Function at 0x14001da40
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x428]
sub rsp, 0x528
mov rax, qword [0x1400fc100]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov r14, r9
mov qword [rsp + 0x38], r9
mov rdi, r8
mov qword [rbp - 0x78], r8
mov r15, rdx
mov r13, rcx
mov qword [rsp + 0x40], rdx
mov qword [rbp + 0x170], r9
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
call fcn.140013730
nop
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x210]
call fcn.1400bc070
lea rcx, [rbp + 0x210]
call fcn.140021e30
nop
mov qword [rbp + 0x200], r12
mov r8b, 1
mov rdx, rdi
lea rcx, [rbp + 0x210]
call fcn.1400220f0
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x14001dafd
jle 0x14001daf6
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x220], r12
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x14001db18
jle 0x14001db11
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x218], r12
mov rcx, qword [rbp + 0x210]
test rcx, rcx
je 0x14001db33
jle 0x14001db2c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x210], r12
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x14001db4e
jle 0x14001db47
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbp + 0x258], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x230], xmm0
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.140009670
cmp byte [rbp + 0x22c], 0
je 0x14001db85
lea rcx, [rbp + 0x328]
call fcn.1400076b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.140009670
mov ebx, r12d
cmp byte [rbp + 0x229], r12b
setne bl
mov rdx, rdi
lea rcx, [rbp + 0x390]
call fcn.1400200c0
nop
lea rax, [0x1400e3dcc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [rbp + 0x390]
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.14001c930
nop
lea rcx, [rbp + 0x390]
call fcn.1400079d0
lea rcx, [rbp + 0x1e0]
call fcn.140013730
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1f0], rcx
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1f8], rdx
lea rcx, [rbp + 0x1e0]
call fcn.140008470
cmp qword [rbp + 0x1f0], 0
setne bl
lea rcx, [rsp + 0x40]
call fcn.140008470
test bl, bl
je 0x14001debe
lea rdx, [rbp + 0x1f0]
lea rcx, [rsp + 0x50]
call fcn.1400136f0
mov rdi, rax
mov dword [r15], 0xc000010e
lea rcx, [r15 + 8]
call fcn.140013730
mov rax, qword [rdi]
mov qword [r15 + 8], rax
mov rax, qword [rdi + 8]
mov qword [r15 + 0x10], rax
mov qword [rdi], r12
mov qword [rdi + 8], r12
mov byte [r15 + 0x18], 1
mov rcx, rdi
call fcn.140008470
nop
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x14001dcb9
jle 0x14001dcb2
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x220], r12
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x14001dcd4
jle 0x14001dccd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x218], r12
mov rcx, qword [rbp + 0x210]
test rcx, rcx
je 0x14001dcef
jle 0x14001dce8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x210], r12
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x14001dd0a
jle 0x14001dd03
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbp + 0x258], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x230], xmm0
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.140009670
cmp byte [rbp + 0x22c], 0
je 0x14001dd41
lea rcx, [rbp + 0x328]
call fcn.1400076b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.140009670
lea rcx, [rbp + 0x348]
call fcn.1400444d0
lea rcx, [rbp + 0x328]
call fcn.1400079d0
lea rcx, [rbp + 0x308]
call fcn.1400079d0
mov rcx, qword [rbp + 0x2e0]
test rcx, rcx
je 0x14001ddac
mov rdx, qword [rbp + 0x2f0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.14000d7c0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], r12
lea rcx, [rbp + 0x2d0]
call fcn.14001a130
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x14001ddf1
mov rdx, qword [rbp + 0x2b0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.14000d7c0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], r12
lea rcx, [rbp + 0x290]
call fcn.14001a130
lea rcx, [rbp + 0x270]
call fcn.140001760
mov r8, qword [rbp + 0x270]
test r8, r8
je 0x14001de5f
mov rcx, qword [rbp + 0x280]
movabs rax, 0x6666666666666667
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rcx, r8
call fcn.14000d7c0
mov qword [rbp + 0x270], r12
mov qword [rbp + 0x278], r12
mov qword [rbp + 0x280], r12
mov rcx, qword [rbp + 0x258]
test rcx, rcx
jle 0x14001de71
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov rcx, qword [rbp + 0x220]
test rcx, rcx
jle 0x14001de83
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp + 0x218]
test rcx, rcx
jle 0x14001de95
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x210]
test rcx, rcx
jle 0x14001dea8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x1f0]
call fcn.140008470
nop
mov rcx, qword [r14 + 8]
jmp 0x14001ee73
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov r8d, 0x1000
mov rdx, qword [r13 + 8]
lea rcx, [rbp + 0x150]
call fcn.140027300
nop
mov eax, dword [rbp + 0x150]
test eax, eax
jns 0x14001df1e
mov dword [r15], eax
mov byte [r15 + 0x18], 0
cmp byte [rbp + 0x168], 0
je 0x14001dc9e
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14001dc9e
call fcn.140002330
jmp 0x14001dc9e
cmp byte [rbp + 0x229], 0
jne 0x14001e012
cmp byte [rbp + 0x168], 0
je 0x14001eeaf
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x14001df48
mov eax, dword [rax]
jmp 0x14001df4b
mov eax, r12d
add eax, 8
mov dword [rbp + 0x1e4], eax
mov rcx, rdi
call fcn.140003820
add ax, ax
mov word [rbp + 0x1e0], ax
mov word [rbp + 0x1e2], ax
mov rax, qword [rbp + 0x168]
test al, al
je 0x14001eeaf
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x14001dfb6
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0x1e0]
mov rdx, qword [rdx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, qword [rbp + 0x168]
test al, al
je 0x14001eeaf
mov rcx, rdi
call fcn.1400076b0
mov rbx, rax
mov rcx, rdi
call fcn.140003820
mov r9, rax
add r9, r9
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x14001e004
mov rax, qword [rdx + 0x18]
mov rdx, qword [rdx]
add rdx, 8
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, rbx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsp + 0x40], 8
jmp 0x14001e0fb
mov dword [rbp + 0x1e4], r12d
cmp byte [rbp + 0x168], 0
je 0x14001eea9
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x14001e037
mov rax, qword [rax]
jmp 0x14001e03a
mov rax, r12
add rax, 0x10
mov qword [rbp + 0x1e8], rax
mov rcx, rdi
call fcn.140003820
add ax, ax
mov word [rbp + 0x1e0], ax
mov word [rbp + 0x1e2], ax
mov rax, qword [rbp + 0x168]
test al, al
je 0x14001eea9
mov esi, reloc.WS2_32.dll_recv
mov qword [rsp + 0x40], rsi
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x14001e0ae
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r9d, esi
lea r8, [rbp + 0x1e0]
mov rdx, qword [rdx]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, qword [rbp + 0x168]
test al, al
je 0x14001eea9
mov rcx, rdi
call fcn.1400076b0
mov rbx, rax
mov rcx, rdi
call fcn.140003820
mov r9, rax
add r9, r9
mov rdx, qword [rbp + 0x158]
test rdx, rdx
je 0x14001e0fb
mov rax, qword [rdx + 0x18]
mov rdx, qword [rdx]
add rdx, rsi
mov rax, qword [rax + 0x70]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, rbx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, qword [r13 + 0x10]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rbp + 0x229]
test al, al
je 0x14001e158
cmp byte [rcx + 0x15], 0
je 0x14001e15e
mov byte [rsp + 0x30], 0
mov esi, r12d
test al, al
setne sil
lea rdx, str.kernel32.dll
lea rcx, [rsp + 0x60]
call fcn.140004270
nop
lea rcx, [rsp + 0x60]
call fcn.140007680
test al, al
je 0x14001e165
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x390]
call fcn.140007a80
jmp 0x14001e23e
cmp byte [rcx + 0x15], 1
jne 0x14001e114
mov byte [rsp + 0x30], 1
jmp 0x14001e119
mov rbx, qword [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.140009940
mov r9d, 0x5c
mov rdx, rbx
mov rcx, rax
call fcn.14001ff20
cmp rax, 0xffffffffffffffff
jne 0x14001e1c4
mov rbx, qword [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.140009940
mov r9d, Ordinal_50
mov rdx, rbx
mov rcx, rax
call fcn.14001ff20
cmp rax, 0xffffffffffffffff
jne 0x14001e1c4
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x390]
call fcn.140007a80
jmp 0x14001e23e
lea rdi, [rax + 1]
lea rcx, [rsp + 0x31]
call fcn.140004300
mov r8, rax
movzx edx, byte [rsp + 0x31]
lea rcx, [rbp + 0x390]
call fcn.14000ed90
nop
mov rax, qword [rsp + 0x70]
cmp rax, rdi
jb 0x14001eeb5
mov qword [rbp + 0x208], 0xffffffffffffffff
sub rax, rdi
mov qword [rbp + 0x1e0], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x208]
call fcn.140004610
mov rbx, qword [rax]
lea rcx, [rsp + 0x60]
call fcn.140009940
lea rdx, [rax + rdi*2]
mov r8, rbx
lea rcx, [rbp + 0x390]
call fcn.140004380
nop
lea rbx, [0x1400e3dcc]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [rbp + 0x390]
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.14001c930
nop
lea rcx, [rbp + 0x390]
call fcn.1400079d0
nop
mov qword [rsp + 0x20], rbx
lea r9, [0x1400e3f68]
mov r8, qword [rsp + 0x50]
lea rdx, [rbp + 0x3b0]
mov rcx, r13
call fcn.14001d080
nop
lea rcx, [rsp + 0x50]
call fcn.140008470
nop
lea rcx, [rsp + 0x60]
call fcn.1400079d0
mov rax, qword [r13]
mov rcx, qword [rax + 0x10]
movzx edx, byte [rcx + 0x15]
movzx eax, byte [rbp + 0x229]
test dl, dl
jne 0x14001e2f8
test al, al
jne 0x14001e2f8
mov dword [r15], 0xc0000359
mov byte [r15 + 0x18], al
cmp byte [rbp + 0x408], al
je 0x14001def7
lea rcx, [rbp + 0x3e0]
call fcn.140007dc0
lea rcx, [rbp + 0x3c0]
call fcn.1400079d0
jmp 0x14001def7
mov ecx, 1
test dl, dl
je 0x14001e307
test al, al
cmovne r12d, ecx
xor esi, esi
mov r9d, esi
test al, al
setne r9b
mov dword [rsp + 0x20], ecx
lea r8, str.LdrLoadDll
lea rdx, [rbp + 0x180]
mov rcx, r13
call fcn.14001d870
nop
mov eax, dword [rbp + 0x180]
test eax, eax
jns 0x14001e56b
mov dword [r15], eax
mov byte [r15 + 0x18], sil
cmp byte [rbp + 0x1d8], sil
je 0x14001e364
lea rcx, [rbp + 0x1b0]
call fcn.140007dc0
lea rcx, [rbp + 0x190]
call fcn.1400079d0
nop
cmp byte [rbp + 0x408], 0
je 0x14001e386
lea rcx, [rbp + 0x3e0]
call fcn.140007dc0
lea rcx, [rbp + 0x3c0]
call fcn.1400079d0
nop
cmp byte [rbp + 0x168], 0
je 0x14001e3a1
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14001e3a1
call fcn.140002330
nop
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x14001e3bc
jle 0x14001e3b5
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x220], rsi
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x14001e3d7
jle 0x14001e3d0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x218], rsi
mov rcx, qword [rbp + 0x210]
test rcx, rcx
je 0x14001e3f2
jle 0x14001e3eb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x210], rsi
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x14001e40d
jle 0x14001e406
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbp + 0x258], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x230], xmm0
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.140009670
cmp byte [rbp + 0x22c], 0
je 0x14001e444
lea rcx, [rbp + 0x328]
call fcn.1400076b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.140009670
lea rcx, [rbp + 0x348]
call fcn.1400444d0
lea rcx, [rbp + 0x328]
call fcn.1400079d0
lea rcx, [rbp + 0x308]
call fcn.1400079d0
mov rcx, qword [rbp + 0x2e0]
test rcx, rcx
je 0x14001e4af
mov rdx, qword [rbp + 0x2f0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.14000d7c0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], rsi
lea rcx, [rbp + 0x2d0]
call fcn.14001a130
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x14001e4f4
mov rdx, qword [rbp + 0x2b0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.14000d7c0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], rsi
lea rcx, [rbp + 0x290]
call fcn.14001a130
lea rcx, [rbp + 0x270]
call fcn.140001760
mov r8, qword [rbp + 0x270]
test r8, r8
je 0x14001de5f
mov rcx, qword [rbp + 0x280]
sub rcx, r8
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rcx, r8
call fcn.14000d7c0
mov qword [rbp + 0x270], rsi
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], rsi
jmp 0x14001de5f
cmp r12d, 1
jne 0x14001e638
cmp byte [r13 + 0x80], 0
jne 0x14001e638
cmp dword [0x1400ffb5c], 6
jne 0x14001e638
mov rax, qword [0x1400ffb60]
cmp eax, r12d
ja 0x14001e638
jb 0x14001e638
mov dword [rbp + 0x1e0], 0x90909090
mov word [rbp + 0x1e4], 0x9090
mov rbx, qword [0x1400ffc90]
test rbx, rbx
je 0x14001e630
mov dword [rbp + 0x208], esi
lea rax, [rbp + 0x208]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 0x3f]
lea r8d, [r12 + 5]
mov rdx, rbx
mov rcx, qword [r13 + 8]
call fcn.1400317f0
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 0x70]
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rsi
lea r9d, [r12 + 5]
lea r8, [rbp + 0x1e0]
mov rdx, rbx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov qword [rsp + 0x20], rsi
mov r9d, dword [rbp + 0x208]
lea r8d, [r12 + 5]
mov rdx, rbx
mov rcx, qword [r13 + 8]
call fcn.1400317f0
mov byte [r13 + 0x80], 1
xor r14d, r14d
mov qword [rbp + 0x1e0], r14
mov edx, r14d
cmp byte [rbp + 0x229], r14b
setne dl
lea rcx, [rbp + 0x1e0]
call fcn.140013c80
nop
mov rbx, qword [rbp + 0x1e0]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x18]
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
mov qword [rbp], 0xffffffffffff0001
mov qword [rbp + 8], 0xff
movabs rdi, 0xffffffff00000003
mov qword [rbp + 0x10], rdi
mov eax, 0xffffffff
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r14
lea rcx, [rbp + 0x30]
call fcn.140006280
mov dword [rbp - 0x10], 2
mov qword [rbp - 8], 4
mov qword [rbp + 0x20], r14
mov dword [rbp + 0x48], r14d
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 0xffffffffffff0001
mov qword [rbp + 0x60], 0xff
mov qword [rbp + 0x68], rdi
mov eax, 0xffffffff
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], r14
mov qword [rbp + 0x80], r14
lea rcx, [rbp + 0x88]
call fcn.140006280
mov dword [rbp + 0x48], 2
mov qword [rbp + 0x50], 4
mov qword [rbp + 0x78], r14
cmp byte [rbp + 0x168], r14b
je 0x14001eebb
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x14001e72a
mov rdi, qword [rax]
jmp 0x14001e72d
mov rdi, r14
mov dword [rbp + 0xa0], r14d
mov qword [rbp + 0xa8], r14
mov qword [rbp + 0xb0], 0xffffffffffff0001
mov qword [rbp + 0xb8], 0xff
movabs rax, 0xffffffff00000003
mov qword [rbp + 0xc0], rax
mov eax, 0xffffffff
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], r14
lea rcx, [rbp + 0xe0]
call fcn.140006280
mov dword [rbp + 0xa0], 2
mov qword [rbp + 0xa8], 8
mov qword [rbp + 0xd0], rdi
cmp byte [rbp + 0x168], 0
je 0x14001eec1
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x14001e7c2
mov rdi, qword [rax]
jmp 0x14001e7c5
mov rdi, r14
add rdi, 0x800
mov dword [rbp + 0xf8], r14d
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x108], 0xffffffffffff0001
mov qword [rbp + 0x110], 0xff
movabs rax, 0xffffffff00000003
mov qword [rbp + 0x118], rax
mov eax, 0xffffffff
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
lea rcx, [rbp + 0x138]
call fcn.140006280
mov dword [rbp + 0xf8], 2
mov qword [rbp + 0x100], 8
mov qword [rbp + 0x128], rdi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140019d40
nop
cmp byte [rbp + 0x1d8], 0
je 0x14001eec7
mov rdi, qword [rbp + 0x188]
mov dword [rbp - 0x70], r14d
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 0xffffffffffff0001
mov qword [rbp - 0x58], 0xff
movabs rax, 0xffffffff00000003
mov qword [rbp - 0x50], rax
mov eax, 0xffffffff
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
lea rcx, [rbp - 0x30]
call fcn.140006280
mov dword [rbp - 0x70], 2
mov qword [rbp - 0x68], 8
mov qword [rbp - 0x40], rdi
mov r9d, 1
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call rsi
nop
lea rcx, [rbp - 0x30]
call fcn.1400061b0
nop
lea rcx, [rsp + 0x60]
call fcn.140001760
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x14001e964
mov rsi, qword [rsp + 0x68]
cmp rdi, rsi
je 0x14001e927
nop dword [rax]
lea rcx, [rdi + 0x40]
call fcn.1400061b0
add rdi, 0x58
cmp rdi, rsi
jne 0x14001e910
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
sub rcx, rdi
movabs rax, 0x2e8ba2e8ba2e8ba3
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rdx, rdx, 0x58
mov rcx, rdi
call fcn.14000d7c0
mov qword [rsp + 0x60], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
lea r9, [0x140013b20]
mov edx, 0x58
lea r8d, [rdx - 0x54]
lea rcx, [rbp - 0x10]
call fcn.14008e9c4
lea r14, [rbx + 0xa8]
mov rax, qword [r14]
lea r8, sym.Loader.exe_struct_asmjit::Operand_const_asmjit::noOperand
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
mov r9, r8
mov edx, 0x21c
mov rcx, r14
call qword [rax + Ordinal_50]
mov rcx, qword [r13]
add rcx, 0x240
xor edx, edx
call fcn.140028ec0
mov rsi, qword [r13]
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001ea6d
mov rcx, qword [rsi + 0x268]
test rcx, rcx
je 0x14001e9e1
call fcn.140002310
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsi + 0x260]
mov rcx, qword [rsi + 0x268]
mov r12, qword [rax]
test rcx, rcx
je 0x14001e9fc
call fcn.140002330
mov rsi, qword [r13]
mov rax, qword [r14]
mov rcx, r14
cmp r12, rdi
mov edi, dword [r14 + 0x60]
jne 0x14001ea39
sub rdi, qword [r14 + 0x48]
add rdi, qword [r14 + 0x58]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r9, [rbp + 0x200]
mov r8, rdi
mov rdx, rax
lea rcx, [rsi + 0x240]
call fcn.140028250
mov edi, eax
test eax, eax
jmp 0x14001eaa4
sub rdi, qword [r14 + 0x48]
add rdi, qword [r14 + 0x58]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x200]
mov r8, rdi
mov rdx, rax
lea rcx, [rsi + 0x240]
call fcn.140028380
mov edi, eax
test eax, eax
jmp 0x14001eaa4
mov edi, dword [r14 + 0x60]
sub rdi, qword [r14 + 0x48]
add rdi, qword [r14 + 0x58]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.WS2_32.dll_htonl]
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x200]
mov r8, rdi
mov rdx, rax
lea rcx, [rsi + 0x240]
call fcn.140027a00
mov edi, eax
test eax, eax
js 0x14001eab6
mov edi, dword [rbp + 0x200]
mov eax, edi
test eax, eax
jns 0x14001ebaf
cmp dword [rbp + 0x3b0], 0
jl 0x14001ebaf
cmp byte [rsp + 0x30], 0
je 0x14001ebaf
mov rcx, qword [r13]
add rcx, 0x240
cmp byte [rbp + 0x168], 0
je 0x14001eea3
mov rax, qword [rbp + 0x158]
xor esi, esi
test rax, rax
je 0x14001eaf9
mov rdx, qword [rax]
jmp 0x14001eafc
mov rdx, rsi
mov r8, qword [rsp + 0x40]
add r8, rdx
cmp byte [rbp + 0x408], 0
je 0x14001eea3
mov rdx, qword [rbp + 0x3b8]
call fcn.140028e10
test eax, eax
jne 0x14001ebb1
mov dword [r15], edi
mov byte [r15 + 0x18], al
test rbx, rbx
je 0x14001eb3f
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp byte [rbp + 0x1d8], 0
je 0x14001eb61
lea rcx, [rbp + 0x1b0]
call fcn.140007dc0
lea rcx, [rbp + 0x190]
call fcn.1400079d0
nop
cmp byte [rbp + 0x408], 0
je 0x14001eb83
lea rcx, [rbp + 0x3e0]
call fcn.140007dc0
lea rcx, [rbp + 0x3c0]
call fcn.1400079d0
nop
cmp byte [rbp + 0x168], 0
je 0x14001eb9e
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14001eb9e
call fcn.140002330
nop
lea rcx, [rbp + 0x210]
call fcn.140021f90
jmp 0x14001ee5d
xor esi, esi
mov eax, esi
cmp byte [rbp + 0x229], 0
setne al
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, qword [rbp - 0x78]
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.14001c8b0
xor r8d, r8d
mov rdx, rax
mov rcx, r15
call fcn.140019f40
nop
test rbx, rbx
je 0x14001ebf7
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp byte [rbp + 0x1d8], 0
je 0x14001ec19
lea rcx, [rbp + 0x1b0]
call fcn.140007dc0
lea rcx, [rbp + 0x190]
call fcn.1400079d0
nop
cmp byte [rbp + 0x408], 0
je 0x14001ec3b
lea rcx, [rbp + 0x3e0]
call fcn.140007dc0
lea rcx, [rbp + 0x3c0]
call fcn.1400079d0
nop
cmp byte [rbp + 0x168], 0
je 0x14001ec56
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14001ec56
call fcn.140002330
nop
mov rcx, qword [rbp + 0x220]
test rcx, rcx
je 0x14001ec71
jle 0x14001ec6a
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x220], rsi
mov rcx, qword [rbp + 0x218]
test rcx, rcx
je 0x14001ec8c
jle 0x14001ec85
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x218], rsi
mov rcx, qword [rbp + 0x210]
test rcx, rcx
je 0x14001eca7
jle 0x14001eca0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x210], rsi
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x14001ecc2
jle 0x14001ecbb
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbp + 0x258], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x230], xmm0
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.140009670
cmp byte [rbp + 0x22c], 0
je 0x14001ecf9
lea rcx, [rbp + 0x328]
call fcn.1400076b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x328]
call fcn.140009670
lea rcx, [rbp + 0x348]
call fcn.1400444d0
lea rcx, [rbp + 0x328]
call fcn.1400079d0
lea rcx, [rbp + 0x308]
call fcn.1400079d0
mov rcx, qword [rbp + 0x2e0]
test rcx, rcx
je 0x14001ed64
mov rdx, qword [rbp + 0x2f0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.14000d7c0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], rsi
lea rcx, [rbp + 0x2d0]
call fcn.14001a130
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x14001eda9
mov rdx, qword [rbp + 0x2b0]
sub rdx, rcx
sar rdx, 3
lea rdx, [rdx*8]
call fcn.14000d7c0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], rsi
lea rcx, [rbp + 0x290]
call fcn.14001a130
lea rcx, [rbp + 0x270]
call fcn.140001760
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je 0x14001ee14
mov rdx, qword [rbp + 0x280]
sub rdx, rcx
movabs rax, 0x6666666666666667
imul rdx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
call fcn.14000d7c0
mov qword [rbp + 0x270], rsi
mov qword [rbp + 0x278], rsi
mov qword [rbp + 0x280], rsi
mov rcx, qword [rbp + 0x258]
test rcx, rcx
jle 0x14001ee26
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov rcx, qword [rbp + 0x220]
test rcx, rcx
jle 0x14001ee38
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp + 0x218]
test rcx, rcx
jle 0x14001ee4a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x210]
test rcx, rcx
jle 0x14001ee5d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x1f0]
call fcn.140008470
nop
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14001ee7d
call fcn.140002330
mov rax, r15
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.14008e960
add rsp, 0x528
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140013890
nop
call fcn.140013890
int3
call fcn.140013890
nop
call fcn.14001fca0
nop
call fcn.140013890
nop
call fcn.140013890
nop
call fcn.140013890
int3