Function at 0x140003340
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x840]
sub rsp, 0x940
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0x830], rax
xor eax, eax
mov qword [rsp + 0x50], rdx
or edi, 0xffffffff
mov dword [rsp + 0x70], eax
xor r12d, r12d
mov dword [rsp + 0x48], eax
mov qword [rbp - 0x78], rax
mov ebx, eax
mov dword [rsp + 0x60], eax
mov r14, rdx
mov dword [rsp + 0x78], eax
lea r15d, [rdi + 2]
mov dword [rsp + 0x64], eax
mov rsi, rcx
mov rax, qword [rdx + 0x40]
mov dword [rsp + 0x7c], r15d
mov dword [rsp + 0x40], edi
mov dword [rbp - 0x7c], r12d
mov dword [rsp + 0x4c], r12d
test rax, rax
jne 0x1400033c1
mov eax, dword [rdx + 0x38]
jmp 0x1400033c4
mov eax, dword [rax + 0x38]
shr eax, 1
lea rcx, [rbp - 0x50]
mov r13d, 0x104
mov dword [rbp - 0x80], r12d
and eax, 8
mov dword [rsp + 0x68], r12d
mov r8d, r13d
mov dword [rsp + 0x74], eax
xor edx, edx
mov qword [rbp + 0x1b8], r12
mov byte [rbp + 0x1c0], r15b
mov qword [rbp + 0x1c8], r13
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, r13d
mov qword [rbp + 0x818], r12
xor edx, edx
mov byte [rbp + 0x820], r15b
lea rcx, [rbp + 0x610]
mov qword [rbp + 0x828], r13
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, r13d
mov qword [rbp + 0x5f8], r12
xor edx, edx
mov byte [rbp + 0x600], r15b
lea rcx, [rbp + 0x3f0]
mov qword [rbp + 0x608], r13
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov r8d, r13d
mov qword [rbp + 0x3d8], r12
xor edx, edx
mov byte [rbp + 0x3e0], r15b
lea rcx, [rbp + 0x1d0]
mov qword [rbp + 0x3e8], r13
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov al, byte [rbp + 0x1c0]
lea rcx, [rbp - 0x50]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.140010e10
test eax, eax
js 0x140004708
mov al, byte [rbp + 0x820]
lea rcx, [rbp + 0x610]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.140010e10
test eax, eax
js 0x140004708
mov al, byte [rbp + 0x600]
lea rcx, [rbp + 0x3f0]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.140010e10
test eax, eax
js 0x140004708
mov al, byte [rbp + 0x3e0]
lea rcx, [rbp + 0x1d0]
neg al
sbb rdx, rdx
and edx, 0xfdc6
add rdx, 0x208
call fcn.140010e10
test eax, eax
js 0x140004708
lea rdx, [0x140037aa8]
lea rcx, [rbp + 0x3f0]
call fcn.140016cc0
xor r9d, r9d
lea r8, [rsp + 0x6c]
mov ecx, 0xfe00
call fcn.1400055f8
mov qword [rsp + 0x58], rax
mov r13, rax
test rax, rax
je 0x140004708
cmp dword [0x14004cb60], r12d
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x6c], eax
je 0x14000357d
mov r9d, r15d
lea r8, [rsp + 0x48]
mov ecx, eax
call fcn.1400055f8
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140004708
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x70], eax
mov rsi, qword [rsi + 0x40]
test rsi, rsi
je 0x140004254
mov rcx, qword [rsi]
mov rbx, qword [rsi + 0x30]
call fcn.140015950
xor r9d, r9d
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rcx
mov rdx, rax
lea rcx, [0x14001e0f0]
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 0x21]
call fcn.14001da20
test al, al
jne 0x1400035dd
cmp dword [0x14004cb5c], 3
jne 0x140004775
cmp dword [0x14004cb64], r12d
jne 0x140004775
jmp 0x140004243
mov r15, qword [rbp - 0x60]
cmp dword [0x1400449b4], r12d
jne 0x1400046ee
mov rax, qword [rbp + 0x818]
lea rdx, [rbp + 0x610]
mov r8d, dword [rbp + 0x828]
test rax, rax
mov rcx, rsi
cmovne rdx, rax
call fcn.1400054c4
mov ebx, 1
cmp eax, ebx
je 0x1400046b5
cmp dword [0x14004cb64], r12d
jne 0x140003659
mov eax, dword [0x14004cb5c]
cmp eax, 3
jne 0x14000365f
mov rax, qword [rbp + 0x5f8]
lea rcx, [rbp + 0x3f0]
mov rdx, qword [rsi + 8]
test rax, rax
cmovne rcx, rax
call fcn.140031f20
test eax, eax
jne 0x14000421a
mov eax, dword [0x14004cb5c]
test byte [rsi + 0x38], 8
jne 0x14000366a
cmp eax, 3
jne 0x140003690
mov rdx, qword [rsi + 8]
lea rcx, str._s_r_n
call fcn.14000dc90
cmp dword [0x14004cb5c], 3
jne 0x140003690
cmp dword [0x14004cb64], r12d
je 0x140003719
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov r9d, dword [rbp + 0x1c8]
test rax, rax
mov rdx, r14
mov dword [rsp + 0x20], r12d
cmovne r8, rax
mov rcx, rsi
call fcn.140004b30
cmp eax, ebx
je 0x1400046b5
cmp dword [0x14004cb5c], 3
jne 0x1400036fd
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov rdx, qword [rbp + 0x608]
lea rcx, [rbp + 0x3f0]
test rax, rax
cmovne r8, rax
mov rax, qword [rbp + 0x5f8]
test rax, rax
cmovne rcx, rax
call fcn.1400158f0
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
cmp word [rcx], r12w
je 0x14000421a
mov rcx, qword [rsi + 8]
xor edx, edx
call fcn.14000a9dc
mov r12d, eax
cmp eax, 0xffffffff
jne 0x140003774
mov ecx, dword [0x14004cc50]
call fcn.140032bb8
xor r12d, r12d
cmp dword [0x14004cb5c], 3
jne 0x14000376b
cmp edi, 0xffffffff
jne 0x14000376b
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
mov rdx, qword [rsi + 8]
test rax, rax
cmovne rcx, rax
call fcn.140031f20
test eax, eax
jne 0x1400047c3
mov dword [rsp + 0x60], ebx
jmp 0x14000421a
mov ecx, r12d
call fcn.14001447c
xor ebx, ebx
test eax, eax
je 0x1400037a8
mov eax, dword [rsi + 0x38]
lea r8d, [rbx + 1]
bts eax, 7
mov dword [rsp + 0x48], 0x80
mov dword [rsi + 0x38], eax
test r8b, al
je 0x1400037d3
and eax, 0xfffffffe
or eax, 4
mov dword [rsi + 0x38], eax
jmp 0x1400037d3
cmp dword [0x14004cb60], ebx
je 0x1400037c1
mov eax, dword [rsp + 0x70]
mov ecx, eax
cmp dword [rsp + 0x6c], eax
cmovb ecx, dword [rsp + 0x6c]
jmp 0x1400037c5
mov ecx, dword [rsp + 0x6c]
mov dword [rsp + 0x48], ecx
mov r8d, 1
mov dword [rsp + 0x70], ecx
mov edx, dword [rsi + 0x38]
test dl, 4
je 0x14000381a
and edx, 0xfffffffb
mov eax, edx
mov ecx, edx
or eax, r8d
or edx, 2
test cl, 0x80
cmove edx, eax
mov dword [rsi + 0x38], edx
cmp byte [0x14004cbc5], bl
jne 0x14000381e
cmp dword [0x14004cb64], ebx
je 0x14000381e
test dl, 8
jne 0x14000381e
cmp dword [0x14004cb5c], 3
jne 0x14000381e
and edx, 0xfffffffe
or edx, 2
mov dword [rsi + 0x38], edx
jmp 0x14000381e
mov dword [rsp + 0x4c], edx
mov rax, qword [rbp + 0x3d8]
lea rcx, [rbp + 0x1d0]
mov r8, qword [rsi + 8]
test rax, rax
mov edx, dword [rbp + 0x3e8]
cmovne rcx, rax
call fcn.140018ed8
mov r14d, eax
lea rcx, [rbp - 0x50]
mov rax, qword [rbp + 0x1b8]
test rax, rax
cmovne rcx, rax
call fcn.140015950
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov dword [rsp + 0x28], edi
mov r8d, 0x200
mov rdx, r13
mov qword [rsp + 0x20], rsi
mov ecx, r12d
call fcn.1400053fc
xor r9d, r9d
mov r13d, eax
cmp dword [0x14004cc50], r9d
je 0x1400038c3
mov ecx, r12d
call fcn.140014604
mov ecx, 0x6e
call fcn.140032bb8
cmp dword [0x14004cb5c], 3
je 0x1400047d5
mov r14, qword [rsp + 0x50]
mov dword [rsp + 0x60], 1
xor r12d, r12d
jmp 0x140004215
mov ebx, dword [0x14004cb5c]
cmp ebx, 3
jne 0x1400038db
cmp dword [0x14004cb64], r9d
je 0x140003c93
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
lea rdx, [rbp + 0x1d0]
mov ecx, r14d
cmovne r8, rax
mov rax, qword [rbp + 0x3d8]
test rax, rax
cmovne rdx, rax
call fcn.140004820
xor ecx, ecx
test eax, eax
je 0x1400039a4
test byte [rsi + 0x38], 0x80
jne 0x1400039a4
mov ecx, r12d
call fcn.140014604
mov r13, qword [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r14d, dword [rsp + 0x48]
mov r9, r13
mov qword [rsp + 0x28], r15
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.1400320f8
xor r12d, r12d
cmp dword [0x14004cb64], r12d
je 0x14000397e
cmp dword [0x14004cb5c], 3
jne 0x140003977
mov eax, dword [rsi + 0x38]
mov ecx, dword [rsp + 0x4c]
and eax, 0xfffffffe
test ecx, ecx
jne 0x140003972
or eax, 2
jmp 0x140003974
or eax, ecx
mov dword [rsi + 0x38], eax
mov dword [rbp - 0x7c], 1
mov r8d, dword [rsi + 0x38]
lea rdx, [rsp + 0x44]
mov rcx, r13
call fcn.1400053c0
mov edi, dword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov dword [0x14004cb64], r12d
jmp 0x14000421a
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov dword [0x14004cbe0], eax
cmp qword [rbx + 0x40], rcx
je 0x1400039f2
cmp dword [0x14004cb64], ecx
je 0x1400039f2
mov dword [0x14004cc50], ecx
mov rcx, qword [rbx + 0x40]
mov dword [0x14004cbdc], eax
call fcn.14000cb6c
mov ecx, dword [0x14004cc50]
cmp ecx, 0x15
je 0x140004667
cmp ecx, 0x458
je 0x140004667
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov r9d, dword [rbp + 0x1c8]
test rax, rax
mov rdx, rbx
mov rcx, rsi
cmovne r8, rax
mov eax, 1
mov dword [rsp + 0x20], eax
call fcn.140004b30
cmp eax, 1
je 0x14000466e
mov rcx, qword [rbp + 0x1b8]
lea rax, [rbp - 0x50]
xor r9d, r9d
test rcx, rcx
cmovne rax, rcx
cmp word [rax], r9w
jne 0x140003a53
mov ecx, r12d
call fcn.140014604
mov r14, rbx
jmp 0x1400038bb
mov rax, qword [rbp + 0x3d8]
lea r8, [rbp - 0x50]
test rcx, rcx
lea rdx, [rbp + 0x1d0]
cmovne r8, rcx
test rax, rax
mov ecx, r14d
cmovne rdx, rax
call fcn.140004820
test eax, eax
je 0x140003ae5
test byte [rsi + 0x38], 0x80
jne 0x140003ae5
mov ecx, r12d
call fcn.140014604
cmp dword [0x14004cb64], 0
je 0x140003abe
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x140003abe
test byte [rax + 0x38], 8
je 0x140003abe
mov eax, dword [0x14004cb5c]
mov ecx, 1
cmp qword [rsi + 0x40], 0
cmove eax, ecx
mov dword [0x14004cb5c], eax
mov r14d, dword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r9, qword [rsp + 0x58]
mov rcx, rsi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
call fcn.1400320f8
mov edi, dword [rsp + 0x40]
jmp 0x140003aea
mov r14d, dword [rsp + 0x48]
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x4c]
xor r9d, r9d
mov ebx, dword [0x14004cb5c]
mov edx, eax
test ecx, ecx
jne 0x140003bbf
cmp dword [rsp + 0x7c], r9d
je 0x140003b49
mov dword [rsp + 0x68], r9d
mov r8d, r9d
cmp eax, 0xffffffff
je 0x140003b42
test dl, 0x10
lea eax, [rcx + 1]
cmovne r8d, eax
mov dword [rsp + 0x68], r8d
mov dword [rsp + 0x7c], r9d
jmp 0x140003b4e
mov r8d, dword [rsp + 0x68]
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffb
cmp byte [0x14004cbc5], r9b
mov dword [rsi + 0x38], eax
jne 0x140003ba1
test al, 8
je 0x140003ba1
cmp ebx, 3
jne 0x140003ba1
test r8d, r8d
mov dword [rbp - 0x80], ebx
mov r8, qword [rsp + 0x50]
jne 0x140003bc4
mov rcx, qword [r8 + 0x40]
test rcx, rcx
je 0x140003b95
test byte [rcx + 0x38], 8
je 0x140003b95
mov ecx, dword [rsp + 0x4c]
lea r10d, [rbx - 2]
or eax, r10d
mov dword [rsi + 0x38], eax
jmp 0x140003bca
mov ecx, dword [rsp + 0x4c]
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x140003bc4
test r8d, r8d
mov r8, qword [rsp + 0x50]
je 0x140003bc4
cmp dword [rbp - 0x80], 3
mov r10d, 1
jne 0x140003bca
or eax, r10d
mov dword [rsi + 0x38], eax
jmp 0x140003bca
mov r8, qword [rsp + 0x50]
mov r10d, 1
cmp dword [0x14004cb64], r9d
je 0x140003c06
mov rax, qword [r8 + 0x40]
test rax, rax
je 0x140003bf0
test byte [rax + 0x38], 8
je 0x140003bf0
cmp qword [rsi + 0x40], r9
cmove ebx, r10d
mov dword [0x14004cb5c], ebx
cmp ebx, 3
jne 0x140003c06
test ecx, ecx
jne 0x140003c03
and dword [rsi + 0x38], 0xfffffffe
or dword [rsi + 0x38], 2
jmp 0x140003c06
mov dword [rsi + 0x38], ecx
test dl, 6
je 0x140003c28
or edi, 0xffffffff
mov dword [0x14004cc50], 5
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x64], r9d
mov dword [rsp + 0x78], r9d
jmp 0x140003c98
test dword [rsi + 0x38], 0x400
jne 0x140003c57
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.14000667c
mov ebx, dword [0x14004cb5c]
mov edi, eax
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x64], r9d
cmp edi, 0xffffffff
je 0x140003c21
mov ebx, 1
mov ecx, edi
mov dword [rsp + 0x78], ebx
call fcn.14001447c
xor r9d, r9d
test eax, eax
je 0x140003c8b
mov dword [rsp + 0x64], ebx
cmp dword [rsp + 0x4c], r9d
jne 0x140003c8b
and dword [rsi + 0x38], 0xfffffffe
or dword [rsi + 0x38], 2
mov ebx, dword [0x14004cb5c]
jmp 0x140003c98
mov r14d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x4c]
mov eax, 1
cmp dword [rbp - 0x7c], eax
jne 0x140003cbf
cmp ebx, 3
jne 0x140003cbf
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffe
test edx, edx
jne 0x140003de6
or eax, 2
mov dword [rsi + 0x38], eax
mov ecx, dword [rsi + 0x38]
mov eax, ecx
test cl, 8
jne 0x140003cdb
cmp ebx, 3
jne 0x140003cdb
test edx, edx
jne 0x140003cdb
and eax, 0xfffffffe
or eax, 2
mov dword [rsi + 0x38], eax
mov r8d, eax
test al, 8
je 0x140003cfe
cmp ebx, 3
jne 0x140003cfe
cmp dword [rsp + 0x68], r9d
jne 0x140003cfe
test edx, edx
jne 0x140003cfe
and r8d, 0xfffffffe
or r8d, 2
mov dword [rsi + 0x38], r8d
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x44]
call fcn.1400053c0
cmp ebx, 3
je 0x14000434e
mov ebx, dword [rsi + 0x38]
mov eax, 1
test al, bl
je 0x14000434e
mov ecx, 0x800
and ebx, ecx
mov eax, ebx
neg eax
sbb r14d, r14d
or r13d, 0xffffffff
and r14d, ecx
cmp edi, r13d
je 0x140003d4f
mov ecx, edi
call fcn.140014604
mov edi, r13d
mov dword [rsp + 0x40], r13d
test dword [rsi + 0x38], 0x400
je 0x140003ded
mov rcx, qword [rsi + 8]
call fcn.140032d48
xor r13d, r13d
test eax, eax
jne 0x140003d8a
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.140032d48
mov r9d, r13d
test eax, eax
je 0x140003d90
mov r9d, 1
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
mov edx, dword [rsp + 0x74]
test rax, rax
cmovne rcx, rax
or edx, r14d
or edx, 2
movabs r10, 0x8091bedc38db6b70
mov rax, qword [0x1400449e0]
lea r8, [0x1400311b0]
mov dword [rsp + 0x28], edx
xor r14d, r14d
mov rdx, rcx
mov qword [rsp + 0x20], r14
mov rcx, qword [rsi + 8]
call qword [0x1400374c8]
or r13d, 0xffffffff
jmp 0x140003e6a
or eax, edx
jmp 0x140003cbc
mov r11, qword [0x1400449e0]
mov rax, qword [rbp + 0x1b8]
test r11, r11
jne 0x140003e25
mov r8d, dword [rsp + 0x74]
lea rdx, [rbp - 0x50]
mov rcx, qword [rsi + 8]
xor r14d, r14d
test rax, rax
cmovne rdx, rax
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
nop dword [rax + rax]
jmp 0x140003e6a
mov edx, dword [rsp + 0x74]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
or edx, r14d
movabs r10, 0x8091bedc38db6b70
mov dword [rsp + 0x28], edx
lea rax, [0x1400449b4]
mov qword [rsp + 0x20], rax
mov rdx, rcx
mov rcx, qword [rsi + 8]
mov rax, r11
xor r9d, r9d
xor r8d, r8d
call qword [0x1400374c8]
xor r14d, r14d
test eax, eax
jne 0x140003f17
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r13d, 1
mov dword [0x14004cc50], eax
cmp eax, r13d
jne 0x140003eab
test ebx, ebx
je 0x140003eab
mov rcx, qword [rsi + 0x30]
test dword [rcx], 0x400
mov ecx, 0x40002730
cmovne eax, ecx
mov dword [0x14004cc50], eax
mov ecx, r12d
call fcn.140014604
mov ecx, dword [0x14004cc50]
mov r12d, dword [rsp + 0x64]
mov eax, r12d
neg eax
mov dword [0x14004cc40], r14d
mov eax, 0x70
sbb ebx, ebx
and ebx, 0x1d
test ecx, ecx
cmove ecx, eax
cmp dword [0x1400449b4], r14d
mov dword [0x14004cc50], ecx
je 0x140003ef0
xor r12d, r12d
mov ebx, r12d
jmp 0x140003efd
test r12d, r12d
jne 0x140003efa
call fcn.140032bb8
xor r12d, r12d
cmp dword [rsp + 0x78], r12d
jne 0x1400047ea
mov dword [rsp + 0x60], r13d
mov r14, qword [rsp + 0x50]
jmp 0x140004215
cmp dword [rsp + 0x64], r14d
jne 0x1400041a7
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140003f68
mov rdx, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rdx, rdx
cmovne rcx, rdx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
cmp dword [0x14004cb60], r14d
mov ebx, 1
je 0x1400041ac
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
mov edx, ebx
cmovne rcx, rax
call fcn.14000a9dc
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, r13d
jne 0x140003fc1
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
mov edx, ebx
mov ecx, 0x4000271f
cmovne r8, rax
call fcn.140002bfc
jmp 0x1400041ac
mov ecx, edi
call fcn.14001447c
mov ecx, edi
test eax, eax
jne 0x14000433c
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
nop dword [rax + rax]
test eax, eax
je 0x14000431c
mov ecx, edi
call fcn.140014604
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
xor edx, edx
call fcn.14000a9dc
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, r13d
je 0x140003f9e
mov ecx, eax
call fcn.14001447c
test eax, eax
jne 0x14000431c
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rbp - 0x6c]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
cmp ebx, eax
jne 0x140004317
mov eax, dword [rbp - 0x70]
cmp dword [rbp - 0x6c], eax
jne 0x140004317
mov r13d, dword [rsp + 0x48]
mov ebx, r14d
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x44]
mov rcx, rax
mov qword [rsp + 0x20], r14
mov r8d, r13d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
mov ecx, edi
test eax, eax
je 0x14000419b
mov r14d, dword [rsp + 0x44]
test r14d, r14d
je 0x140004303
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x68]
mov r8d, r14d
mov rcx, rax
mov r14, qword [rbp - 0x78]
mov rdx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x1400042e8
mov eax, dword [rsp + 0x44]
cmp dword [rbp - 0x68], eax
jne 0x1400042e8
cmp r13d, eax
mov ecx, 1
mov r8d, eax
mov rdx, r14
cmovne ebx, ecx
mov rcx, qword [rsp + 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
xor r14d, r14d
test eax, eax
jne 0x1400042dc
test ebx, ebx
je 0x1400040df
mov ecx, edi
call fcn.140014604
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
mov ebx, 1
mov rax, qword [rsi + 0x30]
mov dword [0x14004cc40], r14d
mov rcx, qword [rax + 0x14]
mov qword [rbp - 0x58], rcx
mov ecx, r12d
call fcn.140014604
xor r12d, r12d
cmp dword [0x14004cb5c], 3
je 0x140004209
cmp dword [0x1400449b4], r12d
je 0x14000464b
mov ecx, edi
call fcn.140014604
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov dword [rsp + 0x60], ebx
mov r14, qword [rsp + 0x50]
mov dword [0x14004cb64], r12d
mov r13, qword [rsp + 0x58]
mov rdx, qword [rsi + 0x30]
lea rcx, [0x14001e0f0]
mov r9, r15
mov r8d, 0x21
call fcn.14001e760
test al, al
jne 0x1400035e1
mov rcx, r15
call fcn.140019110
mov rsi, qword [rsi + 0x40]
test rsi, rsi
jne 0x14000358a
mov ebx, dword [rsp + 0x60]
cmp dword [0x14004cb5c], 3
jne 0x140004273
cmp edi, 0xffffffff
je 0x140004273
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call fcn.140005584
mov rcx, qword [rbp + 0x3d8]
mov qword [rbp + 0x3d8], r12
test rcx, rcx
je 0x14000428b
call fcn.14001fe90
mov rcx, qword [rbp + 0x5f8]
mov qword [rbp + 0x5f8], r12
test rcx, rcx
je 0x1400042a3
call fcn.14001fe90
mov rcx, qword [rbp + 0x818]
mov qword [rbp + 0x818], r12
test rcx, rcx
je 0x1400042bb
call fcn.14001fe90
mov rcx, qword [rbp + 0x1b8]
mov qword [rbp + 0x1b8], r12
test rcx, rcx
je 0x1400046ea
call fcn.14001fe90
jmp 0x1400046ea
mov ecx, edi
call fcn.140014604
or edi, 0xffffffff
jmp 0x1400042f5
mov ecx, edi
call fcn.140014604
or edi, 0xffffffff
xor r14d, r14d
mov dword [rsp + 0x40], edi
mov ebx, 1
jmp 0x140003f9e
call fcn.140014604
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
xor r14d, r14d
jmp 0x1400041a7
mov ebx, 1
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
mov edx, ebx
mov ecx, 0x4000271f
cmovne r8, rax
call fcn.140002bfc
mov ecx, edi
call fcn.140014604
mov edi, r13d
mov dword [rsp + 0x40], r13d
jmp 0x1400041ac
cmp edi, 0xffffffff
je 0x1400043b9
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
nop dword [rax + rax]
cmp dword [0x14004cb64], 0
jne 0x140004417
cmp dword [0x14004cb5c], 3
jne 0x140004417
mov eax, dword [rsi + 0x38]
mov ecx, 0x4002
mov rbx, qword [rsp + 0x58]
and eax, ecx
cmp eax, ecx
jne 0x14000441c
mov eax, dword [rsp + 0x44]
lea rdx, [rbx + 2]
add eax, 0xfffffffe
mov rcx, rbx
mov r8d, eax
mov dword [rsp + 0x44], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
jmp 0x14000441c
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
mov ebx, 1
mov edx, ebx
cmovne rcx, rax
call fcn.14000a9dc
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, 0xffffffff
jne 0x140004370
mov ecx, r12d
call fcn.140014604
xor r12d, r12d
cmp dword [0x14004cbd8], r12d
jne 0x140004401
mov ecx, dword [0x14004cc50]
call fcn.140032bb8
cmp dword [0x14004cb5c], 3
je 0x1400047f5
mov dword [rsp + 0x60], ebx
jmp 0x140003f0d
mov rbx, qword [rsp + 0x58]
mov edx, 0x4000
test dword [rsi + 0x38], edx
je 0x14000443c
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140004439
or dword [rax + 0x38], edx
jmp 0x14000443c
or dword [rcx + 0x38], edx
mov eax, dword [0x14004cc40]
test eax, eax
je 0x1400044da
mov r8d, dword [rsp + 0x44]
xor r14d, r14d
test r8d, r8d
jle 0x1400041a7
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.1400321e4
cmp dword [0x14004cb60], r14d
je 0x1400041a7
mov ecx, edi
call fcn.14001447c
test eax, eax
jne 0x1400041a7
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x20], rax
call fcn.140031260
lea ebx, [r14 + 1]
cmp eax, ebx
je 0x140004807
mov edi, dword [rsp + 0x40]
jmp 0x1400041ac
mov ecx, 1
cmp r13d, ecx
jne 0x1400045a6
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
xor r13d, r13d
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.1400321e4
cmp dword [0x14004cb60], r13d
je 0x140004562
mov ecx, edi
call fcn.14001447c
test eax, eax
jne 0x140004562
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x20], rax
call fcn.140031260
lea edi, [r13 + 1]
cmp eax, edi
je 0x140004763
mov edi, dword [rsp + 0x40]
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
lea r9, [rsp + 0x44]
mov r8d, r14d
mov rdx, rbx
cmovne rcx, rax
mov qword [rsp + 0x30], rcx
mov ecx, r12d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call fcn.1400053fc
mov r13d, eax
mov eax, dword [0x14004cc40]
test eax, eax
je 0x1400044da
xor r14d, r14d
test eax, eax
je 0x1400041a7
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jle 0x1400041a7
lea eax, [r14 + 1]
cmp r13d, eax
jne 0x140004643
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.1400321e4
cmp dword [0x14004cb60], r14d
je 0x1400041a7
mov ecx, edi
call fcn.14001447c
test eax, eax
jne 0x1400041a7
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x20], rax
call fcn.140031260
lea ebx, [r14 + 1]
cmp eax, ebx
je 0x1400047b1
jmp 0x1400044d1
mov rbx, rax
jmp 0x1400041ac
mov r14, qword [rsp + 0x50]
lea r9, [rbp - 0x58]
mov rdx, r14
mov r8d, edi
mov rcx, rsi
call fcn.140005584
jmp 0x14000420e
xor edx, edx
call fcn.140002bc4
mov ecx, r12d
call fcn.140014604
mov rcx, r15
call fcn.140019110
lea rcx, [rbp + 0x1d0]
call fcn.14001e0bc
lea rcx, [rbp + 0x3f0]
call fcn.14001e0bc
lea rcx, [rbp + 0x610]
call fcn.14001e0bc
lea rcx, [rbp - 0x50]
call fcn.14001e0bc
mov eax, 1
jmp 0x140004738
mov rcx, r15
call fcn.140019110
lea rcx, [rbp + 0x1d0]
call fcn.14001e0bc
lea rcx, [rbp + 0x3f0]
call fcn.14001e0bc
lea rcx, [rbp + 0x610]
call fcn.14001e0bc
lea rcx, [rbp - 0x50]
call fcn.14001e0bc
mov eax, ebx
jmp 0x140004738
mov rcx, r15
call fcn.140019110
cmp edi, 0xffffffff
je 0x140004702
mov ecx, edi
call fcn.140014604
mov r15d, 1
lea rcx, [rbp + 0x1d0]
call fcn.14001e0bc
lea rcx, [rbp + 0x3f0]
call fcn.14001e0bc
lea rcx, [rbp + 0x610]
call fcn.14001e0bc
lea rcx, [rbp - 0x50]
call fcn.14001e0bc
mov eax, r15d
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.14001f920
mov rbx, qword [rsp + 0x990]
add rsp, 0x940
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r15
call fcn.140019110
mov edx, edi
xor ecx, ecx
call fcn.1400313b4
int3
mov rdx, qword [rsi]
lea rcx, [0x140038610]
call fcn.14000dc90
lea rcx, [0x140037cf8]
call fcn.14000dc90
mov ecx, dword [0x14004cc50]
call fcn.140032bb8
mov rcx, qword [rbp - 0x60]
call fcn.140019110
mov edx, 1
xor ecx, ecx
call fcn.1400313b4
int3
mov rcx, r15
call fcn.140019110
mov edx, ebx
xor ecx, ecx
call fcn.1400313b4
int3
mov rcx, r15
call fcn.140019110
mov edx, ebx
xor ecx, ecx
call fcn.1400313b4
int3
mov rcx, r15
call fcn.140019110
mov edx, 1
xor ecx, ecx
call fcn.1400313b4
int3
mov edx, r13d
mov ecx, ebx
call fcn.1400313b4
int3
mov rcx, r15
call fcn.140019110
mov edx, ebx
xor ecx, ecx
call fcn.1400313b4
int3
mov rcx, r15
call fcn.140019110
mov edx, ebx
xor ecx, ecx
call fcn.1400313b4
int3