Function at 0x1403b34e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r15
push rbp
sub rsp, 0x60
mov esi, edx
mov qword [rsp + 0xb0], r8
mov r15, r9
mov r13, rcx
cmp esi, 0xfffffffb
je 0x1403b5167
mov ecx, esi
lea rdx, [rsp + 0x58]
mov r8, r13
mov r9d, 2
call fcn.1403bf1e0
mov edi, eax
test edi, edi
je 0x1403b35e4
lea rbx, [rsp + 0xc8]
mov qword [rsp + 0x30], rbx
movzx r10d, byte [rsp + 0xb3]
and r10d, 0x80
mov dword [rsp + 0x40], 0
shr r10d, 7
je 0x1403b355c
mov ebx, dword [rsp + 0xb4]
mov dword [rsp + 0x40], ebx
mov bl, byte [rsp + 0x41]
and bl, 0x80
shr bl, 7
mov bpl, byte [rsp + 0xb0]
and bpl, 1
or bpl, bl
je 0x1403b35c5
test r10d, r10d
je 0x1403b35b3
test byte [rsp + 0x40], 0x10
je 0x1403b35b3
mov rbx, qword [rsp + 0x30]
lea rbp, [rbx + 8]
mov qword [rsp + 0x30], rbp
add rbx, 0x10
mov r10, qword [rbp - 8]
mov qword [rsp + 0x30], rbx
mov rbp, qword [rbp]
cmp byte [r10], 0x38
jne 0x1403b35b3
cmp byte [r10 + 2], 0x4e
je 0x1403b4168
movzx eax, di
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, edi
mov edx, 2
mov r8d, esi
lea r9, str.unknown
call fcn.140383960
mov qword [rsp + 0x30], 0
mov bpl, byte [rsp + 0xb2]
shr bpl, 5
mov rbx, qword [rsp + 0x58]
and bpl, 1
mov r10b, byte [rsp + 0xb0]
mov r12b, r10b
shl bpl, 2
and r12b, 1
mov al, byte [rbx + 0x294]
and r10b, 2
and al, 0xfe
or al, r12b
mov byte [rbx + 0x294], al
mov r9, qword [rsp + 0x58]
mov dword [rsp + 0x50], 0
mov dil, byte [r9 + 0x294]
and dil, 0xfb
or dil, bpl
mov byte [r9 + 0x294], dil
mov r12, qword [rsp + 0x58]
mov r11b, byte [r12 + 0x294]
and r11b, 0xfd
or r11b, r10b
mov byte [r12 + 0x294], r11b
xor r12d, r12d
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x118], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x1c0], r12
mov rax, qword [rsp + 0x58]
and byte [rax + 0x29d], 0xf7
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0x168]
mov qword [rbx + 0x160], rax
movzx eax, byte [rsp + 0xb3]
test eax, 0x80
jne 0x1403b36b5
mov rbx, qword [rsp + 0x58]
xor r10b, r10b
jmp 0x1403b387d
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb4]
mov rbx, qword [rsp + 0x58]
mov dword [rsp + 0x50], eax
test rbx, rbx
je 0x1403b515d
test al, 0x20
je 0x1403b36eb
or byte [rbx + 0x29b], 0x40
mov rbx, qword [rsp + 0x58]
and byte [rbx + 0x29d], 0xbf
mov r10b, byte [rsp + 0x51]
test r10b, 0x20
je 0x1403b3709
mov rbx, qword [rsp + 0x58]
or byte [rbx + 0x29d], 0x40
mov rbx, qword [rsp + 0x58]
and byte [rbx + 0x29d], 0x7f
test r10b, 0x40
je 0x1403b3727
mov rbx, qword [rsp + 0x58]
or byte [rbx + 0x29d], 0x80
mov rbx, qword [rsp + 0x58]
and byte [rbx + 0x29e], 0xef
test r10b, 0x80
je 0x1403b3745
mov rbx, qword [rsp + 0x58]
or byte [rbx + 0x29e], 0x10
mov rbx, qword [rsp + 0x58]
mov bpl, byte [rsp + 0x52]
and byte [rbx + 0x29e], 0xdf
test bpl, 1
je 0x1403b3768
mov rbx, qword [rsp + 0x58]
or byte [rbx + 0x29e], 0x20
mov rbx, qword [rsp + 0x58]
and byte [rbx + 0x29e], 0xbf
test bpl, 2
je 0x1403b3786
mov rbx, qword [rsp + 0x58]
or byte [rbx + 0x29e], 0x40
mov rbx, qword [rsp + 0x58]
and byte [rbx + 0x29e], 0x7f
test bpl, 4
je 0x1403b37a4
mov rbx, qword [rsp + 0x58]
or byte [rbx + 0x29e], 0x80
mov rbx, qword [rsp + 0x58]
and byte [rbx + 0x29f], 0xfe
test bpl, 8
je 0x1403b37c2
mov rbx, qword [rsp + 0x58]
or byte [rbx + 0x29f], 1
test al, 0x10
je 0x1403b386f
mov rax, qword [rsp + 0x40]
lea rbx, [rax + 8]
mov qword [rsp + 0x40], rbx
add rax, 0x10
mov rbp, qword [rbx - 8]
mov qword [rsp + 0x40], rax
mov rbx, qword [rbx]
cmp byte [rbp], 0x38
je 0x1403b4c0e
cmp byte [rbp], 0xb
je 0x1403b4843
cmp byte [rbp], 0x38
je 0x1403b4750
cmp byte [rbp], 0x38
je 0x1403b468b
cmp byte [rbp], 0x38
je 0x1403b4598
cmp byte [rbp], 0x38
je 0x1403b4464
cmp byte [rbp], 0x38
je 0x1403b439f
cmp byte [rbp], 0x38
je 0x1403b42c5
cmp byte [rbp], 1
je 0x1403b3863
mov ecx, 8
mov edx, 2
lea r8, str.for_rseq_lis.c
mov r9d, 0x36e
mov qword [rsp + 0x40], 0
call fcn.140383960
mov rbx, qword [rsp + 0x58]
mov r10b, byte [rsp + 0x51]
jmp 0x1403b3874
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x40], 0
mov dil, r10b
shr dil, 3
mov al, byte [rbx + 0x29e]
and dil, 0xf0
and al, 0xef
or al, dil
mov byte [rbx + 0x29e], al
mov r9, qword [rsp + 0x58]
test byte [r9 + 0x291], 0x20
jne 0x1403b3c71
cmp dword [r9 + 0x1e0], 0xfffffffb
je 0x1403b3c71
mov r11b, byte [rsp + 0xb0]
shr r11b, 7
mov al, byte [r9 + 0x290]
and al, 0xfe
or al, r11b
mov byte [r9 + 0x290], al
mov r9b, byte [rsp + 0xb2]
shr r9b, 2
mov rbp, qword [rsp + 0x58]
and r9b, 1
add r9b, r9b
mov al, byte [rbp + 0x290]
and al, 0xfd
or al, r9b
mov byte [rbp + 0x290], al
mov bpl, byte [rsp + 0xb3]
mov bl, bpl
shr bl, 3
and bl, 1
mov r9b, bl
shl r9b, 2
mov r11, qword [rsp + 0x58]
mov al, byte [r11 + 0x290]
and al, 0xfb
or al, r9b
mov r9b, bpl
shr r9b, 2
and r9b, 1
shl r9b, 3
mov byte [r11 + 0x290], al
mov r11, qword [rsp + 0x58]
mov al, byte [r11 + 0x290]
and al, 0xf7
or al, r9b
mov r9b, bpl
shr r9b, 6
and r9b, 1
shl r9b, 4
mov byte [r11 + 0x290], al
mov r11, qword [rsp + 0x58]
mov al, byte [r11 + 0x290]
and al, 0xef
or al, r9b
mov r9b, bl
shl r9b, 5
shl bl, 3
mov byte [r11 + 0x290], al
mov r11, qword [rsp + 0x58]
mov al, byte [r11 + 0x290]
and al, 0xdf
or al, r9b
mov r9b, bpl
shr r9b, 4
shr bpl, 5
and r9b, 1
and bpl, 1
shl r9b, 2
mov byte [r11 + 0x290], al
mov r11, qword [rsp + 0x58]
mov al, byte [r11 + 0x299]
and al, 0xfb
or al, r9b
mov byte [r11 + 0x299], al
mov rax, qword [rsp + 0x58]
mov r9b, byte [rax + 0x299]
and r9b, 0xf7
or r9b, bl
mov byte [rax + 0x299], r9b
mov r9b, bpl
shl r9b, 6
shl bpl, 7
mov rbx, qword [rsp + 0x58]
mov al, byte [rbx + 0x290]
and al, 0xbf
or al, r9b
mov byte [rbx + 0x290], al
mov rax, qword [rsp + 0x58]
mov r9b, byte [rax + 0x290]
and r9b, 0x7f
or r9b, bpl
mov byte [rax + 0x290], r9b
mov rbp, qword [rsp + 0x58]
mov al, byte [rsp + 0x50]
mov r9b, al
and r9b, 1
mov bl, byte [rbp + 0x291]
and bl, 0xfe
or bl, r9b
mov r9b, al
shr r9b, 1
and r9b, 1
shl r9b, 5
mov byte [rbp + 0x291], bl
mov rbp, qword [rsp + 0x58]
mov bl, byte [rbp + 0x299]
and bl, 0xdf
or bl, r9b
mov r9b, al
shr r9b, 2
and al, 0x80
mov byte [rbp + 0x299], bl
and r9b, 3
mov rbp, qword [rsp + 0x58]
add r9b, r9b
mov bl, byte [rbp + 0x291]
and bl, 0xf9
or bl, r9b
mov r9b, r10b
shr r9b, 1
and r9b, 1
shl r9b, 3
mov byte [rbp + 0x291], bl
mov rbp, qword [rsp + 0x58]
mov bl, byte [rbp + 0x29c]
and bl, 0xf7
or bl, r9b
mov byte [rbp + 0x29c], bl
mov rbx, qword [rsp + 0x58]
mov r9b, byte [rbx + 0x29b]
and r9b, 0x7f
or r9b, al
mov byte [rbx + 0x29b], r9b
mov r9b, r10b
shr r9b, 6
shl r9b, 7
mov rbx, qword [rsp + 0x58]
mov al, byte [rbx + 0x29d]
and al, 0x7f
or al, r9b
mov byte [rbx + 0x29d], al
mov rax, qword [rsp + 0x58]
mov r9b, byte [rax + 0x29e]
and r9b, 0xef
or r9b, dil
mov byte [rax + 0x29e], r9b
mov r9b, byte [rsp + 0x52]
mov dil, r9b
and dil, 1
shl dil, 5
mov rbx, qword [rsp + 0x58]
mov al, byte [rbx + 0x29e]
and al, 0xdf
or al, dil
mov byte [rbx + 0x29e], al
mov al, r9b
shr al, 1
and al, 1
shl al, 6
mov rbp, qword [rsp + 0x58]
mov bl, byte [rbp + 0x29e]
and bl, 0xbf
or bl, al
mov al, r9b
shr al, 2
shr r9b, 3
shl al, 7
mov byte [rbp + 0x29e], bl
and r9b, 1
mov rbp, qword [rsp + 0x58]
mov bl, byte [rbp + 0x29e]
and bl, 0x7f
or bl, al
mov byte [rbp + 0x29e], bl
mov rbx, qword [rsp + 0x58]
mov al, byte [rbx + 0x29f]
and al, 0xfe
or al, r9b
mov byte [rbx + 0x29f], al
mov rcx, qword [rsp + 0x58]
mov al, byte [rcx + 0x29c]
test al, 0x10
jne 0x1403b3bbc
shr r10b, 2
and al, 0xef
and r10b, 1
shl r10b, 4
or al, r10b
mov byte [rcx + 0x29c], al
mov rcx, qword [rsp + 0x58]
mov edx, 1
mov r8d, edx
mov r9d, edx
call fcn.14036de40
test eax, eax
je 0x1403b3c6c
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4c51
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b3c1c
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx ebx, byte [r9 + 0x29e]
mov rbp, rsp
and ebx, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr ebx, 1
and r8d, 7
or r8d, ebx
mov r9d, eax
mov dword [rbp + 0x20], eax
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r9, qword [rsp + 0x58]
mov bl, byte [r9 + 0x293]
test bl, 0x10
je 0x1403b3d28
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b4c6f
test byte [rax + 0x74], 2
je 0x1403b3ce0
mov dword [rax + 0x68], 0x102
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x30]
mov dword [rdx + 0x6c], 0x1f
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0xd8]
test rax, rax
je 0x1403b3ccc
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x102
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x102
mov dword [rbx + 0x20], 0x1f
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test byte [r9 + 0x292], 0x40
jne 0x1403b3dfb
cmp esi, 0xfffffffb
je 0x1403b3dfb
test r9, r9
je 0x1403b3d54
movzx eax, word [r9 + 0x27a]
test eax, eax
jg 0x1403b3dfb
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b4c93
test byte [rax + 0x74], 2
je 0x1403b3db3
mov dword [rax + 0x68], 0x101
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x30]
mov dword [rdx + 0x6c], 0x1f
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0xd8]
test rax, rax
je 0x1403b3d9f
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x101
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x101
mov dword [rbx + 0x20], 0x1f
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test bl, 8
je 0x1403b3eb9
test byte [r9 + 0x290], 4
jne 0x1403b3eb9
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b4cb7
test byte [rax + 0x74], 2
je 0x1403b3e71
mov dword [rax + 0x68], 0x103
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x30]
mov dword [rdx + 0x6c], 0x1f
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0xd8]
test rax, rax
je 0x1403b3e5d
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x103
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x103
mov dword [rbx + 0x20], 0x1f
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rsi, qword [r9 + 0xc8]
test r9, r9
je 0x1403b3ed1
movzx eax, word [r9 + 0x27a]
test eax, eax
jg 0x1403b3ef2
pxor xmm0, xmm0
movdqu xmmword [rsi], xmm0
movdqu xmmword [rsi + 0x10], xmm0
movdqu xmmword [rsi + 0x20], xmm0
movdqu xmmword [rsi + 0x30], xmm0
movdqu xmmword [rsi + 0x40], xmm0
mov r9, qword [rsp + 0x58]
mov qword [rsi], r9
mov rax, qword [rsp + 0x58]
or byte [rax + 0x29a], 0x10
mov rbx, qword [rsp + 0x58]
test byte [rbx + 0x293], 4
je 0x1403b3fe0
mov rax, qword [rbx + 0x108]
xor bpl, bpl
test rax, rax
je 0x1403b5127
cmp byte [rax + 0x33], 0
jne 0x1403b3f35
test byte [rbx + 0x29c], 2
je 0x1403b3f38
mov bpl, 1
test byte [rbx + 0x295], 4
jne 0x1403b4efe
mov r10, qword [rbx + 0x78]
test byte [rbx + 0x294], 8
jne 0x1403b4cef
mov r9, qword [rbx + 0x170]
mov rdi, qword [rbx + 0x160]
mov rax, qword [rbx + 0x180]
sub r9, rdi
add rax, r10
sub rax, r9
mov qword [rbx + 0x80], rax
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rbx + 0x1b8]
test rdi, rdi
je 0x1403b3fa6
mov rax, qword [rbx + 0x80]
sub rdi, rax
add rdi, qword [rbx + 0x78]
mov qword [rbx + 0x140], rdi
mov rbx, qword [rsp + 0x58]
test bpl, bpl
jne 0x1403b3fcf
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0xa8], rax
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0x108]
test rax, rax
jne 0x1403b3ff0
jmp 0x1403b4cdb
mov rax, qword [rbx + 0x108]
test rax, rax
jne 0x1403b3ff0
jmp 0x1403b4cdb
mov rax, qword [rbx + 0x108]
test rax, rax
je 0x1403b4cdb
cmp byte [rax + 0x33], 0
je 0x1403b404a
test rbx, rbx
je 0x1403b400a
movzx eax, word [rbx + 0x27a]
test eax, eax
jg 0x1403b40f2
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x98], rax
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1403b4031
movzx eax, word [rbx + 0x27a]
test eax, eax
jg 0x1403b40f2
mov rax, qword [rbx + 0x108]
test rax, rax
je 0x1403b40f2
mov byte [rax + 0x33], 0
jmp 0x1403b40f2
test rbx, rbx
je 0x1403b405e
movzx eax, word [rbx + 0x27a]
test eax, eax
jg 0x1403b40f2
xor edx, edx
mov rcx, rbx
xor r8d, r8d
call fcn.1403e0880
test eax, eax
je 0x1403b40ca
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4381
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b40bb
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rsp + 0x58]
inc qword [rax + 0x148]
mov rbx, qword [rsp + 0x58]
and byte [rbx + 0x297], 0xfb
mov rbp, qword [rsp + 0x58]
and byte [rbp + 0x297], 0x7f
or byte [rsi + 0x4a], 0x10
add rsi, 8
mov ecx, 0x802
xor edx, edx
mov r8, rsi
call fcn.14035a450
test eax, eax
je 0x1403b513b
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4381
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b4159
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, esi
lea rdx, [rsp + 0x30]
call fcn.1403c1480
test eax, eax
jne 0x1403b35b3
mov rsi, qword [rsp + 0x30]
xor ebx, ebx
mov r12b, byte [rsp + 0xb0]
and r12b, 1
mov qword [rsi + 0x118], rbx
mov r10, qword [rsp + 0x30]
mov sil, byte [rsp + 0x41]
shr sil, 3
mov qword [r10 + 0x1c0], rbx
and sil, 0xf0
mov r11, qword [rsp + 0x30]
and byte [r11 + 0x29d], 0xf7
mov r15, qword [rsp + 0x30]
mov r13b, byte [r15 + 0x294]
and r13b, 0xfe
or r13b, r12b
mov byte [r15 + 0x294], r13b
mov r11, qword [rsp + 0x30]
mov r10b, byte [r11 + 0x29e]
and r10b, 0xef
or r10b, sil
mov byte [r11 + 0x29e], r10b
mov r10, qword [rsp + 0x30]
mov rsi, qword [rbp]
mov qword [r10 + 0x1c0], rsi
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rbp + 8]
mov qword [rsi + 0x118], rbp
mov r9, qword [rsp + 0x30]
mov rbp, qword [r9 + 0x30]
test rbp, rbp
je 0x1403b42aa
test byte [rbp + 0x74], 2
je 0x1403b4269
mov dword [rbp + 0x68], edi
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rbp + 0x30]
mov dword [rsi + 0x6c], edi
mov r10, qword [rsp + 0x30]
mov rbp, qword [r10 + 0xd8]
test rbp, rbp
je 0x1403b4258
mov qword [rbp + 8], rbx
mov rbp, qword [rsp + 0x30]
mov qword [rbp + 0xd8], rbx
mov eax, edi
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx ebx, byte [r9 + 0x29e]
mov rbp, rsp
and ebx, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr ebx, 1
and r8d, 7
or r8d, ebx
mov r9d, edi
mov dword [rbp + 0x20], edi
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor ecx, ecx
mov edx, edi
mov r8d, edi
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbp + 2], 0x53
jne 0x1403b3838
mov rax, rsp
mov r8d, 0x53
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov edx, dword [rbx]
mov dword [rax + 0x20], 3
call fcn.14036c700
test eax, eax
jne 0x1403b432a
mov rbx, qword [rsp + 0x58]
add rbp, 4
mov al, byte [rbx + 0x28b]
mov byte [rbx + 0x28c], al
mov rdi, qword [rsp + 0x58]
or byte [rdi + 0x29b], 0x20
mov r10, qword [rsp + 0x58]
mov r9d, dword [rsp + 0x30]
mov byte [r10 + 0x28b], r9b
jmp 0x1403b3838
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4381
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b4372
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
mov edx, eax
mov r8d, eax
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbp + 2], 0x51
jne 0x1403b382e
mov rax, rsp
mov r8d, 0x51
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov edx, dword [rbx]
mov dword [rax + 0x20], 3
call fcn.14036c700
test eax, eax
jne 0x1403b4409
mov rdi, qword [rsp + 0x58]
add rbp, 4
add rbx, 0x10
mov al, byte [rdi + 0x287]
mov byte [rdi + 0x288], al
mov r9, qword [rsp + 0x58]
or byte [r9 + 0x29b], 0x10
mov r11, qword [rsp + 0x58]
mov r10d, dword [rsp + 0x30]
mov byte [r11 + 0x287], r10b
jmp 0x1403b382e
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4381
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b4455
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbp + 2], 0x3c
jne 0x1403b3824
mov al, byte [rsp + 0x52]
test al, 8
je 0x1403b447c
test al, 2
jne 0x1403b4486
jmp 0x1403b4492
test byte [rsp + 0xb2], 4
jne 0x1403b4492
mov ecx, 0x2fc
xor edx, edx
call fcn.140383960
mov rax, rsp
mov r8d, 0x3c
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov edx, dword [rbx]
mov dword [rax + 0x20], 3
call fcn.14036c700
test eax, eax
jne 0x1403b453d
mov r9, qword [rsp + 0x58]
mov al, byte [r9 + 0x296]
mov dil, al
shr al, 1
and dil, 0xfb
and al, 1
shl al, 2
or dil, al
mov byte [r9 + 0x296], dil
mov r10, qword [rsp + 0x58]
or byte [r10 + 0x29b], 8
mov rax, qword [rsp + 0x30]
cmp rax, 2
jne 0x1403b4520
mov al, byte [rsp + 0xb2]
shr al, 2
mov r9, qword [rsp + 0x58]
and al, 1
add al, al
mov dil, byte [r9 + 0x296]
and dil, 0xfd
or dil, al
mov byte [r9 + 0x296], dil
jmp 0x1403b4530
cmp rax, 1
mov rax, qword [rsp + 0x58]
and byte [rax + 0x296], 0xfd
add rbp, 4
add rbx, 0x10
jmp 0x1403b3824
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4381
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b4589
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbp + 2], 0x3b
jne 0x1403b381a
mov rax, rsp
mov r8d, 0x3b
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov edx, dword [rbx]
mov dword [rax + 0x20], 3
call fcn.14036c700
test eax, eax
jne 0x1403b4630
mov rdi, qword [rsp + 0x58]
mov al, byte [rdi + 0x281]
mov byte [rdi + 0x282], al
mov r9, qword [rsp + 0x58]
or byte [r9 + 0x29b], 4
mov rax, qword [rsp + 0x30]
cmp rax, 2
je 0x1403b4617
cmp rax, 1
jne 0x1403b4603
mov rax, qword [rsp + 0x58]
mov byte [rax + 0x281], 0x27
jmp 0x1403b4623
cmp rax, 3
jne 0x1403b4617
mov rax, qword [rsp + 0x58]
mov byte [rax + 0x281], 0x22
jmp 0x1403b4623
mov rax, qword [rsp + 0x58]
mov byte [rax + 0x281], 0
add rbp, 4
add rbx, 0x10
jmp 0x1403b381a
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4381
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b467c
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbp + 2], 0x52
jne 0x1403b3810
mov rax, rsp
mov r8d, 0x52
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov edx, dword [rbx]
mov dword [rax + 0x20], 3
call fcn.14036c700
test eax, eax
jne 0x1403b46f5
mov rdi, qword [rsp + 0x58]
add rbp, 4
add rbx, 0x10
mov al, byte [rdi + 0x289]
mov byte [rdi + 0x28a], al
mov r9, qword [rsp + 0x58]
or byte [r9 + 0x29b], 2
mov r11, qword [rsp + 0x58]
mov r10d, dword [rsp + 0x30]
mov byte [r11 + 0x289], r10b
jmp 0x1403b3810
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4381
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b4741
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbp + 2], 6
jne 0x1403b3806
mov rax, rsp
mov r8d, 6
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov edx, dword [rbx]
mov dword [rax + 0x20], 3
call fcn.14036c700
test eax, eax
jne 0x1403b47e8
mov r9, qword [rsp + 0x58]
mov al, byte [r9 + 0x293]
mov dil, al
shr al, 5
and dil, 0xbf
and al, 1
shl al, 6
or dil, al
mov byte [r9 + 0x293], dil
mov r10, qword [rsp + 0x58]
or byte [r10 + 0x29b], 1
mov rax, qword [rsp + 0x30]
cmp rax, 1
je 0x1403b47cf
cmp rax, 2
jne 0x1403b47cf
mov rax, qword [rsp + 0x58]
or byte [rax + 0x293], 0x20
jmp 0x1403b47db
mov rax, qword [rsp + 0x58]
and byte [rax + 0x293], 0xdf
add rbp, 4
add rbx, 0x10
jmp 0x1403b3806
mov r9, qword [rsp + 0x58]
mov rbx, qword [r9 + 0x30]
test rbx, rbx
je 0x1403b4381
test byte [rbx + 0x74], 2
je 0x1403b3c2b
mov dword [rbx + 0x68], eax
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rcx + 0x30]
mov dword [rbx + 0x6c], eax
mov rbp, qword [rsp + 0x58]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1403b4834
mov qword [rcx + 8], r12
mov rcx, qword [rsp + 0x58]
mov qword [rcx + 0xd8], r12
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbp + 2], 0x4f
jne 0x1403b37fc
mov r9, qword [rsp + 0x58]
test byte [r9 + 0x293], 4
jne 0x1403b49cb
test byte [r9 + 0x291], 0x20
jne 0x1403b491b
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b4ab6
test byte [rax + 0x74], 2
je 0x1403b48ca
mov edx, 0x6d
mov dword [rax + 0x68], edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0x6c], edx
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x1403b48b6
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x6d
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x6d
mov qword [rsp + 0x40], 0
mov dword [rbx + 0x20], 0x6d
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b4ae0
test byte [rax + 0x74], 2
je 0x1403b497a
mov dword [rax + 0x68], 0x6e
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x30]
mov dword [rdx + 0x6c], 0x1f
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 0xd8]
test rax, rax
je 0x1403b4966
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x6e
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x6e
mov qword [rsp + 0x40], 0
mov dword [rbx + 0x20], 0x1f
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r9, r9
je 0x1403b49dc
movzx eax, word [r9 + 0x27a]
test eax, eax
jg 0x1403b4a09
mov rax, qword [rbx]
add rbx, 8
dec rax
mov qword [r9 + 0x160], rax
mov r9, qword [rsp + 0x58]
cmp qword [r9 + 0x160], 0
jl 0x1403b4b0d
add rbp, 4
jmp 0x1403b37fc
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b4be4
test byte [rax + 0x74], 2
je 0x1403b4a65
mov edx, 0x10f
mov dword [rax + 0x68], edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0x6c], edx
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x1403b4a51
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x10f
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x10f
mov qword [rsp + 0x40], 0
mov dword [rbx + 0x20], 0x10f
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x6d
mov ecx, 1
mov r8d, edx
mov qword [rsp + 0x40], 0
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
mov edx, 0x6e
mov r8d, 0x1f
mov qword [rsp + 0x40], 0
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b4bba
test byte [rax + 0x74], 2
je 0x1403b4b69
mov edx, 0x6f
mov dword [rax + 0x68], edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0x6c], edx
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x1403b4b55
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x6f
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x6f
mov qword [rsp + 0x40], 0
mov dword [rbx + 0x20], 0x6f
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x6f
mov ecx, 1
mov r8d, edx
mov qword [rsp + 0x40], 0
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x10f
mov ecx, 1
mov r8d, edx
mov qword [rsp + 0x40], 0
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbp + 2], 0x4e
jne 0x1403b37f2
mov rdi, qword [rsp + 0x58]
add rbp, 4
mov rax, qword [rbx]
mov qword [rdi + 0x1c0], rax
mov r10, qword [rsp + 0x58]
mov r9, qword [rbx + 8]
add rbx, 0x10
mov qword [r10 + 0x118], r9
mov r11, qword [rsp + 0x58]
and byte [r11 + 0x29d], 0xf7
jmp 0x1403b37f2
mov ecx, 2
mov edx, eax
mov r8d, eax
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
mov edx, 0x102
mov r8d, 0x1f
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
mov edx, 0x101
mov r8d, 0x1f
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
mov edx, 0x103
mov r8d, 0x1f
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, word [rbx + 0x27a]
test eax, eax
jle 0x1403b404f
jmp 0x1403b40f2
cmp r10, qword [rbx + 0xb0]
je 0x1403b4d1e
mov r9, qword [rbx + 0x170]
mov rdi, qword [rbx + 0x160]
cmp rdi, r9
jl 0x1403b4d1e
mov rax, qword [rbx + 0x178]
add rax, r9
cmp rdi, rax
jl 0x1403b3f64
mov rdx, qword [rbx + 0x160]
lea r8, [rsp + 0x44]
mov rcx, qword [rbx + 0x1a0]
xor r9d, r9d
mov qword [r8 - 4], rdx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x40], eax
mov ebx, eax
cmp eax, 0xffffffff
je 0x1403b4edc
mov eax, dword [rsp + 0x44]
shl rax, 0x20
or rax, rbx
cmp rax, 0xffffffffffffffff
je 0x1403b4e01
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0x160]
mov qword [rbx + 0x168], rax
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rdi + 0x160]
mov qword [rdi + 0x170], rbp
mov r9, qword [rsp + 0x58]
mov qword [r9 + 0x180], r12
mov r10, qword [rsp + 0x58]
mov qword [r10 + 0x178], r12
mov rax, qword [rsp + 0x58]
mov r11, qword [rax + 0x178]
mov qword [rax + 0x1b8], r11
mov rax, qword [rsp + 0x58]
and byte [rax + 0x295], 0xfd
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x140], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xa8], r12
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0x108]
test rax, rax
je 0x1403b4cdb
mov byte [rax + 0x33], 0
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0x108]
jmp 0x1403b3fd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0x58]
mov dword [rdx + 0x1a8], eax
mov r9, qword [rsp + 0x58]
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b4ebb
test byte [rax + 0x74], 2
je 0x1403b4e73
mov edx, 0x27
mov dword [rax + 0x68], edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0x6c], edx
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x1403b4e5f
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x27
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x27
mov dword [rbx + 0x20], 0x27
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x27
mov ecx, 1
mov r8d, edx
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1403b4ef4
mov qword [rsp + 0x40], 0xffffffffffffffff
jmp 0x1403b4e01
mov rax, qword [rsp + 0x40]
jmp 0x1403b4d58
mov r8, qword [rbx + 0x240]
mov edx, 0x20000
test r8, r8
mov r9, qword [rbx + 0x78]
cmove r8, rdx
mov rdi, qword [rbx + 0x88]
sub rdi, r9
cmp rdi, r8
ja 0x1403b4f5d
mov rax, rsp
mov rdx, r9
mov rcx, qword [rbx + 0x1a0]
mov r8d, edi
lea r9, [rsp + 0x50]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 0xffffffff
test eax, eax
mov eax, 1
cmove eax, r9d
jmp 0x1403b4ffc
mov rax, rdi
mov qword [rsp + 0x40], r13
mov r12, rax
mov qword [rsp + 0x48], r15
mov r13, r8
mov qword [rsp + 0x38], r14
mov r14, rdx
mov r15, r9
mov r10, rsp
mov rdx, r15
mov rcx, qword [rbx + 0x1a0]
mov r8d, r13d
lea r9, [rsp + 0x50]
mov qword [r10 + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1403b4fbb
mov r13, qword [rsp + 0x40]
xor r12d, r12d
mov r15, qword [rsp + 0x48]
mov eax, 0xffffffff
mov r14, qword [rsp + 0x38]
jmp 0x1403b4ffc
mov r10, qword [rbx + 0x240]
test r10, r10
mov r11d, dword [rsp + 0x50]
cmove r10, r14
mov eax, 1
sub r12, r11
cmp r12, r10
cmovb r13, r12
add r15, r11
test r12, r12
je 0x1403b4fea
test r11, r11
ja 0x1403b4f7b
mov r13, qword [rsp + 0x40]
xor r12d, r12d
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x38]
mov r10, qword [rbx + 0x78]
mov r9, qword [rbx + 0x1c8]
mov r11, qword [rbx + 0x170]
add rdi, r11
mov qword [rbx + 0x88], r10
add r10, r9
and byte [rbx + 0x295], 0xfb
mov qword [rbx + 0x90], r10
mov qword [rbx + 0x158], 0
mov qword [rbx + 0x170], rdi
mov qword [rbx + 0x168], rdi
cmp eax, 0xffffffff
je 0x1403b5051
mov rbx, qword [rsp + 0x58]
jmp 0x1403b3f45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x1a8], eax
mov r9, qword [rsp + 0x58]
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x1403b5106
test byte [rax + 0x74], 2
je 0x1403b50be
mov edx, 0x26
mov dword [rax + 0x68], edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x30]
mov dword [rcx + 0x6c], edx
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx + 0xd8]
test rax, rax
je 0x1403b50aa
mov qword [rax + 8], r12
mov rax, qword [rsp + 0x58]
mov qword [rax + 0xd8], r12
mov eax, 0x26
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [r9 + 0x29e]
mov rbx, rsp
and eax, 0x10
mov rcx, r9
movzx r8d, byte [r9 + 0x294]
mov edx, 0xffffffff
shr eax, 1
and r8d, 7
or r8d, eax
mov r9d, 0x26
mov dword [rbx + 0x20], 0x26
call fcn.1403be580
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov edx, 0x26
mov ecx, 1
mov r8d, edx
call fcn.140381780
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, word [rbx + 0x27a]
test eax, eax
jle 0x1403b3f2c
jmp 0x1403b3f35
mov rcx, r13
mov rdx, r15
mov r8, qword [rsp + 0xc0]
call fcn.1403b5350
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r10b, byte [rsp + 0x51]
jmp 0x1403b3874
mov ecx, 0xfffffffa
lea rdx, [rsp + 0x58]
mov r8, r13
mov r9d, 2
call fcn.1403bf1e0
mov edi, eax
test edi, edi
je 0x1403b35e4
lea rbx, [rsp + 0xc8]
mov qword [rsp + 0x30], rbx
movzx r10d, byte [rsp + 0xb3]
and r10d, 0x80
mov dword [rsp + 0x40], 0
shr r10d, 7
je 0x1403b51bf
mov ebx, dword [rsp + 0xb4]
mov dword [rsp + 0x40], ebx
mov bl, byte [rsp + 0x41]
and bl, 0x80
shr bl, 7
mov bpl, byte [rsp + 0xb0]
and bpl, 1
or bpl, bl
je 0x1403b5222
test r10d, r10d
je 0x1403b5210
test byte [rsp + 0x40], 0x10
je 0x1403b5210
mov rbx, qword [rsp + 0x30]
lea rbp, [rbx + 8]
mov qword [rsp + 0x30], rbp
add rbx, 0x10
mov rsi, qword [rbp - 8]
mov qword [rsp + 0x30], rbx
mov rbp, qword [rbp]
cmp byte [rsi], 0x38
jne 0x1403b5210
cmp byte [rsi + 2], 0x4e
je 0x1403b5249
movzx eax, di
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, edi
mov edx, 2
mov r8d, 0xfffffffb
lea r9, str.unknown
call fcn.140383960
mov qword [rsp + 0x30], 0
jmp 0x1403b35e4
mov ecx, 0xfffffffb
lea rdx, [rsp + 0x30]
call fcn.1403c1480
test eax, eax
jne 0x1403b5210
mov rsi, qword [rsp + 0x30]
xor ebx, ebx
mov r12b, byte [rsp + 0xb0]
and r12b, 1
mov qword [rsi + 0x118], rbx
mov r10, qword [rsp + 0x30]
mov sil, byte [rsp + 0x41]
shr sil, 3
mov qword [r10 + 0x1c0], rbx
and sil, 0xf0
mov r11, qword [rsp + 0x30]
and byte [r11 + 0x29d], 0xf7
mov r15, qword [rsp + 0x30]
mov r13b, byte [r15 + 0x294]
and r13b, 0xfe
or r13b, r12b
mov byte [r15 + 0x294], r13b
mov r11, qword [rsp + 0x30]
mov r10b, byte [r11 + 0x29e]
and r10b, 0xef
or r10b, sil
mov byte [r11 + 0x29e], r10b
mov r10, qword [rsp + 0x30]
mov rsi, qword [rbp]
mov qword [r10 + 0x1c0], rsi
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rbp + 8]
mov qword [rsi + 0x118], rbp
mov r9, qword [rsp + 0x30]
mov rbp, qword [r9 + 0x30]
test rbp, rbp
je 0x1403b42aa
test byte [rbp + 0x74], 2
je 0x1403b4269
mov dword [rbp + 0x68], edi
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rbp + 0x30]
mov dword [rsi + 0x6c], edi
mov r10, qword [rsp + 0x30]
mov rbp, qword [r10 + 0xd8]
test rbp, rbp
je 0x1403b533c
mov qword [rbp + 8], rbx
mov rbp, qword [rsp + 0x30]
mov qword [rbp + 0xd8], rbx
mov eax, edi
add rsp, 0x60
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret