Function at 0x140145730
Capabilities:
Enumerate files on windows
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xce0]
sub rsp, 0xde0
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0xcd0], rax
mov qword [rbp + 0x10], r9
mov rsi, rdx
mov qword [rbp - 0x28], rdx
mov r15, rcx
mov rax, qword [rbp + 0xd48]
mov qword [rbp + 8], rax
xor r14d, r14d
mov dword [rbp - 0x78], r14d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], eax
lea r12, vtable.CBuffer.0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
movdqa xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], r14
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x118], 0x7fd8
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmmword [rbp + 0x140], xmm1
movdqa xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r14
lea rdi, [rbp + 0x100]
shl rdi, 8
lea rax, [rbp + 0x128]
shl rax, 8
sub rax, rdi
or rax, 1
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0x100]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], 0x7fd8
mov qword [rbp + 0x178], r14
mov qword [rbp + 0x180], r14
lea rax, [rbp + 0x128]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x128]
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x168]
mov qword [rbp + 0x100], rax
mov edx, 0x104
lea rcx, [rbp + 0x6b0]
call fcn.140195db0
test al, al
je 0x1401473ba
lea rax, [rbp + 0x6b0]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1401458b3
lea rax, [rcx + 1]
cmp rax, 0x104
jae 0x140145915
lea rax, [rcx + 0xe]
lea r8, [0x14020c310]
mov edx, 0x104
cmp rax, rdx
ja 0x1401458ed
lea rcx, [rbp + 0x6b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140145915
lfence
mov r9d, 0x103
sub r9, rcx
sub rdx, rcx
lea rax, [rbp + 0x6b0]
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x8b6], r14w
lea rcx, [rbp + 0x6b0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140145923
lea r8, [rbp + 0x6b0]
mov edx, 0x104
lea rcx, [rbp + 0xac0]
cmp rax, rdx
jae 0x14014594d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x140145961
mov r9d, 0x103
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0xcc6], r14w
lea rax, [rbp + 0xac0]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140145970
lea rax, [rcx + 1]
cmp rax, 0x104
jae 0x1401459d2
lea rax, [rcx + 6]
lea r8, [0x140203ef8]
mov edx, 0x104
cmp rax, rdx
ja 0x1401459aa
lea rcx, [rbp + 0xac0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x1401459d2
lfence
mov r9d, 0x103
sub r9, rcx
sub rdx, rcx
lea rax, [rbp + 0xac0]
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0xcc6], r14w
mov qword [rbp - 0x80], 8
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
cmp rax, rdx
je 0x140145a0d
test rcx, rcx
je 0x140145a08
mov r8, rcx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rbx, [rcx + 8]
cmp rbx, 8
jb 0x140145abd
cmp rbx, qword [rsp + 0x70]
jbe 0x140145a84
lfence
mov rdx, qword [rsp + 0x70]
shr rdx, 1
add rdx, qword [rsp + 0x70]
mov rax, rbx
cmp rdx, rbx
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rbx
cmovae rbx, rax
mov rax, qword [rsp + 0x58]
mov r8, rbx
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
test rax, rax
je 0x140145abd
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x78]
lea rdx, [rcx + rax]
test rdx, rdx
je 0x140145abd
mov rax, qword [rbp - 0x80]
mov qword [rdx], rax
mov rdx, qword [rsp + 0x78]
mov rcx, rdx
sub rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
add rax, 8
add rcx, rax
cmp rcx, qword [rsp + 0x70]
ja 0x140145abd
add rdx, 8
mov qword [rsp + 0x78], rdx
mov ecx, 4
call fcn.1401adb30
mov r13, rax
test rax, rax
je 0x140145ad7
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x140145ada
mov r13, r14
mov r12d, 5
test dword [rsi + 8], 0xfffffffd
jne 0x140146b5f
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xac0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov qword [rbp - 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x140146b52
lea r14, [rbp + 0x128]
shl r14, 8
sub r14, rdi
or r14, 1
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rbp + 0x6b0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140145b40
lea r8, [rbp + 0x6b0]
mov edx, 0x104
lea rcx, [rbp + 0x4a0]
cmp rax, rdx
jae 0x140145b6c
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor edi, edi
jmp 0x140145b81
mov r9d, 0x103
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
xor edi, edi
mov word [rbp + 0x6a6], di
lea rax, [rbp + 0x4a0]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140145b90
lea rax, [rbp + 0x1ec]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140145bb0
lea rax, [rcx + 1]
cmp rax, 0x104
jae 0x140145c14
lea rax, [rcx + 1]
add rax, rdx
lea r8, [rbp + 0x1ec]
mov edx, 0x104
cmp rax, rdx
ja 0x140145bed
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x140145c14
lfence
mov r9d, 0x103
sub r9, rcx
sub rdx, rcx
lea rax, [rbp + 0x4a0]
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0x6a6], di
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x140145c34
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov qword [rbp + 0xf8], rdi
mov rcx, qword [rbp + 0xf0]
mov rbx, qword [rcx + 0x58]
test rbx, rbx
je 0x140145c69
mov rcx, qword [rbx]
test rcx, rcx
je 0x140145c59
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140145c44
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rcx]
shr rax, 8
sub rcx, rax
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140145c99
nop dword [rax]
mov rbx, qword [rcx + 0x10]
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov rcx, rbx
test rbx, rbx
jne 0x140145c80
mov qword [rbp + 0xf0], rdi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x118], 0x7fd8
movdqa xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
movdqa xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rdi
mov qword [rbp + 0x128], r14
lea rax, [rbp + 0x100]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], 0x7fd8
mov qword [rbp + 0x178], rdi
mov qword [rbp + 0x180], rdi
lea rax, [rbp + 0x128]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x128]
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x168]
mov qword [rbp + 0x100], rax
lea rdx, [0x1401fa2e0]
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
mov qword [rbp + 0x28], rax
lea rax, [0x140055850]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9d, reloc.msi.dll_MsiRecordReadStream
mov r8, rbx
mov rdx, qword [rbp + 0xf0]
lea rcx, [rbp + 0x48]
call fcn.140055350
nop
test rbx, rbx
je 0x140145da3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp dword [rbp + 0x48], 0
jne 0x140146b3a
mov rbx, qword [rbp + 0xf0]
test rbx, rbx
je 0x140145de4
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x140145de4
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140145ddb
lea rcx, str.SYSTEMSTATUS
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140145de7
mov rbx, qword [rbx + 0x30]
test rbx, rbx
jne 0x140145dc2
mov rbx, rdi
mov rax, qword [rbp - 0x28]
cmp dword [rax + 8], 0
jne 0x140146b37
test rbx, rbx
je 0x140145e4c
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x140145e4c
mov rdx, qword [r8 + 8]
test rdx, rdx
je 0x140145f3f
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
lea rax, str.START
movzx eax, byte [rax + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140145f3f
cmp rcx, 6
jne 0x140145e20
test r8, r8
je 0x140145e4c
mov rdx, qword [r8 + 0x10]
test rdx, rdx
jne 0x140145e53
lea rdx, [0x1401ef308]
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], 0
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140145e80
lea rcx, [rbp + 0x70]
call fcn.1400026f0
nop
cmp qword [rbp + 0x80], 0
je 0x14014616f
lea rdi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rdi, qword [rbp + 0x70]
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
lea r9d, [rax - 1]
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
dec eax
xor r8d, r8d
movsxd rdx, eax
lea rcx, [rbp + 0xd0]
call fcn.140011470
mov rsi, rax
or dword [rbp - 0x78], 1
mov r8, qword [rbp + 0xe0]
inc r8
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae rdx, qword [rbp + 0xd0]
mov rcx, rdi
call fcn.1401af0c0
test eax, eax
jne 0x140145f48
lea rax, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 8
cmovae rax, qword [rbp + 0xd0]
xor edi, edi
mov qword [rbp + 0xe0], rdi
mov word [rax], di
jmp 0x140145f4a
mov r8, qword [r8 + 0x20]
jmp 0x140145dfe
xor edi, edi
cmp qword [rsi + 0x18], 8
jb 0x140145f54
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x140145f62
cmp rax, 0xd
jne 0x1401460c0
mov eax, dword [0x140210c04]
mov dword [rbp + 0x410], eax
movzx eax, word [0x140210c08]
mov word [rbp + 0x414], ax
movzx eax, word [rsi]
mov word [rbp + 0x410], ax
movzx eax, word [rsi + 2]
mov word [rbp + 0x412], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov ecx, 0x7d0
cmp ax, 0x5a
mov edx, 0x76c
cmovae cx, dx
add cx, ax
mov word [rbp + 0x60], cx
movzx eax, word [rsi + 4]
mov word [rbp + 0x410], ax
movzx eax, word [rsi + 6]
mov word [rbp + 0x412], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov word [rbp + 0x62], ax
movzx eax, word [rsi + 8]
mov word [rbp + 0x410], ax
movzx eax, word [rsi + 0xa]
mov word [rbp + 0x412], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov word [rbp + 0x66], ax
movzx eax, word [rsi + 0xe]
mov word [rbp + 0x410], ax
movzx eax, word [rsi + 0x10]
mov word [rbp + 0x412], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov word [rbp + 0x68], ax
movzx eax, word [rsi + 0x12]
mov word [rbp + 0x410], ax
movzx eax, word [rsi + 0x14]
mov word [rbp + 0x412], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov word [rbp + 0x6a], ax
movzx eax, word [rsi + 0x16]
mov word [rbp + 0x410], ax
movzx eax, word [rsi + 0x18]
mov word [rbp + 0x412], ax
xor edx, edx
lea r8d, [rdx + 0xa]
lea rcx, [rbp + 0x410]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov word [rbp + 0x6c], ax
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
and dword [rbp - 0x78], 0xfffffffe
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x14014610a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140146105
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140146baf
call fcn.140007ea0
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], di
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov r8d, dword [rbp - 0x4c]
shl r8, 0x20
mov ecx, dword [rbp - 0x50]
movabs rdx, 0xfe624e212ac18000
add r8, rdx
add r8, rcx
movabs rax, 0xd6bf94d5e57a42bd
imul r8
add rdx, r8
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [rbp - 0x70], edx
jmp 0x140146176
mov dword [rbp - 0x70], 0xffffffff
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x1401461b4
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401461af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140146bb6
call fcn.140007ea0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x70], 0
test rbx, rbx
je 0x14014621c
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x14014621c
mov rdx, qword [r8 + 8]
test rdx, rdx
je 0x1401462cb
mov rcx, rdi
nop dword [rax + rax]
lea rax, str.COMMENT
movzx eax, byte [rax + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x1401462cb
cmp rcx, 8
jne 0x1401461f0
test r8, r8
je 0x14014621c
mov rdx, qword [r8 + 0x10]
test rdx, rdx
jne 0x140146223
lea rdx, [0x1401ef308]
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140146251
lea rcx, [rbp + 0x90]
call fcn.1400026f0
nop
cmp qword [rbp + 0xa0], 0
je 0x1401462d4
lea r8, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae r8, qword [rbp + 0x90]
mov dword [rsp + 0x28], 0x100
lea rax, [rbp + 0x8c0]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbp + 0xabe], di
cmp eax, 0x459
jne 0x140146409
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140146409
mov r8, qword [r8 + 0x20]
jmp 0x1401461d3
lea r8, [0x1401ff3c8]
mov edx, 0x100
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test rbx, rbx
je 0x140146356
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140146356
mov rax, qword [rcx + 8]
test rax, rax
je 0x14014631d
mov edx, 0x52
cmp dl, byte [rax]
jne 0x14014631d
mov edx, 0x41
cmp dl, byte [rax + 1]
jne 0x14014631d
cmp dil, byte [rax + 2]
je 0x140146323
mov rcx, qword [rcx + 0x20]
jmp 0x1401462f6
test rcx, rcx
je 0x140146356
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140146356
movzx eax, byte [rax]
cmp al, 0x31
je 0x140146352
sub al, 0x54
cmp al, 0x25
ja 0x14014634e
movabs rcx, 0x2100000021
bt rcx, rax
jb 0x140146352
xor eax, eax
jmp 0x140146358
mov al, 1
jmp 0x140146358
xor al, al
test al, al
je 0x140146409
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 7
lea rax, [0x1401eb910]
mov qword [rbp], rax
mov word [rbp - 0x20], di
lea r8, [rbp - 0x20]
mov edx, 0xf000041
mov rcx, qword [r15 + 0x40]
call fcn.1400ace00
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae r8, qword [rbp - 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], 0
jne 0x1401463a2
lfence
mov edx, 0x100
lea rcx, [rbp + 0x8c0]
cmp rax, rdx
jae 0x1401463c9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x1401463dc
mov r9d, 0xff
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov word [rbp + 0xabe], di
cmp qword [rbp - 8], 8
jb 0x140146409
mov rax, qword [rbp]
mov rax, qword [rax + 0x10]
lea rcx, [fcn.140007ea0]
cmp rax, rcx
mov rcx, qword [rbp - 0x20]
jne 0x140146402
call fcn.1401c5244
jmp 0x140146409
call qword [case.0x14003c8e9.0]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14014644a
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140146445
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140146bbd
call fcn.140007ea0
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], 0
test rbx, rbx
je 0x1401464ac
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x1401464ac
mov rdx, qword [r8 + 8]
test rdx, rdx
je 0x140146554
mov rax, rdi
lea rcx, str.USER
movzx ecx, byte [rcx + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x140146554
cmp rax, r12
jne 0x140146481
test r8, r8
je 0x1401464ac
mov rdx, qword [r8 + 0x10]
test rdx, rdx
jne 0x1401464b3
lea rdx, [0x1401ef308]
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1401464e1
lea rcx, [rbp + 0xb0]
call fcn.1400026f0
nop
cmp qword [rbp + 0xc0], 0
je 0x14014655d
lea r8, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae r8, qword [rbp + 0xb0]
mov dword [rsp + 0x28], 0x40
lea rax, [rbp + 0x420]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbp + 0x49e], di
cmp eax, 0x459
jne 0x140146564
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140146564
mov r8, qword [r8 + 0x20]
jmp 0x14014646c
mov word [rbp + 0x420], di
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x1401465a5
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401465a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140146bc4
call fcn.140007ea0
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
mov edx, 0x104
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea rbx, [rbp + rax*2 + 0x49e]
test rax, rax
je 0x140146601
nop dword [rax]
dec rax
movzx ecx, word [rbx]
cmp cx, 0x2e
je 0x140146607
cmp cx, 0x5c
je 0x140146601
cmp cx, 0x2f
je 0x140146601
sub rbx, 2
test rax, rax
jne 0x1401465e0
cmp word [rbx], 0x2e
jne 0x140146650
lea rcx, [rbp + 0x4a0]
mov rax, rbx
sub rax, rcx
sar rax, 1
mov edi, 0x104
sub rdi, rax
je 0x140146650
lfence
lea r8, [0x1401f1ab8]
mov rdx, rdi
mov rcx, rbx
cmp rdi, 4
jbe 0x14014663f
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x140146650
lea r9, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
xor eax, eax
mov word [rbx + rdi*2 - 2], ax
lea rcx, [rbp + 0x4a0]
mov rax, 0xffffffffffffffff
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140146660
lea rdi, [rax*2 + 2]
mov rdx, qword [rsp + 0x50]
mov rsi, rdx
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
test rdi, rdi
je 0x140146790
cmp rcx, r9
je 0x1401466b5
test rdx, rdx
je 0x1401466ad
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov r9, rcx
mov qword [rsp + 0x40], rcx
lea rbx, [rdi + rdx]
cmp rbx, rdi
jb 0x140146789
cmp rbx, qword [rsp + 0x48]
jbe 0x140146731
lfence
mov rdx, qword [rsp + 0x48]
shr rdx, 1
add rdx, qword [rsp + 0x48]
mov rax, rbx
cmp rdx, rbx
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rbx
cmovae rbx, rax
mov rax, qword [rsp + 0x30]
mov r8, rbx
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
mov r9, rax
test rax, rax
je 0x14014677a
mov rcx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rdx, qword [rsp + 0x50]
lea rax, [rdx + rcx]
test rax, rax
je 0x140146789
mov r8, rdi
lea rdx, [rbp + 0x4a0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rax, rdi
mov rcx, qword [rsp + 0x38]
sub rax, rcx
mov rdx, qword [rsp + 0x50]
add rax, rdx
mov r9, qword [rsp + 0x40]
add rax, r9
cmp rax, qword [rsp + 0x48]
jbe 0x1401468b1
xor r8b, r8b
jmp 0x1401468bc
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rsi, 0xffffffffffffffff
mov dword [rbp - 0x6c], esi
lea r8, [rbp + 0x8c0]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [r8 + rax*2], 0
jne 0x1401467a1
lea rdi, [rax*2 + 2]
mov rsi, rdx
test rdi, rdi
je 0x1401468e8
cmp rcx, r9
je 0x1401467e8
test rdx, rdx
je 0x1401467e0
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov r9, rcx
mov qword [rsp + 0x40], rcx
lea rbx, [rdx + rdi]
cmp rbx, rdi
jb 0x1401468e1
cmp rbx, qword [rsp + 0x48]
jbe 0x140146868
lfence
mov rdx, qword [rsp + 0x48]
shr rdx, 1
add rdx, qword [rsp + 0x48]
mov rax, rbx
cmp rdx, rbx
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rbx
cmovae rbx, rax
mov rax, qword [rsp + 0x30]
mov r8, rbx
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
mov r9, rax
test rax, rax
je 0x1401468d2
mov rcx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rdx, qword [rsp + 0x50]
lea rax, [rdx + rcx]
test rax, rax
je 0x1401468e1
mov r8, rdi
lea rdx, [rbp + 0x8c0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsp + 0x50]
mov rax, rdx
mov rcx, qword [rsp + 0x38]
sub rax, rcx
mov r9, qword [rsp + 0x40]
add rax, r9
add rax, rdi
cmp rax, qword [rsp + 0x48]
jbe 0x1401469f5
xor r8b, r8b
jmp 0x140146a00
add rdx, rdi
mov qword [rsp + 0x50], rdx
mov r8b, 1
mov rax, 0xffffffffffffffff
test r8b, r8b
cmovne rax, rsi
mov rsi, rax
jmp 0x140146790
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rsi, 0xffffffffffffffff
mov dword [rbp - 0x68], esi
lea r8, [rbp + 0x420]
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [r8 + rax*2], 0
jne 0x140146900
lea rdi, [rax*2 + 2]
mov rsi, rdx
test rdi, rdi
je 0x140146a39
cmp rcx, r9
je 0x140146944
test rdx, rdx
je 0x14014693f
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rcx
lea rbx, [rdx + rdi]
cmp rbx, rdi
jb 0x140146a32
cmp rbx, qword [rsp + 0x48]
jbe 0x1401469c1
lfence
mov rdx, qword [rsp + 0x48]
shr rdx, 1
add rdx, qword [rsp + 0x48]
mov rax, rbx
cmp rdx, rbx
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rbx
cmovae rbx, rax
mov rax, qword [rsp + 0x30]
mov r8, rbx
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
mov rcx, rax
test rax, rax
je 0x140146a32
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov rdx, qword [rsp + 0x50]
add rcx, rdx
je 0x140146a32
mov r8, rdi
lea rdx, [rbp + 0x420]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, qword [rsp + 0x38]
add rax, qword [rsp + 0x40]
add rax, rdi
cmp rax, qword [rsp + 0x48]
jbe 0x140146a16
xor cl, cl
jmp 0x140146a20
add rdx, rdi
mov qword [rsp + 0x50], rdx
mov r8b, 1
mov rax, 0xffffffffffffffff
test r8b, r8b
cmovne rax, rsi
mov rsi, rax
jmp 0x1401468e8
add rcx, rdi
mov qword [rsp + 0x50], rcx
mov cl, 1
mov rax, 0xffffffffffffffff
test cl, cl
cmovne rax, rsi
mov rsi, rax
jmp 0x140146a39
mov rsi, 0xffffffffffffffff
mov dword [rbp - 0x64], esi
mov edi, 0x64
mov dword [rbp - 0x60], edi
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
cmp rax, rdx
je 0x140146a77
test rcx, rcx
je 0x140146a72
mov r8, rcx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rbx, [rcx + 0x14]
cmp rbx, 0x14
jb 0x140146b33
cmp rbx, qword [rsp + 0x70]
jbe 0x140146af1
lfence
mov rdx, qword [rsp + 0x70]
shr rdx, 1
add rdx, qword [rsp + 0x70]
mov rax, rbx
cmp rdx, rbx
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rbx
cmovae rbx, rax
mov rax, qword [rsp + 0x58]
mov r8, rbx
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
test rax, rax
je 0x140146b33
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov edi, dword [rbp - 0x60]
mov rcx, qword [rsp + 0x78]
lea rdx, [rcx + rax]
test rdx, rdx
je 0x140146b33
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], edi
mov rdx, qword [rsp + 0x78]
mov rcx, rdx
sub rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
add rax, 0x14
add rcx, rax
mov rsi, qword [rbp - 0x58]
cmp rcx, qword [rsp + 0x70]
ja 0x140146b37
add rdx, 0x14
mov qword [rsp + 0x78], rdx
jmp 0x140146b37
mov rsi, qword [rbp - 0x58]
inc dword [rbp - 0x7c]
lea rdx, [rbp + 0x1c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140145b30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rbp - 0x28]
test r13, r13
je 0x140146b78
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov rcx, r13
call qword [case.0x1401b9e8b.6]
cmp dword [rsi + 8], 2
jb 0x140146bcb
jne 0x140147222
lea rbx, [r15 + 0x18]
mov qword [rbp + 0x38], rbx
mov byte [rbp + 0x40], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov eax, dword [r15 + 8]
add dword [rbp - 0x7c], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140147222
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdi, [r15 + 0x18]
mov qword [rbp + 0x18], rdi
mov byte [rbp + 0x20], 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rbx, qword [r15]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x1401470dd
mov r9, qword [rsp + 0x38]
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
lea r14, [rax*2 + 2]
lea r15, [rbx + 0x30]
cmp qword [r15 + 0x18], 8
jb 0x140146c1a
mov r15, qword [r15]
mov rsi, qword [rsp + 0x50]
test r14, r14
je 0x140146d0c
mov rdx, qword [rsp + 0x40]
cmp r9, rdx
je 0x140146c4c
test rsi, rsi
je 0x140146c47
mov r8, rsi
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x40], r9
mov rdi, qword [rsp + 0x50]
add rdi, r14
cmp rdi, r14
jb 0x140146d05
cmp rdi, qword [rsp + 0x48]
jbe 0x140146cc4
lfence
mov rdx, qword [rsp + 0x48]
shr rdx, 1
add rdx, qword [rsp + 0x48]
mov rax, rdi
cmp rdx, rdi
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rdi
cmovae rdi, rax
mov rax, qword [rsp + 0x30]
mov r8, rdi
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
mov r9, rax
test rax, rax
je 0x140146d00
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdi
mov rcx, qword [rsp + 0x50]
add rcx, r9
je 0x140146d05
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
sub rax, r9
add rax, qword [rsp + 0x40]
add rax, r14
cmp rax, qword [rsp + 0x48]
jbe 0x140146e0f
xor cl, cl
jmp 0x140146e16
mov r9, qword [rsp + 0x38]
mov rsi, 0xffffffffffffffff
mov dword [rbp - 0x6c], esi
mov rax, qword [rbx + 0x60]
lea r14, [rax*2 + 2]
lea r15, [rbx + 0x50]
cmp qword [r15 + 0x18], 8
jb 0x140146d29
mov r15, qword [r15]
mov rsi, qword [rsp + 0x50]
test r14, r14
je 0x140146e37
mov rdx, qword [rsp + 0x40]
cmp r9, rdx
je 0x140146d5b
test rsi, rsi
je 0x140146d56
mov r8, rsi
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x40], r9
mov rdi, qword [rsp + 0x50]
add rdi, r14
cmp rdi, r14
jb 0x140146e30
cmp rdi, qword [rsp + 0x48]
jbe 0x140146dd3
lfence
mov rdx, qword [rsp + 0x48]
shr rdx, 1
add rdx, qword [rsp + 0x48]
mov rax, rdi
cmp rdx, rdi
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rdi
cmovae rdi, rax
mov rax, qword [rsp + 0x30]
mov r8, rdi
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
mov r9, rax
test rax, rax
je 0x140146e2b
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdi
mov rcx, qword [rsp + 0x50]
add rcx, r9
je 0x140146e30
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
sub rax, r9
add rax, qword [rsp + 0x40]
add rax, r14
cmp rax, qword [rsp + 0x48]
jbe 0x140146f3d
xor cl, cl
jmp 0x140146f44
add qword [rsp + 0x50], r14
mov cl, 1
mov rax, 0xffffffffffffffff
test cl, cl
cmovne rax, rsi
mov rsi, rax
jmp 0x140146d0c
mov r9, qword [rsp + 0x38]
mov rsi, 0xffffffffffffffff
mov dword [rbp - 0x68], esi
mov rax, qword [rbx + 0x80]
lea r14, [rax*2 + 2]
lea r15, [rbx + 0x70]
cmp qword [r15 + 0x18], 8
jb 0x140146e57
mov r15, qword [r15]
mov rsi, qword [rsp + 0x50]
test r14, r14
je 0x140146f65
mov rdx, qword [rsp + 0x40]
cmp r9, rdx
je 0x140146e89
test rsi, rsi
je 0x140146e84
mov r8, rsi
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x40], r9
mov rdi, qword [rsp + 0x50]
add rdi, r14
cmp rdi, r14
jb 0x140146f5e
cmp rdi, qword [rsp + 0x48]
jbe 0x140146f01
lfence
mov rdx, qword [rsp + 0x48]
shr rdx, 1
add rdx, qword [rsp + 0x48]
mov rax, rdi
cmp rdx, rdi
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rdi
cmovae rdi, rax
mov rax, qword [rsp + 0x30]
mov r8, rdi
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
mov r9, rax
test rax, rax
je 0x140146f59
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdi
mov rcx, qword [rsp + 0x50]
add rcx, r9
je 0x140146f5e
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
mov r9, qword [rsp + 0x38]
sub rax, r9
add rax, qword [rsp + 0x40]
add rax, r14
cmp rax, qword [rsp + 0x48]
jbe 0x14014708f
xor cl, cl
jmp 0x140147096
add qword [rsp + 0x50], r14
mov cl, 1
mov rax, 0xffffffffffffffff
test cl, cl
cmovne rax, rsi
mov rsi, rax
jmp 0x140146e37
mov r9, qword [rsp + 0x38]
mov rsi, 0xffffffffffffffff
mov dword [rbp - 0x64], esi
mov esi, gethostbyaddr
mov dword [rbp - 0x60], esi
mov eax, dword [rbx + 0x28]
mov dword [rbp - 0x70], eax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
cmp rcx, rdx
je 0x140146fa3
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x140146f99
call sub.VCRUNTIME140.dll_memmove
mov r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdi, qword [rsp + 0x78]
add rdi, 0x14
cmp rdi, 0x14
jb 0x140147060
cmp rdi, qword [rsp + 0x70]
jbe 0x140147022
lfence
mov rdx, qword [rsp + 0x70]
shr rdx, 1
add rdx, qword [rsp + 0x70]
mov rax, rdi
cmp rdx, rdi
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rdi
cmovae rdi, rax
mov rax, qword [rsp + 0x58]
mov r8, rdi
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
mov r9, qword [rsp + 0x38]
test rax, rax
je 0x140147060
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rdi
mov esi, dword [rbp - 0x60]
mov rdx, qword [rsp + 0x78]
add rdx, qword [rsp + 0x60]
je 0x140147060
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], esi
mov r8, qword [rsp + 0x78]
sub r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
add rcx, 0x14
add rcx, r8
mov r9, qword [rsp + 0x38]
cmp rcx, qword [rsp + 0x70]
ja 0x140147060
add qword [rsp + 0x78], 0x14
inc dword [rbp - 0x7c]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1401470ab
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14014708a
cmp rbx, qword [rax + 0x10]
jne 0x14014708a
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140147077
mov rbx, rax
jmp 0x1401470cf
add qword [rsp + 0x50], r14
mov cl, 1
mov rax, 0xffffffffffffffff
test cl, cl
cmovne rax, rsi
mov rsi, rax
jmp 0x140146f65
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1401470cf
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1401470c0
cmp byte [rbx + 0x19], 0
je 0x140146c00
mov rdi, qword [rbp + 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp + 0x20], 0
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1401470ff
lea rax, [rdx + 8]
jmp 0x140147101
xor eax, eax
mov r8d, dword [rbp - 0x7c]
test r8d, r8d
je 0x14014713c
add rax, 8
mov edx, r8d
nop dword [rax]
nop word [rax + rax]
add dword [rax - 4], ecx
add dword [rax], ecx
add dword [rax + 4], ecx
lea rax, [rax + 0x14]
sub rdx, 1
jne 0x140147120
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140147222
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x60]
cmp rax, rdx
je 0x140147178
test rcx, rcx
je 0x140147173
mov r8, rcx
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rbx, [rcx + rdi]
cmp rbx, rdi
jb 0x140147222
cmp rbx, qword [rsp + 0x70]
jbe 0x1401471ee
lfence
mov rdx, qword [rsp + 0x70]
shr rdx, 1
add rdx, qword [rsp + 0x70]
mov rax, rbx
cmp rdx, rbx
cmovae rax, rdx
add rax, 0xfff
and rax, 0xfffffffffffff000
cmp rax, rbx
cmovae rbx, rax
mov rax, qword [rsp + 0x58]
mov r8, rbx
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
test rax, rax
je 0x140147222
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x78]
add rcx, rax
je 0x140147222
mov r8, rdi
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, qword [rsp + 0x60]
add rax, qword [rsp + 0x68]
add rax, rdi
cmp rax, qword [rsp + 0x70]
ja 0x140147222
add rcx, rdi
mov qword [rsp + 0x78], rcx
xor edi, edi
mov edx, edi
cmp qword [rsp + 0x78], rdi
cmovne rdx, qword [rsp + 0x68]
mov rax, qword [rbp - 0x80]
mov qword [rdx], rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x78]
cmp r8, qword [rbp + 0xd40]
ja 0x140147264
mov eax, r8d
mov rcx, qword [rbp + 8]
mov qword [rcx], rax
mov rdx, rbx
mov rcx, qword [rbp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov r12d, edi
mov qword [rsp + 0x78], rdi
mov rax, qword [rsp + 0x68]
cmp rbx, rax
cmovne rax, rbx
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x70], rdi
jbe 0x1401472a7
mov rax, qword [rsp + 0x58]
mov rdx, rbx
lea rcx, [rsp + 0x58]
mov rax, qword [rax + 0x18]
call qword [case.0x14003c8e9.0]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
cmp rdx, rax
cmovne rax, rdx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x48], rdi
jbe 0x1401472ec
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
mov rax, qword [rax + 0x18]
call qword [case.0x14003c8e9.0]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x14014730c
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov qword [rbp + 0xf8], rdi
mov rcx, qword [rbp + 0xf0]
mov rbx, qword [rcx + 0x58]
test rbx, rbx
je 0x140147345
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140147335
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x140147320
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rcx]
shr rax, 8
sub rcx, rax
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140147379
nop dword [rax + rax]
mov rbx, qword [rcx + 0x10]
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov rcx, rbx
test rbx, rbx
jne 0x140147360
mov qword [rbp + 0xf0], rdi
lea rbx, vtable.CBuffer.0
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14014739d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401473b2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, r12d
jmp 0x14014747d
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x1401473da
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov qword [rbp + 0xf8], r14
mov rcx, qword [rbp + 0xf0]
mov rbx, qword [rcx + 0x58]
test rbx, rbx
je 0x140147415
nop word [rax + rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140147405
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1401473f0
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rcx]
shr rax, 8
sub rcx, rax
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140147449
nop dword [rax + rax]
mov rbx, qword [rcx + 0x10]
mov rax, qword [0x14024fa58]
call qword [case.0x14003c8e9.0]
mov rcx, rbx
test rbx, rbx
jne 0x140147430
mov qword [rbp + 0xf0], r14
mov qword [rsp + 0x30], r12
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140147466
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov qword [rsp + 0x58], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14014747b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rcx, qword [rbp + 0xcd0]
xor rcx, rsp
call fcn.1401c5190
mov rbx, qword [rsp + 0xe28]
add rsp, 0xde0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret