Function at 0x1400d27fc
Capabilities:
Clear file content
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rsi, rcx
lea rdx, [rax + 0x10]
lea rcx, [rax - 0x50]
xor ebx, ebx
mov qword [rax - 0x50], rbx
call fcn.14006d404
lea r12d, [rbx + 1]
lea ebp, [rbx + 2]
lea rcx, str.SeBackupPrivilege
mov r8d, r12d
mov edx, ebp
call fcn.14001c318
lea r8d, [rbx + 0x10]
lea rcx, str.SeRestorePrivilege
mov edx, ebp
call fcn.14001c318
mov rcx, qword [rsp + 0x1c8]
mov r14b, bl
mov byte [rsp + 0x42], bl
mov byte [rsp + 0x94], bl
mov byte [rsp + 0x71], bl
mov r15b, bl
mov byte [rsp + 0x1d8], bl
mov byte [rsp + 0x108], bl
mov byte [rsp + 0x41], bl
mov byte [rsp + 0x50], bl
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x98], rbx
mov rdi, rbx
mov qword [rsp + 0xb0], rbx
lea edx, [rbx + 0x23]
lea r9d, [rbx + 9]
lea r13d, [rbx + 0x20]
lea r10d, [rbx + 0x2a]
lea r8d, [rbx + 0x2e]
jmp 0x1400d2900
cmp r9w, ax
ja 0x1400d28c8
cmp ax, 0xd
jbe 0x1400d2908
cmp r13w, ax
je 0x1400d2908
cmp r10w, ax
jne 0x1400d28d9
mov r14b, byte [rcx]
jmp 0x1400d28f5
cmp r8w, ax
jne 0x1400d28e7
mov al, byte [rcx]
mov byte [rsp + 0x42], al
jmp 0x1400d28f5
cmp dx, ax
jne 0x1400d28f5
mov al, byte [rcx]
mov byte [rsp + 0x94], al
add rcx, rbp
mov qword [rsp + 0x1c8], rcx
movzx eax, word [rcx]
cmp ax, bx
jne 0x1400d28bc
lea rcx, [rsp + 0x1c8]
call fcn.14005aec8
mov rbp, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xf8], rbp
call fcn.1400632a0
movzx r11d, word [rbp]
mov r8d, 0x2d
cmp r8w, r11w
jne 0x1400d29fe
lea r15d, [r8 - 1]
lea r10d, [r8 - 0x2b]
movzx eax, word [rbp + 2]
cmp ax, bx
je 0x1400d29c5
mov ecx, 9
cmp cx, ax
ja 0x1400d2970
cmp ax, 0xd
jbe 0x1400d29c5
cmp r13w, ax
je 0x1400d29c5
cmp ax, r15w
je 0x1400d29c5
cmp cx, r11w
ja 0x1400d2989
cmp r11w, 0xd
jbe 0x1400d29a5
cmp r13w, r11w
je 0x1400d29a5
add rbp, r10
mov qword [rsp + 0xf8], rbp
mov r11w, word [rbp]
cmp r11w, bx
jne 0x1400d297c
lea rcx, [rsp + 0xf8]
call fcn.14005aec8
mov rbp, qword [rsp + 0xf8]
mov r11w, word [rbp]
cmp r8w, r11w
je 0x1400d2957
mov qword [rsp + 0xe0], rbp
mov r15b, bl
cmp rbp, qword [rsp + 0x1c8]
je 0x1400d29fe
mov word [rbp - 2], bx
mov rdx, qword [rsp + 0x1c8]
lea r8, [rsp + 0x88]
xor r9d, r9d
mov rcx, rsi
mov byte [rsp + 0x20], r12b
call fcn.14007bba4
mov rax, qword [rsp + 0x88]
lea rcx, [rsp + 0x58]
mov rdx, r12
mov qword [rsp + 0x1c8], rax
call fcn.140063314
or qword [rsp + 0xd0], 0xffffffffffffffff
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0xc8], rax
mov eax, 0x200
mov r13, rbx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0x138], rbx
mov byte [rsp + 0x70], bl
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x110], rax
mov byte [rsp + 0x78], bl
mov byte [rsp + 0x64], bl
mov r12b, bl
mov qword [rsp + 0x148], rbx
jmp 0x1400d2dcb
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14012a434]
mov r8d, 3
call fcn.140065d7c
cmp al, bl
je 0x1400d2ab7
mov byte [rsp + 0x71], 1
jmp 0x1400d2dcb
lea rdx, [rsp + 0x1c8]
lea rcx, str._dir
mov r8d, 4
call fcn.140065d7c
cmp al, bl
je 0x1400d2ae2
mov dword [rsp + 0x68], 0x80000000
jmp 0x1400d2dcb
lea rdx, [rsp + 0x1c8]
lea rcx, str._free
mov r8d, 5
call fcn.140065e58
cmp al, bl
jne 0x1400d3525
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14012a344]
mov r8d, 3
call fcn.140065e58
cmp al, bl
je 0x1400d2c80
mov rcx, qword [rsp + 0x1c8]
mov r9d, 9
movzx eax, word [rcx]
mov r8, rcx
mov qword [rsp + 0xe8], rcx
cmp ax, bx
je 0x1400d2b7a
lea edx, [r9 + 0x17]
lea ebp, [rdx - 0x1e]
cmp r9w, ax
ja 0x1400d2b5a
cmp ax, 0xd
jbe 0x1400d2b72
cmp dx, ax
je 0x1400d2b72
add rcx, rbp
mov qword [rsp + 0x1c8], rcx
mov ax, word [rcx]
cmp ax, bx
jne 0x1400d2b4e
mov rbp, qword [rsp + 0xe0]
lea rcx, [rsp + 0x1c8]
call fcn.14005aec8
mov eax, 0x3f
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xa0], rbx
cmp ax, word [r8]
jne 0x1400d2c0a
lea rdx, [r8 + 2]
mov qword [rsp + 0x148], rdx
mov rcx, rdx
movzx eax, word [rdx]
cmp ax, bx
je 0x1400d2be7
mov edi, 2
lea r8d, [rdi + 0x1e]
cmp r9w, ax
ja 0x1400d2bce
cmp ax, 0xd
jbe 0x1400d2bdf
cmp r8w, ax
je 0x1400d2bdf
add rcx, rdi
mov ax, word [rcx]
cmp ax, bx
jne 0x1400d2bc2
mov rdi, qword [rsp + 0xb0]
cmp word [rcx], bx
je 0x1400d2bef
mov word [rcx], bx
lea r8, [rsp + 0xa0]
xor r9d, r9d
mov rcx, rsi
call fcn.14006d9f0
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe8]
call fcn.1400c14c4
mov rsi, qword [rsp + 0xb8]
cmp rsi, 0xffffffffffffffff
je 0x1400d2c66
cmp rsi, rbx
je 0x1400d2c66
lea rdx, [rsp + 0xb0]
mov rcx, rsi
mov qword [rsp + 0x148], rbx
call fcn.14005b1e8
mov rdi, qword [rsp + 0xb0]
cmp rax, rbx
je 0x1400d2c66
cmp rdi, rbx
cmovne rsi, rdi
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0xa0]
call fcn.14005aef8
mov rsi, qword [rsp + 0x1c0]
jmp 0x1400d2dcb
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14012a428]
mov r8d, 3
call fcn.140065d7c
cmp al, bl
je 0x1400d2caf
mov eax, 1
mov byte [rsp + 0x108], al
jmp 0x1400d2dcb
lea rdx, [rsp + 0x1c8]
lea rcx, [0x140129ff4]
mov r8d, 2
call fcn.140065d7c
cmp al, bl
je 0x1400d2ce1
mov eax, 1
mov r15b, al
mov byte [rsp + 0x1d8], al
jmp 0x1400d2dcb
lea rdx, [rsp + 0x1c8]
lea rcx, str._sparse
mov r8d, 7
call fcn.140065d7c
cmp al, bl
je 0x1400d2d09
mov byte [rsp + 0x41], 1
jmp 0x1400d2dcb
lea rdx, [rsp + 0x1c8]
lea rcx, str._quick
mov r8d, 6
call fcn.140065d7c
cmp al, bl
je 0x1400d2d2f
mov r12b, 1
jmp 0x1400d2dcb
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14012a418]
mov r8d, 3
call fcn.140065d7c
cmp al, bl
jne 0x1400d3066
lea rdx, [rsp + 0x1c8]
lea rcx, [0x140121f6c]
mov r8d, 5
call fcn.140065d7c
cmp al, bl
je 0x1400d2d76
mov byte [rsp + 0x50], 1
jmp 0x1400d2dcb
mov rcx, qword [rsp + 0x1c8]
movzx eax, word [rcx]
cmp ax, bx
je 0x1400d2dbe
mov edx, 0x20
lea ebp, [rdx - 0x1e]
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x1400d2d9e
cmp ax, 0xd
jbe 0x1400d2db6
cmp dx, ax
je 0x1400d2db6
add rcx, rbp
mov qword [rsp + 0x1c8], rcx
mov ax, word [rcx]
cmp ax, bx
jne 0x1400d2d92
mov rbp, qword [rsp + 0xe0]
lea rcx, [rsp + 0x1c8]
call fcn.14005aec8
mov rax, qword [rsp + 0x1c8]
mov ecx, 0x2d
cmp cx, word [rax]
je 0x1400d2a8f
lea rdx, [rsp + 0x1c8]
lea rcx, str._quick
mov r8d, 6
call fcn.140065d7c
mov rsi, qword [rsp + 0x1c0]
movzx ecx, r12b
mov r13d, 1
cmp al, bl
lea r8, [rsp + 0x58]
cmovne ecx, r13d
lea r12d, [r13 + 0x2b]
lea rdx, [rsp + 0x1c8]
mov dword [rsp + 0x10c], ecx
mov rcx, rsi
mov r9d, r12d
mov qword [rsp + 0x1c8], rbp
mov word [rsp + 0x20], bx
call fcn.140054460
cmp word [rax], r12w
jne 0x1400d36b9
mov rax, qword [rsp + 0x58]
cmp word [rax], bx
je 0x1400d36b9
lea edx, [r13 + 0x25]
movzx ecx, r15b
lea r8, [rsp + 0x88]
cmp dx, word [rax]
mov rdx, qword [rsp + 0x1c8]
movzx eax, r14b
cmove ecx, r13d
mov byte [rsp + 0x20], r13b
cmp cl, bl
mov dword [rsp + 0x84], ecx
mov rcx, rsi
cmovne eax, ebx
xor r9d, r9d
mov dword [rsp + 0xc0], eax
call fcn.14007bba4
mov r11, qword [rsp + 0x88]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x1c8], r11
call fcn.140074228
mov rax, qword [rsp + 0xd8]
cmp rax, rbx
mov qword [rsp + 0xb8], rax
jl 0x1400d36b9
mov rax, qword [rsp + 0x1c8]
lea rbp, [r13 - 5]
mov byte [rsp + 0x60], bl
lea ecx, [rbp + 0x27]
mov qword [rsp + 0x1d8], rbp
lea esi, [rbp + 6]
cmp cx, word [rax]
jne 0x1400d2f4a
add rax, rsi
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x1c8], rax
call fcn.14005aec8
mov rax, qword [rsp + 0x1c8]
lea ecx, [rbp + 0x2e]
lea rdx, [rsp + 0x1d8]
cmp cx, word [rax]
lea rcx, [rsp + 0x1c8]
sete byte [rsp + 0x60]
call fcn.140074228
mov rbp, qword [rsp + 0x1d8]
lea rcx, [rsp + 0x1c8]
mov r8d, 0x3b
mov edx, r12d
call fcn.14005b0c8
mov rcx, qword [rsp + 0x1c8]
cmp word [rcx], bx
je 0x1400d2f78
add rcx, rsi
mov qword [rsp + 0x1c8], rcx
mov r15, qword [rsp + 0xd0]
cmp r15, rbx
jl 0x1400d2f8c
cmp rbp, r15
cmovg rbp, r15
lea rcx, [rsp + 0x1c8]
call fcn.14005aec8
mov rcx, qword [rsp + 0x1c8]
call fcn.140018bf8
mov r13, qword [rsp + 0x1c8]
lea rcx, [0x14012a410]
mov rdx, r13
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0x140], rbx
call fcn.14005c518
mov byte [rsp + 0x1d8], al
cmp al, bl
jne 0x1400d301e
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xe8]
call fcn.1400679a0
cmp eax, ebx
je 0x1400d301e
mov rcx, qword [rsp + 0xe8]
cmp bx, word [rcx]
je 0x1400d3009
cmp r12w, word [rcx]
jne 0x1400d301e
mov rax, qword [rsp + 0x48]
mov byte [rsp + 0x1d8], sil
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x100], r13
cmp word [r13], bx
jne 0x1400d35f0
lea rcx, [rsp + 0x58]
call fcn.14005aef8
lea rcx, [rsp + 0x88]
call fcn.14005aef8
cmp rdi, rbx
je 0x1400d305c
cmp rdi, 0xffffffffffffffff
je 0x1400d305c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
jmp 0x1400d36eb
mov r11, qword [rsp + 0x1c8]
mov eax, 1
mov byte [rsp + 0x64], al
mov r14b, al
mov byte [rsp + 0x60], al
mov eax, 0x2d
cmp ax, word [r11]
jne 0x1400d2de1
mov esi, dword [rsp + 0x78]
mov r15d, dword [rsp + 0x108]
mov rdi, rbx
mov r14d, eax
movzx eax, word [r11 + 2]
cmp ax, bx
je 0x1400d34c3
mov r8d, 9
cmp r8w, ax
ja 0x1400d30c3
cmp ax, 0xd
jbe 0x1400d34c3
mov edx, 0x20
cmp dx, ax
je 0x1400d34c3
lea ecx, [rdx + 0xc]
cmp ax, cx
je 0x1400d34c3
movzx eax, word [r11]
mov rcx, r11
mov qword [rsp + 0xb8], rcx
cmp ax, bx
je 0x1400d311f
lea r14d, [rdx - 0x1e]
cmp r8w, ax
ja 0x1400d3101
cmp ax, 0xd
jbe 0x1400d3111
cmp dx, ax
je 0x1400d3111
add rcx, r14
mov ax, word [rcx]
cmp ax, bx
jne 0x1400d30f5
mov qword [rsp + 0xb8], rcx
mov r14d, 0x2d
lea rcx, [rsp + 0xb8]
call fcn.14005aec8
lea rcx, [0x14012a408]
mov r8d, 4
mov rdx, r11
call fcn.14005c4dc
cmp al, bl
je 0x1400d318a
add r11, 8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.140074228
cmp eax, ebx
jle 0x1400d34a9
movsxd rbp, dword [rsp + 0x48]
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x118], rbp
jmp 0x1400d34a9
mov ebp, 5
lea rcx, str._ibs
mov rdx, r11
mov r8d, ebp
call fcn.14005c4dc
cmp al, bl
je 0x1400d31e2
add r11, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.140074228
cmp eax, ebx
jle 0x1400d34a9
movsxd rax, dword [rsp + 0x48]
mov qword [rsp + 0x118], rax
jmp 0x1400d34a9
lea rcx, str._obs
mov r8d, ebp
mov rdx, r11
call fcn.14005c4dc
cmp al, bl
je 0x1400d3235
add r11, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.140074228
cmp eax, ebx
jle 0x1400d34a9
movsxd rax, dword [rsp + 0x48]
mov qword [rsp + 0x110], rax
jmp 0x1400d34a9
lea rcx, str._count
mov r8d, 7
mov rdx, r11
call fcn.14005c4dc
cmp al, bl
je 0x1400d328b
add r11, 0xe
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.140074228
cmp eax, ebx
jle 0x1400d34a9
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc8], rax
jmp 0x1400d34a9
lea rcx, [0x14012a3e8]
mov r8d, ebp
mov rdx, r11
call fcn.14005c4dc
cmp al, bl
je 0x1400d32de
add r11, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.140074228
cmp eax, ebx
jle 0x1400d34a9
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xd0], rax
jmp 0x1400d34a9
mov ebp, 6
lea rcx, str._conv
mov rdx, r11
mov r8d, ebp
call fcn.14005c4dc
cmp al, bl
je 0x1400d336f
add r11, 0xc
lea r8d, [rbp + 1]
lea rcx, str.notrunc
mov rdx, r11
mov qword [rsp + 0x1c8], r11
call fcn.14005c4dc
movzx esi, sil
cmp al, bl
lea eax, [rbp - 5]
cmovne esi, eax
movzx eax, word [r11]
cmp ax, bx
je 0x1400d34a9
lea ecx, [rbp + 0x1a]
lea r8d, [rbp + 3]
cmp r8w, ax
ja 0x1400d3348
cmp ax, 0xd
jbe 0x1400d34a9
cmp cx, ax
je 0x1400d34a9
mov eax, 2
add r11, rax
mov qword [rsp + 0x1c8], r11
mov ax, word [r11]
cmp ax, bx
jne 0x1400d3338
jmp 0x1400d34a9
lea rcx, [0x14012a3d0]
mov r8d, ebp
mov rdx, r11
call fcn.14005c4dc
cmp al, bl
je 0x1400d33be
add r11, 0xc
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.140074228
cmp eax, ebx
jle 0x1400d34a9
mov r13, qword [rsp + 0x48]
jmp 0x1400d34a9
lea rcx, str._skipb
mov r8d, 7
mov rdx, r11
call fcn.14005c4dc
cmp al, bl
je 0x1400d340f
add r11, 0xe
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov r13, rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.140074228
cmp eax, ebx
jle 0x1400d34a9
mov rdi, qword [rsp + 0x48]
jmp 0x1400d34a9
lea rdx, [rsp + 0x1c8]
lea rcx, str._sparse
mov r8d, 7
call fcn.140065d7c
cmp al, bl
je 0x1400d3438
mov eax, 1
mov byte [rsp + 0x41], al
jmp 0x1400d34a9
lea rdx, [rsp + 0x1c8]
lea rcx, str._quick
mov r8d, ebp
call fcn.140065d7c
cmp al, bl
je 0x1400d345d
mov eax, 1
mov r12b, al
jmp 0x1400d34a9
lea rdx, [rsp + 0x1c8]
lea rcx, str._qspace
mov r8d, 7
call fcn.140065d7c
cmp al, bl
je 0x1400d3480
mov r12b, 0x10
jmp 0x1400d34a9
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14012a428]
mov r8d, 3
call fcn.140065d7c
movzx r15d, r15b
cmp al, bl
mov eax, 1
cmovne r15d, eax
mov r11, qword [rsp + 0xb8]
mov qword [rsp + 0x1c8], r11
cmp r14w, word [r11]
je 0x1400d309f
mov rbp, qword [rsp + 0xe0]
mov r14b, byte [rsp + 0x60]
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0x108], r15d
mov r15b, byte [rsp + 0x1d8]
cmp rdi, rbx
mov rdi, qword [rsp + 0xb0]
mov dword [rsp + 0x78], esi
jge 0x1400d2de1
mov rsi, qword [rsp + 0x118]
imul rsi, r13
cmp rsi, rbx
cmovl rsi, rbx
mov qword [rsp + 0xf0], rsi
jmp 0x1400d2de1
mov rcx, qword [rsp + 0x1c8]
mov qword [rsp + 0x100], rcx
movzx eax, word [rcx]
cmp ax, bx
je 0x1400d3575
mov edx, 0x20
lea edi, [rdx - 0x1e]
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x1400d3555
cmp ax, 0xd
jbe 0x1400d356d
cmp dx, ax
je 0x1400d356d
add rcx, rdi
mov qword [rsp + 0x1c8], rcx
mov ax, word [rcx]
cmp ax, bx
jne 0x1400d3549
mov rdi, qword [rsp + 0xb0]
lea rcx, [rsp + 0x1c8]
call fcn.14005aec8
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x1d8], rbx
call fcn.1400c14c4
mov rcx, qword [rsp + 0x1d8]
cmp rcx, 0xffffffffffffffff
je 0x1400d35b8
cmp rcx, rbx
je 0x1400d35b8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
call fcn.14005aef8
lea rcx, [rsp + 0x88]
call fcn.14005aef8
cmp rdi, rbx
je 0x1400d36eb
cmp rdi, 0xffffffffffffffff
je 0x1400d36eb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d36eb
lea rcx, [rsp + 0xe0]
mov edx, 1
mov qword [rsp + 0xe0], r13
call fcn.140079bb0
lea rcx, [rsp + 0x120]
mov rsi, rax
call fcn.140062fc4
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0x130], rbx
mov byte [rsp + 0x40], bl
mov r12, rbx
mov qword [rsp + 0xe8], rbx
movabs r14, 0x3fffffffffffffff
cmp byte [rsp + 0x94], bl
je 0x1400d381a
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0xe0]
call fcn.1400632a0
mov rcx, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rbx
call fcn.1400189c4
mov r12, rax
cmp rax, rbx
jne 0x1400d3716
lea rcx, [rsp + 0xe0]
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x120]
call fcn.14005aef8
lea rcx, [rsp + 0x58]
call fcn.14005aef8
lea rcx, [rsp + 0x88]
call fcn.14005aef8
cmp rdi, rbx
je 0x1400d36e4
cmp rdi, 0xffffffffffffffff
je 0x1400d36e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, 0xffffffff80070057
lea rcx, [rsp + 0x168]
call fcn.14005aef8
mov rax, rbx
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [rax + 0x18]
and rsi, r14
cmp rbp, rbx
mov r14, qword [rsp + 0xf0]
jle 0x1400d3733
lea rax, [r14 + rbp]
cmp rax, rsi
jle 0x1400d3740
mov rbp, rsi
sub rbp, r14
cmp rbp, rbx
cmovle rbp, rbx
cmp r15, rbx
jl 0x1400d374c
cmp r15, rbp
cmovl rbp, r15
lea rdx, [rbp + 0x200000]
lea rcx, [rsp + 0x120]
call fcn.1400630a4
mov r11, qword [rsp + 0x120]
cmp r11, rbx
jne 0x1400d3799
lea rcx, [rsp + 0xe0]
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x120]
call fcn.14005aef8
jmp 0x1400d3031
mov rdx, qword [r12 + 8]
lea r13, [r11 + 0x100000]
mov qword [rsp + 0xe8], rbp
and r13, 0xfffffffffff00000
cmp r14, rsi
mov qword [rsp + 0x128], rbp
cmovg r14, rsi
mov qword [rsp + 0xa8], r13
mov r12, rbp
add rdx, r14
cmp rbp, rbx
mov qword [rsp + 0xf0], r14
jle 0x1400d37ee
cmp r13, rdx
je 0x1400d37ee
mov r8, rbp
mov rcx, r13
call fcn.14001d790
mov eax, 1
lea rcx, [rsp + 0xe0]
mov byte [rsp + 0x40], al
mov byte [rsp + 0x70], al
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400d39e3
cmp rsi, rbx
je 0x1400d39e3
mov edx, 2
lea rax, [rsi + 2]
lea ecx, [rdx + 0x1e]
mov byte [rsp + 0x70], dl
mov byte [rsp + 0x40], dl
mov dword [rsp + 0x150], ecx
lea ecx, [rdx + 0x2c]
mov qword [rsp + 0xe8], rax
cmp cx, word [rax]
jne 0x1400d3864
add rax, rdx
mov dword [rsp + 0x150], 0x40
mov qword [rsp + 0xe8], rax
lea r8, str.EXEDATA
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0xe8]
call fcn.1400d0498
mov r9, qword [rsp + 0xe0]
mov rcx, qword [0x14013cf70]
movzx r13d, word [rsi]
mov r14, rax
mov eax, 0x2e
mov word [rsi], bx
cmp ax, word [r9]
jne 0x1400d38b4
cmp word [r9 + 2], bx
jne 0x1400d38b4
mov rcx, qword [0x14013ca68]
jmp 0x1400d38cf
cmp word [r9], bx
je 0x1400d38cf
xor edx, edx
mov rcx, r9
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
mov rcx, rax
mov word [rsi], r13w
cmp rcx, rbx
je 0x1400d3902
mov rdx, qword [rsp + 0x138]
lea rax, [rsp + 0x150]
lea r9, [rsp + 0x120]
mov r8, r14
mov qword [rsp + 0x20], rax
call fcn.14001ea88
mov rsi, rax
jmp 0x1400d390a
mov rsi, qword [rsp + 0xa8]
cmp r12, rbx
je 0x1400d3918
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp rsi, rbx
je 0x1400d3787
cmp rbp, rbx
mov r12, qword [rsp + 0x128]
mov r13, qword [rsp + 0xf0]
jle 0x1400d3940
lea rax, [r13 + rbp]
cmp rax, r12
jle 0x1400d394d
mov rbp, r12
sub rbp, r13
cmp rbp, rbx
cmovle rbp, rbx
lea rdx, [r12 + 0x200000]
lea rcx, [rsp + 0x120]
call fcn.1400630a4
mov rsi, qword [rsp + 0x120]
cmp rsi, rbx
je 0x1400d3787
lea rcx, [r12 + rsi]
xor edx, edx
mov r8d, 0x1ff
call fcn.140101f00
cmp r13, r12
cmovg r13, r12
add rsi, r13
cmp r15, rbx
mov qword [rsp + 0xf0], r13
jl 0x1400d39a2
cmp r15, rbp
cmovl rbp, r15
lea r13, [rsi + 0x100000]
mov qword [rsp + 0x128], rbp
mov r12, rbp
and r13, 0xfffffffffff00000
cmp rbp, rbx
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xa8], r13
jle 0x1400d39e3
cmp r13, rsi
je 0x1400d39e3
mov r8, rbp
mov rdx, rsi
mov rcx, r13
call fcn.14001d790
mov r15, qword [rsp + 0x98]
mov byte [rsp + 0x138], bl
mov r14, rbx
mov rsi, rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0xa0], r15
cmp byte [rsp + 0x108], bl
je 0x1400d3a23
mov edx, 2
lea rcx, str.SeManageVolumePrivilege
lea r8d, [rdx + 0x3e]
call fcn.14001c318
cmp r15, rbx
mov r9d, 1
mov dword [rsp + 0x80], 0x200
movzx eax, r9b
mov dword [rsp + 0x6c], ebx
mov qword [rsp + 0xe0], rbx
cmovne eax, ebx
mov r13, rbx
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x64]
cmp al, bl
je 0x1400d3a7b
cmp byte [rsp + 0x78], bl
lea r10d, [r9 + 1]
movzx eax, al
sete byte [rsp + 0x138]
cmp byte [rsp + 0x40], bl
cmove eax, r10d
mov dword [rsp + 0x64], eax
cmp byte [rsp + 0x84], bl
je 0x1400d3b58
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x78]
call fcn.1400632a0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call fcn.1400189c4
cmp rax, rbx
jne 0x1400d3acc
lea rcx, [rsp + 0x78]
jmp 0x1400d369a
mov r13, qword [rax + 0x18]
mov rcx, qword [rax + 8]
movabs rax, 0x3fffffffffffffff
and r13, rax
mov qword [rsp + 0xe0], rcx
jle 0x1400d3ac2
cmp byte [rsp + 0x40], bl
je 0x1400d3b37
mov rax, qword [rsp + 0xd8]
sub r13, rax
cmp r13, rbp
cmovg r13, rbp
cmp r13, rbx
jle 0x1400d3b1b
mov rdx, qword [rsp + 0xa8]
add rcx, rax
mov r8, r12
call fcn.14001d790
lea rcx, [rsp + 0x78]
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400d53e5
lea rcx, [rsp + 0x78]
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12d, dword [rsp + 0x6c]
jmp 0x1400d3dd1
cmp byte [rsp + 0x50], bl
je 0x1400d3b66
mov eax, ebx
mov dword [rsp + 0x6c], ebx
jmp 0x1400d3b8a
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.14006c950
movsx eax, al
cmp eax, ebx
mov dword [rsp + 0x6c], eax
jl 0x1400d36ac
mov r9d, 1
mov edx, dword [rsp + 0xc0]
cmp dl, bl
jne 0x1400d3bf1
cmp eax, ebx
jne 0x1400d3bec
mov rax, qword [rsp + 0x58]
mov r8d, 0x5c
cmp r8w, word [rax]
jne 0x1400d3bec
cmp r8w, word [rax + 2]
jne 0x1400d3bec
movzx ecx, word [rax + 4]
lea r10d, [r8 - 0x1d]
cmp r10w, cx
je 0x1400d3bc8
lea eax, [r8 - 0x2e]
cmp ax, cx
jne 0x1400d3bec
mov rax, qword [rsp + 0x58]
cmp r8w, word [rax + 6]
jne 0x1400d3bec
cmp r10w, cx
jne 0x1400d3bf1
cmp r10w, word [rax + 8]
jne 0x1400d3bf1
mov ecx, 0x3a
cmp cx, word [rax + 0xa]
jne 0x1400d3bf1
mov r12b, bl
jmp 0x1400d3c6d
mov r12b, r9b
cmp dl, bl
jne 0x1400d3c1d
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.140101344
movzx ecx, byte [rsp + 0xc0]
cmp eax, ebx
mov eax, 0x20
cmovne ecx, eax
mov byte [rsp + 0xc0], cl
cmp r15, rbx
jne 0x1400d3cbc
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x48]
or r8d, 0xc0000000
mov r9d, 7
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov rsi, qword [rsp + 0x48]
mov r15, rax
mov qword [rsp + 0xa0], rax
cmp r15, rbx
jne 0x1400d3cb7
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov eax, 3
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x48]
or r8d, 0xc0000000
mov r9d, eax
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov rsi, qword [rsp + 0x48]
mov r15, rax
mov qword [rsp + 0xa0], rax
cmp r12b, bl
je 0x1400d3d22
mov r12d, dword [rsp + 0x6c]
cmp byte [rsp + 0x64], bl
je 0x1400d3d27
cmp r12d, ebx
jg 0x1400d3d27
cmp r15, rbx
jne 0x1400d3d75
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x48]
or r8d, 0xc0000000
mov r9d, 3
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov rsi, qword [rsp + 0x48]
mov r15, rax
mov qword [rsp + 0xa0], rax
jmp 0x1400d3d27
mov r12d, dword [rsp + 0x6c]
cmp r15, rbx
jne 0x1400d3d75
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov ecx, 3
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
mov dword [rsp + 0x28], ecx
mov r9d, ecx
lea rcx, [rsp + 0x48]
or r8d, 0xc0000000
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov rsi, qword [rsp + 0x48]
mov r15, rax
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x148]
cmp rax, rbx
je 0x1400d3da9
cmp rsi, rbx
je 0x1400d3da9
mov rcx, qword [rsp + 0x1c0]
lea r9, [0x14011c710]
mov r8, rax
mov rdx, rsi
call fcn.1400665bc
mov rsi, rbx
mov qword [rsp + 0x48], rbx
cmp r12d, ebx
je 0x1400d3dd1
cmp r15, rbx
je 0x1400d3dd1
mov edx, 0x200
mov rcx, r15
call fcn.14005f5d4
mov ecx, 0x200
cmp eax, ecx
cmovl eax, ecx
mov dword [rsp + 0x80], eax
mov ecx, r12d
neg ecx
mov ecx, 2
sbb eax, eax
and eax, dword [rsp + 0x80]
mov dword [rsp + 0x78], eax
cmp byte [rsp + 0x64], cl
jne 0x1400d4d28
mov rcx, qword [rsp + 0x118]
cmp rcx, rbx
jle 0x1400d4257
cmp qword [rsp + 0x110], rbx
jle 0x1400d4257
mov rbp, qword [rsp + 0xd0]
cmp rbp, rbx
jl 0x1400d3e32
lea rax, [rcx + rbp - 1]
cqo
idiv rcx
mov qword [rsp + 0xc8], rax
jmp 0x1400d3e65
mov rax, qword [rsp + 0xc8]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jne 0x1400d3e56
mov rbp, rdx
mov qword [rsp + 0xd0], rdx
jmp 0x1400d3e65
mov rbp, rcx
imul rbp, rax
mov qword [rsp + 0xd0], rbp
mov rcx, qword [rsp + 0x100]
call fcn.14001be60
lea rcx, [rsp + 0x78]
mov rdx, rax
call fcn.14006ff14
mov r8d, dword [rsp + 0x84]
mov rax, qword [rsp + 0x118]
cmp r8b, bl
mov qword [rsp + 0xa8], rax
jg 0x1400d3ecc
cmp r15, rbx
jne 0x1400d3ecc
lea rcx, [rsp + 0x78]
call fcn.14005aef8
cmp rsi, rbx
je 0x1400d3787
cmp rsi, 0xffffffffffffffff
je 0x1400d3787
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d3787
cmp byte [rsp + 0x10c], bl
je 0x1400d41ab
cmp r12d, ebx
jg 0x1400d41ab
cmp r8b, bl
jg 0x1400d41ab
cmp qword [rsp + 0x98], rbx
jne 0x1400d3f11
cmp rsi, rbx
je 0x1400d3f09
cmp rsi, 0xffffffffffffffff
je 0x1400d3f09
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, rbx
mov qword [rsp + 0x48], rbx
cmp byte [rsp + 0x41], bl
je 0x1400d3f23
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.14006c76c
cmp qword [rsp + 0x98], rbx
jne 0x1400d3fa6
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov esi, 0xc0000000
lea rcx, [rsp + 0x48]
mov r9d, 3
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov r15, rax
cmp rax, rbx
jne 0x1400d407a
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x48]
mov r9d, 3
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov rsi, qword [rsp + 0x48]
mov r15, rax
cmp r15, rbx
je 0x1400d3ea1
mov cl, byte [rsp + 0x1d8]
mov rdx, qword [rsp + 0xc8]
cmp cl, bl
je 0x1400d40aa
cmp rdx, rbx
jl 0x1400d40aa
mov rax, qword [rsp + 0x110]
imul rax, rdx
cmp rbp, rbx
jl 0x1400d3fe7
cmp rax, rbp
cmovg rax, rbp
mov rcx, qword [rsp + 0xd8]
lea rbp, [rax + rcx]
movabs rcx, 0x7fffffffffffffff
movabs rax, 0x7ffffffffffffdff
cmp rdx, rcx
cmovge rbp, rax
cmp byte [rsp + 0x138], bl
jne 0x1400d4041
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 2]
call fcn.14005c3c8
mov ecx, dword [rsp + 0x138]
cmp rax, rbp
movzx ecx, cl
mov eax, 1
cmovl ecx, eax
mov dword [rsp + 0x138], ecx
xor r8d, r8d
mov rdx, rbp
mov rcx, r15
call fcn.14005c3c8
cmp rax, rbp
movabs rax, 0x7fffffffffffffff
jne 0x1400d4084
mov rdx, qword [rsp + 0xc8]
cmp rdx, rax
jge 0x1400d40a3
lea rcx, [rsp + 0x78]
call fcn.14005aef8
jmp 0x1400d53e5
mov rsi, qword [rsp + 0x48]
jmp 0x1400d3faf
cmp qword [rsp + 0xc8], rax
jge 0x1400d409b
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.14005c3c8
mov rdx, qword [rsp + 0xc8]
mov cl, byte [rsp + 0x1d8]
mov r8d, dword [rsp + 0x84]
cmp rdx, rbx
jle 0x1400d4d04
cmp qword [rsp + 0xd0], rbx
jle 0x1400d4d04
mov dword [rsp + 0xc0], ebx
mov rax, rbx
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xe8], rbx
cmp cl, bl
jne 0x1400d40f2
mov byte [rsp + 0x41], 1
cmp byte [rsp + 0x40], bl
je 0x1400d40f6
mov byte [rsp + 0x41], bl
cmp r12d, ebx
jle 0x1400d4115
mov eax, dword [rsp + 0xd8]
cdq
idiv dword [rsp + 0x80]
movsxd rax, edx
mov qword [rsp + 0xb0], rax
mov rbp, qword [rsp + 0xd8]
sub rbp, rax
cmp rbp, rbx
jle 0x1400d41bf
cmp r8b, bl
jg 0x1400d41bf
xor r8d, r8d
mov rdx, rbp
mov rcx, r15
call fcn.14005c3c8
cmp rax, rbp
je 0x1400d41bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x78]
mov ebp, eax
call fcn.14005aef8
cmp rsi, rbx
je 0x1400d416b
cmp rsi, 0xffffffffffffffff
je 0x1400d416b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x120]
call fcn.14005aef8
lea rcx, [rsp + 0x58]
call fcn.14005aef8
lea rcx, [rsp + 0x88]
call fcn.14005aef8
cmp rdi, rbx
je 0x1400d41a3
cmp rdi, 0xffffffffffffffff
je 0x1400d41a3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rbp
jmp 0x1400d36eb
mov cl, byte [rsp + 0x1d8]
mov rdx, qword [rsp + 0xc8]
jmp 0x1400d40b2
mov r12, qword [rsp + 0x78]
mov eax, 0x26
mov qword [rsp + 0x158], rbx
cmp ax, word [r12]
mov qword [rsp + 0x148], rbx
mov rbp, rbx
sete al
mov qword [rsp + 0x98], rbx
mov byte [rsp + 0x50], al
cmp al, bl
je 0x1400d4336
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0xa0]
call fcn.1400632a0
mov rcx, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rbx
call fcn.1400189c4
cmp rax, rbx
jne 0x1400d4278
lea rcx, [rsp + 0xa0]
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x78]
call fcn.14005aef8
cmp rsi, rbx
je 0x1400d36ac
cmp rsi, 0xffffffffffffffff
je 0x1400d36ac
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d36ac
mov rcx, qword [rax + 8]
mov rax, qword [rax + 0x18]
movabs rdx, 0x3fffffffffffffff
and rax, rdx
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x148], rax
jg 0x1400d42c5
mov r14, 0xffffffff80070057
lea rcx, [rsp + 0xa0]
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400d406b
cmp byte [rsp + 0x84], bl
je 0x1400d4318
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xf0]
sub r13, r8
sub rax, r12
cmp r13, rdx
cmovg r13, rdx
cmp r13, rax
cmovg r13, rax
cmp r13, rbx
jle 0x1400d42a6
lea rdx, [rcx + r12]
mov rcx, qword [rsp + 0xe0]
add rcx, r8
mov r8, r13
call fcn.14001d790
jmp 0x1400d42a6
lea rcx, [rsp + 0xa0]
call fcn.14005aef8
lea rcx, [0x14013e190]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [rsp + 0x50]
cmp byte [rsp + 0x41], bl
je 0x1400d44c2
cmp al, bl
jg 0x1400d44c2
lea rcx, [rsp + 0x78]
call fcn.14006cab4
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rbx
mov r14d, 3
movsx r13d, al
mov dword [rsp + 0x30], ebx
mov r12d, 0x80000000
lea rcx, [rsp + 0x98]
mov r9d, r14d
mov r8d, r12d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0xc0], r13d
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov rbp, qword [rsp + 0x98]
cmp rbp, rbx
jne 0x1400d43e2
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x98]
mov r9d, r14d
mov r8d, r12d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov rbp, qword [rsp + 0x98]
cmp rbp, rbx
je 0x1400d3ea1
cmp r13d, ebx
je 0x1400d4400
mov edx, 0x200
mov rcx, rbp
call fcn.14005f5d4
mov ecx, eax
mov qword [rsp + 0xf8], rcx
jmp 0x1400d4405
mov ecx, 0x200
cmp r13d, ebx
mov r12, qword [rsp + 0xf0]
jle 0x1400d4425
mov eax, r12d
cdq
idiv ecx
movsxd rax, edx
mov qword [rsp + 0xe8], rax
jmp 0x1400d4428
mov rax, rbx
sub r12, rax
cmp r12, rbx
jle 0x1400d44c5
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call fcn.14005c3c8
cmp rax, r12
je 0x1400d44c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp rbp, rbx
je 0x1400d4464
cmp rbp, 0xffffffffffffffff
je 0x1400d4464
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x78]
call fcn.14005aef8
cmp rsi, rbx
je 0x1400d4482
cmp rsi, 0xffffffffffffffff
je 0x1400d4482
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x120]
call fcn.14005aef8
lea rcx, [rsp + 0x58]
call fcn.14005aef8
lea rcx, [rsp + 0x88]
call fcn.14005aef8
cmp rdi, rbx
je 0x1400d44ba
cmp rdi, 0xffffffffffffffff
je 0x1400d44ba
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r12
jmp 0x1400d36eb
mov r13d, ebx
cmp dword [rsp + 0x6c], ebx
jle 0x1400d44f6
movsxd r8, dword [rsp + 0x80]
mov rax, qword [rsp + 0x110]
lea rax, [r8 + rax - 1]
cqo
idiv r8
mov r9, rax
imul r9, r8
mov qword [rsp + 0x110], r9
jmp 0x1400d4506
mov r8d, dword [rsp + 0x80]
mov r9, qword [rsp + 0x110]
cmp r13d, ebx
jle 0x1400d4536
movsxd rcx, dword [rsp + 0xf8]
mov rax, qword [rsp + 0x118]
lea rax, [rcx + rax - 1]
cqo
idiv rcx
mov rdx, rax
imul rdx, rcx
mov qword [rsp + 0x118], rdx
jmp 0x1400d453e
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xf8]
lea rax, [rdx + r9]
cmp rdx, r9
mov r14, rdx
cmovne r14, rax
mov eax, ecx
add r14, 0x8000
cmp r8d, ecx
lea rcx, [rsp + 0x100]
cmovg eax, r8d
mov qword [rsp + 0xd8], r14
cdqe
lea r12, [rax + r14 + 0x2800]
lea rdx, [r12 + 0x100000]
call fcn.140063028
mov r13, qword [rsp + 0x100]
mov edx, dword [rsp + 0x140]
add r13, 0x100000
mov r8, r12
and r13, 0xfffffffffff00000
mov rcx, r13
mov qword [rsp + 0x160], r13
lea rax, [r13 + r14 + 0x2800]
mov qword [rsp + 0xa0], rax
call fcn.140101f00
mov r12, qword [rsp + 0xe8]
cmp r12, rbx
mov r9b, bl
mov r14, rbx
mov dword [rsp + 0x64], r9d
jle 0x1400d4642
mov r14, qword [rsp + 0xf8]
lea r9, [rsp + 0xa8]
mov rdx, r13
mov rcx, rbp
mov r8d, r14d
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rsp + 0xd0]
movsxd r14, r14d
sub r14, r12
sub rax, r14
mov qword [rsp + 0xd0], rax
jns 0x1400d462d
add r14, rax
lea rdx, [r13 + r12]
mov r8, r14
mov rcx, r13
call fcn.14001d790
mov r9d, dword [rsp + 0x64]
cmp qword [rsp + 0xb0], rbx
jle 0x1400d46f5
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call fcn.14005c3c8
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0xa0]
lea r9, [rsp + 0xa8]
mov rcx, r15
mov r12, rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rsp + 0xb0]
mov r8, r14
mov rdx, r13
lea rcx, [r13 + rax]
call fcn.14001d790
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa0]
mov rcx, r13
call fcn.14001d790
add r14, qword [rsp + 0xb0]
xor r8d, r8d
mov rdx, r12
mov rcx, r15
call fcn.14005c3c8
mov r9d, dword [rsp + 0x64]
cmp byte [rsp + 0x1d8], bl
movzx r9d, r9b
mov eax, 1
cmovne r9d, eax
mov dword [rsp + 0x64], r9d
jmp 0x1400d46fa
mov eax, 1
cmp r14, rbx
mov rcx, qword [rsp + 0xd0]
mov byte [rsp + 0x40], al
jle 0x1400d474b
mov r12, r13
mov rdx, qword [rsp + 0x110]
mov qword [rsp + 0xb0], r12
cmp r14, rdx
jge 0x1400d486c
cmp r14, rbx
jle 0x1400d4753
cmp r13, r12
je 0x1400d4753
mov r8, r14
mov rdx, r12
mov rcx, r13
call fcn.14001d790
mov al, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0x110]
cmp rcx, rbx
jle 0x1400d4847
cmp al, bl
je 0x1400d4847
cmp byte [rsp + 0x41], bl
je 0x1400d4c67
mov rax, qword [rsp + 0x118]
mov r8, rcx
cmp rax, rcx
mov rcx, qword [rsp + 0xd8]
cmovle r8, rax
lea rax, [r8 + r14]
cmp rax, rcx
jle 0x1400d4797
mov r8, rcx
sub r8, r14
mov rax, qword [rsp + 0xf8]
movsxd rdx, eax
add rdx, r8
dec eax
not eax
movsxd rcx, eax
and rdx, rcx
cmp dword [rsp + 0xc0], ebx
cmovg r8, rdx
cmp byte [rsp + 0x50], bl
je 0x1400d4814
mov r12, qword [rsp + 0x148]
mov rcx, qword [rsp + 0xf0]
sub r12, rcx
cmp r12, r8
cmovg r12, r8
cmp r8, rbx
jle 0x1400d47ff
mov rax, qword [rsp + 0x158]
mov r8, r12
lea rdx, [rcx + rax]
lea rcx, [r14 + r13]
call fcn.14001d790
mov rcx, qword [rsp + 0xf0]
add rcx, r12
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xf0], rcx
jmp 0x1400d483e
lea rdx, [r14 + r13]
lea r9, [rsp + 0xa8]
mov rcx, rbp
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [rsp + 0xa8]
cmp r12, rbx
jg 0x1400d4c4d
cmp r14, rbx
jle 0x1400d4cd2
mov r9d, dword [rsp + 0x64]
mov rdx, qword [rsp + 0x110]
mov byte [rsp + 0x40], bl
mov r12, r13
mov qword [rsp + 0xb0], r13
cmp rdx, r14
mov r8, r14
mov dword [rsp + 0x68], ebx
cmovle r8, rdx
cmp dword [rsp + 0x6c], ebx
mov qword [rsp + 0x98], r8
jle 0x1400d48a5
movsxd r10, dword [rsp + 0x80]
mov rax, r8
cqo
idiv r10
mov rax, rdx
mov qword [rsp + 0xc8], rdx
jmp 0x1400d48b8
mov r10d, dword [rsp + 0x80]
mov rax, rbx
mov qword [rsp + 0xc8], rbx
mov r13, r8
sub r13, rax
cmp r13, rbx
mov qword [rsp + 0x140], r13
jle 0x1400d4977
mov rdx, r12
cmp byte [rsp + 0x84], bl
je 0x1400d4906
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xe0]
mov r8, r13
add rcx, rax
call fcn.14001d790
add qword [rsp + 0xb8], r13
mov eax, r13d
jmp 0x1400d4b9e
lea r9, [rsp + 0x68]
mov r8d, r13d
mov rcx, r15
mov dword [rsp + 0x20], r10d
call fcn.140060cb4
cmp eax, ebx
jne 0x1400d4b9a
cmp byte [rsp + 0x90], bl
jne 0x1400d4a92
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
cmp eax, ebx
cmove eax, ecx
mov r14d, eax
lea rcx, [rsp + 0x100]
call fcn.14005aef8
cmp rbp, rbx
je 0x1400d406b
cmp rbp, 0xffffffffffffffff
je 0x1400d406b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d406b
cmp rax, rbx
jle 0x1400d4a46
mov rcx, qword [rsp + 0xa0]
movsxd r13, r10d
xor edx, edx
mov r8, r13
mov qword [rsp + 0x98], r13
call fcn.140101f00
sub r13, qword [rsp + 0xc8]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r15
call fcn.14005c3c8
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0xa0]
lea r9, [rsp + 0xa8]
mov rcx, r15
mov r12, rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xc8]
mov r8, r13
add rdx, rcx
mov rcx, qword [rsp + 0xb0]
add rcx, r14
call fcn.14001d790
xor r8d, r8d
mov rdx, r12
mov rcx, r15
add r14, r13
call fcn.14005c3c8
movzx r9d, byte [rsp + 0x64]
cmp byte [rsp + 0x1d8], bl
mov r13, qword [rsp + 0x140]
mov r8, qword [rsp + 0x98]
mov eax, 1
cmovne r9d, eax
mov dword [rsp + 0x64], r9d
cmp r8, rbx
mov r12, qword [rsp + 0xb0]
mov dword [rsp + 0x68], ebx
jle 0x1400d4c0e
lea r9, [rsp + 0x68]
mov rdx, r12
mov rcx, r15
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x1400d4c09
cmp byte [rsp + 0x90], bl
je 0x1400d4ccb
mov eax, 2
mov byte [rsp + 0x90], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [rsp + 0x90]
mov byte [rsp + 0x90], bl
mov byte [rsp + 0x42], al
mov dword [rsp + 0x68], ebx
cmp rsi, rbx
je 0x1400d4ac2
cmp rsi, 0xffffffffffffffff
je 0x1400d4ac2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov esi, 0xc0000000
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov r15, rax
cmp rax, rbx
jne 0x1400d4b64
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov r15, rax
cmp rax, rbx
jne 0x1400d4b64
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov r15, rax
mov eax, dword [rsp + 0x80]
lea r9, [rsp + 0x68]
mov r8d, r13d
mov rdx, r12
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.140060cb4
mov rsi, qword [rsp + 0x48]
cmp eax, ebx
je 0x1400d4930
mov eax, 2
cmp byte [rsp + 0x42], al
je 0x1400d4c09
mov eax, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
cmp eax, r13d
cmova eax, r13d
mov dword [rsp + 0x68], eax
cmp r9b, bl
je 0x1400d4bcc
mov r8d, eax
xor edx, edx
mov rcx, r12
call fcn.140101f00
mov eax, dword [rsp + 0x68]
mov r9b, bl
mov dword [rsp + 0x64], r9d
mov r8, qword [rsp + 0x98]
mov r10d, dword [rsp + 0x80]
sub r14, rax
sub r8, rax
mov rax, qword [rsp + 0xc8]
add r12, r13
mov qword [rsp + 0xb0], r12
mov byte [rsp + 0x90], bl
mov qword [rsp + 0x98], r8
jmp 0x1400d4977
mov r9d, dword [rsp + 0x64]
cmp r9b, bl
je 0x1400d4c2a
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, r12
call fcn.140101f00
mov r9b, bl
mov dword [rsp + 0x64], r9d
mov eax, dword [rsp + 0x68]
mov r13, qword [rsp + 0x160]
mov rcx, qword [rsp + 0xd0]
add r12, rax
sub r14, rax
mov al, byte [rsp + 0x40]
jmp 0x1400d470e
mov rcx, qword [rsp + 0xd0]
cmp r12, rcx
jle 0x1400d4ca0
mov r12, rcx
mov qword [rsp + 0xa8], rcx
jmp 0x1400d4ca0
cmp rdx, rcx
mov r12, rcx
mov rcx, qword [rsp + 0xd8]
cmovle r12, rdx
mov qword [rsp + 0xa8], r12
lea rax, [r14 + r12]
cmp rax, rcx
jle 0x1400d4c98
mov r12, rcx
sub r12, r14
mov qword [rsp + 0xa8], r12
mov rcx, qword [rsp + 0xd0]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
je 0x1400d4cba
sub rcx, r12
mov qword [rsp + 0xd0], rcx
mov r9d, dword [rsp + 0x64]
mov al, byte [rsp + 0x40]
add r14, r12
jmp 0x1400d470b
mov eax, 1
jmp 0x1400d4cd4
mov eax, ebx
cmp eax, ebx
jne 0x1400d4936
mov rax, qword [rsp + 0xd0]
cmp rax, rbx
jle 0x1400d4cfc
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jne 0x1400d4936
mov r14, rbx
jmp 0x1400d4949
mov rax, qword [rsp + 0xd8]
cmp rax, rbx
je 0x1400d406b
xor r8d, r8d
mov rdx, rax
mov rcx, r15
call fcn.14005c3c8
jmp 0x1400d406b
mov r12w, bx
mov qword [rsp + 0x100], r13
mov rax, rbx
mov qword [rsp + 0x1d8], rbx
mov dword [rsp + 0x90], r12d
cmp byte [rsp + 0x84], bl
jne 0x1400d4f14
mov eax, dword [rsp + 0x6c]
cmp eax, 0x11
jne 0x1400d4d8a
lea r8, [rsp + 0x100]
xor edx, edx
mov rcx, r15
call fcn.140079a94
cmp rax, rbx
mov qword [rsp + 0x1d8], rax
jl 0x1400d3eab
mov r13, qword [rsp + 0x100]
jmp 0x1400d4df0
cmp r15, rbx
je 0x1400d4df4
cmp eax, ebx
jne 0x1400d4dd2
mov r8d, ecx
xor edx, edx
mov rcx, r15
call fcn.14005c3c8
mov rcx, qword [rsp + 0xd8]
mov r13, rax
lea rax, [rcx - 0x400]
cmp r13, rax
jge 0x1400d4dcc
cmp qword [rsp + 0x98], rbx
jne 0x1400d4dcc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d4df0
mov eax, dword [rsp + 0x6c]
jmp 0x1400d4dfc
mov dl, al
mov rcx, r15
call fcn.140060bf8
mov r13, rax
cmp rax, rbx
movabs rax, 0x7fffffffffffffff
cmovl r13, rax
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0xd8]
cmp byte [rsp + 0x60], bl
je 0x1400d4e11
cmp ebp, 0xfffffffc
jne 0x1400d4e11
mov rbp, r13
sub rbp, rcx
cmovs rbp, rbx
cmp r15, rbx
jne 0x1400d4ed7
cmp eax, ebx
jne 0x1400d4ebf
cmp byte [rsp + 0x41], bl
je 0x1400d4e35
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.14006c76c
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov r13d, 3
mov esi, 0xc0000000
lea rcx, [rsp + 0x48]
mov r9d, r13d
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov r15, rax
mov qword [rsp + 0xa0], rax
cmp rax, rbx
jne 0x1400d4ecc
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x48]
mov r9d, r13d
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.140003888
mov r15, rax
mov qword [rsp + 0xa0], rax
cmp rax, rbx
jne 0x1400d4ecc
mov rsi, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x1400d4157
mov rsi, qword [rsp + 0x48]
mov eax, dword [rsp + 0x6c]
jmp 0x1400d4ee4
cmp byte [rsp + 0xc0], bl
je 0x1400d4eee
cmp eax, ebx
jne 0x1400d4ef2
movabs r13, 0x7fffffffffffffff
cmp eax, ebx
je 0x1400d4f0c
mov eax, dword [rsp + 0xd8]
xor edx, edx
div dword [rsp + 0x80]
mov r12d, edx
mov dword [rsp + 0x90], edx
mov rax, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0xd8]
mov qword [rsp + 0xf8], rbx
add rdx, rax
sub r13, rdx
mov qword [rsp + 0xb8], rdx
cmp byte [rsp + 0x84], bl
jne 0x1400d4f74
movzx eax, r12w
xor r8d, r8d
mov rcx, r15
sub rdx, rax
call fcn.14005c3c8
cmp rax, rbx
jge 0x1400d4f6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0xf8]
mov ebp, eax
call fcn.14005aef8
jmp 0x1400d4157
mov rdx, qword [rsp + 0xb8]
cmp byte [rsp + 0x70], bl
je 0x1400d4fdf
mov rax, qword [rsp + 0xe8]
cmp r13, rax
cmovg r13, rax
cmp byte [rsp + 0x84], bl
je 0x1400d4fb2
mov rcx, qword [rsp + 0xe0]
mov r8, r13
add rcx, rdx
mov rdx, qword [rsp + 0xa8]
call fcn.14001d790
jmp 0x1400d53ca
cmp r13, rbx
jle 0x1400d53ca
mov eax, dword [rsp + 0x78]
mov rdx, qword [rsp + 0xa8]
mov r8, r13
movzx r9d, r12w
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.140079cd0
jmp 0x1400d53ca
cmp rbp, rbx
jl 0x1400d4feb
cmp rbp, r13
cmovl r13, rbp
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x1c8], rdx
cmp byte [rsp + 0x42], bl
je 0x1400d5049
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0xf8]
mov r9, rax
mov r8, rax
call fcn.1400631dc
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
cmp rcx, r13
cmovg eax, r13d
cmp eax, ebx
jle 0x1400d53ca
mov rdx, qword [rsp + 0xf8]
movsxd r8, eax
mov eax, dword [rsp + 0x6c]
jmp 0x1400d4fca
mov eax, dword [rsp + 0x80]
lea rcx, [rsp + 0x140]
lea edx, [rax + rax]
call fcn.140063028
mov r9d, dword [rsp + 0x80]
mov r8b, byte [rsp + 0x71]
lea ecx, [r9 - 1]
mov rdx, r9
movzx eax, r12w
add rdx, qword [rsp + 0x140]
not ecx
sub r9d, eax
and rdx, rcx
cmp r13, rbx
mov r12, rbx
mov r10b, bl
mov byte [rsp + 0x42], bl
mov byte [rsp + 0x1d8], r8b
mov qword [rsp + 0x98], rdx
jle 0x1400d53bd
mov edi, dword [rsp + 0x78]
mov rsi, qword [rsp + 0xb8]
mov r11d, 0x30
cmp r12, rbx
mov rax, qword [rsp + 0x1c8]
jg 0x1400d50d3
cmp word [rax], bx
je 0x1400d53ad
movsxd r9, r9d
mov ebp, ebx
mov rcx, rbx
cmp r9, rbx
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0xe8], r9
jle 0x1400d53ad
mov dil, byte [rsp + 0x71]
mov r14d, 1
lea r15d, [r14 + 0x1f]
cmp r13, rbx
jle 0x1400d5328
cmp r12, rbx
jg 0x1400d52f6
cmp word [rax], bx
je 0x1400d5328
lea rcx, [rsp + 0x1c8]
call fcn.14005aec8
mov rcx, qword [rsp + 0x1c8]
mov edx, 0x2a
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0xb8], rbx
cmp dx, word [rcx]
jne 0x1400d51e5
lea eax, [rdx - 0x28]
lea rdx, [rsp + 0x100]
mov qword [rsp + 0x100], r14
add rcx, rax
mov qword [rsp + 0x1c8], rcx
lea rcx, [rsp + 0x1c8]
call fcn.140074228
mov rcx, qword [rsp + 0x1c8]
mov r12, qword [rsp + 0x100]
mov r8b, byte [rsp + 0x1d8]
mov r11d, 0x30
jmp 0x1400d51e0
cmp dx, ax
je 0x1400d52c3
mov edx, 0x28
cmp dx, ax
je 0x1400d521b
cmp ax, r11w
jb 0x1400d51bb
cmp ax, 0x39
jbe 0x1400d51ed
cmp r8b, bl
je 0x1400d51d0
or ax, r15w
cmp ax, 0x61
jb 0x1400d51d0
cmp ax, 0x7a
jbe 0x1400d51ed
mov eax, 2
add rcx, rax
mov qword [rsp + 0x1c8], rcx
mov edx, 0x2a
movzx eax, word [rcx]
cmp ax, bx
jne 0x1400d519c
cmp r11w, word [rcx]
jne 0x1400d523d
movzx eax, word [rcx + 2]
mov edx, 0x78
or ax, r15w
cmp dx, ax
jne 0x1400d523d
add rcx, 4
mov byte [rsp + 0x1d8], r14b
mov qword [rsp + 0x1c8], rcx
jmp 0x1400d5242
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0xb8], rbx
call fcn.140074228
jmp 0x1400d52c3
cmp r8b, bl
je 0x1400d5297
mov eax, 2
lea r8, [rsp + 0x10c]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0xb8], rbx
mov dword [rsp + 0x10c], eax
call fcn.140064788
mov r8, qword [rsp + 0x1c8]
mov ecx, 9
movzx eax, word [r8]
sub ax, 0x30
cmp ax, cx
jbe 0x1400d52b9
mov byte [rsp + 0x1d8], dil
jmp 0x1400d52b9
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x1c8]
call fcn.140074498
cmp eax, r14d
jl 0x1400d5320
mov r8, qword [rsp + 0x1c8]
cmp r8, qword [rsp + 0x160]
je 0x1400d5320
mov r10b, byte [rsp + 0xb8]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x158]
mov r8b, byte [rsp + 0x1d8]
mov r9, qword [rsp + 0xe8]
mov byte [rsp + 0x42], r10b
mov r11d, 0x30
mov byte [rdx + rcx], r10b
add rcx, r14
sub r12, r14
add ebp, r14d
sub r13, r14
cmp rcx, r9
mov qword [rsp + 0x158], rcx
jge 0x1400d5328
mov rax, qword [rsp + 0x1c8]
jmp 0x1400d5103
mov rdx, qword [rsp + 0x98]
cmp ebp, ebx
mov r15, qword [rsp + 0xa0]
mov r14d, dword [rsp + 0x90]
mov edi, dword [rsp + 0x78]
jle 0x1400d53ad
cmp byte [rsp + 0x84], bl
je 0x1400d5364
mov rcx, qword [rsp + 0xe0]
movsxd rbp, ebp
add rcx, rsi
mov r8, rbp
call fcn.14001d790
add rsi, rbp
jmp 0x1400d5377
movzx r9d, r14w
movsxd r8, ebp
mov rcx, r15
mov dword [rsp + 0x20], edi
call fcn.140079cd0
cmp r13, rbx
mov rdx, qword [rsp + 0x98]
mov r8b, byte [rsp + 0x1d8]
mov r10b, byte [rsp + 0x42]
mov r14w, bx
mov r9d, 0x200
mov dword [rsp + 0x90], r14d
mov r11d, 0x30
jg 0x1400d50bd
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0x48]
mov r14, rbx
lea rcx, [rsp + 0x140]
call fcn.14005aef8
cmp r15, rbx
je 0x1400d53d8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [rsp + 0xf8]
call fcn.14005aef8
cmp byte [rsp + 0x138], bl
je 0x1400d53fc
cmp r15, rbx
je 0x1400d53fc
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp byte [rsp + 0x108], bl
je 0x1400d545f
cmp r15, rbx
je 0x1400d545f
lea r8, [rsp + 0x1d8]
mov r9d, 2
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp eax, ebx
je 0x1400d545f
lea r8, [0x14013d380]
lea rdx, str.Kernel32.DLL
lea rcx, str.SetFileValidData
xor r9d, r9d
call fcn.14005c57c
mov r11, qword [0x14013d380]
cmp r11, rbx
je 0x1400d545f
mov rdx, qword [rsp + 0x1d8]
mov rcx, r15
call r11
cmp rsi, rbx
je 0x1400d5473
cmp rsi, 0xffffffffffffffff
je 0x1400d5473
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x120]
call fcn.14005aef8
lea rcx, [rsp + 0x58]
call fcn.14005aef8
lea rcx, [rsp + 0x88]
call fcn.14005aef8
cmp rdi, rbx
je 0x1400d54ab
cmp rdi, 0xffffffffffffffff
je 0x1400d54ab
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r14
jmp 0x1400d36eb