Function at 0x140003f90
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x840]
sub rsp, 0x940
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rbp + 0x830], rax
xor eax, eax
mov qword [rsp + 0x58], rdx
or edi, 0xffffffff
mov dword [rsp + 0x70], eax
xor r12d, r12d
mov dword [rsp + 0x50], eax
mov qword [rbp - 0x80], rax
mov ebx, eax
mov dword [rsp + 0x60], eax
mov r14, rdx
mov dword [rsp + 0x78], eax
lea r15d, [rdi + 2]
mov dword [rsp + 0x64], eax
mov rsi, rcx
mov rax, qword [rdx + 0x40]
mov dword [rbp - 0x78], r15d
mov dword [rsp + 0x40], edi
mov dword [rbp - 0x70], r12d
mov dword [rsp + 0x54], r12d
test rax, rax
je 0x140021936
mov eax, dword [rax + 0x38]
shr eax, 1
lea rcx, [rbp - 0x50]
mov r13d, 0x104
mov dword [rbp - 0x74], r12d
and eax, 8
mov dword [rsp + 0x6c], r12d
mov r8d, r13d
mov dword [rsp + 0x74], eax
xor edx, edx
mov qword [rbp + 0x1b8], r12
mov byte [rbp + 0x1c0], r15b
mov qword [rbp + 0x1c8], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x818], r12
xor edx, edx
mov byte [rbp + 0x820], r15b
lea rcx, [rbp + 0x610]
mov qword [rbp + 0x828], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x5f8], r12
xor edx, edx
mov byte [rbp + 0x600], r15b
lea rcx, [rbp + 0x3f0]
mov qword [rbp + 0x608], r13
call sub.msvcrt.dll_memset
mov r8d, r13d
mov qword [rbp + 0x3d8], r12
xor edx, edx
mov byte [rbp + 0x3e0], r15b
lea rcx, [rbp + 0x1d0]
mov qword [rbp + 0x3e8], r13
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x1c0]
lea rcx, [rbp - 0x50]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.14000ca40
test eax, eax
js 0x14002255a
mov al, byte [rbp + 0x820]
lea rcx, [rbp + 0x610]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.14000ca40
test eax, eax
js 0x14002255a
mov al, byte [rbp + 0x600]
lea rcx, [rbp + 0x3f0]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, r13
call fcn.14000ca40
test eax, eax
js 0x14002255a
mov al, byte [rbp + 0x3e0]
lea rcx, [rbp + 0x1d0]
neg al
sbb rdx, rdx
and edx, 0xfdc6
add rdx, 0x208
call fcn.14000ca40
test eax, eax
js 0x14002255a
lea rdx, [0x140034300]
lea rcx, [rbp + 0x3f0]
call fcn.14000b364
xor r9d, r9d
lea r8, [rsp + 0x68]
mov ecx, 0xfe00
call fcn.140005194
mov qword [rsp + 0x48], rax
mov r13, rax
test rax, rax
je 0x14002255a
cmp dword [0x140045ac0], r12d
jne 0x14002193e
mov rsi, qword [rsi + 0x40]
test rsi, rsi
je 0x1400046bb
mov rcx, qword [rsi]
mov rbx, qword [rsi + 0x30]
call fcn.140011ea0
xor r9d, r9d
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x28], rcx
mov rdx, rax
lea rcx, [0x140018590]
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 0x21]
call fcn.14001823c
test al, al
je 0x140021969
mov r15, qword [rbp - 0x60]
cmp dword [0x140041924], r12d
jne 0x140022540
mov rax, qword [rbp + 0x818]
lea rdx, [rbp + 0x610]
mov r8d, dword [rbp + 0x828]
test rax, rax
mov rcx, rsi
cmovne rdx, rax
call fcn.1400050b0
mov ebx, 1
cmp eax, ebx
je 0x140022505
cmp dword [0x140045ac4], r12d
jne 0x140004771
mov eax, dword [0x140045abc]
cmp eax, 3
je 0x1400219bb
test byte [rsi + 0x38], 8
je 0x140004857
mov rdx, qword [rsi + 8]
lea rcx, str._s_r_n
call fcn.140013448
cmp dword [0x140045abc], 3
je 0x1400219e6
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov r9d, dword [rbp + 0x1c8]
test rax, rax
mov rdx, r14
mov dword [rsp + 0x20], r12d
cmovne r8, rax
mov rcx, rsi
call fcn.140004a30
cmp eax, ebx
je 0x140022505
cmp dword [0x140045abc], 3
je 0x1400219f8
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
cmp word [rcx], r12w
je 0x140004681
mov rcx, qword [rsi + 8]
xor edx, edx
call fcn.140007420
mov r12d, eax
cmp eax, 0xffffffff
je 0x140021a31
mov ecx, eax
call fcn.1400101b8
xor ebx, ebx
test eax, eax
jne 0x140021a87
cmp dword [0x140045ac0], ebx
jne 0x140021ab4
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsi + 0x38]
mov r8d, 1
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x70], eax
test cl, 4
jne 0x14000477c
mov dword [rsp + 0x54], ecx
mov rax, qword [rbp + 0x3d8]
lea rcx, [rbp + 0x1d0]
mov r8, qword [rsi + 8]
test rax, rax
mov edx, dword [rbp + 0x3e8]
cmovne rcx, rax
call fcn.140013060
mov r14d, eax
lea rcx, [rbp - 0x50]
mov rax, qword [rbp + 0x1b8]
test rax, rax
cmovne rcx, rax
call fcn.140011ea0
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x44]
mov dword [rsp + 0x28], edi
mov r8d, 0x200
mov rdx, r13
mov qword [rsp + 0x20], rsi
mov ecx, r12d
call fcn.140004fe8
xor r9d, r9d
mov r13d, eax
cmp dword [0x140045ba8], r9d
jne 0x140021af8
mov ebx, dword [0x140045abc]
cmp ebx, 3
je 0x140021b3e
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
lea rdx, [rbp + 0x1d0]
mov ecx, r14d
cmovne r8, rax
mov rax, qword [rbp + 0x3d8]
test rax, rax
cmovne rdx, rax
call fcn.140004908
xor ecx, ecx
test eax, eax
jne 0x140021b55
cmp dword [0x140045ac4], ecx
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov dword [0x140045b40], eax
jne 0x1400047a2
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov r9d, dword [rbp + 0x1c8]
test rax, rax
mov rdx, rbx
mov rcx, rsi
cmovne r8, rax
mov eax, 1
mov dword [rsp + 0x20], eax
call fcn.140004a30
cmp eax, 1
je 0x14002249f
mov rcx, qword [rbp + 0x1b8]
lea rax, [rbp - 0x50]
xor r9d, r9d
test rcx, rcx
cmovne rax, rcx
cmp word [rax], r9w
je 0x140021b26
mov rax, qword [rbp + 0x3d8]
lea r8, [rbp - 0x50]
test rcx, rcx
lea rdx, [rbp + 0x1d0]
cmovne r8, rcx
test rax, rax
mov ecx, r14d
cmovne rdx, rax
call fcn.140004908
test eax, eax
jne 0x140021bd9
mov r14d, dword [rsp + 0x50]
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x54]
xor r9d, r9d
mov ebx, dword [0x140045abc]
mov edx, eax
test ecx, ecx
je 0x1400047e1
mov r8, qword [rsp + 0x58]
mov r10d, 1
cmp dword [0x140045ac4], r9d
jne 0x140004836
test dl, 6
je 0x140004865
or edi, 0xffffffff
mov dword [0x140045ba8], 5
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x78], r9d
mov dword [rsp + 0x64], r9d
mov edx, dword [rsp + 0x54]
mov eax, 1
cmp dword [rbp - 0x70], eax
je 0x140021cf7
mov ecx, dword [rsi + 0x38]
mov eax, ecx
test cl, 8
je 0x1400048c8
mov r8d, eax
test al, 8
je 0x140004521
cmp ebx, 3
je 0x140021d2f
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x44]
call fcn.140004fac
cmp ebx, 3
mov ebx, 1
je 0x140022133
mov ecx, dword [rsi + 0x38]
test bl, cl
je 0x140022133
mov edx, 0x800
mov r14d, ecx
and r14d, edx
mov eax, r14d
neg eax
sbb ebx, ebx
and ebx, edx
cmp edi, 0xffffffff
jne 0x1400048d6
bt ecx, 0xa
jb 0x140021d53
mov rax, qword [0x140041950]
lea rdx, [rbp - 0x50]
xor r13d, r13d
test rax, rax
je 0x140021dbe
mov rcx, qword [rbp + 0x1b8]
test rcx, rcx
cmovne rdx, rcx
mov ecx, dword [rsp + 0x74]
or ecx, ebx
xor r9d, r9d
mov dword [rsp + 0x28], ecx
xor r8d, r8d
lea rcx, [0x140041924]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsi + 8]
call qword [0x140033e78]
test eax, eax
je 0x140021de7
cmp dword [rsp + 0x64], r13d
jne 0x140022446
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140004614
mov rdx, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rdx, rdx
cmovne rcx, rdx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
cmp dword [0x140045ac0], r13d
mov ebx, 1
jne 0x140021e99
mov r13, qword [rsp + 0x48]
mov rax, qword [rsi + 0x30]
and dword [0x140045b98], 0
mov rcx, qword [rax + 0x14]
mov qword [rbp - 0x58], rcx
mov ecx, r12d
call fcn.14000d208
xor r12d, r12d
cmp dword [0x140045abc], 3
je 0x140022479
cmp dword [0x140041924], r12d
jne 0x140022450
mov r14, qword [rsp + 0x58]
lea r9, [rbp - 0x58]
mov rdx, r14
mov r8d, edi
mov rcx, rsi
call fcn.140004f58
mov dword [0x140045ac4], r12d
mov rdx, qword [rsi + 0x30]
lea rcx, [0x140018590]
mov r9, r15
mov r8d, 0x21
call fcn.140018a70
test al, al
jne 0x1400041ec
mov rcx, r15
call fcn.140013a0c
mov rsi, qword [rsi + 0x40]
test rsi, rsi
jne 0x1400041b0
mov ebx, dword [rsp + 0x60]
cmp dword [0x140045abc], 3
je 0x14002258f
mov rcx, qword [rbp + 0x3d8]
mov qword [rbp + 0x3d8], r12
test rcx, rcx
je 0x1400046e7
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x5f8]
mov qword [rbp + 0x5f8], r12
test rcx, rcx
je 0x140004706
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x818]
mov qword [rbp + 0x818], r12
test rcx, rcx
je 0x140004725
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x1b8]
mov qword [rbp + 0x1b8], r12
test rcx, rcx
je 0x140004744
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.140018f80
mov rbx, qword [rsp + 0x990]
add rsp, 0x940
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x140045abc]
jmp 0x140004246
and ecx, 0xfffffffb
mov eax, ecx
and al, 0x80
neg al
sbb edx, edx
neg edx
add edx, r8d
or edx, ecx
cmp byte [0x140045b25], bl
mov dword [rsi + 0x38], edx
jne 0x14000431d
jmp 0x140021ac8
cmp qword [rbx + 0x40], rcx
je 0x1400043f6
mov dword [0x140045ba8], ecx
mov rcx, qword [rbx + 0x40]
mov dword [0x140045b3c], eax
call fcn.140008b20
mov ecx, dword [0x140045ba8]
cmp ecx, 0x15
je 0x140022498
cmp ecx, 0x458
jne 0x1400043f6
jmp 0x140022498
cmp dword [rbp - 0x78], r9d
je 0x140021c46
mov dword [rsp + 0x6c], r9d
mov r8d, r9d
cmp edx, 0xffffffff
je 0x140004809
test dl, 0x10
mov eax, 1
cmovne r8d, eax
mov dword [rsp + 0x6c], r8d
mov dword [rbp - 0x78], r9d
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffb
cmp byte [0x140045b25], r9b
mov dword [rsi + 0x38], eax
je 0x140021c50
test r8d, r8d
mov r8, qword [rsp + 0x58]
je 0x1400044ba
jmp 0x140021ca3
mov rax, qword [r8 + 0x40]
test rax, rax
je 0x140004849
test byte [rax + 0x38], 8
jne 0x1400048ec
cmp ebx, 3
jne 0x1400044cd
jmp 0x140021cbe
cmp eax, 3
jne 0x14000426d
jmp 0x140004250
test dword [rsi + 0x38], 0x400
jne 0x140004894
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.1400059e4
mov ebx, dword [0x140045abc]
mov edi, eax
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov dword [rsp + 0x64], r9d
cmp edi, 0xffffffff
je 0x1400044e7
mov ebx, 1
mov ecx, edi
mov dword [rsp + 0x78], ebx
call fcn.1400101b8
xor r9d, r9d
test eax, eax
jne 0x140021cdb
mov ebx, dword [0x140045abc]
jmp 0x1400044f1
cmp ebx, 3
jne 0x140004511
jmp 0x140021d19
mov ecx, edi
call fcn.14000d208
mov ecx, dword [rsi + 0x38]
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
jmp 0x140004566
cmp qword [rsi + 0x40], r9
cmove ebx, r10d
mov dword [0x140045abc], ebx
jmp 0x140004849
mov eax, dword [rdx + 0x38]
jmp 0x140004012
mov ecx, dword [rsp + 0x68]
lea r8, [rsp + 0x50]
mov r9d, r15d
call fcn.140005194
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14002255a
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x70], eax
jmp 0x1400041a3
cmp dword [0x140045abc], 3
jne 0x14002197f
cmp dword [0x140045ac4], r12d
je 0x1400046aa
mov rdx, qword [rsi]
lea rcx, [0x140036038]
call fcn.140013448
lea rcx, [0x1400348f0]
call fcn.140013448
mov ecx, dword [0x140045ba8]
call fcn.14002f1d8
mov rcx, qword [rbp - 0x60]
call fcn.140013a0c
mov edx, 1
xor ecx, ecx
call fcn.14002d9d0
int3
mov rax, qword [rbp + 0x5f8]
lea rcx, [rbp + 0x3f0]
mov rdx, qword [rsi + 8]
test rax, rax
cmovne rcx, rax
call fcn.14002e558
test eax, eax
jne 0x140004681
jmp 0x140004771
cmp dword [0x140045ac4], r12d
je 0x1400042c7
jmp 0x14000426d
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
mov rdx, qword [rbp + 0x608]
lea rcx, [rbp + 0x3f0]
test rax, rax
cmovne r8, rax
mov rax, qword [rbp + 0x5f8]
test rax, rax
cmovne rcx, rax
call fcn.1400113e0
nop
jmp 0x1400042ab
mov ecx, dword [0x140045ba8]
call fcn.14002f1d8
xor r12d, r12d
cmp dword [0x140045abc], 3
jne 0x140021a7e
cmp edi, 0xffffffff
jne 0x140021a7e
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
mov rdx, qword [rsi + 8]
test rax, rax
cmovne rcx, rax
call fcn.14002e558
test eax, eax
je 0x140021a7e
mov rcx, r15
call fcn.140013a0c
mov edx, ebx
xor ecx, ecx
call fcn.14002d9d0
int3
mov dword [rsp + 0x60], ebx
jmp 0x140004681
bts dword [rsi + 0x38], 7
mov r8d, 1
mov ecx, dword [rsi + 0x38]
mov dword [rsp + 0x50], 0x80
test r8b, cl
je 0x140004310
and ecx, 0xfffffffe
or ecx, 4
mov dword [rsi + 0x38], ecx
jmp 0x140004310
mov ecx, dword [rsp + 0x70]
mov eax, ecx
cmp dword [rsp + 0x68], ecx
cmovb eax, dword [rsp + 0x68]
jmp 0x1400042ff
cmp dword [0x140045ac4], ebx
je 0x14000431d
test dl, 8
jne 0x14000431d
cmp dword [0x140045abc], 3
jne 0x14000431d
and edx, 0xfffffffe
or edx, 2
mov dword [rsi + 0x38], edx
jmp 0x14000431d
mov ecx, r12d
call fcn.14000d208
mov ecx, 0x6e
call fcn.14002f1d8
cmp dword [0x140045abc], 3
je 0x140022483
mov r14, qword [rsp + 0x58]
mov dword [rsp + 0x60], 1
jmp 0x140021b31
mov ecx, r12d
call fcn.14000d208
mov r14, rbx
mov r13, qword [rsp + 0x48]
xor r12d, r12d
jmp 0x140004681
cmp dword [0x140045ac4], r9d
jne 0x1400043a1
mov r14d, dword [rsp + 0x50]
jmp 0x1400044f1
test byte [rsi + 0x38], 0x80
jne 0x1400043da
mov ecx, r12d
call fcn.14000d208
mov r13, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov r14d, dword [rsp + 0x50]
mov r9, r13
mov qword [rsp + 0x28], r15
mov rcx, rsi
mov dword [rsp + 0x20], r14d
call fcn.14002e724
xor r12d, r12d
cmp dword [0x140045ac4], r12d
je 0x140021bbf
cmp dword [0x140045abc], 3
jne 0x140021bb8
mov eax, dword [rsi + 0x38]
mov ecx, dword [rsp + 0x54]
and eax, 0xfffffffe
test ecx, ecx
jne 0x140021bb3
or eax, 2
jmp 0x140021bb5
or eax, ecx
mov dword [rsi + 0x38], eax
mov dword [rbp - 0x70], 1
mov r8d, dword [rsi + 0x38]
lea rdx, [rsp + 0x44]
mov rcx, r13
call fcn.140004fac
mov edi, dword [rsp + 0x40]
jmp 0x140022479
test byte [rsi + 0x38], 0x80
jne 0x14000447b
mov ecx, r12d
call fcn.14000d208
cmp dword [0x140045ac4], 0
je 0x140021c1c
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x140021c1c
test byte [rax + 0x38], 8
je 0x140021c1c
mov eax, dword [0x140045abc]
mov ecx, 1
cmp qword [rsi + 0x40], 0
cmove eax, ecx
mov dword [0x140045abc], eax
mov r14d, dword [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rcx, rsi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r14d
call fcn.14002e724
mov edi, dword [rsp + 0x40]
jmp 0x140004480
mov r8d, dword [rsp + 0x6c]
jmp 0x14000480d
test al, 8
je 0x140004823
cmp ebx, 3
jne 0x140004823
test r8d, r8d
mov dword [rbp - 0x74], ebx
mov r8, qword [rsp + 0x58]
jne 0x1400044ba
mov rcx, qword [r8 + 0x40]
test rcx, rcx
je 0x140021c94
test byte [rcx + 0x38], 8
je 0x140021c94
mov ecx, dword [rsp + 0x54]
lea r10d, [rbx - 2]
or eax, r10d
mov dword [rsi + 0x38], eax
jmp 0x1400044c0
mov ecx, dword [rsp + 0x54]
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x1400044ba
cmp dword [rbp - 0x74], 3
mov r10d, 1
jne 0x1400044c0
or eax, r10d
mov dword [rsi + 0x38], eax
jmp 0x1400044c0
test ecx, ecx
jne 0x140021cd3
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffe
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x1400044cd
mov dword [rsi + 0x38], ecx
jmp 0x1400044cd
mov dword [rsp + 0x64], ebx
cmp dword [rsp + 0x54], r9d
jne 0x1400048bd
and dword [rsi + 0x38], 0xfffffffe
or dword [rsi + 0x38], 2
jmp 0x1400048bd
cmp ebx, 3
jne 0x140004503
mov eax, dword [rsi + 0x38]
and eax, 0xfffffffe
test edx, edx
jne 0x140021d0f
or eax, 2
jmp 0x140021d11
or eax, edx
mov dword [rsi + 0x38], eax
jmp 0x140004503
test edx, edx
jne 0x140004511
and eax, 0xfffffffe
or eax, 2
mov dword [rsi + 0x38], eax
jmp 0x140004511
cmp dword [rsp + 0x6c], r9d
jne 0x140004521
test edx, edx
jne 0x140004521
and r8d, 0xfffffffe
or r8d, 2
mov dword [rsi + 0x38], r8d
jmp 0x140004521
mov rcx, qword [rsi + 8]
call fcn.14002f358
xor r13d, r13d
test eax, eax
jne 0x140021d81
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call fcn.14002f358
mov r9d, r13d
test eax, eax
je 0x140021d87
mov r9d, 1
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov ecx, dword [rsp + 0x74]
lea r8, [0x14002d7c0]
test rax, rax
cmovne rdx, rax
mov rax, qword [0x140041950]
or ecx, ebx
or ecx, 2
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r13
jmp 0x1400045b1
mov rax, qword [rbp + 0x1b8]
mov r8d, dword [rsp + 0x74]
test rax, rax
mov rcx, qword [rsi + 8]
cmovne rdx, rax
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_CopyFileW]
nop dword [rax + rax]
nop
jmp 0x1400045bb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, 1
mov dword [0x140045ba8], eax
cmp eax, ecx
jne 0x140021e1f
test r14d, r14d
je 0x140021e1f
mov rcx, qword [rsi + 0x30]
test dword [rcx], 0x400
mov ecx, 0x40002730
cmovne eax, ecx
mov dword [0x140045ba8], eax
mov ecx, r12d
call fcn.14000d208
mov ecx, dword [0x140045ba8]
mov r12d, dword [rsp + 0x64]
mov eax, r12d
neg eax
mov dword [0x140045b98], r13d
mov eax, 0x70
sbb ebx, ebx
and ebx, 0x1d
test ecx, ecx
cmove ecx, eax
cmp dword [0x140041924], r13d
mov dword [0x140045ba8], ecx
je 0x140021e64
xor r12d, r12d
mov ebx, r12d
jmp 0x140021e71
test r12d, r12d
jne 0x140021e6e
call fcn.14002f1d8
xor r12d, r12d
cmp dword [rsp + 0x78], r12d
jne 0x1400224e6
mov dword [rsp + 0x60], 1
jmp 0x140021e8a
mov dword [rsp + 0x60], ebx
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x48]
jmp 0x140004681
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
mov edx, ebx
cmovne rcx, rax
call fcn.140007420
or r14d, 0xffffffff
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, r14d
je 0x1400220a3
mov ecx, eax
call fcn.1400101b8
mov ecx, edi
test eax, eax
jne 0x1400220ec
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
nop dword [rax + rax]
test eax, eax
je 0x1400220cc
mov ecx, edi
call fcn.14000d208
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
xor edx, edx
call fcn.140007420
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, r14d
je 0x1400220a3
mov ecx, eax
call fcn.1400101b8
test eax, eax
jne 0x1400220cc
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [rbp - 0x6c]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
cmp ebx, eax
jne 0x1400220c7
mov eax, dword [rbp - 0x6c]
cmp dword [rbp - 0x68], eax
jne 0x1400220c7
mov r14d, dword [rsp + 0x50]
mov ebx, r13d
mov r13, qword [rsp + 0x48]
mov ecx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov r8d, r14d
mov rdx, r13
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
mov ecx, edi
test eax, eax
je 0x14002208f
cmp dword [rsp + 0x44], 0
je 0x14002208f
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov r8d, dword [rsp + 0x44]
lea r9, [rbp - 0x64]
mov rdx, qword [rbp - 0x80]
mov rcx, rax
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x1400220fe
mov eax, dword [rsp + 0x44]
cmp dword [rbp - 0x64], eax
jne 0x1400220fe
mov rdx, qword [rbp - 0x80]
cmp r14d, eax
mov ecx, 1
mov r8d, eax
cmovne ebx, ecx
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400220fe
test ebx, ebx
je 0x140021fe8
mov ecx, edi
call fcn.14000d208
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
lea ebx, [rdi + 2]
jmp 0x14000462b
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
mov edx, ebx
mov ecx, 0x4000271f
cmovne r8, rax
call fcn.140003278
nop
jmp 0x140004626
mov ebx, 1
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
test rax, rax
mov edx, ebx
mov ecx, 0x4000271f
cmovne r8, rax
call fcn.140003278
mov ecx, edi
call fcn.14000d208
mov edi, r14d
mov dword [rsp + 0x40], r14d
jmp 0x140004626
mov ecx, edi
call fcn.14000d208
mov rax, qword [rbp + 0x1b8]
lea r8, [rbp - 0x50]
or edi, 0xffffffff
mov ecx, 0x4000271f
test rax, rax
mov dword [rsp + 0x40], edi
cmovne r8, rax
lea ebx, [rdi + 2]
mov edx, ebx
call fcn.140003278
nop
jmp 0x14000462b
cmp edi, 0xffffffff
je 0x1400221a2
mov ecx, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
nop dword [rax + rax]
cmp dword [0x140045ac4], 0
jne 0x140022204
cmp dword [0x140045abc], 3
jne 0x140022204
mov eax, dword [rsi + 0x38]
mov ecx, 0x4002
mov rbx, qword [rsp + 0x48]
and eax, ecx
cmp eax, ecx
jne 0x140022209
mov eax, dword [rsp + 0x44]
lea rdx, [rbx + 2]
add eax, 0xfffffffe
mov rcx, rbx
mov r8d, eax
mov dword [rsp + 0x44], eax
call sub.msvcrt.dll_memmove
jmp 0x140022209
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
mov edx, ebx
cmovne rcx, rax
call fcn.140007420
mov dword [rsp + 0x40], eax
mov edi, eax
cmp eax, 0xffffffff
jne 0x140022155
mov ecx, r12d
call fcn.14000d208
xor r12d, r12d
cmp dword [0x140045b38], r12d
jne 0x1400221e5
mov ecx, dword [0x140045ba8]
call fcn.14002f1d8
cmp dword [0x140045abc], 3
jne 0x140021e86
mov rcx, r15
call fcn.140013a0c
mov edx, ebx
xor ecx, ecx
call fcn.14002d9d0
int3
mov rbx, qword [rsp + 0x48]
mov edx, 0x4000
test dword [rsi + 0x38], edx
je 0x140022229
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x140022226
or dword [rax + 0x38], edx
jmp 0x140022229
or dword [rcx + 0x38], edx
mov eax, dword [0x140045b98]
test eax, eax
je 0x1400222d5
mov r8d, dword [rsp + 0x44]
xor r13d, r13d
test r8d, r8d
jle 0x140022446
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002e810
cmp dword [0x140045ac0], r13d
je 0x140022446
mov ecx, edi
call fcn.1400101b8
test eax, eax
jne 0x140022446
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.14002d878
lea ebx, [r13 + 1]
cmp eax, ebx
jne 0x1400222cc
mov rcx, r15
call fcn.140013a0c
mov edx, ebx
xor ecx, ecx
call fcn.14002d9d0
int3
mov edi, dword [rsp + 0x40]
jmp 0x140004626
mov ecx, 1
cmp r13d, ecx
jne 0x1400223a6
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
xor r13d, r13d
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002e810
cmp dword [0x140045ac0], r13d
je 0x14002235d
mov ecx, edi
call fcn.1400101b8
test eax, eax
jne 0x14002235d
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.14002d878
lea edi, [r13 + 1]
cmp eax, edi
je 0x1400224f3
mov edi, dword [rsp + 0x40]
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
lea r9, [rsp + 0x44]
mov r8d, r14d
mov rdx, rbx
cmovne rcx, rax
mov qword [rsp + 0x30], rcx
mov ecx, r12d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call fcn.140004fe8
mov r13d, eax
mov eax, dword [0x140045b98]
test eax, eax
je 0x1400222d5
mov ecx, 1
test eax, eax
je 0x140022446
mov r8d, dword [rsp + 0x44]
test r8d, r8d
jle 0x140022446
cmp r13d, ecx
jne 0x140022446
mov rax, qword [rbp + 0x1b8]
lea r9, [rbp - 0x50]
test rax, rax
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, edi
cmovne r9, rax
call fcn.14002e810
cmp dword [0x140045ac0], 0
je 0x140022446
mov ecx, edi
call fcn.1400101b8
test eax, eax
jne 0x140022446
mov rax, qword [rbp + 0x1b8]
lea rdx, [rbp - 0x50]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
test rax, rax
mov r9, rbx
cmovne rdx, rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.14002d878
mov ebx, 1
cmp eax, ebx
jne 0x1400222cc
mov rcx, r15
call fcn.140013a0c
mov edx, ebx
xor ecx, ecx
call fcn.14002d9d0
int3
mov ebx, 1
jmp 0x140004626
mov ecx, edi
call fcn.14000d208
mov rax, qword [rbp + 0x1b8]
lea rcx, [rbp - 0x50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
mov dword [rsp + 0x60], ebx
mov r14, qword [rsp + 0x58]
jmp 0x14000467a
mov rcx, r15
call fcn.140013a0c
mov edx, 1
xor ecx, ecx
call fcn.14002d9d0
int3
xor edx, edx
call fcn.140003240
mov ecx, r12d
call fcn.14000d208
mov rcx, r15
call fcn.140013a0c
lea rcx, [rbp + 0x1d0]
call fcn.14001855c
lea rcx, [rbp + 0x3f0]
call fcn.14001855c
lea rcx, [rbp + 0x610]
call fcn.14001855c
lea rcx, [rbp - 0x50]
call fcn.14001855c
mov eax, 1
jmp 0x140004746
mov edx, 1
mov ecx, ebx
call fcn.14002d9d0
int3
mov rcx, r15
call fcn.140013a0c
mov edx, edi
xor ecx, ecx
call fcn.14002d9d0
int3
mov rcx, r15
call fcn.140013a0c
lea rcx, [rbp + 0x1d0]
call fcn.14001855c
lea rcx, [rbp + 0x3f0]
call fcn.14001855c
lea rcx, [rbp + 0x610]
call fcn.14001855c
lea rcx, [rbp - 0x50]
call fcn.14001855c
nop
jmp 0x140004744
mov rcx, r15
call fcn.140013a0c
cmp edi, 0xffffffff
je 0x140022554
mov ecx, edi
call fcn.14000d208
mov r15d, 1
lea rcx, [rbp + 0x1d0]
call fcn.14001855c
lea rcx, [rbp + 0x3f0]
call fcn.14001855c
lea rcx, [rbp + 0x610]
call fcn.14001855c
lea rcx, [rbp - 0x50]
call fcn.14001855c
mov eax, r15d
jmp 0x140004746
cmp edi, 0xffffffff
je 0x1400046c8
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call fcn.140004f58
nop
jmp 0x1400046c8