Function at 0x14000e904
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rax - 0x48], 0xfffffffffffffffe
mov eax, r9d
mov r14, rcx
xor esi, esi
mov dword [rsp + 0x70], esi
lea r15, str.WmiApRpl
mov qword [rsp + 0x78], r15
mov edi, 0x8000ffff
cmp word [str.WmiApRpl], si
je 0x14000fb29
test eax, eax
jne 0x14000e968
cmp dword [rcx + 0x60], esi
je 0x14000fb29
mov qword [rsp + 0x68], rsi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea ebx, [rax + 0xa]
mov eax, 2
mul rbx
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.14001930c
mov r12, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x14000e9b0
mov edi, 0x8007000e
jmp 0x14000ec4d
mov r8, r15
mov rdx, rbx
mov rcx, rax
call fcn.14000393c
mov edi, eax
test eax, eax
js 0x14000ec4d
lea r8, str._new.ini
mov rdx, rbx
mov rcx, r12
call fcn.14000389c
mov edi, eax
test eax, eax
js 0x14000ec4d
mov rdx, r12
mov rcx, r14
call fcn.14000cb28
mov edi, eax
test eax, eax
js 0x14000ec4d
mov edi, 0x80004005
mov dword [rsp + 0xd8], esi
lea rcx, [0x14002018c]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenA]
mov ebx, eax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xd8]
mov r8d, eax
lea rdx, [0x14002018c]
mov rcx, qword [r14 + 0x78]
call qword [sym.imp.api_ms_win_core_file_l1_2_1.dll_WriteFile]
test eax, eax
je 0x14000ec4d
cmp ebx, dword [rsp + 0xd8]
jne 0x14000ec4d
mov edi, esi
lea r13, vtable.CGenerateComment.0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x30]
call fcn.140011b4c
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011c24
lea rdx, str.Copyright__C__2000_Microsoft_Corporation
lea rcx, [rsp + 0x30]
call fcn.140011c24
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011c24
lea rdx, str.Module_Name:
lea rcx, [rsp + 0x30]
call fcn.140011c24
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140011c24
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011c24
lea rdx, str.Abstract:
lea rcx, [rsp + 0x30]
call fcn.140011c24
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011c24
lea rdx, str.Describes_all_the_counters_supported_via_WMI_Hi_Performance_providers
lea rcx, [rsp + 0x30]
call fcn.140011c24
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011c24
lea rcx, [rsp + 0x30]
call fcn.140011bb0
nop
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011d9c
lea rdx, str._info__r_n
lea rcx, [rsp + 0x30]
call fcn.140011d9c
lea rdx, str.drivername
lea rcx, [rsp + 0x30]
call fcn.140011d9c
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140011d9c
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011d9c
lea rdx, str.symbolfile
lea rcx, [rsp + 0x30]
call fcn.140011d9c
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140011d9c
lea rdx, [0x14002013c]
lea rcx, [rsp + 0x30]
call fcn.140011d9c
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011d9c
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011d9c
lea rdx, str._languages__r_n
lea rcx, [rsp + 0x30]
call fcn.140011d9c
mov ebx, esi
mov r15d, 1
cmp ebx, dword [r14 + 0x6c]
jae 0x14000ebe1
mov eax, ebx
mov edx, dword [r14 + rax*4 + 0x64]
call fcn.14000e318
mov r12, rax
test rax, rax
je 0x14000ebd7
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140011d9c
mov rcx, r12
call sub.msvcrt.dll_free
jmp 0x14000ebdc
mov edi, 0x8007000e
add ebx, r15d
jmp 0x14000eba6
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140011d9c
nop
jmp 0x14000ec16
test edi, edi
js 0x14000ec37
mov rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.14000ca7c
mov edi, eax
test eax, eax
js 0x14000ec37
mov rcx, r14
call fcn.14000e4c0
mov edi, eax
mov qword [rsp + 0x30], r13
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
or r13, 0xffffffffffffffff
jmp 0x14000ec53
mov r15d, 1
jmp 0x14000ec78
test edi, edi
js 0x14000eed5
mov eax, esi
cmp dword [r14 + 0x6c], 2
jne 0x14000ee05
call fcn.140009fc8
mov r12, rax
test rax, rax
je 0x14000edfd
mov r8d, dword [r14 + 0x64]
lea rdx, str.WMI_Objects
call fcn.14000e418
mov r13, rax
test rax, rax
je 0x14000ede9
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000edee
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000edee
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000edee
mov edx, 0xcc
mov rcx, r12
call fcn.140005c8c
mov rbx, rax
test rax, rax
je 0x14000ed51
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000ed47
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000ed56
mov edi, 0x8007000e
test edi, edi
js 0x14000edee
mov r8d, r15d
mov rdx, r13
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000edee
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000edee
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000edee
mov edx, 0xcf
mov rcx, r12
call fcn.140005c8c
mov rbx, rax
test rax, rax
je 0x14000ede9
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000eddf
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000edee
mov edi, 0x8007000e
mov rcx, r12
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
or r13, 0xffffffffffffffff
jmp 0x14000ee02
mov edi, 0x80004005
mov eax, r15d
test edi, edi
js 0x14000eed5
mov r8d, dword [r14 + rax*4 + 0x64]
lea rdx, str.WMI_Objects
call fcn.14000e418
mov rbx, rax
test rax, rax
je 0x14000eeb8
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000eeae
mov r8d, r15d
lea rdx, str.NAMEWMI_Objects
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000eeae
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000eeae
mov r8d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000eeae
mov r8d, r15d
lea rdx, str.HELPNumber_of_WMI_High_Performance_provider_returned_by_WMI_Adapter
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000eeae
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000eebd
mov edi, 0x8007000e
test edi, edi
js 0x14000eed5
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov edx, esi
mov dword [rsp + 0xd8], edx
mov eax, esi
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0x60], eax
test edi, edi
js 0x14000faf3
cmp dword [rsp + 0xe8], r13d
je 0x14000f1df
mov r13d, esi
mov dword [rsp + 0x40], r13d
cmp r13d, dword [r14 + 0x60]
jae 0x14000f1df
test edi, edi
js 0x14000faf3
mov eax, r13d
lea rbx, [rax + rax*2]
add rbx, rbx
cmp qword [r14 + rbx*8 + 0x28], rsi
je 0x14000f1d7
mov rbx, qword [r14 + rbx*8 + 0x20]
mov rbx, qword [rbx]
mov eax, r13d
lea rcx, [rax + rax*2]
add rcx, rcx
cmp rbx, qword [r14 + rcx*8 + 0x20]
je 0x14000f19f
test edi, edi
js 0x14000f19f
mov rax, qword [rbx + 0x20]
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x50], eax
mov r12d, esi
cmp r12d, dword [r14 + 0x6c]
jae 0x14000f0f7
test edi, edi
js 0x14000f10f
cmp r12d, eax
jae 0x14000f0f7
mov rax, qword [rbx + 0x20]
mov r8d, edx
mov rdx, qword [rax + 8]
call fcn.14000c67c
mov rdi, rax
test rax, rax
je 0x14000f0df
mov eax, r12d
mov r8d, dword [r14 + rax*4 + 0x64]
mov rdx, rdi
call fcn.14000e418
mov qword [rsp + 0x58], rax
mov rcx, rdi
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14000f0df
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x18]
mov ecx, r12d
mov rax, qword [rax + rcx*8]
mov r8d, r15d
mov rdx, qword [rax + 8]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov r8d, r15d
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x18]
mov ecx, r12d
mov rax, qword [rax + rcx*8]
mov r8d, r15d
mov rdx, qword [rax + 0x10]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f0d3
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
jmp 0x14000f0e4
mov edi, 0x8007000e
add r12d, r15d
mov edx, dword [rsp + 0xd8]
mov eax, dword [rsp + 0x50]
jmp 0x14000ef63
test edi, edi
js 0x14000f10f
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
cmp dword [rsp + 0x70], esi
je 0x14000f139
test edi, edi
js 0x14000f139
mov dword [rsp + 0x20], 0xbb8
mov edx, 0x3e8
mov ecx, 3
lea r9d, [rcx + 7]
lea r8d, [rcx + 0x61]
call qword [sym.imp.wbemcomn.dll_long_int___cdecl_Throttle_unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int_]
cmp byte [rbx + 0x29], sil
je 0x14000f155
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14001a510
jmp 0x14000f189
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], sil
jne 0x14000f16d
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], sil
je 0x14000f15f
jmp 0x14000f189
mov rax, qword [rbx + 8]
jmp 0x14000f180
cmp rbx, qword [rax + 0x10]
jne 0x14000f186
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], sil
je 0x14000f173
mov rbx, rax
mov edx, dword [rsp + 0xd8]
