Function at 0x44dab0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
sub esp, 0x68
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x44dcf4
mov r8d, 0xffffffff
cmp rax, r8
cmovb r8, rax
cmovb eax, eax
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x34], 0
xor al, 0
add byte [rax], al
invalid
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x58], rax
lea rax, [0x0044dfd0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x40]
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x44db7c
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x44db20
mov edx, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3c]
mov rax, rdx
shl rax, 0x20
or rax, 2
xor r8d, r8d
rol byte [rbp - 0x6af0be2e], 0xc0
cmove rax, rcx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rax
je case.0x44d9af.52
lea rsi, [rsp + 0x48]
mov ecx, eax
and ecx, 3
lea rdx, [0x004a6284]
adc eax, 0x58711
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
loopne 0x44dba5
or rax, 2
mov qword [rsp + 0x40], 1
and al, 0x40
add dword [rax], eax
add byte [rax], al
invalid
lea rsi, [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov ecx, eax
and ecx, 3
lea rdx, [0x004a6284]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
movzx ecx, byte [rax + 0x10]
jmp case.0x44d975.72
add rsi, rcx
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
jmp 0x44dc1a
mov rcx, rax
shr rcx, 0x20
mov rdi, rax
call fcn.00454d80
mov ecx, eax
mov rax, rdi
jmp case.0x44d975.72
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x28
ja case.default.0x44dc03
add byte [rax], al
lea rdx, [0x004a6294]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
xor ecx, ecx
jmp case.0x44d975.72
movzx ecx, byte [rax + 0xf]
cmp cl, 0xb
jne 0x44dc1c
mov rcx, rsi
mov ecx, esi
call fcn.0040e290
invalid
xor eax, eax
ror byte [rax - 0x7d], 0xc4
add rsp, 0x68
push 0xffffffffb1c35e5f
pop rdi
pop rsi
ret
mov cl, 0x25
jmp case.0x44d975.72
and eax, 0x23b1e6eb
mov cl, 0x23
jmp case.0x44d975.72
mov cl, 0x24
jmp case.0x44d975.72
mov cl, 0x1b
jmp case.0x44d975.72
mov cl, 0x22
jmp case.0x44d975.72
mov cl, 0x10
jmp case.0x44d975.72
mov cl, 0xe
jmp case.0x44d975.72
mov cl, 0x21
jmp case.0x44d975.72
mov cl, 0xb
jmp case.0x44d975.72
mov cl, 4
jmp case.0x44d975.72
mov cl, 0x28
jmp case.0x44d975.72
mov cl, 0xc
jmp case.0x44d975.72
mov cl, 9
jmp case.0x44d975.72
mov cl, 0x19
jmp case.0x44d975.72
mov cl, 0x18
jmp case.0x44d975.72
mov cl, 2
jmp case.0x44d975.72
mov cl, 0xf
jmp case.0x44d975.72
mov cl, 3
jmp case.0x44d975.72
mov cl, 7
jmp case.0x44d975.72
mov cl, 1
jmp case.0x44d975.72
mov cl, 0x1f
jmp case.0x44d975.72
mov cl, 0x11
jmp case.0x44d975.72
mov cl, 0x29
jmp case.0x44d975.72
mov cl, 0x14
jmp case.0x44d975.72
invalid
mov dh, byte [rcx - 0x4e7914fb]
adc eax, 0xdb182eb
jmp case.0x44d975.72
mov cl, 0xd
mov cl, 5
jmp case.0x44d975.72
mov cl, 0x15
jmp case.0x44d975.72
mov cl, 0xd
jmp case.0x44d975.72
invalid
mov cl, 6
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x12
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0xa
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 8
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x1e
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x20
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x16
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x27
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x13
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x17
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x1c
jmp case.0x44d975.72
invalid
invalid
invalid
mov cl, 0x1d
jmp case.0x44d975.72
invalid
invalid
mov cl, 0x26
jmp case.0x44d975.72
mov cl, 0x1a
jmp case.0x44d975.72
lea r8, [0x004a6bf0]
mov rcx, rsi
call fcn.00492000
int3
mov eax, 1
jmp 0x44df8c
cmp r12, rbx
jne 0x44ddac
mov rcx, rdi
mov rdx, rsi
call fcn.00437310
test rax, rax
jne 0x44dd4f
test rdx, rdx
je 0x44df81
mov rbx, qword [rsi]
mov r12, qword [rsi + 0x10]
cmp r12, rbx
jne 0x44ddf0
mov r15, rbx
add r15, 0x20
jb 0x44df70
lea rax, [rbx + rbx]
cmp rax, r15
cmova r15, rax
test rbx, rbx
je 0x44de00
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbx
mov eax, 1
jmp 0x44de02
mov rax, qword [rsi + 8]
jmp 0x44de3e
xor eax, eax
mov rdx, r15
not rdx
shr rdx, 0x3f
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
mov r8, r15
lea r9, [rsp + 0x20]
call fcn.00418470
cmp qword [rsp + 0x50], 0
jne 0x44df9d
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rax
mov qword [rsi], r15
mov rbx, r15
add rax, r12
mov r15, rbx
sub r15, r12
cmp r15, rbp
cmovae r15, rbp
std
std
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], 0
xor byte [rax], al
add byte [rax], al
add byte [rcx + rcx*4 + 0x74], cl
and al, 0x38
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.0044a6b0
mov rdx, rax
test rax, rax
lea r14, [rsp + 0x50]
jne 0x44df30
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r14, rdx
invalid
sub r14, rcx
jb 0x44dfbe
invalid
mov rax, qword [rsp + 0x28]
and al, 0x28
cmp rdx, rax
ja 0x44dfac
test rcx, rcx
je 0x44df64
invalid
mov bl, 0
add byte [rax], al
add r12, rcx
cmp rdx, r15
mov rdx, 0xffffffffffffffff
cmovne rbp, rdx
lea rax, [rbp*2]
test rbp, rbp
cmovs rax, rdx
cmp r15, rbp
cmovb rax, rbp
mov qword [rsi + 0x10], r12
cmp rcx, r15
cmove rbp, rax
mov r15, qword [rsp + 0x48]
cmp rbx, r15
je 0x44dd87
jmp 0x44ddac
mov ecx, edx
and ecx, 3
mov eax, 1
movsxd rcx, dword [r13 + rcx*4]
add rcx, r13
jmp rcx
sub r12, qword [rsp + 0x40]
xor eax, eax
mov rdx, r12
jmp 0x44df8c
mov eax, 1
movabs rdx, 0x2600000003
jmp 0x44df8c
mov rdx, qword [rsi + 0x10]
sub rdx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rdx, 0x2600000003
jmp 0x44dd4f
lea r8, [0x004a9360]
mov rcx, rdx
mov rdx, rax
call fcn.00492090
lea r8, [0x004a9360]
call fcn.00492120
int3
cmp qword [rsp + 0x260], 0
je 0x450794
mov rcx, qword [rsp + 0x268]
test rcx, rcx
je 0x45076b
mov rdx, qword [rsp + 0x270]
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x2d8], 0
test byte [rax + rbx*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
mov word [rax + riz*8], fs
add al, byte [rax]
add byte [rax], al
test byte [rax + rbx*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
mov word [rax + riz*8], fs
add al, byte [rax]
add byte [rax], al
mov qword [rsp + 0x2e8], rdx
mov qword [rsp + 0x2f8], 0
mov qword [rsp + 0x300], rcx
mov qword [rsp + 0x308], rdx
mov ecx, 1
mov qword [rsp + 0x2e8], rdx
mov qword [rsp + 0x2f8], 0
mov qword [rsp + 0x300], rcx
mov qword [rsp + 0x308], rdx
mov ecx, 1
jmp 0x45076f
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x2d0], rcx
mov qword [rsp + 0x2f0], rcx
mov qword [rsp + 0x310], rax
lea rcx, [rsp + 0x2d0]
call fcn.0040d3c0
mov rax, qword [rsp + 0x1b8]
cmp dword [rax], 4
jb 0x4507aa
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x700]
add rsp, 0x718
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x4509bd
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.00404360
test sil, sil
je 0x450700
jmp 0x450794
mov eax, 2
xor esi, esi
xor r13d, r13d
mov qword [rsp + 0x1a8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x004d8150], cl
jne 0x451a39
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x100], rbx
mov rax, qword [0x004d8120]
dec r12
test rax, r12
mov dword [rsp + 0x10c], edi
je 0x45164a
call fcn.00444710
mov r13, r12
xor al, 1
jmp 0x45164f
call fcn.00414360
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x4517eb
mov r9, qword [rsp + 0xa0]
imul r8, r9, 0x38
mov rdx, qword [rax + r8 + 0x168]
cmp rdx, r12
je 0x4517eb
shl r9, 5
mov rcx, qword [rax + r8 + 0x170]
mov rbx, qword [rax + r8 + 0x188]
mov r10, qword [rax + r8 + 0x190]
mov qword [rsp + 0x100], r10
mov r10, qword [rax + r8 + 0x198]
mov qword [rsp + 0x1a8], r10
mov r10, qword [rax + r9]
mov qword [rsp + 0x68], r10
mov r10, qword [rax + r9 + 8]
mov qword [rsp + 0x80], r10
mov rsi, qword [rax + r9 + 0x10]
mov rax, qword [rax + r8 + 0x178]
add rax, rcx
xor r11d, r11d
mov r8, rcx
jmp 0x450f5d
xor r11d, r11d
test r9w, r9w
je 0x451284
mov r9w, 1
test r11w, r11w
jne 0x450f50
cmp r8, rax
je 0x451018
movzx r11d, byte [r8]
test r11b, r11b
js 0x450f85
inc r8
mov r10d, r11d
jmp 0x45100d
mov r10d, r11d
and r10d, 0x1f
movzx r13d, byte [r8 + 1]
and r13d, 0x3f
cmp r11b, 0xdf
jbe 0x450fd3
mov r12, rbp
movzx ebp, byte [r8 + 2]
shl r13d, 6
and ebp, 0x3f
or ebp, r13d
cmp r11b, 0xf0
jb 0x450fe0
movzx r11d, byte [r8 + 3]
add r8, 4
and r10d, 7
shl r10d, 0x12
shl ebp, 6
and r11d, 0x3f
or r11d, ebp
or r10d, r11d
jmp 0x450feb
add r8, 2
shl r10d, 6
or r10d, r13d
jmp 0x45100d
add r8, 3
shl r10d, 0xc
or r10d, ebp
cmp r10d, 0xffff
mov rbp, r12
jbe 0x45100d
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x450f53
xor r11d, r11d
mov r9d, r10d
jmp 0x450f53
test rdx, rdx
je 0x451028
mov r8d, 1
call fcn.00404360
mov rax, qword [rsp + 0x130]
sub rax, rdi
mov r8, qword [rsp + 0x1a8]
cmp rax, r8
cmp eax, eax
jae 0x451068
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.00418fc0
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov r8, qword [rsp + 0x1a8]
mov r13, r8
add r8, r8
lea rcx, [rdi*2]
add rcx, rbp
mov r12, qword [rsp + 0x100]
mov rdx, r12
call sub.ntdll.dll_memcpy
add rdi, r13
mov qword [rsp + 0x140], rdi
test rbx, rbx
je 0x4510ad
add rbx, rbx
mov r8d, 2
mov rcx, r12
mov rdx, rbx
call fcn.00404360
cmp rdi, qword [rsp + 0x130]
movabs r12, 0x8000000000000000
jne 0x4510e1
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.00418c10
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov word [rbp + rdi*2], 0x3d
inc rdi
mov qword [rsp + 0x140], rdi
mov rax, qword [rsp + 0x80]
add rsi, rax
xor r8d, r8d
mov rbx, qword [rsp + 0x68]
jmp 0x451114
xor r8d, r8d
test cx, cx
je 0x4515c9
mov cx, 1
test r8w, r8w
jne 0x451108
cmp rax, rsi
je 0x4511be
movzx r8d, byte [rax]
test r8b, r8b
js 0x451138
inc rax
mov edx, r8d
jmp 0x4511b4
mov edx, r8d
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp r8b, 0xdf
jbe 0x451182
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r8b, 0xf0
jb 0x45118e
movzx r8d, byte [rax + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
or edx, r8d
jmp 0x451198
add rax, 2
shl edx, 6
or edx, r10d
jmp 0x4511b4
add rax, 3
shl edx, 0xc
or edx, r9d
cmp edx, 0xffff
jbe 0x4511b4
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x45110b
xor r8d, r8d
mov ecx, edx
jmp 0x45110b
cmp rbx, r12
je 0x451f11
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rsi
mov word [rsp + 0x1f0], 0
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x1e0]
call fcn.004224d0
test rbx, rbx
je 0x451219
mov r8d, 1
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.00404360
mov rdi, qword [rsp + 0x140]
cmp rdi, qword [rsp + 0x130]
jne 0x451255
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.00418c10
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
and al, 0xd0
add al, byte [rax]
add byte [rax - 0x75], cl
mov esp, 0x14024
add bl, ch
invalid
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
and al, 0x90
add byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0xd0
add al, byte [rax]
add byte [rax - 0x75], cl
lodsb al, byte [rsi]
mov rbp, qword [rsp + 0x138]
mov word [rbp + rdi*2], 0
and al, 0x38
add dword [rax], eax
add byte [rsi - 0x39], ah
jge 0x451272
add byte [rax], al
inc rdi
mov qword [rsp + 0x140], rdi
jmp 0x450eba
test rdx, rdx
je 0x451294
mov r8d, 1
call fcn.00404360
mov rdx, qword [rsp + 0x68]
test rdx, rdx
mov rsi, qword [rsp + 0x100]
je 0x4512b9
mov r8d, 1
mov rcx, qword [rsp + 0x80]
call fcn.00404360
lea rdi, str.nul_byte_found_in_provided_data
test rbx, rbx
je 0x4515eb
add rbx, rbx
mov r8d, 2
mov rcx, rsi
jmp 0x4515e3
lea rdi, str.nul_byte_found_in_provided_data
test rbx, rbx
je 0x4515eb
mov r8d, 1
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.00404360
xor esi, esi
lea rcx, [rsp + 0x2d0]
call fcn.0040d3c0
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x45161d
mov rcx, qword [rsp + 0x138]
add rdx, rdx
mov r8d, 2
call fcn.00404360
mov rax, qword [rsp + 0x88]
mov qword [rax], rdi
mov qword [rax + 0x10], 2
jmp 0x451ebe
mov r13, r12
xor eax, eax
lea rcx, [0x004d8150]
movzx edx, byte [0x004d8151]
xor r8d, r8d
test dl, dl
setne r8b
mov qword [rsp + 0x1e8], rcx
mov byte [rsp + 0x1f0], al
mov qword [rsp + 0x1e0], r8
mov qword [rsp + 0x288], 0
mov qword [rsp + 0x298], 0
mov qword [rsp + 0x2a8], 0
cmp byte [rsp + 0x1b0], 0
lea rax, [rsp + 0x110]
mov rdx, qword [rsp + 0x1b8]
cmovne rax, rdx
mov dword [rsp + 0x110], 2
mov r8, qword [rsp + 0x78]
lea rcx, [r8 + 0x58]
cmp dword [r8 + 0x58], 6
cmove rcx, rax
cmp dword [r8 + 0x68], 6
lea rbx, [r8 + 0x68]
cmove rbx, rdx
lea rdi, [r8 + 0x78]
cmp dword [r8 + 0x78], 6
cmove rdi, rdx
lea r8, [rsp + 0x288]
mov edx, 0xfffffff6
call fcn.00452890
mov r12, rdx
test rax, rax
je 0x451726
mov rax, qword [rsp + 0x88]
mov qword [rax], r12
mov qword [rax + 0x10], 2
jmp 0x451dd6
lea r8, [rsp + 0x298]
mov rcx, rbx
mov edx, 0xfffffff5
call fcn.00452890
mov rbx, rdx
test rax, rax
je 0x451852
mov rax, qword [rsp + 0x88]
mov qword [rax], rbx
mov qword [rax + 0x10], 2
jmp 0x451db7
xor esi, esi
lea rcx, [rsp + 0x2d0]
call fcn.0040d3c0
cmp rdi, qword [rsp + 0x130]
jne 0x451826
xor esi, esi
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.00418c10
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov rax, rbp
mov qword [rsp + 0x80], rbp
mov word [rbp + rdi*2], 0
mov rbp, qword [rsp + 0x130]
cmp rbp, r12
jne 0x4518a8
mov rdi, qword [rsp + 0x80]
jmp 0x45161d
lea r8, [rsp + 0x2a8]
mov rcx, rdi
mov edx, 0xfffffff4
call fcn.00452890
test rax, rax
je 0x451a4a
mov rax, qword [rsp + 0x88]
mov qword [rax], rdx
mov qword [rax + 0x10], 2
jmp 0x451daf
mov rbx, qword [rsp + 0x138]
mov edi, dword [rsp + 0x10c]
mov rcx, qword [rsp + 0x78]
cmp qword [rcx + 0x38], r12
je 0x450ae8
mov rax, qword [rcx + 0x40]
mov rcx, qword [rcx + 0x48]
add rcx, rax
xor r10d, r10d
mov rdx, rax
jmp 0x4518e6
xor r10d, r10d
test r8w, r8w
je 0x45199a
mov r8w, 1
test r10w, r10w
jne 0x4518d9
cmp rdx, rcx
je 0x4519b9
movzx r10d, byte [rdx]
test r10b, r10b
js 0x45190e
inc rdx
mov r9d, r10d
jmp 0x45198f
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rdx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x451958
movzx r11d, byte [rdx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x451965
movzx r10d, byte [rdx + 3]
add rdx, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r9d, r10d
jmp 0x451970
add rdx, 2
shl r9d, 6
or r9d, esi
jmp 0x45198f
add rdx, 3
shl r9d, 0xc
or r9d, r11d
cmp r9d, 0xffff
jbe 0x45198f
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x4518dc
xor r10d, r10d
mov r8d, r9d
jmp 0x4518dc
lea rsi, str.nul_byte_found_in_provided_data
mov rax, qword [rsp + 0x88]
mov qword [rax], rsi
mov qword [rax + 0x10], 2
jmp 0x451ea5
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], rcx
mov word [rsp + 0x2e0], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
call fcn.00422650
mov r13, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
cmp rdx, r13
jne 0x451a1a
lea rcx, [rsp + 0x90]
call fcn.00418c10
mov r13, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov word [rsi + rdx*2], 0
mov rax, rsi
cmp r13, r12
jne 0x450af2
jmp 0x4519a1
lea rcx, [0x004d8150]
call fcn.00457df0
jmp 0x450b23
xorps xmm0, xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xe8], xmm0
test rdx, rdx
jne 0x451a8c
test rbx, rbx
jne 0x451a8c
test r12, r12
je 0x451aaf
mov dword [rsp + 0xcc], 0x100
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xf0], rdx
mov rax, qword [rsp + 0x78]
mov rdi, qword [rax + 0xb8]
test rdi, rdi
mov qword [rsp + 0x1b0], rdx
je 0x451ba4
add rax, 0xa8
mov dword [rsp + 0x90], 0x70
lea rcx, [rsp + 0x1c0]
mov rdx, rax
call fcn.00453540
mov rcx, qword [rsp + 0x1c0]
test rcx, rcx
je 0x451d87
mov r8d, dword [rsp + 0x10c]
or r8d, 0x80000
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x280], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movups xmm2, xmmword [rsp + 0xb0]
movups xmm3, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x2d0], xmm0
movaps xmmword [rsp + 0x2e0], xmm1
movaps xmmword [rsp + 0x2f0], xmm2
movaps xmmword [rsp + 0x300], xmm3
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x310], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x320], xmm0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x338], rcx
lea rax, [rsp + 0x2d0]
jmp 0x451bbf
mov dword [rsp + 0x90], 0x68
lea rax, [rsp + 0x90]
mov r8d, dword [rsp + 0x10c]
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x451d4e
movaps xmm0, xmmword [rsp + 0x130]
mov rax, qword [rsp + 0x88]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rsp + 0x288]
movups xmm1, xmmword [rsp + 0x298]
movups xmm2, xmmword [rsp + 0x2a8]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm1
movups xmmword [rax + 0x30], xmm2
test rdi, rdi
je 0x451c5e
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x280]
call fcn.0040f050
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
cmp dword [rsp + 0x110], 4
jb 0x451c92
mov rcx, qword [rsp + 0x118]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [rsp + 0x1e0]
call fcn.0040db00
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x451cbf
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1a8]
call fcn.00404360
test rbp, rbp
je 0x451cdd
add rbp, rbp
mov r8d, 2
mov rcx, qword [rsp + 0x100]
mov rdx, rbp
call fcn.00404360
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x451d00
mov rcx, qword [rsp + 0x188]
add rdx, rdx
mov r8d, 2
call fcn.00404360
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x451d1d
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x70]
call fcn.00404360
test r15, r15
setne al
mov ecx, dword [rsp + 0x1a4]
xor cl, 1
test al, cl
je 0x450794
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.00404360
jmp 0x450794
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
test rdi, rdi
je 0x451da2
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x280]
call fcn.0040f050
jmp 0x451da2
mov rax, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
cmp dword [rsp + 0x110], 4
jb 0x451dd6
mov rcx, qword [rsp + 0x118]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x288], 0
je 0x451dee
mov rcx, qword [rsp + 0x290]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x298], 0
je 0x451e06
mov rcx, qword [rsp + 0x2a0]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x2a8], 0
je 0x451e1e
mov rcx, qword [rsp + 0x2b0]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x1e0], 0
mov rsi, qword [rsp + 0x1e8]
movzx eax, byte [rsp + 0x1f0]
je 0x451e50
test al, al
jne 0x451e6d
mov rax, qword [0x004d8120]
test rax, r13
je 0x451e6d
call fcn.00444710
jmp 0x451e65
test al, al
jne 0x451e6d
mov rax, qword [0x004d8120]
test rax, r13
je 0x451e6d
call fcn.00444710
test al, al
jne 0x451e6d
mov byte [rsi + 1], 1
xor eax, eax
xchg byte [rsi], al
cmp al, 2
jne 0x451e7d
mov rcx, rsi
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rdx, qword [rsp + 0x68]
test rdx, rdx
mov rbx, qword [rsp + 0x100]
je 0x451ea5
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1a8]
call fcn.00404360
test rbp, rbp
je 0x451ebe
add rbp, rbp
mov r8d, 2
mov rcx, rbx
mov rdx, rbp
call fcn.00404360
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x451ee1
mov rcx, qword [rsp + 0x188]
add rdx, rdx
mov r8d, 2
call fcn.00404360
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x451efe
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x70]
call fcn.00404360
mov sil, 1
cmp byte [rsp + 0x60], 0
je 0x450794
jmp 0x4509a4
mov rdi, qword [rsp + 0x80]
jmp 0x4515eb