Function at 0x140028b10
Capabilities:
Create directory
Delete file
Set file attributes
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
movaps xmmword [rsp + 0x210], xmm8
movaps xmmword [rsp + 0x200], xmm7
movaps xmmword [rsp + 0x1f0], xmm6
mov rdi, r8
mov byte [rsp + 0xe8], dl
mov rsi, rcx
mov dword [rsp + 0xdc], r9d
lea rcx, [0x1402da560]
call fcn.1400741a0
movzx eax, byte [0x1402da630]
test al, al
je 0x14002ae4a
mov eax, dword [0x1402daaa8]
movabs r12, 0x730065006c0063
cmp eax, dword [rsp + 0xdc]
mov qword [rsp + 0xe0], rsi
jbe 0x140028ba0
lea rcx, str.exception_at_keyindex
mov dl, 1
call fcn.140011c60
jmp 0x140028d92
movzx esi, byte [0x1402da388]
mov ecx, esi
and cl, 1
je 0x140028bb7
mov rsi, qword [0x1402da390]
jmp 0x140028bba
shr rsi, 1
lea rbx, [rsi + 0x13]
movabs rax, 0x7fffffffffffffef
cmp rbx, rax
ja 0x14002ae86
cmp rbx, 0xa
ja 0x140028bf2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add bl, bl
mov byte [rsp + 0x40], bl
xor eax, eax
jmp 0x140028c2b
mov r14, rbx
or r14, 7
inc r14
js 0x14002aec0
lea rcx, [r14 + r14]
call fcn.1400731c0
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movzx ecx, byte [0x1402da388]
and cl, 1
mov ebx, r14d
test bl, 1
lea r14, [rsp + 0x42]
cmovne r14, rax
test cl, cl
je 0x140028c44
mov rdx, qword [0x1402da398]
jmp 0x140028c4b
lea rdx, [0x1402da38a]
lea r8, [rsi + rsi]
mov rcx, r14
call sub.msvcrt.dll_memmove
mov qword [r14 + rsi*2 + 0x1e], r12
movups xmm0, xmmword [str.programdata_secles]
movups xmmword [r14 + rsi*2], xmm0
movdqu xmm0, xmmword [0x140259960]
movdqu xmmword [r14 + rsi*2 + 0x10], xmm0
mov word [r14 + rsi*2 + 0x26], 0
lea rdx, str.posi.txt
lea rcx, [rsp + 0x40]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x1b0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x1a0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x1a0], 1
lea r14, [rsp + 0x1a2]
mov rcx, r14
je 0x140028cd6
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140028d43
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0xdc]
lea r9, [rsp + 0x180]
mov rcx, r15
mov r8d, 4
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x1a0], 1
je 0x140028d55
mov r14, qword [rsp + 0x1b0]
mov rcx, r14
call fcn.14004e0c0
test byte [rsp + 0x1a0], 1
je 0x140028d74
mov rcx, qword [rsp + 0x1b0]
call fcn.140073240
test byte [rsp + 0x40], 1
je 0x140028d85
mov rcx, qword [rsp + 0x50]
call fcn.140073240
mov eax, dword [rsp + 0xdc]
mov dword [0x1402daaa8], eax
mov rax, qword [0x1402db948]
mov rcx, qword [0x1402db938]
lea rdx, [rcx + rax]
add rdx, 0x3fffffff
add rcx, rax
cmovns rdx, rcx
sar rdx, 0x1e
lea rcx, [rsp + 0xa0]
call fcn.140076890
lea rdx, str.GB_disk_r_n
lea rcx, [rsp + 0xa0]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x100], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rax, qword [0x1402db950]
mov rcx, qword [0x1402db940]
lea rdx, [rcx + rax]
add rdx, 0x3fffffff
add rcx, rax
cmovns rdx, rcx
sar rdx, 0x1e
lea rcx, [rsp + 0x60]
call fcn.140076890
movzx r8d, byte [rsp + 0x60]
test r8b, 1
je 0x140028e46
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
jmp 0x140028e4e
shr r8, 1
lea rdx, [rsp + 0x61]
lea rcx, [rsp + 0xf0]
call fcn.140074e70
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x40], xmm0
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, str.GB_network
lea rcx, [rsp + 0x40]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x190], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x180], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x40], 1
jne 0x140028ef6
test byte [rsp + 0x60], 1
jne 0x140028f07
test byte [rsp + 0xf0], 1
jne 0x140028f1b
test byte [rsp + 0xa0], 1
je 0x140028ee0
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
movzx esi, byte [0x1402da388]
mov eax, esi
and al, 1
je 0x140028f34
mov rsi, qword [0x1402da390]
jmp 0x140028f37
mov rcx, qword [rsp + 0x50]
call fcn.140073240
test byte [rsp + 0x60], 1
je 0x140028ebf
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xf0], 1
je 0x140028ec9
mov rcx, qword [rsp + 0x100]
call fcn.140073240
test byte [rsp + 0xa0], 1
jne 0x140028ed3
jmp 0x140028ee0
shr rsi, 1
lea rbx, [rsi + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14002ae7c
cmp rbx, 0xa
ja 0x140028f72
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add bl, bl
mov byte [rsp + 0x40], bl
xor r15d, r15d
jmp 0x140028fad
mov r14, rbx
or r14, 7
inc r14
js 0x14002ae90
lea rcx, [r14 + r14]
call fcn.1400731c0
mov r15, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movzx eax, byte [0x1402da388]
and al, 1
mov ebx, r14d
test bl, 1
lea r14, [rsp + 0x42]
cmove r15, r14
test al, al
je 0x140028fc6
mov rdx, qword [0x1402da398]
jmp 0x140028fcd
lea rdx, [0x1402da38a]
lea r8, [rsi + rsi]
mov rcx, r15
call sub.msvcrt.dll_memmove
mov qword [r15 + rsi*2 + 0x1e], r12
movups xmm6, xmmword [str.programdata_secles]
movups xmmword [r15 + rsi*2], xmm6
movups xmm7, xmmword [0x140259960]
movups xmmword [r15 + rsi*2 + 0x10], xmm7
mov word [r15 + rsi*2 + 0x26], 0
lea rdx, [0x14025da1c]
lea rcx, [rsp + 0x40]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x170], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x160], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx r12d, byte [rsp + 0x180]
test r12b, 1
mov rsi, qword [rsp + 0xe0]
je 0x140029062
mov r13, qword [rsp + 0x190]
mov r12, qword [rsp + 0x188]
jmp 0x14002906d
shr r12, 1
lea r13, [rsp + 0x181]
test byte [rsp + 0x160], 1
lea r15, [rsp + 0x162]
mov rcx, r15
je 0x14002908a
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400290ef
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xf0]
mov rcx, rbp
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x160], 1
je 0x140029101
mov r15, qword [rsp + 0x170]
mov rcx, r15
call fcn.14004e0c0
test byte [rsp + 0x160], 1
je 0x140029120
mov rcx, qword [rsp + 0x170]
call fcn.140073240
test byte [rsp + 0x40], 1
je 0x140029131
mov rcx, qword [rsp + 0x50]
call fcn.140073240
mov byte [rsp + 0xf0], 4
lea rdx, [rsp + 0xf1]
mov byte [rsp + 0xf3], 0
cmp byte [rsp + 0xe8], 0x73
lea rax, [0x1402da4c2]
lea rcx, [0x1402da4c0]
cmove rcx, rax
movzx eax, word [rcx]
mov word [rsp + 0xf1], ax
mov r8d, 2
mov rcx, rsi
call fcn.140074e70
mov r15, qword [0x1402d72e0]
lea rax, [0x1402d72d8]
cmp r15, rax
je 0x1400293e1
lea r13, [rsp + 0x1ba]
lea r12, [rsp + 0x1b8]
jmp 0x1400291d3
mov rcx, r15
call fcn.140073240
mov r15, rsi
lea rax, [0x1402d72d8]
cmp rsi, rax
mov rsi, qword [rsp + 0xe0]
je 0x1400293e1
movzx ebp, byte [r15 + 0x10]
test bpl, 1
je 0x1400291f0
mov rbx, qword [r15 + 0x20]
mov rbp, qword [r15 + 0x18]
jmp 0x1400291f7
lea rbx, [r15 + 0x11]
shr rbp, 1
movabs rax, 0x7fffffffffffffef
cmp rbp, rax
ja 0x14002adde
cmp rbp, 0xb
jae 0x140029230
lea eax, [rbp + rbp]
mov byte [rsp + 0x1b8], al
mov rax, r13
mov rdx, r13
test rbp, rbp
jne 0x140029265
jmp 0x140029380
mov rsi, rbp
or rsi, 7
inc rsi
js 0x14002adeb
lea rcx, [rsi + rsi]
call fcn.1400731c0
mov qword [rsp + 0x1c8], rax
or rsi, 1
mov qword [rsp + 0x1b8], rsi
mov qword [rsp + 0x1c0], rbp
lea rcx, [rbx + rbp]
cmp rbp, 0x10
jb 0x140029285
cmp rax, rcx
jae 0x140029320
lea rdx, [rax + rbp*2]
cmp rbx, rdx
jae 0x140029320
mov rdx, rax
mov r8, rbx
add ebp, ebx
sub ebp, r8d
mov rax, r8
not rax
add rax, rcx
and rbp, 7
je 0x1400292b4
nop
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rbp
jne 0x1400292a0
cmp rax, 7
jb 0x140029380
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x1400292c0
jmp 0x140029380
mov r9, rbp
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [rbx + r9]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbx + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbx + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x140029340
cmp rbp, r9
jne 0x14002928b
nop
mov word [rdx], 0
mov rcx, r12
call fcn.140013b20
mov ebp, eax
test byte [rsp + 0x1b8], 1
je 0x1400293a6
mov rcx, qword [rsp + 0x1c8]
call fcn.140073240
mov rsi, qword [r15 + 8]
test bpl, bpl
jne 0x1400291b8
mov rax, qword [r15]
mov qword [rax + 8], rsi
mov rcx, qword [r15 + 8]
mov qword [rcx], rax
dec qword [0x1402d72e8]
test byte [r15 + 0x10], 1
je 0x1400291b0
mov rcx, qword [r15 + 0x20]
call fcn.140073240
jmp 0x1400291b0
mov byte [rsp + 0x1d0], 8
mov dword [rsp + 0x1d1], 0x6379626b
mov byte [rsp + 0x1d5], 0
mov r9d, dword [rsp + 0xdc]
lea rdx, [rsp + 0x1d0]
mov rcx, rsi
movzx r8d, byte [rsp + 0xe8]
call fcn.140018cd0
mov ebp, eax
test byte [rsp + 0x1d0], 1
movabs r12, 0x730065006c0063
je 0x140029440
mov rcx, qword [rsp + 0x1e0]
call fcn.140073240
test bpl, bpl
je 0x140029451
test byte [rsi], 1
jne 0x140029497
mov word [rsi], 0
jmp 0x1400294a6
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
movzx eax, byte [rdi]
test al, 1
je 0x140029894
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400298a0
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call fcn.1400761e0
jmp 0x140029c04
mov rax, qword [rsi + 0x10]
mov byte [rax], 0
mov qword [rsi + 8], 0
mov rbp, qword [0x1402d72e0]
lea rax, [0x1402d72d8]
cmp rbp, rax
je 0x140029876
lea rax, [rdi + 2]
mov qword [rsp + 0xe8], rax
lea r15, [rsp + 0xa2]
lea r12, [rsp + 0x40]
lea r13, [0x140259684]
lea rsi, [rsp + 0x80]
xorps xmm8, xmm8
jmp 0x140029504
mov rbp, qword [rbp + 8]
lea rax, [0x1402d72d8]
cmp rbp, rax
je 0x140029876
lea rdx, [rbp + 0x10]
mov rcx, r12
call fcn.1400747e0
movzx r14d, byte [rsp + 0x40]
test r14b, 1
je 0x140029530
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
jmp 0x140029538
shr r14, 1
lea rbx, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp r14, rax
ja 0x14002adf0
cmp r14, 0xb
jae 0x140029580
lea eax, [r14 + r14]
mov byte [rsp + 0x80], al
lea rdx, [rsp + 0x82]
mov rax, rdx
test r14, r14
jne 0x1400295e3
jmp 0x140029700
mov qword [rsp + 0xe0], rbp
mov rbp, rdi
mov rdi, rsi
mov rsi, r13
mov r13, r12
mov r12, r15
mov r15, r14
or r15, 7
inc r15
js 0x14002ae31
lea rcx, [r15 + r15]
call fcn.1400731c0
mov qword [rsp + 0x90], rax
or r15, 1
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], r14
mov r15, r12
mov r12, r13
mov r13, rsi
mov rsi, rdi
mov rdi, rbp
mov rbp, qword [rsp + 0xe0]
lea rcx, [rbx + r14]
cmp r14, 0x10
jb 0x140029603
cmp rax, rcx
jae 0x1400296a0
lea rdx, [rax + r14*2]
cmp rbx, rdx
jae 0x1400296a0
mov rdx, rax
mov r8, rbx
add r14d, ebx
sub r14d, r8d
mov rax, r8
not rax
add rax, rcx
and r14, 7
je 0x140029634
nop
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec r14
jne 0x140029620
cmp rax, 7
jb 0x140029700
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x140029640
jmp 0x140029700
mov r9, r14
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [rbx + r9]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbx + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbx + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x1400296c0
cmp r14, r9
jne 0x140029609
nop
mov word [rdx], 0
mov rcx, rsi
mov rdx, r13
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0xc0]
lea rdx, str.secles
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
movzx r8d, byte [rdi]
test r8b, 1
je 0x140029780
mov rdx, qword [rdi + 0x10]
mov r8, qword [rdi + 8]
jmp 0x14002978b
shr r8, 1
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x60]
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
mov rcx, r15
je 0x1400297cf
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test byte [rsp + 0xa0], 1
jne 0x140029810
test byte [rsp + 0x60], 1
jne 0x140029824
test byte [rsp + 0xc0], 1
jne 0x140029838
test byte [rsp + 0x80], 1
jne 0x14002984f
test byte [rsp + 0x40], 1
je 0x1400294f0
jmp 0x140029867
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0x60], 1
je 0x1400297e6
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xc0], 1
je 0x1400297f0
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
test byte [rsp + 0x80], 1
je 0x1400297fa
mov rcx, qword [rsp + 0x90]
call fcn.140073240
test byte [rsp + 0x40], 1
je 0x1400294f0
mov rcx, qword [rsp + 0x50]
call fcn.140073240
jmp 0x1400294f0
movzx ebx, byte [0x1402da388]
mov ecx, ebx
and cl, 1
je 0x140029958
mov rbx, qword [0x1402da390]
jmp 0x14002995b
shr rax, 1
test rax, rax
jne 0x140029482
mov qword [rsp + 0x108], 0
lea rcx, [rsp + 0x40]
call fcn.14005c770
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x108]
mov r8d, 8
call fcn.14005c780
mov rcx, qword [rsp + 0x108]
movabs rdx, 0xfd53d5aa95466a5f
mov rax, rcx
mul rdx
shr rdx, 0x2b
movabs rax, 0x8159b108e38
imul rax, rdx
neg rax
lea rdx, [rcx + rax]
inc rdx
mov qword [rsp + 0x108], rdx
movsx eax, byte [rsp + 0xe8]
mov byte [rsp + 0x60], 2
mov word [rsp + 0x62], ax
mov word [rsp + 0x64], 0
lea rcx, [rsp + 0xc0]
call fcn.140076ef0
movzx r8d, byte [rsp + 0xc0]
test r8b, 1
je 0x140029b24
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xc8]
jmp 0x140029b2f
shr rbx, 1
movabs r15, 0x730065006c0063
lea rsi, [rbx + 0x13]
movabs rax, 0x7fffffffffffffef
cmp rsi, rax
ja 0x14002aea9
cmp rsi, 0xa
ja 0x1400299aa
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
add sil, sil
mov byte [rsp + 0xa0], sil
xor eax, eax
jmp 0x1400299ec
mov r14, rsi
or r14, 7
inc r14
js 0x14002aecf
lea rcx, [r14 + r14]
call fcn.1400731c0
or r14, 1
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], rsi
movzx ecx, byte [0x1402da388]
and cl, 1
mov esi, r14d
test sil, 1
lea rsi, [rsp + 0xa2]
cmovne rsi, rax
test cl, cl
je 0x140029a09
mov rdx, qword [0x1402da398]
jmp 0x140029a10
lea rdx, [0x1402da38a]
lea r8, [rbx + rbx]
mov rcx, rsi
call sub.msvcrt.dll_memmove
mov qword [rsi + rbx*2 + 0x1e], r15
movups xmmword [rsi + rbx*2], xmm6
movups xmmword [rsi + rbx*2 + 0x10], xmm7
mov word [rsi + rbx*2 + 0x26], 0
movzx r8d, byte [rdi]
test r8b, 1
je 0x140029a45
mov r8, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
jmp 0x140029a4c
add rdi, 2
shr r8, 1
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x40], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x40], 1
je 0x140029a8d
mov rcx, qword [rsp + 0x50]
jmp 0x140029a92
lea rcx, [rsp + 0x42]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test byte [rsp + 0x40], 1
jne 0x140029b0b
test byte [rsp + 0xa0], 1
jne 0x14002ada3
test byte [rsp + 0xf0], 1
jne 0x14002adbe
test byte [rsp + 0x180], 1
je 0x140029ad2
mov rcx, qword [rsp + 0x190]
call fcn.140073240
lea rcx, [0x1402da560]
call fcn.1400741d0
movaps xmm6, xmmword [rsp + 0x1f0]
movaps xmm7, xmmword [rsp + 0x200]
movaps xmm8, xmmword [rsp + 0x210]
add rsp, 0x228
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x50]
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x140029aad
jmp 0x14002ada3
shr r8, 1
lea rdx, [rsp + 0xc2]
lea rcx, [rsp + 0x60]
call fcn.140075c20
movzx ebx, byte [rax]
movzx esi, byte [rax + 1]
movzx ebp, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x88], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x80], rcx
mov r15, qword [rax + 0x10]
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
je 0x140029b85
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
mov byte [rsp + 0xa0], bl
mov byte [rsp + 0xa1], sil
mov word [rsp + 0xa2], bp
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xa4], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0xac], eax
mov qword [rsp + 0xb0], r15
test byte [rsp + 0xc0], 1
je 0x140029bd9
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
test byte [rsp + 0x60], 1
je 0x140029bea
mov rcx, qword [rsp + 0x70]
call fcn.140073240
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.1400761e0
lea rcx, [rsp + 0x40]
call fcn.14005c3d0
movzx esi, byte [0x1402da388]
mov eax, esi
and al, 1
je 0x140029c1a
mov rsi, qword [0x1402da390]
jmp 0x140029c1d
shr rsi, 1
lea rbx, [rsi + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14002ae95
cmp rbx, 0xa
ja 0x140029c57
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add bl, bl
mov byte [rsp + 0x40], bl
xor edi, edi
jmp 0x140029c92
mov r15, rbx
or r15, 7
inc r15
js 0x14002aec5
lea rcx, [r15 + r15]
call fcn.1400731c0
mov rdi, rax
or r15, 1
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movzx eax, byte [0x1402da388]
and al, 1
mov ebx, r15d
test bl, 1
cmove rdi, r14
test al, al
je 0x140029ca6
mov rdx, qword [0x1402da398]
jmp 0x140029cad
lea rdx, [0x1402da38a]
lea r8, [rsi + rsi]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov qword [rdi + rsi*2 + 0x1e], r12
movups xmmword [rdi + rsi*2], xmm6
movups xmmword [rdi + rsi*2 + 0x10], xmm7
mov word [rdi + rsi*2 + 0x26], 0
test byte [rsp + 0x40], 1
je 0x140029cda
mov r14, qword [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test byte [rsp + 0x40], 1
je 0x140029cf4
mov rcx, qword [rsp + 0x50]
call fcn.140073240
movzx esi, byte [0x1402da388]
mov eax, esi
and al, 1
je 0x140029d0a
mov rsi, qword [0x1402da390]
jmp 0x140029d0d
shr rsi, 1
lea rbx, [rsi + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14002ae9f
cmp rbx, 0xa
ja 0x140029d47
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
add bl, bl
mov byte [rsp + 0x40], bl
xor edi, edi
jmp 0x140029d82
mov r14, rbx
or r14, 7
inc r14
js 0x14002aeca
lea rcx, [r14 + r14]
call fcn.1400731c0
mov rdi, rax
or r14, 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
movzx eax, byte [0x1402da388]
and al, 1
mov ebx, r14d
test bl, 1
lea rbx, [rsp + 0x42]
cmove rdi, rbx
test al, al
je 0x140029d9b
mov rdx, qword [0x1402da398]
jmp 0x140029da2
lea rdx, [0x1402da38a]
lea r8, [rsi + rsi]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov qword [rdi + rsi*2 + 0x1e], r12
movups xmmword [rdi + rsi*2], xmm6
movups xmmword [rdi + rsi*2 + 0x10], xmm7
mov word [rdi + rsi*2 + 0x26], 0
test byte [rsp + 0x40], 1
je 0x140029dcf
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov rsi, qword [rsp + 0xe0]
test byte [rsp + 0x40], 1
je 0x140029df3
mov rcx, qword [rsp + 0x50]
call fcn.140073240
mov r13, qword [0x1402d72e0]
lea rax, [0x1402d72d8]
cmp r13, rax
je 0x14002aabd
lea rbx, [0x140259684]
lea r14, [rsp + 0x80]
xorps xmm8, xmm8
lea r15, str.secles
lea r12, [rsp + 0xc0]
jmp 0x140029e44
mov r13, qword [r13 + 8]
lea rax, [0x1402d72d8]
cmp r13, rax
je 0x14002a632
lea rdx, [r13 + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400747e0
movzx edi, byte [rsp + 0x40]
test dil, 1
je 0x140029e70
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
jmp 0x140029e78
shr rdi, 1
lea rbp, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002ae0a
cmp rdi, 0xb
jae 0x140029eb0
lea eax, [rdi + rdi]
mov byte [rsp + 0x80], al
lea rdx, [rsp + 0x82]
mov rax, rdx
test rdi, rdi
jne 0x140029eed
jmp 0x14002a010
mov rsi, rdi
or rsi, 7
inc rsi
js 0x14002ae40
lea rcx, [rsi + rsi]
call fcn.1400731c0
mov qword [rsp + 0x90], rax
or rsi, 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov rsi, qword [rsp + 0xe0]
lea rcx, [rdi + rbp]
cmp rdi, 0x10
jb 0x140029f0d
cmp rax, rcx
jae 0x140029fb0
lea rdx, [rax + rdi*2]
cmp rbp, rdx
jae 0x140029fb0
mov rdx, rax
mov r8, rbp
add edi, ebp
sub edi, r8d
mov rax, r8
not rax
add rax, rcx
and rdi, 7
je 0x140029f44
nop word [rax + rax]
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rdi
jne 0x140029f30
cmp rax, 7
jb 0x14002a010
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x140029f50
jmp 0x14002a010
mov r9, rdi
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [r9 + rbp]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbp + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbp + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x140029fd0
cmp rdi, r9
jne 0x140029f13
nop
mov word [rdx], 0
mov rcx, r14
mov rdx, rbx
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
mov rcx, r12
mov rdx, r15
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x14002a080
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
test byte [rsp + 0x60], 1
jne 0x14002a0d0
test byte [rsp + 0xc0], 1
jne 0x14002a0e4
test byte [rsp + 0x80], 1
je 0x14002a0ae
mov rcx, qword [rsp + 0x90]
call fcn.140073240
movzx edi, byte [rsp + 0x40]
test dil, 1
je 0x14002a100
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
jmp 0x14002a108
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xc0], 1
je 0x14002a097
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
test byte [rsp + 0x80], 1
jne 0x14002a0a1
jmp 0x14002a0ae
shr rdi, 1
lea rbp, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002ae17
cmp rdi, 0xb
jae 0x14002a140
lea eax, [rdi + rdi]
mov byte [rsp + 0x80], al
lea rdx, [rsp + 0x82]
mov rax, rdx
test rdi, rdi
jne 0x14002a17d
jmp 0x14002a2a0
mov rsi, rdi
or rsi, 7
inc rsi
js 0x14002ae3b
lea rcx, [rsi + rsi]
