Function at 0x7fff25d47e90
Capabilities:
Access pe header
Create process on windows
Print debug messages
Resume thread
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1590
call sub.ntdll.dll___chkstk
sub rsp, rax
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x1580], rax
mov qword [rsp + 0x5e8], rsp
mov rax, r9
mov qword [rsp + 0x300], rax
mov rsi, rcx
mov ebx, dword [rsp + 0x1600]
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x118], rdx
mov qword [rsp + 0x108], r8
mov qword [rsp + 0x4b0], rax
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x15f0]
mov qword [rsp + 0x308], rax
mov qword [rsp + 0x4b8], rax
mov qword [rsp + 0x4d0], rax
mov dword [rsp + 0xc8], ebx
mov rax, qword [rsp + 0x1608]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x1610]
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x1618]
mov qword [rsp + 0x410], rcx
mov rax, qword [rsp + 0x1620]
mov qword [rsp + 0x2a0], rax
xor edi, edi
mov dword [rsp + 0xb0], edi
mov qword [rsp + 0x180], rdi
mov word [rsp + 0x12c], di
mov dword [rsp + 0x164], edi
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0xf4], edi
mov qword [rsp + 0x310], rdi
mov qword [rsp + 0x2d8], rdi
mov qword [rsp + 0x298], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x278], xmm0
mov dword [rsp + 0x500], 0x140012
lea r9, [0x7fff25f07318]
mov qword [rsp + 0x508], r9
mov qword [rsp + 0x378], rdi
mov word [rsp + 0x244], di
mov word [rsp + 0x154], di
test rdx, rdx
je 0x7fff25d4c0e3
test rax, rax
je 0x7fff25dda4be
test rcx, rcx
je 0x7fff25dda4be
mov qword [rsp + 0x1d8], rdi
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x1a0], rdi
mov dword [rsp + 0x344], edi
mov qword [rsp + 0x1c8], rdi
mov qword [rsp + 0x4d8], rdi
mov qword [rsp + 0x2e8], rdi
mov qword [rsp + 0x3a0], rdi
mov byte [rsp + 0xe1], dil
mov byte [rsp + 0xe3], dil
mov byte [rsp + 0xd0], dil
mov byte [rsp + 0xe0], dil
mov qword [rsp + 0x288], rdi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x1d0], rdi
mov dword [rsp + 0x15c], edi
mov qword [rsp + 0x268], rdi
mov dword [rsp + 0x1b0], edi
mov qword [rsp + 0x200], rdi
mov dword [rsp + 0x190], edi
mov dword [rsp + 0x160], edi
mov dword [rsp + 0x2f0], edi
mov qword [rsp + 0x420], rdi
mov dword [rsp + 0x2f8], edi
mov qword [rsp + 0x330], rdi
mov dword [rsp + 0x230], edi
mov dword [rsp + 0x124], edi
mov dword [rsp + 0x1b4], edi
mov qword [rsp + 0x418], rdi
mov dword [rsp + 0x2b4], edi
mov qword [rsp + 0x458], rdi
mov qword [rsp + 0x448], rdi
movups xmmword [rsp + 0x520], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rsp + 0x7b0], xmm1
mov qword [rsp + 0x7c0], rax
movups xmmword [rsp + 0x7c8], xmm0
mov qword [rsp + 0x7d8], rax
mov qword [rsp + 0x320], rdi
mov dword [rsp + 0x38c], edi
mov dword [rsp + 0x1e0], edi
mov dword [rsp + 0x1e8], edi
mov byte [rsp + 0xe2], dil
mov qword [rsp + 0x4c0], rdi
xor edx, edx
lea r8d, [rax + 0x58]
lea rcx, [rsp + 0x660]
call sub.ntdll.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x470], xmm0
movups xmmword [rsp + 0x480], xmm0
mov qword [rsp + 0x490], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x2c8], rax
mov r15, qword [rax + 0x30]
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0x370], r15
mov byte [rsp + 0x120], dil
movups xmmword [rsp + 0x220], xmm0
mov r14d, 0x100
mov r8d, r14d
xor edx, edx
lea rcx, [rsp + 0x1480]
call sub.ntdll.dll_memset
mov qword [rsp + 0x1a8], rdi
mov qword [rsp + 0x208], rdi
mov qword [rsp + 0x218], rdi
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x2e0], rdi
mov byte [rsp + 0x128], dil
mov dword [rsp + 0x194], edi
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0x23c], edi
mov qword [rsp + 0x2c0], rdi
mov byte [rsp + 0xe5], dil
mov qword [rsp + 0x318], rdi
mov qword [rsp + 0x380], rdi
mov dword [rsp + 0x2ac], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x620], xmm0
movups xmmword [rsp + 0x630], xmm0
movups xmmword [rsp + 0x640], xmm0
mov qword [rsp + 0x650], rax
movups xmmword [rsp + 0x5f0], xmm0
mov qword [rsp + 0x4c8], rdi
mov eax, ebx
and eax, 0x18
cmp al, 0x18
je 0x7fff25dda4ab
mov eax, ebx
and eax, 0x1000
mov edx, 0x800
test edx, ebx
jne 0x7fff25dd9f1e
mov ecx, ebx
test eax, eax
jne 0x7fff25d482e6
mov rax, qword [0x7fff25fd0dd0]
cmp byte [rax + 0x7f4], dil
jne 0x7fff25dd9f2d
test cl, 0x40
jne 0x7fff25dd9f3b
bt ecx, 0xe
jb 0x7fff25d4c1a9
test cl, 0x20
jne 0x7fff25d4c197
bt ecx, 0xf
jb 0x7fff25dd9f49
test cl, cl
js 0x7fff25d4c268
test r14d, ecx
jne 0x7fff25dd9f50
mov al, dil
mov r12d, 1
mov r13d, 2
mov byte [rsp + 0x110], al
mov r8d, dword [rsp + 0xc8]
and r8d, 0xffff3e1f
mov dword [rsp + 0xc8], r8d
mov ecx, r8d
shr ecx, 0xc
and ecx, 0x40
mov eax, r8d
mov edx, ecx
or edx, r12d
and eax, 0x1000000
cmove edx, ecx
mov eax, r8d
mov ecx, edx
or ecx, r14d
and eax, 0x10000
cmove ecx, edx
mov eax, r8d
mov ebx, ecx
bts ebx, 9
and al, 4
cmovne ebx, ecx
mov dword [rsp + 0xf8], ebx
test r8b, 3
jne 0x7fff25dd9f6a
mov rsi, qword [rsp + 0x198]
mov qword [rsp + 0xba8], 0x20005
mov qword [rsp + 0xbc0], rdi
mov qword [rsp + 0xbc8], 0x10003
mov qword [rsp + 0xbd0], 0x10
mov qword [rsp + 0xbe0], rdi
lea rax, [rsp + 0x460]
mov qword [rsp + 0xbd8], rax
mov qword [rsp + 0xbe8], 6
mov qword [rsp + 0xbf0], 0x40
mov qword [rsp + 0xc00], rdi
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0xbf8], rax
mov dword [rsp + 0xb4], 3
mov ecx, 3
lea r14d, [rcx + 5]
test rsi, rsi
jne 0x7fff25dd9fbc
cmp byte [rsp + 0x110], dil
jne 0x7fff25d4c12c
test dword [rsp + 0xc8], 0x4000000
jne 0x7fff25d4c1b3
test dword [rsp + 0xc8], 0x400000
jne 0x7fff25dd9ff5
xorps xmm0, xmm0
xor ecx, ecx
mov rax, qword [rsp + 0x2a0]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x7fff25d484c8
test dword [rsp + 0xc8], 0x400
jne 0x7fff25d484c8
mov r8d, r12d
lea rdx, [rsp + 0x310]
call qword [sym.imp.ntdll.dll_RtlCreateEnvironmentEx]
nop dword [rax + rax]
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4aaf2
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x148], rax
bts dword [rsp + 0xc8], 0xa
mov rax, qword [rsp + 0x410]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x530], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x540], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x550], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x560], xmm1
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x570], xmm0
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x580], xmm1
movsd xmm0, qword [rax + 0x60]
movsd qword [rsp + 0x590], xmm0
mov r14d, 0x80000
test dword [rsp + 0xc8], r14d
jne 0x7fff25d49ad6
mov ebx, 0x800
test dword [rsp + 0xc8], ebx
jne 0x7fff25d4858c
or rcx, 0xffffffffffffffff
cmp qword [rsp + 0x288], rdi
cmovne rcx, qword [rsp + 0x288]
lea r8, [rsp + 0x260]
xor edx, edx
call sym.KERNELBASE.dll_IsProcessInJob
test eax, eax
je 0x7fff25d4858c
cmp dword [rsp + 0x260], edi
je 0x7fff25d4858c
mov eax, dword [rsp + 0xc8]
btr eax, 0xc
or eax, ebx
mov dword [rsp + 0xc8], eax
mov eax, dword [rsp + 0x56c]
bt eax, 8
jae 0x7fff25d485a4
test eax, 0x600
jne 0x7fff25d4ab40
cmp qword [rsp + 0x168], rdi
je 0x7fff25d48616
xor edx, edx
mov r8d, 0x206
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x1c8], rax
test rax, rax
je 0x7fff25d4ab0d
lea r9, [rsp + 0x4d8]
mov r8, rax
mov edx, 0x103
mov rcx, qword [rsp + 0x168]
call sym.KERNELBASE.dll_GetFullPathNameW
cmp eax, 0x104
jae 0x7fff25d4ab19
test eax, eax
je 0x7fff25d4ab2a
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x168], rax
lea r9, [rsp + 0x518]
xor r8d, r8d
mov rdx, qword [rsp + 0x300]
lea rcx, [rsp + 0x730]
call sym.KERNELBASE.dll_BaseFormatObjectAttributes
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4ab3c
lea r9, [rsp + 0x510]
xor r8d, r8d
mov rdx, qword [rsp + 0x308]
lea rcx, [rsp + 0x760]
call sym.KERNELBASE.dll_BaseFormatObjectAttributes
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4ab3c
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x360], eax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x4e8], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x4a8], rax
mov eax, dword [rsp + 0x360]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0x15f8], edi
je 0x7fff25d49d74
cmp byte [rsp + 0x128], dil
mov dword [rsp + 0x240], r12d
jne 0x7fff25d49d74
mov r14d, dword [rsp + 0x240]
mov dword [rsp + 0x35c], r14d
mov rcx, qword [rsp + 0x2d0]
mov qword [rsp + 0x260], rcx
mov qword [rsp + 0x188], rcx
mov rax, qword [rsp + 0x4a8]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x100]
test rax, rax
jne 0x7fff25d4ab50
cmp qword [rsp + 0x218], rdi
jne 0x7fff25d4ab73
mov rax, qword [rsp + 0x210]
test rax, rax
jne 0x7fff25d4a97b
mov r8, qword [rsp + 0x2d8]
test r8, r8
jne 0x7fff25d4abb0
lea rcx, [rsp + 0x278]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x258]
test rbx, rbx
jne 0x7fff25d4aa0a
mov rcx, qword [rsp + 0x170]
test rcx, rcx
jne 0x7fff25d4a7d9
mov rax, qword [rsp + 0x208]
test rax, rax
jne 0x7fff25d4abce
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
jne 0x7fff25d4abea
mov rax, qword [rsp + 0x138]
test rax, rax
jne 0x7fff25d4ac03
mov rcx, qword [rsp + 0x290]
test rcx, rcx
jne 0x7fff25d4ac39
cmp qword [rsp + 0x140], rdi
jne 0x7fff25d4ac52
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
jne 0x7fff25d4acc1
call fcn.7fff25dd11ec
test al, al
je 0x7fff25d4885f
mov r8, qword [rsp + 0x200]
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepFreeAppCompatData]
nop dword [rax + rax]
mov qword [rsp + 0x1d0], rdi
mov dword [rsp + 0x15c], edi
mov qword [rsp + 0x268], rdi
mov dword [rsp + 0x1b0], edi
mov qword [rsp + 0x200], rdi
mov dword [rsp + 0x190], edi
cmp dword [rsp + 0xf4], edi
jne 0x7fff25d48898
call fcn.7fff25dd11ec
test al, al
je 0x7fff25d48898
lea rcx, [rsp + 0x660]
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepReleaseSxsCreateProcessUtilityStruct]
nop dword [rax + rax]
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rsp + 0x660]
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x1a0]
test rcx, rcx
jne 0x7fff25d4acda
lea rcx, [rsp + 0x470]
call fcn.7fff25d47e3c
mov r15b, dil
mov byte [rsp + 0x150], dil
mov r13b, dil
mov byte [rsp + 0x111], dil
mov dword [rsp + 0x238], r12d
cmp qword [rsp + 0x118], rdi
je 0x7fff25d49859
mov rax, qword [rsp + 0x108]
test rax, rax
je 0x7fff25d4a7a0
cmp word [rax], di
je 0x7fff25d4a7a0
test r15b, r15b
jne 0x7fff25d4a6f8
test r13b, r13b
jne 0x7fff25d4a6f8
mov r13, qword [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x278]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
nop dword [rax + rax]
test al, al
je 0x7fff25d4ad44
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4ad0d
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
nop dword [rax + rax]
mov dword [rsp + 0x358], eax
lea ecx, [rax - 1]
cmp ecx, r12d
ja 0x7fff25d49c46
lea rcx, [rsp + 0x1f0]
call fcn.7fff25d47728
test eax, eax
je 0x7fff25d49c52
mov eax, dword [rsp + 0x1e8]
and eax, 3
cmp al, 3
je 0x7fff25d4ad4b
mov rax, qword [rsp + 0x2c8]
test byte [rax + 3], 0x10
jne 0x7fff25d4a613
cmp dword [rsp + 0x194], edi
jne 0x7fff25d489ee
cmp word [rsp + 0x220], di
jne 0x7fff25d4a0a5
test byte [rax + 3], 0x10
jne 0x7fff25d4a098
cmp dword [rsp + 0x1e0], edi
jne 0x7fff25d4ae6b
mov r15, qword [rsp + 0x260]
lea r9, [rsp + 0x350]
lea r8, [rsp + 0x320]
lea rdx, [rsp + 0x7b0]
lea rcx, [rsp + 0x620]
call qword [sym.imp.api_ms_win_security_isolationpolicy_l1_2_0.dll_GetEmbeddedImageMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0x350], edi
jne 0x7fff25d4ae9b
mov r13d, 8
mov rdx, qword [rsp + 0x1c0]
test rdx, rdx
jne 0x7fff25d4a1aa
cmp dword [rsp + 0x1e0], edi
jne 0x7fff25d4afa8
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x7fff25d48a8a
call sym.KERNELBASE.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7fff25d4af6b
test al, 0x10
je 0x7fff25d4af6b
mov esi, 8
test r15, r15
jne 0x7fff25d49f57
mov rbx, qword [rsp + 0x138]
test rbx, rbx
jne 0x7fff25d4a262
cmp dword [rsp + 0x15f8], edi
je 0x7fff25d49f08
or dword [rsp + 0xf8], 4
mov r13d, 0x58
mov r8d, r13d
xor edx, edx
lea rcx, [rsp + 0x3b0]
call sub.ntdll.dll_memset
mov qword [rsp + 0x3b0], r13
mov eax, dword [rsp + 0xf4]
test eax, eax
jne 0x7fff25d48aff
test r14d, r14d
je 0x7fff25d49d80
test eax, eax
jne 0x7fff25d48aff
test r14d, r14d
je 0x7fff25d49e4d
mov r13d, 2
mov rcx, qword [rsp + 0x2c8]
test byte [rsp + 0xc8], 3
jne 0x7fff25d4affd
cmp byte [rsp + 0xe0], dil
jne 0x7fff25d4b026
or byte [rsp + 0x3c0], r12b
mov eax, 0x2000
mov word [rsp + 0x3c2], ax
mov dword [rsp + 0x3c4], 0x81
cmp qword [rsp + 0x540], rdi
jne 0x7fff25d48b66
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax + 0xc8]
mov qword [rsp + 0x540], rcx
test rbx, rbx
jne 0x7fff25d4a2dd
or byte [rsp + 0x3c0], r13b
lea r8, [rsp + 0x154]
lea rdx, [rsp + 0x244]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_RtlWow64GetProcessMachines]
nop dword [rax + rax]
mov eax, 0xaa64
cmp word [rsp + 0x154], ax
je 0x7fff25d4b03b
mov qword [rsp + 0x790], rdi
mov dword [rsp + 0x798], 0x80000000
mov dword [rsp + 0x79c], edi
mov word [rsp + 0x7a0], di
mov byte [rsp + 0x7a2], dil
mov al, byte [rsp + 0x7a3]
and al, 0xf2
or al, r13b
mov byte [rsp + 0x7a3], al
and al, 0xf
mov byte [rsp + 0x7a3], al
mov al, byte [rsp + 0x7a4]
and al, 0xfc
mov byte [rsp + 0x7a4], al
or al, 4
mov byte [rsp + 0x7a4], al
and al, 0xf7
mov byte [rsp + 0x7a4], al
or al, 0x10
mov byte [rsp + 0x7a4], al
and al, 0xdf
mov byte [rsp + 0x7a4], al
or al, 0x40
mov byte [rsp + 0x7a4], al
and al, 0x7f
mov byte [rsp + 0x7a4], al
and byte [rsp + 0x7a5], 0xfe
xor eax, eax
mov qword [rsp + 0x7a8], rax
mov eax, dword [rsp + 0x194]
neg eax
sbb edx, edx
and edx, 0x10000
cmp word [rsp + 0x220], di
setne r9b
mov rax, qword [rsp + 0x138]
test rax, rax
jne 0x7fff25d4a302
mov r8, rdi
test rax, rax
jne 0x7fff25d4a30b
mov rcx, rdi
or edx, dword [rsp + 0xf8]
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], edx
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x530]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], r9b
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x108]
mov r8, qword [rsp + 0x168]
lea rdx, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x118]
call fcn.7fff25d47840
mov rsi, rax
mov qword [rsp + 0x4f8], rax
test rax, rax
je 0x7fff25d49d54
mov rax, qword [rsp + 0x138]
test rax, rax
jne 0x7fff25d4a314
cmp qword [rsp + 0x100], rdi
jne 0x7fff25d4b0cc
xor edx, edx
mov r8d, 0x208
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x210], rax
test rax, rax
je 0x7fff25d4acf3
mov esi, edi
mov dword [rsp + 0x354], edi
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x180], rax
mov rbx, rax
mov qword [rsp + 0x2b8], rax
cmp word [rax], 0x22
jne 0x7fff25d4a022
mov r14b, dil
mov byte [rsp + 0x130], dil
lea rbx, [rax + 2]
mov qword [rsp + 0x2b8], rbx
mov qword [rsp + 0x118], rbx
cmp word [rbx], di
je 0x7fff25d4990b
cmp word [rbx], 0x22
je 0x7fff25d498fc
add rbx, 2
mov qword [rsp + 0x2b8], rbx
mov qword [rsp + 0x180], rbx
jmp 0x7fff25d498db
mov qword [rsp + 0x180], rbx
mov dword [rsp + 0x238], edi
mov r8, qword [rsp + 0x180]
movzx eax, word [r8]
mov word [rsp + 0x12c], ax
mov word [r8], di
mov rcx, qword [rsp + 0x298]
test rcx, rcx
jne 0x7fff25d4a7c0
lea rdx, [rsp + 0x298]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ntdll.dll_RtlGetExePath]
nop dword [rax + rax]
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4ad0d
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
lea r8, [0x7fff25f07308]
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x298]
call sym.KERNELBASE.dll_SearchPathW
mov dword [rsp + 0x340], eax
test eax, eax
je 0x7fff25d4a99c
cmp eax, 0x104
jae 0x7fff25d4ad14
mov rcx, qword [rsp + 0x210]
call sym.KERNELBASE.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x7fff25d4a99c
test al, 0x10
jne 0x7fff25d4ad1b
mov rcx, qword [rsp + 0x180]
movzx eax, word [rsp + 0x12c]
mov word [rcx], ax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x108]
mov r14d, dword [rsp + 0x35c]
jmp 0x7fff25d488fc
cmp dword [rsp + 0x530], 0x70
jne 0x7fff25d4a3f1
mov rbx, qword [rax + 0x68]
mov qword [rsp + 0x378], rbx
test rbx, rbx
je 0x7fff25d48539
mov dword [rsp + 0xa0], 0x19
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xba0]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x4c8]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x620]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x470]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x38c]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x320]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x7c8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x7b0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x288]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x128]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x220]
lea r8, [rsp + 0x1b4]
xor edx, edx
mov rcx, rbx
call fcn.7fff25d468c8
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4ab3c
test dword [rbx], 0x100
jne 0x7fff25d4a3db
test dword [rbx], r14d
mov eax, dword [rsp + 0x1e0]
cmovne eax, r12d
mov dword [rsp + 0x1e0], eax
test byte [rsp + 0x1b4], 4
je 0x7fff25d48539
bts dword [rsp + 0xf8], 0xa
jmp 0x7fff25d48539
add eax, 0xfffffffa
cmp eax, r12d
jbe 0x7fff25d48994
xorps xmm0, xmm0
movups xmmword [rsp + 0x430], xmm0
mov word [rsp + 0x432], di
mov qword [rsp + 0x438], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x358]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rsp + 0x430]
xor edx, edx
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.ntdll.dll_RtlGetFullPathName_UstrEx]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4ad0d
movaps xmm0, xmmword [rsp + 0x430]
movdqa xmmword [rsp + 0x1f0], xmm0
psrldq xmm0, 8
movq qword [rsp + 0x2d8], xmm0
mov qword [rsp + 0x438], rdi
jmp 0x7fff25d489a9
mov ecx, ebx
call fcn.7fff25d6b370
mov dword [rsp + 0xb0], edi
mov r13d, 8
mov r15, qword [rsp + 0xc0]
mov r14d, 5
jmp 0x7fff25d4be15
mov dword [rsp + 0x240], edi
jmp 0x7fff25d486f3
test dword [rsp + 0x56c], 0x100
jne 0x7fff25d48af2
cmp qword [rsp + 0x288], rdi
jne 0x7fff25d48af2
test dword [rsp + 0xc8], 0x8000018
jne 0x7fff25d48af2
mov eax, dword [rsp + 0x1b8]
and eax, 0xfffffffd
or eax, r12d
mov dword [rsp + 0x1b8], eax
mov dword [rsp + 0x1bc], 3
and eax, 0xffffffe3
mov dword [rsp + 0x1b8], eax
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xba8], 0x2000a
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbb0], rsi
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbc0], rdi
mov eax, dword [rsp + 0xb4]
shl rax, 5
lea rcx, [rsp + 0x1b8]
mov qword [rsp + rax + 0xbb8], rcx
add dword [rsp + 0xb4], r12d
mov eax, dword [rsp + 0xf4]
mov rbx, qword [rsp + 0x138]
jmp 0x7fff25d48af2
test dword [rsp + 0x56c], 0x100
je 0x7fff25d48aff
mov r13d, 2
cmp qword [rsp + 0x288], rdi
je 0x7fff25d48b05
mov eax, dword [rsp + 0x1b8]
and eax, 0xfffffffe
or eax, r13d
mov dword [rsp + 0x1b8], eax
mov dword [rsp + 0x1bc], 3
and eax, 0xffffffe3
mov dword [rsp + 0x1b8], eax
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xba8], 0x2000a
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbb0], rsi
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbc0], rdi
mov eax, dword [rsp + 0xb4]
shl rax, 5
lea rcx, [rsp + 0x1b8]
mov qword [rsp + rax + 0xbb8], rcx
add dword [rsp + 0xb4], r12d
mov rbx, qword [rsp + 0x138]
jmp 0x7fff25d48b05
and dword [rsp + 0xf8], 0xfffffffb
jmp 0x7fff25d48abe
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xba8], 0x60002
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbb0], rsi
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbc0], rdi
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbb8], r15
add dword [rsp + 0xb4], r12d
jmp 0x7fff25d48a98
mov r14b, r12b
mov byte [rsp + 0x130], r12b
mov qword [rsp + 0x118], rax
mov eax, 0x20
lea ecx, [rax - 0x17]
cmp word [rbx], di
je 0x7fff25d4990b
cmp word [rbx], ax
je 0x7fff25d4a066
cmp word [rbx], cx
je 0x7fff25d4a066
add rbx, 2
mov qword [rsp + 0x2b8], rbx
mov qword [rsp + 0x180], rbx
jmp 0x7fff25d4a03d
mov qword [rsp + 0x180], rbx
jmp 0x7fff25d4990b
cmp dword [rsp + 0x2ac], edi
jne 0x7fff25d489ee
call fcn.7fff25dd11ec
test al, al
je 0x7fff25d4ae18
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x138]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x1c0]
lea rdx, [rsp + 0x220]
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepAppXExtension]
nop dword [rax + rax]
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4acfd
mov rax, qword [rsp + 0x148]
cmp qword [rsp + 0x1a8], rdi
cmovne rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x148], rax
mov rdx, qword [rsp + 0x138]
test rdx, rdx
je 0x7fff25d4ae4b
mov rdx, qword [rdx + 0x18]
lea rcx, [rsp + 0x220]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x138]
mov rax, qword [rsp + 0x1c0]
cmp qword [rcx], rdi
cmovne rax, qword [rcx]
mov qword [rsp + 0x1c0], rax
cmp qword [rcx + 0x10], rdi
je 0x7fff25d489ee
cmp qword [rsp + 0x100], rdi
jne 0x7fff25d489ee
mov rbx, qword [rsp + 0x1c8]
test rbx, rbx
jne 0x7fff25d4ae22
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x168], rax
jmp 0x7fff25d489ee
lea r8, [rsp + 0x208]
mov rcx, r15
call fcn.7fff25d4d9c0
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4af4c
mov qword [rsp + 0x368], rdi
call fcn.7fff25dd11ec
test al, al
je 0x7fff25d4af88
lea r8, [rsp + 0x368]
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x1c0]
mov rcx, qword [rcx]
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepAppContainerEnvironmentExtension]
nop dword [rax + rax]
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4af4c
mov rax, qword [rsp + 0x208]
test rax, rax
cmovne r15, rax
mov qword [rsp + 0x188], r15
mov rax, qword [rsp + 0x368]
test rax, rax
je 0x7fff25d48a5a
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
jne 0x7fff25d4af8f
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x148], rax
jmp 0x7fff25d48a5a
test byte [rbx + 0x50], r12b
je 0x7fff25d48aa9
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xba8], 0x60011
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbb0], r12
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbc0], rdi
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbb8], 0x81
add dword [rsp + 0xb4], r12d
or dword [rsp + 0xf8], 0x40
mov rbx, qword [rsp + 0x138]
jmp 0x7fff25d48aa9
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x7fff25d48b6f
cmp word [rax], di
je 0x7fff25d48b6f
test byte [rbx + 0x50], 4
je 0x7fff25d48b77
jmp 0x7fff25d48b6f
mov r8, qword [rax + 0x58]
jmp 0x7fff25d48c79
mov rcx, qword [rax + 8]
jmp 0x7fff25d48c85
test byte [rax + 0x50], r13b
je 0x7fff25d48d33
mov byte [rsp + 0x120], r12b
cmp qword [rsp + 0x1c0], rdi
je 0x7fff25d49c15
mov ecx, 0xc000000d
jmp 0x7fff25d4ab12
cmp qword [rsp + 0x100], rdi
jne 0x7fff25d489cd
mov dword [rsp + 0x1ec], 0xb0001
lea rax, [rsp + 0x610]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4f0]
lea r8, [rsp + 0x1ec]
mov edx, 0xb
mov rsi, 0xfffffffffffffffa
mov rcx, rsi
call fcn.7fff25d451a8
mov r15d, 0x10000000
or eax, r15d
mov ecx, dword [rsp + 0x1ec]
jl 0x7fff25d4ad72
cmp ecx, 0xb0000
je 0x7fff25d4ad55
mov eax, 0xb0002
cmp ecx, eax
je 0x7fff25d4ad95
test ebx, ebx
js 0x7fff25d49d4d
mov dword [rsp + 0x2a8], 0x250000
lea rax, [rsp + 0x618]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5e0]
lea r8, [rsp + 0x2a8]
mov edx, 0x25
mov rcx, rsi
call fcn.7fff25d451a8
or eax, r15d
jl 0x7fff25d4ae07
cmp dword [rsp + 0x2a8], 0x250001
je 0x7fff25d4adfa
test ebx, ebx
js 0x7fff25d49d4d
mov rax, qword [rsp + 0x2c8]
jmp 0x7fff25d489cd
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rax + rsi*2], di
jne 0x7fff25d4a6fc
lea rsi, [rsi*2 + 6]
mov r8, rsi
xor edx, edx
mov r13, qword [rsp + 0xc0]
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x258], rax
test rax, rax
je 0x7fff25d48916
lea r8, [0x7fff25f07278]
mov rdx, rsi
mov rcx, rax
call fcn.7fff25d50450
test r15b, r15b
jne 0x7fff25d4aab1
mov r8, qword [rsp + 0x108]
mov rdx, rsi
mov rbx, qword [rsp + 0x258]
mov rcx, rbx
call fcn.7fff25d4d390
lea r8, [0x7fff25f07278]
mov rdx, rsi
mov rcx, rbx
call fcn.7fff25d4d390
test r15b, r15b
jne 0x7fff25d4aace
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x108], rax
jmp 0x7fff25d48916
mov r13b, r12b
mov byte [rsp + 0x111], r12b
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x108], rax
jmp 0x7fff25d488fc
call qword [sym.imp.ntdll.dll_RtlReleasePath]
nop dword [rax + rax]
mov qword [rsp + 0x298], rdi
jmp 0x7fff25d49934
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov qword [rsp + 0x170], rdi
jmp 0x7fff25d487a2
mov r8, rax
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsp + 0x210], rdi
jmp 0x7fff25d4875b
test esi, esi
je 0x7fff25d4aa71
mov rcx, qword [rsp + 0x180]
movzx eax, word [rsp + 0x12c]
mov word [rcx], ax
cmp word [rbx], di
je 0x7fff25d4ad2a
test r14b, r14b
je 0x7fff25d4ad2a
add rbx, 2
mov qword [rsp + 0x2b8], rbx
mov qword [rsp + 0x180], rbx
mov r15b, r12b
mov byte [rsp + 0x150], r12b
mov dword [rsp + 0x238], edi
mov rax, qword [rsp + 0x108]
jmp 0x7fff25d4a02d
mov r8, rbx
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsp + 0x258], rdi
jmp 0x7fff25d48791
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x68]
mov dword [rsp + 0x354], esi
mov r13b, byte [rsp + 0x111]
mov rbx, qword [rsp + 0x2b8]
mov r14b, byte [rsp + 0x130]
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x260], rax
jmp 0x7fff25d4a9a4
mov r8, qword [rsp + 0x180]
movzx eax, word [r8]
mov word [rsp + 0x12c], ax
mov word [r8], di
jmp 0x7fff25d4a755
mov r8, qword [rsp + 0x180]
movzx eax, word [rsp + 0x12c]
mov word [r8], ax
mov rdx, rsi
mov rcx, rbx
call fcn.7fff25d4d390
jmp 0x7fff25d4a78b
mov ecx, eax
call fcn.7fff25d6b370
lea rdx, [0x7fff25dda4c8]
mov rcx, qword [rsp + 0x5e8]
call sub.ntdll.dll__local_unwind
mov ecx, 0xc0000017
call fcn.7fff25d6b370
jmp 0x7fff25d4ab2a
mov ecx, 0x10b
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov dword [rsp + 0xb0], edi
mov r13d, 8
jmp 0x7fff25d49d69
mov ecx, eax
jmp 0x7fff25d4ab12
btr eax, 8
mov dword [rsp + 0x56c], eax
jmp 0x7fff25d485a4
cmp dword [rax + 0x20], r12d
je 0x7fff25d4873c
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x260], rcx
mov qword [rsp + 0x188], rcx
jmp 0x7fff25d4874a
mov rax, qword [rsp + 0x4e0]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x4e8]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x188], rax
jmp 0x7fff25d4874a
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsp + 0x2d8], rdi
jmp 0x7fff25d4876c
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov qword [rsp + 0x208], rdi
jmp 0x7fff25d487b3
call qword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
nop dword [rax + rax]
mov qword [rsp + 0x1a8], rdi
jmp 0x7fff25d487c4
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
je 0x7fff25d4ac24
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepReleaseAppXContext]
nop dword [rax + rax]
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x138], rdi
jmp 0x7fff25d487d5
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov qword [rsp + 0x290], rdi
jmp 0x7fff25d487e6
test rsi, rsi
je 0x7fff25d4ac6e
mov rdx, rsi
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_NtRemoveProcessDebug]
nop dword [rax + rax]
mov edx, 0xc000022d
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
nop dword [rax + rax]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov qword [rsp + 0x140], rdi
jmp 0x7fff25d487f4
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov qword [rsp + 0xd8], rdi
jmp 0x7fff25d48805
call qword [sym.imp.ntdll.dll_CsrFreeCaptureBuffer]
nop dword [rax + rax]
mov qword [rsp + 0x1a0], rdi
jmp 0x7fff25d488a9
mov ecx, 0xc0000017
jmp 0x7fff25d49d4f
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x1a8], rdi
mov ecx, eax
jmp 0x7fff25d49d4f
mov ecx, 0xc0000106
jmp 0x7fff25d4ad20
mov ecx, 0xc00000ba
call fcn.7fff25d6b370
jmp 0x7fff25d4a99c
mov ecx, esi
jmp 0x7fff25d4ad33
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x7fff25d49d54
mov ecx, 3
jmp 0x7fff25d4ad33
mov ecx, 0xc000000d
jmp 0x7fff25d49d4f
mov rax, qword [rsp + 0x4f0]
and al, 0x24
cmp al, 0x24
mov eax, 0xb0002
cmove ecx, eax
mov dword [rsp + 0x1ec], ecx
mov eax, edi
test eax, eax
js 0x7fff25d4a68c
cmp ecx, 0xb0000
jne 0x7fff25d4a67f
test byte [rsp + 0x1e8], 6
je 0x7fff25d4ada7
jmp 0x7fff25d4a67f
mov eax, dword [rsp + 0x1e8]
and al, 5
cmp al, r12b
jne 0x7fff25d4a68c
call fcn.7fff25dd0de8
test al, al
je 0x7fff25d4ade9
lea rdx, [rsp + 0x194]
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.ext_ms_win_appmodel_daxcore_l1_1_0.dll_CheckAppXPackageBreakaway]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0xb8], eax
test eax, eax
jns 0x7fff25d4a68c
mov dword [rsp + 0x194], edi
jmp 0x7fff25d4a68c
mov ebx, 0xc0000001
mov dword [rsp + 0xb8], ebx
jmp 0x7fff25d4a68c
mov dword [rsp + 0x2ac], r12d
jmp 0x7fff25d4a6e3
mov ebx, 0xc0000001
mov dword [rsp + 0xb8], ebx
jmp 0x7fff25d4a6e3
mov eax, 0xc0000001
jmp 0x7fff25d4a0f8
mov r8, rbx
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsp + 0x1c8], rdi
mov rcx, qword [rsp + 0x138]
jmp 0x7fff25d4a199
xorps xmm0, xmm0
movups xmmword [rsp + 0x220], xmm0
mov word [rsp + 0x222], di
mov qword [rsp + 0x228], rdi
jmp 0x7fff25d489ee
cmp qword [rsp + 0x1c0], rdi
jne 0x7fff25d4ae91
mov rax, qword gs:[0x60]
test byte [rax + 3], 0x20
jne 0x7fff25d4ae91
mov r15, qword [rsp + 0x188]
jmp 0x7fff25d48a03
mov ecx, 0xc00000bb
jmp 0x7fff25d49d4f
test eax, eax
js 0x7fff25d4ad0d
mov dword [rsp + 0x2b0], edi
mov qword [rsp + 0xf78], 0x20010
mov qword [rsp + 0xf80], 0x18
mov qword [rsp + 0xf90], rdi
lea rax, [rsp + 0x7b0]
mov qword [rsp + 0xf88], rax
mov edx, r12d
mov dword [rsp + 0x2b0], edx
mov r13d, 8
cmp dword [rsp + 0x324], edi
je 0x7fff25d4af2a
mov qword [rsp + 0xf98], 0x20016
mov qword [rsp + 0xfa0], r13
mov qword [rsp + 0xfb0], rdi
lea rax, [rsp + 0x320]
mov qword [rsp + 0xfa8], rax
lea edx, [r13 - 6]
mov dword [rsp + 0x2b0], edx
lea r9, [rsp + 0xb4]
lea r8, [rsp + 0xba0]
lea rcx, [rsp + 0xf70]
call fcn.7fff25e462a0
jmp 0x7fff25d48a49
mov qword [rsp + 0x208], rdi
jmp 0x7fff25d4af62
mov eax, 0xc000000d
mov dword [rsp + 0xb8], eax
mov ecx, eax
call fcn.7fff25d6b370
jmp 0x7fff25d4af7c
mov ecx, 0x10b
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov dword [rsp + 0xb0], edi
jmp 0x7fff25d49d61
mov eax, edi
jmp 0x7fff25d4a205
call qword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
nop dword [rax + rax]
mov rax, qword [rsp + 0x368]
jmp 0x7fff25d4a24d
cmp qword [rsp + 0x488], rdi
jne 0x7fff25d4afe4
cmp byte [rsp + 0x490], dil
jne 0x7fff25d4afc8
mov dword [rsp + 0xb8], edi
jmp 0x7fff25d48a67
cmp qword [rsp + 0x478], rdi
je 0x7fff25d4af56
lea rdx, [rsp + 0x470]
mov rcx, r15
call fcn.7fff25e464a0
jmp 0x7fff25d4afe9
mov eax, 0xc000000d
mov dword [rsp + 0xb8], eax
test eax, eax
js 0x7fff25d4af62
jmp 0x7fff25d48a67
cmp byte [rcx + 1], dil
jne 0x7fff25d48b1b
mov al, byte [rsp + 0x3c0]
or al, 4
mov byte [rsp + 0x3c0], al
or al, sil
mov byte [rsp + 0x3c0], al
jmp 0x7fff25d48b29
mov byte [rsp + 0xe0], dil
or byte [rsp + 0x3c0], 4
jmp 0x7fff25d48b29
call fcn.7fff25dd11ec
test al, al
je 0x7fff25d48baa
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x268]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x500]
mov r8, qword [rsp + 0x1f8]
mov edx, 0x20
lea rcx, [rsp + 0x790]
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepQueryModuleChpeSettings]
nop dword [rax + rax]
test eax, eax
je 0x7fff25d48c48
jmp 0x7fff25d48baa
mov rax, qword gs:[0x30]
mov esi, dword [rax + 0x68]
mov r8, qword [rsp + 0x248]
test r8, r8
jne 0x7fff25dda055
mov r8, qword [rsp + 0x2d8]
test r8, r8
jne 0x7fff25d4c0a6
lea rcx, [rsp + 0x278]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
cmp dword [rsp + 0xf4], edi
jne 0x7fff25d4be7d
call fcn.7fff25dd11ec
test al, al
je 0x7fff25d4be7d
lea rcx, [rsp + 0x660]
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepReleaseSxsCreateProcessUtilityStruct]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x310]
test rcx, rcx
jne 0x7fff25d4c095
mov rbx, qword [rsp + 0x100]
test rbx, rbx
jne 0x7fff25dda06c
mov rcx, qword [rsp + 0x138]
test rcx, rcx
jne 0x7fff25d4c0f1
mov rcx, qword [rsp + 0x2e0]
test rcx, rcx
jne 0x7fff25dda349
mov rcx, qword [rsp + 0x208]
test rcx, rcx
jne 0x7fff25d4c10a
mov rcx, qword [rsp + 0x218]
test rcx, rcx
jne 0x7fff25dda35b
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
jne 0x7fff25d4c11b
mov r8, qword [rsp + 0x258]
test r8, r8
jne 0x7fff25d4c22a
mov r8, qword [rsp + 0x210]
test r8, r8
jne 0x7fff25d4c0bc
cmp qword [rsp + 0x2e8], rdi
jne 0x7fff25d4c240
mov r8, qword [rsp + 0x1c8]
test r8, r8
je 0x7fff25d4bf42
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x7fff25d4bf5b
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x290]
test rcx, rcx
je 0x7fff25d4bf74
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
cmp qword [rsp + 0x140], rdi
jne 0x7fff25dda36d
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
jne 0x7fff25dda3dc
call fcn.7fff25dd11ec
test al, al
je 0x7fff25d4bfc0
mov r8, qword [rsp + 0x200]
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepFreeAppCompatData]
nop dword [rax + rax]
lea rcx, [rsp + 0x398]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
cmp qword [rsp + 0x458], rdi
jne 0x7fff25dda3ee
cmp qword [rsp + 0x448], rdi
jne 0x7fff25dda3ee
cmp dword [rsp + 0xf0], edi
jne 0x7fff25dda41d
mov rcx, qword [rsp + 0x298]
test rcx, rcx
jne 0x7fff25d4c0d2
mov rcx, qword [rsp + 0x1a0]
test rcx, rcx
je 0x7fff25d4c02f
call qword [sym.imp.ntdll.dll_CsrFreeCaptureBuffer]
nop dword [rax + rax]
mov qword [rsp + 0x1a0], rdi
mov r8, qword [rsp + 0x318]
test r8, r8
jne 0x7fff25dda47d
mov r8, qword [rsp + 0x380]
test r8, r8
jne 0x7fff25dda494
lea rcx, [rsp + 0x470]
call fcn.7fff25d47e3c
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], esi
mov eax, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0x1580]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x1590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
nop dword [rax + rax]
jmp 0x7fff25d4be8e
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x7fff25d4be43
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x7fff25d4bf16
call qword [sym.imp.ntdll.dll_RtlReleasePath]
nop dword [rax + rax]
jmp 0x7fff25d4c00e
test r8, r8
jne 0x7fff25d47ff3
jmp 0x7fff25dd9f14
call qword [sym.imp.ext_ms_win_kernelbase_processthread_l1_1_0.dll_BasepReleaseAppXContext]
nop dword [rax + rax]
mov qword [rsp + 0x138], rdi
jmp 0x7fff25d4beb0
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
jmp 0x7fff25d4bed2
call qword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
nop dword [rax + rax]
jmp 0x7fff25d4bef4
mov eax, ecx
shl rax, 5
mov qword [rsp + rax + 0xba8], 0x20008
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbb0], r12
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbc0], rdi
mov eax, dword [rsp + 0xb4]
shl rax, 5
lea rcx, [rsp + 0x110]
mov qword [rsp + rax + 0xbb8], rcx
mov eax, dword [rsp + 0xb4]
add eax, r12d
mov dword [rsp + 0xb4], eax
mov ecx, eax
jmp 0x7fff25d48439
mov r13d, 2
mov al, r13b
lea r12d, [r13 - 1]
jmp 0x7fff25d4832c
mov eax, 5
jmp 0x7fff25d48320
mov dword [rsp + 0x390], r12d
mov eax, ecx
shl rax, 5
mov qword [rsp + rax + 0xba8], 0x20009
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbb0], 4
mov eax, dword [rsp + 0xb4]
shl rax, 5
mov qword [rsp + rax + 0xbc0], rdi
mov eax, dword [rsp + 0xb4]
shl rax, 5
lea rcx, [rsp + 0x390]
mov qword [rsp + rax + 0xbb8], rcx
mov eax, dword [rsp + 0xb4]
add eax, r12d
mov dword [rsp + 0xb4], eax
mov ecx, eax
jmp 0x7fff25d4844a
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x7fff25d4bf05
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x2e8]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x7fff25d4bf24
mov al, 3
jmp 0x7fff25d48320
mov ecx, 0xc0000030
jmp 0x7fff25dda4c3
test eax, eax
jne 0x7fff25dda4ab
mov ecx, ebx
jmp 0x7fff25d482e6
or ecx, edx
mov dword [rsp + 0xc8], ecx
jmp 0x7fff25d482e6
mov r12d, 1
mov al, r12b
jmp 0x7fff25d48326
mov al, 6
jmp 0x7fff25d48320
test rsi, rsi
setne dl
xor ecx, ecx
call fcn.7fff25e1caf4
test rax, rax
setne al
add al, 3
jmp 0x7fff25d48320
call qword [sym.imp.ntdll.dll_DbgUiConnectToDbg]
nop dword [rax + rax]
test eax, eax
jns 0x7fff25dd9f81
mov ecx, eax
jmp 0x7fff25dda4c3
call qword [sym.imp.ntdll.dll_DbgUiGetThreadDebugObject]
nop dword [rax + rax]
mov rsi, rax
mov qword [rsp + 0x198], rax
mov dword [rsp + 0xf8], ebx
test byte [rsp + 0xc8], r13b
je 0x7fff25d4839a
or ebx, r13d
mov dword [rsp + 0xf8], ebx
jmp 0x7fff25d4839a
mov qword [rsp + 0xc08], 0x60001
mov qword [rsp + 0xc10], r14
mov qword [rsp + 0xc20], rdi
mov qword [rsp + 0xc18], rsi
mov dword [rsp + 0xb4], 4
mov ecx, 4
jmp 0x7fff25d4842b
mov eax, ecx
shl rax, 5
mov qword [rsp + rax + 0x334800a8], 0x458948c4
invalid
lea ecx, [0x7fff25e37448]
mov qword [rbp + 0xf], 4
mov qword [rbp - 1], 4
mov qword [rbp - 0x11], 4
mov dword [rbp - 0x11], 4
mov qword [rbp - 0x21], 4
mov qword [rbp - 0x31], 4
call fcn.7fff25d5b8e4
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.7fff25d8f720
add rsp, 0xc0
pop rbp
ret
and al, 0x48
mov qword [rdi + 0x20], rsi
call fcn.7fff25d58bec
mov rcx, qword [rdi + 0x20]
mov r8d, ebp
mov edx, r14d
mov dword [rdi + 0x18], r14d
mov dword [rdi + 0x14], ebp
call fcn.7fff25d76430
mov ebx, eax
test eax, eax
jns 0x7fff25dda39a
sar byte [rcx + 0x2a], 0xb9
invalid
mov ecx, 0x8007000e
mov edi, 0x102
cmp eax, ecx
jne 0x7fff25dda38b
mov rdx, qword [rsp + 0x38]
mov r8d, edi
call fcn.7fff25db7c9c
mov rdx, qword [rsp + 0x38]
mov r8, rdi
mov ecx, ebx
call fcn.7fff25db7c9c
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
sub edi, edx
sub edi, r9d
mov eax, dword [rbx + 0x50]
cmp edx, ecx
mov r9d, ecx
mov r8d, eax
cmovg r9d, edx
cmp r10d, eax
cmovl r8d, r10d
cmp r8d, r9d
setg sil
jle 0x7fff25dda45d
retfq 0x3b44
cmp r9d, ecx
jne 0x7fff25dda40b
mov dword [rbx + 0x4c], r8d
jmp 0x7fff25dda421
cmp r8d, eax
jne 0x7fff25dda416
mov dword [rbx + 0x50], r9d
jmp 0x7fff25dda421
sub eax, r10d
add eax, edx
add eax, r11d
mov dword [rbx + 0x50], eax
ret
mov rcx, qword [rbx + 0xf0]
call qword [0x7fff25e0bcd0]
nop dword [rax + rax]
mov rcx, qword [rbx + 0xf8]
and qword [rbx + 0xf0], 0
call qword [0x7fff25e0bcd0]
nop dword [rax + rax]
and qword [rbx + 0xf8], 0
mov ecx, dword [rbx + 0x4c]
mov eax, dword [rbx + 0x50]
sub ecx, edi
sub eax, edi
mov dword [rbx + 0x4c], ecx
mov dword [rbx + 0x50], eax
cmp ecx, eax
jne 0x7fff25dda470
and qword [rbx + 0x4c], 0
mov rbx, qword [rsp + 0x30]
mov al, sil
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
sub rsp, 0x30
mov qword [r11 - 0x18], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rbx, rcx
mov eax, 1
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], eax
lea rax, [0x7fff25e057f0]
add byte [rcx + 0x41890841], cl
or al, 0x48
lea eax, [0x7fff25e057f0]
mov qword [rcx], rax
lea rdi, [rcx + 0x10]
jns 0x7fff25dda4d0
mov qword [r11 + 0x10], rdi
xor eax, eax
mov qword [rdi + 0x18], rax
mov rcx, qword [rdx + 0x18]
test rcx, rcx
adc byte [rbx], dh
ror byte [rax - 0x77], 0x47
sbb byte [rax - 0x75], cl
sbb byte [rax - 0x7b], cl
leave
je 0x7fff25dda4ec
mov rax, qword [rcx]
mov rax, qword [rax]
cmp rcx, rdx
jne 0x7fff25dda4e3
mov rdx, rdi
jmp 0x7fff25dda4e5
xor edx, edx
call qword [fcn.7fff25e0c300]
nop
mov qword [rdi + 0x18], rax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret