Function at 0x1400139fc
Capabilities:
Check if file exists
Enumerate disk volumes
Get disk information via ioctl
Get file attributes
Get volume information via ioctl
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x468]
sub rsp, 0x540
mov rax, qword [0x14004d298]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov byte [rsp + 0x68], dl
mov r14, rcx
xor edi, edi
mov byte [rsp + 0x50], dil
or qword [rsp + 0x40], 0xffffffffffffffff
cmp byte [rcx + 0xa5], dil
je 0x140013cb8
mov qword [rsp + 0x60], rdi
lea rsi, [rcx + 0x2d6]
lea r12, [0x14004d128]
mov edi, 2
lea r15d, [rdi - 1]
xor r13d, r13d
cmp byte [rcx + 0x2d2], r13b
jne 0x140013a85
cmp byte [rsi], r13b
je 0x140013c81
lea rbx, [rcx + 0x18]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
cmp byte [r14 + 0x2d2], r13b
je 0x140013af8
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013ade
test byte [rcx + 0x1c], r15b
je 0x140013ade
cmp byte [rcx + 0x19], 4
jb 0x140013ade
lea r9, [r14 + 0x2b8]
mov edx, 0x39
mov qword [rsp + 0x28], r14
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14001970c
mov byte [r14 + 0x2d2], r13b
mov rax, qword [r14 + 0x2e0]
mov qword [rsp + 0x60], rax
mov qword [r14 + 0x2e0], r13
cmp byte [rsi], r13b
je 0x140013b4d
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013b3a
test byte [rcx + 0x1c], r15b
je 0x140013b3a
cmp byte [rcx + 0x19], 4
jb 0x140013b3a
lea r9, [r14 + 0x2a0]
mov edx, 0x3a
mov qword [rsp + 0x28], r14
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14001970c
mov byte [rsi], r13b
mov rsi, qword [r14 + 0x2e8]
mov qword [r14 + 0x2e8], r13
jmp 0x140013b50
mov rsi, r13
test rbx, rbx
je 0x140013b64
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
lea r13, [0x1400467c0]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140013bf1
mov rcx, rax
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Unregister_Notification]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
je 0x140013bc1
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013bf8
test byte [rcx + 0x1c], r15b
je 0x140013bf8
cmp byte [rcx + 0x19], dil
jb 0x140013bf8
mov edx, 0x3b
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140004f00
jmp 0x140013bf1
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013bf8
test byte [rcx + 0x1c], r15b
je 0x140013bf8
cmp byte [rcx + 0x19], 5
jb 0x140013bf8
mov edx, 0x3c
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140004ebc
mov rcx, qword [0x14004d128]
test rsi, rsi
je 0x140013c88
mov rcx, rsi
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Unregister_Notification]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
je 0x140013c51
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013cae
test byte [rcx + 0x1c], r15b
je 0x140013c88
cmp byte [rcx + 0x19], dil
jb 0x140013c88
mov edx, 0x3d
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140004f00
jmp 0x140013c81
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013cae
test byte [rcx + 0x1c], r15b
je 0x140013c88
cmp byte [rcx + 0x19], 5
jb 0x140013c88
mov edx, 0x3e
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140004ebc
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013cae
test byte [rcx + 0x1c], r15b
je 0x140013cae
cmp byte [rcx + 0x19], dil
jb 0x140013cae
mov qword [rsp + 0x20], r14
mov r9d, dword [r14 + 0x80]
mov rcx, qword [rcx + 0x10]
call fcn.14001926c
mov eax, 0x80830001
jmp 0x140016219
lea rbx, [rcx + 0x18]
mov qword [rbp - 0x70], rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
nop
lea r12, [0x14004d128]
mov r15d, 1
lea r13, [0x1400467c0]
mov esi, 0x102
jmp 0x140013d9f
cmp byte [r14 + 0xa5], dil
jne 0x140013dae
cmp byte [r14 + 0xa6], dil
jne 0x140013dae
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, esi
jne 0x140013dae
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, esi
jne 0x140013dae
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013d7f
test byte [rcx + 0x1c], r15b
je 0x140013d7f
cmp byte [rcx + 0x19], 3
jb 0x140013d7f
mov edx, 0x40
mov qword [rsp + 0x20], r14
mov r9d, dword [r14 + 0x80]
mov rcx, qword [rcx + 0x10]
call fcn.1400191ac
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
cmp byte [r14 + 0xa4], dil
jne 0x140013cee
jmp 0x140013dde
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013de5
test byte [rcx + 0x1c], r15b
je 0x140013de5
cmp byte [rcx + 0x19], 5
jb 0x140013de5
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
mov esi, 2
cmp byte [r14 + 0x2d8], dil
je 0x140013f06
mov byte [rsp + 0x50], r15b
mov byte [r14 + 0x2d8], 0
cmp byte [r14 + 0x2d6], 0
je 0x140013e60
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013e49
test byte [rcx + 0x1c], r15b
je 0x140013e49
cmp byte [rcx + 0x19], 4
jb 0x140013e49
lea r9, [r14 + 0x2a0]
lea edx, [rsi + 0x3f]
mov qword [rsp + 0x28], r14
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14001970c
mov byte [r14 + 0x2d6], 0
mov rdi, qword [r14 + 0x2e8]
and qword [r14 + 0x2e8], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
test rdi, rdi
je 0x140013ef0
mov rcx, rdi
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Unregister_Notification]
nop dword [rax + rax]
mov r9d, eax
xor edi, edi
test eax, eax
je 0x140013ec0
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013ef0
test byte [rcx + 0x1c], r15b
je 0x140013ef0
cmp byte [rcx + 0x19], sil
jb 0x140013ef0
lea edx, [rdi + 0x42]
mov eax, dword [r14 + 0x80]
mov dword [rsp + 0x20], eax
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140004f00
jmp 0x140013ef0
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013ef0
test byte [rcx + 0x1c], r15b
je 0x140013ef0
cmp byte [rcx + 0x19], 5
jb 0x140013ef0
mov edx, 0x43
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140004ebc
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp byte [r14 + 0xa5], dil
jne 0x14001619e
cmp byte [r14 + 0xa6], dil
jne 0x14001619e
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140016197
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140016197
cmp byte [r14 + 0x2d1], dil
jne 0x14001416d
cmp byte [r14 + 0x480], dil
jne 0x140013f8c
cmp byte [r14 + 0x470], dil
jne 0x140013f8c
cmp byte [r14 + 0x490], dil
je 0x1400140ac
xor r9d, r9d
mov r8b, r15b
xor edx, edx
mov rcx, r14
call fcn.14000d550
mov byte [r14 + 0xa4], r15b
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
lea rcx, [r14 + 0x540]
call fcn.14001e688
test eax, eax
jns 0x140013ff6
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140013ff6
test byte [rcx + 0x1c], r15b
je 0x140013ff6
cmp byte [rcx + 0x19], sil
jb 0x140013ff6
mov edx, 0x45
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
lea rcx, [r14 + 0x4a0]
call fcn.14001e688
test eax, eax
jns 0x14001403a
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x14001403a
test byte [rcx + 0x1c], r15b
je 0x14001403a
cmp byte [rcx + 0x19], sil
jb 0x14001403a
mov edx, 0x46
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
lea rcx, [r14 + 0x5e0]
call fcn.14001e688
test eax, eax
jns 0x14001407e
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x14001407e
test byte [rcx + 0x1c], r15b
je 0x14001407e
cmp byte [rcx + 0x19], sil
jb 0x14001407e
mov edx, 0x47
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
mov byte [r14 + 0xa4], dil
mov dl, r15b
mov rcx, r14
call fcn.1400179ec
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14000d680
cmp byte [r14 + 0xa5], dil
jne 0x140014364
cmp byte [r14 + 0xa6], dil
jne 0x140014364
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140014364
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140014364
mov rcx, r14
call fcn.1400174dc
mov edi, eax
test eax, eax
jns 0x140014164
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
mov edx, 0x49
mov dword [rsp + 0x20], edi
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
nop
test rbx, rbx
je 0x14001415d
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
mov eax, edi
jmp 0x140016219
mov byte [r14 + 0x2d1], r15b
xor edi, edi
cmp dword [r14 + 0x320], 0xffffffff
je 0x140014e04
mov rax, qword [r14 + 0x2c0]
cmp rax, qword [r14 + 0x98]
je 0x140014194
test rax, rax
jne 0x140014ab6
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov edx, 0x104
lea rcx, [rbp + 0x220]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstVolumeW]
nop dword [rax + rax]
mov rdi, rax
mov byte [rsp + 0x48], 0
cmp rax, 0xffffffffffffffff
je 0x1400144a8
or qword [rsp + 0x58], 0xffffffffffffffff
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov eax, 0x5c
cmp word [rbp + 0x220], ax
jne 0x140014419
cmp word [rbp + 0x222], ax
jne 0x140014419
lea ecx, [rax - 0x1d]
cmp word [rbp + 0x224], cx
jne 0x140014419
cmp word [rbp + 0x226], ax
jne 0x140014419
mov eax, 0xfffe
add word [rsp + 0x70], ax
mov word [rbp + 0x222], cx
cmp byte [r14 + 0xa5], 0
jne 0x14001452f
cmp byte [r14 + 0xa6], 0
jne 0x14001452f
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x14001452f
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x14001452f
mov r9d, 0x100080
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov cl, r15b
call fcn.14000c078
test eax, eax
js 0x140014419
and qword [rsp + 0x38], 0
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xc
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
je 0x1400143fd
mov eax, dword [rbp + 0x148]
mov r9d, dword [rbp + 0x144]
cmp dword [r14 + 0x320], r9d
jne 0x1400143c6
cmp dword [r14 + 0x324], eax
jne 0x1400143c6
mov byte [rsp + 0x48], r15b
add word [rsp + 0x70], si
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400143fd
test byte [rcx + 0x1c], r15b
je 0x1400143fd
cmp byte [rcx + 0x19], 4
jb 0x1400143fd
mov edx, 0x4b
lea r9, [rsp + 0x70]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
jmp 0x1400143fd
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x14001439f
cmp byte [rcx + 0x19], 5
jb 0x14001439f
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x48
jmp 0x1400161e4
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400143fd
test byte [rcx + 0x1c], r15b
je 0x1400143fd
cmp byte [rcx + 0x19], 5
jb 0x1400143fd
mov edx, 0x4c
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], eax
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140018e40
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
cmp byte [rsp + 0x48], 0
jne 0x140014499
mov r8d, 0x104
lea rdx, [rbp + 0x220]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextVolumeW]
nop dword [rax + rax]
test eax, eax
jne 0x1400141c6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x12
je 0x140014499
mov rax, qword [0x14004d128]
cmp rax, r12
je 0x140014499
test byte [rax + 0x1c], r15b
je 0x140014499
cmp byte [rax + 0x19], sil
jb 0x140014499
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
lea r8, [r14 + 0x90]
mov edx, 0x4d
mov qword [rsp + 0x20], r8
mov r9d, eax
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140018f58
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindVolumeClose]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400144f6
test byte [rcx + 0x1c], r15b
je 0x1400144f6
cmp byte [rcx + 0x19], 4
jb 0x1400144f6
lea rax, [r14 + 0x90]
mov edx, 0x4e
mov qword [rsp + 0x28], rax
mov eax, dword [r14 + 0x324]
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x320]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140018e40
mov rcx, qword [0x14004d128]
cmp byte [rsp + 0x48], 0
jne 0x14001459c
cmp rcx, r12
je 0x1400150ad
test byte [rcx + 0x1c], r15b
je 0x1400150ad
cmp byte [rcx + 0x19], sil
jb 0x1400150ad
lea r9, [r14 + 0x2a0]
mov edx, 0x4f
jmp 0x140015098
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x14001455f
test byte [rcx + 0x1c], r15b
je 0x14001455f
cmp byte [rcx + 0x19], 5
jb 0x14001455f
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindVolumeClose]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x4a
jmp 0x1400161e4
mov r9d, 0x100080
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov cl, r15b
call fcn.14000c078
mov edi, eax
test eax, eax
jns 0x1400145ff
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
lea r9, [r14 + 0x90]
mov edx, 0x50
mov dword [rsp + 0x20], edi
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000c408
jmp 0x140014149
and qword [rsp + 0x38], 0
lea rax, [rbp - 0x74]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x60
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90064
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
je 0x14001475b
and dword [rsp + 0x58], 0
xor ecx, ecx
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_0.dll_OpenCluster]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x140014730
mov dword [rbp - 0x60], 0x11c
lea r9, [rbp - 0x60]
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_0.dll_GetClusterInformation]
nop dword [rax + rax]
test eax, eax
jne 0x1400146e4
test byte [rbp + 0xb4], r15b
je 0x1400146ad
mov eax, dword [rbp + 0xb0]
shr eax, 0x10
cmp eax, 9
ja 0x1400146ad
jne 0x1400146e4
cmp word [rbp + 0xb0], 8
jbe 0x1400146e4
mov byte [r14 + 0x2d9], r15b
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x14001471f
test byte [rcx + 0x1c], r15b
je 0x14001471f
cmp byte [rcx + 0x19], 4
jb 0x14001471f
mov edx, 0x51
lea r9, [rsp + 0x70]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
jmp 0x14001471f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x14001471f
test byte [rcx + 0x1c], r15b
je 0x14001471f
cmp byte [rcx + 0x19], sil
jb 0x14001471f
mov edx, 0x52
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x70]
mov rcx, qword [rcx + 0x10]
call fcn.1400195a0
mov rcx, rdi
call qword [sym.imp.ext_ms_win_cluster_clusapi_l1_1_0.dll_CloseCluster]
nop dword [rax + rax]
jmp 0x140014796
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014796
test byte [rcx + 0x1c], r15b
je 0x140014796
cmp byte [rcx + 0x19], sil
jb 0x140014796
mov edx, 0x53
jmp 0x140014784
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014796
test byte [rcx + 0x1c], r15b
je 0x140014796
cmp byte [rcx + 0x19], sil
jb 0x140014796
mov edx, 0x54
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x70]
mov rcx, qword [rcx + 0x10]
call fcn.1400195a0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
lea rdi, [r14 + 0x2b8]
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [0x14004dce0]
movdqu xmmword [rdi], xmm0
mov rcx, qword [r14 + 0x2b0]
test rcx, rcx
je 0x1400147de
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
and qword [r14 + 0x2b0], 0
movzx ecx, word [rsp + 0x70]
add rcx, rsi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
lea rcx, [r14 + 0x2b0]
mov qword [rcx], rax
test rax, rax
jne 0x140014832
mov edi, 0x8007000e
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
lea edx, [rax + 0x55]
jmp 0x140014131
mov qword [rsp + 0x20], rcx
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.14000af4c
mov dword [rsp + 0x58], eax
lea r11, [r14 + 0x2a0]
test byte [0x14004dcc0], r15b
je 0x140014905
mov r10, qword [r14 + 0x2c0]
movzx ecx, word [rdi]
shr cx, 1
movzx r9d, cx
mov word [rbp - 0x80], r9w
mov r8, qword [r14 + 0x2a8]
movzx ecx, word [r11]
shr cx, 1
movzx edx, cx
mov word [rsp + 0x48], dx
lea rax, [rsp + 0x48]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], rsi
xor ecx, ecx
add edx, edx
mov qword [rbp + 0x1f0], r8
mov dword [rbp + 0x1f8], edx
mov dword [rbp + 0x1fc], ecx
lea rax, [rbp - 0x80]
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], rsi
add r9d, r9d
mov qword [rbp + 0x210], r10
mov dword [rbp + 0x218], r9d
mov dword [rbp + 0x21c], ecx
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
lea r9d, [rcx + 5]
lea rdx, [0x140045b70]
call fcn.140018d10
lea r11, [r14 + 0x2a0]
jmp 0x140014907
xor eax, eax
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014941
test byte [rcx + 0x1c], r15b
je 0x140014941
cmp byte [rcx + 0x19], 4
jb 0x140014941
mov edx, 0x56
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r11
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.140018ff4
mov rcx, qword [0x14004d128]
mov eax, dword [rsp + 0x58]
test eax, eax
jns 0x14001499f
cmp rcx, r12
je 0x140014976
test byte [rcx + 0x1c], r15b
je 0x140014976
cmp byte [rcx + 0x19], sil
jb 0x140014976
lea r9, [r14 + 0x90]
mov edx, 0x57
mov dword [rsp + 0x20], eax
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000c408
movups xmm0, xmmword [r14 + 0x90]
movdqu xmmword [rdi], xmm0
test rbx, rbx
je 0x140014996
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
mov eax, dword [rsp + 0x58]
jmp 0x140016219
cmp rcx, r12
je 0x1400149dd
test byte [rcx + 0x1c], r15b
je 0x1400149dd
cmp byte [rcx + 0x19], 4
jb 0x1400149dd
lea rax, [r14 + 0x90]
mov edx, 0x58
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, dword [r14 + 0x80]
mov rcx, qword [rcx + 0x10]
call fcn.140018ff4
mov rcx, qword [0x14004d128]
cmp byte [r14 + 0xa5], 0
jne 0x140014da9
cmp byte [r14 + 0xa6], 0
jne 0x140014da9
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140014da2
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140014da2
mov rdx, rdi
mov rcx, r14
call fcn.140016ab4
mov edi, eax
test eax, eax
jns 0x140014a7d
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
mov edx, 0x5a
mov r9, qword [rsp + 0x60]
jmp 0x1400145ea
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014aad
test byte [rcx + 0x1c], r15b
je 0x140014aad
cmp byte [rcx + 0x19], 4
jb 0x140014aad
mov edx, 0x5b
lea r9, [r14 + 0x2a0]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
xor edi, edi
mov byte [r14 + 0xa7], dil
cmp byte [rsp + 0x50], dil
je 0x140014bbe
cmp byte [r14 + 0xa5], dil
jne 0x140014d40
cmp byte [r14 + 0xa6], dil
jne 0x140014d40
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140014d40
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140014d40
mov qword [rsp + 0x40], rdi
lea rdx, [r14 + 0x2b8]
mov r9d, 0x100080
lea r8, [rsp + 0x40]
mov cl, r15b
call fcn.14000c078
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], edi
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.14000b044
mov dword [rsp + 0x58], eax
test rdi, rdi
je 0x140014b7d
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor edi, edi
mov qword [rsp + 0x40], rdi
mov eax, dword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
test eax, eax
js 0x140014cb6
mov ecx, dword [rsi + 4]
cmp dword [rsi], ecx
jne 0x140014cb6
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x140014bb9
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor edi, edi
lea esi, [rdi + 2]
cmp byte [r14 + 0x480], dil
jne 0x140014bf7
cmp byte [r14 + 0x2d9], dil
je 0x1400151f4
mov rcx, qword [r14 + 0x360]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x1400151f4
mov byte [r14 + 0x480], dil
cmp byte [r14 + 0x470], dil
jne 0x14001537b
cmp byte [r14 + 0xa5], dil
jne 0x14001543a
cmp byte [r14 + 0xa6], dil
jne 0x14001543a
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x14001543a
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x14001543a
lea r9, [r14 + 0x478]
mov r8d, r15d
mov rdx, qword [r14 + 0x288]
mov rcx, r14
call fcn.14001bc54
mov edi, eax
test eax, eax
jns 0x140015342
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
lea r9, [r14 + 0x2a0]
mov edx, 0x6b
jmp 0x1400145ea
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014cea
test byte [rcx + 0x1c], r15b
je 0x140014cea
cmp byte [rcx + 0x19], 2
jb 0x140014cea
mov edx, 0x5d
mov dword [rsp + 0x20], eax
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
xor edx, edx
mov rcx, r14
call fcn.1400110dc
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
nop
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x140016200
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x140016200
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140014d7b
cmp byte [rcx + 0x19], 5
jb 0x140014d7b
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x5c
jmp 0x1400161e4
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140014ddd
cmp byte [rcx + 0x19], 5
jb 0x140014ddd
mov edx, 0xfc
lea r9, [r14 + 0x2a0]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x59
jmp 0x1400161e4
cmp byte [r14 + 0x2d7], dil
jne 0x140015065
cmp byte [r14 + 0xa5], dil
jne 0x140015003
cmp byte [r14 + 0xa6], dil
jne 0x140015003
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015003
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015003
lea rdi, [r14 + 0x2a0]
mov r9d, 0x100080
lea r8, [rsp + 0x40]
mov rdx, rdi
mov cl, r15b
call fcn.14000c078
test eax, eax
js 0x140014fba
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
and qword [rsp + 0x38], 0
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70214
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rcx, rax
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
je 0x140014f53
mov al, 4
test byte [rbp + 0x158], al
je 0x140014f26
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014f21
test byte [rcx + 0x1c], r15b
je 0x140014f21
cmp byte [rcx + 0x19], al
jb 0x140014f21
mov edx, 0x5f
mov r9, rdi
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov cl, r15b
jmp 0x140014f99
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014f97
test byte [rcx + 0x1c], r15b
je 0x140014f97
cmp byte [rcx + 0x19], al
jb 0x140014f97
mov edx, 0x60
mov r9, rdi
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
jmp 0x140014f97
mov rax, qword [0x14004d128]
cmp rax, r12
je 0x140014f97
test byte [rax + 0x1c], r15b
je 0x140014f97
cmp byte [rax + 0x19], 4
jb 0x140014f97
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
mov edx, 0x61
mov qword [rsp + 0x20], rdi
mov r9d, eax
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140018f58
xor cl, cl
mov eax, 0xa7
mov rdx, r14
lea rdi, [rax + rdx]
mov byte [rdi], cl
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x140014ff4
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014fea
test byte [rcx + 0x1c], r15b
je 0x140014fea
cmp byte [rcx + 0x19], sil
jb 0x140014fea
mov edx, 0x62
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000c408
lea rdi, [r14 + 0xa7]
mov byte [rdi], 0
or qword [rsp + 0x40], 0xffffffffffffffff
mov byte [r14 + 0x2d7], r15b
jmp 0x14001506c
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x14001503e
cmp byte [rcx + 0x19], 5
jb 0x14001503e
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x5e
jmp 0x1400161e4
lea rdi, [r14 + 0xa7]
lea rax, [r14 + 0x2a0]
cmp byte [rdi], 0
je 0x1400150cb
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400150ad
test byte [rcx + 0x1c], r15b
je 0x1400150ad
cmp byte [rcx + 0x19], sil
jb 0x1400150ad
mov edx, 0x63
mov r9, rax
mov dword [rsp + 0x20], 0x80830005
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000c408
nop
test rbx, rbx
je 0x1400150c1
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
mov eax, 0x80830005
jmp 0x140016219
lea rax, [r14 + 0x90]
mov qword [rsp + 0x60], rax
mov r9d, 0x100080
lea r8, [rsp + 0x40]
mov rdx, rax
mov cl, r15b
call fcn.14000c078
mov edi, eax
test eax, eax
jns 0x140015126
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
mov edx, 0x64
mov r9, qword [rsp + 0x60]
jmp 0x1400145ea
xor edi, edi
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x74]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x60
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90064
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
je 0x1400151a1
mov byte [r14 + 0x2d9], r15b
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400151de
test byte [rcx + 0x1c], r15b
je 0x1400151de
cmp byte [rcx + 0x19], 4
jb 0x1400151de
lea edx, [rdi + 0x65]
lea r9, [r14 + 0x2a0]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
jmp 0x1400151de
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400151de
test byte [rcx + 0x1c], r15b
je 0x1400151de
cmp byte [rcx + 0x19], sil
jb 0x1400151de
mov edx, 0x66
mov dword [rsp + 0x20], eax
lea r9, [r14 + 0x2a0]
mov rcx, qword [rcx + 0x10]
call fcn.1400195a0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x140014bbe
cmp byte [r14 + 0xa5], dil
jne 0x1400152e0
cmp byte [r14 + 0xa6], dil
jne 0x1400152e0
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x1400152e0
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x1400152e0
lea r9, [r14 + 0x488]
xor r8d, r8d
mov rdx, qword [r14 + 0x270]
mov rcx, r14
call fcn.14001bc54
mov edi, eax
test eax, eax
jns 0x1400152a2
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
lea r9, [r14 + 0x2a0]
mov edx, 0x68
jmp 0x1400145ea
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400152d2
test byte [rcx + 0x1c], r15b
je 0x1400152d2
cmp byte [rcx + 0x19], 4
jb 0x1400152d2
lea r9, [r14 + 0x2a0]
mov edx, 0x69
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov byte [r14 + 0x480], r15b
xor edi, edi
jmp 0x140014bf7
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x14001531b
cmp byte [rcx + 0x19], 5
jb 0x14001531b
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x67
jmp 0x1400161e4
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140015372
test byte [rcx + 0x1c], r15b
je 0x140015372
cmp byte [rcx + 0x19], 4
jb 0x140015372
lea r9, [r14 + 0x2a0]
mov edx, 0x6c
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov byte [r14 + 0x470], r15b
xor edi, edi
cmp byte [r14 + 0x490], dil
jne 0x1400154d5
cmp byte [r14 + 0xa5], dil
jne 0x1400155a0
cmp byte [r14 + 0xa6], dil
jne 0x1400155a0
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x1400155a0
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x1400155a0
lea r9, [r14 + 0x498]
mov r8d, r15d
mov rdx, qword [r14 + 0x258]
mov rcx, r14
call fcn.14001bc54
mov edi, eax
test eax, eax
jns 0x14001549c
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
lea r9, [r14 + 0x2a0]
mov edx, 0x6e
jmp 0x1400145ea
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140015475
cmp byte [rcx + 0x19], 5
jb 0x140015475
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x6a
jmp 0x1400161e4
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400154cc
test byte [rcx + 0x1c], r15b
je 0x1400154cc
cmp byte [rcx + 0x19], 4
jb 0x1400154cc
lea r9, [r14 + 0x2a0]
mov edx, 0x6f
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov byte [r14 + 0x490], r15b
xor edi, edi
cmp byte [r14 + 0x53c], dil
jne 0x140015666
cmp byte [r14 + 0xa5], dil
jne 0x140015602
cmp byte [r14 + 0xa6], dil
jne 0x140015602
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015602
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015602
lea rcx, [r14 + 0x4a0]
lea rax, [r14 + 0x498]
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8, qword [r14 + 0x380]
mov rdx, r14
call fcn.14001ba04
mov edi, eax
test eax, eax
jns 0x140015664
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
lea r9, [r14 + 0x2a0]
mov edx, 0x71
jmp 0x1400145ea
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x1400155db
cmp byte [rcx + 0x19], 5
jb 0x1400155db
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x6d
jmp 0x1400161e4
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x14001563d
cmp byte [rcx + 0x19], 5
jb 0x14001563d
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x70
jmp 0x1400161e4
xor edi, edi
cmp byte [r14 + 0x67c], dil
jne 0x140015794
cmp byte [r14 + 0xa5], dil
jne 0x140015730
cmp byte [r14 + 0xa6], dil
jne 0x140015730
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015730
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015730
lea rcx, [r14 + 0x5e0]
lea rax, [r14 + 0x478]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8, qword [r14 + 0x340]
mov rdx, r14
call fcn.14001ba04
mov edi, eax
test eax, eax
jns 0x140015792
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
lea r9, [r14 + 0x2a0]
mov edx, 0x73
jmp 0x1400145ea
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x14001576b
cmp byte [rcx + 0x19], 5
jb 0x14001576b
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x72
jmp 0x1400161e4
xor edi, edi
cmp byte [r14 + 0x480], dil
je 0x1400158cc
cmp byte [r14 + 0x5dc], dil
jne 0x1400158cc
cmp byte [r14 + 0xa5], dil
jne 0x140015868
cmp byte [r14 + 0xa6], dil
jne 0x140015868
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015868
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015868
lea rcx, [r14 + 0x540]
lea rax, [r14 + 0x488]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, qword [r14 + 0x360]
mov rdx, r14
call fcn.14001ba04
mov edi, eax
test eax, eax
jns 0x1400158ca
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140014149
test byte [rcx + 0x1c], r15b
je 0x140014149
cmp byte [rcx + 0x19], sil
jb 0x140014149
lea r9, [r14 + 0x2a0]
mov edx, 0x75
jmp 0x1400145ea
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x1400158a3
cmp byte [rcx + 0x19], 5
jb 0x1400158a3
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x74
jmp 0x1400161e4
xor edi, edi
cmp byte [r14 + 0x2d2], dil
jne 0x140015ab2
mov qword [rsp + 0x40], rdi
mov rax, qword [r14 + 0x2c0]
mov qword [rsp + 0x78], rax
movzx eax, word [r14 + 0x2ba]
mov word [rsp + 0x72], ax
movzx eax, word [r14 + 0x2b8]
sub ax, si
mov word [rsp + 0x70], ax
cmp byte [r14 + 0xa5], dil
jne 0x140015b9e
cmp byte [r14 + 0xa6], dil
jne 0x140015b9e
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015b9e
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015b9e
mov r9d, 0x100080
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.14000c078
mov edi, eax
test eax, eax
jns 0x1400159cf
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400159b0
test byte [rcx + 0x1c], r15b
je 0x1400159b0
cmp byte [rcx + 0x19], sil
jb 0x1400159b0
mov edx, 0x77
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], edi
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000c408
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140014149
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x140014149
mov edi, 0x1a0
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll_memset
mov dword [rbp - 0x60], edi
and dword [rbp - 0x5c], 0
mov dword [rbp - 0x58], r15d
mov rdi, qword [rsp + 0x40]
mov qword [rbp - 0x50], rdi
lea r9, [r14 + 0x2e0]
lea r8, [0x14000e160]
mov rdx, r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Register_Notification]
nop dword [rax + rax]
test eax, eax
je 0x140015a7f
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140015a4c
test byte [rcx + 0x1c], r15b
je 0x140015a4c
cmp byte [rcx + 0x19], sil
jb 0x140015a4c
lea r9, [r14 + 0x2a0]
mov edx, 0x78
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.1400195a0
test rdi, rdi
je 0x140015a61
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
test rbx, rbx
je 0x140015a75
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
mov eax, 0x80004005
jmp 0x140016219
test rdi, rdi
je 0x140015a95
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor edi, edi
mov byte [r14 + 0x2d2], r15b
test rdi, rdi
je 0x140015ab0
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor edi, edi
cmp byte [r14 + 0x2d6], dil
jne 0x140015d48
cmp dword [r14 + 0x320], 0xffffffff
je 0x140015d48
mov rax, qword [r14 + 0x98]
cmp qword [r14 + 0x2c0], rax
je 0x140015d48
mov qword [rsp + 0x40], rdi
cmp byte [r14 + 0xa5], dil
jne 0x140015ce6
cmp byte [r14 + 0xa6], dil
jne 0x140015ce6
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015ce6
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015ce6
lea rax, [r14 + 0x2a0]
mov qword [rsp + 0x60], rax
mov r9d, 0x100080
lea r8, [rsp + 0x40]
mov rdx, rax
xor ecx, ecx
call fcn.14000c078
mov edi, eax
test eax, eax
jns 0x140015c00
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x1400159b0
test byte [rcx + 0x1c], r15b
je 0x1400159b0
cmp byte [rcx + 0x19], sil
jb 0x1400159b0
mov edx, 0x7a
mov r9, qword [rsp + 0x60]
jmp 0x1400159a0
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140015bd9
cmp byte [rcx + 0x19], 5
jb 0x140015bd9
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x76
jmp 0x1400161e4
mov edi, 0x1a0
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x60]
call sub.msvcrt.dll_memset
mov dword [rbp - 0x60], edi
and dword [rbp - 0x5c], 0
mov dword [rbp - 0x58], r15d
mov rdi, qword [rsp + 0x40]
mov qword [rbp - 0x50], rdi
lea r9, [r14 + 0x2e8]
lea r8, [0x14000e490]
mov rdx, r14
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Register_Notification]
nop dword [rax + rax]
test eax, eax
je 0x140015c7f
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140015c8d
test byte [rcx + 0x1c], r15b
je 0x140015c8d
cmp byte [rcx + 0x19], sil
jb 0x140015c8d
lea r9, [r14 + 0x2b8]
mov edx, 0x7b
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.1400195a0
jmp 0x140015c86
mov byte [r14 + 0x2d6], r15b
mov rcx, qword [0x14004d128]
test rdi, rdi
je 0x140015ca8
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword [0x14004d128]
xor edi, edi
cmp byte [r14 + 0x2d3], dil
je 0x140015d54
cmp byte [rsp + 0x68], dil
jne 0x140015d54
add dword [r14 + 0x2c8], r15d
test rbx, rbx
je 0x1400160db
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
jmp 0x1400160db
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140015d21
cmp byte [rcx + 0x19], 5
jb 0x140015d21
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x79
jmp 0x1400161e4
mov rcx, qword [0x14004d128]
jmp 0x140015caa
cmp rcx, r12
je 0x140015d8c
test byte [rcx + 0x1c], r15b
je 0x140015d8c
cmp byte [rcx + 0x19], 4
jb 0x140015d8c
lea r9, [r14 + 0x2a0]
mov edx, 0x7c
mov eax, dword [r14 + 0x2c8]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.1400195a0
mov rcx, qword [0x14004d128]
cmp byte [r14 + 0xa5], dil
jne 0x14001614b
cmp byte [r14 + 0xa6], dil
jne 0x14001614b
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140016144
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140016144
mov qword [rsp + 0x40], rdi
lea rax, [r14 + 0x90]
mov qword [rsp + 0x60], rax
mov r9d, 0x100080
lea r8, [rsp + 0x40]
mov rdx, rax
mov cl, r15b
call fcn.14000c078
mov edi, eax
test eax, eax
jns 0x140015e4b
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140015e46
test byte [rcx + 0x1c], r15b
je 0x140015e46
cmp byte [rcx + 0x19], sil
jb 0x140015e46
mov edx, 0x7e
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000c408
nop
jmp 0x1400159b0
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, r14
call fcn.14000f630
mov dword [rsp + 0x58], eax
test eax, eax
jns 0x140015ecd
test rdi, rdi
je 0x140015e7d
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor edi, edi
mov eax, dword [rsp + 0x58]
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140015eb0
test byte [rcx + 0x1c], r15b
je 0x140015eb0
cmp byte [rcx + 0x19], sil
jb 0x140015eb0
mov edx, 0x7f
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000c408
nop
test rdi, rdi
je 0x140014982
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x140014982
cmp byte [r14 + 0xa5], 0
jne 0x1400160e2
cmp byte [r14 + 0xa6], 0
jne 0x1400160e2
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x1400160e2
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x1400160e2
cmp qword [r14 + 0x6a0], 0xffffffffffffffff
jne 0x14001603b
cmp byte [r14 + 0xa5], 0
jne 0x140015fcd
cmp byte [r14 + 0xa6], 0
jne 0x140015fcd
xor edx, edx
mov rcx, qword [r14 + 0x300]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015fcd
xor edx, edx
mov rcx, qword [r14 + 0x2f8]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
cmp eax, 0x102
jne 0x140015fcd
lea rcx, [r14 + 0x698]
call fcn.14001f774
mov dword [rsp + 0x58], eax
test eax, eax
jns 0x14001603b
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140015eb0
test byte [rcx + 0x1c], r15b
je 0x140015eb0
cmp byte [rcx + 0x19], sil
jb 0x140015eb0
mov edx, 0x82
jmp 0x140015e9a
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016036
test byte [rcx + 0x1c], r15b
je 0x140016004
cmp byte [rcx + 0x19], 5
jb 0x140016004
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016036
test byte [rcx + 0x1c], r15b
je 0x140016036
cmp byte [rcx + 0x19], sil
jb 0x140016036
mov edx, 0x81
mov dword [rsp + 0x20], 0x80830002
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
nop
jmp 0x140014d23
mov rdx, rdi
mov rcx, r14
call fcn.14001826c
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016072
test byte [rcx + 0x1c], r15b
je 0x140016072
cmp byte [rcx + 0x19], 4
jb 0x140016072
mov edx, 0x83
mov r9d, eax
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140004f50
test rdi, rdi
je 0x140016088
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor edi, edi
mov byte [r14 + 0x2d3], r15b
add dword [r14 + 0x2c8], r15d
test rdi, rdi
je 0x1400160ab
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
test rbx, rbx
je 0x1400160bf
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
cmp byte [r14 + 0x2d9], 0
je 0x1400160db
cmp byte [r14 + 0x5dc], 0
je 0x1400160db
mov rcx, r14
call fcn.1400186cc
xor eax, eax
jmp 0x140016219
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016036
test byte [rcx + 0x1c], r15b
je 0x14001611d
cmp byte [rcx + 0x19], 5
jb 0x14001611d
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016036
test byte [rcx + 0x1c], r15b
je 0x140016036
cmp byte [rcx + 0x19], sil
jb 0x140016036
mov edx, 0x80
jmp 0x14001601a
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x14001617f
cmp byte [rcx + 0x19], 5
jb 0x14001617f
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x7d
jmp 0x1400161e4
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x1400161ce
cmp byte [rcx + 0x19], 5
jb 0x1400161ce
lea r9, [r14 + 0x2a0]
mov edx, 0xfc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140019524
mov rcx, qword [0x14004d128]
cmp rcx, r12
je 0x140016200
test byte [rcx + 0x1c], r15b
je 0x140016200
cmp byte [rcx + 0x19], sil
jb 0x140016200
mov edx, 0x44
mov dword [rsp + 0x20], 0x80830002
mov r9d, dword [r14 + 0x80]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14000a330
nop
test rbx, rbx
je 0x140016214
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
mov eax, 0x80830002
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.140001e80
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret