Function at 0x140045040
Capabilities:
Read file on windows

Disassembly:
movzx ecx, byte [rax + 0x10]
jmp 0x140041e3f
mov rcx, rax
shr rcx, 0x20
mov rsi, rax
call fcn.14004bfd0
mov ecx, eax
mov rax, rsi
jmp 0x140041e3f
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x28
ja case.default.0x140041e35
lea rdx, [0x14009d148]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
xor ecx, ecx
jmp 0x140041e3f
movzx ecx, byte [rax + 0xf]
cmp cl, 0xb
jne case.0x140041de1.40
lea rcx, [rbp - 8]
clc
call fcn.140007070
cld
push qword [rcx]
ror byte [rax - 0x7d], 0xc4
add rsp, 0x40
pop rdi
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov cl, 0x25
jmp 0x140041e3f
mov cl, 0x23
jmp 0x140041e3f
mov cl, 0x24
jmp 0x140041e3f
mov cl, 0x1b
jmp 0x140041e3f
mov cl, 0x22
jmp 0x140041e3f
mov cl, 0x10
jmp 0x140041e3f
mov cl, 0xe
jmp 0x140041e3f
mov cl, 0x21
jmp 0x140041e3f
mov cl, 0xb
jmp 0x140041e3f
mov cl, 4
jmp 0x140041e3f
mov cl, 0x28
jmp 0x140041e3f
mov cl, 0xc
jmp 0x140041e3f
mov cl, 9
jmp 0x140041e3f
mov cl, 0x19
jmp 0x140041e3f
mov cl, 0x18
jmp 0x140041e3f
mov cl, 2
jmp 0x140041e3f
mov cl, 0xf
jmp 0x140041e3f
mov cl, 3
jmp 0x140041e3f
mov cl, 7
jmp 0x140041e3f
mov cl, 1
jmp 0x140041e3f
mov cl, 0x1f
jmp 0x140041e3f
mov cl, 0x11
jmp 0x140041e3f
mov cl, 0x29
jmp 0x140041e3f
mov cl, 0x14
jmp 0x140041e3f
invalid
mov byte [rcx - 0x4e7b14fb], dh
adc eax, 0xdb180eb
jmp 0x140041e3f
mov cl, 0xd
mov cl, 5
jmp 0x140041e3f
mov cl, 0x15
jmp 0x140041e3f
mov cl, 0xd
jmp 0x140041e3f
invalid
mov cl, 6
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x12
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0xa
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 8
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x1e
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x20
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x16
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x27
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x13
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x17
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x1c
jmp 0x140041e3f
invalid
invalid
invalid
mov cl, 0x1d
jmp 0x140041e3f
mov cl, 0x26
jmp 0x140041e3f
mov cl, 0x1a
jmp 0x140041e3f
or r15, 2
jmp 0x140042e50
mov word [rbp + 0x1b2], cx
mov dword [rbp + 0x1b4], eax
movups xmmword [rbp + 0x1b8], xmm0
adc dword [rbp + 0x1b8], eax
adc dword [rbp + 0x1b8], eax
mov dword [rbp + 0x1c8], edx
lea rdx, [rbp + 0x1b0]
add dword [rax], eax
add byte [rax - 0x77], cl
stc
add dword [rax], eax
add byte [rax - 0x77], cl
stc
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x140042c7a
xor r15d, r15d
jmp 0x140042c8a
invalid
adc al, ch
in eax, dx
push rdi
add eax, 0xc7894100
call sub.WS2_32.dll_WSAGetLastError
mov r15d, eax
shl r15, 0x20
or r15, 2
mov qword [rbp + 0x3c0], r15
mov dword [rbp + 0x1b0], 0
lea r8, [rbp + 0x1b0]
mov rcx, rdi
mov edx, 0x8004667e
call sub.WS2_32.dll_ioctlsocket
cmp eax, 0xffffffff
je 0x140042cd6
test r15, r15
je 0x140042cf3
mov eax, r15d
and eax, 3
lea rcx, [0x14009d1ec]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
movzx eax, byte [r15 + 0x10]
jmp 0x140042d32
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
test r15, r15
jne 0x140042e41
jmp 0x140042e4d
xor r15d, r15d
jmp 0x140042e50
mov rcx, r15
shr rcx, 0x20
call fcn.14004bfd0
jmp 0x140042d32
mov rax, r15
shr rax, 0x20
cmp eax, 0x28
ja case.default.0x140042d27
lea rcx, [0x14009d1fc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor eax, eax
jmp 0x140042d32
movzx eax, byte [r15 + 0xf]
cmp al, 0xd
jne 0x140042e50
test r14, r14
jne 0x140042d4f
test ebx, ebx
jne 0x140042d4f
lea rsi, str.8_n_
jmp 0x140042e41
cmp r14, 0x7fffffff
mov eax, 0x7fffffff
cmovb rax, r14
cmovb eax, esi
mov ecx, ebx
imul rcx, rcx, 0x10624dd3
shr rcx, 0x26
mov dword [rbp + 0x3b8], eax
test rax, rax
mov eax, 1
cmovne eax, ecx
cmp ebx, 0x3e8
cmovae eax, ecx
mov dword [rbp + 0x3bc], eax
lea rcx, [rbp + 0x1c0]
mov r8d, 0x1f8
xor edx, edx
call sub.msvcrt.dll_memset
add byte [rax - 0x39], cl
test al, 1
add byte [rax], al
add byte [rax], al
add byte [rax - 0x39], cl
test al, 1
add byte [rax], al
add byte [rax], al
mov qword [rbp - 0x50], rdi
add byte [rax], al
mov qword [rbp - 0x50], rdi
lea rcx, [rbp - 0x48]
lea ecx, [rbp - 0x48]
mov r8d, 0x1f8
add byte [rax], al
xor edx, edx
call sub.msvcrt.dll_memset
add eax, 0x85c74800
mov al, 1
add byte [rax], al
add dword [rax], eax
add byte [rax], al
add eax, 0x85c74800
mov al, 1
add byte [rax], al
add dword [rax], eax
add byte [rax], al
mov qword [rbp + 0x1b8], rdi
mov dword [rbp + 0x1b8], edi
lea rax, [rbp + 0x3b8]
lea eax, [rbp + 0x3b8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], eax
lea r8, [rbp - 0x58]
lea r9, [rbp + 0x1b0]
invalid
test al, 0x4c
lea ecx, [rbp + 0x1b0]
invalid
add byte [rcx + 1], bh
mov ecx, 1
xor edx, edx
call sub.WS2_32.dll_select
test eax, eax
invalid
je 0x140042e0c
shr al, cl
invalid
sal byte [rsi + rdx - 0x7d], 0xf8
push qword [rbp + 0x1a]
invalid
cmp eax, 0xffffffff
jne 0x140042e15
invalid
sbb ch, al
insb byte [rdi], dx
push rsi
add eax, 0x48c68900
invalid
shl rsi, 0x20
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
invalid
shl rsi, 0x20
invalid
or rsi, 2
jmp 0x140042e41
invalid
lea r15, str.p_n_
jmp 0x140042e1e
jne 0x140042e06
add eax, 0x8309eb00
cmp dword [rbp - 0x58], 1
jne 0x140042e2c
jge 0x140042dc0
add dword [rbp + 0x11], esi
xor r15d, r15d
dec dword [rax - 0x73]
invalid
lea rcx, [rbp + 0x3c0]
call fcn.140007070
jmp 0x140042e50
invalid
add al, ch
cld
invalid
and al, 0x48
mov ecx, esi
mov rcx, rsi
call fcn.140043830
add byte [rax], al
mov rsi, rdx
test rax, rax
jne 0x140042e41
test rsi, rsi
je 0x140042e1b
invalid
fimul dword [rax - 0x73]
invalid
lea rcx, [rbp + 0x3c0]
call fcn.140007070
add al, ch
and eax, dword [rdx - 4]
dec dword [rcx - 0x77]
mov edi, esi
mov rax, r15
add rsp, 0x448
pop rbx
pop rdi
mov r15, rsi
mov edi, esi
mov rax, r15
add rsp, 0x448
invalid
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov al, 0x25
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x23
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x24
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x1b
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x22
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x10
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0xe
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x21
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0xb
jmp 0x140042d32
invalid
invalid
invalid
mov al, 4
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x28
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0xc
jmp 0x140042d32
invalid
invalid
invalid
mov al, 9
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x19
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x18
jmp 0x140042d32
invalid
invalid
invalid
mov al, 2
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0xf
jmp 0x140042d32
invalid
invalid
invalid
mov al, 3
jmp 0x140042d32
invalid
invalid
invalid
mov al, 7
jmp 0x140042d32
invalid
invalid
invalid
mov al, 1
jmp 0x140042d32
mov al, 0x1f
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x11
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x29
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x14
jmp 0x140042d32
invalid
invalid
invalid
mov al, 5
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x15
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0xd
jmp 0x140042d32
invalid
invalid
invalid
mov al, 6
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x12
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0xa
jmp 0x140042d32
invalid
invalid
invalid
mov al, 8
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x1e
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x20
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x16
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x27
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x13
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x17
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x1c
jmp 0x140042d32
invalid
invalid
invalid
mov al, 0x1d
jmp 0x140042d32
mov al, 0x26
jmp 0x140042d32
mov al, 0x1a
jmp 0x140042d32
mov rsi, qword [rbp + 0x70]
call fcn.140075060
add al, byte [rbx]
invalid
add al, byte [rbx]
add byte [rdi], cl
or ecx, dword [rcx - 0x77]
mov byte [rcx - 0x49], 1
test r12, r12
je 0x140044def
ud2
mov rdx, r12
add rdx, r12
add edx, esp
add edx, esp
mov r8d, 2
mov rcx, rsi
jmp 0x140044dea
test dil, 1
jne 0x140044e17
mov r15b, 1
jmp 0x140044def
mov bh, 1
test r12, r12
je 0x140044def
add r12, r12
mov r8d, 2
mov rcx, rsi
mov rdx, r12
mov edx, esp
mov edx, esp
call fcn.140003f90
int1
sti
dec dword [rax - 0x75]
mov esi, dword [rbp + 0x70]
mov rsi, qword [rbp + 0x70]
mov esi, dword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
mov edx, dword [rbp + 0x68]
test rdx, rdx
test edx, edx
je 0x140044e0a
mov r8d, 1
add byte [rax], al
mov rcx, rsi
int1
call fcn.140003f90
sti
inc dword [rbp - 0x7c]
test r15b, r15b
jne 0x140044e17
push qword [rbp + 8]
mov rcx, rbx
mov ecx, ebx
call sub.KERNEL32.dll_CloseHandle
xor eax, 0x894c0005
int1
mov rcx, r14
mov ecx, esi
call fcn.140098850
int3
cmp al, byte [0x1965a1a22]
push rbp
push rsi
push rdi
sub rsp, 0x60
sub esp, 0x60
sub esp, 0x60
lea rbp, [rsp + 0x60]
lea ebp, [rsp + 0x60]
mov eax, 0xffffffff
cmp r8, rax
dec dword [rcx + 0x39]
ror byte [rdi + rcx + 0x43], 0xc0
cmovae r8, rax
cmovae r8, rax
mov dword [rbp - 0xc], 0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
ror byte [r8 - 0x39], 1
loopne 0x140044e4b
add byte [rax], al
invalid
add byte [rax], al
add byte [rdi], cl
push rdi
ror byte [rdi], 0x29
ror byte [r8 - 0x39], 1
loopne 0x140044e4b
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax - 0x73], cl
invalid
lea rax, [rbp - 0xc]
lea eax, [rbp - 0xc]
hlt
mov qword [rbp - 0x18], rax
lea rax, [0x140045510]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
invalid
invalid
lea ecx, [rbp - 0x30]
shr r8b, 1
jmp 0xc504539e
invalid
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x140044eca
nop
mov ecx, 0xffffffff
mov edx, 1
invalid
invalid
invalid
add dword [rax], eax
add byte [rax], al
invalid
add al, ch
push rbp
xor al, byte [0x13481d182]
jge 0x140044e76
call sub.KERNEL32.dll_SleepEx
cmp dword [rbp - 0xc], 0
jge 0x140044e76
invalid
je 0x140044e70
jge 0x140044e76
add byte [rbx + rbp*8 - 0x75], dh
clc
clc
mov eax, dword [rbp - 8]
clc
mov edx, dword [rbp - 4]
mov rcx, rax
ror dword [rax - 0x3f], 0xe1
and byte [rax - 0x7d], cl
leave
shl rcx, 0x20
or rcx, 2
add al, byte [rbp + 0x31]
rol byte [rbp - 0x6af0be40], 0xc0
setne al
add al, byte [rbp + 0x31]
rol byte [rbp - 0x6af0be40], 0xc0
setne al
setne al
cmovne rdx, rcx
cmovne edx, ecx
mov qword [rbp - 0x30], r8
mov dword [rbp - 0x30], eax
mov qword [rbp - 0x28], rdx
mov dword [rbp - 0x28], edx
fmul dword [rdi]
je 0x140044f53
test byte [rdx + 0x48000000], ah
lea esi, [rbp - 0x28]
invalid
add byte [rax - 0x73], cl
jne 0x140044e8d
invalid
lea rsi, [rbp - 0x28]
fmul dword [rcx + 0x3e083d0]
mov eax, edx
and eax, 3
loopne 0x140044ebd
loopne 0x140044ebd
lea rcx, [0x14009d2a0]
or eax, 0x583df
fild word [rbx + 0x63480005]
add byte [rax + 0x63], cl
movsxd rax, dword [rcx + rax*4]
add al, 0x81
or dword [rax + 1], 0xe8e0ffc8
insd dword [rdi], dx
add rax, rcx
jmp rax
call sub.KERNEL32.dll_GetLastError
mov edx, eax
ret 0xc148
loop 0x140044ef5
invalid
xor eax, dword [0x188c6d7d2]
shl edx, 0x20
invalid
ret 0xc148
and byte [rax - 0x7d], cl
retf 0x4802
invalid
invalid
or rdx, 2
mov qword [rbp - 0x30], 1
rol byte [rcx], 1
add byte [rax], al
add byte [rax - 0x73], cl
jne 0x140044ebd
invalid
add cl, byte [rax - 0x39]
rol byte [r9], 1
rol byte [rcx], 1
rol byte [rcx], 1
add byte [rax], al
add byte [rax - 0x73], cl
jne 0x140044ebd
invalid
fmul dword [rax - 0x77]
push rbp
mov qword [rbp - 0x28], rdx
mov eax, edx
and eax, 3
loopne 0x140044ef1
fmul dword [rcx + 0x3e083d0]
loopne 0x140044ef1
lea rcx, [0x14009d2a0]
or eax, 0x583ab
stosd dword [rdi], eax
add dword [0x1446796f9], 0xffffff81
invalid
movsxd rax, dword [rcx + rax*4]
or dword [rax + 1], 0xfe0ffc8
mov dh, 0x42
adc bl, ch
add rax, rcx
jmp rax
movzx eax, byte [rdx + 0x10]
jmp 0x140044f40
invalid
cmp al, 0x48
mov ecx, edx
mov rcx, rdx
shr rcx, 0x20
mov rdi, rdx
and byte [rax - 0x77], cl
xlatb
call fcn.14004bfd0
add byte [rax], al
mov rdx, rdi
jmp 0x140044f40
mov rax, rdx
shr rax, 0x20
shr eax, 0x20
shr eax, 0x20
cmp eax, 0x28
ja case.default.0x140044f36
add byte [rax], al
add byte [rax], al
lea rcx, [0x14009d2b0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
add eax, ecx
add eax, 0x4634800
or dword [rax + 1], 0x31e0ffc8
add eax, ecx
jmp rax
xor eax, eax
jmp 0x140044f40
add eax, ecx
jmp rax
xor eax, eax
jmp 0x140044f40
add al, 0xf
mov dh, 0x42
ud1
add dword [rax], eax
add byte [rax], al
invalid
movzx eax, byte [rdx + 0xf]
mov ecx, 1
add byte [rax], al
add byte [rbx + rcx], bh
cmp al, 0xb
jne 0x140044f55
mov rcx, rsi
call fcn.140007070
push qword [rcx]
invalid
push qword [rcx]
sal byte [rcx], cl
xor ecx, ecx
leave
mov rax, rcx
enter 0xffffffffffff8348, 0xffffffffffffffc4
invalid
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov al, 0x25
jmp 0x140044f40
mov al, 0x23
jmp 0x140044f40
and ebp, ebx
fdiv dword [rax - 0x4f2b14dc]
mov al, 0x24
jmp 0x140044f40
mov al, 0x1b
jmp 0x140044f40
mov al, 0x22
jmp 0x140044f40
mov al, 0x10
jmp 0x140044f40
mov al, 0xe
jmp 0x140044f40
mov al, 0x24
jmp 0x140044f40
mov al, 0x1b
jmp 0x140044f40
mov al, 0x22
jmp 0x140044f40
mov al, 0x10
jmp 0x140044f40
mov al, 0xe
jmp 0x140044f40
mov al, 0x21
jmp 0x140044f40
invalid
sal byte [rax - 0x4f4314f5], 4
mov al, 0xb
jmp 0x140044f40
invalid
mov esp, 0xb8eb04b0
mov al, 4
jmp 0x140044f40
mov eax, 0xb4eb28b0
mov al, 0x28
jmp 0x140044f40
invalid
mov ah, 0xb0
or al, 0xeb
mov al, 0xc
jmp 0x140044f40
invalid
mov al, 0xb0
or ebx, ebp
mov al, 9
jmp 0x140044f40
lodsb al, byte [rsi]
lodsb al, byte [rsi]
mov al, 0x19
jmp 0x140044f40
invalid
test al, 0xb0
sbb bl, ch
mov al, 0x18
jmp 0x140044f40
movsb byte [rdi], byte [rsi]
movsb byte [rdi], byte [rsi]
mov al, 2
jmp 0x140044f40
invalid
movabs al, byte [0x98eb03b09ceb0fb0]
mov al, 0xf
jmp 0x140044f40
pushfq
pushfq
mov al, 3
jmp 0x140044f40
cwde
cwde
mov al, 7
jmp 0x140044f40
xchg esp, eax
xchg esp, eax
mov al, 1
jmp 0x140044f40
nop
nop
mov al, 0x1f
jmp 0x140044f40
invalid
invalid
mov al, 0x11
jmp 0x140044f40
invalid
mov byte [rax - 0x4f7b14d7], dh
adc al, 0xeb
invalid
mov al, 0x29
jmp 0x140044f40
invalid
test byte [rax - 0x4f7f14ec], dh
add eax, 0xffff79e9
jns 0x140044fc4
invalid
mov al, 0x14
jmp 0x140044f40
xor byte [rax - 0x8616fb], 0xff
mov al, 5
jmp 0x140044f40
jns 0x140044fc4
invalid
invalid
jns 0x140044fc4
invalid
invalid
push qword [rax - 0x8d16eb]
mov al, 0x15
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 0xd
or eax, 0xffff6be9
push qword [rax - 0x9b16fa]
mov al, 6
invalid
invalid
invalid
jmp 0x140044f40
invalid
mov al, 6
jmp 0x140044f40
invalid
invalid
invalid
push qword [rax - 0xa216ee]
mov al, 0x12
jmp 0x140044f40
pop rbp
invalid
invalid
invalid
pop rbp
invalid
invalid
mov al, 0xa
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 8
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 0x1e
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 0x20
jmp 0x140044f40
invalid
invalid
invalid
and cl, ch
invalid
invalid
invalid
mov al, 0x16
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 0x27
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 0x13
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 0x17
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 0x1c
jmp 0x140044f40
invalid
invalid
invalid
invalid
invalid
mov al, 0x1d
jmp 0x140044f40
invalid
invalid
invalid
invalid
push qword [rax - 0xef16da]
invalid
mov al, 0x26
jmp 0x140044f40
invalid
invalid
invalid
invalid
mov al, 0x1a
jmp 0x140044f40
or edi, edi
invalid
invalid
or edi, edi
invalid
invalid
nop word [rax + rax]
push rbp
push rsi
add byte [rax], al
add byte [rax], al
add byte [rbp + 0x56], dl
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
insb byte [rdi], dx
and al, 0x60
invalid
invalid
mov rsi, rdx
mov r8, qword [rdx + 8]
or byte [rax - 0x75], cl
jp case.0x140044efc.119
mov rdi, qword [rdx + 0x10]
sub r8, rdi
mov eax, 0xffffffff
invalid
invalid
invalid
invalid
cmp r8, rax
cmovae r8, rax
cmovae eax, eax
cmovae eax, eax
mov rdx, qword [rdx]
mov edx, dword [rdx]
add rdx, rdi
cli
mov dword [rbp - 0xc], 0
add byte [rax], al
add byte [rax], al
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
sub dword [rbp - 0x30], eax
sub dword [rbp - 0x30], eax
mov qword [rbp - 0x20], 0
mov dword [rbp - 0x20], 0
add byte [rax], al
add byte [rax - 0x73], cl
invalid
lea rax, [rbp - 0xc]
lea eax, [rbp - 0xc]
hlt
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x18], eax
lea rax, [0x140045510]
add byte [rax], al
mov qword [rsp + 0x20], rax
and al, 0x20
and al, 0x20
lea r9, [rbp - 0x30]
lea ecx, [rbp - 0x30]
call sub.KERNEL32.dll_ReadFileEx
test eax, eax
je 0x140045106
invalid
mov ch, 0x30
add eax, 0x74c08500
invalid
nop word cs:[rax + rax]
invalid
add byte [rax], al
add byte [rcx - 1], bh
mov ecx, 0xffffffff
mov ecx, 0xffffffff
invalid
mov edx, 1
add dword [rax], eax
add byte [rax], al
add al, ch
adc eax, 0x83000530
invalid
invalid
jge 0x1400450b6
add byte [rax], al
call sub.KERNEL32.dll_SleepEx
cmp dword [rbp - 0xc], 0
je case.0x140044efc.104
add byte [rbx + 0x7400f47d], al
jmp 0x140045051
invalid
add byte [rbx + rbp*8 - 0x75], dh
push rbp
clc
mov edx, dword [rbp - 8]
mov ecx, dword [rbp - 4]
cld
mov rax, rdx
mov eax, edx
shl rax, 0x20
or rax, 2
or eax, 2
or eax, 2
xor r8d, r8d
test edx, edx
rol byte [rcx + 0xf], cl
xchg ebp, eax
invalid
rol byte [rbp - 0x6af0be2e], 0xc0
rol byte [rcx + 0xf], cl
xchg ebp, eax
ror byte [rax + 0xf], 0x44
ror dword [rcx + rcx*4 + 0x45], 0xd0
setne al
cmove rax, rcx
mov qword [rbp - 0x30], r8
ror dword [rcx + rcx*4 + 0x45], 0xd0
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x28], eax
je 0x14004513e
push rcx
lea rsi, [rbp - 0x28]
jne 0x1400450c9
mov ecx, eax
and ecx, 3
lea rdx, [0x14009d354]
lea edx, [0x14009d354]
add eax, 0xc634800
mov cl, byte [rax + 1]
movsxd rcx, dword [rdx + rcx*4]
or al, 0x8a
add rcx, rdx
jmp rcx
sar edi, 1
loope case.0x140044efc.123
call sub.KERNEL32.dll_GetLastError
xor dword [rcx], esi
add eax, 0xe0c14800
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x30], 1
lea rsi, [rbp - 0x28]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x30], 1
add dword [rax], eax
add byte [rax], al
lea rsi, [rbp - 0x28]
mov qword [rbp - 0x28], rax
mov ecx, eax
and ecx, 3
add ecx, dword [rax - 0x73]
adc eax, 0x58225
invalid
invalid
invalid
invalid
add ecx, dword [rax - 0x73]
adc eax, 0x58225
invalid
invalid
invalid
invalid
and eax, 0x48000582
movsxd rcx, dword [rdx + rcx*4]
invalid
add rcx, rdx
jmp rcx
invalid
loope 0x140045148
movzx ecx, byte [rax + 0x10]
jmp 0x140045194
mov dh, 0x48
adc bl, ch
push rsi
add rdi, rcx
add edi, ecx
mov qword [rsi + 0x10], rdi
jle 0x140045155
mov rax, qword [rsi + 0x18]
cmp rax, rdi
clc
sbb byte [rax + 0x39], r9b
sbb byte [rax + 0x39], cl
clc
cmova rdi, rax
clc
mov qword [rsi + 0x18], rdi
jmp 0x1400451a1
sbb bl, ch
mov rcx, rax
mov rcx, rax
mov ecx, eax
shr rcx, 0x20
jmp 0x1078d9980
mov rdi, rax
call fcn.14004bfd0
invalid
invalid
imul ebp, dword [rsi], 0
add byte [rcx - 0x776b73f], cl
mov ecx, eax
mov rax, rdi
ror dword [rax - 0x77], 0xf8
jmp 0x140045194
sub byte [rax - 0x77], cl
mov rcx, rax
mov ecx, eax
ror dword [rax - 0x3f], 0xe9
shr rcx, 0x20
cmp ecx, 0x28
stc
sub byte [rdi], cl
invalid
xchg dword [rax], eax
add byte [rax], al
invalid
jmp 0x168fdd496
and byte [rbx - 0x78f0d707], al
xchg dword [rax], eax
add byte [rax], al
invalid
stc
sub byte [rdi], cl
xchg dword [rdi + 0x48000000], eax
add byte [rax - 0x73], cl
adc eax, 0x581e1
invalid
invalid
invalid
add byte [rax], al
add byte [rax - 0x73], cl
adc eax, 0x581e1
invalid
invalid
invalid
lea rdx, [0x14009d364]
add dword [0x14c67998a], 0xd101488a
add byte [rax + 0x63], cl
or al, 0x8a
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
sar edi, 1
loope 0x1400451be
jmp rcx
xor ecx, ecx
leave
jmp 0x140045194
movzx ecx, byte [rax + 0xf]
cmp cl, 0xb
stc
or esi, dword [rbp + 0xa]
jne case.0x140045136.40
jne case.0x140045136.40
mov rcx, rsi
int1
call fcn.140007070
invalid
cld
push qword [rcx]
ror byte [rax - 0x7d], 0xc4
add rsp, 0x60
xor eax, eax
add rsp, 0x60
invalid
pop rdi
pop rsi
pop rbp
ret
mov cl, 0x25
jmp 0x140045194
and eax, 0x23b1e5eb
mov cl, 0x23
jmp 0x140045194
mov cl, 0x24
jmp 0x140045194
mov cl, 0x1b
jmp 0x140045194
invalid
fnstenv [rcx - 0x4e2a14de]
adc bl, ch
jmp 0x140045194
mov cl, 0xe
jmp 0x140045194
mov cl, 0x21
jmp 0x140045194
mov cl, 0x22
jmp 0x140045194
invalid
mov cl, 0x10
jmp 0x140045194
mov cl, 0xe
jmp 0x140045194
mov cl, 0x21
jmp 0x140045194
mov cl, 0xb
jmp 0x140045194
mov cl, 4
jmp 0x140045194
mov cl, 0x28
jmp 0x140045194
mov cl, 0xc
jmp 0x140045194
mov cl, 9
jmp 0x140045194
mov cl, 0x19
jmp 0x140045194
mov cl, 0x18
jmp 0x140045194
sbb bl, ch
lodsd eax, dword [rsi]
mov cl, 2
jmp 0x140045194
mov cl, 0xf
jmp 0x140045194
mov cl, 3
jmp 0x140045194
mov cl, 7
jmp 0x140045194
mov cl, 1
jmp 0x140045194
mov cl, 0x1f
jmp 0x140045194
mov cl, 0x11
jmp 0x140045194
mov cl, 0x29
jmp 0x140045194
mov cl, 0x14
jmp 0x140045194
invalid
mov dword [rcx - 0x4e7a14fb], esi
adc eax, 0xdb181eb
jmp 0x140045194
mov cl, 0xd
mov cl, 5
jmp 0x140045194
mov cl, 0x15
jmp 0x140045194
mov cl, 0xd
jmp 0x140045194
invalid
mov cl, 6
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x12
jmp 0x140045194
invalid
invalid
adc ch, cl
insb byte [rdi], dx
invalid
invalid
mov cl, 0xa
jmp 0x140045194
invalid
invalid
invalid
mov cl, 8
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x1e
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x20
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x16
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x27
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x13
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x17
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x1c
jmp 0x140045194
invalid
invalid
invalid
mov cl, 0x1d
jmp 0x140045194
mov cl, 0x26
jmp 0x140045194
mov cl, 0x1a
jmp 0x140045194
mov rdi, rcx
mov r15, qword [rdx]
mov rbx, qword [rdx + 0x10]
mov rax, r15
sub rax, rbx
mov r14, r15
mov r13, rbx
cmp rax, 0x20
jae 0x1400452ea
mov rcx, rdi
mov rdx, rsi
call fcn.14002eea0
test rax, rax
je 0x1400452da
mov eax, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test rdx, rdx
je 0x1400454c3
mov r14, qword [rsi]
mov r13, qword [rsi + 0x10]
outsb dx, byte [rsi]
adc byte [rax - 0x77], cl
pop rbp
add byte [rcx - 0x44], al
add byte [rax], ah
add byte [rax], al
mov qword [rbp], rbx
mov r12d, 0x2000
xor r8d, r8d
lea rbx, [0x14009d408]
lea ebx, [0x14009d408]
lea ebx, [0x14009d408]
mov qword [rbp - 0x30], r15
cmp r14, r15
jne 0x14004533b
cmp r13, r14
jne 0x14004533b
mov rdx, rsi
mov rsi, r8
mov rcx, rdi
mov r14, rdx
call fcn.14002eea0
test rax, rax
jne 0x1400452c4
test rdx, rdx
je 0x1400454ee
mov rax, r14
mov r14, qword [r14]
mov r13, qword [rax + 0x10]
mov r8, rsi
mov rsi, rax
cmp r13, r14
jne 0x140045380
mov r15, r14
add r15, 0x20
jb 0x1400454da
invalid
add byte [rbx - 0x73], cl
add al, 0x36
lea rax, [r14 + r14]
cmp rax, r15
cmova r15, rax
test r14, r14
mov qword [rbp - 0x28], r8
mov dword [rbp - 0x28], eax
je 0x140045390
mov rax, qword [rsi + 8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], r14
mov eax, 1
jmp 0x140045392
mov rax, qword [rsi + 8]
jmp 0x1400453cd
test byte [rax], al
add byte [rax], al
add byte [rax], al
xor eax, eax
mov rdx, r15
not rdx
shr rdx, 0x3f
invalid
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x48]
mov r8, r15
lea r9, [rbp - 0x20]
call fcn.140010930
cmp qword [rbp - 0x48], 0
jne 0x1400454fd
xor byte [rbp - 0x7cb70004], 0x7d
mov eax, 0x42850f00
add dword [rax], eax
add byte [rax - 0x75], cl
ror byte [r8 - 0x77], 0x46
or byte [rcx + rcx*4 + 0x3e], cl
mov rax, qword [rbp - 0x40]
mov qword [rsi + 8], rax
mov qword [rsi], r15
mov r14, r15
mov r8, qword [rbp - 0x28]
add rax, r13
mov r15, r14
sub r15, r13
cmp r15, r12
cmovae r15, r12
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], r8
jmp 0x140045417
mov rcx, rdi
lea rdx, [rbp - 0x20]
call fcn.140041d90
mov rdx, rax
test rax, rax
je 0x140045470
mov ecx, edx
and ecx, 3
mov eax, 1
movsxd rcx, dword [rbx + rcx*4]
add rcx, rbx
jmp rcx
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x1400454cc
mov rcx, qword [rbp - 8]
mov r8, rcx
sub r8, rax
add r13, rax
cmp rcx, r15
mov rdx, 0xffffffffffffffff
cmovne r12, rdx
lea rcx, [r12 + r12]
test r12, r12
cmovs rcx, rdx
cmp r15, r12
cmovb rcx, r12
mov qword [rsi + 0x10], r13
cmp rax, r15
cmove r12, rcx
mov r15, qword [rbp - 0x30]
cmp r14, r15
je 0x140045307
jmp 0x14004533b
xor edx, edx
xor eax, eax
jmp 0x1400452c9
sub r13, qword [rbp]
xor eax, eax
mov rdx, r13
jmp 0x1400452c9
mov eax, 1
movabs rdx, 0x2600000003
jmp 0x1400452c9
mov rdx, qword [r14 + 0x10]
sub rdx, qword [rbp]
xor eax, eax
jmp 0x1400452c9
movabs rdx, 0x2600000003
jmp 0x1400452c4
lea rcx, [rbp + 0x540]
call fcn.1400443a0
mov rsi, qword [rbp + 0x540]
movabs rax, 0x8000000000000000
cmp rsi, rax
mov qword [rbp + 0x5e0], r14
jne 0x140047600
lea rcx, [rbp + 0x548]
call fcn.140007070
jmp 0x1400476bf
mov rdi, qword [rbp + 0x548]
mov rbx, qword [rbp + 0x550]
mov r14, qword [rbp + 0x558]
mov rcx, rdi
mov rdx, rbx
call case.0x140034406.21
cmp rbx, rdx
cmovb rdx, rbx
test rax, rax
cmove rdx, rbx
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r14
lea rcx, [rbp - 0x30]
mov rdx, r13
mov r8, qword [rbp + 0x5d0]
call fcn.140033a20
cmp byte [rbp + 0x5d8], 0
jne 0x140047670
lea rdx, str.exe.NULexit_code:
lea rcx, [rbp - 0x30]
mov r8d, 3
call fcn.1400346f0
mov rsi, qword [rbp - 0x28]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp + 0x440]
mov rdx, rsi
call fcn.140049a20
mov rdx, qword [rbp - 0x30]
test rdx, rdx
mov r14, qword [rbp + 0x5e0]
je 0x1400476a5
mov r8d, 1
mov rcx, rsi
call fcn.140003f90
mov r12, qword [rbp + 0x440]
movabs rax, 0x8000000000000000
cmp r12, rax
jne 0x140047a04
mov qword [rbp + 0x5c0], r13
mov qword [rbp + 0x4f0], 0
mov qword [rbp + 0x4f8], 2
mov qword [rbp + 0x500], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x5c8], rax
xor r14d, r14d
xor r13d, r13d
xor edi, edi
cmp r8, 0x201
jb 0x14004771f
jmp 0x140047730
jae 0x1400477ea
cmp r8, 0x201
jae 0x140047730
mov ebx, 0x200
lea r15, [rbp - 0x30]
mov r12, r8
jmp 0x140047787
sub r8, rdi
sub r13, rdi
cmp r13, r8
jae 0x14004775f
lea rcx, [rbp + 0x4f0]
mov rdx, rdi
call fcn.140010b30
mov r14, qword [rbp + 0x4f0]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x5c8], rax
mov eax, 0xffffffff
cmp r14, rax
mov edi, 0xffffffff
cmovb rdi, r14
mov qword [rbp + 0x500], rdi
mov r13, r14
mov rbx, rdi
mov r15, qword [rbp + 0x5c8]
mov r12, rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov edx, r12d
call sub.KERNEL32.dll_GetSystemDirectoryW
mov esi, eax
test eax, eax
jne 0x1400477ac
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140047ed5
mov r8d, esi
cmp r12, r8
jne 0x140047710
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140049254
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jae 0x140047730
jmp 0x14004771f
cmp rbx, r8
jb 0x140049324
lea rcx, [rbp + 0x540]
mov rdx, r15
mov r14, qword [rbp + 0x5e0]
call fcn.140031a90
mov r13, qword [rbp + 0x5c0]
mov r8, qword [rbp + 0x5d0]
lea rcx, [rbp + 0x540]
mov rdx, r13
call fcn.140033a20
cmp byte [rbp + 0x5d8], 0
jne 0x140047848
lea rdx, str.exe.NULexit_code:
lea rcx, [rbp + 0x540]
mov r8d, 3
call fcn.1400346f0
mov rsi, qword [rbp + 0x548]
mov r8, qword [rbp + 0x550]
lea rcx, [rbp + 0x440]
mov rdx, rsi
call fcn.140049a20
mov rdx, qword [rbp + 0x540]
test rdx, rdx
je 0x14004787f
mov r8d, 1
mov rcx, rsi
call fcn.140003f90
movups xmm0, xmmword [rbp + 0x440]
movaps xmmword [rbp + 0x4b0], xmm0
mov rax, qword [rbp + 0x450]
mov qword [rbp + 0x4c0], rax
mov rdx, qword [rbp + 0x4f0]
test rdx, rdx
je 0x1400478bc
mov rcx, qword [rbp + 0x4f8]
add rdx, rdx
mov r8d, 2
call fcn.140003f90
mov r12, qword [rbp + 0x4b0]
movabs rcx, 0x8000000000000000
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x2418d48], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x2418d48], al
cmp r12, rax
jge 0x140048179
cmp r12, rcx
je 0x140047f31
movabs rax, 0x8000000000000001
cmp r12, rax
je 0x140047f25
mov rcx, qword [rbp + 0x4b8]
mov r8d, 2
call fcn.140003f90
jmp 0x140047f31
cmp rdx, r12
je 0x1400475c6
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x1400479e0
mov r8, qword [rbp - 0x18]
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r8
mov rcx, rsi
mov rdx, r13
mov r8, qword [rbp + 0x5d0]
call fcn.140033a20
cmp byte [rbp + 0x5d8], 0
jne 0x140047982
mov r8d, 3
mov rcx, rsi
int1
int1
mov rdx, r15
call fcn.1400346f0
mov r12, qword [rbp - 0x28]
mov r8, qword [rbp - 0x20]
mov rcx, rbx
mov rdx, r12
call fcn.140049a20
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x1400479ac
mov r8d, 1
mov rcx, r12
call fcn.140003f90
mov r12, qword [rbp + 0x440]
movabs rax, 0x8000000000000000
cmp r12, rax
jne 0x140047a04
mov rcx, rsi
mov rdx, rdi
call fcn.140044140
mov rdx, qword [rbp - 0x30]
movabs r12, 0x8000000000000000
jmp 0x140047928
test rdx, rdx
je 0x1400479f0
mov r8d, 1
call fcn.140003f90
mov rcx, rsi
mov rdx, rdi
call fcn.140044140
mov rdx, qword [rbp - 0x30]
jmp 0x140047928
mov r15, qword [rbp + 0x448]
mov rdi, qword [rbp + 0x450]
jmp 0x140047b7a
mov rax, rcx
test rax, rax
cmovne r8, rax
test r8, r8
je 0x140047a50
test rax, rax
test eax, eax
cmove rdx, r9
add r8, rdx
sub r8, rbx
cmp rdi, r8
cmovae rdi, r8
lea rcx, [rbp - 0x30]
mov rdx, rbx
mov r8, rdi
call fcn.14004c190
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
cmp rcx, r15
jne 0x140047a7c
mov qword [rbp + 0x4d8], rax
mov qword [rbp + 0x4d0], r15
jmp 0x140047a9c
mov rdx, qword [rbp - 0x20]
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rdx
lea rcx, [rbp + 0x4d0]
lea rdx, [rbp - 0x30]
call fcn.14003e680
test rsi, rsi
je 0x140047ab2
mov r8d, 1
mov rcx, rbx
mov rdx, rsi
call fcn.140003f90
mov r12, qword [rbp + 0x4d0]
mov r15, qword [rbp + 0x4d8]
movabs rax, 0x8000000000000000
cmp r12, rax
jne 0x140047b73
mov rax, qword [rbp + 0x5b0]
mov qword [rax], r15
mov qword [rax + 0x10], 2
add al, byte [rax]
add byte [rax], al
add al, byte [rax]
add byte [rax], al
cmp qword [rbp + 0x3d8], 0
je 0x140047b49
mov rcx, qword [rbp + 0x3e0]
test rcx, rcx
je 0x140047b30
invalid
mov rdx, qword [rbp + 0x3e8]
mov rax, qword [rbp + 0x3f0]
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rdx
mov qword [rbp - 8], 0
mov qword [rbp], rcx
mov qword [rbp + 8], rdx
mov ecx, 1
jmp 0x140047b34
xor ecx, ecx
xor eax, eax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x30]
call fcn.1400060d0
cmp dword [r14], 4
jb 0x140047b58
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_CloseHandle
movaps xmm6, xmmword [rbp + 0x5f0]
add rsp, 0x688
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rdi, qword [rbp + 0x4e0]
cmp rdi, 5
mov qword [rbp + 0x5e0], r14
jb case.0x140048612.68
lea rax, [r15 + rdi*2]
mov rcx, rax
add rcx, 0xfffffffffffffff6
je case.0x140048612.68
cmp word [rcx], 0x2e
jne case.0x140048612.68
cmp word [rax - 2], 0
je 0x1400485f4
mov rax, qword [rbp + 0x5e8]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
movzx ebx, byte [rax + 0xc5]
mov qword [rbp + 0x540], 0
mov qword [rbp + 0x548], 2
mov qword [rbp + 0x550], 0
lea rcx, [rbp + 0x540]
call fcn.140010d20
mov rax, qword [rbp + 0x548]
mov word [rax], 0x22
mov qword [rbp + 0x550], 1
mov qword [rbp - 0x30], r13
mov rax, qword [rbp + 0x5b8]
mov qword [rbp - 0x28], rax
mov word [rbp - 0x20], 0
lea rcx, [rbp + 0x540]
lea rdx, [rbp - 0x30]
call fcn.14001a4a0
mov r14, qword [rbp + 0x550]
cmp r14, qword [rbp + 0x540]
jne 0x140047c40
lea rcx, [rbp + 0x540]
call fcn.140010d20
mov rax, qword [rbp + 0x548]
mov word [rax + r14*2], 0x22
inc r14
mov qword [rbp + 0x550], r14
shl rdi, 3
lea r14, [rdi + rdi*4]
lea rdi, [rbp + 0x540]
nop word [rax + rax]
test r14, r14
je 0x140047ce9
mov r13, qword [rbp + 0x550]
cmp r13, qword [rbp + 0x540]
jne 0x140047c8d
mov rcx, rdi
call fcn.140010d20
mov rax, qword [rbp + 0x548]
mov word [rax + r13*2], 0x20
inc r13
mov qword [rbp + 0x550], r13
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
call fcn.14003d7b0
add rsi, 0x28
add r14, 0xffffffffffffffd8
test rax, rax
je 0x140047c70
mov rdx, qword [rbp + 0x540]
test rdx, rdx
je 0x140047d06
mov rcx, qword [rbp + 0x548]
add rdx, rdx
mov r8d, 2
mov rsi, rax
call fcn.140003f90
mov rax, rsi
jmp 0x140047d06
mov rcx, qword [rbp + 0x540]
mov rax, qword [rbp + 0x548]
movabs rdx, 0x8000000000000000
cmp rcx, rdx
jne 0x140047d48
mov r14, qword [rbp + 0x5e0]
mov rcx, qword [rbp + 0x5b0]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
xor esi, esi
test r12, r12
je 0x140047d3a
add r12, r12
mov r8d, 2
mov rcx, r15
mov rdx, r12
call fcn.140003f90
test sil, sil
je 0x140047ae5
jmp 0x140047b49
mov rsi, qword [rbp + 0x550]
mov dl, 1
mov dword [rbp + 0x4a4], edx
mov dword [rbp + 0x5c8], 0
mov qword [rbp + 0x5d8], r12
mov qword [rbp + 0x5b8], r15
mov qword [rbp + 0x4d0], rcx
mov qword [rbp + 0x4d8], rax
mov qword [rbp + 0x4e0], rsi
cmp rsi, rcx
jne 0x140047d9c
lea rcx, [rbp + 0x4d0]
call fcn.140010d20
mov rax, qword [rbp + 0x4d8]
mov word [rax + rsi*2], 0
inc rsi
mov qword [rbp + 0x4e0], rsi
mov rcx, qword [rbp + 0x5e8]
cmp byte [rcx + 0xc4], 0
mov eax, 0x400
mov edi, 0x608
cmove edi, eax
or edi, dword [rcx + 0xc0]
cmp qword [rbp + 0x3d8], 0
je 0x140047e30
mov dword [rbp + 0x438], edi
mov r14, qword [rbp + 0x3f0]
mov qword [rbp + 0x4c0], r14
movups xmm0, xmmword [rbp + 0x3e0]
movaps xmmword [rbp + 0x4b0], xmm0
mov qword [rbp + 0x4f0], 0
mov qword [rbp + 0x4f8], 2
mov qword [rbp + 0x500], 0
test r14, r14
je 0x14004818c
mov r13d, 2
xor edi, edi
jmp 0x1400481b8
mov eax, 2
mov qword [rbp + 0x5d0], rax
xor r13d, r13d
xor r14d, r14d
mov rcx, qword [rbp + 0x5e8]
movabs rax, 0x8000000000000000
cmp qword [rcx + 0x38], rax
jne 0x140048ae2
mov qword [rbp + 0x3f8], r13
mov eax, 2
mov qword [rbp + 0x538], rax
xor r13d, r13d
xor eax, eax
mov qword [rbp + 0x5c0], rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x4b0], xmm0
mov qword [rbp + 0x4c0], 0
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x1400d4150], cl
jne 0x140048ca2
mov rax, qword [0x1400d4120]
movabs rcx, 0x8000000000000000
dec rcx
mov qword [rbp + 0x430], rcx
test rax, rcx
je 0x1400488c9
call fcn.14003be90
mov esi, edi
xor al, 1
jmp 0x1400488cd
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x4b8], rax
movabs rax, 0x8000000000000000
inc rax
mov qword [rbp + 0x4b0], rax
mov rdx, qword [rbp + 0x4f0]
test rdx, rdx
je 0x140047f1e
mov rcx, qword [rbp + 0x4f8]
add rdx, rdx
mov r8d, 2
call fcn.140003f90
mov r14, qword [rbp + 0x5e0]
lea rcx, [rbp + 0x4b8]
call fcn.140007070
mov qword [rbp + 0x4f0], 0
mov qword [rbp + 0x4f8], 2
mov qword [rbp + 0x500], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x5c8], rax
xor r13d, r13d
xor r14d, r14d
xor edi, edi
cmp r8, 0x201
jb 0x140047f8f
jmp 0x140047fa0
jae 0x14004805a
cmp r8, 0x201
jae 0x140047fa0
mov ebx, 0x200
lea r15, [rbp - 0x30]
mov r12, r8
jmp 0x140047ff7
sub r8, rdi
sub r14, rdi
cmp r14, r8
jae 0x140047fcf
lea rcx, [rbp + 0x4f0]
mov rdx, rdi
call fcn.140010b30
mov r13, qword [rbp + 0x4f0]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x5c8], rax
mov eax, 0xffffffff
cmp r13, rax
mov edi, 0xffffffff
cmovb rdi, r13
mov qword [rbp + 0x500], rdi
mov r14, r13
mov rbx, rdi
mov r15, qword [rbp + 0x5c8]
mov r12, rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov edx, r12d
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov esi, eax
test eax, eax
jne 0x14004801c
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140048698
mov r8d, esi
cmp r12, r8
jne 0x140047f80
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140049271
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jae 0x140047fa0
jmp 0x140047f8f
cmp rbx, r8
jb 0x14004933b
lea rcx, [rbp + 0x540]
mov rdx, r15
mov r14, qword [rbp + 0x5e0]
call fcn.140031a90
mov r13, qword [rbp + 0x5c0]
mov r8, qword [rbp + 0x5d0]
lea rcx, [rbp + 0x540]
mov rdx, r13
call fcn.140033a20
cmp byte [rbp + 0x5d8], 0
jne 0x1400480b8
lea rdx, str.exe.NULexit_code:
lea rcx, [rbp + 0x540]
mov r8d, 3
call fcn.1400346f0
mov rsi, qword [rbp + 0x548]
mov r8, qword [rbp + 0x550]
lea rcx, [rbp + 0x440]
mov rdx, rsi
call fcn.140049a20
mov rdx, qword [rbp + 0x540]
test rdx, rdx
je 0x1400480ef
mov r8d, 1
mov rcx, rsi
call fcn.140003f90
movups xmm0, xmmword [rbp + 0x440]
movaps xmmword [rbp + 0x4b0], xmm0
mov rax, qword [rbp + 0x450]
mov qword [rbp + 0x4c0], rax
mov rdx, qword [rbp + 0x4f0]
test rdx, rdx
je 0x14004812c
mov rcx, qword [rbp + 0x4f8]
add rdx, rdx
mov r8d, 2
call fcn.140003f90
mov r12, qword [rbp + 0x4b0]
movabs rcx, 0x8000000000000000
lea rax, [rcx + 2]
cmp r12, rax
jge 0x140048179
cmp r12, rcx
je 0x1400486fb
movabs rax, 0x8000000000000001
cmp r12, rax
je 0x1400486ef
mov rcx, qword [rbp + 0x4b8]
mov r8d, 2
call fcn.140003f90
jmp 0x1400486fb
mov r15, qword [rbp + 0x4b8]
mov rdi, qword [rbp + 0x4c0]
jmp 0x140047b7a
mov bl, 1
lea rcx, [rbp + 0x4f0]
call fcn.140010d20
mov r13, qword [rbp + 0x4f8]
mov word [r13], 0
mov qword [rbp + 0x500], 1
mov edi, 1
mov rax, qword [rbp + 0x4b0]
mov rcx, qword [rbp + 0x4b8]
xor edx, edx
test rax, rax
setne dl
cmove r14, rax
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], 0
mov qword [rbp], rax
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], r14
lea r14, [rbp + 0x540]
lea rdx, [rbp - 0x30]
mov rcx, r14
call fcn.14000ce30
mov rax, qword [rbp + 0x540]
test rax, rax
je 0x140048a68
mov r9, qword [rbp + 0x550]
imul r8, r9, 0x38
mov rdx, qword [rax + r8 + 0x168]
movabs rcx, 0x8000000000000000
cmp rdx, rcx
je 0x140048a68
mov qword [rbp + 0x3f8], r13
mov rcx, qword [rax + r8 + 0x170]
mov r14, qword [rax + r8 + 0x188]
mov r10, qword [rax + r8 + 0x190]
mov qword [rbp + 0x5c0], r10
mov r10, qword [rax + r8 + 0x198]
mov qword [rbp + 0x430], r10
shl r9, 5
mov r10, qword [rax + r9]
mov qword [rbp + 0x5d0], r10
mov r10, qword [rax + r9 + 8]
mov qword [rbp + 0x538], r10
mov r13, qword [rax + r9 + 0x10]
mov rax, qword [rax + r8 + 0x178]
add rax, rcx
xor r11d, r11d
mov r8, rcx
jmp 0x1400482bd
xor r11d, r11d
test r9w, r9w
je 0x14004859b
mov r9w, 1
test r11w, r11w
jne 0x1400482b0
cmp r8, rax
je 0x14004836c
movzx r11d, byte [r8]
test r11b, r11b
js 0x1400482e2
inc r8
mov r10d, r11d
jmp 0x140048361
mov r10d, r11d
and r10d, 0x1f
movzx ebx, byte [r8 + 1]
and ebx, 0x3f
cmp r11b, 0xdf
jbe 0x14004832a
movzx esi, byte [r8 + 2]
shl ebx, 6
and esi, 0x3f
or esi, ebx
cmp r11b, 0xf0
jb 0x140048337
movzx r11d, byte [r8 + 3]
add r8, 4
and r10d, 7
shl r10d, 0x12
shl esi, 6
and r11d, 0x3f
or r11d, esi
or r10d, r11d
jmp 0x140048342
add r8, 2
shl r10d, 6
or r10d, ebx
invalid
jmp 0x140048361
invalid
add r8, 3
shl r10d, 0xc
or r10d, esi
cmp r10d, 0xffff
jbe 0x140048361
and r10d, 0x3ff
or r10d, 0xdc00
fadd qword [rax]
add byte [rbp - 0x77], al
shr ecx, cl
push rdx
invalid
invalid
invalid
fadd qword [rax]
add byte [rbp - 0x77], al
shr ecx, cl
push rdx
invalid
xor r11d, r11d
mov r9d, r10d
jmp 0x1400482b3
test rdx, rdx
je 0x14004837c
mov r8d, 1
call fcn.140003f90
mov rax, qword [rbp + 0x4f0]
sub rax, rdi
mov r8, qword [rbp + 0x430]
cmp rax, r8
mov qword [rbp + 0x400], r13
jae 0x1400483bf
lea rcx, [rbp + 0x4f0]
mov rdx, rdi
call fcn.140010b30
mov rax, qword [rbp + 0x4f8]
mov rdi, qword [rbp + 0x500]
mov r8, qword [rbp + 0x430]
jmp 0x1400483c6
mov rax, qword [rbp + 0x3f8]
mov r13, r8
add r8, r8
mov rsi, rax
lea rcx, [rax + rdi*2]
mov rbx, qword [rbp + 0x5c0]
mov rdx, rbx
call sub.msvcrt.dll_memcpy
add rdi, r13
mov qword [rbp + 0x500], rdi
add byte [0xc55183ee], al
invalid
je 0x140048405
add byte [0xc55183ee], al
div byte [rsp + rdx + 0x4d]
add esi, esi
add r14, r14
mov r8d, 2
mov rcx, rbx
mov rdx, r14
call fcn.140003f90
cmp rdi, qword [rbp + 0x4f0]
add byte [rax], al
mov rbx, qword [rbp + 0x538]
lea r14, [rbp + 0x540]
mov r13, qword [rbp + 0x400]
jne 0x140048436
lea rcx, [rbp + 0x4f0]
call fcn.140010d20
mov rsi, qword [rbp + 0x4f8]
mov word [rsi + rdi*2], 0x3d
inc rdi
mov qword [rbp + 0x500], rdi
add r13, rbx
xor r8d, r8d
mov rax, rbx
mov rsi, qword [rbp + 0x5d0]
jmp 0x140048464
xor r8d, r8d
test cx, cx
je 0x140048869
mov cx, 1
test r8w, r8w
jne 0x140048458
cmp rax, r13
je 0x14004850e
movzx r8d, byte [rax]
test r8b, r8b
js 0x140048488
inc rax
mov edx, r8d
jmp 0x140048504
mov edx, r8d
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp r8b, 0xdf
jbe 0x1400484d2
xor eax, 0x48b60f44
add al, byte [rcx - 0x3f]
loop case.0x140044f36.90
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
rol dword [rcx - 0x80], 1
clc
invalid
jb 0x1400484de
rol dword [rcx - 0x80], 1
clc
invalid
movzx r8d, byte [rax + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
or edx, r8d
or edx, eax
invalid
or edx, eax
jmp 0x1400484e8
add rax, 2
shl edx, 6
or edx, r10d
jmp 0x140048504
add rax, 3
shl edx, 0xc
or edx, r9d
cmp edx, 0xffff
jbe 0x140048504
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x14004845b
xor r8d, r8d
mov ecx, edx
jmp 0x14004845b
movabs rax, 0x8000000000000000
cmp rsi, rax
je 0x140049171
mov qword [rbp + 0x440], rbx
mov qword [rbp + 0x448], r13
mov word [rbp + 0x450], 0
lea rcx, [rbp + 0x4f0]
lea rdx, [rbp + 0x440]
call fcn.14001a4a0
test rsi, rsi
je 0x140048561
mov r8d, 1
mov rcx, rbx
mov rdx, rsi
call fcn.140003f90
dec dword [rax - 0x75]
mov ebp, 0x500
mov rdi, qword [rbp + 0x500]
cmp rdi, qword [rbp + 0x4f0]
jne 0x14004857d
lea rcx, [rbp + 0x4f0]
lea ecx, [rbp + 0x4f0]
call fcn.140010d20
mov r13, qword [rbp + 0x4f8]
add byte [rax], al
mov word [r13 + rdi*2], 0
inc rdi
mov qword [rbp + 0x500], rdi
jmp 0x140048205
test rdx, rdx
je 0x1400485ab
mov r8d, 1
call fcn.140003f90
mov rdx, qword [rbp + 0x5d0]
test rdx, rdx
mov rsi, qword [rbp + 0x5c0]
je 0x1400485d0
mov r8d, 1
mov rcx, qword [rbp + 0x538]
call fcn.140003f90
lea r13, str.nul_byte_found_in_provided_data
test r14, r14
je 0x140048886
add r14, r14
mov r8d, 2
mov rcx, rsi
mov rdx, r14
jmp 0x140048881
movzx ecx, word [rax - 8]
lea edx, [rcx - 0x42]
cmp edx, 0x21
ja case.0x140048612.68
lea r8, [0x14009d418]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
movzx edx, word [rax - 6]
or edx, 0x20
cmp edx, 0x61
jne 0x14004862c
movzx edx, word [rax - 4]
or edx, 0x20
cmp edx, 0x74
je 0x140048656
cmp cx, 0x43
jne case.0x140048612.68
movzx ecx, word [rax - 6]
or ecx, 0x20
cmp ecx, 0x6d
jne case.0x140048612.68
movzx eax, word [rax - 4]
or eax, 0x20
cmp eax, 0x64
jne case.0x140048612.68
lea rcx, [rbp - 0x30]
call fcn.14004a320
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
movabs rax, 0x8000000000000000
mov qword [rbp + 0x5d8], rcx
cmp rcx, rax
jne 0x1400489dc
mov rax, qword [rbp + 0x5b0]
mov qword [rax], rdx
mov qword [rax + 0x10], 2
jmp 0x140047d1f
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x4b8], rax
movabs rax, 0x8000000000000000
inc rax
mov qword [rbp + 0x4b0], rax
mov rdx, qword [rbp + 0x4f0]
test rdx, rdx
je 0x1400486e1
mov rcx, qword [rbp + 0x4f8]
add rdx, rdx
mov r8d, 2
call fcn.140003f90
mov r14, qword [rbp + 0x5e0]
mov r13, qword [rbp + 0x5c0]
lea rcx, [rbp + 0x4b8]
call fcn.140007070
lea rdx, str.PATHlibrary_std_src_sys_commonprocess.rs
lea rcx, [rbp + 0x440]
mov r8d, 4
call fcn.140024c20
mov rsi, qword [rbp + 0x440]
movabs r12, 0x8000000000000000
cmp rsi, r12
je 0x14004885d
mov rbx, qword [rbp + 0x448]
mov rax, qword [rbp + 0x450]
add rax, rbx
mov qword [rbp + 0x540], rbx
mov qword [rbp + 0x548], rax
mov word [rbp + 0x550], 0
mov byte [rbp + 0x558], 1
lea rdi, [rbp - 0x30]
lea r15, [rbp + 0x540]
mov rcx, rdi
mov rdx, r15
call fcn.140044140
jmp 0x140048780
mov rcx, rdi
mov rdx, r15
call fcn.140044140
mov rdx, qword [rbp - 0x30]
cmp rdx, r12
je 0x140048847
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
test rax, rax
jne 0x1400487ac
test rdx, rdx
je 0x140048775
mov r8d, 1
call fcn.140003f90
jmp 0x140048775
mov r8, qword [rbp - 0x18]
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r8
mov rcx, rdi
mov rdx, r13
mov r8, qword [rbp + 0x5d0]
call fcn.140033a20
cmp byte [rbp + 0x5d8], 0
jne 0x1400487f0
mov r8d, 3
mov rcx, rdi
lea rdx, str.exe.NULexit_code:
call fcn.1400346f0
mov r12, qword [rbp - 0x28]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp + 0x4f0]
mov rdx, r12
call fcn.140049a20
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x14004881e
mov r8d, 1
mov rcx, r12
call fcn.140003f90
mov r12, qword [rbp + 0x4f0]
movabs rax, 0x8000000000000000
cmp r12, rax
jne 0x140048dd9
movabs r12, 0x8000000000000000
jmp 0x140048768
test rsi, rsi
je 0x14004885d
mov r8d, 1
mov rcx, rbx
mov rdx, rsi
call fcn.140003f90
lea r15, str.l_n_
jmp 0x140047ad3
lea r13, str.nul_byte_found_in_provided_data
test rsi, rsi
je 0x140048886
mov r8d, 1
mov rcx, rbx
mov rdx, rsi
call fcn.140003f90
xor ebx, ebx
lea rcx, [rbp - 0x30]
call fcn.1400060d0
mov rdx, qword [rbp + 0x4f0]
test rdx, rdx
je 0x1400488b2
mov rcx, qword [rbp + 0x4f8]
add rdx, rdx
mov r8d, 2
call fcn.140003f90
mov rax, qword [rbp + 0x5b0]
mov qword [rax], r13
mov qword [rax + 0x10], 2
jmp 0x140049113
mov esi, edi
xor eax, eax
lea rcx, [0x1400d4150]
movzx edx, byte [0x1400d4151]
xor r8d, r8d
test dl, dl
setne r8b
mov qword [rbp + 0x4f8], rcx
mov byte [rbp + 0x500], al
mov qword [rbp + 0x4f0], r8
mov qword [rbp + 0x440], 0
mov qword [rbp + 0x450], 0
mov qword [rbp + 0x460], 0
cmp byte [rbp + 0x4a8], 0
lea rax, [rbp + 0x420]
mov rdx, qword [rbp + 0x5e0]
cmovne rax, rdx
mov dword [rbp + 0x420], 2
mov r8, qword [rbp + 0x5e8]
lea rcx, [r8 + 0x58]
cmp dword [r8 + 0x58], 6
cmove rcx, rax
cmp dword [r8 + 0x68], 6
lea rbx, [r8 + 0x68]
cmove rbx, rdx
lea rdi, [r8 + 0x78]
cmp dword [r8 + 0x78], 6
cmove rdi, rdx
lea r8, [rbp + 0x440]
mov edx, 0xfffffff6
call fcn.140049af0
mov qword [rbp + 0x4a8], rdx
test rax, rax
je 0x1400489a5
mov rax, qword [rbp + 0x5b0]
mov rcx, qword [rbp + 0x4a8]
mov qword [rax], rcx
mov qword [rax + 0x10], 2
jmp 0x14004902f
lea r8, [rbp + 0x450]
mov rcx, rbx
mov edx, 0xfffffff5
call fcn.140049af0
mov rbx, rdx
test rax, rax
je 0x140048c57
mov rax, qword [rbp + 0x5b0]
mov qword [rax], rbx
mov qword [rax + 0x10], 2
jmp 0x14004900e
mov qword [rbp + 0x5b8], rdx
mov rcx, qword [rbp + 0x5e8]
mov r9, qword [rcx + 0x28]
mov rax, qword [rcx + 0x30]
movzx ecx, byte [rcx + 0xc5]
mov byte [rsp + 0x28], cl
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x30]
mov rdx, r15
mov r8, rdi
call fcn.14003dc50
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
movabs rdx, 0x8000000000000000
cmp rcx, rdx
jne 0x140048c87
mov rcx, qword [rbp + 0x5b0]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
mov rdx, qword [rbp + 0x5d8]
test rdx, rdx
je 0x140047d1f
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x5b8]
call fcn.140003f90
jmp 0x140047d1f
xor ebx, ebx
lea rcx, [rbp - 0x30]
call fcn.1400060d0
cmp rdi, qword [rbp + 0x4f0]
jne 0x140048a91
xor ebx, ebx
lea rcx, [rbp + 0x4f0]
call fcn.140010d20
mov r13, qword [rbp + 0x4f8]
mov word [r13 + rdi*2], 0
mov r14, qword [rbp + 0x4f0]
movabs rax, 0x8000000000000000
cmp r14, rax
je 0x1400488b2
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x5d0], rax
mov edi, dword [rbp + 0x438]
mov rcx, qword [rbp + 0x5e8]
movabs rax, 0x8000000000000000
cmp qword [rcx + 0x38], rax
je 0x140047e5d
mov rax, qword [rcx + 0x40]
mov rcx, qword [rcx + 0x48]
add rcx, rax
xor r10d, r10d
mov rdx, rax
jmp 0x140048b02
xor r10d, r10d
test r8w, r8w
je 0x140048bb6
mov r8w, 1
test r10w, r10w
jne 0x140048af5
cmp rdx, rcx
je 0x140048bd4
movzx r10d, byte [rdx]
test r10b, r10b
js 0x140048b2a
inc rdx
mov r9d, r10d
jmp 0x140048bab
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rdx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x140048b74
movzx r11d, byte [rdx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x140048b81
movzx r10d, byte [rdx + 3]
add rdx, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r9d, r10d
jmp 0x140048b8c
add rdx, 2
shl r9d, 6
or r9d, esi
jmp 0x140048bab
add rdx, 3
shl r9d, 0xc
or r9d, r11d
cmp r9d, 0xffff
jbe 0x140048bab
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x140048af8
xor r10d, r10d
mov r8d, r9d
jmp 0x140048af8
lea r13, str.nul_byte_found_in_provided_data
mov rax, qword [rbp + 0x5b0]
mov qword [rax], r13
mov qword [rax + 0x10], 2
jmp 0x1400490f6
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
mov word [rbp - 0x20], 0
lea rcx, [rbp + 0x540]
lea rdx, [rbp - 0x30]
call fcn.14001a8f0
mov rcx, qword [rbp + 0x540]
mov rsi, qword [rbp + 0x550]
cmp rsi, rcx
jne 0x140048c18
lea rcx, [rbp + 0x540]
call fcn.140010d20
mov rcx, qword [rbp + 0x540]
mov qword [rbp + 0x3f8], r13
mov r13, qword [rbp + 0x548]
mov word [r13 + rsi*2], 0
mov qword [rbp + 0x538], r13
movabs rax, 0x8000000000000000
mov rdx, rcx
mov qword [rbp + 0x5c0], rcx
cmp rcx, rax
jne 0x140047e7c
jmp 0x140048bbd
lea r8, [rbp + 0x460]
mov rcx, rdi
mov edx, 0xfffffff4
call fcn.140049af0
test rax, rax
je 0x140048cb3
mov rax, qword [rbp + 0x5b0]
mov qword [rax], rdx
mov qword [rax + 0x10], 2
jmp 0x140049006
mov rsi, qword [rbp - 0x20]
mov dl, 1
mov dword [rbp + 0x5c8], edx
mov dword [rbp + 0x4a4], 0
jmp 0x140047d6f
lea rcx, [0x1400d4150]
call fcn.14004f200
jmp 0x140047ea3
xorps xmm0, xmm0
movups xmmword [rbp + 0x574], xmm0
movups xmmword [rbp + 0x568], xmm0
movups xmmword [rbp + 0x558], xmm0
movups xmmword [rbp + 0x548], xmm0
movups xmmword [rbp + 0x588], xmm0
movups xmmword [rbp + 0x598], xmm0
test rdx, rdx
jne 0x140048cf4
test rbx, rbx
jne 0x140048cf4
cmp qword [rbp + 0x4a8], 0
je 0x140048d1a
mov dword [rbp + 0x57c], 0x100
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x590], rax
mov qword [rbp + 0x598], rbx
mov qword [rbp + 0x5a0], rdx
mov rax, qword [rbp + 0x5e8]
mov rdi, qword [rax + 0xb8]
test rdi, rdi
mov qword [rbp + 0x438], rdx
je 0x140048e06
add rax, 0xa8
mov dword [rbp + 0x540], 0x70
lea rcx, [rbp + 0x408]
mov rdx, rax
call fcn.14004a7d0
mov rcx, qword [rbp + 0x408]
test rcx, rcx
je 0x140048fe1
or esi, 0x80000
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x400], rax
movups xmm0, xmmword [rbp + 0x540]
movups xmm1, xmmword [rbp + 0x550]
movups xmm2, xmmword [rbp + 0x560]
movups xmm3, xmmword [rbp + 0x570]
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x20], xmm1
movaps xmmword [rbp - 0x10], xmm2
movaps xmmword [rbp], xmm3
movups xmm0, xmmword [rbp + 0x580]
movaps xmmword [rbp + 0x10], xmm0
movups xmm0, xmmword [rbp + 0x590]
movaps xmmword [rbp + 0x20], xmm0
mov rax, qword [rbp + 0x5a0]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x5e8], rcx
mov qword [rbp + 0x38], rcx
lea rax, [rbp - 0x30]
jmp 0x140048e17
mov r15, qword [rbp + 0x4f8]
mov rdi, qword [rbp + 0x500]
test rsi, rsi
je 0x140047b7a
mov r8d, 1
mov rcx, rbx
mov rdx, rsi
call fcn.140003f90
jmp 0x140047b7a
mov dword [rbp + 0x540], 0x68
lea rax, [rbp + 0x540]
mov rdx, qword [rbp + 0x4d8]
lea rcx, [rbp + 0x4b0]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov rax, qword [rbp + 0x3f8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
mov rcx, qword [rbp + 0x5b8]
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x140048fa8
movups xmm0, xmmword [rbp + 0x440]
movups xmm1, xmmword [rbp + 0x450]
movups xmm2, xmmword [rbp + 0x460]
mov rax, qword [rbp + 0x5b0]
movups xmmword [rax + 0x30], xmm2
movups xmmword [rax + 0x20], xmm1
movups xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [rbp + 0x4b0]
movups xmmword [rax], xmm0
test rdi, rdi
je 0x140048eb0
mov rcx, qword [rbp + 0x5e8]
mov rdx, qword [rbp + 0x400]
call fcn.140007f30
mov rcx, qword [rbp + 0x438]
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rbp + 0x4a8]
call sub.KERNEL32.dll_CloseHandle
cmp dword [rbp + 0x420], 4
jb 0x140048ee5
mov rcx, qword [rbp + 0x428]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [rbp + 0x4f0]
call fcn.1400068b0
mov rdx, qword [rbp + 0x5c0]
test rdx, rdx
je 0x140048f12
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x538]
call fcn.140003f90
test r14, r14
je 0x140048f2f
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x5d0]
mov rdx, r14
call fcn.140003f90
mov rdx, qword [rbp + 0x4d0]
test rdx, rdx
je 0x140048f50
mov rcx, qword [rbp + 0x4d8]
add rdx, rdx
mov r8d, 2
call fcn.140003f90
mov rdx, qword [rbp + 0x5d8]
test rdx, rdx
mov r14, qword [rbp + 0x5e0]
je 0x140048f78
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x5b8]
call fcn.140003f90
test r12, r12
setne al
mov ecx, dword [rbp + 0x4a4]
xor cl, 1
test al, cl
je 0x140047b49
add r12, r12
mov r8d, 2
mov rcx, r15
mov rdx, r12
call fcn.140003f90
jmp 0x140047b49
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x5b0]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
test rdi, rdi
je 0x140048ffa
mov rcx, qword [rbp + 0x5e8]
mov rdx, qword [rbp + 0x400]
call fcn.140007f30
jmp 0x140048ffa
mov rax, qword [rbp + 0x410]
mov rcx, qword [rbp + 0x5b0]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
mov rcx, qword [rbp + 0x438]
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rbp + 0x4a8]
call sub.KERNEL32.dll_CloseHandle
cmp dword [rbp + 0x420], 4
jb 0x14004902f
mov rcx, qword [rbp + 0x428]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rbp + 0x440], 0
je 0x140049045
mov rcx, qword [rbp + 0x448]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rbp + 0x450], 0
je 0x14004905b
mov rcx, qword [rbp + 0x458]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rbp + 0x460], 0
je 0x140049071
mov rcx, qword [rbp + 0x468]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rbp + 0x4f0], 0
mov rsi, qword [rbp + 0x4f8]
movzx eax, byte [rbp + 0x500]
je 0x1400490a4
test al, al
jne 0x1400490c5
mov rax, qword [0x1400d4120]
test qword [rbp + 0x430], rax
je 0x1400490c5
call fcn.14003be90
jmp 0x1400490bd
test al, al
jne 0x1400490c5
mov rax, qword [0x1400d4120]
test qword [rbp + 0x430], rax
je 0x1400490c5
call fcn.14003be90
test al, al
jne 0x1400490c5
mov byte [rsi + 1], 1
xor eax, eax
xchg byte [rsi], al
cmp al, 2
jne 0x1400490d5
mov rcx, rsi
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
mov rdx, qword [rbp + 0x5c0]
test rdx, rdx
je 0x1400490f6
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x538]
call fcn.140003f90
test r14, r14
je 0x140049113
add r14, r14
mov r8d, 2
mov rcx, qword [rbp + 0x5d0]
mov rdx, r14
call fcn.140003f90
mov rdx, qword [rbp + 0x4d0]
test rdx, rdx
je 0x140049134
mov rcx, qword [rbp + 0x4d8]
add rdx, rdx
mov r8d, 2
call fcn.140003f90
mov rdx, qword [rbp + 0x5d8]
test rdx, rdx
mov r14, qword [rbp + 0x5e0]
je 0x14004915c
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x5b8]
call fcn.140003f90
mov sil, 1
cmp byte [rbp + 0x5c8], 0
je 0x140047b49
jmp 0x140047d21
mov r13, rbx
jmp 0x140048886
lea rcx, [0x14009e790]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400825d0
jmp 0x140049350
lea rcx, [0x14009e790]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400825d0
jmp 0x140049350
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rbx
mov r8, rax
call fcn.140088830
jmp 0x140049350
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, rbx
mov r8, rax
call fcn.140088830
ud2