Function at 0x140010d90
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x10830
call fcn.14001dcc0
sub rsp, rax
mov rax, qword [0x1400590c0]
xor rax, rsp
mov qword [rsp + 0x10820], rax
mov r15, rdx
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xc8], rdx
xor r13d, r13d
mov dword [rsp + 0x48], r13d
lea rcx, [rsp + 0x50]
call fcn.140012bc0
nop
lea r8, str.updateShellFile.xml
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140002620
nop
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov qword [rsp + 0xc0], rax
cmp rax, 0xffffffffffffffff
jne 0x140010eb0
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010e6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010e8d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140010ea9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
jmp 0x140011d41
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test eax, eax
jne 0x140010f2b
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010ee8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010f08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140010f24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
jmp 0x140011d41
lea eax, [rbx + 1]
mov edi, eax
mov ecx, eax
call fcn.1400244e8
mov rsi, rax
mov qword [rsp + 0xf8], rax
test rax, rax
jne 0x140010fb1
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010f6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010f8e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140010faa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
jmp 0x140011d41
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.14003fd50
mov byte [rbx + rsi], 0
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xd0]
mov r8d, ebx
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x790], xmm0
mov qword [rsp + 0x7b0], r13
mov dword [rsp + 0x7b8], r13d
mov qword [rsp + 0x10808], r13
mov qword [rsp + 0x10810], r13
lea rax, [rsp + 0x808]
mov qword [rsp + 0x7f0], rax
lea rax, [rsp + 0x808]
neg rax
and eax, 7
lea r8, [rsp + 0x808]
add rax, r8
mov qword [rsp + 0x7f8], rax
lea rax, [rsp + 0x10808]
mov qword [rsp + 0x800], rax
mov r8, rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x7c0], r13
mov qword [rsp + 0x7d0], r13
cmp byte [rsi], 0xef
jne 0x14001107d
cmp byte [rsi + 1], 0xbb
jne 0x14001107d
cmp byte [rsi + 2], 0xbf
jne 0x14001107d
lea r8, [rsi + 3]
mov qword [rsp + 0x40], r8
lea rbx, [0x140043d00]
movzx eax, byte [r8]
cmp byte [rax + rbx], 0
je 0x14001109d
nop
inc r8
movzx eax, byte [r8]
cmp byte [rax + rbx], 0
jne 0x140011090
mov qword [rsp + 0x40], r8
movzx eax, byte [r8]
test al, al
jne 0x140011c35
cmp qword [rsp + 0x7c0], 0
je 0x140011c00
lea r10, str.item
mov rdx, r10
inc rdx
cmp byte [rdx], 0
jne 0x1400110c7
sub rdx, r10
mov rax, qword [rsp + 0x7c0]
mov r14, qword [rax + 0x30]
mov qword [rsp + 0x40], r14
lea rbx, [0x14005a778]
test r14, r14
je 0x140011141
nop
mov rcx, qword [r14]
test rcx, rcx
je 0x1400110fe
mov rax, qword [r14 + 0x10]
jmp 0x140011104
mov rax, r13
mov rcx, rbx
cmp rax, rdx
jne 0x140011133
lea r9, [rax + rcx]
cmp rcx, r9
jae 0x140011149
mov r8, r10
sub r8, rcx
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
cmp byte [rcx], al
jne 0x140011133
inc rcx
cmp rcx, r9
jb 0x140011120
jmp 0x140011149
mov r14, qword [r14 + 0x58]
mov qword [rsp + 0x40], r14
test r14, r14
jne 0x1400110f0
mov r14, r13
mov qword [rsp + 0x40], r13
mov rdi, 0xffffffffffffffff
lea r8, str.file
test r14, r14
je 0x140011c09
mov rdx, qword [r14 + 0x40]
test rdx, rdx
je 0x140011b63
nop dword [rax]
mov rcx, qword [rdx]
test rcx, rcx
je 0x140011b95
cmp qword [rdx + 0x10], 4
jne 0x140011b95
lea r9, [rcx + 4]
cmp rcx, r9
jae 0x1400111bc
lea r8, str.type
sub r8, rcx
nop word [rax + rax]
movzx eax, byte [rcx + r8]
cmp byte [rcx], al
jne 0x140011b8e
inc rcx
cmp rcx, r9
jb 0x1400111a0
lea r8, str.file
test rdx, rdx
je 0x140011b63
mov rax, qword [rdx + 8]
mov rdx, rbx
test rax, rax
cmovne rdx, rax
mov rcx, r13
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140011b63
cmp rcx, 5
jne 0x1400111e0
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x140011d6e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xd8]
call fcn.14000fd80
nop
mov r8, qword [rax]
lea rdx, [0x14004496c]
lea rcx, [rsp + 0x70]
call fcn.1400031a0
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001125d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x140011d79
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0xe0]
call fcn.140012bc0
nop
mov r8, qword [rax]
lea rdx, [0x14004496c]
lea rcx, [rsp + 0x68]
call fcn.1400031a0
nop
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400112c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x78]
call fcn.14000b190
nop
mov rax, qword [r14 + 8]
mov rsi, rbx
test rax, rax
cmovne rsi, rax
lea rax, [rsp + 0x138]
mov qword [rsp + 0x130], rax
mov r8d, 0xfde9
mov rdx, rsi
lea rcx, [rsp + 0x130]
call fcn.140006d90
nop
mov r8, qword [rsp + 0x130]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xb0]
call fcn.140002620
nop
lea rax, [rsp + 0x138]
mov rcx, qword [rsp + 0x130]
cmp rcx, rax
je 0x140011336
call fcn.1400244d4
mov rdx, qword [r14 + 0x40]
test rdx, rdx
je 0x140011449
mov rcx, qword [rdx]
test rcx, rcx
je 0x14001143c
cmp qword [rdx + 0x10], 3
jne 0x14001143c
lea r9, [rcx + 3]
cmp rcx, r9
jae 0x140011385
lea r8, [0x140044974]
sub r8, rcx
nop dword [rax]
movzx eax, byte [rcx + r8]
cmp byte [rcx], al
jne 0x14001143c
inc rcx
cmp rcx, r9
jb 0x140011370
test rdx, rdx
je 0x140011449
mov rax, qword [rdx + 8]
mov rdx, rbx
test rax, rax
cmovne rdx, rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x240], rax
mov r8d, 0xfde9
lea rcx, [rsp + 0x240]
call fcn.140006d90
nop
mov rdx, qword [rsp + 0x240]
test rdx, rdx
jne 0x1400113d2
mov r8d, r13d
jmp 0x1400113e0
mov r8, rdi
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400113d5
lea rcx, [rsp + 0x88]
call fcn.1400048b0
nop
lea rax, [rsp + 0x248]
mov rcx, qword [rsp + 0x240]
cmp rcx, rax
je 0x140011408
call fcn.1400244d4
mov r8, qword [rsp + 0x70]
lea rdx, [0x140044978]
lea rcx, [rsp + 0x88]
call fcn.1400149b0
mov r8, qword [rsp + 0x68]
lea rdx, str._VERSIONPATH_
lea rcx, [rsp + 0x88]
call fcn.1400149b0
jmp 0x140011449
mov rdx, qword [rdx + 0x30]
test rdx, rdx
jne 0x140011343
mov rdx, qword [rsp + 0xb0]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x78]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400114b6
cmp dword [rbx + 0x10], 0
jl 0x1400114a8
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400114a8
call fcn.140002eb0
mov rdi, rax
mov rax, 0xffffffffffffffff
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140011496
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x78], rax
mov rdi, 0xffffffffffffffff
jmp 0x1400114b6
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.1400048b0
lea rax, [rsp + 0x358]
mov qword [rsp + 0x350], rax
mov r8d, 0xfde9
mov rdx, rsi
lea rcx, [rsp + 0x350]
call fcn.140006d90
nop
mov r13, qword [rsp + 0x350]
mov rcx, qword [r15]
sub rcx, 0x18
call fcn.140002eb0
add rax, 0x18
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xe8]
call fcn.140010710
mov rsi, rax
mov rax, qword [rax]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14001152f
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011540
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140011d84
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
mov r12d, dword [rsp + 0x48]
or r12d, 2
mov dword [rsp + 0x48], r12d
test r13, r13
jne 0x140011570
xor r14d, r14d
jmp 0x14001157f
mov r14, rdi
inc r14
cmp word [r13 + r14*2], 0
jne 0x140011573
mov rsi, qword [rsi]
movsxd rdi, dword [rsi - 0x10]
lea r15d, [rdi + r14]
test r15d, r15d
js 0x140011d8f
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x1400115b7
mov edx, r15d
lea rcx, [rsp + 0x60]
call fcn.1400045e0
mov rbx, qword [rsp + 0x60]
add rdi, rdi
je 0x1400115ed
test rbx, rbx
je 0x1400115dd
mov r8, rdi
mov rcx, rbx
test rsi, rsi
je 0x1400115d6
mov rdx, rsi
call fcn.14003f6b0
jmp 0x1400115ed
xor edx, edx
call fcn.14003fd50
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
movsxd r8, r14d
add r8, r8
lea rcx, [rdi + rbx]
je 0x140011624
test rcx, rcx
je 0x140011614
test r13, r13
je 0x14001160d
mov rdx, r13
call fcn.14003f6b0
jmp 0x140011624
xor edx, edx
call fcn.14003fd50
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
cmp r15d, dword [rbx - 0xc]
jg 0x140011d99
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor r13d, r13d
mov word [rbx + rax*2], r13w
lea rcx, [rbx - 0x18]
mov rdi, qword [rsp + 0x80]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400116b1
cmp dword [rdi + 0x10], r13d
jl 0x14001169d
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001169d
call fcn.140002eb0
mov rbx, rax
mov rax, 0xffffffffffffffff
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140011685
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x80], rax
mov rbx, qword [rsp + 0x60]
mov r12d, dword [rsp + 0x48]
jmp 0x1400116b1
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.1400048b0
and r12d, 0xfffffffd
mov dword [rsp + 0x48], r12d
lea rdx, [rbx - 0x18]
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400116db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400116fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rax, [rsp + 0x358]
mov rcx, qword [rsp + 0x350]
cmp rcx, rax
je 0x140011717
call fcn.1400244d4
mov r14, qword [rsp + 0x40]
mov rdx, qword [r14 + 0x40]
test rdx, rdx
je 0x140011822
nop dword [rax]
mov rcx, qword [rdx]
test rcx, rcx
je 0x140011815
cmp qword [rdx + 0x10], 0xd
jne 0x140011815
lea r9, [rcx + 0xd]
cmp rcx, r9
jae 0x140011775
lea r8, str.requestAccess
sub r8, rcx
nop word [rax + rax]
movzx eax, byte [rcx + r8]
cmp byte [rcx], al
jne 0x140011815
inc rcx
cmp rcx, r9
jb 0x140011760
test rdx, rdx
je 0x140011822
mov rax, qword [rdx + 8]
lea rdx, [0x14005a778]
test rax, rax
cmovne rdx, rax
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x140011793
test rax, rax
je 0x140011822
lea rax, [rsp + 0x468]
mov qword [rsp + 0x460], rax
mov r8d, 0xfde9
lea rcx, [rsp + 0x460]
call fcn.140006d90
nop
mov rdx, qword [rsp + 0x460]
test rdx, rdx
jne 0x1400117db
mov r8d, r13d
jmp 0x1400117eb
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400117e0
lea rcx, [rsp + 0x90]
call fcn.1400048b0
nop
lea rax, [rsp + 0x468]
mov rcx, qword [rsp + 0x460]
cmp rcx, rax
je 0x140011822
call fcn.1400244d4
jmp 0x140011822
mov rdx, qword [rdx + 0x30]
test rdx, rdx
jne 0x140011730
mov rdx, qword [r14 + 0x40]
test rdx, rdx
je 0x140011922
nop
mov rcx, qword [rdx]
test rcx, rcx
je 0x140011915
cmp qword [rdx + 0x10], 8
jne 0x140011915
lea r9, [rcx + 8]
cmp rcx, r9
jae 0x140011875
lea r8, str.md5check
sub r8, rcx
nop word [rax + rax]
movzx eax, byte [rcx + r8]
cmp byte [rcx], al
jne 0x140011915
inc rcx
cmp rcx, r9
jb 0x140011860
test rdx, rdx
je 0x140011922
mov rax, qword [rdx + 8]
lea rdx, [0x14005a778]
test rax, rax
cmovne rdx, rax
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x140011893
test rax, rax
je 0x140011922
lea rax, [rsp + 0x578]
mov qword [rsp + 0x570], rax
mov r8d, 0xfde9
lea rcx, [rsp + 0x570]
call fcn.140006d90
nop
mov rdx, qword [rsp + 0x570]
test rdx, rdx
jne 0x1400118db
mov r8d, r13d
jmp 0x1400118eb
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400118e0
lea rcx, [rsp + 0x98]
call fcn.1400048b0
nop
lea rax, [rsp + 0x578]
mov rcx, qword [rsp + 0x570]
cmp rcx, rax
je 0x140011922
call fcn.1400244d4
jmp 0x140011922
mov rdx, qword [rdx + 0x30]
test rdx, rdx
jne 0x140011830
mov rdx, qword [r14 + 0x40]
test rdx, rdx
je 0x140011a22
nop
mov rax, qword [rdx]
test rax, rax
je 0x140011a15
cmp qword [rdx + 0x10], 0x14
jne 0x140011a15
lea r9, [rax + 0x14]
cmp rax, r9
jae 0x140011975
lea r8, str.needWaitProccessExit
sub r8, rax
nop word [rax + rax]
movzx ecx, byte [rax + r8]
cmp byte [rax], cl
jne 0x140011a15
inc rax
cmp rax, r9
jb 0x140011960
test rdx, rdx
je 0x140011a22
mov rax, qword [rdx + 8]
lea rdx, [0x14005a778]
test rax, rax
cmovne rdx, rax
mov rax, rdi
inc rax
cmp byte [rdx + rax], 0
jne 0x140011993
test rax, rax
je 0x140011a22
lea rax, [rsp + 0x688]
mov qword [rsp + 0x680], rax
mov r8d, 0xfde9
lea rcx, [rsp + 0x680]
call fcn.140006d90
nop
mov rdx, qword [rsp + 0x680]
test rdx, rdx
jne 0x1400119db
mov r8d, r13d
jmp 0x1400119eb
mov r8, rdi
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400119e0
lea rcx, [rsp + 0xa0]
call fcn.1400048b0
nop
lea rax, [rsp + 0x688]
mov rcx, qword [rsp + 0x680]
cmp rcx, rax
je 0x140011a22
call fcn.1400244d4
jmp 0x140011a22
mov rdx, qword [rdx + 0x30]
test rdx, rdx
jne 0x140011930
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsi + 8]
cmp rbx, qword [rsi + 0x10]
je 0x140011ad9
mov qword [rsp + 0x100], rbx
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
call fcn.140002eb0
add rax, 0x18
mov qword [rbx], rax
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
call fcn.140002eb0
add rax, 0x18
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
call fcn.140002eb0
add rax, 0x18
mov qword [rbx + 0x10], rax
mov rcx, qword [rsp + 0x90]
add rcx, 0xffffffffffffffe8
call fcn.140002eb0
add rax, 0x18
mov qword [rbx + 0x18], rax
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
call fcn.140002eb0
add rax, 0x18
mov qword [rbx + 0x20], rax
mov rcx, qword [rsp + 0xa0]
add rcx, 0xffffffffffffffe8
call fcn.140002eb0
add rax, 0x18
mov qword [rbx + 0x28], rax
add qword [rsi + 8], 0x30
jmp 0x140011aea
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, rsi
call fcn.140008080
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011b0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x78]
call fcn.14000bde0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011b36
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011b54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r10, str.item
mov r15, qword [rsp + 0xb8]
mov r9, r10
inc r9
cmp byte [r9], 0
jne 0x140011b66
sub r9, r10
mov r14, qword [r14 + 0x58]
mov qword [rsp + 0x40], r14
test r14, r14
je 0x140011bec
mov rcx, qword [r14]
test rcx, rcx
je 0x140011ba4
mov rax, qword [r14 + 0x10]
jmp 0x140011bae
lea r8, str.file
mov rdx, qword [rdx + 0x30]
test rdx, rdx
jne 0x140011170
jmp 0x140011b63
mov rax, r13
lea rcx, [0x14005a778]
cmp rax, r9
jne 0x140011bde
lea r8, [rax + rcx]
cmp rcx, r8
jae 0x140011bf4
mov rdx, r10
sub rdx, rcx
movzx eax, byte [rcx + rdx]
cmp byte [rcx], al
jne 0x140011bde
inc rcx
cmp rcx, r8
jb 0x140011bc2
lea rbx, [0x14005a778]
jmp 0x140011150
mov r14, qword [r14 + 0x58]
mov qword [rsp + 0x40], r14
test r14, r14
jne 0x140011b80
mov r14, r13
mov qword [rsp + 0x40], r13
lea rbx, [0x14005a778]
jmp 0x140011150
mov rdi, 0xffffffffffffffff
jmp 0x140011c19
mov rsi, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xc0]
mov rcx, rsi
call fcn.1400244d4
nop
lea rcx, [rsp + 0x7f0]
call fcn.14000bba0
nop
jmp 0x140011cd9
cmp al, 0x3c
jne 0x140011da4
lea rax, [r8 + 1]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x790]
call fcn.1400093f0
mov rcx, rax
test rax, rax
jne 0x140011c6a
mov r8, qword [rsp + 0x40]
jmp 0x140011084
cmp qword [rsp + 0x7c0], 0
je 0x140011c8f
mov rax, qword [rsp + 0x7c8]
mov qword [rcx + 0x50], rax
mov rax, qword [rsp + 0x7c8]
mov qword [rax + 0x58], rcx
jmp 0x140011c9b
mov qword [rax + 0x50], r13
mov qword [rsp + 0x7c0], rcx
mov qword [rsp + 0x7c8], rcx
lea rax, [rsp + 0x790]
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x58], r13
mov r8, qword [rsp + 0x40]
jmp 0x140011084
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011d02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011d21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140011d3c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, 1
mov rcx, qword [rsp + 0x10820]
xor rcx, rsp
call fcn.14001d590
lea r11, [rsp + 0x10830]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
mov ecx, 0x80070057
call fcn.140002a90
nop
lea rdx, [0x1400456b8]
lea rcx, [rsp + 0x108]
call fcn.14000b7e0
lea rdx, [0x140056fd8]
lea rcx, [rsp + 0x108]
call fcn.14001ed3c
int3