Function at 0x140047ef0
Capabilities:
Delete file
Move file
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x140048a81
mov r9d, ebx
mov r14d, ebx
mov qword [rsp + 0x100], rbx
cmp dword [rcx + 0x48], ebx
jne 0x140047f2d
mov eax, dword [rcx + 0x28]
cmp dword [rcx + 0x2c], eax
je 0x140047f33
mov r9d, 1
mov r10, qword [rcx + 0x50]
test r10, r10
je 0x140047f7f
mov rax, qword [rcx + 0x60]
mov r8, r10
add rax, 0x10
mov edx, dword [rax + 8]
test edx, edx
jne 0x140047f60
cmp qword [rax], rbx
jne 0x140047f60
mov rcx, qword [rax - 8]
test rcx, rcx
je 0x140047f6a
cmp dword [rcx], ebx
je 0x140047f6a
mov r9d, 1
test edx, edx
jne 0x140047f6d
inc r14
add rax, 0x20
sub r8, 1
jne 0x140047f47
mov qword [rsp + 0x100], r14
test r14, r14
jne 0x140047fc7
mov rcx, qword [rdi]
test rcx, rcx
je 0x140047fcc
test byte [rdi + 0x10], 8
jne 0x140047f9d
test r9d, r9d
je 0x140047fcc
cmp qword [rdi + 8], rbx
je 0x140047fcc
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x140047fcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
add rdi, 0x18
je 0x140048a81
mov dword [rdi], socket
mov dword [rdi + 4], ecx
jmp 0x140048a81
test r9d, r9d
jne 0x140047fdb
mov rcx, rdi
call fcn.14004dbb0
xor eax, eax
jmp 0x140048a86
cmp r14, r10
ja 0x14004826a
mov rcx, r14
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0xf8], rax
mov r12, rax
test rax, rax
je 0x140048a81
mov ecx, dword [rdi + 0x2c]
test cl, 1
je 0x140048121
lea r14, [rdi + 0x18]
test cl, 2
je 0x140048032
test r14, r14
je 0x14004838c
mov qword [r14], 0x19
mov rcx, rax
jmp 0x140048a7b
mov edx, socket
lea rcx, str.TORRENTZIPPED_XXXXXXXX
mov r9, r14
xor r8d, r8d
call fcn.14004ddd0
mov rsi, rax
test rax, rax
je 0x14004838c
xor edx, edx
mov rcx, rax
call fcn.14004e7f0
cmp eax, 4
jne 0x140048098
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test r14, r14
je 0x14004838c
mov qword [r14], reloc.WS2_32.dll_select
mov rcx, r12
jmp 0x140048a7b
mov r14, qword [rdi + 0x40]
test r14, r14
je 0x1400480bd
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rdi + 0x38]
mov qword [rdi + 0x40], rbx
test rcx, rcx
je 0x14004810d
movzx eax, word [rcx + 8]
cmp ax, word [rsi + 8]
jne 0x14004810d
mov rdx, qword [rsi]
mov r8d, eax
mov rcx, qword [rcx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov ecx, ebx
sete cl
test ecx, ecx
je 0x14004810d
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
jmp 0x140048116
mov qword [rdi + 0x40], rsi
mov eax, 1
mov r14, qword [rsp + 0x100]
mov dword [rdi + 0x48], eax
mov r13, rbx
mov rbp, rbx
cmp qword [rdi + 0x50], rbx
jbe 0x140048254
mov r15, rbx
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi + 0x60]
cmp dword [r15 + rax + 0x18], ebx
jne 0x14004820f
lea rsi, [rdi + 0x18]
cmp r13, r14
jae 0x140048229
mov qword [r12], rbp
cmp rbp, qword [rdi + 0x50]
jb 0x14004817b
test rsi, rsi
je 0x140048200
mov qword [rsi], reloc.WS2_32.dll_select
jmp 0x140048200
mov rax, qword [rdi + 0x60]
mov r14, qword [r15 + rax + 8]
test r14, r14
jne 0x1400481a7
mov r14, qword [r15 + rax]
test r14, r14
je 0x140048166
cmp dword [r15 + rax + 0x18], ebx
je 0x1400481a7
test rsi, rsi
je 0x140048200
mov qword [rsi], reloc.WS2_32.dll_socket
jmp 0x140048200
mov r14, qword [r14 + 0x38]
test r14, r14
jne 0x1400481b9
lea rax, [0x1400ae139]
jmp 0x140048203
cmp dword [r14 + 0xc], ebx
jne 0x1400481c9
xor edx, edx
mov rcx, r14
call fcn.14004e7f0
cmp dword [r14 + 0xc], 4
jne 0x1400481f8
mov rax, qword [r14 + 0x10]
test rax, rax
jne 0x140048203
movzx edx, word [r14 + 8]
lea r8, [r14 + 0x18]
mov rcx, qword [r14]
mov r9, rsi
call fcn.14004e930
mov qword [r14 + 0x10], rax
test rax, rax
je 0x140048200
jmp 0x140048203
mov rax, qword [r14]
test rax, rax
jne 0x140048203
mov rax, rbx
inc r13
mov qword [r12 + 8], rax
add r12, 0x10
inc rbp
add r15, 0x20
cmp rbp, qword [rdi + 0x50]
jae 0x14004824c
mov r14, qword [rsp + 0x100]
jmp 0x140048140
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rsi, rsi
je 0x140048a81
mov qword [rsi], socket
jmp 0x140048a81
mov r12, qword [rsp + 0xf8]
mov r14, qword [rsp + 0x100]
cmp r13, r14
jae 0x140048280
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rdi, 0x18
je 0x140048a81
mov qword [rdi], socket
jmp 0x140048a81
mov rax, qword [rdi + 0x78]
lea rsi, [rdi + 0x78]
mov rcx, 0xffffffffffffffff
test rax, rax
je 0x1400482d0
inc rcx
cmp byte [rax + rcx], bl
jne 0x140048294
add rcx, 0xd
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x1400482c7
add rdi, 0x18
je 0x14004838c
mov qword [rdi], recv
mov rcx, r12
jmp 0x140048a7b
lea rdx, str._s_.zip.XXXXXX
jmp 0x1400482f7
mov rax, qword [rdi]
inc rcx
cmp byte [rax + rcx], bl
jne 0x1400482d3
add rcx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1400482ae
lea rdx, str._s.XXXXXX
mov rsi, rdi
mov r8, qword [rsi]
mov rcx, rbp
call fcn.14000e090
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__mktemp]
mov rcx, rax
mov edx, 0x180
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__creat]
cmp eax, 0xffffffff
lea rdx, [0x14014b72c]
mov esi, eax
cmove esi, ebx
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
mov r15, rax
test rax, rax
jne 0x140048371
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
add rdi, 0x18
je 0x14004834f
mov dword [rdi], recv
mov dword [rdi + 4], ecx
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
jmp 0x140048a7b
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
mov edx, 0x8000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__setmode]
test rbp, rbp
jne 0x140048394
mov rcx, r12
jmp 0x140048a7b
test byte [rdi + 0x2c], 1
je 0x1400483c4
lea r9, [0x140049300]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
test byte [rdi + 0x2c], 1
je 0x1400483c4
test byte [rdi + 0x28], 1
mov ecx, 1
je 0x1400483c7
mov rcx, rbx
mov qword [rsp + 0x48], rcx
mov rax, rbx
mov qword [rsp + 0x40], rbx
test r14, r14
je 0x140048ab2
add rax, rax
mov esi, 0xfff7
mov rax, qword [r12 + rax*8]
mov r12, rax
mov qword [rsp + 0x108], rax
shl r12, 5
add r12, qword [rdi + 0x60]
mov qword [rsp + 0x30], r12
cmp qword [r12 + 0x10], rbx
jne 0x140048421
test rcx, rcx
jne 0x140048421
mov rax, qword [r12 + 8]
test rax, rax
je 0x14004841c
test byte [rax], 1
jne 0x140048421
mov r13d, ebx
jmp 0x140048427
mov r13d, 1
mov r14, qword [r12 + 8]
test r14, r14
jne 0x1400484e4
mov rsi, qword [r12]
mov ecx, 0x68
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x14004894f
test rsi, rsi
je 0x14004848f
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rsi + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rsi + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rsi + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rsi + 0x50]
movups xmmword [rax + 0x50], xmm1
movsd xmm0, qword [rsi + 0x60]
movsd qword [rax + 0x60], xmm0
jmp 0x1400484d1
mov dword [rax + 4], ebx
mov dword [rax + 0xc], 0x140314
mov word [rax + 0x10], bx
mov dword [rax + 0x14], 0xffffffff
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], ebx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov qword [rax + 0x38], rbx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov dword [rax + 0x50], ebx
mov word [rax + 0x54], bx
mov dword [rax + 0x58], 0x81b60000
mov qword [rax + 0x60], rbx
mov dword [rax], ebx
mov esi, 0xfff7
mov dword [rax + 8], 1
mov qword [r12 + 8], rax
mov rdx, qword [rsp + 0x108]
mov rcx, rdi
call fcn.14004d830
test eax, eax
js 0x140048a58
test byte [rdi + 0x2c], 1
je 0x14004850c
mov rcx, qword [r12 + 8]
call fcn.14004c290
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rcx, eax
mov qword [r14 + 0x60], rcx
test r13d, r13d
je 0x14004880b
mov rsi, rbx
cmp qword [r12 + 0x10], rbx
jne 0x140048784
mov rsi, qword [rsp + 0x108]
cmp rsi, qword [rdi + 0x50]
jae 0x140048a10
lea r9, [rsp + 0x60]
mov r8d, 8
mov rdx, rsi
mov rcx, rdi
call fcn.14004e570
test eax, eax
js 0x140048a01
cmp word [rsp + 0x96], bx
jne 0x1400489f2
movzx eax, word [rsp + 0x94]
mov qword [rsp + 0x108], rbx
test ax, ax
je 0x14004859f
cmp ax, 8
jne 0x14004896a
lea rax, [0x14004ea90]
mov qword [rsp + 0x108], rax
lea r12, [rdi + 0x18]
mov rdx, rsi
mov r8, r12
mov rcx, rdi
call fcn.14004daa0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140048a58
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140048631
mov ecx, 0x28
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
test rax, rax
je 0x14004899b
xor ecx, ecx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], ebx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, 0x20
mov qword [r13 + 0x18], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140048980
mov qword [rax], rbx
mov qword [rax + 0x18], rbx
lea rax, [0x14004e440]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r13
jmp 0x140048775
mov r13, qword [rdi + 8]
test r13, r13
je 0x1400489e3
mov ecx, 0x78
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14004899b
mov qword [rax], rbx
mov rcx, 0xffffffffffffffff
mov qword [rax + 8], r13
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x58], rax
mov rax, qword [rsp + 0x58]
mov dword [rsi + 0x10], ebx
test rax, rax
cmovne rcx, rax
mov qword [rsi + 0x60], rcx
mov ecx, 0x20
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x28], xmm1
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsi + 0x38], xmm0
movaps xmm1, xmmword [rsp + 0x90]
movups xmmword [rsi + 0x48], xmm1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
test rax, rax
je 0x1400489cb
mov qword [rax], rbx
mov qword [rax + 0x18], rbx
lea rax, [0x14004e160]
mov qword [r13 + 8], rax
mov rax, qword [rsp + 0x108]
mov qword [r13 + 0x10], rsi
test rax, rax
je 0x140048703
movzx r8d, word [rsp + 0x94]
xor r9d, r9d
mov rdx, r13
mov rcx, rdi
call rax
test rax, rax
je 0x1400489be
mov r13, rax
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
test rax, rax
je 0x1400489b1
mov ecx, 0x20
mov dword [rax], ebx
mov qword [rax + 4], 1
mov dword [rax + 0xc], ebx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x140048756
lea rax, [rdi + 0x18]
test rax, rax
je 0x140048751
mov qword [rax], recv
mov rsi, rbx
jmp 0x14004876c
mov qword [rax + 0x18], rbx
mov qword [rax], r13
lea rax, [0x14004d180]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r12
test rsi, rsi
je 0x1400489be
test rsi, rsi
je 0x14004877f
mov rdx, rsi
jmp 0x140048789
mov r12, qword [rsp + 0x30]
mov rdx, qword [r12 + 0x10]
mov r9, r15
mov r8, r14
mov rcx, rdi
call fcn.140048c80
test eax, eax
js 0x140048a1f
test rsi, rsi
je 0x14004891f
cmp dword [rsi + 0x1c], ebx
je 0x1400487b5
mov rcx, rsi
call fcn.14004a940
mov rcx, qword [rsi]
xor r8d, r8d
mov rax, qword [rsi + 0x10]
mov r10, qword [rsi + 8]
test rcx, rcx
jne 0x1400487e4
mov r9d, 5
xor edx, edx
mov rcx, rax
call r10
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14004891f
xor r9d, r9d
mov dword [rsp + 0x20], 5
mov rdx, rax
call r10
mov rcx, qword [rsi]
call fcn.14004a750
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14004891f
and word [r14 + 0x10], si
mov r8d, 0x100
lea rsi, [rdi + 0x18]
mov rdx, r15
mov r9, rsi
mov rcx, r14
call fcn.14004c380
test eax, eax
js 0x140048a58
mov rax, qword [rdi + 0x60]
xor r8d, r8d
mov rcx, qword [rsp + 0x108]
shl rcx, 5
mov rcx, qword [rcx + rax]
mov r13, qword [rcx + 0x60]
mov rcx, qword [rdi + 8]
mov edx, r13d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140048a9a
mov r12, qword [rdi + 8]
mov edx, 0x1a
mov rcx, r12
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
js 0x140048a9a
mov r9, r12
lea rcx, [rsp + 0xf0]
mov edx, 4
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x140048a42
movzx eax, byte [rsp + 0xf3]
movzx edx, byte [rsp + 0xf0]
movzx ecx, byte [rsp + 0xf1]
add edx, 0x1e
add ecx, eax
movzx eax, byte [rsp + 0xf2]
shl ecx, 8
add ecx, eax
add edx, ecx
add rdx, r13
cmp rdx, 0x7fffffff
ja 0x140048a2e
test rdx, rdx
je 0x140048a58
mov rcx, qword [rdi + 8]
lea rsi, [rdi + 0x18]
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
js 0x140048b56
mov rdx, qword [r14 + 0x28]
mov r9, rsi
mov rcx, qword [rdi + 8]
mov r8, r15
call fcn.1400490b0
test eax, eax
js 0x140048a58
mov rax, qword [rsp + 0x40]
mov r14, qword [rsp + 0x100]
inc rax
mov qword [rsp + 0x40], rax
cmp rax, r14
jae 0x140048ab2
mov r12, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x48]
jmp 0x1400483dd
mov qword [r12 + 8], rbx
add rdi, 0x18
je 0x140048a58
mov qword [rdi], recv
jmp 0x140048a58
add rdi, 0x18
je 0x140048a58
mov qword [rdi], reloc.WS2_32.dll_recv
jmp 0x140048a58
test r12, r12
je 0x14004898d
mov qword [r12], recv
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140048a58
test r12, r12
je 0x140048a58
mov qword [r12], recv
jmp 0x140048a58
add rdi, 0x18
je 0x1400489be
mov qword [rdi], recv
mov rcx, r13
call fcn.14004a750
jmp 0x140048a58
test r12, r12
je 0x1400489d8
mov qword [r12], recv
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140048a58
test r12, r12
je 0x140048a58
mov qword [r12], reloc.WS2_32.dll_select
jmp 0x140048a58
add rdi, 0x18
je 0x140048a58
mov qword [rdi], 0x1a
jmp 0x140048a58
add rdi, 0x18
je 0x140048a58
mov qword [rdi], socket
jmp 0x140048a58
add rdi, 0x18
je 0x140048a58
mov qword [rdi], reloc.WS2_32.dll_select
jmp 0x140048a58
test rsi, rsi
je 0x140048a58
mov rcx, rsi
call fcn.14004a750
jmp 0x140048a58
test rsi, rsi
je 0x140048a58
mov dword [rsi + 4], 0x1b
mov dword [rsi], 4
jmp 0x140048a58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
test rsi, rsi
je 0x140048a58
mov dword [rsi], 5
mov dword [rsi + 4], ecx
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 0xffffffff
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
test rsi, rsi
je 0x140048a58
mov dword [rsi + 4], ecx
mov dword [rsi], 4
jmp 0x140048a58
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rsi, qword [rsp + 0xf8]
mov r9, r15
mov rdx, rsi
mov r8, r14
mov rcx, rdi
mov r12d, eax
call fcn.14004af20
mov r14, rax
test rax, rax
js 0x140048a58
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
test byte [rdi + 0x2c], 1
mov r13d, eax
jne 0x140048afd
mov rcx, rsi
jmp 0x140048bb5
lea rsi, [rdi + 0x18]
mov r8d, r14d
lea r9, [rsp + 0xf0]
mov qword [rsp + 0x20], rsi
mov edx, r12d
mov rcx, r15
call fcn.14004a650
test eax, eax
js 0x140048a58
mov r9d, dword [rsp + 0xf0]
lea r8, str._08lX
mov edx, 9
lea rcx, [rsp + 0x30]
call fcn.140047e90
lea edx, [r13 - 8]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jns 0x140048b72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
test rsi, rsi
je 0x140048a58
mov dword [rsi], 4
jmp 0x140048a55
mov r9, r15
lea rcx, [rsp + 0x30]
mov edx, 8
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
je 0x140048bad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
test rsi, rsi
je 0x140048a58
mov dword [rsi], 6
jmp 0x140048a55
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
je 0x140048be8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
add rdi, 0x18
je 0x140048a6f
mov dword [rdi], 3
mov dword [rdi + 4], ecx
jmp 0x140048a6f
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140048c00
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rdi + 8], rbx
mov ebx, 1
mov rdx, qword [rdi]
mov r8d, 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x140048c63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
lea rax, [rdi + 0x18]
test rax, rax
je 0x140048c30
mov dword [rax], 2
mov dword [rax + 4], ecx
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebx, ebx
je 0x140048a81
mov rcx, qword [rdi]
lea rdx, [0x1400aced8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rdi + 8], rax
jmp 0x140048a81
mov rcx, rdi
call fcn.14004dbb0
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x140048a86