Function at 0x14002a550
Capabilities:
Extract resource via kernel32 functions
Get common file path
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, rdx
xor ecx, ecx
xor dl, dl
mov r12d, r9d
mov byte [rbp - 0x30], dl
mov rsi, r8
mov edx, 0x228
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x14002a5db
xor edx, edx
mov r8d, 0x124
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x14002a60f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
xor ecx, ecx
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rdi + 0x50], rax
test rax, rax
jne 0x14002a603
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, 2
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, r12d
mov qword [rdi + 0x38], 0xffffffffffffffff
and eax, 0x3ffffff7
xor ebx, ebx
mov ecx, 1
mov r13d, 2
sub eax, ecx
je 0x14002a706
sub eax, ecx
je 0x14002a67c
cmp eax, r13d
jne 0x14002a77c
lea r14, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], r13d
mov r9, r14
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov r8, rsi
mov dword [rsp + 0x20], ebx
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14002a6d1
mov qword [r14], r15
jmp 0x14002a6d4
mov qword [rsp + 0x30], rbx
lea r14, [rdi + 8]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, 3
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
mov rcx, r15
test r12d, r12d
jns 0x14002a6b0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14002a6b6
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x14002a6d1
mov rcx, rdi
mov ebx, 1
call fcn.14002a4b0
jmp 0x14002a5e0
mov dword [rdi], r13d
mov rcx, qword [r14]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rdi + 0x14], eax
cmp eax, 0xffffffff
jne 0x14002a77c
mov rcx, rdi
mov ebx, reloc.WSOCK32.dll_recv
call fcn.14002a4b0
jmp 0x14002a5e0
mov qword [rdi + 8], r15
test r15, r15
jne 0x14002a776
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, si
mov r8d, 0xa
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14002b698
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14002b698
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rdi + 8], rax
test rax, rax
je 0x14002b688
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov ecx, 1
mov qword [rdi + 0x18], rsi
mov dword [rdi], ecx
test r12b, 8
je 0x14002a7bf
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
mov word [rdi + 0x88], ax
mov eax, dword [rdi + 0x14]
or dword [rdi], 8
mov dword [rdi + 0x86], eax
mov qword [rdi + 0x9a], rax
mov word [rdi + 0x66], 8
mov qword [rdi + 0x38], rbx
jmp 0x14002b637
test byte [rdi], 1
jne 0x14002a7e8
mov rcx, qword [rdi + 8]
lea r8, [rbp - 0x20]
mov r9d, r13d
mov qword [rbp - 0x20], rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [rdi + 0x14]
mov r14, qword [rbp - 0x20]
sub r14, rax
jmp 0x14002a7f0
mov r14, qword [rdi + 0x18]
mov qword [rdi + 0x20], r14
mov esi, 0xffff
mov qword [rbp - 0x28], r14
cmp r14, rsi
mov edx, 0x404
cmovl rsi, r14
xor ecx, ecx
mov qword [rbp - 0x18], rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test rax, rax
je 0x14002b688
mov eax, 4
cmp rsi, rax
jle 0x14002a885
nop word [rax + rax]
lea rcx, [rax + 0x400]
mov r15d, r14d
cmp rcx, rsi
mov rax, rcx
mov ecx, 0x404
cmovg rax, rsi
mov rsi, r14
sub rsi, rax
mov qword [rbp - 0x10], rax
sub r15d, esi
mov qword [rbp - 0x20], rsi
cmp rax, rcx
cmova r15d, ecx
test byte [rdi], 1
jne 0x14002a8b4
mov edx, dword [rdi + 0x14]
lea r8, [rbp - 0x38]
mov rcx, qword [rdi + 8]
add rdx, rsi
xor r9d, r9d
mov qword [rbp - 0x38], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14002a8b8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test byte [rdi], 1
jne 0x14002b582
mov edx, dword [rdi + 0x14]
lea r8, [rbp - 0x18]
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov qword [rbp - 0x18], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x14002b586
mov qword [rdi + 0x20], rsi
test byte [rdi], 1
mov r14d, r15d
jne 0x14002a8f2
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x40]
mov r8d, r15d
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002a8ec
mov dword [rdi + 0x10], 7
mov r14d, ebx
mov dword [rbp - 0x40], ebx
jmp 0x14002a928
mov r14d, dword [rbp - 0x40]
jmp 0x14002a928
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
mov eax, r15d
add rax, rcx
cmp rax, rdx
jbe 0x14002a90b
mov r14d, edx
sub r14d, ecx
mov rdx, qword [rdi + 8]
add rdx, rcx
mov r8d, r14d
mov rcx, r12
mov esi, r14d
call sub.VCRUNTIME140.dll_memcpy
add qword [rdi + 0x20], rsi
mov rsi, qword [rbp - 0x20]
test r14d, r14d
je 0x14002a885
lea edx, [r15 - 3]
movsxd rax, edx
test edx, edx
js 0x14002a978
lea rcx, [r12 + 3]
mov r8, 0xfffffffffffffffd
add rcx, rax
sub r8, r12
nop
mov rax, rcx
dec edx
dec rcx
cmp byte [rcx - 3], 0x50
jne 0x14002a96f
cmp byte [rax - 3], 0x4b
jne 0x14002a96f
cmp byte [rcx - 1], 5
jne 0x14002a96f
cmp byte [rcx], 6
je 0x14002a992
lea rax, [r8 + rcx]
test rax, rax
jns 0x14002a950
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 0x18]
cmp rax, rsi
jge 0x14002a885
mov r14, qword [rbp - 0x28]
jmp 0x14002a830
movsxd rax, edx
cmp byte [rax + r12 - 0x14], 0x50
jne 0x14002a9c3
cmp byte [rax + r12 - 0x13], 0x4b
jne 0x14002a9c3
cmp byte [rax + r12 - 0x12], 6
jne 0x14002a9c3
cmp byte [rax + r12 - 0x11], 7
jne 0x14002a9c3
mov rsi, qword [rax + r12 - 0xc]
mov r14b, 1
mov byte [rbp - 0x30], r14b
jmp 0x14002a9c9
add rsi, rax
xor r14b, r14b
mov rcx, r12
mov qword [rbp - 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test byte [rdi], 1
jne 0x14002a9f8
mov edx, dword [rdi + 0x14]
lea r8, [rbp - 0x18]
mov rcx, qword [rdi + 8]
add rdx, rsi
xor r9d, r9d
mov qword [rbp - 0x18], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x14002a9fc
mov qword [rdi + 0x20], rsi
mov dword [rbp - 0x40], ebx
cmp dword [rdi + 0x10], ebx
jne 0x14002aa58
test byte [rdi], 1
jne 0x14002aa33
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, 4
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002aa58
mov dword [rdi + 0x10], 7
jmp 0x14002aa58
mov rdx, qword [rdi + 0x20]
mov ecx, 4
mov r8, qword [rdi + 0x18]
lea rax, [rdx + 4]
cmp rax, r8
jbe 0x14002aa4f
mov rcx, r8
sub rcx, rdx
mov eax, ecx
add rax, rdx
mov qword [rdi + 0x20], rax
mov qword [rbp - 0x28], rbx
mov r13, rbx
mov r15d, 8
test r14b, r14b
je 0x14002abb7
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x38], rbx
cmp dword [rdi + 0x10], ebx
jne 0x14002ab53
test byte [rdi], 1
mov r14d, r15d
jne 0x14002aab7
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x40]
mov r8d, r15d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002aab1
mov dword [rdi + 0x10], 7
mov r14d, ebx
jmp 0x14002aaed
mov r14d, dword [rbp - 0x40]
jmp 0x14002aaed
mov r12, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r12 + 8]
cmp rax, rcx
jbe 0x14002aacf
mov r14d, ecx
sub r14d, r12d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x38]
add rdx, r12
mov r8d, r14d
mov esi, r14d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r12]
mov qword [rdi + 0x20], rax
test r14d, r14d
movzx r14d, byte [rbp - 0x30]
je 0x14002ab4b
movzx eax, byte [rbp - 0x32]
movzx r13d, byte [rbp - 0x31]
shl r13, 8
or r13, rax
movzx eax, byte [rbp - 0x33]
shl r13, 8
or r13, rax
movzx eax, byte [rbp - 0x34]
shl r13, 8
or r13, rax
movzx eax, byte [rbp - 0x35]
shl r13, 8
or r13, rax
movzx eax, byte [rbp - 0x36]
shl r13, 8
or r13, rax
movzx eax, byte [rbp - 0x37]
shl r13, 8
or r13, rax
movzx eax, byte [rbp - 0x38]
shl r13, 8
or r13, rax
jmp 0x14002ab4f
mov r13, qword [rbp - 0x38]
mov qword [rbp - 0x28], r13
mov dword [rbp - 0x40], ebx
cmp dword [rdi + 0x10], ebx
jne 0x14002abb7
test byte [rdi], 1
mov esi, 4
jne 0x14002ab8f
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, esi
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002ab8a
mov dword [rdi + 0x10], 7
mov eax, dword [rdi + 0x10]
jmp 0x14002abc8
mov rdx, qword [rdi + 0x20]
mov rcx, rsi
mov r8, qword [rdi + 0x18]
lea rax, [rdx + 4]
cmp rax, r8
jbe 0x14002aba9
mov rcx, r8
sub rcx, rdx
mov eax, ecx
add rax, rdx
mov qword [rdi + 0x20], rax
mov eax, dword [rdi + 0x10]
jmp 0x14002abc8
mov eax, dword [rdi + 0x10]
test r14b, r14b
je 0x14002aedd
mov esi, 4
mov dword [rbp - 0x40], ebx
mov r12d, ebx
test eax, eax
jne 0x14002ac7a
test byte [rdi], 1
mov r14d, esi
jne 0x14002ac0e
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, esi
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002ac08
mov dword [rdi + 0x10], 7
mov r14d, ebx
jmp 0x14002ac49
mov r14d, dword [rbp - 0x38]
jmp 0x14002ac49
mov r12, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r12 + 4]
cmp rax, rcx
jbe 0x14002ac26
mov r14d, ecx
sub r14d, r12d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r12
mov r8d, r14d
mov esi, r14d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r12]
mov esi, 4
mov qword [rdi + 0x20], rax
test r14d, r14d
je 0x14002ac76
movzx eax, byte [rbp - 0x3e]
movzx r12d, byte [rbp - 0x3d]
shl r12d, 8
or r12d, eax
movzx eax, byte [rbp - 0x3f]
shl r12d, 8
or r12d, eax
movzx eax, byte [rbp - 0x40]
shl r12d, 8
or r12d, eax
jmp 0x14002ac7a
mov r12d, dword [rbp - 0x40]
mov r14d, ebx
mov dword [rbp - 0x40], ebx
cmp dword [rdi + 0x10], ebx
jne 0x14002ad27
test byte [rdi], 1
mov r14d, esi
jne 0x14002acc1
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, esi
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002acbb
mov dword [rdi + 0x10], 7
mov r14d, ebx
jmp 0x14002acf6
mov r14d, dword [rbp - 0x38]
jmp 0x14002acf6
mov r13, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r13 + 4]
cmp rax, rcx
jbe 0x14002acd8
mov r14d, ecx
sub r14d, r13d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r13
mov r8d, r14d
mov esi, r14d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r13]
mov qword [rdi + 0x20], rax
test r14d, r14d
je 0x14002ad23
movzx eax, byte [rbp - 0x3e]
movzx r14d, byte [rbp - 0x3d]
shl r14d, 8
or r14d, eax
movzx eax, byte [rbp - 0x3f]
shl r14d, 8
or r14d, eax
movzx eax, byte [rbp - 0x40]
shl r14d, 8
or r14d, eax
jmp 0x14002ad27
mov r14d, dword [rbp - 0x40]
mov rcx, rbx
mov qword [rbp - 0x40], rbx
cmp dword [rdi + 0x10], ebx
jne 0x14002adfc
test byte [rdi], 1
mov r13d, r15d
jne 0x14002ad6f
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, r15d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002ad69
mov dword [rdi + 0x10], 7
mov r13d, ebx
jmp 0x14002ada0
mov r13d, dword [rbp - 0x38]
jmp 0x14002ada0
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
lea rax, [rcx + 8]
cmp rax, rdx
jbe 0x14002ad86
mov r13d, edx
sub r13d, ecx
mov rdx, qword [rdi + 8]
add rdx, rcx
mov r8d, r13d
lea rcx, [rbp - 0x40]
mov esi, r13d
call sub.VCRUNTIME140.dll_memcpy
add qword [rdi + 0x20], rsi
test r13d, r13d
je 0x14002adf8
movzx eax, byte [rbp - 0x3a]
movzx ecx, byte [rbp - 0x39]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3e]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3f]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x40]
shl rcx, 8
or rcx, rax
jmp 0x14002adfc
mov rcx, qword [rbp - 0x40]
mov qword [rdi + 0x28], rcx
mov rcx, rbx
mov qword [rbp - 0x40], rbx
cmp dword [rdi + 0x10], ebx
jne 0x14002b61d
test byte [rdi], 1
mov r13d, r15d
jne 0x14002ae48
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, r15d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002ae42
mov dword [rdi + 0x10], 7
mov r13d, ebx
jmp 0x14002ae79
mov r13d, dword [rbp - 0x38]
jmp 0x14002ae79
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
lea rax, [rcx + 8]
cmp rax, rdx
jbe 0x14002ae5f
mov r13d, edx
sub r13d, ecx
mov rdx, qword [rdi + 8]
add rdx, rcx
mov r8d, r13d
lea rcx, [rbp - 0x40]
mov esi, r13d
call sub.VCRUNTIME140.dll_memcpy
add qword [rdi + 0x20], rsi
test r13d, r13d
je 0x14002aed4
movzx eax, byte [rbp - 0x3a]
movzx ecx, byte [rbp - 0x39]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3e]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3f]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x40]
shl rcx, 8
or rcx, rax
jmp 0x14002b13f
mov rcx, qword [rbp - 0x40]
jmp 0x14002b13f
test eax, eax
jne 0x14002af6e
test byte [rdi], 1
mov eax, 2
mov r14d, eax
jne 0x14002af22
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, eax
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002af1c
mov dword [rdi + 0x10], 7
mov r14d, ebx
jmp 0x14002af58
mov r14d, dword [rbp - 0x38]
jmp 0x14002af58
mov r12, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r12 + 2]
cmp rax, rcx
jbe 0x14002af3a
mov r14d, ecx
sub r14d, r12d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r12
mov r8d, r14d
mov esi, r14d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r12]
mov qword [rdi + 0x20], rax
test r14d, r14d
je 0x14002af6e
movzx ecx, byte [rbp - 0x3f]
movzx eax, byte [rbp - 0x40]
shl cx, 8
or cx, ax
jmp 0x14002af72
movzx ecx, word [rbp - 0x40]
movzx r12d, cx
mov qword [rbp - 0x28], r13
cmp dword [rdi + 0x10], ebx
jne 0x14002b00b
test byte [rdi], 1
mov eax, 2
mov r14d, eax
jne 0x14002afc0
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, eax
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002afba
mov dword [rdi + 0x10], 7
mov r14d, ebx
jmp 0x14002aff5
mov r14d, dword [rbp - 0x38]
jmp 0x14002aff5
mov r13, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r13 + 2]
cmp rax, rcx
jbe 0x14002afd7
mov r14d, ecx
sub r14d, r13d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r13
mov r8d, r14d
mov esi, r14d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r13]
mov qword [rdi + 0x20], rax
test r14d, r14d
je 0x14002b00b
movzx ecx, byte [rbp - 0x3f]
movzx eax, byte [rbp - 0x40]
shl cx, 8
or cx, ax
jmp 0x14002b00f
movzx ecx, word [rbp - 0x40]
movzx r14d, cx
cmp dword [rdi + 0x10], ebx
jne 0x14002b0a0
test byte [rdi], 1
mov eax, 2
mov r13d, eax
jne 0x14002b059
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, eax
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b053
mov dword [rdi + 0x10], 7
mov r13d, ebx
jmp 0x14002b08a
mov r13d, dword [rbp - 0x38]
jmp 0x14002b08a
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
lea rax, [rcx + 2]
cmp rax, rdx
jbe 0x14002b070
mov r13d, edx
sub r13d, ecx
mov rdx, qword [rdi + 8]
add rdx, rcx
mov r8d, r13d
lea rcx, [rbp - 0x40]
mov esi, r13d
call sub.VCRUNTIME140.dll_memcpy
add qword [rdi + 0x20], rsi
test r13d, r13d
je 0x14002b0a0
movzx ecx, byte [rbp - 0x3f]
movzx eax, byte [rbp - 0x40]
shl cx, 8
or cx, ax
jmp 0x14002b0a4
movzx ecx, word [rbp - 0x40]
movzx eax, cx
mov qword [rdi + 0x28], rax
cmp dword [rdi + 0x10], ebx
jne 0x14002b138
test byte [rdi], 1
mov eax, 2
mov r13d, eax
jne 0x14002b0f1
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, eax
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b0eb
mov dword [rdi + 0x10], 7
mov r13d, ebx
jmp 0x14002b122
mov r13d, dword [rbp - 0x38]
jmp 0x14002b122
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rdi + 0x18]
lea rax, [rcx + 2]
cmp rax, rdx
jbe 0x14002b108
mov r13d, edx
sub r13d, ecx
mov rdx, qword [rdi + 8]
add rdx, rcx
mov r8d, r13d
lea rcx, [rbp - 0x40]
mov esi, r13d
call sub.VCRUNTIME140.dll_memcpy
add qword [rdi + 0x20], rsi
test r13d, r13d
je 0x14002b138
movzx ecx, byte [rbp - 0x3f]
movzx eax, byte [rbp - 0x40]
shl cx, 8
or cx, ax
jmp 0x14002b13c
movzx ecx, word [rbp - 0x40]
movzx ecx, cx
cmp dword [rdi + 0x10], ebx
jne 0x14002b61d
cmp rcx, qword [rdi + 0x28]
jne 0x14002b572
test r14d, r14d
jne 0x14002b572
test r12d, r12d
jne 0x14002b572
mov eax, dword [rdi]
and eax, 1
cmp byte [rbp - 0x30], bl
je 0x14002b35a
mov qword [rbp - 0x40], rbx
mov r14d, r15d
test eax, eax
jne 0x14002b1ad
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, r15d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b1a7
mov dword [rdi + 0x10], 7
mov r14d, ebx
jmp 0x14002b1e3
mov r14d, dword [rbp - 0x38]
jmp 0x14002b1e3
mov r12, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r12 + 8]
cmp rax, rcx
jbe 0x14002b1c5
mov r14d, ecx
sub r14d, r12d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r12
mov r8d, r14d
mov esi, r14d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r12]
mov qword [rdi + 0x20], rax
test r14d, r14d
je 0x14002b23c
movzx eax, byte [rbp - 0x3a]
movzx r14d, byte [rbp - 0x39]
shl r14, 8
or r14, rax
movzx eax, byte [rbp - 0x3b]
shl r14, 8
or r14, rax
movzx eax, byte [rbp - 0x3c]
shl r14, 8
or r14, rax
movzx eax, byte [rbp - 0x3d]
shl r14, 8
or r14, rax
movzx eax, byte [rbp - 0x3e]
shl r14, 8
or r14, rax
movzx eax, byte [rbp - 0x3f]
shl r14, 8
or r14, rax
movzx eax, byte [rbp - 0x40]
shl r14, 8
or r14, rax
jmp 0x14002b240
mov r14, qword [rbp - 0x40]
mov rcx, rbx
mov qword [rbp - 0x40], rbx
cmp dword [rdi + 0x10], ebx
jne 0x14002b317
test byte [rdi], 1
jne 0x14002b285
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, r15d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b27f
mov dword [rdi + 0x10], 7
mov r15d, ebx
jmp 0x14002b2bb
mov r15d, dword [rbp - 0x38]
jmp 0x14002b2bb
mov r12, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r12 + 8]
cmp rax, rcx
jbe 0x14002b29d
mov r15d, ecx
sub r15d, r12d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r12
mov r8d, r15d
mov esi, r15d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r12]
mov qword [rdi + 0x20], rax
test r15d, r15d
je 0x14002b313
movzx eax, byte [rbp - 0x3a]
movzx ecx, byte [rbp - 0x39]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3e]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x3f]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbp - 0x40]
shl rcx, 8
or rcx, rax
jmp 0x14002b317
mov rcx, qword [rbp - 0x40]
mov edx, dword [rdi + 0x14]
mov rax, qword [rbp - 0x28]
add rax, r14
mov qword [rdi + 0x48], rcx
add rax, rcx
lea rcx, [rdx + 0x34]
add rcx, rax
test byte [rdi], 1
jne 0x14002b351
add rdx, rcx
lea r8, [rbp - 0x18]
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov qword [rbp - 0x18], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x14002b4a2
mov qword [rdi + 0x20], rcx
jmp 0x14002b4a2
mov dword [rbp - 0x40], ebx
mov r12d, 4
mov r14d, r12d
test eax, eax
jne 0x14002b39a
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, r12d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b394
mov dword [rdi + 0x10], 7
mov r14d, ebx
jmp 0x14002b3cf
mov r14d, dword [rbp - 0x38]
jmp 0x14002b3cf
mov r15, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r15 + 4]
cmp rax, rcx
jbe 0x14002b3b1
mov r14d, ecx
sub r14d, r15d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r15
mov r8d, r14d
mov esi, r14d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r15]
mov qword [rdi + 0x20], rax
test r14d, r14d
je 0x14002b3f5
movzx eax, byte [rbp - 0x3e]
movzx ecx, byte [rbp - 0x3d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 0x3f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 0x40]
shl ecx, 8
or ecx, eax
jmp 0x14002b3f8
mov ecx, dword [rbp - 0x40]
mov r14d, ecx
mov ecx, ebx
mov dword [rbp - 0x40], ebx
cmp dword [rdi + 0x10], ebx
jne 0x14002b49c
test byte [rdi], 1
jne 0x14002b43e
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, r12d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b438
mov dword [rdi + 0x10], 7
mov r12d, ebx
jmp 0x14002b473
mov r12d, dword [rbp - 0x38]
jmp 0x14002b473
mov r15, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r15 + 4]
cmp rax, rcx
jbe 0x14002b455
sub ecx, r15d
mov r12d, ecx
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r15
mov r8d, r12d
mov esi, r12d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r15]
mov qword [rdi + 0x20], rax
test r12d, r12d
je 0x14002b499
movzx eax, byte [rbp - 0x3e]
movzx ecx, byte [rbp - 0x3d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 0x3f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp - 0x40]
shl ecx, 8
or ecx, eax
jmp 0x14002b49c
mov ecx, dword [rbp - 0x40]
mov eax, ecx
mov qword [rdi + 0x48], rax
cmp dword [rdi + 0x10], ebx
jne 0x14002b534
test byte [rdi], 1
jne 0x14002b4df
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, 2
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b4da
mov dword [rdi + 0x10], 7
jmp 0x14002b51f
mov ebx, dword [rbp - 0x38]
jmp 0x14002b51f
mov rsi, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [rsi + 2]
cmp rax, rcx
jbe 0x14002b4f8
mov r15d, ecx
sub r15d, esi
jmp 0x14002b4fe
mov r15d, 2
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, rsi
mov r8d, r15d
mov ebx, r15d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbx + rsi]
mov ebx, r15d
mov qword [rdi + 0x20], rax
test ebx, ebx
je 0x14002b534
movzx ecx, byte [rbp - 0x3f]
movzx eax, byte [rbp - 0x40]
shl cx, 8
or cx, ax
jmp 0x14002b538
movzx ecx, word [rbp - 0x40]
cmp dword [rdi + 0x10], 0
movzx eax, cx
mov dword [rdi + 0x30], eax
jne 0x14002b61d
mov edx, dword [rdi + 0x14]
mov r8, qword [rdi + 0x48]
mov r9, qword [rbp - 0x20]
lea rax, [r8 + r14]
lea rcx, [r9 + rdx]
cmp rcx, rax
jb 0x14002b61d
sub r9d, r14d
sub r9d, r8d
add r9d, edx
jmp 0x14002b649
mov rcx, rdi
mov ebx, r15d
call fcn.14002a4b0
jmp 0x14002a5e0
mov qword [rdi + 0x20], rbx
cmp dword [rdi + 0x10], ebx
jne 0x14002b60f
test byte [rdi], 1
jne 0x14002b5c4
mov rcx, qword [rdi + 8]
lea r9, [rbp - 0x38]
mov r8d, r13d
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b5be
mov dword [rdi + 0x10], 7
mov r13d, ebx
jmp 0x14002b5f9
mov r13d, dword [rbp - 0x38]
jmp 0x14002b5f9
mov r14, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
lea rax, [r14 + 2]
cmp rax, rcx
jbe 0x14002b5db
mov r13d, ecx
sub r13d, r14d
mov rdx, qword [rdi + 8]
lea rcx, [rbp - 0x40]
add rdx, r14
mov r8d, r13d
mov esi, r13d
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r14]
mov qword [rdi + 0x20], rax
test r13d, r13d
je 0x14002b60f
movzx ecx, byte [rbp - 0x3f]
movzx eax, byte [rbp - 0x40]
shl cx, 8
or cx, ax
jmp 0x14002b613
movzx ecx, word [rbp - 0x40]
mov eax, 0x8b1f
cmp cx, ax
je 0x14002b62f
mov rcx, rdi
mov ebx, 6
call fcn.14002a4b0
jmp 0x14002a5e0
mov qword [rdi + 0x48], 3
or dword [rdi], 4
mov r9d, dword [rdi + 0x14]
mov dword [rdi + 0x10], ebx
mov qword [rdi + 0x28], 1
lea rdx, [rdi + 0x120]
mov dword [rdi + 0x34], r9d
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, eax
test rax, rax
je 0x14002b670
cmp byte [rax + rdi + 0x11f], 0x5c
je 0x14002b67a
mov word [rax + rdi + 0x120], WSAAsyncSelect
mov rax, qword [rbp + 0x30]
mov qword [rax], rdi
xor eax, eax
jmp 0x14002a5e2
mov rcx, rdi
mov ebx, r13d
call fcn.14002a4b0
jmp 0x14002a5e0
mov ebx, 4
mov rcx, rdi
call fcn.14002a4b0
jmp 0x14002a5e0