Function at 0x4ad11db8
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf10
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0xf00], rax
mov rdi, rcx
mov r12, rdx
mov qword [rsp + 0x50], rdx
lea rcx, [rsp + 0x2c4]
xor edx, edx
mov r8d, 0x204
mov dword [rsp + 0x2c0], 0x20
call sub.msvcrt.dll_memset
mov rax, qword [r12 + 0x40]
xor r15d, r15d
or esi, 0xffffffff
lea r14d, [rsi + 2]
mov dword [rsp + 0x40], esi
mov r13d, r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x80], r15d
mov dword [rsp + 0x5c], r15d
mov dword [rsp + 0x84], r14d
cmp rax, r15
je 0x4ad1c2f5
mov eax, dword [rax + 0x38]
shr eax, 1
mov ebx, 0x80
lea r8, [rsp + 0x64]
and eax, 8
xor r9d, r9d
mov ecx, 0xfe00
mov edx, ebx
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x6c], eax
call fcn.4ad11494
mov qword [rsp + 0x88], rax
cmp rax, r15
je 0x4ad1c2ff
cmp dword [0x4ad2e160], r15d
jne 0x4ad1c307
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x78], rax
mov rdi, qword [rdi + 0x40]
cmp rdi, r15
je 0x4ad123c3
mov ebp, dword [rsp + 0x58]
mov dword [rsp + 0x4c], ebp
mov rcx, qword [rdi]
mov rbx, qword [rdi + 0x30]
call fcn.4ad02e40
lea rcx, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
lea r8d, [r9 + 0x21]
lea rcx, [0x4ad04960]
mov rdx, rax
mov qword [rsp + 0x20], rbx
call fcn.4ad04688
cmp al, r15b
je 0x4ad1c32a
mov r14, qword [rsp + 0xa0]
cmp dword [0x4ad2e19c], r15d
jne 0x4ad1ce15
lea rdx, [rsp + 0xcf0]
mov r8d, 0x104
mov rcx, rdi
call fcn.4ad11520
mov ebx, 1
cmp eax, ebx
je 0x4ad1ce06
cmp dword [0x4ad2e1bc], r15d
je 0x4ad12b51
mov eax, dword [0x4ad2e16c]
test byte [rdi + 0x38], 8
jne 0x4ad12b65
cmp eax, 3
je 0x4ad12b65
lea r8, [rsp + 0xb0]
mov r9d, 0x104
mov rdx, r12
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.4ad12480
cmp eax, ebx
je 0x4ad1ce06
cmp dword [0x4ad2e16c], 3
je 0x4ad1c3ab
cmp word [rsp + 0xb0], r15w
je 0x4ad12387
mov rcx, qword [rdi + 8]
xor edx, edx
mov r9d, ebx
lea r8d, [rdx + 3]
call fcn.4ad11788
mov r13d, eax
cmp eax, 0xffffffff
je 0x4ad1c400
mov ecx, eax
call fcn.4ad03380
cmp eax, r15d
jne 0x4ad1c46b
cmp dword [0x4ad2e160], r15d
jne 0x4ad1c48f
mov r15d, dword [rsp + 0x64]
mov dword [rsp + 0x4c], r15d
mov eax, dword [rdi + 0x38]
test al, 4
je 0x4ad12b87
and eax, 0xfffffffb
mov dword [rdi + 0x38], eax
test al, al
js 0x4ad1c4a1
or eax, ebx
mov dword [rdi + 0x38], eax
xor eax, eax
cmp byte [0x4ad2e0ca], al
je 0x4ad1c4a9
mov r8, qword [rdi + 8]
lea rcx, [rsp + 0x8e0]
mov edx, 0x208
call fcn.4ad045b0
lea rcx, [rsp + 0xb0]
mov ebp, eax
call fcn.4ad02e40
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov r8d, 0x200
mov ecx, r13d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call fcn.4ad116c4
xor r8d, r8d
mov r12d, eax
cmp dword [0x4ad2e13c], r8d
jne 0x4ad1c4db
mov ebx, dword [0x4ad2e16c]
mov edx, dword [0x4ad2e1bc]
cmp ebx, 3
je 0x4ad1c512
cmp ebp, r8d
jne 0x4ad1c520
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x8e0]
call fcn.4ad12404
mov edx, dword [0x4ad2e1bc]
xor r8d, r8d
jmp 0x4ad120a1
cmp eax, r8d
jne 0x4ad1c528
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov rcx, qword [rbx + 0x40]
mov dword [0x4ad2e10c], eax
cmp rcx, r8
je 0x4ad120fa
cmp edx, r8d
je 0x4ad120fa
mov dword [0x4ad2e110], eax
mov dword [0x4ad2e13c], r8d
call fcn.4ad0b410
mov ecx, dword [0x4ad2e13c]
cmp ecx, 0x15
je 0x4ad1cdbf
cmp ecx, 0x458
je 0x4ad1cdbf
mov eax, 1
lea r8, [rsp + 0xb0]
mov r9d, 0x104
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.4ad12480
cmp eax, 1
je 0x4ad1cdc6
xor eax, eax
cmp word [rsp + 0xb0], ax
je 0x4ad1c5c1
cmp ebp, eax
jne 0x4ad12149
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x8e0]
call fcn.4ad12404
xor ebp, ebp
cmp eax, ebp
jne 0x4ad1c5d4
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, dword [rsp + 0x5c]
mov ebx, dword [0x4ad2e16c]
xor r8d, r8d
mov r11d, eax
cmp ebp, r8d
jne 0x4ad12b90
cmp dword [rsp + 0x84], r8d
je 0x4ad1c63f
mov ecx, r8d
mov dword [rsp + 0x60], ecx
cmp eax, 0xffffffff
jne 0x4ad12940
mov dword [rsp + 0x84], r8d
jmp 0x4ad121a2
and dword [rdi + 0x38], 0xfffffffb
mov eax, dword [rdi + 0x38]
cmp byte [0x4ad2e0ca], r8b
je 0x4ad1c648
mov rdx, qword [rsp + 0x50]
cmp ecx, r8d
jne 0x4ad1c692
mov ecx, 1
cmp dword [0x4ad2e1bc], r8d
je 0x4ad121ee
mov rax, qword [rdx + 0x40]
cmp rax, r8
je 0x4ad121e5
test byte [rax + 0x38], 8
jne 0x4ad12a43
cmp ebx, 3
je 0x4ad1c6a4
test r11b, 6
je 0x4ad1298c
or esi, 0xffffffff
mov dword [0x4ad2e13c], 5
mov dword [rsp + 0x40], esi
jmp 0x4ad1220b
mov dword [rsp + 0x68], r8d
cmp esi, 0xffffffff
jne 0x4ad12952
mov dword [rsp + 0x58], r8d
jmp 0x4ad12220
mov ecx, 1
cmp dword [rsp + 0x80], ecx
je 0x4ad1c6e1
mov eax, dword [rdi + 0x38]
test al, 8
jne 0x4ad12242
cmp ebx, 3
je 0x4ad1c705
mov eax, dword [rdi + 0x38]
test al, 8
jne 0x4ad12b9a
mov eax, dword [rdi + 0x38]
mov rbp, qword [rsp + 0x88]
mov edx, 0x8002
and eax, edx
cmp eax, edx
je 0x4ad1c73e
cmp ebx, 3
je 0x4ad1ca97
mov ebx, dword [rdi + 0x38]
test cl, bl
je 0x4ad1ca97
and ebx, 0x800
cmp esi, 0xffffffff
jne 0x4ad12979
bt dword [rdi + 0x38], 0xa
mov rcx, qword [rdi + 8]
jb 0x4ad1c755
mov r10, qword [0x4ad2e2c0]
xor r12d, r12d
lea rdx, [rsp + 0xb0]
cmp r10, r12
je 0x4ad1c7af
mov eax, ebx
xor r9d, r9d
xor r8d, r8d
or eax, dword [rsp + 0x6c]
mov dword [rsp + 0x28], eax
lea rax, [0x4ad2e19c]
mov qword [rsp + 0x20], rax
call r10
cmp eax, r12d
je 0x4ad1c7bf
cmp dword [rsp + 0x68], r12d
jne 0x4ad1ca2a
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad1230d
and eax, 0xfffffffe
lea rcx, [rsp + 0xb0]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, 1
cmp dword [0x4ad2e160], r12d
jne 0x4ad1c869
xor r15d, r15d
jmp 0x4ad12324
mov rax, qword [rdi + 0x30]
mov dword [0x4ad2e138], r15d
mov rcx, qword [rax + 0x14]
mov qword [rsp + 0xa8], rcx
mov ecx, r13d
call fcn.4ad0319c
cmp dword [0x4ad2e16c], 3
je 0x4ad12377
cmp dword [0x4ad2e19c], r15d
jne 0x4ad1ca37
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0xa8]
mov r8d, esi
mov rcx, rdi
call fcn.4ad11600
mov dword [0x4ad2e1c0], ebx
mov r12, qword [rsp + 0x50]
mov dword [0x4ad2e1bc], r15d
mov ebp, dword [rsp + 0x4c]
mov r13d, dword [rsp + 0x48]
mov rdx, qword [rdi + 0x30]
lea rcx, [0x4ad04960]
mov r9, r14
mov r8d, 0x21
call fcn.4ad0b630
cmp al, r15b
jne 0x4ad11ef9
mov rcx, r14
call fcn.4ad0478c
mov rdi, qword [rdi + 0x40]
cmp rdi, r15
jne 0x4ad11eb4
cmp dword [0x4ad2e16c], 3
je 0x4ad1cd38
mov eax, r13d
mov rcx, qword [rsp + 0xf00]
xor rcx, rsp
call fcn.4ad01000
mov rbx, qword [rsp + 0xf60]
add rsp, 0xf10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test al, 0x10
lea eax, [r8 + 1]
cmovne ecx, eax
mov dword [rsp + 0x60], ecx
jmp 0x4ad12198
mov ebx, 1
mov ecx, esi
mov dword [rsp + 0x58], ebx
call fcn.4ad03380
xor r8d, r8d
cmp eax, r8d
jne 0x4ad1c6be
mov ebx, dword [0x4ad2e16c]
jmp 0x4ad12220
mov ecx, esi
call fcn.4ad0319c
or esi, 0xffffffff
mov dword [rsp + 0x40], esi
jmp 0x4ad1228a
bt dword [rdi + 0x38], 0xa
jb 0x4ad1220b
lea rcx, [rsp + 0xb0]
call fcn.4ad129c0
mov ebx, dword [0x4ad2e16c]
xor r8d, r8d
mov esi, eax
mov dword [rsp + 0x40], eax
jmp 0x4ad1220b
cmp qword [rdi + 0x40], r8
cmove ebx, ecx
mov dword [0x4ad2e16c], ebx
jmp 0x4ad121e5
mov eax, dword [0x4ad2e16c]
cmp eax, 3
jne 0x4ad11f3c
jmp 0x4ad1c34e
mov rdx, qword [rdi + 8]
lea rcx, str._s_r_n
call fcn.4ad05fc4
cmp dword [0x4ad2e16c], 3
jne 0x4ad11f4f
jmp 0x4ad1c399
mov dword [rsp + 0x5c], eax
jmp 0x4ad12002
mov rdx, qword [rsp + 0x50]
jmp 0x4ad121c4
cmp ebx, 3
jne 0x4ad1224d
jmp 0x4ad1c71c
mov eax, dword [r12 + 0x38]
jmp 0x4ad11e48
mov eax, r14d
jmp 0x4ad123d3
mov ecx, dword [rsp + 0x64]
lea r8, [rsp + 0x58]
mov r9d, r14d
mov edx, ebx
call fcn.4ad11494
mov qword [rsp + 0x78], rax
cmp rax, r15
jne 0x4ad11e9f
jmp 0x4ad1c2ff
cmp dword [0x4ad2e16c], 3
jne 0x4ad1cd58
cmp dword [0x4ad2e1bc], r15d
jne 0x4ad1cd58
mov r13d, dword [rsp + 0x48]
jmp 0x4ad123b6
mov rbx, qword [rdi + 8]
lea r8, [rsp + 0x2c0]
lea rcx, [rsp + 0x4d0]
mov edx, 0x208
call fcn.4ad045b0
cmp eax, r15d
jne 0x4ad1c383
lea rdx, [rsp + 0x4d0]
mov rcx, rbx
call fcn.4ad24700
jmp 0x4ad1c386
mov eax, r15d
cmp eax, r15d
jne 0x4ad12387
mov ebx, 1
jmp 0x4ad11f36
cmp dword [0x4ad2e1bc], r15d
jne 0x4ad11f4f
jmp 0x4ad11f91
lea r8, [rsp + 0xb0]
lea rax, [rsp + 0x2c0]
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0x2c0]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r15
je 0x4ad1c3ee
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x4ad1c3ee
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x4ad1c3cb
cmp rdx, r15
jne 0x4ad1c3f7
sub rcx, 2
mov word [rcx], r15w
jmp 0x4ad11f82
mov ecx, dword [0x4ad2e13c]
call fcn.4ad110f8
cmp dword [0x4ad2e16c], 3
jne 0x4ad1c45f
cmp esi, r13d
jne 0x4ad1c45f
mov rbx, qword [rdi + 8]
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0x4d0]
mov edx, 0x208
call fcn.4ad045b0
cmp eax, r15d
jne 0x4ad1c44e
lea rdx, [rsp + 0x4d0]
mov rcx, rbx
call fcn.4ad24700
jmp 0x4ad1c451
mov eax, r15d
cmp eax, r15d
jne 0x4ad1cd98
mov ebx, 1
mov r13d, ebx
mov dword [rsp + 0x48], ebx
jmp 0x4ad1238c
bts dword [rdi + 0x38], 7
mov eax, dword [rdi + 0x38]
mov r15d, 0x80
test bl, al
je 0x4ad11fd6
and eax, 0xfffffffe
or eax, 4
mov dword [rdi + 0x38], eax
jmp 0x4ad11fd6
cmp dword [rsp + 0x64], ebp
mov r15d, ebp
cmovb r15d, dword [rsp + 0x64]
jmp 0x4ad11fd1
or eax, 2
jmp 0x4ad11ff1
cmp dword [0x4ad2e1bc], eax
je 0x4ad12002
mov eax, dword [rdi + 0x38]
test al, 8
jne 0x4ad12002
cmp dword [0x4ad2e16c], 3
jne 0x4ad12002
and eax, 0xfffffffe
or eax, 2
mov dword [rdi + 0x38], eax
jmp 0x4ad12002
mov ecx, r13d
call fcn.4ad0319c
mov ecx, 0x6e
call fcn.4ad110f8
cmp dword [0x4ad2e16c], 3
je 0x4ad1cdad
mov r12, qword [rsp + 0x50]
mov ebp, dword [rsp + 0x4c]
mov r13d, ebx
mov dword [rsp + 0x48], ebx
xor r15d, r15d
jmp 0x4ad1238c
cmp edx, r8d
jne 0x4ad12078
jmp 0x4ad1c6d8
mov eax, r8d
jmp 0x4ad120a1
test byte [rdi + 0x38], 0x80
jne 0x4ad120aa
mov ecx, r13d
call fcn.4ad0319c
mov rbp, qword [rsp + 0x88]
mov r8d, dword [0x4ad2e1bc]
lea rdx, [rsp + 0x40]
mov r9, rbp
mov rcx, rdi
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
call fcn.4ad23dc0
xor r15d, r15d
cmp dword [0x4ad2e1bc], r15d
je 0x4ad1c59d
cmp dword [0x4ad2e16c], 3
jne 0x4ad1c592
and dword [rdi + 0x38], 0xfffffffe
mov ecx, dword [rsp + 0x5c]
mov eax, dword [rdi + 0x38]
cmp ecx, r15d
jne 0x4ad1c58d
or eax, 2
jmp 0x4ad1c58f
or eax, ecx
mov dword [rdi + 0x38], eax
mov dword [rsp + 0x80], 1
mov eax, dword [rdi + 0x38]
mov ecx, 0x8002
and eax, ecx
cmp eax, ecx
jne 0x4ad1c5b8
lea rdx, [rsp + 0x44]
mov rcx, rbp
call fcn.4ad2459c
mov esi, dword [rsp + 0x40]
jmp 0x4ad12377
mov ecx, r13d
call fcn.4ad0319c
mov r12, rbx
xor r15d, r15d
jmp 0x4ad12383
test byte [rdi + 0x38], 0x80
jne 0x4ad12153
mov ecx, r13d
call fcn.4ad0319c
mov r8d, dword [0x4ad2e1bc]
cmp r8d, ebp
je 0x4ad1c617
mov rax, qword [rbx + 0x40]
cmp rax, rbp
je 0x4ad1c617
test byte [rax + 0x38], 8
je 0x4ad1c617
mov eax, dword [0x4ad2e16c]
cmp qword [rdi + 0x40], rbp
lea ecx, [rbp + 1]
cmove eax, ecx
mov dword [0x4ad2e16c], eax
mov r9, qword [rsp + 0x88]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
call fcn.4ad23dc0
mov esi, dword [rsp + 0x40]
jmp 0x4ad12153
mov ecx, dword [rsp + 0x60]
jmp 0x4ad121a2
test al, 8
je 0x4ad121b6
cmp ebx, 3
jne 0x4ad121b6
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x70], ebx
cmp ecx, r8d
jne 0x4ad121c4
mov rcx, qword [rdx + 0x40]
cmp rcx, r8
je 0x4ad1c687
test byte [rcx + 0x38], 8
je 0x4ad1c687
lea ecx, [rbx - 2]
or eax, ecx
mov dword [rdi + 0x38], eax
jmp 0x4ad121c9
or eax, 2
mov dword [rdi + 0x38], eax
jmp 0x4ad121c4
cmp dword [rsp + 0x70], 3
mov ecx, 1
jne 0x4ad121c9
jmp 0x4ad1c67d
cmp ebp, r8d
jne 0x4ad1c6b6
and dword [rdi + 0x38], 0xfffffffe
or dword [rdi + 0x38], 2
jmp 0x4ad121ee
mov dword [rdi + 0x38], ebp
jmp 0x4ad121ee
mov dword [rsp + 0x68], ebx
cmp ebp, r8d
jne 0x4ad1296e
and dword [rdi + 0x38], 0xfffffffe
or dword [rdi + 0x38], 2
jmp 0x4ad1296e
mov ebp, dword [rsp + 0x5c]
jmp 0x4ad12220
cmp ebx, 3
jne 0x4ad12232
and dword [rdi + 0x38], 0xfffffffe
mov eax, dword [rdi + 0x38]
cmp ebp, r8d
jne 0x4ad1c6fb
or eax, 2
jmp 0x4ad1c6fd
or eax, ebp
mov dword [rdi + 0x38], eax
jmp 0x4ad12232
cmp ebp, r8d
jne 0x4ad12242
and eax, 0xfffffffe
or eax, 2
mov dword [rdi + 0x38], eax
jmp 0x4ad12242
cmp dword [rsp + 0x60], r8d
jne 0x4ad1224d
cmp ebp, r8d
jne 0x4ad1224d
and eax, 0xfffffffe
or eax, 2
mov dword [rdi + 0x38], eax
jmp 0x4ad1224d
lea rdx, [rsp + 0x44]
mov rcx, rbp
call fcn.4ad2459c
mov ecx, 1
jmp 0x4ad12267
call fcn.4ad251bc
xor r12d, r12d
cmp eax, r12d
jne 0x4ad1c777
lea rcx, [rsp + 0xb0]
call fcn.4ad251bc
mov ecx, r12d
cmp eax, r12d
je 0x4ad1c77c
mov ecx, 1
mov eax, ebx
movsxd r9, ecx
mov rcx, qword [rdi + 8]
or eax, dword [rsp + 0x6c]
lea r8, [0x4ad23d0c]
lea rdx, [rsp + 0xb0]
or eax, 2
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
call qword [0x4ad2e2c0]
jmp 0x4ad122d3
mov r8d, dword [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4ad122d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, 1
xor r15d, r15d
mov dword [0x4ad2e13c], eax
cmp eax, ebp
jne 0x4ad1c7f2
cmp ebx, r15d
je 0x4ad1c7f2
mov rcx, qword [rdi + 0x30]
mov edx, 0x40002730
bt dword [rcx], 0xa
cmovb eax, edx
mov dword [0x4ad2e13c], eax
mov ecx, r13d
call fcn.4ad0319c
cmp dword [rsp + 0x68], r15d
mov ecx, dword [0x4ad2e13c]
mov eax, 0x1d
mov ebx, r15d
mov dword [0x4ad2e138], r15d
cmovne ebx, eax
cmp ecx, r15d
mov eax, 0x70
cmove ecx, eax
mov dword [0x4ad2e13c], ecx
cmp dword [0x4ad2e19c], r15d
je 0x4ad1c836
mov ebx, r15d
jmp 0x4ad1c840
cmp ebx, r15d
jne 0x4ad1c840
call fcn.4ad110f8
cmp dword [rsp + 0x58], r15d
jne 0x4ad1cdd8
mov rbx, rbp
mov r12, qword [rsp + 0x50]
mov ebp, dword [rsp + 0x4c]
mov r13d, ebx
mov dword [rsp + 0x48], ebx
mov dword [0x4ad2e1c0], ebx
jmp 0x4ad1238c
lea r8d, [rbx + 2]
lea rcx, [rsp + 0xb0]
xor r9d, r9d
mov edx, ebx
call fcn.4ad11788
mov esi, eax
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
jne 0x4ad1c8a3
lea r8, [rsp + 0xb0]
mov edx, ebx
mov ecx, 0x4000271f
call fcn.4ad0b8b0
jmp 0x4ad1231f
mov ecx, eax
call fcn.4ad03380
mov ecx, esi
cmp eax, r12d
jne 0x4ad1ca86
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp eax, r12d
je 0x4ad1ca70
mov ecx, esi
call fcn.4ad0319c
xor edx, edx
lea rcx, [rsp + 0xb0]
lea r8d, [rdx + 3]
mov r9d, ebx
call fcn.4ad11788
mov esi, eax
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
je 0x4ad1c88a
mov ecx, eax
call fcn.4ad03380
cmp eax, r12d
jne 0x4ad1ca70
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea rdx, [rsp + 0x94]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, esi
mov ebx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea rdx, [rsp + 0x98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp ebx, eax
jne 0x4ad1ca6b
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x94], eax
jne 0x4ad1ca6b
mov ebx, r12d
mov r12, qword [rsp + 0x78]
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov r8d, r15d
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, esi
test eax, eax
je 0x4ad1ca1e
cmp dword [rsp + 0x44], 0
je 0x4ad1ca1e
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r8d, dword [rsp + 0x44]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov rcx, rax
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad1ca55
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x90], eax
jne 0x4ad1ca55
cmp r15d, eax
mov ecx, 1
mov r8, rax
cmovne ebx, ecx
mov rcx, rbp
mov rdx, r12
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x4ad1ca55
test ebx, ebx
je 0x4ad1c991
mov ecx, esi
call fcn.4ad0319c
or esi, 0xffffffff
mov dword [rsp + 0x40], esi
xor r15d, r15d
mov ebx, 1
jmp 0x4ad12324
mov ecx, esi
call fcn.4ad0319c
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x48], ebx
jmp 0x4ad12371
mov ecx, esi
call fcn.4ad0319c
or esi, 0xffffffff
lea ebx, [rsi + 2]
mov dword [rsp + 0x40], esi
jmp 0x4ad1c88a
mov ebx, 1
lea r8, [rsp + 0xb0]
mov edx, ebx
mov ecx, 0x4000271f
call fcn.4ad0b8b0
mov ecx, esi
call fcn.4ad0319c
or esi, 0xffffffff
mov dword [rsp + 0x40], esi
jmp 0x4ad1231f
cmp esi, 0xffffffff
je 0x4ad1cb03
mov ecx, esi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ebx, ebx
cmp dword [0x4ad2e1bc], ebx
jne 0x4ad1cae7
cmp dword [0x4ad2e16c], 3
jne 0x4ad1cae7
test byte [rdi + 0x38], 2
je 0x4ad1cae7
bt dword [rdi + 0x38], 0xe
jae 0x4ad1cae7
mov eax, dword [rsp + 0x44]
lea rdx, [rbp + 2]
mov rcx, rbp
add eax, 0xfffffffe
mov r8d, eax
mov dword [rsp + 0x44], eax
call sub.msvcrt.dll_memmove
bt dword [rdi + 0x38], 0xe
jae 0x4ad1cb6b
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + 0x40]
cmp rax, rbx
je 0x4ad1cb66
bts dword [rax + 0x38], 0xe
jmp 0x4ad1cb6b
xor r9d, r9d
lea rcx, [rsp + 0xb0]
lea ebx, [r9 + 1]
lea r8d, [r9 + 3]
mov edx, ebx
call fcn.4ad11788
mov esi, eax
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
jne 0x4ad1caad
mov ecx, r13d
call fcn.4ad0319c
xor r15d, r15d
cmp dword [0x4ad2e114], r15d
jne 0x4ad1cb47
mov ecx, dword [0x4ad2e13c]
call fcn.4ad110f8
cmp dword [0x4ad2e16c], 3
jne 0x4ad1c84e
mov rcx, r14
call fcn.4ad0478c
mov edx, ebx
xor ecx, ecx
call fcn.4ad2477c
int3
bts dword [rcx + 0x38], 0xe
mov eax, dword [0x4ad2e138]
cmp eax, ebx
je 0x4ad1cbf3
mov r8d, dword [rsp + 0x44]
xor r15d, r15d
cmp r8d, r15d
jle 0x4ad1ca2d
lea r9, [rsp + 0xb0]
mov rdx, rbp
mov ecx, esi
mov dword [rsp + 0x20], r13d
call fcn.4ad24604
cmp dword [0x4ad2e160], r15d
je 0x4ad1ca2d
mov ecx, esi
call fcn.4ad03380
cmp eax, r15d
jne 0x4ad1ca2d
mov rax, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
mov r9, rbp
mov qword [rsp + 0x20], rax
call fcn.4ad2497c
lea ebx, [r15 + 1]
cmp eax, ebx
je 0x4ad1cde2
mov esi, dword [rsp + 0x40]
jmp 0x4ad12324
mov ecx, 1
cmp r12d, ecx
jne 0x4ad1cc9f
mov r8d, dword [rsp + 0x44]
lea r9, [rsp + 0xb0]
mov rdx, rbp
mov ecx, esi
mov dword [rsp + 0x20], r13d
call fcn.4ad24604
cmp dword [0x4ad2e160], ebx
je 0x4ad1cc65
mov ecx, esi
call fcn.4ad03380
cmp eax, ebx
jne 0x4ad1cc65
mov rax, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
mov r9, rbp
mov qword [rsp + 0x20], rax
call fcn.4ad2497c
mov esi, 1
cmp eax, esi
je 0x4ad1cdf4
mov esi, dword [rsp + 0x40]
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0x44]
mov r8d, r15d
mov qword [rsp + 0x30], rax
mov rdx, rbp
mov ecx, r13d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call fcn.4ad116c4
mov r12d, eax
mov eax, dword [0x4ad2e138]
cmp eax, ebx
je 0x4ad1cbf3
xor r15d, r15d
cmp eax, r15d
je 0x4ad1ca2d
mov r8d, dword [rsp + 0x44]
lea ebx, [r15 + 1]
cmp r8d, r15d
jle 0x4ad12324
cmp r12d, ebx
jne 0x4ad12324
lea r9, [rsp + 0xb0]
mov rdx, rbp
mov ecx, esi
mov dword [rsp + 0x20], r13d
call fcn.4ad24604
cmp dword [0x4ad2e160], r15d
je 0x4ad12324
mov ecx, esi
call fcn.4ad03380
cmp eax, r15d
jne 0x4ad12324
mov rax, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
mov r9, rbp
mov qword [rsp + 0x20], rax
call fcn.4ad2497c
cmp eax, ebx
jne 0x4ad1cbea
mov rcx, r14
call fcn.4ad0478c
mov edx, ebx
xor ecx, ecx
call fcn.4ad2477c
int3
cmp esi, 0xffffffff
je 0x4ad123d0
xor r9d, r9d
mov r8d, esi
mov rdx, r12
mov rcx, rdi
call fcn.4ad11600
nop
jmp 0x4ad123d0
mov rdx, qword [rdi]
lea rcx, [0x4ad3c310]
call fcn.4ad05fc4
lea rcx, [0x4ad3c300]
call fcn.4ad05fc4
mov ecx, dword [0x4ad2e13c]
call fcn.4ad110f8
mov rcx, qword [rsp + 0xa0]
call fcn.4ad0478c
mov edx, 1
xor ecx, ecx
call fcn.4ad2477c
int3
mov rcx, r14
call fcn.4ad0478c
mov edx, 1
xor ecx, ecx
call fcn.4ad2477c
int3
mov rcx, r14
call fcn.4ad0478c
mov edx, ebx
xor ecx, ecx
call fcn.4ad2477c
int3
xor edx, edx
call fcn.4ad07d88
mov ecx, r13d
call fcn.4ad0319c
mov rcx, r14
call fcn.4ad0478c
jmp 0x4ad1ce29
mov edx, ebp
mov ecx, ebx
call fcn.4ad2477c
int3
mov rcx, r14
call fcn.4ad0478c
mov edx, ebx
xor ecx, ecx
call fcn.4ad2477c
int3
mov rcx, r14
call fcn.4ad0478c
mov edx, esi
xor ecx, ecx
call fcn.4ad2477c
int3
mov rcx, r14
call fcn.4ad0478c
mov eax, ebx
jmp 0x4ad123d3
mov rcx, r14
call fcn.4ad0478c
cmp esi, 0xffffffff
je 0x4ad1ce29
mov ecx, esi
call fcn.4ad0319c
mov eax, 1
jmp 0x4ad123d3