add edx, r15d
mov dword [rsp + 0xd8], edx
jmp 0x14000ef38
jmp 0x14000f1d7
add r13d, r15d
jmp 0x14000ef04
test edi, edi
js 0x14000faf3
mov eax, esi
cmp dword [r14 + 0x6c], 2
jne 0x14000f4e8
call fcn.140009fc8
mov r13, rax
test rax, rax
je 0x14000f4e0
mov r8d, dword [r14 + 0x64]
lea rdx, str.HiPerf_Classes
call fcn.14000e418
mov r12, rax
test rax, rax
je 0x14000f35c
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov edx, 0xcd
mov rcx, r13
call fcn.140005c8c
mov rbx, rax
test rax, rax
je 0x14000f2b8
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f2ae
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000f2bd
mov edi, 0x8007000e
test edi, edi
js 0x14000f4d5
mov r8d, r15d
mov rdx, r12
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov edx, 0xd0
mov rcx, r13
call fcn.140005c8c
mov rbx, rax
test rax, rax
je 0x14000f35c
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f352
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000f361
mov edi, 0x8007000e
test edi, edi
js 0x14000f4d5
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, dword [r14 + 0x64]
lea rdx, str.HiPerf_Validity
call fcn.14000e418
mov r12, rax
test rax, rax
je 0x14000f4d0
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov edx, 0xce
mov rcx, r13
call fcn.140005c8c
mov rbx, rax
test rax, rax
je 0x14000f438
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f42e
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000f43d
mov edi, 0x8007000e
test edi, edi
js 0x14000f4d5
mov r8d, r15d
mov rdx, r12
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4d5
mov edx, 0xd1
mov rcx, r13
call fcn.140005c8c
mov rbx, rax
test rax, rax
je 0x14000f4d0
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f4c6
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000f4d5
mov edi, 0x8007000e
mov rcx, r13
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
jmp 0x14000f4e5
mov edi, 0x80004005
mov eax, r15d
test edi, edi
js 0x14000faf3
mov r12d, eax
mov r8d, dword [r14 + r12*4 + 0x64]
lea rdx, str.HiPerf_Classes
call fcn.14000e418
mov rbx, rax
test rax, rax
je 0x14000f582
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f578
mov r8d, r15d
lea rdx, str.NAMEHiPerf_Classes
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f578
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f578
mov r8d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f578
mov r8d, r15d
lea rdx, str.HELPShows_High_Performance_Classes
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000f587
mov edi, 0x8007000e
test edi, edi
js 0x14000faf3
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000faf3
mov r8d, dword [r14 + r12*4 + 0x64]
lea rdx, str.HiPerf_Validity
call fcn.14000e418
mov rbx, rax
test rax, rax
je 0x14000f656
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f64c
mov r8d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f64c
mov r8d, r15d
lea rdx, str.NAMEHiPerf_Validity
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f64c
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f64c
mov r8d, r15d
mov rdx, rbx
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f64c
mov r8d, r15d
lea rdx, str.HELPShows_if_High_Performance_Classes_are_valid
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14000f65b
mov edi, 0x8007000e
test edi, edi
js 0x14000faf3
or rbx, 0xffffffffffffffff
cmp dword [rsp + 0xe8], ebx
je 0x14000f9f7
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0xd8], eax
mov r13d, esi
mov dword [rsp + 0x50], r13d
cmp r13d, dword [r14 + 0x60]
jae 0x14000f9f7
test edi, edi
js 0x14000faf3
mov eax, r13d
lea rbx, [rax + rax*2]
add rbx, rbx
cmp qword [r14 + rbx*8 + 0x28], rsi
je 0x14000f9eb
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rbx, qword [r14 + rbx*8 + 0x20]
mov rbx, qword [rbx]
mov eax, r13d
lea rcx, [rax + rax*2]
add rcx, rcx
cmp rbx, qword [r14 + rcx*8 + 0x20]
je 0x14000f9b7
test edi, edi
js 0x14000f9b7
mov ecx, esi
mov dword [rsp + 0x40], ecx
mov rax, qword [rbx + 0x20]
cmp ecx, dword [rax + 0x38]
jae 0x14000f91d
test edi, edi
js 0x14000f91d
mov edx, ecx
mov qword [rsp + 0x30], rdx
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + rdx*8]
cmp qword [rcx + 0x20], rsi
je 0x14000f911
mov eax, dword [rcx + 0x28]
mov dword [rsp + 0x60], eax
mov r12d, esi
cmp r12d, dword [r14 + 0x6c]
jae 0x14000f8f9
test edi, edi
js 0x14000f911
cmp r12d, eax
jae 0x14000f8f9
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + rdx*8]
mov r8d, dword [rsp + 0xe0]
mov rdx, qword [rax + 8]
call fcn.14000c67c
mov rdi, rax
test rax, rax
je 0x14000f8e3
mov eax, r12d
mov r8d, dword [r14 + rax*4 + 0x64]
mov rdx, rdi
call fcn.14000e418
mov qword [rsp + 0x58], rax
mov rcx, rdi
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14000f8e3
mov r8d, r15d
mov rdx, rax
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov r8d, r15d
lea rdx, str.NAME
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax + rcx*8]
mov rax, qword [rax + 0x20]
mov ecx, r12d
mov rax, qword [rax + rcx*8]
mov r8d, r15d
mov rdx, qword [rax + 8]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov r8d, r15d
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov r8d, r15d
lea rdx, str.HELP
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov r8d, r15d
lea rdx, [0x14001fc78]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov rax, qword [rbx + 0x20]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax + rcx*8]
mov rax, qword [rax + 0x20]
mov ecx, r12d
mov rax, qword [rax + rcx*8]
mov r8d, r15d
mov rdx, qword [rax + 0x10]
mov rcx, r14
call fcn.14000c798
mov edi, eax
test eax, eax
js 0x14000f8d7
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov rcx, qword [rsp + 0x58]
call sub.msvcrt.dll_free
jmp 0x14000f8e8
mov edi, 0x8007000e
add r12d, r15d
mov rdx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x60]
jmp 0x14000f73c
test edi, edi
js 0x14000f911
mov r8d, r15d
lea rdx, [0x14001fc20]
mov rcx, r14
call fcn.14000c798
mov edi, eax
mov ecx, dword [rsp + 0x40]
add ecx, r15d
jmp 0x14000f700
cmp dword [rsp + 0x70], esi
je 0x14000f947
test edi, edi
js 0x14000f947
mov dword [rsp + 0x20], 0xbb8
mov edx, 0x3e8
mov ecx, 3
lea r9d, [rcx + 7]
lea r8d, [rcx + 0x61]
call qword [sym.imp.wbemcomn.dll_long_int___cdecl_Throttle_unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int__unsigned_long_int_]
cmp byte [rbx + 0x29], sil
je 0x14000f963
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14001a510
jmp 0x14000f997
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x29], sil
jne 0x14000f97b
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], sil
je 0x14000f96d
jmp 0x14000f997
mov rax, qword [rbx + 8]
jmp 0x14000f98e
cmp rbx, qword [rax + 0x10]
jne 0x14000f994
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x29], sil
je 0x14000f981
mov rbx, rax
mov r12d, dword [rsp + 0xe0]
add r12d, r15d
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r12d
jmp 0x14000f6e1
jmp 0x14000f9eb
or rbx, 0xffffffffffffffff
add r13d, r15d
jmp 0x14000f699
test edi, edi
js 0x14000faf3
mov edx, r15d
mov rcx, r14
call fcn.14000c720
mov edi, eax
test eax, eax
js 0x14000fad3
mov qword [rsp + 0xd8], rsi
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenW]
lea r15d, [rax + 6]
mov eax, 2
mul r15
cmovo rax, rbx
mov rcx, rax
call fcn.14001930c
mov rbx, rax
mov qword [rsp + 0xd8], rax
test rax, rax
jne 0x14000fa56
mov edi, 0x8007000e
jmp 0x14000fa9b
mov r8, qword [rsp + 0x78]
mov rdx, r15
mov rcx, rax
call fcn.14000393c
mov edi, eax
test eax, eax
js 0x14000fa9b
lea r8, str..ini
mov rdx, r15
mov rcx, rbx
call fcn.14000389c
mov edi, eax
test eax, eax
js 0x14000fa9b
mov r8, rbx
mov r15, qword [rsp + 0x48]
mov rdx, r15
mov rcx, r14
call fcn.14000ce38
mov edi, eax
jmp 0x14000faa0
mov r15, qword [rsp + 0x48]
jmp 0x14000fac0
test rbx, rbx
je 0x14000facd
mov rcx, rbx
call sub.msvcrt.dll_free
test edi, edi
jns 0x14000fb1c
jmp 0x14000fad8
mov r15, qword [rsp + 0x48]
mov rax, qword [0x1400306c0]
test rax, rax
je 0x14000fb11
mov word [rax], si
mov dword [0x14002f248], 0x1000
jmp 0x14000fb11
mov rax, qword [0x1400306c0]
test rax, rax
je 0x14000fb0c
mov word [rax], si
mov dword [0x14002f248], 0x1000
mov r15, qword [rsp + 0x48]
mov rdx, r15
mov rcx, r14
call fcn.14000ccf0
test r15, r15
je 0x14000fb29
mov rcx, r15
call sub.msvcrt.dll_free
mov eax, edi
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret