Function at 0x140105e19
Capabilities:
Create directory
Get file size
Move file
Read file on windows
Shutdown system

Disassembly:
test r9, r9
je 0x1401075fd
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov qword [rsp + 0x230], rbx
mov rax, qword [0x1402e0068]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov r14, r9
mov esi, edx
mov r13, rcx
mov edi, dword [r9 + 0x10]
cmp edi, 1
jb case.0x140105e94.3
mov rbx, qword [r9 + 8]
movzx eax, byte [rbx]
add eax, 0xfffffffe
cmp eax, 0x4a
ja case.0x140105e94.3
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x10766c]
mov ecx, dword [rdx + rax*4 + 0x107600]
add rcx, rdx
jmp rcx
cmp dword [0x1402e47d8], 0
jne case.0x140105e94.3
mov dword [r13 + 0x360], esi
lea rcx, [r13 + 0x300]
mov rdx, r9
call fcn.140103ea0
jmp case.0x140105e94.3
movzx eax, byte [rbx + 1]
mov dword [0x1402e49f0], eax
jmp case.0x140105e94.3
cmp dword [0x1402e47d8], 0
jne case.0x140105e94.3
mov dword [rsp + 0x58], reloc.WS2_32.dll_listen
mov r14d, 1
mov dword [rsp + 0x5c], r14d
lea edx, [r14 + 1]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
test eax, eax
jle case.0x140105e94.3
mov edx, 0x100000
mov ecx, eax
call fcn.140105c10
mov rdi, rax
test rax, rax
je case.0x140105e94.3
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x20], 0xffffffff
mov r9d, r14d
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + reloc.WS2_32.dll_htonl]
jmp case.0x140105e94.3
cmp dword [0x1402e47d8], 0
jne case.0x140105e94.3
movzx ebx, byte [r13 + 0x3cc]
mov byte [r13 + 0x3cc], 0
mov rcx, r9
call fcn.140103120
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [r13 + 0x3c8], eax
mov byte [r13 + 0x3cc], bl
jmp case.0x140105e94.3
cmp dword [0x1402e47d8], 0
jne case.0x140105e94.3
call fcn.1401017e0
jmp case.0x140105e94.3
mov edx, esi
mov rcx, r13
call fcn.140105590
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
jne 0x14010602d
mov ecx, 3
call fcn.14001e5c0
mov rdi, rax
test rax, rax
je case.0x140105e94.3
mov rcx, qword [rax + 8]
mov byte [rcx], 0x1f
mov byte [rcx + 1], 0
mov byte [rcx + 2], 0xff
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x240]
mov dword [rsp + 0x20], r11d
mov r9d, 2
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + reloc.WS2_32.dll_htonl]
jmp case.0x140105e94.3
mov r14d, 1
mov ecx, r14d
lea rdx, [rbx + 1]
cmp edi, 2
jb case.0x140105e94.3
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x140106059
lea eax, [rcx + 1]
cmp eax, edi
jbe 0x140106043
jmp case.0x140105e94.3
xor r12d, r12d
mov qword [rsp + 0xb0], r12
mov dword [rsp + 0xb8], r14d
test rdx, rdx
je 0x140106084
mov rcx, rdx
call fcn.140001980
mov r12, rax
mov qword [rsp + 0xb0], rax
mov edx, 0xf000
mov rcx, r12
call fcn.140104390
mov rdi, rax
test r12, r12
je 0x1401060a1
mov rcx, r12
call fcn.1401e64f8
test rdi, rdi
je case.0x140105e94.3
mov edx, 0x7d0
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov ebp, 2
mov r14d, dword [rsp + 0x240]
nop
mov rcx, rdi
call fcn.140102d10
mov r12d, eax
cmp qword [r13 + 8], 0
je 0x140106161
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x20], r14d
mov r9d, ebp
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp r12d, 1
jne 0x140106161
mov eax, dword [rdi + 0x1c]
cmp eax, r12d
jle 0x140106161
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140106149
mov r8d, 0x2710
lea rdx, [rsp + 0x78]
call qword [0x1402e6740]
test eax, eax
je 0x140106174
jmp 0x140106161
mov r8d, 0x2710
lea rdx, [rsp + 0x78]
mov rcx, qword [rdi + 0x20]
call fcn.1400012c0
test eax, eax
jle 0x140106174
mov rcx, rdi
call fcn.1401035c0
cmp r12d, 1
jne 0x14010619a
jmp 0x1401060e0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.0x140105e94.3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
je case.0x140105e94.3
mov r14d, 1
lea r15, [rbx + 1]
cmp edi, 2
jb case.0x140105e94.3
mov eax, r14d
inc r14d
cmp byte [rax + rbx], 0
je 0x1401061fa
lea eax, [r14 + 1]
cmp eax, edi
jbe 0x1401061e1
jmp case.0x140105e94.3
xor r12d, r12d
mov rbx, r12
test r15, r15
je 0x140106210
mov rcx, r15
call fcn.140001980
mov rbx, rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test rbx, rbx
je 0x14010622a
mov rcx, rbx
call fcn.1401e64f8
mov ecx, r12d
test ebp, ebp
sete cl
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8d, 0x20
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
mov ecx, 0x400
call fcn.14001e5c0
mov rdi, rax
test rax, rax
je case.0x140105e94.3
mov r8, qword [rax + 8]
mov r9d, dword [rax + 0x10]
mov byte [r8], 0x21
test ebp, ebp
sete cl
mov byte [r8 + 1], cl
mov ebp, 2
mov edx, ebp
cmp r9d, 3
jb 0x1401062e1
nop word [rax + rax]
movzx ecx, byte [r15]
mov eax, edx
mov byte [rax + r8], cl
inc edx
inc r15
test cl, cl
je 0x1401062ad
lea eax, [rdx + 1]
cmp eax, r9d
jbe 0x140106290
jmp 0x1401062e1
mov dword [rdi + 0x10], edx
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x240]
mov dword [rsp + 0x20], r11d
mov r9d, ebp
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
je case.0x140105e94.3
mov r14d, 1
mov ecx, r14d
lea r15, [rbx + 1]
cmp edi, 2
jb case.0x140105e94.3
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x140106329
lea eax, [rcx + 1]
cmp eax, edi
jbe 0x140106313
jmp case.0x140105e94.3
xor r12d, r12d
mov rbx, r12
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0xa8], r14d
test r15, r15
je 0x140106357
mov rcx, r15
call fcn.140001980
mov rbx, rax
mov qword [rsp + 0xa0], rax
mov rcx, rbx
call fcn.1401024e0
mov ebp, eax
test rbx, rbx
je 0x14010636e
mov rcx, rbx
call fcn.1401e64f8
mov ecx, r12d
test ebp, ebp
sete cl
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8d, 0x22
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
mov ecx, 0x400
call fcn.14001e5c0
mov rdi, rax
test rax, rax
je case.0x140105e94.3
mov r8, qword [rax + 8]
mov r9d, dword [rax + 0x10]
mov byte [r8], 0x23
test ebp, ebp
sete cl
mov byte [r8 + 1], cl
mov ebp, 2
mov edx, ebp
cmp r9d, 3
jb 0x140106421
nop
movzx ecx, byte [r15]
mov eax, edx
mov byte [rax + r8], cl
inc edx
inc r15
test cl, cl
je 0x1401063ed
lea eax, [rdx + 1]
cmp eax, r9d
jbe 0x1401063d0
jmp 0x140106421
mov dword [rdi + 0x10], edx
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x240]
mov dword [rsp + 0x20], r11d
mov r9d, ebp
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
je case.0x140105e94.3
mov r14d, 1
lea rax, [rbx + 1]
mov qword [rsp + 0x58], rax
cmp edi, 2
jb case.0x140105e94.3
nop word [rax + rax]
mov eax, r14d
inc r14d
cmp byte [rax + rbx], 0
je 0x140106479
lea eax, [r14 + 1]
cmp eax, edi
jbe 0x140106460
jmp case.0x140105e94.3
mov r15d, r14d
add r15, rbx
lea ecx, [r14 + 1]
cmp ecx, edi
ja case.0x140105e94.3
nop dword [rax + rax]
mov eax, r14d
inc r14d
inc ecx
cmp byte [rax + rbx], 0
je 0x1401064a7
cmp ecx, edi
jbe 0x140106490
jmp case.0x140105e94.3
xor r12d, r12d
mov rdi, r12
test r15, r15
je 0x1401064bd
mov rcx, r15
call fcn.140001980
mov rdi, rax
mov rbp, r12
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1401064d5
