Function at 0x7fff25d947e8
Capabilities:
Check os version
Get file attributes
Set file attributes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1200
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x11f0], rax
mov qword [rsp + 0xb8], r9
mov dword [rsp + 0x1cc], r8d
mov r14, rdx
mov qword [rsp + 0xb0], rdx
mov rax, rcx
mov qword [rsp + 0x200], rcx
mov qword [rsp + 0x330], rcx
mov qword [rsp + 0x3c0], rdx
mov r12, qword [rsp + 0x1260]
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0x328], r12
mov rax, qword [rsp + 0x1270]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x3b8], rax
mov r13, qword [rsp + 0x1278]
mov qword [rsp + 0x148], r13
mov rax, qword [rsp + 0x1280]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x3d0], rax
mov rax, qword [rsp + 0x1288]
mov qword [rsp + 0x3b0], rax
mov qword [rsp + 0x3d8], rax
mov rdi, qword [rsp + 0x1290]
mov qword [rsp + 0x1d8], rdi
mov rsi, qword [rsp + 0x1298]
mov rax, qword [rsp + 0x12a0]
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x3c8], rax
mov rax, qword [rsp + 0x12c0]
mov qword [rsp + 0x2d0], rax
or qword [rsp + 0x90], 0xffffffffffffffff
xor r15d, r15d
mov dword [rsp + 0x1a0], r15d
mov dword [rsp + 0x1e8], r15d
mov qword [rsp + 0x210], r15
mov qword [rsp + 0xd0], r15
mov dword [rsp + 0xe4], r15d
mov dword [rsp + 0xfc], r15d
mov qword [rsp + 0x1f0], r15
mov qword [rsp + 0x270], r15
mov dword [rsp + 0xf4], r15d
mov dword [rsp + 0x168], r15d
mov rbx, qword [rsi]
mov qword [rsp + 0x128], rbx
xor edx, edx
lea r8d, [r15 + 0x40]
lea rcx, [rsp + 0x340]
call sub.ntdll.dll_memset
mov dword [rsp + 0xf8], r15d
mov qword [rsp + 0x290], r15
mov dword [rsp + 0xd8], r15d
mov dword [rsp + 0xe8], r15d
mov dword [rsp + 0x1c8], r15d
mov dword [rsp + 0x1d0], r15d
mov dword [rsp + 0x1d4], r15d
mov dword [rsp + 0xec], r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x3f0], xmm0
mov qword [rsp + 0x298], r15
mov qword [rsp + 0x240], r15
mov dword [rsp + 0x260], r15d
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0xfe0]
call sub.ntdll.dll_memset
mov dword [rsp + 0x19c], r15d
mov dword [rsp + 0x11c], r15d
mov dword [rsp + 0x178], r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x2e8], xmm0
movups xmmword [rsp + 0x2f8], xmm0
mov dword [rsp + 0x280], r15d
xorps xmm1, xmm1
movups xmmword [rsp + 0x598], xmm1
movups xmmword [rsp + 0x5a8], xmm1
mov qword [rsp + 0x2d8], r15
xor eax, eax
mov qword [rsp + 0x4f0], rax
mov dword [rsp + 0x4f8], eax
mov qword [rsp + 0x110], r15
mov dword [rsp + 0x258], r15d
mov dword [rsp + 0x25c], r15d
mov dword [rsp + 0x158], r15d
mov eax, dword [r13]
and eax, 0x11000
mov dword [rsp + 0x104], eax
mov dword [rsp + 0x248], r15d
lea edx, [r15 + 1]
mov qword [rsp + 0x208], r15
xor eax, eax
movups xmmword [rsp + 0x510], xmm0
movups xmmword [rsp + 0x520], xmm0
mov dword [rsp + 0x530], eax
mov dword [rsp + 0x190], r15d
mov dword [rsp + 0x22c], r15d
mov dword [rsp + 0x250], r15d
mov dword [rsp + 0x16c], r15d
mov dword [rsp + 0x1ec], r15d
mov dword [rsp + 0x228], r15d
mov dword [rsp + 0x1f8], edx
mov eax, dword [r13]
and eax, 0x4000000
setne r15b
mov dword [rsp + 0x1b8], r15d
mov ecx, dword [r13]
and ecx, 0x8000000
mov dword [rsp + 0x164], ecx
xor r10d, r10d
mov qword [rsp + 0x278], r10
mov dword [rsp + 0x154], edx
mov r9d, 0x40000
mov r8, qword [rsp + 0xa0]
test dword [r13], r9d
jne 0x7fff25df1898
mov ecx, edx
cmp qword [r8], r9
cmovl ecx, r10d
mov dword [rsp + 0x198], ecx
mov dword [rsp + 0x1c0], ecx
test eax, eax
jne 0x7fff25d94b64
test r8, r8
je 0x7fff25d94b64
mov rax, r10
cmp qword [r8], 0x1000
cmovge rax, r8
mov qword [rsp + 0x110], rax
mov dword [rdi], 0x10000
mov rax, qword gs:[0x30]
add rax, 0x1268
cmp qword [rsp + 0x200], rax
je 0x7fff25df18a0
mov rdi, qword [rsp + 0x128]
test rbx, rbx
je 0x7fff25d94bce
mov dword [rdi + 0x30], 2
mov rax, qword [r8]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], r10
add dword [rdi + 0x10], edx
mov dword [rdi + 0x14], edx
mov dword [rdi + 0x18], 0x4d3
mov rax, qword [r14]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x50], r10
mov qword [rdi + 0x60], r10
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x4b8]
lea rdx, [rsp + 0x130]
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
xor edx, edx
mov eax, edx
test ebx, ebx
cmovns eax, dword [rsp + 0x4d8]
mov dword [rsp + 0xcc], eax
mov dword [rsp + 0x1a4], eax
mov ecx, eax
and ecx, 0x4010
cmp ecx, 0x4000
je 0x7fff25df193b
test r12, r12
jne 0x7fff25df1962
test ebx, ebx
js 0x7fff25df1954
mov eax, dword [r13]
mov ebx, dword [rsp + 0xcc]
test al, 2
jne 0x7fff25df196e
mov dword [rsp + 0x1c4], edx
mov dword [rsp + 0xf0], edx
mov r14d, edx
mov dword [rsp + 0x1bc], r14d
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
nop dword [rax + rax]
xor r10d, r10d
test r12, r12
jne 0x7fff25d980ed
mov dword [rsp + 0x100], r10d
mov qword [rsp + 0x308], r10
mov dword [rsp + 0x254], r10d
test r14d, r14d
jne 0x7fff25d9713e
test dword [r13], 0x4000
jne 0x7fff25d9713e
mov r13d, r15d
cmp qword [rsp + 0x90], 0xffffffffffffffff
jne 0x7fff25d98099
mov rdx, qword [rsp + 0x148]
mov ecx, dword [rdx]
mov eax, ecx
mov r11d, 0xffffbfff
and eax, r11d
mov dword [rdx], eax
mov r13d, dword [0x7fff25fd2338]
mov eax, 0x20
test r14d, r14d
cmovne r13d, eax
mov dword [0x7fff25fd2338], r13d
mov dword [rsp + 0x100], r10d
mov r8d, ebx
and r8d, 0x10
jne 0x7fff25d96650
or r13d, 0x44
mov dword [rsp + 0x100], r13d
test ecx, 0x11000
jne 0x7fff25d9720d
test ecx, 0x140
jne 0x7fff25d96c76
mov edx, ecx
mov r9d, 1
and edx, r9d
test r8d, r8d
jne 0x7fff25d96663
mov eax, edx
neg eax
sbb esi, esi
and esi, 0xfffffffd
add esi, 5
mov dword [rsp + 0x124], esi
mov r12d, 0xc0110080
mov dword [rsp + 0x118], r12d
bt ecx, 0x19
mov eax, 0xc0150080
cmovae r12d, eax
mov dword [rsp + 0x118], r12d
test r8d, r8d
jne 0x7fff25d96670
test ecx, 0x2010
mov r14d, dword [rsp + 0x11c]
cmovne r14d, r9d
mov dword [rsp + 0x11c], r14d
test ecx, 0x2040
jne 0x7fff25d97216
test ecx, 0x2020
jne 0x7fff25d97228
mov dword [rsp + 0x174], 0x1000000
or eax, 0xffffffff
mov dword [rsp + 0x15c], eax
bt ecx, 0x17
cmovb eax, r11d
mov dword [rsp + 0xc8], eax
mov dword [rsp + 0x15c], eax
cmp dword [rsp + 0x12a8], r10d
jne 0x7fff25d97254
mov dword [rsp + 0x1b8], r13d
mov dword [rsp + 0x2e4], esi
mov r14, qword [rsp + 0xb8]
mov rdx, r14
lea rcx, [rsp + 0x468]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d97292
movzx eax, word [rsp + 0x468]
shr rax, 1
movzx eax, word [r14 + rax*2 - 2]
mov word [rsp + 0x230], ax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x3f0]
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
js 0x7fff25d972d2
mov rax, qword [rsp + 0x3f8]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rax
mov dword [rsp + 0x380], 0x30
mov qword [rsp + 0x388], rcx
mov dword [rsp + 0x398], 0x40
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x390], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x3a0], xmm0
mov word [rsp + 0x4e8], 0x101
mov dword [rsp + 0x4e4], 2
mov dword [rsp + 0x4e0], 0xc
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x3a8], rax
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x240], rcx
mov dword [rsp + 0x120], ecx
mov dword [rsp + 0x1e0], ecx
mov dword [rsp + 0x20], 7
lea r9d, [rcx + 4]
lea r8, [rsp + 0x2a4]
lea rdx, [rsp + 0x218]
mov r14, qword [rsp + 0xb0]
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
js 0x7fff25d94f67
mov ebx, dword [rsp + 0x2a4]
test ebx, ebx
jne 0x7fff25d9693a
mov ebx, dword [rsp + 0xcc]
mov r8d, dword [rsp + 0xc8]
mov eax, r10d
mov r14d, r12d
mov dword [rsp + 0xdc], r12d
mov dword [rsp + 0x108], r12d
mov dword [rsp + 0xe0], r10d
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x308], rcx
mov dword [rsp + 0x254], eax
btr ebx, 0xc
mov dword [rsp + 0xcc], ebx
mov dword [rsp + 0x1a4], ebx
mov dword [rsp + 0x238], ebx
mov eax, ebx
and eax, 0x4010
mov ecx, 0x4000
cmp eax, ecx
je 0x7fff25d9736d
cmp dword [rsp + 0x190], r10d
jne 0x7fff25d95034
call fcn.7fff25dd0420
xor r10d, r10d
test al, al
je 0x7fff25d9501d
lea rcx, [rsp + 0x16c]
call fcn.7fff25d941f4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
xor r10d, r10d
test eax, eax
jg 0x7fff25d9756c
js 0x7fff25d9501d
cmp dword [rsp + 0x16c], r10d
jne 0x7fff25d9757b
mov eax, r10d
mov ecx, 1
mov dword [rsp + 0x250], eax
test eax, eax
jne 0x7fff25d97587
mov dword [rsp + 0x16c], r15d
mov dword [rsp + 0x194], r15d
mov eax, dword [rsp + 0x258]
mov dword [rsp + 0x150], eax
mov eax, dword [rsp + 0x25c]
mov dword [rsp + 0x1a8], eax
mov r15d, 1
mov rcx, qword [rsp + 0x110]
mov r8d, dword [rsp + 0xe0]
mov edx, dword [rsp + 0xc8]
mov rax, qword [rsp + 0x90]
inc rax
test rax, 0xfffffffffffffffe
jne 0x7fff25d97c6f
mov eax, r13d
shr eax, 3
and eax, r15d
mov dword [rsp + 0x104], eax
mov r15d, edx
and r15d, ebx
and r15d, 0x5affb7
or r14d, 1
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x380]
mov edx, r14d
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
mov rcx, qword [rsp + 0x110]
cmp eax, 0xc000007f
je 0x7fff25d975c2
cmp dword [rsp + 0x1ec], r10d
jne 0x7fff25d97604
test eax, eax
js 0x7fff25d96bcb
mov eax, 1
mov dword [rsp + 0x11c], eax
mov dword [rsp + 0xdc], r14d
mov dword [rsp + 0x108], r14d
test ebx, ebx
js 0x7fff25d96be6
cmp dword [rsp + 0x250], r10d
jne 0x7fff25d97652
test ebx, ebx
js 0x7fff25d96be6
mov r14d, dword [rsp + 0xcc]
and r14d, 0x10
jne 0x7fff25d96691
test r14d, r14d
jne 0x7fff25d967da
mov dword [rsp + 0x20], 4
mov r9d, 8
lea r8, [rsp + 0x3e0]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
js 0x7fff25d97a29
mov ebx, dword [rsp + 0x3e4]
test bl, 0x10
jne 0x7fff25d97a3c
mov esi, r10d
mov dword [rsp + 0x150], r10d
mov dword [rsp + 0x258], esi
and ebx, 0x10000
mov r15, qword [rsp + 0xa0]
test esi, esi
jne 0x7fff25d97a59
mov dword [rsp + 0x158], r10d
test ebx, ebx
jne 0x7fff25d97a85
mov r15d, dword [rsp + 0x1a8]
lea ecx, [rbx + 1]
cmp dword [rsp + 0x1bc], r10d
jne 0x7fff25d95283
test r13b, 8
jne 0x7fff25d95283
mov eax, r10d
test esi, esi
sete al
mov dword [rsp + 0x1a0], eax
mov eax, r13d
and eax, 0x20
test esi, esi
jne 0x7fff25d97ab7
test eax, eax
je 0x7fff25d96b42
cmp dword [rsp + 0x158], r10d
jne 0x7fff25d96b42
test r15d, r15d
jne 0x7fff25d96b42
test esi, esi
jne 0x7fff25d97acc
mov r15d, dword [rsp + 0xcc]
mov esi, 1
mov r12d, dword [rsp + 0xc8]
test sil, r15b
jne 0x7fff25d97bd1
mov r14d, dword [rsp + 0xdc]
cmp dword [rsp + 0x260], r10d
jne 0x7fff25d97c89
cmp dword [rsp + 0x12a8], r10d
jne 0x7fff25d97d0d
mov rsi, qword [rsp + 0x2d0]
mov dword [rsi], r10d
mov dword [rsp + 0xec], r10d
xor edx, edx
mov r8d, 0x218
lea rcx, [rsp + 0x890]
call sub.ntdll.dll_memset
xor edx, edx
mov r8d, 0x218
lea rcx, [rsp + 0xab0]
call sub.ntdll.dll_memset
mov dword [rsp + 0x20], 5
mov r9d, 0x218
lea r8, [rsp + 0xab0]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d95348
mov eax, dword [rsp + 0xab0]
mov dword [rsi], eax
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x558]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
mov ecx, dword [rsp + 0xec]
test eax, eax
cmovns ecx, dword [rsp + 0x578]
mov dword [rsp + 0xec], ecx
mov dword [rsp + 0x20], 5
mov r9d, 0x218
lea r8, [rsp + 0x890]
lea rdx, [rsp + 0x130]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
js 0x7fff25d97a29
lea eax, [r10 + 1]
mov dword [rsp + 0x248], eax
mov rbx, qword [rsp + 0xb0]
test byte [rsp + 0x890], 8
je 0x7fff25d95470
mov ecx, dword [rsp + 0x12b8]
test ecx, ecx
je 0x7fff25d95470
mov dword [rsp + 0x24c], r10d
mov dword [rsp + 0x50], r10d
lea rax, [rsp + 0x24c]
mov qword [rsp + 0x48], rax
mov eax, dword [rsi]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r14d
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb8]
mov r8d, dword [rsp + 0x1cc]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x200]
call fcn.7fff25d9176c
xor r10d, r10d
test eax, eax
je 0x7fff25d97df1
mov rax, qword [rsp + 0x148]
mov ecx, dword [rax]
test cl, 0x10
jne 0x7fff25d96e8c
lea rax, [rsp + 0x510]
mov qword [rsp + 0x88], rax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x128]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x22c]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
mov eax, dword [rsi]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0xec]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r13d
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0x380]
