Function at 0x140011310
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x918
mov rax, qword [0x140025100]
xor rax, rsp
mov qword [rsp + 0x900], rax
mov dword [rsp + 0xa4], 0
mov dword [rsp + 0x88], 0
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x140011379
lea rdx, [0x140003690]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 2
test eax, eax
je 0x1400113ac
lea rdx, [0x140003c08]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x20], 0
je 0x1400113dc
lea rdx, [0x140003c48]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x4000
test eax, eax
je 0x140011411
lea rdx, [0x140003738]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x20
test eax, eax
je 0x140011444
lea rdx, [0x140003c78]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x58], 0
je 0x140011474
lea rdx, [0x140003ca0]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x28], 0
jne 0x1400114a4
lea rdx, [0x140003ad8]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 4
test eax, eax
jne 0x140011512
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x10
test eax, eax
je 0x140011512
mov rax, qword [rsp + 0x930]
mov rax, qword [rax + 0x28]
movsx eax, byte [rax]
cmp eax, 0x5c
je 0x140011512
mov rax, qword [rsp + 0x930]
mov rax, qword [rax + 0x28]
movsx eax, byte [rax + 1]
cmp eax, 0x5c
je 0x140011512
lea rdx, [0x140003ce0]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x40], 0
jne 0x140011542
lea rdx, [0x140003d30]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x48], 0
jne 0x140011572
lea rdx, [0x140003810]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x60], 0
jne 0x1400115a2
lea rdx, [0x140003d60]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x68], 0
je 0x1400115e4
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x10
test eax, eax
jne 0x1400115e4
lea rdx, [0x140003840]
mov ecx, 2
call fcn.1400058d0
mov dword [rsp + 0x88], 0x57
jmp 0x14001296d
mov rax, qword [rsp + 0x930]
mov edx, dword [rax + 8]
mov rax, qword [rsp + 0x930]
mov rcx, qword [rax + 0x40]
call fcn.14000b8c0
test eax, eax
jne 0x14001163c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140003d98]
mov ecx, 1
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
jmp 0x14001296d
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x10], 0
jne 0x14001166a
lea rax, [0x140002bdd]
mov qword [rsp + 0x8d0], rax
jmp 0x14001167e
mov rax, qword [rsp + 0x930]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x8d0], rax
mov rax, qword [rsp + 0x930]
cmp qword [rax + 0x50], 0
jne 0x14001169e
lea rax, [0x140002bdd]
mov qword [rsp + 0x8d8], rax
jmp 0x1400116b2
mov rax, qword [rsp + 0x930]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x8d8], rax
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x10
test eax, eax
je 0x1400116d5
lea rax, [0x140002e2c]
mov qword [rsp + 0x8e0], rax
jmp 0x1400116e4
lea rax, [0x140002e30]
mov qword [rsp + 0x8e0], rax
movzx eax, word [rsp + 0x9c]
movzx ecx, word [rsp + 0x9a]
movzx edx, word [rsp + 0x98]
movzx r8d, word [rsp + 0x90]
movzx r9d, word [rsp + 0x96]
movzx r10d, word [rsp + 0x92]
mov r11, qword [rsp + 0x8d0]
mov qword [rsp + 0x60], r11
mov r11, qword [rsp + 0x8d8]
mov qword [rsp + 0x58], r11
mov r11, qword [rsp + 0x930]
mov r11, qword [r11 + 0x48]
mov qword [rsp + 0x50], r11
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], r10d
mov r9, qword [rsp + 0x8e0]
lea r8, [0x1400038a0]
mov edx, 0x436
lea rcx, [rsp + 0xb0]
call fcn.14001f670
mov dword [rsp + 0x4f8], eax
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x40
test eax, eax
je 0x1400117da
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0xc0000000
mov rax, qword [rsp + 0x930]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x4f0], rax
jmp 0x14001181b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rax, qword [rsp + 0x930]
mov rcx, qword [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x4f0], rax
cmp qword [rsp + 0x4f0], 0xffffffffffffffff
je 0x140012932
cmp dword [rsp + 0x4f8], 0
jne 0x1400128f8
mov qword [rsp + 0x510], 0
lea rax, [rsp + 0x518]
mov rdi, rax
xor eax, eax
mov ecx, 0x150
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x640]
lea rdx, [rsp + 0x524]
mov rcx, qword [rsp + 0x930]
call fcn.140013430
mov r8, qword [rsp + 0x640]
lea rdx, [rsp + 0x524]
mov rcx, qword [rsp + 0x930]
call fcn.1400129e0
test eax, eax
je 0x1400128eb
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xb0]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, [rsp + 0x78]
mov edx, 0xb
mov rax, qword [rsp + 0x930]
mov rcx, qword [rax + 0x40]
call fcn.14000af30
test eax, eax
je 0x1400128ab
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x78]
mov rax, qword [rsp + 0x930]
mov rcx, qword [rax + 0x40]
call fcn.14000bb00
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x930]
mov r9, qword [rax + 0x40]
lea r8, [0x140003900]
mov edx, 0x436
lea rcx, [rsp + 0xb0]
call fcn.14001f670
mov dword [rsp + 0x4f8], eax
cmp dword [rsp + 0x4f8], 0
je 0x140011987
mov eax, dword [rsp + 0x4f8]
and eax, 0xffff
mov dword [rsp + 0x88], eax
mov r8d, dword [rsp + 0x88]
lea rdx, [0x140003910]
mov ecx, 3
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
jmp 0x14001289b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0xffffffffffffffff
jne 0x140011a0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov r9d, dword [rsp + 0x88]
lea r8, [rsp + 0xb0]
lea rdx, [0x140003dc8]
mov ecx, 1
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
jmp 0x14001289b
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x10000
test eax, eax
jne 0x140011a48
lea r9, [rsp + 0x8b0]
lea r8, [rsp + 0x7a0]
mov edx, 0x105
mov rax, qword [rsp + 0x930]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x140011a66
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x28]
mov edx, 0x105
lea rcx, [rsp + 0x7a0]
call fcn.140021c50
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x7a0]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
movsx eax, byte [rsp + rax + 0x79f]
cmp eax, 0x5c
je 0x140011aab
lea r8, [0x140002a30]
mov edx, 0x105
lea rcx, [rsp + 0x7a0]
call fcn.14001f5e0
lea rax, [rsp + 0x510]
mov rdi, rax
xor eax, eax
mov ecx, 0x158
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x510], rax
mov rax, qword [rsp + 0x930]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x518], rax
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
mov dword [rsp + 0x520], eax
mov rax, qword [rsp + 0x930]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x630], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x638], rax
mov rax, qword [rsp + 0x930]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x660], rax
cmp dword [0x140025a3c], 0
jne 0x1400126da
lea r9, [rsp + 0x500]
lea r8, [rsp + 0xb0]
mov edx, 0x436
mov rcx, qword [rsp + 0x4f0]
call fcn.140020a50
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 1
jbe 0x1400126da
mov eax, dword [rsp + 0xa4]
inc eax
mov dword [rsp + 0xa4], eax
mov eax, dword [rsp + 0xa0]
cmp dword [rsp + 0x500], eax
je 0x140011bc7
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 8
test eax, eax
je 0x140011bc2
mov r9d, dword [rsp + 0xa4]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003df0]
xor ecx, ecx
call fcn.1400058d0
jmp 0x1400126d5
movsx eax, byte [rsp + 0xb0]
cmp eax, 0x3b
je 0x1400126d5
movsx eax, byte [rsp + 0xb0]
test eax, eax
je 0x1400126d5
mov dword [rsp + 0x8bc], 0
lea rax, [rsp + 0x678]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xb0]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x8c0], eax
mov dword [rsp + 0x8b8], 0
jmp 0x140011c55
mov eax, dword [rsp + 0x8b8]
inc eax
mov dword [rsp + 0x8b8], eax
mov eax, dword [rsp + 0x8c0]
cmp dword [rsp + 0x8b8], eax
jae 0x140011d7d
mov eax, dword [rsp + 0x8b8]
movsx eax, byte [rsp + rax + 0xb0]
cmp eax, 0x22
jne 0x140011cad
cmp dword [rsp + 0x8bc], 0
jne 0x140011c94
mov dword [rsp + 0x8e8], 1
jmp 0x140011c9f
mov dword [rsp + 0x8e8], 0
mov eax, dword [rsp + 0x8e8]
mov dword [rsp + 0x8bc], eax
cmp dword [rsp + 0x8bc], 0
jne 0x140011d78
mov eax, dword [rsp + 0x8b8]
movsx eax, byte [rsp + rax + 0xb0]
cmp eax, 0x2c
jne 0x140011d78
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 1
je 0x140011d01
cmp dword [rsp + 0xa0], 2
je 0x140011d01
cmp dword [rsp + 0xa0], 4
jne 0x140011d69
cmp dword [rsp + 0x8b8], 0
je 0x140011d22
mov eax, dword [rsp + 0x8b8]
dec eax
mov eax, eax
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
jne 0x140011d69
lea rax, [0x1400259f8]
lock inc dword [rax]
cmp dword [0x140025a38], 0
je 0x140011d65
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xa4]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003e10]
mov ecx, 2
call fcn.1400058d0
jmp 0x140011d7d
mov eax, dword [rsp + 0x8b8]
mov byte [rsp + rax + 0xb0], 0
jmp 0x140011c45
cmp dword [rsp + 0xa0], 7
jne 0x1400126a6
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x670], rax
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
cmp eax, 0x22
jne 0x140011e15
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x670]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov rcx, qword [rsp + 0x670]
movsx eax, byte [rcx + rax - 1]
cmp eax, 0x22
jne 0x140011e15
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x670]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov rcx, qword [rsp + 0x670]
mov byte [rcx + rax - 1], 0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x670]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
test rax, rax
jne 0x140011e7b
lea rax, [0x1400259f8]
lock inc dword [rax]
cmp dword [0x140025a38], 0
je 0x140011e76
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0xa4]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003e10]
mov ecx, 2
call fcn.1400058d0
jmp 0x1400126a4
mov rax, qword [rsp + 0x670]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7a0]
lea r8, [0x140002c8c]
mov edx, 0x105
lea rcx, [rsp + 0x690]
call fcn.14001f670
mov dword [rsp + 0x4f8], eax
cmp dword [rsp + 0x4f8], 0
jne 0x140012639
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
test eax, eax
je 0x140011ee2
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
jmp 0x140011ebe
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
test eax, eax
jne 0x140011f06
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
jmp 0x140011ee2
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
cmp eax, 0x22
jne 0x140011f80
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x670]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov rcx, qword [rsp + 0x670]
movsx eax, byte [rcx + rax - 1]
cmp eax, 0x22
jne 0x140011f80
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x670]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov rcx, qword [rsp + 0x670]
mov byte [rcx + rax - 1], 0
mov rax, qword [rsp + 0x670]
mov qword [rsp + 0x678], rax
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
test eax, eax
je 0x140011fb4
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
jmp 0x140011f90
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
test eax, eax
jne 0x140011fd8
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
jmp 0x140011fb4
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
test eax, eax
je 0x140011ffc
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
jmp 0x140011fd8
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
test eax, eax
jne 0x140012020
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
jmp 0x140011ffc
mov rax, qword [rsp + 0x670]
movsx eax, byte [rax]
cmp eax, 0x22
jne 0x14001209a
mov rax, qword [rsp + 0x670]
inc rax
mov qword [rsp + 0x670], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x670]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov rcx, qword [rsp + 0x670]
movsx eax, byte [rcx + rax - 1]
cmp eax, 0x22
jne 0x14001209a
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x670]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov rcx, qword [rsp + 0x670]
mov byte [rcx + rax - 1], 0
mov rax, qword [rsp + 0x670]
mov qword [rsp + 0x688], rax
lea rax, [rsp + 0x690]
mov qword [rsp + 0x680], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x688]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
test rax, rax
jne 0x140012120
lea rax, [0x1400259f8]
lock inc dword [rax]
cmp dword [0x140025a38], 0
je 0x14001211b
mov dword [rsp + 0x20], 4
mov r9d, dword [rsp + 0xa4]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003e10]
mov ecx, 2
call fcn.1400058d0
jmp 0x140012637
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x680]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
test rax, rax
jne 0x140012186
lea rax, [0x1400259f8]
lock inc dword [rax]
cmp dword [0x140025a38], 0
je 0x140012181
mov dword [rsp + 0x20], 1
mov r9d, dword [rsp + 0xa4]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003e10]
mov ecx, 2
call fcn.1400058d0
jmp 0x140012637
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x678]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
test rax, rax
jne 0x1400121ec
lea rax, [0x1400259f8]
lock inc dword [rax]
cmp dword [0x140025a38], 0
je 0x1400121e7
mov dword [rsp + 0x20], 2
mov r9d, dword [rsp + 0xa4]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003e10]
mov ecx, 2
call fcn.1400058d0
jmp 0x140012637
cmp dword [0x140025a3c], 0
jne 0x140012637
mov ecx, 0x158
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x8c8], rax
cmp qword [rsp + 0x8c8], 0
jne 0x140012221
jmp 0x14001261f
lea rax, [rsp + 0x510]
mov rdi, qword [rsp + 0x8c8]
mov rsi, rax
mov ecx, 0x158
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x2000
test eax, eax
je 0x140012289
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x678]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
add rax, 4
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov rcx, qword [rsp + 0x8c8]
mov qword [rcx + 0x138], rax
jmp 0x1400122c0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x678]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
inc rax
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov rcx, qword [rsp + 0x8c8]
mov qword [rcx + 0x138], rax
mov rax, qword [rsp + 0x8c8]
cmp qword [rax + 0x138], 0
jne 0x1400122ea
mov rcx, qword [rsp + 0x8c8]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14001261f
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x680]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
inc rax
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov rcx, qword [rsp + 0x8c8]
mov qword [rcx + 0x140], rax
mov rax, qword [rsp + 0x8c8]
cmp qword [rax + 0x140], 0
jne 0x140012360
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x8c8]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14001261f
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x688]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
inc rax
mov rcx, rax
call qword [sym.imp.msvcrt.dll_malloc]
mov rcx, qword [rsp + 0x8c8]
mov qword [rcx + 0x148], rax
mov rax, qword [rsp + 0x8c8]
cmp qword [rax + 0x148], 0
jne 0x1400123eb
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call qword [sym.imp.msvcrt.dll_free]
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x140]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x8c8]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14001261f
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x2000
test eax, eax
je 0x140012512
cmp qword [rsp + 0x670], 0
je 0x1400124eb
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call qword [sym.imp.msvcrt.dll__msize]
mov r8, qword [rsp + 0x678]
mov rdx, rax
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call fcn.1400053e0
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x8c8]
mov rdi, qword [rdx + 0x138]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
cmp rax, 2
jbe 0x140012482
mov rax, qword [rsp + 0x8c8]
mov rax, qword [rax + 0x138]
mov byte [rax + 2], 0
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call qword [sym.imp.msvcrt.dll__msize]
lea r8, [0x140002a30]
mov rdx, rax
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call fcn.14001f5e0
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call qword [sym.imp.msvcrt.dll__msize]
mov r8, qword [rsp + 0x678]
mov rdx, rax
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call fcn.14001f5e0
jmp 0x140012510
mov r8, qword [rsp + 0x678]
lea rdx, [0x140003e38]
xor ecx, ecx
call fcn.1400058d0
lea rax, [0x1400259f8]
lock inc dword [rax]
jmp 0x140011b2a
jmp 0x140012546
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call qword [sym.imp.msvcrt.dll__msize]
mov r8, qword [rsp + 0x678]
mov rdx, rax
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x138]
call fcn.1400053e0
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x140]
call qword [sym.imp.msvcrt.dll__msize]
mov r8, qword [rsp + 0x680]
mov rdx, rax
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x140]
call fcn.1400053e0
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x148]
call qword [sym.imp.msvcrt.dll__msize]
mov r8, qword [rsp + 0x688]
mov rdx, rax
mov rax, qword [rsp + 0x8c8]
mov rcx, qword [rax + 0x148]
call fcn.1400053e0
mov rax, qword [rsp + 0x8c8]
add rax, 0x18
lea r8, [rsp + 0x690]
mov edx, 0x105
mov rcx, rax
call fcn.1400053e0
lea r9, [rsp + 0x4fc]
mov r8, qword [rsp + 0x8c8]
lea rdx, [0x140010330]
mov rcx, qword [0x140025a08]
call fcn.140016ea0
test eax, eax
jne 0x140012619
lea rcx, [0x1400031b8]
call fcn.140005ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140005800
lea rax, [0x1400259f8]
lock inc dword [rax]
xor eax, eax
test eax, eax
je 0x140012637
lea rdx, [0x140003e68]
xor ecx, ecx
call fcn.1400058d0
lea rax, [0x1400259f8]
lock inc dword [rax]
jmp 0x1400126a4
mov eax, dword [rsp + 0x4f8]
and eax, 0xffff
mov dword [rsp + 0x88], eax
lea rax, [0x1400259f8]
lock inc dword [rax]
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 8
test eax, eax
je 0x1400126a4
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xa4]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003e98]
mov ecx, 3
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
jmp 0x1400126d5
mov r9d, dword [rsp + 0xa4]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003ed0]
mov ecx, 2
call fcn.1400058d0
lea rax, [0x1400259f8]
lock inc dword [rax]
jmp 0x140011b2a
cmp dword [0x140025a3c], 0
je 0x14001270c
mov edx, 0xffffffff
mov rax, qword [0x140025a08]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x140025a08]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14001271a
xor edx, edx
mov rcx, qword [0x140025a08]
call fcn.140016be0
mov rax, qword [rsp + 0x930]
mov eax, dword [rax + 8]
and eax, 0x40
test eax, eax
je 0x14001288d
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x78]
lea r8, [0x140003f00]
mov edx, 0x436
lea rcx, [rsp + 0xb0]
call fcn.14001f670
mov dword [rsp + 0x4f8], eax
cmp dword [rsp + 0x4f8], 0
jne 0x140012858
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xb0]
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x500]
mov r8d, eax
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140012827
mov eax, dword [rsp + 0x500]
mov qword [rsp + 0x8f0], rax
xor ecx, ecx
mov qword [rsp + 0x8f8], rcx
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xb0]
mov rdi, qword [rsp + 0x8f8]
mov rax, rdi
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov rcx, qword [rsp + 0x8f0]
cmp rcx, rax
jne 0x140012827
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x140012856
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov r8d, dword [rsp + 0x88]
lea rdx, [0x140003f18]
xor ecx, ecx
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
jmp 0x14001288d
mov eax, dword [rsp + 0x4f8]
and eax, 0xffff
mov dword [rsp + 0x88], eax
mov r8d, dword [rsp + 0x88]
lea rdx, [0x140003f18]
xor ecx, ecx
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400128e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov r9d, dword [rsp + 0x88]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x40]
lea rdx, [0x140003f50]
mov ecx, 1
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
jmp 0x1400128f6
mov dword [rsp + 0x88], 0x57
jmp 0x140012930
mov eax, dword [rsp + 0x4f8]
and eax, 0xffff
mov dword [rsp + 0x88], eax
mov r8d, dword [rsp + 0x88]
lea rdx, [0x140003910]
mov ecx, 3
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
jmp 0x14001296d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov r9d, dword [rsp + 0x88]
mov rax, qword [rsp + 0x930]
mov r8, qword [rax + 0x60]
lea rdx, [0x140003f80]
xor ecx, ecx
call fcn.1400058d0
mov ecx, dword [rsp + 0x88]
call fcn.140005800
cmp dword [0x140025a3c], 0
je 0x14001299f
mov edx, 0xffffffff
mov rax, qword [0x140025a08]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x140025a08]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x1400129ad
xor edx, edx
mov rcx, qword [0x140025a08]
call fcn.140016be0
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x900]
xor rcx, rsp
call fcn.140021740
add rsp, 0x918
pop rdi
pop rsi
ret