Function at 0x1400613c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov ebx, dword [rcx + 0x168]
mov rsi, rcx
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
mov eax, ebx
and eax, 3
cmp eax, 3
je 0x140060df0
lea rdx, [0x140226cc8]
mov edx, dword [rdx + rax*4]
mov eax, edx
and eax, 0xfffffffd
or eax, 4
test bl, 8
cmovne edx, eax
mov eax, ebx
and eax, 0x10000000
cmp eax, 1
mov eax, ebx
sbb r8d, r8d
and eax, 0x700
and r8d, 7
cmp eax, 0x300
je 0x140061030
jle 0x140060e20
cmp eax, 0x600
je 0x140061020
jg 0x140060fd8
cmp eax, 0x400
je 0x140061040
mov dword [rsp + 0x48], 1
cmp eax, 0x500
jne 0x140060df0
nop word [rax + rax]
test bh, 1
je 0x140060e42
mov eax, edi
not eax
and eax, dword [rsi + 0x158]
and eax, 0x80
mov edi, eax
mov ecx, eax
mov r15d, eax
mov r14d, eax
neg edi
mov edi, eax
mov r13d, eax
sbb r12d, r12d
add r12d, 0x20000081
neg edi
mov edi, eax
sbb ebp, ebp
add ebp, 0x28000081
neg edi
sbb edi, edi
add edi, 0x30000081
neg ecx
mov ecx, eax
sbb r11d, r11d
add r11d, 0x10000081
neg ecx
mov ecx, eax
sbb r10d, r10d
add r10d, 0x8000081
neg ecx
sbb ecx, ecx
add ecx, 0x20000181
neg r15d
sbb r15d, r15d
add r15d, 0x28000181
neg r14d
sbb r14d, r14d
add r14d, 0x30000181
mov dword [rsp + 0x44], r14d
mov r14d, eax
neg r14d
mov r14d, eax
sbb r9d, r9d
add r9d, 0x10000181
neg r14d
sbb r14d, r14d
mov dword [rsp + 0x40], r9d
mov r9d, eax
add r14d, 0x8000181
neg r9d
sbb r9d, r9d
add r9d, 0x181
neg r13d
sbb r13d, r13d
add r13d, 0x24000181
mov dword [rsp + 0x5c], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x2c000181
mov dword [rsp + 0x58], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x34000181
mov dword [rsp + 0x54], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x14000181
mov dword [rsp + 0x50], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0xc000181
mov dword [rsp + 0x4c], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x4000181
neg eax
sbb eax, eax
add eax, 0x81
jmp 0x140060eb8
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 0x100
je 0x140060fc8
cmp eax, 0x200
je 0x140061020
test eax, eax
jne 0x140060df0
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x44], 0x30000180
mov r12d, 0x20000080
mov ebp, 0x28000080
mov edi, 0x30000080
mov dword [rsp + 0x40], 0x10000180
mov r11d, 0x10000080
mov r10d, 0x8000080
mov ecx, 0x20000180
mov dword [rsp + 0x5c], 0x24000180
mov r15d, 0x28000180
mov r14d, 0x8000180
mov r9d, 0x180
mov dword [rsp + 0x58], 0x2c000180
mov r13d, 0x4000180
mov eax, pe_nt_image_headers64
mov dword [rsp + 0x54], 0x34000180
mov dword [rsp + 0x50], 0x14000180
mov dword [rsp + 0x4c], 0xc000180
test bl, 0x40
je 0x140060ef2
mov edi, dword [rsp + 0x54]
mov r11d, dword [rsp + 0x50]
mov r9d, r13d
mov eax, r13d
mov r12d, dword [rsp + 0x5c]
mov ebp, dword [rsp + 0x58]
or edx, 0x10000
mov r10d, dword [rsp + 0x4c]
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], r11d
mov ecx, r12d
mov r15d, ebp
mov r14d, r10d
test bh, 0x10
jne 0x140060f0c
mov dword [rsp + 0x44], edi
mov ecx, r12d
mov r15d, ebp
mov r14d, r10d
mov dword [rsp + 0x40], r11d
mov r9d, eax
mov eax, ebx
and eax, 0x30
cmp eax, 0x10
je 0x140061000
cmp eax, 0x20
je 0x140060ff0
test eax, eax
jne 0x140060df0
test ebx, 0x2000000
je 0x140060f47
test dl, 4
je 0x140060f44
test dl, 2
je 0x140060df0
and edx, 0xfffffffb
mov r9d, ecx
mov eax, ebx
and eax, 0xc000000
lea ecx, [rax - 0x4000000]
and ecx, 0xf8000000
je 0x140061010
test eax, eax
jne 0x140060df0
mov eax, dword [rsp + 0x48]
or r9d, 0x2000000
mov rcx, qword [rsi + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r9d
xor r9d, r9d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140061050
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
test eax, eax
js 0x140061090
cdqe
mov qword [rsi + 0x88], rax
jmp 0x140060e05
mov dword [rsp + 0x48], 4
jmp 0x140060ca0
cmp eax, 0x700
jne 0x140060df0
mov dword [rsp + 0x48], 1
jmp 0x140060ca0
mov ecx, r15d
mov r9d, r14d
jmp 0x140060f2b
mov ecx, dword [rsp + 0x44]
mov r9d, dword [rsp + 0x40]
jmp 0x140060f2b
or r9d, 0x80000000
jmp 0x140060f68
mov dword [rsp + 0x48], 5
jmp 0x140060ca0
mov dword [rsp + 0x48], 2
jmp 0x140060ca0
mov dword [rsp + 0x48], 3
jmp 0x140060ca0
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x50
jne 0x140061070
and ebx, 0x500
cmp ebx, 0x100
je 0x1400610f7
call rdi
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x140060e05
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x18
jne 0x1400610d0
mov qword [rsi + 0x88], 0xfffffffffffff01e
mov dword [rsi + 0x14c], 4
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
je 0x140061111
call rbx
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x1400610b0
mov qword [rsi + 0x88], 0xfffffffffffff01c
mov dword [rsi + 0x14c], 0x50
jmp 0x140060e05
mov dword [rsi + 0x14c], 0xfffff002
mov ecx, 0xfffff002
call fcn.1400605e0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x1400610b0