mov rcx, rbx
call fcn.140001980
mov rbp, rax
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r14d, eax
test rbp, rbp
je 0x1401064f1
mov rcx, rbp
call fcn.1401e64f8
test rdi, rdi
je 0x1401064fe
mov rcx, rdi
call fcn.1401e64f8
test r14d, r14d
sete r12b
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov r9, rbx
mov r8d, 0x24
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
mov ecx, 0x400
call fcn.14001e5c0
mov rdi, rax
test rax, rax
je case.0x140105e94.3
mov r10, qword [rax + 8]
mov r9d, dword [rax + 0x10]
mov byte [r10], 0x25
test r14d, r14d
sete cl
mov byte [r10 + 1], cl
mov ebp, 2
mov edx, ebp
cmp r9d, 3
jb 0x1401065ef
nop word [rax + rax]
movzx ecx, byte [rbx]
mov eax, edx
mov byte [rax + r10], cl
inc edx
inc rbx
test cl, cl
je 0x14010658c
lea eax, [rdx + 1]
cmp eax, r9d
jbe 0x140106570
jmp 0x1401065ef
lea r8d, [rdx + 1]
cmp r8d, r9d
ja 0x1401065ef
nop word [rax + rax]
movzx ecx, byte [r15]
mov byte [rdx + r10], cl
inc edx
inc r8d
inc r15
test cl, cl
je 0x1401065bb
cmp r8d, r9d
jbe 0x1401065a0
jmp 0x1401065ef
mov dword [rdi + 0x10], edx
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x240]
mov dword [rsp + 0x20], r11d
mov r9d, ebp
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
jne 0x140106634
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x27
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
cmp qword [r13 + 0x3b0], 0xffffffffffffffff
je 0x14010666b
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x27
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
mov dword [r13 + 0x3c0], esi
mov rdx, qword [r9 + 8]
mov ecx, dword [r9 + 0x10]
mov r14d, 1
lea rdi, [rdx + 1]
cmp ecx, 2
jb 0x140106761
nop dword [rax]
mov eax, r14d
inc r14d
cmp byte [rax + rdx], 0
je 0x1401066a9
lea eax, [r14 + 1]
cmp eax, ecx
jbe 0x140106690
jmp 0x140106761
xor r12d, r12d
mov rbx, r12
test rdi, rdi
je 0x1401066bf
mov rcx, rdi
call fcn.140001980
mov rbx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov ebp, 2
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r13 + 0x3b0], rax
test rbx, rbx
je 0x1401066fd
mov rcx, rbx
call fcn.1401e64f8
mov eax, r12d
cmp qword [r13 + 0x3b0], 0xffffffffffffffff
sete al
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8d, 0x26
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
mov r9d, r12d
cmp qword [r13 + 0x3b0], 0xffffffffffffffff
cmove r9d, ebp
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r8b, 0x27
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 4
mov r8b, 0x27
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
jne 0x1401067c5
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x29
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
mov rcx, qword [r13 + 0x3b0]
cmp rcx, 0xffffffffffffffff
je 0x140106846
cmp dword [r13 + 0x3c0], esi
jne 0x140106846
lea r8d, [rdi - 1]
lea rdx, [rbx + 1]
call fcn.1401031a0
test eax, eax
je 0x140106819
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8b, 0x29
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x29
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x29
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
jne 0x1401068aa
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x2b
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
mov rcx, qword [r13 + 0x3b0]
cmp rcx, 0xffffffffffffffff
je 0x1401069bb
cmp dword [r13 + 0x3c0], esi
jne 0x1401069bb
cmp edi, 9
jb 0x1401069bb
mov edx, dword [rbx + 1]
mov dword [rsp + 0x48], edx
mov eax, dword [rbx + 5]
mov dword [rsp + 0x4c], eax
cmp edi, 9
je 0x140106927
lea r8d, [rdi - 9]
lea rdx, [rbx + 9]
call fcn.1401031a0
test eax, eax
jne 0x14010691f
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x2b
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp 0x140106997
mov eax, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
test edx, edx
je 0x140106950
test eax, eax
je 0x140106950
lea rcx, [rsp + 0x48]
call fcn.1401025f0
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, qword [r13 + 0x3b0]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, qword [r13 + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3b0], 0xffffffffffffffff
xor r12d, r12d
mov dword [r13 + 0x3c0], r12d
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8b, 0x2b
mov edx, esi
mov rcx, r13
call fcn.140104bb0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r9 + 0x2a]
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
jmp case.0x140105e94.3
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x2b
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
mov rcx, qword [r13 + 0x3b0]
xor r12d, r12d
cmp rcx, 0xffffffffffffffff
je 0x140106a65
cmp dword [r13 + 0x3c0], esi
jne 0x140106a65
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3b0], 0xffffffffffffffff
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x240]
mov dword [rsp + 0x20], r11d
lea r9d, [r12 + 2]
mov r8, r14
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r12 + 0x2c]
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
mov dword [r13 + 0x3c0], r12d
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
jne 0x140106aa8
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
cmp qword [r13 + 0x3b8], 0xffffffffffffffff
je 0x140106adf
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
mov dword [r13 + 0x3c4], esi
mov r9, qword [r9 + 8]
mov r8d, dword [r14 + 0x10]
mov r14d, 1
mov ecx, r14d
lea rbp, [r9 + 1]
cmp r8d, 2
jb 0x140106ca8
mov eax, ecx
inc ecx
cmp byte [rax + r9], 0
je 0x140106b1d
lea eax, [rcx + 1]
cmp eax, r8d
jbe 0x140106b05
jmp 0x140106ca8
mov edi, ecx
add rdi, r9
lea edx, [rcx + 1]
xor r12d, r12d
cmp edx, r8d
ja 0x140106b41
nop dword [rax]
mov eax, ecx
inc ecx
inc edx
cmp byte [rax + r9], r12b
je 0x140106b44
cmp edx, r8d
jbe 0x140106b30
mov rdi, r12
cmp byte [rbp], r12b
je 0x140106b5c
mov rcx, qword [r13 + 0x3d0]
test rcx, rcx
je 0x140106b5c
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [r13 + 0x3d0]
test rcx, rcx
je 0x140106b6e
add rcx, 0x30
jmp 0x140106b71
mov rcx, rbp
mov rbx, r12
test rcx, rcx
je 0x140106b81
call fcn.140001980
mov rbx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r13 + 0x3b8], rax
test rbx, rbx
je 0x140106bbe
mov rcx, rbx
call fcn.1401e64f8
mov rcx, qword [r13 + 0x3b8]
cmp rcx, 0xffffffffffffffff
je 0x140106c3b
lea rdx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.140104bb0
cmp dword [rsp + 0x50], r12d
jne 0x140106c36
cmp dword [rsp + 0x54], r12d
jne 0x140106c36
mov rcx, qword [r13 + 0x3b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3b8], 0xffffffffffffffff
mov dword [r13 + 0x3c4], r12d
jmp 0x140106c60
mov r14d, r12d
jmp 0x140106c60
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.140104bb0
test rdi, rdi
je 0x140106c6f
mov rcx, rdi
call fcn.140001d00
mov esi, eax
mov eax, r12d
cmp qword [r13 + 0x3b8], 0xffffffffffffffff
sete al
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, rbp
mov r8d, 0x2d
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
test r14d, r14d
je case.0x140105e94.3
jmp 0x140106cd0
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 4
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.140104bb0
mov rcx, qword [r13 + 0x3d0]
test rcx, rcx
je case.0x140105e94.3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
jne 0x140106d22
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x30
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
cmp qword [r13 + 0x3b8], 0xffffffffffffffff
jne 0x140106d59
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x30
mov edx, esi
mov rcx, r13
call fcn.140104bb0
jmp case.0x140105e94.3
cmp dword [r13 + 0x3c4], esi
jne case.0x140105e94.3
mov r14d, 1
cmp edi, 5
jb 0x140106d78
mov ebx, dword [rbx + 1]
test ebx, ebx
jne 0x140106d7d
mov ebx, 0x5000
lea ecx, [rbx + 2]
call fcn.14001e5c0
mov rdi, rax
test rax, rax
je 0x140106ea6
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov rcx, qword [rax + 8]
mov byte [rcx], 0x30
mov rcx, qword [rax + 8]
mov byte [rcx + 1], r12b
mov rdx, qword [rax + 8]
add rdx, 2
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rcx, qword [r13 + 0x3b8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140106e6d
mov eax, dword [rsp + 0x40]
add eax, 2
mov dword [rdi + 0x10], eax
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x240]
mov dword [rsp + 0x20], r11d
lea r9d, [r12 + 2]
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rsp + 0x40], r12d
jne 0x140106e57
mov rcx, qword [r13 + 0x3b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3b8], 0xffffffffffffffff
mov dword [r13 + 0x3c4], r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r12 + 0x31]
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
jmp 0x140106e92
mov rcx, qword [r13 + 0x3d0]
test rcx, rcx
je 0x140106e68
call fcn.140102e80
mov r14d, r12d
jmp 0x140106e92
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x30
mov edx, esi
mov rcx, r13
call fcn.140104bb0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
test r14d, r14d
je case.0x140105e94.3
jmp 0x140106ece
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x30
mov edx, esi
mov rcx, r13
call fcn.140104bb0
mov rcx, qword [r13 + 0x3d0]
test rcx, rcx
je case.0x140105e94.3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x140105e94.3
cmp dword [r13 + 0x3c4], esi
jne case.0x140105e94.3
mov rcx, qword [r13 + 0x3b8]
cmp rcx, 0xffffffffffffffff
je 0x140106f09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3b8], 0xffffffffffffffff
xor r12d, r12d
mov dword [r13 + 0x3c4], r12d
cmp dword [r14 + 0x10], 1
jbe 0x140106f58
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x240]
mov dword [rsp + 0x20], r11d
lea r9d, [r12 + 2]
mov r8, r14
mov edx, esi
mov rcx, r13
call fcn.140103930
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r9 + 0x33]
mov edx, esi
mov rcx, qword [0x1402e4700]
call fcn.1400f3610
mov rcx, qword [r13 + 0x3d0]
test rcx, rcx
je case.0x140105e94.3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x140105e94.3
cmp dword [r13 + 0x370], 0
je case.0x140105e94.3
mov rcx, qword [r13 + 0x3d0]
test rcx, rcx
je 0x140106fb7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x140105e94.3
cmp edi, 3
jbe case.0x140105e94.3
mov ecx, 0x188
call fcn.1401e65ec
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140106ff3
xor r12d, r12d
mov qword [rsp + 0x20], r12
lea r9, [0x140105b80]
mov r8d, esi
mov rdx, r14
mov rcx, rax
call fcn.14010a8f0
jmp 0x140106ff9
xor r12d, r12d
mov rax, r12
mov qword [r13 + 0x3d0], rax
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400010a0
test eax, eax
jne case.0x140105e94.3
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 0xff
mov r8b, getservbyport
mov edx, esi
mov rcx, r13
call fcn.140104bb0
mov rcx, qword [r13 + 0x3d0]
test rcx, rcx
je case.0x140105e94.3
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140105e94.3
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rbx + 1]
lea eax, [r11 - 0xa]
cmp eax, 0x2706
ja 0x140107077
mov dword [r13 + 0x3a4], r11d
mov edx, dword [rbx + 5]
lea eax, [rdx - 1]
cmp eax, 0x270f
ja 0x14010708b
mov dword [r13 + 0x3ac], edx
mov edx, dword [rbx + 9]
lea eax, [rdx - 1]
cmp eax, 0x7cf
ja 0x14010709f
mov dword [r13 + 0x3a8], edx
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x140105e94.3
mov edi, dword [rbx + 1]
mov esi, dword [rbx + 5]
movzx ebx, byte [rbx + 9]
mov ebp, 0xdc
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0xf0]
call fcn.1401e6750
mov word [rsp + 0x134], bp
mov dword [rsp + 0x198], ebx
mov dword [rsp + 0x19c], edi
mov dword [rsp + 0x1a0], esi
mov dword [rsp + 0x138], 0x1c0000
xor edx, edx
lea rcx, [rsp + 0xf0]
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
jmp case.0x140105e94.3
cmp edi, 9
jae 0x14010711e
mov byte [r13 + 0x3ce], 1
jmp case.0x140105e94.3
mov esi, dword [rbx + 1]
mov ebp, dword [rbx + 5]
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11d, [rbp - 1]
cmp r11d, 0x63
ja 0x14010713f
mov dword [r13 + 0x39c], ebp
test esi, esi
jne 0x14010715a
mov dword [r13 + 0x3a0], 0xffffffff
xor r12d, r12d
mov dword [0x1402e49d0], r12d
jmp 0x1401071d9
cmp esi, 1
jne 0x140107176
mov dword [r13 + 0x3a0], 0xffffffff
mov dword [0x1402e49d0], 0xfefefe
jmp 0x1401071d9
cmp esi, 2
jne 0x140107192
mov dword [r13 + 0x3a0], 0xffffffff
mov dword [0x1402e49d0], 0xfcfcfc
jmp 0x1401071d9
cmp esi, 3
jne 0x1401071ae
mov dword [r13 + 0x3a0], 0xffffffff
mov dword [0x1402e49d0], 0xf8f8f8
jmp 0x1401071d9
cmp esi, 4
jne 0x1401071ca
mov dword [r13 + 0x3a0], 0x9c400
xor r12d, r12d
mov dword [0x1402e49d0], r12d
jmp 0x1401071d9
cmp esi, 0x4e200
jbe 0x1401071d9
mov dword [r13 + 0x3a0], esi
cmp edi, 0xd
jb 0x1401071e7
mov eax, dword [rbx + 9]
mov dword [0x1402e49d0], eax
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x140105e94.3
mov r14d, 1
mov ecx, r14d
cmp dword [0x1402e47d8], 0
jne case.0x140105e94.3
cmp edi, 2
jb case.0x140105e94.3
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x14010722b
lea eax, [rcx + 1]
cmp eax, edi
jbe 0x140107215
jmp case.0x140105e94.3
xor r12d, r12d
mov ebp, r12d
mov esi, ecx
add rsi, rbx
lea edx, [rcx + 1]
cmp edx, edi
ja 0x140107283
nop dword [rax]
mov eax, ecx
inc ecx
inc edx
cmp byte [rax + rbx], bpl
je 0x140107252
cmp edx, edi
jbe 0x140107240
jmp 0x140107283
mov r8d, ecx
add r8, rbx
lea edx, [rcx + 1]
cmp edx, edi
ja 0x140107286
nop
mov eax, ecx
inc ecx
inc edx
cmp byte [rax + rbx], bpl
je 0x140107272
cmp edx, edi
jbe 0x140107260
jmp 0x140107286
mov rcx, r8
call fcn.140009a00
test r14b, al
cmovne ebp, r14d
jmp 0x140107286
mov rsi, r12
lea rdx, str.reboot
lea rcx, [rbx + 1]
call fcn.1401e63ec
test eax, eax
jne 0x140107328
lea rcx, str.SeShutdownPrivilege
call fcn.140101100
test eax, eax
jne 0x1401072dd
cmp dword [reloc.WS2_32.dll_accept], r14d
jg 0x1401072dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.shutdown_err_d
mov r8d, 0x3de
lea rdx, str..TShareApe.cpp
mov ecx, r14d
call fcn.1400045f0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne case.0x140105e94.3
cmp dword [reloc.WS2_32.dll_accept], r14d
jg case.0x140105e94.3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.shutdown_err2_d
mov r8d, 0x3e2
lea rdx, str..TShareApe.cpp
mov ecx, r14d
call fcn.1400045f0
jmp case.0x140105e94.3
test ebp, ebp
jne 0x140107343
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbx + 1]
call fcn.140101de0
test eax, eax
jne case.0x140105e94.3
lea rdx, [rbx + 1]
lea rcx, str.logoff
call fcn.1401e63ec
test eax, eax
je case.0x140105e94.3
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r12
mov r9, rsi
lea r8, [rbx + 1]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x140105e94.3
cmp dword [0x1402e47d8], 0
jne case.0x140105e94.3
movzx eax, byte [rbx + 1]
mov ecx, eax
and ecx, 3
je 0x1401073a5
and cl, 1
mov byte [r13 + 0x3cc], cl
shr eax, 2
and eax, 3
je case.0x140105e94.3
and al, 1
mov byte [r13 + 0x3cd], al
jmp case.0x140105e94.3
cmp edi, 0x10
jbe 0x1401073f8
mov eax, dword [rbx + 1]
mov ecx, dword [rbx + 5]
mov edx, dword [rbx + 9]
mov r8d, dword [rbx + 0xd]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], ecx
mov dword [rsp + 0x70], edx
mov dword [rsp + 0x74], r8d
lea rdx, [rsp + 0x68]
mov rcx, qword [0x1402e4700]
call fcn.1400ea970
jmp case.0x140105e94.3
xor edx, edx
mov rcx, qword [0x1402e4700]
call fcn.1400ea970
jmp case.0x140105e94.3
mov edx, edi
mov r14d, 1
mov ecx, r14d
cmp edi, 5
jbe 0x140107574
cmp edx, 2
jb 0x140107574
nop dword [rax + rax]
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x140107446
lea eax, [rcx + 1]
cmp eax, edx
jbe 0x140107430
jmp 0x140107574
lea rdx, [rbx + 1]
lea rcx, [rsp + 0xc0]
call fcn.140004d00
nop
cmp qword [r13 + 0x3d8], 0
jne 0x140107565
mov ecx, 0x1f8
call fcn.1401e65ec
mov qword [rsp + 0x60], rax
xor r12d, r12d
test rax, rax
je 0x14010748a
mov edx, r14d
mov rcx, rax
call fcn.14001e010
jmp 0x14010748d
mov rax, r12
mov qword [r13 + 0x3d8], rax
lea rbp, [r13 + 0xa0]
mov r8d, 0xea60
lea rdx, str.bitRate
lea rcx, [rsp + 0xc0]
call fcn.140004ec0
mov esi, eax
mov r8d, 8
lea rdx, str.sizeIndex
lea rcx, [rsp + 0xc0]
call fcn.140004ec0
mov edi, eax
mov r8d, r14d
lea rdx, str.channel
lea rcx, [rsp + 0xc0]
call fcn.140004ec0
mov ebx, eax
mov r8d, 0x5dc0
lea rdx, str.sampleRate
lea rcx, [rsp + 0xc0]
call fcn.140004ec0
mov r8d, eax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
mov r9d, ebx
mov edx, 0x7e
mov rcx, qword [r13 + 0x3d8]
call fcn.14001e250
test eax, eax
je 0x140107542
mov rcx, qword [r13 + 0x3d8]
add rcx, 8
call fcn.140102ee0
test eax, eax
je 0x140107565
mov rbx, qword [r13 + 0x3d8]
test rbx, rbx
je 0x14010755e
mov rcx, rbx
call fcn.14001e160
mov rcx, rbx
call fcn.1401e60f0
mov qword [r13 + 0x3d8], r12
lea rcx, [rsp + 0xc0]
call fcn.140004d80
jmp case.0x140105e94.3
mov rbx, qword [r13 + 0x3d8]
test rbx, rbx
je case.0x140105e94.3
mov rcx, rbx
call fcn.14001e160
mov rcx, rbx
call fcn.1401e60f0
xor r12d, r12d
mov qword [r13 + 0x3d8], r12
jmp case.0x140105e94.3
mov ecx, edi
mov r14d, 1
cmp edi, 5
jbe case.0x140105e94.3
lea rdx, [rbx + 1]
cmp ecx, 2
jb case.0x140105e94.3
mov eax, r14d
inc r14d
cmp byte [rax + rbx], 0
je 0x1401075c8
lea eax, [r14 + 1]
cmp eax, ecx
jbe 0x1401075b2
jmp case.0x140105e94.3
mov r8d, esi
mov rcx, r13
call fcn.140105900
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1401e6720
mov rbx, qword [rsp + 0x230]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
repz ret