Function at 0x140061f90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x18]
sub rsp, 0x110
cmp byte [0x14021ac80], 0
je 0x140062555
mov qword [rax - 0x10], rbx
lea rcx, [0x14021a4d8]
mov qword [rax - 0x18], rsi
xor r9d, r9d
mov qword [rax - 0x38], r14
mov edx, 0xc0000000
xor r14d, r14d
mov qword [rax - 0x40], r15
mov qword [rsp + 0x30], r14
mov r15d, r14d
mov dword [rsp + 0x28], 0x80
mov ebx, r14d
mov qword [rax - 0x20], rdi
lea r8d, [r14 + 3]
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14006250b
mov edi, 0x400000
lea rdx, [0x14014fdc0]
mov ecx, edi
call fcn.14002e8b0
test rax, rax
je 0x14006250b
mov qword [rsp + 0xf0], r12
lea r9, [r14 - 1]
mov r15, rax
mov r12d, edi
xor eax, eax
mov dword [rbp + 0x28], edi
lea rdi, [0x14021a1d8]
mov qword [rsp + 0xe8], r13
mov ecx, 0x3e
mov qword [rsp + 0x60], r14
rep stosd dword [rdi], eax
lea edx, [rax + 0x40]
mov dword [0x14021a1d8], 3
lea rcx, [0x14021a1dc]
mov r13d, r14d
lea r8, str.Copyright_2000_2024__MetaQuotes_Ltd.
call fcn.14003c218
lea r9, [r14 - 1]
lea r8, str.cookies
lea edx, [r14 + 0x10]
lea rcx, [0x14021a25c]
call fcn.14003c218
mov eax, 0x40000000
mov r14d, r12d
mov edi, eax
and edi, eax
mov eax, 0xf8
cmp r12d, eax
mov dword [rbp + 0x38], edi
cmova r14d, eax
test r14d, r14d
je 0x14006244d
mov r8d, r14d
mov eax, r12d
test r15, r15
jne 0x1400620d5
call fcn.1400409f4
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x140062100
mov rcx, r15
cmp rax, r8
jb 0x1400620eb
lea rdx, [0x14021a1d8]
call fcn.14014cbf0
jmp 0x140062105
mov r8, rax
xor edx, edx
call fcn.14014d290
call fcn.1400409f4
mov dword [rax], 0x22
call fcn.140040884
cmp r14d, ebx
mov dl, 1
mov byte [rbp + 0x20], dl
cmova ebx, r14d
cmp r14d, 0xf8
jne 0x14006244f
cmp dword [0x14021ac70], r13d
je 0x140062434
mov rax, qword [0x14021ac68]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140062434
mov r10d, r13d
mov ecx, 0x8c8
mov qword [rsp + 0x48], r10
nop dword [rax]
cmp qword [rax + 0x8c0], 0
je 0x1400623dc
cmp word [rax], 0
je 0x1400623dc
cmp byte [rax + 0x80], 0
je 0x1400623dc
cmp byte [rax + 0xc0], 0
je 0x1400623dc
test r15, r15
je 0x1400623dc
test edi, edi
je 0x1400623dc
cmp r14d, ebx
ja 0x1400623dc
cmp r14d, r12d
ja 0x1400623dc
mov eax, r12d
sub eax, r14d
cmp eax, ecx
jae 0x140062363
cmp rsi, 0xffffffffffffffff
je 0x1400623d7
test edi, edi
je 0x140062251
cmp ebx, 1
jb 0x140062251
test dl, dl
je 0x140062251
xor r9d, r9d
mov qword [rsp + 0x70], r13
lea r8, [rsp + 0x74]
mov edx, r10d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x70], eax
cmp eax, 0xffffffff
jne 0x140062202
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14006232f
cmp qword [rsp + 0x70], 0xffffffffffffffff
je 0x14006232f
xor eax, eax
mov dword [rbp + 0x30], eax
test ebx, ebx
je 0x14006223b
lea r9, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140062238
mov dword [rbp + 0x30], eax
jmp 0x14006223b
mov eax, dword [rbp + 0x30]
lock add qword [0x1401f3d68], rax
cmp ebx, dword [rbp + 0x30]
jne 0x14006232f
xor al, al
mov byte [rbp + 0x20], al
mov eax, r14d
add r13, rax
mov r12, r13
and r12d, 0xfff
sub r13, r12
lea edi, [r12 + 0x400000]
cmp edi, dword [rbp + 0x28]
jbe 0x14006229e
mov ecx, edi
lea rdx, [0x14014fdc0]
call fcn.14002e8b0
mov rsi, rax
test rax, rax
je 0x140062325
mov rcx, r15
call fcn.14002e8a8
mov r15, rsi
mov dword [rbp + 0x28], edi
mov rsi, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x78], r13
lea r8, [rsp + 0x7c]
mov edx, r13d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x78], eax
cmp eax, 0xffffffff
jne 0x1400622ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14006232a
cmp qword [rsp + 0x78], 0xffffffffffffffff
je 0x14006232a
test r15, r15
je 0x140062338
xor eax, eax
mov ebx, eax
nop dword [rax + rax]
mov r8d, edi
mov edx, ebx
sub r8d, ebx
mov dword [rsp + 0x5c], eax
add rdx, r15
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140062319
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x140062319
add ebx, eax
mov eax, 0
cmp ebx, edi
jb 0x1400622e0
mov eax, ebx
lock add qword [0x1401f3d70], rax
jmp 0x14006233a
mov rsi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
movzx edx, byte [rbp + 0x20]
jmp 0x1400623d2
xor ebx, ebx
xor dl, dl
mov qword [rsp + 0x60], r13
mov byte [rbp + 0x20], dl
mov r14d, r12d
cmp r12d, ebx
ja 0x14006238e
cmp r12d, dword [rbp + 0x28]
ja 0x14006238e
mov r12d, dword [rbp + 0x28]
mov r10, r13
mov qword [rsp + 0x48], r13
mov ecx, 0x8c8
mov eax, r12d
sub eax, r14d
cmp eax, ecx
mov edi, eax
cmova edi, ecx
test edi, edi
je 0x1400623d7
mov ecx, r14d
mov r8d, edi
mov edx, eax
add rcx, r15
jne 0x140062398
call fcn.1400409f4
mov dword [rax], reloc.WS2_32.dll_shutdown
jmp 0x1400623be
mov r10d, r13d
mov qword [rsp + 0x48], r10
jmp 0x1400623d7
cmp rdx, r8
jb 0x1400623a9
mov rdx, qword [rsp + 0x40]
call fcn.14014cbf0
jmp 0x1400623c3
mov r8, rdx
xor edx, edx
call fcn.14014d290
call fcn.1400409f4
mov dword [rax], 0x22
call fcn.140040884
add r14d, edi
mov dl, 1
cmp r14d, ebx
mov byte [rbp + 0x20], dl
cmova ebx, r14d
mov r10, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rcx, qword [0x14021ac68]
test rcx, rcx
je 0x140062444
cmp rax, rcx
jb 0x140062444
mov eax, dword [0x14021ac70]
mov edx, dword [0x14021ac78]
dec eax
mov r9, qword [rsp + 0x40]
imul eax, edx
add rax, rcx
cmp r9, rax
jae 0x140062440
mov r12d, dword [rbp + 0x28]
mov eax, edx
movzx edx, byte [rbp + 0x20]
add rax, r9
mov edi, dword [rbp + 0x38]
mov ecx, 0x8c8
mov qword [rsp + 0x40], rax
jne 0x140062150
mov byte [0x14021ac80], 0
jmp 0x140062452
mov r10d, r13d
mov byte [0x14021ac80], 0
jmp 0x140062452
movzx edx, byte [rbp + 0x20]
mov byte [0x14021ac80], 0
jmp 0x140062452
xor dl, dl
mov r10d, r13d
mov r12, qword [rsp + 0xf0]
cmp rsi, 0xffffffffffffffff
je 0x1400624db
test r15, r15
je 0x1400624eb
cmp ebx, 1
jb 0x1400624db
test dl, dl
je 0x1400624db
xor r9d, r9d
mov qword [rsp + 0x50], r13
lea r8, [rsp + 0x54]
mov edx, r10d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], eax
cmp eax, 0xffffffff
jne 0x14006249e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400624db
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x1400624db
xor eax, eax
mov dword [rbp + 0x38], eax
test ebx, ebx
je 0x1400624d3
lea r9, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400624d0
mov dword [rbp + 0x38], eax
jmp 0x1400624d3
mov eax, dword [rbp + 0x38]
lock add qword [0x1401f3d68], rax
test r15, r15
je 0x1400624eb
mov rcx, r15
call fcn.14002e8a8
xor r15d, r15d
mov r13, qword [rsp + 0xe8]
cmp rsi, 0xffffffffffffffff
je 0x140062511
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, 0xffffffffffffffff
jmp 0x140062511
cmp rsi, 0xffffffffffffffff
jne 0x14006251e
test r15, r15
je 0x14006251e
mov rcx, r15
call fcn.14002e8a8
mov r15, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x108]
cmp rsi, 0xffffffffffffffff
je 0x14006254d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x100]
add rsp, 0x110
pop rbp
ret