Function at 0x1400a393c
Capabilities:
Get common file path
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x398
mov r13, rcx
lea rcx, [rax - 0x2f0]
mov r15, r9
call fcn.14005bc74
xor ebp, ebp
lea rcx, [rsp + 0x100]
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xf8], rbp
mov word [rsp + 0x88], bp
call fcn.14005c138
lea rcx, [rsp + 0x3e8]
call fcn.140053eb0
lea rax, [rsp + 0x100]
mov ebx, ebp
mov qword [rsp + 0x150], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x120], rbp
mov qword [rsp + 0x128], rbp
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x138], rbp
mov dword [rsp + 0xb4], eax
mov qword [rsp + 0x140], rbp
mov qword [rsp + 0x148], rbp
mov dword [rsp + 0xb0], 2
mov dword [rsp + 0x5c], ebp
mov r14d, ebp
mov dword [rsp + 0x50], ebx
mov edi, ebp
mov dword [rsp + 0xc0], ebp
mov dword [rsp + 0xa0], ebp
mov r12d, ebp
mov dword [rsp + 0x90], ebp
mov dword [rsp + 0xc4], ebp
mov esi, ebp
lea r10d, [rbp + 9]
xor r8d, r8d
mov r9d, 0x20
mov rax, qword [rsp + 0x3e8]
mov ecx, 0x2a
lea edx, [rcx + 3]
cmp cx, word [rax]
je 0x1400a3a61
lea ecx, [rdx + 2]
cmp cx, word [rax]
je 0x1400a3a61
cmp dx, word [rax]
jne 0x1400a3eeb
cmp dx, word [rax]
jne 0x1400a3a94
cmp dx, word [rax + 2]
jne 0x1400a3a94
movzx ecx, word [rax + 4]
cmp r10w, cx
ja 0x1400a3a80
cmp cx, 0xd
jbe 0x1400a3fec
cmp r9w, cx
je 0x1400a3fec
cmp cx, r8w
je 0x1400a3fec
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140107a8c]
mov r8d, 2
call fcn.14005e4b0
xor ecx, ecx
cmp al, cl
je 0x1400a3ac1
and r14d, 0xfffffffe
or r14d, 6
jmp 0x1400a3fda
mov r11, qword [rsp + 0x3e8]
lea rcx, [0x140107a88]
mov r8d, 3
lea rdx, [r11 + 2]
call fcn.1400553c8
xor ecx, ecx
cmp al, cl
je 0x1400a3aef
add r11, 8
lea r14d, [rcx + 6]
jmp 0x1400a3b13
lea rdx, [r11 + 2]
lea rcx, str.delims:
mov r8d, 7
call fcn.1400553c8
xor ebx, ebx
cmp al, bl
je 0x1400a3b95
add r11, 0x10
mov eax, 0xa
lea rcx, [rsp + 0x3e8]
mov qword [rsp + 0x3e8], r11
or r14d, eax
call fcn.1400594d4
mov rbx, qword [rsp + 0x3e8]
movzx eax, word [rbx]
mov word [rsp + 0x88], ax
xor r8d, r8d
movzx eax, word [rbx]
mov r10d, 9
cmp ax, r8w
je 0x1400a3b7f
lea ecx, [r10 + 0x17]
cmp r10w, ax
ja 0x1400a3b65
cmp ax, 0xd
jbe 0x1400a3b7f
cmp cx, ax
je 0x1400a3b7f
add rbx, 2
mov qword [rsp + 0x3e8], rbx
mov ax, word [rbx]
cmp ax, r8w
jne 0x1400a3b59
lea rcx, [rsp + 0x3e8]
call fcn.140053eb0
mov ebx, dword [rsp + 0x50]
jmp 0x1400a3a35
lea rdx, [rsp + 0x3e8]
lea rcx, [0x1400fff4c]
or r8d, 0xffffffff
call fcn.14005e44c
cmp al, bl
jne 0x1400a3fce
lea rdx, [rsp + 0x3e8]
lea rcx, [0x1400fc900]
or r8d, 0xffffffff
call fcn.14005e44c
cmp al, bl
jne 0x1400a3fce
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140105c3c]
mov r8d, 1
call fcn.14005e4b0
cmp al, bl
jne 0x1400a3fc8
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140107020]
mov r8d, 2
call fcn.14005e44c
cmp al, bl
jne 0x1400a3fc8
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140107a7c]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x1400a3c41
mov esi, 1
jmp 0x1400a3fd6
lea rdx, [rsp + 0x3e8]
lea rcx, [0x1400ffff4]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x1400a3c6f
mov dword [rsp + 0xc0], 1
jmp 0x1400a3fd6
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140107a78]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x1400a3c95
mov r12d, 1
jmp 0x1400a3cb9
lea rdx, [rsp + 0x3e8]
lea rcx, str.qu
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x1400a3cc6
mov r12d, 2
mov dword [rsp + 0x90], r12d
jmp 0x1400a3fd6
lea rdx, [rsp + 0x3e8]
lea rcx, str.off
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x1400a3cf4
mov dword [rsp + 0xc4], 1
jmp 0x1400a3fd6
lea rdx, [rsp + 0x3e8]
lea rcx, [0x140107a64]
mov r8d, 2
call fcn.14005e44c
cmp al, bl
je 0x1400a3d22
mov ebx, dword [rsp + 0x50]
or ebx, 0x10
mov dword [rsp + 0x50], ebx
jmp 0x1400a3fda
mov r11, qword [rsp + 0x3e8]
lea rcx, [0x140107a60]
mov r8d, 3
mov rdx, r11
call fcn.1400553c8
cmp al, bl
je 0x1400a3d74
mov ebx, dword [rsp + 0x50]
add r11, 6
lea rdx, [rsp + 0xb4]
or ebx, 0x10
lea rcx, [rsp + 0x3e8]
mov qword [rsp + 0x3e8], r11
mov dword [rsp + 0x50], ebx
call fcn.14006a974
jmp 0x1400a3fda
lea rdx, [rsp + 0x3e8]
lea rcx, str._O:N
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x1400a3da4
mov ebx, dword [rsp + 0x50]
mov r9d, 0x20
mov edi, r9d
jmp 0x1400a3fe0
lea rdx, [rsp + 0x3e8]
lea rcx, str._O:_N
mov r8d, 5
call fcn.14005e44c
cmp al, bl
je 0x1400a3dcc
mov edi, 0x60
jmp 0x1400a3fd6
lea rdx, [rsp + 0x3e8]
lea rcx, str.cur
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x1400a3dfa
mov dword [rsp + 0xa0], 1
jmp 0x1400a3fd6
mov rbx, qword [rsp + 0x3e8]
lea rcx, str._size:
mov r8d, 6
mov rdx, rbx
call fcn.1400553c8
xor r8d, r8d
cmp al, r8b
je 0x1400a3ed9
lea rax, [rbx + 0xc]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
call fcn.140061ca4
mov r11, qword [rsp + 0x78]
xor eax, eax
cmp word [r11], ax
je 0x1400a3b43
lea edx, [rax + 9]
cmp dx, word [r11]
ja 0x1400a3e5f
cmp word [r11], 0xd
jbe 0x1400a3e8f
mov ecx, 0x20
cmp cx, word [r11]
je 0x1400a3e94
add r11, 2
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], r11
call fcn.140061ca4
mov r11, qword [rsp + 0x78]
xor eax, eax
lea edx, [rax + 9]
mov ecx, 0x20
cmp word [r11], ax
je 0x1400a3b43
cmp dx, word [r11]
ja 0x1400a3eaf
cmp word [r11], 0xd
jbe 0x1400a3b43
cmp cx, word [r11]
je 0x1400a3b43
add r11, 2
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], r11
call fcn.140061ca4
jmp 0x1400a3b43
mov eax, 0x2a
cmp ax, word [rbx]
je 0x1400a3b46
mov ebx, dword [rsp + 0x50]
mov al, bl
lea rcx, [rsp + 0xd8]
and al, 0x10
neg al
sbb eax, eax
or ebx, edi
and eax, esi
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x78], eax
cdqe
or qword [rsp + 0x148], rax
call fcn.14005bc74
lea rbx, [0x1400fb538]
lea rcx, [rsp + 0xc8]
mov rdx, rbx
call fcn.1400668e8
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.1400668e8
lea rcx, [rsp + 0x98]
mov rdx, rbx
call fcn.1400668e8
mov rdi, qword [rsp + 0x3e8]
xor esi, esi
cmp r12d, esi
je 0x1400a40ba
cmp r14d, 1
jne 0x1400a40ba
lea rcx, [rsp + 0x68]
call fcn.14005bc74
mov r8, qword [rsp + 0x3e8]
lea ebx, [rsi + 0x2c]
lea r15d, [rsi + 0x22]
movzx eax, word [r8]
cmp r15w, ax
jne 0x1400a400a
add r8, 2
lea rcx, [rsp + 0x3e8]
mov edx, r15d
mov qword [rsp + 0x3e8], r8
call fcn.1400ccf8c
mov rcx, qword [rsp + 0x3e8]
cmp word [rcx], si
je 0x1400a4041
add rcx, 2
mov qword [rsp + 0x3e8], rcx
jmp 0x1400a4041
or r14d, 5
jmp 0x1400a3fd6
and r14d, 0xfffffffd
or r14d, 1
mov ebx, dword [rsp + 0x50]
mov r9d, 0x20
xor r8d, r8d
lea r10d, [r8 + 9]
jmp 0x1400a3a3b
add rax, 4
lea rcx, [rsp + 0x3e8]
mov qword [rsp + 0x3e8], rax
call fcn.140053eb0
jmp 0x1400a3eeb
cmp ax, si
je 0x1400a4041
mov ecx, 0x20
lea edx, [rcx - 0x17]
cmp bx, ax
je 0x1400a4041
cmp dx, ax
ja 0x1400a4027
cmp ax, 0xd
jbe 0x1400a4041
cmp cx, ax
je 0x1400a4041
add r8, 2
mov qword [rsp + 0x3e8], r8
mov ax, word [r8]
cmp ax, si
jne 0x1400a4017
lea rcx, [rsp + 0x3e8]
call fcn.140053eb0
mov r8, qword [rsp + 0x3e8]
cmp word [r8], si
je 0x1400a4066
cmp bx, word [r8]
jne 0x1400a3f83
sub r8, rdi
lea rcx, [rsp + 0x68]
mov rdx, rdi
sar r8, 1
call fcn.14005bedc
mov rdx, qword [rsp + 0x68]
lea r8, [rsp + 0xe8]
xor r9d, r9d
mov rcx, r13
mov byte [rsp + 0x20], 1
call fcn.14007059c
mov r11, qword [rsp + 0xe8]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0xf8], r11
call fcn.140053e80
mov r15, qword [rsp + 0x3f8]
jmp 0x1400a40da
mov ebx, 0x2c
lea rdx, [rsp + 0x3e8]
lea rcx, [rsp + 0xe8]
mov r8d, ebx
mov r9b, 1
call fcn.140073af0
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xf8]
xor r8d, r8d
call fcn.14005f7b4
mov r11, qword [rsp + 0xd8]
mov edi, 0x5c
mov qword [rsp + 0x68], r11
cmp r14d, esi
jne 0x1400a418e
movzx eax, word [r11]
cmp ax, si
je 0x1400a418e
mov ecx, 9
cmp cx, ax
ja 0x1400a4126
cmp ax, 0xd
jbe 0x1400a418e
mov ecx, 0x20
cmp cx, ax
je 0x1400a418e
mov ecx, 0x40
cmp cx, ax
jne 0x1400a4147
mov dword [rsp + 0xb0], 1
jmp 0x1400a4180
mov ecx, 0x24
cmp cx, ax
jne 0x1400a415e
mov dword [rsp + 0xb0], 3
jmp 0x1400a4180
cmp di, ax
jne 0x1400a4171
cmp di, word [r11 + 2]
je 0x1400a418b
or dword [rsp + 0x5c], 1
jmp 0x1400a4180
mov ecx, 0x21
cmp cx, ax
jne 0x1400a418e
or dword [rsp + 0x5c], 2
add r11, 2
mov qword [rsp + 0x68], r11
jmp 0x1400a410d
mov bpl, 1
lea rcx, [rsp + 0x68]
call fcn.140053eb0
mov r12d, r14d
and r12d, 1
jne 0x1400a41ad
mov rcx, qword [rsp + 0x68]
call fcn.140019c78
jmp 0x1400a41b2
mov rax, qword [rsp + 0x68]
cmp dword [rsp + 0x5c], esi
jne 0x1400a41e3
cmp r14d, esi
jne 0x1400a41e8
cmp bpl, sil
jne 0x1400a41e8
cmp di, word [rax]
jne 0x1400a41cd
cmp di, word [rax + 2]
je 0x1400a41e8
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.14001a0d4
jmp 0x1400a41f8
add rax, 2
cmp word [rax], di
je 0x1400a41df
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140066968
mov rcx, qword [rsp + 0x3e8]
cmp bx, word [rcx]
jne 0x1400a4247
add rcx, 2
lea rdx, [rsp + 0x3e8]
mov r8d, ebx
mov qword [rsp + 0x3e8], rcx
lea rcx, [rsp + 0xe8]
mov r9b, 1
call fcn.140073af0
lea rdx, [rsp + 0xc8]
xor r8d, r8d
mov rcx, rax
call fcn.14005f7b4
mov rcx, qword [rsp + 0x3e8]
cmp r14d, esi
jne 0x1400a4294
cmp bx, word [rcx]
jne 0x1400a4294
add rcx, 2
lea rdx, [rsp + 0x3e8]
mov r8d, ebx
mov qword [rsp + 0x3e8], rcx
lea rcx, [rsp + 0xe8]
mov r9b, 1
call fcn.140073af0
lea rdx, [rsp + 0x120]
movzx r8d, bx
mov rcx, rax
call fcn.14005fa8c
mov rcx, qword [rsp + 0x3e8]
mov rax, qword [rsp + 0x120]
mov rdx, 0xfffffffffffffff8
cmp rax, rsi
cmovle rax, rdx
mov qword [rsp + 0x120], rax
cmp word [rcx], bx
je 0x1400a4321
lea rcx, [rsp + 0x98]
call fcn.140053e80
lea rcx, [rsp + 0x80]
call fcn.140053e80
lea rcx, [rsp + 0xc8]
call fcn.140053e80
lea rcx, [rsp + 0xd8]
call fcn.140053e80
lea rcx, [rsp + 0x100]
call fcn.14001bdcc
lea rcx, [rsp + 0x100]
call fcn.140053e80
lea rcx, [rsp + 0xe8]
call fcn.140053e80
movabs rax, 1
jmp 0x1400a4e5b
add rcx, 2
mov qword [rsp + 0x3e8], rcx
lea rcx, [rsp + 0x3e8]
call fcn.140053eb0
mov rdx, qword [rsp + 0x3e8]
lea rcx, [rsp + 0x98]
call fcn.140066a00
mov rbp, qword [rsp + 0x98]
mov eax, 0x2a
cmp word [rbp], ax
jne 0x1400a436a
mov bl, 1
cmp word [rbp + 2], si
je 0x1400a436d
mov bl, sil
lea rcx, [rsp + 0x158]
mov byte [rsp + 0x58], bl
call fcn.14005bc74
mov rdi, qword [rsp + 0xc8]
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rsi
cmp bl, sil
jne 0x1400a43ab
lea rcx, [rsp + 0x158]
mov rdx, rdi
call fcn.140066a00
mov qword [rsp + 0xd0], rsi
cmp r15, rsi
je 0x1400a43bd
mov r15, qword [r15]
jmp 0x1400a43c0
mov r15, rsi
mov qword [rsp + 0x68], r15
cmp word [rbp], si
jne 0x1400a43f4
cmp r15, rsi
je 0x1400a43f4
movzx eax, word [r15]
cmp word [r13 + 0x96], ax
jne 0x1400a43f4
mov rdx, qword [rsp + 0x3f8]
xor r9d, r9d
xor r8d, r8d
mov rcx, r13
call fcn.14005ab58
lea rcx, [rsp + 0x118]
mov edx, 0x32a
call fcn.14005bce8
mov rbx, qword [rsp + 0x118]
mov r10, qword [rsp + 0x3e0]
xor r11d, r11d
lea rax, [rbx + 4]
mov qword [rsp + 0xb8], rax
mov eax, 0x8b
mov qword [rsp + 0xa8], r11
and word [r10 + 0xc8], ax
mov r13d, r11d
mov dword [rsp + 0x54], r11d
mov dword [rsp + 0x70], r11d
lea ecx, [rax + 0x75]
cmp word [rbp], r11w
jne 0x1400a4467
cmp r15, r11
je 0x1400a4467
movzx eax, word [r15]
mov r15d, ecx
cmp word [r10 + 0x96], ax
je 0x1400a446a
mov r15d, r11d
cmp word [rdi], r11w
je 0x1400a448b
mov rax, qword [rsp + 0x98]
cmp word [rax], r11w
jne 0x1400a448b
mov dword [rsp + 0x60], 1
cmp r15d, r11d
je 0x1400a4490
mov dword [rsp + 0x60], r11d
mov rcx, qword [rsp + 0x80]
mov ebp, r14d
mov qword [rsp + 0xe0], r11
and ebp, 4
mov r8, rcx
mov qword [rsp + 0x3e8], rcx
je 0x1400a4560
lea rcx, [0x14011af08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x3e0]
xor eax, eax
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.140016e70
xor ecx, ecx
cmp rax, rcx
jne 0x1400a4503
lea ebx, [rcx + 2]
lea rcx, [0x14011af08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400a4d88
mov r8, qword [rax + 0x18]
mov rdx, qword [rax + 8]
movabs rcx, 0x1fffffffffffffff
shr r8, 1
and r8, rcx
lea rcx, [rsp + 0xe0]
call fcn.14005bedc
mov r11, qword [rsp + 0xe0]
lea rcx, [0x14011af08]
mov qword [rsp + 0x3e8], r11
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x80]
mov r10, qword [rsp + 0x3e0]
xor r11d, r11d
movsxd r13, r15d
test r14b, 2
je 0x1400a4711
movzx eax, word [r8]
mov qword [rsp + 0xb8], r11
cmp ax, r11w
je 0x1400a46f6
mov rsi, qword [rsp + 0x400]
mov r14, qword [rsp + 0x68]
mov r12w, word [rsp + 0x88]
mov r15, qword [rsp + 0x3f0]
mov ebp, 0xfeff
test byte [r10 + 0xc8], 0xef
jne 0x1400a46f6
mov r9, r8
cmp r12w, r11w
je 0x1400a45d8
lea rcx, [rsp + 0x3e8]
movzx edx, r12w
call fcn.1400ccf8c
mov r8, qword [rsp + 0x3e8]
jmp 0x1400a4604
cmp ax, r11w
je 0x1400a4604
mov ecx, 0xa
cmp ax, 0xd
je 0x1400a4604
cmp ax, cx
je 0x1400a4604
add r8, 2
mov qword [rsp + 0x3e8], r8
mov ax, word [r8]
cmp ax, r11w
jne 0x1400a45e3
movzx ebx, word [r8]
mov word [r8], r11w
mov rdx, rdi
mov r8, r9
mov rcx, r10
call fcn.14005b2f4
mov r8, qword [rsp + 0x3e8]
xor r11d, r11d
cmp r12w, r11w
jne 0x1400a4642
cmp bx, 0xd
jne 0x1400a4642
lea eax, [r11 + 0xa]
cmp ax, word [r8 + 2]
jne 0x1400a4648
add r8, 4
jmp 0x1400a464c
cmp bx, r11w
je 0x1400a4654
add r8, 2
mov qword [rsp + 0x3e8], r8
inc dword [rsp + 0x54]
cmp r13, r11
je 0x1400a4692
mov rcx, qword [rsp + 0x3e0]
lea rax, [r14 + 2]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0xd0], rax
lea rax, [0x1400fb538]
xor r9d, r9d
mov rdx, r15
mov qword [rsp + 0x20], rax
call fcn.14009be30
jmp 0x1400a46b8
mov rdx, qword [rsp + 0x98]
cmp word [rdx], r11w
je 0x1400a46c3
mov rcx, qword [rsp + 0x3e0]
xor r9d, r9d
mov r8, r15
mov qword [rsp + 0x20], rsi
call fcn.140045d3c
mov r8, qword [rsp + 0x3e8]
xor r11d, r11d
mov r10, qword [rsp + 0x3e0]
mov ecx, pe_nt_image_headers64
movzx eax, word [r10 + 0xc8]
test cx, ax
je 0x1400a46e8
and ax, bp
mov word [r10 + 0xc8], ax
mov ax, word [r8]
cmp ax, r11w
jne 0x1400a45a6
lea rcx, [rsp + 0xb8]
call fcn.140053e80
mov r13d, dword [rsp + 0x54]
mov ebx, dword [rsp + 0x70]
jmp 0x1400a4d88
cmp r12d, r11d
je 0x1400a490f
cmp ebp, r11d
je 0x1400a4734
lea rcx, [rsp + 0x3e8]
call fcn.140053eb0
mov r8, qword [rsp + 0x3e8]
movsxd rcx, dword [rsp + 0x90]
movzx eax, word [r8]
mov qword [rsp + 0x78], r11
mov rbp, rcx
lea ebx, [rcx - 1]
cmp ax, r11w
je 0x1400a4905
mov rsi, qword [rsp + 0x400]
mov r14, qword [rsp + 0x68]
mov r12d, 0xfeff
test byte [r10 + 0xc8], 0xef
jne 0x1400a4905
mov rdx, r8
mov ecx, r11d
cmp rbp, r11
je 0x1400a47e9
mov r9d, 0x22
cmp r9w, ax
jne 0x1400a47e9
movsxd rax, ebx
lea rdx, [r8 + rax*2]
add r8, 2
mov qword [rsp + 0x3e8], r8
movzx eax, word [r8]
cmp ax, r11w
je 0x1400a4821
cmp r9w, ax
jne 0x1400a4794
movzx eax, word [r8 + 2]
cmp ax, r11w
je 0x1400a47d9
mov r10d, 9
cmp r10w, ax
ja 0x1400a47cd
cmp ax, 0xd
jbe 0x1400a47d9
mov r10d, 0x20
cmp r10w, ax
jne 0x1400a4794
add r8, 2
mov ecx, ebx
mov qword [rsp + 0x3e8], r8
jmp 0x1400a4821
cmp ax, r11w
je 0x1400a4821
mov r9d, 0x20
lea r10d, [r9 - 0x17]
cmp r10w, ax
ja 0x1400a4805
cmp ax, 0xd
jbe 0x1400a4821
cmp r9w, ax
je 0x1400a4821
add r8, 2
mov qword [rsp + 0x3e8], r8
mov ax, word [r8]
cmp ax, r11w
jne 0x1400a47f9
movsxd rax, ecx
lea rcx, [rsp + 0x78]
add rax, rax
sub r8, rax
sub r8, rdx
sar r8, 1
call fcn.14005bedc
lea rcx, [rsp + 0x3e8]
call fcn.140053eb0
mov r15, qword [rsp + 0x3e0]
mov r8, qword [rsp + 0x78]
mov rcx, r15
mov rdx, rdi
call fcn.14005b2f4
inc dword [rsp + 0x54]
xor r11d, r11d
cmp r13, r11
je 0x1400a48a0
mov rdx, qword [rsp + 0x3f0]
lea rax, [r14 + 2]
lea r8, [rsp + 0xd0]
mov qword [rsp + 0xd0], rax
lea rax, [0x1400fb538]
xor r9d, r9d
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14009be30
jmp 0x1400a48c6
mov rdx, qword [rsp + 0x98]
cmp word [rdx], r11w
je 0x1400a48c9
mov r8, qword [rsp + 0x3f0]
xor r9d, r9d
mov rcx, r15
mov qword [rsp + 0x20], rsi
call fcn.140045d3c
xor r11d, r11d
mov r10, qword [rsp + 0x3e0]
mov ecx, pe_nt_image_headers64
movzx eax, word [r10 + 0xc8]
test cx, ax
je 0x1400a48ef
and ax, r12w
mov word [r10 + 0xc8], ax
mov r8, qword [rsp + 0x3e8]
mov ax, word [r8]
cmp ax, r11w
jne 0x1400a4768
lea rcx, [rsp + 0x78]
jmp 0x1400a46fe
call fcn.140019c78
lea rcx, [rsp + 0x80]
mov rdx, rax
call fcn.140066968
mov r11, qword [rsp + 0x80]
xor ecx, ecx
cmp word [r11], cx
je 0x1400a4d83
mov r12d, dword [rsp + 0x5c]
movzx r13d, cx
mov r14b, cl
cmp r12d, ecx
je 0x1400a49fb
cmp dword [rsp + 0xa0], ecx
je 0x1400a4993
mov word [rsp + 0x180], cx
lea rdx, [rsp + 0x180]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13w, word [rsp + 0x180]
cmp r13w, 0x61
jb 0x1400a4991
cmp r13w, 0x7a
ja 0x1400a4991
mov eax, 0xffdf
and r13w, ax
xor ecx, ecx
lea rsi, [rbx + 4]
mov rdx, rsi
mov word [rsi + 2], cx
mov word [rsi], cx
mov word [rbx + 2], cx
mov word [rbx], cx
mov ecx, 0x324
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ecx, ecx
and r12b, 2
mov rbp, rsi
mov rbx, rsi
cmp word [rsi], cx
je 0x1400a49df
mov rcx, rbx
mov rbp, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [rbx + rcx*2 + 2]
xor ecx, ecx
cmp word [rbx], cx
jne 0x1400a49c4
cmp r12b, cl
mov r12, qword [rsp + 0x400]
cmovne rsi, rbp
mov rbp, qword [rsp + 0xb8]
jmp 0x1400a4c04
mov rax, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xb8]
mov r12, qword [rsp + 0x400]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa8], r11
cmp r15d, ecx
jne 0x1400a4a41
mov rax, qword [rsp + 0x98]
cmp word [rax], cx
jne 0x1400a4a41
mov eax, dword [rsp + 0x60]
cmp eax, ecx
je 0x1400a4d78
cmp dword [rsp + 0xc0], ecx
je 0x1400a4a6c
movzx ecx, word [r11]
xor eax, eax
cmp cx, ax
je 0x1400a4a6c
cmp word [r11 + 2], 0x3a
jne 0x1400a4a6c
call fcn.1400de69c
xor ecx, ecx
cmp eax, ecx
je 0x1400a4bfa
lea rcx, [rsp + 0x90]
call fcn.14005bc74
mov rcx, qword [rsp + 0xa8]
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x90]
xor r14d, r14d
mov qword [rsp + 0xb8], r14
call fcn.1400c8c48
mov r8, qword [rsp + 0x90]
cmp dword [rsp + 0xc4], r14d
je 0x1400a4ac9
mov rax, qword [rsp + 0xb8]
sub rax, r8
sar rax, 1
mov qword [rsp + 0x138], rax
cmp dword [rsp + 0x78], r14d
je 0x1400a4b61
mov ebx, 8
mov rcx, rbx
call fcn.1400df578
cmp rax, r14
je 0x1400a4af8
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140066948
jmp 0x1400a4afb
mov rax, r14
lea r9, [rsp + 0x170]
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x170], rax
mov dword [rsp + 0x20], ebx
call fcn.14005bfc4
cmp dword [rsp + 0x5c], r14d
je 0x1400a4b59
cmp word [rsi], r14w
je 0x1400a4b59
lea rcx, [rsp + 0x90]
mov r14b, 1
call fcn.140053e80
xor ecx, ecx
jmp 0x1400a4c04
mov r8, qword [rsp + 0x90]
mov eax, dword [rsp + 0xb4]
mov rbx, qword [rsp + 0x3e0]
mov r9, qword [rsp + 0x3f0]
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
mov ecx, r15d
or ecx, dword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
or ecx, dword [rsp + 0xb0]
lea rdx, [rsp + 0x158]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400a2e44
mov ecx, pe_nt_image_headers64
add dword [rsp + 0x54], eax
movzx eax, word [rbx + 0xc8]
test cx, ax
je 0x1400a4beb
mov ecx, 0xfeff
and ax, cx
mov word [rbx + 0xc8], ax
lea rcx, [rsp + 0x90]
call fcn.140053e80
xor ecx, ecx
cmp dword [rsp + 0x5c], ecx
je 0x1400a4cd4
movsxd rbx, dword [rsp + 0xa0]
cmp word [rsi], cx
je 0x1400a4cd4
lea rax, [rsp + 0x120]
cmp qword [rax], rcx
je 0x1400a4cd4
mov rax, qword [rsp + 0x3e0]
test byte [rax + 0xc8], 0xef
jne 0x1400a4cd4
lea rcx, [rsp + 0xa8]
mov rdx, rsi
call fcn.140066a00
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0xa8]
call fcn.14005bdb0
xor ecx, ecx
cmp rbx, rcx
jne 0x1400a4cb4
test byte [rsp + 0x5c], 2
je 0x1400a4c8a
sub rsi, 2
cmp rsi, rbp
jbe 0x1400a4c9d
lea rax, [rsi - 2]
cmp word [rax], cx
je 0x1400a4c9d
mov rsi, rax
cmp rax, rbp
ja 0x1400a4c77
jmp 0x1400a4c9d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
xor ecx, ecx
cdqe
lea rsi, [rsi + rax*2]
mov r11, qword [rsp + 0xa8]
cmp r13w, word [r11]
jne 0x1400a4a23
jmp 0x1400a4c0c
mov rax, qword [rsp + 0xa8]
mov dword [rsp + 0xa0], ecx
mov word [rax], r13w
mov r11, qword [rsp + 0xa8]
jmp 0x1400a4a23
cmp r14b, cl
je 0x1400a4703
mov rbx, qword [rsp + 0x98]
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0x100]
mov r9d, 8
xor ecx, ecx
call fcn.14005c0d4
or r15d, dword [rsp + 0x50]
mov r9, qword [rsp + 0x3f0]
mov rcx, qword [rax]
mov rax, qword [rsp + 0x400]
or r15d, dword [rsp + 0xb0]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0x3e0]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xb4]
lea rdx, [rsp + 0x158]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call fcn.1400a2e44
mov r13d, dword [rsp + 0x54]
add r13d, eax
jmp 0x1400a4708
mov r13d, dword [rsp + 0x54]
mov ebx, dword [rsp + 0x70]
jmp 0x1400a4d8c
mov r13d, ecx
mov ebx, ecx
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x3e0]
mov edx, 0x8b
and word [rcx + 0xc8], dx
xor edx, edx
cmp byte [rsp + 0x58], dl
je 0x1400a4dba
mov r8, qword [rsp + 0x158]
mov rdx, rdi
call fcn.14005b2f4
jmp 0x1400a4dc9
cmp eax, edx
je 0x1400a4dc9
mov r8, rdi
mov edx, r13d
call fcn.14005ecfc
lea rcx, [rsp + 0xe0]
call fcn.140053e80
lea rcx, [rsp + 0xa8]
call fcn.140053e80
lea rcx, [rsp + 0x118]
call fcn.140053e80
lea rcx, [rsp + 0x158]
call fcn.140053e80
lea rcx, [rsp + 0x98]
call fcn.140053e80
lea rcx, [rsp + 0x80]
call fcn.140053e80
lea rcx, [rsp + 0xc8]
call fcn.140053e80
lea rcx, [rsp + 0xd8]
call fcn.140053e80
lea rcx, [rsp + 0x100]
call fcn.14001bdcc
lea rcx, [rsp + 0x100]
call fcn.140053e80
lea rcx, [rsp + 0xe8]
call fcn.140053e80
movsxd rax, ebx
add rsp, 0x398
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret