Function at 0x140004620
Capabilities:
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, qword [0x1400400a8]
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r12, [0x140000000]
mov r15d, operator
inc eax
test eax, 0xfffffffe
jne 0x1400046a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140004694
mov eax, eax
mov ecx, dword [r12 + rax*4 + 0x30680]
jmp 0x140004697
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov rcx, qword [rsi]
lea r9, [rbp - 5]
mov edi, 0x10
lea rdx, [0x140043c70]
xor r13d, r13d
mov r8d, edi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400046f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400046e3
mov eax, eax
mov ecx, dword [r12 + rax*4 + 0x30680]
jmp 0x1400046e6
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r13b
mov qword [rsp + 0xc8], r14
cmp dword [rbp - 5], edi
jne 0x140005a46
cmp byte [0x140043c70], 0xff
jne 0x140005a46
movzx eax, word [0x140043c71]
cmp ax, word [0x140030314]
jne 0x140005a46
movzx eax, byte [0x140043c73]
cmp al, byte [0x140030316]
jne 0x140005a46
cmp byte [0x140043c79], 0xb
jne 0x140005a46
cmp byte [0x140043c7a], 3
jne 0x140005a46
cmp byte [0x140043c7b], r13b
jne 0x140005a46
lea rdx, [0x140043c70]
mov rcx, rbx
sub rdx, rbx
nop dword [rax]
movzx eax, byte [rdx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x140004770
mov rcx, qword [rsi]
lea r9, [rbp - 5]
lea r8d, [rdi + 0x2a]
mov qword [rsp + 0x20], r13
lea rdx, [0x140043c70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400047c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400047b8
mov eax, eax
mov ecx, dword [r12 + rax*4 + 0x30680]
jmp 0x1400047bb
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r13b
cmp dword [rbp - 5], 0x2a
jne 0x140005a46
movzx eax, byte [0x140043c70]
mov byte [rbx + 0x10], al
cmp byte [rbx + 0x10], 0x4d
movzx eax, byte [0x140043c71]
mov byte [rbx + 0x11], al
je 0x1400047f9
cmp byte [0x140043c71], 0x53
jne 0x140005a46
movzx eax, byte [0x140043c72]
lea r9, [rbp - 5]
mov byte [rbx + 0x12], al
lea rdx, [0x140043c70]
movzx eax, byte [0x140043c73]
mov r8d, 0x3b
mov byte [rbx + 0x13], al
movzx eax, byte [0x140043c74]
mov byte [rbx + 0x14], al
movzx eax, byte [0x140043c75]
mov byte [rbx + 0x15], al
movzx eax, byte [0x140043c76]
mov byte [rbx + 0x16], al
movzx eax, byte [0x140043c77]
mov byte [rbx + 0x17], al
movzx eax, word [0x140043c78]
mov word [rbx + 0x18], ax
mov eax, dword [0x140043c7a]
mov dword [rbx + 0x1c], eax
mov eax, dword [0x140043c7e]
mov dword [rbx + 0x20], eax
mov eax, dword [0x140043c82]
mov dword [rbx + 0x24], eax
mov eax, dword [0x140043c86]
mov dword [rbx + 0x28], eax
mov eax, dword [0x140043c8a]
mov dword [rbx + 0x2c], eax
mov eax, dword [0x140043c8e]
mov dword [rbx + 0x30], eax
mov eax, dword [0x140043c92]
mov dword [rbx + 0x34], eax
mov eax, dword [0x140043c96]
mov dword [rbx + 0x38], eax
mov rcx, qword [rsi]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400048d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400048c2
mov eax, eax
mov ecx, dword [r12 + rax*4 + 0x30680]
jmp 0x1400048c5
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r13b
cmp dword [rbp - 5], 0x3b
jne 0x140005a46
movzx eax, byte [0x140043c70]
xor r8d, r8d
mov edx, dword [rbx + 0x20]
mov rcx, rsi
mov byte [rbx + 0x3c], al
movzx eax, byte [0x140043c71]
mov byte [rbx + 0x3d], al
mov eax, dword [0x140043c72]
mov dword [rbx + 0x40], eax
movzx eax, word [0x140043c76]
mov word [rbx + 0x44], ax
mov eax, dword [0x140043c78]
mov dword [rbx + 0x48], eax
movzx eax, word [0x140043c7c]
mov word [rbx + 0x4c], ax
movzx eax, word [0x140043c7e]
mov word [rbx + 0x4e], ax
mov eax, dword [0x140043c80]
mov dword [rbx + 0x50], eax
mov eax, dword [0x140043c84]
mov dword [rbx + 0x54], eax
mov eax, dword [0x140043c88]
mov dword [rbx + 0x58], eax
mov eax, dword [0x140043c8c]
mov dword [rbx + 0x5c], eax
mov eax, dword [0x140043c90]
mov dword [rbx + 0x60], eax
mov eax, dword [0x140043c94]
mov dword [rbx + 0x64], eax
mov eax, dword [0x140043c98]
mov dword [rbx + 0x68], eax
movzx eax, word [0x140043c9c]
mov word [rbx + 0x6c], ax
movzx eax, word [0x140043c9c]
mov word [0x14003e1b8], ax
mov eax, dword [0x140043c9e]
mov dword [rbx + 0x70], eax
movzx eax, word [0x140043ca2]
mov word [rbx + 0x74], ax
mov eax, dword [0x140043ca4]
mov dword [rbx + 0x78], eax
movzx eax, word [0x140043ca8]
mov word [rbx + 0x7c], ax
movzx eax, byte [0x140043caa]
mov byte [rbx + 0x7e], al
call fcn.14002a520
cmp word [rbx + 0x44], r13w
jbe 0x1400049f0
mov edx, dword [rbx + 0x40]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
movzx r9d, word [rbx + 0x44]
lea r8, [0x14003e198]
mov edx, dword [rbx + 0x40]
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
cmp word [rbx + 0x4e], r13w
jbe 0x140004aad
mov edx, dword [rbx + 0x48]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
movzx r9d, word [rbx + 0x4e]
lea r8, [0x140042910]
mov edx, dword [rbx + 0x48]
mov rcx, rsi
shl r9w, 3
call fcn.140005b10
test ax, ax
jne 0x140005a4b
movzx edi, r13w
mov rcx, qword [0x140042910]
mov r8, rcx
mov qword [0x140040500], rcx
cmp r13w, word [rbx + 0x4e]
jge 0x140004aad
nop word [rax + rax]
movsx rax, di
inc di
lea rdx, [rax*8]
movzx eax, word [rdx + rcx]
mov word [rdx + r8], ax
mov rax, qword [0x140042910]
movzx ecx, word [rdx + rax + 2]
mov word [rdx + r8 + 2], cx
mov rax, qword [0x140042910]
movzx ecx, word [rdx + rax + 4]
mov word [rdx + r8 + 4], cx
mov rax, qword [0x140042910]
movzx ecx, word [rdx + rax + 6]
mov word [rdx + r8 + 6], cx
cmp di, word [rbx + 0x4e]
jge 0x140004aad
mov rcx, qword [0x140042910]
jmp 0x140004a50
movsx rax, word [rbx + 0x4c]
mov word [0x14003ee64], ax
lea ecx, [rax + rax*4]
add ecx, ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x140041aa8], rax
test rax, rax
jne 0x140004ada
mov eax, 4
jmp 0x140005a4b
movsx rcx, word [0x14003ee64]
shl ecx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x140042918], rax
test rax, rax
je 0x140004ad0
mov edx, dword [rbx + 0x48]
test edx, edx
je 0x140004b10
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
mov rax, qword [0x140042918]
movzx r8d, word [rbx + 0x4c]
lea r9, [rbp - 9]
mov rcx, qword [rsi]
mov rdx, rax
shl r8d, 3
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004b3f
lea rcx, [rbp - 9]
call fcn.14002a4e0
mov ecx, eax
jmp 0x140004b42
mov ecx, dword [rbp - 9]
movzx eax, word [rbx + 0x4c]
shl eax, 3
cmp ecx, eax
jne 0x140005a46
movzx eax, word [0x14003ee64]
mov r14d, 1
mov rdx, qword [0x140041aa8]
mov rcx, qword [0x140042918]
mov qword [0x14003df20], rdx
cmp r13w, ax
jge 0x140004bc8
lea rdi, [rcx + 4]
movzx r8d, ax
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi - 4]
lea rdi, [rdi + 8]
mov word [rdx + 2], ax
movzx eax, word [rdi - 0xa]
mov word [rdx], ax
movzx eax, word [rdi - 8]
mov word [rdx + 4], ax
movzx eax, word [rdi - 6]
mov word [rdx + 6], ax
mov word [rdx + 8], r14w
add rdx, 0xa
sub r8, r14
jne 0x140004b90
mov qword [0x14003df20], rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [rbx + 0x5c]
mov ecx, eax
mov dword [0x14003deec], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x140040718], rax
test rax, rax
je 0x140004ad0
mov ecx, dword [0x14003deec]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x140042918], rax
test rax, rax
je 0x140004ad0
mov edx, dword [rbx + 0x58]
test edx, edx
je 0x140004c24
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
mov rax, qword [0x140042918]
mov r8d, dword [0x14003deec]
lea r9, [rbp - 9]
mov rcx, qword [rsi]
mov rdx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004c51
lea rcx, [rbp - 9]
call fcn.14002a4e0
mov ecx, eax
jmp 0x140004c54
mov ecx, dword [rbp - 9]
mov eax, dword [0x14003deec]
cmp ecx, eax
je 0x140004c67
movzx eax, r14w
jmp 0x140005a4b
mov rdx, qword [0x140040718]
mov rcx, qword [0x140042918]
shr eax, 3
mov qword [0x1400404f8], rdx
mov word [0x140040f44], ax
cmp r13w, ax
jge 0x140004cbe
mov rdi, rcx
movzx r8d, ax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rdi]
lea rdi, [rdi + 8]
mov dword [rdx], eax
mov eax, dword [rdi - 4]
mov dword [rdx + 4], eax
add rdx, 8
sub r8, r14
jne 0x140004ca0
mov qword [0x1400404f8], rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp dword [rbx + 0x54], r13d
jbe 0x140004efd
mov edx, dword [rbx + 0x50]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
lea r8, [rbp - 9]
mov rcx, rsi
lea rdx, [0x1400400b0]
call fcn.140005bd0
test ax, ax
jne 0x140005a4b
movzx eax, word [rbp - 9]
lea r8, [rbp - 9]
lea rdx, [0x1400400b8]
mov word [0x1400411d8], ax
mov rcx, rsi
call fcn.140005bd0
test ax, ax
jne 0x140005a4b
movzx eax, word [rbp - 9]
lea r8, [rbp - 9]
lea rdx, [0x140040f80]
mov word [0x140040f40], ax
mov rcx, rsi
call fcn.140005bd0
test ax, ax
jne 0x140005a4b
movzx eax, word [rbp - 9]
lea rdx, [rbp - 9]
mov rcx, rsi
mov word [0x140040508], ax
call fcn.140005a80
test ax, ax
jne 0x140005a4b
movzx r12d, word [rbp - 9]
mov edi, 0xffff
cmp r12w, di
je 0x140004e1d
nop word [rax + rax]
lea rax, [0x140000000]
movsx rdi, r13w
movzx ecx, r12w
mov word [rax + rdi*2 + 0x40fd0], r12w
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea rcx, [0x140000000]
mov qword [rcx + rdi*8 + 0x411e0], rax
test rax, rax
je 0x140004ad0
mov rcx, qword [rsi]
lea r9, [rbp - 5]
movsx edi, r12w
mov rdx, rax
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004de5
lea rcx, [rbp - 5]
call fcn.14002a4e0
jmp 0x140004de8
mov eax, dword [rbp - 5]
cmp eax, edi
jne 0x140005424
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.140005a80
test ax, ax
jne 0x140005a4b
movzx r12d, word [rbp - 9]
inc r13w
mov edi, 0xffff
cmp r12w, di
jne 0x140004d80
lea rdx, [rbp - 9]
mov word [0x140040710], r13w
mov rcx, rsi
call fcn.140005a80
test ax, ax
jne 0x140005a4b
movzx r12d, word [rbp - 9]
xor eax, eax
movzx r13d, ax
cmp r12w, di
je 0x140004eeb
nop
lea rax, [0x140000000]
movsx rdi, r13w
movzx ecx, r12w
mov word [rax + rdi*2 + 0x40510], r12w
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea rcx, [0x140000000]
mov qword [rcx + rdi*8 + 0x40720], rax
test rax, rax
je 0x140004ad0
xor ecx, ecx
movsx edi, r12w
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 5]
mov rcx, qword [rsi]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004eb3
lea rcx, [rbp - 5]
call fcn.14002a4e0
jmp 0x140004eb6
mov eax, dword [rbp - 5]
cmp eax, edi
jne 0x140005424
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.140005a80
test ax, ax
jne 0x140005a4b
movzx r12d, word [rbp - 9]
inc r13w
mov eax, 0xffff
cmp r12w, ax
jne 0x140004e50
mov word [0x1400403f8], r13w
lea r12, [0x140000000]
xor r13d, r13d
cmp word [rbx + 0x6c], 0
jbe 0x140004f32
mov edx, dword [rbx + 0x68]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
movzx r9d, word [rbx + 0x6c]
lea r8, [0x14003e1a0]
mov edx, dword [rbx + 0x68]
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
cmp word [rbx + 0x74], 0
jbe 0x140004f67
mov edx, dword [rbx + 0x70]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
movzx r9d, word [rbx + 0x74]
lea r8, [0x140040f48]
mov edx, dword [rbx + 0x70]
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
cmp word [rbx + 0x7c], 0
jbe 0x140004f9c
mov edx, dword [rbx + 0x78]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
movzx r9d, word [rbx + 0x7c]
lea r8, [0x140040f50]
mov edx, dword [rbx + 0x78]
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
mov edx, dword [rbx + 0x24]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
mov rcx, qword [rsi]
lea r9, [rbp - 5]
mov r8d, 0x24
mov qword [rsp + 0x20], r13
lea rdx, [0x140043c70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004ff4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140004fe4
mov eax, eax
mov ecx, dword [r12 + rax*4 + 0x30680]
jmp 0x140004fe7
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rbp - 5], 0x24
jne 0x140005424
movzx eax, word [0x140043c70]
mov word [rbx + 0x80], ax
movzx eax, word [0x140043c72]
mov word [rbx + 0x82], ax
mov eax, dword [0x140043c74]
mov dword [rbx + 0x84], eax
mov eax, dword [0x140043c78]
mov dword [rbx + 0x88], eax
movzx eax, word [0x140043c7c]
mov word [rbx + 0x8c], ax
mov eax, dword [0x140043c7e]
mov dword [rbx + 0x90], eax
movzx eax, word [0x140043c82]
mov word [rbx + 0x94], ax
movzx eax, word [0x140043c84]
mov word [rbx + 0x96], ax
mov eax, dword [0x140043c86]
mov dword [rbx + 0x98], eax
movzx eax, word [0x140043c8a]
mov word [rbx + 0x9c], ax
mov eax, dword [0x140043c8c]
mov dword [rbx + 0xa0], eax
mov eax, dword [0x140043c90]
mov dword [rbx + 0xa4], eax
movzx eax, word [rbx + 0x96]
mov word [0x140040f7a], ax
movzx eax, word [rbx + 0x9c]
mov word [0x140040f7c], ax
movzx eax, word [rbx + 0x94]
mov word [0x140040f78], ax
movzx r9d, word [rbx + 0x80]
test r9w, r9w
je 0x140005122
mov edx, dword [rbx + 0x84]
lea r8, [0x14003e180]
inc r9w
mov rcx, rsi
add r9w, r9w
call fcn.140005b10
test ax, ax
jne 0x140005a4b
movzx eax, word [rbx + 0x80]
movzx ecx, r13w
inc ax
cmp r13w, ax
jge 0x140005122
nop dword [rax]
movzx eax, word [rbx + 0x80]
inc cx
inc ax
cmp cx, ax
jl 0x140005110
cmp word [rbx + 0x80], 0
jbe 0x140005152
movzx r9d, word [rbx + 0x8c]
lea r8, [0x14003e178]
mov edx, dword [rbx + 0x88]
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
movzx r9d, word [rbx + 0x94]
test r9w, r9w
je 0x14000517e
mov edx, dword [rbx + 0x90]
lea r8, [0x140040f58]
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
movzx r9d, word [rbx + 0x9c]
test r9w, r9w
je 0x1400051aa
mov edx, dword [rbx + 0x98]
lea r8, [0x140040f60]
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
movzx r9d, word [rbx + 0x96]
test r9w, r9w
je 0x1400051da
mov edx, dword [rbx + 0xa0]
lea r8, [0x140040f68]
add r9w, r9w
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
movzx r9d, word [rbx + 0x96]
test r9w, r9w
je 0x14000520a
mov edx, dword [rbx + 0xa4]
lea r8, [0x140040f70]
add r9w, r9w
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
mov edx, dword [rbx + 0x2c]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
mov rcx, qword [rsi]
lea r9, [rbp - 5]
mov r8d, 0x25
mov qword [rsp + 0x20], r13
lea rdx, [0x140043c70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140005262
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140005252
mov eax, eax
mov ecx, dword [r12 + rax*4 + 0x30680]
jmp 0x140005255
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rbp - 5], 0x25
jne 0x140004c5e
movzx eax, word [0x140043c70]
lea rdi, [0x14003df00]
mov word [rbx + 0xa8], ax
lea rdx, [0x140043c7f]
movzx eax, word [0x140043c72]
mov ecx, 0x16
mov word [rbx + 0xaa], ax
sub rdx, rdi
mov eax, dword [0x140043c74]
mov dword [rbx + 0xac], eax
movzx eax, word [0x140043c78]
mov word [rbx + 0xb0], ax
mov eax, dword [0x140043c7a]
mov word [0x140040fc4], ax
mov word [rbx + 0xb2], ax
movzx eax, word [0x140043c7c]
mov word [0x140040fc6], ax
mov word [rbx + 0xb4], ax
mov eax, dword [0x140043c7e]
mov byte [0x140040fc8], al
mov byte [rbx + 0xb6], al
movzx eax, byte [rdi + rdx]
dec ecx
mov byte [rdi], al
inc rdi
test al, al
je 0x140005308
test ecx, ecx
jne 0x1400052f3
jmp 0x140005310
test ecx, ecx
jle 0x140005310
xor eax, eax
rep stosb byte [rdi], al
movzx r9d, word [rbx + 0xa8]
test r9w, r9w
je 0x140005374
mov edx, dword [rbx + 0xac]
lea r8, [0x140040fa0]
inc r9w
mov word [0x140040714], r14w
add r9w, r9w
mov rcx, rsi
call fcn.140005b10
test ax, ax
jne 0x140005a4b
movzx eax, word [rbx + 0xa8]
movzx ecx, r13w
inc ax
cmp r13w, ax
jge 0x14000537c
movzx eax, word [rbx + 0xa8]
inc cx
inc ax
cmp cx, ax
jl 0x140005360
jmp 0x14000537c
mov word [0x140040714], r13w
movzx ecx, word [rbx + 0x82]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x14003e190], rax
test rax, rax
je 0x140004ad0
cmp word [rbx + 0xa8], 0
jbe 0x1400053c0
movzx ecx, word [rbx + 0xaa]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x140040fb0], rax
test rax, rax
je 0x140004ad0
mov edx, dword [rbx + 0x34]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
cmp byte [rbx + 0x7e], 0
lea r9, [rbp - 5]
mov rcx, qword [rsi]
lea rdx, [0x140043c70]
mov qword [rsp + 0x20], r13
jne 0x14000542e
mov r8d, 0x3c
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000541e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000540e
mov eax, eax
mov ecx, dword [r12 + rax*4 + 0x30680]
jmp 0x140005411
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rbp - 5], 0x3c
je 0x140005475
mov eax, 3
jmp 0x140005a4b
mov r8d, 0x56
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140005465
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140005455
mov eax, eax
mov ecx, dword [r12 + rax*4 + 0x30680]
jmp 0x140005458
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rbp - 5], 0x56
je 0x140005475
mov eax, 3
jmp 0x140005a4b
movzx eax, word [0x140043c70]
movzx ecx, byte [rbx + 0x7e]
mov word [rbx + 0xb8], ax
movzx eax, word [0x140043c72]
mov word [rbx + 0xba], ax
movzx eax, word [0x140043c74]
mov word [rbx + 0xbc], ax
movzx eax, word [0x140043c76]
mov word [rbx + 0xbe], ax
movzx eax, word [0x140043c78]
mov word [rbx + 0xc0], ax
movzx eax, word [0x140043c7a]
mov word [rbx + 0xc2], ax
movzx eax, word [0x140043c7c]
mov word [rbx + 0xc4], ax
movzx eax, word [0x140043c7e]
mov word [rbx + 0xc6], ax
movzx eax, word [0x140043c80]
mov word [rbx + 0xc8], ax
test cl, cl
jne 0x140005517
mov qword [rbx + 0xca], 0
mov word [rbx + 0xd2], r13w
movzx eax, word [0x140043c82]
jmp 0x140005564
movzx eax, word [0x140043c82]
mov word [rbx + 0xca], ax
movzx eax, word [0x140043c84]
mov word [rbx + 0xcc], ax
movzx eax, word [0x140043c86]
mov word [rbx + 0xce], ax
movzx eax, word [0x140043c88]
mov word [rbx + 0xd0], ax
movzx eax, word [0x140043c8a]
mov word [rbx + 0xd2], ax
movzx eax, word [0x140043c8c]
mov word [rbx + 0xd4], ax
test cl, cl
jne 0x140005600
mov eax, dword [0x140043c84]
mov dword [rbx + 0xd8], eax
mov eax, dword [0x140043c88]
mov dword [rbx + 0xdc], eax
mov eax, dword [0x140043c8c]
mov dword [rbx + 0xe0], eax
mov eax, dword [0x140043c90]
mov dword [rbx + 0xe4], eax
mov eax, dword [0x140043c94]
mov dword [rbx + 0xe8], eax
mov eax, dword [0x140043c98]
mov dword [rbx + 0xec], eax
mov eax, dword [0x140043c9c]
mov dword [rbx + 0xf0], eax
mov eax, dword [0x140043ca0]
mov dword [rbx + 0xf4], eax
mov eax, dword [0x140043ca4]
mov dword [rbx + 0xf8], eax
mov qword [rbx + 0xfc], 0
mov qword [rbx + 0x104], 0
mov eax, dword [0x140043ca8]
jmp 0x1400056a2
mov eax, dword [0x140043c8e]
mov dword [rbx + 0xd8], eax
mov eax, dword [0x140043c92]
mov dword [rbx + 0xdc], eax
mov eax, dword [0x140043c96]
mov dword [rbx + 0xe0], eax
mov eax, dword [0x140043c9a]
mov dword [rbx + 0xe4], eax
mov eax, dword [0x140043c9e]
mov dword [rbx + 0xe8], eax
mov eax, dword [0x140043ca2]
mov dword [rbx + 0xec], eax
mov eax, dword [0x140043ca6]
mov dword [rbx + 0xf0], eax
mov eax, dword [0x140043caa]
mov dword [rbx + 0xf4], eax
mov eax, dword [0x140043cae]
mov dword [rbx + 0xf8], eax
mov eax, dword [0x140043cb2]
mov dword [rbx + 0xfc], eax
mov eax, dword [0x140043cb6]
mov dword [rbx + 0x100], eax
mov eax, dword [0x140043cba]
mov dword [rbx + 0x104], eax
mov eax, dword [0x140043cbe]
mov dword [rbx + 0x108], eax
mov eax, dword [0x140043cc2]
mov dword [rbx + 0x10c], eax
lea r14, [0x140000000]
mov rcx, r13
movzx eax, byte [rcx + r14 + 0x302f8]
mov byte [rbp + rcx + 7], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400056b2
lea rcx, [rbp + 7]
call fcn.14002a700
mov edx, 0xa
mov rcx, rax
mov rdi, rax
call fcn.14002a380
mov qword [0x1400411d0], rax
test rax, rax
je 0x140005424
mov rcx, rdi
call fcn.14002a780
mov edx, dword [rbx + 0x38]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
mov r12d, dword [rbx + 0x38]
cmp r12d, dword [rbx + 0x28]
jae 0x1400058a3
nop dword [rax]
nop dword [rax + rax]
mov edi, dword [rbx + 0x28]
lea rdx, [0x140043c70]
mov rcx, qword [rsi]
sub edi, r12d
mov qword [rsp + 0x20], r13
cmp edi, 0x100
jbe 0x1400057ed
lea r9, [rbp - 5]
mov r8d, 0x100
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000577c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000576c
mov eax, eax
mov ecx, dword [r14 + rax*4 + 0x30680]
jmp 0x14000576f
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov r14d, dword [rbp - 5]
cmp r14d, 0x100
jne 0x1400059c0
mov rcx, qword [0x1400411d0]
lea r9, [rbp - 9]
mov r8d, r14d
mov qword [rsp + 0x20], r13
lea rdx, [0x140043c70]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400057e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400057d1
mov eax, eax
lea rcx, [0x140000000]
mov ecx, dword [rcx + rax*4 + 0x30680]
jmp 0x1400057d4
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rbp - 9], 0x100
jmp 0x140005889
lea r9, [rbp - 1]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140005825
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140005815
mov eax, eax
mov ecx, dword [r14 + rax*4 + 0x30680]
jmp 0x140005818
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov r14d, dword [rbp - 1]
cmp r14d, edi
jne 0x1400059c0
mov rcx, qword [0x1400411d0]
lea r9, [rbp + 3]
mov r8d, edi
mov qword [rsp + 0x20], r13
lea rdx, [0x140043c70]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140005886
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140005876
mov eax, eax
lea rcx, [0x140000000]
mov ecx, dword [rcx + rax*4 + 0x30680]
jmp 0x140005879
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rbp + 3], edi
jne 0x1400059c0
add r12d, r14d
lea r14, [0x140000000]
cmp r12d, dword [rbx + 0x28]
jb 0x140005720
mov rcx, qword [0x1400411d0]
call fcn.14002a1e0
mov rcx, r13
movzx eax, byte [rcx + r14 + 0x30308]
mov byte [rbp + rcx + 7], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400058b2
lea rcx, [rbp + 7]
call fcn.14002a700
mov edx, 0xa
mov rcx, rax
mov rdi, rax
call fcn.14002a380
mov qword [0x140040f88], rax
test rax, rax
je 0x140005424
mov rcx, rdi
call fcn.14002a780
mov edx, dword [rbx + 0x30]
xor r8d, r8d
mov rcx, rsi
call fcn.14002a520
nop word [rax + rax]
mov rcx, qword [rsi]
lea r9, [rbp + 3]
mov r8d, 0x100
mov qword [rsp + 0x20], r13
lea rdx, [0x140043c70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000595a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x14000594a
mov eax, eax
mov ecx, dword [r14 + rax*4 + 0x30680]
jmp 0x14000594d
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov edi, dword [rbp + 3]
cmp edi, 0x100
jne 0x1400059c8
mov rcx, qword [0x140040f88]
lea r9, [rbp - 1]
mov r8d, edi
mov qword [rsp + 0x20], r13
lea rdx, [0x140043c70]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400059b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400059a3
mov eax, eax
mov ecx, dword [r14 + rax*4 + 0x30680]
jmp 0x1400059a6
mov ecx, r15d
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rbp - 1], 0x100
je 0x140005910
or eax, 0xffffffff
jmp 0x140005a4b
test edi, edi
jle 0x140005a1b
mov rcx, qword [0x140040f88]
lea r9, [rbp - 1]
mov r8d, edi
mov qword [rsp + 0x20], r13
lea rdx, [0x140043c70]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140005a16
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140005a08
mov eax, eax
mov r15d, dword [r14 + rax*4 + 0x30680]
mov dword [0x140042de8], r15d
mov byte [0x1400433b0], 0
cmp dword [rbp - 1], edi
jne 0x1400059c0
mov rcx, qword [0x140040f88]
call fcn.14002a1e0
movzx ecx, word [rbx + 0x6c]
mov r9, qword [0x14003e198]
movzx edx, byte [rbx + 0x3d]
mov word [rsp + 0x20], cx
call fcn.140005ca0
movzx eax, r13w
jmp 0x140005a4b
mov eax, 1
mov r14, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14002c160
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret