Function at 0x1400a3740
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov r13, rcx
lea rcx, [rax - 0x68]
call fcn.14005a150
lea rcx, [rsp + 0x1a8]
xor ebp, ebp
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x140], rbp
call fcn.140052130
lea rcx, [rsp + 0x80]
call fcn.14005a150
lea rcx, [rsp + 0x90]
call fcn.14005a150
lea rcx, [rsp + 0x108]
call fcn.14005a150
lea rcx, [rsp + 0x68]
call fcn.14005a150
mov r11, qword [rsp + 0x1a8]
lea r15d, [rbp + 0x2c]
lea r14d, [rbp + 1]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
mov r8d, r15d
mov r9b, r14b
mov qword [rsp + 0x50], r11
call fcn.140071da4
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, rax
call fcn.14005dc90
mov r9, qword [rsp + 0x80]
mov byte [rsp + 0x64], bpl
movzx eax, word [r9]
mov byte [rsp + 0x40], bpl
mov sil, bpl
mov rcx, r9
mov rbx, rbp
lea edx, [rbp + 9]
lea edi, [rbp + 2]
lea r8d, [rbp + 0x20]
cmp ax, bp
je 0x1400a385d
cmp dx, ax
ja 0x1400a3836
cmp ax, 0xd
jbe 0x1400a383c
cmp r8w, ax
jne 0x1400a383f
mov rbx, rcx
add rcx, rdi
mov ax, word [rcx]
cmp ax, bp
jne 0x1400a382b
cmp rbx, rbp
je 0x1400a385d
mov word [rbx], bp
mov r9, qword [rsp + 0x80]
add rbx, rdi
mov qword [rsp + 0x1a8], r9
mov r12d, 0x2a
cmp rbx, rbp
je 0x1400a3975
cmp r12w, word [r9]
jne 0x1400a3975
lea r15d, [r12 - 0x27]
lea r13d, [r12 + 3]
cmp r13w, word [r9 + 2]
je 0x1400a395f
lea rdx, [rsp + 0x1a8]
lea rcx, [0x14010597c]
mov r8d, 6
call fcn.14005c928
cmp al, bpl
je 0x1400a38bc
mov byte [rsp + 0x40], r14b
jmp 0x1400a394d
lea rdx, [rsp + 0x1a8]
lea rcx, [0x140105970]
mov r8d, 0xa
call fcn.14005c928
cmp al, bpl
je 0x1400a38e2
mov byte [rsp + 0x64], r14b
jmp 0x1400a394d
lea rdx, [rsp + 0x1a8]
lea rcx, [0x140105968]
mov r8d, r15d
call fcn.14005c928
cmp al, bpl
je 0x1400a3903
mov sil, r14b
jmp 0x1400a394d
mov rcx, qword [rsp + 0x1a8]
movzx eax, word [rcx]
cmp ax, bp
je 0x1400a3940
mov edx, 9
lea r8d, [rdx + 0x17]
cmp dx, ax
ja 0x1400a3927
cmp ax, 0xd
jbe 0x1400a3938
cmp r8w, ax
je 0x1400a3938
add rcx, rdi
mov ax, word [rcx]
cmp ax, bp
jne 0x1400a391c
mov qword [rsp + 0x1a8], rcx
lea rcx, [rsp + 0x1a8]
call fcn.140052130
mov r9, qword [rsp + 0x1a8]
cmp r12w, word [r9]
je 0x1400a3888
mov r9, qword [rsp + 0x80]
mov r13, qword [rsp + 0x1a0]
mov r15d, 0x2c
mov byte [rsp + 0x59], bpl
mov dil, bpl
mov byte [rsp + 0x5a], bpl
mov byte [rsp + 0x1a8], bpl
mov r12b, bpl
mov byte [rsp + 0x1b8], bpl
cmp rbx, rbp
je 0x1400a39d3
lea rcx, [rsp + 0x78]
mov rdx, rbx
call fcn.140064d14
mov r11, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r11
call fcn.140052160
mov r9, qword [rsp + 0x80]
cmp sil, bpl
je 0x1400a4502
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, r13
call fcn.14000397c
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x68]
xor r9d, r9d
mov rcx, r13
mov byte [rsp + 0x20], r14b
call fcn.14006e854
mov r11, qword [rsp + 0x68]
mov r8d, 0x2c
mov qword [rsp + 0x50], r11
mov r15, rbp
mov qword [rsp + 0xd8], rbp
cmp r8w, word [r11]
jne 0x1400a3a33
add r11, 2
mov qword [rsp + 0x50], r11
lea rcx, [rsp + 0x50]
call fcn.140052130
mov rcx, qword [rsp + 0x50]
mov si, word [rcx]
cmp si, bp
je 0x1400a44b5
mov edx, 0x2b
mov r11d, 0x3a3
lea r10d, [r11 - 3]
cmp dx, si
jne 0x1400a3a6d
cmp dx, word [rcx + 2]
jne 0x1400a3a88
mov esi, r11d
jmp 0x1400a3a84
mov edx, 0x2a
cmp dx, si
jne 0x1400a3a88
cmp dx, word [rcx + 2]
jne 0x1400a3a88
mov si, r10w
mov r15, r14
add rcx, 2
mov r9d, 2
add rcx, r9
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.140052130
mov rax, qword [rsp + 0x50]
cmp r11w, si
je 0x1400a3ab1
cmp r10w, si
jne 0x1400a3ae0
cmp r8w, word [rax]
je 0x1400a3ae6
lea rcx, [rsp + 0x50]
mov edx, r8d
mov qword [rsp + 0xd8], rax
call fcn.1400cb7a8
mov rcx, qword [rsp + 0x50]
cmp word [rcx], bp
je 0x1400a3aee
mov word [rcx], bp
add qword [rsp + 0x50], r9
jmp 0x1400a3aee
cmp r8w, word [rax]
jne 0x1400a3aee
add rax, r9
mov qword [rsp + 0x50], rax
or qword [rsp + 0x78], 0xffffffffffffffff
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x1b8], rbp
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0xf8], 0xfffffffffffe0000
mov dword [rsp + 0x1a8], r14d
call fcn.14009c980
cmp eax, ebp
jle 0x1400a44b5
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x50]
call fcn.140006efc
cmp eax, ebp
jle 0x1400a44b5
cmp dword [rsp + 0x1a8], ebp
jle 0x1400a44b5
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x50]
call fcn.14009c980
mov rbx, qword [rsp + 0xa8]
cmp rbx, rbp
jl 0x1400a44b5
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.14009c980
lea rdi, [0x140118f08]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rdx, qword [rsp + 0x80]
or r9d, 0xffffffff
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rbp
call fcn.140016e9c
cmp rax, rbp
je 0x1400a44ac
mov r13, qword [rax + 0x18]
movabs rcx, 0x3fffffffffffffff
and r13, rcx
cmp rbx, r13
jge 0x1400a44ac
cmp r13, rbp
jle 0x1400a44ac
mov r14, qword [rsp + 0x78]
mov rax, qword [rax + 8]
mov rcx, r13
cmp r14, rbp
mov qword [rsp + 0xa8], rax
cmovle r14, r13
sub rcx, rbx
cmp r14, rcx
cmovg r14, rcx
cmp rcx, r14
cmovg rcx, r14
cmp rcx, rbp
mov qword [rsp + 0x100], rcx
jle 0x1400a44ac
mov r12, qword [rsp + 0x1b8]
lea rdi, [rax + rbx]
mov eax, 0x2d
lea r9d, [rax + 0x11]
lea edx, [rax - 2]
cmp ax, si
jne 0x1400a3c52
mov si, dx
jmp 0x1400a3c60
mov eax, 0x3c
cmp ax, si
jne 0x1400a3c63
mov si, r9w
neg r12
mov ecx, 0x68
movzx eax, si
mov qword [rsp + 0x120], r12
lea r8d, [rcx + 7]
or ax, 0x20
mov dword [rsp + 0x128], r8d
cmp cx, ax
je 0x1400a3c97
lea ecx, [r8 - 1]
cmp cx, ax
je 0x1400a3c97
cmp r8w, ax
jne 0x1400a3c9b
mov si, r8w
mov eax, 0x5e
lea r10d, [rax - 0x3b]
lea ecx, [rax - 0x30]
mov dword [rsp + 0xc0], r10d
cmp dx, si
je 0x1400a3cf0
cmp ax, si
je 0x1400a3cf0
cmp r10w, si
je 0x1400a3cf0
cmp r9w, si
je 0x1400a3cf0
cmp r8w, si
je 0x1400a3cf6
cmp cx, si
je 0x1400a3cf0
mov eax, 0x3a3
cmp ax, si
je 0x1400a3cf0
mov eax, 0x3a0
cmp ax, si
je 0x1400a3cf0
lea rcx, [0x140118f08]
jmp 0x1400a44af
cmp r8w, si
jne 0x1400a3cfd
cmp rbx, r12
cmovg rbx, r12
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x50]
call fcn.14009c980
mov rax, qword [rsp + 0xe8]
lea rdx, [rsp + 0xf8]
cmp rax, rbp
lea rcx, [rsp + 0x50]
cmove rax, r14
mov qword [rsp + 0xb8], rax
call fcn.14009c980
mov r14, qword [rsp + 0xf8]
cmp r14, rbp
jg 0x1400a3d7d
cmp r14, 0xfffffffffffe0000
je 0x1400a3d71
mov rax, qword [rsp + 0xb8]
mov rcx, rax
neg rcx
cmp rax, rbp
cmovg rcx, rax
sub r13, rbx
mov rax, r13
cqo
idiv rcx
mov r14, rax
cmp r14, rbp
mov eax, 1
cmovle r14, rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x50]
call fcn.14009c980
mov rax, qword [rsp + 0x88]
mov r9, qword [rsp + 0x100]
movzx r11d, byte [rsp + 0x1a8]
mov r13d, dword [rsp + 0x1a8]
cmp rax, rbp
cmove rax, qword [rsp + 0xb8]
sar r13d, 8
mov ecx, r9d
mov qword [rsp + 0xf0], rax
mov eax, r9d
mov qword [rsp + 0x110], r11
and eax, 7
mov qword [rsp + 0xd0], rdi
sub ecx, eax
mov dword [rsp + 0x12c], eax
mov eax, 1
mov dword [rsp + 0xb0], ecx
mov rcx, qword [rsp + 0xa8]
add rcx, r12
cmp r13d, ebp
cmovle r13d, eax
mov qword [rsp + 0xc8], rcx
lea eax, [r13 + r13]
mov dword [rsp + 0x98], r13d
mov dword [rsp + 0xa0], eax
mov rax, r9
cqo
idiv r11
mov rbx, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x158], rdx
mov eax, 0x5e
mov edx, 0x3a3
cmp ax, si
mov eax, 0x3e
sete cl
cmp ax, si
mov eax, 2
movzx r8d, cl
mov ecx, 0x2e
cmove r8d, eax
cmp cx, si
mov ecx, 3
movzx eax, r8b
cmove eax, ecx
cmp dx, si
mov edx, 0x3a0
movzx ecx, al
mov eax, 4
cmove ecx, eax
cmp dx, si
movzx eax, cl
mov ecx, 5
cmove eax, ecx
movsxd rcx, r13d
mov dword [rsp + 0x70], eax
mov eax, r11d
mov qword [rsp + 0x150], rcx
cdq
idiv r13d
cdqe
lea r13, [rax - 1]
cqo
sub rax, rdx
sar rax, 1
mov r8, rax
mov qword [rsp + 0x88], rax
imul r13, rcx
imul rcx, rax
sub r11, rcx
sub r14, 1
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], r11
js 0x1400a4008
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xf0]
mov rdx, rdi
cmp word [rsp + 0xc0], si
jne 0x1400a4041
movsxd rdx, dword [rsp + 0xb0]
mov r13, rcx
add rdx, rcx
cmp rcx, rdx
jae 0x1400a3f51
mov rax, qword [rdi]
mov rcx, qword [r13]
mov qword [r13], rax
add r13, 8
mov qword [rdi], rcx
add rdi, 8
cmp r13, rdx
jb 0x1400a3f2e
mov rcx, qword [rsp + 0xc8]
movsxd rax, dword [rsp + 0x12c]
cmp eax, ebp
jle 0x1400a448f
lea rcx, [rsp + 0x148]
mov r8, rax
mov rdx, rdi
mov rbx, rax
call fcn.14001b7a8
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.14001b7a8
mov r8, rbx
lea rdx, [rsp + 0x148]
mov rcx, r13
call fcn.14001b7a8
mov r11, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x100]
mov rbx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x88]
mov r13, qword [rsp + 0xe0]
mov r10, qword [rsp + 0xf0]
add rdx, r10
add rcx, rax
sub r14, 1
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xd0], rdx
mov rdi, rdx
mov qword [rsp + 0xc8], rcx
jns 0x1400a3f0d
mov rax, qword [rsp + 0xd8]
cmp rax, rbp
je 0x1400a402f
mov rcx, qword [rsp + 0x1a0]
lea r9, [0x140103458]
mov r8, rax
mov rdx, r15
call fcn.14005d100
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1400a44bc
cmp word [rsp + 0x128], si
jne 0x1400a4165
cmp qword [rsp + 0x150], 1
jg 0x1400a40ce
lea r9, [rbx - 1]
cmp r9, rbp
jl 0x1400a4482
lea r10d, [r8 - 1]
mov r12d, 1
cmp r10d, ebp
lea rdx, [r13 + rdi]
mov r8d, r10d
jl 0x1400a4091
mov al, byte [rdx]
mov cl, byte [rdi]
mov byte [rdi], al
mov byte [rdx], cl
sub rdx, r12
add rdi, r12
sub r8d, r12d
jns 0x1400a407e
add rdi, r11
sub r9, r12
jns 0x1400a4071
mov r12, qword [rsp + 0x120]
mov r9, qword [rsp + 0x100]
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0x88]
jmp 0x1400a3fd5
lea r10, [rbx - 1]
cmp r10, rbp
jl 0x1400a3fd5
mov rax, qword [rsp + 0xe0]
mov r14d, dword [rsp + 0x98]
movsxd r12, dword [rsp + 0xa0]
lea r13d, [r8 - 1]
cmp r13d, ebp
lea rdx, [rax + rdi]
mov r9d, r13d
jl 0x1400a4147
lea ebx, [r14 - 1]
mov r14d, 1
cmp ebx, ebp
mov r8d, ebx
jl 0x1400a4127
mov al, byte [rdx]
mov cl, byte [rdi]
mov byte [rdi], al
mov byte [rdx], cl
add rdx, r14
add rdi, r14
sub r8d, r14d
jns 0x1400a4114
sub rdx, r12
sub r9d, r14d
jns 0x1400a410d
mov r11, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xe0]
mov r14d, dword [rsp + 0x98]
add rdi, r11
sub r10, 1
jns 0x1400a40f7
mov r12, qword [rsp + 0x120]
mov r14, qword [rsp + 0xa8]
jmp 0x1400a3fa0
mov rax, qword [rsp + 0x158]
mov r14, qword [rsp + 0x110]
mov r8, rdi
mov r13d, eax
mov dword [rsp + 0x5c], eax
cdqe
sub r8, rax
mov bl, r12b
mov r11d, ebp
mov dword [rsp + 0x1b8], ebp
mov qword [rsp + 0xf8], rbp
add r8, r9
mov rax, rbp
movzx ecx, byte [rsp + 0x1a8]
mov qword [rsp + 0x118], rax
cmp ecx, 8
jl 0x1400a4241
and bl, 0x3f
mov r9d, pe_nt_image_headers64
sub r9b, bl
cmp rdi, r8
jae 0x1400a4408
movzx r10d, byte [rsp + 0x70]
mov r11d, 1
lea r13d, [r11 + 0x5d]
mov ecx, r10d
cmp r10d, ebp
je 0x1400a4231
sub ecx, r11d
je 0x1400a4226
sub ecx, r11d
je 0x1400a420c
sub ecx, r11d
je 0x1400a4200
sub ecx, r11d
je 0x1400a4203
cmp ecx, r11d
je 0x1400a4206
jmp 0x1400a4234
mov qword [rdi], r12
add r15, qword [rdi]
imul r15, qword [rdi]
jmp 0x1400a4234
mov rdx, qword [rdi]
mov cl, r9b
mov rax, rdx
shl rax, cl
mov cl, r12b
shr rdx, cl
or rax, rdx
mov qword [rdi], rax
jmp 0x1400a4234
cmp r13w, si
jne 0x1400a4234
xor qword [rdi], r12
jmp 0x1400a4234
add qword [rdi], r12
add rdi, r14
cmp rdi, r8
jb 0x1400a41dd
jmp 0x1400a43f3
cmp ecx, 4
jl 0x1400a42d2
and bl, 0x1f
mov r9d, 0x20
sub r9b, bl
cmp rdi, r8
jae 0x1400a4408
movzx r10d, byte [rsp + 0x70]
mov r11d, 1
lea r13d, [r11 + 0x5d]
mov ecx, r10d
cmp r10d, ebp
je 0x1400a42c2
sub ecx, r11d
je 0x1400a42b7
sub ecx, r11d
je 0x1400a42a4
sub ecx, r11d
je 0x1400a4292
sub ecx, r11d
je 0x1400a4295
cmp ecx, r11d
je 0x1400a429b
jmp 0x1400a42c5
mov dword [rdi], r12d
movsxd rax, dword [rdi]
add r15, rax
movsxd rax, dword [rdi]
imul r15, rax
jmp 0x1400a42c5
mov edx, dword [rdi]
mov cl, r9b
mov eax, edx
shl eax, cl
mov cl, bl
shr edx, cl
or eax, edx
mov dword [rdi], eax
jmp 0x1400a42c5
cmp r13w, si
jne 0x1400a42c5
xor dword [rdi], r12d
jmp 0x1400a42c5
add dword [rdi], r12d
add rdi, r14
cmp rdi, r8
jb 0x1400a426f
jmp 0x1400a43f3
cmp ecx, 2
jl 0x1400a436e
and bl, 0xf
mov r9d, 0x10
sub r9b, bl
cmp rdi, r8
jae 0x1400a4408
movzx r10d, byte [rsp + 0x70]
mov r11d, 1
lea r13d, [r11 + 0x5d]
mov ecx, r10d
cmp r10d, ebp
je 0x1400a435d
sub ecx, r11d
je 0x1400a4351
sub ecx, r11d
je 0x1400a4338
sub ecx, r11d
je 0x1400a4323
sub ecx, r11d
je 0x1400a4327
cmp ecx, r11d
je 0x1400a432e
jmp 0x1400a4361
mov word [rdi], r12w
movsx rax, word [rdi]
add r15, rax
movsx rax, word [rdi]
imul r15, rax
jmp 0x1400a4361
movzx edx, word [rdi]
mov cl, r9b
movzx eax, dx
shl ax, cl
mov cl, bl
shr dx, cl
or ax, dx
mov word [rdi], ax
jmp 0x1400a4361
cmp r13w, si
jne 0x1400a4361
xor word [rdi], r12w
jmp 0x1400a4361
add word [rdi], r12w
add rdi, r14
cmp rdi, r8
jb 0x1400a4300
jmp 0x1400a43f3
and bl, 7
mov r9d, 8
sub r9b, bl
cmp rdi, r8
jae 0x1400a4408
movzx r10d, byte [rsp + 0x70]
mov r11d, 1
lea r13d, [r11 + 0x5d]
mov ecx, r10d
cmp r10d, ebp
je 0x1400a43e8
sub ecx, r11d
je 0x1400a43dd
sub ecx, r11d
je 0x1400a43ca
sub ecx, r11d
je 0x1400a43b6
sub ecx, r11d
je 0x1400a43b9
cmp ecx, r11d
je 0x1400a43c0
jmp 0x1400a43eb
mov byte [rdi], r12b
movsx rax, byte [rdi]
add r15, rax
movsx rax, byte [rdi]
imul r15, rax
jmp 0x1400a43eb
mov dl, byte [rdi]
mov cl, r9b
mov al, dl
shl al, cl
mov cl, bl
shr dl, cl
or al, dl
mov byte [rdi], al
jmp 0x1400a43eb
cmp r13w, si
jne 0x1400a43eb
xor byte [rdi], r12b
jmp 0x1400a43eb
add byte [rdi], r12b
add rdi, r14
cmp rdi, r8
jb 0x1400a4393
mov rax, qword [rsp + 0x118]
mov r11d, dword [rsp + 0x1b8]
mov r13d, dword [rsp + 0x5c]
cmp r13d, ebp
jle 0x1400a445e
mov ecx, 0x3e
cmp cx, si
je 0x1400a445e
mov ecx, 0x2e
cmp cx, si
je 0x1400a445e
lea rcx, [rsp + 0xf8]
movsxd r8, r13d
mov rdx, rdi
call fcn.14001b7a8
mov rax, rdi
mov r11d, r13d
mov dword [rsp + 0x1b8], r13d
lea rdi, [rsp + 0xf8]
mov dword [rsp + 0x5c], ebp
mov r13d, ebp
lea r8, [rsp + r14 + 0xf8]
jmp 0x1400a419f
mov r14, qword [rsp + 0xa8]
cmp r11d, ebp
je 0x1400a3f98
movsxd r8, r11d
lea rdx, [rsp + 0xf8]
mov rcx, rax
jmp 0x1400a3f93
mov r9, qword [rsp + 0x100]
jmp 0x1400a3fdd
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xe0]
jmp 0x1400a3fdd
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov rbp, 0xffffffff80070057
lea rcx, [rsp + 0x68]
call fcn.140052160
lea rcx, [rsp + 0x108]
call fcn.140052160
lea rcx, [rsp + 0x90]
call fcn.140052160
lea rcx, [rsp + 0x80]
call fcn.140052160
lea rcx, [rsp + 0x130]
call fcn.140052160
mov rax, rbp
jmp 0x1400a5417
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 2]
mov qword [rsp + 0x110], rcx
cmp r15w, word [rax]
jne 0x1400a45a7
mov qword [rsp + 0x50], rcx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
mov r8d, r15d
mov r9b, r14b
call fcn.140071da4
lea rdx, [rsp + 0x90]
xor r8d, r8d
mov rcx, rax
call fcn.14005ddbc
mov rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x80]
cmp r15w, word [rax]
jne 0x1400a45a7
mov ebx, 2
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
add rax, rbx
mov r8d, r15d
mov r9b, r14b
mov qword [rsp + 0x50], rax
call fcn.140071da4
lea rdx, [rsp + 0x108]
mov rcx, rax
xor r8d, r8d
call fcn.14005dc90
mov r9, qword [rsp + 0x80]
mov rax, qword [rsp + 0x50]
jmp 0x1400a45ac
mov ebx, 2
cmp r15w, word [rax]
jne 0x1400a45ea
add rax, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
mov r8d, r15d
mov r9b, r14b
mov qword [rsp + 0x50], rax
call fcn.140071da4
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov rcx, rax
call fcn.14005dc90
mov r9, qword [rsp + 0x80]
cmp word [r9], bp
je 0x1400a53d6
mov rax, qword [rsp + 0x90]
cmp word [rax], bp
je 0x1400a53d6
mov r10, qword [rsp + 0x108]
cmp word [r10], bp
je 0x1400a53d6
mov rax, qword [rsp + 0x68]
cmp word [rax], bp
je 0x1400a53d6
mov r11d, 0x2a
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x74], ebp
mov r14d, ebp
mov r13d, ebp
mov dword [rsp + 0x98], ebp
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x5c], ebp
mov r15, rbp
mov byte [rsp + 0x58], bpl
cmp r11w, word [r9]
jne 0x1400a4693
cmp r11w, word [r9 + 2]
jne 0x1400a467f
mov al, byte [r9]
add r9, 4
mov byte [rsp + 0x5a], bl
mov byte [rsp + 0x59], al
mov dil, al
cmp r11w, word [r9]
jne 0x1400a4693
add r9, rbx
mov byte [rsp + 0x5a], 3
jmp 0x1400a4693
cmp r11w, word [r9]
jne 0x1400a4693
mov al, byte [r9]
add r9, 2
mov byte [rsp + 0x59], al
mov dil, al
mov eax, 0x2d
cmp ax, word [r9]
jne 0x1400a46a4
mov dil, byte [r9]
add r9, rbx
cmp dil, bpl
je 0x1400a44b5
lea rcx, [0x140105964]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
je 0x1400a46d0
mov edi, 1
mov byte [rsp + 0x58], dil
jmp 0x1400a481f
lea rcx, [0x1400fa7e8]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
jne 0x1400a47ff
lea rcx, [0x140105960]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
je 0x1400a470c
mov edi, 1
mov r14d, 0x3a8
jmp 0x1400a481f
lea rcx, [0x140105958]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
je 0x1400a4730
mov edi, 1
mov r14d, 0x3b6
jmp 0x1400a481f
lea rcx, [0x1400fa7f0]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
je 0x1400a4754
mov edi, 1
mov r14d, 0xfde9
jmp 0x1400a481f
lea rcx, [0x140105950]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
je 0x1400a4778
mov edi, 1
mov r14d, 0xfde8
jmp 0x1400a481f
lea rcx, [0x140105948]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
jne 0x1400a47a0
lea rcx, [0x1400fa7e4]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
je 0x1400a47ad
mov edi, 1
mov r13d, 0x4b0
jmp 0x1400a481f
lea rcx, [0x140105938]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
jne 0x1400a47d5
lea rcx, [0x14010592c]
mov rdx, r9
call fcn.1400536b0
cmp al, bpl
je 0x1400a47e2
mov edi, 1
mov r13d, 0x4b1
jmp 0x1400a481f
movzx eax, word [r9]
mov ecx, 9
sub ax, 0x30
cmp ax, cx
ja 0x1400a4806
mov rcx, r9
call fcn.14005b3b8
mov r14, rax
mov edi, 1
jmp 0x1400a481f
cmp word [r9], bp
jne 0x1400a44b5
mov edi, 1
mov r13d, edi
mov dword [rsp + 0x98], edi
cmp r11w, word [r10]
jne 0x1400a4855
cmp r11w, word [r10 + 2]
jne 0x1400a483d
mov sil, byte [r10]
add r10, 4
mov byte [rsp + 0x1b8], sil
jmp 0x1400a484a
cmp r11w, word [r10]
jne 0x1400a4855
mov sil, byte [r10]
add r10, 2
mov r12b, sil
mov byte [rsp + 0x1a8], sil
mov eax, 0x2d
cmp ax, word [r10]
jne 0x1400a4866
mov r12b, byte [r10]
add r10, rbx
cmp r12b, bpl
je 0x1400a44b5
lea rcx, [0x1400fa7e8]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
je 0x1400a488c
mov dword [rsp + 0x60], ebp
jmp 0x1400a49ca
lea rcx, [0x140105960]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
je 0x1400a48ad
mov dword [rsp + 0x60], 0x3a8
jmp 0x1400a49ca
lea rcx, [0x140105958]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
je 0x1400a48ce
mov dword [rsp + 0x60], 0x3b6
jmp 0x1400a49ca
lea rcx, [0x1400fa7f0]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
je 0x1400a4901
mov r12d, 3
mov dword [rsp + 0x60], 0xfde9
lea r15, [0x140100670]
mov dword [rsp + 0x5c], r12d
jmp 0x1400a49d0
lea rcx, [0x140105950]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
je 0x1400a4922
mov dword [rsp + 0x60], 0xfde8
jmp 0x1400a49ca
lea rcx, [0x140105948]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
je 0x1400a494b
mov dword [rsp + 0x74], 0x4b0
lea r15, [0x140100668]
mov dword [rsp + 0x5c], ebx
jmp 0x1400a49ca
lea rcx, [0x1400fa7e4]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
jne 0x1400a4936
lea rcx, [0x140105938]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
je 0x1400a4984
mov dword [rsp + 0x74], 0x4b1
lea r15, [0x14010066c]
jmp 0x1400a4945
lea rcx, [0x14010592c]
mov rdx, r10
call fcn.1400536b0
cmp al, bpl
jne 0x1400a4973
movzx eax, word [r10]
mov ecx, 9
sub ax, 0x30
cmp ax, cx
ja 0x1400a49b8
mov rcx, r10
call fcn.14005b3b8
mov dword [rsp + 0x60], eax
jmp 0x1400a49ca
cmp word [r10], bp
jne 0x1400a44b5
mov dword [rsp + 0x74], edi
mov dword [rsp + 0x70], edi
mov r12d, 3
cmp byte [rsp + 0x40], bpl
lea rcx, [rsp + 0x48]
mov rbx, rbp
cmovne r15, rbp
mov qword [rsp + 0xa8], rbx
call fcn.140059e74
mov esi, ebp
cmp byte [rsp + 0x59], bpl
jne 0x1400a4ca9
mov rax, qword [rsp + 0x110]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x130]
mov r8d, 0x2c
mov r9b, dil
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0x50], rax
call fcn.140071da4
lea rdx, [rsp + 0x90]
mov rcx, rax
xor r8d, r8d
call fcn.14005dc90
mov rcx, qword [rsp + 0x90]
call fcn.140019d38
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0xd8]
mov r9d, 7
mov r8d, 0x80000000
mov rdx, rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call fcn.1400037e4
mov rdi, qword [rsp + 0xd8]
cmp rdi, rbp
jne 0x1400a4a9f
lea rcx, [rsp + 0x48]
call fcn.140052160
mov ebp, 1
jmp 0x1400a44bc
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.140053560
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.140053560
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov r12, rax
call fcn.140053560
lea r11d, [r12 + 0xa]
lea rcx, [rsp + 0x48]
movsxd rdx, r11d
call fcn.140059f54
mov r11, qword [rsp + 0x48]
lea r9, [rsp + 0xc0]
mov byte [r11 + 2], bpl
mov rcx, qword [rsp + 0x48]
mov r8d, r12d
mov byte [rcx + 1], bpl
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbp
mov byte [rcx], bpl
mov rdx, qword [rsp + 0x48]
or dword [rsp + 0xc0], 0xffffffff
mov rcx, rdi
mov qword [rsp + 0xd8], rdx
call qword [sym.imp.KERNEL32.DLL_ReadFile]
movsxd rsi, dword [rsp + 0xc0]
cmp esi, ebp
jge 0x1400a4b49
cmp rdi, 0xffffffffffffffff
je 0x1400a4a8b
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400a4a8b
mov rax, qword [rsp + 0x48]
mov r11b, byte [rsp + 0x58]
mov r10d, ebp
mov byte [rsi + rax + 2], bpl
mov rax, qword [rsp + 0x48]
mov byte [rax + rsi + 1], bpl
mov rax, qword [rsp + 0x48]
mov byte [rax + rsi], bpl
cmp r11b, bpl
jne 0x1400a4b7c
cmp r13d, 0x4b0
jne 0x1400a4bb1
mov r9, qword [rsp + 0xd8]
lea rdx, [0x140100668]
mov r8d, 2
mov rcx, r9
call fcn.140052190
cmp eax, ebp
jne 0x1400a4baa
mov eax, 2
mov r13d, 0x4b0
jmp 0x1400a4c1a
cmp r11b, bpl
jne 0x1400a4bc2
jmp 0x1400a4bb9
mov r9, qword [rsp + 0xd8]
cmp r13d, 0x4b1
jne 0x1400a4bed
lea rdx, [0x14010066c]
mov r8d, 2
mov rcx, r9
call fcn.140052190
cmp eax, ebp
jne 0x1400a4be8
mov eax, 2
mov r13d, 0x4b1
jmp 0x1400a4c1a
cmp r11b, bpl
jne 0x1400a4bf6
cmp r14d, 0xfde9
jne 0x1400a4c43
lea rdx, [0x140100670]
mov r8d, 3
mov rcx, r9
call fcn.140052190
cmp eax, ebp
jne 0x1400a4c43
mov eax, 3
mov r14d, 0xfde9
mov dword [rsp + 0xb0], eax
cdqe
mov r8d, 3
sub r12, rax
lea rdx, [r9 + rax]
mov rcx, r9
add r8, r12
call fcn.14001b760
mov r10d, dword [rsp + 0xb0]
sub esi, r10d
cmovs esi, ebp
cmp rdi, 0xffffffffffffffff
je 0x1400a4c58
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dil, bl
mov r9d, 2
cmp esi, ebp
jl 0x1400a4a8b
cmp byte [rsp + 0x58], bpl
je 0x1400a4e34
cmp dil, bpl
je 0x1400a4e34
mov r12, qword [rsp + 0x48]
lea rdx, [0x140100668]
mov r8, r9
mov rcx, r12
mov edi, ebp
call fcn.140052190
cmp eax, ebp
jne 0x1400a4dcc
mov r13d, 0x4b0
jmp 0x1400a4e0c
mov dil, byte [rsp + 0x5a]
cmp dil, bpl
je 0x1400a4d78
mov r12, qword [rsp + 0x1a0]
lea rdx, [rsp + 0x90]
xor r8d, r8d
mov rcx, r12
call fcn.14000397c
mov rdx, qword [rsp + 0x90]
or r9d, 0xffffffff
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rbp
call fcn.140016e9c
lea rcx, [rsp + 0x48]
mov r12, rax
cmp rax, rbp
je 0x1400a4d53
mov eax, 3
cmp dil, al
jne 0x1400a4d16
mov rdx, qword [r12 + 8]
call fcn.140069e74
mov dil, 2
mov esi, eax
jmp 0x1400a4d60
movsxd rsi, dword [r12 + 0x18]
lea eax, [rsi + 8]
movsxd rdx, eax
call fcn.140059f54
mov rcx, qword [rsp + 0x48]
xor edx, edx
lea r8d, [rdx + 8]
add rcx, rsi
mov rdi, rsi
call fcn.1400dd9e0
mov rdx, qword [r12 + 8]
mov rcx, qword [rsp + 0x48]
mov r8, rsi
call fcn.14001b7a8
mov dil, 1
jmp 0x1400a4d60
mov edx, 8
call fcn.140059f54
mov dil, bl
xor edx, edx
movsxd rcx, esi
add rcx, qword [rsp + 0x48]
lea r8d, [rdx + 8]
call fcn.1400dd9e0
jmp 0x1400a4c5b
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x48]
cmp dword [rsp + 0x98], ebp
je 0x1400a4db7
call fcn.140064e2c
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea rcx, [rsp + 0x48]
mov esi, eax
add esi, esi
lea eax, [rsi + 8]
movsxd rdx, eax
call fcn.140059f54
jmp 0x1400a4dbe
call fcn.140069e74
mov esi, eax
mov r9d, 2
mov dil, r9b
jmp 0x1400a4c61
lea rdx, [0x14010066c]
mov r8, r9
mov rcx, r12
call fcn.140052190
cmp eax, ebp
jne 0x1400a4dea
mov r13d, 0x4b1
jmp 0x1400a4e0c
mov r9d, 3
lea rdx, [0x140100670]
mov rcx, r12
mov r8, r9
call fcn.140052190
cmp eax, ebp
jne 0x1400a4e2d
mov r14d, 0xfde9
mov eax, esi
movsxd rdx, r9d
mov rcx, r12
sub eax, r9d
add rdx, r12
mov edi, r9d
add eax, 4
movsxd r8, eax
call fcn.14001b760
mov r12, qword [rsp + 0x48]
sub esi, edi
cmovs esi, ebp
jmp 0x1400a4e39
mov r12, qword [rsp + 0x48]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x110], r12
call fcn.14005a150
lea rcx, [rsp + 0x60]
call fcn.140059b58
cmp dword [rax], r14d
jne 0x1400a4f39
lea rcx, [rsp + 0x74]
call fcn.140059b58
cmp dword [rax], r13d
jne 0x1400a4f39
cmp byte [rsp + 0x1b8], bpl
je 0x1400a4ea9
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x1a0]
lea rax, [rsp + 0x68]
mov r9d, esi
mov byte [rsp + 0x28], bpl
mov qword [rsp + 0x20], rax
call fcn.1400694b8
jmp 0x1400a4f1d
cmp byte [rsp + 0x1a8], bpl
jne 0x1400a4ed2
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x1a0]
mov r8d, esi
xor ecx, ecx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x1400a4f1d
cmp dword [rsp + 0x70], ebp
jne 0x1400a4ef7
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0xa0]
mov r8d, esi
call fcn.14005f5c4
mov r8, qword [rsp + 0xa0]
jmp 0x1400a4f0b
mov r8, qword [rsp + 0x90]
cmp dword [rsp + 0x98], ebp
jne 0x1400a4f0b
mov r8, r12
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x1a0]
call fcn.1400596c4
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x48]
call fcn.140052160
jmp 0x1400a44bc
cmp r13d, 0x4b1
jne 0x1400a4f57
mov rcx, qword [rsp + 0x48]
mov edx, esi
mov r13d, 0x4b0
call fcn.1400577bc
and esi, 0xfffffffe
cmp byte [rsp + 0x1a8], bpl
jne 0x1400a4fc0
mov rcx, qword [rsp + 0x68]
call fcn.140019d38
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0xa8]
mov r9d, 7
mov r8d, 0x40000000
mov rdx, rax
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbp
call fcn.1400037e4
mov rbx, qword [rsp + 0xa8]
cmp rbx, rbp
jne 0x1400a4fc0
lea rcx, [rsp + 0xa0]
call fcn.140052160
jmp 0x1400a4a8b
mov eax, 0x3a8
mov qword [rsp + 0x78], rbp
cmp dword [rsp + 0x60], eax
jne 0x1400a4fd9
cmp r14d, 0x3b6
je 0x1400a4ff0
cmp r14d, eax
jne 0x1400a50aa
cmp dword [rsp + 0x60], 0x3b6
jne 0x1400a50aa
movzx eax, byte [rsp + 0x64]
lea rcx, [rsp + 0x88]
mov edi, eax
cmp al, bpl
mov eax, 3
cmovne edi, eax
call fcn.140059e74
cmp dword [rsp + 0x60], 0x3b6
mov rcx, qword [rsp + 0x48]
mov r8d, ebp
lea rdx, [rsp + 0x88]
sete r8b
call fcn.14005f69c
mov r11, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x88], r11
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
mov r12, qword [rsp + 0x48]
mov esi, eax
mov eax, 3
cmp dil, al
jne 0x1400a509d
cmp byte [rsp + 0x1a8], bpl
jne 0x1400a509d
cmp esi, ebp
jle 0x1400a508b
lea r9, [rsp + 0x1a0]
mov r8d, esi
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.DLL_WriteFile]
lea rcx, [rsp + 0x88]
call fcn.140052160
jmp 0x1400a5351
lea rcx, [rsp + 0x88]
call fcn.140052160
movsxd rdi, esi
shr rdi, 1
cmp r13d, ebp
jne 0x1400a5104
lea edi, [rsi + 0xa]
lea rcx, [rsp + 0xa0]
lea eax, [rdi + 0xa]
movsxd rdx, eax
call fcn.14005a250
mov r12, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x48]
mov r9d, esi
xor edx, edx
mov ecx, r14d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r12
call qword [0x1401178e8]
cmp eax, ebp
mov r9, r12
cmovl eax, ebp
movsxd rdi, eax
lea esi, [rdi + rdi]
mov word [r12 + rdi*2], bp
jmp 0x1400a510c
mov r9, qword [rsp + 0x110]
mov eax, dword [rsp + 0x74]
cmp eax, 0x4b1
jne 0x1400a5125
mov edx, esi
mov rcx, r12
call fcn.1400577bc
mov eax, dword [rsp + 0x74]
cmp eax, ebp
jle 0x1400a5248
cmp byte [rsp + 0x1b8], bpl
je 0x1400a51a0
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x1a0]
lea rax, [rsp + 0x68]
mov r9d, esi
mov r8, r12
mov byte [rsp + 0x28], bpl
mov qword [rsp + 0x20], rax
call fcn.1400694b8
lea rcx, [rsp + 0x78]
call fcn.140052160
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x48]
call fcn.140052160
cmp rbx, rbp
je 0x1400a44bc
cmp rbx, 0xffffffffffffffff
je 0x1400a44bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400a44bc
cmp byte [rsp + 0x1a8], bpl
jne 0x1400a51f6
cmp esi, ebp
jle 0x1400a5351
cmp r15, rbp
je 0x1400a51d5
mov r8d, dword [rsp + 0x5c]
lea r9, [rsp + 0x1a0]
mov rdx, r15
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rdx, r12
lea r9, [rsp + 0x1a0]
mov r8d, esi
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x1400a5351
cmp dword [rsp + 0x70], ebp
jne 0x1400a524e
lea rcx, [rsp + 0x1a8]
call fcn.14005a150
lea rcx, [rsp + 0x1a8]
mov r8d, edi
mov rdx, r12
call fcn.14005f660
mov r8, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x1a0]
call fcn.1400596c4
lea rcx, [rsp + 0x1a8]
call fcn.140052160
jmp 0x1400a5351
cmp dword [rsp + 0x70], ebp
je 0x1400a5256
mov r8, r9
jmp 0x1400a533f
movsxd rsi, esi
lea rcx, [rsp + 0x78]
shr rsi, 1
lea eax, [rsi + rsi*2]
lea edi, [rax + rax + 0xa]
lea eax, [rdi + 1]
movsxd rdx, eax
call fcn.140059f54
mov ecx, dword [rsp + 0x60]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edi
mov rdi, qword [rsp + 0x78]
mov r9d, esi
mov r8, r12
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
cmp eax, ebp
mov esi, eax
cmovl esi, ebp
movsxd rax, esi
mov byte [rax + rdi], bpl
cmp byte [rsp + 0x1a8], bpl
jne 0x1400a52e8
cmp esi, ebp
jle 0x1400a5351
cmp r15, rbp
je 0x1400a52e0
mov r8d, dword [rsp + 0x5c]
lea r9, [rsp + 0x1a0]
mov rdx, r15
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rdx, rdi
jmp 0x1400a51d8
cmp byte [rsp + 0x1b8], bpl
je 0x1400a5324
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x1a0]
movsxd r9, eax
lea rax, [rsp + 0x68]
mov r8, rdi
mov byte [rsp + 0x28], bpl
mov qword [rsp + 0x20], rax
call fcn.1400694b8
jmp 0x1400a5351
lea rcx, [rsp + 0xa0]
mov r8d, esi
mov rdx, rdi
call fcn.14005f5c4
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x1a0]
call fcn.1400596c4
cmp rbx, rbp
je 0x1400a535f
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
lea rcx, [rsp + 0x78]
call fcn.140052160
lea rcx, [rsp + 0xa0]
call fcn.140052160
lea rcx, [rsp + 0x48]
call fcn.140052160
cmp rbx, rbp
je 0x1400a5394
cmp rbx, 0xffffffffffffffff
je 0x1400a5394
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rsp + 0x68]
call fcn.140052160
lea rcx, [rsp + 0x108]
call fcn.140052160
lea rcx, [rsp + 0x90]
call fcn.140052160
lea rcx, [rsp + 0x80]
call fcn.140052160
lea rcx, [rsp + 0x130]
call fcn.140052160
xor eax, eax
jmp 0x1400a5417
lea rcx, [rsp + 0x68]
call fcn.140052160
lea rcx, [rsp + 0x108]
call fcn.140052160
lea rcx, [rsp + 0x90]
call fcn.140052160
lea rcx, [rsp + 0x80]
call fcn.140052160
lea rcx, [rsp + 0x130]
call fcn.140052160
mov rax, r14
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret