Function at 0x140061930
Capabilities:
Create directory
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov ebx, dword [rcx + 0x168]
mov rsi, rcx
xor ecx, ecx
call sub.msvcrt.dll__umask
mov ecx, eax
mov edi, eax
call sub.msvcrt.dll__umask
mov eax, ebx
and eax, 3
cmp eax, 3
je 0x140060ea0
lea rdx, [0x140226cc8]
mov edx, dword [rdx + rax*4]
mov eax, edx
and eax, 0xfffffffd
or eax, 4
test bl, 8
cmovne edx, eax
mov eax, ebx
and eax, 0x10000000
cmp eax, 1
mov eax, ebx
sbb r8d, r8d
and eax, 0x700
and r8d, 7
cmp eax, 0x300
je 0x1400610e0
jle 0x140060ed0
cmp eax, 0x600
je 0x1400610d0
jg 0x140061088
cmp eax, 0x400
je 0x1400610f0
mov dword [rsp + 0x48], 1
cmp eax, 0x500
jne 0x140060ea0
nop word [rax + rax]
test bh, 1
je 0x140060ef2
mov eax, edi
not eax
and eax, dword [rsi + 0x158]
and eax, 0x80
mov edi, eax
mov ecx, eax
mov r15d, eax
mov r14d, eax
neg edi
mov edi, eax
mov r13d, eax
sbb r12d, r12d
add r12d, 0x20000081
neg edi
mov edi, eax
sbb ebp, ebp
add ebp, 0x28000081
neg edi
sbb edi, edi
add edi, 0x30000081
neg ecx
mov ecx, eax
sbb r11d, r11d
add r11d, 0x10000081
neg ecx
mov ecx, eax
sbb r10d, r10d
add r10d, 0x8000081
neg ecx
sbb ecx, ecx
add ecx, 0x20000181
neg r15d
sbb r15d, r15d
add r15d, 0x28000181
neg r14d
sbb r14d, r14d
add r14d, 0x30000181
mov dword [rsp + 0x44], r14d
mov r14d, eax
neg r14d
mov r14d, eax
sbb r9d, r9d
add r9d, 0x10000181
neg r14d
sbb r14d, r14d
mov dword [rsp + 0x40], r9d
mov r9d, eax
add r14d, 0x8000181
neg r9d
sbb r9d, r9d
add r9d, 0x181
neg r13d
sbb r13d, r13d
add r13d, 0x24000181
mov dword [rsp + 0x5c], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x2c000181
mov dword [rsp + 0x58], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x34000181
mov dword [rsp + 0x54], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x14000181
mov dword [rsp + 0x50], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0xc000181
mov dword [rsp + 0x4c], r13d
mov r13d, eax
neg r13d
sbb r13d, r13d
add r13d, 0x4000181
neg eax
sbb eax, eax
add eax, 0x81
jmp 0x140060f68
mov qword [rsi + 0x88], 0xfffffffffffff019
mov dword [rsi + 0x14c], 0x57
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 0x100
je 0x140061078
cmp eax, 0x200
je 0x1400610d0
test eax, eax
jne 0x140060ea0
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x44], 0x30000180
mov r12d, 0x20000080
mov ebp, 0x28000080
mov edi, 0x30000080
mov dword [rsp + 0x40], 0x10000180
mov r11d, 0x10000080
mov r10d, 0x8000080
mov ecx, 0x20000180
mov dword [rsp + 0x5c], 0x24000180
mov r15d, 0x28000180
mov r14d, 0x8000180
mov r9d, 0x180
mov dword [rsp + 0x58], 0x2c000180
mov r13d, 0x4000180
mov eax, pe_nt_image_headers64
mov dword [rsp + 0x54], 0x34000180
mov dword [rsp + 0x50], 0x14000180
mov dword [rsp + 0x4c], 0xc000180
test bl, 0x40
je 0x140060fa2
mov edi, dword [rsp + 0x54]
mov r11d, dword [rsp + 0x50]
mov r9d, r13d
mov eax, r13d
mov r12d, dword [rsp + 0x5c]
mov ebp, dword [rsp + 0x58]
or edx, 0x10000
mov r10d, dword [rsp + 0x4c]
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], r11d
mov ecx, r12d
mov r15d, ebp
mov r14d, r10d
test bh, 0x10
jne 0x140060fbc
mov dword [rsp + 0x44], edi
mov ecx, r12d
mov r15d, ebp
mov r14d, r10d
mov dword [rsp + 0x40], r11d
mov r9d, eax
mov eax, ebx
and eax, 0x30
cmp eax, 0x10
je 0x1400610b0
cmp eax, 0x20
je 0x1400610a0
test eax, eax
jne 0x140060ea0
test ebx, 0x2000000
je 0x140060ff7
test dl, 4
je 0x140060ff4
test dl, 2
je 0x140060ea0
and edx, 0xfffffffb
mov r9d, ecx
mov eax, ebx
and eax, 0xc000000
lea ecx, [rax - 0x4000000]
and ecx, 0xf8000000
je 0x1400610c0
test eax, eax
jne 0x140060ea0
mov eax, dword [rsp + 0x48]
or r9d, 0x2000000
mov rcx, qword [rsi + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r9d
xor r9d, r9d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140061100
mov edx, ebx
mov rcx, rax
call qword [sym.imp.msvcrt.dll__open_osfhandle]
test eax, eax
js 0x140061140
cdqe
mov qword [rsi + 0x88], rax
jmp 0x140060eb5
mov dword [rsp + 0x48], 4
jmp 0x140060d50
cmp eax, 0x700
jne 0x140060ea0
mov dword [rsp + 0x48], 1
jmp 0x140060d50
mov ecx, r15d
mov r9d, r14d
jmp 0x140060fdb
mov ecx, dword [rsp + 0x44]
mov r9d, dword [rsp + 0x40]
jmp 0x140060fdb
or r9d, 0x80000000
jmp 0x140061018
mov dword [rsp + 0x48], 5
jmp 0x140060d50
mov dword [rsp + 0x48], 2
jmp 0x140060d50
mov dword [rsp + 0x48], 3
jmp 0x140060d50
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 0x50
jne 0x140061120
and ebx, 0x500
cmp ebx, 0x100
je 0x1400611a7
call rdi
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rsi + 0x88], rax
jmp 0x140060eb5
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x18
jne 0x140061180
mov qword [rsi + 0x88], 0xfffffffffffff01e
mov dword [rsi + 0x14c], 4
mov rcx, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
je 0x1400611c1
call rbx
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rsi + 0x88], rax
jmp 0x140061160
mov qword [rsi + 0x88], 0xfffffffffffff01c
mov dword [rsi + 0x14c], 0x50
jmp 0x140060eb5
mov dword [rsi + 0x14c], 0xfffff002
mov ecx, 0xfffff002
call fcn.140060690
cdqe
mov qword [rsi + 0x88], rax
jmp 0x140061160
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov r14, qword [rbx + 0x180]
cmp ecx, 0xffffffff
je 0x1400613d0
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140061440
cmp r14, 0xffffffffffffffff
jne 0x140061300
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
xor r14d, r14d
xor esi, esi
lea r13, [rsp + 0x44]
jmp 0x1400612a5
add r14, 1
cmp r14d, dword [rbx + 0x170]
jae 0x1400612de
mov rax, r14
mov r9, r13
mov rcx, rbp
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
call r12
add esi, dword [rsp + 0x44]
mov edi, eax
test eax, eax
jne 0x140061298
or edi, esi
je 0x1400613f0
mov eax, esi
mov qword [rbx + 0x88], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
pxor xmm0, xmm0
xor edx, edx
movaps xmmword [rsp + 0x50], xmm0
mov r9d, 1
xor r15d, r15d
xor esi, esi
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
lea r13, [rsp + 0x44]
movaps xmmword [rsp + 0x60], xmm0
call rax
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x140061361
add r15, 1
cmp r15d, dword [rbx + 0x170]
jae 0x140061410
mov eax, esi
mov r9, r13
mov rcx, rbp
add rax, r14
mov qword [rsp + 0x60], rax
mov rax, r15
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call r12
add esi, dword [rsp + 0x44]
mov r10d, eax
test eax, eax
jne 0x140061350
test edi, edi
je 0x1400612d6
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r10d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbp
call rax
mov edi, dword [rsp + 0x30]
or edi, esi
jne 0x1400612de
jmp 0x1400613f0
mov qword [rbx + 0x88], 0xfffffffffffff00d
mov dword [rbx + 0x14c], 6
jmp 0x1400612e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x140061420
mov qword [rbx + 0x88], 0
jmp 0x1400612e7
test edi, edi
je 0x1400612de
jmp 0x1400613a6
mov dword [rbx + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rbx + 0x88], rax
jmp 0x1400612e7
mov dword [rbx + 0x14c], 6
mov ecx, 6
call fcn.140060690
cdqe
mov qword [rbx + 0x88], rax
jmp 0x1400612e7
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov r14, qword [rbx + 0x180]
cmp ecx, 0xffffffff
je 0x140061600
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140061658
cmp r14, 0xffffffffffffffff
jne 0x140061530
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
xor r14d, r14d
xor esi, esi
lea r13, [rsp + 0x44]
jmp 0x1400614d5
add r14, 1
cmp r14d, dword [rbx + 0x170]
jae 0x14006150e
mov rax, r14
mov r9, r13
mov rcx, rbp
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], 0
call r12
add esi, dword [rsp + 0x44]
mov edi, eax
test eax, eax
jne 0x1400614c8
or edi, esi
je 0x140061620
mov eax, esi
mov qword [rbx + 0x88], rax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
pxor xmm0, xmm0
xor edx, edx
movaps xmmword [rsp + 0x50], xmm0
mov r9d, 1
xor r15d, r15d
xor esi, esi
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x48]
lea r13, [rsp + 0x44]
movaps xmmword [rsp + 0x60], xmm0
call rax
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x140061591
add r15, 1
cmp r15d, dword [rbx + 0x170]
jae 0x140061648
mov eax, esi
mov r9, r13
mov rcx, rbp
add rax, r14
mov qword [rsp + 0x60], rax
mov rax, r15
shl rax, 4
add rax, qword [rbx + 0x178]
mov r8d, dword [rax]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
call r12
add esi, dword [rsp + 0x44]
mov r10d, eax
test eax, eax
jne 0x140061580
test edi, edi
je 0x140061506
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r10d
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
mov rcx, rbp
call rax
mov edi, dword [rsp + 0x30]
or edi, esi
jne 0x14006150e
jmp 0x140061620
mov qword [rbx + 0x88], 0xfffffffffffff00d
mov dword [rbx + 0x14c], 6
jmp 0x140061517
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061517
test edi, edi
je 0x14006150e
jmp 0x1400615d6
mov dword [rbx + 0x14c], 6
mov ecx, 6
call fcn.140060690
cdqe
mov qword [rbx + 0x88], rax
jmp 0x140061517
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc0
xor r9d, r9d
mov r8d, 7
mov edx, 0x10180
mov rsi, rcx
mov rcx, qword [rcx + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140061850
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x140061880
mov eax, dword [rsp + 0x80]
test al, 0x10
je 0x14006177a
test ah, 4
je 0x140061890
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400609c0
test eax, eax
js 0x1400618a8
mov eax, dword [rsp + 0x80]
mov rdi, qword [0x1402341d0]
mov r10, qword [rdi]
test al, 1
jne 0x1400617d8
lea r12, [rsp + 0x50]
lea rbp, [rsp + 0x40]
mov byte [rsp + 0x50], 1
mov r8, r12
mov rdx, rbp
mov rcx, rbx
mov dword [rsp + 0x20], 0xd
mov r9d, 1
call qword [rdi]
test eax, eax
js 0x140061825
mov qword [rsi + 0x40], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
and eax, 0xffffffde
pxor xmm0, xmm0
lea r12, [rsp + 0x50]
mov rcx, rbx
or eax, 0x20
lea rbp, [rsp + 0x40]
movaps xmmword [rsp + 0x50], xmm0
mov r8, r12
movaps xmmword [rsp + 0x60], xmm0
mov r9d, 0x28
mov rdx, rbp
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x70], eax
call r10
test eax, eax
jns 0x140061792
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rsi + 0x88], rax
jmp 0x1400617bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rsi + 0x88], rax
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140061830
mov dword [rsi + 0x14c], 5
mov ecx, 5
jmp 0x140061838
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
cmp eax, 0x5b8
jne 0x1400618c1
mov ecx, 5
mov eax, 5
mov dword [rsi + 0x14c], eax
jmp 0x140061838
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14, rcx
mov rcx, qword [rcx + 0x150]
call sub.msvcrt.dll_wcslen
mov rdx, qword [r14 + 0x150]
cmp rax, 5
ja 0x140061988
mov qword [r14 + 0x88], 0xfffffffffffff019
mov dword [r14 + 0x14c], 0x57
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rdx + rax*2 - 0xc]
mov r8d, 6
lea rdx, str.XXXXXX
mov rcx, rdi
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x14006195c
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140061c10
lea rax, [rsp + 0x48]
mov rbp, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov r13, qword [sym.imp.msvcrt.dll__wmkdir]
mov esi, 0x7fff
mov qword [rsp + 0x38], rax
mov r12, qword [sym.imp.msvcrt.dll__errno]
movabs rbx, 0x8421084210842109
jmp 0x140061b37
mov r15, qword [rsp + 0x48]
lea rcx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
mov rdx, r15
shr rdx, 1
mov rax, rdx
mul rbx
mov r9, rdx
shr rdx, 5
mov rax, rdx
shr r9, 4
mul rbx
mov r10, rdx
shr rdx, 5
mov rax, rdx
shr r10, 4
mul rbx
mov rax, r9
shl rax, 5
sub rax, r9
add rax, rax
mov r11, rdx
shr rdx, 5
sub r15, rax
mov rax, r10
shr r11, 4
shl rax, 5
sub rax, r10
add rax, rax
sub r9, rax
mov rax, r11
shl rax, 5
movzx r9d, word [rcx + r9*2]
sub rax, r11
add rax, rax
sub r10, rax
mov rax, rdx
mul rbx
movzx r10d, word [rcx + r10*2]
mov r8, rdx
shr r8, 4
mov rax, r8
shl rax, 5
sub rax, r8
add rax, rax
sub r11, rax
movzx eax, word [rcx + r11*2]
shl rax, 0x10
or rax, r10
shl rax, 0x10
or rax, r9
movzx r9d, word [rcx + r15*2]
shl rax, 0x10
shr rdx, 5
or rax, r9
mov qword [rdi], rax
mov rax, rdx
mul rbx
mov r9, rdx
shr rdx, 5
shr r9, 4
mov rax, r9
shl rax, 5
sub rax, r9
add rax, rax
sub r8, rax
mov rax, rdx
mul rbx
shr rdx, 4
mov rax, rdx
mov qword [rsp + 0x48], rdx
shl rax, 5
sub rax, rdx
add rax, rax
sub r9, rax
movzx eax, word [rcx + r9*2]
movzx ecx, word [rcx + r8*2]
shl eax, 0x10
or eax, ecx
mov rcx, qword [r14 + 0x150]
mov dword [rdi + 8], eax
call r13
test eax, eax
je 0x140061bb9
call r12
cmp dword [rax], 0x11
jne 0x140061bf8
sub esi, 1
je 0x140061b7f
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov edx, 8
call rbp
test eax, eax
jne 0x140061a00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [r14 + 0x14c], ecx
call fcn.140060690
mov rcx, qword [rsp + 0x40]
xor edx, edx
cdqe
mov qword [r14 + 0x88], rax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140061972
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov qword [r14 + 0x88], 0xffffffffffffffff
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [r14 + 0x14c], ecx
call fcn.140060690
cdqe
mov qword [r14 + 0x88], rax
jmp 0x140061972
mov rbx, qword [r14 + 0x98]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov r8d, 6
lea rcx, [rbx + rax - 6]
call sub.msvcrt.dll_wcstombs
mov rcx, qword [rsp + 0x40]
xor edx, edx
mov qword [r14 + 0x88], 0
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140061972
mov qword [r14 + 0x88], 0xffffffffffffffff
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
jmp 0x140061b58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14 + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [r14 + 0x88], rax
jmp 0x140061972
push r15
mov eax, 0x20a8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400c9670
sub rsp, rax
xor r9d, r9d
mov r8d, 7
mov edx, 0x100001
mov rdi, rcx
mov rcx, qword [rcx + 0x150]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140062060
lea rax, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x80], rax
lea r12, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [0x140234190]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x2000
mov qword [rsp + 0x20], r12
call qword [rax]
cmp eax, 0xc000000d
je 0x140062081
xor r14d, r14d
xor ebp, ebp
xor r13d, r13d
test eax, eax
js 0x140062115
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x20f0], rdi
mov qword [rsp + 0x88], r12
mov r13, qword [rsp + 0x80]
xor ebx, ebx
nop dword [rax + rax]
add r13, rbx
mov r9d, dword [r13 + 0x3c]
mov ebx, dword [r13]
shr r9d, 1
jmp 0x140061d64
cmp word [r13 + r9*2 + 0x3e], 0
lea rax, [r9 - 1]
jne 0x140061e60
mov r9, rax
test r9, r9
jne 0x140061d50
test rbx, rbx
jne 0x140061d40
mov rax, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], rax
mov rax, qword [0x140234190]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x2000
call qword [rax]
test eax, eax
jne 0x140061fef
cmp qword [rsp + 0x98], 0
jne 0x140061d2e
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
mov eax, 0x80000005
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rdi + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rdi + 0x88], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140062107
nop dword [rax]
sub r14, 1
mov rcx, qword [r13 + r14*8]
call fcn.140082dd0
test r14, r14
jne 0x140061e28
mov rcx, r13
call fcn.140082dd0
nop
add rsp, 0x20a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp r9, 1
je 0x140061fa8
cmp r9, 2
jne 0x140061e7e
cmp dword [r13 + 0x40], 0x2e002e
je 0x140061d69
lea r12, [r13 + 0x40]
mov dword [rsp + 0x64], r9d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov r8, r12
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rsi, rdi
test rdi, rdi
je 0x1400620a6
cmp r14, rbp
jb 0x140061fd0
test rbp, rbp
je 0x140061fc0
add rbp, rbp
lea rdx, [rbp*8]
mov rcx, qword [rsp + 0x68]
call fcn.140082e10
mov r15, rax
test rax, rax
je 0x1400620f5
lea rcx, [rdi + 8]
call fcn.140082db0
mov r11, rax
test rax, rax
je 0x1400620be
lea rax, [r14 + 1]
mov qword [r15 + r14*8], r11
xor edx, edx
mov r9d, dword [rsp + 0x64]
mov qword [rsp + 0x70], rax
lea rax, [r11 + 4]
mov r8, r12
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400620e3
mov r11, qword [rsp + 0x68]
mov edx, 6
mov byte [r11 + rdi + 4], 0
mov eax, dword [r13 + 0x38]
test al, 0x40
je 0x140061f98
mov dword [r11], edx
mov r14, qword [rsp + 0x70]
mov qword [rsp + 0x68], r15
test rbx, rbx
jne 0x140061d40
jmp 0x140061d6e
test ah, 4
je 0x140061fe0
mov edx, 3
jmp 0x140061f77
cmp word [r13 + 0x40], 0x2e
jne 0x140061e7e
jmp 0x140061d69
mov edx, 0x100
mov ebp, 0x20
jmp 0x140061ee6
mov r15, qword [rsp + 0x68]
jmp 0x140061efc
xor edx, edx
test al, 0x10
setne dl
add edx, 1
jmp 0x140061f77
jns 0x140061d2e
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
cmp eax, 0x80000006
jne 0x140061df0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x90], r13
test r13, r13
je 0x14006202b
or dword [rdi + 0x148], 8
mov qword [rdi + 0x88], r14
cmp r14, 0xffffffffffffffff
jne 0x140062141
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rdi + 0x14c], ecx
call fcn.140060690
cdqe
mov qword [rdi + 0x88], rax
jmp 0x140062141
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x14c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rdi + 0x88], rax
jmp 0x140061e44
mov qword [rdi + 0x88], 0xfffffffffffff02c
mov rcx, qword [rsp + 0x78]
mov dword [rdi + 0x14c], 0x10b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140061e44
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140061dfb
mov rdi, qword [rsp + 0x20f0]
mov qword [rdi + 0x88], 0xfffffffffffff027
mov r13, r15
mov dword [rdi + 0x14c], 0xe
jmp 0x140061e11
mov rdi, qword [rsp + 0x20f0]
mov r14, qword [rsp + 0x70]
mov r13, r15
jmp 0x1400620b3
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20f0]
mov r15, r13
jmp 0x1400620c6
test r13, r13
je 0x140061e44
jmp 0x140061e3b
cmp eax, 0x80000006
jne 0x140061df0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x90], 0
mov qword [rdi + 0x88], 0
mov dword [rdi + 0x170], 0
jmp 0x140061e44
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov rbx, rcx
lea rcx, [rcx - 0x120]
cmp dword [rbx - 0xb0], 0x1e
ja case.0x14006218a.0
mov eax, dword [rbx - 0xb0]
lea rdx, [0x140226c4c]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x30]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400621f0
nop dword [rax + rax]
mov qword [rbx - 0x98], 0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062230
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne case.0x14006218a.26
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x14006218a.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062230
cmp ecx, 2
jle case.0x14006218a.26
call qword [sym.imp.msvcrt.dll__close]
cmp eax, 0xffffffff
jne case.0x14006218a.26
nop dword [rax + rax]
mov qword [rbx - 0x98], 0xfffffffffffff00d
mov dword [rbx + 0x2c], 6
jmp case.0x14006218a.0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x1400616e0
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400621f0
xor r8d, r8d
lea rdx, [rbx - 0x90]
mov rcx, rax
call fcn.1400609c0
test eax, eax
jne 0x1400630a0
or dword [rbx + 0x28], 8
mov qword [rbx - 0x98], 0
mov rcx, rsi
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 0x48]
mov r12, qword [rbx + 0x30]
mov r13, qword [rbx + 0x40]
mov esi, dword [0x1402171f0]
mov rdi, qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
test al, 2
je 0x140062354
jmp 0x1400631d9
call rbp
cmp eax, 0x57
jne 0x14006332d
and esi, 2
je 0x140063345
mov eax, dword [rbx + 0x48]
mov r12, qword [rbx + 0x30]
mov dword [0x1402171f0], 0
mov r13, qword [rbx + 0x40]
mov esi, eax
and esi, 2
jne 0x1400631d9
and eax, 1
mov rdx, r12
mov rcx, r13
or esi, eax
mov r8d, esi
call rdi
test al, al
je 0x140062320
jmp case.0x14006218a.26
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wmkdir]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x14006218a.0
nop dword [rax]
call qword [sym.imp.msvcrt.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x2c], ecx
call fcn.140060690
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x14006218a.0
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wrmdir]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x14006218a.0
jmp 0x140062390
xor r8d, r8d
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
jne case.0x14006218a.26
jmp 0x1400621f0
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061c40
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061930
mov r8d, dword [rbx + 0x48]
test r8b, 4
je 0x1400630c0
mov qword [rbx - 0x98], 0xfffffffffffff02a
mov dword [rbx + 0x2c], 0x32
jmp case.0x14006218a.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062230
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReOpenFile]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400621f0
mov rcx, rax
mov rax, qword [0x1402341a0]
lea rbp, [rsp + 0x80]
lea rdi, [rsp + 0x60]
mov dword [rsp + 0x20], 4
mov r9d, 0x28
mov r8, rbp
mov rdx, rdi
call qword [rax]
test eax, eax
js 0x1400630f8
mov r12, qword [0x1402341d0]
mov eax, dword [rsp + 0xa0]
mov r10, qword [r12]
test al, 0x20
jne 0x14006334c
or eax, 0x20
mov r9d, 0x28
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0xa0], eax
mov rcx, rsi
mov dword [rsp + 0x20], 4
call r10
test eax, eax
js 0x1400630f8
mov eax, dword [rsp + 0xa0]
mov r13d, 1
mov edx, eax
or eax, 1
mov r9d, 0x28
mov r8, rbp
and edx, 0xfffffffe
test byte [rbx + 0x38], 0x80
mov rcx, rsi
mov dword [rsp + 0x20], 4
cmovne eax, edx
mov rdx, rdi
mov dword [rsp + 0xa0], eax
call qword [r12]
test eax, eax
js 0x1400630f8
test r13d, r13d
je 0x14006258d
mov eax, dword [rsp + 0xa0]
mov edx, pe_nt_image_headers64
mov r8, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 4
mov r9d, 0x28
and eax, 0xffffffdf
cmove eax, edx
mov rdx, rdi
mov dword [rsp + 0xa0], eax
call qword [r12]
test eax, eax
js 0x1400630f8
mov qword [rbx - 0xe0], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x14006218a.0
mov edx, dword [rbx + 0x38]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.msvcrt.dll__wchmod]
cdqe
mov qword [rbx - 0x98], rax
cmp rax, 0xffffffffffffffff
jne case.0x14006218a.0
jmp 0x140062390
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400621f0
test byte [rbx + 0x38], 2
je case.0x14006218a.26
and eax, 0x11
cmp eax, 1
jne case.0x14006218a.26
mov dword [rbx + 0x2c], 0xfffff030
mov ecx, 0xfffff030
call fcn.140060690
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x14006218a.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062230
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140063129
movsd xmm2, qword [0x140226d18]
movsd xmm3, qword [rbx + 0x38]
movsd xmm0, qword [0x140226d20]
movsd xmm1, qword [rbx + 0x40]
mulsd xmm3, xmm2
comisd xmm3, xmm0
cvttsd2si rax, xmm3
jb 0x140062676
subsd xmm3, xmm0
cvttsd2si rax, xmm3
btc rax, 0x3f
mulsd xmm1, xmm2
movabs rdx, 0x19db1ded53e8000
add rax, rdx
mov qword [rsp + 0x60], rax
comisd xmm1, xmm0
cvttsd2si rax, xmm1
jb 0x1400626a5
subsd xmm1, xmm0
cvttsd2si rax, xmm1
btc rax, 0x3f
movabs rdx, 0x19db1ded53e8000
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x60]
add rax, rdx
xor edx, edx
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne case.0x14006218a.26
jmp 0x1400621f0
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, 0x100
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400621f0
movsd xmm2, qword [0x140226d18]
movsd xmm3, qword [rbx + 0x38]
movsd xmm0, qword [0x140226d20]
movsd xmm1, qword [rbx + 0x40]
mulsd xmm3, xmm2
comisd xmm3, xmm0
cvttsd2si rax, xmm3
jb 0x140062755
subsd xmm3, xmm0
cvttsd2si rax, xmm3
btc rax, 0x3f
mulsd xmm1, xmm2
movabs rdx, 0x19db1ded53e8000
add rax, rdx
mov qword [rsp + 0x60], rax
comisd xmm1, xmm0
cvttsd2si rax, xmm1
jb 0x140062784
subsd xmm1, xmm0
cvttsd2si rax, xmm1
btc rax, 0x3f
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x60]
mov rcx, rsi
movabs rdx, 0x19db1ded53e8000
add rax, rdx
xor edx, edx
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x1400630a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx - 0x98], 0
jmp case.0x14006218a.0
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062230
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 8
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov rcx, rax
mov rax, qword [rbx + 0x60]
mov dword [rsp + 0x20], 0x14
mov qword [rsp + 0x60], rax
mov rax, qword [0x1402341d0]
call qword [rax]
mov ecx, eax
xor eax, eax
test ecx, ecx
jns 0x140062202
mov rax, qword [0x1402341f0]
call qword [rax]
jmp 0x1400621f6
mov ecx, dword [rbx + 0x30]
cmp ecx, 0xffffffff
je 0x140062230
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140063129
mov rcx, rax
lea rbp, [rsp + 0x50]
lea rsi, [rbx - 0x80]
mov rax, qword [0x1402341a0]
mov rdx, rbp
mov dword [rsp + 0x20], 0x12
mov r9d, 0x68
lea r8, [rsp + 0x80]
call qword [rax]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x14006386b
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x140063380
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x14006386b
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x14006331b
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x48], r8
movabs r8, 0xd6bf94d5e57a42bd
cmove rax, rcx
pxor xmm0, xmm0
movabs rcx, 0xfe624e212ac18000
mov qword [rbx - 0x40], 0x1000
add r9, rcx
mov qword [rbx - 0x30], 0
mov qword [rbx - 0x78], rax
mov rax, r9
mul r8
mov qword [rbx - 0x58], 0
mov qword [rbx - 0x28], 0
mov qword [rbx - 0x90], rsi
shr rdx, 0x17
movups xmmword [rbx - 0x68], xmm0
mov dword [rbx - 0x20], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
mov qword [rbx - 0x98], 0
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0x1c], r9d
mov r9, qword [rsp + 0x98]
add r9, rcx
mov rax, r9
mul r8
shr rdx, 0x17
mov dword [rbx - 0x10], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0xc], r9d
mov r9, qword [rsp + 0x90]
add r9, rcx
add rcx, qword [rsp + 0x80]
mov rax, r9
mul r8
mov rax, rcx
shr rdx, 0x17
mov dword [rbx - 0x18], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
mul r8
mov rax, qword [rsp + 0xc0]
imul r9d, r9d, 0x64
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rdx, 0x17
mov dword [rbx - 8], edx
movsxd rdx, edx
shr rax, 9
imul rdx, rdx, 0x989680
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov dword [rbx - 0x14], r9d
mov qword [rbx - 0x70], rax
sub rcx, rdx
imul ecx, ecx, 0x64
mov dword [rbx - 4], ecx
jmp case.0x14006218a.0
mov rsi, qword [rbx + 0x30]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x140062a78
cmp word [rsi + rax*2 - 4], 0x3a
lea rdx, [rax + rax]
je 0x140062a78
lea rdx, [rsi + rdx - 2]
movzx eax, word [rdx]
cmp ax, 0x5c
je 0x14006336a
cmp ax, 0x2f
je 0x14006336a
nop word [rax + rax]
mov rcx, qword [rbx + 0x30]
mov r13, qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov r8d, 7
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400621f0
mov r14, qword [0x1402341a0]
lea r12, [rsp + 0x50]
lea rbp, [rsp + 0x80]
mov dword [rsp + 0x20], 0x12
mov rdx, r12
mov r9d, 0x68
mov r8, rbp
mov rcx, rax
call qword [r14]
lea rdi, [rbx - 0x80]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x14006316d
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, r12
mov rcx, rsi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x140063122
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x14006316d
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
mov qword [rbx - 0x78], 0
test dh, 4
jne 0x140063148
test dl, 0x10
je 0x140063354
mov qword [rbx - 0x48], 0
mov eax, 0x4000
mov rcx, rax
or rax, 0x1b6
or rcx, 0x124
and edx, 1
cmovne rax, rcx
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x78], rax
pxor xmm0, xmm0
movabs r8, 0xfe624e212ac18000
movabs rcx, 0xd6bf94d5e57a42bd
mov qword [rbx - 0x40], 0x1000
add r9, r8
mov qword [rbx - 0x30], 0
mov rax, r9
mov qword [rbx - 0x58], 0
mul rcx
mov qword [rbx - 0x28], 0
mov qword [rbx - 0x90], rdi
movups xmmword [rbx - 0x68], xmm0
shr rdx, 0x17
mov dword [rbx - 0x20], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0x1c], r9d
mov r9, qword [rsp + 0x98]
add r9, r8
mov rax, r9
mul rcx
shr rdx, 0x17
mov dword [rbx - 0x10], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
imul r9d, r9d, 0x64
mov dword [rbx - 0xc], r9d
mov r9, qword [rsp + 0x90]
add r9, r8
add r8, qword [rsp + 0x80]
mov rax, r9
mul rcx
mov rax, r8
shr rdx, 0x17
mov dword [rbx - 0x18], edx
movsxd rdx, edx
imul rdx, rdx, 0x989680
sub r9, rdx
mul rcx
mov rax, qword [rsp + 0xc0]
imul r9d, r9d, 0x64
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rdx, 0x17
mov dword [rbx - 8], edx
movsxd rdx, edx
shr rax, 9
imul rdx, rdx, 0x989680
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov dword [rbx - 0x14], r9d
mov qword [rbx - 0x70], rax
sub r8, rdx
imul r8d, r8d, 0x64
mov dword [rbx - 4], r8d
jmp 0x1400622c6
mov r14d, dword [rbx + 0x68]
mov esi, 0x10000
mov eax, dword [rbx + 0x4c]
mov r12d, dword [rbx + 0x30]
mov rbp, qword [rbx + 0x60]
cmp r14, rsi
mov dword [rsp + 0x4c], eax
cmovbe rsi, r14
mov rcx, rsi
call fcn.140082db0
mov rdi, rax
test rax, rax
je 0x1400638ce
cmp rbp, 0xffffffffffffffff
je 0x140063018
xor r8d, r8d
mov rdx, rbp
mov ecx, r12d
call sub.msvcrt.dll__lseeki64
cmp rax, 0xffffffffffffffff
jne 0x140063018
mov rcx, rdi
call fcn.140082dd0
mov qword [rbx - 0x98], 0xffffffffffffffff
jmp 0x140062390
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061470
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140061240
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140060ca0
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000080
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400621f0
mov rdi, qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call rdi
mov esi, eax
test eax, eax
je 0x14006339a
lea ecx, [rax + 1]
add rcx, rcx
call fcn.140082db0
mov rbp, rax
test rax, rax
je 0x140063883
xor r9d, r9d
mov r8d, esi
mov rdx, rax
mov rcx, r12
call rdi
test eax, eax
je 0x140063830
mov r8d, 8
lea rdx, str._UNC_
mov rcx, rbp
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x1400632f2
mov eax, 0x5c
lea r14, [rbp + 0xc]
lea edi, [rsi - 6]
mov word [rbp + 0xc], ax
mov dword [rsp + 0x28], 0
mov r9d, edi
mov r8, r14
xor edx, edx
mov qword [rsp + 0x38], 0
mov r15, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call r15
movsxd rsi, eax
test esi, esi
je 0x140063392
lea ecx, [rsi + 1]
movsxd rcx, ecx
call fcn.140082db0
mov r13, rax
test rax, rax
je 0x140063387
mov r9d, edi
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call r15
mov byte [r13 + rsi], 0
mov rcx, rbp
mov qword [rbx - 0x90], r13
call fcn.140082dd0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [rbx + 0x28], 8
jmp case.0x14006218a.26
mov rsi, qword [rbx + 0x30]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 1
jbe 0x140062f20
cmp word [rsi + rax*2 - 4], 0x3a
lea rdx, [rax + rax]
je 0x140062f20
lea rdx, [rsi + rdx - 2]
movzx eax, word [rdx]
cmp ax, 0x5c
je 0x140063376
cmp ax, 0x2f
je 0x140063376
nop word [rax + rax]
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400621f0
mov rcx, rax
lea rbp, [rsp + 0x50]
lea rdi, [rbx - 0x80]
mov rax, qword [0x1402341a0]
mov rdx, rbp
mov dword [rsp + 0x20], 0x12
mov r9d, 0x68
lea r8, [rsp + 0x80]
call qword [rax]
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x140063848
mov rax, qword [0x1402341c0]
lea r8, [rsp + 0x60]
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 1
mov r9d, 0x18
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
je 0x14006311b
mov edx, eax
shr edx, 0x1e
cmp edx, 3
je 0x140063848
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x1400630e0
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov qword [rbx - 0x48], r8
cmove rax, rcx
jmp 0x140062b85
mov r13, qword [sym.imp.msvcrt.dll__read]
mov r15, qword [sym.imp.msvcrt.dll__write]
xor ebp, ebp
test r14, r14
jne 0x140063060
jmp 0x1400637f7
cmp eax, 0xffffffff
je 0x140062d05
cdqe
mov ecx, dword [rsp + 0x4c]
mov rdx, rdi
sub r14, rax
call r15
cmp eax, 0xffffffff
je 0x140062d05
add ebp, eax
test r14, r14
je 0x14006307a
cmp r14, rsi
mov r8, rsi
mov rdx, rdi
mov ecx, r12d
cmovbe r8, r14
call r13
mov r8d, eax
test eax, eax
jne 0x140063038
movsxd rbp, ebp
mov rcx, rdi
call fcn.140082dd0
mov qword [rbx - 0x98], rbp
cmp rbp, 0xffffffffffffffff
jne case.0x14006218a.0
jmp 0x140062390
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rbx - 0x98], rax
jmp 0x1400622d1
and r8d, 1
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne case.0x14006218a.26
jmp 0x1400621f0
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x140063002
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rbx - 0x98], rax
jmp 0x140062598
xor eax, eax
jmp 0x140062fdc
xor eax, eax
jmp 0x140062b3c
mov dword [rbx + 0x2c], 6
mov ecx, 6
call fcn.140060690
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x14006218a.0
xor edx, edx
lea r8, [rbx - 0x48]
mov rcx, rsi
call fcn.1400609c0
test eax, eax
jne 0x140063180
mov rax, qword [rbx - 0x78]
mov edx, dword [rsp + 0xa0]
or ah, 0xa0
jmp 0x140062b6e
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
call r15
cmp eax, 0x5b8
je 0x14006354a
cmp eax, 0x1126
je 0x14006354a
call r15
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.140060690
cdqe
mov qword [rbx - 0x98], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rax, rbx
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
mov rcx, r12
call sub.msvcrt.dll_wcslen
mov r8d, 4
lea rdx, [0x140226cf8]
mov rcx, r12
mov rsi, rax
call sub.msvcrt.dll_wcsncmp
mov ebp, eax
test eax, eax
je 0x140063240
cmp esi, 2
jle 0x1400633a8
movzx eax, word [r12]
and eax, 0xffffffdf
sub eax, 0x41
cmp ax, 0x19
ja 0x1400633a8
cmp word [r12 + 2], 0x3a
jne 0x1400633a8
movzx eax, word [r12 + 4]
cmp ax, 0x5c
je 0x140063240
cmp ax, 0x2f
jne 0x1400633a8
lea ecx, [rsi*4 + 0x20]
movsxd rcx, ecx
call fcn.140082db0
mov rsi, rax
test rax, rax
je 0x1400638ce
lea rdi, [rax + 0x10]
mov r8d, 4
lea rdx, [0x140226d08]
mov rcx, rdi
call sub.msvcrt.dll_wcsncpy
xor eax, eax
test ebp, ebp
sete al
lea r9, [r12 + rax*8]
movzx eax, word [r9]
test ax, ax
je 0x1400633bf
xor ecx, ecx
mov r8d, 4
xor r10d, r10d
jmp 0x1400632e4
cmp ax, 0x2f
je 0x1400632ea
mov edx, r8d
test r10d, r10d
je 0x1400632c4
movsxd r8, r8d
mov r14d, 0x5c
add edx, 1
mov word [rdi + r8*2], r14w
movzx eax, word [r9 + rcx]
lea r8d, [rdx + 1]
movsxd rdx, edx
xor r10d, r10d
mov word [rdi + rdx*2], ax
add rcx, 2
movzx eax, word [r9 + rcx]
test ax, ax
je 0x1400633c5
cmp ax, 0x5c
jne 0x1400632a0
mov r10d, 1
jmp 0x1400632d2
mov r8d, 4
lea rdx, [0x140226cf8]
mov rcx, rbp
call sub.msvcrt.dll_wcsncmp
test eax, eax
jne 0x140063830
lea r14, [rbp + 8]
lea edi, [rsi - 4]
jmp 0x140062e30
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x1400628fb
mov ecx, eax
mov dword [rbx + 0x2c], eax
call fcn.140060690
cdqe
mov qword [rbx - 0x98], rax
jmp case.0x14006218a.0
mov ecx, 0x57
jmp 0x14006332f
xor r13d, r13d
jmp 0x140062513
mov rax, qword [rsp + 0xb0]
mov qword [rbx - 0x48], rax
mov eax, 0x8000
jmp 0x140062b6e
xor r15d, r15d
mov word [rdx], r15w
jmp 0x140062a78
xor eax, eax
mov word [rdx], ax
jmp 0x140062f20
xor eax, eax
jmp 0x1400628d5
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call fcn.140082dd0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400621f0
mov qword [rbx - 0x98], 0xfffffffffffff019
mov dword [rbx + 0x2c], 0x32
jmp case.0x14006218a.0
mov r8d, 4
movsxd rax, r8d
lea edx, [r8 + r8 + 2]
mov r11d, 0x5c
xor ebp, ebp
add rax, rax
xor r12d, r12d
add r8d, 2
mov word [rsi + rax + 0x10], r11w
mov word [rsi + 0xa], dx
mov edx, r8d
mov word [rsi + 8], bp
mov word [rdi + rax + 2], r12w
movzx eax, word [r9]
test ax, ax
je 0x14006346b
xor ecx, ecx
xor r10d, r10d
jmp 0x14006344d
cmp ax, 0x2f
je 0x140063453
test r10d, r10d
je 0x140063431
movsxd rax, edx
mov r10d, 0x5c
add edx, 1
mov word [rdi + rax*2], r10w
movzx eax, word [r9 + rcx]
movsxd r10, edx
add edx, 1
mov word [rdi + r10*2], ax
xor r10d, r10d
add rcx, 2
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14006345b
cmp ax, 0x5c
jne 0x140063410
mov r10d, 1
jmp 0x14006343f
mov eax, edx
sub eax, r8d
cmp eax, 2
je 0x14006379d
add eax, eax
movsxd rdx, edx
add r8d, r8d
xor ecx, ecx
mov word [rsi + 0xe], ax
lea ebp, [rdx + rdx + 0x12]
mov word [rsi + 0xc], r8w
xor r8d, r8d
lea eax, [rbp - 8]
mov word [rdi + rdx*2], cx
xor edx, edx
mov rcx, r13
mov dword [rsi], 0xa0000003
mov word [rsi + 4], ax
mov word [rsi + 6], r8w
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140063757
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r13
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006380d
lea rax, [rsp + 0x80]
mov r9d, ebp
mov r8, rsi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
mov edx, 0x900a4
mov rcx, rdi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400637bf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.140082dd0
mov qword [rbx - 0x98], 0
jmp case.0x14006218a.0
mov rcx, qword [rbx + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov r8d, 7
mov dword [rsp + 0x28], 0x2000000
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call r13
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1400631a0
mov rcx, rax
mov r9d, 0x68
mov r8, rbp
mov rdx, r12
mov dword [rsp + 0x20], 0x12
call qword [r14]
mov ecx, eax
shr eax, 0x1e
cmp eax, 3
je 0x140063893
mov rax, qword [0x1402341c0]
mov rcx, r13
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
mov r9d, 0x18
mov rdx, r12
call qword [rax]
cmp dword [rsp + 0x50], 0xc0000002
mov ecx, eax
je 0x1400637b8
shr eax, 0x1e
cmp eax, 3
je 0x140063893
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0xa0]
mov qword [rbx - 0x80], rax
test dl, 0x10
jne 0x14006378b
mov r8, qword [rsp + 0xb0]
mov ecx, 0x81b6
mov eax, 0x8124
and edx, 1
mov r9, qword [rsp + 0x88]
mov qword [rbx - 0x48], r8
movabs r8, 0xfe624e212ac18000
cmove rax, rcx
pxor xmm0, xmm0
movabs rcx, 0xd6bf94d5e57a42bd
mov qword [rbx - 0x90], rdi
add r9, r8
movups xmmword [rbx - 0x68], xmm0
mov qword [rbx - 0x78], rax
mov rax, r9
mul rcx
mov qword [rbx - 0x40], 0x1000
mov qword [rbx - 0x30], 0
mov qword [rbx - 0x58], 0
shr rdx, 0x17
mov qword [rbx - 0x28], 0
movsxd rax, edx
mov dword [rbx - 0x20], edx
imul rax, rax, 0x989680
mov qword [rbx - 0x98], 0
sub r9, rax
imul eax, r9d, 0x64
mov r9, qword [rsp + 0x98]
add r9, r8
mov dword [rbx - 0x1c], eax
mov rax, r9
mul rcx
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 0x10], edx
imul rax, rax, 0x989680
sub r9, rax
imul eax, r9d, 0x64
mov r9, qword [rsp + 0x90]
add r9, r8
add r8, qword [rsp + 0x80]
mov dword [rbx - 0xc], eax
mov rax, r9
mul rcx
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 0x18], edx
imul rax, rax, 0x989680
sub r9, rax
imul eax, r9d, 0x64
mov dword [rbx - 0x14], eax
mov rax, r8
mul rcx
mov rcx, r13
shr rdx, 0x17
movsxd rax, edx
mov dword [rbx - 8], edx
imul rax, rax, 0x989680
sub r8, rax
imul eax, r8d, 0x64
mov dword [rbx - 4], eax
mov rax, qword [rsp + 0xc0]
mov qword [rbx - 0x50], rax
mov rax, qword [rsp + 0xa8]
shr rax, 9
mov qword [rbx - 0x38], rax
mov eax, dword [rsp + 0xb8]
mov qword [rbx - 0x70], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
jmp 0x1400631bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.140060690
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140082dd0
mov ecx, 0x41b6
mov eax, 0x4124
xor r8d, r8d
jmp 0x140063615
movsxd rax, edx
mov r9d, 0x5c
add edx, 1
mov word [rdi + rax*2], r9w
mov eax, 6
jmp 0x14006346b
xor eax, eax
jmp 0x1400635ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.140060690
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
call fcn.140082dd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp case.0x14006218a.0
mov rcx, rdi
call fcn.140082dd0
xor eax, eax
mov qword [rbx - 0x98], rax
jmp case.0x14006218a.0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.140060690
mov rcx, rsi
cdqe
mov qword [rbx - 0x98], rax
call fcn.140082dd0
jmp 0x1400637e9
mov rcx, rbp
call fcn.140082dd0
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006339a
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
call rdi
jmp 0x1400630a6
mov ecx, eax
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400621f0
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006339a
mov rax, qword [0x1402341f0]
call qword [rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call r15
call r15
mov dword [rbx + 0x2c], eax
mov ecx, eax
call fcn.140060690
mov rcx, r13
cdqe
mov qword [rbx - 0x98], rax
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
jmp 0x1400631bd
lea rdx, [0x140226c3e]
mov ecx, 0xe
call fcn.140060630
nop