Function at 0x140049538
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x198
xor r15d, r15d
mov rsi, r9
mov r13, rdx
mov rbp, rcx
cmp r8, r15
je 0x14004957c
movzx eax, word [r8]
neg ax
sbb r10, r10
and r10, r8
mov qword [r11 + 0x18], r10
mov rax, qword [rsp + 0x200]
mov r12d, r9d
mov ebx, r9d
and r12d, 0x100000
and ebx, 0x10000
mov byte [rsp + 0x69], r9b
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x128], r15
cmp rax, r15
je 0x1400495b9
mov rax, qword [rax]
mov qword [rsp + 0x128], rax
lea rcx, [rsp + 0x110]
call fcn.140056490
mov r12d, 1
test rsi, 0xffffffff80000000
mov rax, r15
setne al
test rsi, 0x60000
cmovne ebx, r15d
mov rcx, rsi
mov qword [rsp + 0xe0], r15
shr rcx, 0x15
mov qword [rsp + 0x130], r15
mov qword [rsp + 0xb8], r15
and cl, r12b
mov qword [rsp + 0xf8], rax
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x178], rcx
mov rcx, rsi
mov byte [rsp + 0x68], r15b
shr rcx, 0x16
lea edx, [r12 + 1]
lea r14d, [r12 + 7]
and cl, r12b
mov qword [rsp + 0x180], rcx
mov rcx, rsi
shr rcx, 0x17
and cl, r12b
mov qword [rsp + 0x150], rcx
cmp rax, r15
je 0x140049707
mov rax, qword [rsp + 0x1f0]
cmp rax, r15
je 0x1400497cd
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xe0]
mov r8d, 0x125
mov qword [rsp + 0x200], r15
mov qword [rsp + 0xe0], rax
call fcn.1400236d0
mov qword [rsp + 0x1f0], rax
cmp word [rax], r15w
jne 0x1400496d4
mov byte [rsp + 0x68], r12b
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x1f0]
call fcn.14005ba04
mov r11, qword [rsp + 0xe0]
mov edx, 2
mov qword [rsp + 0x1f0], r11
jmp 0x14004970f
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x1f0]
call fcn.14005ba04
cmp eax, r15d
jg 0x1400496a8
lea rcx, [rsp + 0x110]
call fcn.14004ea6c
mov rax, 0xffffffff80070057
jmp 0x14004a863
mov r11, qword [rsp + 0x1f0]
cmp r11, r15
je 0x1400497cd
cmp word [r11], r15w
je 0x1400497cd
movzx eax, word [r11]
mov ecx, 0x5c
add r11, rdx
cmp cx, ax
jne 0x14004973b
lea eax, [rcx - 0x2d]
mov word [r11 - 2], ax
cmp word [r11], r15w
jne 0x140049722
jmp 0x1400497bb
lea rdx, [rsp + 0x1f8]
lea rcx, [rsp + 0x200]
mov r8d, 0xd
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x1f8], r15
call fcn.1400236d0
mov rcx, qword [rsp + 0x200]
mov qword [rsp + 0x1f0], rax
cmp word [rcx], r15w
je 0x1400497c3
mov qword [rsp + 0xa0], rcx
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x120]
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x118]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r14d
call fcn.14005631c
mov rax, qword [rsp + 0x1f0]
cmp word [rax], r15w
jne 0x140049743
mov rdi, qword [rsp + 0x120]
mov eax, edi
neg eax
sbb rcx, rcx
and rcx, qword [rsp + 0x110]
mov qword [rsp + 0x100], rcx
cmp edi, r12d
jne 0x14004980b
mov rax, qword [rcx]
cmp word [rax], 0x3c
jne 0x14004980b
cmp word [rax + 2], 0x3e
jne 0x14004980b
cmp word [rax + 4], r15w
jne 0x14004980b
mov r15b, r12b
xor r9d, r9d
movsxd r12, edi
mov qword [rsp + 0x170], r12
cmp ebx, r9d
jne 0x140049889
cmp r12, r9
mov rbx, r9
jle 0x140049889
mov r13, rcx
xor ebp, ebp
lea r14d, [r9 + 1]
mov rdx, qword [r13 + rbx*8]
lea rcx, str._udext
mov r8d, 6
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
jne 0x140049860
cmp r12, r14
movzx r15d, r15b
mov dword [rsp + 0x78], r14d
cmove r15d, r14d
bts rsi, 0x11
add rbx, r14
cmp rbx, r12
jl 0x14004982f
mov r13, qword [rsp + 0x1e8]
mov rbp, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x100]
mov r14d, 8
xor r9d, r9d
mov rdx, qword [rsp + 0xf8]
cmp rdx, r9
je 0x1400498b1
cmp edi, r9d
jl 0x14004a5c6
cmp rcx, r9
je 0x1400498b1
mov rax, qword [rcx]
cmp word [rax], 0x3c
je 0x14004a5c6
mov qword [rsp + 0x38], r9
mov rax, rdx
mov dword [rsp + 0x30], 0x80
neg rax
mov qword [rsp + 0x200], r9
mov dword [rsp + 0x28], 3
sbb r8d, r8d
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x200]
and r8d, 0x40000000
mov r9d, 7
mov rdx, rbp
bts r8d, 0x1f
call fcn.140003590
mov rbx, qword [rsp + 0x200]
xor edi, edi
cmp rbx, rdi
jne 0x140049916
or rbp, 0xffffffffffffffff
jmp 0x14004a853
lea rcx, [rsp + 0x70]
mov edx, 0xe0000
call fcn.140056040
mov r12, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
mov rdx, r12
mov r8d, 0x200
mov rcx, rbx
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x60], 0x200
jb 0x14004a822
cmp dword [r12 + 0x1b4], 0x46424246
jne 0x14004a822
mov eax, 0xaa55
cmp ax, word [r12 + 0x1fe]
jne 0x14004a822
movzx ebp, word [r12 + 0x1b2]
xor r8d, r8d
mov rcx, rbx
inc ebp
mov eax, ebp
shl eax, 9
movsxd rdi, eax
mov rdx, rdi
call fcn.14004fd5c
cmp rdi, rax
jne 0x14004a820
xor edi, edi
lea r9, [rsp + 0x60]
mov r8d, 0x200
mov rdx, r12
mov rcx, rbx
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x60], 0x200
jb 0x14004a822
movzx eax, word [r12 + 2]
movsx ecx, byte [r12 + 4]
mov edx, 0xff
mov word [rsp + 0x200], ax
mov eax, 0x100
mov r13, rdi
mov dword [rsp + 0x1f8], edi
mov edi, esi
imul cx, ax
movsx eax, byte [r12 + 5]
add cx, ax
mov eax, 0x107
cmp cx, ax
setae cl
mov al, cl
mov byte [rsp + 0x6a], cl
neg al
sbb al, al
and al, 4
add al, 0xe
mov byte [rsp + 0x6c], al
movzx eax, al
sub dx, ax
mov al, cl
movzx ecx, word [r12 + 0xa]
neg al
mov qword [rsp + 0xe8], rcx
mov dword [rsp + 0xf0], edx
sbb al, al
xor r8d, r8d
mov edx, 0x8600
and al, 4
and edi, 0x80000
add al, 0xa
mov byte [rsp + 0x6b], al
mov eax, dword [r12 + 0xc]
mov qword [rsp + 0xd8], rax
lea rax, [rcx + 8]
mov qword [rsp + 0xa8], rax
movzx eax, word [r12]
add eax, ebp
mov ebp, esi
movsxd rcx, eax
movzx eax, word [r12 + 8]
and ebp, 0x60000
mov qword [rsp + 0xa0], rcx
mov rcx, rbx
mov dword [rsp + 0x84], eax
mov dword [rsp + 0xb0], ebp
call fcn.14004fd5c
cmp rax, 0x8600
jne 0x140049b41
xor eax, eax
lea r9, [rsp + 0x60]
mov r8d, 0x200
mov rdx, r12
mov rcx, rbx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
cmp eax, edx
je 0x140049b43
cmp dword [rsp + 0x60], 0x200
jne 0x140049b43
movzx r14d, byte [r12 + 0x1f8]
mov al, r14b
and r14d, 0x1f
and al, 0xe0
cmp dword [r12 + 0x1b4], 0x46424246
jne 0x140049b43
mov ecx, 0x10000
mov dword [rsp + 0x1f8], ecx
cmp al, dl
jne 0x140049bc2
mov rax, qword [r12 + 0x1f0]
mov r13, qword [r12 + 0x1e8]
mov qword [rsp + 0xa8], rax
jmp 0x140049bc2
xor edx, edx
cmp qword [rsp + 0xd8], r14
jbe 0x140049bc2
cmp edi, edx
je 0x140049bc2
mov rdi, qword [rsp + 0xa8]
xor r8d, r8d
mov rcx, rbx
shl rdi, 9
mov rdx, rdi
call fcn.14004fd5c
cmp rdi, rax
jne 0x140049bc2
xor edi, edi
lea r9, [rsp + 0x60]
mov r8d, 0x200
mov rdx, r12
mov rcx, rbx
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x140049bc2
cmp dword [rsp + 0x60], 0x200
jne 0x140049bc2
cmp byte [r12], 0xeb
jne 0x140049bc2
mov eax, 0xaa55
cmp ax, word [r12 + 0x1fe]
jne 0x140049bc2
mov r13, qword [rsp + 0xd8]
sub r13, r14
mov eax, dword [rsp + 0x84]
mov r14, qword [rsp + 0x1e8]
lea edi, [rax + rax*4]
mov rcx, r14
shl edi, 9
lea eax, [rdi + 0xc64]
movsxd rdx, eax
call fcn.1400560cc
mov rax, qword [r14]
movsxd r11, edi
mov rdi, qword [rsp + 0xa0]
lea rax, [rax + r11*2 + 0x200]
and rax, 0xfffffffffffffe00
cmp rdi, 0x44
mov qword [rsp + 0x98], rax
jle 0x140049c2e
mov eax, dword [rsp + 0x84]
lea rcx, [rsp + 0x70]
shl eax, 0xa
movsxd rdx, eax
call fcn.1400560cc
mov r12, qword [rsp + 0x70]
shl rdi, 9
xor r8d, r8d
mov rcx, rbx
mov rdx, rdi
call fcn.14004fd5c
cmp rdi, rax
jne 0x14004a837
mov r10, qword [r14]
mov ecx, dword [rsp + 0x80]
xor r11d, r11d
mov qword [rsp + 0x88], r10
cmp ebp, r11d
je 0x140049c68
cmp ecx, r11d
je 0x140049c78
mov rdx, r11
mov r13, r11
mov qword [rsp + 0xa8], rdx
jmp 0x140049c80
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xd8]
or rbp, 0xffffffffffffffff
shl rax, 9
mov qword [rsp + 0xd0], rax
cmp dword [rsp + 0xb0], r11d
je 0x140049d6b
cmp ecx, r11d
jne 0x140049d6b
mov eax, r11d
cmp r13, r11
jbe 0x140049d17
mov r8d, dword [rsp + 0x1f8]
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov rax, r13
lea r9, str._udext_
shl rax, 9
or r8d, 0xff00
mov rcx, r10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rdx, str.0x_02X___s__0x_I64X__I64u__u__02u__02u__02u__02u__02u_r_n
call qword [sym.imp.USER32.dll_wsprintfW]
mov r10, qword [rsp + 0x88]
xor r11d, r11d
cdqe
lea r10, [r10 + rax*2]
mov qword [rsp + 0x88], r10
mov word [r10], r11w
cmp r13, r11
jbe 0x140049d41
mov rax, r13
mov dword [rsp + 0x78], ebp
shl rax, 9
mov qword [rsp + 0xd0], rax
bt rsi, 0x12
jae 0x140049d6b
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
cmp rbx, rbp
je 0x140049d60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
mov rbp, r12
jmp 0x14004a853
cmp r15b, r11b
jne 0x140049e08
mov rax, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x84]
lea r13d, [rax + rcx]
mov edi, eax
cmp eax, r13d
jge 0x140049e08
mov rsi, r12
mov rdx, qword [rsp + 0x98]
lea r9, [rsp + 0x60]
mov r8d, 0x200
mov rcx, rbx
mov dword [rsp + 0x60], r11d
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x200
cmp dword [rsp + 0x60], eax
jne 0x140049fb5
mov rdx, qword [rsp + 0x98]
mov r8, rax
mov rcx, rsi
call fcn.14001a4c0
add rsi, 0x1fe
xor r11d, r11d
cmp byte [r12], r11b
je 0x140049e08
movzx eax, byte [r12]
add eax, 2
movsxd rcx, eax
add rcx, r12
cmp rcx, rsi
ja 0x140049e01
mov r12, rcx
jmp 0x140049de3
inc edi
cmp edi, r13d
jl 0x140049d91
mov ax, word [rsp + 0x200]
mov byte [rsp + 0x1f8], r11b
and al, 1
mov r13, r12
mov r8d, r11d
neg al
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x64], r11d
sbb r10w, r10w
mov rdx, rax
mov qword [rsp + 0x160], rax
and r10w, 0xfde9
cmp r15b, r11b
movsxd r15, dword [rsp + 0x80]
cmovne rdx, r12
mov rax, r15
mov word [rsp + 0x7c], r10w
mov qword [rsp + 0x148], rax
cmp rdx, r12
jae 0x14004a434
movzx eax, byte [rsp + 0x6c]
mov rcx, rax
mov qword [rsp + 0x140], rax
mov r9d, eax
movzx eax, byte [rdx]
lea r8, [rcx + rdx]
mov rdi, rdx
add ax, 2
mov r13, rdx
movzx ecx, ax
movzx eax, ax
add rdx, rax
mov eax, dword [rdi + 2]
sub ecx, r9d
mov qword [rsp + 0x138], rdx
mov dl, byte [rdi + 1]
mov byte [rsp + 0x200], dl
cmp rax, qword [rsp + 0xe8]
jb 0x140049ec3
or dl, 1
mov byte [rsp + 0x200], dl
mov al, byte [rsp + 0x69]
cmp al, r11b
je 0x140049ed4
test al, dl
je 0x140049fab
cmp ecx, r11d
mov r15, qword [rsp + 0x98]
mov dword [rsp + 0xb4], r11d
mov word [r15], r11w
jle 0x140049f3e
cmp byte [r8], r11b
je 0x140049f3e
movsxd rsi, ecx
mov r9d, ebp
xor edx, edx
add rsi, r8
movzx ecx, r10w
mov dword [rsp + 0x28], 0x800
mov dil, byte [rsi]
mov byte [rsi], r11b
mov qword [rsp + 0x20], r15
call qword [0x140106900]
mov dl, byte [rsp + 0x200]
mov byte [rsi], dil
movzx r9d, al
xor r11d, r11d
mov rdi, r13
mov word [r15 + r9*2], r11w
mov dword [rsp + 0xb4], r9d
mov rax, r9
mov r14d, dword [rdi + 6]
cmp byte [rsp + 0x6a], r11b
je 0x140049f4d
mov r14, qword [rdi + 6]
cmp byte [rsp + 0x180], r11b
je 0x140049f65
test r14, 0x1ff
jne 0x140049fab
cmp r14, r11
je 0x140049fab
cmp byte [rsp + 0x178], r11b
je 0x140049f74
test dl, 0x7c
jne 0x140049fc7
mov rsi, qword [rsp + 0x170]
cmp rsi, r11
je 0x140049fc7
mov rdi, r11
jle 0x140049fab
mov rax, qword [rsp + 0x100]
mov rcx, r15
mov rdx, qword [rax + rdi*8]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
xor r11d, r11d
cmp eax, r11d
jne 0x140049fc4
inc rdi
cmp rdi, rsi
jl 0x140049f86
mov r8d, dword [rsp + 0x64]
jmp 0x14004a223
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
jmp 0x14004a845
mov rdi, r13
mov al, byte [rsp + 0x200]
mov rsi, r14
test al, al
jns 0x140049fd9
shl rsi, 9
cmp qword [rsp + 0x148], r11
jne 0x14004a24a
movsxd rcx, dword [rsp + 0xb0]
cmp rcx, r11
je 0x14004a0b8
cmp r14, 0x8000
jb 0x140049fab
test r14, 0x1ff
jne 0x140049fab
test al, 0x7c
jne 0x14004a0b8
movsxd rax, dword [rsp + 0xb4]
cmp eax, 4
jle 0x14004a039
lea rdx, [r15 + rax*2 - 0xa]
lea rcx, str..iso
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r11d, r11d
cmp eax, r11d
je 0x14004a0b8
mov edi, dword [rdi + 2]
xor r8d, r8d
mov rcx, rbx
shl rdi, 9
mov rdx, rdi
call fcn.14004fd5c
cmp rdi, rax
jne 0x14004a21b
xor eax, eax
lea r9, [rsp + 0x60]
lea rdx, [r15 + 0x400]
mov r8d, 0x200
mov rcx, rbx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r11d, r11d
cmp eax, r11d
je 0x140049fab
cmp dword [rsp + 0x60], 0x200
jne 0x140049fab
cmp byte [r15 + 0x400], 0xeb
jne 0x140049fab
mov eax, 0xaa55
cmp ax, word [r15 + 0x5fe]
jne 0x140049fab
movzx eax, byte [rsp + 0x6b]
mov rcx, r13
mov byte [rsp + 0x1f8], 1
mov ecx, dword [rax + rcx]
movabs rax, 0x2b6109100
mov word [rsp + 0xc0], r11w
add rcx, rax
xor eax, eax
mov qword [rsp + 0xc2], rax
mov dword [rsp + 0xca], eax
mov word [rsp + 0xce], ax
imul rcx, rcx, 0x989680
mov qword [rsp + 0x158], rcx
cmp qword [rsp + 0xf8], r11
jne 0x14004a41f
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov r8d, dword [rsp + 0x64]
mov edx, dword [rsp + 0x78]
inc r8d
mov rdi, r13
mov dword [rsp + 0x64], r8d
cmp edx, ebp
jne 0x14004a166
mov eax, dword [r13 + 2]
cmp qword [rsp + 0xa8], rax
jne 0x14004a18e
mov rcx, qword [rsp + 0xd0]
cmp rcx, rsi
je 0x14004a220
jmp 0x14004a16e
mov rcx, qword [rsp + 0xd0]
xor r8d, r8d
cmp edx, r8d
jle 0x14004a18e
mov eax, dword [rdi + 2]
cmp qword [rsp + 0xe8], rax
jne 0x14004a18e
cmp rcx, rsi
cmove edx, r8d
mov dword [rsp + 0x78], edx
movzx eax, word [rsp + 0xcc]
movzx ecx, word [rsp + 0xca]
movzx edx, word [rsp + 0xc8]
movzx r9d, word [rsp + 0xc6]
movzx r10d, word [rsp + 0xc2]
movzx r11d, word [rsp + 0xc0]
movzx r8d, byte [rsp + 0x200]
mov dword [rsp + 0x58], eax
mov eax, dword [rdi + 2]
mov rdi, qword [rsp + 0x88]
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
lea rdx, str.0x_02X___s__0x_lX__I64u__u__02u__02u__02u__02u__02u_r_n
mov rcx, rdi
mov r9, r15
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
mov qword [rsp + 0x88], rdi
mov r8d, dword [rsp + 0x64]
xor r11d, r11d
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x140]
movzx r10d, word [rsp + 0x7c]
mov r9d, ecx
cmp rdx, r12
jb 0x140049e7d
jmp 0x14004a424
mov edi, dword [rdi + 2]
and al, 1
shl rdi, 9
neg al
sbb r8d, r8d
and r8d, 2
add r8d, 0x1fe
cmp rsi, r11
jle 0x140049d48
mov r15, qword [rsp + 0x128]
cmp r15, rsi
cmovg r15, rsi
sub rsi, r15
cmp rsi, 0x7ffffde0
jge 0x140049fb5
movsxd rcx, r8d
mov rax, r15
cqo
idiv rcx
mov ecx, eax
imul eax, r8d
xor r8d, r8d
shl ecx, 9
cdqe
movsxd rcx, ecx
sub r15, rax
add rdi, rcx
mov rcx, rbx
mov rdx, rdi
call fcn.14004fd5c
cmp rdi, rax
jne 0x140049fb5
mov rcx, qword [rsp + 0x1e8]
lea eax, [rsi + r15]
mov r14, 0xfffffffffffffe00
lea edi, [rax + 0x1ff]
add eax, 0x20f
and eax, r14d
and edi, r14d
add eax, 0x200
movsxd rdx, eax
call fcn.140055e58
mov r13, rax
xor eax, eax
cmp r13, rax
je 0x140049fb5
mov rdx, qword [rsp + 0x1e8]
mov r12, qword [rdx]
add r12, 0x200
and r12, r14
test byte [rsp + 0x200], 0x3d
lea r14, [r12 + 0x200]
mov dword [r14], eax
je 0x14004a374
lea r9, [rsp + 0x60]
mov r8d, edi
mov rdx, r14
mov rcx, rbx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r12d, r12d
cmp eax, r12d
je 0x140049fb5
cmp dword [rsp + 0x60], edi
jb 0x140049fb5
mov rdx, qword [rsp + 0x1e8]
movsxd rax, r15d
sub rax, qword [rdx]
add rax, r14
mov qword [rdx + 0x10], rax
jmp 0x14004a3e5
cmp edi, eax
jle 0x14004a3e2
lea r9, [rsp + 0x60]
mov r8d, 0x200
mov rdx, r12
mov rcx, rbx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x60], 0x200
jne 0x140049fb5
mov eax, 0x1fe
movsxd rdx, r15d
mov rcx, r13
sub eax, r15d
add rdx, r12
mov r8d, eax
mov dword [rsp + 0x60], eax
call fcn.14001a4c0
mov r11d, dword [rsp + 0x60]
xor eax, eax
sub edi, 0x1fe
add r13, r11
mov r15d, eax
cmp edi, eax
jg 0x14004a378
mov rdx, qword [rsp + 0x1e8]
xor r12d, r12d
mov rcx, qword [rdx + 0x10]
mov qword [rdx + 8], rsi
add rcx, qword [rdx]
xor edx, edx
lea r8d, [rdx + 0x10]
add rcx, rsi
call fcn.1400cc8d0
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
cmp rbx, rbp
je 0x140049d63
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140049d63
mov r8d, dword [rsp + 0x64]
mov r15d, dword [rsp + 0x80]
mov r14, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x88]
cmp byte [rsp + 0x150], r11b
je 0x14004a480
cmp r8d, r11d
jle 0x14004a480
mov rdi, rsi
mov dword [rsp + 0x78], r11d
sub rdi, r11
add rdi, 2
sar rdi, 1
cmp r11, r11
je 0x14004a476
mov rcx, qword [r14]
movsxd r8, edi
mov rdx, r11
add r8, r8
call fcn.14001a478
xor r11d, r11d
movsxd rax, edi
neg rax
lea rsi, [rsi + rax*2]
cmp dword [rsp + 0x78], r11d
jle 0x14004a4ee
cmp qword [rsp + 0xd8], r11
jbe 0x14004a4ee
cmp r15d, r11d
jne 0x14004a4ee
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xe8]
lea r9, str._udext.norm_
lea rdx, str.0x_02X___s__0x_I64X__I64u__u__02u__02u__02u__02u__02u_r_n
mov r8d, 0x2ff00
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
xor r11d, r11d
cmp qword [rsp + 0xf8], r11
je 0x14004a7f7
mov al, byte [rsp + 0x68]
mov cl, byte [rsp + 0x1f8]
cmp al, r11b
je 0x14004a516
cmp cl, r11b
jne 0x14004a51d
jmp 0x140049d48
cmp cl, r11b
cmove r13, r12
cmp al, r11b
je 0x14004a5d2
movzx ecx, byte [r13]
mov eax, r12d
add ecx, 2
sub eax, r13d
movsxd rdi, ecx
sub eax, ecx
mov rcx, r13
inc eax
lea rdx, [rdi + r13]
movsxd r8, eax
call fcn.14001a478
mov rcx, r12
mov r8, rdi
sub rcx, rdi
xor edx, edx
call fcn.1400cc8d0
mov r15, qword [rsp + 0x98]
mov r9, qword [rsp + 0x160]
mov r10d, 0x80808081
sub r13d, r9d
sub r12d, r9d
mov eax, r10d
imul r13d
mov eax, r10d
lea r8d, [r13 + rdx]
sar r8d, 8
mov ecx, r8d
shr ecx, 0x1f
imul r12d
add edx, r12d
add r8d, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, dword [rsp + 0x84]
jl 0x14004a72f
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
cmp rbx, rbp
je 0x14004a5c6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, 0xffffffff80070057
jmp 0x14004a853
mov rax, qword [rsp + 0x130]
shr rax, 9
mov dword [r13 + 2], eax
cmp byte [rsp + 0x6a], r11b
jne 0x14004a63e
test byte [r13 + 1], 0xbc
mov eax, dword [rsp + 0xb8]
mov dword [r13 + 6], eax
jne 0x14004a603
mov al, byte [rsp + 0x69]
mov byte [r13 + 1], al
mov rax, qword [rsp + 0xb8]
movabs rdx, 0x100000000
cmp rax, rdx
jb 0x14004a627
or byte [r13 + 1], 0x80
mov rax, qword [rsp + 0xb8]
test byte [r13 + 1], 0x80
je 0x14004a64a
add rax, 0x1ff
shr rax, 9
mov dword [r13 + 6], eax
jmp 0x14004a64a
mov rax, qword [rsp + 0xb8]
mov qword [r13 + 6], rax
lea r12, [r13 + 0xc]
cmp cl, r11b
jne 0x14004a55a
xor eax, eax
lea rcx, [rsp + 0x200]
mov dword [rsp + 0x200], r11d
mov dword [rsp + 0x204], eax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r15, qword [rsp + 0x98]
movzx ecx, word [rsp + 0x7c]
xor r14d, r14d
movabs rax, 0xd6bf94d5e57a42bd
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov r9d, ebp
mul qword [rsp + 0x200]
movzx eax, byte [rsp + 0x6b]
shr rdx, 0x17
mov dword [rsp + 0x28], 0x100
add edx, 0x49ef6f00
mov qword [rsp + 0x20], r15
mov dword [rax + r13], edx
mov r8, qword [rsp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
cmp edi, r14d
jle 0x14004a6e6
cmp byte [rdi + r15 - 1], r14b
jne 0x14004a6e6
dec edi
movzx ecx, word [rsp + 0xf0]
movzx esi, byte [rsp + 0x6c]
mov rdx, r15
cmp edi, ecx
cmovg edi, ecx
lea rcx, [r13 + rsi]
movsxd rax, edi
mov byte [rax + r15], r14b
lea eax, [rdi + 1]
movsxd r8, eax
call fcn.14001a4c0
add dil, sil
dec dil
movzx eax, dil
mov byte [r13], al
lea r12, [rax + r13 + 3]
mov byte [r12 - 1], r14b
jmp 0x14004a562
cmp r8d, edx
jg 0x14004a7f7
mov rcx, qword [rsp + 0xa0]
sub edx, r8d
mov eax, r8d
movsxd rsi, r8d
lea r14d, [rdx + 1]
imul eax, eax, 0x1fe
add rsi, rcx
movsxd r13, eax
sub r12d, eax
add r13, r9
shl rsi, 9
xor ebp, ebp
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.14004fd5c
mov eax, 0x1fe
lea r9, [rsp + 0x60]
cmp r12d, eax
lea r8d, [rax + 2]
mov edi, r12d
mov rdx, r15
mov rcx, rbx
mov dword [rsp + 0x60], ebp
cmovg edi, eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd r8, edi
mov rdx, r13
mov rcx, r15
call fcn.14001a4c0
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.14004fd5c
mov edi, 0x200
lea r9, [rsp + 0x60]
mov r8d, edi
mov rdx, r15
mov rcx, rbx
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [rdi - 2]
add rsi, rdi
sub r12d, eax
add r13, rax
sub r14, 1
jne 0x14004a765
or rbp, 0xffffffffffffffff
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
cmp rbx, rbp
je 0x14004a80f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x110]
call fcn.14004ea6c
xor eax, eax
jmp 0x14004a863
xor edi, edi
mov edx, 0x64
mov rcx, r13
call fcn.1400560cc
mov r11, qword [r13]
mov word [r11], di
lea rcx, [rsp + 0x70]
call fcn.14004ea6c
or rbp, 0xffffffffffffffff
cmp rbx, rbp
je 0x14004a853
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x110]
call fcn.14004ea6c
mov rax, rbp
add rsp, 0x198
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret