Function at 0x1403e4ee0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x108
mov rbx, rcx
mov rax, qword [0x14194d6d8]
mov rdi, r8
xor rax, rsp
mov rsi, rdx
mov qword [rsp + 0x100], rax
mov rax, qword [rbx + 0x260]
test rax, rax
jge 0x1403e4f24
neg rax
or byte [rbx + 0x29a], 0x20
mov qword [rbx + 0x260], rax
test rdi, rdi
jle 0x1403e527d
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xd8], rbp
or byte [rbx + 0x29d], 1
mov rax, qword [rbx + 0x260]
cmp rdi, rax
jle 0x1403e4f6b
mov r12, rax
mov r15b, 1
xor r14d, r14d
jmp 0x1403e4f7b
mov r14d, 0
mov r12, rdi
sete r14b
xor r15b, r15b
mov r9b, byte [rbx + 0x298]
xor r10b, r10b
and r9b, 0x80
xor ebp, ebp
mov r8b, byte [rbx + 0x299]
shr r9b, 7
and r8b, 1
mov rdx, qword [rbx + 0x1a0]
mov r13, qword [rbx + 0x248]
cmp dword [rbx + 0x40], 0xfffffffc
je 0x1403e687b
cmp dword [0x141a6ae3c], 0
je 0x1403e508a
lea rax, [r13 - 1]
cmp rax, 1
ja 0x1403e4fd1
xor r13d, r13d
jmp 0x1403e51a8
test r9b, r9b
je 0x1403e5081
cmp r13, 0xfffffffffffffffa
je 0x1403e55ad
test r13, r13
je 0x1403e5532
test r8b, r8b
je 0x1403e508a
mov dword [rsp + 0xf8], ecx
mov byte [rsp + 0xc8], r10b
mov qword [rsp + 0xd0], rdx
call fcn.14043d2b0
mov ecx, dword [rsp + 0xf8]
call fcn.14043d430
mov r10b, byte [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
test r10b, r10b
je 0x1403e508a
mov rcx, rsi
mov edx, r12d
mov r8d, dword [rsp + 0xf8]
call fcn.14043d350
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1403e4fc9
lea rcx, [0x14059fd50]
mov edx, 2
xor r9d, r9d
mov r8d, dword [rsp + 0xf8]
call fcn.14043d310
mov byte [rbp + rsi], 0xa
inc rbp
mov r13d, 1
jmp 0x1403e51a8
test r13, r13
je 0x1403e5532
mov qword [rsp + 0xd0], rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rbx + 0x240]
mov eax, 0x20000
test r8, r8
cmove r8, rax
xor ebp, ebp
cmp r12, r8
jbe 0x1403e50c1
test r13, r13
jne 0x1403e50ea
mov rax, rsp
mov rcx, rdx
mov rdx, rsi
mov r8d, r12d
lea r9, [rsp + 0x64]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rbp, dword [rsp + 0x64]
jmp 0x1403e519f
mov rcx, rsi
mov r13, r12
mov dword [rsp + 0x88], r14d
mov r14, rdx
mov byte [rsp + 0x90], r15b
mov r15, rcx
mov qword [rsp + 0x98], r12
mov r12, rax
mov qword [rsp + 0xa0], rsi
mov rsi, r8
mov qword [rsp + 0xa8], rdi
mov r10, rsp
mov rdi, rsi
mov rcx, r14
mov rdx, r15
mov r8d, esi
lea r9, [rsp + 0x64]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1403e5177
mov r9, qword [rbx + 0x240]
test r9, r9
movsxd r10, dword [rsp + 0x64]
cmove r9, r12
sub r13, r10
cmp r13, r9
cmovbe rsi, r13
add r15, r10
add rbp, r10
test r13, r13
je 0x1403e5177
cmp r10, rdi
je 0x1403e5124
mov r14d, dword [rsp + 0x88]
mov r15b, byte [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
xor r13d, r13d
test eax, eax
setne r13b
mov rax, qword [rbx + 0x260]
add rsi, rbp
sub rdi, rbp
sub rax, rbp
test byte [rbx + 0x29a], 0x20
jne 0x1403e51ca
mov qword [rbx + 0x260], rax
jmp 0x1403e51d4
neg rax
mov qword [rbx + 0x260], rax
test rbp, rbp
jle 0x1403e51fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e3
je 0x1403e6860
test r13d, r13d
je 0x1403e6780
test rbp, rbp
je 0x1403e66f4
cmp rbp, r12
jl 0x1403e66a4
cmp r15b, 1
jne 0x1403e5218
test byte [rbx + 0x29a], 0x20
je 0x1403e55c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp r12d, 0x3e3
je 0x1403e6696
test r13d, r13d
je 0x1403e65b3
test rbp, rbp
je 0x1403e6527
cmp r15b, 1
je 0x1403e5c8a
cmp r14d, 1
je 0x1403e5c7d
test rdi, rdi
jg 0x1403e4f4d
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
test rsi, rsi
je 0x1403e52b5
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
xor eax, eax
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov al, byte [rbx + 0x29d]
mov sil, al
and al, 0xfe
and sil, 1
mov byte [rbx + 0x29d], al
mov al, byte [rbx + 0x29c]
mov cl, al
not cl
and cl, 0x80
movzx edi, cl
shr rdi, 5
movzx edx, word [rbx + 0x27a]
lea rcx, [rdi + 4]
test edx, edx
jg 0x1403e54ff
mov rdx, qword [rbx + 0x140]
test al, 0x40
je 0x1403e533a
test rdx, rdx
jbe 0x1403e5329
mov rax, qword [rbx + 0x260]
lea rax, [rax + rdi + 4]
cmp rax, rdx
jae 0x1403e5321
add qword [rbx + 0x80], rax
sub rdx, rax
jmp 0x1403e53c4
sub rax, rdx
jmp 0x1403e53bf
mov rax, qword [rbx + 0x260]
lea rax, [rax + rdi + 4]
jmp 0x1403e53bf
mov r9, qword [rbx + 0x80]
mov r11, qword [rbx + 0x78]
mov r10, qword [rbx + 0x1b0]
lea rdi, [rdx + r9]
lea r8, [r11 + r10]
cmp rdi, r8
je 0x1403e5398
test sil, sil
jne 0x1403e538a
mov rdi, qword [rbx + 0xb0]
test rdi, rdi
je 0x1403e538a
cmp rdi, r11
jbe 0x1403e538a
cmp rdi, r8
ja 0x1403e538a
je 0x1403e538a
sub rdi, r9
cmp rdx, rdi
je 0x1403e539d
mov qword [rbx + 0x140], rdi
mov rdx, rdi
jmp 0x1403e539d
sub r11, r9
lea rdx, [r10 + r11]
mov qword [rbx + 0x140], rdx
test sil, sil
jne 0x1403e53d9
test al, 1
je 0x1403e53b5
mov rax, rcx
sub rax, rdx
mov rdi, qword [rbx + 0x260]
lea rax, [rax + rdi - 4]
jmp 0x1403e53bf
mov rax, rcx
sub rax, rdx
add rax, 0xfffffffffffffffc
test rax, rax
jne 0x1403e5429
test sil, sil
jne 0x1403e53e6
sub rdx, rcx
add rdx, 4
mov qword [rbx + 0x140], rdx
jmp 0x1403e53f6
mov rax, qword [rbx + 0x260]
add rax, 4
jne 0x1403e5429
xor eax, eax
mov qword [rbx + 0x140], rax
mov qword [rbx + 0xa8], rax
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
xor eax, eax
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x68], rax
mov edx, eax
mov rcx, qword [rbx + 0x1a0]
lea r8, [rsp + 0x6c]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x68], eax
mov edx, eax
cmp eax, 0xffffffff
je 0x1403e5c54
mov r12d, dword [rsp + 0x6c]
shl r12, 0x20
or r12, rdx
xor esi, esi
lea r8, [rsp + 0x74]
mov edi, esi
mov r9d, 1
mov rcx, qword [rbx + 0x1a0]
xor edx, edx
mov qword [r8 - 4], rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x70], eax
cmp eax, 0xffffffff
je 0x1403e5c38
cmp r12, 0xffffffffffffffff
je 0x1403e5bfc
test byte [rbx + 0x29a], 0x20
jne 0x1403e5627
mov rax, qword [rbx + 0x78]
mov qword [rbx + 0x140], rsi
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0xb0], rsi
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], rsi
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
xor eax, eax
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
xor eax, eax
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r10b, 1
mov byte [rsp + 0xc8], r10b
mov byte [rsp + 0xb0], r8b
mov byte [rsp + 0xb8], r9b
mov qword [rsp + 0xd0], rdx
call fcn.14043d530
mov rdx, qword [rsp + 0xd0]
mov r9b, byte [rsp + 0xb8]
mov r8b, byte [rsp + 0xb0]
mov r10b, byte [rsp + 0xc8]
mov dword [rsp + 0xf8], eax
movsxd rcx, dword [rsp + 0xf8]
cmp dword [0x141a6ae3c], 0
je 0x1403e5033
test r9b, r9b
je 0x1403e5033
test r8b, r8b
jne 0x1403e4ff6
jmp 0x1403e5033
mov r10b, 1
mov rcx, rdx
test r8b, r8b
jne 0x1403e4ff6
mov dword [rsp + 0xf8], edx
jmp 0x1403e5033
and byte [rbx + 0x29d], 0xfe
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x43
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14043dac0
nop
mov qword [rbx + 0x140], 0
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xd8], rbp
mov r12b, byte [rbx + 0x298]
xor r14b, r14b
and r12b, 0x80
xor esi, esi
mov r13b, byte [rbx + 0x299]
shr r12b, 7
and r13b, 1
mov rdx, qword [rbx + 0x1a0]
mov rbp, qword [rbx + 0x248]
cmp dword [rbx + 0x40], 0xfffffffc
je 0x1403e5bd0
cmp dword [0x141a6ae3c], 0
je 0x1403e5732
lea rax, [rbp - 1]
cmp rax, 1
ja 0x1403e56a7
xor ebp, ebp
jmp 0x1403e580e
test r12b, r12b
je 0x1403e5729
cmp rbp, 0xfffffffffffffffa
je 0x1403e5978
test rbp, rbp
je 0x1403e593c
test r13b, r13b
je 0x1403e5732
mov r15d, r9d
mov ecx, r15d
mov qword [rsp + 0x48], rdx
call fcn.14043d2b0
mov ecx, r15d
call fcn.14043d430
mov rdx, qword [rsp + 0x48]
test r14b, r14b
je 0x1403e5732
mov edx, 4
lea rcx, [rsp + 0x78]
mov r8d, r15d
call fcn.14043d350
movsxd rsi, eax
cmp eax, 0xffffffff
je 0x1403e56a0
lea rcx, [0x14059fd50]
mov edx, 2
mov r8d, r15d
xor r9d, r9d
call fcn.14043d310
mov byte [rsp + rsi + 0x78], 0xa
inc rsi
mov ebp, 1
jmp 0x1403e580e
test rbp, rbp
je 0x1403e593c
mov qword [rsp + 0x48], rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rbx + 0x240]
xor esi, esi
mov rdx, qword [rsp + 0x48]
test r14, r14
je 0x1403e57dd
cmp r14, 4
jae 0x1403e57dd
test rbp, rbp
je 0x1403e57dd
mov r13d, 0x20000
test r14, r14
mov dword [rsp + 0x30], edi
cmove r14, r13
mov r12d, 4
lea rbp, [rsp + 0x78]
mov rdi, rdx
mov rax, rsp
mov r15, r14
mov rcx, rdi
mov rdx, rbp
mov r8d, r14d
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1403e57d7
mov r8, qword [rbx + 0x240]
test r8, r8
movsxd r9, dword [rsp + 0x40]
cmove r8, r13
sub r12, r9
cmp r12, r8
cmovbe r14, r12
add rbp, r9
add rsi, r9
test r12, r12
je 0x1403e57d7
cmp r9, r15
je 0x1403e5784
mov edi, dword [rsp + 0x30]
jmp 0x1403e5806
mov rax, rsp
mov rcx, rdx
mov r8d, 4
lea rdx, [rsp + 0x78]
lea r9, [rsp + 0x40]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x40]
xor ebp, ebp
test eax, eax
setne bpl
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp r12d, 0x3e3
je 0x1403e5bc2
test ebp, ebp
je 0x1403e5adf
test rsi, rsi
je 0x1403e5a46
movzx ebp, byte [rsp + 0x78]
movzx ecx, byte [rsp + 0x79]
movzx eax, byte [rsp + 0x7a]
movzx esi, byte [rsp + 0x7b]
test byte [rbx + 0x295], 0x20
je 0x1403e5863
shl eax, 8
shl ecx, 0x10
or esi, eax
shl ebp, 0x18
or esi, ecx
or esi, ebp
jmp 0x1403e5872
shl ecx, 8
shl eax, 0x10
or ebp, ecx
shl esi, 0x18
or ebp, eax
or esi, ebp
movsxd rdx, esi
jl 0x1403e5887
mov qword [rbx + 0x260], rdx
and byte [rbx + 0x29a], 0xdf
jmp 0x1403e5893
neg esi
movsxd rdx, esi
mov qword [rbx + 0x260], rdx
add rdx, 4
lea r8, [rsp + 0x5c]
mov rcx, qword [rbx + 0x1a0]
mov r9d, 1
mov qword [r8 - 4], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, eax
mov dword [rsp + 0x58], ecx
mov eax, ecx
cmp ecx, 0xffffffff
je 0x1403e5a07
mov ecx, dword [rsp + 0x5c]
shl rcx, 0x20
or rcx, rax
cmp rcx, 0xffffffffffffffff
je 0x1403e59ab
mov rcx, qword [rbx + 0x1a0]
mov edx, edi
mov r9d, 1
lea r8, [rsp + 0x54]
mov qword [r8 - 4], 0
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x50], eax
cmp eax, 0xffffffff
je 0x1403e598f
test byte [rbx + 0x29a], 0x20
jne 0x1403e5652
mov r13, qword [rsp + 0xf0]
xor esi, esi
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
jmp 0x1403e54a9
mov qword [rsp + 0x48], rdx
mov r14b, 1
call fcn.14043d530
mov rdx, qword [rsp + 0x48]
mov r15d, eax
movsxd r9, r15d
cmp dword [0x141a6ae3c], 0
je 0x1403e56e6
test r12b, r12b
je 0x1403e56e6
test r13b, r13b
jne 0x1403e56c4
jmp 0x1403e56e6
mov r14b, 1
mov r9, rdx
test r13b, r13b
jne 0x1403e56c4
mov r15d, edx
jmp 0x1403e56e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1403e5908
mov qword [rsp + 0x50], 0xffffffffffffffff
jmp 0x1403e5908
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a8], eax
and byte [rbx + 0x29d], 0xfe
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b87
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1403e5a3c
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov qword [rsp + 0x58], 0xffffffffffffffff
jmp 0x1403e59cb
mov rcx, qword [rsp + 0x58]
jmp 0x1403e58cf
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp dword [rbx + 0x1e0], 0xfffffffc
je 0x1403e5a9f
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
call fcn.140384990
cmp eax, 1
jle 0x1403e5a76
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x30d
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov dword [rbx + 0x1a8], r12d
cmp r12d, 0x26
jne 0x1403e5b49
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x18
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp r12d, 0x6d
jne 0x1403e5b63
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, qword [rbx + 0x1a0]
je 0x1403e5b99
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x27
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x1403e5824
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x48], rdx
call fcn.140384990
mov rdx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x38]
cmp eax, 1
jle 0x1403e5689
mov ebp, 1
jmp 0x1403e580e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a8], eax
and byte [rbx + 0x29d], 0xfe
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b87
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1403e5492
mov qword [rsp + 0x70], 0xffffffffffffffff
jmp 0x1403e5492
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1403e5c73
mov qword [rsp + 0x68], 0xffffffffffffffff
mov r12, 0xffffffffffffffff
jmp 0x1403e5463
mov r12, qword [rsp + 0x68]
jmp 0x1403e5463
test byte [rbx + 0x29a], 0x20
je 0x1403e5254
mov r9b, byte [rbx + 0x298]
xor bpl, bpl
and r9b, 0x80
xor r14d, r14d
mov r8b, byte [rbx + 0x299]
shr r9b, 7
and r8b, 1
mov r13, qword [rbx + 0x1a0]
mov r12, qword [rbx + 0x78]
mov r15, qword [rbx + 0x248]
cmp dword [rbx + 0x40], 0xfffffffc
je 0x1403e64f1
cmp dword [0x141a6ae3c], 0
je 0x1403e5d66
lea rax, [r15 - 1]
cmp rax, 1
ja 0x1403e5ce4
xor ebp, ebp
jmp 0x1403e5e4d
test r9b, r9b
je 0x1403e5d5d
cmp r15, 0xfffffffffffffffa
je 0x1403e6145
test r15, r15
je 0x1403e60fc
test r8b, r8b
je 0x1403e5d66
mov dword [rsp + 0x78], ecx
call fcn.14043d2b0
mov ecx, dword [rsp + 0x78]
call fcn.14043d430
test bpl, bpl
je 0x1403e5d66
mov rcx, r12
mov edx, 4
mov r8d, dword [rsp + 0x78]
call fcn.14043d350
movsxd r14, eax
cmp eax, 0xffffffff
je 0x1403e5cdd
lea rcx, [0x14059fd50]
mov edx, 2
xor r9d, r9d
mov r8d, dword [rsp + 0x78]
call fcn.14043d310
mov byte [r14 + r12], 0xa
inc r14
mov ebp, 1
jmp 0x1403e5e4d
test r15, r15
je 0x1403e60fc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rbx + 0x240]
xor r14d, r14d
test rbp, rbp
je 0x1403e5e1e
cmp rbp, 4
jae 0x1403e5e1e
test r15, r15
je 0x1403e5e1e
mov r15d, 0x20000
test rbp, rbp
mov qword [rsp + 0xa0], rsi
cmove rbp, r15
mov eax, 4
mov qword [rsp + 0xa8], rdi
mov rsi, rax
mov r10, rsp
mov rdi, rbp
mov rcx, r13
mov rdx, r12
mov r8d, ebp
lea r9, [rsp + 0x60]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1403e5e0c
mov r8, qword [rbx + 0x240]
test r8, r8
movsxd r9, dword [rsp + 0x60]
cmove r8, r15
sub rsi, r9
cmp rsi, r8
cmovbe rbp, rsi
add r12, r9
add r14, r9
test rsi, rsi
je 0x1403e5e0c
cmp r9, rdi
je 0x1403e5db9
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
jmp 0x1403e5e45
mov rax, rsp
mov rcx, r13
mov rdx, r12
mov r8d, 4
lea r9, [rsp + 0x60]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd r14, dword [rsp + 0x60]
xor ebp, ebp
test eax, eax
setne bpl
mov rax, r14
add rax, qword [rbx + 0x78]
mov qword [rbx + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp r12d, 0x3e3
je 0x1403e64e3
test ebp, ebp
je 0x1403e6400
test r14, r14
je 0x1403e6374
mov r15b, byte [rbx + 0x298]
xor r8b, r8b
and r15b, 0x80
xor ebp, ebp
mov r9b, byte [rbx + 0x299]
shr r15b, 7
and r9b, 1
mov r14, qword [rbx + 0x1a0]
mov r13, qword [rbx + 0x78]
mov r12, qword [rbx + 0x248]
cmp dword [rbx + 0x40], 0xfffffffc
je 0x1403e633d
cmp dword [0x141a6ae3c], 0
je 0x1403e5f6f
lea rax, [r12 - 1]
cmp rax, 1
ja 0x1403e5edd
xor r13d, r13d
jmp 0x1403e6056
test r15b, r15b
je 0x1403e5f66
cmp r12, 0xfffffffffffffffa
je 0x1403e61a7
test r12, r12
je 0x1403e615e
test r9b, r9b
je 0x1403e5f6f
mov dword [rsp + 0x70], ecx
mov byte [rsp + 0x68], r8b
call fcn.14043d2b0
mov ecx, dword [rsp + 0x70]
call fcn.14043d430
mov r8b, byte [rsp + 0x68]
test r8b, r8b
je 0x1403e5f6f
mov rcx, r13
mov edx, 4
mov r8d, dword [rsp + 0x70]
call fcn.14043d350
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1403e5ed5
lea rcx, [0x14059fd50]
mov edx, 2
xor r9d, r9d
mov r8d, dword [rsp + 0x70]
call fcn.14043d310
mov byte [rbp + r13], 0xa
inc rbp
mov r13d, 1
jmp 0x1403e6056
test r12, r12
je 0x1403e615e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [rbx + 0x240]
xor ebp, ebp
test r15, r15
je 0x1403e6026
cmp r15, 4
jae 0x1403e6026
test r12, r12
je 0x1403e6026
mov r12d, 0x20000
test r15, r15
mov qword [rsp + 0xa0], rsi
cmove r15, r12
mov eax, 4
mov qword [rsp + 0xa8], rdi
mov rsi, rax
mov r10, rsp
mov rdi, r15
mov rcx, r14
mov rdx, r13
mov r8d, r15d
lea r9, [rsp + 0x44]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1403e6014
mov r8, qword [rbx + 0x240]
test r8, r8
movsxd r9, dword [rsp + 0x44]
cmove r8, r12
sub rsi, r9
cmp rsi, r8
cmovbe r15, rsi
add r13, r9
add rbp, r9
test rsi, rsi
je 0x1403e6014
cmp r9, rdi
je 0x1403e5fc1
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
jmp 0x1403e604d
mov rax, rsp
mov rcx, r14
mov rdx, r13
mov r8d, 4
lea r9, [rsp + 0x44]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rbp, dword [rsp + 0x44]
xor r13d, r13d
test eax, eax
setne r13b
mov rax, rbp
add rax, qword [rbx + 0x78]
mov qword [rbx + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp r12d, 0x3e3
je 0x1403e632f
test r13d, r13d
je 0x1403e624c
test rbp, rbp
je 0x1403e61c0
mov rax, qword [rbx + 0x78]
test byte [rbx + 0x295], 0x20
movzx r9d, byte [rax]
movzx r8d, byte [rax + 1]
movzx ebp, byte [rax + 2]
movzx eax, byte [rax + 3]
je 0x1403e60bf
shl ebp, 8
shl r8d, 0x10
or eax, ebp
shl r9d, 0x18
or eax, r8d
or eax, r9d
jmp 0x1403e60d2
shl r8d, 8
shl ebp, 0x10
or r9d, r8d
shl eax, 0x18
or r9d, ebp
or eax, r9d
movsxd rax, eax
test rax, rax
jl 0x1403e60ed
mov qword [rbx + 0x260], rax
and byte [rbx + 0x29a], 0xdf
jmp 0x1403e5254
neg rax
mov qword [rbx + 0x260], rax
jmp 0x1403e5254
mov byte [rsp + 0x48], r8b
mov bpl, 1
mov byte [rsp + 0x50], r9b
call fcn.14043d530
mov r9b, byte [rsp + 0x50]
mov r8b, byte [rsp + 0x48]
mov dword [rsp + 0x78], eax
movsxd rcx, dword [rsp + 0x78]
cmp dword [0x141a6ae3c], 0
je 0x1403e5d18
test r9b, r9b
je 0x1403e5d18
test r8b, r8b
jne 0x1403e5d01
jmp 0x1403e5d18
mov bpl, 1
mov rcx, r13
test r8b, r8b
jne 0x1403e5d01
mov dword [rsp + 0x78], r13d
jmp 0x1403e5d18
mov r8b, 1
mov byte [rsp + 0x68], r8b
mov byte [rsp + 0x30], r9b
call fcn.14043d530
mov r9b, byte [rsp + 0x30]
mov r8b, byte [rsp + 0x68]
mov dword [rsp + 0x70], eax
movsxd rcx, dword [rsp + 0x70]
cmp dword [0x141a6ae3c], 0
je 0x1403e5f1f
test r15b, r15b
je 0x1403e5f1f
test r9b, r9b
jne 0x1403e5efe
jmp 0x1403e5f1f
mov r8b, 1
mov rcx, r14
test r9b, r9b
jne 0x1403e5efe
mov dword [rsp + 0x70], r14d
jmp 0x1403e5f1f
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp dword [rbx + 0x1e0], 0xfffffffc
je 0x1403e6219
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
call fcn.140384990
cmp eax, 1
jle 0x1403e61f0
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5acd
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov dword [rbx + 0x1a8], r12d
cmp r12d, 0x26
jne 0x1403e62b6
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x18
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp r12d, 0x6d
jne 0x1403e62d0
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, qword [rbx + 0x1a0]
je 0x1403e6306
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x27
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x1403e607a
mov qword [rsp + 0x38], rcx
mov byte [rsp + 0x68], r8b
mov byte [rsp + 0x30], r9b
call fcn.140384990
mov r9b, byte [rsp + 0x30]
mov r8b, byte [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
cmp eax, 1
jle 0x1403e5ebd
mov r13d, 1
jmp 0x1403e6056
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp dword [rbx + 0x1e0], 0xfffffffc
je 0x1403e63cd
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
call fcn.140384990
cmp eax, 1
jle 0x1403e63a4
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5acd
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov dword [rbx + 0x1a8], r12d
cmp r12d, 0x26
jne 0x1403e646a
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x18
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp r12d, 0x6d
jne 0x1403e6484
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, qword [rbx + 0x1a0]
je 0x1403e64ba
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x27
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x1403e5e71
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x48], r8b
mov byte [rsp + 0x50], r9b
call fcn.140384990
mov r9b, byte [rsp + 0x50]
mov r8b, byte [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
cmp eax, 1
jle 0x1403e5cc6
mov ebp, 1
jmp 0x1403e5e4d
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp dword [rbx + 0x1e0], 0xfffffffc
je 0x1403e6580
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
call fcn.140384990
cmp eax, 1
jle 0x1403e6557
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5acd
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov dword [rbx + 0x1a8], r12d
cmp r12d, 0x26
jne 0x1403e661d
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x18
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp r12d, 0x6d
jne 0x1403e6637
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, qword [rbx + 0x1a0]
je 0x1403e666d
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x27
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x1403e522e
and byte [rbx + 0x29d], 0xfe
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b87
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
cmp dword [rbx + 0x1e0], 0xfffffffc
je 0x1403e674d
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
call fcn.140384990
cmp eax, 1
jle 0x1403e6724
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5acd
and byte [rbx + 0x29d], 0xfe
mov r13, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov dword [rbx + 0x1a8], eax
cmp eax, 0x26
jne 0x1403e67e8
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x18
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp eax, 0x6d
jne 0x1403e6801
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, qword [rbx + 0x1a0]
je 0x1403e6837
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
mov eax, 0x27
add rsp, 0x108
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x100], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x1403e5621
jmp 0x1403e5b37
mov dword [rsp + 0x80], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x80]
jmp 0x1403e51ea
mov qword [rsp + 0xc0], rcx
mov byte [rsp + 0xc8], r10b
mov byte [rsp + 0xb0], r8b
mov byte [rsp + 0xb8], r9b
mov qword [rsp + 0xd0], rdx
call fcn.140384990
mov rdx, qword [rsp + 0xd0]
mov r9b, byte [rsp + 0xb8]
mov r8b, byte [rsp + 0xb0]
mov r10b, byte [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
cmp eax, 1
jle 0x1403e4fb2
mov r13d, 1
jmp 0x1403e51a8