Function at 0x14001289c
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov r14, rdx
mov qword [rsp + 0x60], rdx
mov rdi, rcx
mov dword [rbp + 0x1c0], 0x20
xor edx, edx
lea rcx, [rbp + 0x1c4]
mov r8d, 0x204
call sub.msvcrt.dll_memset
mov rax, qword [r14 + 0x40]
xor r15d, r15d
or esi, 0xffffffff
mov qword [rbp - 0x80], r15
mov dword [rsp + 0x40], esi
mov ebx, r15d
mov dword [rsp + 0x74], ebx
mov r12d, r15d
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x50], r15d
lea ebx, [rsi + 2]
mov dword [rbp - 0x78], ebx
mov dword [rsp + 0x7c], r15d
mov dword [rsp + 0x68], r15d
mov dword [rbp - 0x70], r15d
mov dword [rsp + 0x58], r15d
test rax, rax
je 0x14001bbfa
mov eax, dword [rax + 0x38]
movsx eax, al
lea r8, [rsp + 0x6c]
and eax, 0x10
mov dword [rbp - 0x74], r15d
shr eax, 1
xor r9d, r9d
mov ecx, 0xfe00
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], r15d
call fcn.140013934
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
je 0x14001bc03
cmp dword [0x140030338], r15d
je 0x140012e2b
mov ecx, dword [rsp + 0x6c]
lea r8, [rsp + 0x54]
mov r9d, ebx
call fcn.140013934
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001bc03
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x74], eax
jmp 0x140012e2b
mov rcx, qword [rdi]
mov rbx, qword [rdi + 0x30]
call fcn.14000e400
xor r9d, r9d
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rcx
mov rdx, rax
lea rcx, [fcn.140005b00]
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 0x21]
call fcn.140005954
test al, al
je 0x14001bc0a
mov r15, qword [rbp - 0x60]
xor ebx, ebx
cmp dword [0x14002f70c], ebx
jne 0x14001c4a3
lea rdx, [rbp + 0x7e0]
mov rcx, rdi
call fcn.1400134f4
mov r12d, 1
cmp eax, r12d
je 0x14001c495
cmp dword [0x140030334], ebx
je 0x140012ea2
mov eax, dword [0x140046d18]
test byte [rdi + 0x38], 8
jne 0x140012e72
cmp eax, 3
je 0x140012e72
lea r8, [rbp - 0x50]
mov dword [rsp + 0x20], ebx
mov rdx, r14
mov rcx, rdi
call fcn.1400120b0
cmp eax, r12d
je 0x14001c495
cmp dword [0x140046d18], 3
je 0x14001bc61
cmp word [rbp - 0x50], bx
je 0x14001bc46
mov rcx, qword [rdi + 8]
xor edx, edx
call fcn.140014474
mov r12d, eax
cmp eax, 0xffffffff
je 0x14001bc7c
mov ecx, eax
call fcn.14000b708
test eax, eax
jne 0x14001bcca
cmp dword [0x140030338], ebx
jne 0x140012f46
mov ecx, dword [rsp + 0x6c]
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x74], ecx
mov ecx, 1
mov eax, dword [rdi + 0x38]
test al, 4
je 0x140012eb6
and eax, 0xfffffffb
mov dword [rdi + 0x38], eax
test al, al
js 0x14001bcf4
or eax, ecx
cmp byte [0x140046d39], bl
mov dword [rdi + 0x38], eax
je 0x14001bcfc
mov r8, qword [rdi + 8]
lea rcx, [rbp + 0x3d0]
mov edx, 0x208
call fcn.14000f654
lea rcx, [rbp - 0x50]
mov r14d, eax
call fcn.14000e400
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov dword [rsp + 0x28], esi
mov r8d, 0x200
mov rdx, r13
mov qword [rsp + 0x20], rdi
mov ecx, r12d
call fcn.140013438
xor r9d, r9d
mov r13d, eax
cmp dword [0x140046d88], r9d
jne 0x14001bd2e
mov ebx, dword [0x140046d18]
cmp ebx, 3
je 0x14001bd74
lea r8, [rbp - 0x50]
mov ecx, r14d
lea rdx, [rbp + 0x3d0]
call fcn.1400125a8
xor ebx, ebx
test eax, eax
jne 0x14001bd8b
mov rbx, qword [rsp + 0x60]
xor eax, eax
cmp dword [0x140030334], eax
mov ecx, 1
mov dword [0x140046d48], ecx
je 0x140012bb5
cmp qword [rbx + 0x40], rax
je 0x140012bb5
mov dword [0x140046d44], ecx
mov dword [0x140046d88], eax
mov rcx, qword [rbx + 0x40]
call fcn.1400072f0
mov ecx, dword [0x140046d88]
cmp ecx, 0x15
je 0x14001c455
cmp ecx, 0x458
je 0x14001c455
mov ecx, 1
mov dword [rsp + 0x20], ecx
lea r8, [rbp - 0x50]
mov rcx, rdi
mov rdx, rbx
call fcn.1400120b0
cmp eax, 1
je 0x14001c45c
xor edx, edx
cmp word [rbp - 0x50], dx
je 0x14001be17
lea r8, [rbp - 0x50]
mov ecx, r14d
lea rdx, [rbp + 0x3d0]
call fcn.1400125a8
xor r14d, r14d
test eax, eax
jne 0x14001be2e
mov r14d, dword [rsp + 0x54]
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
mov ecx, dword [rsp + 0x58]
xor r9d, r9d
mov ebx, dword [0x140046d18]
mov edx, eax
test ecx, ecx
jne 0x140012ed4
cmp dword [rbp - 0x78], r9d
je 0x14001be9a
mov dword [rsp + 0x70], r9d
mov r8d, r9d
cmp eax, 0xffffffff
jne 0x140012ebf
mov dword [rbp - 0x78], r9d
and dword [rdi + 0x38], 0xfffffffb
cmp byte [0x140046d39], r9b
mov eax, dword [rdi + 0x38]
je 0x14001bea4
test r8d, r8d
mov r8, qword [rsp + 0x60]
jne 0x14001bef7
mov r10d, 1
cmp dword [0x140030334], r9d
je 0x140012c8d
mov rax, qword [r8 + 0x40]
test rax, rax
je 0x140012c84
test byte [rax + 0x38], 8
jne 0x140012f5a
cmp ebx, 3
je 0x14001bf12
test dl, 6
je 0x140012ede
or esi, 0xffffffff
mov dword [0x140046d88], 5
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x68], r9d
mov dword [rsp + 0x7c], r9d
mov ecx, dword [rsp + 0x58]
mov eax, 1
cmp dword [rbp - 0x70], eax
je 0x14001bf47
mov eax, dword [rdi + 0x38]
test al, 8
jne 0x140012cd3
cmp ebx, 3
je 0x14001bf6a
mov eax, dword [rdi + 0x38]
test al, 8
jne 0x140012e94
mov r8d, dword [rdi + 0x38]
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
call fcn.1400133f0
mov eax, 1
cmp ebx, 3
je 0x14001c127
mov ebx, dword [rdi + 0x38]
test al, bl
je 0x14001c127
and ebx, 0x800
cmp esi, 0xffffffff
jne 0x140012f33
test dword [rdi + 0x38], 0x400
jne 0x14001bfa1
mov rax, qword [0x14003a890]
xor r13d, r13d
test rax, rax
je 0x14001bfee
mov ecx, ebx
xor r9d, r9d
or ecx, dword [rsp + 0x78]
mov dword [rsp + 0x28], ecx
xor r8d, r8d
lea rcx, [0x14002f70c]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x50]
call qword [vtable._SH_.0]
test eax, eax
je 0x14001c007
cmp dword [rsp + 0x68], r13d
jne 0x140012d9d
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012d90
and eax, 0xfffffffe
lea rcx, [rbp - 0x50]
mov edx, eax
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFileAttributesW]
cmp dword [0x140030338], r13d
jne 0x140012f6d
mov r14d, 1
mov r13, qword [rsp + 0x48]
mov rax, qword [rdi + 0x30]
xor ebx, ebx
mov dword [0x140030394], ebx
mov rcx, qword [rax + 0x14]
mov qword [rbp - 0x58], rcx
mov ecx, r12d
call fcn.140008c50
cmp dword [0x140046d18], 3
je 0x14001c3f5
cmp dword [0x14002f70c], ebx
jne 0x14001c3da
mov r14, qword [rsp + 0x60]
lea r9, [rbp - 0x58]
mov rdx, r14
mov r8d, esi
mov rcx, rdi
call fcn.14001339c
mov r12d, dword [rsp + 0x50]
mov dword [0x140030334], ebx
mov rdx, qword [rdi + 0x30]
lea rcx, [fcn.140005b00]
mov r9, r15
mov r8d, 0x21
call fcn.140003588
test al, al
jne 0x1400129ed
mov rcx, r15
call fcn.140006a48
xor r15d, r15d
mov rdi, qword [rdi + 0x40]
test rdi, rdi
jne 0x1400129af
cmp dword [0x140046d18], 3
je 0x14001c4c1
mov eax, r12d
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.1400151c0
mov rbx, qword [rsp + 0xb50]
add rsp, 0xb00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rdi + 8]
lea rcx, str._s_r_n
call fcn.14000ed0c
cmp dword [0x140046d18], 3
jne 0x140012a3c
jmp 0x14001bc50
cmp ebx, 3
jne 0x140012cde
jmp 0x14001bf80
mov eax, dword [0x140046d18]
cmp eax, 3
jne 0x140012a29
jmp 0x14001bc2e
mov dword [rsp + 0x58], eax
jmp 0x140012adc
test al, 0x10
mov eax, 1
cmovne r8d, eax
mov dword [rsp + 0x70], r8d
jmp 0x140012c3c
mov r8, qword [rsp + 0x60]
jmp 0x140012c62
test dword [rdi + 0x38], 0x400
jne 0x140012eff
lea rcx, [rbp - 0x50]
call fcn.1400143e8
mov ebx, dword [0x140046d18]
mov esi, eax
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x68], r9d
cmp esi, 0xffffffff
je 0x140012cac
mov ebx, 1
mov ecx, esi
mov dword [rsp + 0x7c], ebx
call fcn.14000b708
xor r9d, r9d
test eax, eax
jne 0x14001bf2b
mov ebx, dword [0x140046d18]
jmp 0x140012cb1
mov ecx, esi
call fcn.140008c50
or esi, 0xffffffff
mov dword [rsp + 0x40], esi
jmp 0x140012d19
mov eax, dword [rsp + 0x74]
mov ecx, eax
cmp dword [rsp + 0x6c], eax
cmovb ecx, dword [rsp + 0x6c]
jmp 0x140012aa5
cmp qword [rdi + 0x40], r9
cmove ebx, r10d
mov dword [0x140046d18], ebx
jmp 0x140012c84
mov ebx, 1
lea rcx, [rbp - 0x50]
mov edx, ebx
call fcn.140014474
mov dword [rsp + 0x40], eax
mov esi, eax
cmp eax, 0xffffffff
je 0x14001c09c
mov ecx, eax
call fcn.14000b708
mov ecx, esi
test eax, eax
jne 0x14001c0c0
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_FlushFileBuffers]
test eax, eax
je 0x14001c0ae
mov ecx, esi
call fcn.140008c50
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140014474
mov dword [rsp + 0x40], eax
mov esi, eax
cmp eax, 0xffffffff
je 0x14001c09c
mov ecx, eax
call fcn.14000b708
test eax, eax
jne 0x14001c0ae
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetFilePointer]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea rdx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileSize]
mov ecx, esi
mov ebx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea rdx, [rbp - 0x6c]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_GetFileSize]
cmp ebx, eax
jne 0x14001c0fd
mov eax, dword [rbp - 0x6c]
cmp dword [rbp - 0x68], eax
jne 0x14001c0fd
mov ebx, r13d
mov r13, qword [rsp + 0x48]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor edx, edx
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rdx
mov rcx, rax
mov rdx, r13
mov r8d, r14d
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
xor ecx, ecx
test eax, eax
je 0x1400130f4
cmp dword [rsp + 0x44], ecx
mov ecx, esi
je 0x1400130f6
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r8d, dword [rsp + 0x44]
lea r9, [rbp - 0x64]
mov rdx, qword [rbp - 0x80]
mov rcx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_ReadFile]
test eax, eax
je 0x14001c0d4
mov eax, dword [rsp + 0x44]
cmp dword [rbp - 0x64], eax
jne 0x14001c0d4
mov rdx, qword [rbp - 0x80]
cmp r14d, eax
mov ecx, 1
mov r8d, eax
cmovne ebx, ecx
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14001c0d4
test ebx, ebx
je 0x140013060
mov ecx, esi
call fcn.140008c50
or esi, 0xffffffff
mov dword [rsp + 0x40], esi
lea r14d, [rsi + 2]
jmp 0x140012da8
mov eax, dword [r14 + 0x38]
jmp 0x14001293f
mov eax, ebx
jmp 0x140012e48
cmp dword [0x140046d18], 3
jne 0x14001c404
cmp dword [0x140030334], r15d
jne 0x14001c404
mov r12d, dword [rsp + 0x50]
jmp 0x140012e2b
mov rdx, qword [rdi + 8]
lea rcx, [rbp + 0x1c0]
call fcn.140024314
test eax, eax
je 0x140012a23
mov r12d, dword [rsp + 0x50]
jmp 0x140012dff
cmp dword [0x140030334], ebx
je 0x140012a6f
jmp 0x140012a3c
lea r8, [rbp - 0x50]
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call fcn.14000dc10
nop
jmp 0x140012a65
mov ecx, dword [0x140046d88]
call fcn.140024bb8
cmp dword [0x140046d18], 3
jne 0x14001bcb9
cmp esi, 0xffffffff
jne 0x14001bcb9
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x50]
call fcn.140024314
test eax, eax
je 0x14001bcb9
mov rcx, r15
call fcn.140006a48
lea edx, [rsi + 2]
xor ecx, ecx
call fcn.140023ab8
int3
mov eax, 1
mov r12d, eax
mov dword [rsp + 0x50], eax
jmp 0x140012dff
mov eax, 0x80
mov ecx, 1
or dword [rdi + 0x38], eax
mov dword [rsp + 0x54], eax
mov eax, dword [rdi + 0x38]
test cl, al
je 0x140012ab2
and eax, 0xfffffffe
or eax, 4
mov dword [rdi + 0x38], eax
jmp 0x140012ab2
or eax, 2
jmp 0x140012acd
cmp dword [0x140030334], ebx
je 0x140012adc
mov eax, dword [rdi + 0x38]
test al, 8
jne 0x140012adc
cmp dword [0x140046d18], 3
jne 0x140012adc
and eax, 0xfffffffe
or eax, 2
mov dword [rdi + 0x38], eax
jmp 0x140012adc
mov ecx, r12d
call fcn.140008c50
mov ecx, 0x6e
call fcn.140024bb8
cmp dword [0x140046d18], 3
je 0x14001c440
mov eax, 1
mov r12d, eax
mov dword [rsp + 0x50], eax
jmp 0x14001bd63
mov r12d, r14d
mov dword [rsp + 0x50], r14d
mov r13, qword [rsp + 0x48]
xor ebx, ebx
mov r14, qword [rsp + 0x60]
jmp 0x140012dff
cmp dword [0x140030334], r9d
jne 0x140012b43
mov r14d, dword [rsp + 0x54]
jmp 0x140012cb1
test byte [rdi + 0x38], 0x80
jne 0x140012b60
mov ecx, r12d
call fcn.140008c50
mov r13, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r14d, dword [rsp + 0x54]
mov r9, r13
mov qword [rsp + 0x28], r15
mov rcx, rdi
mov dword [rsp + 0x20], r14d
call fcn.1400243ac
cmp dword [0x140030334], ebx
je 0x14001bdf2
cmp dword [0x140046d18], 3
jne 0x14001bdeb
and dword [rdi + 0x38], 0xfffffffe
mov ecx, dword [rsp + 0x58]
mov eax, dword [rdi + 0x38]
test ecx, ecx
jne 0x14001bde6
or eax, 2
jmp 0x14001bde8
or eax, ecx
mov dword [rdi + 0x38], eax
mov dword [rbp - 0x70], 1
mov r8d, dword [rdi + 0x38]
lea rdx, [rsp + 0x44]
mov rcx, r13
call fcn.1400133f0
mov esi, dword [rsp + 0x40]
mov r14, qword [rsp + 0x60]
mov dword [0x140030334], ebx
jmp 0x14001bc46
mov ecx, r12d
call fcn.140008c50
mov r13, qword [rsp + 0x48]
mov r14, rbx
xor ebx, ebx
jmp 0x14001bc46
test byte [rdi + 0x38], 0x80
jne 0x140012bfb
mov ecx, r12d
call fcn.140008c50
cmp dword [0x140030334], r14d
je 0x14001be70
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x14001be70
test byte [rax + 0x38], 8
je 0x14001be70
mov eax, dword [0x140046d18]
mov ecx, 1
cmp qword [rdi + 0x40], r14
cmove eax, ecx
mov dword [0x140046d18], eax
mov r14d, dword [rsp + 0x54]
lea rdx, [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
call fcn.1400243ac
mov esi, dword [rsp + 0x40]
jmp 0x140012c00
mov r8d, dword [rsp + 0x70]
jmp 0x140012c40
test al, 8
je 0x140012c54
cmp ebx, 3
jne 0x140012c54
test r8d, r8d
mov dword [rbp - 0x74], ebx
mov r8, qword [rsp + 0x60]
jne 0x140012c62
mov rcx, qword [r8 + 0x40]
test rcx, rcx
je 0x14001bee8
test byte [rcx + 0x38], 8
je 0x14001bee8
mov ecx, dword [rsp + 0x58]
lea r10d, [rbx - 2]
or eax, r10d
mov dword [rdi + 0x38], eax
jmp 0x140012c68
mov ecx, dword [rsp + 0x58]
or eax, 2
mov dword [rdi + 0x38], eax
jmp 0x140012c62
cmp dword [rbp - 0x74], 3
mov r10d, 1
jne 0x140012c68
or eax, r10d
mov dword [rdi + 0x38], eax
jmp 0x140012c68
test ecx, ecx
jne 0x14001bf23
and dword [rdi + 0x38], 0xfffffffe
or dword [rdi + 0x38], 2
jmp 0x140012c8d
mov dword [rdi + 0x38], ecx
jmp 0x140012c8d
mov dword [rsp + 0x68], ebx
cmp dword [rsp + 0x58], r9d
jne 0x140012f28
and dword [rdi + 0x38], 0xfffffffe
or dword [rdi + 0x38], 2
jmp 0x140012f28
cmp ebx, 3
jne 0x140012cc3
and dword [rdi + 0x38], 0xfffffffe
mov eax, dword [rdi + 0x38]
test ecx, ecx
jne 0x14001bf60
or eax, 2
jmp 0x14001bf62
or eax, ecx
mov dword [rdi + 0x38], eax
jmp 0x140012cc3
test ecx, ecx
jne 0x140012cd3
and eax, 0xfffffffe
or eax, 2
mov dword [rdi + 0x38], eax
jmp 0x140012cd3
cmp dword [rsp + 0x70], r9d
jne 0x140012cde
test ecx, ecx
jne 0x140012cde
and eax, 0xfffffffe
or eax, 2
mov dword [rdi + 0x38], eax
jmp 0x140012cde
mov rcx, qword [rdi + 8]
call fcn.140024d0c
xor r13d, r13d
test eax, eax
jne 0x14001bfc1
lea rcx, [rbp - 0x50]
call fcn.140024d0c
test eax, eax
mov eax, r13d
je 0x14001bfc6
mov eax, 1
mov ecx, ebx
movsxd r9, eax
or ecx, dword [rsp + 0x78]
lea r8, [0x1400238e0]
mov rax, qword [0x14003a890]
or ecx, 2
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r13
jmp 0x140012d55
mov r8d, dword [rsp + 0x78]
lea rdx, [rbp - 0x50]
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_1.dll_CopyFileW]
nop
jmp 0x140012d63
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov r14d, 1
mov dword [0x140046d88], eax
cmp eax, r14d
jne 0x14001c03a
test ebx, ebx
je 0x14001c03a
mov rcx, qword [rdi + 0x30]
test dword [rcx], 0x400
mov ecx, 0x40002730
cmovne eax, ecx
mov dword [0x140046d88], eax
mov ecx, r12d
call fcn.140008c50
cmp dword [rsp + 0x68], r13d
mov eax, 0x1d
mov ecx, dword [0x140046d88]
mov ebx, r13d
cmovne ebx, eax
mov dword [0x140030394], r13d
test ecx, ecx
mov eax, 0x70
cmove ecx, eax
cmp dword [0x14002f70c], r13d
mov dword [0x140046d88], ecx
je 0x14001c07d
mov ebx, r13d
jmp 0x14001c086
test ebx, ebx
jne 0x14001c086
call fcn.140024bb8
cmp dword [rsp + 0x7c], r13d
je 0x14001bd5b
mov edx, r14d
mov ecx, ebx
call fcn.140023ab8
int3
lea r8, [rbp - 0x50]
mov edx, ebx
mov ecx, 0x4000271f
call fcn.1400057e4
jmp 0x14001c0cc
lea r8, [rbp - 0x50]
mov edx, ebx
mov ecx, 0x4000271f
call fcn.1400057e4
mov ecx, esi
call fcn.140008c50
or esi, 0xffffffff
mov dword [rsp + 0x40], esi
mov r14d, ebx
jmp 0x140012da3
mov ecx, esi
call fcn.140008c50
or esi, 0xffffffff
lea r8, [rbp - 0x50]
mov ecx, 0x4000271f
mov dword [rsp + 0x40], esi
lea r14d, [rsi + 2]
mov edx, r14d
call fcn.1400057e4
nop
jmp 0x140012da8
mov r14d, 1
lea r8, [rbp - 0x50]
mov edx, r14d
mov ecx, 0x4000271f
call fcn.1400057e4
mov ecx, esi
call fcn.140008c50
or esi, 0xffffffff
mov dword [rsp + 0x40], esi
jmp 0x140012da3
cmp esi, 0xffffffff
je 0x14001c188
mov ecx, esi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_SetEndOfFile]
xor edx, edx
cmp dword [0x140030334], edx
jne 0x14001c1e3
cmp dword [0x140046d18], 3
jne 0x14001c1e3
mov eax, dword [rdi + 0x38]
mov ecx, 0x4002
mov rbx, qword [rsp + 0x48]
and eax, ecx
cmp eax, ecx
jne 0x14001c1e8
mov eax, dword [rsp + 0x44]
lea rdx, [rbx + 2]
add eax, 0xfffffffe
mov rcx, rbx
mov r8d, eax
mov dword [rsp + 0x44], eax
call qword [sym.imp.msvcrt.dll_memmove]
jmp 0x14001c1e8
mov edx, eax
lea rcx, [rbp - 0x50]
call fcn.140014474
mov dword [rsp + 0x40], eax
mov esi, eax
cmp eax, 0xffffffff
jne 0x14001c13d
mov ecx, r12d
call fcn.140008c50
xor ebx, ebx
cmp dword [0x14003036c], ebx
jne 0x14001c1bb
mov ecx, dword [0x140046d88]
call fcn.140024bb8
cmp dword [0x140046d18], 3
je 0x14001c46e
mov r13, qword [rsp + 0x48]
mov eax, 1
mov r14, qword [rsp + 0x60]
mov r12d, eax
mov dword [rsp + 0x50], eax
jmp 0x140012dff
mov rbx, qword [rsp + 0x48]
mov r8d, 0x4000
test dword [rdi + 0x38], r8d
je 0x14001c20c
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x14001c208
or dword [rax + 0x38], r8d
jmp 0x14001c20c
or dword [rcx + 0x38], r8d
mov eax, dword [0x140030394]
test eax, eax
je 0x14001c2a0
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jle 0x140012d9d
lea r9, [rbp - 0x50]
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, esi
call fcn.140024490
xor r14d, r14d
cmp dword [0x140030338], r14d
je 0x140012d9d
mov ecx, esi
call fcn.14000b708
test eax, eax
jne 0x140012d9d
mov rax, qword [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140023990
mov r14d, 1
cmp eax, r14d
jne 0x14001c297
mov rcx, r15
call fcn.140006a48
mov edx, r14d
xor ecx, ecx
call fcn.140023ab8
int3
mov esi, dword [rsp + 0x40]
jmp 0x140012da3
mov ecx, 1
cmp r13d, ecx
jne 0x14001c342
mov r8d, dword [rsp + 0x44]
lea r9, [rbp - 0x50]
mov rdx, rbx
mov dword [rsp + 0x20], r12d
mov ecx, esi
call fcn.140024490
xor r13d, r13d
cmp dword [0x140030338], r13d
je 0x14001c30c
mov ecx, esi
call fcn.14000b708
test eax, eax
jne 0x14001c30c
mov rax, qword [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140023990
lea esi, [r13 + 1]
cmp eax, esi
je 0x14001c483
mov esi, dword [rsp + 0x40]
lea rax, [rbp - 0x50]
mov r8d, r14d
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov dword [rsp + 0x28], esi
mov rdx, rbx
mov ecx, r12d
mov qword [rsp + 0x20], rdi
call fcn.140013438
mov r13d, eax
mov eax, dword [0x140030394]
test eax, eax
je 0x14001c2a0
mov r14d, 1
test eax, eax
je 0x140012da3
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jle 0x140012da3
cmp r13d, r14d
jne 0x140012da3
lea r9, [rbp - 0x50]
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, esi
call fcn.140024490
xor r14d, r14d
cmp dword [0x140030338], r14d
je 0x140012d9d
mov ecx, esi
call fcn.14000b708
test eax, eax
jne 0x140012d9d
mov rax, qword [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140023990
mov r14d, 1
cmp eax, r14d
jne 0x14001c297
mov rcx, r15
call fcn.140006a48
mov edx, r14d
xor ecx, ecx
call fcn.140023ab8
int3
mov ecx, esi
call fcn.140008c50
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_DeleteFileW]
mov r12d, r14d
mov dword [rsp + 0x50], r14d
jmp 0x14001c3fa
mov r12d, dword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
jmp 0x140012df9
mov rdx, qword [rdi]
lea rcx, [0x140029238]
call fcn.14000ed0c
lea rcx, [0x1400283c0]
call fcn.14000ed0c
mov ecx, dword [0x140046d88]
call fcn.140024bb8
mov rcx, qword [rbp - 0x60]
call fcn.140006a48
mov edx, 1
xor ecx, ecx
call fcn.140023ab8
int3
mov rcx, r15
call fcn.140006a48
mov edx, 1
xor ecx, ecx
call fcn.140023ab8
int3
xor edx, edx
call fcn.140004ae0
mov ecx, r12d
call fcn.140008c50
mov rcx, r15
call fcn.140006a48
jmp 0x14001c4b7
mov rcx, r15
call fcn.140006a48
mov edx, 1
xor ecx, ecx
call fcn.140023ab8
int3
mov rcx, r15
call fcn.140006a48
mov edx, esi
xor ecx, ecx
call fcn.140023ab8
int3
mov rcx, r15
call fcn.140006a48
nop
jmp 0x140012e45
mov rcx, r15
call fcn.140006a48
cmp esi, 0xffffffff
je 0x14001c4b7
mov ecx, esi
call fcn.140008c50
mov eax, 1
jmp 0x140012e48
cmp esi, 0xffffffff
je 0x140012e45
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov rcx, rdi
call fcn.14001339c
nop
jmp 0x140012e45