lea r8, [rsp + 0x90]
mov r13, qword [rsp + 0xb8]
mov rdx, r13
mov rcx, qword [rbx]
call fcn.7fff25d91bd8
mov dword [rsp + 0xd8], eax
xor r10d, r10d
mov rdi, qword [rsp + 0x128]
test eax, eax
je 0x7fff25d9808c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.KERNELBASE.dll_CreateEventA
mov rbx, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [rsi]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsp + 0xec]
mov r8d, r15d
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
call fcn.7fff25d920d8
mov rcx, rbx
call sym.KERNELBASE.dll_CloseHandle
mov rax, qword [rsp + 0x148]
test dword [rax], 0x200
setne cl
test r15b, 0x10
setne al
test al, cl
jne 0x7fff25d96895
mov r13d, dword [rsp + 0x16c]
xor r10d, r10d
mov r9d, dword [rsp + 0x238]
mov edx, r9d
and edx, 0x10
mov r8d, dword [rsp + 0xec]
cmp r15d, r8d
jne 0x7fff25d96a56
mov r9d, r15d
mov ecx, 0xffff0000
and r9d, ecx
jne 0x7fff25d98040
mov r12d, 0x100000
mov r14, qword [rsp + 0x148]
test dword [r14], r12d
sete cl
test r15b, 0x10
sete al
test al, cl
jne 0x7fff25d95d57
mov esi, 1
mov dword [rsp + 0x1e8], esi
test rdi, rdi
je 0x7fff25d980b1
mov dword [rdi + 0x30], 4
mov dword [rdi + 0x14], esi
mov ecx, 0xc0000240
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov dword [rdi + 0x18], eax
xor eax, eax
mov qword [rdi + 0x40], rax
mov r15, qword [rsp + 0xb0]
mov rax, qword [r15]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov rdx, rdi
mov ecx, 3
call sym.KERNELBASE.dll_BasepCopyFileCallback
xor r10d, r10d
test eax, eax
je 0x7fff25d980be
mov rcx, rdi
call fcn.7fff25d946e8
xor r10d, r10d
test eax, eax
jne 0x7fff25d980be
mov dword [rsp + 0xe8], esi
jmp 0x7fff25d95ce8
test rdi, rdi
je 0x7fff25d956a7
cmp qword [rdi + 0x80], r10
jne 0x7fff25d9989d
mov rax, qword [rsp + 0x148]
test dword [rax], 0x10000000
jne 0x7fff25d99914
xor r12d, r12d
test esi, esi
jne 0x7fff25d99dde
mov rax, qword [rsp + 0x1d8]
mov r15d, dword [rax]
mov dword [rsp + 0x178], r15d
mov dword [rsp + 0x234], r15d
mov dword [rsp + 0xe4], r12d
mov ebx, r12d
mov dword [rsp + 0x160], ebx
lea eax, [rsi + 1]
mov dword [rsp + 0xd8], eax
movsxd r13, dword [rsp + 0x1a0]
lea r8, [rsp + 0x270]
lea rcx, [rsp + 0xee0]
call fcn.7fff25d9472c
mov r14d, eax
mov dword [rsp + 0xd8], eax
test eax, eax
je 0x7fff25d95c73
mov rsi, qword [rsp + 0x270]
mov eax, dword [rsi + 0x10]
test eax, eax
je 0x7fff25d95908
sub eax, 1
je 0x7fff25d95ac3
cmp eax, 1
jne 0x7fff25d99967
test rdi, rdi
je 0x7fff25d9575d
mov dword [rdi + 0x30], 4
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp qword [rcx + 8], rsi
jne 0x7fff25d99da3
cmp qword [rax], rsi
jne 0x7fff25d99da3
mov qword [rax], rcx
mov qword [rcx + 8], rax
lea rdx, [rsi + 0x30]
mov dword [rsp + 0x20], r12d
or r9d, 0xffffffff
lea r8, [rsp + 0xe4]
mov ecx, 1
call sym.KERNELBASE.dll_GetOverlappedResultEx
mov r14d, eax
mov dword [rsp + 0xd8], eax
xor r10d, r10d
test eax, eax
je 0x7fff25d99a3e
mov eax, dword [rsi + 0x28]
cmp dword [rsp + 0xe4], eax
ja 0x7fff25d99a58
mov ebx, dword [rsp + 0xe4]
add qword [rsp + 0xd0], rbx
xor r12d, r12d
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0xf8], 0x283e
test rdi, rdi
je 0x7fff25d95872
add qword [rdi + 8], rbx
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov eax, 1
mov dword [rdi + 0x14], eax
mov dword [rdi + 0x18], 0x4d3
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x48], rbx
mov rdx, rdi
mov ecx, 2
call sym.KERNELBASE.dll_BasepCopyFileCallback
test eax, eax
je 0x7fff25d99b52
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
jne 0x7fff25d99b52
mov dword [rsp + 0xf8], r12d
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
mov eax, r15d
imul eax, dword [rsp + 0xfc]
add qword [rsi + 0x18], rax
mov dword [rsi + 0x28], r15d
xor r10d, r10d
mov dword [rsi + 0x10], r10d
mov rax, qword [rsp + 0xee8]
lea rcx, [rsp + 0xee0]
cmp qword [rax], rcx
jne 0x7fff25d99da3
lea rcx, [rsp + 0xee0]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov qword [rax], rsi
mov qword [rsp + 0xee8], rsi
mov eax, dword [rsp + 0xf4]
mov ebx, dword [rsp + 0x160]
mov r11d, 1
test r14d, r14d
je 0x7fff25d99c83
mov r15d, dword [rsp + 0x178]
xor r12d, r12d
jmp 0x7fff25d95705
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp qword [rcx + 8], rsi
jne 0x7fff25d99da3
cmp qword [rax], rsi
jne 0x7fff25d99da3
mov qword [rax], rcx
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0xf8], 0x26e9
test ebx, ebx
jne 0x7fff25d95d0d
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx]
cmp qword [rsi + 0x18], rax
jge 0x7fff25d95d0d
mov eax, dword [rsi + 0x18]
mov dword [rsi + 0x40], eax
mov eax, dword [rsi + 0x1c]
mov dword [rsi + 0x44], eax
test rdi, rdi
je 0x7fff25d95a1c
mov dword [rdi + 0x30], 3
mov rax, qword [rdi + 0x60]
mov qword [rsi + 0x20], rax
lea r14d, [rbx + 1]
add qword [rdi + 0x60], r14
mov rax, qword [rcx]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x14], r14d
mov dword [rdi + 0x18], 0x4d3
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x50], rax
mov rcx, qword [rcx]
sub rcx, qword [rsi + 0x18]
mov eax, r15d
cmp rax, rcx
cmovg rax, rcx
mov qword [rdi + 0x48], rax
cmp dword [rsp + 0x154], r12d
je 0x7fff25d95a04
mov rdx, rdi
mov ecx, r14d
call sym.KERNELBASE.dll_BasepCopyFileCallback
test eax, eax
je 0x7fff25d99c07
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
jne 0x7fff25d99c07
mov dword [rsp + 0x154], r14d
lea rcx, [rsi + 0x30]
mov edx, dword [rsi + 0x14]
imul edx, r15d
add rdx, qword [rsp + 0x210]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, r15d
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
call sym.KERNELBASE.dll_ReadFile
mov r14d, eax
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xf8], r12d
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
xor r10d, r10d
test r14d, r14d
je 0x7fff25d99c2a
mov eax, dword [rsp + 0xf4]
lea r11d, [r10 + 1]
mov dword [rsi + 0x10], r11d
mov rcx, qword [rsp + 0xef8]
lea rdx, [rsp + 0xef0]
cmp qword [rcx], rdx
jne 0x7fff25d99da3
lea rdx, [rsp + 0xef0]
mov qword [rsi], rdx
mov qword [rsi + 8], rcx
mov qword [rcx], rsi
mov qword [rsp + 0xef8], rsi
jmp 0x7fff25d958ef
test rdi, rdi
je 0x7fff25d95acf
mov dword [rdi + 0x30], 3
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp qword [rcx + 8], rsi
jne 0x7fff25d99da3
cmp qword [rax], rsi
jne 0x7fff25d99da3
mov qword [rax], rcx
mov qword [rcx + 8], rax
lea rdx, [rsi + 0x30]
mov dword [rsp + 0x20], r12d
or r9d, 0xffffffff
lea r8, [rsp + 0xe4]
mov ecx, 1
call sym.KERNELBASE.dll_GetOverlappedResultEx
mov r14d, eax
mov dword [rsp + 0xd8], eax
test eax, eax
je 0x7fff25d99b6d
mov ebx, dword [rsp + 0xe4]
cmp dword [rsp + 0x104], r12d
jne 0x7fff25d99b87
mov r12d, ebx
cmp r12d, ebx
ja 0x7fff25d99ba6
mov dword [rsi + 0x28], ebx
mov r15d, r12d
xor ecx, ecx
test r13, r13
mov eax, 0x100000
cmovne r15d, eax
mov dword [rsp + 0x2bc], r15d
mov rbx, qword [rsi + 0x18]
mov qword [rsp + 0x318], rbx
mov r13d, ecx
mov dword [rsp + 0x2b4], ecx
mov eax, r12d
sub eax, r13d
cmp r15d, eax
cmova r15d, eax
mov dword [rsp + 0x2bc], r15d
mov dword [rsi + 0x40], ebx
mov eax, dword [rsp + 0x31c]
mov dword [rsi + 0x44], eax
mov ecx, dword [rsp + 0x178]
imul ecx, dword [rsi + 0x14]
mov edx, r13d
mov rax, qword [rsp + 0x210]
add rax, rcx
add rdx, rax
lea rax, [rsi + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, r15d
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_WriteFile
mov r14d, eax
mov dword [rsp + 0xd8], eax
test eax, eax
je 0x7fff25d99bcd
add r13d, r15d
mov dword [rsp + 0x2b4], r13d
mov eax, r15d
add rbx, rax
mov qword [rsp + 0x318], rbx
cmp r13d, r12d
jb 0x7fff25d95b74
mov eax, dword [rsp + 0xf4]
xor r10d, r10d
test r14d, r14d
je 0x7fff25d95c66
movsxd rax, dword [rsp + 0x1a0]
test rax, rax
je 0x7fff25d95c25
mov eax, r13d
mov qword [rsi + 0x38], rax
mov dword [rsi + 0x10], 2
mov rax, qword [rsp + 0xf08]
lea rcx, [rsp + 0xf00]
cmp qword [rax], rcx
jne 0x7fff25d99da3
lea rcx, [rsp + 0xf00]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov qword [rax], rsi
mov qword [rsp + 0xf08], rsi
mov eax, dword [rsp + 0xf4]
movsxd r13, dword [rsp + 0x1a0]
jmp 0x7fff25d958e2
call sym.KERNELBASE.dll_GetLastError
mov dword [rsp + 0xf4], eax
cmp eax, 0x103
mov r11d, 1
cmove r14d, r11d
mov dword [rsp + 0xd8], r14d
xor r10d, r10d
test r14d, r14d
je 0x7fff25d99c83
cmp eax, 0x458
je 0x7fff25d98670
test rdi, rdi
je 0x7fff25d95cbc
cmp dword [rdi + 0x68], r10d
jne 0x7fff25d98670
test r14d, r14d
je 0x7fff25d95ccb
xor ecx, ecx
call fcn.7fff25d6b370
xor r10d, r10d
mov r15, qword [rsp + 0xb0]
test r14d, r14d
je 0x7fff25d9a20c
mov eax, 1
mov dword [rsp + 0xe8], eax
mov r13, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xa0]
jmp 0x7fff25d9a222
mov eax, 1
mov ebx, eax
mov dword [rsp + 0x160], eax
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov dword [rsp + 0xf8], r12d
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [rsp + 0xf4]
xor r10d, r10d
mov r11d, ebx
jmp 0x7fff25d958ef
mov r15, qword [rsp + 0xb0]
cmp dword [rsp + 0x1bc], r10d
jne 0x7fff25d98714
mov esi, dword [rsp + 0xf0]
cmp qword [rsp + 0xa8], r10
jne 0x7fff25d98763
cmp dword [rsp + 0x104], r10d
jne 0x7fff25d98763
mov r14d, 1
cmp dword [rsp + 0x104], r10d
cmovne r14d, dword [rsp + 0x168]
mov dword [rsp + 0x1cc], r14d
mov dword [rsp + 0xcc], r14d
lea rdx, [rsp + 0x1d4]
mov rcx, qword [rsp + 0x90]
call fcn.7fff25d9428c
mov ebx, eax
lea rdx, [rsp + 0x1d0]
mov rcx, qword [r15]
call fcn.7fff25d9428c
xor r10d, r10d
test eax, eax
je 0x7fff25d95dff
mov ecx, dword [rsp + 0x1d0]
test cl, 0x10
jne 0x7fff25d9884d
bt ecx, 0x10
jb 0x7fff25d9884d
mov eax, dword [rsp + 0x178]
mov dword [rsp + 0x1bc], eax
test r13d, r13d
jne 0x7fff25d988fc
test esi, esi
jne 0x7fff25d988ea
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x7fff25d95e8b
cmp dword [rsp + 0x104], r10d
jne 0x7fff25d98909
mov qword [rsp + 0x188], rcx
mov dword [rsp + 0x20], 0x14
mov r9d, 8
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r10d, r10d
cmp eax, 0xc000007f
je 0x7fff25d98924
mov ecx, 1
mov rax, qword [rsp + 0x148]
test dword [rax], 0x4000
jne 0x7fff25d989de
mov r15, r10
mov qword [rsp + 0xd0], r15
mov dword [rsp + 0x1e8], ecx
test rdi, rdi
je 0x7fff25d98a34
mov dword [rdi + 0x14], ecx
mov ecx, 0xc0000240
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov dword [rdi + 0x18], eax
mov rax, qword [rbx]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], r15
mov r15, qword [rsp + 0xb0]
mov rax, qword [r15]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov rdx, rdi
mov ecx, 3
call sym.KERNELBASE.dll_BasepCopyFileCallback
test eax, eax
je 0x7fff25d989ef
mov rcx, rdi
call fcn.7fff25d946e8
xor r10d, r10d
test eax, eax
jne 0x7fff25d989ef
lea ecx, [rax + 1]
cmp qword [rbx], r10
je 0x7fff25d9662c
mov r15, qword [rsp + 0x148]
test esi, esi
jne 0x7fff25d98a41
test dword [r15], 0x4000
jne 0x7fff25d98a41
mov rdi, qword [rsp + 0xb0]
cmp dword [rsp + 0x1c0], r10d
jne 0x7fff25d96336
cmp dword [rsp + 0x164], r10d
jne 0x7fff25d98a98
mov rcx, qword [rdi]
test esi, esi
jne 0x7fff25d98bea
mov ebx, r10d
mov dword [rsp + 0x2cc], ebx
call fcn.7fff25d94410
mov esi, eax
mov rcx, qword [rsp + 0x90]
call fcn.7fff25d94410
mov edi, eax
xor ecx, ecx
test esi, esi
jne 0x7fff25d98ab6
test edi, edi
jne 0x7fff25d98ad1
lea rdx, [rsp + 0xfc]
cmp dword [rsp + 0x158], ecx
mov rcx, qword [rsp + 0x1d8]
jne 0x7fff25d98afb
call fcn.7fff25d91428
mov rax, qword [rsp + 0x1d8]
mov r8d, dword [rax]
xor r9d, r9d
test r8d, r8d
jne 0x7fff25d98b41
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x338], rcx
test ebx, ebx
jne 0x7fff25d98b05
cmp dword [rsp + 0x158], r9d
jne 0x7fff25d98b0f
cmp rcx, 0x80000
ja 0x7fff25d9638a
mov eax, 0x20000
cmp rcx, rax
cmovb eax, ecx
mov dword [rsp + 0xe4], eax
mov r12, qword [rsp + 0x1d8]
mov dword [r12], eax
mov r8d, eax
mov edx, dword [rsp + 0xfc]
test edx, edx
jne 0x7fff25d98b5c
test ebx, ebx
jne 0x7fff25d98b49
cmp dword [rsp + 0x158], r9d
jne 0x7fff25d98b69
mov rbx, qword [rsp + 0xa0]
cmp r8d, 0x2000000
jae 0x7fff25d98b78
mov rdx, qword [rbx]
imul ecx, r8d, 7
cmp rdx, rcx
jg 0x7fff25d963b4
mov ecx, r8d
lea rax, [rdx - 1]
add rax, rcx
cqo
idiv rcx
mov rdx, rax
mov dword [rsp + 0xfc], eax
cmp dword [rsp + 0x104], r9d
jne 0x7fff25d98b82
test esi, esi
jne 0x7fff25d98b82
test edi, edi
jne 0x7fff25d98b82
mov r13d, 1
mov edx, r13d
mov dword [rsp + 0xfc], edx
lea ecx, [r8 - 1]
add ecx, r14d
mov eax, r14d
neg eax
and ecx, eax
mov dword [r12], ecx
mov r8d, r9d
mov dword [rsp + 0x140], r9d
cmp r8d, 3
jae 0x7fff25d96118
mov eax, r8d
shl rax, 4
lea rcx, [rsp + 0xee0]
add rcx, rax
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
add r8d, r13d
mov dword [rsp + 0x140], r8d
jmp 0x7fff25d960ec
mov eax, edx
lea r8, [rax + rax*4]
shl r8, 4
mov edx, dword [0x7fff25fd0c80]
or edx, 8
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x1f0], rax
xor esi, esi
test rax, rax
je 0x7fff25d98ba0
mov edi, esi
mov dword [rsp + 0x140], esi
cmp edi, dword [rsp + 0xfc]
jb 0x7fff25d9629d
mov eax, dword [r12]
imul eax, dword [rsp + 0xfc]
mov esi, dword [rsp + 0xf0]
mov r8d, eax
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x210], rax
xor r10d, r10d
test rax, rax
je 0x7fff25d98c12
mov rdi, qword [rsp + 0x128]
test rdi, rdi
je 0x7fff25d961d8
mov ecx, dword [r12]
mov rax, qword [rsp + 0xd0]
cqo
idiv rcx
mov qword [rdi + 0x60], rax
cmp dword [rsp + 0x198], r10d
jne 0x7fff25d963c5
cmp dword [rsp + 0x19c], r10d
jne 0x7fff25d963c5
mov r14d, 1
cmp dword [rsp + 0x198], r10d
jne 0x7fff25d9642a
mov r15, qword [rsp + 0xb0]
mov r13d, r10d
cmp dword [rsp + 0x19c], r10d
jne 0x7fff25d99263
mov ebx, dword [rsp + 0xe4]
mov esi, dword [rsp + 0xf0]
test esi, esi
jne 0x7fff25d95695
mov r8d, r10d
mov dword [rsp + 0x140], r10d
mov r9, qword [rsp + 0x1d8]
cmp r8d, dword [rsp + 0xfc]
jae 0x7fff25d95695
mov eax, r8d
lea rdx, [rax + rax*4]
shl rdx, 4
add rdx, qword [rsp + 0x1f0]
mov qword [rsp + 0x270], rdx
mov dword [rdx + 0x14], r8d
mov ecx, dword [r9]
imul ecx, r8d
add rcx, qword [rsp + 0xd0]
mov qword [rdx + 0x18], rcx
mov eax, dword [r9]
mov dword [rdx + 0x28], eax
inc r8d
mov dword [rsp + 0x140], r8d
jmp 0x7fff25d9624a
mov eax, edi
lea rbx, [rax + rax*4]
shl rbx, 4
add rbx, qword [rsp + 0x1f0]
mov qword [rsp + 0x270], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
xor ecx, ecx
call sym.KERNELBASE.dll_CreateEventA
mov qword [rbx + 0x48], rax
test rax, rax
je 0x7fff25d98bc3
mov dword [rbx + 0x14], edi
mov ecx, dword [r12]
imul ecx, edi
add rcx, qword [rsp + 0xd0]
mov qword [rbx + 0x18], rcx
mov eax, dword [r12]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x10], esi
mov rax, qword [rsp + 0xee8]
lea rcx, [rsp + 0xee0]
cmp qword [rax], rcx
jne 0x7fff25d99da3
lea rcx, [rsp + 0xee0]
mov qword [rbx], rcx
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [rsp + 0xee8], rbx
add edi, r13d
mov dword [rsp + 0x140], edi
jmp 0x7fff25d96160
mov rcx, qword [rsp + 0x90]
call fcn.7fff25d94410
mov ebx, eax
mov rcx, qword [rdi]
call fcn.7fff25d94410
mov r8d, eax
lea rax, [rsp + 0x208]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rdi]
call fcn.7fff25d90cf4
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x198]
mov dword [rsp + 0x198], ecx
xor r10d, r10d
jmp 0x7fff25d95f63
cmp rcx, 0x200000
ja 0x7fff25d9639d
mov eax, 0x40000
jmp 0x7fff25d96028
cmp rcx, 0x800000
ja 0x7fff25d96617
mov eax, 0x80000
jmp 0x7fff25d96028
mov edx, 8
mov dword [rsp + 0xfc], edx
jmp 0x7fff25d960a1
xor r9d, r9d
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
xor ecx, ecx
call sym.KERNELBASE.dll_CreateEventA
mov qword [rsp + 0x300], rax
xor r10d, r10d
test rax, rax
jne 0x7fff25d961fa
mov r12, qword [rsp + 0xa8]
test r12, r12
jne 0x7fff25d9641b
test esi, esi
jne 0x7fff25d9641b
test dword [r15], 0x4000
jne 0x7fff25d9641b
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, 0xc0000017
call fcn.7fff25d6b370
jmp 0x7fff25d981c9
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rbx]
mov r15, qword [rsp + 0xd0]
cmp rcx, r15
jl 0x7fff25d96208
mov r13, r15
mov dword [rsp + 0x1e4], r10d
je 0x7fff25d98c25
test rdi, rdi
je 0x7fff25d98c56
mov dword [rdi + 0x14], r14d
mov ecx, 0xc0000240
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov dword [rdi + 0x18], eax
mov r15, qword [rsp + 0xb0]
mov rax, qword [r15]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov rcx, qword [rbx]
mov r12, r13
mov esi, 0x10000000
mov edx, 0x20
mov qword [rsp + 0x538], rdx
and qword [rsp + 0x540], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x548], rax
sub rcx, r12
mov qword [rsp + 0x550], rcx
lea rax, [rcx + 0xfffff]
and rax, 0xfffffffffff00000
mov qword [rsp + 0x550], rax
mov dword [rsp + 0x48], 0x210
lea rax, [rsp + 0xcd0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
lea rax, [rsp + 0x538]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x94264
lea rax, [rsp + 0x218]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e8]
xor r8d, r8d
mov rdx, qword [rsp + 0x300]
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
cmp eax, 0x103
je 0x7fff25d98c63
test ebx, ebx
cmovns ebx, dword [rsp + 0x218]
mov dword [rsp + 0x98], ebx
mov r8, qword [rsp + 0x208]
mov edx, ebx
mov ecx, r14d
call fcn.7fff25d8e900
xor r10d, r10d
test ebx, ebx
jns 0x7fff25d98c7b
mov dword [rsp + 0x1e4], r14d
test rdi, rdi
je 0x7fff25d96594
and dword [rdi + 0x58], 0xfffffffe
mov dword [rsp + 0x98], r10d
mov r8, qword [rsp + 0x208]
test r8, r8
je 0x7fff25d965be
xor edx, edx
lea ecx, [rdx + 3]
call fcn.7fff25d8e900
xor r10d, r10d
mov qword [rsp + 0x208], r10
mov dword [rsp + 0x1c8], r10d
xor r9d, r9d
lea r8, [rsp + 0xd4]
mov edx, dword [rsp + 0xd0]
mov r15, qword [rsp + 0xb0]
mov rcx, qword [r15]
call sym.KERNELBASE.dll_SetFilePointer
xor r9d, r9d
lea r8, [rsp + 0xd4]
mov edx, dword [rsp + 0xd0]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_SetFilePointer
xor r10d, r10d
mov dword [rsp + 0xe8], r10d
jmp 0x7fff25d96210
cmp rcx, 0x40000000
ja 0x7fff25d98b19
mov eax, r12d
jmp 0x7fff25d96028
mov dword [rsp + 0xe8], ecx
mov r12, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
jmp 0x7fff25d9a222
mov r13d, 0x4021
mov dword [rsp + 0x100], r13d
jmp 0x7fff25d94d29
mov esi, edx
xor esi, r9d
add esi, 2
jmp 0x7fff25d94d55
btr r12d, 0x1e
mov dword [rsp + 0x118], r12d
or r12d, 0x113
mov dword [rsp + 0x118], r12d
jmp 0x7fff25d94d88
mov eax, 1
cmp esi, eax
jne 0x7fff25d9518d
mov ebx, dword [rsp + 0xdc]
test bl, 2
setne cl
test al, r13b
setne al
test al, cl
je 0x7fff25d9518d
and r13d, 0xfffffffe
mov dword [rsp + 0x100], r13d
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov eax, 1
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov rsi, qword [rsp + 0x110]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x380]
mov edx, ebx
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
jns 0x7fff25d95196
mov ecx, 1
or r13d, ecx
mov dword [rsp + 0x100], r13d
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], ecx
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x380]
mov edx, ebx
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
jns 0x7fff25d95196
or qword [rsp + 0x90], 0xffffffffffffffff
jmp 0x7fff25d97a18
cmp esi, 3
jne 0x7fff25d95196
mov dword [rsp + 0x20], 4
lea r9d, [rsi + 0x25]
lea r8, [rsp + 0x618]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d97a29
mov edx, dword [rsp + 0x638]
test dl, 0x10
jne 0x7fff25d95196
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [rsp + 0x90], 0xffffffffffffffff
mov esi, 2
mov dword [rsp + 0x124], esi
mov r14d, dword [rsp + 0xdc]
and r14d, 0xfffffffd
mov dword [rsp + 0xdc], r14d
mov dword [rsp + 0x108], r14d
xor r10d, r10d
mov ebx, dword [rsp + 0xcc]
jmp 0x7fff25d95060
mov edi, 0x1000
mov dword [rsp + 0x2e0], edi
mov r8d, edi
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7fff25d972b0
mov dword [rsp + 0x20], 0x16
mov r9d, edi
mov r8, rax
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
jns 0x7fff25d97e36
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea eax, [rdi + rdi]
mov edi, eax
mov dword [rsp + 0x2e0], eax
jmp 0x7fff25d97e5e
mov dword [rsp + 0x1e0], ebx
lea eax, [rbx + rbx]
mov dword [rsp + 0x1e0], eax
mov r8d, eax
mov rcx, qword gs:[0x60]
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x240], rax
xor eax, eax
test rdi, rdi
je 0x7fff25d97347
lea ecx, [rax + 1]
mov byte [rsp + 0x40], cl
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], al
mov ebx, dword [rsp + 0x1e0]
mov r9d, ebx
mov r8, rdi
lea rdx, [rsp + 0x218]
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_NtQueryEaFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
js 0x7fff25d972f3
cmp eax, 0x80000005
je 0x7fff25d96941
cmp eax, 0xc0000023
je 0x7fff25d96941
mov eax, dword [rsp + 0x220]
mov dword [rsp + 0x120], eax
mov dword [rsp + 0x1e0], eax
mov rdi, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x298]
mov qword [rsp + 0x288], rcx
mov ebx, dword [rsp + 0x1a4]
mov ecx, dword [rsp + 0x1c4]
mov dword [rsp + 0xf0], ecx
mov esi, dword [rsp + 0x124]
mov r12d, dword [rsp + 0x118]
mov r8d, dword [rsp + 0x15c]
mov dword [rsp + 0xc8], r8d
jmp 0x7fff25d94f72
test edx, edx
je 0x7fff25d955d6
mov ecx, 0xffff0000
and r9d, ecx
test edx, edx
je 0x7fff25d98053
or r8d, r15d
mov dword [rsp + 0xec], r8d
mov esi, 0x28
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x558], xmm0
movups xmmword [rsp + 0x568], xmm0
mov qword [rsp + 0x578], rax
mov dword [rsp + 0x578], r8d
mov dword [rsp + 0x20], 4
mov r9d, esi
lea r8, [rsp + 0x558]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor eax, eax
test ebx, ebx
js 0x7fff25d9805b
mov dword [rsp + 0xec], eax
mov dword [rsp + 0x20], 4
mov r9d, esi
lea r8, [rsp + 0x558]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
js 0x7fff25d97a29
mov eax, dword [rsp + 0x578]
mov dword [rsp + 0xec], eax
jmp 0x7fff25d955e7
mov ebx, dword [rsp + 0xcc]
test cl, bl
jne 0x7fff25d97ae1
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [rsp + 0x90], 0xffffffffffffffff
xor r10d, r10d
cmp dword [rsp + 0x158], r10d
jne 0x7fff25d97bb0
test r15d, r15d
jne 0x7fff25d97bb0
neg r14d
sbb esi, esi
and esi, 0xfffffffe
add esi, 3
mov dword [rsp + 0x124], esi
cmp dword [rsp + 0x150], r10d
jne 0x7fff25d97bc1
or r13d, 0x20
mov dword [0x7fff25fd2338], 0x20
mov dword [rsp + 0x100], r13d
mov r14d, dword [rsp + 0xdc]
jmp 0x7fff25d95060
cmp dword [rsp + 0x11c], r10d
je 0x7fff25d96d24
mov r14d, dword [rsp + 0xdc]
jmp 0x7fff25d9515d
mov ecx, ebx
call fcn.7fff25d6b370
mov rcx, qword [rsp + 0x148]
mov eax, dword [rcx]
mov r15d, 1
and eax, r15d
jne 0x7fff25d97828
cmp ebx, 0xc00000ba
je 0x7fff25d97851
test byte [rcx], 0x80
jne 0x7fff25d96f62
xor ebx, ebx
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x20
je 0x7fff25d96c31
call sym.KERNELBASE.dll_GetLastError
cmp eax, 5
jne 0x7fff25d96c98
mov r8d, dword [rsp + 0xe0]
mov eax, r8d
and eax, 3
cmp al, 3
jne 0x7fff25d96c88
bt r14d, 0x10
jae 0x7fff25d96c98
btr r14d, 0x10
mov dword [rsp + 0xdc], r14d
mov dword [rsp + 0x108], r14d
mov ebx, dword [rsp + 0xcc]
mov rcx, qword [rsp + 0x110]
xor r10d, r10d
jmp 0x7fff25d95076
bts r13d, 0xe
mov dword [rsp + 0x100], r13d
jmp 0x7fff25d94d35
mov r8d, 3
mov dword [rsp + 0xe0], r8d
jmp 0x7fff25d96c5f
cmp qword [rsp + 0x1b0], rbx
jne 0x7fff25d978a4
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x522
je 0x7fff25d96cbc
call sym.KERNELBASE.dll_GetLastError
cmp eax, 5
jne 0x7fff25d96cc7
bt r14d, 0x18
jb 0x7fff25d97882
call sym.KERNELBASE.dll_GetLastError
cmp eax, 5
jne 0x7fff25d970cf
test r14d, 0xc0000
je 0x7fff25d970cf
bt r14d, 0x12
jae 0x7fff25d978f8
btr r14d, 0x12
mov dword [rsp + 0x108], r14d
mov dword [rsp + 0xdc], r14d
xor r10d, r10d
mov r8d, r10d
mov dword [rsp + 0xe0], r10d
mov rcx, qword [rsp + 0x110]
mov ebx, dword [rsp + 0xcc]
jmp 0x7fff25d95076
mov eax, dword [rsp + 0xdc]
btr eax, 0x1f
mov dword [rsp + 0xdc], eax
mov dword [rsp + 0x108], eax
mov r14d, eax
or r14d, 1
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], esi
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x380]
mov edx, r14d
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
jns 0x7fff25d95141
cmp eax, 0xc000007f
mov rax, qword [rsp + 0x110]
je 0x7fff25d9763a
mov ecx, dword [rsp + 0x120]
mov dword [rsp + 0x50], ecx
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], esi
mov ecx, dword [rsp + 0xe0]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x380]
mov r14d, dword [rsp + 0xdc]
mov edx, r14d
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
cmp eax, 0xc000007f
jne 0x7fff25d9515d
cmp dword [rsp + 0x164], r10d
je 0x7fff25d9515d
cmp qword [rsp + 0x110], r10
je 0x7fff25d9515d
mov ecx, r10d
mov qword [rsp + 0x110], rcx
lea eax, [r10 + 1]
mov dword [rsp + 0x16c], eax
mov dword [rsp + 0x194], eax
mov ebx, dword [rsp + 0xcc]
mov r15, rax
jmp 0x7fff25d9506e
mov dword [rsp + 0x264], r10d
mov ebx, dword [rsp + 0xec]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.KERNELBASE.dll_CreateEventA
mov r14, rax
xor r8d, r8d
mov esi, r8d
mov dword [rsp + 0x264], r8d
mov r15d, r8d
and ebx, 0x800
setne r15b
mov ebx, dword [rsp + 0x22c]
mov r12, qword [rsp + 0x278]
cmp esi, 2
jge 0x7fff25d970aa
mov rax, qword [rsp + 0x148]
mov ecx, dword [rax]
mov rax, qword [rsp + 0x2d0]
mov edx, dword [rax]
test r15d, r15d
je 0x7fff25d96fe3
mov r15d, r8d
lea rax, [rsp + 0x128]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
mov r9d, dword [rsp + 0xec]
mov r8d, dword [rsp + 0xcc]
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
call fcn.7fff25dcd59c
mov dword [rsp + 0xd8], eax
xor r8d, r8d
test eax, eax
je 0x7fff25d97e29
inc esi
mov dword [rsp + 0x264], esi
jmp 0x7fff25d96ed7
cmp ebx, 0xc0000103
jne 0x7fff25d96c1b
xor ebx, ebx
test eax, eax
jne 0x7fff25d96c1d
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x1020
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x380]
mov edx, 0x110000
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
jns 0x7fff25d97863
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d97125
mov r15d, 1
lea rax, [rsp + 0x510]
mov qword [rsp + 0x88], rax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x128]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x68], r12
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], edx
lea rax, [rsp + 0xec]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r13d
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xdc]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x380]
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
call fcn.7fff25d91bd8
mov dword [rsp + 0xd8], eax
mov rdi, qword [rsp + 0x128]
jmp 0x7fff25d96f49
mov rcx, r14
call sym.KERNELBASE.dll_CloseHandle
mov r15d, dword [rsp + 0xcc]
mov rsi, qword [rsp + 0x2d0]
mov r13, qword [rsp + 0xb8]
jmp 0x7fff25d95544
mov ebx, dword [rsp + 0xcc]
mov eax, 0x4000
mov edx, dword [rsp + 0xc8]
test eax, ebx
jne 0x7fff25d97920
mov eax, ebx
mov r9d, 0x110
and eax, r9d
cmp eax, r9d
je 0x7fff25d97988
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x57
je 0x7fff25d97998
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0xb7
je 0x7fff25d97998
test bl, 0x10
jne 0x7fff25d979ac
or qword [rsp + 0x90], 0xffffffffffffffff
mov r15, qword [rsp + 0xb0]
xor r10d, r10d
jmp 0x7fff25d95ce8
lea rax, [rsp + 0x158]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x12a8]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x4d8]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x104]
lea r8, [rsp + 0x90]
mov r13, qword [rsp + 0xb8]
mov rdx, r13
mov rcx, qword [rsp + 0xb0]
mov rcx, qword [rcx]
call 0x7fff25e06650
mov dword [rsp + 0xd8], eax
cmp eax, 2
jne 0x7fff25d971f5
mov r15, qword [rsp + 0xb0]
mov rcx, qword [r15]
call fcn.7fff25d94410
xor r10d, r10d
test eax, eax
je 0x7fff25d971e5
mov eax, 0xf000
mov rcx, qword [rsp + 0x1d8]
mov dword [rcx], eax
mov dword [rsp + 0xe8], 2
jmp 0x7fff25d95cf8
xor r10d, r10d
test eax, eax
jne 0x7fff25d94cb9
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d95cf8
or r13d, 8
jmp 0x7fff25d96656
bts r12d, 0x13
mov dword [rsp + 0x118], r12d
jmp 0x7fff25d94dae
mov r8d, 0x1000000
mov dword [rsp + 0x174], r8d
test dword [rsp + 0x1cc], r8d
je 0x7fff25d94dc5
or r12d, r8d
mov dword [rsp + 0x118], r12d
jmp 0x7fff25d94dc5
bts r13d, 0x15
mov dword [rsp + 0x100], r13d
btr r12d, 0x10
mov eax, 0x80000000
or r12d, eax
mov dword [rsp + 0x118], r12d
mov esi, edx
xor esi, r9d
add esi, 2
mov dword [rsp + 0x124], esi
mov dword [rsp + 0x11c], r9d
jmp 0x7fff25d94df3
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d972ab
mov ecx, eax
call fcn.7fff25d6b370
or qword [rsp + 0x90], 0xffffffffffffffff
mov r13, r14
jmp 0x7fff25d972c2
mov ecx, 0xc0000017
call fcn.7fff25d6b370
mov rdi, qword [rsp + 0x128]
mov r15, qword [rsp + 0xb0]
xor r10d, r10d
jmp 0x7fff25d95cf0
cmp eax, 0xc0000017
je 0x7fff25d9729b
cmp eax, 0xc000009a
je 0x7fff25d9729b
mov ecx, 3
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25d972a2
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x240]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r10d, r10d
mov eax, r10d
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x220], r10
mov ebx, dword [rsp + 0x1e0]
mov eax, dword [rsp + 0x98]
jmp 0x7fff25d969da
mov ecx, 0xc0000017
call fcn.7fff25d6b370
mov r15, r14
jmp 0x7fff25d97360
mov ecx, 0xc0000017
call fcn.7fff25d6b370
mov rdi, qword [rsp + 0x128]
jmp 0x7fff25d97136
test ecx, r8d
je 0x7fff25d94fd1
cmp esi, 2
je 0x7fff25d97384
cmp esi, 5
jne 0x7fff25d94fd1
lea rdx, [rsp + 0x2a0]
mov ecx, esi
call 0x7fff25e059c8
mov dword [rsp + 0x98], eax
test eax, eax
jns 0x7fff25d973aa
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d97564
and r8d, 0xfffffffe
mov dword [rsp + 0xc8], r8d
mov dword [rsp + 0x15c], r8d
call fcn.7fff25dd02e4
xor ecx, ecx
test al, al
je 0x7fff25d974a7
mov r9d, dword [rsp + 0xc8]
and r9d, ebx
and r9d, 0x5affb7
mov qword [rsp + 0x20], rcx
mov r8d, dword [rsp + 0x2a0]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.ext_ms_win_feclient_encryptedfile_l1_1_0.dll_EfsClientDuplicateEncryptionInfo]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x1777
jne 0x7fff25d97475
mov rax, qword [rsp + 0x148]
test dword [rax], 0x1000000
je 0x7fff25d9745b
xor eax, eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xec]
mov dword [rsp + 0x28], eax
mov ebx, dword [rsp + 0xcc]
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0x200]
xor edx, edx
xor ecx, ecx
call fcn.7fff25e06e78
jmp 0x7fff25d97545
mov r8d, 1
mov dword [rsp + 0x190], r8d
mov ebx, dword [rsp + 0xcc]
jmp 0x7fff25d9754b
mov ecx, 0x1787
cmp eax, ecx
je 0x7fff25d97496
xor ecx, ecx
jmp 0x7fff25d974ac
xor edx, edx
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, 0x164
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25d9712e
mov ebx, 0x32
test ebx, ebx
je 0x7fff25d9753e
mov dword [rsp + 0x1a8], ecx
call fcn.7fff25dd02e4
test al, al
je 0x7fff25d9751a
xor r8d, r8d
lea rdx, [rsp + 0x1a8]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.ext_ms_win_feclient_encryptedfile_l1_1_0.dll_EfsClientGetEncryptedFileVersion]
nop dword [rax + rax]
test eax, eax
jne 0x7fff25d974fa
mov ecx, dword [rsp + 0x1a8]
add ecx, 0xfffffffb
lea r8d, [rax + 1]
cmp ecx, r8d
jbe 0x7fff25d974ff
cmp eax, 0x32
jne 0x7fff25d9751f
mov ecx, dword [rsp + 0xc8]
btr ecx, 0xe
mov dword [rsp + 0xc8], ecx
mov dword [rsp + 0x15c], ecx
jmp 0x7fff25d9751f
mov eax, 0x32
test eax, eax
je 0x7fff25d97527
mov ecx, eax
jmp 0x7fff25d97529
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov ebx, dword [rsp + 0xcc]
jmp 0x7fff25d97564
mov ebx, dword [rsp + 0xcc]
mov r8d, 1
mov esi, r8d
mov dword [rsp + 0x124], r8d
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor r10d, r10d
jmp 0x7fff25d94fd1
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0x7fff25d9500d
mov ecx, 1
mov eax, ecx
jmp 0x7fff25d95025
cmp esi, 5
jne 0x7fff25d975a8
mov dword [rsp + 0x1ec], ecx
mov dword [rsp + 0x228], esi
mov esi, ecx
mov dword [rsp + 0x124], ecx
jmp 0x7fff25d95034
mov eax, dword [rsp + 0x1f8]
cmp esi, 2
cmove eax, r10d
mov dword [rsp + 0x1f8], eax
jmp 0x7fff25d95034
cmp dword [rsp + 0x164], r10d
je 0x7fff25d9512b
test rcx, rcx
je 0x7fff25d9512b
mov rcx, r10
mov qword [rsp + 0x110], rcx
mov eax, 1
mov dword [rsp + 0x16c], eax
mov dword [rsp + 0x194], eax
mov r14d, dword [rsp + 0xdc]
jmp 0x7fff25d96e7d
cmp eax, 0xc0000034
jne 0x7fff25d95139
mov dword [rsp + 0x1f8], r10d
mov dword [rsp + 0x1ec], r10d
mov esi, dword [rsp + 0x228]
mov dword [rsp + 0x124], esi
mov r14d, dword [rsp + 0xdc]
jmp 0x7fff25d96889
cmp dword [rsp + 0x164], r10d
je 0x7fff25d96dc8
test rax, rax
jne 0x7fff25d975d9
jmp 0x7fff25d96dc8
lea rax, [rsp + 0x510]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x22c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x278]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x148]
mov eax, dword [rax]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
mov r8d, dword [rsp + 0xcc]
mov rdx, qword [rsp + 0x200]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
call 0x7fff25e05f84
cmp dword [rsp + 0x190], 2
jne 0x7fff25d97779
xor ebx, ebx
cmp dword [rsp + 0x1f8], ebx
jne 0x7fff25d97491
mov esi, 0x10000
test esi, r14d
jne 0x7fff25d97482
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [rsp + 0x90], 0xffffffffffffffff
or r14d, esi
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], r13d
lea eax, [rbx + 1]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x380]
mov edx, r14d
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
jns 0x7fff25d97482
jmp 0x7fff25d97491
xor r10d, r10d
cmp dword [rsp + 0x1ec], r10d
je 0x7fff25d95173
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [rsp + 0x90], 0xffffffffffffffff
mov esi, dword [rsp + 0x228]
mov dword [rsp + 0x124], esi
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], esi
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r15d
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x380]
mov edx, r14d
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
jmp 0x7fff25d95173
cmp ebx, 0xc0000035
jne 0x7fff25d96c06
mov ecx, 0x50
jmp 0x7fff25d97840
mov ecx, 5
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25d97125
cmp word [rsp + 0x230], 0x5c
mov ecx, 3
je 0x7fff25d97840
jmp 0x7fff25d9783b
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
or qword [rsp + 0x90], 0xffffffffffffffff
jmp 0x7fff25d97897
btr r14d, 0x18
mov dword [rsp + 0xdc], r14d
mov dword [rsp + 0x108], r14d
mov r8d, dword [rsp + 0xe0]
jmp 0x7fff25d96c5f
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x11a
jne 0x7fff25d96ca6
mov dword [rsp + 0x260], r15d
xor r10d, r10d
mov eax, r10d
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x120], eax
mov dword [rsp + 0x254], eax
mov r14d, r12d
mov dword [rsp + 0xdc], r12d
mov dword [rsp + 0x108], r12d
jmp 0x7fff25d96d05
bt r14d, 0x13
jae 0x7fff25d96d02
btr r14d, 0x13
mov dword [rsp + 0x108], r14d
mov eax, r12d
and eax, 0x40000
or r14d, eax
jmp 0x7fff25d96cf2
test eax, edx
je 0x7fff25d970ea
btr edx, 0xe
jmp 0x7fff25d9793c
mov esi, r15d
mov dword [rsp + 0x124], r15d
or edx, 0xffffffff
mov dword [rsp + 0xc8], edx
mov dword [rsp + 0x15c], edx
mov r13d, dword [rsp + 0x1b8]
mov dword [rsp + 0x100], r13d
mov r14d, r12d
mov dword [rsp + 0xdc], r12d
mov dword [rsp + 0x108], r12d
xor r10d, r10d
mov r8d, r10d
mov dword [rsp + 0xe0], r10d
mov rcx, qword [rsp + 0x110]
jmp 0x7fff25d9507d
bt edx, 8
jae 0x7fff25d970fe
btr edx, 8
jmp 0x7fff25d9793c
test bl, 0x10
je 0x7fff25d97125
cmp esi, 3
jne 0x7fff25d9711c
jmp 0x7fff25d9792e
and r14d, r12d
test r14b, 2
je 0x7fff25d97125
and r12d, 0xfffffffd
mov dword [rsp + 0x118], r12d
mov r14d, r12d
mov dword [rsp + 0xdc], r12d
mov dword [rsp + 0x108], r12d
mov esi, dword [rsp + 0x2e4]
mov dword [rsp + 0x124], esi
mov r13d, dword [rsp + 0x1b8]
mov dword [rsp + 0x100], r13d
xor r10d, r10d
mov r8d, r10d
mov dword [rsp + 0xe0], r10d
mov rcx, qword [rsp + 0x110]
jmp 0x7fff25d95076
mov dword [rsp + 0x98], eax
mov ecx, eax
jmp 0x7fff25d97a1f
mov ecx, r15d
call fcn.7fff25d6b370
jmp 0x7fff25d9712e
mov rcx, qword [rsp + 0x90]
xor edx, edx
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, ebx
jmp 0x7fff25d97a1f
bt ebx, 0xc
jb 0x7fff25d951ec
mov eax, 1
mov esi, eax
mov dword [rsp + 0x150], eax
jmp 0x7fff25d951f7
cmp qword [r15], 0x800000
jle 0x7fff25d95214
mov rcx, qword [rsp + 0x90]
call fcn.7fff25e063d4
movzx eax, al
mov dword [rsp + 0x158], eax
xor r10d, r10d
jmp 0x7fff25d9521c
mov rcx, qword [r15]
call fcn.7fff25e04ff8
mov r15d, dword [rsp + 0x1a8]
xor r10d, r10d
test al, al
lea ecx, [r10 + 1]
cmove r15d, ecx
mov dword [rsp + 0x1a8], r15d
mov dword [rsp + 0x25c], r15d
jmp 0x7fff25d9522f
test eax, eax
jne 0x7fff25d96b42
test esi, esi
jne 0x7fff25d95264
jmp 0x7fff25d9525c
mov rcx, qword [rsp + 0x90]
call 0x7fff25e05e98
xor r10d, r10d
jmp 0x7fff25d95283
mov esi, dword [rsp + 0xc8]
test cl, sil
je 0x7fff25d96b51
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x5c8]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d97a29
mov eax, dword [rsp + 0x5e8]
and eax, 0xfffffffe
mov dword [rsp + 0x5e8], eax
bts eax, 7
mov dword [rsp + 0x5e8], eax
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x5c8]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d97a29
and esi, 0xfffffffe
mov dword [rsp + 0xc8], esi
mov dword [rsp + 0x15c], esi
mov ebx, dword [rsp + 0xcc]
jmp 0x7fff25d96b51
or r13d, 8
mov dword [rsp + 0x100], r13d
jmp 0x7fff25d96b88
and r13d, 0xffffffdf
mov dword [0x7fff25fd2338], r10d
jmp 0x7fff25d96bb6
test sil, r12b
jne 0x7fff25d952a1
mov dword [rsp + 0x20], 4
mov r14d, 0x28
mov r9d, r14d
lea r8, [rsp + 0x5f0]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
mov rcx, qword [rsp + 0x90]
test eax, eax
js 0x7fff25d97a31
or dword [rsp + 0x610], esi
mov dword [rsp + 0x20], 4
mov r9d, r14d
lea r8, [rsp + 0x5f0]
lea rdx, [rsp + 0x130]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
js 0x7fff25d97a29
jmp 0x7fff25d952a1
mov r15d, dword [rsp + 0xcc]
mov r12d, dword [rsp + 0xc8]
mov esi, 1
jmp 0x7fff25d952a9
mov rax, qword [rsp + 0x148]
test byte [rax], 0x10
je 0x7fff25d952b7
test rdi, rdi
je 0x7fff25d97cc1
mov dword [rdi + 0x14], esi
mov dword [rdi + 0x18], 0x11a
mov qword [rdi + 0x40], r10
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rdi + 0x20], rax
or qword [rdi + 0x28], 0xffffffffffffffff
mov rdx, rdi
mov ecx, 0xd
call sym.KERNELBASE.dll_BasepCopyFileCallback
xor r10d, r10d
test eax, eax
jne 0x7fff25d952b7
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
je 0x7fff25d97cf4
xor edx, edx
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x7fff25d97125
cmp qword [rsp + 0x90], 0xffffffffffffffff
je 0x7fff25d952c5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sym.KERNELBASE.dll_CreateEventW
mov rsi, rax
xor r10d, r10d
test rax, rax
je 0x7fff25d97de4
mov r8, rax
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
call 0x7fff25e07aa4
mov ebx, eax
mov rcx, rsi
call sym.KERNELBASE.dll_CloseHandle
xor r10d, r10d
test ebx, ebx
jne 0x7fff25d952c5
mov rax, qword [rsp + 0x148]
lea esi, [rbx + 1]
test byte [rax], sil
je 0x7fff25d97db4
mov byte [rsp + 0x170], sil
mov dword [rsp + 0x20], 0xd
mov r9d, esi
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
xor r10d, r10d
mov rax, qword [rsp + 0x90]
mov r14, qword [rsp + 0xc0]
mov qword [r14], rax
mov r12, qword [rsp + 0xa8]
mov r15, qword [rsp + 0xb0]
mov r13, qword [rsp + 0xb8]
jmp 0x7fff25d95d00
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d95ce8
cmp dword [rsp + 0x24c], r10d
je 0x7fff25d97e21
xor edx, edx
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
xor r10d, r10d
test rdi, rdi
je 0x7fff25d97e21
mov rax, qword [rdi + 0x70]
test rax, rax
je 0x7fff25d97e21
lea ecx, [r10 + 1]
mov dword [rax], ecx
mov r15, rbx
jmp 0x7fff25d95ce8
mov rcx, r14
call sym.KERNELBASE.dll_CloseHandle
jmp 0x7fff25d9712e
cmp qword [rsp + 0x138], r10
jne 0x7fff25d97e6b
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r10d, r10d
mov eax, dword [rsp + 0x98]
mov ebx, r10d
cmp eax, 0x80000005
je 0x7fff25d968a1
cmp eax, 0xc0000023
je 0x7fff25d968a1
test rbx, rbx
je 0x7fff25d98015
mov rdi, rbx
mov qword [rsp + 0x418], rbx
mov esi, 1
movzx eax, word [rdi + 4]
mov word [rsp + 0x400], ax
mov word [rsp + 0x402], ax
lea rax, [rdi + 0x18]
mov qword [rsp + 0x408], rax
mov dword [rsp + 0x478], 0x30
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x480], rax
mov dword [rsp + 0x490], 0x40
lea rax, [rsp + 0x400]
mov qword [rsp + 0x488], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x498], xmm0
mov dword [rsp + 0x50], r10d
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x40], 0x1020
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x218]
lea r8, [rsp + 0x478]
mov edx, 0x110000
lea rcx, [rsp + 0x3e8]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
jns 0x7fff25d97f9e
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, dword [rsp + 0x98]
call fcn.7fff25d6b370
mov rdi, qword [rsp + 0x128]
jmp 0x7fff25d9712e
mov rcx, qword [rsp + 0x3e8]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor r10d, r10d
cmp dword [rdi], r10d
jne 0x7fff25d98003
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x128]
mov r13d, dword [rsp + 0x194]
mov r15d, dword [rsp + 0x1a4]
mov eax, dword [rsp + 0x1c4]
mov dword [rsp + 0xf0], eax
jmp 0x7fff25d955b4
mov eax, dword [rdi]
add rdi, rax
mov qword [rsp + 0x418], rdi
jmp 0x7fff25d97e9a
mov rdi, qword [rsp + 0x128]
mov r13d, dword [rsp + 0x194]
mov r15d, dword [rsp + 0x1a4]
mov eax, dword [rsp + 0x1c4]
mov dword [rsp + 0xf0], eax
jmp 0x7fff25d955b7
mov eax, r8d
and eax, ecx
cmp r9d, eax
je 0x7fff25d955e7
jmp 0x7fff25d96a66
or r8d, r9d
jmp 0x7fff25d96a71
test r15b, 0x10
setne dl
mov r8d, dword [rsp + 0xec]
bt r8d, 8
setb cl
test cl, dl
je 0x7fff25d97a29
btr r8d, 8
mov dword [rsp + 0xec], r8d
jmp 0x7fff25d96a7e
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d95cf0
mov dword [rsp + 0x174], 0x1000000
mov r15d, dword [rsp + 0xcc]
jmp 0x7fff25d955e7
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d9565e
mov dword [rsp + 0xe8], r10d
mov rcx, rdi
call fcn.7fff25d946e8
xor r10d, r10d
test eax, eax
je 0x7fff25d95ce8
xor edx, edx
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
jmp 0x7fff25d97136
test rdi, rdi
je 0x7fff25d980f9
mov dword [rdi + 0x30], 2
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x458]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r8d, r8d
test eax, eax
js 0x7fff25d9819c
mov dword [rsp + 0x428], 0x30
mov qword [rsp + 0x430], r12
mov dword [rsp + 0x440], r8d
lea rax, [rsp + 0x458]
mov qword [rsp + 0x438], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x448], xmm0
mov ecx, dword [r13]
lea r9d, [r8 + 1]
and ecx, r9d
mov eax, ecx
neg eax
sbb ebx, ebx
and ebx, 0xfffffffd
add ebx, 5
mov dword [rsp + 0x26c], ebx
test r14d, r14d
jne 0x7fff25d98212
test dword [r13], 0x4000
jne 0x7fff25d98212
mov rdx, qword [rsp + 0x180]
jmp 0x7fff25d98230
mov ecx, eax
jmp 0x7fff25d96420
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, 0xc0000017
call fcn.7fff25d6b370
mov rdi, qword [rsp + 0x128]
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d98202
mov dword [rdi + 0x68], ebx
mov dword [rsp + 0xd8], ebx
mov ecx, 0xc0000240
call fcn.7fff25d6b370
mov dword [rsp + 0xf8], ebx
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
mov r13, qword [rsp + 0xb8]
xor r10d, r10d
jmp 0x7fff25d95cf8
mov rdx, qword [rsp + 0x180]
mov rax, qword [rdx + 0x28]
neg rax
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 5
mov dword [rsp + 0x26c], ebx
mov r14d, 0x24
mov dword [rsp + 0x268], r14d
mov esi, 0x40100000
mov dword [rsp + 0x118], esi
test dword [r13], 0x180
mov eax, 0x4024
cmovne r14d, eax
mov dword [rsp + 0x268], r14d
cmp dword [rsp + 0x12a8], r8d
je 0x7fff25d982b0
bts r14d, 0x15
mov dword [rsp + 0x268], r14d
mov esi, 0xc0100000
mov dword [rsp + 0x118], esi
test ecx, ecx
je 0x7fff25d982a4
cmp dword [rsp + 0xf0], r8d
jne 0x7fff25d9829e
test dword [r13], 0x4000
je 0x7fff25d982a4
cmp qword [rdx + 0x28], r8
jne 0x7fff25d982b0
mov ebx, 3
mov dword [rsp + 0x26c], ebx
mov r13d, 0x80000000
test r13d, esi
jne 0x7fff25d982c0
test r9b, sil
je 0x7fff25d982c8
mov dword [rsp + 0x11c], r9d
mov dword [rsp + 0x50], r8d
mov r12, qword [rsp + 0x110]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r12
cmp dword [rsp + 0x11c], r8d
lea r8, [rsp + 0x428]
jne 0x7fff25d983b2
mov r13d, esi
or r13d, r9d
lea r9, [rsp + 0x130]
mov edx, r13d
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov r15d, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
js 0x7fff25d9835f
lea eax, [r10 + 1]
mov dword [rsp + 0x11c], eax
mov esi, r13d
mov dword [rsp + 0x118], r13d
mov r13d, 0x80000000
jmp 0x7fff25d983d5
mov dword [rsp + 0x50], r10d
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x130]
lea r8, [rsp + 0x428]
mov edx, esi
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov r13d, 0x80000000
jmp 0x7fff25d983c8
lea r9, [rsp + 0x130]
mov edx, esi
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
xor r10d, r10d
mov dword [rsp + 0x98], eax
mov r15d, eax
test r15d, r15d
jns 0x7fff25d9868d
mov ecx, r15d
call fcn.7fff25d6b370
cmp r15d, 0xc0000033
jne 0x7fff25d98473
mov rax, qword [rsp + 0x460]
movzx ecx, word [rax + 2]
dec cx
cmp cx, 0x1e
ja 0x7fff25d98473
mov dword [rsp + 0x20], 5
mov r9d, 0x10
lea r8, [rsp + 0x5b8]
lea rdx, [rsp + 0x4a8]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
lea ecx, [rax + r13]
test r13d, ecx
jne 0x7fff25d9844e
cmp eax, 0x80000005
jne 0x7fff25d97a11
test dword [rsp + 0x5b8], 0x10000
jne 0x7fff25d98473
xor r10d, r10d
mov dword [rsp + 0x98], r10d
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d95cdc
cmp r15d, 0xc0000022
jne 0x7fff25d97a1c
mov dword [rsp + 0x20], 4
mov r13d, 0x28
mov r9d, r13d
lea r8, [rsp + 0x4b8]
lea rdx, [rsp + 0x130]
mov r15, qword [rsp + 0xa8]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
jns 0x7fff25d984d5
mov ecx, eax
call fcn.7fff25d6b370
mov r12, r15
jmp 0x7fff25d981c9
mov eax, dword [rsp + 0x4d8]
mov dword [rsp + 0x238], eax
mov ecx, 1
test cl, al
je 0x7fff25d9866b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x4b8], xmm0
movups xmmword [rsp + 0x4c8], xmm0
mov qword [rsp + 0x4d8], rax
mov dword [rsp + 0x4d8], 0x80
mov dword [rsp + 0x20], 4
mov r9d, r13d
lea r8, [rsp + 0x4b8]
lea rdx, [rsp + 0x130]
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
xor eax, eax
mov dword [rsp + 0x50], eax
lea r9, [rsp + 0x130]
lea r8, [rsp + 0x428]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
cmp dword [rsp + 0x11c], eax
jne 0x7fff25d98600
mov r13d, esi
or r13d, 1
mov edx, r13d
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov r15d, eax
mov dword [rsp + 0x98], eax
xor eax, eax
test r15d, r15d
js 0x7fff25d985c5
mov eax, 1
mov dword [rsp + 0x11c], eax
mov dword [rsp + 0x118], r13d
jmp 0x7fff25d98618
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x130]
lea r8, [rsp + 0x428]
lea rcx, [rsp + 0x90]
mov edx, esi
call qword [sym.imp.ntdll.dll_NtCreateFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
mov r15d, eax
mov eax, dword [rsp + 0x238]
mov dword [rsp + 0x4d8], eax
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x4b8]
lea rdx, [rsp + 0x130]
mov r12, qword [rsp + 0xa8]
mov rcx, r12
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
xor r10d, r10d
test r15d, r15d
jns 0x7fff25d9868d
mov ecx, r15d
jmp 0x7fff25d96420
mov r12, r15
jmp 0x7fff25d98678
mov r12, qword [rsp + 0xa8]
mov r15, qword [rsp + 0xb0]
mov r13, qword [rsp + 0xb8]
jmp 0x7fff25d95cf8
mov dword [rsp + 0x104], r10d
mov eax, 1
mov dword [rsp + 0x1a0], eax
mov ebx, dword [rsp + 0x1b8]
mov r13d, ebx
mov r14, qword [rsp + 0x148]
cmp dword [rsp + 0x12a8], r10d
je 0x7fff25d986fe
test byte [r14], al
je 0x7fff25d986e3
cmp dword [rsp + 0xf0], r10d
jne 0x7fff25d986d5
test dword [r14], 0x4000
je 0x7fff25d986e3
mov rax, qword [rsp + 0x180]
cmp qword [rax + 0x28], r10
jne 0x7fff25d986fe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_SetFilePointer
mov r13d, ebx
xor r10d, r10d
mov r12d, 0x100000
mov dword [rsp + 0x174], 0x1000000
jmp 0x7fff25d95d57
mov rcx, qword [r15]
call fcn.7fff25d94410
xor r10d, r10d
test eax, eax
jne 0x7fff25d95d6d
mov rcx, qword [rsp + 0x90]
call fcn.7fff25d94410
xor r10d, r10d
test eax, eax
jne 0x7fff25d95d6d
and dword [r14], 0xfffffffd
mov esi, r10d
mov dword [rsp + 0xf0], r10d
mov eax, 0x4ac3
mov rcx, qword [rsp + 0x180]
mov word [rcx], ax
jmp 0x7fff25d95d74
mov dword [rsp + 0x20], 3
mov r9d, 0x18
lea r8, [rsp + 0x580]
lea rdx, [rsp + 0x130]
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d9880f
mov eax, dword [rsp + 0x594]
mov dword [rsp + 0x168], eax
mov dword [rsp + 0x20], 3
mov r9d, 0x18
lea r8, [rsp + 0x580]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
js 0x7fff25d9880f
mov eax, dword [rsp + 0x168]
cmp dword [rsp + 0x594], eax
cmova eax, dword [rsp + 0x594]
mov dword [rsp + 0x168], eax
jmp 0x7fff25d95d90
mov r12, qword [rsp + 0xa8]
test r12, r12
jne 0x7fff25d9883d
test esi, esi
jne 0x7fff25d9883d
test dword [r14], 0x4000
jne 0x7fff25d9883d
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, ebx
jmp 0x7fff25d98843
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d98202
test ebx, ebx
je 0x7fff25d95dff
mov ebx, dword [rsp + 0x1d4]
test bl, 0x10
jne 0x7fff25d9886b
bt ebx, 0x10
jae 0x7fff25d95dff
and ebx, ecx
test bl, 0x10
je 0x7fff25d98894
lea r8, [rsp + 0x598]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [r15]
call 0x7fff25e051d0
mov dword [rsp + 0x19c], eax
xor r10d, r10d
cmp dword [rsp + 0x19c], r10d
jne 0x7fff25d95dff
bt ebx, 0x10
jae 0x7fff25d95dff
lea r8, [rsp + 0x598]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [r15]
call 0x7fff25e05a0c
mov dword [rsp + 0x19c], eax
mov ecx, dword [rsp + 0x178]
xor r10d, r10d
test eax, eax
lea eax, [r10 + 1]
cmovne ecx, eax
mov dword [rsp + 0x178], ecx
jmp 0x7fff25d95dff
mov rax, qword [rsp + 0x180]
cmp qword [rax + 0x28], r10
je 0x7fff25d95e1e
mov rbx, qword [rsp + 0xa0]
jmp 0x7fff25d95e8b
mov eax, dword [rsp + 0x168]
dec rcx
add rcx, rax
dec rax
not rax
and rcx, rax
jmp 0x7fff25d95e3c
cmp dword [rsp + 0x164], r10d
je 0x7fff25d9894a
mov ecx, 1
mov r13d, ecx
mov dword [rsp + 0x194], ecx
mov dword [rsp + 0x98], r10d
jmp 0x7fff25d95e90
mov ecx, 0xc000007f
call fcn.7fff25d6b370
mov rax, qword [rsp + 0x148]
test dword [rax], 0x4000
jne 0x7fff25d98978
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_CloseHandle
or qword [rsp + 0x90], 0xffffffffffffffff
mov r12, qword [rsp + 0xa8]
jmp 0x7fff25d989c6
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, 0xc0000017
call fcn.7fff25d6b370
mov rdi, qword [rsp + 0x128]
mov r15, qword [rsp + 0xb0]
mov r13, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
xor r10d, r10d
jmp 0x7fff25d9a222
mov rax, qword [rsp + 0x180]
mov r15, qword [rax + 0x28]
jmp 0x7fff25d95ea7
mov rcx, rdi
call fcn.7fff25d946e8
mov r12, qword [rsp + 0xa8]
test eax, eax
je 0x7fff25d98a28
mov rcx, qword [rsp + 0x90]
test r12, r12
cmovne rcx, r12
jmp 0x7fff25d98a1c
mov rcx, qword [rsp + 0x90]
mov edx, dword [rsp + 0x4d8]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, 0xc0000240
call fcn.7fff25d6b370
jmp 0x7fff25d989c6
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d95f27
mov rax, qword [rsp + 0x180]
lea rbx, [rax + 0x2c]
xor r9d, r9d
mov r8, rbx
mov edx, dword [rax + 0x28]
mov rdi, qword [rsp + 0xb0]
mov rcx, qword [rdi]
call sym.KERNELBASE.dll_SetFilePointer
xor r9d, r9d
mov r8, rbx
mov rbx, qword [rsp + 0x180]
mov edx, dword [rbx + 0x28]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_SetFilePointer
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0xd0], rax
xor r10d, r10d
jmp 0x7fff25d95f55
test r13d, r13d
je 0x7fff25d95f71
mov dword [rsp + 0x198], r10d
mov dword [rsp + 0x19c], r10d
jmp 0x7fff25d95f71
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
call fcn.7fff25e06c14
xor ecx, ecx
test eax, eax
jne 0x7fff25d98ae8
jmp 0x7fff25d95fa6
mov rcx, qword [rsp + 0x90]
call fcn.7fff25e06c14
xor ecx, ecx
test eax, eax
je 0x7fff25d95fae
mov eax, 1
mov ebx, eax
mov dword [rsp + 0x2cc], eax
jmp 0x7fff25d95fae
call 0x7fff25e057a4
jmp 0x7fff25d95fd0
mov eax, 0x8000
jmp 0x7fff25d96028
mov eax, 0x800000
jmp 0x7fff25d96028
cmp dword [rsp + 0x104], r9d
je 0x7fff25d96624
call 0x7fff25e0590c
xor r9d, r9d
test eax, eax
mov eax, 0x2000000
jne 0x7fff25d96028
jmp 0x7fff25d96624
mov r12, rax
jmp 0x7fff25d9603e
mov edx, 0x10
jmp 0x7fff25d98b55
mov edx, 2
mov dword [rsp + 0xfc], edx
mov rbx, qword [rsp + 0xa0]
jmp 0x7fff25d960a1
cmp r8d, 0x800000
jb 0x7fff25d96063
jmp 0x7fff25d98b50
mov edx, 2
jmp 0x7fff25d963b9
cmp dword [rsp + 0x164], r9d
je 0x7fff25d98b95
test r13d, r13d
jne 0x7fff25d960bf
mov r13d, 1
jmp 0x7fff25d960cf
mov r12, qword [rsp + 0xa8]
test r12, r12
jne 0x7fff25d989ac
test dword [r15], 0x4000
jne 0x7fff25d989ac
jmp 0x7fff25d98998
mov r12, qword [rsp + 0xa8]
test r12, r12
jmp 0x7fff25d98bd2
test esi, esi
jne 0x7fff25d981b7
test dword [r15], 0x4000
jne 0x7fff25d981b7
jmp 0x7fff25d981a3
call fcn.7fff25d94410
mov r12, qword [rsp + 0x1d8]
test eax, eax
je 0x7fff25d98c09
mov eax, 0xf000
mov dword [r12], eax
jmp 0x7fff25d96180
mov eax, dword [r12]
jmp 0x7fff25d96180
mov r12, qword [rsp + 0xa8]
test r12, r12
jne 0x7fff25d981b7
jmp 0x7fff25d98bd0
mov dword [rsp + 0xe8], r14d
jmp 0x7fff25d98c37
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
jmp 0x7fff25d98c49
mov qword [rsp + 0xd0], rax
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d9663b
mov r15, qword [rsp + 0xb0]
jmp 0x7fff25d96496
xor r8d, r8d
or edx, 0xffffffff
mov rcx, qword [rsp + 0x300]
call sym.KERNELBASE.dll_WaitForSingleObjectEx
jmp 0x7fff25d96555
cmp dword [rsp + 0xcd0], 0x210
jne 0x7fff25d96583
mov rcx, qword [rsp + 0xcd8]
test rcx, rcx
je 0x7fff25d99256
mov dword [rsp + 0x1c0], r14d
mov r15, qword [rsp + 0xd0]
mov qword [rsp + 0x670], 0x220
mov qword [rsp + 0x678], r15
sub rcx, r15
lea rax, [rcx + r13]
mov qword [rsp + 0x680], rax
cmp rax, rsi
cmova rax, rsi
mov qword [rsp + 0x680], rax
mov rax, r15
sub rax, r12
mov qword [rsp + 0x688], rax
lea rax, [rsp + 0x690]
lea rcx, [rsp + 0xce0]
mov edx, 4
lea r8d, [rdx + 0x7c]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
add rax, r8
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
add rcx, r8
sub rdx, 1
jne 0x7fff25d98d06
test rdi, rdi
je 0x7fff25d98e08
mov dword [rdi + 0x30], 3
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov rax, qword [rsp + 0x680]
mov qword [rdi + 0x48], rax
mov rax, qword [rdi + 0x60]
mov qword [rdi + 0x50], rax
or dword [rdi + 0x58], r14d
mov rbx, qword [rsp + 0xa0]
mov rax, qword [rbx]
sub rax, r15
cmp qword [rdi + 0x48], rax
jle 0x7fff25d98d9c
mov qword [rdi + 0x48], rax
cmp dword [rsp + 0x154], r10d
je 0x7fff25d98df3
mov rdx, rdi
mov ecx, r14d
call sym.KERNELBASE.dll_BasepCopyFileCallback
xor esi, esi
test eax, eax
jne 0x7fff25d98df5
mov rcx, rdi
call fcn.7fff25d946e8
mov r12, qword [rsp + 0xa8]
test eax, eax
je 0x7fff25d98de4
test r12, r12
jne 0x7fff25d98de4
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, 0xc0000240
call fcn.7fff25d6b370
jmp 0x7fff25d989be
xor esi, esi
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
jne 0x7fff25d98db7
mov dword [rsp + 0x154], esi
mov dword [rsp + 0x48], 0x10
lea rax, [rsp + 0x500]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x670]
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x670]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x98268
lea rax, [rsp + 0x218]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e8]
xor r8d, r8d
mov rdx, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x98], eax
cmp eax, 0x103
jne 0x7fff25d98e94
xor r8d, r8d
or edx, 0xffffffff
mov rcx, qword [rsp + 0x300]
call sym.KERNELBASE.dll_WaitForSingleObjectEx
test ebx, ebx
cmovns ebx, dword [rsp + 0x218]
mov dword [rsp + 0x98], ebx
mov r8, qword [rsp + 0x208]
mov edx, ebx
mov ecx, 2
call fcn.7fff25d8e900
xor r10d, r10d
test ebx, ebx
js 0x7fff25d9913c
mov dword [rsp + 0x1c0], r10d
mov rsi, qword [rsp + 0x508]
add rsi, qword [rsp + 0xd0]
mov qword [rsp + 0xd0], rsi
mov ecx, dword [rsp + 0x1c8]
add ecx, r14d
mov dword [rsp + 0x1c8], ecx
cmp dword [rsp + 0xf0], r10d
je 0x7fff25d9903a
mov rax, rsi
test cl, 3
jne 0x7fff25d98f1a
test rsi, rsi
je 0x7fff25d98f1a
mov rbx, qword [rsp + 0xa0]
jmp 0x7fff25d98f2e
mov rbx, qword [rsp + 0xa0]
cmp rsi, qword [rbx]
jne 0x7fff25d99042
mov rsi, rax
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa8]
test rax, rax
cmovne r14, rax
lea rdx, [rsp + 0x130]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d990d8
mov rbx, qword [rsp + 0xd0]
mov qword [rsp + 0x310], rbx
mov rax, qword [rsp + 0xa0]
cmp rsi, qword [rax]
cmovg rbx, qword [rax]
mov qword [rsp + 0x310], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call sym.KERNELBASE.dll_SetFilePointer
mov r10, qword [rsp + 0x180]
mov qword [r10 + 0x28], rbx
mov rcx, r10
call 0x7fff25e05580
mov dword [r10 + 0x34], eax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c8]
lea r8d, [rax + 0x38]
mov rdx, r10
mov rcx, r14
call sym.KERNELBASE.dll_WriteFile
mov dword [rsp + 0xd8], eax
xor r10d, r10d
test eax, eax
je 0x7fff25d98c2f
cmp dword [rsp + 0x2c8], 0x38
jne 0x7fff25d98c2f
lea rdx, [rsp + 0x130]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d97a18
xor r9d, r9d
lea r8, [rsp + 0x314]
mov edx, ebx
mov rcx, r14
call sym.KERNELBASE.dll_SetFilePointer
xor r10d, r10d
lea r14d, [r10 + 1]
mov rbx, qword [rsp + 0xa0]
test rdi, rdi
je 0x7fff25d990b2
mov dword [rdi + 0x30], 4
mov rax, qword [rsp + 0x508]
add qword [rdi + 8], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov rax, qword [rsp + 0x508]
mov qword [rdi + 0x48], rax
mov rax, qword [rbx]
sub rax, r15
cmp qword [rsp + 0x508], rax
jle 0x7fff25d99086
mov qword [rdi + 0x48], rax
mov rdx, rdi
mov ecx, 2
call sym.KERNELBASE.dll_BasepCopyFileCallback
test eax, eax
je 0x7fff25d990ec
mov rcx, rdi
call fcn.7fff25d946e8
xor r10d, r10d
test eax, eax
jne 0x7fff25d990ec
add qword [rdi + 0x60], r14
mov dword [rsp + 0x154], r14d
mov rax, qword [rsp + 0xd0]
sub rax, r13
mov rcx, qword [rsp + 0xcd8]
cmp rax, rcx
jae 0x7fff25d99180
mov esi, 0x10000000
jmp 0x7fff25d98ca5
mov ecx, eax
call fcn.7fff25d6b370
mov r12, qword [rsp + 0xa8]
jmp 0x7fff25d989be
mov rcx, rdi
call fcn.7fff25d946e8
mov r12, qword [rsp + 0xa8]
test eax, eax
je 0x7fff25d99119
test r12, r12
jne 0x7fff25d99119
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, 0xc0000240
call fcn.7fff25d6b370
mov rax, qword [rbx]
xor r10d, r10d
cmp qword [rsp + 0xd0], rax
jle 0x7fff25d98c37
jmp 0x7fff25d98c41
mov r14d, dword [rsp + 0x1c0]
mov esi, r14d
mov dword [rsp + 0x1e4], r14d
test r14d, r14d
je 0x7fff25d99187
cmp ebx, 0xc0000465
jne 0x7fff25d99187
cmp qword [rsp + 0xd0], r10
jne 0x7fff25d99187
mov r8, qword [rsp + 0x208]
lea edx, [rbx - 1]
mov ecx, 2
call fcn.7fff25d8e900
xor r10d, r10d
jmp 0x7fff25d99187
mov esi, dword [rsp + 0x1e4]
test esi, esi
jne 0x7fff25d9658b
mov r13, qword [rsp + 0xd0]
mov r12, r13
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rbx]
cmp r13, rcx
jae 0x7fff25d991bb
mov r15, qword [rsp + 0xb0]
lea r14d, [rsi + 1]
jmp 0x7fff25d96499
jl 0x7fff25d9922e
cmp dword [rsp + 0x104], r10d
je 0x7fff25d9922e
mov qword [rsp + 0x188], rcx
mov dword [rsp + 0x20], 0x14
mov r9d, 8
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r10d, r10d
test eax, eax
jns 0x7fff25d9922e
mov ecx, eax
call fcn.7fff25d6b370
xor r10d, r10d
mov dword [rsp + 0xe8], r10d
test esi, esi
je 0x7fff25d9659c
jmp 0x7fff25d9658b
mov rax, qword [rsp + 0xd0]
cmp r13, qword [rbx]
cmovg rax, qword [rbx]
mov qword [rsp + 0xd0], rax
mov eax, 1
mov dword [rsp + 0xe8], eax
jmp 0x7fff25d98c37
mov dword [rsp + 0xe8], r14d
jmp 0x7fff25d95ce8
mov rcx, qword gs:[0x60]
mov ebx, 0x1b8
mov r8d, ebx
mov edx, dword [0x7fff25fd0c80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x2d8], rax
test rax, rax
je 0x7fff25d97356
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
movups xmm0, xmmword [rsp + 0x598]
movups xmmword [rsi], xmm0
movsd xmm0, qword [rsp + 0x5a8]
movsd qword [rsi + 0x10], xmm0
mov ecx, 0x1000000
mov dword [rsp + 0x234], ecx
xor r10d, r10d
mov r13d, r10d
mov rdi, qword [rsp + 0x128]
mov r14d, dword [rsp + 0xd8]
mov rbx, qword [rsp + 0xa0]
mov r12d, 1
mov rbx, qword [rbx]
sub rbx, qword [rsp + 0xd0]
mov eax, ecx
cmp rbx, rax
jle 0x7fff25d99311
mov ebx, ecx
mov dword [rsp + 0xe4], ecx
jmp 0x7fff25d99336
mov dword [rsp + 0xe4], ebx
cmp dword [rsp + 0x104], r10d
je 0x7fff25d99336
mov eax, dword [rsp + 0x1cc]
neg eax
and eax, ebx
mov ebx, eax
mov dword [rsp + 0xe4], eax
test ebx, ebx
je 0x7fff25d997a5
mov dword [rsi + 0x18], r10d
mov r9d, ebx
mov dword [rsp + 0x2c4], ebx
mov ecx, r10d
test r9d, r9d
je 0x7fff25d993b5
mov eax, 0x100000
mov ecx, eax
cmp r9d, eax
cmovb ecx, r9d
mov eax, dword [rsi + 0x18]
add rax, 2
lea rax, [rax + rax*2]
mov dword [rsi + rax*8], ecx
mov edx, dword [rsi + 0x18]
mov r8d, edx
shl r8d, 0x14
add r8, qword [rsp + 0xd0]
lea rax, [rdx + rdx*2]
mov qword [rsi + rax*8 + 0x20], r8
mov eax, dword [rsi + 0x18]
lea rcx, [rax + rax*2]
mov qword [rsi + rcx*8 + 0x28], r8
mov ecx, dword [rsi + 0x18]
lea rax, [rcx + 2]
lea rax, [rax + rax*2]
sub r9d, dword [rsi + rax*8]
mov dword [rsp + 0x2c4], r9d
inc ecx
mov dword [rsi + 0x18], ecx
jmp 0x7fff25d9934f
test rdi, rdi
je 0x7fff25d99481
mov dword [rdi + 0x30], 5
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x14], r12d
mov dword [rdi + 0x18], 0x4d3
mov rax, qword [r15]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov eax, ebx
mov qword [rdi + 0x48], rax
mov rax, qword [rdi + 0x60]
mov qword [rdi + 0x50], rax
cmp dword [rsp + 0x154], r10d
je 0x7fff25d99467
mov rdx, rdi
mov ecx, r12d
call sym.KERNELBASE.dll_BasepCopyFileCallback
xor r14d, r14d
test eax, eax
jne 0x7fff25d9946a
mov rcx, rdi
call fcn.7fff25d946e8
mov r12, qword [rsp + 0xa8]
test eax, eax
je 0x7fff25d99455
test r12, r12
jne 0x7fff25d99455
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov dword [rsp + 0xd8], r14d
mov ecx, 0xc0000240
jmp 0x7fff25d98843
xor r14d, r14d
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
jne 0x7fff25d99428
mov dword [rsp + 0x154], r14d
mov ecx, dword [rsi + 0x18]
mov eax, dword [rsp + 0x11c]
neg eax
sbb edx, edx
and edx, 0xffffbffc
add edx, 0x14841c
lea r9d, [rcx + rcx*2]
lea r9d, [r9*8 + 0x20]
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xc
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_DeviceIoControl
mov r14d, eax
mov dword [rsp + 0xd8], eax
xor r10d, r10d
test eax, eax
jne 0x7fff25d99537
call sym.KERNELBASE.dll_GetLastError
cmp eax, 0x3e5
jne 0x7fff25d99534
mov rcx, qword [rsp + 0x90]
or rcx, r12
xor eax, eax
mov dword [rsp + 0x20], eax
or r9d, 0xffffffff
lea r8, [rsp + 0xdc]
lea rdx, [rsp + 0x2e8]
call sym.KERNELBASE.dll_GetOverlappedResultEx
mov r14d, eax
mov dword [rsp + 0xd8], eax
xor r10d, r10d
test r14d, r14d
jne 0x7fff25d99593
call sym.KERNELBASE.dll_GetLastError
xor r10d, r10d
cmp eax, 0x57
jne 0x7fff25d9958a
cmp dword [rsp + 0x280], r10d
jne 0x7fff25d9958a
mov ecx, dword [rsp + 0x4f4]
lea eax, [rcx - 0x10000]
cmp eax, 0xf0000
ja 0x7fff25d9958a
mov dword [rsp + 0x174], ecx
mov dword [rsp + 0x234], ecx
mov dword [rsp + 0x280], r12d
mov rbx, qword [rsp + 0xa0]
jmp 0x7fff25d992f4
test r14d, r14d
je 0x7fff25d997a5
mov r12d, ebx
mov rcx, qword [rsp + 0xd0]
add rcx, r12
mov qword [rsp + 0xd0], rcx
mov edx, 1
add r13d, edx
mov dword [rsp + 0x1c8], r13d
cmp dword [rsp + 0xf0], r10d
je 0x7fff25d996eb
test r13b, 3
jne 0x7fff25d995d2
test rcx, rcx
jne 0x7fff25d995e3
mov rbx, qword [rsp + 0xa0]
cmp rcx, qword [rbx]
jne 0x7fff25d996f3
mov rbx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa8]
test rax, rax
cmovne rbx, rax
lea rdx, [rsp + 0x130]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r14d, r14d
test eax, eax
jns 0x7fff25d9962b
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d97136
mov r15, qword [rsp + 0xd0]
mov qword [rsp + 0x420], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sym.KERNELBASE.dll_SetFilePointer
mov r10, qword [rsp + 0x180]
mov qword [r10 + 0x28], r15
mov rcx, r10
call 0x7fff25e05580
mov dword [r10 + 0x34], eax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x2c0]
mov r8d, 0x38
mov rdx, r10
mov rcx, rbx
call sym.KERNELBASE.dll_WriteFile
mov r14d, eax
mov dword [rsp + 0xd8], eax
xor r10d, r10d
test eax, eax
je 0x7fff25d98670
cmp dword [rsp + 0x2c0], 0x38
jne 0x7fff25d98670
lea rdx, [rsp + 0x130]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d97a18
xor r9d, r9d
lea r8, [rsp + 0x424]
mov edx, dword [rsp + 0xd0]
mov rcx, rbx
call sym.KERNELBASE.dll_SetFilePointer
xor r10d, r10d
lea edx, [r10 + 1]
mov rbx, qword [rsp + 0xa0]
test rdi, rdi
mov ecx, dword [rsp + 0x174]
mov r15, qword [rsp + 0xb0]
je 0x7fff25d992ee
add qword [rdi + 8], r12
mov rax, qword [rbx]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov dword [rdi + 0x14], edx
mov dword [rdi + 0x18], 0x4d3
mov rax, qword [r15]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x48], r12
mov rdx, rdi
mov ecx, 2
call sym.KERNELBASE.dll_BasepCopyFileCallback
test eax, eax
je 0x7fff25d9977f
mov rcx, rdi
call fcn.7fff25d946e8
xor r10d, r10d
test eax, eax
jne 0x7fff25d9977f
lea r12d, [r10 + 1]
add qword [rdi + 0x60], r12
mov dword [rsp + 0x154], r12d
mov ecx, dword [rsp + 0x174]
jmp 0x7fff25d992f4
mov rcx, rdi
call fcn.7fff25d946e8
mov r12, qword [rsp + 0xa8]
test eax, eax
je 0x7fff25d98a28
test r12, r12
jne 0x7fff25d98a28
jmp 0x7fff25d98a14
mov eax, dword [rsp + 0x1bc]
test eax, eax
je 0x7fff25d997ca
mov rdx, qword [rsp + 0x90]
mov rcx, qword [r15]
call 0x7fff25e05d4c
mov eax, dword [rsp + 0x1bc]
xor r10d, r10d
test r14d, r14d
je 0x7fff25d997f4
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xa0]
cmp qword [rcx], rax
jne 0x7fff25d9985c
mov dword [rsp + 0xe8], r12d
mov rbx, rcx
jmp 0x7fff25d96633
test r13d, r13d
je 0x7fff25d9985c
test eax, eax
jne 0x7fff25d9985c
mov r12, qword [rsp + 0xa8]
test r12, r12
jne 0x7fff25d98678
call sym.KERNELBASE.dll_GetLastError
xor r10d, r10d
cmp eax, 0x458
je 0x7fff25d98678
cmp dword [rsp + 0xf0], r10d
jne 0x7fff25d98678
mov rax, qword [rsp + 0x148]
test dword [rax], 0x4000
jne 0x7fff25d98678
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
jmp 0x7fff25d98202
xor r9d, r9d
lea r8, [rsp + 0xd4]
mov edx, dword [rsp + 0xd0]
mov rcx, qword [r15]
call sym.KERNELBASE.dll_SetFilePointer
xor r9d, r9d
lea r8, [rsp + 0xd4]
mov edx, dword [rsp + 0xd0]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_SetFilePointer
xor r10d, r10d
jmp 0x7fff25d96228
mov qword [rsp + 0x368], r15
mov rax, qword [rdi + 0x88]
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x378], rax
xor r8d, r8d
lea rdx, [rsp + 0x340]
lea rcx, [0x7fff25e05710]
call sym.KERNELBASE.dll_CreateThreadpoolWait
mov qword [rsp + 0x290], rax
xor r10d, r10d
test rax, rax
je 0x7fff25d95ce8
xor r8d, r8d
mov rdx, qword [rdi + 0x80]
mov rcx, rax
call qword [sym.imp.ntdll.dll_TpSetWait]
nop dword [rax + rax]
mov esi, dword [rsp + 0xf0]
jmp 0x7fff25d956a7
test byte [rsp + 0x1d0], 0x10
je 0x7fff25d99932
mov rcx, qword [r15]
call fcn.7fff25e06354
test al, al
je 0x7fff25d99932
mov rcx, qword [r15]
call fcn.7fff25e06dc8
test byte [rsp + 0x1d4], 0x10
je 0x7fff25d956bb
mov rcx, qword [rsp + 0x90]
call fcn.7fff25e06354
test al, al
je 0x7fff25d956bb
mov rcx, qword [rsp + 0x90]
call fcn.7fff25e06dc8
jmp 0x7fff25d956bb
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp qword [rcx + 8], rsi
jne 0x7fff25d99da3
cmp qword [rax], rsi
jne 0x7fff25d99da3
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov r14d, r12d
mov dword [rsp + 0xd8], r12d
mov ecx, 0x54f
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
jmp 0x7fff25d99a07
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov r14d, r12d
mov dword [rsp + 0xd8], r12d
mov ecx, 0xc0000240
call fcn.7fff25d6b370
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov dword [rsp + 0xf8], r12d
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [rsp + 0xf4]
jmp 0x7fff25d99a36
mov ecx, 1
mov r14d, ecx
mov dword [rsp + 0xd8], ecx
mov ebx, ecx
mov dword [rsp + 0x160], ecx
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
xor r10d, r10d
jmp 0x7fff25d958e9
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov eax, dword [rsp + 0xf4]
jmp 0x7fff25d958e9
mov dword [rsp + 0xe4], eax
mov rbx, rax
mov r15, qword [rsp + 0xd0]
add r15, rax
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0x188], r15
mov dword [rsp + 0x20], 0x14
mov r9d, 8
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
xor r12d, r12d
test eax, eax
jns 0x7fff25d99b45
mov r14d, r12d
mov dword [rsp + 0xd8], r12d
mov ecx, eax
call fcn.7fff25d6b370
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
jmp 0x7fff25d99b36
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov r14d, r12d
mov dword [rsp + 0xd8], r12d
mov ecx, 0xc0000240
call fcn.7fff25d6b370
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov dword [rsp + 0xf8], r12d
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
mov eax, dword [rsp + 0xf4]
xor r10d, r10d
jmp 0x7fff25d958e2
mov r15d, dword [rsp + 0x178]
jmp 0x7fff25d957d4
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
je 0x7fff25d99af7
cmp qword [rsp + 0xa8], r12
jne 0x7fff25d99af7
jmp 0x7fff25d99ae3
call sym.KERNELBASE.dll_GetLastError
mov dword [rsp + 0xf4], eax
cmp eax, 0x26
jne 0x7fff25d99a28
jmp 0x7fff25d99a10
mov r12d, dword [rsp + 0xcc]
dec r12d
add r12d, ebx
mov eax, dword [rsp + 0x1cc]
neg eax
and r12d, eax
jmp 0x7fff25d95b39
mov r8d, r12d
sub r8d, ebx
mov ecx, dword [rsi + 0x14]
imul ecx, r15d
mov r9d, ebx
add rcx, qword [rsp + 0x210]
add rcx, r9
xor edx, edx
call sub.ntdll.dll_memset
jmp 0x7fff25d95b42
call sym.KERNELBASE.dll_GetLastError
mov dword [rsp + 0xf4], eax
cmp eax, 0x3e5
jne 0x7fff25d99bf4
mov eax, 1
mov r14d, eax
mov dword [rsp + 0xd8], eax
jmp 0x7fff25d95be0
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
jmp 0x7fff25d95c09
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
je 0x7fff25d999c8
cmp qword [rsp + 0xa8], r12
jne 0x7fff25d999c8
jmp 0x7fff25d999b4
call sym.KERNELBASE.dll_GetLastError
mov dword [rsp + 0xf4], eax
mov r11d, 1
xor r10d, r10d
cmp eax, 0x26
jne 0x7fff25d99c6c
mov r14d, r11d
mov dword [rsp + 0xd8], r11d
mov ebx, r11d
mov dword [rsp + 0x160], ebx
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
jmp 0x7fff25d958ef
cmp eax, 0x3e5
jne 0x7fff25d99c59
mov r14d, r11d
mov dword [rsp + 0xd8], r11d
jmp 0x7fff25d95a87
mov rbx, r10
mov qword [rsp + 0x320], rbx
mov r12d, r11d
mov dword [rsp + 0x2b8], r11d
call qword [sym.imp.ntdll.dll_RtlGetLastWin32Error]
nop dword [rax + rax]
mov r13d, eax
xor r10d, r10d
mov r15d, r10d
mov dword [rsp + 0x140], r10d
lea r11d, [r10 + 1]
cmp r15d, dword [rsp + 0xfc]
jae 0x7fff25d99daa
mov ecx, r15d
lea rsi, [rcx + rcx*4]
shl rsi, 4
add rsi, qword [rsp + 0x1f0]
mov qword [rsp + 0x270], rsi
cmp dword [rsi + 0x10], 3
jne 0x7fff25d99cee
jmp 0x7fff25d99d93
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp qword [rcx + 8], rsi
jne 0x7fff25d99da3
cmp qword [rax], rsi
jne 0x7fff25d99da3
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov eax, dword [rsi + 0x10]
sub eax, r11d
cmp eax, r11d
ja 0x7fff25d99d85
lea rdx, [rsi + 0x30]
mov dword [rsp + 0x20], r10d
or r9d, 0xffffffff
lea r8, [rsp + 0xe4]
mov rcx, r11
call sym.KERNELBASE.dll_GetOverlappedResultEx
xor r10d, r10d
test eax, eax
je 0x7fff25d99d74
test rdi, rdi
je 0x7fff25d99d7f
cmp dword [rdi + 0x68], r10d
je 0x7fff25d99d7f
cmp dword [rsi + 0x10], 2
jne 0x7fff25d99d7f
test r12d, r12d
je 0x7fff25d99d7f
mov eax, dword [rsp + 0xe4]
lea r11d, [r10 + 1]
cmp eax, dword [rsi + 0x28]
jbe 0x7fff25d99d67
mov eax, dword [rsi + 0x28]
add rbx, rax
mov qword [rsp + 0x320], rbx
jmp 0x7fff25d99d85
mov r12d, r10d
mov dword [rsp + 0x2b8], r10d
mov r11d, 1
mov dword [rsi + 0x10], 3
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
add r15d, r11d
mov dword [rsp + 0x140], r15d
jmp 0x7fff25d99cba
mov ecx, 3
int 0x29
test r12d, r12d
je 0x7fff25d99dd2
mov ecx, r13d
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
add qword [rsp + 0xd0], rbx
xor r10d, r10d
test rdi, rdi
je 0x7fff25d99dd2
add qword [rdi + 8], rbx
mov eax, dword [rsp + 0xf4]
jmp 0x7fff25d95ca2
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0xf8], 0x28d9
mov rax, qword [rsp + 0x1d8]
mov esi, dword [rax]
mov dword [rsp + 0x234], esi
mov r12, qword [rsp + 0xa0]
test rdi, rdi
je 0x7fff25d99eb7
mov dword [rdi + 0x30], 3
mov rax, qword [r12]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov ecx, 1
mov dword [rdi + 0x14], ecx
mov dword [rdi + 0x18], 0x4d3
mov rax, qword [r15]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov eax, ebx
mov qword [rdi + 0x48], rax
mov rdx, rdi
call sym.KERNELBASE.dll_BasepCopyFileCallback
xor ebx, ebx
test eax, eax
je 0x7fff25d99e7c
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
je 0x7fff25d99eb9
mov rcx, rdi
call fcn.7fff25d946e8
mov r12, qword [rsp + 0xa8]
test eax, eax
je 0x7fff25d99ea9
test r12, r12
jne 0x7fff25d99ea9
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
cmp dword [rdi + 0x68], ebx
je 0x7fff25d981d6
jmp 0x7fff25d981d3
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xe4]
mov r8d, esi
mov rsi, qword [rsp + 0x210]
mov rdx, rsi
mov rcx, qword [r15]
call sym.KERNELBASE.dll_ReadFile
mov r14d, eax
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0xf8], ebx
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
xor r10d, r10d
test r14d, r14d
je 0x7fff25d9a20c
mov ebx, dword [rsp + 0xe4]
test ebx, ebx
je 0x7fff25d95cd3
test rdi, rdi
je 0x7fff25d99f28
mov dword [rdi + 0x30], 4
mov dword [rsp + 0x284], r10d
mov qword [rsp + 0x20], r10
lea r9, [rsp + 0x284]
mov r8d, ebx
mov rdx, rsi
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_WriteFile
xor esi, esi
test eax, eax
jne 0x7fff25d99f5f
call sym.KERNELBASE.dll_GetLastError
mov esi, eax
jmp 0x7fff25d99f7d
cmp dword [rsp + 0x284], ebx
je 0x7fff25d99fd0
mov eax, 0x1d
mov esi, eax
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor r10d, r10d
cmp esi, 0x70
jne 0x7fff25d98670
cmp dword [rsp + 0x164], r10d
je 0x7fff25d98670
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9, qword [r12]
mov r8d, esi
mov rcx, rdi
call fcn.7fff25e06ba8
xor r10d, r10d
test eax, eax
je 0x7fff25d98670
mov rsi, qword [rsp + 0x210]
jmp 0x7fff25d99f28
mov rcx, qword [rsp + 0xd0]
add rcx, rbx
mov qword [rsp + 0xd0], rcx
inc r13d
mov dword [rsp + 0x1c8], r13d
test r13b, 3
jne 0x7fff25d99ff9
test rcx, rcx
jne 0x7fff25d9a00c
cmp rcx, qword [r12]
je 0x7fff25d9a00c
mov r12, qword [rsp + 0xa8]
jmp 0x7fff25d9a109
mov rsi, qword [rsp + 0x90]
mov r12, qword [rsp + 0xa8]
test r12, r12
cmovne rsi, r12
lea rdx, [rsp + 0x130]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d98841
mov r15, qword [rsp + 0xd0]
mov qword [rsp + 0x410], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call sym.KERNELBASE.dll_SetFilePointer
mov r10, qword [rsp + 0x180]
mov qword [r10 + 0x28], r15
mov rcx, r10
call 0x7fff25e05580
mov dword [r10 + 0x34], eax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2a8]
lea r8d, [rax + 0x38]
mov rdx, r10
mov rcx, rsi
call sym.KERNELBASE.dll_WriteFile
mov dword [rsp + 0xd8], eax
xor r10d, r10d
test eax, eax
je 0x7fff25d98678
cmp dword [rsp + 0x2a8], 0x38
jne 0x7fff25d98678
lea rdx, [rsp + 0x130]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtFlushBuffersFile]
nop dword [rax + rax]
mov dword [rsp + 0x98], eax
test eax, eax
js 0x7fff25d9819c
xor r9d, r9d
lea r8, [rsp + 0x414]
mov edx, dword [rsp + 0xd0]
mov rcx, rsi
call sym.KERNELBASE.dll_SetFilePointer
mov r15, qword [rsp + 0xb0]
xor esi, esi
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0xf8], 0x2995
test rdi, rdi
je 0x7fff25d9a1a5
add qword [rdi + 8], rbx
mov eax, 1
mov dword [rdi + 0x14], eax
mov ecx, 0xc0000240
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov dword [rdi + 0x18], eax
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov rax, qword [r15]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x48], rbx
mov rdx, rdi
mov ecx, 2
call sym.KERNELBASE.dll_BasepCopyFileCallback
test eax, eax
je 0x7fff25d9a1c9
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
jne 0x7fff25d9a1c9
mov eax, 1
add qword [rdi + 0x50], rax
xor r12d, r12d
mov dword [rsp + 0xf8], r12d
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
jmp 0x7fff25d99dde
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
je 0x7fff25d9a1ee
test r12, r12
jne 0x7fff25d9a1ee
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
cmp dword [rdi + 0x68], esi
je 0x7fff25d9a1f6
mov dword [rdi + 0x68], esi
mov ecx, 0xc0000240
call fcn.7fff25d6b370
mov dword [rsp + 0xf8], esi
jmp 0x7fff25d981ee
mov r12, qword [rsp + 0xa8]
test r12, r12
jne 0x7fff25d98678
jmp 0x7fff25d99821
cmp dword [rsp + 0xf8], r10d
ja 0x7fff25df19ac
mov rsi, qword [rsp + 0x290]
test rsi, rsi
jne 0x7fff25df19c8
test rdi, rdi
je 0x7fff25d9a48b
cmp dword [rsp + 0x1e8], r10d
je 0x7fff25d9a48b
mov rax, qword [rbx]
mov qword [rdi + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rdi + 0x40], rax
mov ebx, 1
mov dword [rdi + 0x14], ebx
mov dword [rdi + 0x18], 0x4d3
mov rax, qword [r15]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x28], rax
mov rdx, rdi
lea ecx, [rbx + 3]
call sym.KERNELBASE.dll_BasepCopyFileCallback
xor r10d, r10d
test eax, eax
je 0x7fff25df19f3
mov rcx, rdi
call fcn.7fff25d946e8
xor r10d, r10d
test eax, eax
jne 0x7fff25df19f3
test rdi, rdi
je 0x7fff25d9a2c5
cmp dword [rdi + 0x68], r10d
jne 0x7fff25df1a40
mov rax, qword [rsp + 0x90]
cmp rax, 0xffffffffffffffff
je 0x7fff25d9a2d6
mov qword [r14], rax
mov rcx, qword [rsp + 0x3b0]
test rcx, rcx
je 0x7fff25d9a2ec
mov eax, dword [rsp + 0x104]
mov dword [rcx], eax
mov rax, qword [rsp + 0x300]
test rax, rax
jne 0x7fff25d9a47b
cmp qword [rsp + 0x1f0], r10
je 0x7fff25d9a317
mov ebx, r10d
cmp ebx, dword [rsp + 0xfc]
jb 0x7fff25d9a451
mov r8, qword [rsp + 0x208]
test r8, r8
jne 0x7fff25df1b5a
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x2d8]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x1f0]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x210]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x298]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x240]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x278]
xor r15d, r15d
test rbx, rbx
jne 0x7fff25df1b6a
lea rax, [rsp + 0xfe0]
mov r14, qword [rsp + 0x200]
cmp r14, rax
je 0x7fff25df1b89
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
nop dword [rax + rax]
cmp dword [rsp + 0x530], r15d
jne 0x7fff25df1c07
mov eax, dword [rsp + 0xe8]
mov rcx, qword [rsp + 0x11f0]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x1200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
lea rcx, [rax + rax*4]
shl rcx, 4
add rcx, qword [rsp + 0x1f0]
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x7fff25d9a474
call sym.KERNELBASE.dll_CloseHandle
xor r10d, r10d
inc ebx
jmp 0x7fff25d9a30a
mov rcx, rax
call sym.KERNELBASE.dll_CloseHandle
xor r10d, r10d
jmp 0x7fff25d9a2fd
mov ebx, 1
jmp 0x7fff25d9a2b6
mov ecx, r10d
jmp 0x7fff25d94b37
mov rax, qword gs:[0x30]
lea rcx, [rax + 0x1268]
lea rdx, [rsp + 0xfe0]
mov eax, 4
lea r9d, [rax + 0x7c]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
add rdx, r9
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, r9
sub rax, 1
jne 0x7fff25df18c1
mov rax, qword [rcx]
mov qword [rdx], rax
movzx eax, word [rcx + 8]
mov word [rdx + 8], ax
lea rax, [rsp + 0xfe0]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x330], rax
mov edx, 1
jmp 0x7fff25d94b87
test r12, r12
jne 0x7fff25df1962
lea rcx, [rsp + 0x510]
call 0x7fff25e050f4
xor edx, edx
jmp 0x7fff25d94c2d
mov ecx, ebx
call fcn.7fff25d6b370
xor eax, eax
jmp 0x7fff25d9a42d
mov dword [rsp + 0x4d8], edx
jmp 0x7fff25d94c3e
mov r8d, 1
mov r14d, r8d
mov dword [rsp + 0xf0], r8d
mov dword [rsp + 0x1c4], r8d
test bl, 0x10
je 0x7fff25d94c62
and eax, 0xfffffffd
mov dword [r13], eax
mov eax, 0x4ac3
mov rcx, qword [rsp + 0x180]
mov word [rcx], ax
jmp 0x7fff25d94c51
lea rcx, [rsp + 0x340]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
xor r10d, r10d
jmp 0x7fff25d9a230
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_TpWaitForWait]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_TpReleaseWait]
nop dword [rax + rax]
xor r10d, r10d
jmp 0x7fff25d9a241
cmp dword [rsp + 0xe8], r10d
je 0x7fff25d9a2b6
mov rcx, rdi
call fcn.7fff25d946e8
test eax, eax
je 0x7fff25df1a26
test r12, r12
jne 0x7fff25df1a26
mov edx, dword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x90]
call sym.KERNELBASE.dll_BaseMarkFileForDelete
mov ecx, 0xc0000240
call fcn.7fff25d6b370
xor r10d, r10d
mov dword [rsp + 0xe8], r10d
jmp 0x7fff25d9a2b6
mov dword [rsp + 0xe8], r10d
mov rax, qword [rdi]
cmp qword [rdi + 8], rax
jl 0x7fff25df1ab4
mov rcx, rdi
call fcn.7fff25d946e8
xor esi, esi
test eax, eax
jne 0x7fff25df1ab4
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x188], rax
mov dword [rsp + 0x20], 0x14
lea r9d, [rsi + 8]
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x7fff25df1aad
mov dword [rsp + 0xe8], ebx
mov dword [rdi + 0x68], esi
mov ecx, eax
jmp 0x7fff25df1b4d
mov r15, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x180]
mov qword [rbx + 0x28], r15
mov rcx, rbx
call 0x7fff25e05580
mov dword [rbx + 0x34], eax
mov qword [rsp + 0x188], r15
mov dword [rsp + 0x20], 0x14
mov r9d, 8
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov r8d, dword [rsp + 0x104]
test r12, r12
cmovne r8d, dword [rsp + 0x1268]
mov rcx, qword [rsp + 0x90]
cmovne rcx, r12
mov r9d, dword [rsp + 0x168]
mov rdx, rbx
call 0x7fff25e07054
xor r10d, r10d
test eax, eax
je 0x7fff25d9a2c5
mov ecx, 0xc0000459
call fcn.7fff25d6b370
xor r10d, r10d
jmp 0x7fff25d9a2c5
xor edx, edx
lea ecx, [rdx + 3]
call fcn.7fff25d8e900
nop
jmp 0x7fff25d9a328
call sym.KERNELBASE.dll_GetProcessHeap
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
nop
jmp 0x7fff25d9a3eb
mov rax, qword gs:[0x30]
lea rcx, [rax + 0x1268]
lea rdx, [rsp + 0xfe0]
mov eax, 4
lea r8d, [rax + 0x7c]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r8
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rdx, r8
sub rax, 1
jne 0x7fff25df1baa
mov rax, qword [rdx]
mov qword [rcx], rax
movzx eax, word [rdx + 8]
mov word [rcx + 8], ax
jmp 0x7fff25d9a404
mov dword [rsp + 0x150], r15d
mov dword [rsp + 0x120], r15d
mov rbx, r15
call qword [sym.imp.ntdll.dll_RtlGetLastWin32Error]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlGetLastNtStatus]
nop dword [rax + rax]
mov esi, eax
test r14, r14
je 0x7fff25df1c52
mov edx, 0x2e
mov rcx, r14
call qword [sym.imp.ntdll.dll_wcsrchr]
nop dword [rax + rax]
mov rbx, rax
cmp dword [rsp + 0x248], r15d
jne 0x7fff25df1d4c
xor edx, edx
mov r8d, 0x218
lea rcx, [rsp + 0x890]
call sub.ntdll.dll_memset
xor edx, edx
mov r8d, 0x218
lea rcx, [rsp + 0xab0]
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x90]
cmp rcx, 0xffffffffffffffff
je 0x7fff25df1d0c
mov dword [rsp + 0x20], 5
mov r9d, 0x218
lea r8, [rsp + 0xab0]
lea rdx, [rsp + 0x130]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
mov dword [rsp + 0x20], 4
mov r9d, 0x28
lea r8, [rsp + 0x640]
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
mov ecx, dword [rsp + 0xec]
test eax, eax
cmovns ecx, dword [rsp + 0x660]
mov dword [rsp + 0xec], ecx
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x7fff25df1d4c
cmp qword [rax], 0xffffffffffffffff
je 0x7fff25df1d4c
mov dword [rsp + 0x20], 5
mov r9d, 0x218
lea r8, [rsp + 0x890]
lea rdx, [rsp + 0x130]
mov rcx, qword [rax]
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
nop dword [rax + rax]
call fcn.7fff25dd02e4
test al, al
je 0x7fff25df1dc5
test r14, r14
je 0x7fff25df1d8b
test dword [rsp + 0x1a4], 0x4000
je 0x7fff25df1d8b
cmp dword [rsp + 0x1d0], r15d
jne 0x7fff25df1d8b
xor r8d, r8d
lea rdx, [rsp + 0x150]
mov rcx, r14
call qword [sym.imp.ext_ms_win_feclient_encryptedfile_l1_1_0.dll_EfsClientGetEncryptedFileVersion]
nop dword [rax + rax]
test r13, r13
je 0x7fff25df1dc5
bt dword [rsp + 0xec], 0xe
setb dl
test byte [rsp + 0x1d4], 0x10
sete al
test al, dl
je 0x7fff25df1dc5
xor r8d, r8d
lea rdx, [rsp + 0x120]
mov rcx, r13
call qword [sym.imp.ext_ms_win_feclient_encryptedfile_l1_1_0.dll_EfsClientGetEncryptedFileVersion]
nop dword [rax + rax]
cmp dword [0x7fff25fcf188], 5
jbe 0x7fff25df1fea
movabs rdx, 0x400000000000
test qword [0x7fff25fcf198], rdx
je 0x7fff25df1fea
mov rax, qword [0x7fff25fcf1a0]
and rax, rdx
cmp rax, qword [0x7fff25fcf1a0]
jne 0x7fff25df1fea
mov eax, edi
cmp dword [rsp + 0xe8], r15d
cmovne eax, r15d
mov dword [rsp + 0xc8], eax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0xf30], rax
mov qword [rsp + 0xf38], 4
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x7fff25df1e43
mov rax, qword [rax]
jmp 0x7fff25df1e46
mov rax, r15
mov qword [rsp + 0x338], rax
lea rax, [rsp + 0x338]
mov qword [rsp + 0xf40], rax
mov qword [rsp + 0xf48], 8
mov eax, dword [rsp + 0x1a4]
shr eax, 0xe
mov ecx, 1
and al, cl
mov byte [rsp + 0x172], al
lea rax, [rsp + 0x172]
mov qword [rsp + 0xf50], rax
mov qword [rsp + 0xf58], rcx
mov eax, dword [rsp + 0xec]
shr eax, 0xe
and al, cl
mov byte [rsp + 0x171], al
lea rax, [rsp + 0x171]
mov qword [rsp + 0xf60], rax
mov qword [rsp + 0xf68], rcx
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x2ac], eax
lea rax, [rsp + 0x2ac]
mov qword [rsp + 0xf70], rax
mov qword [rsp + 0xf78], 4
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0x2b0], eax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0xf80], rax
mov qword [rsp + 0xf88], 4
lea rdx, [rsp + 0x89c]
lea rcx, [rsp + 0xf90]
call 0x7fff25e07c94
lea rdx, [rsp + 0xabc]
lea rcx, [rsp + 0xfa0]
call 0x7fff25e07c94
mov ecx, dword [rsp + 0x1d0]
mov dword [rsp + 0x288], ecx
lea rax, [rsp + 0x288]
mov qword [rsp + 0xfb0], rax
mov qword [rsp + 0xfb8], 4
mov eax, dword [rsp + 0x1d4]
mov dword [rsp + 0x1b0], eax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0xfc0], rax
mov qword [rsp + 0xfc8], 4
lea rdx, [0x7fff25f9c250]
test rbx, rbx
cmovne rdx, rbx
lea rcx, [rsp + 0xfd0]
call 0x7fff25e07c94
lea rcx, [rsp + 0xf10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0xd
lea r9, [rsp + 0x510]
lea r8, [rsp + 0x520]
lea rdx, [0x7fff25f9b105]
lea rcx, [0x7fff25fcf188]
call fcn.7fff25d86f48
lea rdx, [rsp + 0x510]
mov ecx, 2
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventActivityIdControl]
nop dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al