Function at 0x1400011e0
Capabilities:
Create new key via cryptacquirecontext
Delete file
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r12, r8
mov r14, rdx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], r8
xor edi, edi
mov dword [rbp - 0x78], edi
mov dword [rbp + 0x90], edi
mov dword [rbp + 0x6c], edi
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140001239
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, r14
call fcn.140002b90
mov rdx, r14
lea rcx, [rbp + 0x30]
call fcn.140002c80
nop
mov rdx, r12
mov rcx, rax
call fcn.140002800
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov ebx, 4
mov r8d, ebx
lea rdx, str..hdr
lea rcx, [rbp + 0x10]
call fcn.140002b90
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 1
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001344
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000133f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000133f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140001392
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000138d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000138d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x1400013e0
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140002c80
nop
mov rdx, r12
mov rcx, rax
call fcn.140002800
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8, rbx
lea rdx, str..src
lea rcx, [rsp + 0x60]
call fcn.140002b90
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r15d, 0x3c0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 1
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov qword [rbp - 0x80], rax
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400014fa
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000154a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001545
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001545
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14000159b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001596
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001596
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rbp], rdi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
cmp r13, 0xffffffffffffffff
je 0x1400017da
cmp rsi, 0xffffffffffffffff
je 0x1400017da
mov dword [rbp + 0x68], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x68]
mov r8d, ebx
lea rdx, [rbp + 0x90]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140001f5c
cmp dword [rbp + 0x90], 0x186a0
jae 0x140001609
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1400016cc
mov dword [rsp + 0x20], edi
mov r9d, 1
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [0x1400077e8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140001655
mov dword [rsp + 0x20], 8
mov r9d, 1
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [0x1400077e8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400016cc
lea rax, [0x1400077f8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, qword [0x1400077e8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400016cc
mov r9d, 1
mov r8d, 0x1d
lea rdx, str.owsd9012__1as_wpow1033b____12
mov rcx, qword [0x1400077f8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400016cc
lea rax, [0x1400077f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x800000
mov r8, qword [0x1400077f8]
mov edx, 0x6801
mov rcx, qword [0x1400077e8]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x68]
mov r8d, ebx
lea rdx, [rbp + 0x6c]
mov rcx, r13
cmp qword [0x1400077e8], 0
je 0x1400017cc
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140001727
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
mov rdx, qword [0x1400077f8]
mov rcx, qword [0x1400077f0]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov dword [rbp - 0x74], edi
cmp dword [rbp + 0x6c], 0
jbe 0x140001f5c
mov dword [rbp + 0x54], edi
mov r8d, 2
cmp qword [0x1400077e8], 0
cmove r8d, ebx
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x68]
lea rdx, [rbp + 0x54]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001f5c
movsxd rbx, dword [rbp + 0x54]
mov rdi, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xor eax, eax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
ja 0x14000229b
cmp rbx, 0xf
ja 0x14000189d
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], 0xf
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + rbx + 0x70], 0
jmp 0x140001936
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001727
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140001814
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14000180f
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000228d
mov rcx, r8
call fcn.140003780
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140001860
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x14000185b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002294
mov rcx, r8
call fcn.140003780
mov byte [r12], 0
mov qword [r12 + 0x18], 0xf
mov qword [r12 + 0x10], rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140003760
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400018b9
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400018e5
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
je 0x140001909
cmp rcx, 0x1000
jb 0x140001904
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400022a1
mov rcx, rax
call fcn.140003788
test rax, rax
je 0x140001f4b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000190c
call fcn.140003788
mov rsi, rax
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], rbx
mov r8, rdi
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov byte [rsi + rdi], 0
mov ebx, dword [rbp + 0x54]
mov rsi, qword [rbp - 0x80]
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x68]
mov r8d, ebx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001f16
mov dword [rbp + 0x94], edi
mov dword [rbp + 0x50], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x68]
mov ebx, 4
mov r8d, ebx
lea rdx, [rbp + 0x94]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001eda
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x68]
mov r8d, ebx
lea rdx, [rbp + 0x50]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001eda
lea rbx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rbx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x80]
cmp rax, 1
jb 0x140001a19
lea rdi, [rax + rbx]
mov r8, rdi
sub r8, rbx
mov edx, 0x5c
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001a17
cmp byte [rax], 0x5c
je 0x140001b21
inc rax
mov r8, rdi
sub r8, rax
mov edx, 0x5c
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400019f3
xor edi, edi
xor bl, bl
test r15b, 2
je 0x140001a75
and r15d, 0xfffffffd
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001a62
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ebe
call fcn.140003780
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
test r15b, 1
je 0x140001aba
and r15d, 0xfffffffe
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001aba
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ab5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ec5
call fcn.140003780
test bl, bl
je 0x140001c6c
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140001b00
inc rdx
mov rcx, qword [rbp + 0x70]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140001afb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f4b
call fcn.140003780
mov rsi, qword [rbp - 0x80]
mov ebx, dword [rbp - 0x74]
inc ebx
mov dword [rbp - 0x74], ebx
xor edi, edi
cmp ebx, dword [rbp + 0x6c]
mov ebx, 4
jae 0x140001f5c
jmp 0x140001734
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140001a17
mov rbx, r14
mov rsi, qword [r14 + 0x18]
cmp rsi, 0xf
jbe 0x140001b3e
mov rbx, qword [r14]
mov rdi, qword [r14 + 0x10]
test rdi, rdi
je 0x140001bcb
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x140005460]
lea rsi, [0x140005462]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0xa0], 1
inc rcx
cmp rcx, rsi
jne 0x140001b70
mov rsi, qword [r14 + 0x18]
lea rax, [rdi - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax + 0xa0], 0
jne 0x140001bc6
nop word [rax + rax]
cmp r8, rbx
je 0x140001bcb
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax + 0xa0], 0
je 0x140001bb0
sub r8, rbx
jmp 0x140001bd2
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
cmp rdi, r8
cmovb r8, rdi
mov rdx, r14
cmp rsi, 0xf
jbe 0x140001bf6
mov rdx, qword [r14]
lea rcx, [rbp - 0x70]
call fcn.140002e40
or r15d, 0xc00
or r15d, 1
mov dword [rbp - 0x78], r15d
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], dil
jne 0x140001c37
lea rcx, [rsp + 0x40]
call fcn.140002e40
nop
or r15d, 2
mov dword [rbp - 0x78], r15d
lea rdx, [rsp + 0x40]
call fcn.1400022b0
test eax, eax
jne 0x140001a19
mov bl, 1
jmp 0x140001a1b
mov rdx, r14
lea rcx, [rbp - 0x70]
call fcn.140002c80
mov rdi, rax
lea r9, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova r9, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x80]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140001cd2
lea rax, [rsi + rcx]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x140001cba
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp 0x140001ce5
mov qword [rsp + 0x20], rsi
mov rdx, rsi
mov rcx, rdi
call fcn.1400030b0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], bl
bts r15d, 0xc
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 2
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001d97
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ecc
call fcn.140003780
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], bl
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001de4
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ddf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ed3
call fcn.140003780
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
cmp rdi, 0xffffffffffffffff
je 0x140001ac2
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x94]
mov rsi, qword [rbp - 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [rbp + 0x50]
call fcn.1400037c4
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x68]
mov r8d, dword [rbp + 0x50]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001e8a
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140001b04
inc rdx
mov rcx, qword [rbp + 0x70]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140001e80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f4b
call fcn.140003780
jmp 0x140001b04
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x68]
mov r8d, dword [rbp + 0x50]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140001e43
mov rcx, rbx
call fcn.140003780
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001e43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140001f5c
inc rdx
mov rcx, qword [rbp + 0x70]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140001f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f4b
call fcn.140003780
jmp 0x140001f5c
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140001f57
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov ebx, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140002c80
nop
mov rdx, r12
mov rcx, rax
call fcn.140002800
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8, rbx
lea rdx, str..hdr
lea rcx, [rsp + 0x60]
call fcn.140002b90
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140002055
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002050
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002050
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400020a8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400020f9
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140002c80
nop
mov rdx, r12
mov rcx, rax
call fcn.140002800
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8, rbx
lea rdx, str..src
lea rcx, [rsp + 0x60]
call fcn.140002b90
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400021e0
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140002233
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000222e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000222e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400017da
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002283
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002283
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003780
jmp 0x1400017da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400011c0
int3
call fcn.140001120
int3