Function at 0x140005eec
Capabilities:
Create thread
Get common file path
Move file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x92a8
call fcn.140001685
sub rsp, rax
movaps xmmword [rsp + 0x9290], xmm6
mov rdi, qword [rcx]
mov r14, qword [rcx + 8]
mov rbx, qword [rcx + 0x10]
movzx eax, byte [rcx + 0x1c]
lea rcx, [rsp + 0xb0]
mov qword [rcx], rdi
mov qword [rcx + 8], r14
and qword [rcx + 0x10], 0
mov qword [rsp + 0x138], rcx
lea ecx, [rax - 3]
cmp ecx, 0x10
jbe 0x1400060ad
lea ecx, [rax - 0x2f]
cmp ecx, 9
jbe 0x14000615c
cmp eax, 0x1b
je 0x140006967
cmp eax, 0x21
je 0x140006a64
cmp eax, 0x27
je 0x14000699c
cmp eax, 0x43
je 0x14000668f
cmp eax, 0x49
je 0x1400067d2
cmp eax, 0x4a
je 0x1400066a6
cmp eax, 0x4e
jne case.0x1400060bd.7
lea rsi, [rsp + 0x1d0]
lea r12, [rsp + 0xb0]
mov rcx, rsi
mov rdx, r12
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov r8d, dword [rsp + 0x1d0]
mov si, 0xb
cmp r8, 0x100
ja case.0x1400060bd.6
test r8, r8
je 0x14000605c
lea r15, [rbx + 0x188]
lea rsi, [rsp + 0xb78]
mov rcx, rsi
mov rdx, r15
call fcn.140003d54
movzx esi, word [rsi + 0x10]
test si, si
jne case.0x1400060bd.6
mov r14, qword [rsp + 0xb78]
mov rdi, qword [rsp + 0xb80]
lea rdx, [rsp + 0x548]
mov qword [rdx], r12
lea rcx, [rsp + 0x330]
mov r8, r14
mov r9, rdi
call fcn.14000a313
lea r8, str._COMSPEC_
mov r9d, 9
mov rcx, r14
mov rdx, rdi
call fcn.140005c99
test al, 1
je 0x140007638
mov rcx, r15
mov rdx, r14
mov r8, rdi
call fcn.140004692
movdqu xmm0, xmmword [rbx + 0x188]
lea rdx, [rsp + 0x860]
movdqa xmmword [rdx], xmm0
lea r8, str.cmd.exe
lea rsi, [rsp + 0x1290]
mov r9d, 7
mov rcx, rsi
call fcn.140004044
cmp word [rsi + 0x10], 0
jne 0x14000762e
mov rdi, qword [rsp + 0x1298]
mov r14, qword [rsp + 0x1290]
jmp 0x140007633
xor esi, esi
lea rax, [0x140008608]
movsxd rcx, dword [rax + rcx*4]
add rcx, rax
jmp rcx
mov edx, 1
lock xadd dword [rbx + 0x198], edx
mov qword [rsp + 0x20], 4
lea r9, [0x14002f2f7]
mov rcx, rbx
mov r8d, 0x1a
call fcn.1400088ca
mov esi, eax
test ax, ax
jne case.0x1400060bd.6
lea rsi, [rbx + 0x180]
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
xor edi, edi
mov rax, qword [rbx + 0x160]
test rax, rax
je 0x140006124
cmp dword [rbx + 0x168], 0
je 0x1400085e4
mov ecx, dword [rax - 8]
jmp 0x140006133
cmp dword [rbx + 0x168], 0
je 0x1400085e4
xor ecx, ecx
mov edx, edi
cmp rcx, rdx
je 0x1400085e4
cmp byte [rax + rdx], 0
js 0x140006149
inc rdx
jmp 0x140006135
mov rax, qword [rax - 0x18]
lea edi, [rdx + 1]
mov rax, qword [rax + rdx*8]
mov rcx, qword [rax]
call qword [rax + 8]
jmp 0x140006106
lea rax, [0x14000864c]
movsxd rcx, dword [rax + rcx*4]
add rcx, rax
jmp rcx
lea rsi, [rsp + 0x1290]
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov eax, dword [rsp + 0x1290]
imul rcx, rax, 0xf4240
call fcn.14000446d
jmp case.0x1400060bd.6
lea rdx, str.not_support
mov r8d, 0xb
jmp 0x14000752a
lea rdx, [rsp + 0x138]
mov cl, 1
jmp 0x140006699
lea r15, [rsp + 0x860]
lea rsi, [rsp + 0x1290]
mov rcx, r15
mov rdx, rsi
mov r8, rdi
mov r9, r14
call fcn.140008f10
cmp word [r15 + 8], 0
jne 0x14000622c
mov rax, qword [rsp + 0x860]
cmp rax, 0x104
ja 0x14000622c
add eax, eax
lea rcx, [rsp + 0xb78]
mov word [rcx], ax
mov word [rcx + 2], ax
mov qword [rcx + 8], rsi
call sub.ntdll.dll_RtlSetCurrentDirectory_U
cmp eax, 0xc0000013
je 0x14000622c
test eax, eax
je 0x14000737f
lea rdx, [0x14002f2fc]
mov r8d, 2
jmp 0x14000752a
lea rsi, [rsp + 0xb78]
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov edi, dword [rsp + 0xb78]
lea rsi, [rbx + 0x180]
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov r14, qword [rbx + 0x160]
lea r15, [0x1400301d0]
cmp dword [rbx + 0x168], 0
je 0x140007227
mov ecx, edi
call fcn.140009455
test r14, r14
je 0x140006bd7
mov ecx, dword [r14 - 8]
lea edx, [rcx - 1]
jmp 0x140006bde
lea rsi, [rsp + 0xb78]
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov edi, dword [rsp + 0xb78]
lea rsi, [rsp + 0x1290]
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov al, byte [rsp + 0x1290]
mov dword [rbx + 0x108], edi
mov byte [rbx + 0x112], al
jmp 0x14000737f
lea r15, [rbx + 0x188]
lea rsi, [rsp + 0xb78]
mov rcx, rsi
mov rdx, r15
mov r8, rdi
mov r9, r14
call fcn.140004044
movzx esi, word [rsi + 0x10]
test si, si
jne case.0x1400060bd.6
mov r14, qword [rsp + 0xb78]
mov rdi, qword [rsp + 0xb80]
lea r9, [0x14002fe00]
lea rsi, [rsp + 0x860]
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.140008ffa
cmp word [rsi + 8], 0
je 0x140006b61
lea rdx, str.open
jmp 0x140006b8e
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x50], rax
cmp r14, 4
jae 0x140006ab0
test r14, r14
je 0x140007314
mov al, byte [rdi]
jmp 0x140007278
cmp r14, 4
mov esi, 4
cmovb rsi, r14
lea rcx, [rsp + 0xd8]
mov rdx, rdi
mov r8, rsi
call fcn.1400027aa
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x10], rsi
lea rsi, [rsp + 0x88]
mov rcx, rsi
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov edi, dword [rsp + 0x88]
lea r14, [rbx + 0x188]
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.140003d54
movzx esi, word [rsi + 0x10]
test si, si
jne case.0x1400060bd.6
mov r15, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
lea rcx, [rsp + 0xb0]
mov rdx, r15
mov r8, r12
call fcn.140005eb6
mov si, 1
test ax, ax
jne 0x14000812f
dec edi
cmp byte [r15 + rdi], 0x2a
cmovne rdi, r12
lea rsi, [rsp + 0x860]
mov rcx, rsi
mov rdx, r15
mov r8, rdi
call fcn.1400096b0
cmp word [rsi + 0x218], 0
jne 0x140008118
mov qword [rsp + 0x50], r12
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0x860]
mov r8d, 0x218
call fcn.1400027aa
lea rdi, [rsp + 0x338]
mov r13, qword [rdi - 8]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov r12, qword [rax + 0x48]
movabs rax, 0x180100000
lea r9, [rsp + 0x548]
mov qword [r9 + 0x10], rax
mov qword [r9], r12
and qword [r9 + 8], 0
mov dword [r9 + 0x18], 1
mov word [r9 + 0x1c], 0x100
lea rsi, [rsp + 0xa0]
mov rcx, rsi
mov rdx, rdi
mov r8, r13
call fcn.140009716
movzx ebp, word [rsi + 8]
cmp ebp, 0x17
je 0x1400078cf
test ebp, ebp
je 0x14000791f
jmp 0x14000810e
mov rcx, rdi
mov rdx, r14
call fcn.14000a38e
test rax, rax
je 0x1400065e6
mov r9, rdx
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x48]
lea rdx, [rsp + 0xd8]
mov qword [rdx], rcx
lea rsi, [rsp + 0x1b0]
mov rcx, rsi
mov r8, rax
call fcn.14000a231
cmp word [rsi + 8], 0
jne 0x1400065e6
mov rsi, qword [rsp + 0x1b0]
mov rcx, rdi
mov rdx, r14
call fcn.140004174
mov rdi, rax
mov r14, rdx
lea rdx, [rsp + 0x88]
mov qword [rdx], rsi
mov byte [rsp + 0x20], 5
lea r15, [rsp + 0x548]
mov rcx, r15
mov r8, rax
mov r9, r14
call fcn.14000a9bc
movzx r13d, word [r15 + 0x10]
test r13w, r13w
je 0x140006c25
mov rcx, rsi
call sub.ntdll.dll_NtClose
test r13w, r13w
je 0x1400071ea
lea rdx, str.delete
mov r8d, 6
jmp 0x14000752a
cmp r14, 4
mov esi, 4
cmovb rsi, r14
lea rcx, [rsp + 0xb78]
mov rdx, rdi
mov r8, rsi
call fcn.1400027aa
mov qword [rsp + 0xc0], rsi
call sub.KERNEL32.dll_GetLogicalDrives
test eax, eax
je 0x140006ac2
lea rcx, [rsp + 0xb7c]
lea rsi, [rsp + 0x1290]
mov qword [rsi], rcx
mov qword [rsi + 8], 0xa
and qword [rsi + 0x10], 0
lea rdx, [rsp + 0x860]
mov qword [rdx], rsi
mov ecx, eax
call fcn.14000a2a5
mov rax, qword [rsi + 0x10]
mov edx, 1
lock xadd dword [rbx + 0x198], edx
add rax, 4
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb78]
mov rcx, rbx
mov r8d, 0x16
jmp 0x14000720d
lea rdx, [rsp + 0x138]
xor ecx, ecx
mov r8, rbx
call fcn.14000ac42
jmp 0x140007532
lea rsi, [rsp + 0xa0]
lea r14, [rsp + 0xb0]
mov rcx, rsi
mov rdx, r14
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov edi, dword [rsp + 0xa0]
cmp rdi, 0x100
ja 0x14000737f
lea rdx, [rsp + 0x1b0]
mov qword [rdx], r14
lea rcx, [rsp + 0x1d0]
lea r8, [rsp + 0x230]
mov r9, rdi
call fcn.14000a313
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov rdx, r14
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov esi, dword [rsp + 0x160]
cmp rsi, 0x100
ja 0x14000737f
lea rdx, [rsp + 0xe0]
mov qword [rdx], r14
lea rcx, [rsp + 0x548]
lea r8, [rsp + 0x648]
mov r9, rsi
call fcn.14000a313
lea r14, [rsp + 0xb78]
lea rdx, [rsp + 0x230]
mov rcx, r14
mov r8, rdi
call fcn.1400096b0
cmp word [r14 + 0x218], 0
jne 0x1400067c6
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0xb78]
mov r8d, 0x218
call fcn.1400027aa
lea rdi, [rsp + 0x1290]
lea rdx, [rsp + 0x648]
mov rcx, rdi
mov r8, rsi
call fcn.1400096b0
cmp word [rdi + 0x218], 0
je 0x140007964
lea rdx, [0x14002f38f]
jmp 0x140006233
lea rsi, [rsp + 0x1a0]
lea r15, [rsp + 0xb0]
mov rcx, rsi
mov rdx, r15
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov r14d, dword [rsp + 0x1a0]
cmp r14, 0x100
ja 0x14000737f
lea rdx, [rsp + 0x220]
mov qword [rdx], r15
lea rcx, [rsp + 0xc8]
lea r8, [rsp + 0x548]
mov r9, r14
call fcn.14000a313
lea rsi, [rsp + 0x1a8]
mov rcx, rsi
mov rdx, r15
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov edi, dword [rsp + 0x1a8]
cmp rdi, 0x100
ja 0x14000737f
lea rdx, [rsp + 0x228]
mov qword [rdx], r15
lea rcx, [rsp + 0x90]
lea r8, [rsp + 0x230]
mov r9, rdi
call fcn.14000a313
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov r15, qword [rax + 0x48]
lea rdx, [rsp + 0xd8]
mov qword [rdx], r15
lea rax, [0x14002fe00]
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x140]
lea r8, [rsp + 0x548]
mov rcx, rsi
mov r9, r14
call fcn.14000a118
cmp word [rsi + 8], 0
jne 0x140007dd1
mov rsi, qword [rsp + 0x140]
lea r14, [rsp + 0x1d0]
mov rcx, r14
mov rdx, rsi
call fcn.140009034
cmp word [r14 + 0x48], 0
jne 0x140007dc9
mov r13, qword [rsp + 0x1d8]
mov qword [rsp + 0x88], r15
lea rcx, [rsp + 0x230]
mov rdx, rdi
call fcn.14000a38e
test rax, rax
je 0x140007b49
mov r9, rdx
lea rdx, [rsp + 0x860]
mov qword [rdx], r15
lea r14, [rsp + 0x1290]
mov rcx, r14
mov r8, rax
call fcn.14000a231
movzx eax, word [r14 + 8]
test ax, ax
je 0x140007b6b
mov word [rsp + 0x118], ax
jmp 0x140007ba9
lea rcx, [rsp + 0x1290]
call fcn.140003f92
mov r8d, 1
lock xadd dword [rbx + 0x198], r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov edx, r8d
mov r8d, 0x10
mov r9, rax
jmp 0x14000720d
lea rdi, [rsp + 0x1290]
mov ecx, 0x104
mov rdx, rdi
call sub.KERNEL32.dll_GetCurrentDirectoryW
test eax, eax
je 0x140006ad4
add eax, eax
lea rsi, [rsp + 0x860]
mov qword [rsi], rdi
mov qword [rsi + 8], rax
and qword [rsi + 0x10], 0
xor r12d, r12d
lea rdi, [rsp + 0x330]
lea r14, [rsp + 0x230]
lea r15, [rsp + 0x648]
mov rcx, rdi
mov rdx, rsi
call fcn.14000949f
cmp byte [rsp + 0x334], 0
je 0x140006aeb
movzx eax, byte [rsp + 0x332]
shl eax, 0x10
movzx ebp, word [rsp + 0x330]
or ebp, eax
mov rcx, r14
mov edx, ebp
call fcn.14000956d
movzx eax, byte [rsp + 0x232]
add rax, r12
cmp rax, 0xff
ja 0x140006ad9
lea r8, [rsp + r12]
add r8, 0xb78
mov r9d, 0x100
sub r9, r12
mov rcx, r15
mov edx, ebp
call fcn.1400095bc
movzx eax, byte [rsp + 0x64a]
add r12, rax
jmp 0x1400069ea
lea rsi, [rsp + 0x1290]
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
jne case.0x1400060bd.6
mov ecx, dword [rsp + 0x1290]
call fcn.14000adee
test ax, ax
je 0x140006bb5
lea rdx, str.kill
mov r8d, 4
jmp 0x14000752a
movzx eax, byte [rdi]
cmp eax, 0x5c
je 0x140006b13
cmp eax, 0x2f
je 0x140006b29
jmp 0x140007278
lea rdx, str.drivers
mov r8d, 7
jmp 0x14000752a
call sub.KERNEL32.dll_GetLastError
lea rdx, [0x14002f309]
mov r8d, 3
jmp 0x14000752a
mov edx, 1
lock xadd dword [rbx + 0x198], edx
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb78]
mov rcx, rbx
mov r8d, 0x13
jmp 0x14000720d
movzx ecx, byte [rdi + 3]
cmp ecx, 0x5c
je 0x14000757d
cmp ecx, 0x2f
jne 0x140007294
xor ecx, ecx
movzx edx, byte [rdi + 1]
cmp edx, 0x2f
je 0x140006b46
cmp edx, 0x3f
je 0x140007269
cmp edx, 0x5c
jne 0x140007278
movzx ecx, byte [rdi + 2]
cmp ecx, 0x2e
je 0x14000751d
cmp ecx, 0x3f
je 0x14000751d
jmp 0x140007278
mov rbp, qword [rsp + 0x860]
lea rsi, [rsp + 0x1290]
mov rcx, rsi
mov rdx, rbp
call fcn.140009034
cmp word [rsi + 0x48], 0
je 0x140007584
lea rdx, str.stat
mov r8d, 4
mov rcx, rbx
call fcn.1400087d0
test ax, ax
je 0x14000737f
mov esi, eax
mov rcx, r15
mov rdx, r14
mov r8, rdi
jmp 0x140008138
mov edx, 1
lock xadd dword [rbx + 0x198], edx
mov qword [rsp + 0x20], 7
lea r9, str.kill_ok
jmp 0x140007207
xor ecx, ecx
mov edx, 0xffffffff
mov r8, rax
shr r8, 0x39
and eax, edx
mov r9b, byte [r14 + rax]
sub ecx, 1
setb r10b
test r9b, r9b
je 0x140007227
test r10b, r10b
jne 0x140007227
test r9b, r9b
jns 0x140006c20
and r9b, 0x7f
cmp r8b, r9b
jne 0x140006c20
mov r9, qword [r14 - 0x10]
cmp dword [r9 + rax*4], edi
je 0x140007217
inc rax
jmp 0x140006be5
cmp byte [rsp + 0x550], 0
je 0x14000766b
mov r12, qword [rsp + 0x548]
lea r15, [rsp + 0x1290]
mov r8d, 0x7308
mov rcx, r15
xor edx, edx
call fcn.140002794
movzx ecx, byte [r15 + 0x7300]
lea eax, [rcx + 1]
mov edx, eax
and dl, 0x1f
mov byte [r15 + 0x7300], dl
add byte [rax + 0x69], cl
leave
xor byte [rdi], al
add byte [rax], al
add byte [rax + 0x69], cl
leave
xor byte [rdi], al
add byte [rax], al
mov qword [rsp + rcx + 0x1290], rdi
mov qword [rsp + rcx + 0x1298], r14
mov qword [rsp + rcx + 0x12a0], rsi
mov qword [rsp + rcx + 0x12a8], r12
xorps xmm6, xmm6
movups xmmword [rsp + rcx + 0x12b0], xmm6
mov byte [rsp + rcx + 0x16c0], 0
test al, 0x1f
je 0x14000766b
dec al
movzx eax, al
and eax, 0x1f
imul rdi, rax, 0x730
lea rax, [rsp + rdi]
add rax, 0x1290
mov qword [rsp + 0x58], rax
lea rbp, [rsp + rdi]
add rbp, 0x12a8
lea rcx, [rsp + 0x648]
mov rdx, rbp
call fcn.140009f50
cmp word [rsp + 0x668], 0
jne 0x140007b12
cmp byte [rsp + 0x660], 0
je 0x1400070d8
mov r14, qword [rsp + 0x648]
mov r15, qword [rsp + 0x650]
mov al, byte [rsp + 0x658]
mov byte [rsp + 0x50], al
cmp al, 2
sete r12b
test r12b, 1
je 0x140006d7b
mov al, byte [rsp + 0x8590]
shl al, 3
sar al, 3
add ecx, dword [rdi]
mov ah, dl
add byte [rax], al
invalid
add ecx, dword [rdi]
mov ah, dl
add byte [rax], al
add byte [rax - 0x73], cl
add eax, 0x29155
lea rax, [0x14002fe98]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x160]
mov rdx, rbp
mov r8, r14
mov r9, r15
call fcn.1400099c7
movzx r13d, word [rsp + 0x168]
movzx eax, r13w
lea rcx, [0x1400086e0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rcx, rbp
mov rdx, r14
mov r8, r15
call fcn.14000abe3
mov r13d, eax
movzx eax, ax
add eax, 0xfffffff8
cmp eax, 0x39
ja case.0x140006d79.8
cmp rax, 0xf
jne 0x140006daa
xor r12b, 1
jmp 0x140006d23
movabs rcx, 0x2000010001022fa
bt rcx, rax
jb 0x14000777a
jmp case.0x140006d79.8
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x150]
mov rdx, qword [rsp + 0x130]
mov r8, qword [rsp + 0x128]
call fcn.14000ab81
test ax, ax
je 0x140006e06
mov r13d, eax
movzx eax, ax
cmp eax, 8
je 0x140006e06
cmp eax, 0x6c
jne 0x14000706e
mov rcx, qword [rsp + 0x70]
call sub.ntdll.dll_NtClose
mov rax, qword [rbp]
mov qword [rsp + 0x140], rax
mov al, byte [rsp + 0x50]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0x140]
mov r8, r14
mov r9, r15
call fcn.14000a9bc
movzx r13d, word [rsp + 0x240]
test r13w, r13w
jne 0x140007ae1
cmp byte [rsp + 0x238], 0
je case.0x140006d79.8
mov r12, qword [rsp + 0x230]
mov qword [rsp + 0x90], r12
mov al, 1
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x130], r14
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x78], r12
lea rax, [rsp + 0xb80]
movups xmmword [rax], xmm6
mov qword [rsp + 0xb78], r12
mov byte [rsp + 0xf90], 0
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0xb78]
call fcn.140009f50
movzx r13d, word [rsp + 0x350]
test r13w, r13w
jne case.0x140006f54.9
cmp byte [rsp + 0x348], 0
je 0x140007017
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x68], rax
cmp byte [rsp + 0x340], 2
sete r12b
test r12b, 1
je 0x140006f56
lea rax, [0x14002fe98]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1d0]
lea rdx, [rsp + 0x90]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x68]
call fcn.1400099c7
movzx r13d, word [rsp + 0x1d8]
movzx eax, r13w
lea rcx, [0x140008674]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rcx, [rsp + 0x90]
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x68]
call fcn.14000abe3
mov r13d, eax
movzx eax, ax
add eax, 0xfffffff8
cmp eax, 0x39
ja case.0x140006f54.8
cmp rax, 0xf
jne 0x140006f91
xor r12b, 1
jmp 0x140006f05
movabs rcx, 0x2000010001022fa
bt rcx, rax
jb case.0x140006f54.9
jmp case.0x140006f54.8
test byte [rsp + 0x64], 1
jne 0x140006fbb
mov rcx, qword [rsp + 0x70]
call sub.ntdll.dll_NtClose
mov r12, qword [rsp + 0x1d0]
mov qword [rsp + 0x90], r12
lea rcx, [rsp + 0x860]
mov rdx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x68]
mov r8, r13
call fcn.1400027aa
mov dword [rsp + 0x64], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x860]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x128], r13
jmp 0x140006e86
and al, 0x30
add dword [rax], eax
add byte [rcx + rcx*4 - 0x54], cl
and al, 0x28
add dword [rax], eax
add cl, ch
outsd dx, dword [rsi]
invalid
mov rcx, qword [rsp + 0x78]
call sub.ntdll.dll_NtClose
js 0x140007005
fistp qword [rdi]
add al, byte [rax]
test byte [rsp + 0x64], 1
je 0x140006dc3
mov rax, qword [rbp]
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xa0]
mov rdx, r14
mov r8, r15
call fcn.14000ab81
cmp ax, 0x6c
je 0x140006e10
mov r13d, eax
movzx eax, ax
test eax, eax
je case.0x140006d79.8
cmp eax, 8
je case.0x140006d79.8
jmp 0x140007078
mov rcx, qword [rsp + 0x70]
call sub.ntdll.dll_NtClose
test r13w, r13w
je case.0x140006d79.8
jmp 0x140007ae1
mov rax, qword [rsp + 0x160]
mov rdi, qword [rbp]
movzx ecx, byte [rsp + 0x8590]
lea edx, [rcx + 1]
and dl, 0x1f
mov byte [rsp + 0x8590], dl
imul rcx, rcx, 0x730
add rcx, rsp
add rcx, 0x1290
mov qword [rcx], r14
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rax
movups xmmword [rcx + 0x20], xmm6
mov byte [rcx + 0x430], 0
jmp case.0x14000718e.8
mov rcx, qword [rbp]
call fcn.14000ab7c
add byte [rax], al
add byte [rax], al
mov rdi, qword [rsp + rdi + 0x12a0]
mov qword [rsp + 0xc8], rdi
mov rax, qword [rsp + 0x58]
mov r14, qword [rax]
mov r15, qword [rax + 8]
mov al, byte [rsp + 0x8590]
dec al
enter 0x1f24, 0xffffffffffffff88
test byte [rax + rdx*4], ah
test dword [rax], eax
add byte [rax - 0x73], cl
mov word [rax + rcx*8], fs
add byte [rax], al
add byte [rcx + rcx*4 - 0xe], cl
enter 0x1f24, 0xffffffffffffff88
test byte [rax + rdx*4], ah
test dword [rax], eax
add byte [rax - 0x73], cl
mov word [rax + rcx*8], fs
add byte [rax], al
add byte [rcx + rcx*4 - 0xe], cl
mov r8, r15
call fcn.14000ab81
test ax, ax
je case.0x14000718e.8
mov r13d, eax
movzx eax, ax
cmp eax, 8
je case.0x14000718e.8
cmp eax, 0x6c
jne 0x140008025
mov bpl, 1
test bpl, 1
je 0x140007190
invalid
lea rax, [0x14002fe98]
lea rax, [0x14002fe98]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0xc8]
add byte [rax], al
add byte [rbp - 0x77], cl
invalid
mov r9, r15
call fcn.1400099c7
add byte [rax], al
add byte [rax], al
add byte [rbp - 0x77], cl
invalid
add byte [rax], al
movzx r13d, word [rsp + 0xe8]
movzx eax, r13w
lea rcx, [0x14000874c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rcx, [rsp + 0xc8]
mov rdx, r14
mov r8, r15
call fcn.14000abe3
mov r13d, eax
movzx eax, ax
add eax, 0xfffffff8
cmp eax, 0x39
ja case.0x14000718e.8
cmp rax, 0xf
jne 0x1400071bd
xor bpl, 1
jmp 0x140007146
movabs rcx, 0x2000010001022fa
bt rcx, rax
jb 0x140007e17
mov al, byte [rsp + 0x8590]
jmp 0x140006ca4
mov rax, qword [rsp + 0xe0]
jmp 0x140007093
mov edx, 1
lock xadd dword [rbx + 0x198], edx
mov qword [rsp + 0x20], 9
lea r9, str.delete_ok
mov rcx, rbx
xor r8d, r8d
call fcn.1400088ca
jmp 0x140007532
lea r15, [rsp + 0x1290]
mov qword [r15], rax
mov byte [r15 + 8], 1
cmp byte [r15 + 8], 0
je 0x14000725c
mov rax, qword [r15]
mov rcx, qword [r14 - 0x18]
mov rdx, qword [rcx + rax*8]
mov byte [r14 + rax], 1
movq xmm0, qword [rbx + 0x168]
paddd xmm0, xmmword [0x14002eb30]
movq qword [rbx + 0x168], xmm0
mov rcx, qword [rdx]
call qword [rdx + 8]
mov rcx, rsi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
jmp 0x14000737f
cmp byte [rdi + 2], 0x3f
sete dl
test cl, dl
jne 0x14000751d
cmp al, 0x5c
je 0x140007284
movzx eax, al
cmp eax, 0x2f
jne 0x1400072cb
mov r12d, 1
cmp r14, 2
jb 0x140007317
movzx eax, byte [rdi + 1]
cmp eax, 0x5c
je 0x1400072a8
mov r12d, 1
cmp eax, 0x2f
jne 0x140007317
cmp r14, 3
jne 0x14000750c
movzx eax, byte [rdi + 2]
mov r12d, 3
cmp eax, 0x2e
je 0x140007317
cmp eax, 0x3f
je 0x140007317
jmp 0x140007511
cmp r14, 2
jb 0x140007314
cmp byte [rdi + 1], 0x3a
jne 0x140007314
mov r12d, 2
cmp r14, 3
jb 0x140007317
movzx eax, byte [rdi + 2]
cmp eax, 0x5c
je 0x1400072f1
cmp eax, 0x2f
jne 0x140007317
mov r12d, 3
cmp r12, r14
jae 0x1400078ac
movzx eax, byte [rdi + r12]
cmp eax, 0x5c
je 0x14000730f
cmp eax, 0x2f
jne 0x140007317
inc r12
jmp 0x1400072f7
xor r12d, r12d
lea rcx, [rdi - 1]
xor eax, eax
mov rdx, r12
cmp r14, rdx
je 0x14000737f
movzx r8d, byte [rcx + r14]
cmp r8d, 0x5c
je 0x140007336
cmp r8d, 0x2f
jne 0x140007341
inc rax
dec rcx
inc rdx
jmp 0x140007320
mov r13, r12
neg r13
mov r15, r14
sub r15, rax
lea rbp, [r15 + 1]
mov rcx, r13
add rcx, rbp
cmp rcx, 1
je 0x140007371
movzx ecx, byte [rdi + rbp - 2]
dec rbp
cmp ecx, 0x2f
je 0x140007374
cmp ecx, 0x5c
jne 0x140007351
jmp 0x140007374
mov rbp, r12
mov rcx, r14
sub rcx, rbp
cmp rcx, rax
jne 0x140007386
xor esi, esi
jmp case.0x1400060bd.6
lea rcx, [rsp + 0x1290]
mov rdx, rdi
mov r8, r15
call fcn.1400096b0
movzx esi, word [rsp + 0x14a8]
test si, si
jne 0x140007441
mov r8d, 0x218
lea rcx, [rsp + 0xb78]
lea rdx, [rsp + 0x1290]
call fcn.1400027aa
movabs rax, 0x780100000
mov qword [rsp + 0x870], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x860], rax
and qword [rsp + 0x868], 0
mov r8, qword [rsp + 0xb78]
mov dword [rsp + 0x878], 2
mov word [rsp + 0x87c], 0x101
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0xb80]
lea r9, [rsp + 0x860]
call fcn.140009716
movzx esi, word [rsp + 0x338]
test si, si
jne 0x140007441
mov rcx, qword [rsp + 0x330]
call sub.ntdll.dll_NtClose
test si, si
je 0x14000749d
movzx eax, si
cmp eax, 7
je 0x14000749d
cmp eax, 8
jne 0x14000751d
lea rax, [rbp + 1]
mov r15, rbp
cmp r12, r15
je 0x14000751d
movzx ecx, byte [rdi + r15 - 1]
cmp ecx, 0x5c
je 0x140007477
cmp ecx, 0x2f
jne 0x14000747f
dec r15
dec rax
jmp 0x14000745e
lea rcx, [rax + r13]
cmp rcx, 1
je 0x1400074fb
movzx ecx, byte [rdi + rax - 2]
dec rax
cmp ecx, 0x2f
je 0x1400074fe
cmp ecx, 0x5c
jne 0x14000747f
jmp 0x1400074fe
cmp r15, r14
mov rbp, r14
cmova rbp, r15
cmp r15, r14
jae 0x1400074c0
movzx eax, byte [rdi + r15]
cmp eax, 0x5c
je 0x1400074bb
cmp eax, 0x2f
jne 0x1400074c5
inc r15
jmp 0x1400074a7
mov r15, rbp
jmp 0x1400074c8
mov rbp, r15
cmp rbp, r14
mov rax, r14
cmova rax, rbp
cmp r15, r14
jae 0x1400074eb
movzx ecx, byte [rdi + r15]
cmp ecx, 0x2f
je 0x1400074ee
cmp ecx, 0x5c
je 0x1400074ee
inc r15
jmp 0x1400074d2
mov r15, rax
xor esi, esi
cmp r15, rbp
jne 0x140007386
jmp case.0x1400060bd.6
mov rax, r12
mov rbp, rax
cmp rax, r15
jne 0x140007386
jmp 0x14000751d
jb 0x140007552
mov al, byte [rdi + 2]
cmp al, 0x2f
je 0x14000751d
movzx eax, al
cmp eax, 0x5c
jne 0x140007552
lea rdx, str.mkdir
mov r8d, 5
mov rcx, rbx
call fcn.1400087d0
mov esi, eax
mov eax, esi
movaps xmm6, xmmword [rsp + 0x9290]
add rsp, 0x92a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12d, 2
cmp r12, r14
jae 0x1400076fc
movzx eax, byte [rdi + r12]
cmp eax, 0x2f
je 0x1400076ff
cmp eax, 0x5c
je 0x1400076ff
inc r12
jmp 0x140007558
mov cl, 1
jmp 0x140006b2b
mov r13d, dword [rsp + 0x1298]
call sub.KERNEL32.dll_GetProcessHeap
mov si, 2
test rax, rax
je 0x140006ba7
mov r12, rax
mov dword [rsp + 0x50], r13d
mov r8d, 0x50
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x140006ba7
mov r13, rax
mov rsi, rax
add rsi, 7
and rsi, 0xfffffffffffffff8
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x10], eax
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], rbx
mov byte [rsi + 0x40], 0
mov qword [rsi + 0x28], r13
mov qword [rsi + 0x30], r12
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140009117]
mov edx, 0x1000000
xor ecx, ecx
mov r9, rsi
call sub.KERNEL32.dll_CreateThread
test rax, rax
je 0x1400078b4
mov qword [rsi + 0x38], rax
add rsi, 0x28
mov rcx, rsi
call fcn.140009423
jmp 0x14000737f
xor edi, edi
xor r14d, r14d
test r14, r14
je 0x140007673
lea rsi, [rsp + 0x230]
lea r12, [rsp + 0xb0]
mov rcx, rsi
mov rdx, r12
call fcn.140005cc6
movzx esi, word [rsi + 4]
test si, si
je 0x140007698
add rbx, 0x188
mov byte [rcx], al
add byte [rax], al
mov rcx, rbx
jmp 0x140006baa
xor r13d, r13d
jmp 0x1400065d4
lea rdx, str.shell_path
mov r8d, 0xa
mov rcx, rbx
call fcn.1400087d0
test ax, ax
mov esi, 8
cmovne esi, eax
jmp case.0x1400060bd.6
mov r8d, dword [rsp + 0x230]
lea r15, [rbx + 0x188]
cmp r8, 0x1001
jb 0x1400077ab
mov rcx, r15
mov rdx, r14
mov r8, rdi
call fcn.140004692
mov si, 0x5f
jmp case.0x1400060bd.6
movzx eax, byte [rsp + 0x8590]
imul rdi, rax, 0x730
xor r14d, r14d
cmp rdi, r14
je 0x1400065d4
mov rcx, qword [rsp + r14 + 0x12a8]
call fcn.14000ab7c
add r14, 0x730
jmp 0x1400076dd
mov r12, r14
cmp r12, r14
mov rax, r14
cmova rax, r12
cmp r12, r14
jae 0x140007722
movzx ecx, byte [rdi + r12]
cmp ecx, 0x5c
je 0x14000771d
cmp ecx, 0x2f
jne 0x140007725
inc r12
jmp 0x140007709
mov r12, rax
cmp r12, r14
mov rax, r14
cmova rax, r12
cmp r12, r14
jae 0x140007748
movzx ecx, byte [rdi + r12]
cmp ecx, 0x2f
je 0x14000774b
cmp ecx, 0x5c
je 0x14000774b
inc r12
jmp 0x14000772f
mov r12, rax
cmp r12, r14
mov rax, r14
cmova rax, r12
cmp r12, r14
jae 0x140007772
movzx ecx, byte [rdi + r12]
cmp ecx, 0x5c
je 0x14000776d
cmp ecx, 0x2f
jne 0x140007317
inc r12
jmp 0x140007755
mov r12, rax
jmp 0x140007317
movzx eax, byte [rsp + 0x8590]
imul rdi, rax, 0x730
xor r14d, r14d
cmp rdi, r14
je 0x1400065d4
mov rcx, qword [rsp + r14 + 0x12a8]
call fcn.14000ab7c
add r14, 0x730
jmp 0x14000778c
lea rsi, [rsp + 0x1290]
mov rcx, rsi
mov rdx, r15
call fcn.140003d54
movzx esi, word [rsi + 0x10]
test si, si
jne 0x140006ba7
mov r8, qword [rsp + 0x1290]
mov r13, qword [rsp + 0x1298]
lea rdx, [rsp + 0x648]
mov qword [rdx], r12
lea rcx, [rsp + 0x860]
mov qword [rsp + 0x50], r8
mov r9, r13
call fcn.14000a313
call sub.KERNEL32.dll_GetProcessHeap
mov si, 2
test rax, rax
je 0x140007897
mov rbp, rax
mov r8d, 0x50
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x140007897
mov r12, rax
mov rsi, rax
add rsi, 7
and rsi, 0xfffffffffffffff8
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], r13
mov qword [rsi + 0x20], rbx
mov byte [rsi + 0x40], 0
mov qword [rsi + 0x28], r12
mov qword [rsi + 0x30], rbp
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x14000ae12]
mov edx, 0x1000000
xor ecx, ecx
mov r9, rsi
call sub.KERNEL32.dll_CreateThread
test rax, rax
jne 0x140007619
call sub.KERNEL32.dll_GetLastError
mov rcx, rbp
xor edx, edx
mov r8, r12
call fcn.14002ae90
mov si, 0xe
mov rcx, r15
mov rdx, qword [rsp + 0x50]
mov r8, r13
call fcn.140004692
jmp 0x140006ba7
mov r12, r14
jmp 0x140007317
call sub.KERNEL32.dll_GetLastError
mov rcx, r12
xor edx, edx
mov r8, r13
call fcn.14002ae90
mov si, 0xe
jmp 0x140006ba7
lea r9, [rsp + 0x230]
movabs rax, 0x180100000
mov qword [r9 + 0x10], rax
mov qword [r9], r12
and qword [r9 + 8], 0
mov dword [r9 + 0x18], 1
mov word [r9 + 0x1c], 0x101
lea rsi, [rsp + 0x1b0]
mov rcx, rsi
mov rdx, rdi
mov r8, r13
call fcn.140009716
movzx ebp, word [rsi + 8]
test bp, bp
jne 0x14000810e
lea rdx, [rsp + 0x850]
lea rax, [rsp + 0x64f]
and rax, 0xfffffffffffffff8
xor edi, edi
sub rdx, rax
cmovb rdx, rdi
cmovb rax, rdi
test rax, rax
je 0x1400079ac
and rdx, 0xfffffffffffffffe
mov rcx, rdx
shr rcx, 1
test rdx, rdx
cmove rcx, rdx
mov edx, 8
cmove rax, rdx
mov rdi, rax
jmp 0x1400079ae
lea rcx, [rsp + 0x860]
lea rdx, [rsp + 0x1290]
mov r8d, 0x218
call fcn.1400027aa
lea rcx, [rsp + 0x338]
lea rdx, [rsp + 0x868]
mov r8d, 9
call sub.KERNEL32.dll_MoveFileExW
test eax, eax
jne 0x14000737f
call sub.KERNEL32.dll_GetLastError
jmp 0x1400067c6
xor ecx, ecx
mov rsi, qword [rsi]
mov bp, 0xb
test rdi, rdi
je 0x140008106
lea eax, [rcx + rcx]
cmp rcx, 0x7fffffff
mov r9d, 0xffffffff
cmovbe r9d, eax
and qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 1
mov r8, rdi
call sub.ntdll.dll_NtQueryObject
cmp eax, 0x80000005
je 0x140008102
cmp eax, 0xc0000004
je 0x140008102
cmp eax, 0xc0000008
je 0x1400080d4
cmp eax, 0xc0000022
je 0x140007ddd
cmp eax, 0xc0000023
je 0x140008102
mov bp, 0xe
test eax, eax
jne 0x140008106
cmp word [rdi + 2], 0
je 0x140008106
movzx r12d, word [rdi]
mov r8, qword [rdi + 8]
lea rcx, str.Device_
mov edx, 8
mov r9d, 8
mov qword [rsp + 0x58], r8
call fcn.140009962
test al, 1
je 0x140008106
mov rax, r12
shr rax, 1
mov qword [rsp + 0x68], rax
test r12w, r12w
je 0x140007e48
mov rax, qword [rsp + 0x68]
lea rbp, [rax - 1]
mov rax, qword [rsp + 0x58]
lea rdi, [rax + 0x10]
mov r13d, 8
lea r12, [0x14002ffd6]
cmp r13, rbp
ja 0x140007e48
mov edx, 1
mov r9d, 1
mov rcx, rdi
mov r8, r12
call fcn.140009962
test al, 1
jne 0x140007e4b
inc r13
add rdi, 2
jmp 0x140007a96
mov rcx, qword [rsp + 0x78]
call sub.ntdll.dll_NtClose
test byte [rsp + 0x64], 1
jne 0x140007ae1
mov rcx, qword [rsp + 0x70]
call sub.ntdll.dll_NtClose
movzx eax, byte [rsp + 0x8590]
imul rdi, rax, 0x730
xor r14d, r14d
cmp rdi, r14
je 0x1400065d4
mov rcx, qword [rsp + r14 + 0x12a8]
call fcn.14000ab7c
add r14, 0x730
jmp 0x140007af3
movzx eax, byte [rsp + 0x8590]
imul rdi, rax, 0x730
xor r14d, r14d
cmp rdi, r14
je 0x140007b3f
mov rcx, qword [rsp + r14 + 0x12a8]
call fcn.14000ab7c
add r14, 0x730
jmp 0x140007b24
mov r13w, 1
jmp 0x1400065d4
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x230]
lea r9, [rsp + 0x88]
mov r8, rdi
jmp 0x140007ba4
mov rax, qword [rsp + 0x1290]
lea r14, [rsp + 0xb78]
mov qword [r14], rax
lea rcx, [rsp + 0x230]
mov rdx, rdi
call fcn.140004174
mov r8, rdx
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0xe0]
mov rdx, rax
mov r9, r14
call fcn.14000a51d
cmp word [rsp + 0x118], 0
jne 0x140007dc9
movdqu xmm0, xmmword [rsp + 0xe0]
movups xmm1, xmmword [rsp + 0xf0]
movups xmm2, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x160], xmm0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x190], rax
movaps xmmword [rsp + 0x180], xmm2
movaps xmmword [rsp + 0x170], xmm1
xor ebp, ebp
mov rdi, qword [rsp + 0x160]
lea r14, [rsp + 0x330]
lea r15, [rsp + 0x1290]
lea r12, [rsp + 0x860]
mov qword [rsp + 0xb78], rbp
mov byte [rsp + 0xb80], 1
lea rax, [rsp + 0xb78]
mov qword [rsp + 0x20], rax
mov r9d, 0x8000
mov rcx, r14
mov rdx, rsi
mov r8, r15
call fcn.14000a79b
cmp word [rsp + 0x338], 0
jne 0x140007dbc
mov r9, qword [rsp + 0x330]
test r9, r9
je 0x140007c9b
mov rcx, r12
mov rdx, rdi
mov r8, r15
call fcn.14000a875
cmp word [rsp + 0x868], 0
jne 0x140007dbc
mov rax, qword [rsp + 0x860]
test rax, rax
je 0x140007c9b
add rbp, rax
cmp r13, rax
jne 0x140007c1c
cmp byte [rsp + 0x191], 0
je 0x140007cb5
mov rcx, rdi
call sub.ntdll.dll_NtClose
mov byte [rsp + 0x191], 0
lea rdx, [rsp + 0x180]
mov rbp, qword [rdx - 8]
mov rdi, qword [rdx - 0x18]
mov r14, qword [rdx - 0x10]
lea r15, [rsp + 0x860]
mov r8d, 0x10
mov rcx, r15
call fcn.1400096b0
cmp word [r15 + 0x218], 0
jne 0x140007dbc
lea rcx, [rsp + 0x648]
lea rdx, [rsp + 0x860]
mov r8d, 0x218
call fcn.1400027aa
lea r15, [rsp + 0xb78]
or eax, dword [rax]
add byte [rcx + rcx*4 - 7], cl
or eax, dword [rax]
add byte [rcx + rcx*4 - 7], cl
mov rdx, rdi
mov r8, r14
call fcn.1400096b0
cmp word [r15 + 0x218], 0
jne 0x140007dbc
lea rdi, [rsp + 0x330]
lea rdx, [rsp + 0xb78]
mov r8d, 0x218
mov rcx, rdi
call fcn.1400027aa
lea rdx, [rsp + 0x650]
movabs rax, 0x740110000
lea r9, [rsp + 0x1b0]
mov qword [r9 + 0x10], rax
mov qword [r9], rbp
and qword [r9 + 8], 0
mov r8, qword [rdx - 8]
mov r14, qword [rdi]
mov dword [r9 + 0x18], 1
mov dword [rcx + 0x18], 1
mov dword [rcx + 0x18], 1
mov word [r9 + 0x1c], 2
lea rdi, [rsp + 0x150]
mov rcx, rdi
call fcn.140009716
cmp word [rdi + 8], 0
jne 0x140007dbc
mov rdi, qword [rsp + 0x150]
cmp r14, 0x187
jb 0x140007f3c
mov rcx, rdi
call sub.ntdll.dll_NtClose
lea rcx, [rsp + 0x160]
call fcn.14000a95f
mov rcx, rsi
call sub.ntdll.dll_NtClose
lea rdx, str.copy
jmp 0x140006aa5
mov bp, 9
jmp 0x140008106
movzx eax, byte [rsp + 0x8590]
imul rdi, rax, 0x730
xor r14d, r14d
cmp rdi, r14
je 0x1400065d4
mov rcx, qword [rsp + r14 + 0x12a8]
call fcn.14000ab7c
add r14, 0x730
jmp 0x140007df8
movzx eax, byte [rsp + 0x8590]
imul rdi, rax, 0x730
xor r14d, r14d
cmp rdi, r14
je 0x1400065d4
mov rcx, qword [rsp + r14 + 0x12a8]
call fcn.14000ab7c
add r14, 0x730
jmp 0x140007e29
xor r13d, r13d
lea r12, [rsp + 0xb78]
mov r8d, 0x11c
mov rcx, r12
xor edx, edx
call fcn.140002794
lea rdx, str.__MountPointManager
lea r9, [0x14002ffd8]
lea rdi, [rsp + 0xe0]
mov r8d, 0x15
mov rcx, rdi
call fcn.140009716
movzx ebp, word [rdi + 8]
test bp, bp
jne 0x140008106
mov rdi, qword [rsp + 0xe0]
lea rcx, [rsp + 0xb90]
mov dword [rcx - 8], 0x18
mov r8, r13
add r8, r13
mov word [rcx - 4], r8w
mov rdx, qword [rsp + 0x58]
call fcn.1400027aa
lea rax, [rsp + 0x1290]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 0x470
mov dword [rsp + 0x38], 0x11c
mov dword [rsp + 0x28], 0x6d0008
mov r12, rdi
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtDeviceIoControlFile
cmp eax, 0xc0000010
je 0x140007f2b
cmp eax, 0xc0000022
je 0x140007f2b
test eax, eax
je 0x140008056
mov bp, 0xe
cmp eax, 0xc0000061
jne 0x140007f2f
mov bp, 9
mov rcx, r12
call sub.ntdll.dll_NtClose
jmp 0x140008106
lea r15, [rsp + 0x338]
lea r12, [r14 + r14]
lea r13, [rsp + 0x12a4]
mov byte [r13 - 0x14], 1
mov rcx, r15
mov rdx, r14
call fcn.14000a923
xor ecx, ecx
test al, 1
cmovne rbp, rcx
mov qword [r13 - 0xc], rbp
mov dword [r13 - 4], r12d
mov rcx, r13
mov rdx, r15
mov r8, r12
call fcn.1400027aa
lea r9d, [r12 + 0x17]
mov dword [rsp + 0x20], 0xa
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0x1290]
mov rcx, rdi
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x140007db4
cmp eax, 0xc0000034
je 0x140007db4
cmp eax, 0xc0000035
je 0x140007db4
cmp eax, 0xc000003a
je 0x140007db4
cmp eax, 0xc00000d4
je 0x140007db4
test eax, eax
jne 0x140007db4
mov rcx, rdi
call sub.ntdll.dll_NtClose
lea rcx, [rsp + 0x160]
mov byte [rcx + 0x32], 0
call fcn.14000a95f
mov rcx, rsi
call sub.ntdll.dll_NtClose
mov edx, 1
lock xadd dword [rbx + 0x198], edx
mov qword [rsp + 0x20], 7
lea r9, str.copy_ok
jmp 0x140007207
movzx eax, byte [rsp + 0x8590]
imul rdi, rax, 0x730
xor r14d, r14d
cmp rdi, r14
je 0x1400065d4
mov rcx, qword [rsp + r14 + 0x12a8]
call fcn.14000ab7c
add r14, 0x730
jmp 0x140008037
mov rax, qword [rsp + 0x58]
lea rax, [rax + r13*2]
mov qword [rsp + 0x80], rax
sub qword [rsp + 0x68], r13
mov eax, dword [rsp + 0x1294]
imul rax, rax, 0x18
mov qword [rsp + 0x58], rax
xor r13d, r13d
cmp qword [rsp + 0x58], r13
je 0x1400080cc
movzx edi, word [rsp + r13 + 0x129c]
cmp rdi, 0x18
jb 0x1400080c6
mov eax, dword [rsp + r13 + 0x1298]
lea rbp, [rsp + rax]
add rbp, 0x1290
mov edx, 0xc
mov r9d, 0xc
mov rcx, rbp
lea r8, str.DosDevices_
call fcn.140009962
test al, 1
jne 0x1400080da
add r13, 0x18
jmp 0x14000807f
mov rcx, r12
call sub.ntdll.dll_NtClose
mov bp, 8
jmp 0x140008106
shr rdi, 1
mov rax, qword [rsp + 0x68]
add rax, rdi
add rax, 0xfffffffffffffff4
mov qword [rsp + 0x58], rax
cmp rax, 0x104
jbe 0x14000833c
mov rcx, r12
call sub.ntdll.dll_NtClose
mov bp, 0xb
mov rcx, rsi
call sub.ntdll.dll_NtClose
test bp, bp
mov r12, qword [rsp + 0x50]
je 0x140008142
lea rdx, str.realpath
mov r8d, 8
mov rcx, rbx
call fcn.1400087d0
mov esi, eax
mov rcx, r14
mov rdx, r15
mov r8, r12
call fcn.140004692
jmp case.0x1400060bd.6
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x48]
lea rdx, [rsp + 0x1290]
mov qword [rdx], rax
lea rax, [0x1400300e5]
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x150]
lea r8, [rsp + 0xb78]
mov rcx, rsi
mov r9, r13
call fcn.1400099c7
cmp word [rsi + 8], 0
je 0x14000819f
lea rdx, str.opendir
mov r8d, 7
jmp 0x140008125
mov rbp, qword [rsp + 0x150]
mov qword [rsp + 0xc8], rbp
lea rsi, [rsp + 0x648]
mov rcx, rsi
mov rdx, rbp
call fcn.140009a5e
cmp word [rsi + 0x48], 0
je 0x1400081e5
lea rdx, str.dirstat
mov r8d, 7
mov rcx, rbx
call fcn.1400087d0
mov esi, eax
jmp 0x14000832a
lea rdi, [rsp + 0x230]
lea rsi, [rsp + 0x648]
mov ecx, 9
rep movsq qword [rdi], qword [rsi]
mov r8d, dword [rbx + 0x10c]
lea rsi, [rsp + 0x548]
mov rcx, rsi
mov rdx, r14
call fcn.140004268
movzx esi, word [rsi + 0x28]
test si, si
jne 0x14000832a
mov rax, qword [rsp + 0x568]
lea rcx, [rsp + 0xe0]
mov qword [rcx + 0x20], rax
movdqu xmm0, xmmword [rsp + 0x548]
movups xmm1, xmmword [rsp + 0x558]
movaps xmmword [rcx + 0x10], xmm1
movdqa xmmword [rcx], xmm0
mov qword [rsp + 0x90], rcx
lea rdx, [rsp + 0xd8]
mov r8d, 4
call fcn.1400042c1
test ax, ax
jne 0x14000831b
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0xb78]
mov r8, r13
call fcn.1400042c1
test ax, ax
jne 0x14000831b
lea rcx, [rsp + 0xe0]
mov dl, 0x5c
call fcn.140004367
test ax, ax
jne 0x14000831b
lea rdx, [0x14002f379]
lea rcx, [rsp + 0xe0]
mov r8d, 2
call fcn.1400042c1
test ax, ax
jne 0x14000831b
lea r8, [0x14002f37c]
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x230]
mov r9d, 1
call fcn.140009a64
test ax, ax
jne 0x14000831b
lea r8, [0x14002f37e]
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x230]
mov r9d, 2
call fcn.140009a64
test ax, ax
je 0x1400083f7
mov esi, eax
lea rcx, [rsp + 0xe0]
call fcn.140004649
mov rcx, rbp
call sub.ntdll.dll_NtClose
mov r12, qword [rsp + 0x50]
jmp 0x14000812f
lea r13, [rdi - 0xc]
add rbp, 0x18
mov r8, r13
add r8, r13
lea rcx, [rsp + 0x648]
mov rdx, rbp
call fcn.1400027aa
lea rax, [rsp + r13*2]
add rax, 0x648
xor ecx, ecx
cmp qword [rsp + 0x68], rcx
je 0x140008382
mov rdx, qword [rsp + 0x80]
movzx edx, word [rdx + rcx*2]
mov word [rax + rcx*2], dx
inc rcx
jmp 0x140008366
mov rax, qword [rsp + 0x68]
add rax, rdi
add rax, 0xfffffffffffffff4
xor ecx, ecx
cmp rax, rcx
je 0x1400083b5
cmp word [rsp + rcx*2 + 0x648], 0
lea rcx, [rcx + 1]
jne 0x140008390
mov rcx, r12
call sub.ntdll.dll_NtClose
mov bp, 0xd
jmp 0x140008106
mov rcx, r12
call sub.ntdll.dll_NtClose
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x1290]
lea rdx, [rsp + 0xb78]
lea r9, [rsp + 0x648]
mov r8d, 0x30d
mov rcx, rdi
call fcn.1400040a6
xor ebp, ebp
mov r13, qword [rdi]
jmp 0x140008106
pxor xmm0, xmm0
lea rax, [rsp + 0x1290]
movdqu xmmword [rax + 8], xmm0
mov qword [rax], rbp
mov byte [rax + 0x418], 1
lea rcx, [rsp + 0x1d0]
lea rdx, [rsp + 0x1290]
call fcn.140009f50
cmp word [rsp + 0x1f0], 0
jne 0x14000859e
cmp byte [rsp + 0x1e8], 0
je 0x14000859e
mov r13, qword [rsp + 0x1d0]
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x58], rax
cmp byte [rsp + 0x1e0], 2
jne 0x1400084bf
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xc8]
mov r8, r13
mov r9, qword [rsp + 0x58]
call fcn.14000a231
cmp word [rsp + 0xa8], 0
jne 0x140008412
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x330]
mov r12, rdx
call fcn.140009a5e
cmp word [rsp + 0x378], 0
je 0x140008553
mov rcx, r12
call sub.ntdll.dll_NtClose
jmp 0x140008412
mov qword [rsp + 0x140], rbp
lea rax, [0x14002fe00]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1b0]
lea rdx, [rsp + 0x140]
mov r8, r13
mov r9, qword [rsp + 0x58]
call fcn.14000a118
movzx eax, word [rsp + 0x1b8]
test ax, ax
je 0x14000850a
mov word [rsp + 0x8a8], ax
jmp 0x140008412
mov rsi, qword [rsp + 0x1b0]
lea rcx, [rsp + 0x860]
mov rdx, rsi
call fcn.140009034
mov rcx, rsi
call sub.ntdll.dll_NtClose
cmp word [rsp + 0x8a8], 0
and al, 0xa8
or byte [rax], al
add byte [rax], al
and al, 0xa8
or byte [rax], al
add byte [rax], al
jne 0x140008412
mov ecx, 9
lea rdi, [rsp + 0x230]
lea rsi, [rsp + 0x860]
rep movsq qword [rdi], qword [rsi]
jmp 0x140008573
mov ecx, 9
lea rdi, [rsp + 0x230]
lea rsi, [rsp + 0x330]
rep movsq qword [rdi], qword [rsi]
mov rcx, r12
call sub.ntdll.dll_NtClose
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x230]
mov r8, r13
mov r9, qword [rsp + 0x58]
call fcn.140009a64
test ax, ax
je 0x140008412
jmp 0x14000831b
mov edx, 1
lock xadd dword [rbx + 0x198], edx
lea rdi, [rsp + 0xe0]
mov r9, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r8d, 0x16
call fcn.1400088ca
mov esi, eax
mov rcx, rdi
call fcn.140004649
mov rcx, qword [rsp + 0xc8]
jmp 0x14000832d
mov rcx, rsi
call fcn.140008e6c
lea rcx, [rbx + 0xb8]
call fcn.140008e71
mov rcx, rbx
call fcn.140008ed7
call fcn.140008f04
int3
mov ecx, eax
bswap eax
movdqa xmm12, xmmword [rsp + 0x70]
movdqa xmm0, xmm12
pinsrd xmm0, eax, 3
lea eax, [rcx + 1]
bswap eax
movdqa xmm14, xmm12
pinsrd xmm14, eax, 3
lea eax, [rcx + 2]
bswap eax
movdqa xmm15, xmm12
pinsrd xmm15, eax, 3
lea eax, [rcx + 3]
mov r10d, eax
bswap r10d
pinsrd xmm12, r10d, 3
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm0, xmm1
pxor xmm14, xmm1
pxor xmm15, xmm1
pxor xmm12, xmm1
movdqa xmm1, xmmword [rsp + 0x50]
aesenc xmm0, xmm1
aesenc xmm14, xmm1
aesenc xmm15, xmm1
aesenc xmm12, xmm1
movdqa xmm1, xmmword [rsp + 0x40]
aesenc xmm0, xmm1
aesenc xmm14, xmm1
aesenc xmm15, xmm1
aesenc xmm12, xmm1
aesenc xmm0, xmm4
aesenc xmm14, xmm4
aesenc xmm15, xmm4
aesenc xmm12, xmm4
aesenc xmm0, xmm5
aesenc xmm14, xmm5
aesenc xmm15, xmm5
aesenc xmm12, xmm5
aesenc xmm0, xmm6
aesenc xmm14, xmm6
aesenc xmm15, xmm6
aesenc xmm12, xmm6
aesenc xmm0, xmm7
aesenc xmm14, xmm7
aesenc xmm15, xmm7
aesenc xmm12, xmm7
aesenc xmm0, xmm8
aesenc xmm14, xmm8
aesenc xmm15, xmm8
aesenc xmm12, xmm8
aesenc xmm0, xmm9
aesenc xmm14, xmm9
aesenc xmm15, xmm9
aesenc xmm12, xmm9
loope 0x140020f94
invalid
invalid
cmp ah, bl
ret 0x4566
invalid
cmp ah, bl
invalid
aesenc xmm15, xmm10
aesenc xmm12, xmm10
cmp r8d, 0xc
je 0x140020f6e
loope 0x140020f94
invalid
cmp r8d, 0xa
jne 0x140020faa
aesenclast xmm0, xmm11
aesenclast xmm14, xmm11
aesenclast xmm15, xmm11
aesenclast xmm12, xmm11
jmp 0x140021035
aesenc xmm0, xmm11
aesenc xmm14, xmm11
aesenc xmm15, xmm11
aesenc xmm12, xmm11
movdqa xmm1, xmmword [rsp + 0x10]
aesenc xmm0, xmm1
aesenc xmm14, xmm1
cmp ah, bl
int1
aesenc xmm15, xmm1
aesenc xmm12, xmm1
movdqa xmm1, xmmword [rsp]
jmp 0x14002101e
invalid
aesenc xmm0, xmm11
aesenc xmm14, xmm11
aesenc xmm15, xmm11
aesenc xmm12, xmm11
movdqa xmm1, xmmword [rsp + 0x10]
aesenc xmm0, xmm1
aesenc xmm14, xmm1
aesenc xmm15, xmm1
aesenc xmm12, xmm1
movdqa xmm1, xmmword [rsp]
aesenc xmm0, xmm1
aesenc xmm14, xmm1
aesenc xmm15, xmm1
aesenc xmm12, xmm1
movdqa xmm1, xmmword [rsp + 0x30]
aesenc xmm0, xmm1
fadd st(1), st(0)
fadd st(1), st(0)
aesenc xmm14, xmm1
aesenc xmm15, xmm1
aesenc xmm12, xmm1
movdqa xmm1, xmmword [rsp + 0x20]
aesenclast xmm0, xmm1
aesenclast xmm14, xmm1
aesenclast xmm15, xmm1
aesenclast xmm12, xmm1
cmp rdx, 0x3f
jbe 0x140021092
movdqu xmm13, xmmword [r9]
movdqu xmm1, xmmword [r9 + 0x10]
movdqu xmm2, xmmword [r9 + 0x20]
movdqu xmm3, xmmword [r9 + 0x30]
pxor xmm13, xmm0
pxor xmm1, xmm14
pxor xmm2, xmm15
pxor xmm3, xmm12
movdqu xmmword [r9], xmm13
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add r9, 0x40
inc eax
add rdx, 0xffffffffffffffc0
jne 0x140020e06
add ecx, 4
jmp 0x1400210d3
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x90], xmm14
movdqa xmmword [rsp + 0xa0], xmm15
movdqa xmmword [rsp + 0xb0], xmm12
xor eax, eax
mov r8b, byte [rsp + rax + 0x80]
xor byte [r9 + rax], r8b
inc eax
cmp rdx, rax
ja 0x1400210bb
shr edx, 4
add ecx, edx
mov eax, ecx
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1c0]
movaps xmm8, xmmword [rsp + 0x1d0]
movaps xmm9, xmmword [rsp + 0x1e0]
movaps xmm10, xmmword [rsp + 0x1f0]
movaps xmm11, xmmword [rsp + 0x200]
movaps xmm12, xmmword [rsp + 0x210]
movaps xmm13, xmmword [rsp + 0x220]
movaps xmm14, xmmword [rsp + 0x230]
movaps xmm15, xmmword [rsp + 0x240]
add rsp, 0x250
pop rsi
ret