Function at 0x140102b80
Capabilities:
Create directory
Get file size
Move file
Read file on windows
Shutdown system

Disassembly:
test r9, r9
je 0x14010469b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov qword [rsp + 0xf0], 0xfffffffffffffffe
mov qword [rsp + 0x240], rbx
mov rax, qword [0x1402de400]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r14, r9
mov esi, edx
mov r13, rcx
mov edi, dword [r9 + 0x10]
cmp edi, 1
jb case.0x140102c04.3
mov rbx, qword [r9 + 8]
movzx eax, byte [rbx]
add eax, 0xfffffffe
cmp eax, 0x4b
ja case.0x140102c04.3
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x104718]
mov ecx, dword [rdx + rax*4 + 0x1046a0]
add rcx, rdx
jmp rcx
cmp dword [0x1402e2b58], 0
jne case.0x140102c04.3
mov dword [r13 + 0x368], esi
lea rcx, [r13 + 0x308]
mov rdx, r9
call fcn.140100970
jmp case.0x140102c04.3
movzx eax, byte [rbx + 1]
mov dword [0x1402e2da0], eax
jmp case.0x140102c04.3
cmp dword [0x1402e2b58], 0
jne case.0x140102c04.3
mov dword [rsp + 0x68], reloc.WS2_32.dll_listen
mov r14d, 1
mov dword [rsp + 0x6c], r14d
lea edx, [r14 + 1]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
test eax, eax
jle case.0x140102c04.3
mov edx, 0x100000
mov ecx, eax
call fcn.140102980
mov rdi, rax
test rax, rax
je case.0x140102c04.3
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x20], 0xffffffff
mov r9d, r14d
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + reloc.WS2_32.dll_htonl]
jmp case.0x140102c04.3
cmp dword [0x1402e2b58], 0
jne case.0x140102c04.3
movzx ebx, byte [r13 + 0x3d4]
mov byte [r13 + 0x3d4], 0
mov rcx, r9
call fcn.1400ffbd0
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [r13 + 0x3d0], eax
mov byte [r13 + 0x3d4], bl
jmp case.0x140102c04.3
cmp dword [0x1402e2b58], 0
jne case.0x140102c04.3
call fcn.1400fd600
jmp case.0x140102c04.3
mov edx, esi
mov rcx, r13
call fcn.140102300
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
jne 0x140102d9d
mov ecx, 3
call fcn.14001c0c0
mov rdi, rax
test rax, rax
je case.0x140102c04.3
mov rcx, qword [rax + 8]
mov byte [rcx], 0x1f
mov byte [rcx + 1], 0
mov byte [rcx + 2], 0xff
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x250]
mov dword [rsp + 0x20], r11d
mov r9d, 2
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + reloc.WS2_32.dll_htonl]
jmp case.0x140102c04.3
mov r14d, 1
mov ecx, r14d
lea rdx, [rbx + 1]
cmp edi, 2
jb case.0x140102c04.3
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x140102dc9
lea eax, [rcx + 1]
cmp eax, edi
jbe 0x140102db3
jmp case.0x140102c04.3
xor r12d, r12d
mov qword [rsp + 0xa8], r12
mov dword [rsp + 0xb0], r14d
test rdx, rdx
je 0x140102df4
mov rcx, rdx
call fcn.140001930
mov r12, rax
mov qword [rsp + 0xa8], rax
mov edx, 0xf000
mov rcx, r12
call fcn.140100f10
mov rdi, rax
test r12, r12
je 0x140102e11
mov rcx, r12
call fcn.1401e36c8
test rdi, rdi
je case.0x140102c04.3
mov edx, 0x7d0
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
nop
lea rax, [rsp + 0x80]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov ebp, 2
mov r14d, dword [rsp + 0x250]
mov rcx, rdi
call fcn.1400feb50
mov r12d, eax
cmp qword [r13 + 8], 0
je 0x140102ede
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x20], r14d
mov r9d, ebp
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp r12d, 1
jne 0x140102ede
mov eax, dword [rdi + 0x1c]
cmp eax, r12d
jle 0x140102ede
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140102ec3
mov r8d, 0x2710
lea rdx, [rsp + 0x80]
call qword [0x1402e4b00]
test eax, eax
je 0x140102ef1
jmp 0x140102ede
mov r8d, 0x2710
lea rdx, [rsp + 0x80]
mov rcx, qword [rdi + 0x20]
call fcn.140001270
test eax, eax
jle 0x140102ef1
mov rcx, rdi
call fcn.140100090
cmp r12d, 1
jne 0x140102f1d
jmp 0x140102e57
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.0x140102c04.3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
je case.0x140102c04.3
mov r14d, 1
lea r15, [rbx + 1]
cmp edi, 2
jb case.0x140102c04.3
nop word [rax + rax]
mov eax, r14d
inc r14d
cmp byte [rax + rbx], 0
je 0x140102f89
lea eax, [r14 + 1]
cmp eax, edi
jbe 0x140102f70
jmp case.0x140102c04.3
xor r12d, r12d
mov rbx, r12
test r15, r15
je 0x140102f9f
mov rcx, r15
call fcn.140001930
mov rbx, rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test rbx, rbx
je 0x140102fb9
mov rcx, rbx
call fcn.1401e36c8
mov ecx, r12d
test ebp, ebp
sete cl
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8d, 0x20
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
mov ecx, 0x400
call fcn.14001c0c0
mov rdi, rax
test rax, rax
je case.0x140102c04.3
mov r8, qword [rax + 8]
mov r9d, dword [rax + 0x10]
mov byte [r8], 0x21
test ebp, ebp
sete cl
mov byte [r8 + 1], cl
mov ebp, 2
mov edx, ebp
cmp r9d, 3
jb 0x140103071
nop dword [rax]
movzx ecx, byte [r15]
mov eax, edx
mov byte [rax + r8], cl
inc edx
inc r15
test cl, cl
je 0x14010303d
lea eax, [rdx + 1]
cmp eax, r9d
jbe 0x140103020
jmp 0x140103071
mov dword [rdi + 0x10], edx
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x250]
mov dword [rsp + 0x20], r11d
mov r9d, ebp
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
je case.0x140102c04.3
mov r14d, 1
mov ecx, r14d
lea r15, [rbx + 1]
cmp edi, 2
jb case.0x140102c04.3
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x1401030b9
lea eax, [rcx + 1]
cmp eax, edi
jbe 0x1401030a3
jmp case.0x140102c04.3
xor r12d, r12d
mov rbx, r12
mov qword [rsp + 0xb8], rbx
mov dword [rsp + 0xc0], r14d
test r15, r15
je 0x1401030e7
mov rcx, r15
call fcn.140001930
mov rbx, rax
mov qword [rsp + 0xb8], rax
mov rcx, rbx
call fcn.1400fe320
mov ebp, eax
test rbx, rbx
je 0x1401030fe
mov rcx, rbx
call fcn.1401e36c8
mov ecx, r12d
test ebp, ebp
sete cl
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8d, 0x22
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
mov ecx, 0x400
call fcn.14001c0c0
mov rdi, rax
test rax, rax
je case.0x140102c04.3
mov r8, qword [rax + 8]
mov r9d, dword [rax + 0x10]
mov byte [r8], 0x23
test ebp, ebp
sete cl
mov byte [r8 + 1], cl
mov ebp, 2
mov edx, ebp
cmp r9d, 3
jb 0x1401031b1
nop
movzx ecx, byte [r15]
mov eax, edx
mov byte [rax + r8], cl
inc edx
inc r15
test cl, cl
je 0x14010317d
lea eax, [rdx + 1]
cmp eax, r9d
jbe 0x140103160
jmp 0x1401031b1
mov dword [rdi + 0x10], edx
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x250]
mov dword [rsp + 0x20], r11d
mov r9d, ebp
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
je case.0x140102c04.3
mov r14d, 1
lea rax, [rbx + 1]
mov qword [rsp + 0x58], rax
cmp edi, 2
jb case.0x140102c04.3
nop word [rax + rax]
mov eax, r14d
inc r14d
cmp byte [rax + rbx], 0
je 0x140103209
lea eax, [r14 + 1]
cmp eax, edi
jbe 0x1401031f0
jmp case.0x140102c04.3
mov r15d, r14d
add r15, rbx
lea ecx, [r14 + 1]
cmp ecx, edi
ja case.0x140102c04.3
nop dword [rax + rax]
mov eax, r14d
inc r14d
inc ecx
cmp byte [rax + rbx], 0
je 0x140103237
cmp ecx, edi
jbe 0x140103220
jmp case.0x140102c04.3
xor r12d, r12d
mov rdi, r12
test r15, r15
je 0x14010324d
mov rcx, r15
call fcn.140001930
mov rdi, rax
mov rbp, r12
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x140103265
mov rcx, rbx
call fcn.140001930
mov rbp, rax
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov r14d, eax
test rbp, rbp
je 0x140103281
mov rcx, rbp
call fcn.1401e36c8
test rdi, rdi
je 0x14010328e
mov rcx, rdi
call fcn.1401e36c8
test r14d, r14d
sete r12b
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
mov r9, rbx
mov r8d, 0x24
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
mov ecx, 0x400
call fcn.14001c0c0
mov rdi, rax
test rax, rax
je case.0x140102c04.3
mov r10, qword [rax + 8]
mov r9d, dword [rax + 0x10]
mov byte [r10], 0x25
test r14d, r14d
sete cl
mov byte [r10 + 1], cl
mov ebp, 2
mov edx, ebp
cmp r9d, 3
jb 0x14010337f
nop word [rax + rax]
movzx ecx, byte [rbx]
mov eax, edx
mov byte [rax + r10], cl
inc edx
inc rbx
test cl, cl
je 0x14010331c
lea eax, [rdx + 1]
cmp eax, r9d
jbe 0x140103300
jmp 0x14010337f
lea r8d, [rdx + 1]
cmp r8d, r9d
ja 0x14010337f
nop word [rax + rax]
movzx ecx, byte [r15]
mov byte [rdx + r10], cl
inc edx
inc r8d
inc r15
test cl, cl
je 0x14010334b
cmp r8d, r9d
jbe 0x140103330
jmp 0x14010337f
mov dword [rdi + 0x10], edx
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x250]
mov dword [rsp + 0x20], r11d
mov r9d, ebp
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
jne 0x1401033c4
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x27
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
cmp qword [r13 + 0x3b8], 0xffffffffffffffff
je 0x1401033fb
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x27
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
mov dword [r13 + 0x3c8], esi
mov rdx, qword [r9 + 8]
mov ecx, dword [r9 + 0x10]
mov r14d, 1
lea rdi, [rdx + 1]
cmp ecx, 2
jb 0x1401034f1
nop dword [rax]
mov eax, r14d
inc r14d
cmp byte [rax + rdx], 0
je 0x140103439
lea eax, [r14 + 1]
cmp eax, ecx
jbe 0x140103420
jmp 0x1401034f1
xor r12d, r12d
mov rbx, r12
test rdi, rdi
je 0x14010344f
mov rcx, rdi
call fcn.140001930
mov rbx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov ebp, 2
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r13 + 0x3b8], rax
test rbx, rbx
je 0x14010348d
mov rcx, rbx
call fcn.1401e36c8
mov eax, r12d
cmp qword [r13 + 0x3b8], 0xffffffffffffffff
sete al
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8d, 0x26
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
mov r9d, r12d
cmp qword [r13 + 0x3b8], 0xffffffffffffffff
cmove r9d, ebp
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r8b, 0x27
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 4
mov r8b, 0x27
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
jne 0x140103555
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x29
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
mov rcx, qword [r13 + 0x3b8]
cmp rcx, 0xffffffffffffffff
je 0x1401035d6
cmp dword [r13 + 0x3c8], esi
jne 0x1401035d6
lea r8d, [rdi - 1]
lea rdx, [rbx + 1]
call fcn.1400ffc50
test eax, eax
je 0x1401035a9
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8b, 0x29
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x29
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x29
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
jne 0x14010363a
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x2b
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
mov rcx, qword [r13 + 0x3b8]
cmp rcx, 0xffffffffffffffff
je 0x14010374b
cmp dword [r13 + 0x3c8], esi
jne 0x14010374b
cmp edi, 9
jb 0x14010374b
mov edx, dword [rbx + 1]
mov dword [rsp + 0x48], edx
mov eax, dword [rbx + 5]
mov dword [rsp + 0x4c], eax
cmp edi, 9
je 0x1401036b7
lea r8d, [rdi - 9]
lea rdx, [rbx + 9]
call fcn.1400ffc50
test eax, eax
jne 0x1401036af
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x2b
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp 0x140103727
mov eax, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
test edx, edx
je 0x1401036e0
test eax, eax
je 0x1401036e0
lea rcx, [rsp + 0x48]
call fcn.1400fe430
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, qword [r13 + 0x3b8]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, qword [r13 + 0x3b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3b8], 0xffffffffffffffff
xor r12d, r12d
mov dword [r13 + 0x3c8], r12d
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8b, 0x2b
mov edx, esi
mov rcx, r13
call fcn.1401016e0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r9 + 0x2a]
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
jmp case.0x140102c04.3
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x2b
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
mov rcx, qword [r13 + 0x3b8]
xor r12d, r12d
cmp rcx, 0xffffffffffffffff
je 0x1401037f5
cmp dword [r13 + 0x3c8], esi
jne 0x1401037f5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3b8], 0xffffffffffffffff
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x250]
mov dword [rsp + 0x20], r11d
lea r9d, [r12 + 2]
mov r8, r14
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r12 + 0x2c]
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
mov dword [r13 + 0x3c8], r12d
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
jne 0x140103838
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
cmp qword [r13 + 0x3c0], 0xffffffffffffffff
je 0x14010386f
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
mov dword [r13 + 0x3cc], esi
mov r9, qword [r9 + 8]
mov r8d, dword [r14 + 0x10]
mov r14d, 1
mov ecx, r14d
lea rbp, [r9 + 1]
cmp r8d, 2
jb 0x140103a38
mov eax, ecx
inc ecx
cmp byte [rax + r9], 0
je 0x1401038ad
lea eax, [rcx + 1]
cmp eax, r8d
jbe 0x140103895
jmp 0x140103a38
mov edi, ecx
add rdi, r9
lea edx, [rcx + 1]
xor r12d, r12d
cmp edx, r8d
ja 0x1401038d1
nop dword [rax]
mov eax, ecx
inc ecx
inc edx
cmp byte [rax + r9], r12b
je 0x1401038d4
cmp edx, r8d
jbe 0x1401038c0
mov rdi, r12
cmp byte [rbp], r12b
je 0x1401038ec
mov rcx, qword [r13 + 0x3d8]
test rcx, rcx
je 0x1401038ec
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [r13 + 0x3d8]
test rcx, rcx
je 0x1401038fe
add rcx, 0x30
jmp 0x140103901
mov rcx, rbp
mov rbx, r12
test rcx, rcx
je 0x140103911
call fcn.140001930
mov rbx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r13 + 0x3c0], rax
test rbx, rbx
je 0x14010394e
mov rcx, rbx
call fcn.1401e36c8
mov rcx, qword [r13 + 0x3c0]
cmp rcx, 0xffffffffffffffff
je 0x1401039cb
lea rdx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.1401016e0
cmp dword [rsp + 0x50], r12d
jne 0x1401039c6
cmp dword [rsp + 0x54], r12d
jne 0x1401039c6
mov rcx, qword [r13 + 0x3c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3c0], 0xffffffffffffffff
mov dword [r13 + 0x3cc], r12d
jmp 0x1401039f0
mov r14d, r12d
jmp 0x1401039f0
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.1401016e0
test rdi, rdi
je 0x1401039ff
mov rcx, rdi
call fcn.140001cb0
mov esi, eax
mov eax, r12d
cmp qword [r13 + 0x3c0], 0xffffffffffffffff
sete al
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, rbp
mov r8d, 0x2d
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
test r14d, r14d
je case.0x140102c04.3
jmp 0x140103a60
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 4
mov r8b, 0x2e
mov edx, esi
mov rcx, r13
call fcn.1401016e0
mov rcx, qword [r13 + 0x3d8]
test rcx, rcx
je case.0x140102c04.3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
jne 0x140103ab2
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 1
mov r8b, 0x30
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
cmp qword [r13 + 0x3c0], 0xffffffffffffffff
jne 0x140103ae9
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 3
mov r8b, 0x30
mov edx, esi
mov rcx, r13
call fcn.1401016e0
jmp case.0x140102c04.3
cmp dword [r13 + 0x3cc], esi
jne case.0x140102c04.3
mov r14d, 1
cmp edi, 5
jb 0x140103b08
mov ebx, dword [rbx + 1]
test ebx, ebx
jne 0x140103b0d
mov ebx, 0x5000
lea ecx, [rbx + 2]
call fcn.14001c0c0
mov rdi, rax
test rax, rax
je 0x140103c36
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov rcx, qword [rax + 8]
mov byte [rcx], 0x30
mov rcx, qword [rax + 8]
mov byte [rcx + 1], r12b
mov rdx, qword [rax + 8]
add rdx, 2
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rcx, qword [r13 + 0x3c0]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140103bfd
mov eax, dword [rsp + 0x40]
add eax, 2
mov dword [rdi + 0x10], eax
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x250]
mov dword [rsp + 0x20], r11d
lea r9d, [r12 + 2]
mov r8, rdi
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [rsp + 0x40], r12d
jne 0x140103be7
mov rcx, qword [r13 + 0x3c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3c0], 0xffffffffffffffff
mov dword [r13 + 0x3cc], r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r12 + 0x31]
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
jmp 0x140103c22
mov rcx, qword [r13 + 0x3d8]
test rcx, rcx
je 0x140103bf8
call fcn.1400ff930
mov r14d, r12d
jmp 0x140103c22
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x30
mov edx, esi
mov rcx, r13
call fcn.1401016e0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
test r14d, r14d
je case.0x140102c04.3
jmp 0x140103c5e
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x30], eax
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 2
mov r8b, 0x30
mov edx, esi
mov rcx, r13
call fcn.1401016e0
mov rcx, qword [r13 + 0x3d8]
test rcx, rcx
je case.0x140102c04.3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x140102c04.3
cmp dword [r13 + 0x3cc], esi
jne case.0x140102c04.3
mov rcx, qword [r13 + 0x3c0]
cmp rcx, 0xffffffffffffffff
je 0x140103c99
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + 0x3c0], 0xffffffffffffffff
xor r12d, r12d
mov dword [r13 + 0x3cc], r12d
cmp dword [r14 + 0x10], 1
jbe 0x140103ce8
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsp + 0x250]
mov dword [rsp + 0x20], r11d
lea r9d, [r12 + 2]
mov r8, r14
mov edx, esi
mov rcx, r13
call fcn.140100400
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r9 + 0x33]
mov edx, esi
mov rcx, qword [0x1402e2a80]
call fcn.1400ef270
mov rcx, qword [r13 + 0x3d8]
test rcx, rcx
je case.0x140102c04.3
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x140102c04.3
cmp dword [r13 + 0x378], 0
je case.0x140102c04.3
mov rcx, qword [r13 + 0x3d8]
test rcx, rcx
je 0x140103d47
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x140102c04.3
cmp edi, 3
jbe case.0x140102c04.3
mov ecx, 0x188
call fcn.1401e37b4
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140103d83
xor r12d, r12d
mov qword [rsp + 0x20], r12
lea r9, [0x1401028f0]
mov r8d, esi
mov rdx, r14
mov rcx, rax
call fcn.1401079d0
jmp 0x140103d89
xor r12d, r12d
mov rax, r12
mov qword [r13 + 0x3d8], rax
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140001050
test eax, eax
jne case.0x140102c04.3
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9b, 0xff
mov r8b, getservbyport
mov edx, esi
mov rcx, r13
call fcn.1401016e0
mov rcx, qword [r13 + 0x3d8]
test rcx, rcx
je case.0x140102c04.3
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140102c04.3
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rbx + 1]
lea eax, [r11 - 0xa]
cmp eax, 0x2706
ja 0x140103e07
mov dword [r13 + 0x3ac], r11d
mov edx, dword [rbx + 5]
lea eax, [rdx - 1]
cmp eax, 0x270f
ja 0x140103e1b
mov dword [r13 + 0x3b4], edx
mov edx, dword [rbx + 9]
lea eax, [rdx - 1]
cmp eax, 0x7cf
ja 0x140103e2f
mov dword [r13 + 0x3b0], edx
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x140102c04.3
mov edi, dword [rbx + 1]
mov esi, dword [rbx + 5]
movzx ebx, byte [rbx + 9]
mov ebp, 0xdc
mov r8, rbp
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.1401e42d0
mov word [rsp + 0x144], bp
mov dword [rsp + 0x1a8], ebx
mov dword [rsp + 0x1ac], edi
mov dword [rsp + 0x1b0], esi
mov dword [rsp + 0x148], 0x1c0000
xor edx, edx
lea rcx, [rsp + 0x100]
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
jmp case.0x140102c04.3
cmp edi, 9
jae 0x140103eae
mov byte [r13 + 0x3d6], 1
jmp case.0x140102c04.3
mov esi, dword [rbx + 1]
mov ebp, dword [rbx + 5]
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11d, [rbp - 1]
cmp r11d, 0x63
ja 0x140103ecf
mov dword [r13 + 0x3a4], ebp
test esi, esi
jne 0x140103eea
mov dword [r13 + 0x3a8], 0xffffffff
xor r12d, r12d
mov dword [0x1402e2d80], r12d
jmp 0x140103f69
cmp esi, 1
jne 0x140103f06
mov dword [r13 + 0x3a8], 0xffffffff
mov dword [0x1402e2d80], 0xfefefe
jmp 0x140103f69
cmp esi, 2
jne 0x140103f22
mov dword [r13 + 0x3a8], 0xffffffff
mov dword [0x1402e2d80], 0xfcfcfc
jmp 0x140103f69
cmp esi, 3
jne 0x140103f3e
mov dword [r13 + 0x3a8], 0xffffffff
mov dword [0x1402e2d80], 0xf8f8f8
jmp 0x140103f69
cmp esi, 4
jne 0x140103f5a
mov dword [r13 + 0x3a8], 0x9c400
xor r12d, r12d
mov dword [0x1402e2d80], r12d
jmp 0x140103f69
cmp esi, 0x4e200
jbe 0x140103f69
mov dword [r13 + 0x3a8], esi
cmp edi, 0xd
jb 0x140103f77
mov eax, dword [rbx + 9]
mov dword [0x1402e2d80], eax
lea rcx, [r13 + 0x68]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x140102c04.3
mov r14d, 1
mov ecx, r14d
cmp dword [0x1402e2b58], 0
jne case.0x140102c04.3
cmp edi, 2
jb case.0x140102c04.3
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x140103fbb
lea eax, [rcx + 1]
cmp eax, edi
jbe 0x140103fa5
jmp case.0x140102c04.3
xor r12d, r12d
mov ebp, r12d
mov esi, ecx
add rsi, rbx
lea edx, [rcx + 1]
cmp edx, edi
ja 0x140104013
nop dword [rax]
mov eax, ecx
inc ecx
inc edx
cmp byte [rax + rbx], bpl
je 0x140103fe2
cmp edx, edi
jbe 0x140103fd0
jmp 0x140104013
mov r8d, ecx
add r8, rbx
lea edx, [rcx + 1]
cmp edx, edi
ja 0x140104016
nop
mov eax, ecx
inc ecx
inc edx
cmp byte [rax + rbx], bpl
je 0x140104002
cmp edx, edi
jbe 0x140103ff0
jmp 0x140104016
mov rcx, r8
call fcn.1400099b0
test r14b, al
cmovne ebp, r14d
jmp 0x140104016
mov rsi, r12
lea rdx, str.reboot
lea rcx, [rbx + 1]
call fcn.1401e35ac
test eax, eax
jne 0x1401040b8
lea rcx, str.SeShutdownPrivilege
call fcn.1400fcf20
test eax, eax
jne 0x14010406d
cmp dword [reloc.WS2_32.dll_accept], r14d
jg 0x14010406d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.shutdown_err_d
mov r8d, 0x3e8
lea rdx, str..TShareApe.cpp
mov ecx, r14d
call fcn.1400045a0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne case.0x140102c04.3
cmp dword [reloc.WS2_32.dll_accept], r14d
jg case.0x140102c04.3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.shutdown_err2_d
mov r8d, 0x3ec
lea rdx, str..TShareApe.cpp
mov ecx, r14d
call fcn.1400045a0
jmp case.0x140102c04.3
test ebp, ebp
jne 0x1401040d3
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbx + 1]
call fcn.1400fdc10
test eax, eax
jne case.0x140102c04.3
lea rdx, [rbx + 1]
lea rcx, str.logoff
call fcn.1401e35ac
test eax, eax
je case.0x140102c04.3
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r12
mov r9, rsi
lea r8, [rbx + 1]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.0x140102c04.3
cmp dword [0x1402e2b58], 0
jne case.0x140102c04.3
movzx eax, byte [rbx + 1]
mov ecx, eax
and ecx, 3
je 0x140104135
and cl, 1
mov byte [r13 + 0x3d4], cl
shr eax, 2
and eax, 3
je case.0x140102c04.3
and al, 1
mov byte [r13 + 0x3d5], al
jmp case.0x140102c04.3
cmp edi, 0x10
jbe 0x140104188
mov eax, dword [rbx + 1]
mov ecx, dword [rbx + 5]
mov edx, dword [rbx + 9]
mov r8d, dword [rbx + 0xd]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], ecx
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x7c], r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [0x1402e2a80]
call fcn.1400e6500
jmp case.0x140102c04.3
xor edx, edx
mov rcx, qword [0x1402e2a80]
call fcn.1400e6500
jmp case.0x140102c04.3
mov edx, edi
mov r14d, 1
mov ecx, r14d
cmp edi, 5
jbe 0x140104307
cmp edx, 2
jb 0x140104307
nop dword [rax + rax]
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x1401041d6
lea eax, [rcx + 1]
cmp eax, edx
jbe 0x1401041c0
jmp 0x140104307
lea rdx, [rbx + 1]
lea rcx, [rsp + 0xc8]
call fcn.140004c50
nop
cmp qword [r13 + 0x3e0], 0
jne 0x1401042f5
mov ecx, 0x1f8
call fcn.1401e37b4
mov qword [rsp + 0x60], rax
xor r12d, r12d
test rax, rax
je 0x14010421a
mov edx, r14d
mov rcx, rax
call fcn.14001bb10
jmp 0x14010421d
mov rax, r12
mov qword [r13 + 0x3e0], rax
lea rbp, [r13 + 0xa0]
mov r8d, 0xea60
lea rdx, str.bitRate
lea rcx, [rsp + 0xc8]
call fcn.140004e10
mov esi, eax
mov r8d, 8
lea rdx, str.sizeIndex
lea rcx, [rsp + 0xc8]
call fcn.140004e10
mov edi, eax
mov r8d, r14d
lea rdx, str.channel
lea rcx, [rsp + 0xc8]
call fcn.140004e10
mov ebx, eax
mov r8d, 0x5dc0
lea rdx, str.sampleRate
lea rcx, [rsp + 0xc8]
call fcn.140004e10
mov r8d, eax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
mov r9d, ebx
mov edx, 0x7e
mov rcx, qword [r13 + 0x3e0]
call fcn.14001bd50
test eax, eax
je 0x1401042d2
mov rcx, qword [r13 + 0x3e0]
add rcx, 8
call fcn.1400ff990
test eax, eax
je 0x1401042f5
mov rbx, qword [r13 + 0x3e0]
test rbx, rbx
je 0x1401042ee
mov rcx, rbx
call fcn.14001bc60
mov rcx, rbx
call fcn.1401e32b0
mov qword [r13 + 0x3e0], r12
lea rcx, [rsp + 0xc8]
call fcn.140004cd0
jmp case.0x140102c04.3
mov rbx, qword [r13 + 0x3e0]
test rbx, rbx
je case.0x140102c04.3
mov rcx, rbx
call fcn.14001bc60
mov rcx, rbx
call fcn.1401e32b0
xor r12d, r12d
mov qword [r13 + 0x3e0], r12
jmp case.0x140102c04.3
mov r14d, 1
mov ecx, r14d
cmp edi, 2
jb 0x1401043c3
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x140104357
lea eax, [rcx + 1]
cmp eax, edi
jbe 0x140104344
jmp 0x1401043c3
cmp byte [rbx + 1], 0
jne 0x140104380
test r13, r13
je 0x14010436b
lea r12, [r13 + 0xb8]
jmp 0x14010436e
xor r12d, r12d
mov r8d, r14d
mov rdx, r12
xor ecx, ecx
call fcn.1400ff510
jmp case.0x140102c04.3
mov r8d, 5
lea rdx, str.exit:
lea rcx, [rbx + 1]
call fcn.1401e59f0
test eax, eax
jne 0x1401043af
lea rcx, [rbx + 6]
call fcn.140001cb0
mov ecx, eax
call fcn.1400ff380
jmp case.0x140102c04.3
mov r8d, r14d
lea rdx, [rbx + 1]
mov ecx, r14d
call fcn.1400ff100
jmp case.0x140102c04.3
cmp dword [reloc.WS2_32.dll_accept], 3
jg case.0x140102c04.3
lea r9, str.Invalid_shell_parameter.
mov r8d, 0x454
lea rdx, str..TShareApe.cpp
mov ecx, 3
call fcn.1400045a0
jmp case.0x140102c04.3
mov r14d, 1
mov ecx, r14d
lea rdx, [rbx + 1]
cmp edi, 2
jb case.0x140102c04.3
nop dword [rax]
mov eax, ecx
inc ecx
cmp byte [rax + rbx], 0
je 0x140104426
lea eax, [rcx + 1]
cmp eax, edi
jbe 0x140104410
jmp case.0x140102c04.3
xor r8d, r8d
mov ecx, r14d
call fcn.1400ff100
jmp case.0x140102c04.3
lea rbx, str.no_func__
mov ebp, esi
and ebp, 0xfffffff1
or ebp, 1
mov rax, qword [0x1402e2a80]
mov ecx, dword [rax + 0x2b8]
shr ecx, 4
not ecx
xor r12d, r12d
test cl, 1
je 0x1401045f2
call fcn.1400e5970
test al, al
je 0x1401045f2
mov eax, dword [r13 + 0x368]
test eax, eax
je 0x140104483
cmp eax, esi
jne 0x1401045f2
cmp dword [r14 + 0x10], 1
jbe 0x1401044f5
mov rax, qword [r14 + 8]
movzx esi, byte [rax + 1]
test esi, esi
je 0x1401044f8
cmp qword [r13 + 0x3e8], r12
je 0x1401045db
mov r14d, 1
mov edx, r14d
mov rcx, r13
call fcn.140100fa0
mov rcx, qword [0x1402e2a80]
mov r9, qword [r13 + 0x3e8]
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [r13 + 0x3e8]
test rcx, rcx
je 0x1401044e9
mov rax, qword [rcx]
mov edx, r14d
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [r13 + 0x3e8], r12
jmp 0x1401045db
mov esi, r12d
cmp qword [r13 + 0x3e8], r12
jne 0x1401045db
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
test rax, rax
je 0x140104566
mov edx, 0x76
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
mov edx, 0x75
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r14d, eax
test ebx, ebx
jg 0x140104548
mov edx, 8
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
test r14d, r14d
jg 0x14010455b
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 0x50
call fcn.1401e37b4
test rax, rax
je 0x14010459c
mov qword [rax + 8], r12
mov qword [rax + 0x28], r12
mov qword [rax + 0x30], r12
mov dword [rax + 0x38], r12d
mov rcx, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rax + 0x40], rcx
lea rcx, vtable.CBlankScreen.0
mov qword [rax], rcx
jmp 0x14010459f
mov rax, r12
mov qword [r13 + 0x3e8], rax
mov dword [rax + 0x48], ebp
mov rcx, qword [0x1402e2a80]
mov r9, qword [r13 + 0x3e8]
mov edx, 0x402
mov r8d, 1
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x1401045db
xor edx, edx
mov rcx, r13
call fcn.140100fa0
mov ebp, r12d
lea rax, str.__dlg_scut__nscreen__.removeClass_active_
lea rbx, str.__dlg_scut__nscreen__.addClass_active_
test esi, esi
cmovg rbx, rax
mov qword [rsp + 0x58], r12
mov r8, rbx
mov edx, 0x25
lea rcx, [rsp + 0x58]
call fcn.1400dea40
nop
mov rbx, qword [rsp + 0x58]
mov r8, rbx
mov edx, ebp
mov rcx, qword [0x1402e2a80]
call fcn.1400de9a0
nop
test rbx, rbx
je case.0x140102c04.3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp case.0x140102c04.3
mov ecx, edi
mov r14d, 1
cmp edi, 5
jbe case.0x140102c04.3
lea rdx, [rbx + 1]
cmp ecx, 2
jb case.0x140102c04.3
nop word [rax + rax]
mov eax, r14d
inc r14d
cmp byte [rax + rbx], 0
je 0x140104666
lea eax, [r14 + 1]
cmp eax, ecx
jbe 0x140104650
jmp case.0x140102c04.3
mov r8d, esi
mov rcx, r13
call fcn.140102670
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1401e42a0
mov rbx, qword [rsp + 0x240]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
repz ret