Function at 0x14001d9a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov edi, edx
mov r14, rcx
movabs rsi, 0xffffffff00000000
lea rcx, [0x140028870]
mov rdx, r14
call fcn.14001d3a0
mov rcx, r14
call fcn.140016b50
test eax, eax
je 0x14001da72
mov rbx, rcx
test rcx, rcx
je 0x14001da72
mov rcx, r14
call fcn.140016090
lea rcx, [0x1400280e8]
cmp rax, rcx
je 0x14001da72
mov cl, 1
cmp dword [rax + 4], 2
jne 0x14001da16
movzx ecx, word [rax + 0xc]
cmp ecx, 0x3f3f
setne cl
test cl, cl
je 0x14001da72
test edx, edx
je 0x14001da72
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xc0], rbx
mov dword [rsp + 0x2c], edi
movsxd rcx, edx
mov dword [rsp + 0x30], edx
mov eax, edx
mov qword [rsp + 0x38], rcx
and rcx, rsi
or rcx, rax
mov qword [rsp + 0xb8], rcx
xor r14d, r14d
lea r12, str._s_at__s:_d
lea rbp, [0x1400288a7]
lea rbx, [0x140026b48]
lea rdi, [0x140028070]
jmp 0x14001e28a
mov rcx, r14
call fcn.140016b50
mov qword [rsp + 0x30], rcx
test eax, eax
je 0x14001dacc
mov rbx, rdx
mov rcx, r14
call fcn.1400163a0
mov qword [rsp + 0x80], rcx
test eax, eax
je 0x14001dacc
test rbx, rbx
js 0x14001f02c
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x2c], edi
xor ebx, ebx
lea rbp, str._s__lld_in__s
lea r12, [0x1400288ca]
lea r15, [0x140026b9c]
lea rdi, [0x140028070]
jmp 0x14001db39
lea rcx, [0x140028118]
call fcn.140016f40
test edi, edi
jne 0x14001e8e7
jmp 0x14001f00b
cmp eax, 2
jne 0x14001f031
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x54]
nop word cs:[rax + rax]
call sub.KERNEL32.dll_WriteFile
inc ebx
jo 0x14001f02c
inc rbp
cmp rbp, r12
jae 0x14001e8db
xor r13d, r13d
nop dword [rax]
cmp byte [rbp + r13], 0x25
je 0x14001db60
lea rax, [rbp + r13 + 1]
inc r13
cmp rax, r12
jb 0x14001db40
jmp 0x14001db65
test r13, r13
je 0x14001dbca
add r13, rbp
mov r14, r13
sub r14, rbp
lea rax, [r14 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rbp
mov r8d, r14d
lea r9, [rsp + 0x68]
call sub.KERNEL32.dll_WriteFile
cmp byte [r13 + 1], 0x6c
jne 0x14001dbe0
lea rbp, [r13 + 2]
lea rax, [r13 + 3]
cmp byte [r13 + 2], 0x6c
sete r8b
cmove rbp, rax
cmp rbp, r12
jb 0x14001dbf0
jmp 0x14001e8db
mov r13, rbp
cmp byte [r13 + 1], 0x6c
je 0x14001dbab
nop word cs:[rax + rax]
nop
lea rbp, [r13 + 1]
xor r8d, r8d
cmp rbp, r12
jae 0x14001e8db
movzx eax, byte [rbp]
add eax, 0xffffff9c
cmp eax, 0x14
ja case.0x14001dc07.101
movsxd rax, dword [r15 + rax*4]
add rax, r15
jmp rax
lea eax, [rbx + 3]
test ebx, ebx
cmovns eax, ebx
test eax, eax
je 0x14001daee
cmp eax, 1
jne 0x14001dae5
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001e110
test ecx, ecx
setns r9b
test r8b, r8b
je 0x14001e197
lea r10, [rsp + 0x80]
nop word [rax + rax]
lea r13, [r10 - 1]
mov rax, rcx
movabs rdx, 0x6666666666666667
imul rdx
mov rax, rdx
shr rax, 0x3f
sar rdx, 2
add rdx, rax
lea rax, [rdx + rdx]
lea rax, [rax + rax*4]
mov r11, rcx
sub r11, rax
mov rax, r11
neg rax
cmovs rax, r11
movzx eax, byte [rax + rdi + 0xc]
mov byte [r10 - 1], al
add rcx, 9
cmp rcx, 0x13
mov rcx, rdx
mov r10, r13
jae 0x14001dc50
jmp 0x14001e1f9
mov r14, rbp
sub r14, r13
lea rax, [r14 - 0x7fffffff]
cmp rax, rsi
jb 0x14001f02c
inc r14
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r14d
lea r9, [rsp + 0xcc]
call sub.KERNEL32.dll_WriteFile
inc rbp
cmp rbp, r12
jb 0x14001db39
jmp 0x14001e8db
lea ecx, [rbx + 3]
test ebx, ebx
cmovns ecx, ebx
test ecx, ecx
mov rax, qword [rsp + 0x30]
je 0x14001dd26
cmp ecx, 1
je 0x14001de3a
cmp ecx, 2
mov rax, qword [rsp + 0x80]
jne 0x14001f031
test rax, rax
je 0x14001de3a
mov r14, rax
add r14, 0xc
mov r13d, dword [rax + 4]
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r14
mov r8d, r13d
lea r9, [rsp + 0x64]
jmp 0x14001db20
lea eax, [rbx + 3]
test ebx, ebx
cmovns eax, ebx
cmp eax, 3
jae 0x14001f031
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0xd0]
jmp 0x14001db20
lea eax, [rbx + 3]
test ebx, ebx
cmovns eax, ebx
test eax, eax
je 0x14001ddbf
cmp eax, 1
je 0x14001de67
cmp eax, 2
jne 0x14001f031
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x48]
jmp 0x14001db20
lea eax, [rbx + 3]
test ebx, ebx
cmovns eax, ebx
test eax, eax
je 0x14001de0a
cmp eax, 1
je 0x14001df95
cmp eax, 2
jne 0x14001f031
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0xd4]
jmp 0x14001db20
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x60]
jmp 0x14001db20
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001e13d
lea eax, [r8 + r8]
or al, 0xb8
test r8b, r8b
mov r8d, 0
cmovne r8, rcx
lea r13, [rsp + 0xb8]
cmp al, 0xb8
je 0x14001df00
and r8, rsi
movzx eax, al
cmp eax, 0xb9
jne 0x14001df40
mov eax, ecx
or r8, rax
je 0x14001e08b
mov rax, r8
movabs rcx, 0x6666666666666667
imul rcx
mov rcx, rdx
mov rax, rdx
shr rax, 0x3f
sar rcx, 2
add rcx, rax
lea rax, [rcx + rcx]
lea rax, [rax + rax*4]
sub r8, rax
mov rax, r8
neg rax
cmovs rax, r8
movzx eax, byte [rax + rdi + 0xc]
mov byte [r13 - 1], al
dec r13
mov al, 0xb9
mov r8, rcx
jmp 0x14001de90
test ecx, ecx
je 0x14001e08b
mov r8d, ecx
mov eax, 0xcccccccd
imul r8, rax
shr r8, 0x23
lea eax, [r8 + r8]
lea eax, [rax + rax*4]
sub ecx, eax
movzx eax, byte [rcx + rdi + 0xc]
mov byte [r13 - 1], al
dec r13
mov al, 0xb8
mov rcx, r8
jmp 0x14001de90
mov r9d, ecx
or r9, r8
je 0x14001e08b
mov rax, r9
movabs r10, 0xcccccccccccccccd
mul r10
shr rdx, 2
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*4]
sub r9, rax
movzx eax, byte [rdi + r9 + 0xc]
mov byte [r13 - 1], al
dec r13
and ecx, 0xfffffffe
or r8, rcx
mov rax, r8
mul r10
mov rcx, rdx
shr rcx, 3
mov al, 0xba
mov r8, rcx
jmp 0x14001de90
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14001e16a
lea r9d, [r8 + r8]
or r9b, 0xb8
test r8b, r8b
mov ecx, 0
cmovne rcx, rax
lea r13, [rsp + 0xa4]
nop
mov edx, eax
cmp r9b, 0xb8
je 0x14001e030
and rcx, rsi
movzx r8d, r9b
cmp r8d, 0xb9
jne 0x14001e060
or rdx, rcx
je 0x14001e0cc
and eax, 0xf
lea r8, [rcx + rax + 0xf]
or rcx, rax
cmovns r8, rcx
and r8, 0xfffffffffffffff0
sub rcx, r8
mov rax, rcx
neg rax
cmovs rax, rcx
movzx eax, byte [rax + rdi + 0xc]
mov byte [r13 - 1], al
dec r13
lea rax, [rdx + 0xf]
test rdx, rdx
cmovns rax, rdx
sar rax, 4
mov r9b, 0xb9
mov rcx, rax
jmp 0x14001dfc0
test rdx, rdx
je 0x14001e0cc
mov ecx, eax
and ecx, 0xf
movzx ecx, byte [rcx + rdi + 0xc]
mov byte [r13 - 1], cl
dec r13
shr eax, 4
mov r9b, 0xb8
mov rcx, rax
jmp 0x14001dfc0
or rdx, rcx
je 0x14001e0cc
mov edx, eax
and edx, 0xf
movzx edx, byte [rdx + rdi + 0xc]
mov byte [r13 - 1], dl
dec r13
and eax, 0xfffffff0
or rcx, rax
shr rcx, 4
mov r9b, 0xba
mov rax, rcx
jmp 0x14001dfc0
lea r14, [rsp + 0xb8]
sub r14, r13
lea rax, [r14 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r14d
lea r9, [rsp + 0x4c]
jmp 0x14001db20
lea r14, [rsp + 0xa4]
sub r14, r13
lea rax, [r14 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r14d
lea r9, [rsp + 0x8c]
jmp 0x14001db20
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140027794]
mov r8d, 1
lea r9, [rsp + 0x5c]
jmp 0x14001db20
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140027794]
mov r8d, 1
lea r9, [rsp + 0x50]
jmp 0x14001db20
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140027794]
mov r8d, 1
lea r9, [rsp + 0x44]
jmp 0x14001db20
test ecx, ecx
lea rdx, [rsp + 0x80]
mov r13, rdx
mov eax, ecx
mov rcx, rdx
je 0x14001e1f9
nop dword [rax + rax]
lea r13, [rcx - 1]
movsxd rdx, eax
imul rax, rdx, 0x66666667
mov r10, rax
shr r10, 0x3f
sar rax, 0x22
add eax, r10d
lea r10d, [rax + rax]
lea r10d, [r10 + r10*4]
mov r11d, edx
sub r11d, r10d
mov r10d, r11d
neg r10d
cmovs r10d, r11d
movzx r10d, byte [r10 + rdi + 0xc]
mov byte [rcx - 1], r10b
add edx, 9
cmp edx, 0x13
mov rcx, r13
jae 0x14001e1b0
or r8b, r9b
jne 0x14001e206
mov byte [r13 - 1], 0x2d
dec r13
lea r14, [rsp + 0x80]
sub r14, r13
lea rax, [r14 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r14d
lea r9, [rsp + 0x58]
jmp 0x14001db20
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x60]
nop
call sub.KERNEL32.dll_WriteFile
inc r14d
jo 0x14001f02c
inc r12
cmp r12, rbp
jae 0x14001e8db
xor r13d, r13d
nop dword [rax]
cmp byte [r12 + r13], 0x25
je 0x14001e2b0
lea rax, [r12 + r13 + 1]
inc r13
cmp rax, rbp
jb 0x14001e290
jmp 0x14001e2b5
test r13, r13
je 0x14001e319
add r13, r12
mov r15, r13
sub r15, r12
lea rax, [r15 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r12
mov r8d, r15d
lea r9, [rsp + 0x68]
call sub.KERNEL32.dll_WriteFile
cmp byte [r13 + 1], 0x6c
jne 0x14001e330
lea r12, [r13 + 2]
lea rcx, [r13 + 3]
cmp byte [r13 + 2], 0x6c
sete al
cmove r12, rcx
cmp r12, rbp
jb 0x14001e33f
jmp 0x14001e8db
mov r13, r12
cmp byte [r13 + 1], 0x6c
je 0x14001e2fb
nop word cs:[rax + rax]
nop dword [rax]
lea r12, [r13 + 1]
xor eax, eax
cmp r12, rbp
jae 0x14001e8db
movzx ecx, byte [r12]
add ecx, 0xffffff9c
cmp ecx, 0x14
ja case.0x14001e353.101
movsxd rcx, dword [rbx + rcx*4]
add rcx, rbx
jmp rcx
lea ecx, [r14 + 3]
test r14d, r14d
cmovns ecx, r14d
cmp ecx, 2
jae 0x14001e4e7
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x58]
jmp 0x14001e270
mov r15, r12
sub r15, r13
lea rax, [r15 - 0x7fffffff]
cmp rax, rsi
jb 0x14001f02c
inc r15
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r15d
lea r9, [rsp + 0x8c]
call sub.KERNEL32.dll_WriteFile
inc r12
cmp r12, rbp
jb 0x14001e28a
jmp 0x14001e8db
lea eax, [r14 + 3]
test r14d, r14d
cmovns eax, r14d
test eax, eax
je 0x14001e81a
cmp eax, 2
je 0x14001e247
cmp eax, 1
mov r13, qword [rsp + 0x80]
jne 0x14001f031
test r13, r13
jne 0x14001e82b
jmp 0x14001e247
lea eax, [r14 + 3]
test r14d, r14d
cmovns eax, r14d
cmp eax, 3
jae 0x14001f031
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x44]
jmp 0x14001e270
lea ecx, [r14 + 3]
test r14d, r14d
cmovns ecx, r14d
cmp ecx, 2
jae 0x14001e609
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x50]
jmp 0x14001e270
lea ecx, [r14 + 3]
test r14d, r14d
cmovns ecx, r14d
cmp ecx, 2
jae 0x14001e732
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x48]
jmp 0x14001e270
jne 0x14001f031
test al, al
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x80]
je 0x14001e570
mov rcx, qword [rsp + 0xb8]
lea r8, [rsp + 0x80]
nop dword [rax]
lea r13, [r8 - 1]
mov rax, rcx
movabs rdx, 0x6666666666666667
imul rdx
mov rax, rdx
shr rax, 0x3f
sar rdx, 2
add rdx, rax
lea rax, [rdx + rdx]
lea rax, [rax + rax*4]
mov r9, rcx
sub r9, rax
mov rax, r9
neg rax
cmovs rax, r9
movzx eax, byte [rax + rdi + 0xc]
mov byte [r8 - 1], al
add rcx, 9
cmp rcx, 0x12
mov rcx, rdx
mov r8, r13
ja 0x14001e510
jmp 0x14001e5b9
lea r13, [rcx - 1]
movsxd rdx, eax
imul rax, rdx, 0x66666667
mov r8, rax
shr r8, 0x3f
sar rax, 0x22
add eax, r8d
lea r8d, [rax + rax]
lea r8d, [r8 + r8*4]
mov r9d, edx
sub r9d, r8d
mov r8d, r9d
neg r8d
cmovs r8d, r9d
movzx r8d, byte [r8 + rdi + 0xc]
mov byte [rcx - 1], r8b
add edx, 9
cmp edx, 0x13
mov rcx, r13
jae 0x14001e570
cmp dword [rsp + 0x30], 0
jns 0x14001e5c8
mov byte [r13 - 1], 0x2d
dec r13
lea r15, [rsp + 0x80]
sub r15, r13
lea rax, [r15 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r15d
lea r9, [rsp + 0x5c]
jmp 0x14001e270
jne 0x14001f031
movzx ecx, al
lea r8d, [rcx + rcx + 0xb8]
test al, al
mov ecx, 0
cmovne rcx, qword [rsp + 0x38]
lea r13, [rsp + 0xb8]
mov eax, dword [rsp + 0x30]
mov edx, eax
nop word cs:[rax + rax]
nop
cmp r8d, 0xb8
je 0x14001e6b0
and rcx, rsi
cmp r8d, 0xb9
mov eax, edx
jne 0x14001e6f0
or rcx, rax
je 0x14001e859
mov rax, rcx
movabs rdx, 0x6666666666666667
imul rdx
mov rax, rdx
shr rax, 0x3f
sar rdx, 2
add rdx, rax
lea rax, [rdx + rdx]
lea rax, [rax + rax*4]
sub rcx, rax
mov rax, rcx
neg rax
cmovs rax, rcx
movzx eax, byte [rax + rdi + 0xc]
mov byte [r13 - 1], al
dec r13
mov r8d, 0xb9
mov rcx, rdx
jmp 0x14001e640
test edx, edx
je 0x14001e859
mov ecx, edx
mov eax, 0xcccccccd
imul rcx, rax
shr rcx, 0x23
lea eax, [rcx + rcx]
lea eax, [rax + rax*4]
sub edx, eax
movzx eax, byte [rdx + rdi + 0xc]
mov byte [r13 - 1], al
dec r13
mov r8d, 0xb8
mov edx, ecx
jmp 0x14001e640
or rcx, rax
je 0x14001e859
mov rax, rcx
movabs rdx, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdx + rdx]
lea rax, [rax + rax*4]
sub rcx, rax
movzx eax, byte [rdi + rcx + 0xc]
mov byte [r13 - 1], al
dec r13
mov r8d, 0xba
mov rcx, rdx
jmp 0x14001e640
jne 0x14001f031
movzx eax, al
lea edx, [rax + rax + 0xb8]
test al, al
mov ecx, 0
cmovne rcx, qword [rsp + 0x38]
lea r13, [rsp + 0xa4]
mov eax, dword [rsp + 0x30]
nop dword [rax + rax]
cmp edx, 0xb8
je 0x14001e7c0
and rcx, rsi
cmp edx, 0xb9
jne 0x14001e7f0
mov eax, eax
or rcx, rax
je 0x14001e89a
lea rax, [rcx + 0xf]
test rcx, rcx
cmovns rax, rcx
mov rdx, rax
and rdx, 0xfffffffffffffff0
sub rcx, rdx
mov rdx, rcx
neg rdx
cmovs rdx, rcx
movzx ecx, byte [rdx + rdi + 0xc]
mov byte [r13 - 1], cl
dec r13
sar rax, 4
mov edx, 0xb9
mov rcx, rax
jmp 0x14001e760
test eax, eax
je 0x14001e89a
mov ecx, eax
and ecx, 0xf
movzx ecx, byte [rcx + rdi + 0xc]
mov byte [r13 - 1], cl
dec r13
shr eax, 4
mov edx, 0xb8
mov rcx, rax
jmp 0x14001e760
mov edx, eax
or rcx, rdx
je 0x14001e89a
and eax, 0xf
movzx eax, byte [rax + rdi + 0xc]
mov byte [r13 - 1], al
dec r13
shr rcx, 4
mov edx, 0xba
mov eax, ecx
jmp 0x14001e760
mov r13, qword [rsp + 0xc0]
test r13, r13
je 0x14001e247
mov r15d, dword [r13 + 4]
add r13, 0xc
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r15d
lea r9, [rsp + 0x64]
jmp 0x14001e270
lea r15, [rsp + 0xb8]
sub r15, r13
lea rax, [r15 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r15d
lea r9, [rsp + 0x54]
jmp 0x14001e270
lea r15, [rsp + 0xa4]
sub r15, r13
lea rax, [r15 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
mov r8d, r15d
lea r9, [rsp + 0x4c]
jmp 0x14001e270
mov edi, dword [rsp + 0x2c]
test edi, edi
je 0x14001f00b
inc edi
jo 0x14001f02c
mov dword [rsp + 0x2c], edi
mov eax, edi
mov qword [rsp + 0x30], rax
xor r14d, r14d
lea rbp, str.___d_times_
lea r13, [0x1400288e7]
movabs rbx, 0x6666666666666667
lea rdi, [0x140028070]
jmp 0x14001e96a
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140027794]
mov r8d, 1
lea r9, [rsp + 0x60]
nop word cs:[rax + rax]
call sub.KERNEL32.dll_WriteFile
inc r14d
jo 0x14001f02c
inc rbp
cmp rbp, r13
jae 0x14001f00b
xor r15d, r15d
nop dword [rax]
cmp byte [rbp + r15], 0x25
je 0x14001e990
lea rax, [rbp + r15 + 1]
inc r15
cmp rax, r13
jb 0x14001e970
jmp 0x14001e995
test r15, r15
je 0x14001e9fa
add r15, rbp
mov r12, r15
sub r12, rbp
lea rax, [r12 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rbp
mov r8d, r12d
lea r9, [rsp + 0x68]
call sub.KERNEL32.dll_WriteFile
cmp byte [r15 + 1], 0x6c
jne 0x14001ea10
lea rbp, [r15 + 2]
lea rcx, [r15 + 3]
cmp byte [r15 + 2], 0x6c
sete al
cmove rbp, rcx
cmp rbp, r13
jb 0x14001ea1f
jmp 0x14001f00b
mov r15, rbp
cmp byte [r15 + 1], 0x6c
je 0x14001e9dc
nop word cs:[rax + rax]
nop
lea rbp, [r15 + 1]
xor eax, eax
cmp rbp, r13
jae 0x14001f00b
movzx ecx, byte [rbp]
add ecx, 0xffffff9c
cmp ecx, 0x14
ja case.0x14001ea3d.101
lea rdx, [0x140026bf0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov ecx, r14d
shr ecx, 0x1f
add ecx, r14d
jne 0x14001f031
cmp dword [rsp + 0x2c], 0
je 0x14001e91e
mov ecx, 0xb7
test al, al
je 0x14001ec91
mov rdx, qword [rsp + 0x30]
xor r8d, r8d
call fcn.140014f90
mov r8, rax
shr r8, 0x3f
test rax, rax
je 0x14001eff5
mov rcx, rax
lea r15, [rsp + 0x80]
nop
mov rax, rcx
imul rbx
mov rax, rdx
shr rax, 0x3f
sar rdx, 2
add rdx, rax
lea rax, [rdx + rdx]
lea rax, [rax + rax*4]
mov r9, rcx
sub r9, rax
mov rax, r9
neg rax
cmovs rax, r9
movzx eax, byte [rax + rdi + 0xc]
mov byte [r15 - 1], al
dec r15
add rcx, 9
cmp rcx, 0x13
mov rcx, rdx
jae 0x14001ea90
jmp 0x14001ed00
mov r12, rbp
sub r12, r15
lea rax, [r12 - 0x7fffffff]
cmp rax, rsi
jb 0x14001f02c
inc r12
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r15
mov r8d, r12d
lea r9, [rsp + 0x44]
call sub.KERNEL32.dll_WriteFile
inc rbp
cmp rbp, r13
jb 0x14001e96a
jmp 0x14001f00b
mov eax, r14d
shr eax, 0x1f
add eax, r14d
jne 0x14001f031
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x64]
jmp 0x14001e950
mov eax, r14d
shr eax, 0x1f
add eax, r14d
jne 0x14001f031
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, str._____
mov r8d, 5
lea r9, [rsp + 0x48]
jmp 0x14001e950
mov ecx, r14d
shr ecx, 0x1f
add ecx, r14d
jne 0x14001f031
cmp dword [rsp + 0x2c], 0
je 0x14001ec37
mov ecx, 0xb7
test al, al
je 0x14001ed4f
mov rdx, qword [rsp + 0x30]
xor r8d, r8d
call fcn.1400150a0
mov rcx, rax
mov edx, ecx
shr edx, 8
mov r9, rax
shr r9, 0x10
mov r8d, 0xba
jmp 0x14001ed70
mov ecx, r14d
shr ecx, 0x1f
add ecx, r14d
jne 0x14001f031
cmp dword [rsp + 0x2c], 0
je 0x14001ec64
mov ecx, 0xb7
test al, al
je 0x14001eeb4
mov rdx, qword [rsp + 0x30]
xor r8d, r8d
call fcn.1400150a0
mov ecx, eax
shr ecx, 8
mov rdx, rax
shr rdx, 0x10
mov r8d, 0xba
mov r9d, eax
jmp 0x14001eed6
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140027794]
mov r8d, 1
lea r9, [rsp + 0x58]
jmp 0x14001e950
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [0x140027794]
mov r8d, 1
lea r9, [rsp + 0x50]
jmp 0x14001e950
mov rdx, qword [rsp + 0x30]
xor r8d, r8d
call fcn.140015040
mov r8d, eax
shr r8d, 0x1f
test eax, eax
lea r15, [rsp + 0x80]
je 0x14001ed00
nop word cs:[rax + rax]
nop dword [rax + rax]
movsxd rcx, eax
imul rax, rcx, 0x66666667
mov rdx, rax
shr rdx, 0x3f
sar rax, 0x22
add eax, edx
lea edx, [rax + rax]
lea edx, [rdx + rdx*4]
mov r9d, ecx
sub r9d, edx
mov edx, r9d
neg edx
cmovs edx, r9d
movzx edx, byte [rdx + rdi + 0xc]
mov byte [r15 - 1], dl
dec r15
add ecx, 9
cmp ecx, 0x13
jae 0x14001ecc0
test r8b, r8b
je 0x14001ed0d
mov byte [r15 - 1], 0x2d
dec r15
lea r12, [rsp + 0x80]
sub r12, r15
lea rax, [r12 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r15
mov r8d, r12d
lea r9, [rsp + 0x5c]
jmp 0x14001e950
mov rdx, qword [rsp + 0x30]
xor r8d, r8d
call fcn.140015150
mov edx, eax
shr edx, 8
mov r9d, eax
shr r9d, 0x10
mov r8d, 0xb8
xor ecx, ecx
lea r15, [rsp + 0xb8]
jmp 0x14001edd3
or rcx, rax
je 0x14001ee72
mov rax, rcx
imul rbx
mov rax, rdx
shr rax, 0x3f
sar rdx, 2
add rdx, rax
lea rax, [rdx + rdx]
lea rax, [rax + rax*4]
sub rcx, rax
mov rax, rcx
neg rax
cmovs rax, rcx
movzx eax, byte [rax + rdi + 0xc]
mov byte [r15 - 1], al
dec r15
mov r8d, 0xb9
mov rcx, rdx
movzx edx, ch
mov r9d, ecx
shr r9d, 0x10
mov eax, ecx
shl edx, 8
movzx eax, al
or eax, edx
shl r9d, 0x10
movzx eax, ax
or eax, r9d
cmp r8d, 0xb8
je 0x14001ee40
and rcx, rsi
mov eax, eax
cmp r8d, 0xb9
je 0x14001ed80
or rcx, rax
je 0x14001ee72
mov rax, rcx
movabs rdx, 0xcccccccccccccccd
mul rdx
shr rdx, 3
lea rax, [rdx + rdx]
lea rax, [rax + rax*4]
sub rcx, rax
movzx eax, byte [rdi + rcx + 0xc]
mov byte [r15 - 1], al
dec r15
mov r8d, 0xba
jmp 0x14001edc4
test eax, eax
je 0x14001ee72
mov ecx, eax
mov edx, 0xcccccccd
imul rcx, rdx
shr rcx, 0x23
lea edx, [rcx + rcx]
lea edx, [rdx + rdx*4]
sub eax, edx
movzx eax, byte [rax + rdi + 0xc]
mov byte [r15 - 1], al
dec r15
mov r8d, 0xb8
jmp 0x14001edc7
lea r12, [rsp + 0xb8]
sub r12, r15
lea rax, [r12 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r15
mov r8d, r12d
lea r9, [rsp + 0x54]
jmp 0x14001e950
mov rdx, qword [rsp + 0x30]
xor r8d, r8d
call fcn.140015150
mov r9d, eax
mov ecx, eax
shr ecx, 8
mov edx, eax
shr edx, 0x10
mov r8d, 0xb8
xor eax, eax
lea r15, [rsp + 0xa4]
jmp 0x14001ef0e
test edx, edx
je 0x14001efb7
and ecx, 0xf
movzx eax, byte [rcx + rdi + 0xc]
mov byte [r15 - 1], al
dec r15
shr edx, 4
mov r8d, 0xb8
mov rax, rdx
movzx ecx, ah
mov edx, eax
shr edx, 0x10
mov r9d, eax
shl ecx, 8
movzx r10d, r9b
or r10d, ecx
shl edx, 0x10
movzx ecx, r10w
or edx, ecx
cmp r8d, 0xb8
je 0x14001eee0
and rax, rsi
cmp r8d, 0xb9
mov ecx, edx
jne 0x14001ef90
or rcx, rax
je 0x14001efb7
movzx edx, r9w
lea r8, [rax + rdx + 0xf]
or rax, rdx
cmovns r8, rax
and r8, 0xfffffffffffffff0
sub rax, r8
mov rdx, rax
neg rdx
cmovs rdx, rax
movzx eax, byte [rdx + rdi + 0xc]
mov byte [r15 - 1], al
dec r15
lea rax, [rcx + 0xf]
test rcx, rcx
cmovns rax, rcx
sar rax, 4
mov r8d, 0xb9
jmp 0x14001ef03
or rax, rcx
je 0x14001efb7
movzx ecx, r9w
and ecx, 0xf
movzx ecx, byte [rcx + rdi + 0xc]
mov byte [r15 - 1], cl
dec r15
shr rax, 4
mov r8d, 0xba
jmp 0x14001ef03
lea r12, [rsp + 0xa4]
sub r12, r15
lea rax, [r12 - 0x80000000]
cmp rax, rsi
jb 0x14001f02c
mov ecx, 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r15
mov r8d, r12d
lea r9, [rsp + 0x4c]
jmp 0x14001e950
lea r15, [rsp + 0x80]
test r8b, r8b
jne 0x14001ed05
jmp 0x14001ed0d
lea rcx, [0x1400288e8]
call fcn.140016f40
nop
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140003430
call fcn.1400053c0
mov rcx, rax
call fcn.140005420
int3