Function at 0x44da90
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
sub esp, 0x68
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x44dcd4
mov r8d, 0xffffffff
cmp rax, r8
cmovb r8, rax
cmovb eax, eax
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x34], 0
xor al, 0
add byte [rax], al
invalid
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x58], rax
lea rax, [0x0044dfb0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x40]
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x44db5c
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x44db00
mov edx, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3c]
mov rax, rdx
shl rax, 0x20
or rax, 2
xor r8d, r8d
rol byte [rbp - 0x6af0be2e], 0xc0
cmove rax, rcx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rax
je case.0x44d98f.52
lea rsi, [rsp + 0x48]
mov ecx, eax
and ecx, 3
lea rdx, [0x004a6274]
adc eax, 0x58721
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
loopne 0x44db85
or rax, 2
mov qword [rsp + 0x40], 1
and al, 0x40
add dword [rax], eax
add byte [rax], al
invalid
lea rsi, [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov ecx, eax
and ecx, 3
lea rdx, [0x004a6274]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
movzx ecx, byte [rax + 0x10]
jmp case.0x44d955.72
add rsi, rcx
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
jmp 0x44dbfa
mov rcx, rax
shr rcx, 0x20
mov rdi, rax
call fcn.00454d60
mov ecx, eax
mov rax, rdi
jmp case.0x44d955.72
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x28
ja case.default.0x44dbe3
add byte [rax], al
lea rdx, [0x004a6284]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
xor ecx, ecx
jmp case.0x44d955.72
movzx ecx, byte [rax + 0xf]
cmp cl, 0xb
jne 0x44dbfc
mov rcx, rsi
mov ecx, esi
call fcn.0040e270
invalid
xor eax, eax
ror byte [rax - 0x7d], 0xc4
add rsp, 0x68
push 0xffffffffb1c35e5f
pop rdi
pop rsi
ret
mov cl, 0x25
jmp case.0x44d955.72
and eax, 0x23b1e6eb
mov cl, 0x23
jmp case.0x44d955.72
mov cl, 0x24
jmp case.0x44d955.72
mov cl, 0x1b
jmp case.0x44d955.72
mov cl, 0x22
jmp case.0x44d955.72
mov cl, 0x10
jmp case.0x44d955.72
mov cl, 0xe
jmp case.0x44d955.72
mov cl, 0x21
jmp case.0x44d955.72
mov cl, 0xb
jmp case.0x44d955.72
mov cl, 4
jmp case.0x44d955.72
mov cl, 0x28
jmp case.0x44d955.72
mov cl, 0xc
jmp case.0x44d955.72
mov cl, 9
jmp case.0x44d955.72
mov cl, 0x19
jmp case.0x44d955.72
mov cl, 0x18
jmp case.0x44d955.72
mov cl, 2
jmp case.0x44d955.72
mov cl, 0xf
jmp case.0x44d955.72
mov cl, 3
jmp case.0x44d955.72
mov cl, 7
jmp case.0x44d955.72
mov cl, 1
jmp case.0x44d955.72
mov cl, 0x1f
jmp case.0x44d955.72
mov cl, 0x11
jmp case.0x44d955.72
mov cl, 0x29
jmp case.0x44d955.72
mov cl, 0x14
jmp case.0x44d955.72
invalid
mov dh, byte [rcx - 0x4e7914fb]
adc eax, 0xdb182eb
jmp case.0x44d955.72
mov cl, 0xd
mov cl, 5
jmp case.0x44d955.72
mov cl, 0x15
jmp case.0x44d955.72
mov cl, 0xd
jmp case.0x44d955.72
invalid
mov cl, 6
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x12
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0xa
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 8
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x1e
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x20
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x16
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x27
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x13
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x17
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x1c
jmp case.0x44d955.72
invalid
invalid
invalid
mov cl, 0x1d
jmp case.0x44d955.72
invalid
invalid
mov cl, 0x26
jmp case.0x44d955.72
mov cl, 0x1a
jmp case.0x44d955.72
lea r8, [0x004a6be0]
mov rcx, rsi
call fcn.00491fe0
int3
mov eax, 1
jmp 0x44df6c
cmp r12, rbx
jne 0x44dd8c
mov rcx, rdi
mov rdx, rsi
call fcn.004372f0
test rax, rax
jne 0x44dd2f
test rdx, rdx
je 0x44df61
mov rbx, qword [rsi]
mov r12, qword [rsi + 0x10]
cmp r12, rbx
jne 0x44ddd0
mov r15, rbx
add r15, 0x20
jb 0x44df50
lea rax, [rbx + rbx]
cmp rax, r15
cmova r15, rax
test rbx, rbx
je 0x44dde0
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbx
mov eax, 1
jmp 0x44dde2
mov rax, qword [rsi + 8]
jmp 0x44de1e
xor eax, eax
mov rdx, r15
not rdx
shr rdx, 0x3f
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
mov r8, r15
lea r9, [rsp + 0x20]
call fcn.00418450
cmp qword [rsp + 0x50], 0
jne 0x44df7d
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rax
mov qword [rsi], r15
mov rbx, r15
add rax, r12
mov r15, rbx
sub r15, r12
cmp r15, rbp
cmovae r15, rbp
std
std
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], 0
xor byte [rax], al
add byte [rax], al
add byte [rcx + rcx*4 + 0x74], cl
and al, 0x38
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.0044a690
mov rdx, rax
test rax, rax
lea r14, [rsp + 0x50]
jne 0x44df10
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r14, rdx
invalid
sub r14, rcx
jb 0x44df9e
invalid
mov rax, qword [rsp + 0x28]
and al, 0x28
cmp rdx, rax
ja 0x44df8c
test rcx, rcx
je 0x44df44
invalid
mov bl, 0
add byte [rax], al
add r12, rcx
cmp rdx, r15
mov rdx, 0xffffffffffffffff
cmovne rbp, rdx
lea rax, [rbp*2]
test rbp, rbp
cmovs rax, rdx
cmp r15, rbp
cmovb rax, rbp
mov qword [rsi + 0x10], r12
cmp rcx, r15
cmove rbp, rax
mov r15, qword [rsp + 0x48]
cmp rbx, r15
je 0x44dd67
jmp 0x44dd8c
mov ecx, edx
and ecx, 3
mov eax, 1
movsxd rcx, dword [r13 + rcx*4]
add rcx, r13
jmp rcx
sub r12, qword [rsp + 0x40]
xor eax, eax
mov rdx, r12
jmp 0x44df6c
mov eax, 1
movabs rdx, 0x2600000003
jmp 0x44df6c
mov rdx, qword [rsi + 0x10]
sub rdx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rdx, 0x2600000003
jmp 0x44dd2f
lea r8, [0x004a9350]
mov rcx, rdx
mov rdx, rax
call fcn.00492070
lea r8, [0x004a9350]
call fcn.00492100
int3
cmp qword [rsp + 0x260], 0
je 0x450774
mov rcx, qword [rsp + 0x268]
test rcx, rcx
je 0x45074b
mov rdx, qword [rsp + 0x270]
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x2d8], 0
test byte [rax + rbx*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
mov word [rax + riz*8], fs
add al, byte [rax]
add byte [rax], al
test byte [rax + rbx*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
mov word [rax + riz*8], fs
add al, byte [rax]
add byte [rax], al
mov qword [rsp + 0x2e8], rdx
mov qword [rsp + 0x2f8], 0
mov qword [rsp + 0x300], rcx
mov qword [rsp + 0x308], rdx
mov ecx, 1
mov qword [rsp + 0x2e8], rdx
mov qword [rsp + 0x2f8], 0
mov qword [rsp + 0x300], rcx
mov qword [rsp + 0x308], rdx
mov ecx, 1
jmp 0x45074f
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x2d0], rcx
mov qword [rsp + 0x2f0], rcx
mov qword [rsp + 0x310], rax
lea rcx, [rsp + 0x2d0]
call fcn.0040d3a0
mov rax, qword [rsp + 0x1b8]
cmp dword [rax], 4
jb 0x45078a
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x700]
add rsp, 0x718
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x45099d
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.00404340
test sil, sil
je 0x4506e0
jmp 0x450774
mov eax, 2
xor esi, esi
xor r13d, r13d
mov qword [rsp + 0x1a8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x004d8150], cl
jne 0x451a19
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x100], rbx
mov rax, qword [0x004d8120]
dec r12
test rax, r12
mov dword [rsp + 0x10c], edi
je 0x45162a
call fcn.004446f0
mov r13, r12
xor al, 1
jmp 0x45162f
call fcn.00414340
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x4517cb
mov r9, qword [rsp + 0xa0]
imul r8, r9, 0x38
mov rdx, qword [rax + r8 + 0x168]
cmp rdx, r12
je 0x4517cb
shl r9, 5
mov rcx, qword [rax + r8 + 0x170]
mov rbx, qword [rax + r8 + 0x188]
mov r10, qword [rax + r8 + 0x190]
mov qword [rsp + 0x100], r10
mov r10, qword [rax + r8 + 0x198]
mov qword [rsp + 0x1a8], r10
mov r10, qword [rax + r9]
mov qword [rsp + 0x68], r10
mov r10, qword [rax + r9 + 8]
mov qword [rsp + 0x80], r10
mov rsi, qword [rax + r9 + 0x10]
mov rax, qword [rax + r8 + 0x178]
add rax, rcx
xor r11d, r11d
mov r8, rcx
jmp 0x450f3d
xor r11d, r11d
test r9w, r9w
je 0x451264
mov r9w, 1
test r11w, r11w
jne 0x450f30
cmp r8, rax
je 0x450ff8
movzx r11d, byte [r8]
test r11b, r11b
js 0x450f65
inc r8
mov r10d, r11d
jmp 0x450fed
mov r10d, r11d
and r10d, 0x1f
movzx r13d, byte [r8 + 1]
and r13d, 0x3f
cmp r11b, 0xdf
jbe 0x450fb3
mov r12, rbp
movzx ebp, byte [r8 + 2]
shl r13d, 6
and ebp, 0x3f
or ebp, r13d
cmp r11b, 0xf0
jb 0x450fc0
movzx r11d, byte [r8 + 3]
add r8, 4
and r10d, 7
shl r10d, 0x12
shl ebp, 6
and r11d, 0x3f
or r11d, ebp
or r10d, r11d
jmp 0x450fcb
add r8, 2
shl r10d, 6
or r10d, r13d
jmp 0x450fed
add r8, 3
shl r10d, 0xc
or r10d, ebp
cmp r10d, 0xffff
mov rbp, r12
jbe 0x450fed
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x450f33
xor r11d, r11d
mov r9d, r10d
jmp 0x450f33
test rdx, rdx
je 0x451008
mov r8d, 1
call fcn.00404340
mov rax, qword [rsp + 0x130]
sub rax, rdi
mov r8, qword [rsp + 0x1a8]
cmp rax, r8
cmp eax, eax
jae 0x451048
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.00418fa0
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov r8, qword [rsp + 0x1a8]
mov r13, r8
add r8, r8
lea rcx, [rdi*2]
add rcx, rbp
mov r12, qword [rsp + 0x100]
mov rdx, r12
call sub.ntdll.dll_memcpy
add rdi, r13
mov qword [rsp + 0x140], rdi
test rbx, rbx
je 0x45108d
add rbx, rbx
mov r8d, 2
mov rcx, r12
mov rdx, rbx
call fcn.00404340
cmp rdi, qword [rsp + 0x130]
movabs r12, 0x8000000000000000
jne 0x4510c1
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.00418bf0
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov word [rbp + rdi*2], 0x3d
inc rdi
mov qword [rsp + 0x140], rdi
mov rax, qword [rsp + 0x80]
add rsi, rax
xor r8d, r8d
mov rbx, qword [rsp + 0x68]
jmp 0x4510f4
xor r8d, r8d
test cx, cx
je 0x4515a9
mov cx, 1
test r8w, r8w
jne 0x4510e8
cmp rax, rsi
je 0x45119e
movzx r8d, byte [rax]
test r8b, r8b
js 0x451118
inc rax
mov edx, r8d
jmp 0x451194
mov edx, r8d
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp r8b, 0xdf
jbe 0x451162
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r8b, 0xf0
jb 0x45116e
movzx r8d, byte [rax + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
or edx, r8d
jmp 0x451178
add rax, 2
shl edx, 6
or edx, r10d
jmp 0x451194
add rax, 3
shl edx, 0xc
or edx, r9d
cmp edx, 0xffff
jbe 0x451194
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x4510eb
xor r8d, r8d
mov ecx, edx
jmp 0x4510eb
cmp rbx, r12
je 0x451ef1
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rsi
mov word [rsp + 0x1f0], 0
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x1e0]
call fcn.004224b0
test rbx, rbx
je 0x4511f9
mov r8d, 1
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.00404340
mov rdi, qword [rsp + 0x140]
cmp rdi, qword [rsp + 0x130]
jne 0x451235
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.00418bf0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
and al, 0xd0
add al, byte [rax]
add byte [rax - 0x75], cl
mov esp, 0x14024
add bl, ch
invalid
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
and al, 0x90
add byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0xd0
add al, byte [rax]
add byte [rax - 0x75], cl
lodsb al, byte [rsi]
mov rbp, qword [rsp + 0x138]
mov word [rbp + rdi*2], 0
and al, 0x38
add dword [rax], eax
add byte [rsi - 0x39], ah
jge 0x451252
add byte [rax], al
inc rdi
mov qword [rsp + 0x140], rdi
jmp 0x450e9a
test rdx, rdx
je 0x451274
mov r8d, 1
call fcn.00404340
mov rdx, qword [rsp + 0x68]
test rdx, rdx
mov rsi, qword [rsp + 0x100]
je 0x451299
mov r8d, 1
mov rcx, qword [rsp + 0x80]
call fcn.00404340
lea rdi, str.nul_byte_found_in_provided_data
test rbx, rbx
je 0x4515cb
add rbx, rbx
mov r8d, 2
mov rcx, rsi
jmp 0x4515c3
lea rdi, str.nul_byte_found_in_provided_data
test rbx, rbx
je 0x4515cb
mov r8d, 1
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.00404340
xor esi, esi
lea rcx, [rsp + 0x2d0]
call fcn.0040d3a0
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x4515fd
mov rcx, qword [rsp + 0x138]
add rdx, rdx
mov r8d, 2
call fcn.00404340
mov rax, qword [rsp + 0x88]
mov qword [rax], rdi
mov qword [rax + 0x10], 2
jmp 0x451e9e
mov r13, r12
xor eax, eax
lea rcx, [0x004d8150]
movzx edx, byte [0x004d8151]
xor r8d, r8d
test dl, dl
setne r8b
mov qword [rsp + 0x1e8], rcx
mov byte [rsp + 0x1f0], al
mov qword [rsp + 0x1e0], r8
mov qword [rsp + 0x288], 0
mov qword [rsp + 0x298], 0
mov qword [rsp + 0x2a8], 0
cmp byte [rsp + 0x1b0], 0
lea rax, [rsp + 0x110]
mov rdx, qword [rsp + 0x1b8]
cmovne rax, rdx
mov dword [rsp + 0x110], 2
mov r8, qword [rsp + 0x78]
lea rcx, [r8 + 0x58]
cmp dword [r8 + 0x58], 6
cmove rcx, rax
cmp dword [r8 + 0x68], 6
lea rbx, [r8 + 0x68]
cmove rbx, rdx
lea rdi, [r8 + 0x78]
cmp dword [r8 + 0x78], 6
cmove rdi, rdx
lea r8, [rsp + 0x288]
mov edx, 0xfffffff6
call fcn.00452870
mov r12, rdx
test rax, rax
je 0x451706
mov rax, qword [rsp + 0x88]
mov qword [rax], r12
mov qword [rax + 0x10], 2
jmp 0x451db6
lea r8, [rsp + 0x298]
mov rcx, rbx
mov edx, 0xfffffff5
call fcn.00452870
mov rbx, rdx
test rax, rax
je 0x451832
mov rax, qword [rsp + 0x88]
mov qword [rax], rbx
mov qword [rax + 0x10], 2
jmp 0x451d97
xor esi, esi
lea rcx, [rsp + 0x2d0]
call fcn.0040d3a0
cmp rdi, qword [rsp + 0x130]
jne 0x451806
xor esi, esi
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.00418bf0
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov rax, rbp
mov qword [rsp + 0x80], rbp
mov word [rbp + rdi*2], 0
mov rbp, qword [rsp + 0x130]
cmp rbp, r12
jne 0x451888
mov rdi, qword [rsp + 0x80]
jmp 0x4515fd
lea r8, [rsp + 0x2a8]
mov rcx, rdi
mov edx, 0xfffffff4
call fcn.00452870
test rax, rax
je 0x451a2a
mov rax, qword [rsp + 0x88]
mov qword [rax], rdx
mov qword [rax + 0x10], 2
jmp 0x451d8f
mov rbx, qword [rsp + 0x138]
mov edi, dword [rsp + 0x10c]
mov rcx, qword [rsp + 0x78]
cmp qword [rcx + 0x38], r12
je 0x450ac8
mov rax, qword [rcx + 0x40]
mov rcx, qword [rcx + 0x48]
add rcx, rax
xor r10d, r10d
mov rdx, rax
jmp 0x4518c6
xor r10d, r10d
test r8w, r8w
je 0x45197a
mov r8w, 1
test r10w, r10w
jne 0x4518b9
cmp rdx, rcx
je 0x451999
movzx r10d, byte [rdx]
test r10b, r10b
js 0x4518ee
inc rdx
mov r9d, r10d
jmp 0x45196f
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rdx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x451938
movzx r11d, byte [rdx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x451945
movzx r10d, byte [rdx + 3]
add rdx, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r9d, r10d
jmp 0x451950
add rdx, 2
shl r9d, 6
or r9d, esi
jmp 0x45196f
add rdx, 3
shl r9d, 0xc
or r9d, r11d
cmp r9d, 0xffff
jbe 0x45196f
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x4518bc
xor r10d, r10d
mov r8d, r9d
jmp 0x4518bc
lea rsi, str.nul_byte_found_in_provided_data
mov rax, qword [rsp + 0x88]
mov qword [rax], rsi
mov qword [rax + 0x10], 2
jmp 0x451e85
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], rcx
mov word [rsp + 0x2e0], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
call fcn.00422630
mov r13, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
cmp rdx, r13
jne 0x4519fa
lea rcx, [rsp + 0x90]
call fcn.00418bf0
mov r13, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov word [rsi + rdx*2], 0
mov rax, rsi
cmp r13, r12
jne 0x450ad2
jmp 0x451981
lea rcx, [0x004d8150]
call fcn.00457dd0
jmp 0x450b03
xorps xmm0, xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xe8], xmm0
test rdx, rdx
jne 0x451a6c
test rbx, rbx
jne 0x451a6c
test r12, r12
je 0x451a8f
mov dword [rsp + 0xcc], 0x100
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xf0], rdx
mov rax, qword [rsp + 0x78]
mov rdi, qword [rax + 0xb8]
test rdi, rdi
mov qword [rsp + 0x1b0], rdx
je 0x451b84
add rax, 0xa8
mov dword [rsp + 0x90], 0x70
lea rcx, [rsp + 0x1c0]
mov rdx, rax
call fcn.00453520
mov rcx, qword [rsp + 0x1c0]
test rcx, rcx
je 0x451d67
mov r8d, dword [rsp + 0x10c]
or r8d, 0x80000
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x280], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movups xmm2, xmmword [rsp + 0xb0]
movups xmm3, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x2d0], xmm0
movaps xmmword [rsp + 0x2e0], xmm1
movaps xmmword [rsp + 0x2f0], xmm2
movaps xmmword [rsp + 0x300], xmm3
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x310], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x320], xmm0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x338], rcx
lea rax, [rsp + 0x2d0]
jmp 0x451b9f
mov dword [rsp + 0x90], 0x68
lea rax, [rsp + 0x90]
mov r8d, dword [rsp + 0x10c]
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x451d2e
movaps xmm0, xmmword [rsp + 0x130]
mov rax, qword [rsp + 0x88]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rsp + 0x288]
movups xmm1, xmmword [rsp + 0x298]
movups xmm2, xmmword [rsp + 0x2a8]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm1
movups xmmword [rax + 0x30], xmm2
test rdi, rdi
je 0x451c3e
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x280]
call fcn.0040f030
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
cmp dword [rsp + 0x110], 4
jb 0x451c72
mov rcx, qword [rsp + 0x118]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [rsp + 0x1e0]
call fcn.0040dae0
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x451c9f
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1a8]
call fcn.00404340
test rbp, rbp
je 0x451cbd
add rbp, rbp
mov r8d, 2
mov rcx, qword [rsp + 0x100]
mov rdx, rbp
call fcn.00404340
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x451ce0
mov rcx, qword [rsp + 0x188]
add rdx, rdx
mov r8d, 2
call fcn.00404340
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x451cfd
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x70]
call fcn.00404340
test r15, r15
setne al
mov ecx, dword [rsp + 0x1a4]
xor cl, 1
test al, cl
je 0x450774
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.00404340
jmp 0x450774
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
test rdi, rdi
je 0x451d82
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x280]
call fcn.0040f030
jmp 0x451d82
mov rax, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
cmp dword [rsp + 0x110], 4
jb 0x451db6
mov rcx, qword [rsp + 0x118]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x288], 0
je 0x451dce
mov rcx, qword [rsp + 0x290]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x298], 0
je 0x451de6
mov rcx, qword [rsp + 0x2a0]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x2a8], 0
je 0x451dfe
mov rcx, qword [rsp + 0x2b0]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x1e0], 0
mov rsi, qword [rsp + 0x1e8]
movzx eax, byte [rsp + 0x1f0]
je 0x451e30
test al, al
jne 0x451e4d
mov rax, qword [0x004d8120]
test rax, r13
je 0x451e4d
call fcn.004446f0
jmp 0x451e45
test al, al
jne 0x451e4d
mov rax, qword [0x004d8120]
test rax, r13
je 0x451e4d
call fcn.004446f0
test al, al
jne 0x451e4d
mov byte [rsi + 1], 1
xor eax, eax
xchg byte [rsi], al
cmp al, 2
jne 0x451e5d
mov rcx, rsi
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rdx, qword [rsp + 0x68]
test rdx, rdx
mov rbx, qword [rsp + 0x100]
je 0x451e85
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1a8]
call fcn.00404340
test rbp, rbp
je 0x451e9e
add rbp, rbp
mov r8d, 2
mov rcx, rbx
mov rdx, rbp
call fcn.00404340
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x451ec1
mov rcx, qword [rsp + 0x188]
add rdx, rdx
mov r8d, 2
call fcn.00404340
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x451ede
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x70]
call fcn.00404340
mov sil, 1
cmp byte [rsp + 0x60], 0
je 0x450774
jmp 0x450984
mov rdi, qword [rsp + 0x80]
jmp 0x4515cb