Function at 0x14001cfc0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
mov ecx, 1
mov edx, 0x320
call dbg.CALLOC
xor ecx, ecx
lea r12, [rsi + 0xe2c]
mov qword [rax], rsi
mov rbx, rax
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
or byte [rbx + 0x230], 1
mov qword [rbx + 0x228], rax
mov rax, qword [rsi + 0xf38]
mov qword [rbx + 0x248], rax
mov rax, qword [rsi + 0xf40]
movdqu xmm4, xmmword [rsi + 0x1620]
movzx edx, byte [rsi + 0xce4]
mov qword [rbx + 0x250], rax
mov eax, dword [rsi + 0x1640]
mov ecx, edx
movups xmmword [rbx + 0x2d8], xmm4
mov dword [rbx + 0x2f0], eax
mov rax, qword [rsi + 0x1630]
shr cl, 2
and ecx, 1
mov qword [rbx + 0x2e8], rax
mov rax, qword [rsi + 0x1638]
mov qword [rbx + 0x2f8], rax
mov eax, edx
shr dl, 4
shr al, 2
and edx, 4
and eax, 2
or eax, ecx
or eax, edx
movzx edx, byte [rsi + 0xf34]
mov ecx, edx
shr cl, 1
and ecx, 8
or eax, ecx
mov ecx, edx
and ecx, 1
shl ecx, 4
or eax, ecx
mov ecx, edx
shl edx, 4
shl ecx, 4
and edx, 0x40
and ecx, 0x20
or eax, ecx
mov rcx, r12
or eax, edx
movzx edx, byte [rsi + 0xf2c]
shl edx, 7
or eax, edx
mov byte [rbx + 0x270], al
call sym.strlen
lea r13, [rax + 1]
mov rbp, rax
mov rcx, r13
call dbg.MALLOC
mov r8, r13
mov rdx, r12
lea r12, [rsi + 0xf48]
mov rcx, rax
call sym.memcpy
mov rcx, r12
mov byte [rax + rbp], 0
mov qword [rbx + 0x318], rax
call sym.strlen
lea r13, [rax + 1]
mov rbp, rax
mov rcx, r13
call dbg.MALLOC
mov r8, r13
mov rdx, r12
mov rcx, rax
call sym.memcpy
mov byte [rax + rbp], 0
cmp dword [rsi + 0xba0], 1
lea rbp, [rsi + 0xd2c]
mov qword [rbx + 0x268], rax
jbe 0x14001d280
mov rcx, rbp
mov edx, edi
call dbg.indexed_filename
mov rcx, rax
mov qword [rbx + 8], rcx
lea rax, [rsi + 0x128]
lea rdx, [rbx + 0x10]
lea rcx, [rsi + 0xca8]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop
movdqu xmm0, xmmword [rax]
add rax, 0x170
add rdx, 0x40
movups xmmword [rdx - 0x40], xmm0
movdqu xmm1, xmmword [rax - 0x160]
movups xmmword [rdx - 0x30], xmm1
movdqu xmm2, xmmword [rax - 0x150]
movups xmmword [rdx - 0x20], xmm2
movdqu xmm3, xmmword [rax - 0x140]
movups xmmword [rdx - 0x10], xmm3
cmp rax, rcx
jne 0x14001d180
mov eax, dword [rsi + 0xd28]
mov dword [rbx + 0x220], eax
cmp eax, 0x80
je 0x14001d366
ja 0x14001d200
lea edx, [rax - 2]
cmp edx, 0xf
ja case.0x14001d1f7.0
cmp eax, 0x11
ja case.0x14001d1f7.0
lea rdx, [0x1400604cc]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp eax, 0x800
je 0x14001d372
ja 0x14001d2b8
cmp eax, 0x100
je 0x14001d336
mov rdx, qword [0x140073940]
cmp eax, 0x200
jne case.0x14001d1f7.0
nop
mov qword [rbx + 0x218], rdx
cmp byte [rsi + 0xd2c], 0
je 0x14001d2e0
cmp rdx, qword [0x1400738b0]
je 0x14001d2e0
mov rdx, rbp
mov rcx, rbx
call dbg.open_rotate
test rax, rax
je 0x14001d396
mov qword [rbx + 0x210], rax
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov qword [rbx + 0x240], rax
jmp 0x14001d2e0
mov rcx, rbp
call sym.strlen
lea r12, [rax + 1]
mov rdi, rax
mov rcx, r12
call dbg.MALLOC
mov r8, r12
mov rdx, rbp
mov rcx, rax
call sym.memcpy
mov byte [rax + rdi], 0
mov rcx, rax
jmp 0x14001d13c
mov rdx, qword [0x1400736d0]
cmp eax, 0x1000
je 0x14001d230
nop word [rax + rax]
mov rax, qword [0x1400738b0]
mov qword [rbx + 0x218], rax
nop
mov edx, dword [rsi + 0xf38]
mov eax, 0x7fffffff
test edx, edx
je 0x14001d31f
mov r8d, dword [rbx + 0x24c]
mov rcx, qword [rbx + 0x240]
mov r9d, dword [rbx + 0x248]
cmp r8d, 1
jbe 0x14001d30d
sub rcx, r9
mov rax, rcx
cqo
idiv r9
sub rcx, rdx
add rcx, r9
lea rax, [rcx + r8]
mov qword [rbx + 0x238], rax
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [0x1400738d0]
jmp 0x14001d230
mov rdx, qword [0x1400738a0]
jmp 0x14001d230
mov rdx, qword [0x140073710]
jmp 0x14001d230
mov rdx, qword [0x140073670]
jmp 0x14001d230
mov rdx, qword [0x1400736c0]
jmp 0x14001d230
mov rdx, qword [0x140073680]
jmp 0x14001d230
mov rdx, qword [0x140073930]
jmp 0x14001d230
mov rdx, qword [0x140073960]
jmp 0x14001d230
mov rcx, rbp
call sym.perror
mov ecx, 1
call sym.exit
nop
nop dword [rax]