Function at 0x14006aa10
Capabilities:
Get common file path
Query environment variable

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x5b8
mov rsi, rdx
mov ebx, 1
xor edi, edi
mov dword [rsp + 0x5a0], edi
mov r14d, ebx
mov dword [rsp + 0x5a4], edi
mov rbp, rcx
mov dword [rsp + 0x5a8], edi
mov r13d, r14d
mov dword [rsp + 0x5ac], edi
test byte [rsi + 0x244], 4
je 0x14006aa74
mov rax, qword [rbp + 0x100]
test rax, rax
jne 0x14006aa74
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x14006d2a0
cmp dword [rbp + 0x148], 0
je 0x14006aa8a
mov byte [rsp + 0x490], 0
jmp 0x14006ae10
mov rdx, qword [rbp + 0xb0]
cmp rdx, 3
mov r15, qword [rbp + 0x40]
mov rax, qword [rbp + 0x48]
mov r12, qword [rbp + 0x58]
mov r8d, dword [rbp + 0x60]
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], r15
mov r15d, 1
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x78], 0
je 0x14006e665
mov r9d, dword [rsi + 0x1b0]
cmp r9d, 0xfffffffc
je 0x14006e604
cmp r9d, 0xfffffffd
je 0x14006ab18
cmp r9d, 0xfffffffe
jne 0x14006ab00
test byte [rsi + 0x24d], 4
je 0x14006abbb
jmp 0x14006e771
cmp r9d, 0xffffffff
jne 0x14006ab3c
test byte [rsi + 0x24d], 4
je 0x14006ab99
jmp 0x14006e75f
movzx eax, byte [rsi + 0x24d]
test al, 4
je 0x14006abdd
test byte [rsi + 0x244], 1
jne 0x14006abdd
jne 0x14006abbb
jne 0x14006ab99
test r12, r12
je 0x14006d2c0
mov eax, 0x100
cmp r8d, 0x100
mov rdx, r12
lea rcx, [rsp + 0x387]
cmovg r8d, eax
mov dword [rsp + 0x594], r8d
movsxd r8, r8d
mov qword [rsp + 0x598], rcx
call fcn.14009ef60
mov r10d, dword [rsp + 0x594]
movsxd r10, r10d
mov r8, qword [rsp + 0x598]
mov byte [r8 + r10], 0
movsx r9d, byte [r8]
jmp 0x14006ac37
lea rcx, str.FOR_PRINT
call fcn.14003fb28
mov r8, rax
mov qword [rsp + 0x598], r8
test r8, r8
je 0x14006d4a6
jmp 0x14006abfd
lea rcx, str.FOR_TYPE
call fcn.14003fb28
mov r8, rax
mov qword [rsp + 0x598], r8
test r8, r8
je 0x14006d4cf
jmp 0x14006abfd
lea rcx, str.FOR_ACCEPT
call fcn.14003fb28
mov r8, rax
mov qword [rsp + 0x598], r8
test r8, r8
je 0x14006e5db
mov rdx, r8
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14006ac28
mov rax, rdx
add rdx, rcx
call fcn.14009ef90
mov r10d, eax
mov dword [rsp + 0x594], r10d
movsx r9d, byte [r8]
cmp r9d, 0x20
jne 0x14006ac5e
test r10d, r10d
jle 0x14006ac5e
inc r8
dec r10d
mov qword [rsp + 0x598], r8
mov dword [rsp + 0x594], r10d
cmp byte [r8], 0x20
je 0x14006ac3d
xor edx, edx
mov r9d, r10d
mov ecx, r10d
mov qword [rsp + 0x58], 0
xor eax, eax
test r10d, r10d
jle 0x14006acc7
movsxd r11, r10d
add r11, r8
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rbp
mov rsi, qword [rsp + 0x50]
mov r11, qword [rsp + 0x58]
movsx ebp, byte [r11 + rsi - 1]
cmp ebp, 0x20
je 0x14006aca4
test ebp, ebp
jne 0x14006acbd
inc edx
lea r10d, [rcx + rax - 1]
dec eax
dec r11
mov dword [rsp + 0x594], r10d
cmp edx, r9d
jb 0x14006ac95
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
test r10d, r10d
jne 0x14006ad15
test byte [rsi + 0x24d], 4
je 0x14006ad15
mov rcx, rsi
lea rdx, [rsp + 0x598]
lea r8, [rsp + 0x594]
call fcn.140069b10
test eax, eax
jne 0x14006acfb
mov r8, qword [rsp + 0x598]
jmp 0x14006ad15
je 0x14006ae10
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r15d, r15d
je 0x14006ada4
movsxd rax, dword [rsp + 0x594]
mov rcx, rsi
mov rdx, r8
mov byte [r8 + rax], 0
call fcn.14004d550
cmp eax, 0xffffffff
je 0x14006e286
xor r15d, r15d
cmp dword [0x1400fc280], 0
jne 0x14006ad50
cmp eax, 0xfffffffa
je 0x14006ad8a
cmp eax, 1
je 0x14006ad8a
test eax, eax
jne 0x14006ad66
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x14006ad95
cmp eax, 2
jne 0x14006ad78
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
jmp 0x14006ad95
mov dword [rsp + 0x78], 1
mov r8, qword [rsp + 0x598]
jmp 0x14006ada4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsi + 0x178], rax
mov r8, qword [rsp + 0x598]
mov rcx, r8
lea rdx, [rsp + 0x490]
test cl, 3
je 0x14006adc7
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14006adcc
inc rdx
test cl, 3
jne 0x14006adb4
call fcn.14009efc0
cmp dword [0x1400fc280], 0
je 0x14006adea
test r15d, r15d
jne 0x14006ae00
cmp qword [rsi + 0x178], 0xffffffffffffffff
je 0x14006d4f8
jmp 0x14006ae00
test r15d, r15d
jne 0x14006ae00
cmp qword [rsi + 0x178], 0xffffffffffffffff
jne 0x14006ae00
mov ebx, 1
jmp 0x14006ae10
mov eax, 1
cmp dword [rsp + 0x78], 0
mov ebx, r15d
cmovne ebx, eax
lea rdx, [rsp + 0x490]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14006ae40
mov rax, rdx
add rdx, rcx
call fcn.14009ef90
movsx rcx, ax
lea r15, [rsi + 0xb8]
add rcx, 0xa
xor edx, edx
mov r8, r15
mov word [rsi + 0x22e], ax
call fcn.140071900
test eax, eax
je 0x14006ae78
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rdx, qword [rsi + 0xb8]
lea rcx, [rsp + 0x490]
test cl, 3
je 0x14006ae9f
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14006aea4
inc rdx
test cl, 3
jne 0x14006ae8c
call fcn.14009efc0
mov rax, qword [rsi + 0x120]
test rax, rax
jne 0x14006aebb
mov qword [rsi + 0x120], 1
mov rax, qword [rbp + 0x88]
test rax, rax
je 0x14006aeed
or byte [rsi + 0x245], 0x40
or dword [rsp + 0x5ac], 0x80
or dword [rsp + 0x5a0], 0x80000000
or byte [rsi + 0x24b], 0x10
jmp 0x14006af03
or dword [rsp + 0x5ac], 0x80
or dword [rsp + 0x5a0], 0xc0000000
mov rax, qword [rbp + 0xd8]
test rax, rax
je 0x14006afe5
cmp rax, 2
je 0x14006afbf
cmp rax, 1
jne 0x14006af55
or byte [rsi + 0x245], 0x40
xor r14d, r14d
mov eax, dword [rsp + 0x5a0]
and eax, 0x3fffffff
or eax, 0x80000000
or dword [rsp + 0x5ac], 0x80
mov dword [rsp + 0x5a0], eax
jmp 0x14006afe5
cmp rax, 3
jne 0x14006af97
test byte [rsi + 0x245], 0x40
jne 0x14006b18b
or byte [rsi + 0x24a], 1
xor r14d, r14d
mov eax, dword [rsp + 0x5a0]
and eax, 0x7fffffff
or eax, 0x40000000
or dword [rsp + 0x5ac], 0x80
mov dword [rsp + 0x5a0], eax
jmp 0x14006afe5
mov edx, 0x2ed
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test byte [rsi + 0x245], 0x40
jne 0x14006b18b
xor r14d, r14d
or dword [rsp + 0x5ac], 0x80
or dword [rsp + 0x5a0], 0xc0000000
mov rax, qword [rbp + 0x118]
test rax, rax
je 0x14006b0c7
cmp rax, 2
je 0x14006b0a1
cmp rax, 1
jne 0x14006b037
or byte [rsi + 0x245], 0x40
xor r14d, r14d
mov eax, dword [rsp + 0x5a0]
and eax, 0x3fffffff
or eax, 0x80000000
or dword [rsp + 0x5ac], 0x80
mov dword [rsp + 0x5a0], eax
jmp 0x14006b0c7
cmp rax, 3
jne 0x14006b079
test byte [rsi + 0x245], 0x40
jne 0x14006b18b
or byte [rsi + 0x24a], 1
xor r14d, r14d
mov eax, dword [rsp + 0x5a0]
and eax, 0x7fffffff
or eax, 0x40000000
or dword [rsp + 0x5ac], 0x80
mov dword [rsp + 0x5a0], eax
jmp 0x14006b0c7
mov edx, 0x23b
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test byte [rsi + 0x245], 0x40
jne 0x14006b18b
xor r14d, r14d
or dword [rsp + 0x5ac], 0x80
or dword [rsp + 0x5a0], 0xc0000000
mov rax, qword [rbp]
cmp rax, 5
ja case.default.0x14006b0e7
movsxd rdx, eax
lea rax, [0x140000000]
mov rcx, qword [rax + rdx*8 + 0xb9600]
jmp rcx
or byte [rsi + 0x247], 4
and byte [rsi + 0x244], 0x7b
jmp case.0x14006b0e7.0
movzx r8d, byte [rsi + 0x247]
or r8d, 0x10
mov byte [rsi + 0x247], r8b
jmp 0x14006b154
test byte [rsi + 0x245], 0x40
jne 0x14006b18b
movzx r8d, byte [rsi + 0x247]
or r8d, 3
mov byte [rsi + 0x247], r8b
jmp 0x14006b154
movzx r8d, byte [rsi + 0x247]
or r8d, 8
mov byte [rsi + 0x247], r8b
jmp 0x14006b154
movzx r8d, byte [rsi + 0x247]
or r8d, 2
mov byte [rsi + 0x247], r8b
mov rax, qword [rbp + 0xb0]
cmp rax, 5
ja case.default.0x14006b177
movsxd rdx, eax
lea rax, [0x140000000]
mov rcx, qword [rax + rdx*8 + 0xb9630]
jmp rcx
test r8d, 1
je 0x14006b1a4
test byte [rsi + 0x244], 4
jne 0x14006b1a4
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
or dword [rsp + 0x5a8], 2
or dword [rsp + 0x5ac], 0x4000002
or byte [rsi + 0x246], 4
jmp 0x14006b254
test r8d, 1
je 0x14006b1ee
test byte [rsi + 0x244], 4
jne 0x14006b1ee
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
or dword [rsp + 0x5a8], 1
jmp 0x14006b254
test byte [rsi + 0x244], 4
je case.0x14006b177.4
lea rdx, [0x1400b989c]
lea rcx, [rsp + 0x490]
call fcn.14002da1c
test eax, eax
jne case.0x14006b177.4
or byte [rsi + 0x246], 8
test byte [rsi + 0x245], 0x40
je 0x14006b232
test byte [rsi + 0x244], 4
je case.0x14006b177.1
test byte [rsi + 0x24b], 0x10
je case.0x14006b177.5
or byte [rsi + 0x246], 2
or dword [rsp + 0x5a8], 3
jmp 0x14006b254
or dword [rsp + 0x5a8], 4
mov rax, qword [rbp + 0x50]
cmp rax, 6
ja case.default.0x14006b3df
movsxd rdx, eax
lea rax, [0x140000000]
mov rcx, qword [rax + rdx*8 + 0xb9660]
jmp rcx
test byte [rsi + 0x246], 4
je case.0x14006b274.2
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [rsi + 0x246]
test al, 4
jne 0x14006b18b
or eax, 0x20
mov byte [rsi + 0x246], al
jmp case.0x14006b274.0
movzx eax, byte [rsi + 0x246]
test al, 4
jne 0x14006b18b
or eax, 0x10
mov byte [rsi + 0x246], al
jmp case.0x14006b274.0
test byte [rsi + 0x245], 0x40
jne 0x14006b18b
movzx edx, byte [rsi + 0x246]
or edx, 8
mov byte [rsi + 0x246], dl
mov rax, qword [rbp + 0x50]
cmp rax, 5
jne 0x14006b301
or edx, 0x10
mov byte [rsi + 0x246], dl
jmp case.0x14006b274.0
cmp rax, 6
jne case.0x14006b274.0
or edx, 0x20
mov byte [rsi + 0x246], dl
jmp case.0x14006b274.0
test byte [rsi + 0x246], 4
je case.0x14006b274.0
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rbp + 0x68]
cmp rax, 4
ja case.default.0x14006b354
movsxd rdx, eax
lea rax, [0x140000000]
mov rcx, qword [rax + rdx*8 + 0xb9698]
jmp rcx
or byte [rsi + 0x24c], 2
jmp 0x14006b3b0
movzx eax, byte [rsi + 0x244]
test eax, 0x80
jne 0x14006b376
or byte [rsi + 0x246], 0x80
jmp 0x14006b3b0
or byte [rsi + 0x24c], 1
jmp 0x14006b3b0
movzx eax, byte [rsi + 0x247]
test al, 8
jne 0x14006b392
test al, 0x10
jne 0x14006b392
test al, 4
je case.0x14006b354.1
movzx eax, byte [rsi + 0x244]
test eax, 0x80
jne 0x14006b376
or byte [rsi + 0x246], 0x80
jmp 0x14006b3b0
or byte [rsi + 0x246], 0x40
mov eax, dword [rbp + 0x98]
mov byte [rsi + 0x230], al
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
ja case.default.0x14006b3df
movsxd rcx, edx
lea rdx, [0x140000000]
mov r8, qword [rdx + rcx*8 + 0xb96c0]
jmp r8
movzx edx, byte [rsi + 0x247]
test dl, 8
jne 0x14006b401
test dl, 0x10
jne 0x14006b401
test dl, 4
jne 0x14006b401
test byte [rsi + 0x246], 0x40
je case.0x14006b3df.0
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov byte [rsi + 0x230], 4
mov eax, 4
jmp case.0x14006b3df.0
test byte [rsi + 0x247], 4
je case.0x14006b3df.0
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, dword [rbp + 0x30]
mov byte [rsi + 0x232], dl
mov rdx, qword [rbp + 0x30]
test rdx, rdx
je 0x14006e204
cmp rdx, 1
je 0x14006b4c7
cmp rdx, 2
jne 0x14006b499
test byte [rsi + 0x247], 4
jne 0x14006b18b
test byte [rsi + 0x246], 0x40
je 0x14006b4d4
movsx rdx, al
cmp edx, 5
jl 0x14006b4d4
cmp edx, 8
jg 0x14006b4d4
mov byte [rsi + 0x232], 3
jmp 0x14006b4d4
cmp rdx, 3
je 0x14006b4d4
mov edx, 0x2f2
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test byte [rsi + 0x247], 4
jne 0x14006b18b
mov rdx, qword [rbp + 0x80]
test rdx, rdx
je 0x14006e1de
cmp rdx, 1
je 0x14006b576
cmp rdx, 2
jne 0x14006b51a
movzx r8d, byte [rsi + 0x247]
test r8d, 0x10
jne 0x14006b18b
mov byte [rsi + 0x231], 2
mov ecx, 2
jmp 0x14006b5c6
cmp rdx, 3
jne case.default.0x14006b3df
movzx r8d, byte [rsi + 0x247]
test r8d, 8
jne 0x14006b18b
test r8d, 1
jne 0x14006b18b
test r8d, 4
jne 0x14006b18b
mov byte [rsi + 0x231], 3
mov ecx, 3
jmp 0x14006b5c6
mov eax, Ordinal_52
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx r8d, byte [rsi + 0x247]
test r8d, 8
je 0x14006b5ad
movsx rdx, al
cmp edx, 1
je 0x14006b5ad
test edx, edx
je 0x14006b5ad
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r8d, 0x10
jne 0x14006b18b
mov byte [rsi + 0x231], 1
mov ecx, 1
cmp ecx, 2
je 0x14006b5d8
test r8d, 8
je 0x14006b6ce
lea rcx, str.FOR_DO_NOT_CASHE_DIRECT_FILE
call fcn.14003fb28
test rax, rax
je 0x14006b6b5
mov edx, dword [rsi + 0x1b0]
mov dword [rsp + 0x58], edx
movsx edx, byte [rax]
cmp edx, 0x20
jne 0x14006b60a
inc rax
movsx edx, byte [rax]
cmp edx, 0x20
je 0x14006b5ff
mov r8, rax
je 0x14006b622
movsx edx, byte [rax]
test edx, edx
je 0x14006b622
inc r8
movsx edx, byte [r8]
cmp edx, 0x20
jne 0x14006b612
mov rcx, rax
lea rdx, [0x1400b9898]
mov byte [r8], 0
call fcn.14002d810
test rax, rax
je 0x14006b6b5
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x68], rbp
mov rbp, rax
mov qword [rsp + 0x70], rsi
mov r14d, dword [rsp + 0x58]
mov rcx, rbp
mov edx, reloc.LMGR10.dll_Ordinal_45
call fcn.140040b00
mov rsi, rax
test rsi, rsi
je 0x14006d535
mov rcx, rbp
mov byte [rsi], 0
call fcn.14002d8fc
inc rsi
mov ebp, eax
mov rcx, rsi
call fcn.14002d8fc
cmp r14d, ebp
jl 0x14006b690
cmp r14d, eax
jle 0x14006d513
xor ecx, ecx
lea rdx, [0x1400b9898]
call fcn.14002d810
mov rbp, rax
test rbp, rbp
jne 0x14006b651
mov r14d, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
or dword [rsp + 0x5ac], 0x10000000
movsx eax, byte [rsi + 0x230]
movsx ecx, byte [rsi + 0x231]
mov rdx, qword [rbp + 0x98]
test rdx, rdx
jne 0x14006b765
cmp ecx, 3
je 0x14006b6f9
cmp ecx, 2
je 0x14006b6f9
movzx edx, byte [rsi + 0x247]
test dl, 8
jne 0x14006b6f9
test dl, 0x10
je 0x14006b707
mov byte [rsi + 0x230], 1
mov eax, 1
jmp 0x14006b765
movzx eax, byte [rsi + 0x24c]
test al, 1
jne 0x14006b72e
test al, 2
jne 0x14006b72e
movzx eax, byte [rsi + 0x246]
and eax, 0x80
shr eax, 7
test dl, 4
je 0x14006b73c
test eax, eax
je 0x14006b74e
mov byte [rsi + 0x230], 5
mov eax, 5
jmp 0x14006b776
test eax, eax
je 0x14006b74e
mov byte [rsi + 0x230], 4
mov eax, 4
jmp 0x14006b776
cmp byte [rsi + 0x232], 3
je 0x14006b72e
mov byte [rsi + 0x230], 8
mov eax, 8
jmp 0x14006b776
cmp ecx, 3
je 0x14006b780
cmp ecx, 2
je 0x14006b780
movzx edx, byte [rsi + 0x247]
test dl, 8
jne 0x14006b780
test dl, 0x10
je 0x14006b7a2
movsx rax, al
cmp eax, 1
je 0x14006b7a6
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movsx rax, al
test byte [rsi + 0x24c], 1
je 0x14006b7de
movzx edx, byte [rsi + 0x247]
test dl, 1
jne 0x14006b7c0
test dl, 2
je 0x14006b7de
cmp eax, 5
je 0x14006b7e7
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp eax, 4
je 0x14006e1b8
or dword [rsp + 0x5a4], 1
mov rax, qword [rbp + 0xa8]
test rax, rax
jne 0x14006b804
test byte [rsi + 0x244], 4
je 0x14006b81d
or byte [rsi + 0x246], 1
xor r13d, r13d
and byte [rsi + 0x24c], 0xfb
or dword [rsp + 0x5a4], 2
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x14006b863
cmp rax, 1
je 0x14006b85a
cmp rax, 2
je 0x14006b86c
mov edx, 0x23d
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [rsi + 0x247]
jmp 0x14006b87c
test r12, r12
je 0x14006e196
movzx eax, byte [rsi + 0x247]
or eax, 0x20
mov byte [rsi + 0x247], al
and eax, 4
mov r12, qword [rbp + 0x90]
shr eax, 2
test r12, r12
je 0x14006b8ab
test eax, eax
je 0x14006b906
mov eax, 0x70
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test eax, eax
jne 0x14006ba1c
test byte [rsi + 0x246], 0x40
je 0x14006b8d8
mov r12d, dword [0x1400e5010]
cmp r12d, 0xfffffffe
je 0x14006e6c4
cmp r12d, 0xffffffff
jne 0x14006b8f3
jmp 0x14006ba1c
mov r12d, dword [0x1400e5014]
cmp r12d, 0xfffffffe
je 0x14006e6ab
cmp r12d, 0xffffffff
je 0x14006ba1c
movsxd r12, r12d
mov qword [rbp + 0x90], r12
test r12, r12
je 0x14006ba1c
test byte [rsi + 0x244], 4
je 0x14006b93c
test r12, r12
jle 0x14006b923
movabs rax, 0xfffffffa
cmp r12, rax
jle 0x14006b945
mov eax, 0x245
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r12, r12
jle 0x14006e6dd
movzx eax, byte [rsi + 0x246]
and eax, 0x80
shr eax, 7
mov qword [rsi + 0x1a8], r12
test eax, eax
je 0x14006b97e
test byte [rsi + 0x248], 0x10
jne 0x14006b97e
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
lea rcx, [r12*4]
cmove r12, rcx
movsx edx, byte [rsi + 0x230]
dec edx
cmp edx, 7
ja case.default.0x14006b99e
movsxd rdx, edx
lea rcx, [0x140000000]
mov r8, qword [rcx + rdx*8 + 0xb9720]
jmp r8
cmp byte [rsi + 0x232], 3
lea rax, [r12 + 1]
cmove r12, rax
jmp case.0x14006b99e.1
movzx edx, byte [rsi + 0x247]
test byte [rsi + 0x24c], 2
jne 0x14006b9cc
test dl, 4
je case.0x14006b99e.1
test eax, eax
je case.0x14006b99e.1
or edx, 0xffffff80
mov r12d, 0x400
mov qword [rsi + 0x1a8], 0x10000
mov byte [rsi + 0x247], dl
jmp case.0x14006b99e.1
add r12, 4
jmp case.0x14006b99e.1
add r12, 8
jmp case.0x14006b99e.1
mov ecx, 8
mov edx, 2
lea r8, str.for_nt_open_proc.c
mov r9d, 0x6ba
call fcn.14006765c
mov qword [rsi + 0x1a0], r12
jmp 0x14006bb16
cmp byte [rsi + 0x230], 1
je 0x14006ba31
movzx ecx, byte [rsi + 0x247]
test cl, 8
je 0x14006ba59
mov edx, 0x241
mov eax, 0x25
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [rsi + 0x24c]
test al, 1
jne 0x14006ba82
test al, 2
jne 0x14006ba82
mov edx, ecx
and edx, 4
shr edx, 2
movzx eax, byte [rsi + 0x246]
test edx, edx
je 0x14006ba9a
test eax, 0x80
je 0x14006ba9a
mov qword [rsi + 0x1a0], 0x400
mov qword [rsi + 0x1a8], 0x10000
jmp 0x14006bb0d
test byte [rsi + 0x244], 4
je 0x14006babc
test al, 0x40
je 0x14006babc
mov eax, 0x400
mov qword [rsi + 0x1a0], rax
mov qword [rsi + 0x1a8], rax
jmp 0x14006bb0d
test eax, 0x80
je 0x14006badb
mov qword [rsi + 0x1a0], 0x800
mov qword [rsi + 0x1a8], 0x1fe
jmp 0x14006bb0d
test edx, edx
je 0x14006baf7
mov qword [rsi + 0x1a0], 0x401
mov qword [rsi + 0x1a8], 0x400
jmp 0x14006bb0d
mov qword [rsi + 0x1a0], 0x85
mov qword [rsi + 0x1a8], 0x84
or ecx, 0xffffff80
mov byte [rsi + 0x247], cl
mov rax, qword [rbp + 8]
test rax, rax
je 0x14006bb2f
mov qword [rsi + 0xa0], rax
mov eax, dword [rbp + 0x10]
mov byte [rsi + 0x233], al
mov rax, qword [rbp + 0x78]
mov qword [rsi + 0x160], rax
mov rax, qword [rbp + 0xe0]
test rax, rax
je 0x14006bbc3
test byte [rsi + 0x246], 0x40
jne 0x14006bb77
mov edx, 0x2ee
mov eax, 0x2e
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp rax, 2
je 0x14006bbc3
cmp rax, 1
jne 0x14006bb8c
mov byte [rsi + 0x235], Ordinal_45
jmp 0x14006bbca
cmp rax, 3
jne 0x14006bb9b
mov byte [rsi + 0x235], reloc.LMGR10.dll_Ordinal_34
jmp 0x14006bbca
mov edx, 0x2ef
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov byte [rsi + 0x235], 0
mov rax, qword [rbp + 0xe8]
test rax, rax
je 0x14006bc44
test byte [rsi + 0x246], 0x40
jne 0x14006bc07
mov edx, 0x2f0
mov eax, 0x2e
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp rax, 2
je 0x14006bc44
cmp rax, 1
jne 0x14006bc1c
and byte [rsi + 0x24a], 0xfd
jmp 0x14006bc60
mov edx, 0x2f1
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rsi + 0x24a]
movzx eax, byte [rsi + 0x244]
and edx, 0xfffffffd
and eax, 2
or edx, eax
mov byte [rsi + 0x24a], dl
mov rax, qword [rbp + 0xf0]
test rax, rax
je 0x14006bcbd
cmp rax, 2
je 0x14006bca6
cmp rax, 1
je 0x14006bca6
cmp rax, 3
je 0x14006bca6
mov edx, 0x2ec
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [rsi + 0x247]
test al, 8
jne 0x14006b18b
test al, 0x10
jne 0x14006b18b
mov rax, qword [rbp + 0x120]
cmp rax, 5
ja case.default.0x14006bce0
movsxd rdx, eax
lea rax, [0x140000000]
mov rcx, qword [rax + rdx*8 + 0xb9760]
jmp rcx
and dword [rsp + 0x5a4], 0xfffffffd
xor r13d, r13d
movzx eax, byte [rsi + 0x24c]
and eax, 0xffffffe3
movzx edx, byte [rsi + 0x246]
or eax, 0x20
and edx, 0xfffffffe
mov byte [rsi + 0x246], dl
mov byte [rsi + 0x24c], al
jmp 0x14006be20
mov eax, dword [rsp + 0x5a4]
xor r13d, r13d
or eax, 2
and eax, 0xfffffffe
mov dword [rsp + 0x5a4], eax
movzx eax, byte [rsi + 0x24c]
and eax, 0xffffffcb
movzx edx, byte [rsi + 0x246]
or eax, 8
and edx, 0xfffffffe
mov byte [rsi + 0x246], dl
mov byte [rsi + 0x24c], al
jmp 0x14006be20
or dword [rsp + 0x5a4], 2
xor r13d, r13d
movzx eax, byte [rsi + 0x24c]
or eax, 4
movzx edx, byte [rsi + 0x246]
and eax, 0xffffffc7
or edx, 1
mov byte [rsi + 0x246], dl
mov byte [rsi + 0x24c], al
jmp 0x14006be20
mov rax, qword [rbp + 0xa8]
test rax, rax
jne 0x14006bd9c
test byte [rsi + 0x244], 4
je 0x14006bdc1
xor r13d, r13d
movzx edx, byte [rsi + 0x246]
movzx eax, byte [rsi + 0x24c]
or edx, 1
or eax, 4
mov byte [rsi + 0x246], dl
mov byte [rsi + 0x24c], al
jmp 0x14006be20
mov rax, qword [rbp + 0xa0]
test rax, rax
je 0x14006bdfd
and dword [rsp + 0x5a4], 0xfffffffc
xor r13d, r13d
movzx eax, byte [rsi + 0x24c]
and eax, 0xffffffd3
movzx edx, byte [rsi + 0x246]
or eax, 0x10
and edx, 0xfffffffe
mov byte [rsi + 0x246], dl
mov byte [rsi + 0x24c], al
jmp 0x14006be20
movzx eax, byte [rsi + 0x24c]
and eax, 0xffffffe3
movzx edx, byte [rsi + 0x246]
or eax, 0x20
and edx, 0xfffffffe
mov byte [rsi + 0x246], dl
mov byte [rsi + 0x24c], al
mov r8d, edx
and r8d, 0x40
mov rcx, qword [rbp + 0x160]
shr r8d, 6
test rcx, rcx
je 0x14006be64
test r8d, r8d
jne 0x14006be64
mov edx, 0x2f0
mov eax, 0x2e
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov byte [rsi + 0x23b], cl
mov rcx, qword [rbp + 0x168]
test rcx, rcx
je 0x14006bea3
test r8d, r8d
jne 0x14006bea3
mov edx, 0x2f0
mov eax, 0x2e
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov byte [rsi + 0x23d], cl
mov rcx, qword [rbp + 0x170]
test rcx, rcx
je 0x14006bee2
test r8d, r8d
jne 0x14006bee2
mov edx, 0x2f0
mov eax, 0x2e
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov byte [rsi + 0x23f], cl
mov rcx, qword [rbp + 0x178]
test rcx, rcx
je 0x14006bf21
test r8d, r8d
jne 0x14006bf24
mov edx, 0x2f0
mov eax, 0x2e
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r8d, r8d
mov byte [rsi + 0x241], cl
je 0x14006bf74
movzx eax, byte [rsi + 0x247]
test al, 2
jne 0x14006bf3b
test al, 1
je 0x14006bf4a
mov dword [rsi + 0x208], 3
jmp 0x14006c010
test al, 8
je 0x14006bf5d
mov dword [rsi + 0x208], 2
jmp 0x14006c010
test al, 0x10
je 0x14006c010
mov dword [rsi + 0x208], 8
jmp 0x14006c010
test edx, 0x80
jne 0x14006bf80
test al, 1
je 0x14006bfcf
movzx edx, byte [rsi + 0x247]
test dl, 2
jne 0x14006bf91
test dl, 1
je 0x14006bfad
test al, 1
je 0x14006bfa1
mov dword [rsi + 0x208], 7
jmp 0x14006c010
mov dword [rsi + 0x208], 0xb
jmp 0x14006c010
test dl, 8
je 0x14006bfbe
mov dword [rsi + 0x208], 6
jmp 0x14006c010
test dl, 0x10
je 0x14006c010
mov dword [rsi + 0x208], 9
jmp 0x14006c010
movzx edx, byte [rsi + 0x247]
test al, 2
je 0x14006c010
test dl, 2
jne 0x14006bfe4
test dl, 1
je 0x14006bff0
mov dword [rsi + 0x208], 5
jmp 0x14006c010
test dl, 8
je 0x14006c001
mov dword [rsi + 0x208], 4
jmp 0x14006c010
test dl, 0x10
je 0x14006c010
mov dword [rsi + 0x208], 0xa
mov rax, qword [rbp + 0x108]
test rax, rax
mov edx, dword [0x1400fc280]
je 0x14006c03f
test edx, edx
jne 0x14006c03f
mov eax, 0x232
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rbp + 0x128]
test rax, rax
je 0x14006e12a
test edx, edx
je 0x14006d1e7
mov edi, dword [rbp + 0x130]
mov rax, qword [rbp + 0x138]
cmp rax, 1
je 0x14006c0c9
test rax, rax
jne 0x14006c08a
test byte [rsi + 0x24d], 0x20
jne 0x14006c094
lea rcx, str.FORT_BUFFERED
call fcn.1400768b0
test eax, eax
je 0x14006c0c9
jmp 0x14006c094
cmp rax, 2
jne case.default.0x14006b3df
mov rcx, rsi
lea rdx, [rsp + 0x490]
call fcn.14004d550
mov edx, 1
cmp eax, 0xffffffff
mov eax, 0
cmove eax, edx
movzx ecx, byte [rsi + 0x24d]
shl eax, 6
and ecx, 0xffffffbf
or ecx, eax
mov byte [rsi + 0x24d], cl
mov rcx, rsi
lea rdx, [rsp + 0x490]
call fcn.14004d550
mov r12d, eax
cmp r12d, 0xffffffff
je 0x14006c14b
mov eax, dword [rsi + 0x208]
cmp eax, 3
jne 0x14006c0f9
mov dword [rsi + 0x208], 1
jmp 0x14006c0fe
cmp eax, 5
jne 0x14006c11b
test byte [rsi + 0x244], 4
je 0x14006c14b
or byte [rsi + 0x246], 2
mov dword [rsp + 0x5a8], 3
jmp 0x14006c14b
movzx edx, byte [rsi + 0x244]
test dl, 4
je 0x14006c14b
mov ecx, 0x229
mov eax, Ordinal_52
test dl, 0x20
cmovne eax, ecx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, dword [0x1400fc280]
test edx, edx
jne 0x14006c163
cmp r12d, 0xfffffffa
jne 0x14006c18b
mov r12d, 1
jmp 0x14006c19e
cmp r12d, 0xfffffffa
je 0x14006df6b
cmp r12d, 1
je 0x14006c19e
test edi, edi
jne 0x14006d1e7
mov rax, qword [rbp + 0x108]
test rax, rax
jne 0x14006c026
cmp r12d, 0xfffffffc
je 0x14006e07d
test r12d, r12d
jl 0x14006df59
cmp dword [rsi + 0x208], 1
jne 0x14006c1cd
test r12d, r12d
je 0x14006c1b8
cmp r12d, 2
je 0x14006c1b8
cmp r12d, 1
jne 0x14006c1cd
movzx eax, byte [rsi + 0x24c]
shl edx, 7
and eax, 0x7f
or eax, edx
mov byte [rsi + 0x24c], al
test ebx, ebx
je 0x14006c2b8
cmp dword [rbp + 0x148], 0
jne 0x14006c295
mov rax, qword [rbp + 0xd0]
test rax, rax
je 0x14006d547
mov eax, dword [rsi + 0x1b0]
lea rdi, [rsp + 0x490]
mov rdx, rdi
mov dword [rsp + 0x80], eax
mov qword [rsp + 0x78], 0
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14006c23b
mov rax, rdx
add rdx, rcx
call fcn.14009ef90
mov rcx, rdi
lea r10, [rsp + 0x5a8]
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x78]
lea r11, [rsp + 0x5ac]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r9
lea rdx, [rsp + 0x5a0]
lea r8, [rsp + 0x5a4]
lea r15, [rsp + 0x80]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], eax
call qword [rbp + 0xd0]
mov rdi, rax
mov qword [rsi + 0x178], rdi
jmp 0x14006c2bf
mov ecx, dword [rbp + 0x14c]
call fcn.140038f74
mov rdi, rax
mov qword [rsi + 0x178], rdi
mov eax, dword [rbp + 0x14c]
mov dword [rsi + 0x254], eax
jmp 0x14006c2bf
mov rdi, qword [rsi + 0x178]
cmp rdi, 0xffffffffffffffff
je 0x14006dc33
cmp dword [rbp + 0x148], 0
jne 0x14006c3da
mov dword [rsi + 0x254], 0xffffffff
cmp dword [0x1400f5968], 0
je 0x14006c3da
movzx r8d, byte [rsi + 0x247]
test r8d, 8
jne 0x14006c3da
test ebx, ebx
je 0x14006c379
xor edx, edx
test byte [rsi + 0x24c], 2
jne 0x14006c328
test r8d, 4
je 0x14006c32d
movzx eax, byte [rsi + 0x246]
test eax, 0x80
je 0x14006c32d
mov edx, 0x8000
mov eax, dword [rsp + 0x5a0]
test eax, 0xc0000000
je 0x14006c340
or edx, 2
jmp 0x14006c34d
mov ecx, edx
or ecx, 1
test eax, 0x40000000
cmovne edx, ecx
cmp qword [rbp + 0xf0], 1
je 0x14006c360
test r8d, 1
je 0x14006c363
or edx, 8
mov rcx, rdi
call fcn.1400392c0
mov dword [rsi + 0x254], eax
mov eax, dword [0x1400fc280]
jmp 0x14006c3e0
cmp dword [0x1400fc280], 0
jne 0x14006c3e4
cmp r12d, 1
je 0x14006c3c1
test r12d, r12d
jne 0x14006c3a2
call fcn.14002e91c
mov rcx, rax
call fcn.14002e214
mov dword [rsi + 0x254], eax
jmp 0x14006c40c
cmp r12d, 2
jne 0x14006c40c
call fcn.14002e91c
add rax, 0x60
mov rcx, rax
call fcn.14002e214
mov dword [rsi + 0x254], eax
jmp 0x14006c40c
call fcn.14002e91c
add rax, 0x30
mov rcx, rax
call fcn.14002e214
mov dword [rsi + 0x254], eax
jmp 0x14006c40c
mov eax, dword [0x1400fc280]
test eax, eax
je 0x14006c405
lea ecx, [r12 + 6]
cmp ecx, 0x40
jae 0x14006c405
mov eax, 1
shl rax, cl
test rax, 0x1c1
je 0x14006c405
mov eax, 2
jmp 0x14006c415
mov rdi, qword [rsi + 0x178]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileType]
movsx edx, byte [rsi + 0x232]
test edx, edx
jne 0x14006c540
cmp byte [rsi + 0x230], 1
je 0x14006d595
movzx edi, byte [rsi + 0x245]
and edi, 6
shr edi, 1
test edi, edi
je 0x14006c4d5
mov ecx, dword [rsi + 0x1b0]
add ecx, 2
cmp ecx, 0x40
jae 0x14006c4d5
mov edx, 1
shl rdx, cl
test rdx, 0x103
je 0x14006c4d5
cmp edi, 1
je 0x14006c4b9
cmp edi, 2
jne 0x14006c491
mov byte [rsi + 0x232], 2
mov edx, 2
movzx edi, byte [rsi + 0x244]
movzx ecx, byte [rsi + 0x246]
jmp 0x14006c54e
cmp edi, 3
jne case.default.0x14006b3df
mov byte [rsi + 0x232], 3
mov edx, 3
movzx edi, byte [rsi + 0x244]
movzx ecx, byte [rsi + 0x246]
jmp 0x14006c54e
mov byte [rsi + 0x232], 1
mov edx, 1
movzx edi, byte [rsi + 0x244]
movzx ecx, byte [rsi + 0x246]
jmp 0x14006c54e
movzx edi, byte [rsi + 0x244]
test edi, 4
movzx ecx, byte [rsi + 0x246]
je 0x14006c514
cmp dword [rsi + 0x208], 1
je 0x14006c506
test cl, 0x40
je 0x14006d5b9
cmp eax, 2
jne 0x14006d5b9
mov byte [rsi + 0x232], 1
mov edx, 1
jmp 0x14006c54e
test cl, 0x40
je 0x14006d5b9
cmp eax, 2
jne 0x14006d5b9
test edi, 1
je 0x14006d5b9
mov byte [rsi + 0x232], 1
mov edx, 1
jmp 0x14006c54e
movzx edi, byte [rsi + 0x244]
movzx ecx, byte [rsi + 0x246]
cmp edx, 3
je 0x14006c56c
cmp byte [rsi + 0x230], 1
je 0x14006c563
inc qword [rsi + 0x1a0]
cmp edx, 1
je 0x14006dc19
test edi, 1
je 0x14006c58d
test byte [rsi + 0x247], 8
je 0x14006c58d
cmp byte [rsi + 0x231], 2
jne 0x14006c58d
inc qword [rsi + 0x1a0]
test edi, 4
je 0x14006c5b2
and ecx, 0x40
shr ecx, 6
test byte [rsi + 0x247], 8
je 0x14006c5b8
test ecx, ecx
je 0x14006c5b8
add qword [rsi + 0x1a0], 2
jmp 0x14006c5b8
and ecx, 0x40
shr ecx, 6
cmp eax, 1
jne 0x14006c5c9
movzx eax, byte [rsi + 0x248]
or eax, 8
jmp 0x14006c5d3
movzx eax, byte [rsi + 0x248]
and eax, 0xfffffff7
mov byte [rsi + 0x248], al
test ecx, ecx
je 0x14006c6d6
mov rcx, rsi
call fcn.14007b820
test eax, eax
jne 0x14006ad01
mov rdx, qword [rsi + 0xf0]
test rdx, rdx
je 0x14006c6d6
movzx eax, byte [rdx + 0x32]
test eax, eax
je 0x14006c6d6
mov rdi, qword [rdx + 0x18]
movzx ecx, byte [rdi + 0x249]
test cl, 0x40
je 0x14006c62a
cmp byte [rdi + 0x232], 1
je 0x14006d5db
mov rcx, rdi
call fcn.140070310
mov rcx, qword [rsi + 0xf0]
test rcx, rcx
je 0x14006c642
mov byte [rcx + 0x32], 0
test eax, eax
je 0x14006c6c8
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x14006d613
test byte [rcx + 0x74], 2
je 0x14006c694
mov dword [rcx + 0x68], eax
mov rcx, qword [rdi + 0x30]
mov dword [rcx + 0x6c], eax
mov rcx, qword [rdi + 0xc0]
test rcx, rcx
je 0x14006c680
movzx r8d, byte [rdi + 0x248]
mov rcx, rdi
and r8d, 7
mov edx, 0xffffffff
mov r9d, eax
mov dword [rsp + 0x20], eax
call fcn.140065650
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
inc qword [rdi + 0x120]
and byte [rdi + 0x24b], 0xfb
movzx edx, byte [rsi + 0x247]
test dl, 8
je 0x14006c704
test byte [rsi + 0x248], 8
jne 0x14006c704
mov eax, Ordinal_52
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test ebx, ebx
je 0x14006ce31
cmp qword [rbp + 0xb0], 5
je 0x14006da9d
mov rax, qword [rbp + 0xf0]
test rax, rax
je 0x14006ce23
cmp rax, 2
je 0x14006ce23
cmp rax, 3
jne 0x14006c761
movzx edx, byte [rsi + 0x247]
and edx, 0xfffffffe
and byte [rsi + 0x24b], 0xfb
mov byte [rsi + 0x247], dl
mov qword [rsi + 0x120], 1
jmp 0x14006ce31
cmp rax, 1
jne 0x14006c77e
or byte [rsi + 0x24b], 4
movzx edx, byte [rsi + 0x247]
test dl, 1
je 0x14006ceae
test byte [rsi + 0x248], 8
je 0x14006ceda
xor edx, edx
mov r8d, 2
mov rcx, qword [rsi + 0x178]
call fcn.14006e790
cmp rax, 0xffffffffffffffff
je 0x14006d73f
cmp dword [rsi + 0x208], 7
jne 0x14006ce90
movabs rdx, 0xffffffffffffffff
mov r8d, 1
mov rcx, qword [rsi + 0x178]
call fcn.14006e790
cmp rax, 0xffffffffffffffff
je 0x14006d73f
and byte [rsi + 0x24b], 0xfb
movzx edx, byte [rsi + 0x247]
test dl, 1
mov qword [rsi + 0x120], 0xffffffff80000000
jne 0x14006ceda
test byte [rsi + 0x248], 8
je 0x14006ceda
test byte [rsi + 0x244], 4
je 0x14006cec5
test dl, 8
jne 0x14006ceda
test byte [rsi + 0x246], 0x40
jne 0x14006ced3
test dl, 4
jne 0x14006ceda
or byte [rsi + 0x249], 8
test edx, 0x80
jne 0x14006cef1
mov eax, dword [rsi + 0x1a0]
mov word [rsi + 0x22c], ax
jmp 0x14006cf21
cmp byte [rsi + 0x232], 1
je 0x14006dbcd
test byte [rsi + 0x244], 4
je 0x14006cf15
mov eax, reloc.LMGR10.dll_Ordinal_79
mov word [rsi + 0x22c], ax
jmp 0x14006cf21
mov eax, 0x50
mov word [rsi + 0x22c], ax
mov rdi, qword [rbp + 0x28]
test rdi, rdi
jle 0x14006db82
movzx edx, byte [rsi + 0x244]
and edx, 4
shr edx, 2
mov rax, qword [rbp + 0x20]
test edx, edx
je 0x14006cf52
mov eax, 0x234
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x23f
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x23e
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x23a
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x23c
mov eax, Ordinal_52
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rbp + 0xb0]
test rax, rax
jne 0x14006aa74
mov qword [rbp + 0xb0], 3
jmp 0x14006aa74
lea rdx, str.FORT_d
lea rcx, [rsp + 0x387]
mov r8d, r9d
call fcn.14002d710
lea rcx, [rsp + 0x387]
call fcn.14003fb28
mov r8, rax
mov qword [rsp + 0x598], r8
test r8, r8
jne 0x14006abfd
mov eax, dword [rsi + 0x1b0]
add eax, 4
cmp eax, 0xa
ja case.0x14006d31c.1
movsxd rax, eax
lea rdx, [0x140000000]
mov rcx, qword [rdx + rax*8 + 0xb95a0]
jmp rcx
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, str.CONOUT_
mov qword [rsi + 0x178], rax
mov qword [rsp + 0x598], r8
jmp 0x14006d385
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, str.CONOUT_
mov qword [rsi + 0x178], rax
mov qword [rsp + 0x598], r8
jmp 0x14006d385
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [0x1400b2c80]
mov qword [rsi + 0x178], rax
mov qword [rsp + 0x598], r8
xor r15d, r15d
test r8, r8
jne 0x14006abfd
test byte [rsi + 0x24d], 4
jne 0x14006d483
test byte [rsi + 0x245], 0x20
je 0x14006d40e
mov r8, qword [rsi + 0xb8]
mov rdx, r8
mov qword [rsp + 0x598], r8
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14006d3e1
mov rax, rdx
add rdx, rcx
call fcn.14009ef90
mov rcx, qword [rsp + 0x80]
xor edx, edx
test rcx, rcx
mov r10d, eax
cmovne rcx, rdx
mov dword [rsp + 0x594], r10d
movsx r9d, byte [r8]
mov qword [rsp + 0x80], rcx
jmp 0x14006ac37
lea rdx, str.fort._d
lea rcx, [rsp + 0x387]
mov r8d, dword [rsi + 0x1b0]
call fcn.14002d710
lea rdx, [rsp + 0x387]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14006d459
mov rax, rdx
add rdx, rcx
call fcn.14009ef90
mov r10d, eax
lea r8, [rsp + 0x387]
mov rcx, r8
mov rdx, r8
mov dword [rsp + 0x594], r10d
mov qword [rsp + 0x598], rdx
movsx r9d, byte [rcx]
jmp 0x14006ac37
xor r10d, r10d
lea r8, [rsp + 0x387]
mov byte [r8], r10b
mov qword [rsp + 0x598], r8
mov dword [rsp + 0x594], r10d
jmp 0x14006ac5e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r15d, r15d
lea r8, str.CONOUT_
mov qword [rsi + 0x178], rax
mov qword [rsp + 0x598], r8
jmp 0x14006abfd
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r15d, r15d
lea r8, str.CONOUT_
mov qword [rsi + 0x178], rax
mov qword [rsp + 0x598], r8
jmp 0x14006abfd
cmp dword [rsp + 0x78], 0
jne 0x14006adf9
mov qword [rsi + 0x178], 0
jmp 0x14006ae00
mov r14d, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movsx eax, byte [rsi + 0x230]
movsx ecx, byte [rsi + 0x231]
jmp 0x14006b6ce
mov rcx, rbp
call fcn.14002d8fc
cmp eax, r14d
je 0x14006d513
jmp 0x14006b690
mov eax, dword [rsp + 0x5a8]
lea rcx, [rsp + 0x490]
mov edi, dword [rsp + 0x5ac]
xor r9d, r9d
mov edx, dword [rsp + 0x5a0]
mov r8d, dword [rsp + 0x5a4]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov qword [rsi + 0x178], rdi
jmp 0x14006c2bf
movzx edi, byte [rsi + 0x244]
test edi, 4
movzx ecx, byte [rsi + 0x246]
je 0x14006d5ca
test byte [rsi + 0x247], 8
je 0x14006d5ca
test cl, 0x40
je 0x14006d5ca
mov byte [rsi + 0x232], 2
mov edx, 2
jmp 0x14006c54e
mov byte [rsi + 0x232], 3
mov edx, 3
jmp 0x14006c54e
mov rdx, qword [rdi + 0x68]
movsx eax, byte [rdx + 5]
cmp eax, 0x20
je 0x14006d606
cmp eax, 0x2b
jne 0x14006d5f8
mov byte [rdx + 5], 0
movzx ecx, byte [rdi + 0x249]
and ecx, 0xffffffbf
mov byte [rdi + 0x249], cl
jmp 0x14006c62a
mov byte [rdx + 5], 0x24
movzx ecx, byte [rdi + 0x249]
jmp 0x14006d5f8
mov ecx, 1
mov edx, eax
mov r8d, eax
mov r9, rdi
call fcn.140065e30
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x180], eax
mov eax, 0x78
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsi + 0x178]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14006daba
and byte [rsi + 0x249], 0xf7
jmp 0x14006c71a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x180], eax
mov eax, 0x26
and byte [rsi + 0x249], 0xf7
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edi, dword [0x1400e501c]
cmp edi, 0xfffffffe
je 0x14006dbb4
movzx ecx, byte [rsi + 0x244]
and ecx, 4
shr ecx, 2
cmp byte [rsi + 0x230], 1
je 0x14006dbfe
mov eax, 0x54
mov edx, 0x55
test ecx, ecx
cmovne edx, eax
mov word [rsi + 0x22c], dx
jmp 0x14006cf21
mov eax, 0x50
mov edx, 0x51
test ecx, ecx
cmovne edx, eax
mov word [rsi + 0x22c], dx
jmp 0x14006cf21
cmp byte [rsi + 0x230], 1
je 0x14006c56c
add qword [rsi + 0x1a0], 5
jmp 0x14006c56c
cmp dword [rbp + 0x148], 0
je 0x14006dd40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.14002e694
mov dword [rax], edi
cmp edi, 2
jge 0x14006dd0f
cmp edi, 0x7b
je 0x14006e746
cmp edi, 0xa1
je 0x14006e746
cmp edi, 0xce
je 0x14006e746
cmp edi, 0xb7
je 0x14006e6f6
cmp edi, 0x50
je 0x14006e6f6
cmp edi, 0x13
je 0x14006e71e
cmp edi, 5
je 0x14006e71e
cmp edi, 0x14
je 0x14006dcf6
cmp edi, 0xf
je 0x14006dcf6
cmp edi, 4
jne 0x14006dcd7
mov edx, 0x25b
mov eax, Ordinal_34
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [rsi + 0x180], edi
mov eax, Ordinal_34
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, Ordinal_45
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp edi, 3
jg 0x14006dc58
mov edx, 0x25a
mov eax, Ordinal_32
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test byte [rsi + 0x244], 1
je 0x14006dd56
test byte [rsi + 0x245], 0x40
je 0x14006dc40
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, byte [rsi + 0x244]
cmp eax, 0x13
je 0x14006dd76
cmp eax, 5
je 0x14006dd76
test dl, 4
je 0x14006de17
test dl, 1
jne 0x14006de17
test r14d, r14d
je 0x14006de17
test byte [rsi + 0x245], 0x40
jne 0x14006de17
test byte [rsi + 0x24a], 1
jne 0x14006de17
mov edx, dword [rsp + 0x5a0]
lea rcx, [rsp + 0x490]
and edx, 0x3fffffff
xor r9d, r9d
or edx, 0x80000000
mov eax, dword [rsp + 0x5a8]
mov edi, dword [rsp + 0x5ac]
mov r8d, dword [rsp + 0x5a4]
mov dword [rsp + 0x5a0], edx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov qword [rsi + 0x178], rdi
cmp rdi, 0xffffffffffffffff
je 0x14006dee4
or byte [rsi + 0x245], 0x40
or byte [rsi + 0x24b], 0x10
jmp 0x14006ded5
cmp eax, 0x20
jne 0x14006dece
test r13d, r13d
je 0x14006dece
test r14d, r14d
jne 0x14006de3b
test byte [rsi + 0x245], 0x40
je 0x14006dece
mov edx, dword [rsp + 0x5a0]
lea rcx, [rsp + 0x490]
and edx, 0x3fffffff
xor r9d, r9d
mov r8d, dword [rsp + 0x5a4]
or edx, 0x80000000
or r8d, 2
mov eax, dword [rsp + 0x5a8]
mov edi, dword [rsp + 0x5ac]
mov dword [rsp + 0x5a0], edx
mov dword [rsp + 0x5a4], r8d
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov qword [rsi + 0x178], rdi
cmp rdi, 0xffffffffffffffff
je 0x14006dc40
or byte [rsi + 0x245], 0x40
or byte [rsi + 0x24b], 0x10
or byte [rsi + 0x246], 1
or byte [rsi + 0x24c], 4
jmp 0x14006c2c9
mov rdi, qword [rsi + 0x178]
cmp rdi, 0xffffffffffffffff
je 0x14006dc40
jmp 0x14006c2c9
test byte [rsi + 0x244], 4
je 0x14006de04
mov edx, dword [rsp + 0x5a0]
lea rcx, [rsp + 0x490]
and edx, 0x7fffffff
xor r9d, r9d
or edx, 0x40000000
mov eax, dword [rsp + 0x5a8]
mov edi, dword [rsp + 0x5ac]
mov r8d, dword [rsp + 0x5a4]
mov dword [rsp + 0x5a0], edx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov qword [rsi + 0x178], rdi
or byte [rsi + 0x24a], 1
jmp 0x14006ded5
test edx, edx
je 0x14006c1cd
cmp r12d, 0xfffffffa
jne 0x14006c1cd
or byte [rsi + 0x24c], 0x80
xor ebx, ebx
mov rax, qword [rbp + 0x108]
test rax, rax
je 0x14006df95
mov rax, qword [rbp + 0x110]
test rax, rax
jne 0x14006df95
and byte [rsi + 0x24d], 0xfe
jmp 0x14006df9c
or byte [rsi + 0x24d], 1
mov eax, 0x100
test edi, edi
lea r8, [rsp + 0x68]
cmove edi, eax
xor edx, edx
movsxd rdi, edi
lea rcx, [rdi + 1]
call fcn.140071900
test eax, eax
jne 0x14006ad01
cmp dword [rbp + 0x130], 0
jne 0x14006dfe4
lea rdx, str.Unit__i
mov rcx, qword [rsp + 0x68]
mov r8d, dword [rsi + 0x1b0]
call fcn.14002d710
jmp 0x14006e001
mov r8, rdi
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rbp + 0x128]
call fcn.14002de50
mov rax, qword [rsp + 0x68]
mov byte [rdi + rax], 0
mov rcx, qword [rsp + 0x68]
call fcn.1400a7740
movsxd rax, eax
mov qword [rsi + 0x178], rax
cmp rax, 0xffffffffffffffff
je 0x14006e71e
test byte [rsi + 0x24d], 1
je 0x14006e057
mov ecx, eax
call fcn.1400a7740
mov ecx, dword [rsi + 0x178]
call fcn.1400a7740
test eax, eax
jne 0x14006e057
mov eax, 0x28e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x68]
call fcn.1400719c0
test eax, eax
je 0x14006c2b8
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movsx eax, word [rsi + 0x22e]
cmp eax, 4
jge 0x14006e0d4
mov rcx, qword [rsi + 0xb8]
call fcn.1400719c0
test eax, eax
je 0x14006e0ad
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 5
xor edx, edx
mov r8, r15
call fcn.140071900
test eax, eax
je 0x14006e0d4
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov byte [rsp + 0x494], 0
mov dword [rsp + 0x490], 0x314d4f43
mov rdx, qword [rsi + 0xb8]
lea rcx, [rsp + 0x490]
test cl, 3
je 0x14006e10e
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14006e113
inc rdx
test cl, 3
jne 0x14006e0fb
call fcn.14009efc0
mov eax, 4
mov word [rsi + 0x22e], ax
mov edx, dword [0x1400fc280]
jmp 0x14006df59
test edx, edx
jne 0x14006c05d
lea rdx, [0x1400b989c]
lea rcx, [rsp + 0x490]
call fcn.14002da1c
test eax, eax
jne 0x14006c05d
mov dword [rsp + 0x490], 0x4e4f43
mov rdx, qword [rsi + 0xb8]
lea rcx, [rsp + 0x490]
test cl, 3
je 0x14006e180
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14006e185
inc rdx
test cl, 3
jne 0x14006e16d
call fcn.14009efc0
mov eax, 3
mov word [rsi + 0x22e], ax
jmp 0x14006c05d
test byte [rsi + 0x244], 1
je 0x14006b86c
movzx eax, byte [rsi + 0x247]
and eax, 0xffffffdf
mov byte [rsi + 0x247], al
jmp 0x14006b87c
cmp byte [rsi + 0x232], 3
je 0x14006b7e7
mov eax, 0x2e
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx r8d, byte [rsi + 0x247]
test r8d, 0x10
je 0x14006b5ba
mov byte [rsi + 0x231], 3
mov ecx, 3
jmp 0x14006b5c6
test byte [rsi + 0x244], 4
je 0x14006e22b
test byte [rsi + 0x247], 8
je 0x14006e22b
test byte [rsi + 0x246], 0x40
je 0x14006e22b
mov byte [rsi + 0x232], 2
jmp 0x14006b4d4
movsx rdx, al
cmp edx, 4
je 0x14006e27a
cmp edx, 1
je 0x14006e27a
movzx r8d, byte [rsi + 0x246]
test r8d, 0x80
jne 0x14006e27a
movzx ecx, byte [rsi + 0x24c]
test cl, 1
jne 0x14006e27a
test cl, 2
jne 0x14006e27a
test r8d, 0x40
je 0x14006b4d4
cmp edx, 5
jl 0x14006b4d4
cmp edx, 8
jg 0x14006b4d4
mov byte [rsi + 0x232], 3
jmp 0x14006b4d4
test byte [rsi + 0x24d], 8
jne 0x14006e2a2
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x14006e3e2
jmp 0x14006e2b3
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x14006e5a9
mov rbx, qword [rsp + 0x90]
cmp ebx, 0xff
jle 0x14006e2dc
mov eax, reloc.LMGR10.dll_Ordinal_43
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movsxd r8, dword [rsp + 0x90]
lea rcx, [rsp + 0x286]
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x50], r8
call fcn.14009ef60
mov rax, qword [rsp + 0x50]
lea rdx, [rsp + 0x286]
mov byte [rsp + rax + 0x286], 0
jmp 0x14006e544
test ebx, ebx
jg 0x14006e324
xor eax, eax
mov dword [rsp + 0x58], eax
jmp 0x14006e33b
movsxd rbx, ebx
xor eax, eax
mov r8d, 1
cmp byte [rdx + rbx], 0x5c
cmovne eax, r8d
mov dword [rsp + 0x58], eax
cmp qword [rsp + 0x80], 3
je 0x14006e433
add eax, dword [rsp + 0x594]
add eax, ebx
cmp eax, 0x100
jle 0x14006e373
mov eax, reloc.LMGR10.dll_Ordinal_43
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movsxd rbx, ebx
lea rcx, [rsp + 0x490]
mov r8, rbx
mov qword [rsp + 0x50], rbx
call fcn.14009ef60
cmp dword [rsp + 0x58], 0
je 0x14006e39f
mov rax, qword [rsp + 0x50]
mov byte [rsp + rax + 0x490], 0x5c
mov ebx, dword [rsp + 0x58]
movsxd r8, dword [rsp + 0x594]
mov rdx, qword [rsp + 0x598]
lea rcx, [rsp + rbx + 0x490]
add rcx, qword [rsp + 0x50]
call fcn.14009ef60
movsxd rax, dword [rsp + 0x594]
add rax, rbx
add rax, qword [rsp + 0x50]
mov byte [rsp + rax + 0x490], 0
jmp 0x14006adcc
mov rcx, qword [rsp + 0x598]
mov edx, 0x101
lea r8, [rsp + 0x286]
lea r9, [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x14006e42a
mov eax, eax
cmp rax, 0x101
jae 0x14006e42a
mov dword [rsp + 0x594], eax
lea rdx, [rsp + 0x286]
mov qword [rsp + 0x598], rdx
xor ebx, ebx
xor edx, edx
jmp 0x14006e31c
test byte [rsi + 0x245], 0x20
jne 0x14006e34a
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x14006e4ad
mov rcx, rdx
lea r9, [rsp + 0x185]
lea rdx, [0x1400b9910]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test byte [rsi + 0x24d], 8
lea rcx, [rsp + 0x187]
lea rax, [rsp + 0x185]
cmove rcx, rax
lea rdx, [rsp + 0x490]
test cl, 3
je 0x14006e4a3
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14006e4a8
inc rdx
test cl, 3
jne 0x14006e490
call fcn.14009efc0
jmp 0x14006adcc
test byte [rsi + 0x24d], 8
je 0x14006e4d3
mov byte [rsp + 0x84], Ordinal_52
lea rdx, [rsp + 0x84]
mov byte [rsp + 0x85], 0
jmp 0x14006e44d
lea rcx, str.FORT_TMPDIR
call fcn.14003fb28
test rax, rax
je 0x14006e519
mov rcx, rax
lea rdx, [rsp + 0x84]
test cl, 3
je 0x14006e507
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14006e50c
inc rdx
test cl, 3
jne 0x14006e4f4
call fcn.14009efc0
lea rdx, [rsp + 0x84]
jmp 0x14006e44d
mov ecx, 0x100
lea rdx, [rsp + 0x84]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea rdx, [rsp + 0x84]
mov eax, 0
cmove rdx, rax
jmp 0x14006e44d
cmp byte [rsp + 0x286], 0x20
jne 0x14006e564
test ebx, ebx
jle 0x14006e55c
inc rdx
dec ebx
cmp byte [rdx], 0x20
je 0x14006e54e
movsxd rbx, ebx
mov qword [rsp + 0x50], rbx
xor r9d, r9d
xor r10d, r10d
test ebx, ebx
jle 0x14006e31c
mov rax, qword [rsp + 0x50]
mov r8, qword [rsp + 0x50]
lea r11, [rdx + rax]
movsx ecx, byte [r10 + r11 - 1]
cmp ecx, 0x20
je 0x14006e593
test ecx, ecx
jne 0x14006e318
lea ebx, [rax - 1]
sub ebx, r9d
inc r9
dec r10
cmp r9, r8
jb 0x14006e580
jmp 0x14006e318
cmp qword [rsp + 0x80], 3
je 0x14006e5c1
mov r8, qword [rsp + 0x598]
jmp 0x14006ada4
test byte [rsi + 0x245], 0x20
je 0x14006e3e2
mov r8, qword [rsp + 0x598]
jmp 0x14006ada4
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r15d, r15d
lea r8, [0x1400b2c80]
mov qword [rsi + 0x178], rax
mov qword [rsp + 0x598], r8
jmp 0x14006abfd
movzx eax, byte [rsi + 0x24d]
test al, 4
je 0x14006e61c
test byte [rsi + 0x244], 1
je 0x14006ab1f
lea rcx, str.FOR_READ
call fcn.14003fb28
mov r8, rax
mov qword [rsp + 0x598], r8
test r8, r8
jne 0x14006abfd
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r15d, r15d
lea r8, [0x1400b2c80]
mov qword [rsi + 0x178], rax
mov qword [rsp + 0x598], r8
jmp 0x14006abfd
test byte [rsi + 0x245], 0x20
jne 0x14006aad1
lea rdx, str.SCRATCH
lea rcx, [rsp + 0x387]
call fcn.14002d710
mov dword [rsp + 0x594], 7
lea r8, [rsp + 0x387]
mov qword [rsp + 0x598], r8
mov eax, 7
jmp 0x14006ad26
mov eax, 0x64
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, 0x63
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, 0x25
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x259
mov eax, 0xa
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x258
mov eax, 9
test byte [rsi + 0x244], 0x20
cmovne eax, edx
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, reloc.LMGR10.dll_Ordinal_43
add rsp, 0x5b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test byte [rsi + 0x244], 1
jne 0x14006ab99
jmp 0x14006ab3c
test byte [rsi + 0x244], 1
jne 0x14006abbb
jmp 0x14006ab3a