Function at 0x14012f840
Capabilities:
Manipulate console buffer
Set current directory

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov word [rsp + 8], cx
sub rsp, 0x148
mov byte [rsp + 0x30], 0x5f
movzx eax, byte [rsp + 0x160]
mov byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x158]
sub eax, 0xc4
mov byte [rsp + 0x30], al
movzx eax, word [rsp + 0x150]
mov word [rsp + 0x34], ax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x70], al
cmp byte [rsp + 0x70], 0x3c
je 0x14012f8a4
cmp byte [rsp + 0x70], 0xf4
je 0x14012f996
jmp 0x14012f9a9
movzx eax, byte [rsp + 0x158]
add eax, 0x6f
movzx ecx, byte [rsp + 0x30]
cmp eax, ecx
je 0x14012f994
movsx eax, byte [rsp + 0x160]
and eax, 0x1a
movsx ecx, byte [rsp + 0x31]
cmp eax, ecx
jne 0x14012f968
lea rax, [rsp + 0x160]
mov qword [rsp + 0x48], rax
movzx eax, word [rsp + 0x34]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
je 0x14012f8fd
cmp dword [rsp + 0x74], 0x55f
je 0x14012f91f
jmp 0x14012f966
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [0x14017c008]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x60], rax
jmp 0x14012f966
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x160]
xor eax, ecx
mov byte [rsp + 0x31], al
mov edx, 0xd8
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_DecryptFileA]
mov dword [rsp + 0x88], eax
movzx eax, word [rsp + 0x34]
movzx ecx, word [rsp + 0x150]
shl eax, cl
mov rcx, qword [rsp + 0x60]
mov word [rcx], ax
jmp 0x14012f994
movzx eax, word [rsp + 0x150]
or eax, 0xd97
movzx ecx, word [rsp + 0x34]
cmp eax, ecx
jg 0x14012f994
movzx eax, byte [rsp + 0x158]
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx]
sar eax, cl
mov byte [rsp + 0x30], al
jmp 0x14012f9a9
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
movzx ecx, byte [rax]
call fcn.140130610
nop
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x30]
add eax, ecx
movzx ecx, byte [rsp + 0x158]
cmp eax, ecx
jle 0x14012fe03
movzx eax, word [rsp + 0x150]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x73f
je 0x14012f9f1
cmp dword [rsp + 0x78], 0xf3e
je 0x14012fa81
jmp 0x14012fb51
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x158]
add eax, ecx
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x160]
mov byte [rsp + 0x7c], al
cmp byte [rsp + 0x7c], 0x21
je 0x14012fa23
cmp byte [rsp + 0x7c], 0x78
je 0x14012fa70
jmp 0x14012fa7c
movsx eax, byte [rsp + 0x31]
movsx ecx, byte [rsp + 0x160]
add eax, ecx
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x98]
mov r8d, 0x50
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov dword [rsp + 0xb4], eax
jmp 0x14012fa7c
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x158], al
jmp 0x14012fb51
movsx eax, byte [rsp + 0x31]
movsx ecx, byte [rsp + 0x160]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
movsx eax, byte [rsp + 0x31]
movsx ecx, byte [rsp + 0x160]
or eax, ecx
mov rcx, qword [rsp + 0x48]
movsx ecx, byte [rcx]
cmp eax, ecx
jg 0x14012fb0f
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x80], al
cmp byte [rsp + 0x80], 0x5c
je 0x14012fad7
cmp byte [rsp + 0x80], 0x71
je 0x14012faf9
jmp 0x14012fb0f
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [rsp + 0xb8], eax
mov ecx, 0x1b
call fcn.14012efc0
nop
jmp 0x14012fb0f
movzx eax, byte [rsp + 0x158]
movzx ecx, byte [rsp + 0x30]
sar eax, cl
mov rcx, qword [rsp + 0x40]
mov byte [rcx], al
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x150]
xor eax, ecx
mov word [rsp + 0x34], ax
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x30]
shl eax, cl
mov rcx, qword [rsp + 0x40]
mov byte [rcx], al
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x94], al
cmp byte [rsp + 0x94], 0x3c
je 0x14012fb6c
jmp 0x14012fc63
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x58], rax
mov eax, 0x6cc0
mov word [rsp + 0x38], ax
movzx eax, byte [rsp + 0x30]
movzx ecx, byte [rsp + 0x158]
and eax, ecx
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx]
cmp eax, ecx
jle 0x14012fc61
movzx eax, byte [rsp + 0x30]
movzx ecx, byte [rsp + 0x158]
sub eax, ecx
mov rcx, qword [rsp + 0x40]
movzx ecx, byte [rcx]
cmp eax, ecx
jne 0x14012fbc7
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov word [rsp + 0x50], ax
jmp 0x14012fc12
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
add eax, 0xc6956743
cmp eax, dword [rsp + 0x3c]
je 0x14012fc12
mov rax, qword [rsp + 0x58]
mov eax, dword [rax]
add eax, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
mov rax, qword [rsp + 0x48]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x30]
mov rax, qword [rsp + 0x60]
movzx ecx, word [rax]
call fcn.14012f840
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x160], al
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd3
mov r9d, 0x5c
mov r8d, 0x55
mov edx, 0xd3
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_LockFileEx]
mov dword [rsp + 0xbc], eax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x3c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
jmp 0x14012fc8b
movsx eax, byte [rsp + 0x160]
mov rcx, qword [rsp + 0x48]
movsx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x58]
mov edx, dword [rax]
mov ecx, 0x82
call fcn.140130970
nop
mov eax, dword [rsp + 0x3c]
add eax, 0xc4d3e8aa
mov rcx, qword [rsp + 0x58]
cmp eax, dword [rcx]
jne 0x14012fd29
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x30]
sub eax, ecx
mov rcx, qword [rsp + 0x40]
mov byte [rcx], al
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0x87198439
je 0x14012fd12
cmp dword [rsp + 0x84], 0xa8e238c0
je 0x14012fcde
jmp 0x14012fd29
movsx eax, word [rsp + 0x38]
sub eax, 0xce6
mov word [rsp + 0x38], ax
mov r8d, 0x99
lea rdx, str.Ignorant_Bookbinders
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov qword [rsp + 0xc0], rax
jmp 0x14012fd29
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x50]
add eax, ecx
mov rcx, qword [rsp + 0x60]
mov word [rcx], ax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xc8], rax
movabs rax, 0x8ef258a56b266c08
cmp qword [rsp + 0xc8], rax
je 0x14012fd4c
jmp 0x14012fd5c
mov rax, qword [rsp + 0x60]
movzx ecx, word [rax]
call fcn.1401302a0
nop
jmp 0x14012fd8e
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x8c], ax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x100], rax
mov dword [rsp + 0xb0], 0x8e73b47
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xa0], rax
movabs rax, 0x69739c30c7fd5522
cmp qword [rsp + 0xa0], rax
je 0x14012fded
movabs rax, 0x84cee7d515b6eb8b
cmp qword [rsp + 0xa0], rax
je 0x14012fdc5
jmp 0x14012fe03
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x54], al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x108], rax
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x90], ax
jmp 0x14012fe03
movzx eax, byte [rsp + 0x158]
movzx ecx, byte [rsp + 0x30]
xor eax, ecx
mov rcx, qword [rsp + 0x40]
mov byte [rcx], al
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xa8], rax
movabs rax, 0xaffe40a8e5aca481
cmp qword [rsp + 0xa8], rax
je 0x14012fe96
movabs rax, 0xce9ff95039e28337
cmp qword [rsp + 0xa8], rax
je 0x14012fe3a
jmp 0x14012feac
mov rax, qword [rsp + 0x48]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x31]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
movabs rax, 0xd05ab8c1dd05869d
mov rcx, qword [0x14017c008]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x88]
lea rcx, str.impersonators_famousBistable_bellyful_spacemen
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
mov dword [rsp + 0x3c], eax
mov edx, dword [rsp + 0x3c]
mov ecx, 0x42
call fcn.140130970
nop
jmp 0x14012feac
mov rax, qword [rsp + 0x40]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x30]
sub eax, ecx
mov rcx, qword [rsp + 0x40]
mov byte [rcx], al
mov eax, 9
add rsp, 0x148
ret