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov r14, qword [rbx + 0x180]
cmp ecx, 0xffffffff
je 0x140061320
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140061390
cmp r14, 0xffffffffffffffff
jne 0x140061250
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
xor r14d, r14d
xor esi, esi
lea r13, [rsp + 0x44]
jmp 0x1400611f5
add r14, 1
cmp r14d, dword [rbx + 0x170]
jae 0x14006122e
mov rax, r14
mov r9, r13
mov rcx, rbp
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
call r12
add esi, dword [rsp + 0x44]
mov edi, eax
test eax, eax
jne 0x1400611e8
or edi, esi
je 0x140061340
mov eax, esi
mov qword [rbx + 0x88], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
pxor xmm0, xmm0
xor edx, edx
movaps xmmword [rsp + 0x50], xmm0
mov r9d, 1
xor r15d, r15d
xor esi, esi
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
lea r13, [rsp + 0x44]
movaps xmmword [rsp + 0x60], xmm0
call rax
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1400612b1
add r15, 1
cmp r15d, dword [rbx + 0x170]
jae 0x140061360
mov eax, esi
mov r9, r13
mov rcx, rbp
add rax, r14
mov qword [rsp + 0x60], rax
mov rax, r15
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call r12
add esi, dword [rsp + 0x44]
mov r10d, eax
test eax, eax
jne 0x1400612a0
test edi, edi
je 0x140061226
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r10d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbp
call rax
mov edi, dword [rsp + 0x30]
or edi, esi
jne 0x14006122e
jmp 0x140061340
mov qword [rbx + 0x88], 0xfffffffffffff00d
mov dword [rbx + 0x14c], 6
jmp 0x140061237
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x140061370
mov qword [rbx + 0x88], 0
jmp 0x140061237
test edi, edi
je 0x14006122e
jmp 0x1400612f6
mov dword [rbx + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061237
mov dword [rbx + 0x14c], 6
mov ecx, 6
call fcn.1400605e0
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061237
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov r14, qword [rbx + 0x180]
cmp ecx, 0xffffffff
je 0x140061550
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400615a8
cmp r14, 0xffffffffffffffff
jne 0x140061480
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
xor r14d, r14d
xor esi, esi
lea r13, [rsp + 0x44]
jmp 0x140061425
add r14, 1
cmp r14d, dword [rbx + 0x170]
jae 0x14006145e
mov rax, r14
mov r9, r13
mov rcx, rbp
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
call r12
add esi, dword [rsp + 0x44]
mov edi, eax
test eax, eax
jne 0x140061418
or edi, esi
je 0x140061570
mov eax, esi
mov qword [rbx + 0x88], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
pxor xmm0, xmm0
xor edx, edx
movaps xmmword [rsp + 0x50], xmm0
mov r9d, 1
xor r15d, r15d
xor esi, esi
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
lea r13, [rsp + 0x44]
movaps xmmword [rsp + 0x60], xmm0
call rax
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x1400614e1
add r15, 1
cmp r15d, dword [rbx + 0x170]
jae 0x140061598
mov eax, esi
mov r9, r13
mov rcx, rbp
add rax, r14
mov qword [rsp + 0x60], rax
mov rax, r15
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call r12
add esi, dword [rsp + 0x44]
mov r10d, eax
test eax, eax
jne 0x1400614d0
test edi, edi
je 0x140061456
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r10d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbp
call rax
mov edi, dword [rsp + 0x30]
or edi, esi
jne 0x14006145e
jmp 0x140061570
mov qword [rbx + 0x88], 0xfffffffffffff00d
mov dword [rbx + 0x14c], 6
jmp 0x140061467
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061467
test edi, edi
je 0x14006145e
jmp 0x140061526
mov dword [rbx + 0x14c], 6
mov ecx, 6
call fcn.1400605e0
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061467
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc0
xor r9d, r9d
mov r8d, 7
mov edx, 0x10180
mov rsi, rcx
mov rcx, qword [rcx + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400617a0
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1400617d0
mov eax, dword [rsp + 0x80]
test al, 0x10
je 0x1400616ca
test ah, 4
je 0x1400617e0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140060910
test eax, eax
js 0x1400617f8
mov eax, dword [rsp + 0x80]
mov rdi, qword [0x1402341d0]
mov r10, qword [rdi]
test al, 1
jne 0x140061728
lea r12, [rsp + 0x50]
lea rbp, [rsp + 0x40]
mov byte [rsp + 0x50], 1
mov r8, r12
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x20], 0xd
mov r9d, 1
call qword [rdi]
test eax, eax
js 0x140061775
mov qword [rsi + 0x40], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
and eax, 0xffffffde
pxor xmm0, xmm0
lea r12, [rsp + 0x50]
mov rcx, rbx
or eax, 0x20
lea rbp, [rsp + 0x40]
movaps xmmword [rsp + 0x50], xmm0
mov r8, r12
movaps xmmword [rsp + 0x60], xmm0
mov r9d, 0x28
mov rdx, rbp
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x70], eax
call r10
test eax, eax
jns 0x1400616e2
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rsi + 0x88], rax
jmp 0x14006170c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rsi + 0x88], rax
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140061780
mov dword [rsi + 0x14c], 5
mov ecx, 5
jmp 0x140061788
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x5b8
jne 0x140061811
mov ecx, 5
mov eax, 5
mov dword [rsi + 0x14c], eax
jmp 0x140061788
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14, rcx
mov rcx, qword [rcx + 0x150]
call sub.msvcrt.dll_wcslen
mov rdx, qword [r14 + 0x150]
cmp rax, 5
ja 0x1400618d8
mov qword [r14 + 0x88], 0xfffffffffffff019
mov dword [r14 + 0x14c], 0x57
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rdx + rax*2 - 0xc]
mov r8d, 6
lea rdx, str.XXXXXX
mov rcx, rdi
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x1400618ac
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140061b60
lea rax, [rsp + 0x48]
mov rbp, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov r13, qword [sym.imp.msvcrt.dll__wmkdir]
mov esi, 0x7fff
mov qword [rsp + 0x38], rax
mov r12, qword [sym.imp.msvcrt.dll__errno]
movabs rbx, 0x8421084210842109
jmp 0x140061a87
mov r15, qword [rsp + 0x48]
lea rcx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov rdx, r15
shr rdx, 1
mov rax, rdx
mul rbx
mov r9, rdx
shr rdx, 5
mov rax, rdx
shr r9, 4
mul rbx
mov r10, rdx
shr rdx, 5
mov rax, rdx
shr r10, 4
mul rbx
mov rax, r9
shl rax, 5
sub rax, r9
add rax, rax
mov r11, rdx
shr rdx, 5
sub r15, rax
mov rax, r10
shr r11, 4
shl rax, 5
sub rax, r10
add rax, rax
sub r9, rax
mov rax, r11
shl rax, 5
movzx r9d, word [rcx + r9*2]
sub rax, r11
add rax, rax
sub r10, rax
mov rax, rdx
mul rbx
movzx r10d, word [rcx + r10*2]
mov r8, rdx
shr r8, 4
mov rax, r8
shl rax, 5
sub rax, r8
add rax, rax
sub r11, rax
movzx eax, word [rcx + r11*2]
shl rax, 0x10
or rax, r10
shl rax, 0x10
or rax, r9
movzx r9d, word [rcx + r15*2]
shl rax, 0x10
shr rdx, 5
or rax, r9
mov qword [rdi], rax
mov rax, rdx
mul rbx
mov r9, rdx
shr rdx, 5
shr r9, 4
mov rax, r9
shl rax, 5
sub rax, r9
add rax, rax
sub r8, rax
mov rax, rdx
mul rbx
shr rdx, 4
mov rax, rdx
mov qword [rsp + 0x48], rdx
shl rax, 5
sub rax, rdx
add rax, rax
sub r9, rax
movzx eax, word [rcx + r9*2]
movzx ecx, word [rcx + r8*2]
shl eax, 0x10
or eax, ecx
mov rcx, qword [r14 + 0x150]
mov dword [rdi + 8], eax
call r13
test eax, eax
je 0x140061b09
call r12
cmp dword [rax], 0x11
jne 0x140061b48
sub esi, 1
je 0x140061acf
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov edx, 8
call rbp
test eax, eax
jne 0x140061950
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [r14 + 0x14c], ecx
call fcn.1400605e0
mov rcx, qword [rsp + 0x40]
xor edx, edx
cdqe
mov qword [r14 + 0x88], rax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400618c2
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [r14 + 0x88], 0xffffffffffffffff
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [r14 + 0x14c], ecx
call fcn.1400605e0
cdqe
mov qword [r14 + 0x88], rax
jmp 0x1400618c2
mov rbx, qword [r14 + 0x98]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov r8d, 6
lea rcx, [rbx + rax - 6]
call sub.msvcrt.dll_wcstombs
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov qword [r14 + 0x88], 0
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1400618c2
mov qword [r14 + 0x88], 0xffffffffffffffff
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
jmp 0x140061aa8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14 + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [r14 + 0x88], rax
jmp 0x1400618c2
push r15
mov eax, 0x20a8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400c95f0
sub rsp, rax
xor r9d, r9d
mov r8d, 7
mov edx, 0x100001
mov rdi, rcx
mov rcx, qword [rcx + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140061fb0
lea rax, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x80], rax
lea r12, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [0x140234190]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x20], r12
call qword [rax]
cmp eax, 0xc000000d
je 0x140061fd1
xor r14d, r14d
xor ebp, ebp
xor r13d, r13d
test eax, eax
js 0x140062065
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x20f0], rdi
mov qword [rsp + 0x88], r12
mov r13, qword [rsp + 0x80]
xor ebx, ebx
nop dword [rax + rax]
add r13, rbx
mov r9d, dword [r13 + 0x3c]
mov ebx, dword [r13]
shr r9d, 1
jmp 0x140061cb4
cmp word [r13 + r9*2 + 0x3e], 0
lea rax, [r9 - 1]
jne 0x140061db0
mov r9, rax
test r9, r9
jne 0x140061ca0
test rbx, rbx
jne 0x140061c90
mov rax, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], rax
mov rax, qword [0x140234190]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x2000
call qword [rax]
test eax, eax
jne 0x140061f3f
cmp qword [rsp + 0x98], 0
jne 0x140061c7e
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
mov eax, 0x80000005
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rdi + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rdi + 0x88], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140062057
nop dword [rax]
sub r14, 1
mov rcx, qword [r13 + r14*8]
call fcn.140082d20
test r14, r14
jne 0x140061d78
mov rcx, r13
call fcn.140082d20
nop
add rsp, 0x20a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r9, 1
je 0x140061ef8
cmp r9, 2
jne 0x140061dce
cmp dword [r13 + 0x40], 0x2e002e
je 0x140061cb9
lea r12, [r13 + 0x40]
mov dword [rsp + 0x64], r9d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov r8, r12
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rsi, rdi
test rdi, rdi
je 0x140061ff6
cmp r14, rbp
jb 0x140061f20
test rbp, rbp
je 0x140061f10
add rbp, rbp
lea rdx, [rbp*8]
mov rcx, qword [rsp + 0x68]
call fcn.140082d60
mov r15, rax
test rax, rax
je 0x140062045
lea rcx, [rdi + 8]
call fcn.140082d00
mov r11, rax
test rax, rax
je 0x14006200e
lea rax, [r14 + 1]
mov qword [r15 + r14*8], r11
xor edx, edx
mov r9d, dword [rsp + 0x64]
mov qword [rsp + 0x70], rax
lea rax, [r11 + 4]
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140062033
mov r11, qword [rsp + 0x68]
mov edx, 6
mov byte [r11 + rdi + 4], 0
mov eax, dword [r13 + 0x38]
test al, 0x40
je 0x140061ee8
mov dword [r11], edx
mov r14, qword [rsp + 0x70]
mov qword [rsp + 0x68], r15
test rbx, rbx
jne 0x140061c90
jmp 0x140061cbe
test ah, 4
je 0x140061f30
mov edx, 3
jmp 0x140061ec7
cmp word [r13 + 0x40], 0x2e
jne 0x140061dce
jmp 0x140061cb9
mov edx, 0x100
mov ebp, 0x20
jmp 0x140061e36
mov r15, qword [rsp + 0x68]
jmp 0x140061e4c
xor edx, edx
test al, 0x10
setne dl
add edx, 1
jmp 0x140061ec7
jns 0x140061c7e
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
cmp eax, 0x80000006
jne 0x140061d40
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x90], r13
test r13, r13
je 0x140061f7b
or dword [rdi + 0x148], 8
mov qword [rdi + 0x88], r14
cmp r14, 0xffffffffffffffff
jne 0x140062091
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rdi + 0x14c], ecx
call fcn.1400605e0
cdqe
mov qword [rdi + 0x88], rax
jmp 0x140062091
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x14c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rdi + 0x88], rax
jmp 0x140061d94
mov qword [rdi + 0x88], 0xfffffffffffff02c
mov rcx, qword [rsp + 0x78]
mov dword [rdi + 0x14c], 0x10b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140061d94
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140061d4b
mov rdi, qword [rsp + 0x20f0]
mov qword [rdi + 0x88], 0xfffffffffffff027
mov r13, r15
mov dword [rdi + 0x14c], 0xe
jmp 0x140061d61
mov rdi, qword [rsp + 0x20f0]
mov r14, qword [rsp + 0x70]
mov r13, r15
jmp 0x140062003
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
mov r15, r13
jmp 0x140062016
test r13, r13
je 0x140061d94
jmp 0x140061d8b
cmp eax, 0x80000006
jne 0x140061d40
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x90], 0
mov qword [rdi + 0x88], 0
mov dword [rdi + 0x170], 0
jmp 0x140061d94
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rbx, rcx
lea rcx, [rcx - 0x120]
cmp dword [rbx - 0xb0], 0x1e
ja case.0x1400620da.0
mov eax, dword [rbx - 0xb0]
lea rdx, [0x140226c4c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x30]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140062140
nop dword [rax + rax]
mov qword [rbx - 0x98], 0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062180
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne case.0x1400620da.26
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620da.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062180
cmp ecx, 2
jle case.0x1400620da.26
call qword [sym.imp.msvcrt.dll__close]
cmp eax, 0xffffffff
jne case.0x1400620da.26
nop dword [rax + rax]
mov qword [rbx - 0x98], 0xfffffffffffff00d
mov dword [rbx + 0x2c], 6
jmp case.0x1400620da.0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061630
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062140
xor r8d, r8d
lea rdx, [rbx - 0x90]
mov rcx, rax
call fcn.140060910
test eax, eax
jne 0x140062ff0
or dword [rbx + 0x28], 8
mov qword [rbx - 0x98], 0
mov rcx, rsi
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 0x48]
mov r12, qword [rbx + 0x30]
mov r13, qword [rbx + 0x40]
mov esi, dword [0x1402171f0]
mov rdi, qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
test al, 2
je 0x1400622a4
jmp 0x140063129
call rbp
cmp eax, 0x57
jne 0x14006327d
and esi, 2
je 0x140063295
mov eax, dword [rbx + 0x48]
mov r12, qword [rbx + 0x30]
mov dword [0x1402171f0], 0
mov r13, qword [rbx + 0x40]
mov esi, eax
and esi, 2
jne 0x140063129
and eax, 1
mov rdx, r12
mov rcx, r13
or esi, eax
mov r8d, esi
call rdi
test al, al
je 0x140062270
jmp case.0x1400620da.26
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wmkdir]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x1400620da.0
nop dword [rax]
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x2c], ecx
call fcn.1400605e0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620da.0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wrmdir]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x1400620da.0
jmp 0x1400622e0
xor r8d, r8d
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
jne case.0x1400620da.26
jmp 0x140062140
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061b90
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061880
mov r8d, dword [rbx + 0x48]
test r8b, 4
je 0x140063010
mov qword [rbx - 0x98], 0xfffffffffffff02a
mov dword [rbx + 0x2c], 0x32
jmp case.0x1400620da.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062180
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReOpenFile]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062140
mov rcx, rax
mov rax, qword [0x1402341a0]
lea rbp, [rsp + 0x80]
lea rdi, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r9d, 0x28
mov r8, rbp
mov rdx, rdi
call qword [rax]
test eax, eax
js 0x140063048
mov r12, qword [0x1402341d0]
mov eax, dword [rsp + 0xa0]
mov r10, qword [r12]
test al, 0x20
jne 0x14006329c
or eax, 0x20
mov r9d, 0x28
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0xa0], eax
mov rcx, rsi
mov dword [rsp + 0x20], 4
call r10
test eax, eax
js 0x140063048
mov eax, dword [rsp + 0xa0]
mov r13d, 1
mov edx, eax
or eax, 1
mov r9d, 0x28
mov r8, rbp
and edx, 0xfffffffe
test byte [rbx + 0x38], 0x80
mov rcx, rsi
mov dword [rsp + 0x20], 4
cmovne eax, edx
mov rdx, rdi
mov dword [rsp + 0xa0], eax
call qword [r12]
test eax, eax
js 0x140063048
test r13d, r13d
je 0x1400624dd
mov eax, dword [rsp + 0xa0]
mov edx, pe_nt_image_headers64
mov r8, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov r9d, 0x28
and eax, 0xffffffdf
cmove eax, edx
mov rdx, rdi
mov dword [rsp + 0xa0], eax
call qword [r12]
test eax, eax
js 0x140063048
mov qword [rbx - 0xe0], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x1400620da.0
mov edx, dword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wchmod]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x1400620da.0
jmp 0x1400622e0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140062140
test byte [rbx + 0x38], 2
je case.0x1400620da.26
and eax, 0x11
cmp eax, 1
jne case.0x1400620da.26
mov dword [rbx + 0x2c], 0xfffff030
mov ecx, 0xfffff030
call fcn.1400605e0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620da.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062180
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140063079
movsd xmm2, qword [0x140226d18]
movsd xmm3, qword [rbx + 0x38]
movsd xmm0, qword [0x140226d20]
movsd xmm1, qword [rbx + 0x40]
mulsd xmm3, xmm2
comisd xmm3, xmm0
cvttsd2si rax, xmm3
jb 0x1400625c6
subsd xmm3, xmm0
cvttsd2si rax, xmm3
btc rax, 0x3f
mulsd xmm1, xmm2
movabs rdx, 0x19db1ded53e8000
add rax, rdx
mov qword [rsp + 0x60], rax
comisd xmm1, xmm0
cvttsd2si rax, xmm1
jb 0x1400625f5
subsd xmm1, xmm0
cvttsd2si rax, xmm1
btc rax, 0x3f
movabs rdx, 0x19db1ded53e8000
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x60]
add rax, rdx
xor edx, edx
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne case.0x1400620da.26
jmp 0x140062140
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, 0x100
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062140
movsd xmm2, qword [0x140226d18]
movsd xmm3, qword [rbx + 0x38]
movsd xmm0, qword [0x140226d20]
movsd xmm1, qword [rbx + 0x40]
mulsd xmm3, xmm2
comisd xmm3, xmm0
cvttsd2si rax, xmm3
jb 0x1400626a5
subsd xmm3, xmm0
cvttsd2si rax, xmm3
btc rax, 0x3f
mulsd xmm1, xmm2
movabs rdx, 0x19db1ded53e8000
add rax, rdx
mov qword [rsp + 0x60], rax
comisd xmm1, xmm0
cvttsd2si rax, xmm1
jb 0x1400626d4
subsd xmm1, xmm0
cvttsd2si rax, xmm1
btc rax, 0x3f
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x60]
mov rcx, rsi
movabs rdx, 0x19db1ded53e8000
add rax, rdx
xor edx, edx
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x140062ff0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx - 0x98], 0
jmp case.0x1400620da.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062180
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 8
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov rcx, rax
mov rax, qword [rbx + 0x60]
mov dword [rsp + 0x20], 0x14
mov qword [rsp + 0x60], rax
mov rax, qword [0x1402341d0]
call qword [rax]
mov ecx, eax
xor eax, eax
test ecx, ecx
jns 0x140062152
mov rax, qword [0x1402341f0]
call qword [rax]
jmp 0x140062146
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062180
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140063079
mov rcx, rax
lea rbp, [rsp + 0x50]
lea rsi, [rbx - 0x80]
mov rax, qword [0x1402341a0]
mov rdx, rbp
mov dword [rsp + 0x20], 0x12
mov r9d, 0x68
lea r8, [rsp + 0x80]
call qword [rax]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400637bb
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x1400632d0
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400637bb
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x14006326b
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x48], r8
movabs r8, 0xd6bf94d5e57a42bd
cmove rax, rcx
pxor xmm0, xmm0
movabs rcx, 0xfe624e212ac18000
mov qword [rbx - 0x40], 0x1000
add r9, rcx
mov qword [rbx - 0x30], 0
mov qword [rbx - 0x78], rax
mov rax, r9
mul r8
mov qword [rbx - 0x58], 0
mov qword [rbx - 0x28], 0
mov qword [rbx - 0x90], rsi
shr rdx, 0x17
movups xmmword [rbx - 0x68], xmm0
mov dword [rbx - 0x20], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
mov qword [rbx - 0x98], 0
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0x1c], r9d
mov r9, qword [rsp + 0x98]
add r9, rcx
mov rax, r9
mul r8
shr rdx, 0x17
mov dword [rbx - 0x10], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0xc], r9d
mov r9, qword [rsp + 0x90]
add r9, rcx
add rcx, qword [rsp + 0x80]
mov rax, r9
mul r8
mov rax, rcx
shr rdx, 0x17
mov dword [rbx - 0x18], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
mul r8
mov rax, qword [rsp + 0xc0]
imul r9d, r9d, 0x64
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rdx, 0x17
mov dword [rbx - 8], edx
movsxd rdx, edx
shr rax, 9
imul rdx, rdx, 0x989680
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov dword [rbx - 0x14], r9d
mov qword [rbx - 0x70], rax
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [rbx - 4], ecx
jmp case.0x1400620da.0
mov rsi, qword [rbx + 0x30]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x1400629c8
cmp word [rsi + rax*2 - 4], 0x3a
lea rdx, [rax + rax]
je 0x1400629c8
lea rdx, [rsi + rdx - 2]
movzx eax, word [rdx]
cmp ax, 0x5c
je 0x1400632ba
cmp ax, 0x2f
je 0x1400632ba
nop word [rax + rax]
mov rcx, qword [rbx + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov r8d, 7
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062140
mov r14, qword [0x1402341a0]
lea r12, [rsp + 0x50]
lea rbp, [rsp + 0x80]
mov dword [rsp + 0x20], 0x12
mov rdx, r12
mov r9d, 0x68
mov r8, rbp
mov rcx, rax
call qword [r14]
lea rdi, [rbx - 0x80]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400630bd
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x140063072
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x1400630bd
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
mov qword [rbx - 0x78], 0
test dh, 4
jne 0x140063098
test dl, 0x10
je 0x1400632a4
mov qword [rbx - 0x48], 0
mov eax, 0x4000
mov rcx, rax
or rax, 0x1b6
or rcx, 0x124
and edx, 1
cmovne rax, rcx
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x78], rax
pxor xmm0, xmm0
movabs r8, 0xfe624e212ac18000
movabs rcx, 0xd6bf94d5e57a42bd
mov qword [rbx - 0x40], 0x1000
add r9, r8
mov qword [rbx - 0x30], 0
mov rax, r9
mov qword [rbx - 0x58], 0
mul rcx
mov qword [rbx - 0x28], 0
mov qword [rbx - 0x90], rdi
movups xmmword [rbx - 0x68], xmm0
shr rdx, 0x17
mov dword [rbx - 0x20], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0x1c], r9d
mov r9, qword [rsp + 0x98]
add r9, r8
mov rax, r9
mul rcx
shr rdx, 0x17
mov dword [rbx - 0x10], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0xc], r9d
mov r9, qword [rsp + 0x90]
add r9, r8
add r8, qword [rsp + 0x80]
mov rax, r9
mul rcx
mov rax, r8
shr rdx, 0x17
mov dword [rbx - 0x18], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
mul rcx
mov rax, qword [rsp + 0xc0]
imul r9d, r9d, 0x64
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rdx, 0x17
mov dword [rbx - 8], edx
movsxd rdx, edx
shr rax, 9
imul rdx, rdx, 0x989680
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov dword [rbx - 0x14], r9d
mov qword [rbx - 0x70], rax
sub r8, rdx
imul r8d, r8d, 0x64
mov dword [rbx - 4], r8d
jmp 0x140062216
mov r14d, dword [rbx + 0x68]
mov esi, 0x10000
mov eax, dword [rbx + 0x4c]
mov r12d, dword [rbx + 0x30]
mov rbp, qword [rbx + 0x60]
cmp r14, rsi
mov dword [rsp + 0x4c], eax
cmovbe rsi, r14
mov rcx, rsi
call fcn.140082d00
mov rdi, rax
test rax, rax
je 0x14006381e
cmp rbp, 0xffffffffffffffff
je 0x140062f68
xor r8d, r8d
mov rdx, rbp
mov ecx, r12d
call sub.msvcrt.dll__lseeki64
cmp rax, 0xffffffffffffffff
jne 0x140062f68
mov rcx, rdi
call fcn.140082d20
mov qword [rbx - 0x98], 0xffffffffffffffff
jmp 0x1400622e0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x1400613c0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061190
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140060bf0
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000080
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140062140
mov rdi, qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call rdi
mov esi, eax
test eax, eax
je 0x1400632ea
lea ecx, [rax + 1]
add rcx, rcx
call fcn.140082d00
mov rbp, rax
test rax, rax
je 0x1400637d3
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, r12
call rdi
test eax, eax
je 0x140063780
mov r8d, 8
lea rdx, str._UNC_
mov rcx, rbp
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140063242
mov eax, 0x5c
lea r14, [rbp + 0xc]
lea edi, [rsi - 6]
mov word [rbp + 0xc], ax
mov dword [rsp + 0x28], 0
mov r9d, edi
mov r8, r14
xor edx, edx
mov qword [rsp + 0x38], 0
mov r15, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call r15
movsxd rsi, eax
test esi, esi
je 0x1400632e2
lea ecx, [rsi + 1]
movsxd rcx, ecx
call fcn.140082d00
mov r13, rax
test rax, rax
je 0x1400632d7
mov r9d, edi
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call r15
mov byte [r13 + rsi], 0
mov rcx, rbp
mov qword [rbx - 0x90], r13
call fcn.140082d20
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [rbx + 0x28], 8
jmp case.0x1400620da.26
mov rsi, qword [rbx + 0x30]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x140062e70
cmp word [rsi + rax*2 - 4], 0x3a
lea rdx, [rax + rax]
je 0x140062e70
lea rdx, [rsi + rdx - 2]
movzx eax, word [rdx]
cmp ax, 0x5c
je 0x1400632c6
cmp ax, 0x2f
je 0x1400632c6
nop word [rax + rax]
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140062140
mov rcx, rax
lea rbp, [rsp + 0x50]
lea rdi, [rbx - 0x80]
mov rax, qword [0x1402341a0]
mov rdx, rbp
mov dword [rsp + 0x20], 0x12
mov r9d, 0x68
lea r8, [rsp + 0x80]
call qword [rax]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x140063798
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x14006306b
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x140063798
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x140063030
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov qword [rbx - 0x48], r8
cmove rax, rcx
jmp 0x140062ad5
mov r13, qword [sym.imp.msvcrt.dll__read]
mov r15, qword [sym.imp.msvcrt.dll__write]
xor ebp, ebp
test r14, r14
jne 0x140062fb0
jmp 0x140063747
cmp eax, 0xffffffff
je 0x140062c55
cdqe
mov ecx, dword [rsp + 0x4c]
mov rdx, rdi
sub r14, rax
call r15
cmp eax, 0xffffffff
je 0x140062c55
add ebp, eax
test r14, r14
je 0x140062fca
cmp r14, rsi
mov r8, rsi
mov rdx, rdi
mov ecx, r12d
cmovbe r8, r14
call r13
mov r8d, eax
test eax, eax
jne 0x140062f88
movsxd rbp, ebp
mov rcx, rdi
call fcn.140082d20
mov qword [rbx - 0x98], rbp
cmp rbp, 0xffffffffffffffff
jne case.0x1400620da.0
jmp 0x1400622e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rbx - 0x98], rax
jmp 0x140062221
and r8d, 1
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne case.0x1400620da.26
jmp 0x140062140
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x140062f52
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rbx - 0x98], rax
jmp 0x1400624e8
xor eax, eax
jmp 0x140062f2c
xor eax, eax
jmp 0x140062a8c
mov dword [rbx + 0x2c], 6
mov ecx, 6
call fcn.1400605e0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620da.0
xor edx, edx
lea r8, [rbx - 0x48]
mov rcx, rsi
call fcn.140060910
test eax, eax
jne 0x1400630d0
mov rax, qword [rbx - 0x78]
mov edx, dword [rsp + 0xa0]
or ah, 0xa0
jmp 0x140062abe
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
call r15
cmp eax, 0x5b8
je 0x14006349a
cmp eax, 0x1126
je 0x14006349a
call r15
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605e0
cdqe
mov qword [rbx - 0x98], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rax, rbx
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov r8d, 4
lea rdx, [0x140226cf8]
mov rcx, r12
mov rsi, rax
call sub.msvcrt.dll_wcsncmp
mov ebp, eax
test eax, eax
je 0x140063190
cmp esi, 2
jle 0x1400632f8
movzx eax, word [r12]
and eax, 0xffffffdf
sub eax, 0x41
cmp ax, 0x19
ja 0x1400632f8
cmp word [r12 + 2], 0x3a
jne 0x1400632f8
movzx eax, word [r12 + 4]
cmp ax, 0x5c
je 0x140063190
cmp ax, 0x2f
jne 0x1400632f8
lea ecx, [rsi*4 + 0x20]
movsxd rcx, ecx
call fcn.140082d00
mov rsi, rax
test rax, rax
je 0x14006381e
lea rdi, [rax + 0x10]
mov r8d, 4
lea rdx, [0x140226d08]
mov rcx, rdi
call sub.msvcrt.dll_wcsncpy
xor eax, eax
test ebp, ebp
sete al
lea r9, [r12 + rax*8]
movzx eax, word [r9]
test ax, ax
je 0x14006330f
xor ecx, ecx
mov r8d, 4
xor r10d, r10d
jmp 0x140063234
cmp ax, 0x2f
je 0x14006323a
mov edx, r8d
test r10d, r10d
je 0x140063214
movsxd r8, r8d
mov r14d, 0x5c
add edx, 1
mov word [rdi + r8*2], r14w
movzx eax, word [r9 + rcx]
lea r8d, [rdx + 1]
movsxd rdx, edx
xor r10d, r10d
mov word [rdi + rdx*2], ax
add rcx, 2
movzx eax, word [r9 + rcx]
test ax, ax
je 0x140063315
cmp ax, 0x5c
jne 0x1400631f0
mov r10d, 1
jmp 0x140063222
mov r8d, 4
lea rdx, [0x140226cf8]
mov rcx, rbp
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140063780
lea r14, [rbp + 8]
lea edi, [rsi - 4]
jmp 0x140062d80
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x14006284b
mov ecx, eax
mov dword [rbx + 0x2c], eax
call fcn.1400605e0
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x1400620da.0
mov ecx, 0x57
jmp 0x14006327f
xor r13d, r13d
jmp 0x140062463
mov rax, qword [rsp + 0xb0]
mov qword [rbx - 0x48], rax
mov eax, 0x8000
jmp 0x140062abe
xor r15d, r15d
mov word [rdx], r15w
jmp 0x1400629c8
xor eax, eax
mov word [rdx], ax
jmp 0x140062e70
xor eax, eax
jmp 0x140062825
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call fcn.140082d20
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140062140
mov qword [rbx - 0x98], 0xfffffffffffff019
mov dword [rbx + 0x2c], 0x32
jmp case.0x1400620da.0
mov r8d, 4
movsxd rax, r8d
lea edx, [r8 + r8 + 2]
mov r11d, 0x5c
xor ebp, ebp
add rax, rax
xor r12d, r12d
add r8d, 2
mov word [rsi + rax + 0x10], r11w
mov word [rsi + 0xa], dx
mov edx, r8d
mov word [rsi + 8], bp
mov word [rdi + rax + 2], r12w
movzx eax, word [r9]
test ax, ax
je 0x1400633bb
xor ecx, ecx
xor r10d, r10d
jmp 0x14006339d
cmp ax, 0x2f
je 0x1400633a3
test r10d, r10d
je 0x140063381
movsxd rax, edx
mov r10d, 0x5c
add edx, 1
mov word [rdi + rax*2], r10w
movzx eax, word [r9 + rcx]
movsxd r10, edx
add edx, 1
mov word [rdi + r10*2], ax
xor r10d, r10d
add rcx, 2
movzx eax, word [r9 + rcx]
test ax, ax
je 0x1400633ab
cmp ax, 0x5c
jne 0x140063360
mov r10d, 1
jmp 0x14006338f
mov eax, edx
sub eax, r8d
cmp eax, 2
je 0x1400636ed
add eax, eax
movsxd rdx, edx
add r8d, r8d
xor ecx, ecx
mov word [rsi + 0xe], ax
lea ebp, [rdx + rdx + 0x12]
mov word [rsi + 0xc], r8w
xor r8d, r8d
lea eax, [rbp - 8]
mov word [rdi + rdx*2], cx
xor edx, edx
mov rcx, r13
mov dword [rsi], 0xa0000003
mov word [rsi + 4], ax
mov word [rsi + 6], r8w
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400636a7
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r13
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006375d
lea rax, [rsp + 0x80]
mov r9d, ebp
mov r8, rsi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov edx, 0x900a4
mov rcx, rdi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14006370f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140082d20
mov qword [rbx - 0x98], 0
jmp case.0x1400620da.0
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1400630f0
mov rcx, rax
mov r9d, 0x68
mov r8, rbp
mov rdx, r12
mov dword [rsp + 0x20], 0x12
call qword [r14]
mov ecx, eax
shr eax, 0x1e
cmp eax, 3
je 0x1400637e3
mov rax, qword [0x1402341c0]
mov rcx, r13
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
mov r9d, 0x18
mov rdx, r12
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
mov ecx, eax
je 0x140063708
shr eax, 0x1e
cmp eax, 3
je 0x1400637e3
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x1400636db
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x48], r8
movabs r8, 0xfe624e212ac18000
cmove rax, rcx
pxor xmm0, xmm0
movabs rcx, 0xd6bf94d5e57a42bd
mov qword [rbx - 0x90], rdi
add r9, r8
movups xmmword [rbx - 0x68], xmm0
mov qword [rbx - 0x78], rax
mov rax, r9
mul rcx
mov qword [rbx - 0x40], 0x1000
mov qword [rbx - 0x30], 0
mov qword [rbx - 0x58], 0
shr rdx, 0x17
mov qword [rbx - 0x28], 0
movsxd rax, edx
mov dword [rbx - 0x20], edx
imul rax, rax, 0x989680
mov qword [rbx - 0x98], 0
sub r9, rax
imul eax, r9d, 0x64
mov r9, qword [rsp + 0x98]
add r9, r8
mov dword [rbx - 0x1c], eax
mov rax, r9
mul rcx
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 0x10], edx
imul rax, rax, 0x989680
sub r9, rax
imul eax, r9d, 0x64
mov r9, qword [rsp + 0x90]
add r9, r8
add r8, qword [rsp + 0x80]
mov dword [rbx - 0xc], eax
mov rax, r9
mul rcx
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 0x18], edx
imul rax, rax, 0x989680
sub r9, rax
imul eax, r9d, 0x64
mov dword [rbx - 0x14], eax
mov rax, r8
mul rcx
mov rcx, r13
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 8], edx
imul rax, rax, 0x989680
sub r8, rax
imul eax, r8d, 0x64
mov dword [rbx - 4], eax
mov rax, qword [rsp + 0xc0]
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rax, 9
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov qword [rbx - 0x70], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
jmp 0x14006310d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605e0
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140082d20
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x140063565
movsxd rax, edx
mov r9d, 0x5c
add edx, 1
mov word [rdi + rax*2], r9w
mov eax, 6
jmp 0x1400633bb
xor eax, eax
jmp 0x14006353f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605e0
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
call fcn.140082d20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp case.0x1400620da.0
mov rcx, rdi
call fcn.140082d20
xor eax, eax
mov qword [rbx - 0x98], rax
jmp case.0x1400620da.0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605e0
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
call fcn.140082d20
jmp 0x140063739
mov rcx, rbp
call fcn.140082d20
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400632ea
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
call rdi
jmp 0x140062ff6
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140062140
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400632ea
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call r15
call r15
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.1400605e0
mov rcx, r13
cdqe
mov qword [rbx - 0x98], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
jmp 0x14006310d
lea rdx, [0x140226c3e]
mov ecx, 0xe
call fcn.140060580
nop