Function at 0x1400041fc
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x840]
sub rsp, 0x940
mov rax, qword [0x14003b0f8]
xor rax, rsp
mov qword [rbp + 0x830], rax
xor eax, eax
mov qword [rsp + 0x58], rdx
or edi, 0xffffffff
mov dword [rsp + 0x70], eax
xor r12d, r12d
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x80], rax
mov ebx, eax
mov dword [rsp + 0x60], eax
mov r14, rdx
mov dword [rsp + 0x78], eax
lea r15d, [rdi + 2]
mov dword [rsp + 0x64], eax
mov rsi, rcx
mov rax, qword [rdx + 0x40]
mov dword [rbp - 0x78], r15d
mov dword [rsp + 0x40], edi
mov dword [rbp - 0x70], r12d
mov dword [rsp + 0x54], r12d
test rax, rax
je 0x140021582
mov eax, dword [rax + 0x38]
shr eax, 1
lea rcx, [rbp - 0x50]
mov r13d, 0x104
mov dword [rbp - 0x74], r12d
and eax, 8
mov dword [rsp + 0x6c], r12d
mov r8d, r13d
mov dword [rsp + 0x74], eax
xor edx, edx
mov qword [rbp + 0x1b8], r12
mov byte [rbp + 0x1c0], r15b
mov qword [rbp + 0x1c8], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x818], r12
xor edx, edx
mov byte [rbp + 0x820], r15b
lea rcx, [rbp + 0x610]
mov qword [rbp + 0x828], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x5f8], r12
xor edx, edx
mov byte [rbp + 0x600], r15b
lea rcx, [rbp + 0x3f0]
mov qword [rbp + 0x608], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x3d8], r12
xor edx, edx
mov byte [rbp + 0x3e0], r15b
lea rcx, [rbp + 0x1d0]
mov qword [rbp + 0x3e8], r13
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x1c0]
lea rcx, [rbp - 0x50]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.14000c130
test eax, eax
js 0x140022134
mov al, byte [rbp + 0x820]
lea rcx, [rbp + 0x610]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.14000c130
test eax, eax
js 0x140022134
mov al, byte [rbp + 0x600]
lea rcx, [rbp + 0x3f0]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.14000c130
test eax, eax
js 0x140022134
mov al, byte [rbp + 0x3e0]
lea rcx, [rbp + 0x1d0]
neg al
sbb rdx, rdx
and edx, 0xfdc6
add rdx, 0x208
call fcn.14000c130
test eax, eax
js 0x140022134
lea rdx, [0x140032318]
lea rcx, [rbp + 0x3f0]
call fcn.14000abcc
xor r9d, r9d
lea r8, [rsp + 0x68]
mov ecx, 0xfe00
call fcn.14000538c
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
je 0x140022134
cmp dword [0x140043a40], r12d
jne 0x14002158a
mov rsi, qword [rsi + 0x40]
test rsi, rsi
je 0x140004915
mov rcx, qword [rsi]
mov rbx, qword [rsi + 0x30]
call fcn.140011130
xor r9d, r9d
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rcx
mov rdx, rax
lea rcx, [0x140017250]
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 0x21]
call fcn.140016f4c
test al, al
je 0x1400215b5
mov r15, qword [rbp - 0x60]
cmp dword [0x14003f8a4], r12d
jne 0x14002211a
mov rax, qword [rbp + 0x818]
lea rdx, [rbp + 0x610]
mov r8d, dword [rbp + 0x828]
test rax, rax
mov rcx, rsi
cmovne rdx, rax
call fcn.1400052a8
mov ebx, 1
cmp eax, ebx
je 0x1400220df
cmp dword [0x140043a44], r12d
jne 0x1400049b2
mov eax, dword [0x140043a3c]
cmp eax, 3
je 0x140021607
test byte [rsi + 0x38], 8
je 0x140004a98
mov rdx, qword [rsi + 8]
lea rcx, str._s_r_n
call fcn.14001277c
cmp dword [0x140043a3c], 3
je 0x140021632
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov r9d, dword [rbp + 0x1c8]
test rax, rax
mov rdx, r14
mov dword [rsp + 0x20], r12d
cmovne r8, rax
mov rcx, rsi
call fcn.140004c60
cmp eax, ebx
je 0x1400220df
cmp dword [0x140043a3c], 3
je 0x140021644
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
cmp word [rcx], r12w
je 0x1400048db
mov rcx, qword [rsi + 8]
xor edx, edx
call fcn.140006494
mov r12d, eax
cmp eax, 0xffffffff
je 0x14002167d
mov ecx, eax
call fcn.14000f7c8
xor ebx, ebx
test eax, eax
jne 0x1400216d3
cmp dword [0x140043a40], ebx
jne 0x140021700
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsi + 0x38]
mov r8d, 1
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x70], eax
test cl, 4
jne 0x1400049bd
mov dword [rsp + 0x54], ecx
mov rax, qword [rbp + 0x3d8]
lea rcx, [rbp + 0x1d0]
mov r8, qword [rsi + 8]
test rax, rax
mov edx, dword [rbp + 0x3e8]
cmovne rcx, rax
call fcn.14001222c
mov r14d, eax
lea rcx, [rbp - 0x50]
mov rax, qword [rbp + 0x1b8]
test rax, rax
cmovne rcx, rax
call fcn.140011130
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov dword [rsp + 0x28], edi
mov r8d, 0x200
mov rdx, r13
mov qword [rsp + 0x20], rsi
mov ecx, r12d
call fcn.1400051ec
xor r9d, r9d
mov r13d, eax
cmp dword [0x140043b28], r9d
jne 0x140021744
mov ebx, dword [0x140043a3c]
cmp ebx, 3
je 0x14002178a
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
lea rdx, [rbp + 0x1d0]
mov ecx, r14d
cmovne r8, rax
mov rax, qword [rbp + 0x3d8]
test rax, rax
cmovne rdx, rax
call fcn.140004b48
xor ecx, ecx
test eax, eax
jne 0x1400217a1
cmp dword [0x140043a44], ecx
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov dword [0x140043ac0], eax
jne 0x1400049e3
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov r9d, dword [rbp + 0x1c8]
test rax, rax
mov rdx, rbx
mov rcx, rsi
cmovne r8, rax
mov eax, 1
mov dword [rsp + 0x20], eax
call fcn.140004c60
cmp eax, 1
je 0x140022079
mov rcx, qword [rbp + 0x1b8]
lea rax, [rbp - 0x50]
xor r9d, r9d
test rcx, rcx
cmovne rax, rcx
cmp word [rax], r9w
je 0x140021772
mov rax, qword [rbp + 0x3d8]
lea r8, [rbp - 0x50]
test rcx, rcx
lea rdx, [rbp + 0x1d0]
cmovne r8, rcx
test rax, rax
mov ecx, r14d
cmovne rdx, rax
call fcn.140004b48
test eax, eax
jne 0x140021825
mov r14d, dword [rsp + 0x50]
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ecx, dword [rsp + 0x54]
xor r9d, r9d
mov ebx, dword [0x140043a3c]
mov edx, eax
test ecx, ecx
je 0x140004a22
mov r8, qword [rsp + 0x58]
mov r10d, 1
cmp dword [0x140043a44], r9d
jne 0x140004a77
test dl, 6
je 0x140004aa6
or edi, 0xffffffff
mov dword [0x140043b28], 5
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x78], r9d
mov dword [rsp + 0x64], r9d
mov edx, dword [rsp + 0x54]
mov eax, 1
cmp dword [rbp - 0x70], eax
je 0x140021943
mov ecx, dword [rsi + 0x38]
mov eax, ecx
test cl, 8
je 0x140004b09
mov r8d, eax
test al, 8
je 0x140004787
cmp ebx, 3
je 0x14002197b
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x44]
call fcn.1400051b0
cmp ebx, 3
mov ebx, 1
je 0x140021d1f
mov ecx, dword [rsi + 0x38]
test bl, cl
je 0x140021d1f
mov edx, 0x800
mov r14d, ecx
and r14d, edx
mov eax, r14d
neg eax
sbb ebx, ebx
and ebx, edx
cmp edi, 0xffffffff
jne 0x140004b17
bt ecx, 0xa
jb 0x14002199f
mov rax, qword [0x14003f8d0]
lea rdx, [rbp - 0x50]
xor r13d, r13d
test rax, rax
je 0x140021a0a
mov rcx, qword [rbp + 0x1b8]
test rcx, rcx
cmovne rdx, rcx
mov ecx, dword [rsp + 0x74]
or ecx, ebx
xor r9d, r9d
mov dword [rsp + 0x28], ecx
xor r8d, r8d
lea rcx, [0x14003f8a4]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi + 8]
call qword [0x140031e48]
test eax, eax
je 0x140021a2d
cmp dword [rsp + 0x64], r13d
jne 0x140022026
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000486e
mov rdx, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rdx, rdx
cmovne rcx, rdx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
cmp dword [0x140043a40], r13d
mov ebx, 1
jne 0x140021ad9
mov r13, qword [rsp + 0x48]
mov rax, qword [rsi + 0x30]
and dword [0x140043b18], 0
mov rcx, qword [rax + 0x14]
mov qword [rbp - 0x58], rcx
mov ecx, r12d
call fcn.14000c8e8
xor r12d, r12d
cmp dword [0x140043a3c], 3
je 0x140022053
cmp dword [0x14003f8a4], r12d
jne 0x140022030
mov r14, qword [rsp + 0x58]
lea r9, [rbp - 0x58]
mov rdx, r14
mov r8d, edi
mov rcx, rsi
call fcn.14000515c
mov dword [0x140043a44], r12d
mov rdx, qword [rsi + 0x30]
lea rcx, [0x140017250]
mov r9, r15
mov r8d, 0x21
call fcn.1400179bc
test al, al
jne 0x140004458
mov rcx, r15
call fcn.140012b04
mov rsi, qword [rsi + 0x40]
test rsi, rsi
jne 0x14000441c
mov ebx, dword [rsp + 0x60]
cmp dword [0x140043a3c], 3
je 0x140022169
mov rcx, qword [rbp + 0x3d8]
mov qword [rbp + 0x3d8], r12
test rcx, rcx
je 0x14000493b
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x5f8]
mov qword [rbp + 0x5f8], r12
test rcx, rcx
je 0x140004954
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x818]
mov qword [rbp + 0x818], r12
test rcx, rcx
je 0x14000496d
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x1b8]
mov qword [rbp + 0x1b8], r12
test rcx, rcx
je 0x140004986
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, ebx
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.1400182e0
mov rbx, qword [rsp + 0x990]
add rsp, 0x940
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x140043a3c]
jmp 0x1400044b2
and ecx, 0xfffffffb
mov eax, ecx
and al, 0x80
neg al
sbb edx, edx
neg edx
add edx, r8d
or edx, ecx
cmp byte [0x140043aa5], bl
mov dword [rsi + 0x38], edx
jne 0x140004589
jmp 0x140021714
cmp qword [rbx + 0x40], rcx
je 0x140004662
mov dword [0x140043b28], ecx
mov rcx, qword [rbx + 0x40]
mov dword [0x140043abc], eax
call fcn.140008468
mov ecx, dword [0x140043b28]
cmp ecx, 0x15
je 0x140022072
cmp ecx, 0x458
jne 0x140004662
jmp 0x140022072
cmp dword [rbp - 0x78], r9d
je 0x140021892
mov dword [rsp + 0x6c], r9d
mov r8d, r9d
cmp edx, 0xffffffff
je 0x140004a4a
test dl, 0x10
mov eax, 1
cmovne r8d, eax
mov dword [rsp + 0x6c], r8d
mov dword [rbp - 0x78], r9d
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffb
cmp byte [0x140043aa5], r9b
mov dword [rsi + 0x38], eax
je 0x14002189c
test r8d, r8d
mov r8, qword [rsp + 0x58]
je 0x140004720
jmp 0x1400218ef
mov rax, qword [r8 + 0x40]
test rax, rax
je 0x140004a8a
test byte [rax + 0x38], 8
jne 0x140004b2d
cmp ebx, 3
jne 0x140004733
jmp 0x14002190a
cmp eax, 3
jne 0x1400044d9
jmp 0x1400044bc
test dword [rsi + 0x38], 0x400
jne 0x140004ad5
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.140005508
mov ebx, dword [0x140043a3c]
mov edi, eax
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x64], r9d
cmp edi, 0xffffffff
je 0x14000474d
mov ebx, 1
mov ecx, edi
mov dword [rsp + 0x78], ebx
call fcn.14000f7c8
xor r9d, r9d
test eax, eax
jne 0x140021927
mov ebx, dword [0x140043a3c]
jmp 0x140004757
cmp ebx, 3
jne 0x140004777
jmp 0x140021965
mov ecx, edi
call fcn.14000c8e8
mov ecx, dword [rsi + 0x38]
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
jmp 0x1400047cc
cmp qword [rsi + 0x40], r9
cmove ebx, r10d
mov dword [0x140043a3c], ebx
jmp 0x140004a8a
mov eax, dword [rdx + 0x38]
jmp 0x14000427e
mov ecx, dword [rsp + 0x68]
lea r8, [rsp + 0x50]
mov r9d, r15d
call fcn.14000538c
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140022134
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x70], eax
jmp 0x14000440f
cmp dword [0x140043a3c], 3
jne 0x1400215cb
cmp dword [0x140043a44], r12d
je 0x140004904
mov rdx, qword [rsi]
lea rcx, [0x140032a60]
call fcn.14001277c
lea rcx, [0x1400328e8]
call fcn.14001277c
mov ecx, dword [0x140043b28]
call fcn.14002cc98
mov rcx, qword [rbp - 0x60]
call fcn.140012b04
mov edx, 1
xor ecx, ecx
call fcn.14002b5c0
int3
mov rax, qword [rbp + 0x5f8]
lea rcx, [rbp + 0x3f0]
mov rdx, qword [rsi + 8]
test rax, rax
cmovne rcx, rax
call fcn.14002c104
test eax, eax
jne 0x1400048db
jmp 0x1400049b2
cmp dword [0x140043a44], r12d
je 0x140004533
jmp 0x1400044d9
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov rdx, qword [rbp + 0x608]
lea rcx, [rbp + 0x3f0]
test rax, rax
cmovne r8, rax
mov rax, qword [rbp + 0x5f8]
test rax, rax
cmovne rcx, rax
call fcn.1400106e0
nop
jmp 0x140004517
mov ecx, dword [0x140043b28]
call fcn.14002cc98
xor r12d, r12d
cmp dword [0x140043a3c], 3
jne 0x1400216ca
cmp edi, 0xffffffff
jne 0x1400216ca
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
mov rdx, qword [rsi + 8]
test rax, rax
cmovne rcx, rax
call fcn.14002c104
test eax, eax
je 0x1400216ca
mov rcx, r15
call fcn.140012b04
mov edx, ebx
xor ecx, ecx
call fcn.14002b5c0
int3
mov dword [rsp + 0x60], ebx
jmp 0x1400048db
bts dword [rsi + 0x38], 7
mov r8d, 1
mov ecx, dword [rsi + 0x38]
mov dword [rsp + 0x50], 0x80
test r8b, cl
je 0x14000457c
and ecx, 0xfffffffe
or ecx, 4
mov dword [rsi + 0x38], ecx
jmp 0x14000457c
mov ecx, dword [rsp + 0x70]
mov eax, ecx
cmp dword [rsp + 0x68], ecx
cmovb eax, dword [rsp + 0x68]
jmp 0x14000456b
cmp dword [0x140043a44], ebx
je 0x140004589
test dl, 8
jne 0x140004589
cmp dword [0x140043a3c], 3
jne 0x140004589
and edx, 0xfffffffe
or edx, 2
mov dword [rsi + 0x38], edx
jmp 0x140004589
mov ecx, r12d
call fcn.14000c8e8
mov ecx, 0x6e
call fcn.14002cc98
cmp dword [0x140043a3c], 3
je 0x14002205d
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x60], 1
jmp 0x14002177d
mov ecx, r12d
call fcn.14000c8e8
mov r14, rbx
mov r13, qword [rsp + 0x48]
xor r12d, r12d
jmp 0x1400048db
cmp dword [0x140043a44], r9d
jne 0x14000460d
mov r14d, dword [rsp + 0x50]
jmp 0x140004757
test byte [rsi + 0x38], 0x80
jne 0x140004646
mov ecx, r12d
call fcn.14000c8e8
mov r13, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r14d, dword [rsp + 0x50]
mov r9, r13
mov qword [rsp + 0x28], r15
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.14002c2bc
xor r12d, r12d
cmp dword [0x140043a44], r12d
je 0x14002180b
cmp dword [0x140043a3c], 3
jne 0x140021804
mov eax, dword [rsi + 0x38]
mov ecx, dword [rsp + 0x54]
and eax, 0xfffffffe
test ecx, ecx
jne 0x1400217ff
or eax, 2
jmp 0x140021801
or eax, ecx
mov dword [rsi + 0x38], eax
mov dword [rbp - 0x70], 1
mov r8d, dword [rsi + 0x38]
lea rdx, [rsp + 0x44]
mov rcx, r13
call fcn.1400051b0
mov edi, dword [rsp + 0x40]
jmp 0x140022053
test byte [rsi + 0x38], 0x80
jne 0x1400046e7
mov ecx, r12d
call fcn.14000c8e8
cmp dword [0x140043a44], 0
je 0x140021868
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x140021868
test byte [rax + 0x38], 8
je 0x140021868
mov eax, dword [0x140043a3c]
mov ecx, 1
cmp qword [rsi + 0x40], 0
cmove eax, ecx
mov dword [0x140043a3c], eax
mov r14d, dword [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
call fcn.14002c2bc
mov edi, dword [rsp + 0x40]
jmp 0x1400046ec
mov r8d, dword [rsp + 0x6c]
jmp 0x140004a4e
test al, 8
je 0x140004a64
cmp ebx, 3
jne 0x140004a64
test r8d, r8d
mov dword [rbp - 0x74], ebx
mov r8, qword [rsp + 0x58]
jne 0x140004720
mov rcx, qword [r8 + 0x40]
test rcx, rcx
je 0x1400218e0
test byte [rcx + 0x38], 8
je 0x1400218e0
mov ecx, dword [rsp + 0x54]
lea r10d, [rbx - 2]
or eax, r10d
mov dword [rsi + 0x38], eax
jmp 0x140004726
mov ecx, dword [rsp + 0x54]
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x140004720
cmp dword [rbp - 0x74], 3
mov r10d, 1
jne 0x140004726
or eax, r10d
mov dword [rsi + 0x38], eax
jmp 0x140004726
test ecx, ecx
jne 0x14002191f
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffe
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x140004733
mov dword [rsi + 0x38], ecx
jmp 0x140004733
mov dword [rsp + 0x64], ebx
cmp dword [rsp + 0x54], r9d
jne 0x140004afe
and dword [rsi + 0x38], 0xfffffffe
or dword [rsi + 0x38], 2
jmp 0x140004afe
cmp ebx, 3
jne 0x140004769
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffe
test edx, edx
jne 0x14002195b
or eax, 2
jmp 0x14002195d
or eax, edx
mov dword [rsi + 0x38], eax
jmp 0x140004769
test edx, edx
jne 0x140004777
and eax, 0xfffffffe
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x140004777
cmp dword [rsp + 0x6c], r9d
jne 0x140004787
test edx, edx
jne 0x140004787
and r8d, 0xfffffffe
or r8d, 2
mov dword [rsi + 0x38], r8d
jmp 0x140004787
mov rcx, qword [rsi + 8]
call fcn.14002cdfc
xor r13d, r13d
test eax, eax
jne 0x1400219cd
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.14002cdfc
mov r9d, r13d
test eax, eax
je 0x1400219d3
mov r9d, 1
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov ecx, dword [rsp + 0x74]
lea r8, [0x14002b3e0]
test rax, rax
cmovne rdx, rax
mov rax, qword [0x14003f8d0]
or ecx, ebx
or ecx, 2
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r13
jmp 0x140004817
mov rax, qword [rbp + 0x1b8]
mov r8d, dword [rsp + 0x74]
test rax, rax
mov rcx, qword [rsi + 8]
cmovne rdx, rax
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_CopyFileW]
nop
jmp 0x140004821
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, 1
mov dword [0x140043b28], eax
cmp eax, ecx
jne 0x140021a5f
test r14d, r14d
je 0x140021a5f
mov rcx, qword [rsi + 0x30]
test dword [rcx], 0x400
mov ecx, 0x40002730
cmovne eax, ecx
mov dword [0x140043b28], eax
mov ecx, r12d
call fcn.14000c8e8
mov ecx, dword [0x140043b28]
mov r12d, dword [rsp + 0x64]
mov eax, r12d
neg eax
mov dword [0x140043b18], r13d
mov eax, 0x70
sbb ebx, ebx
and ebx, 0x1d
test ecx, ecx
cmove ecx, eax
cmp dword [0x14003f8a4], r13d
mov dword [0x140043b28], ecx
je 0x140021aa4
xor r12d, r12d
mov ebx, r12d
jmp 0x140021ab1
test r12d, r12d
jne 0x140021aae
call fcn.14002cc98
xor r12d, r12d
cmp dword [rsp + 0x78], r12d
jne 0x1400220c0
mov dword [rsp + 0x60], 1
jmp 0x140021aca
mov dword [rsp + 0x60], ebx
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x48]
jmp 0x1400048db
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
mov edx, ebx
cmovne rcx, rax
call fcn.140006494
or r14d, 0xffffffff
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, r14d
je 0x140021c8f
mov ecx, eax
call fcn.14000f7c8
mov ecx, edi
test eax, eax
jne 0x140021cd8
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
test eax, eax
je 0x140021cb8
mov ecx, edi
call fcn.14000c8e8
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
xor edx, edx
call fcn.140006494
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, r14d
je 0x140021c8f
mov ecx, eax
call fcn.14000f7c8
test eax, eax
jne 0x140021cb8
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov ecx, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea rdx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea rdx, [rbp - 0x6c]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
cmp ebx, eax
jne 0x140021cb3
mov eax, dword [rbp - 0x6c]
cmp dword [rbp - 0x68], eax
jne 0x140021cb3
mov r14d, dword [rsp + 0x50]
mov ebx, r13d
mov r13, qword [rsp + 0x48]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov r8d, r14d
mov rdx, r13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
mov ecx, edi
test eax, eax
je 0x140021c7b
cmp dword [rsp + 0x44], 0
je 0x140021c7b
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r8d, dword [rsp + 0x44]
lea r9, [rbp - 0x64]
mov rdx, qword [rbp - 0x80]
mov rcx, rax
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x140021cea
mov eax, dword [rsp + 0x44]
cmp dword [rbp - 0x64], eax
jne 0x140021cea
mov rdx, qword [rbp - 0x80]
cmp r14d, eax
mov ecx, 1
mov r8d, eax
cmovne ebx, ecx
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140021cea
test ebx, ebx
je 0x140021bec
mov ecx, edi
call fcn.14000c8e8
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
lea ebx, [rdi + 2]
jmp 0x140004885
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
mov edx, ebx
mov ecx, 0x4000271f
cmovne r8, rax
call fcn.140015118
nop
jmp 0x140004880
mov ebx, 1
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
mov edx, ebx
mov ecx, 0x4000271f
cmovne r8, rax
call fcn.140015118
mov ecx, edi
call fcn.14000c8e8
mov edi, r14d
mov dword [rsp + 0x40], r14d
jmp 0x140004880
mov ecx, edi
call fcn.14000c8e8
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
or edi, 0xffffffff
mov ecx, 0x4000271f
test rax, rax
mov dword [rsp + 0x40], edi
cmovne r8, rax
lea ebx, [rdi + 2]
mov edx, ebx
call fcn.140015118
nop
jmp 0x140004885
cmp edi, 0xffffffff
je 0x140021d82
mov ecx, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
cmp dword [0x140043a44], 0
jne 0x140021de4
cmp dword [0x140043a3c], 3
jne 0x140021de4
mov eax, dword [rsi + 0x38]
mov ecx, 0x4002
mov rbx, qword [rsp + 0x48]
and eax, ecx
cmp eax, ecx
jne 0x140021de9
mov eax, dword [rsp + 0x44]
lea rdx, [rbx + 2]
add eax, 0xfffffffe
mov rcx, rbx
mov r8d, eax
mov dword [rsp + 0x44], eax
call sub.msvcrt.dll_memmove
jmp 0x140021de9
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
mov edx, ebx
cmovne rcx, rax
call fcn.140006494
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, 0xffffffff
jne 0x140021d35
mov ecx, r12d
call fcn.14000c8e8
xor r12d, r12d
cmp dword [0x140043ab8], r12d
jne 0x140021dc5
mov ecx, dword [0x140043b28]
call fcn.14002cc98
cmp dword [0x140043a3c], 3
jne 0x140021ac6
mov rcx, r15
call fcn.140012b04
mov edx, ebx
xor ecx, ecx
call fcn.14002b5c0
int3
mov rbx, qword [rsp + 0x48]
mov edx, 0x4000
test dword [rsi + 0x38], edx
je 0x140021e09
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140021e06
or dword [rax + 0x38], edx
jmp 0x140021e09
or dword [rcx + 0x38], edx
mov eax, dword [0x140043b18]
test eax, eax
je 0x140021eb5
mov r8d, dword [rsp + 0x44]
xor r13d, r13d
test r8d, r8d
jle 0x140022026
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002c39c
cmp dword [0x140043a40], r13d
je 0x140022026
mov ecx, edi
call fcn.14000f7c8
test eax, eax
jne 0x140022026
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.14002b490
lea ebx, [r13 + 1]
cmp eax, ebx
jne 0x140021eac
mov rcx, r15
call fcn.140012b04
mov edx, ebx
xor ecx, ecx
call fcn.14002b5c0
int3
mov edi, dword [rsp + 0x40]
jmp 0x140004880
mov ecx, 1
cmp r13d, ecx
jne 0x140021f86
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
xor r13d, r13d
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002c39c
cmp dword [0x140043a40], r13d
je 0x140021f3d
mov ecx, edi
call fcn.14000f7c8
test eax, eax
jne 0x140021f3d
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.14002b490
lea edi, [r13 + 1]
cmp eax, edi
je 0x1400220cd
mov edi, dword [rsp + 0x40]
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
lea r9, [rsp + 0x44]
mov r8d, r14d
mov rdx, rbx
cmovne rcx, rax
mov qword [rsp + 0x30], rcx
mov ecx, r12d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call fcn.1400051ec
mov r13d, eax
mov eax, dword [0x140043b18]
test eax, eax
je 0x140021eb5
mov ecx, 1
test eax, eax
je 0x140022026
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jle 0x140022026
cmp r13d, ecx
jne 0x140022026
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002c39c
cmp dword [0x140043a40], 0
je 0x140022026
mov ecx, edi
call fcn.14000f7c8
test eax, eax
jne 0x140022026
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.14002b490
mov ebx, 1
cmp eax, ebx
jne 0x140021eac
mov rcx, r15
call fcn.140012b04
mov edx, ebx
xor ecx, ecx
call fcn.14002b5c0
int3
mov ebx, 1
jmp 0x140004880
mov ecx, edi
call fcn.14000c8e8
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov dword [rsp + 0x60], ebx
mov r14, qword [rsp + 0x58]
jmp 0x1400048d4
mov rcx, r15
call fcn.140012b04
mov edx, 1
xor ecx, ecx
call fcn.14002b5c0
int3
xor edx, edx
call fcn.140003aa8
mov ecx, r12d
call fcn.14000c8e8
mov rcx, r15
call fcn.140012b04
lea rcx, [rbp + 0x1d0]
call fcn.140017138
lea rcx, [rbp + 0x3f0]
call fcn.140017138
lea rcx, [rbp + 0x610]
call fcn.140017138
lea rcx, [rbp - 0x50]
call fcn.140017138
mov eax, 1
jmp 0x140004988
mov edx, 1
mov ecx, ebx
call fcn.14002b5c0
int3
mov rcx, r15
call fcn.140012b04
mov edx, edi
xor ecx, ecx
call fcn.14002b5c0
int3
mov rcx, r15
call fcn.140012b04
lea rcx, [rbp + 0x1d0]
call fcn.140017138
lea rcx, [rbp + 0x3f0]
call fcn.140017138
lea rcx, [rbp + 0x610]
call fcn.140017138
lea rcx, [rbp - 0x50]
call fcn.140017138
nop
jmp 0x140004986
mov rcx, r15
call fcn.140012b04
cmp edi, 0xffffffff
je 0x14002212e
mov ecx, edi
call fcn.14000c8e8
mov r15d, 1
lea rcx, [rbp + 0x1d0]
call fcn.140017138
lea rcx, [rbp + 0x3f0]
call fcn.140017138
lea rcx, [rbp + 0x610]
call fcn.140017138
lea rcx, [rbp - 0x50]
call fcn.140017138
mov eax, r15d
jmp 0x140004988
cmp edi, 0xffffffff
je 0x140004922
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call fcn.14000515c
nop
jmp 0x140004922