Function at 0x140044ee0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x68
sub esp, 0x68
mov rdi, rdx
mov rdx, qword [rdx + 8]
mov rsi, qword [rdi + 0x10]
mov rax, rdx
sub rax, rsi
jb 0x140045124
mov r8d, 0xffffffff
cmp rax, r8
cmovb r8, rax
cmovb eax, eax
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x34], 0
xor al, 0
add byte [rax], al
invalid
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x58], rax
lea rax, [0x140045400]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x40]
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x140044fac
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call sub.KERNEL32.dll_SleepEx
cmp dword [rsp + 0x34], 0
je 0x140044f50
mov edx, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3c]
mov rax, rdx
shl rax, 0x20
or rax, 2
xor r8d, r8d
rol byte [rbp - 0x6af0be2e], 0xc0
cmove rax, rcx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rax
je case.0x140044ddf.52
lea rsi, [rsp + 0x48]
mov ecx, eax
and ecx, 3
add ecx, dword [rax - 0x73]
adc eax, 0xb27461
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
loopne 0x140044fd5
or rax, 2
mov qword [rsp + 0x40], 1
and al, 0x40
add dword [rax], eax
add byte [rax], al
invalid
lea rsi, [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov ecx, eax
and ecx, 3
lea rdx, [0x140b6c404]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
movzx ecx, byte [rax + 0x10]
jmp case.0x140044da5.72
add rsi, rcx
mov qword [rdi + 0x10], rsi
mov rax, qword [rdi + 0x18]
cmp rax, rsi
cmova rsi, rax
mov qword [rdi + 0x18], rsi
jmp 0x14004504a
mov rcx, rax
shr rcx, 0x20
mov rdi, rax
call fcn.14004c1b0
mov ecx, eax
mov rax, rdi
jmp case.0x140044da5.72
mov rcx, rax
shr rcx, 0x20
invalid
invalid
cmp ecx, 0x28
ja case.default.0x140045033
add byte [rax], al
lea rdx, [0x140b6c414]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
xor ecx, ecx
jmp case.0x140044da5.72
movzx ecx, byte [rax + 0xf]
cmp cl, 0xb
jne 0x14004504c
mov rcx, rsi
mov ecx, esi
call fcn.1400056c0
invalid
xor eax, eax
ror byte [rax - 0x7d], 0xc4
add rsp, 0x68
push 0xffffffffb1c35e5f
pop rdi
pop rsi
ret
mov cl, 0x25
jmp case.0x140044da5.72
and eax, 0x23b1e6eb
mov cl, 0x23
jmp case.0x140044da5.72
mov cl, 0x24
jmp case.0x140044da5.72
mov cl, 0x1b
jmp case.0x140044da5.72
mov cl, 0x22
jmp case.0x140044da5.72
mov cl, 0x10
jmp case.0x140044da5.72
mov cl, 0xe
jmp case.0x140044da5.72
mov cl, 0x21
jmp case.0x140044da5.72
mov cl, 0xb
jmp case.0x140044da5.72
mov cl, 4
jmp case.0x140044da5.72
mov cl, 0x28
jmp case.0x140044da5.72
mov cl, 0xc
jmp case.0x140044da5.72
mov cl, 9
jmp case.0x140044da5.72
mov cl, 0x19
jmp case.0x140044da5.72
mov cl, 0x18
jmp case.0x140044da5.72
mov cl, 2
jmp case.0x140044da5.72
mov cl, 0xf
jmp case.0x140044da5.72
mov cl, 3
jmp case.0x140044da5.72
mov cl, 7
jmp case.0x140044da5.72
mov cl, 1
jmp case.0x140044da5.72
mov cl, 0x1f
jmp case.0x140044da5.72
mov cl, 0x11
jmp case.0x140044da5.72
mov cl, 0x29
jmp case.0x140044da5.72
mov cl, 0x14
jmp case.0x140044da5.72
invalid
mov dh, byte [rcx - 0x4e7914fb]
adc eax, 0xdb182eb
jmp case.0x140044da5.72
mov cl, 0xd
mov cl, 5
jmp case.0x140044da5.72
mov cl, 0x15
jmp case.0x140044da5.72
mov cl, 0xd
jmp case.0x140044da5.72
invalid
mov cl, 6
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x12
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0xa
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 8
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x1e
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x20
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x16
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x27
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x13
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x17
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x1c
jmp case.0x140044da5.72
invalid
invalid
invalid
mov cl, 0x1d
jmp case.0x140044da5.72
invalid
invalid
mov cl, 0x26
jmp case.0x140044da5.72
mov cl, 0x1a
jmp case.0x140044da5.72
lea r8, [0x140b6cd70]
mov rcx, rsi
call fcn.140089430
int3
mov eax, 1
jmp 0x1400453bc
cmp r12, rbx
jne 0x1400451dc
mov rcx, rdi
mov rdx, rsi
call fcn.14002e740
test rax, rax
jne 0x14004517f
test rdx, rdx
je 0x1400453b1
mov rbx, qword [rsi]
mov r12, qword [rsi + 0x10]
cmp r12, rbx
jne 0x140045220
mov r15, rbx
add r15, 0x20
jb 0x1400453a0
lea rax, [rbx + rbx]
cmp rax, r15
cmova r15, rax
test rbx, rbx
je 0x140045230
mov rax, qword [rsi + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rbx
mov eax, 1
jmp 0x140045232
mov rax, qword [rsi + 8]
jmp 0x14004526e
xor eax, eax
mov rdx, r15
not rdx
shr rdx, 0x3f
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x50]
mov r8, r15
lea r9, [rsp + 0x20]
call fcn.14000f8a0
cmp qword [rsp + 0x50], 0
jne 0x1400453cd
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rax
mov qword [rsi], r15
mov rbx, r15
add rax, r12
mov r15, rbx
sub r15, r12
cmp r15, rbp
cmovae r15, rbp
std
std
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], r14
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.140041ae0
mov rdx, rax
test rax, rax
lea r14, [rsp + 0x50]
jne 0x140045360
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov r14, rdx
invalid
sub r14, rcx
jb 0x1400453ee
invalid
mov rax, qword [rsp + 0x28]
and al, 0x28
cmp rdx, rax
ja 0x1400453dc
test rcx, rcx
je 0x140045394
add r12, rcx
cmp rdx, r15
mov rdx, 0xffffffffffffffff
cmovne rbp, rdx
lea rax, [rbp*2]
test rbp, rbp
cmovs rax, rdx
cmp r15, rbp
cmovb rax, rbp
mov qword [rsi + 0x10], r12
cmp rcx, r15
cmove rbp, rax
mov r15, qword [rsp + 0x48]
cmp rbx, r15
je 0x1400451b7
jmp 0x1400451dc
mov ecx, edx
and ecx, 3
mov eax, 1
movsxd rcx, dword [r13 + rcx*4]
add rcx, r13
jmp rcx
sub r12, qword [rsp + 0x40]
xor eax, eax
mov rdx, r12
jmp 0x1400453bc
mov eax, 1
movabs rdx, 0x2600000003
jmp 0x1400453bc
mov rdx, qword [rsi + 0x10]
sub rdx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rdx, 0x2600000003
jmp 0x14004517f
lea r8, [0x140b6f4e0]
mov rcx, rdx
mov rdx, rax
call fcn.1400894c0
lea r8, [0x140b6f4e0]
call fcn.140089550
int3
cmp qword [rsp + 0x260], 0
je 0x140047bc4
mov rcx, qword [rsp + 0x268]
test rcx, rcx
je 0x140047b9b
mov rdx, qword [rsp + 0x270]
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x2d8], 0
test byte [rax + rbx*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
mov word [rax + riz*8], fs
add al, byte [rax]
invalid
test byte [rax + rbx*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
mov word [rax + riz*8], fs
add al, byte [rax]
add byte [rax - 0x77], cl
xchg esp, eax
and al, 0xe8
add al, byte [rax]
add byte [rax - 0x39], cl
test byte [rax + rdi*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax - 0x77], cl
mov word [rax + rax], fs
add eax, dword [rax]
add byte [rax - 0x77], cl
xchg esp, eax
and al, 8
add eax, dword [rax]
add byte [rcx + 1], bh
mov qword [rsp + 0x2e8], rdx
mov qword [rsp + 0x2f8], 0
mov qword [rsp + 0x300], rcx
mov qword [rsp + 0x308], rdx
mov ecx, 1
jmp 0x140047b9f
xor ecx, ecx
xor eax, eax
mov qword [rsp + 0x2d0], rcx
mov qword [rsp + 0x2f0], rcx
mov qword [rsp + 0x310], rax
lea rcx, [rsp + 0x2d0]
call fcn.1400047f0
mov rax, qword [rsp + 0x1b8]
cmp dword [rax], 4
jb 0x140047bda
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x700]
add rsp, 0x718
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x140047ded
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.140002620
test sil, sil
je 0x140047b30
jmp 0x140047bc4
mov eax, 2
xor esi, esi
xor r13d, r13d
mov qword [rsp + 0x1a8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x140b9e1c0], cl
jne 0x140048e69
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x100], rbx
mov rax, qword [0x140b9e190]
dec r12
test rax, r12
mov dword [rsp + 0x10c], edi
je 0x140048a7a
call fcn.14003bb40
mov r13, r12
xor al, 1
jmp 0x140048a7f
call fcn.14000b790
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x140048c1b
mov r9, qword [rsp + 0xa0]
imul r8, r9, 0x38
mov rdx, qword [rax + r8 + 0x168]
cmp rdx, r12
je 0x140048c1b
shl r9, 5
mov rcx, qword [rax + r8 + 0x170]
mov rbx, qword [rax + r8 + 0x188]
mov r10, qword [rax + r8 + 0x190]
mov qword [rsp + 0x100], r10
mov r10, qword [rax + r8 + 0x198]
mov qword [rsp + 0x1a8], r10
mov r10, qword [rax + r9]
mov qword [rsp + 0x68], r10
mov r10, qword [rax + r9 + 8]
mov qword [rsp + 0x80], r10
mov rsi, qword [rax + r9 + 0x10]
mov rax, qword [rax + r8 + 0x178]
add rax, rcx
xor r11d, r11d
mov r8, rcx
jmp 0x14004838d
xor r11d, r11d
test r9w, r9w
je 0x1400486b4
mov r9w, 1
test r11w, r11w
jne 0x140048380
cmp r8, rax
je 0x140048448
movzx r11d, byte [r8]
test r11b, r11b
js 0x1400483b5
inc r8
mov r10d, r11d
jmp 0x14004843d
mov r10d, r11d
and r10d, 0x1f
movzx r13d, byte [r8 + 1]
and r13d, 0x3f
cmp r11b, 0xdf
jbe 0x140048403
mov r12, rbp
movzx ebp, byte [r8 + 2]
shl r13d, 6
and ebp, 0x3f
or ebp, r13d
cmp r11b, 0xf0
jb 0x140048410
movzx r11d, byte [r8 + 3]
add r8, 4
and r10d, 7
shl r10d, 0x12
shl ebp, 6
and r11d, 0x3f
or r11d, ebp
or r10d, r11d
jmp 0x14004841b
add r8, 2
shl r10d, 6
or r10d, r13d
jmp 0x14004843d
add r8, 3
shl r10d, 0xc
or r10d, ebp
cmp r10d, 0xffff
mov rbp, r12
jbe 0x14004843d
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x140048383
xor r11d, r11d
mov r9d, r10d
jmp 0x140048383
test rdx, rdx
je 0x140048458
mov r8d, 1
call fcn.140002620
mov rax, qword [rsp + 0x130]
sub rax, rdi
mov r8, qword [rsp + 0x1a8]
cmp rax, r8
cmp eax, eax
jae 0x140048498
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.1400103f0
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov r8, qword [rsp + 0x1a8]
mov r13, r8
add r8, r8
lea rcx, [rdi*2]
add rcx, rbp
mov r12, qword [rsp + 0x100]
mov rdx, r12
call sub.msvcrt.dll_memcpy
add rdi, r13
mov qword [rsp + 0x140], rdi
test rbx, rbx
je 0x1400484dd
add rbx, rbx
mov r8d, 2
mov rcx, r12
mov rdx, rbx
call fcn.140002620
cmp rdi, qword [rsp + 0x130]
movabs r12, 0x8000000000000000
jne 0x140048511
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.140010040
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov word [rbp + rdi*2], 0x3d
inc rdi
mov qword [rsp + 0x140], rdi
mov rax, qword [rsp + 0x80]
add rsi, rax
xor r8d, r8d
mov rbx, qword [rsp + 0x68]
jmp 0x140048544
xor r8d, r8d
test cx, cx
je 0x1400489f9
mov cx, 1
test r8w, r8w
jne 0x140048538
cmp rax, rsi
je 0x1400485ee
movzx r8d, byte [rax]
test r8b, r8b
js 0x140048568
inc rax
mov edx, r8d
jmp 0x1400485e4
mov edx, r8d
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp r8b, 0xdf
jbe 0x1400485b2
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r8b, 0xf0
jb 0x1400485be
movzx r8d, byte [rax + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
or edx, r8d
jmp 0x1400485c8
add rax, 2
shl edx, 6
or edx, r10d
jmp 0x1400485e4
add rax, 3
shl edx, 0xc
or edx, r9d
cmp edx, 0xffff
jbe 0x1400485e4
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x14004853b
xor r8d, r8d
mov ecx, edx
jmp 0x14004853b
cmp rbx, r12
je 0x140049341
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rsi
mov word [rsp + 0x1f0], 0
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x1e0]
call fcn.140019900
test rbx, rbx
je 0x140048649
mov r8d, 1
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.140002620
mov rdi, qword [rsp + 0x140]
cmp rdi, qword [rsp + 0x130]
jne 0x140048685
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.140010040
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
mov rdi, qword [rsp + 0x140]
jmp 0x140048695
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
and al, 0x90
add byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0xd0
add al, byte [rax]
add byte [rax - 0x75], cl
lodsb al, byte [rsi]
mov rbp, qword [rsp + 0x138]
mov word [rbp + rdi*2], 0
and al, 0x38
add dword [rax], eax
add byte [rsi - 0x39], ah
jge 0x1400486a2
add byte [rax], al
inc rdi
mov qword [rsp + 0x140], rdi
jmp 0x1400482ea
test rdx, rdx
je 0x1400486c4
mov r8d, 1
call fcn.140002620
mov rdx, qword [rsp + 0x68]
test rdx, rdx
mov rsi, qword [rsp + 0x100]
je 0x1400486e9
mov r8d, 1
mov rcx, qword [rsp + 0x80]
call fcn.140002620
lea rdi, [0x140b719f8]
test rbx, rbx
je 0x140048a1b
add rbx, rbx
mov r8d, 2
mov rcx, rsi
jmp 0x140048a13
lea rdi, [0x140b719f8]
test rbx, rbx
je 0x140048a1b
mov r8d, 1
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.140002620
xor esi, esi
lea rcx, [rsp + 0x2d0]
call fcn.1400047f0
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x140048a4d
mov rcx, qword [rsp + 0x138]
add rdx, rdx
mov r8d, 2
call fcn.140002620
mov rax, qword [rsp + 0x88]
mov qword [rax], rdi
mov qword [rax + 0x10], 2
jmp 0x1400492ee
mov r13, r12
xor eax, eax
lea rcx, [0x140b9e1c0]
movzx edx, byte [0x140b9e1c1]
xor r8d, r8d
test dl, dl
setne r8b
mov qword [rsp + 0x1e8], rcx
mov byte [rsp + 0x1f0], al
mov qword [rsp + 0x1e0], r8
mov qword [rsp + 0x288], 0
mov qword [rsp + 0x298], 0
mov qword [rsp + 0x2a8], 0
cmp byte [rsp + 0x1b0], 0
lea rax, [rsp + 0x110]
mov rdx, qword [rsp + 0x1b8]
cmovne rax, rdx
mov dword [rsp + 0x110], 2
mov r8, qword [rsp + 0x78]
lea rcx, [r8 + 0x58]
cmp dword [r8 + 0x58], 6
cmove rcx, rax
cmp dword [r8 + 0x68], 6
lea rbx, [r8 + 0x68]
cmove rbx, rdx
lea rdi, [r8 + 0x78]
cmp dword [r8 + 0x78], 6
cmove rdi, rdx
lea r8, [rsp + 0x288]
mov edx, 0xfffffff6
call fcn.140049cc0
mov r12, rdx
test rax, rax
je 0x140048b56
mov rax, qword [rsp + 0x88]
mov qword [rax], r12
mov qword [rax + 0x10], 2
jmp 0x140049206
lea r8, [rsp + 0x298]
mov rcx, rbx
mov edx, 0xfffffff5
call fcn.140049cc0
mov rbx, rdx
test rax, rax
je 0x140048c82
mov rax, qword [rsp + 0x88]
mov qword [rax], rbx
mov qword [rax + 0x10], 2
jmp 0x1400491e7
xor esi, esi
lea rcx, [rsp + 0x2d0]
call fcn.1400047f0
cmp rdi, qword [rsp + 0x130]
jne 0x140048c56
xor esi, esi
lea rcx, [rsp + 0x130]
mov rdx, rdi
call fcn.140010040
mov rbp, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov rax, rbp
mov qword [rsp + 0x80], rbp
mov word [rbp + rdi*2], 0
mov rbp, qword [rsp + 0x130]
cmp rbp, r12
jne 0x140048cd8
mov rdi, qword [rsp + 0x80]
jmp 0x140048a4d
lea r8, [rsp + 0x2a8]
mov rcx, rdi
mov edx, 0xfffffff4
call fcn.140049cc0
test rax, rax
je 0x140048e7a
mov rax, qword [rsp + 0x88]
mov qword [rax], rdx
mov qword [rax + 0x10], 2
jmp 0x1400491df
mov rbx, qword [rsp + 0x138]
mov edi, dword [rsp + 0x10c]
mov rcx, qword [rsp + 0x78]
cmp qword [rcx + 0x38], r12
je 0x140047f18
mov rax, qword [rcx + 0x40]
mov rcx, qword [rcx + 0x48]
add rcx, rax
xor r10d, r10d
mov rdx, rax
jmp 0x140048d16
xor r10d, r10d
test r8w, r8w
je 0x140048dca
mov r8w, 1
test r10w, r10w
jne 0x140048d09
cmp rdx, rcx
je 0x140048de9
movzx r10d, byte [rdx]
test r10b, r10b
js 0x140048d3e
inc rdx
mov r9d, r10d
jmp 0x140048dbf
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rdx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x140048d88
movzx r11d, byte [rdx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x140048d95
movzx r10d, byte [rdx + 3]
add rdx, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r9d, r10d
jmp 0x140048da0
add rdx, 2
shl r9d, 6
or r9d, esi
jmp 0x140048dbf
add rdx, 3
shl r9d, 0xc
or r9d, r11d
cmp r9d, 0xffff
jbe 0x140048dbf
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x140048d0c
xor r10d, r10d
mov r8d, r9d
jmp 0x140048d0c
lea rsi, [0x140b719f8]
mov rax, qword [rsp + 0x88]
mov qword [rax], rsi
mov qword [rax + 0x10], 2
jmp 0x1400492d5
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], rcx
mov word [rsp + 0x2e0], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x2d0]
call fcn.140019a80
mov r13, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
cmp rdx, r13
jne 0x140048e4a
lea rcx, [rsp + 0x90]
call fcn.140010040
mov r13, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov word [rsi + rdx*2], 0
mov rax, rsi
cmp r13, r12
jne 0x140047f22
jmp 0x140048dd1
lea rcx, [0x140b9e1c0]
call fcn.14004f220
jmp 0x140047f53
xorps xmm0, xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0x98], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xe8], xmm0
test rdx, rdx
jne 0x140048ebc
test rbx, rbx
jne 0x140048ebc
test r12, r12
je 0x140048edf
mov dword [rsp + 0xcc], 0x100
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xf0], rdx
mov rax, qword [rsp + 0x78]
mov rdi, qword [rax + 0xb8]
test rdi, rdi
mov qword [rsp + 0x1b0], rdx
je 0x140048fd4
add rax, 0xa8
mov dword [rsp + 0x90], 0x70
lea rcx, [rsp + 0x1c0]
mov rdx, rax
call fcn.14004a970
mov rcx, qword [rsp + 0x1c0]
test rcx, rcx
je 0x1400491b7
mov r8d, dword [rsp + 0x10c]
or r8d, 0x80000
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x280], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movups xmm2, xmmword [rsp + 0xb0]
movups xmm3, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x2d0], xmm0
movaps xmmword [rsp + 0x2e0], xmm1
movaps xmmword [rsp + 0x2f0], xmm2
movaps xmmword [rsp + 0x300], xmm3
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x310], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x320], xmm0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x338], rcx
lea rax, [rsp + 0x2d0]
jmp 0x140048fef
mov dword [rsp + 0x90], 0x68
lea rax, [rsp + 0x90]
mov r8d, dword [rsp + 0x10c]
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x14004917e
movaps xmm0, xmmword [rsp + 0x130]
mov rax, qword [rsp + 0x88]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rsp + 0x288]
movups xmm1, xmmword [rsp + 0x298]
movups xmm2, xmmword [rsp + 0x2a8]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm1
movups xmmword [rax + 0x30], xmm2
test rdi, rdi
je 0x14004908e
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x280]
call fcn.140006480
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
cmp dword [rsp + 0x110], 4
jb 0x1400490c2
mov rcx, qword [rsp + 0x118]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [rsp + 0x1e0]
call fcn.140004f30
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x1400490ef
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1a8]
call fcn.140002620
test rbp, rbp
je 0x14004910d
add rbp, rbp
mov r8d, 2
mov rcx, qword [rsp + 0x100]
mov rdx, rbp
call fcn.140002620
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x140049130
mov rcx, qword [rsp + 0x188]
add rdx, rdx
mov r8d, 2
call fcn.140002620
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x14004914d
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x70]
call fcn.140002620
test r15, r15
setne al
mov ecx, dword [rsp + 0x1a4]
xor cl, 1
test al, cl
je 0x140047bc4
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.140002620
jmp 0x140047bc4
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
test rdi, rdi
je 0x1400491d2
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x280]
call fcn.140006480
jmp 0x1400491d2
mov rax, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x88]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
cmp dword [rsp + 0x110], 4
jb 0x140049206
mov rcx, qword [rsp + 0x118]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x288], 0
je 0x14004921e
mov rcx, qword [rsp + 0x290]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x298], 0
je 0x140049236
mov rcx, qword [rsp + 0x2a0]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x2a8], 0
je 0x14004924e
mov rcx, qword [rsp + 0x2b0]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x1e0], 0
mov rsi, qword [rsp + 0x1e8]
movzx eax, byte [rsp + 0x1f0]
je 0x140049280
test al, al
jne 0x14004929d
mov rax, qword [0x140b9e190]
test rax, r13
je 0x14004929d
call fcn.14003bb40
jmp 0x140049295
test al, al
jne 0x14004929d
mov rax, qword [0x140b9e190]
test rax, r13
je 0x14004929d
call fcn.14003bb40
test al, al
jne 0x14004929d
mov byte [rsi + 1], 1
xor eax, eax
xchg byte [rsi], al
cmp al, 2
jne 0x1400492ad
mov rcx, rsi
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rdx, qword [rsp + 0x68]
test rdx, rdx
mov rbx, qword [rsp + 0x100]
je 0x1400492d5
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1a8]
call fcn.140002620
test rbp, rbp
je 0x1400492ee
add rbp, rbp
mov r8d, 2
mov rcx, rbx
mov rdx, rbp
call fcn.140002620
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x140049311
mov rcx, qword [rsp + 0x188]
add rdx, rdx
mov r8d, 2
call fcn.140002620
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x14004932e
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x70]
call fcn.140002620
mov sil, 1
cmp byte [rsp + 0x60], 0
je 0x140047bc4
jmp 0x140047dd4
mov rdi, qword [rsp + 0x80]
jmp 0x140048a1b