Function at 0x14000fe58
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rax - 0x48], 0xfffffffffffffffe
mov eax, r9d
mov r14, rcx
lea r15, str.WmiApRpl
mov qword [rsp + 0x68], r15
mov edi, 0x8000ffff
xor esi, esi
cmp word [str.WmiApRpl], si
je 0x140010ff5
test eax, eax
jne 0x14000feb8
cmp dword [rcx + 0x60], esi
je 0x140010ff5
mov qword [rsp + 0x50], rsi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea ebx, [rax + 0xa]
mov eax, 2
mul rbx
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.140018538
mov r12, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x14000ff00
mov edi, 0x8007000e
jmp 0x14001019d
mov r8, r15
mov rdx, rbx
mov rcx, r12
call fcn.1400036d4
mov edi, eax
test eax, eax
js 0x14001019d
lea r8, str._new.ini
mov rdx, rbx
mov rcx, r12
call fcn.14000363c
mov edi, eax
test eax, eax
js 0x14001019d
mov rdx, r12
mov rcx, r14
call fcn.14000e1b8
mov edi, eax
test eax, eax
js 0x14001019d
mov edi, 0x80004005
mov dword [rsp + 0xd0], esi
lea rcx, [0x14001f3f4]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenA]
mov ebx, eax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xd0]
mov r8d, eax
lea rdx, [0x14001f3f4]
mov rcx, qword [r14 + 0x78]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x14001019d
cmp ebx, dword [rsp + 0xd0]
jne 0x14001019d
mov edi, esi
lea r13, vtable.CGenerateComment.0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x30]
call fcn.140012a60
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012b20
lea rdx, str.Copyright__C__2000_Microsoft_Corporation
lea rcx, [rsp + 0x30]
call fcn.140012b20
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012b20
lea rdx, str.Module_Name:
lea rcx, [rsp + 0x30]
call fcn.140012b20
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140012b20
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012b20
lea rdx, str.Abstract:
lea rcx, [rsp + 0x30]
call fcn.140012b20
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012b20
lea rdx, str.Describes_all_the_counters_supported_via_WMI_Hi_Performance_providers
lea rcx, [rsp + 0x30]
call fcn.140012b20
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012b20
lea rcx, [rsp + 0x30]
call fcn.140012ab4
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012c84
lea rdx, str._info__r_n
lea rcx, [rsp + 0x30]
call fcn.140012c84
lea rdx, str.drivername
lea rcx, [rsp + 0x30]
call fcn.140012c84
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140012c84
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012c84
lea rdx, str.symbolfile
lea rcx, [rsp + 0x30]
call fcn.140012c84
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140012c84
lea rdx, [0x14001f3a4]
lea rcx, [rsp + 0x30]
call fcn.140012c84
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012c84
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012c84
lea rdx, str._languages__r_n
lea rcx, [rsp + 0x30]
call fcn.140012c84
mov ebx, esi
mov r15d, 1
cmp ebx, dword [r14 + 0x6c]
jae 0x140010131
mov eax, ebx
mov edx, dword [r14 + rax*4 + 0x64]
call fcn.14000f8b8
mov r12, rax
test rax, rax
je 0x140010127
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140012c84
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x14001012c
mov edi, 0x8007000e
add ebx, r15d
jmp 0x1400100f6
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140012c84
nop
jmp 0x140010166
test edi, edi
js 0x140010187
mov rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.14000e114
mov edi, eax
test eax, eax
js 0x140010187
mov rcx, r14
call fcn.14000fa48
mov edi, eax
mov qword [rsp + 0x30], r13
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
or r13, 0xffffffffffffffff
jmp 0x1400101a3
mov r15d, 1
jmp 0x1400101c8
test edi, edi
js 0x140010426
mov rax, rsi
cmp dword [r14 + 0x6c], 2
jne 0x140010356
call fcn.14000980c
mov r12, rax
test rax, rax
je 0x14001034e
mov r8d, dword [r14 + 0x64]
lea rdx, str.WMI_Objects
call fcn.14000f9a4
mov r13, rax
test rax, rax
je 0x14001033a
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001033f
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001033f
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001033f
mov edx, 0xcc
mov rcx, r12
call fcn.140005844
mov rbx, rax
test rax, rax
je 0x1400102a2
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010298
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x1400102a7
mov edi, 0x8007000e
test edi, edi
js 0x14001033f
mov r8d, r15d
mov rdx, r13
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001033f
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001033f
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001033f
mov edx, 0xcf
mov rcx, r12
call fcn.140005844
mov rbx, rax
test rax, rax
je 0x14001033a
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010330
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14001033f
mov edi, 0x8007000e
mov rcx, r12
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
or r13, 0xffffffffffffffff
jmp 0x140010353
mov edi, 0x80004005
mov rax, r15
test edi, edi
js 0x140010426
mov r8d, dword [r14 + rax*4 + 0x64]
lea rdx, str.WMI_Objects
call fcn.14000f9a4
mov rbx, rax
test rax, rax
je 0x140010409
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400103ff
mov r8d, r15d
lea rdx, str.NAMEWMI_Objects
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400103ff
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400103ff
mov r8d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400103ff
mov r8d, r15d
lea rdx, str.HELPNumber_of_WMI_High_Performance_provider_returned_by_WMI_Adapter
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400103ff
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14001040e
mov edi, 0x8007000e
test edi, edi
js 0x140010426
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov edx, esi
mov dword [rsp + 0xd0], edx
test edi, edi
js 0x140010fbf
cmp dword [rsp + 0xd8], r13d
je 0x1400106ff
mov r12d, esi
mov dword [rsp + 0x40], r12d
cmp r12d, dword [r14 + 0x60]
jae 0x1400106ff
test edi, edi
js 0x140010fbf
mov eax, r12d
lea rbx, [rax + rax*2]
add rbx, rbx
cmp qword [r14 + rbx*8 + 0x28], rsi
je 0x1400106f7
mov rbx, qword [r14 + rbx*8 + 0x20]
mov rbx, qword [rbx]
mov eax, r12d
lea rcx, [rax + rax*2]
add rcx, rcx
cmp rbx, qword [r14 + rcx*8 + 0x20]
je 0x1400106c6
test edi, edi
js 0x1400106c6
mov rax, qword [rbx + 0x20]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0xc8], eax
mov r13d, esi
cmp r13d, dword [r14 + 0x6c]
jae 0x140010641
test edi, edi
js 0x140010660
cmp r13d, eax
jae 0x140010641
mov rax, qword [rbx + 0x20]
mov r8d, edx
mov rdx, qword [rax + 8]
call fcn.14000dd44
mov rdi, rax
test rax, rax
je 0x140010626
mov eax, r13d
mov r8d, dword [r14 + rax*4 + 0x64]
mov rdx, rdi
call fcn.14000f9a4
mov qword [rsp + 0x58], rax
mov rcx, rdi
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x140010626
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x18]
mov ecx, r13d
mov rax, qword [rax + rcx*8]
mov r8d, r15d
mov rdx, qword [rax + 8]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov r8d, r15d
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x18]
mov ecx, r13d
mov rax, qword [rax + rcx*8]
mov r8d, r15d
mov rdx, qword [rax + 0x10]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001061a
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
jmp 0x14001062b
mov edi, 0x8007000e
add r13d, r15d
mov edx, dword [rsp + 0xd0]
mov eax, dword [rsp + 0xc8]
jmp 0x1400104aa
test edi, edi
js 0x140010660
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov edx, dword [rsp + 0xd0]
cmp byte [rbx + 0x29], sil
je 0x140010683
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140019434
mov edx, dword [rsp + 0xd0]
jmp 0x1400106b7
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], sil
jne 0x14001069b
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], sil
je 0x14001068d
jmp 0x1400106b7
mov rax, qword [rbx + 8]
