Function at 0x14000a590
Capabilities:
Get file system object information
Read file on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1b420
call fcn.14001ab40
sub rsp, rax
mov qword [rsp + 0x438], 0xfffffffffffffffe
mov qword [rsp + 0x1b460], rbx
mov qword [rsp + 0x1b468], rsi
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x1b410], rax
mov rbx, rdx
mov qword [rsp + 0x60], rdx
mov rsi, rcx
mov qword [rsp + 0x2d8], rcx
mov qword [rsp + 0x268], rdx
xor edi, edi
mov dword [rsp + 0xd8], edi
mov r13d, edi
mov qword [rdx], rdi
mov qword [rdx + 8], rdi
call fcn.140005030
mov qword [rbx], rax
mov dword [rsp + 0xd8], 1
cmp qword [rsi + 0x48], rdi
je 0x14000a628
cmp qword [rsi + 0x50], rdi
je 0x14000a628
cmp qword [rsi + 0x58], rdi
jne 0x14000a62f
mov dword [rsi + 0x28], 0x80040102
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, str.silent
lea rcx, [rsp + 0x2e0]
call fcn.14000fb80
mov r12, rax
lea r15, [rsi + 0x90]
mov r14, qword [r15]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000a68a
lea rcx, [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
call fcn.1400108a0
test ax, ax
jns 0x14000a67e
mov rbx, qword [rbx + 0x10]
jmp 0x14000a684
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14000a661
cmp r14, qword [r15]
je 0x14000a6b8
lea rdx, [r14 + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.1400108a0
test ax, ax
js 0x14000a6b8
mov qword [rsp + 0x288], r14
lea rbx, [rsp + 0x288]
jmp 0x14000a6cb
mov rax, qword [r15]
mov qword [rsp + 0x2a8], rax
lea rbx, [rsp + 0x2a8]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x300]
mov rcx, rdi
mov qword [rsp + 0x300], rcx
test rax, rax
je 0x14000a6f6
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x300]
call fcn.1400137cc
mov rax, qword [rsp + 0x2f0]
mov rcx, rdi
mov qword [rsp + 0x2f0], rcx
test rax, rax
je 0x14000a723
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x2f0]
call fcn.1400137cc
cmp rbx, qword [r15]
je 0x14000a75c
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, [0x14002ee78]
lea rcx, [rsp + 0x4f8]
call fcn.14000fb80
lea rcx, [rbx + 0x50]
lea r8, [rsp + 0xf0]
mov rdx, rax
call fcn.140012020
mov eax, dword [rsp + 0xf0]
mov dword [rsi + 0x80], eax
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, str.parent
lea rcx, [rsp + 0x370]
call fcn.14000fb80
mov r12, rax
mov r14, qword [r15]
mov rbx, qword [r14 + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000a7c9
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rbx + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
call fcn.1400108a0
test ax, ax
jns 0x14000a7bd
mov rbx, qword [rbx + 0x10]
jmp 0x14000a7c3
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14000a7a0
cmp r14, qword [r15]
je 0x14000a7f7
lea rdx, [r14 + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.1400108a0
test ax, ax
js 0x14000a7f7
mov qword [rsp + 0x2d0], r14
lea rbx, [rsp + 0x2d0]
jmp 0x14000a80a
mov rax, qword [r15]
mov qword [rsp + 0x2b0], rax
lea rbx, [rsp + 0x2b0]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x390]
mov rcx, rdi
mov qword [rsp + 0x390], rcx
test rax, rax
je 0x14000a835
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x390]
call fcn.1400137cc
mov rax, qword [rsp + 0x380]
mov rcx, rdi
mov qword [rsp + 0x380], rcx
test rax, rax
je 0x14000a862
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x380]
call fcn.1400137cc
mov eax, edi
mov dword [rsp + 0x90], eax
cmp rbx, qword [r15]
je 0x14000a8ab
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, [0x14002f134]
lea rcx, [rsp + 0x4c8]
call fcn.14000fb80
lea rcx, [rbx + 0x50]
lea r8, [rsp + 0x90]
mov rdx, rax
call fcn.140012020
mov eax, dword [rsp + 0x90]
mov r12d, eax
mov qword [rsp + 0xe8], r12
mov rcx, qword [rsi + 0x78]
test rcx, rcx
je 0x14000bc69
mov qword [rsp + 0xa8], rdi
mov rax, qword [rcx]
lea r8, [rsp + 0xa8]
xor edx, edx
call qword [rax + 0x20]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000bc69
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [0x14002f2e0]
call qword [rax + 0x38]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000bc4f
mov qword [rsp + 0x98], rdi
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
lea r9, [rsp + 0x98]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [rax + 0x98]
mov dword [rsi + 0x28], eax
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x14000bc4f
cmp dword [rdx], 0
je 0x14000a96c
test eax, eax
js 0x14000a96c
cmp eax, 0x40380
je 0x14000a96c
mov rax, qword [rdx + 0x10]
movzx ecx, word [rax + 8]
test ecx, ecx
jne 0x14000a96c
mov rcx, qword [rsi + 0x38]
call fcn.140008ea0
jmp 0x14000a909
test rdx, rdx
je 0x14000bc4f
cmp dword [rdx], 0
je 0x14000bc4f
mov rax, qword [rdx + 0x10]
mov r8d, dword [rax + 0x20]
mov r9, qword [rax + 0x28]
mov qword [rsp + 0x80], rdi
mov rcx, qword [rsi + 0x78]
mov rax, qword [rcx]
movsxd rdx, r12d
lea r10, [rsp + 0x80]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
call qword [rax + 0x28]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000bc32
mov qword [rsp + 0xa0], rdi
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, str.totalAttachmentSize
lea rcx, [rsp + 0x3a0]
call fcn.14000fb80
nop
mov r8, rax
lea rdx, [rsp + 0x440]
mov rcx, r15
call fcn.14000f0a0
mov rbx, qword [rax]
mov rax, qword [rsp + 0x3c0]
mov rcx, rdi
mov qword [rsp + 0x3c0], rcx
test rax, rax
je 0x14000aa26
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x3c0]
call fcn.1400137cc
mov rax, qword [rsp + 0x3b0]
mov rcx, rdi
mov qword [rsp + 0x3b0], rcx
test rax, rax
je 0x14000aa53
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x3b0]
call fcn.1400137cc
cmp rbx, qword [r15]
je 0x14000ab24
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, [0x14002f134]
lea rcx, [rsp + 0x468]
call fcn.14000fb80
lea rcx, [rbx + 0x50]
lea r8, [rsp + 0xa0]
mov rdx, rax
call fcn.1400120c0
cmp qword [rsp + 0xa0], 0
je 0x14000ab2c
mov dword [rsp + 0xe0], edi
mov qword [rsp + 0x100], rdi
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea rdx, [rsp + 0x100]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xe0]
xor r8d, r8d
lea rdx, [0x14002f290]
call qword [rax + 0x28]
mov dword [rsi + 0x28], eax
mov rdx, qword [rsp + 0x100]
test rdx, rdx
je 0x14000ab16
test eax, eax
jne 0x14000ab0c
mov eax, dword [rdx + 8]
shl eax, 0xa
mov ecx, eax
test eax, eax
je 0x14000ab0c
cmp qword [rsp + 0xa0], rcx
jb 0x14000ab0c
mov dword [rsi + 0x28], 0x8004666d
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [rsi + 0x28], 0x8004010f
jne 0x14000ab2c
mov dword [rsi + 0x28], edi
jmp 0x14000ab2c
mov qword [rsp + 0xa0], rdi
cmp dword [rsi + 0x28], 0
jl 0x14000bc18
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea rdx, [rsp + 0x138]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xf4]
xor r8d, r8d
lea rdx, [0x14002f2b8]
call qword [rax + 0x28]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000bc18
cmp eax, 0x40380
je 0x14000bbff
cmp dword [rsp + 0xf4], 1
jne 0x14000bbff
mov rax, qword [rsp + 0x138]
mov edx, dword [rax + 8]
mov r8, qword [rax + 0x10]
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0xfc], edi
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea r9, [rsp + 0xb0]
mov qword [rsp + 0x30], r9
lea r9, [rsp + 0xfc]
mov qword [rsp + 0x28], r9
mov dword [rsp + 0x20], 0x10
xor r9d, r9d
call qword [rax + 0x88]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000bbff
mov qword [rsp + 0x68], rdi
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx]
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x98]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000bbe5
mov qword [rsp + 0xc0], rdi
mov rcx, qword [rsi + 0x78]
mov rax, qword [rcx]
mov r9d, edi
cmp dword [rsi + 0x80], edi
setne r9b
lea rdx, [rsp + 0xc0]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
xor edx, edx
call qword [rax + 0x30]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000ba59
mov rdx, r15
lea rcx, [rsp + 0x448]
call fcn.140006f10
mov r9d, edi
cmp dword [rsi + 0x80], edi
sete r9b
lea rax, [rsp + 0x448]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xc0]
mov rcx, rsi
call fcn.14000d080
test eax, eax
je 0x14000ba3d
mov qword [rsp + 0x78], rdi
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, str.message
lea rcx, [rsp + 0x400]
call fcn.14000fb80
nop
mov r8, rax
lea rdx, [rsp + 0x458]
mov rcx, r15
call fcn.14000f0a0
mov rbx, qword [rax]
mov rax, qword [rsp + 0x420]
mov rcx, rdi
mov qword [rsp + 0x420], rcx
test rax, rax
je 0x14000acf3
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x420]
call fcn.1400137cc
mov rax, qword [rsp + 0x410]
mov rcx, rdi
mov qword [rsp + 0x410], rcx
test rax, rax
je 0x14000ad20
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x410]
call fcn.1400137cc
cmp rbx, qword [r15]
je 0x14000afb8
mov dword [rsp + 0x1a8], edi
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x1c8], rdi
mov qword [rsp + 0x1d0], rdi
lea rdx, [rbx + 0x50]
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x1a8]
call fcn.140010560
nop
lea rcx, [rsp + 0x1a8]
call fcn.140011320
cmp qword [rsp + 0x1b0], 0
je 0x14000af5e
xor eax, eax
mov qword [rsp + 0x124], rax
mov qword [rsp + 0x12c], rax
mov dword [rsp + 0x134], eax
mov dword [rsp + 0x120], 0x1000001f
lea rcx, [rsp + 0x1a8]
call fcn.140011320
mov qword [rsp + 0x128], rax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0x120]
mov edx, 1
call qword [rax + 0x40]
mov dword [rsi + 0x28], eax
mov r8, qword [rsp + 0xc8]
test eax, eax
js 0x14000af4b
test r8, r8
je 0x14000af5e
mov edx, edi
cmp edx, dword [r8]
jae 0x14000af4b
mov eax, edx
lea rcx, [rax + rax*2]
movsd xmm0, qword [r8 + rcx*4 + 4]
movsd qword [rsp + 0x2b8], xmm0
cmp dword [r8 + rcx*4 + 0xc], 0x80040103
jne 0x14000af44
mov dword [rsp + 0x120], 0x1000001e
mov dword [rsp + 0x148], edi
mov qword [rsp + 0x150], rdi
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], rdi
or r8, 0xffffffffffffffff
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x148]
call fcn.140010560
nop
lea rcx, [rsp + 0x148]
call fcn.140011370
nop
lea rcx, [rsp + 0x148]
call fcn.140011370
cmp qword [rsp + 0x150], 0
je 0x14000aee0
lea rcx, [rsp + 0x148]
call fcn.140011370
mov qword [rsp + 0x128], rax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x120]
lea edx, [r9 + 1]
call qword [rax + 0x40]
mov dword [rsi + 0x28], eax
mov rax, qword [rsp + 0x168]
mov rcx, rdi
mov qword [rsp + 0x168], rcx
test rax, rax
je 0x14000af08
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x168]
call fcn.1400137cc
mov rax, qword [rsp + 0x158]
mov rcx, rdi
mov qword [rsp + 0x158], rcx
test rax, rax
je 0x14000af35
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x158]
call fcn.1400137cc
mov r8, qword [rsp + 0xc8]
jmp 0x14000af4b
inc edx
jmp 0x14000ae06
test r8, r8
je 0x14000af5e
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x10]
nop
mov rax, qword [rsp + 0x1c8]
mov rcx, rdi
mov qword [rsp + 0x1c8], rcx
test rax, rax
je 0x14000af86
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x1c8]
call fcn.1400137cc
mov rax, qword [rsp + 0x1b8]
mov rcx, rdi
mov qword [rsp + 0x1b8], rcx
test rax, rax
je 0x14000afb3
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x1b8]
call fcn.1400137cc
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, str.subject
lea rcx, [rsp + 0x3d0]
call fcn.14000fb80
nop
mov r8, rax
lea rdx, [rsp + 0x460]
lea rcx, [rsi + 0x90]
call fcn.14000f0a0
mov rbx, qword [rax]
mov rax, qword [rsp + 0x3f0]
mov rcx, rdi
mov qword [rsp + 0x3f0], rcx
test rax, rax
je 0x14000b016
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x3f0]
call fcn.1400137cc
mov rax, qword [rsp + 0x3e0]
mov rcx, rdi
mov qword [rsp + 0x3e0], rcx
test rax, rax
je 0x14000b043
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x3e0]
call fcn.1400137cc
cmp rbx, qword [rsi + 0x90]
je 0x14000b2e2
mov dword [rsp + 0x1d8], edi
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x1f8], rdi
mov qword [rsp + 0x200], rdi
lea rdx, [rbx + 0x50]
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x1d8]
call fcn.140010560
nop
lea rcx, [rsp + 0x1d8]
call fcn.140011320
cmp qword [rsp + 0x1e0], 0
je 0x14000b288
xor eax, eax
mov qword [rsp + 0x10c], rax
mov qword [rsp + 0x114], rax
mov dword [rsp + 0x11c], eax
mov dword [rsp + 0x108], 0x37001f
lea rcx, [rsp + 0x1d8]
call fcn.140011320
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x108]
mov edx, 1
call qword [rax + 0x40]
mov dword [rsi + 0x28], eax
mov r8, qword [rsp + 0xd0]
test eax, eax
js 0x14000b275
test r8, r8
je 0x14000b288
mov edx, edi
nop dword [rax]
cmp edx, dword [r8]
jae 0x14000b275
mov eax, edx
lea rcx, [rax + rax*2]
movsd xmm0, qword [r8 + rcx*4 + 4]
movsd qword [rsp + 0x2b8], xmm0
cmp dword [r8 + rcx*4 + 0xc], 0x80040103
jne 0x14000b26e
mov dword [rsp + 0x108], 0x37001e
mov dword [rsp + 0x178], edi
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rdi
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x1a0], rdi
or r8, 0xffffffffffffffff
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x178]
call fcn.140010560
nop
lea rcx, [rsp + 0x178]
call fcn.140011370
nop
lea rcx, [rsp + 0x178]
call fcn.140011370
cmp qword [rsp + 0x180], 0
je 0x14000b20a
lea rcx, [rsp + 0x178]
call fcn.140011370
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x108]
lea edx, [r9 + 1]
call qword [rax + 0x40]
mov dword [rsi + 0x28], eax
mov rax, qword [rsp + 0x198]
mov rcx, rdi
mov qword [rsp + 0x198], rcx
test rax, rax
je 0x14000b232
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x198]
call fcn.1400137cc
mov rax, qword [rsp + 0x188]
mov rcx, rdi
mov qword [rsp + 0x188], rcx
test rax, rax
je 0x14000b25f
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x188]
call fcn.1400137cc
mov r8, qword [rsp + 0xd0]
jmp 0x14000b275
inc edx
jmp 0x14000b130
test r8, r8
je 0x14000b288
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x10]
nop
mov rax, qword [rsp + 0x1f8]
mov rcx, rdi
mov qword [rsp + 0x1f8], rcx
test rax, rax
je 0x14000b2b0
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x1f8]
call fcn.1400137cc
mov rax, qword [rsp + 0x1e8]
mov rcx, rdi
mov qword [rsp + 0x1e8], rcx
test rax, rax
je 0x14000b2dd
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x1e8]
call fcn.1400137cc
mov dword [rsp + 0x208], edi
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x218], rdi
mov qword [rsp + 0x220], rdi
mov qword [rsp + 0x228], rdi
mov qword [rsp + 0x230], rdi
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, str.attachment
lea rcx, [rsp + 0x310]
call fcn.14000fb80
nop
mov r8, rax
lea rdx, [rsp + 0x430]
lea rcx, [rsi + 0x90]
call fcn.14000f0a0
mov rbx, qword [rax]
mov rax, qword [rsp + 0x330]
mov rcx, rdi
mov qword [rsp + 0x330], rcx
test rax, rax
je 0x14000b36f
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x330]
call fcn.1400137cc
mov rax, qword [rsp + 0x320]
mov rcx, rdi
mov qword [rsp + 0x320], rcx
test rax, rax
je 0x14000b39c
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x320]
call fcn.1400137cc
cmp rbx, qword [rsi + 0x90]
je 0x14000b3bf
lea rdx, [rbx + 0x50]
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x208]
call fcn.140010560
lea rcx, [rsp + 0x208]
call fcn.140011320
cmp qword [rsp + 0x210], 0
je 0x14000b940
lea rcx, [rsp + 0x208]
call fcn.140011320
mov r8, rax
mov edx, 0xcbe8
lea rcx, [rsp + 0x1c40]
call fcn.140014134
lea r8, [rsp + 0x2c8]
lea rdx, [0x14002f1bc]
lea rcx, [rsp + 0x1c40]
call fcn.140013fec
mov dword [rsp + 0xf8], edi
mov r15d, 0x80044005
mov r13, rax
cmp edi, 0xc8
jge 0x14000b938
test rax, rax
je 0x14000b938
mov qword [rsp + 0x88], rdi
mov rcx, qword [rsi + 0x70]
test rcx, rcx
je 0x14000b45f
mov rax, qword [rcx]
mov rdx, r13
call qword [rax]
test al, al
je 0x14000b91d
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xf8]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x80]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000b91d
xor eax, eax
mov qword [rsp + 0x7f0], rax
mov qword [rsp + 0x7f8], rax
mov qword [rsp + 0x800], rax
mov qword [rsp + 0x808], rax
mov qword [rsp + 0x810], rax
mov qword [rsp + 0x818], rax
mov qword [rsp + 0x820], rax
mov qword [rsp + 0x828], rax
mov qword [rsp + 0x830], rax
mov dword [rsp + 0x7f0], 0x37050003
mov dword [rsp + 0x7f8], 1
mov qword [rsp + 0x810], rdi
mov qword [rsp + 0x828], rdi
mov qword [rsp + 0x40], pe_nt_image_headers64
lea rax, [rsp + 0xa40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], pe_nt_image_headers64
lea rax, [rsp + 0x840]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.140013a24
lea r8, [rsp + 0xa40]
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x840]
call fcn.1400140ac
mov dword [rsp + 0x808], 0x3704001f
lea rax, [rsp + 0x840]
mov qword [rsp + 0x810], rax
mov qword [rsp + 0x530], rdi
xor edx, edx
mov r8d, 0x2b0
lea rcx, [rsp + 0x538]
call fcn.140014d80
mov dword [rsp + 0x20], 0x200
mov r9d, 0x2b8
lea r8, [rsp + 0x530]
mov edx, 0xd0
mov rcx, r13
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x14000b5d9
mov dword [rsp + 0x820], 0x3001001f
lea rax, [rsp + 0x540]
mov qword [rsp + 0x828], rax
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x7f0]
mov edx, 3
call qword [rax + 0x40]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000b7ac
cmp qword [rsp + 0xb8], 0
je 0x14000b7c6
mov edx, edi
nop dword [rax + rax]
mov r8, qword [rsp + 0xb8]
cmp edx, dword [r8]
jae 0x14000b7a6
mov eax, edx
lea rcx, [rax + rax*2]
movsd xmm0, qword [r8 + rcx*4 + 4]
movsd qword [rsp + 0x2b8], xmm0
cmp dword [r8 + rcx*4 + 0xc], 0x80040103
jne 0x14000b79f
mov r15, rdi
mov r12, rdi
mov ebx, edi
mov r14d, edi
mov r8, qword [rsp + 0x810]
test r8, r8
je 0x14000b6de
mov dword [rsp + 0x808], 0x3704001e
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
test eax, eax
je 0x14000b6de
mov rcx, rbx
call fcn.14001396c
mov r15, rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, qword [rsp + 0x810]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
mov qword [rsp + 0x810], r15
mov r8, qword [rsp + 0x828]
test r8, r8
je 0x14000b75d
mov dword [rsp + 0x820], 0x3001001e
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r14, eax
test eax, eax
je 0x14000b75d
mov rcx, r14
call fcn.14001396c
mov r12, rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, qword [rsp + 0x828]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r14d, eax
mov qword [rsp + 0x828], r12
test ebx, ebx
je 0x14000b783
test r14d, r14d
je 0x14000b783
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x7f0]
lea edx, [r9 + 3]
call qword [rax + 0x40]
test r15, r15
je 0x14000b790
mov rcx, r15
call fcn.14001392c
test r12, r12
je 0x14000b7a6
mov rcx, r12
call fcn.14001392c
jmp 0x14000b7a6
inc edx
jmp 0x14000b620
mov r15d, 0x80044005
mov r8, qword [rsp + 0xb8]
test r8, r8
je 0x14000b7c6
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 3
mov r9d, 1
lea r8, [0x140027458]
mov edx, 0x37010102
call qword [rax + 0x38]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000b8ff
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000b83f
mov dword [rsi + 0x28], r15d
jmp 0x14000b8e2
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x94], edi
nop word [rax + rax]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
mov r8d, 0x1000
lea rdx, [rsp + 0xc40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000b8d9
cmp dword [rsp + 0x70], 0
je 0x14000b8d9
lea rbx, [rsp + 0xc40]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea r9, [rsp + 0x94]
mov r8d, dword [rsp + 0x70]
mov rdx, rbx
call qword [rax + 0x20]
mov edx, dword [rsp + 0x94]
test edx, edx
cmove eax, r15d
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000b8d0
mov ecx, dword [rsp + 0x70]
sub ecx, edx
mov dword [rsp + 0x70], ecx
add rbx, rdx
test ecx, ecx
jne 0x14000b890
cmp eax, 0
jge 0x14000b850
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x78], rdi
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea r8, [rsp + 0x2c8]
lea rdx, [0x14002f1bc]
xor ecx, ecx
call fcn.140013fec
jmp 0x14000b426
mov r12, qword [rsp + 0xe8]
xor eax, eax
mov qword [rsp + 0x274], rax
mov qword [rsp + 0x27c], rax
mov dword [rsp + 0x284], eax
mov dword [rsp + 0x270], 0x1a001e
lea rbx, str.IPM.Note
mov qword [rsp + 0x278], rbx
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x270]
lea edx, [r9 + 1]
call qword [rax + 0x40]
mov dword [rsi + 0x28], eax
mov rax, qword [rsp + 0x228]
mov rcx, rdi
mov qword [rsp + 0x228], rcx
test rax, rax
je 0x14000b9b8
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x228]
call fcn.1400137cc
mov rax, qword [rsp + 0x218]
mov rcx, rdi
mov qword [rsp + 0x218], rcx
test rax, rax
je 0x14000b9e5
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x218]
call fcn.1400137cc
nop
mov r15, qword [rsp + 0x60]
jmp 0x14000ba13
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14000ba35
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r13d, 1
jmp 0x14000ba49
lea rbx, str.IPM.Note
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000ba65
lea rbx, str.IPM.Note
mov r15, qword [rsp + 0x60]
cmp dword [rsi + 0x28], 0
jl 0x14000bbea
cmp dword [rsi + 0x80], 0
jne 0x14000bb1c
mov ecx, 8
call fcn.1400138b8
mov r14, rax
mov rcx, qword [rsi + 0x78]
mov r10, qword [rcx]
mov r9, rax
mov r8, qword [rsp + 0x68]
xor edx, edx
call qword [r10 + 0xa8]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000bb14
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000bab8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x78]
mov r10, qword [rcx]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], 2
mov qword [rsp + 0x30], rdi
mov rax, qword [r14]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, qword [rsp + 0xb0]
mov r8, qword [rsp + 0x80]
mov rdx, r12
call qword [r10 + 0xa0]
mov dword [rsi + 0x28], eax
jmp 0x14000bbea
mov r13d, edi
jmp 0x14000bbea
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea rdx, [rsp + 0x140]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xdc]
xor r8d, r8d
lea rdx, [0x14002f288]
call qword [rax + 0x28]
mov dword [rsi + 0x28], eax
test eax, eax
js 0x14000bbc5
cmp eax, 0x40380
je 0x14000bbb3
cmp dword [rsp + 0xdc], 1
jne 0x14000bbb3
xor eax, eax
mov qword [rsp + 0x294], rax
mov qword [rsp + 0x29c], rax
mov dword [rsp + 0x2a4], eax
mov dword [rsp + 0x290], 0xe0a0102
mov rax, qword [rsp + 0x140]
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x298], xmm0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x290]
lea edx, [r9 + 1]
call qword [rax + 0x40]
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x140]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000bbea
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000bc04
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000bc04
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x138]
call qword [rax + 0x10]
jmp 0x14000bc1d
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000bc37
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000bc37
mov r15, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x14000bc54
mov rcx, qword [rsi + 0x38]
call fcn.140008ea0
jmp 0x14000bc54
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14000bc6e
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000bc6e
mov r15, qword [rsp + 0x60]
mov dword [rsp + 0x238], edi
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], rdi
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, [0x14002ee78]
lea rcx, [rsp + 0x498]
call fcn.14000fb80
mov r8d, r13d
mov rdx, rax
lea rcx, [rsp + 0x238]
call fcn.140011fa0
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, str.result
lea rcx, [rsp + 0x340]
call fcn.14000fb80
nop
mov rdx, rax
mov rcx, r15
call fcn.1400047c0
or r8, 0xffffffffffffffff
lea rdx, [rsp + 0x238]
mov rcx, rax
call fcn.140010560
nop
mov rax, qword [rsp + 0x360]
mov rcx, rdi
mov qword [rsp + 0x360], rcx
test rax, rax
je 0x14000bd2f
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x360]
call fcn.1400137cc
mov rax, qword [rsp + 0x350]
mov rcx, rdi
mov qword [rsp + 0x350], rcx
test rax, rax
je 0x14000bd5c
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x350]
call fcn.1400137cc
nop
mov rax, qword [rsp + 0x258]
mov rcx, rdi
mov qword [rsp + 0x258], rcx
test rax, rax
je 0x14000bd8a
mov rcx, rax
call fcn.140013924
mov rcx, qword [rsp + 0x258]
call fcn.1400137cc
mov rcx, qword [rsp + 0x248]
mov qword [rsp + 0x248], rdi
test rcx, rcx
je 0x14000bdb1
call fcn.140013924
mov rdi, qword [rsp + 0x248]
mov rcx, rdi
call fcn.1400137cc
mov rax, r15
mov rcx, qword [rsp + 0x1b410]
xor rcx, rsp
call fcn.1400130a0
lea r11, [rsp + 0x1b420]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret