Function at 0x14001fb8c
Capabilities:
Get file size
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r13
push r14
lea rbp, [rax - 0x668]
mov eax, 0x750
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0x640], rax
mov ebx, ecx
xor edi, edi
call fcn.140188170
lea esi, [rdi + 7]
cmp eax, 0x3000
jae 0x14001fc85
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x48], di
lea rdx, str.Attempting_to_create_schedule_task_without_elevating.
lea rcx, [rsp + 0x48]
call fcn.14000ae4c
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x130]
call fcn.1400101b0
mov qword [rsp + 0x20], rax
lea r9, str.C2RMan::CreateScheduleTask
mov ecx, 0x236d5460
lea r8d, [rdi + 0xa]
call fcn.14000d110
lea rcx, [rbp + 0x138]
call fcn.14000ac30
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14001fc7e
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
lea rax, [rax*2 + 2]
mov r14d, 0x1000
cmp rax, r14
jb 0x14001fc78
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14001fc78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x140020c4d
mov qword [rbp + 8], rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rsi
mov word [rbp + 8], di
lea rdx, str.MicrosoftOfficeOffice_Serviceability_Manager
lea rcx, [rbp + 8]
call fcn.14000ae4c
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x270]
call fcn.14018f31c
nop
mov r14d, 0x1000
mov rax, qword [rbp + 0x20]
cmp rax, 8
jb 0x14001fcf9
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 8]
mov rdx, rcx
cmp rax, r14
jb 0x14001fcf3
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14001fcf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rsi
mov word [rbp + 8], di
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], rsi
mov word [rbp + 0x110], di
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xe8], rsi
mov word [rbp + 0xd0], di
lea rdx, [rbp + 0x110]
xor ecx, ecx
call fcn.140011164
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x110]
call fcn.140010e48
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x68], di
lea rdx, str.OfficeSvcMgrSchedule.xml
lea rcx, [rsp + 0x68]
call fcn.14000ae4c
nop
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x158]
call fcn.14002b464
nop
mov rax, qword [rbp - 0x80]
cmp rax, 8
jb 0x14001fdd9
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, r14
jb 0x14001fdd3
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14001fdd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x68], di
mov eax, 0x5a
cmp ebx, 1
cmovl ebx, eax
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x30]
lea rdx, str.OfficeSvcMgrSchedule__dM.xml
lea rcx, [rbp + 0x68]
call fcn.140023d0c
nop
mov r8, rax
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xf0]
call fcn.14002b464
nop
lea rcx, [rbp + 0x68]
call fcn.14000ac30
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rsi
mov word [rbp + 0x90], di
lea rdx, str.File
lea rcx, [rbp + 0x90]
call fcn.14000ae4c
nop
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x58], di
lea rdx, str.Create_customized_xml_for_schedule_task.
lea rcx, [rbp - 0x58]
call fcn.14000ae4c
nop
lea r9, [rbp + 0xf0]
lea r8, [rbp + 0x90]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x130]
call fcn.14000d964
mov qword [rsp + 0x20], rax
lea r9, str.C2RMan::CreateScheduleTask
mov ecx, 0x236d545f
mov r8d, 0x32
call fcn.14000d110
lea rcx, [rbp + 0x138]
call fcn.14000ac30
nop
mov rax, qword [rbp - 0x40]
cmp rax, 8
jb 0x14001ff00
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rdx, rcx
cmp rax, r14
jb 0x14001fefa
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14001fefa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x58], di
mov rax, qword [rbp + 0xa8]
cmp rax, 8
jb 0x14001ff4e
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rdx, rcx
cmp rax, r14
jb 0x14001ff48
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14001ff48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rsi
mov word [rbp + 0x90], di
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x158]
call fcn.14018b9e4
lea rax, vtable.RefCounted.0
mov qword [rbp + 0x90], rax
mov dword [rbp + 0x98], edi
lea rax, vtable.OFile.0
mov qword [rbp + 0x90], rax
mov qword [rbp + 0xa0], rdi
movdqa xmm0, xmmword [0x14031bbe0]
movdqa xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], di
or qword [rbp + 0xc0], 0xffffffffffffffff
mov dword [rbp + 0xc8], 0x4d
mov dword [rsp + 0x20], edi
mov r9d, 2
lea r8d, [r9 + 1]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x90]
call fcn.140026848
test al, al
jne 0x1400200a1
mov qword [rsp + 0x48], rdi
movdqa xmm0, xmmword [0x14031bbe0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
lea rdx, str.File
lea rcx, [rsp + 0x48]
call fcn.14000ae4c
nop
mov qword [rbp + 0x68], rdi
movdqa xmm0, xmmword [0x14031bbe0]
movdqu xmmword [rbp + 0x78], xmm0
mov word [rbp + 0x68], di
lea rdx, str.Failed_to_open_file_for_schedule_task.
lea rcx, [rbp + 0x68]
call fcn.14000ae4c
nop
lea r9, [rbp + 0xf0]
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x130]
call fcn.14000d964
mov qword [rsp + 0x20], rax
lea r9, str.C2RMan::CreateScheduleTask
mov ecx, 0x236d545e
mov r8d, 0xa
call fcn.14000d110
lea rcx, [rbp + 0x138]
call fcn.14000ac30
nop
lea rcx, [rbp + 0x68]
call fcn.14000ac30
lea rcx, [rsp + 0x48]
call fcn.14000ac30
mov bl, dil
jmp 0x140020ac8
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rdi
lea rdx, [rsp + 0x38]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, 0xffffffff
cmp qword [rsp + 0x38], rax
jg 0x140020ca9
mov edx, dword [rsp + 0x38]
lea rcx, [rbp + 8]
call fcn.14002a118
mov rdi, qword [rbp + 0x10]
mov r13, qword [rbp + 8]
sub rdi, r13
mov rax, rdi
neg rax
sbb rdx, rdx
and rdx, r13
mov r8, rdi
lea rcx, [rbp + 0x90]
call fcn.140025ff0
mov rdx, rdi
shr rdx, 1
neg rdi
sbb r9, r9
and r9, r13
xor eax, eax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rsi
mov word [rbp + 0x48], ax
lea rcx, [rbp + 0x48]
cmp rdx, rsi
ja 0x140020148
mov qword [rbp + 0x58], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
xor ecx, ecx
mov word [rbp + rdi + 0x48], cx
jmp 0x14002014e
call fcn.14000b820
nop
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.14000d7f0
mov rdi, rax
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x58], ax
lea rdx, str._SYNCFREQUENCY_
lea rcx, [rbp - 0x58]
call fcn.14000ae4c
nop
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x48]
call fcn.1400097d4
nop
mov rax, qword [rbp - 0x40]
cmp rax, 8
jb 0x1400201cf
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rdx, rcx
cmp rax, r14
jb 0x1400201c9
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400201c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edi, edi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rsi
mov word [rbp - 0x58], di
lea rcx, [rbp + 0x250]
call fcn.14000ac30
mov qword [rbp + 0x178], rdi
movdqa xmm0, xmmword [0x14031bbe0]
movdqu xmmword [rbp + 0x188], xmm0
mov word [rbp + 0x178], di
lea rdx, [rbp + 0x178]
xor ecx, ecx
call fcn.140011164
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x80], rsi
mov word [rbp + 0x68], di
lea rdx, str._EXECUTABLEFULLPATH_
lea rcx, [rbp + 0x68]
call fcn.14000ae4c
nop
lea r8, [rbp + 0x178]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.1400097d4
nop
mov rax, qword [rbp + 0x80]
cmp rax, 8
jb 0x14002028d
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rdx, rcx
cmp rax, r14
jb 0x140020287
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020287
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
movsxd rcx, ebx
imul rcx, rcx, 0x23c34600
add rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x40], rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm0
mov dword [rbp + 0x1b8], eax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x198]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
test eax, eax
jne 0x1400204a5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], rax
lea r9, [rbp + 0x198]
lea r8, str._Y__m__dT_H:_M:_S
lea edx, [rax + 0x14]
lea rcx, [rbp + 0x130]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
cmp rax, 0x13
jne 0x1400203e7
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rsi
mov word [rbp - 0x78], di
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.14000ae4c
nop
mov qword [rsp + 0x68], rdi
movdqa xmm0, xmmword [0x14031bbe0]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], di
lea rdx, str.2020_01_01T12:30:00
lea rcx, [rsp + 0x68]
call fcn.14000ae4c
nop
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.1400097d4
nop
lea rcx, [rsp + 0x68]
call fcn.14000ac30
mov rax, qword [rbp - 0x60]
cmp rax, 8
jb 0x1400205df
nop
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rdx, rcx
cmp rax, r14
jb 0x1400203dc
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400203dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400205df
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.140025aa0
mov rdi, rax
xor ecx, ecx
mov qword [rsp + 0x68], rcx
movdqa xmm0, xmmword [0x14031bbe0]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], cx
lea rdx, [0x140289580]
lea rcx, [rsp + 0x68]
call fcn.14000ae4c
xor eax, eax
mov qword [rbp - 0x78], rax
movdqa xmm0, xmmword [0x14031bbe0]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], ax
lea rdx, str.Wcsftime_return_wrong_size.
lea rcx, [rbp - 0x78]
call fcn.14000ae4c
mov r9, rdi
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x200]
nop
call fcn.14000d964
mov qword [rsp + 0x20], rax
lea r9, str.C2RMan::CreateScheduleTask
mov ecx, 0x232c724a
mov r8d, 0xa
call fcn.14000d110
lea rcx, [rbp + 0x208]
call fcn.14000ac30
lea rcx, [rbp - 0x78]
call fcn.14000ac30
lea rcx, [rsp + 0x68]
call fcn.14000ac30
jmp 0x1400205d3
mov edx, eax
lea rcx, [rbp + 0x1c0]
call fcn.14000d7f0
mov rdi, rax
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rsi
mov word [rbp - 0x78], ax
lea rdx, [0x140286978]
lea rcx, [rbp - 0x78]
call fcn.14000ae4c
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x68], ax
lea rdx, str.Failed_to_convert_time_t_to_tm.
lea rcx, [rsp + 0x68]
call fcn.14000ae4c
mov r9, rdi
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x200]
call fcn.14000d964
mov qword [rsp + 0x20], rax
lea r9, str.C2RMan::CreateScheduleTask
mov ecx, 0x232c7249
mov r8d, 0xa
call fcn.14000d110
lea rcx, [rbp + 0x208]
call fcn.14000ac30
mov rax, qword [rbp - 0x80]
cmp rax, 8
jb 0x14002057b
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, r14
jb 0x140020575
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020575
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor edi, edi
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x68], di
mov rax, qword [rbp - 0x60]
cmp rax, 8
jb 0x1400205c7
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rdx, rcx
cmp rax, r14
jb 0x1400205c1
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400205c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rsi
mov word [rbp - 0x78], di
lea rcx, [rbp + 0x1c0]
call fcn.14000ac30
xor r8d, r8d
lea rcx, [rbp + 0x90]
call fcn.1400265c8
mov eax, dword [rbp + 0x58]
lea r8d, [rax + rax]
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 8
cmovae rdx, qword [rbp + 0x48]
mov rdi, qword [rbp + 0xc0]
cmp rdi, 0xffffffffffffffff
je 0x140020cd9
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140020c79
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbp + 0xc0], 0xffffffffffffffff
lea rax, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rax, qword [rbp + 0xa0]
xor edi, edi
mov qword [rbp + 0xb0], rdi
mov word [rax], di
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x270]
call fcn.14018f48c
mov edx, ebx
lea rcx, [rbp + 0x1e0]
test eax, eax
je 0x1400208a5
call fcn.14000d7f0
mov rbx, rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x48], di
lea rdx, str.SyncFrequency_min_
lea rcx, [rsp + 0x48]
call fcn.14000ae4c
nop
mov qword [rbp - 0x18], rdi
mov qword [rbp - 8], rdi
mov qword [rbp], rsi
mov word [rbp - 0x18], di
lea rdx, str.MicrosoftOfficeOffice_Serviceability_Manager
lea rcx, [rbp - 0x18]
call fcn.14000ae4c
nop
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x38], di
lea rdx, str.Task
lea rcx, [rbp - 0x38]
call fcn.14000ae4c
nop
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rsi
mov word [rbp + 0x28], di
lea rdx, str.Failed_to_create_schedule_task.
lea rcx, [rbp + 0x28]
call fcn.14000ae4c
nop
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x18]
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x228]
call fcn.140010438
mov qword [rsp + 0x20], rax
lea r9, str.C2RMan::CreateScheduleTask
mov ecx, 0x236d545d
lea r8d, [rdi + 0xa]
call fcn.14000d110
lea rcx, [rbp + 0x230]
call fcn.14000ac30
nop
mov rax, qword [rbp + 0x40]
cmp rax, 8
jb 0x1400207a8
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rdx, rcx
cmp rax, r14
jb 0x1400207a2
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400207a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rsi
mov word [rbp + 0x28], di
mov rax, qword [rbp - 0x20]
cmp rax, 8
jb 0x1400207f0
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rdx, rcx
cmp rax, r14
jb 0x1400207ea
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400207ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x38], di
mov rax, qword [rbp]
cmp rax, 8
jb 0x140020838
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rdx, rcx
cmp rax, r14
jb 0x140020832
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020832
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 8], rdi
mov qword [rbp], rsi
mov word [rbp - 0x18], di
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x140020882
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, r14
jb 0x14002087c
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14002087c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x48], di
lea rcx, [rbp + 0x1e0]
call fcn.14000ac30
mov bl, dil
jmp 0x140020a7d
call fcn.14000d7f0
mov rbx, rax
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x38], di
lea rdx, str.SyncFrequency_min_
lea rcx, [rbp - 0x38]
call fcn.14000ae4c
mov qword [rbp - 0x18], rdi
mov qword [rbp - 8], rdi
mov qword [rbp], rsi
mov word [rbp - 0x18], di
lea rdx, str.MicrosoftOfficeOffice_Serviceability_Manager
lea rcx, [rbp - 0x18]
call fcn.14000ae4c
mov qword [rbp + 0x28], rdi
movdqa xmm0, xmmword [0x14031bbe0]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], di
lea rdx, str.Task
lea rcx, [rbp + 0x28]
call fcn.14000ae4c
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x48], di
lea rdx, str.Succefully_created_schedule_task.
lea rcx, [rsp + 0x48]
call fcn.14000ae4c
mov qword [rsp + 0x28], rbx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x18]
lea r8, [rbp + 0x28]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x228]
call fcn.140010438
mov qword [rsp + 0x20], rax
lea r9, str.C2RMan::CreateScheduleTask
mov ecx, 0x236d545c
mov r8d, 0x32
call fcn.14000d110
lea rcx, [rbp + 0x230]
call fcn.14000ac30
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x1400209c4
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, r14
jb 0x1400209be
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x1400209be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov word [rsp + 0x48], di
lea rcx, [rbp + 0x28]
call fcn.14000ac30
mov rax, qword [rbp]
cmp rax, 8
jb 0x140020a18
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rdx, rcx
cmp rax, r14
jb 0x140020a12
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020a12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 8], rdi
mov qword [rbp], rsi
mov word [rbp - 0x18], di
mov rax, qword [rbp - 0x20]
cmp rax, 8
jb 0x140020a60
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rdx, rcx
cmp rax, r14
jb 0x140020a5a
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020a5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x38], di
lea rcx, [rbp + 0x1e0]
call fcn.14000ac30
mov ebx, 1
lea rcx, [rbp + 0x178]
call fcn.14000ac30
lea rcx, [rbp + 0x48]
call fcn.14000ac30
test r13, r13
je 0x140020ac8
mov rax, qword [rbp + 0x18]
sub rax, r13
mov rcx, r13
cmp rax, r14
jb 0x140020abe
mov r13, qword [r13 - 8]
sub rcx, r13
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140020abe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rbp + 0x90]
call fcn.140026950
mov rax, qword [rbp + 0x108]
cmp rax, 8
jb 0x140020b25
nop dword [rax]
nop word [rax + rax]
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rdx, rcx
cmp rax, r14
jb 0x140020b1f
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020b1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x108], rsi
mov word [rbp + 0xf0], di
mov rax, qword [rbp + 0x170]
cmp rax, 8
jb 0x140020b7c
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0x158]
mov rdx, rcx
cmp rax, r14
jb 0x140020b76
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020b76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x168], rdi
mov qword [rbp + 0x170], rsi
mov word [rbp + 0x158], di
mov rax, qword [rbp + 0xe8]
cmp rax, 8
jb 0x140020bd3
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rdx, rcx
cmp rax, r14
jb 0x140020bcd
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020bcd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xe8], rsi
mov word [rbp + 0xd0], di
mov rax, qword [rbp + 0x128]
cmp rax, 8
jb 0x140020c2a
lea rax, [rax*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rdx, rcx
cmp rax, r14
jb 0x140020c24
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140020c24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], rsi
mov word [rbp + 0x110], di
lea rcx, [rbp + 0x270]
call fcn.1400b5c08
mov al, bl
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.14024c6d0
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.write_to_file_failed
lea rcx, [rbp + 0x2b0]
call fcn.1400259c0
lea rdx, [0x140325060]
lea rcx, [rbp + 0x2b0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.OFile_does_not_support_reading_files_of_this_size
lea rcx, [rbp + 0x2b0]
call fcn.140025b50
lea rdx, [0x140325060]
lea rcx, [rbp + 0x2b0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [rbp + 0x2b0]
call fcn.140025920
lea rdx, [0x140325060]
lea rcx, [rbp + 0x2b0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3