Function at 0x1400a49d0
Capabilities:
Clear file content
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rsi, rcx
lea rdx, [rax + 0x10]
lea rcx, [rax - 0x50]
xor ebx, ebx
mov qword [rax - 0x50], rbx
call fcn.14006b72c
lea r12d, [rbx + 1]
lea ebp, [rbx + 2]
lea rcx, str.SeBackupPrivilege
mov r8d, r12d
mov edx, ebp
call fcn.14001ba5c
lea r8d, [rbx + 0x10]
lea rcx, str.SeRestorePrivilege
mov edx, ebp
call fcn.14001ba5c
mov rcx, qword [rsp + 0x1c8]
mov r14b, bl
mov byte [rsp + 0x42], bl
mov byte [rsp + 0x94], bl
mov byte [rsp + 0x71], bl
mov r15b, bl
mov byte [rsp + 0x1d8], bl
mov byte [rsp + 0x108], bl
mov byte [rsp + 0x41], bl
mov byte [rsp + 0x50], bl
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x98], rbx
mov rdi, rbx
mov qword [rsp + 0xb0], rbx
lea edx, [rbx + 0x23]
lea r9d, [rbx + 9]
lea r13d, [rbx + 0x20]
lea r10d, [rbx + 0x2a]
lea r8d, [rbx + 0x2e]
jmp 0x1400a4ad4
cmp r9w, ax
ja 0x1400a4a9c
cmp ax, 0xd
jbe 0x1400a4adc
cmp r13w, ax
je 0x1400a4adc
cmp r10w, ax
jne 0x1400a4aad
mov r14b, byte [rcx]
jmp 0x1400a4ac9
cmp r8w, ax
jne 0x1400a4abb
mov al, byte [rcx]
mov byte [rsp + 0x42], al
jmp 0x1400a4ac9
cmp dx, ax
jne 0x1400a4ac9
mov al, byte [rcx]
mov byte [rsp + 0x94], al
add rcx, rbp
mov qword [rsp + 0x1c8], rcx
movzx eax, word [rcx]
cmp ax, bx
jne 0x1400a4a90
lea rcx, [rsp + 0x1c8]
call fcn.140058ecc
mov rbp, qword [rsp + 0x1c8]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0xe0], rbp
mov qword [rsp + 0xf8], rbp
call fcn.140061620
movzx r11d, word [rbp]
mov r8d, 0x2d
cmp r8w, r11w
jne 0x1400a4bd2
lea r15d, [r8 - 1]
lea r10d, [r8 - 0x2b]
movzx eax, word [rbp + 2]
cmp ax, bx
je 0x1400a4b99
mov ecx, 9
cmp cx, ax
ja 0x1400a4b44
cmp ax, 0xd
jbe 0x1400a4b99
cmp r13w, ax
je 0x1400a4b99
cmp ax, r15w
je 0x1400a4b99
cmp cx, r11w
ja 0x1400a4b5d
cmp r11w, 0xd
jbe 0x1400a4b79
cmp r13w, r11w
je 0x1400a4b79
add rbp, r10
mov qword [rsp + 0xf8], rbp
mov r11w, word [rbp]
cmp r11w, bx
jne 0x1400a4b50
lea rcx, [rsp + 0xf8]
call fcn.140058ecc
mov rbp, qword [rsp + 0xf8]
mov r11w, word [rbp]
cmp r8w, r11w
je 0x1400a4b2b
mov qword [rsp + 0xe0], rbp
mov r15b, bl
cmp rbp, qword [rsp + 0x1c8]
je 0x1400a4bd2
mov word [rbp - 2], bx
mov rdx, qword [rsp + 0x1c8]
lea r8, [rsp + 0x88]
xor r9d, r9d
mov rcx, rsi
mov byte [rsp + 0x20], r12b
call fcn.140078800
mov rax, qword [rsp + 0x88]
lea rcx, [rsp + 0x58]
mov rdx, r12
mov qword [rsp + 0x1c8], rax
call fcn.140061694
or qword [rsp + 0xd0], 0xffffffffffffffff
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0xc8], rax
mov eax, 0x200
mov r13, rbx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0x138], rbx
mov byte [rsp + 0x70], bl
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x110], rax
mov byte [rsp + 0x78], bl
mov byte [rsp + 0x64], bl
mov r12b, bl
mov qword [rsp + 0x148], rbx
jmp 0x1400a4f9f
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14011ee74]
mov r8d, 3
call fcn.14006402c
cmp al, bl
je 0x1400a4c8b
mov byte [rsp + 0x71], 1
jmp 0x1400a4f9f
lea rdx, [rsp + 0x1c8]
lea rcx, str._dir
mov r8d, 4
call fcn.14006402c
cmp al, bl
je 0x1400a4cb6
mov dword [rsp + 0x68], 0x80000000
jmp 0x1400a4f9f
lea rdx, [rsp + 0x1c8]
lea rcx, str._free
mov r8d, 5
call fcn.140064108
cmp al, bl
jne 0x1400a56f9
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14011ee68]
mov r8d, 3
call fcn.140064108
cmp al, bl
je 0x1400a4e54
mov rcx, qword [rsp + 0x1c8]
mov r9d, 9
movzx eax, word [rcx]
mov r8, rcx
mov qword [rsp + 0xe8], rcx
cmp ax, bx
je 0x1400a4d4e
lea edx, [r9 + 0x17]
lea ebp, [rdx - 0x1e]
cmp r9w, ax
ja 0x1400a4d2e
cmp ax, 0xd
jbe 0x1400a4d46
cmp dx, ax
je 0x1400a4d46
add rcx, rbp
mov qword [rsp + 0x1c8], rcx
mov ax, word [rcx]
cmp ax, bx
jne 0x1400a4d22
mov rbp, qword [rsp + 0xe0]
lea rcx, [rsp + 0x1c8]
call fcn.140058ecc
mov eax, 0x3f
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xa0], rbx
cmp ax, word [r8]
jne 0x1400a4dde
lea rdx, [r8 + 2]
mov qword [rsp + 0x148], rdx
mov rcx, rdx
movzx eax, word [rdx]
cmp ax, bx
je 0x1400a4dbb
mov edi, 2
lea r8d, [rdi + 0x1e]
cmp r9w, ax
ja 0x1400a4da2
cmp ax, 0xd
jbe 0x1400a4db3
cmp r8w, ax
je 0x1400a4db3
add rcx, rdi
mov ax, word [rcx]
cmp ax, bx
jne 0x1400a4d96
mov rdi, qword [rsp + 0xb0]
cmp word [rcx], bx
je 0x1400a4dc3
mov word [rcx], bx
lea r8, [rsp + 0xa0]
xor r9d, r9d
mov rcx, rsi
call fcn.14006b974
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe8]
call fcn.140065cf0
mov rsi, qword [rsp + 0xb8]
cmp rsi, 0xffffffffffffffff
je 0x1400a4e3a
cmp rsi, rbx
je 0x1400a4e3a
lea rdx, [rsp + 0xb0]
mov rcx, rsi
mov qword [rsp + 0x148], rbx
call fcn.1400592d0
mov rdi, qword [rsp + 0xb0]
cmp rax, rbx
je 0x1400a4e3a
cmp rdi, rbx
cmovne rsi, rdi
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0xa0]
call fcn.140058efc
mov rsi, qword [rsp + 0x1c0]
jmp 0x1400a4f9f
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14011ee64]
mov r8d, 3
call fcn.14006402c
cmp al, bl
je 0x1400a4e83
mov eax, 1
mov byte [rsp + 0x108], al
jmp 0x1400a4f9f
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14011ee60]
mov r8d, 2
call fcn.14006402c
cmp al, bl
je 0x1400a4eb5
mov eax, 1
mov r15b, al
mov byte [rsp + 0x1d8], al
jmp 0x1400a4f9f
lea rdx, [rsp + 0x1c8]
lea rcx, str._sparse
mov r8d, 7
call fcn.14006402c
cmp al, bl
je 0x1400a4edd
mov byte [rsp + 0x41], 1
jmp 0x1400a4f9f
lea rdx, [rsp + 0x1c8]
lea rcx, str._quick
mov r8d, 6
call fcn.14006402c
cmp al, bl
je 0x1400a4f03
mov r12b, 1
jmp 0x1400a4f9f
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14011ee50]
mov r8d, 3
call fcn.14006402c
cmp al, bl
jne 0x1400a523a
lea rdx, [rsp + 0x1c8]
lea rcx, [0x140117df4]
mov r8d, 5
call fcn.14006402c
cmp al, bl
je 0x1400a4f4a
mov byte [rsp + 0x50], 1
jmp 0x1400a4f9f
mov rcx, qword [rsp + 0x1c8]
movzx eax, word [rcx]
cmp ax, bx
je 0x1400a4f92
mov edx, 0x20
lea ebp, [rdx - 0x1e]
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x1400a4f72
cmp ax, 0xd
jbe 0x1400a4f8a
cmp dx, ax
je 0x1400a4f8a
add rcx, rbp
mov qword [rsp + 0x1c8], rcx
mov ax, word [rcx]
cmp ax, bx
jne 0x1400a4f66
mov rbp, qword [rsp + 0xe0]
lea rcx, [rsp + 0x1c8]
call fcn.140058ecc
mov rax, qword [rsp + 0x1c8]
mov ecx, 0x2d
cmp cx, word [rax]
je 0x1400a4c63
lea rdx, [rsp + 0x1c8]
lea rcx, str._quick
mov r8d, 6
call fcn.14006402c
mov rsi, qword [rsp + 0x1c0]
movzx ecx, r12b
mov r13d, 1
cmp al, bl
lea r8, [rsp + 0x58]
cmovne ecx, r13d
lea r12d, [r13 + 0x2b]
lea rdx, [rsp + 0x1c8]
mov dword [rsp + 0x10c], ecx
mov rcx, rsi
mov r9d, r12d
mov qword [rsp + 0x1c8], rbp
mov word [rsp + 0x20], bx
call fcn.1400524d0
cmp word [rax], r12w
jne 0x1400a588d
mov rax, qword [rsp + 0x58]
cmp word [rax], bx
je 0x1400a588d
lea edx, [r13 + 0x25]
movzx ecx, r15b
lea r8, [rsp + 0x88]
cmp dx, word [rax]
mov rdx, qword [rsp + 0x1c8]
movzx eax, r14b
cmove ecx, r13d
mov byte [rsp + 0x20], r13b
cmp cl, bl
mov dword [rsp + 0x84], ecx
mov rcx, rsi
cmovne eax, ebx
xor r9d, r9d
mov dword [rsp + 0xc0], eax
call fcn.140078800
mov r11, qword [rsp + 0x88]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x1c8], r11
call fcn.1400713b4
mov rax, qword [rsp + 0xd8]
cmp rax, rbx
mov qword [rsp + 0xb8], rax
jl 0x1400a588d
mov rax, qword [rsp + 0x1c8]
lea rbp, [r13 - 5]
mov byte [rsp + 0x60], bl
lea ecx, [rbp + 0x27]
mov qword [rsp + 0x1d8], rbp
lea esi, [rbp + 6]
cmp cx, word [rax]
jne 0x1400a511e
add rax, rsi
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x1c8], rax
call fcn.140058ecc
mov rax, qword [rsp + 0x1c8]
lea ecx, [rbp + 0x2e]
lea rdx, [rsp + 0x1d8]
cmp cx, word [rax]
lea rcx, [rsp + 0x1c8]
sete byte [rsp + 0x60]
call fcn.1400713b4
mov rbp, qword [rsp + 0x1d8]
lea rcx, [rsp + 0x1c8]
mov r8d, 0x3b
mov edx, r12d
call fcn.1400591b0
mov rcx, qword [rsp + 0x1c8]
cmp word [rcx], bx
je 0x1400a514c
add rcx, rsi
mov qword [rsp + 0x1c8], rcx
mov r15, qword [rsp + 0xd0]
cmp r15, rbx
jl 0x1400a5160
cmp rbp, r15
cmovg rbp, r15
lea rcx, [rsp + 0x1c8]
call fcn.140058ecc
mov rcx, qword [rsp + 0x1c8]
call fcn.140018610
mov r13, qword [rsp + 0x1c8]
lea rcx, [0x14011ee48]
mov rdx, r13
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0x140], rbx
call fcn.14005a600
mov byte [rsp + 0x1d8], al
cmp al, bl
jne 0x1400a51f2
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xe8]
call fcn.140065bbc
cmp eax, ebx
je 0x1400a51f2
mov rcx, qword [rsp + 0xe8]
cmp bx, word [rcx]
je 0x1400a51dd
cmp r12w, word [rcx]
jne 0x1400a51f2
mov rax, qword [rsp + 0x48]
mov byte [rsp + 0x1d8], sil
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x100], r13
cmp word [r13], bx
jne 0x1400a57c4
lea rcx, [rsp + 0x58]
call fcn.140058efc
lea rcx, [rsp + 0x88]
call fcn.140058efc
cmp rdi, rbx
je 0x1400a5230
cmp rdi, 0xffffffffffffffff
je 0x1400a5230
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
jmp 0x1400a58bf
mov r11, qword [rsp + 0x1c8]
mov eax, 1
mov byte [rsp + 0x64], al
mov r14b, al
mov byte [rsp + 0x60], al
mov eax, 0x2d
cmp ax, word [r11]
jne 0x1400a4fb5
mov esi, dword [rsp + 0x78]
mov r15d, dword [rsp + 0x108]
mov rdi, rbx
mov r14d, eax
movzx eax, word [r11 + 2]
cmp ax, bx
je 0x1400a5697
mov r8d, 9
cmp r8w, ax
ja 0x1400a5297
cmp ax, 0xd
jbe 0x1400a5697
mov edx, 0x20
cmp dx, ax
je 0x1400a5697
lea ecx, [rdx + 0xc]
cmp ax, cx
je 0x1400a5697
movzx eax, word [r11]
mov rcx, r11
mov qword [rsp + 0xb8], rcx
cmp ax, bx
je 0x1400a52f3
lea r14d, [rdx - 0x1e]
cmp r8w, ax
ja 0x1400a52d5
cmp ax, 0xd
jbe 0x1400a52e5
cmp dx, ax
je 0x1400a52e5
add rcx, r14
mov ax, word [rcx]
cmp ax, bx
jne 0x1400a52c9
mov qword [rsp + 0xb8], rcx
mov r14d, 0x2d
lea rcx, [rsp + 0xb8]
call fcn.140058ecc
lea rcx, str._bs
mov r8d, 4
mov rdx, r11
call fcn.14005a5c4
cmp al, bl
je 0x1400a535e
add r11, 8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.1400713b4
cmp eax, ebx
jle 0x1400a567d
movsxd rbp, dword [rsp + 0x48]
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x118], rbp
jmp 0x1400a567d
mov ebp, 5
lea rcx, str._ibs
mov rdx, r11
mov r8d, ebp
call fcn.14005a5c4
cmp al, bl
je 0x1400a53b6
add r11, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.1400713b4
cmp eax, ebx
jle 0x1400a567d
movsxd rax, dword [rsp + 0x48]
mov qword [rsp + 0x118], rax
jmp 0x1400a567d
lea rcx, str._obs
mov r8d, ebp
mov rdx, r11
call fcn.14005a5c4
cmp al, bl
je 0x1400a5409
add r11, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.1400713b4
cmp eax, ebx
jle 0x1400a567d
movsxd rax, dword [rsp + 0x48]
mov qword [rsp + 0x110], rax
jmp 0x1400a567d
lea rcx, str._count
mov r8d, 7
mov rdx, r11
call fcn.14005a5c4
cmp al, bl
je 0x1400a545f
add r11, 0xe
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.1400713b4
cmp eax, ebx
jle 0x1400a567d
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc8], rax
jmp 0x1400a567d
lea rcx, str._len
mov r8d, ebp
mov rdx, r11
call fcn.14005a5c4
cmp al, bl
je 0x1400a54b2
add r11, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.1400713b4
cmp eax, ebx
jle 0x1400a567d
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xd0], rax
jmp 0x1400a567d
mov ebp, 6
lea rcx, str._conv
mov rdx, r11
mov r8d, ebp
call fcn.14005a5c4
cmp al, bl
je 0x1400a5543
add r11, 0xc
lea r8d, [rbp + 1]
lea rcx, [0x14011ee10]
mov rdx, r11
mov qword [rsp + 0x1c8], r11
call fcn.14005a5c4
movzx esi, sil
cmp al, bl
lea eax, [rbp - 5]
cmovne esi, eax
movzx eax, word [r11]
cmp ax, bx
je 0x1400a567d
lea ecx, [rbp + 0x1a]
lea r8d, [rbp + 3]
cmp r8w, ax
ja 0x1400a551c
cmp ax, 0xd
jbe 0x1400a567d
cmp cx, ax
je 0x1400a567d
mov eax, 2
add r11, rax
mov qword [rsp + 0x1c8], r11
mov ax, word [r11]
cmp ax, bx
jne 0x1400a550c
jmp 0x1400a567d
lea rcx, str._skip
mov r8d, ebp
mov rdx, r11
call fcn.14005a5c4
cmp al, bl
je 0x1400a5592
add r11, 0xc
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.1400713b4
cmp eax, ebx
jle 0x1400a567d
mov r13, qword [rsp + 0x48]
jmp 0x1400a567d
lea rcx, str._skipb
mov r8d, 7
mov rdx, r11
call fcn.14005a5c4
cmp al, bl
je 0x1400a55e3
add r11, 0xe
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x1c8]
mov r13, rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x1c8], r11
call fcn.1400713b4
cmp eax, ebx
jle 0x1400a567d
mov rdi, qword [rsp + 0x48]
jmp 0x1400a567d
lea rdx, [rsp + 0x1c8]
lea rcx, str._sparse
mov r8d, 7
call fcn.14006402c
cmp al, bl
je 0x1400a560c
mov eax, 1
mov byte [rsp + 0x41], al
jmp 0x1400a567d
lea rdx, [rsp + 0x1c8]
lea rcx, str._quick
mov r8d, ebp
call fcn.14006402c
cmp al, bl
je 0x1400a5631
mov eax, 1
mov r12b, al
jmp 0x1400a567d
lea rdx, [rsp + 0x1c8]
lea rcx, str._qspace
mov r8d, 7
call fcn.14006402c
cmp al, bl
je 0x1400a5654
mov r12b, 0x10
jmp 0x1400a567d
lea rdx, [rsp + 0x1c8]
lea rcx, [0x14011ee64]
mov r8d, 3
call fcn.14006402c
movzx r15d, r15b
cmp al, bl
mov eax, 1
cmovne r15d, eax
mov r11, qword [rsp + 0xb8]
mov qword [rsp + 0x1c8], r11
cmp r14w, word [r11]
je 0x1400a5273
mov rbp, qword [rsp + 0xe0]
mov r14b, byte [rsp + 0x60]
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf0], rdi
mov dword [rsp + 0x108], r15d
mov r15b, byte [rsp + 0x1d8]
cmp rdi, rbx
mov rdi, qword [rsp + 0xb0]
mov dword [rsp + 0x78], esi
jge 0x1400a4fb5
mov rsi, qword [rsp + 0x118]
imul rsi, r13
cmp rsi, rbx
cmovl rsi, rbx
mov qword [rsp + 0xf0], rsi
jmp 0x1400a4fb5
mov rcx, qword [rsp + 0x1c8]
mov qword [rsp + 0x100], rcx
movzx eax, word [rcx]
cmp ax, bx
je 0x1400a5749
mov edx, 0x20
lea edi, [rdx - 0x1e]
lea r8d, [rdx - 0x17]
cmp r8w, ax
ja 0x1400a5729
cmp ax, 0xd
jbe 0x1400a5741
cmp dx, ax
je 0x1400a5741
add rcx, rdi
mov qword [rsp + 0x1c8], rcx
mov ax, word [rcx]
cmp ax, bx
jne 0x1400a571d
mov rdi, qword [rsp + 0xb0]
lea rcx, [rsp + 0x1c8]
call fcn.140058ecc
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x1d8], rbx
call fcn.140065cf0
mov rcx, qword [rsp + 0x1d8]
cmp rcx, 0xffffffffffffffff
je 0x1400a578c
cmp rcx, rbx
je 0x1400a578c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
call fcn.140058efc
lea rcx, [rsp + 0x88]
call fcn.140058efc
cmp rdi, rbx
je 0x1400a58bf
cmp rdi, 0xffffffffffffffff
je 0x1400a58bf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a58bf
lea rcx, [rsp + 0xe0]
mov edx, 1
mov qword [rsp + 0xe0], r13
call fcn.1400764f0
lea rcx, [rsp + 0x120]
mov rsi, rax
call fcn.140061344
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0x130], rbx
mov byte [rsp + 0x40], bl
mov r12, rbx
mov qword [rsp + 0xe8], rbx
movabs r14, 0x3fffffffffffffff
cmp byte [rsp + 0x94], bl
je 0x1400a59ee
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0xe0]
call fcn.140061620
mov rcx, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rbx
call fcn.1400183dc
mov r12, rax
cmp rax, rbx
jne 0x1400a58ea
lea rcx, [rsp + 0xe0]
call fcn.140058efc
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x120]
call fcn.140058efc
lea rcx, [rsp + 0x58]
call fcn.140058efc
lea rcx, [rsp + 0x88]
call fcn.140058efc
cmp rdi, rbx
je 0x1400a58b8
cmp rdi, 0xffffffffffffffff
je 0x1400a58b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, 0xffffffff80070057
lea rcx, [rsp + 0x168]
call fcn.140058efc
mov rax, rbx
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [rax + 0x18]
and rsi, r14
cmp rbp, rbx
mov r14, qword [rsp + 0xf0]
jle 0x1400a5907
lea rax, [r14 + rbp]
cmp rax, rsi
jle 0x1400a5914
mov rbp, rsi
sub rbp, r14
cmp rbp, rbx
cmovle rbp, rbx
cmp r15, rbx
jl 0x1400a5920
cmp r15, rbp
cmovl rbp, r15
lea rdx, [rbp + 0x200000]
lea rcx, [rsp + 0x120]
call fcn.140061424
mov r11, qword [rsp + 0x120]
cmp r11, rbx
jne 0x1400a596d
lea rcx, [rsp + 0xe0]
call fcn.140058efc
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x120]
call fcn.140058efc
jmp 0x1400a5205
mov rdx, qword [r12 + 8]
lea r13, [r11 + 0x100000]
mov qword [rsp + 0xe8], rbp
and r13, 0xfffffffffff00000
cmp r14, rsi
mov qword [rsp + 0x128], rbp
cmovg r14, rsi
mov qword [rsp + 0xa8], r13
mov r12, rbp
add rdx, r14
cmp rbp, rbx
mov qword [rsp + 0xf0], r14
jle 0x1400a59c2
cmp r13, rdx
je 0x1400a59c2
mov r8, rbp
mov rcx, r13
call fcn.14001d004
mov eax, 1
lea rcx, [rsp + 0xe0]
mov byte [rsp + 0x40], al
mov byte [rsp + 0x70], al
call fcn.140058efc
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400a5bb7
cmp rsi, rbx
je 0x1400a5bb7
mov edx, 2
lea rax, [rsi + 2]
lea ecx, [rdx + 0x1e]
mov byte [rsp + 0x70], dl
mov byte [rsp + 0x40], dl
mov dword [rsp + 0x150], ecx
lea ecx, [rdx + 0x2c]
mov qword [rsp + 0xe8], rax
cmp cx, word [rax]
jne 0x1400a5a38
add rax, rdx
mov dword [rsp + 0x150], 0x40
mov qword [rsp + 0xe8], rax
lea r8, str.EXEDATA
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0xe8]
call fcn.1400a4890
mov r9, qword [rsp + 0xe0]
mov rcx, qword [0x140131f48]
movzx r13d, word [rsi]
mov r14, rax
mov eax, 0x2e
mov word [rsi], bx
cmp ax, word [r9]
jne 0x1400a5a88
cmp word [r9 + 2], bx
jne 0x1400a5a88
mov rcx, qword [0x140131a70]
jmp 0x1400a5aa3
cmp word [r9], bx
je 0x1400a5aa3
xor edx, edx
mov rcx, r9
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r12, rax
mov rcx, rax
mov word [rsi], r13w
cmp rcx, rbx
je 0x1400a5ad6
mov rdx, qword [rsp + 0x138]
lea rax, [rsp + 0x150]
lea r9, [rsp + 0x120]
mov r8, r14
mov qword [rsp + 0x20], rax
call fcn.14001e2c8
mov rsi, rax
jmp 0x1400a5ade
mov rsi, qword [rsp + 0xa8]
cmp r12, rbx
je 0x1400a5aec
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp rsi, rbx
je 0x1400a595b
cmp rbp, rbx
mov r12, qword [rsp + 0x128]
mov r13, qword [rsp + 0xf0]
jle 0x1400a5b14
lea rax, [r13 + rbp]
cmp rax, r12
jle 0x1400a5b21
mov rbp, r12
sub rbp, r13
cmp rbp, rbx
cmovle rbp, rbx
lea rdx, [r12 + 0x200000]
lea rcx, [rsp + 0x120]
call fcn.140061424
mov rsi, qword [rsp + 0x120]
cmp rsi, rbx
je 0x1400a595b
lea rcx, [r12 + rsi]
xor edx, edx
mov r8d, 0x1ff
call fcn.1400f8760
cmp r13, r12
cmovg r13, r12
add rsi, r13
cmp r15, rbx
mov qword [rsp + 0xf0], r13
jl 0x1400a5b76
cmp r15, rbp
cmovl rbp, r15
lea r13, [rsi + 0x100000]
mov qword [rsp + 0x128], rbp
mov r12, rbp
and r13, 0xfffffffffff00000
cmp rbp, rbx
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xa8], r13
jle 0x1400a5bb7
cmp r13, rsi
je 0x1400a5bb7
mov r8, rbp
mov rdx, rsi
mov rcx, r13
call fcn.14001d004
mov r15, qword [rsp + 0x98]
mov byte [rsp + 0x138], bl
mov r14, rbx
mov rsi, rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0xa0], r15
cmp byte [rsp + 0x108], bl
je 0x1400a5bf7
mov edx, 2
lea rcx, str.SeManageVolumePrivilege
lea r8d, [rdx + 0x3e]
call fcn.14001ba5c
cmp r15, rbx
mov r9d, 1
mov dword [rsp + 0x80], 0x200
movzx eax, r9b
mov dword [rsp + 0x6c], ebx
mov qword [rsp + 0xe0], rbx
cmovne eax, ebx
mov r13, rbx
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x64]
cmp al, bl
je 0x1400a5c4f
cmp byte [rsp + 0x78], bl
lea r10d, [r9 + 1]
movzx eax, al
sete byte [rsp + 0x138]
cmp byte [rsp + 0x40], bl
cmove eax, r10d
mov dword [rsp + 0x64], eax
cmp byte [rsp + 0x84], bl
je 0x1400a5d2c
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x78]
call fcn.140061620
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call fcn.1400183dc
cmp rax, rbx
jne 0x1400a5ca0
lea rcx, [rsp + 0x78]
jmp 0x1400a586e
mov r13, qword [rax + 0x18]
mov rcx, qword [rax + 8]
movabs rax, 0x3fffffffffffffff
and r13, rax
mov qword [rsp + 0xe0], rcx
jle 0x1400a5c96
cmp byte [rsp + 0x40], bl
je 0x1400a5d0b
mov rax, qword [rsp + 0xd8]
sub r13, rax
cmp r13, rbp
cmovg r13, rbp
cmp r13, rbx
jle 0x1400a5cef
mov rdx, qword [rsp + 0xa8]
add rcx, rax
mov r8, r12
call fcn.14001d004
lea rcx, [rsp + 0x78]
call fcn.140058efc
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400a75b9
lea rcx, [rsp + 0x78]
call fcn.140058efc
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r12d, dword [rsp + 0x6c]
jmp 0x1400a5fa5
cmp byte [rsp + 0x50], bl
je 0x1400a5d3a
mov eax, ebx
mov dword [rsp + 0x6c], ebx
jmp 0x1400a5d5e
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.14006ac78
movsx eax, al
cmp eax, ebx
mov dword [rsp + 0x6c], eax
jl 0x1400a5880
mov r9d, 1
mov edx, dword [rsp + 0xc0]
cmp dl, bl
jne 0x1400a5dc5
cmp eax, ebx
jne 0x1400a5dc0
mov rax, qword [rsp + 0x58]
mov r8d, 0x5c
cmp r8w, word [rax]
jne 0x1400a5dc0
cmp r8w, word [rax + 2]
jne 0x1400a5dc0
movzx ecx, word [rax + 4]
lea r10d, [r8 - 0x1d]
cmp r10w, cx
je 0x1400a5d9c
lea eax, [r8 - 0x2e]
cmp ax, cx
jne 0x1400a5dc0
mov rax, qword [rsp + 0x58]
cmp r8w, word [rax + 6]
jne 0x1400a5dc0
cmp r10w, cx
jne 0x1400a5dc5
cmp r10w, word [rax + 8]
jne 0x1400a5dc5
mov ecx, 0x3a
cmp cx, word [rax + 0xa]
jne 0x1400a5dc5
mov r12b, bl
jmp 0x1400a5e41
mov r12b, r9b
cmp dl, bl
jne 0x1400a5df1
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.1400f7c14
movzx ecx, byte [rsp + 0xc0]
cmp eax, ebx
mov eax, 0x20
cmovne ecx, eax
mov byte [rsp + 0xc0], cl
cmp r15, rbx
jne 0x1400a5e90
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x48]
or r8d, 0xc0000000
mov r9d, 7
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov rsi, qword [rsp + 0x48]
mov r15, rax
mov qword [rsp + 0xa0], rax
cmp r15, rbx
jne 0x1400a5e8b
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov eax, 3
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x48]
or r8d, 0xc0000000
mov r9d, eax
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov rsi, qword [rsp + 0x48]
mov r15, rax
mov qword [rsp + 0xa0], rax
cmp r12b, bl
je 0x1400a5ef6
mov r12d, dword [rsp + 0x6c]
cmp byte [rsp + 0x64], bl
je 0x1400a5efb
cmp r12d, ebx
jg 0x1400a5efb
cmp r15, rbx
jne 0x1400a5f49
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x48]
or r8d, 0xc0000000
mov r9d, 3
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov rsi, qword [rsp + 0x48]
mov r15, rax
mov qword [rsp + 0xa0], rax
jmp 0x1400a5efb
mov r12d, dword [rsp + 0x6c]
cmp r15, rbx
jne 0x1400a5f49
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov ecx, 3
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
mov dword [rsp + 0x28], ecx
mov r9d, ecx
lea rcx, [rsp + 0x48]
or r8d, 0xc0000000
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov rsi, qword [rsp + 0x48]
mov r15, rax
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x148]
cmp rax, rbx
je 0x1400a5f7d
cmp rsi, rbx
je 0x1400a5f7d
mov rcx, qword [rsp + 0x1c0]
lea r9, [0x140112690]
mov r8, rax
mov rdx, rsi
call fcn.140064814
mov rsi, rbx
mov qword [rsp + 0x48], rbx
cmp r12d, ebx
je 0x1400a5fa5
cmp r15, rbx
je 0x1400a5fa5
mov edx, 0x200
mov rcx, r15
call fcn.14005d66c
mov ecx, 0x200
cmp eax, ecx
cmovl eax, ecx
mov dword [rsp + 0x80], eax
mov ecx, r12d
neg ecx
mov ecx, 2
sbb eax, eax
and eax, dword [rsp + 0x80]
mov dword [rsp + 0x78], eax
cmp byte [rsp + 0x64], cl
jne 0x1400a6efc
mov rcx, qword [rsp + 0x118]
cmp rcx, rbx
jle 0x1400a642b
cmp qword [rsp + 0x110], rbx
jle 0x1400a642b
mov rbp, qword [rsp + 0xd0]
cmp rbp, rbx
jl 0x1400a6006
lea rax, [rcx + rbp - 1]
cqo
idiv rcx
mov qword [rsp + 0xc8], rax
jmp 0x1400a6039
mov rax, qword [rsp + 0xc8]
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jne 0x1400a602a
mov rbp, rdx
mov qword [rsp + 0xd0], rdx
jmp 0x1400a6039
mov rbp, rcx
imul rbp, rax
mov qword [rsp + 0xd0], rbp
mov rcx, qword [rsp + 0x100]
call fcn.14001b5a4
lea rcx, [rsp + 0x78]
mov rdx, rax
call fcn.14006d444
mov r8d, dword [rsp + 0x84]
mov rax, qword [rsp + 0x118]
cmp r8b, bl
mov qword [rsp + 0xa8], rax
jg 0x1400a60a0
cmp r15, rbx
jne 0x1400a60a0
lea rcx, [rsp + 0x78]
call fcn.140058efc
cmp rsi, rbx
je 0x1400a595b
cmp rsi, 0xffffffffffffffff
je 0x1400a595b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a595b
cmp byte [rsp + 0x10c], bl
je 0x1400a637f
cmp r12d, ebx
jg 0x1400a637f
cmp r8b, bl
jg 0x1400a637f
cmp qword [rsp + 0x98], rbx
jne 0x1400a60e5
cmp rsi, rbx
je 0x1400a60dd
cmp rsi, 0xffffffffffffffff
je 0x1400a60dd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, rbx
mov qword [rsp + 0x48], rbx
cmp byte [rsp + 0x41], bl
je 0x1400a60f7
mov rcx, qword [rsp + 0x58]
xor edx, edx
call fcn.14006aa94
cmp qword [rsp + 0x98], rbx
jne 0x1400a617a
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov esi, 0xc0000000
lea rcx, [rsp + 0x48]
mov r9d, 3
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov r15, rax
cmp rax, rbx
jne 0x1400a624e
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x48]
mov r9d, 3
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov rsi, qword [rsp + 0x48]
mov r15, rax
cmp r15, rbx
je 0x1400a6075
mov cl, byte [rsp + 0x1d8]
mov rdx, qword [rsp + 0xc8]
cmp cl, bl
je 0x1400a627e
cmp rdx, rbx
jl 0x1400a627e
mov rax, qword [rsp + 0x110]
imul rax, rdx
cmp rbp, rbx
jl 0x1400a61bb
cmp rax, rbp
cmovg rax, rbp
mov rcx, qword [rsp + 0xd8]
lea rbp, [rax + rcx]
movabs rcx, 0x7fffffffffffffff
movabs rax, 0x7ffffffffffffdff
cmp rdx, rcx
cmovge rbp, rax
cmp byte [rsp + 0x138], bl
jne 0x1400a6215
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 2]
call fcn.14005a4b0
mov ecx, dword [rsp + 0x138]
cmp rax, rbp
movzx ecx, cl
mov eax, 1
cmovl ecx, eax
mov dword [rsp + 0x138], ecx
xor r8d, r8d
mov rdx, rbp
mov rcx, r15
call fcn.14005a4b0
cmp rax, rbp
movabs rax, 0x7fffffffffffffff
jne 0x1400a6258
mov rdx, qword [rsp + 0xc8]
cmp rdx, rax
jge 0x1400a6277
lea rcx, [rsp + 0x78]
call fcn.140058efc
jmp 0x1400a75b9
mov rsi, qword [rsp + 0x48]
jmp 0x1400a6183
cmp qword [rsp + 0xc8], rax
jge 0x1400a626f
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.14005a4b0
mov rdx, qword [rsp + 0xc8]
mov cl, byte [rsp + 0x1d8]
mov r8d, dword [rsp + 0x84]
cmp rdx, rbx
jle 0x1400a6ed8
cmp qword [rsp + 0xd0], rbx
jle 0x1400a6ed8
mov dword [rsp + 0xc0], ebx
mov rax, rbx
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xe8], rbx
cmp cl, bl
jne 0x1400a62c6
mov byte [rsp + 0x41], 1
cmp byte [rsp + 0x40], bl
je 0x1400a62ca
mov byte [rsp + 0x41], bl
cmp r12d, ebx
jle 0x1400a62e9
mov eax, dword [rsp + 0xd8]
cdq
idiv dword [rsp + 0x80]
movsxd rax, edx
mov qword [rsp + 0xb0], rax
mov rbp, qword [rsp + 0xd8]
sub rbp, rax
cmp rbp, rbx
jle 0x1400a6393
cmp r8b, bl
jg 0x1400a6393
xor r8d, r8d
mov rdx, rbp
mov rcx, r15
call fcn.14005a4b0
cmp rax, rbp
je 0x1400a6393
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x78]
mov ebp, eax
call fcn.140058efc
cmp rsi, rbx
je 0x1400a633f
cmp rsi, 0xffffffffffffffff
je 0x1400a633f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x120]
call fcn.140058efc
lea rcx, [rsp + 0x58]
call fcn.140058efc
lea rcx, [rsp + 0x88]
call fcn.140058efc
cmp rdi, rbx
je 0x1400a6377
cmp rdi, 0xffffffffffffffff
je 0x1400a6377
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rbp
jmp 0x1400a58bf
mov cl, byte [rsp + 0x1d8]
mov rdx, qword [rsp + 0xc8]
jmp 0x1400a6286
mov r12, qword [rsp + 0x78]
mov eax, 0x26
mov qword [rsp + 0x158], rbx
cmp ax, word [r12]
mov qword [rsp + 0x148], rbx
mov rbp, rbx
sete al
mov qword [rsp + 0x98], rbx
mov byte [rsp + 0x50], al
cmp al, bl
je 0x1400a650a
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0xa0]
call fcn.140061620
mov rcx, qword [rsp + 0x1c0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rbx
call fcn.1400183dc
cmp rax, rbx
jne 0x1400a644c
lea rcx, [rsp + 0xa0]
call fcn.140058efc
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x78]
call fcn.140058efc
cmp rsi, rbx
je 0x1400a5880
cmp rsi, 0xffffffffffffffff
je 0x1400a5880
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a5880
mov rcx, qword [rax + 8]
mov rax, qword [rax + 0x18]
movabs rdx, 0x3fffffffffffffff
and rax, rdx
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x148], rax
jg 0x1400a6499
mov r14, 0xffffffff80070057
lea rcx, [rsp + 0xa0]
call fcn.140058efc
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400a623f
cmp byte [rsp + 0x84], bl
je 0x1400a64ec
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xf0]
sub r13, r8
sub rax, r12
cmp r13, rdx
cmovg r13, rdx
cmp r13, rax
cmovg r13, rax
cmp r13, rbx
jle 0x1400a647a
lea rdx, [rcx + r12]
mov rcx, qword [rsp + 0xe0]
add rcx, r8
mov r8, r13
call fcn.14001d004
jmp 0x1400a647a
lea rcx, [rsp + 0xa0]
call fcn.140058efc
lea rcx, [0x140133120]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [rsp + 0x50]
cmp byte [rsp + 0x41], bl
je 0x1400a6696
cmp al, bl
jg 0x1400a6696
lea rcx, [rsp + 0x78]
call fcn.14006addc
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rbx
mov r14d, 3
movsx r13d, al
mov dword [rsp + 0x30], ebx
mov r12d, 0x80000000
lea rcx, [rsp + 0x98]
mov r9d, r14d
mov r8d, r12d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0xc0], r13d
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov rbp, qword [rsp + 0x98]
cmp rbp, rbx
jne 0x1400a65b6
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x98]
mov r9d, r14d
mov r8d, r12d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov rbp, qword [rsp + 0x98]
cmp rbp, rbx
je 0x1400a6075
cmp r13d, ebx
je 0x1400a65d4
mov edx, 0x200
mov rcx, rbp
call fcn.14005d66c
mov ecx, eax
mov qword [rsp + 0xf8], rcx
jmp 0x1400a65d9
mov ecx, 0x200
cmp r13d, ebx
mov r12, qword [rsp + 0xf0]
jle 0x1400a65f9
mov eax, r12d
cdq
idiv ecx
movsxd rax, edx
mov qword [rsp + 0xe8], rax
jmp 0x1400a65fc
mov rax, rbx
sub r12, rax
cmp r12, rbx
jle 0x1400a6699
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call fcn.14005a4b0
cmp rax, r12
je 0x1400a6699
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp rbp, rbx
je 0x1400a6638
cmp rbp, 0xffffffffffffffff
je 0x1400a6638
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x78]
call fcn.140058efc
cmp rsi, rbx
je 0x1400a6656
cmp rsi, 0xffffffffffffffff
je 0x1400a6656
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x120]
call fcn.140058efc
lea rcx, [rsp + 0x58]
call fcn.140058efc
lea rcx, [rsp + 0x88]
call fcn.140058efc
cmp rdi, rbx
je 0x1400a668e
cmp rdi, 0xffffffffffffffff
je 0x1400a668e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r12
jmp 0x1400a58bf
mov r13d, ebx
cmp dword [rsp + 0x6c], ebx
jle 0x1400a66ca
movsxd r8, dword [rsp + 0x80]
mov rax, qword [rsp + 0x110]
lea rax, [r8 + rax - 1]
cqo
idiv r8
mov r9, rax
imul r9, r8
mov qword [rsp + 0x110], r9
jmp 0x1400a66da
mov r8d, dword [rsp + 0x80]
mov r9, qword [rsp + 0x110]
cmp r13d, ebx
jle 0x1400a670a
movsxd rcx, dword [rsp + 0xf8]
mov rax, qword [rsp + 0x118]
lea rax, [rcx + rax - 1]
cqo
idiv rcx
mov rdx, rax
imul rdx, rcx
mov qword [rsp + 0x118], rdx
jmp 0x1400a6712
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xf8]
lea rax, [rdx + r9]
cmp rdx, r9
mov r14, rdx
cmovne r14, rax
mov eax, ecx
add r14, 0x8000
cmp r8d, ecx
lea rcx, [rsp + 0x100]
cmovg eax, r8d
mov qword [rsp + 0xd8], r14
cdqe
lea r12, [rax + r14 + 0x2800]
lea rdx, [r12 + 0x100000]
call fcn.1400613a8
mov r13, qword [rsp + 0x100]
mov edx, dword [rsp + 0x140]
add r13, 0x100000
mov r8, r12
and r13, 0xfffffffffff00000
mov rcx, r13
mov qword [rsp + 0x160], r13
lea rax, [r13 + r14 + 0x2800]
mov qword [rsp + 0xa0], rax
call fcn.1400f8760
mov r12, qword [rsp + 0xe8]
cmp r12, rbx
mov r9b, bl
mov r14, rbx
mov dword [rsp + 0x64], r9d
jle 0x1400a6816
mov r14, qword [rsp + 0xf8]
lea r9, [rsp + 0xa8]
mov rdx, r13
mov rcx, rbp
mov r8d, r14d
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rsp + 0xd0]
movsxd r14, r14d
sub r14, r12
sub rax, r14
mov qword [rsp + 0xd0], rax
jns 0x1400a6801
add r14, rax
lea rdx, [r13 + r12]
mov r8, r14
mov rcx, r13
call fcn.14001d004
mov r9d, dword [rsp + 0x64]
cmp qword [rsp + 0xb0], rbx
jle 0x1400a68c9
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 1]
call fcn.14005a4b0
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0xa0]
lea r9, [rsp + 0xa8]
mov rcx, r15
mov r12, rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rsp + 0xb0]
mov r8, r14
mov rdx, r13
lea rcx, [r13 + rax]
call fcn.14001d004
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa0]
mov rcx, r13
call fcn.14001d004
add r14, qword [rsp + 0xb0]
xor r8d, r8d
mov rdx, r12
mov rcx, r15
call fcn.14005a4b0
mov r9d, dword [rsp + 0x64]
cmp byte [rsp + 0x1d8], bl
movzx r9d, r9b
mov eax, 1
cmovne r9d, eax
mov dword [rsp + 0x64], r9d
jmp 0x1400a68ce
mov eax, 1
cmp r14, rbx
mov rcx, qword [rsp + 0xd0]
mov byte [rsp + 0x40], al
jle 0x1400a691f
mov r12, r13
mov rdx, qword [rsp + 0x110]
mov qword [rsp + 0xb0], r12
cmp r14, rdx
jge 0x1400a6a40
cmp r14, rbx
jle 0x1400a6927
cmp r13, r12
je 0x1400a6927
mov r8, r14
mov rdx, r12
mov rcx, r13
call fcn.14001d004
mov al, byte [rsp + 0x40]
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0x110]
cmp rcx, rbx
jle 0x1400a6a1b
cmp al, bl
je 0x1400a6a1b
cmp byte [rsp + 0x41], bl
je 0x1400a6e3b
mov rax, qword [rsp + 0x118]
mov r8, rcx
cmp rax, rcx
mov rcx, qword [rsp + 0xd8]
cmovle r8, rax
lea rax, [r8 + r14]
cmp rax, rcx
jle 0x1400a696b
mov r8, rcx
sub r8, r14
mov rax, qword [rsp + 0xf8]
movsxd rdx, eax
add rdx, r8
dec eax
not eax
movsxd rcx, eax
and rdx, rcx
cmp dword [rsp + 0xc0], ebx
cmovg r8, rdx
cmp byte [rsp + 0x50], bl
je 0x1400a69e8
mov r12, qword [rsp + 0x148]
mov rcx, qword [rsp + 0xf0]
sub r12, rcx
cmp r12, r8
cmovg r12, r8
cmp r8, rbx
jle 0x1400a69d3
mov rax, qword [rsp + 0x158]
mov r8, r12
lea rdx, [rcx + rax]
lea rcx, [r14 + r13]
call fcn.14001d004
mov rcx, qword [rsp + 0xf0]
add rcx, r12
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xf0], rcx
jmp 0x1400a6a12
lea rdx, [r14 + r13]
lea r9, [rsp + 0xa8]
mov rcx, rbp
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r12, qword [rsp + 0xa8]
cmp r12, rbx
jg 0x1400a6e21
cmp r14, rbx
jle 0x1400a6ea6
mov r9d, dword [rsp + 0x64]
mov rdx, qword [rsp + 0x110]
mov byte [rsp + 0x40], bl
mov r12, r13
mov qword [rsp + 0xb0], r13
cmp rdx, r14
mov r8, r14
mov dword [rsp + 0x68], ebx
cmovle r8, rdx
cmp dword [rsp + 0x6c], ebx
mov qword [rsp + 0x98], r8
jle 0x1400a6a79
movsxd r10, dword [rsp + 0x80]
mov rax, r8
cqo
idiv r10
mov rax, rdx
mov qword [rsp + 0xc8], rdx
jmp 0x1400a6a8c
mov r10d, dword [rsp + 0x80]
mov rax, rbx
mov qword [rsp + 0xc8], rbx
mov r13, r8
sub r13, rax
cmp r13, rbx
mov qword [rsp + 0x140], r13
jle 0x1400a6b4b
mov rdx, r12
cmp byte [rsp + 0x84], bl
je 0x1400a6ada
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xe0]
mov r8, r13
add rcx, rax
call fcn.14001d004
add qword [rsp + 0xb8], r13
mov eax, r13d
jmp 0x1400a6d72
lea r9, [rsp + 0x68]
mov r8d, r13d
mov rcx, r15
mov dword [rsp + 0x20], r10d
call fcn.14005edd4
cmp eax, ebx
jne 0x1400a6d6e
cmp byte [rsp + 0x90], bl
jne 0x1400a6c66
call qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
cmp eax, ebx
cmove eax, ecx
mov r14d, eax
lea rcx, [rsp + 0x100]
call fcn.140058efc
cmp rbp, rbx
je 0x1400a623f
cmp rbp, 0xffffffffffffffff
je 0x1400a623f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a623f
cmp rax, rbx
jle 0x1400a6c1a
mov rcx, qword [rsp + 0xa0]
movsxd r13, r10d
xor edx, edx
mov r8, r13
mov qword [rsp + 0x98], r13
call fcn.1400f8760
sub r13, qword [rsp + 0xc8]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r15
call fcn.14005a4b0
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0xa0]
lea r9, [rsp + 0xa8]
mov rcx, r15
mov r12, rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xc8]
mov r8, r13
add rdx, rcx
mov rcx, qword [rsp + 0xb0]
add rcx, r14
call fcn.14001d004
xor r8d, r8d
mov rdx, r12
mov rcx, r15
add r14, r13
call fcn.14005a4b0
movzx r9d, byte [rsp + 0x64]
cmp byte [rsp + 0x1d8], bl
mov r13, qword [rsp + 0x140]
mov r8, qword [rsp + 0x98]
mov eax, 1
cmovne r9d, eax
mov dword [rsp + 0x64], r9d
cmp r8, rbx
mov r12, qword [rsp + 0xb0]
mov dword [rsp + 0x68], ebx
jle 0x1400a6de2
lea r9, [rsp + 0x68]
mov rdx, r12
mov rcx, r15
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x1400a6ddd
cmp byte [rsp + 0x90], bl
je 0x1400a6e9f
mov eax, 2
mov byte [rsp + 0x90], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [rsp + 0x90]
mov byte [rsp + 0x90], bl
mov byte [rsp + 0x42], al
mov dword [rsp + 0x68], ebx
cmp rsi, rbx
je 0x1400a6c96
cmp rsi, 0xffffffffffffffff
je 0x1400a6c96
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov esi, 0xc0000000
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov r15, rax
cmp rax, rbx
jne 0x1400a6d38
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov r15, rax
cmp rax, rbx
jne 0x1400a6d38
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov r15, rax
mov eax, dword [rsp + 0x80]
lea r9, [rsp + 0x68]
mov r8d, r13d
mov rdx, r12
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.14005edd4
mov rsi, qword [rsp + 0x48]
cmp eax, ebx
je 0x1400a6b04
mov eax, 2
cmp byte [rsp + 0x42], al
je 0x1400a6ddd
mov eax, dword [rsp + 0x68]
mov r9d, dword [rsp + 0x64]
cmp eax, r13d
cmova eax, r13d
mov dword [rsp + 0x68], eax
cmp r9b, bl
je 0x1400a6da0
mov r8d, eax
xor edx, edx
mov rcx, r12
call fcn.1400f8760
mov eax, dword [rsp + 0x68]
mov r9b, bl
mov dword [rsp + 0x64], r9d
mov r8, qword [rsp + 0x98]
mov r10d, dword [rsp + 0x80]
sub r14, rax
sub r8, rax
mov rax, qword [rsp + 0xc8]
add r12, r13
mov qword [rsp + 0xb0], r12
mov byte [rsp + 0x90], bl
mov qword [rsp + 0x98], r8
jmp 0x1400a6b4b
mov r9d, dword [rsp + 0x64]
cmp r9b, bl
je 0x1400a6dfe
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, r12
call fcn.1400f8760
mov r9b, bl
mov dword [rsp + 0x64], r9d
mov eax, dword [rsp + 0x68]
mov r13, qword [rsp + 0x160]
mov rcx, qword [rsp + 0xd0]
add r12, rax
sub r14, rax
mov al, byte [rsp + 0x40]
jmp 0x1400a68e2
mov rcx, qword [rsp + 0xd0]
cmp r12, rcx
jle 0x1400a6e74
mov r12, rcx
mov qword [rsp + 0xa8], rcx
jmp 0x1400a6e74
cmp rdx, rcx
mov r12, rcx
mov rcx, qword [rsp + 0xd8]
cmovle r12, rdx
mov qword [rsp + 0xa8], r12
lea rax, [r14 + r12]
cmp rax, rcx
jle 0x1400a6e6c
mov r12, rcx
sub r12, r14
mov qword [rsp + 0xa8], r12
mov rcx, qword [rsp + 0xd0]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
je 0x1400a6e8e
sub rcx, r12
mov qword [rsp + 0xd0], rcx
mov r9d, dword [rsp + 0x64]
mov al, byte [rsp + 0x40]
add r14, r12
jmp 0x1400a68df
mov eax, 1
jmp 0x1400a6ea8
mov eax, ebx
cmp eax, ebx
jne 0x1400a6b0a
mov rax, qword [rsp + 0xd0]
cmp rax, rbx
jle 0x1400a6ed0
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jne 0x1400a6b0a
mov r14, rbx
jmp 0x1400a6b1d
mov rax, qword [rsp + 0xd8]
cmp rax, rbx
je 0x1400a623f
xor r8d, r8d
mov rdx, rax
mov rcx, r15
call fcn.14005a4b0
jmp 0x1400a623f
mov r12w, bx
mov qword [rsp + 0x100], r13
mov rax, rbx
mov qword [rsp + 0x1d8], rbx
mov dword [rsp + 0x90], r12d
cmp byte [rsp + 0x84], bl
jne 0x1400a70e8
mov eax, dword [rsp + 0x6c]
cmp eax, 0x11
jne 0x1400a6f5e
lea r8, [rsp + 0x100]
xor edx, edx
mov rcx, r15
call fcn.1400763d4
cmp rax, rbx
mov qword [rsp + 0x1d8], rax
jl 0x1400a607f
mov r13, qword [rsp + 0x100]
jmp 0x1400a6fc4
cmp r15, rbx
je 0x1400a6fc8
cmp eax, ebx
jne 0x1400a6fa6
mov r8d, ecx
xor edx, edx
mov rcx, r15
call fcn.14005a4b0
mov rcx, qword [rsp + 0xd8]
mov r13, rax
lea rax, [rcx - 0x400]
cmp r13, rax
jge 0x1400a6fa0
cmp qword [rsp + 0x98], rbx
jne 0x1400a6fa0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400a6fc4
mov eax, dword [rsp + 0x6c]
jmp 0x1400a6fd0
mov dl, al
mov rcx, r15
call fcn.14005ed18
mov r13, rax
cmp rax, rbx
movabs rax, 0x7fffffffffffffff
cmovl r13, rax
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0xd8]
cmp byte [rsp + 0x60], bl
je 0x1400a6fe5
cmp ebp, 0xfffffffc
jne 0x1400a6fe5
mov rbp, r13
sub rbp, rcx
cmovs rbp, rbx
cmp r15, rbx
jne 0x1400a70ab
cmp eax, ebx
jne 0x1400a7093
cmp byte [rsp + 0x41], bl
je 0x1400a7009
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.14006aa94
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov r13d, 3
mov esi, 0xc0000000
lea rcx, [rsp + 0x48]
mov r9d, r13d
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov r15, rax
mov qword [rsp + 0xa0], rax
cmp rax, rbx
jne 0x1400a70a0
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x48]
mov r9d, r13d
mov r8d, esi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rbx
call fcn.1400037bc
mov r15, rax
mov qword [rsp + 0xa0], rax
cmp rax, rbx
jne 0x1400a70a0
mov rsi, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x1400a632b
mov rsi, qword [rsp + 0x48]
mov eax, dword [rsp + 0x6c]
jmp 0x1400a70b8
cmp byte [rsp + 0xc0], bl
je 0x1400a70c2
cmp eax, ebx
jne 0x1400a70c6
movabs r13, 0x7fffffffffffffff
cmp eax, ebx
je 0x1400a70e0
mov eax, dword [rsp + 0xd8]
xor edx, edx
div dword [rsp + 0x80]
mov r12d, edx
mov dword [rsp + 0x90], edx
mov rax, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0xd8]
mov qword [rsp + 0xf8], rbx
add rdx, rax
sub r13, rdx
mov qword [rsp + 0xb8], rdx
cmp byte [rsp + 0x84], bl
jne 0x1400a7148
movzx eax, r12w
xor r8d, r8d
mov rcx, r15
sub rdx, rax
call fcn.14005a4b0
cmp rax, rbx
jge 0x1400a7140
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0xf8]
mov ebp, eax
call fcn.140058efc
jmp 0x1400a632b
mov rdx, qword [rsp + 0xb8]
cmp byte [rsp + 0x70], bl
je 0x1400a71b3
mov rax, qword [rsp + 0xe8]
cmp r13, rax
cmovg r13, rax
cmp byte [rsp + 0x84], bl
je 0x1400a7186
mov rcx, qword [rsp + 0xe0]
mov r8, r13
add rcx, rdx
mov rdx, qword [rsp + 0xa8]
call fcn.14001d004
jmp 0x1400a759e
cmp r13, rbx
jle 0x1400a759e
mov eax, dword [rsp + 0x78]
mov rdx, qword [rsp + 0xa8]
mov r8, r13
movzx r9d, r12w
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.140076610
jmp 0x1400a759e
cmp rbp, rbx
jl 0x1400a71bf
cmp rbp, r13
cmovl r13, rbp
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x1c8], rdx
cmp byte [rsp + 0x42], bl
je 0x1400a721d
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0xf8]
mov r9, rax
mov r8, rax
call fcn.14006155c
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rcx, eax
cmp rcx, r13
cmovg eax, r13d
cmp eax, ebx
jle 0x1400a759e
mov rdx, qword [rsp + 0xf8]
movsxd r8, eax
mov eax, dword [rsp + 0x6c]
jmp 0x1400a719e
mov eax, dword [rsp + 0x80]
lea rcx, [rsp + 0x140]
lea edx, [rax + rax]
call fcn.1400613a8
mov r9d, dword [rsp + 0x80]
mov r8b, byte [rsp + 0x71]
lea ecx, [r9 - 1]
mov rdx, r9
movzx eax, r12w
add rdx, qword [rsp + 0x140]
not ecx
sub r9d, eax
and rdx, rcx
cmp r13, rbx
mov r12, rbx
mov r10b, bl
mov byte [rsp + 0x42], bl
mov byte [rsp + 0x1d8], r8b
mov qword [rsp + 0x98], rdx
jle 0x1400a7591
mov edi, dword [rsp + 0x78]
mov rsi, qword [rsp + 0xb8]
mov r11d, 0x30
cmp r12, rbx
mov rax, qword [rsp + 0x1c8]
jg 0x1400a72a7
cmp word [rax], bx
je 0x1400a7581
movsxd r9, r9d
mov ebp, ebx
mov rcx, rbx
cmp r9, rbx
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0xe8], r9
jle 0x1400a7581
mov dil, byte [rsp + 0x71]
mov r14d, 1
lea r15d, [r14 + 0x1f]
cmp r13, rbx
jle 0x1400a74fc
cmp r12, rbx
jg 0x1400a74ca
cmp word [rax], bx
je 0x1400a74fc
lea rcx, [rsp + 0x1c8]
call fcn.140058ecc
mov rcx, qword [rsp + 0x1c8]
mov edx, 0x2a
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0xb8], rbx
cmp dx, word [rcx]
jne 0x1400a73b9
lea eax, [rdx - 0x28]
lea rdx, [rsp + 0x100]
mov qword [rsp + 0x100], r14
add rcx, rax
mov qword [rsp + 0x1c8], rcx
lea rcx, [rsp + 0x1c8]
call fcn.1400713b4
mov rcx, qword [rsp + 0x1c8]
mov r12, qword [rsp + 0x100]
mov r8b, byte [rsp + 0x1d8]
mov r11d, 0x30
jmp 0x1400a73b4
cmp dx, ax
je 0x1400a7497
mov edx, 0x28
cmp dx, ax
je 0x1400a73ef
cmp ax, r11w
jb 0x1400a738f
cmp ax, 0x39
jbe 0x1400a73c1
cmp r8b, bl
je 0x1400a73a4
or ax, r15w
cmp ax, 0x61
jb 0x1400a73a4
cmp ax, 0x7a
jbe 0x1400a73c1
mov eax, 2
add rcx, rax
mov qword [rsp + 0x1c8], rcx
mov edx, 0x2a
movzx eax, word [rcx]
cmp ax, bx
jne 0x1400a7370
cmp r11w, word [rcx]
jne 0x1400a7411
movzx eax, word [rcx + 2]
mov edx, 0x78
or ax, r15w
cmp dx, ax
jne 0x1400a7411
add rcx, 4
mov byte [rsp + 0x1d8], r14b
mov qword [rsp + 0x1c8], rcx
jmp 0x1400a7416
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0xb8], rbx
call fcn.1400713b4
jmp 0x1400a7497
cmp r8b, bl
je 0x1400a746b
mov eax, 2
lea r8, [rsp + 0x10c]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0xb8], rbx
mov dword [rsp + 0x10c], eax
call fcn.140062a38
mov r8, qword [rsp + 0x1c8]
mov ecx, 9
movzx eax, word [r8]
sub ax, 0x30
cmp ax, cx
jbe 0x1400a748d
mov byte [rsp + 0x1d8], dil
jmp 0x1400a748d
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x1c8]
call fcn.140071624
cmp eax, r14d
jl 0x1400a74f4
mov r8, qword [rsp + 0x1c8]
cmp r8, qword [rsp + 0x160]
je 0x1400a74f4
mov r10b, byte [rsp + 0xb8]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x158]
mov r8b, byte [rsp + 0x1d8]
mov r9, qword [rsp + 0xe8]
mov byte [rsp + 0x42], r10b
mov r11d, 0x30
mov byte [rdx + rcx], r10b
add rcx, r14
sub r12, r14
add ebp, r14d
sub r13, r14
cmp rcx, r9
mov qword [rsp + 0x158], rcx
jge 0x1400a74fc
mov rax, qword [rsp + 0x1c8]
jmp 0x1400a72d7
mov rdx, qword [rsp + 0x98]
cmp ebp, ebx
mov r15, qword [rsp + 0xa0]
mov r14d, dword [rsp + 0x90]
mov edi, dword [rsp + 0x78]
jle 0x1400a7581
cmp byte [rsp + 0x84], bl
je 0x1400a7538
mov rcx, qword [rsp + 0xe0]
movsxd rbp, ebp
add rcx, rsi
mov r8, rbp
call fcn.14001d004
add rsi, rbp
jmp 0x1400a754b
movzx r9d, r14w
movsxd r8, ebp
mov rcx, r15
mov dword [rsp + 0x20], edi
call fcn.140076610
cmp r13, rbx
mov rdx, qword [rsp + 0x98]
mov r8b, byte [rsp + 0x1d8]
mov r10b, byte [rsp + 0x42]
mov r14w, bx
mov r9d, 0x200
mov dword [rsp + 0x90], r14d
mov r11d, 0x30
jg 0x1400a7291
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0x48]
mov r14, rbx
lea rcx, [rsp + 0x140]
call fcn.140058efc
cmp r15, rbx
je 0x1400a75ac
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [rsp + 0xf8]
call fcn.140058efc
cmp byte [rsp + 0x138], bl
je 0x1400a75d0
cmp r15, rbx
je 0x1400a75d0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp byte [rsp + 0x108], bl
je 0x1400a7633
cmp r15, rbx
je 0x1400a7633
lea r8, [rsp + 0x1d8]
mov r9d, 2
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp eax, ebx
je 0x1400a7633
lea r8, [0x140132350]
lea rdx, str.Kernel32.DLL
lea rcx, str.SetFileValidData
xor r9d, r9d
call fcn.14005a664
mov r11, qword [0x140132350]
cmp r11, rbx
je 0x1400a7633
mov rdx, qword [rsp + 0x1d8]
mov rcx, r15
call r11
cmp rsi, rbx
je 0x1400a7647
cmp rsi, 0xffffffffffffffff
je 0x1400a7647
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x120]
call fcn.140058efc
lea rcx, [rsp + 0x58]
call fcn.140058efc
lea rcx, [rsp + 0x88]
call fcn.140058efc
cmp rdi, rbx
je 0x1400a767f
cmp rdi, 0xffffffffffffffff
je 0x1400a767f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r14
jmp 0x1400a58bf