call fcn.1400731c0
mov qword [rsp + 0x90], rax
or rsi, 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov rsi, qword [rsp + 0xe0]
lea rcx, [rdi + rbp]
cmp rdi, 0x10
jb 0x14002a19d
cmp rax, rcx
jae 0x14002a240
lea rdx, [rax + rdi*2]
cmp rbp, rdx
jae 0x14002a240
mov rdx, rax
mov r8, rbp
add edi, ebp
sub edi, r8d
mov rax, r8
not rax
add rax, rcx
and rdi, 7
je 0x14002a1d4
nop word [rax + rax]
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rdi
jne 0x14002a1c0
cmp rax, 7
jb 0x14002a2a0
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002a1e0
jmp 0x14002a2a0
mov r9, rdi
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [r9 + rbp]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbp + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbp + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002a260
cmp rdi, r9
jne 0x14002a1a3
nop
mov word [rdx], 0
mov rcx, r14
mov rdx, rbx
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
mov rcx, r12
mov rdx, r15
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x14002a310
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x60], 1
jne 0x14002a360
test byte [rsp + 0xc0], 1
jne 0x14002a374
test byte [rsp + 0x80], 1
je 0x14002a340
mov rcx, qword [rsp + 0x90]
call fcn.140073240
movzx edi, byte [rsp + 0x40]
test dil, 1
je 0x14002a390
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
jmp 0x14002a398
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xc0], 1
je 0x14002a329
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
test byte [rsp + 0x80], 1
jne 0x14002a333
jmp 0x14002a340
shr rdi, 1
lea rbp, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002adfd
cmp rdi, 0xb
jae 0x14002a3d0
lea eax, [rdi + rdi]
mov byte [rsp + 0x80], al
lea rdx, [rsp + 0x82]
mov rax, rdx
test rdi, rdi
jne 0x14002a40d
jmp 0x14002a530
mov rsi, rdi
or rsi, 7
inc rsi
js 0x14002ae36
lea rcx, [rsi + rsi]
call fcn.1400731c0
mov qword [rsp + 0x90], rax
or rsi, 1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov rsi, qword [rsp + 0xe0]
lea rcx, [rdi + rbp]
cmp rdi, 0x10
jb 0x14002a42d
cmp rax, rcx
jae 0x14002a4d0
lea rdx, [rax + rdi*2]
cmp rbp, rdx
jae 0x14002a4d0
mov rdx, rax
mov r8, rbp
add edi, ebp
sub edi, r8d
mov rax, r8
not rax
add rax, rcx
and rdi, 7
je 0x14002a464
nop word [rax + rax]
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rdi
jne 0x14002a450
cmp rax, 7
jb 0x14002a530
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002a470
jmp 0x14002a530
mov r9, rdi
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [r9 + rbp]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rbp + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rbp + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002a4f0
cmp rdi, r9
jne 0x14002a433
nop
mov word [rdx], 0
mov rcx, r14
mov rdx, rbx
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
mov rcx, r12
mov rdx, r15
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x14002a5a0
mov rcx, qword [rsp + 0x70]
mov edx, 2
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test byte [rsp + 0x60], 1
jne 0x14002a5e0
test byte [rsp + 0xc0], 1
jne 0x14002a5f4
test byte [rsp + 0x80], 1
jne 0x14002a60b
test byte [rsp + 0x40], 1
je 0x140029e30
jmp 0x14002a623
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xc0], 1
je 0x14002a5bc
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
test byte [rsp + 0x80], 1
je 0x14002a5c6
mov rcx, qword [rsp + 0x90]
call fcn.140073240
test byte [rsp + 0x40], 1
je 0x140029e30
mov rcx, qword [rsp + 0x50]
call fcn.140073240
jmp 0x140029e30
mov r12, qword [0x1402d72e0]
lea rax, [0x1402d72d8]
cmp r12, rax
je 0x14002aabd
lea r13, [rsi + 1]
lea rbp, [rsp + 0x142]
lea rbx, [0x140259684]
xorps xmm8, xmm8
jmp 0x14002a685
mov r12, qword [r12 + 8]
lea rax, [0x1402d72d8]
cmp r12, rax
je 0x14002aabd
lea rdx, [r12 + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400747e0
movzx edi, byte [rsp + 0x40]
test dil, 1
je 0x14002a6b0
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
jmp 0x14002a6b8
shr rdi, 1
lea rsi, [rsp + 0x41]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002ae24
cmp rdi, 0xb
jae 0x14002a6f0
lea eax, [rdi + rdi]
mov byte [rsp + 0x108], al
lea rdx, [rsp + 0x10a]
mov rax, rdx
test rdi, rdi
jne 0x14002a725
jmp 0x14002a840
mov r14, rdi
or r14, 7
inc r14
js 0x14002ae45
lea rcx, [r14 + r14]
call fcn.1400731c0
mov qword [rsp + 0x118], rax
or r14, 1
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x110], rdi
lea rcx, [rsi + rdi]
cmp rdi, 0x10
jb 0x14002a745
cmp rax, rcx
jae 0x14002a7e0
lea rdx, [rax + rdi*2]
cmp rsi, rdx
jae 0x14002a7e0
mov rdx, rax
mov r8, rsi
add edi, esi
sub edi, r8d
mov rax, r8
not rax
add rax, rcx
and rdi, 7
je 0x14002a774
nop
movsx r9d, byte [r8]
mov word [rdx], r9w
inc r8
add rdx, 2
dec rdi
jne 0x14002a760
cmp rax, 7
jb 0x14002a840
nop
movsx eax, byte [r8]
mov word [rdx], ax
movsx eax, byte [r8 + 1]
mov word [rdx + 2], ax
movsx eax, byte [r8 + 2]
mov word [rdx + 4], ax
movsx eax, byte [r8 + 3]
mov word [rdx + 6], ax
movsx eax, byte [r8 + 4]
mov word [rdx + 8], ax
movsx eax, byte [r8 + 5]
mov word [rdx + 0xa], ax
movsx eax, byte [r8 + 6]
mov word [rdx + 0xc], ax
movsx eax, byte [r8 + 7]
mov word [rdx + 0xe], ax
add r8, 8
add rdx, 0x10
cmp r8, rcx
jne 0x14002a780
jmp 0x14002a840
mov r9, rdi
and r9, 0xfffffffffffffff0
lea rdx, [rax + r9*2]
lea r8, [rsi + r9]
xor r10d, r10d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r10]
punpcklbw xmm0, xmm0
movq xmm1, qword [rsi + r10 + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rax + r10*2], xmm0
movdqu xmmword [rax + r10*2 + 0x10], xmm1
add r10, 0x10
cmp r9, r10
jne 0x14002a800
cmp rdi, r9
jne 0x14002a74b
nop
mov word [rdx], 0
lea rcx, [rsp + 0x108]
mov rdx, rbx
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x80]
lea rdx, str.secles
call fcn.140076360
mov rsi, qword [rsp + 0xe0]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0xc0]
mov rdx, rbx
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
movzx r8d, byte [rsp + 0xa0]
test r8b, 1
je 0x14002a910
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xa8]
jmp 0x14002a91b
shr r8, 1
lea rdx, [rsp + 0xa2]
lea rcx, [rsp + 0x60]
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x150], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x140], xmm0
movups xmmword [rax], xmm8
mov qword [rax + 0x10], 0
movzx edi, byte [rsi]
test dil, 1
je 0x14002a960
mov r14, qword [rsi + 0x10]
mov rdi, qword [rsi + 8]
jmp 0x14002a966
shr rdi, 1
mov r14, r13
test byte [rsp + 0x140], 1
mov rcx, rbp
je 0x14002a97b
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14002a9e0
mov qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, r14
mov r8d, edi
lea r9, [rsp + 0x1ec]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x140], 1
mov rcx, rbp
je 0x14002a9f5
mov rcx, qword [rsp + 0x150]
call fcn.14004e0c0
test byte [rsp + 0x140], 1
jne 0x14002aa40
test byte [rsp + 0x60], 1
jne 0x14002aa54
test byte [rsp + 0xc0], 1
jne 0x14002aa68
test byte [rsp + 0x80], 1
jne 0x14002aa7f
test byte [rsp + 0x108], 1
jne 0x14002aa96
test byte [rsp + 0x40], 1
je 0x14002a670
jmp 0x14002aaae
mov rcx, qword [rsp + 0x150]
call fcn.140073240
test byte [rsp + 0x60], 1
je 0x14002aa0b
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xc0], 1
je 0x14002aa15
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
test byte [rsp + 0x80], 1
je 0x14002aa1f
mov rcx, qword [rsp + 0x90]
call fcn.140073240
test byte [rsp + 0x108], 1
je 0x14002aa29
mov rcx, qword [rsp + 0x118]
call fcn.140073240
test byte [rsp + 0x40], 1
je 0x14002a670
mov rcx, qword [rsp + 0x50]
call fcn.140073240
jmp 0x14002a670
movzx esi, byte [0x1402da388]
mov ecx, esi
and cl, 1
je 0x14002aad4
mov rsi, qword [0x1402da390]
jmp 0x14002aad7
shr rsi, 1
movabs r14, 0x730065006c0063
lea rdi, [rsi + 0x13]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002aeb6
cmp rdi, 0xa
ja 0x14002ab1d
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
add dil, dil
mov byte [rsp + 0x60], dil
xor eax, eax
jmp 0x14002ab55
mov rbx, rdi
or rbx, 7
inc rbx
js 0x14002aed4
lea rcx, [rbx + rbx]
call fcn.1400731c0
or rbx, 1
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rdi
movzx ecx, byte [0x1402da388]
and cl, 1
mov edi, ebx
test dil, 1
lea rdi, [rsp + 0x62]
cmovne rdi, rax
test cl, cl
je 0x14002ab6f
mov rdx, qword [0x1402da398]
jmp 0x14002ab76
lea rdx, [0x1402da38a]
lea r8, [rsi + rsi]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov qword [rdi + rsi*2 + 0x1e], r14
movups xmmword [rdi + rsi*2], xmm6
movups xmmword [rdi + rsi*2 + 0x10], xmm7
mov word [rdi + rsi*2 + 0x26], 0
lea rdx, [0x140259684]
lea rcx, [rsp + 0x60]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x40], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx r8d, byte [rsp + 0xa0]
test r8b, 1
mov rsi, qword [rsp + 0xe0]
je 0x14002abf4
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xa8]
jmp 0x14002abff
shr r8, 1
lea rdx, [rsp + 0xa2]
lea rcx, [rsp + 0x40]
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x130], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x120], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
movzx ebx, byte [rsi]
lea r12, [rsi + 1]
test bl, 1
je 0x14002ac48
mov r14, qword [rsi + 0x10]
mov rbx, qword [rsi + 8]
jmp 0x14002ac4e
shr rbx, 1
mov r14, r12
test byte [rsp + 0x120], 1
lea rdi, [rsp + 0x122]
mov rcx, rdi
je 0x14002ac6b
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14002acd0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xc0]
mov rcx, r15
mov rdx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x120], 1
je 0x14002ace2
mov rdi, qword [rsp + 0x130]
mov rcx, rdi
call fcn.14004e0c0
test byte [rsp + 0x120], 1
jne 0x14002ad1a
test byte [rsp + 0x40], 1
jne 0x14002ad2e
test byte [rsp + 0x60], 1
je 0x14002ad0c
mov rcx, qword [rsp + 0x70]
call fcn.140073240
movzx ecx, byte [rsi]
test cl, 1
je 0x14002ad41
mov rax, qword [rsi + 8]
jmp 0x14002ad47
mov rcx, qword [rsp + 0x130]
call fcn.140073240
test byte [rsp + 0x40], 1
je 0x14002acfb
mov rcx, qword [rsp + 0x50]
call fcn.140073240
test byte [rsp + 0x60], 1
jne 0x14002ad02
jmp 0x14002ad0c
mov rax, rcx
shr rax, 1
dec rax
test cl, 1
jne 0x14002ad59
lea ecx, [rax + rax]
mov byte [rsi], cl
mov rcx, r12
jmp 0x14002ad61
mov rcx, qword [rsi + 0x10]
mov qword [rsi + 8], rax
mov byte [rcx + rax], 0
movzx ecx, byte [rsi]
test cl, 1
je 0x14002ad73
mov rax, qword [rsi + 8]
jmp 0x14002ad79
mov rax, rcx
shr rax, 1
dec rax
test cl, 1
jne 0x14002ad88
lea ecx, [rax + rax]
mov byte [rsi], cl
jmp 0x14002ad90
mov r12, qword [rsi + 0x10]
mov qword [rsi + 8], rax
mov byte [r12 + rax], 0
test byte [rsp + 0xa0], 1
je 0x140029aad
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0xf0], 1
je 0x140029abb
mov rcx, qword [rsp + 0x100]
call fcn.140073240
test byte [rsp + 0x180], 1
jne 0x140029ac5
jmp 0x140029ad2
lea rcx, [rsp + 0x1b8]
call fcn.140002b00
call fcn.140002ba0
lea rcx, [rsp + 0x80]
call fcn.140002b00
lea rcx, [rsp + 0x80]
call fcn.140002b00
lea rcx, [rsp + 0x80]
call fcn.140002b00
lea rcx, [rsp + 0x80]
call fcn.140002b00
lea rcx, [rsp + 0x108]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [0x1402da630]
call fcn.1400718f0
test eax, eax
je 0x140028b6c
mov eax, dword [rsp + 0xdc]
mov dword [0x1402daaa8], eax
lea rcx, [0x1402da630]
call fcn.1400719cb
jmp 0x140028b6c
lea rcx, [rsp + 0x40]
call fcn.140002b00
lea rcx, [rsp + 0x40]
call fcn.140002b00
call fcn.140002ba0
lea rcx, [rsp + 0x40]
call fcn.140002b00
lea rcx, [rsp + 0x40]
call fcn.140002b00
lea rcx, [rsp + 0xa0]
call fcn.140002b00
lea rcx, [rsp + 0x60]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
mov rsi, rax
test byte [rsp + 0xc0], 1
je 0x14002b072
mov rcx, qword [rsp + 0xd0]
jmp 0x14002b06d
call fcn.140073240
test byte [rsp + 0x60], 1
je 0x14002b3b8
mov rcx, qword [rsp + 0x70]
jmp 0x14002b3b3
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x14002b3d4
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
jmp 0x14002b3d4
test byte [rsp + 0xf0], 1
je 0x14002b3eb
mov rcx, qword [rsp + 0x100]
call fcn.140073240
test byte [rsp + 0x180], 1
je 0x14002b402
mov rcx, qword [rsp + 0x190]
call fcn.140073240
lea rcx, [0x1402da560]
call fcn.1400741d0
mov rcx, rsi
call fcn.14009d370
int3