jmp 0x1400106ae
cmp rbx, qword [rax + 0x10]
jne 0x1400106b4
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], sil
je 0x1400106a1
mov rbx, rax
add edx, r15d
mov dword [rsp + 0xd0], edx
jmp 0x14001047c
jmp 0x1400106f3
or r13, 0xffffffffffffffff
add r12d, r15d
jmp 0x140010448
test edi, edi
js 0x140010fbf
mov eax, esi
cmp dword [r14 + 0x6c], 2
jne 0x140010a0c
call fcn.14000980c
mov r12, rax
test rax, rax
je 0x140010a04
mov r8d, dword [r14 + 0x64]
lea rdx, str.HiPerf_Classes
call fcn.14000f9a4
mov r13, rax
test rax, rax
je 0x14001087c
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov edx, 0xcd
mov rcx, r12
call fcn.140005844
mov rbx, rax
test rax, rax
je 0x1400107d8
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400107ce
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x1400107dd
mov edi, 0x8007000e
test edi, edi
js 0x1400109f5
mov r8d, r15d
mov rdx, r13
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov edx, 0xd0
mov rcx, r12
call fcn.140005844
mov rbx, rax
test rax, rax
je 0x14001087c
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010872
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x140010881
mov edi, 0x8007000e
test edi, edi
js 0x1400109f5
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, dword [r14 + 0x64]
lea rdx, str.HiPerf_Validity
call fcn.14000f9a4
mov r13, rax
test rax, rax
je 0x1400109f0
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov edx, 0xce
mov rcx, r12
call fcn.140005844
mov rbx, rax
test rax, rax
je 0x140010958
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x14001094e
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14001095d
mov edi, 0x8007000e
test edi, edi
js 0x1400109f5
mov r8d, r15d
mov rdx, r13
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109f5
mov edx, 0xd1
mov rcx, r12
call fcn.140005844
mov rbx, rax
test rax, rax
je 0x1400109f0
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x1400109e6
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x1400109f5
mov edi, 0x8007000e
mov rcx, r12
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
or r13, 0xffffffffffffffff
jmp 0x140010a09
mov edi, 0x80004005
mov eax, r15d
test edi, edi
js 0x140010fbf
mov r12d, eax
mov r8d, dword [r14 + r12*4 + 0x64]
lea rdx, str.HiPerf_Classes
call fcn.14000f9a4
mov rbx, rax
test rax, rax
je 0x140010aa6
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010a9c
mov r8d, r15d
lea rdx, str.NAMEHiPerf_Classes
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010a9c
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010a9c
mov r8d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010a9c
mov r8d, r15d
lea rdx, str.HELPShows_High_Performance_Classes
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x140010aab
mov edi, 0x8007000e
test edi, edi
js 0x140010fbf
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010fbf
mov r8d, dword [r14 + r12*4 + 0x64]
lea rdx, str.HiPerf_Validity
call fcn.14000f9a4
mov rbx, rax
test rax, rax
je 0x140010b7a
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010b70
mov r8d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010b70
mov r8d, r15d
lea rdx, str.NAMEHiPerf_Validity
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010b70
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010b70
mov r8d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010b70
mov r8d, r15d
lea rdx, str.HELPShows_if_High_Performance_Classes_are_valid
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x140010b7f
mov edi, 0x8007000e
test edi, edi
js 0x140010fbf
cmp dword [rsp + 0xd8], r13d
je 0x140010ecc
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov dword [rsp + 0xd0], esi
mov r12d, esi
mov dword [rsp + 0x40], r12d
cmp r12d, dword [r14 + 0x60]
jae 0x140010ecc
test edi, edi
js 0x140010fbf
mov eax, r12d
lea rbx, [rax + rax*2]
add rbx, rbx
cmp qword [r14 + rbx*8 + 0x28], rsi
je 0x140010ec4
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rbx, qword [r14 + rbx*8 + 0x20]
mov rbx, qword [rbx]
mov eax, r12d
lea rcx, [rax + rax*2]
add rcx, rcx
cmp rbx, qword [r14 + rcx*8 + 0x20]
je 0x140010e9a
test edi, edi
js 0x140010e9a
mov ecx, esi
mov dword [rsp + 0xc8], ecx
mov rax, qword [rbx + 0x20]
cmp ecx, dword [rax + 0x38]
jae 0x140010e3d
test edi, edi
js 0x140010e3d
mov edx, ecx
mov qword [rsp + 0x30], rdx
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + rdx*8]
cmp qword [rcx + 0x20], rsi
je 0x140010e2e
mov eax, dword [rcx + 0x28]
mov dword [rsp + 0x58], eax
mov r13d, esi
cmp r13d, dword [r14 + 0x6c]
jae 0x140010e16
test edi, edi
js 0x140010e2e
cmp r13d, eax
jae 0x140010e16
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + rdx*8]
mov r8d, dword [rsp + 0xd0]
mov rdx, qword [rax + 8]
call fcn.14000dd44
mov rdi, rax
test rax, rax
je 0x140010e00
mov eax, r13d
mov r8d, dword [r14 + rax*4 + 0x64]
mov rdx, rdi
call fcn.14000f9a4
mov qword [rsp + 0x60], rax
mov rcx, rdi
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140010e00
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax + rcx*8]
mov rax, qword [rax + 0x20]
mov ecx, r13d
mov rax, qword [rax + rcx*8]
mov r8d, r15d
mov rdx, qword [rax + 8]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov r8d, r15d
mov rdx, qword [rsp + 0x60]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov r8d, r15d
lea rdx, [0x14001ee08]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax + rcx*8]
mov rax, qword [rax + 0x20]
mov ecx, r13d
mov rax, qword [rax + rcx*8]
mov r8d, r15d
mov rdx, qword [rax + 0x10]
mov rcx, r14
call fcn.14000de50
mov edi, eax
test eax, eax
js 0x140010df4
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_free
jmp 0x140010e05
mov edi, 0x8007000e
add r13d, r15d
mov rdx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x58]
jmp 0x140010c59
test edi, edi
js 0x140010e2e
mov r8d, r15d
lea rdx, [0x14001edb0]
mov rcx, r14
call fcn.14000de50
mov edi, eax
mov ecx, dword [rsp + 0xc8]
add ecx, r15d
jmp 0x140010c1a
cmp byte [rbx + 0x29], sil
je 0x140010e59
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140019434
jmp 0x140010e8d
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], sil
jne 0x140010e71
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], sil
je 0x140010e63
jmp 0x140010e8d
mov rax, qword [rbx + 8]
jmp 0x140010e84
cmp rbx, qword [rax + 0x10]
jne 0x140010e8a
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], sil
je 0x140010e77
mov rbx, rax
add dword [rsp + 0xd0], r15d
jmp 0x140010bfb
jmp 0x140010ec0
or r13, 0xffffffffffffffff
add r12d, r15d
jmp 0x140010bb3
test edi, edi
js 0x140010fbf
mov edx, r15d
mov rcx, r14
call fcn.14000dde0
mov edi, eax
test eax, eax
js 0x140010f9f
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea r15d, [rax + 6]
mov eax, 2
mul r15
cmovo rax, r13
mov rcx, rax
call fcn.140018538
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140010f25
mov edi, 0x8007000e
jmp 0x140010f6a
mov r8, qword [rsp + 0x68]
mov rdx, r15
mov rcx, rbx
call fcn.1400036d4
mov edi, eax
test eax, eax
js 0x140010f6a
lea r8, str..ini
mov rdx, r15
mov rcx, rbx
call fcn.14000363c
mov edi, eax
test eax, eax
js 0x140010f6a
mov r8, rbx
mov r15, qword [rsp + 0x48]
mov rdx, r15
mov rcx, r14
call fcn.14000e4c0
mov edi, eax
jmp 0x140010f6f
mov r15, qword [rsp + 0x48]
jmp 0x140010f8c
test rbx, rbx
je 0x140010f99
mov rcx, rbx
call sub.msvcrt.dll_free
test edi, edi
jns 0x140010fe8
jmp 0x140010fa4
mov r15, qword [rsp + 0x48]
mov rax, qword [0x1400306d0]
test rax, rax
je 0x140010fdd
mov word [rax], si
mov dword [0x14002ffa0], 0x1000
jmp 0x140010fdd
mov rax, qword [0x1400306d0]
test rax, rax
je 0x140010fd8
mov word [rax], si
mov dword [0x14002ffa0], 0x1000
mov r15, qword [rsp + 0x48]
mov rdx, r15
mov rcx, r14
call fcn.14000e37c
test r15, r15
je 0x140010ff5
mov rcx, r15
call sub.msvcrt.dll_free
mov eax, edi
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret