Function at 0x1400052c0
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x840]
sub rsp, 0x940
mov rax, qword [0x1400390f8]
xor rax, rsp
mov qword [rbp + 0x830], rax
xor eax, eax
mov qword [rsp + 0x58], rdx
or edi, 0xffffffff
mov dword [rsp + 0x70], eax
xor r12d, r12d
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x80], rax
mov ebx, eax
mov dword [rsp + 0x60], eax
mov r14, rdx
mov dword [rsp + 0x78], eax
lea r15d, [rdi + 2]
mov dword [rsp + 0x64], eax
mov rsi, rcx
mov rax, qword [rdx + 0x40]
mov dword [rbp - 0x78], r15d
mov dword [rsp + 0x40], edi
mov dword [rbp - 0x70], r12d
mov dword [rsp + 0x54], r12d
test rax, rax
je 0x14001fe86
mov eax, dword [rax + 0x38]
shr eax, 1
lea rcx, [rbp - 0x50]
mov r13d, 0x104
mov dword [rbp - 0x74], r12d
and eax, 8
mov dword [rsp + 0x6c], r12d
mov r8d, r13d
mov dword [rsp + 0x74], eax
xor edx, edx
mov qword [rbp + 0x1b8], r12
mov byte [rbp + 0x1c0], r15b
mov qword [rbp + 0x1c8], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x818], r12
xor edx, edx
mov byte [rbp + 0x820], r15b
lea rcx, [rbp + 0x610]
mov qword [rbp + 0x828], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x5f8], r12
xor edx, edx
mov byte [rbp + 0x600], r15b
lea rcx, [rbp + 0x3f0]
mov qword [rbp + 0x608], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x3d8], r12
xor edx, edx
mov byte [rbp + 0x3e0], r15b
lea rcx, [rbp + 0x1d0]
mov qword [rbp + 0x3e8], r13
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x1c0]
lea rcx, [rbp - 0x50]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.1400104d0
test eax, eax
js 0x140020a6d
mov al, byte [rbp + 0x820]
lea rcx, [rbp + 0x610]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.1400104d0
test eax, eax
js 0x140020a6d
mov al, byte [rbp + 0x600]
lea rcx, [rbp + 0x3f0]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.1400104d0
test eax, eax
js 0x140020a6d
mov al, byte [rbp + 0x3e0]
lea rcx, [rbp + 0x1d0]
neg al
sbb rdx, rdx
and edx, 0xfdc6
add rdx, 0x208
call fcn.1400104d0
test eax, eax
js 0x140020a6d
lea rdx, [0x140030364]
lea rcx, [rbp + 0x3f0]
call fcn.140010630
xor r9d, r9d
lea r8, [rsp + 0x68]
mov ecx, 0xfe00
call fcn.1400063d0
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
je 0x140020a6d
cmp dword [0x140039858], r12d
jne 0x14001fe8e
mov rsi, qword [rsi + 0x40]
test rsi, rsi
je 0x1400059d9
mov rcx, qword [rsi]
mov rbx, qword [rsi + 0x30]
call fcn.140011c70
xor r9d, r9d
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rcx
mov rdx, rax
lea rcx, [fcn.140016cc0]
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 0x21]
call fcn.140016b14
test al, al
je 0x14001fef1
mov r15, qword [rbp - 0x60]
cmp dword [0x140039834], r12d
jne 0x1400209fb
mov rax, qword [rbp + 0x818]
lea rdx, [rbp + 0x610]
mov r8d, dword [rbp + 0x828]
test rax, rax
mov rcx, rsi
cmovne rdx, rax
call fcn.1400062fc
mov ebx, 1
cmp eax, ebx
je 0x1400209ed
cmp dword [0x14003985c], r12d
jne 0x140005a46
mov eax, dword [0x140039854]
cmp eax, 3
je 0x14001ff43
test byte [rsi + 0x38], 8
je 0x140005b2c
mov rdx, qword [rsi + 8]
lea rcx, [0x1400303c8]
call fcn.14001242c
cmp dword [0x140039854], 3
je 0x14001ff6e
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov r9d, dword [rbp + 0x1c8]
test rax, rax
mov rdx, r14
mov dword [rsp + 0x20], r12d
cmovne r8, rax
mov rcx, rsi
call fcn.140005cdc
cmp eax, ebx
je 0x1400209ed
cmp dword [0x140039854], 3
je 0x14001ff80
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
cmp word [rcx], r12w
je 0x14000599f
mov rcx, qword [rsi + 8]
xor edx, edx
call fcn.14000244c
mov r12d, eax
cmp eax, 0xffffffff
je 0x14001ffb9
mov ecx, eax
call fcn.14000f518
xor ebx, ebx
test eax, eax
jne 0x14002000f
cmp dword [0x140039858], ebx
jne 0x14002003c
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsi + 0x38]
mov r8d, 1
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x70], eax
test cl, 4
jne 0x140005a51
mov dword [rsp + 0x54], ecx
mov rax, qword [rbp + 0x3d8]
lea rcx, [rbp + 0x1d0]
mov r8, qword [rsi + 8]
test rax, rax
mov edx, dword [rbp + 0x3e8]
cmovne rcx, rax
call fcn.140012fc4
mov r14d, eax
lea rcx, [rbp - 0x50]
mov rax, qword [rbp + 0x1b8]
test rax, rax
cmovne rcx, rax
call fcn.140011c70
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov dword [rsp + 0x28], edi
mov r8d, 0x200
mov rdx, r13
mov qword [rsp + 0x20], rsi
mov ecx, r12d
call fcn.140006248
xor r9d, r9d
mov r13d, eax
cmp dword [0x1400502f8], r9d
jne 0x140020080
mov ebx, dword [0x140039854]
cmp ebx, 3
je 0x1400200c6
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
lea rdx, [rbp + 0x1d0]
mov ecx, r14d
cmovne r8, rax
mov rax, qword [rbp + 0x3d8]
test rax, rax
cmovne rdx, rax
call fcn.140005bd4
xor ecx, ecx
test eax, eax
jne 0x1400200dd
cmp dword [0x14003985c], ecx
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov dword [0x1400398b4], eax
jne 0x140005a77
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov r9d, dword [rbp + 0x1c8]
test rax, rax
mov rdx, rbx
mov rcx, rsi
cmovne r8, rax
mov eax, 1
mov dword [rsp + 0x20], eax
call fcn.140005cdc
cmp eax, 1
je 0x1400209bc
mov rcx, qword [rbp + 0x1b8]
lea rax, [rbp - 0x50]
xor r9d, r9d
test rcx, rcx
cmovne rax, rcx
cmp word [rax], r9w
je 0x1400200ae
mov rax, qword [rbp + 0x3d8]
lea r8, [rbp - 0x50]
test rcx, rcx
lea rdx, [rbp + 0x1d0]
cmovne r8, rcx
test rax, rax
mov ecx, r14d
cmovne rdx, rax
call fcn.140005bd4
test eax, eax
jne 0x140020164
mov r14d, dword [rsp + 0x50]
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ecx, dword [rsp + 0x54]
xor r9d, r9d
mov ebx, dword [0x140039854]
mov edx, eax
test ecx, ecx
je 0x140005ab6
mov r8, qword [rsp + 0x58]
mov r10d, 1
cmp dword [0x14003985c], r9d
jne 0x140005b0b
test dl, 6
je 0x140005b3a
or edi, 0xffffffff
mov dword [0x1400502f8], 5
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x78], r9d
mov dword [rsp + 0x64], r9d
mov edx, dword [rsp + 0x54]
mov eax, 1
cmp dword [rbp - 0x70], eax
je 0x140020282
mov ecx, dword [rsi + 0x38]
mov eax, ecx
test cl, 8
je 0x140005b9d
mov r8d, eax
test al, 8
je 0x14000584b
cmp ebx, 3
je 0x1400202bd
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x44]
call fcn.140006208
cmp ebx, 3
mov ebx, 1
je 0x140020661
mov ecx, dword [rsi + 0x38]
test bl, cl
je 0x140020661
mov edx, 0x800
mov r14d, ecx
and r14d, edx
mov eax, r14d
neg eax
sbb ebx, ebx
and ebx, edx
cmp edi, 0xffffffff
jne 0x140005bab
bt ecx, 0xa
jb 0x1400202e1
mov rax, qword [0x14003fc18]
lea rdx, [rbp - 0x50]
xor r13d, r13d
test rax, rax
je 0x14002034c
mov rcx, qword [rbp + 0x1b8]
test rcx, rcx
cmovne rdx, rcx
mov ecx, dword [rsp + 0x74]
or ecx, ebx
xor r9d, r9d
mov dword [rsp + 0x28], ecx
xor r8d, r8d
lea rcx, [0x140039834]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi + 8]
call qword [0x14002fd18]
test eax, eax
je 0x14002036f
cmp dword [rsp + 0x64], r13d
jne 0x140020969
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005932
mov rdx, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rdx, rdx
cmovne rcx, rdx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
cmp dword [0x140039858], r13d
mov ebx, 1
jne 0x14002041b
mov r13, qword [rsp + 0x48]
mov rax, qword [rsi + 0x30]
and dword [0x1400398e4], 0
mov rcx, qword [rax + 0x14]
mov qword [rbp - 0x58], rcx
mov ecx, r12d
call fcn.14000d778
xor r12d, r12d
cmp dword [0x140039854], 3
je 0x140020996
cmp dword [0x140039834], r12d
jne 0x140020973
mov r14, qword [rsp + 0x58]
lea r9, [rbp - 0x58]
mov rdx, r14
mov r8d, edi
mov rcx, rsi
call fcn.1400061b8
mov dword [0x14003985c], r12d
mov rdx, qword [rsi + 0x30]
lea rcx, [fcn.140016cc0]
mov r9, r15
mov r8d, 0x21
call fcn.140016cd0
test al, al
jne 0x14000551c
mov rcx, r15
call fcn.140013ddc
mov rsi, qword [rsi + 0x40]
test rsi, rsi
jne 0x1400054e0
mov ebx, dword [rsp + 0x60]
cmp dword [0x140039854], 3
je 0x140020a4d
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x818]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, ebx
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.1400173b0
mov rbx, qword [rsp + 0x990]
add rsp, 0x940
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x140039854]
jmp 0x140005576
and ecx, 0xfffffffb
mov eax, ecx
and al, 0x80
neg al
sbb edx, edx
neg edx
add edx, r8d
or edx, ecx
cmp byte [0x1400502b9], bl
mov dword [rsi + 0x38], edx
jne 0x14000564d
jmp 0x140020050
cmp qword [rbx + 0x40], rcx
je 0x140005726
mov dword [0x1400502f8], ecx
mov rcx, qword [rbx + 0x40]
mov dword [0x1400398b0], eax
call fcn.14001430c
mov ecx, dword [0x1400502f8]
cmp ecx, 0x15
je 0x1400209b5
cmp ecx, 0x458
jne 0x140005726
jmp 0x1400209b5
cmp dword [rbp - 0x78], r9d
je 0x1400201d1
mov dword [rsp + 0x6c], r9d
mov r8d, r9d
cmp edx, 0xffffffff
je 0x140005ade
test dl, 0x10
mov eax, 1
cmovne r8d, eax
mov dword [rsp + 0x6c], r8d
mov dword [rbp - 0x78], r9d
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffb
cmp byte [0x1400502b9], r9b
mov dword [rsi + 0x38], eax
je 0x1400201db
test r8d, r8d
mov r8, qword [rsp + 0x58]
je 0x1400057e4
jmp 0x14002022e
mov rax, qword [r8 + 0x40]
test rax, rax
je 0x140005b1e
test byte [rax + 0x38], 8
jne 0x140005bc1
cmp ebx, 3
jne 0x1400057f7
jmp 0x140020249
cmp eax, 3
jne 0x14000559d
jmp 0x140005580
test dword [rsi + 0x38], 0x400
jne 0x140005b69
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.14000655c
mov ebx, dword [0x140039854]
mov edi, eax
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x64], r9d
cmp edi, 0xffffffff
je 0x140005811
mov ebx, 1
mov ecx, edi
mov dword [rsp + 0x78], ebx
call fcn.14000f518
xor r9d, r9d
test eax, eax
jne 0x140020266
mov ebx, dword [0x140039854]
jmp 0x14000581b
cmp ebx, 3
jne 0x14000583b
jmp 0x1400202a7
mov ecx, edi
call fcn.14000d778
mov ecx, dword [rsi + 0x38]
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
jmp 0x140005890
cmp qword [rsi + 0x40], r9
cmove ebx, r10d
mov dword [0x140039854], ebx
jmp 0x140005b1e
mov eax, dword [rdx + 0x38]
jmp 0x140005342
mov ecx, dword [rsp + 0x68]
lea r8, [rsp + 0x50]
mov r9d, r15d
call fcn.1400063d0
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x14001fee4
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x818]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rax, r15
jmp 0x140005a1c
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x70], eax
jmp 0x1400054d3
cmp dword [0x140039854], 3
jne 0x14001ff07
cmp dword [0x14003985c], r12d
je 0x1400059c8
mov rdx, qword [rsi]
lea rcx, [0x140031c80]
call fcn.14001242c
lea rcx, [0x140030688]
call fcn.14001242c
mov ecx, dword [0x1400502f8]
call fcn.14002b61c
mov rcx, qword [rbp - 0x60]
call fcn.140013ddc
mov edx, 1
xor ecx, ecx
call fcn.140029fe8
int3
mov rax, qword [rbp + 0x5f8]
lea rcx, [rbp + 0x3f0]
mov rdx, qword [rsi + 8]
test rax, rax
cmovne rcx, rax
call fcn.14002aab4
test eax, eax
jne 0x14000599f
jmp 0x140005a46
cmp dword [0x14003985c], r12d
je 0x1400055f7
jmp 0x14000559d
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov rdx, qword [rbp + 0x608]
lea rcx, [rbp + 0x3f0]
test rax, rax
cmovne r8, rax
mov rax, qword [rbp + 0x5f8]
test rax, rax
cmovne rcx, rax
call fcn.140011620
nop
jmp 0x1400055db
mov ecx, dword [0x1400502f8]
call fcn.14002b61c
xor r12d, r12d
cmp dword [0x140039854], 3
jne 0x140020006
cmp edi, 0xffffffff
jne 0x140020006
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
mov rdx, qword [rsi + 8]
test rax, rax
cmovne rcx, rax
call fcn.14002aab4
test eax, eax
je 0x140020006
mov rcx, r15
call fcn.140013ddc
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov dword [rsp + 0x60], ebx
jmp 0x14000599f
bts dword [rsi + 0x38], 7
mov r8d, 1
mov ecx, dword [rsi + 0x38]
mov dword [rsp + 0x50], 0x80
test r8b, cl
je 0x140005640
and ecx, 0xfffffffe
or ecx, 4
mov dword [rsi + 0x38], ecx
jmp 0x140005640
mov ecx, dword [rsp + 0x70]
mov eax, ecx
cmp dword [rsp + 0x68], ecx
cmovb eax, dword [rsp + 0x68]
jmp 0x14000562f
cmp dword [0x14003985c], ebx
je 0x14000564d
test dl, 8
jne 0x14000564d
cmp dword [0x140039854], 3
jne 0x14000564d
and edx, 0xfffffffe
or edx, 2
mov dword [rsi + 0x38], edx
jmp 0x14000564d
mov ecx, r12d
call fcn.14000d778
mov ecx, 0x6e
call fcn.14002b61c
cmp dword [0x140039854], 3
je 0x1400209a0
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x60], 1
jmp 0x1400200b9
mov ecx, r12d
call fcn.14000d778
mov r14, rbx
mov r13, qword [rsp + 0x48]
xor r12d, r12d
jmp 0x14000599f
cmp dword [0x14003985c], r9d
jne 0x1400056d1
mov r14d, dword [rsp + 0x50]
jmp 0x14000581b
test byte [rsi + 0x38], 0x80
jne 0x14000570a
mov ecx, r12d
call fcn.14000d778
mov r13, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r14d, dword [rsp + 0x50]
mov r9, r13
mov qword [rsp + 0x28], r15
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.14002ac58
xor r12d, r12d
cmp dword [0x14003985c], r12d
je 0x14002014a
cmp dword [0x140039854], 3
jne 0x140020143
mov eax, dword [rsi + 0x38]
mov ecx, dword [rsp + 0x54]
and eax, 0xfffffffe
mov dword [rsi + 0x38], eax
test ecx, ecx
jne 0x14002013e
or eax, 2
jmp 0x140020140
or eax, ecx
mov dword [rsi + 0x38], eax
mov dword [rbp - 0x70], 1
mov r8d, dword [rsi + 0x38]
lea rdx, [rsp + 0x44]
mov rcx, r13
call fcn.140006208
mov edi, dword [rsp + 0x40]
jmp 0x140020996
test byte [rsi + 0x38], 0x80
jne 0x1400057ab
mov ecx, r12d
call fcn.14000d778
cmp dword [0x14003985c], 0
je 0x1400201a7
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1400201a7
test byte [rax + 0x38], 8
je 0x1400201a7
mov eax, dword [0x140039854]
mov ecx, 1
cmp qword [rsi + 0x40], 0
cmove eax, ecx
mov dword [0x140039854], eax
mov r14d, dword [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
call fcn.14002ac58
mov edi, dword [rsp + 0x40]
jmp 0x1400057b0
mov r8d, dword [rsp + 0x6c]
jmp 0x140005ae2
test al, 8
je 0x140005af8
cmp ebx, 3
jne 0x140005af8
test r8d, r8d
mov dword [rbp - 0x74], ebx
mov r8, qword [rsp + 0x58]
jne 0x1400057e4
mov rcx, qword [r8 + 0x40]
test rcx, rcx
je 0x14002021f
test byte [rcx + 0x38], 8
je 0x14002021f
mov ecx, dword [rsp + 0x54]
lea r10d, [rbx - 2]
or eax, r10d
mov dword [rsi + 0x38], eax
jmp 0x1400057ea
mov ecx, dword [rsp + 0x54]
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x1400057e4
cmp dword [rbp - 0x74], 3
mov r10d, 1
jne 0x1400057ea
or eax, r10d
mov dword [rsi + 0x38], eax
jmp 0x1400057ea
test ecx, ecx
jne 0x14002025e
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffe
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x1400057f7
mov dword [rsi + 0x38], ecx
jmp 0x1400057f7
mov dword [rsp + 0x64], ebx
cmp dword [rsp + 0x54], r9d
jne 0x140005b92
and dword [rsi + 0x38], 0xfffffffe
or dword [rsi + 0x38], 2
jmp 0x140005b92
cmp ebx, 3
jne 0x14000582d
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffe
mov dword [rsi + 0x38], eax
test edx, edx
jne 0x14002029d
or eax, 2
jmp 0x14002029f
or eax, edx
mov dword [rsi + 0x38], eax
jmp 0x14000582d
test edx, edx
jne 0x14000583b
and eax, 0xfffffffe
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x14000583b
cmp dword [rsp + 0x6c], r9d
jne 0x14000584b
test edx, edx
jne 0x14000584b
and r8d, 0xfffffffe
or r8d, 2
mov dword [rsi + 0x38], r8d
jmp 0x14000584b
mov rcx, qword [rsi + 8]
call fcn.14002b75c
xor r13d, r13d
test eax, eax
jne 0x14002030f
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.14002b75c
mov r9d, r13d
test eax, eax
je 0x140020315
mov r9d, 1
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov ecx, dword [rsp + 0x74]
lea r8, [0x140029e10]
test rax, rax
cmovne rdx, rax
mov rax, qword [0x14003fc18]
or ecx, ebx
or ecx, 2
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r13
jmp 0x1400058db
mov rax, qword [rbp + 0x1b8]
mov r8d, dword [rsp + 0x74]
test rax, rax
mov rcx, qword [rsi + 8]
cmovne rdx, rax
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_CopyFileW]
nop
jmp 0x1400058e5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, 1
mov dword [0x1400502f8], eax
cmp eax, ecx
jne 0x1400203a1
test r14d, r14d
je 0x1400203a1
mov rcx, qword [rsi + 0x30]
test dword [rcx], 0x400
mov ecx, 0x40002730
cmovne eax, ecx
mov dword [0x1400502f8], eax
mov ecx, r12d
call fcn.14000d778
mov ecx, dword [0x1400502f8]
mov r12d, dword [rsp + 0x64]
mov eax, r12d
neg eax
mov dword [0x1400398e4], r13d
mov eax, 0x70
sbb ebx, ebx
and ebx, 0x1d
test ecx, ecx
cmove ecx, eax
cmp dword [0x140039834], r13d
mov dword [0x1400502f8], ecx
je 0x1400203e6
xor r12d, r12d
mov ebx, r12d
jmp 0x1400203f3
test r12d, r12d
jne 0x1400203f0
call fcn.14002b61c
xor r12d, r12d
cmp dword [rsp + 0x78], r12d
jne 0x1400209ce
mov dword [rsp + 0x60], 1
jmp 0x14002040c
mov dword [rsp + 0x60], ebx
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x48]
jmp 0x14000599f
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
mov edx, ebx
cmovne rcx, rax
call fcn.14000244c
or r14d, 0xffffffff
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, r14d
je 0x1400205d1
mov ecx, eax
call fcn.14000f518
mov ecx, edi
test eax, eax
jne 0x14002061a
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
test eax, eax
je 0x1400205fa
mov ecx, edi
call fcn.14000d778
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
xor edx, edx
call fcn.14000244c
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, r14d
je 0x1400205d1
mov ecx, eax
call fcn.14000f518
test eax, eax
jne 0x1400205fa
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov ecx, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea rdx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea rdx, [rbp - 0x6c]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
cmp ebx, eax
jne 0x1400205f5
mov eax, dword [rbp - 0x6c]
cmp dword [rbp - 0x68], eax
jne 0x1400205f5
mov r14d, dword [rsp + 0x50]
mov ebx, r13d
mov r13, qword [rsp + 0x48]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov r8d, r14d
mov rdx, r13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
mov ecx, edi
test eax, eax
je 0x1400205bd
cmp dword [rsp + 0x44], 0
je 0x1400205bd
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r8d, dword [rsp + 0x44]
lea r9, [rbp - 0x64]
mov rdx, qword [rbp - 0x80]
mov rcx, rax
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x14002062c
mov eax, dword [rsp + 0x44]
cmp dword [rbp - 0x64], eax
jne 0x14002062c
mov rdx, qword [rbp - 0x80]
cmp r14d, eax
mov ecx, 1
mov r8d, eax
cmovne ebx, ecx
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14002062c
test ebx, ebx
je 0x14002052e
mov ecx, edi
call fcn.14000d778
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
lea ebx, [rdi + 2]
jmp 0x140005949
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
mov edx, ebx
mov ecx, 0x4000271f
cmovne r8, rax
call fcn.140014d90
nop
jmp 0x140005944
mov ebx, 1
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
mov edx, ebx
mov ecx, 0x4000271f
cmovne r8, rax
call fcn.140014d90
mov ecx, edi
call fcn.14000d778
mov edi, r14d
mov dword [rsp + 0x40], r14d
jmp 0x140005944
mov ecx, edi
call fcn.14000d778
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
or edi, 0xffffffff
mov ecx, 0x4000271f
test rax, rax
mov dword [rsp + 0x40], edi
cmovne r8, rax
lea ebx, [rdi + 2]
mov edx, ebx
call fcn.140014d90
nop
jmp 0x140005949
cmp edi, 0xffffffff
je 0x1400206c5
mov ecx, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
cmp dword [0x14003985c], 0
jne 0x140020727
cmp dword [0x140039854], 3
jne 0x140020727
mov eax, dword [rsi + 0x38]
mov ecx, 0x4002
mov rbx, qword [rsp + 0x48]
and eax, ecx
cmp eax, ecx
jne 0x14002072c
mov eax, dword [rsp + 0x44]
lea rdx, [rbx + 2]
add eax, 0xfffffffe
mov rcx, rbx
mov r8d, eax
mov dword [rsp + 0x44], eax
call qword [sym.imp.msvcrt.dll_memmove]
jmp 0x14002072c
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
mov edx, ebx
cmovne rcx, rax
call fcn.14000244c
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, 0xffffffff
jne 0x140020677
mov ecx, r12d
call fcn.14000d778
xor r12d, r12d
cmp dword [0x1400398ac], r12d
jne 0x140020708
mov ecx, dword [0x1400502f8]
call fcn.14002b61c
cmp dword [0x140039854], 3
jne 0x140020408
mov rcx, r15
call fcn.140013ddc
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov rbx, qword [rsp + 0x48]
mov edx, 0x4000
test dword [rsi + 0x38], edx
je 0x14002074c
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140020749
or dword [rax + 0x38], edx
jmp 0x14002074c
or dword [rcx + 0x38], edx
mov eax, dword [0x1400398e4]
test eax, eax
je 0x1400207f8
mov r8d, dword [rsp + 0x44]
xor r13d, r13d
test r8d, r8d
jle 0x140020969
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002ad34
cmp dword [0x140039858], r13d
je 0x140020969
mov ecx, edi
call fcn.14000f518
test eax, eax
jne 0x140020969
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.140029ebc
lea ebx, [r13 + 1]
cmp eax, ebx
jne 0x1400207ef
mov rcx, r15
call fcn.140013ddc
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov edi, dword [rsp + 0x40]
jmp 0x140005944
mov ecx, 1
cmp r13d, ecx
jne 0x1400208c9
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
xor r13d, r13d
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002ad34
cmp dword [0x140039858], r13d
je 0x140020880
mov ecx, edi
call fcn.14000f518
test eax, eax
jne 0x140020880
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.140029ebc
lea edi, [r13 + 1]
cmp eax, edi
je 0x1400209db
mov edi, dword [rsp + 0x40]
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
lea r9, [rsp + 0x44]
mov r8d, r14d
mov rdx, rbx
cmovne rcx, rax
mov qword [rsp + 0x30], rcx
mov ecx, r12d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call fcn.140006248
mov r13d, eax
mov eax, dword [0x1400398e4]
test eax, eax
je 0x1400207f8
mov ecx, 1
test eax, eax
je 0x140020969
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jle 0x140020969
cmp r13d, ecx
jne 0x140020969
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002ad34
cmp dword [0x140039858], 0
je 0x140020969
mov ecx, edi
call fcn.14000f518
test eax, eax
jne 0x140020969
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.140029ebc
mov ebx, 1
cmp eax, ebx
jne 0x1400207ef
mov rcx, r15
call fcn.140013ddc
mov edx, ebx
xor ecx, ecx
call fcn.140029fe8
int3
mov ebx, 1
jmp 0x140005944
mov ecx, edi
call fcn.14000d778
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov dword [rsp + 0x60], ebx
mov r14, qword [rsp + 0x58]
jmp 0x140005998
mov rcx, r15
call fcn.140013ddc
mov edx, 1
xor ecx, ecx
call fcn.140029fe8
int3
xor edx, edx
call fcn.140015a74
mov ecx, r12d
call fcn.14000d778
mov rcx, r15
call fcn.140013ddc
jmp 0x140020a0f
mov edx, 1
mov ecx, ebx
call fcn.140029fe8
int3
mov rcx, r15
call fcn.140013ddc
mov edx, edi
xor ecx, ecx
call fcn.140029fe8
int3
mov rcx, r15
call fcn.140013ddc
nop
jmp 0x1400059e6
mov rcx, r15
call fcn.140013ddc
cmp edi, 0xffffffff
je 0x140020a0f
mov ecx, edi
call fcn.14000d778
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x818]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, 1
jmp 0x140005a1c
cmp edi, 0xffffffff
je 0x1400059e6
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call fcn.1400061b8
nop
jmp 0x1400059e6
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x5f8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x818]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, r15d
jmp 0x140005a1c