d
mov r9, qword [rsp + 0x90]
add r9, r8
add r8, qword [rsp + 0x80]
mov rax, r9
mul rcx
mov rax, r8
shr rdx, 0x17
mov dword [rbx - 0x18], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
mul rcx
mov rax, qword [rsp + 0xc0]
imul r9d, r9d, 0x64
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rdx, 0x17
mov dword [rbx - 8], edx
movsxd rdx, edx
shr rax, 9
imul rdx, rdx, 0x989680
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov dword [rbx - 0x14], r9d
mov qword [rbx - 0x70], rax
sub r8, rdx
imul r8d, r8d, 0x64
mov dword [rbx - 4], r8d
jmp 0x140062226
mov r14d, dword [rbx + 0x68]
mov esi, 0x10000
mov eax, dword [rbx + 0x4c]
mov r12d, dword [rbx + 0x30]
mov rbp, qword [rbx + 0x60]
cmp r14, rsi
mov dword [rsp + 0x4c], eax
cmovbe rsi, r14
mov rcx, rsi
call fcn.140082d10
mov rdi, rax
test rax, rax
je 0x14006382e
cmp rbp, 0xffffffffffffffff
je 0x140062f78
xor r8d, r8d
mov rdx, rbp
mov ecx, r12d
call sub.msvcrt.dll__lseeki64
cmp rax, 0xffffffffffffffff
jne 0x140062f78
mov rcx, rdi
call fcn.140082d30
mov qword [rbx - 0x98], 0xffffffffffffffff
jmp 0x1400622f0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x1400613d0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x1400611a0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140060c00
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000080
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140062150
mov rdi, qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call rdi
mov esi, eax
test eax, eax
je 0x1400632fa
lea ecx, [rax + 1]
add rcx, rcx
call fcn.140082d10
mov rbp, rax
test rax, rax
je 0x1400637e3
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, r12
call rdi
test eax, eax
je 0x140063790
mov r8d, 8
lea rdx, str._UNC_
mov rcx, rbp
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140063252
mov eax, 0x5c
lea r14, [rbp + 0xc]
lea edi, [rsi - 6]
mov word [rbp + 0xc], ax
mov dword [rsp + 0x28], 0
mov r9d, edi
mov r8, r14
xor edx, edx
mov qword [rsp + 0x38], 0
mov r15, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call r15
movsxd rsi, eax
test esi, esi
je 0x1400632f2
lea ecx, [rsi + 1]
movsxd rcx, ecx
call fcn.140082d10
mov r13, rax
test rax, rax
je 0x1400632e7
mov r9d, edi
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call r15
mov byte [r13 + rsi], 0
mov rcx, rbp
mov qword [rbx - 0x90], r13
call fcn.140082d30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [rbx + 0x28], 8
jmp case.0x1400620ea.26
mov rsi, qword [rbx + 0x30]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x140062e80
cmp word [rsi + rax*2 - 4], 0x3a
lea rdx, [rax + rax]
je 0x140062e80
lea rdx, [rsi + rdx - 2]
movzx eax, word [rdx]
cmp ax, 0x5c
je 0x1400632d6
cmp ax, 0x2f
je 0x1400632d6
nop word [rax + rax]
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062150
mov rcx, rax
lea rbp, [rsp + 0x50]
lea rdi, [rbx - 0x80]
mov rax, qword [0x1402341a0]
mov rdx, rbp
mov dword [rsp + 0x20], 0x12
mov r9d, 0x68
lea r8, [rsp + 0x80]
call qword [rax]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400637a8
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x14006307b
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400637a8
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x140063040
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov qword [rbx - 0x48], r8
cmove rax, rcx
jmp 0x140062ae5
mov r13, qword [sym.imp.msvcrt.dll__read]
mov r15, qword [sym.imp.msvcrt.dll__write]
xor ebp, ebp
test r14, r14
jne 0x140062fc0
jmp 0x140063757
cmp eax, 0xffffffff
je 0x140062c65
cdqe
mov ecx, dword [rsp + 0x4c]
mov rdx, rdi
sub r14, rax
call r15
cmp eax, 0xffffffff
je 0x140062c65
add ebp, eax
test r14, r14
je 0x140062fda
cmp r14, rsi
mov r8, rsi
mov rdx, rdi
mov ecx, r12d
cmovbe r8, r14
call r13
mov r8d, eax
test eax, eax
jne 0x140062f98
movsxd rbp, ebp
mov rcx, rdi
call fcn.140082d30
mov qword [rbx - 0x98], rbp
cmp rbp, 0xffffffffffffffff
jne case.0x1400620ea.0
jmp 0x1400622f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rbx - 0x98], rax
jmp 0x140062231
and r8d, 1
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne case.0x1400620ea.26
jmp 0x140062150
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x140062f62
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rbx - 0x98], rax
jmp 0x1400624f8
xor eax, eax
jmp 0x140062f3c
xor eax, eax
jmp 0x140062a9c
mov dword [rbx + 0x2c], 6
mov ecx, 6
call fcn.1400605f0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620ea.0
xor edx, edx
lea r8, [rbx - 0x48]
mov rcx, rsi
call fcn.140060920
test eax, eax
jne 0x1400630e0
mov rax, qword [rbx - 0x78]
mov edx, dword [rsp + 0xa0]
or ah, 0xa0
jmp 0x140062ace
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
call r15
cmp eax, 0x5b8
je 0x1400634aa
cmp eax, 0x1126
je 0x1400634aa
call r15
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605f0
cdqe
mov qword [rbx - 0x98], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rax, rbx
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov r8d, 4
lea rdx, [0x140226cf8]
mov rcx, r12
mov rsi, rax
call sub.msvcrt.dll_wcsncmp
mov ebp, eax
test eax, eax
je 0x1400631a0
cmp esi, 2
jle 0x140063308
movzx eax, word [r12]
and eax, 0xffffffdf
sub eax, 0x41
cmp ax, 0x19
ja 0x140063308
cmp word [r12 + 2], 0x3a
jne 0x140063308
movzx eax, word [r12 + 4]
cmp ax, 0x5c
je 0x1400631a0
cmp ax, 0x2f
jne 0x140063308
lea ecx, [rsi*4 + 0x20]
movsxd rcx, ecx
call fcn.140082d10
mov rsi, rax
test rax, rax
je 0x14006382e
lea rdi, [rax + 0x10]
mov r8d, 4
lea rdx, [0x140226d08]
mov rcx, rdi
call sub.msvcrt.dll_wcsncpy
xor eax, eax
test ebp, ebp
sete al
lea r9, [r12 + rax*8]
movzx eax, word [r9]
test ax, ax
je 0x14006331f
xor ecx, ecx
mov r8d, 4
xor r10d, r10d
jmp 0x140063244
cmp ax, 0x2f
je 0x14006324a
mov edx, r8d
test r10d, r10d
je 0x140063224
movsxd r8, r8d
mov r14d, 0x5c
add edx, 1
mov word [rdi + r8*2], r14w
movzx eax, word [r9 + rcx]
lea r8d, [rdx + 1]
movsxd rdx, edx
xor r10d, r10d
mov word [rdi + rdx*2], ax
add rcx, 2
movzx eax, word [r9 + rcx]
test ax, ax
je 0x140063325
cmp ax, 0x5c
jne 0x140063200
mov r10d, 1
jmp 0x140063232
mov r8d, 4
lea rdx, [0x140226cf8]
mov rcx, rbp
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140063790
lea r14, [rbp + 8]
lea edi, [rsi - 4]
jmp 0x140062d90
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x14006285b
mov ecx, eax
mov dword [rbx + 0x2c], eax
call fcn.1400605f0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620ea.0
mov ecx, 0x57
jmp 0x14006328f
xor r13d, r13d
jmp 0x140062473
mov rax, qword [rsp + 0xb0]
mov qword [rbx - 0x48], rax
mov eax, 0x8000
jmp 0x140062ace
xor r15d, r15d
mov word [rdx], r15w
jmp 0x1400629d8
xor eax, eax
mov word [rdx], ax
jmp 0x140062e80
xor eax, eax
jmp 0x140062835
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call fcn.140082d30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140062150
mov qword [rbx - 0x98], 0xfffffffffffff019
mov dword [rbx + 0x2c], 0x32
jmp case.0x1400620ea.0
mov r8d, 4
movsxd rax, r8d
lea edx, [r8 + r8 + 2]
mov r11d, 0x5c
xor ebp, ebp
add rax, rax
xor r12d, r12d
add r8d, 2
mov word [rsi + rax + 0x10], r11w
mov word [rsi + 0xa], dx
mov edx, r8d
mov word [rsi + 8], bp
mov word [rdi + rax + 2], r12w
movzx eax, word [r9]
test ax, ax
je 0x1400633cb
xor ecx, ecx
xor r10d, r10d
jmp 0x1400633ad
cmp ax, 0x2f
je 0x1400633b3
test r10d, r10d
je 0x140063391
movsxd rax, edx
mov r10d, 0x5c
add edx, 1
mov word [rdi + rax*2], r10w
movzx eax, word [r9 + rcx]
movsxd r10, edx
add edx, 1
mov word [rdi + r10*2], ax
xor r10d, r10d
add rcx, 2
movzx eax, word [r9 + rcx]
test ax, ax
je 0x1400633bb
cmp ax, 0x5c
jne 0x140063370
mov r10d, 1
jmp 0x14006339f
mov eax, edx
sub eax, r8d
cmp eax, 2
je 0x1400636fd
add eax, eax
movsxd rdx, edx
add r8d, r8d
xor ecx, ecx
mov word [rsi + 0xe], ax
lea ebp, [rdx + rdx + 0x12]
mov word [rsi + 0xc], r8w
xor r8d, r8d
lea eax, [rbp - 8]
mov word [rdi + rdx*2], cx
xor edx, edx
mov rcx, r13
mov dword [rsi], 0xa0000003
mov word [rsi + 4], ax
mov word [rsi + 6], r8w
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400636b7
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r13
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006376d
lea rax, [rsp + 0x80]
mov r9d, ebp
mov r8, rsi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov edx, 0x900a4
mov rcx, rdi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14006371f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140082d30
mov qword [rbx - 0x98], 0
jmp case.0x1400620ea.0
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140063100
mov rcx, rax
mov r9d, 0x68
mov r8, rbp
mov rdx, r12
mov dword [rsp + 0x20], 0x12
call qword [r14]
mov ecx, eax
shr eax, 0x1e
cmp eax, 3
je 0x1400637f3
mov rax, qword [0x1402341c0]
mov rcx, r13
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
mov r9d, 0x18
mov rdx, r12
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
mov ecx, eax
je 0x140063718
shr eax, 0x1e
cmp eax, 3
je 0x1400637f3
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x1400636eb
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x48], r8
movabs r8, 0xfe624e212ac18000
cmove rax, rcx
pxor xmm0, xmm0
movabs rcx, 0xd6bf94d5e57a42bd
mov qword [rbx - 0x90], rdi
add r9, r8
movups xmmword [rbx - 0x68], xmm0
mov qword [rbx - 0x78], rax
mov rax, r9
mul rcx
mov qword [rbx - 0x40], 0x1000
mov qword [rbx - 0x30], 0
mov qword [rbx - 0x58], 0
shr rdx, 0x17
mov qword [rbx - 0x28], 0
movsxd rax, edx
mov dword [rbx - 0x20], edx
imul rax, rax, 0x989680
mov qword [rbx - 0x98], 0
sub r9, rax
imul eax, r9d, 0x64
mov r9, qword [rsp + 0x98]
add r9, r8
mov dword [rbx - 0x1c], eax
mov rax, r9
mul rcx
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 0x10], edx
imul rax, rax, 0x989680
sub r9, rax
imul eax, r9d, 0x64
mov r9, qword [rsp + 0x90]
add r9, r8
add r8, qword [rsp + 0x80]
mov dword [rbx - 0xc], eax
mov rax, r9
mul rcx
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 0x18], edx
imul rax, rax, 0x989680
sub r9, rax
imul eax, r9d, 0x64
mov dword [rbx - 0x14], eax
mov rax, r8
mul rcx
mov rcx, r13
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 8], edx
imul rax, rax, 0x989680
sub r8, rax
imul eax, r8d, 0x64
mov dword [rbx - 4], eax
mov rax, qword [rsp + 0xc0]
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rax, 9
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov qword [rbx - 0x70], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
jmp 0x14006311d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605f0
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140082d30
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x140063575
movsxd rax, edx
mov r9d, 0x5c
add edx, 1
mov word [rdi + rax*2], r9w
mov eax, 6
jmp 0x1400633cb
xor eax, eax
jmp 0x14006354f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605f0
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
call fcn.140082d30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp case.0x1400620ea.0
mov rcx, rdi
call fcn.140082d30
xor eax, eax
mov qword [rbx - 0x98], rax
jmp case.0x1400620ea.0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605f0
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
call fcn.140082d30
jmp 0x140063749
mov rcx, rbp
call fcn.140082d30
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400632fa
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
call rdi
jmp 0x140063006
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140062150
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400632fa
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call r15
call r15
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605f0
mov rcx, r13
cdqe
mov qword [rbx - 0x98], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
jmp 0x14006311d
lea rdx, [0x140226c3e]
mov ecx, 0xe
call fcn.140060590
nop