Function at 0x1400354b0
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x428]
sub rsp, 0x528
mov rax, qword [0x140200100]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov r14, r9
mov qword [rsp + 0x38], r9
mov rdi, r8
mov qword [rbp - 0x78], r8
mov r15, rdx
mov r13, rcx
mov qword [rsp + 0x40], rdx
mov qword [rbp + 0x170], r9
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
call fcn.140016f30
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x210]
call fcn.140198190
lea rcx, [rbp + 0x210]
call fcn.140040220
nop
mov qword [rbp + 0x200], r12
mov r8b, 1
mov rdx, rdi
lea rcx, [rbp + 0x210]
call fcn.1400404e0
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x14003556d
jle 0x140035566
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x220], r12
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x140035588
jle 0x140035581
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x218], r12
mov rcx, qword [rbp + 0x210]
test rcx, rcx
je 0x1400355a3
jle 0x14003559c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x210], r12
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x1400355be
jle 0x1400355b7
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbp + 0x258], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x230], xmm0
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.14000b7d0
cmp byte [rbp + 0x22c], 0
je 0x1400355f5
lea rcx, [rbp + 0x328]
call fcn.140009740
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.14000b7d0
mov ebx, r12d
cmp byte [rbp + 0x229], r12b
setne bl
mov rdx, rdi
lea rcx, [rbp + 0x390]
call fcn.14003d1f0
nop
lea rax, [0x1401cf698]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [rbp + 0x390]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.140033ff0
nop
lea rcx, [rbp + 0x390]
call fcn.140009a90
lea rcx, [rbp + 0x1e0]
call fcn.140016f30
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1f0], rcx
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1f8], rdx
lea rcx, [rbp + 0x1e0]
call fcn.14000a580
cmp qword [rbp + 0x1f0], 0
setne bl
lea rcx, [rsp + 0x40]
call fcn.14000a580
test bl, bl
je 0x14003592e
lea rdx, [rbp + 0x1f0]
lea rcx, [rsp + 0x50]
call fcn.140016ef0
mov rdi, rax
mov dword [r15], 0xc000010e
lea rcx, [r15 + 8]
call fcn.140016f30
mov rax, qword [rdi]
mov qword [r15 + 8], rax
mov rax, qword [rdi + 8]
mov qword [r15 + 0x10], rax
mov qword [rdi], r12
mov qword [rdi + 8], r12
mov byte [r15 + 0x18], 1
mov rcx, rdi
call fcn.14000a580
nop
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x140035729
jle 0x140035722
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x220], r12
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x140035744
jle 0x14003573d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x218], r12
mov rcx, qword [rbp + 0x210]
test rcx, rcx
je 0x14003575f
jle 0x140035758
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x210], r12
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x14003577a
jle 0x140035773
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbp + 0x258], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x230], xmm0
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.14000b7d0
cmp byte [rbp + 0x22c], 0
je 0x1400357b1
lea rcx, [rbp + 0x328]
call fcn.140009740
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.14000b7d0
lea rcx, [rbp + 0x348]
call fcn.1400863c0
lea rcx, [rbp + 0x328]
call fcn.140009a90
lea rcx, [rbp + 0x308]
call fcn.140009a90
mov rcx, qword [rbp + 0x2e0]
test rcx, rcx
je 0x14003581c
mov rdx, qword [rbp + 0x2f0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.140010610
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], r12
lea rcx, [rbp + 0x2d0]
call fcn.140020490
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x140035861
mov rdx, qword [rbp + 0x2b0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.140010610
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], r12
lea rcx, [rbp + 0x290]
call fcn.140020490
lea rcx, [rbp + 0x270]
call fcn.140001bf0
mov r8, qword [rbp + 0x270]
test r8, r8
je 0x1400358cf
mov rcx, qword [rbp + 0x280]
movabs rax, 0x6666666666666667
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rcx, r8
call fcn.140010610
mov qword [rbp + 0x270], r12
mov qword [rbp + 0x278], r12
mov qword [rbp + 0x280], r12
mov rcx, qword [rbp + 0x258]
test rcx, rcx
jle 0x1400358e1
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov rcx, qword [rbp + 0x220]
test rcx, rcx
jle 0x1400358f3
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp + 0x218]
test rcx, rcx
jle 0x140035905
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x210]
test rcx, rcx
jle 0x140035918
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x1f0]
call fcn.14000a580
nop
mov rcx, qword [r14 + 8]
jmp 0x1400368e3
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 0x1000
mov rdx, qword [r13 + 8]
lea rcx, [rbp + 0x150]
call fcn.14004d3b0
nop
mov eax, dword [rbp + 0x150]
test eax, eax
jns 0x14003598e
mov dword [r15], eax
mov byte [r15 + 0x18], 0
cmp byte [rbp + 0x168], 0
je 0x14003570e
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14003570e
call fcn.140002a00
jmp 0x14003570e
cmp byte [rbp + 0x229], 0
jne 0x140035a82
cmp byte [rbp + 0x168], 0
je 0x14003691f
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x1400359b8
mov eax, dword [rax]
jmp 0x1400359bb
mov eax, r12d
add eax, 8
mov dword [rbp + 0x1e4], eax
mov rcx, rdi
call fcn.140003f10
add ax, ax
mov word [rbp + 0x1e0], ax
mov word [rbp + 0x1e2], ax
mov rax, qword [rbp + 0x168]
test al, al
je 0x14003691f
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x140035a26
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x1e0]
mov rdx, qword [rdx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, qword [rbp + 0x168]
test al, al
je 0x14003691f
mov rcx, rdi
call fcn.140009740
mov rbx, rax
mov rcx, rdi
call fcn.140003f10
mov r9, rax
add r9, r9
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x140035a74
mov rax, qword [rdx + 0x18]
mov rdx, qword [rdx]
add rdx, 8
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, rbx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsp + 0x40], 8
jmp 0x140035b6b
mov dword [rbp + 0x1e4], r12d
cmp byte [rbp + 0x168], 0
je 0x140036919
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x140035aa7
mov rax, qword [rax]
jmp 0x140035aaa
mov rax, r12
add rax, 0x10
mov qword [rbp + 0x1e8], rax
mov rcx, rdi
call fcn.140003f10
add ax, ax
mov word [rbp + 0x1e0], ax
mov word [rbp + 0x1e2], ax
mov rax, qword [rbp + 0x168]
test al, al
je 0x140036919
mov esi, reloc.WS2_32.dll_recv
mov qword [rsp + 0x40], rsi
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x140035b1e
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r9d, esi
lea r8, [rbp + 0x1e0]
mov rdx, qword [rdx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, qword [rbp + 0x168]
test al, al
je 0x140036919
mov rcx, rdi
call fcn.140009740
mov rbx, rax
mov rcx, rdi
call fcn.140003f10
mov r9, rax
add r9, r9
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x140035b6b
mov rax, qword [rdx + 0x18]
mov rdx, qword [rdx]
add rdx, rsi
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, rbx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, qword [r13 + 0x10]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rbp + 0x229]
test al, al
je 0x140035bc8
cmp byte [rcx + 0x15], 0
je 0x140035bce
mov byte [rsp + 0x30], 0
mov esi, r12d
test al, al
setne sil
lea rdx, str.kernel32.dll
lea rcx, [rsp + 0x60]
call fcn.140005760
nop
lea rcx, [rsp + 0x60]
call fcn.1400096a0
test al, al
je 0x140035bd5
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x390]
call fcn.140009b90
jmp 0x140035cae
cmp byte [rcx + 0x15], 1
jne 0x140035b84
mov byte [rsp + 0x30], 1
jmp 0x140035b89
mov rbx, qword [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000bc10
mov r9d, 0x5c
mov rdx, rbx
mov rcx, rax
call fcn.14003b620
cmp rax, 0xffffffffffffffff
jne 0x140035c34
mov rbx, qword [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000bc10
mov r9d, Ordinal_50
mov rdx, rbx
mov rcx, rax
call fcn.14003b620
cmp rax, 0xffffffffffffffff
jne 0x140035c34
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x390]
call fcn.140009b90
jmp 0x140035cae
lea rdi, [rax + 1]
lea rcx, [rsp + 0x31]
call fcn.1400057f0
mov r8, rax
movzx edx, byte [rsp + 0x31]
lea rcx, [rbp + 0x390]
call fcn.140011d40
nop
mov rax, qword [rsp + 0x70]
cmp rax, rdi
jb 0x140036925
mov qword [rbp + 0x208], 0xffffffffffffffff
sub rax, rdi
mov qword [rbp + 0x1e0], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x208]
call fcn.140005b00
mov rbx, qword [rax]
lea rcx, [rsp + 0x60]
call fcn.14000bc10
lea rdx, [rax + rdi*2]
mov r8, rbx
lea rcx, [rbp + 0x390]
call fcn.140005870
nop
lea rbx, [0x1401cf698]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [rbp + 0x390]
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.140033ff0
nop
lea rcx, [rbp + 0x390]
call fcn.140009a90
nop
mov qword [rsp + 0x20], rbx
lea r9, [0x1401cf8a0]
mov r8, qword [rsp + 0x50]
lea rdx, [rbp + 0x3b0]
mov rcx, r13
call fcn.140034940
nop
lea rcx, [rsp + 0x50]
call fcn.14000a580
nop
lea rcx, [rsp + 0x60]
call fcn.140009a90
mov rax, qword [r13]
mov rcx, qword [rax + 0x10]
movzx edx, byte [rcx + 0x15]
movzx eax, byte [rbp + 0x229]
test dl, dl
jne 0x140035d68
test al, al
jne 0x140035d68
mov dword [r15], 0xc0000359
mov byte [r15 + 0x18], al
cmp byte [rbp + 0x408], al
je 0x140035967
lea rcx, [rbp + 0x3e0]
call fcn.140009ed0
lea rcx, [rbp + 0x3c0]
call fcn.140009a90
jmp 0x140035967
mov ecx, 1
test dl, dl
je 0x140035d77
test al, al
cmovne r12d, ecx
xor esi, esi
mov r9d, esi
test al, al
setne r9b
mov dword [rsp + 0x20], ecx
lea r8, str.LdrLoadDll
lea rdx, [rbp + 0x180]
mov rcx, r13
call fcn.1400352e0
nop
mov eax, dword [rbp + 0x180]
test eax, eax
jns 0x140035fdb
mov dword [r15], eax
mov byte [r15 + 0x18], sil
cmp byte [rbp + 0x1d8], sil
je 0x140035dd4
lea rcx, [rbp + 0x1b0]
call fcn.140009ed0
lea rcx, [rbp + 0x190]
call fcn.140009a90
nop
cmp byte [rbp + 0x408], 0
je 0x140035df6
lea rcx, [rbp + 0x3e0]
call fcn.140009ed0
lea rcx, [rbp + 0x3c0]
call fcn.140009a90
nop
cmp byte [rbp + 0x168], 0
je 0x140035e11
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x140035e11
call fcn.140002a00
nop
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x140035e2c
jle 0x140035e25
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x220], rsi
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x140035e47
jle 0x140035e40
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x218], rsi
mov rcx, qword [rbp + 0x210]
test rcx, rcx
je 0x140035e62
jle 0x140035e5b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x210], rsi
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x140035e7d
jle 0x140035e76
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbp + 0x258], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x230], xmm0
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.14000b7d0
cmp byte [rbp + 0x22c], 0
je 0x140035eb4
lea rcx, [rbp + 0x328]
call fcn.140009740
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.14000b7d0
lea rcx, [rbp + 0x348]
call fcn.1400863c0
lea rcx, [rbp + 0x328]
call fcn.140009a90
lea rcx, [rbp + 0x308]
call fcn.140009a90
mov rcx, qword [rbp + 0x2e0]
test rcx, rcx
je 0x140035f1f
mov rdx, qword [rbp + 0x2f0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.140010610
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], rsi
lea rcx, [rbp + 0x2d0]
call fcn.140020490
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x140035f64
mov rdx, qword [rbp + 0x2b0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.140010610
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], rsi
lea rcx, [rbp + 0x290]
call fcn.140020490
lea rcx, [rbp + 0x270]
call fcn.140001bf0
mov r8, qword [rbp + 0x270]
test r8, r8
je 0x1400358cf
mov rcx, qword [rbp + 0x280]
sub rcx, r8
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rcx, r8
call fcn.140010610
mov qword [rbp + 0x270], rsi
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], rsi
jmp 0x1400358cf
cmp r12d, 1
jne 0x1400360a8
cmp byte [r13 + 0x80], 0
jne 0x1400360a8
cmp dword [0x1402054ac], 6
jne 0x1400360a8
mov rax, qword [0x1402054b0]
cmp eax, r12d
ja 0x1400360a8
jb 0x1400360a8
mov dword [rbp + 0x1e0], 0x90909090
mov word [rbp + 0x1e4], 0x9090
mov rbx, qword [0x1402052b0]
test rbx, rbx
je 0x1400360a0
mov dword [rbp + 0x208], esi
lea rax, [rbp + 0x208]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 0x3f]
lea r8d, [r12 + 5]
mov rdx, rbx
mov rcx, qword [r13 + 8]
call fcn.14005f7b0
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 0x70]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rsi
lea r9d, [r12 + 5]
lea r8, [rbp + 0x1e0]
mov rdx, rbx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsp + 0x20], rsi
mov r9d, dword [rbp + 0x208]
lea r8d, [r12 + 5]
mov rdx, rbx
mov rcx, qword [r13 + 8]
call fcn.14005f7b0
mov byte [r13 + 0x80], 1
xor r14d, r14d
mov qword [rbp + 0x1e0], r14
mov edx, r14d
cmp byte [rbp + 0x229], r14b
setne dl
lea rcx, [rbp + 0x1e0]
call fcn.140017db0
nop
mov rbx, qword [rbp + 0x1e0]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x18]
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
mov qword [rbp], 0xffffffffffff0001
mov qword [rbp + 8], 0xff
movabs rdi, 0xffffffff00000003
mov qword [rbp + 0x10], rdi
mov eax, 0xffffffff
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r14
lea rcx, [rbp + 0x30]
call fcn.140008140
mov dword [rbp - 0x10], 2
mov qword [rbp - 8], 4
mov qword [rbp + 0x20], r14
mov dword [rbp + 0x48], r14d
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 0xffffffffffff0001
mov qword [rbp + 0x60], 0xff
mov qword [rbp + 0x68], rdi
mov eax, 0xffffffff
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], r14
mov qword [rbp + 0x80], r14
lea rcx, [rbp + 0x88]
call fcn.140008140
mov dword [rbp + 0x48], 2
mov qword [rbp + 0x50], 4
mov qword [rbp + 0x78], r14
cmp byte [rbp + 0x168], r14b
je 0x14003692b
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x14003619a
mov rdi, qword [rax]
jmp 0x14003619d
mov rdi, r14
mov dword [rbp + 0xa0], r14d
mov qword [rbp + 0xa8], r14
mov qword [rbp + 0xb0], 0xffffffffffff0001
mov qword [rbp + 0xb8], 0xff
movabs rax, 0xffffffff00000003
mov qword [rbp + 0xc0], rax
mov eax, 0xffffffff
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], r14
lea rcx, [rbp + 0xe0]
call fcn.140008140
mov dword [rbp + 0xa0], 2
mov qword [rbp + 0xa8], 8
mov qword [rbp + 0xd0], rdi
cmp byte [rbp + 0x168], 0
je 0x140036931
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x140036232
mov rdi, qword [rax]
jmp 0x140036235
mov rdi, r14
add rdi, 0x800
mov dword [rbp + 0xf8], r14d
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x108], 0xffffffffffff0001
mov qword [rbp + 0x110], 0xff
movabs rax, 0xffffffff00000003
mov qword [rbp + 0x118], rax
mov eax, 0xffffffff
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
lea rcx, [rbp + 0x138]
call fcn.140008140
mov dword [rbp + 0xf8], 2
mov qword [rbp + 0x100], 8
mov qword [rbp + 0x128], rdi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.14001f7c0
nop
cmp byte [rbp + 0x1d8], 0
je 0x140036937
mov rdi, qword [rbp + 0x188]
mov dword [rbp - 0x70], r14d
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 0xffffffffffff0001
mov qword [rbp - 0x58], 0xff
movabs rax, 0xffffffff00000003
mov qword [rbp - 0x50], rax
mov eax, 0xffffffff
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x30]
call fcn.140008140
mov dword [rbp - 0x70], 2
mov qword [rbp - 0x68], 8
mov qword [rbp - 0x40], rdi
mov r9d, 1
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call rsi
nop
lea rcx, [rbp - 0x30]
call fcn.140007f40
nop
lea rcx, [rsp + 0x60]
call fcn.140001bf0
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1400363d4
mov rsi, qword [rsp + 0x68]
cmp rdi, rsi
je 0x140036397
nop dword [rax]
lea rcx, [rdi + 0x40]
call fcn.140007f40
add rdi, 0x58
cmp rdi, rsi
jne 0x140036380
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
sub rcx, rdi
movabs rax, 0x2e8ba2e8ba2e8ba3
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x58
mov rcx, rdi
call fcn.140010610
mov qword [rsp + 0x60], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
lea r9, [0x140017c40]
mov edx, 0x58
lea r8d, [rdx - 0x54]
lea rcx, [rbp - 0x10]
call fcn.140115b94
lea r14, [rbx + 0xa8]
mov rax, qword [r14]
lea r8, sym.Loader.exe_struct_asmjit::Operand_const_asmjit::noOperand
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
mov r9, r8
mov edx, 0x21c
mov rcx, r14
call qword [rax + Ordinal_50]
mov rcx, qword [r13]
add rcx, 0x240
xor edx, edx
call fcn.14004fa40
mov rsi, qword [r13]
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400364dd
mov rcx, qword [rsi + 0x268]
test rcx, rcx
je 0x140036451
call fcn.1400029e0
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsi + 0x260]
mov rcx, qword [rsi + 0x268]
mov r12, qword [rax]
test rcx, rcx
je 0x14003646c
call fcn.140002a00
mov rsi, qword [r13]
mov rax, qword [r14]
mov rcx, r14
cmp r12, rdi
mov edi, dword [r14 + 0x60]
jne 0x1400364a9
sub rdi, qword [r14 + 0x48]
add rdi, qword [r14 + 0x58]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r9, [rbp + 0x200]
mov r8, rdi
mov rdx, rax
lea rcx, [rsi + 0x240]
call fcn.14004edd0
mov edi, eax
test eax, eax
jmp 0x140036514
sub rdi, qword [r14 + 0x48]
add rdi, qword [r14 + 0x58]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x200]
mov r8, rdi
mov rdx, rax
lea rcx, [rsi + 0x240]
call fcn.14004ef00
mov edi, eax
test eax, eax
jmp 0x140036514
mov edi, dword [r14 + 0x60]
sub rdi, qword [r14 + 0x48]
add rdi, qword [r14 + 0x58]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.WS2_32.dll_htonl]
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x200]
mov r8, rdi
mov rdx, rax
lea rcx, [rsi + 0x240]
call fcn.14004e4c0
mov edi, eax
test eax, eax
js 0x140036526
mov edi, dword [rbp + 0x200]
mov eax, edi
test eax, eax
jns 0x14003661f
cmp dword [rbp + 0x3b0], 0
jl 0x14003661f
cmp byte [rsp + 0x30], 0
je 0x14003661f
mov rcx, qword [r13]
add rcx, 0x240
cmp byte [rbp + 0x168], 0
je 0x140036913
mov rax, qword [rbp + 0x158]
xor esi, esi
test rax, rax
je 0x140036569
mov rdx, qword [rax]
jmp 0x14003656c
mov rdx, rsi
mov r8, qword [rsp + 0x40]
add r8, rdx
cmp byte [rbp + 0x408], 0
je 0x140036913
mov rdx, qword [rbp + 0x3b8]
call fcn.14004f990
test eax, eax
jne 0x140036621
mov dword [r15], edi
mov byte [r15 + 0x18], al
test rbx, rbx
je 0x1400365af
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp byte [rbp + 0x1d8], 0
je 0x1400365d1
lea rcx, [rbp + 0x1b0]
call fcn.140009ed0
lea rcx, [rbp + 0x190]
call fcn.140009a90
nop
cmp byte [rbp + 0x408], 0
je 0x1400365f3
lea rcx, [rbp + 0x3e0]
call fcn.140009ed0
lea rcx, [rbp + 0x3c0]
call fcn.140009a90
nop
cmp byte [rbp + 0x168], 0
je 0x14003660e
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14003660e
call fcn.140002a00
nop
lea rcx, [rbp + 0x210]
call fcn.140040380
jmp 0x1400368cd
xor esi, esi
mov eax, esi
cmp byte [rbp + 0x229], 0
setne al
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, qword [rbp - 0x78]
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.140033f70
xor r8d, r8d
mov rdx, rax
mov rcx, r15
call fcn.14001fc80
nop
test rbx, rbx
je 0x140036667
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp byte [rbp + 0x1d8], 0
je 0x140036689
lea rcx, [rbp + 0x1b0]
call fcn.140009ed0
lea rcx, [rbp + 0x190]
call fcn.140009a90
nop
cmp byte [rbp + 0x408], 0
je 0x1400366ab
lea rcx, [rbp + 0x3e0]
call fcn.140009ed0
lea rcx, [rbp + 0x3c0]
call fcn.140009a90
nop
cmp byte [rbp + 0x168], 0
je 0x1400366c6
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400366c6
call fcn.140002a00
nop
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x1400366e1
jle 0x1400366da
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x220], rsi
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x1400366fc
jle 0x1400366f5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x218], rsi
mov rcx, qword [rbp + 0x210]
test rcx, rcx
je 0x140036717
jle 0x140036710
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x210], rsi
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x140036732
jle 0x14003672b
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbp + 0x258], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x230], xmm0
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.14000b7d0
cmp byte [rbp + 0x22c], 0
je 0x140036769
lea rcx, [rbp + 0x328]
call fcn.140009740
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.14000b7d0
lea rcx, [rbp + 0x348]
call fcn.1400863c0
lea rcx, [rbp + 0x328]
call fcn.140009a90
lea rcx, [rbp + 0x308]
call fcn.140009a90
mov rcx, qword [rbp + 0x2e0]
test rcx, rcx
je 0x1400367d4
mov rdx, qword [rbp + 0x2f0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.140010610
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], rsi
lea rcx, [rbp + 0x2d0]
call fcn.140020490
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x140036819
mov rdx, qword [rbp + 0x2b0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.140010610
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], rsi
lea rcx, [rbp + 0x290]
call fcn.140020490
lea rcx, [rbp + 0x270]
call fcn.140001bf0
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je 0x140036884
mov rdx, qword [rbp + 0x280]
sub rdx, rcx
movabs rax, 0x6666666666666667
imul rdx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
call fcn.140010610
mov qword [rbp + 0x270], rsi
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], rsi
mov rcx, qword [rbp + 0x258]
test rcx, rcx
jle 0x140036896
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov rcx, qword [rbp + 0x220]
test rcx, rcx
jle 0x1400368a8
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp + 0x218]
test rcx, rcx
jle 0x1400368ba
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x210]
test rcx, rcx
jle 0x1400368cd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x1f0]
call fcn.14000a580
nop
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400368ed
call fcn.140002a00
mov rax, r15
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140115b30
add rsp, 0x528
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140017270
nop
call fcn.140017270
int3
call fcn.140017270
nop
call fcn.14003a790
nop
call fcn.140017270
nop
call fcn.140017270
nop
call fcn.140017270
int3