Function at 0x14008d7d4
Capabilities:
Create process on windows
Encode data using base64
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7a8
movaps xmmword [rsp + 0x790], xmm6
mov r12, rcx
mov dword [rsp + 0x2e0], 3
mov al, byte [rdx + 0x68]
test al, al
sete cl
mov rdi, qword [rdx + 0x60]
test rdi, rdi
sete r8b
and r8b, cl
mov qword [rsp + 0x80], rdx
mov byte [rsp + 0x88], r8b
je 0x14008d82c
xor esi, esi
jmp 0x14008e003
mov qword [rsp + 0x68], r12
and qword [rsp + 0x1d8], 0
and qword [rsp + 0x1e8], 0
test al, al
jne 0x14008d9ab
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14009057e
lea r14, [rsp + 0x130]
lea r15, [rsp + 0x390]
lea r13, [rsp + 0x1d8]
mov qword [rsp + 0x58], rax
mov r12, rax
mov rbp, r12
cmp word [r12], 0
je 0x14008d998
mov rdx, 0xfffffffffffffffe
xor ecx, ecx
mov rsi, rcx
mov rax, rdx
inc rcx
add rdx, 2
cmp word [rbp + rsi*2], 0
jne 0x14008d892
test rsi, rsi
je 0x140090583
lea r12, [rcx*2]
add r12, rbp
xor ebx, ebx
test rax, rax
je 0x14008d87a
cmp word [rbp + rbx*2 + 2], 0x3d
je 0x14008d8d3
inc rbx
add rax, 0xfffffffffffffffe
jmp 0x14008d8bd
cmp rbx, rsi
jae 0x140090583
lea r8, [rbx + 1]
mov rcx, r14
mov rdx, rbp
call fcn.140085ad0
add rbx, 2
sub rsi, rbx
jb 0x140090583
lea rdx, [rbx*2]
add rdx, rbp
lea rcx, [rsp + 0x3b0]
mov r8, rsi
call fcn.140085ad0
movups xmm0, xmmword [rsp + 0x130]
movups xmm1, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0x390], xmm0
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0x3b0]
movaps xmm1, xmmword [rsp + 0x3c0]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
cmp byte [rsp + 0xb8], 2
je 0x14008d998
mov rcx, r15
lea rdx, [rsp + 0xa0]
call fcn.14008c6e2
mov rcx, r14
mov rdx, r13
mov r8, r15
lea r9, [rsp + 0xc0]
call fcn.14008849a
mov rcx, r14
call fcn.14007cfec
jmp 0x14008d87a
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rdx, qword [rsp + 0x80]
lea r15, [rsp + 0x1f0]
and qword [r15 + 8], 0
mov rax, qword [rdx + 0x50]
and qword [r15 + 0x28], 0
mov rcx, qword [rdx + 0x58]
xor edx, edx
test rax, rax
setne dl
mov qword [r15], rdx
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], rcx
mov qword [r15 + 0x20], rdx
mov qword [r15 + 0x30], rax
mov qword [r15 + 0x38], rcx
lea r12, [rsp + 0x3a8]
cmove rdi, rax
lea r13, [rsp + 0x390]
lea rbp, [rsp + 0xa0]
xorps xmm6, xmm6
test rdi, rdi
je 0x14008df25
dec rdi
mov qword [rsp + 0x230], rdi
mov rcx, r15
call fcn.140084765
test rax, rax
je 0x140090583
mov rdi, rax
mov rcx, r13
mov rdx, rax
call fcn.1400847ab
mov rsi, qword [rsp + 0x390]
test rsi, rsi
je 0x140090583
mov rax, qword [rsp + 0x398]
mov r14, qword [rsp + 0x3a0]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], r14
mov rcx, r13
mov rdx, rbp
call fcn.1400847f8
imul rax, r14, 0x38
lea rbx, [rsi + rax]
add rbx, 0x168
shl r14, 5
mov rax, qword [rsp + 0x3a0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x390]
movups xmmword [rdi], xmm0
cmp byte [rsi + r14 + 0x18], 2
jne 0x14008dd05
mov rdx, qword [rsp + 0x1d8]
test rdx, rdx
je 0x14008de72
mov r8, qword [rsp + 0x1e0]
mov r9, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x270]
call fcn.140087da0
cmp qword [rsp + 0x270], 0
jne 0x14008de72
mov rax, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x288]
mov byte [rsp + 0x57], 0
test rdx, rdx
je 0x14008dd54
dec rdx
mov rax, qword [rax + rcx*8 + 0x3d8]
movzx ecx, word [rax + 0x3d2]
sub rdx, 1
jae 0x14008db1a
dec rcx
mov qword [rsp + 0x2c8], rax
and qword [rsp + 0x2d0], 0
mov qword [rsp + 0x2d8], rcx
mov rcx, r13
lea rdx, [rsp + 0x2c8]
lea r8, [rsp + 0x57]
call fcn.140087e74
mov rax, qword [rsp + 0x3c0]
mov qword [rsp + 0x1c0], rax
movups xmm0, xmmword [rsp + 0x390]
movups xmm1, xmmword [rsp + 0x3a0]
movups xmm2, xmmword [rsp + 0x3b0]
movaps xmmword [rsp + 0x1b0], xmm2
movaps xmmword [rsp + 0x1a0], xmm1
movaps xmmword [rsp + 0x190], xmm0
movups xmm0, xmmword [r12 + 0x20]
movups xmm1, xmmword [r12 + 0x30]
movaps xmmword [rsp + 0x240], xmm0
movaps xmmword [rsp + 0x250], xmm1
movups xmm0, xmmword [r12 + 0x40]
movaps xmmword [rsp + 0x290], xmm0
mov rax, qword [r12 + 0x50]
mov qword [rsp + 0x2a0], rax
mov rcx, r13
lea rdx, [rsp + 0x290]
call fcn.1400847ab
mov rcx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x398]
mov rdx, qword [rsp + 0x3a0]
imul r8, rdx, 0x38
mov r9, rdx
shl r9, 5
mov r10, qword [rcx + r8 + 0x198]
mov qword [rsp + 0x160], r10
movups xmm0, xmmword [rcx + r8 + 0x168]
movups xmm1, xmmword [rcx + r8 + 0x178]
movups xmm2, xmmword [rcx + r8 + 0x188]
movaps xmmword [rsp + 0x150], xmm2
movaps xmmword [rsp + 0x140], xmm1
movaps xmmword [rsp + 0x130], xmm0
mov r10, qword [rsp + 0x1c0]
mov qword [rcx + r8 + 0x198], r10
movaps xmm0, xmmword [rsp + 0x190]
movaps xmm1, xmmword [rsp + 0x1a0]
movaps xmm2, xmmword [rsp + 0x1b0]
movups xmmword [rcx + r8 + 0x188], xmm2
movups xmmword [rcx + r8 + 0x178], xmm1
movups xmmword [rcx + r8 + 0x168], xmm0
movups xmm0, xmmword [rcx + r9]
movups xmm1, xmmword [rcx + r9 + 0x10]
lea r8, [rsp + 0x168]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
movaps xmm0, xmmword [rsp + 0x240]
movaps xmm1, xmmword [rsp + 0x250]
movups xmmword [rcx + r9], xmm0
movups xmmword [rcx + r9 + 0x10], xmm1
inc rdx
test rax, rax
je 0x14008dd7f
lea rcx, [rcx + rdx*8]
add rcx, 0x3d8
mov rdx, qword [rcx]
lea rcx, [rdx + 0x3d8]
dec rax
jne 0x14008dcde
mov qword [rsp + 0xf8], rdx
lea rax, [rsp + 0x100]
movups xmmword [rax], xmm6
jmp 0x14008dd98
add rsi, r14
lea rdx, [rbx + 0x18]
mov rcx, r12
call fcn.14008c727
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, r13
call fcn.140089584
mov rcx, rbp
mov rdx, rsi
call fcn.14008c727
lea rsi, [rsp + 0x130]
mov rcx, rsi
lea rdx, [rsp + 0x1d8]
mov r8, r13
mov r9, rbp
call fcn.14008849a
mov rcx, rsi
jmp 0x14008de7d
mov qword [rsp + 0x390], rax
and qword [rsp + 0x398], 0
mov qword [rsp + 0x3a0], rcx
mov rcx, rbp
mov rdx, r13
lea r8, [rsp + 0x57]
call fcn.140087e74
jmp 0x14008ddab
mov qword [rsp + 0xf8], rcx
and qword [rsp + 0x100], 0
mov qword [rsp + 0x108], rdx
mov ecx, 0xb
mov rdi, rbp
lea rsi, [rsp + 0x130]
rep movsq qword [rdi], qword [rsi]
movups xmm0, xmmword [rsp + 0xa0]
movups xmm1, xmmword [rsp + 0xb0]
movups xmm2, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x150], xmm2
movaps xmmword [rsp + 0x140], xmm1
movaps xmmword [rsp + 0x130], xmm0
mov sil, byte [rsp + 0xd0]
lea rax, [rsp + 0x100]
movups xmm0, xmmword [rax - 0x2f]
movups xmm1, xmmword [rax - 0x1f]
movaps xmmword [rsp + 0x190], xmm0
movaps xmmword [rsp + 0x1a0], xmm1
dec qword [rsp + 0x1e8]
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x1af], rax
cmp byte [rsp + 0x57], 0
je 0x14008de6c
mov rcx, qword [rsp + 0x1d8]
test rcx, rcx
je 0x140090583
mov rax, qword [rsp + 0x1e0]
test rax, rax
je 0x140090583
mov rdx, qword [rcx + 0x3d8]
mov qword [rsp + 0x1d8], rdx
dec rax
mov qword [rsp + 0x1e0], rax
and qword [rdx + 0x160], 0
mov edx, 8
call fcn.1400107b0
cmp sil, 2
jne 0x14008de8f
mov byte [rsp + 0xb8], 2
mov rcx, rbp
call fcn.14007cfec
mov rdi, qword [rsp + 0x230]
jmp 0x14008da03
movaps xmm0, xmmword [rsp + 0x130]
movaps xmm1, xmmword [rsp + 0x140]
movaps xmm2, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x3b0], xmm2
movaps xmmword [rsp + 0x3a0], xmm1
movaps xmmword [rsp + 0x390], xmm0
mov byte [rsp + 0x3c0], sil
mov rax, qword [rsp + 0x1af]
mov qword [r12 + 0x38], rax
movaps xmm0, xmmword [rsp + 0x190]
movaps xmm1, xmmword [rsp + 0x1a0]
movups xmmword [r12 + 0x29], xmm1
movups xmmword [r12 + 0x19], xmm0
movups xmm0, xmmword [r12 + 0x20]
mov rax, qword [r12 + 0x30]
mov rcx, qword [r12 + 0x38]
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rcx
mov rcx, r13
call fcn.140087160
jmp 0x14008de7a
mov rbx, qword [rsp + 0x1d8]
mov r14, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x1e8]
mov ecx, 4
call fcn.1400862c7
mov dword [rax], 0x48544150
lea r8, [rsp + 0xa0]
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov qword [r8 + 0x10], 4
mov byte [r8 + 0x18], 0
lea rcx, [rsp + 0x390]
mov rdx, r8
call fcn.14008c6e2
test rbx, rbx
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x268], r14
je 0x14008dfc8
mov r9, qword [rsp + 0x390]
mov rax, qword [rsp + 0x3a0]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call fcn.140087da0
cmp qword [rdi], 0
mov r12, qword [rsp + 0x68]
je 0x14008dfd1
xor esi, esi
jmp 0x14008dfee
xor esi, esi
mov r12, qword [rsp + 0x68]
jmp 0x14008dfee
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb8]
shl rcx, 5
mov rsi, qword [rax + rcx]
mov rbp, qword [rax + rcx + 0x10]
lea rcx, [rsp + 0x390]
call fcn.140087160
mov rdx, qword [rsp + 0x80]
mov r15, qword [rdx + 0x30]
mov r14, qword [rdx + 0x40]
mov qword [rsp + 0x270], r15
mov qword [rsp + 0x278], r14
lea r13, str.program_path_has_no_file_name
test r14, r14
je 0x14008e834
lea r8, str.__UNC._
mov r9d, 4
mov rcx, r15
mov rdx, r14
call fcn.140081855
lea rcx, [0x14008c77e]
lea rdx, [0x14008c785]
test al, al
cmovne rdx, rcx
mov cl, byte [r14 + r15 - 1]
call rdx
test al, al
jne 0x14008e834
cmp r14, 4
mov qword [rsp + 0x58], rbx
jae 0x14008e078
xor eax, eax
jmp 0x14008e106
lea rdx, [r14 + r15]
add rdx, 0xfffffffffffffffc
mov qword [rsp + 0x20], 4
lea r9, str..exeprogram_not_found
lea rdi, [rsp + 0x390]
mov r8d, 4
mov rcx, rdi
call fcn.140087436
mov rcx, qword [rdi + 0x28]
mov r9, qword [rdi + 0x20]
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r9, rcx
setae al
jae 0x14008e0f1
mov r10b, byte [rdx + r9]
mov r11b, byte [r8 + r9]
inc r9
lea edi, [r10 - 0x41]
cmp dil, 0x1a
setb bl
shl bl, 5
or bl, r10b
lea r10d, [r11 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
or r10b, r11b
cmp bl, r10b
je 0x14008e0b5
mov r15, qword [rsp + 0x270]
mov r14, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x58]
lea rcx, [r15 + r14]
xor edx, edx
cmp r14, rdx
je 0x14008e141
movzx r8d, byte [r15 + rdx]
cmp r8d, 0x5c
je 0x14008e125
inc rdx
cmp r8d, 0x2f
jne 0x14008e10c
test al, al
je 0x14008e183
lea rcx, [rsp + 0x240]
mov rdx, r15
mov r8, r14
call fcn.14008c801
jmp 0x14008e3f6
lea rdi, [rsp + 0x390]
mov qword [rdi], r15
mov qword [rdi + 8], rcx
and word [rdi + 0x10], 0
mov rcx, rdi
call fcn.140084842
cmp ax, 1
jne 0x14008e168
test dx, dx
jne 0x14008e155
cmp ax, 1
jne 0x14008e296
lea r13, str.h_r_
mov rbx, qword [rsp + 0x58]
jmp 0x14008e834
mov rcx, r14
call fcn.1400862c7
mov rdi, rax
mov rbx, rdx
mov rcx, rax
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], r14
mov byte [rsp + 0xb8], 0
mov rax, qword [rsp + 0xb0]
mov cl, byte [rsp + 0xb8]
mov edx, dword [rsp + 0xb9]
movzx r8d, word [rsp + 0xbd]
mov r9b, byte [rsp + 0xbf]
lea rdi, [rsp + 0x390]
mov qword [rdi + 0x10], rax
mov byte [rdi + 0x18], cl
mov dword [rdi + 0x19], edx
mov word [rdi + 0x1d], r8w
mov byte [rdi + 0x1f], r9b
mov rax, qword [rsp + 0xa0]
mov qword [rdi], rax
mov rax, qword [rsp + 0xa8]
mov qword [rdi + 8], rax
lea rdx, str..exeprogram_not_found
mov r8d, 4
mov rcx, rdi
call fcn.14008ac81
movaps xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
mov rdi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb0]
lea rbx, [rsp + 0x390]
mov rcx, rbx
mov rdx, rdi
call fcn.14008c794
cmp qword [rbx], 0
je 0x14008e3b0
mov rax, qword [rsp + 0x3a0]
mov qword [rsp + 0x250], rax
movups xmm0, xmmword [rsp + 0x390]
movaps xmmword [rsp + 0x240], xmm0
jmp 0x14008e3e1
mov qword [rsp + 0x68], r12
mov rcx, r15
mov rdx, r14
mov r8b, 0x2e
call fcn.14008ccc9
mov byte [rsp + 0x290], al
test rsi, rsi
je 0x14008eba9
add rbp, rsi
lea r14, [rsp + 0x130]
mov qword [r14], rsi
mov qword [r14 + 8], rbp
and word [r14 + 0x10], 0
mov byte [r14 + 0x18], 1
lea r13, [rsp + 0xb9]
lea rbp, [rsp + 0x3a9]
lea r15, [rsp + 0x390]
lea rbx, [rsp + 0x270]
lea rdi, [rsp + 0xa0]
mov rcx, r15
mov rdx, r14
call fcn.14008abde
mov al, byte [rsp + 0x3a8]
cmp al, 2
je 0x14008eb9c
cmp qword [rsp + 0x3a0], 0
je 0x14008e396
mov rcx, qword [rsp + 0x3a0]
mov qword [rsp + 0xb0], rcx
movups xmm0, xmmword [rsp + 0x390]
movaps xmmword [rsp + 0xa0], xmm0
mov ecx, dword [rbp]
mov edx, dword [rbp + 3]
mov dword [r13 + 3], edx
mov dword [r13], ecx
mov byte [rsp + 0xb8], al
mov rcx, r15
mov rdx, rbx
lea r8, [rsp + 0x290]
mov r9, rdi
call fcn.14008cce9
mov rsi, qword [rsp + 0x390]
mov r12, qword [rsp + 0x398]
test rsi, rsi
jne 0x14008ee9e
xor ecx, ecx
mov rdx, r12
call fcn.14008cd4a
jmp 0x14008e2fe
mov rcx, qword [rsp + 0x390]
mov rdx, qword [rsp + 0x398]
call fcn.140010c6f
jmp 0x14008e2fe
lea rdx, [0x1400fb828]
lea rbx, [rsp + 0xa0]
mov rcx, rbx
xor r8d, r8d
call fcn.14008c2f3
mov rdi, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x240]
mov rdx, rdi
call fcn.14008c801
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0xa8]
mov rcx, rdi
call fcn.140010c6f
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x240]
test r8, r8
je 0x14008e508
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x128], rax
mov r9, qword [rsp + 0x250]
cmp r9, 4
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r12
jbe 0x14008e44d
cmp word [r8 + r9*2 - 0xa], 0x2e
jne 0x14008e44d
cmp word [r8 + r9*2 - 2], 0
je 0x14008ee6f
mov r15, qword [rdx + 0x30]
mov r14, qword [rdx + 0x90]
mov bl, byte [rdx + 0xc5]
mov r12, qword [rdx + 0x40]
add r12, r15
imul rsi, qword [rdx + 0xa0], 0x28
lea rdi, [rsp + 0xa0]
mov qword [rdi], 2
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
mov rcx, rdi
mov dx, 0x22
call fcn.14008a076
lea rdx, [rsp + 0x390]
mov qword [rdx], r15
mov qword [rdx + 8], r12
and word [rdx + 0x10], 0
mov rcx, rdi
call fcn.140089fa0
mov rcx, rdi
mov dx, 0x22
call fcn.14008a076
test rsi, rsi
je 0x14008e515
lea r15, [r14 + 0x28]
mov rcx, rdi
mov dx, 0x20
call fcn.14008a076
mov rcx, rdi
mov rdx, r14
mov r8d, ebx
call fcn.14008cd73
add rsi, 0xffffffffffffffd8
mov r14, r15
test rax, rax
je 0x14008e4b7
mov r13, rax
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
call fcn.140085aa1
mov rbx, qword [rsp + 0x58]
jmp 0x14008e81a
mov r13, qword [rsp + 0x248]
jmp 0x14008e834
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
test rax, rax
mov rbx, qword [rsp + 0x58]
je 0x14008e817
mov rdx, qword [rsp + 0xb0]
mov cl, 1
mov dword [rsp + 0x9c], ecx
mov dword [rsp + 0x1d4], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x128]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x290]
mov qword [rcx], rax
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rdx
xor ebp, ebp
xor edx, edx
call fcn.14008a076
mov rdx, qword [rsp + 0x80]
cmp byte [rdx + 0xc4], 0
mov eax, 0x400
mov ecx, 0x608
cmove ecx, eax
or ecx, dword [rdx + 0xc0]
mov dword [rsp + 0x260], ecx
mov eax, 2
mov qword [rsp + 0x90], rax
mov r12d, 2
mov r14d, 0
cmp byte [rsp + 0x88], 0
jne 0x14008eedc
mov qword [rsp + 0x190], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x198], xmm0
mov rsi, qword [rsp + 0x120]
test rsi, rsi
jne 0x14008e605
lea rcx, [rsp + 0x190]
xor edx, edx
call fcn.14008a076
xor eax, eax
test rbx, rbx
setne al
cmove rsi, rbx
lea rdx, [rsp + 0x390]
mov qword [rdx], rax
and qword [rdx + 8], 0
mov qword [rdx + 0x10], rbx
mov rcx, qword [rsp + 0x268]
mov qword [rdx + 0x18], rcx
mov qword [rdx + 0x20], rax
and qword [rdx + 0x28], 0
mov qword [rdx + 0x30], rbx
mov qword [rdx + 0x38], rcx
mov qword [rdx + 0x40], rsi
lea rbp, [rsp + 0xb9]
lea r12, [rsp + 0xa0]
lea r14, [rsp + 0x130]
lea rdi, [rsp + 0x190]
mov rcx, r12
lea rdx, [rsp + 0x390]
call fcn.140085897
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x14008eeab
mov rdx, qword [rsp + 0xb0]
imul r8, rdx, 0x38
mov cl, byte [rax + r8 + 0x198]
cmp cl, 2
je 0x14008eeab
add r8, rax
add r8, 0x168
mov rsi, qword [r8]
mov r9, qword [r8 + 8]
mov qword [rsp + 0x88], r9
mov rbx, qword [r8 + 0x10]
shl rdx, 5
lea r9, [rax + rdx]
mov r15, qword [rax + rdx]
mov rax, qword [rax + rdx + 8]
mov qword [rsp + 0x58], rax
mov rax, qword [r8 + 0x28]
mov qword [rsp + 0xb0], rax
movups xmm0, xmmword [r8 + 0x18]
movaps xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0xb8], cl
mov eax, dword [r8 + 0x31]
mov ecx, dword [r8 + 0x34]
mov dword [rbp + 3], ecx
mov dword [rbp], eax
movups xmm0, xmmword [r9 + 0x10]
movaps xmmword [rsp + 0x240], xmm0
mov rcx, r14
mov rdx, r12
call fcn.14008ced7
cmp byte [rsp + 0x148], 2
mov r13, qword [rsp + 0x130]
je 0x14008f227
mov rdx, qword [rsp + 0x138]
mov rcx, r13
call fcn.140010c6f
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.140085a5f
mov rcx, rsi
mov rdx, qword [rsp + 0x88]
call fcn.140085aa1
mov rcx, rdi
mov dx, 0x3d
call fcn.14008a076
mov qword [rsp + 0xa0], r15
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0x240]
mov rbx, rbp
movups xmmword [rbp - 9], xmm0
mov r15, r14
mov rcx, r14
mov rsi, r12
mov rdx, r12
call fcn.14008ced7
cmp byte [rsp + 0x148], 2
mov r13, qword [rsp + 0x130]
je 0x14008f244
mov r14, qword [rsp + 0x138]
mov rax, qword [rsp + 0x140]
add rax, r13
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], rax
and word [rsp + 0x200], 0
mov rcx, rdi
lea rdx, [rsp + 0x1f0]
call fcn.140089fa0
mov rcx, r13
mov rdx, r14
call fcn.140010c6f
mov rcx, rdi
xor edx, edx
call fcn.14008a076
mov rbp, rbx
mov r12, rsi
mov r14, r15
jmp 0x14008e666
mov r13, r14
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rcx, rdi
mov rdx, qword [rsp + 0x128]
call fcn.140085aa1
mov r14d, 2
cmp byte [rsp + 0x88], 0
jne 0x14008e8ae
test rbx, rbx
je 0x14008e892
and qword [rsp + 0x398], 0
mov qword [rsp + 0x3a0], rbx
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x3a8], rax
and qword [rsp + 0x3b8], 0
mov qword [rsp + 0x3c0], rbx
mov qword [rsp + 0x3c8], rax
mov eax, 1
mov rdx, qword [rsp + 0x120]
jmp 0x14008e896
xor eax, eax
xor edx, edx
lea rcx, [rsp + 0x390]
mov qword [rcx], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x40], rdx
call fcn.1400895fb
mov ecx, dword [rsp + 0x2e0]
mov rdx, qword [rsp + 0x2e8]
call fcn.14008d330
cmp r14, 2
je 0x14008f08b
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x318], rax
movaps xmm0, xmmword [rsp + 0x340]
movaps xmm1, xmmword [rsp + 0x350]
movups xmmword [rsp + 0x308], xmm1
movups xmmword [rsp + 0x2f8], xmm0
mov rdx, qword [rsp + 0x2f8]
and qword [rsp + 0x2f0], 0
mov rcx, r14
call fcn.14008d371
mov rcx, qword [rsp + 0x300]
and qword [rsp + 0x300], 0
mov rbx, qword [rsp + 0x308]
mov rax, qword [rsp + 0x310]
and qword [rsp + 0x310], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x198], xmm0
movups xmmword [rsp + 0x1f8], xmm0
mov edx, 1
mov qword [rsp + 0x190], rdx
mov qword [rsp + 0x1f0], rdx
mov rdi, qword [rsp + 0x318]
test rcx, rcx
je 0x14008ea0a
test rax, rax
je 0x14008ea45
lea r14, [rsp + 0x390]
lea r8, [rsp + 0x190]
mov rcx, r14
mov rdx, rbx
call fcn.14009058e
mov rax, qword [r14]
cmp rax, 3
je 0x140090573
lea rbx, [rsp + 0x390]
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x140], xmm0
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rcx
lea r8, [rsp + 0x1f0]
mov rcx, rbx
mov rdx, rdi
call fcn.14009058e
mov rax, qword [rbx]
cmp rax, 3
jne 0x14008ea80
mov rdi, qword [rsp + 0x398]
jmp 0x14008ef32
test rax, rax
je 0x14008ef48
lea rdx, [rsp + 0x390]
mov qword [rdx], rdi
lea rbx, [rsp + 0xa0]
lea r8, [rsp + 0x1f0]
mov rcx, rbx
call fcn.14008c506
cmp qword [rbx], 0
jne 0x140090583
mov rcx, rdi
jmp 0x14008ea75
lea rdx, [rsp + 0x390]
mov qword [rdx], rbx
lea rdi, [rsp + 0xa0]
lea r8, [rsp + 0x190]
mov rcx, rdi
call fcn.14008c506
cmp qword [rdi], 0
jne 0x140090583
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x14008ef48
lea rdi, [rsp + 0x390]
mov rcx, qword [rdi + 8]
movups xmm0, xmmword [rdi + 0x20]
lea rbx, [rsp + 0xa0]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx], rax
mov qword [rbx + 8], rcx
lea r14, [rsp + 0x130]
mov rax, qword [r14 + 0x28]
mov rcx, qword [rbx + 0x28]
lea r15, [rsp + 0x340]
mov qword [r15], rax
mov qword [r15 + 8], rcx
mov rbp, qword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov ecx, 2
mov rdx, r15
xor r8d, r8d
mov r9d, 0xffffffff
call rbp
cmp eax, 1
je 0x14008eb31
test eax, eax
jne 0x14008ef1d
mov rcx, rdi
mov rdx, r14
call fcn.140090614
cmp byte [rsp + 0x390], 0
jne 0x14008eb7d
cmp byte [rsp + 0x391], 0
je 0x14008eb8a
mov rcx, rdi
mov rdx, r14
call fcn.1400906d7
cmp byte [rsp + 0x390], 0
jne 0x14008eb7d
cmp byte [rsp + 0x391], 0
jne 0x14008ead1
jmp 0x14008eb8a
mov rcx, rdi
mov rdx, rbx
call fcn.140090614
cmp byte [rsp + 0x390], 0
jne 0x14008eb7d
cmp byte [rsp + 0x391], 0
je 0x14008eb73
mov rcx, rdi
mov rdx, rbx
call fcn.1400906d7
cmp byte [rsp + 0x390], 0
jne 0x14008eb7d
cmp byte [rsp + 0x391], 0
jne 0x14008ead1
lea rcx, [rsp + 0x130]
jmp 0x14008eb92
mov rdi, qword [rsp + 0x398]
jmp 0x14008ef25
lea rcx, [rsp + 0xa0]
call fcn.14009081c
jmp 0x14008ef22
lea rcx, [rsp + 0x390]
call fcn.14007cfec
lea rax, [rsp + 0xa0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov r14d, 2
xor r15d, r15d
mov ebx, 0xffffffff
xor esi, esi
cmp r8, 0x201
jae 0x14008ebf1
lea r13, [rsp + 0x390]
mov r12d, 0x200
mov rbp, r8
jmp 0x14008ec31
sub r8, rsi
lea rcx, [rsp + 0xa0]
mov rdx, r8
call fcn.140084968
mov r14, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
cmp r15, rbx
mov esi, 0xffffffff
cmovb rsi, r15
mov qword [rsp + 0xb0], rsi
mov r13, r14
mov r12, rsi
mov rbp, rsi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
xor ecx, ecx
mov rdx, r13
mov r8d, ebp
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov edi, eax
test eax, eax
jne 0x14008ec57
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14008ecb1
mov r8d, edi
cmp rbp, r8
jne 0x14008ec8a
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140090583
add rbp, rbp
mov eax, 0xffffffff
cmp rbp, rax
mov ebx, 0xffffffff
cmovae rbp, rax
mov r8, rbp
jmp 0x14008ebd5
jb 0x14008ebd5
cmp r12, r8
jb 0x140090583
lea rdi, [rsp + 0x190]
mov rcx, rdi
mov rdx, r13
call fcn.140085ad0
mov bl, byte [rdi + 0x18]
jmp 0x14008ecc8
call fcn.14003f61f
mov qword [rsp + 0x190], rax
mov byte [rsp + 0x1a8], 2
mov bl, 2
mov rcx, r14
mov rdx, r15
call fcn.140085aa1
cmp bl, 2
jne 0x14008ecea
lea rcx, [rsp + 0x190]
call fcn.140085ab7
jmp 0x14008f4a8
mov rbx, qword [rsp + 0x190]
mov r12, qword [rsp + 0x198]
mov r14, qword [rsp + 0x1a0]
lea rdi, [rsp + 0x130]
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call fcn.140085c54
lea r15, [rsp + 0x1f0]
mov rcx, r15
mov rdx, rdi
call fcn.140087251
mov al, byte [r15]
cmp al, 0xa
je 0x14008f441
add al, 0xfa
cmp al, 3
ja 0x14008f441
movzx eax, al
dec rax
cmp rax, 2
ja 0x14008f441
mov rsi, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
mov al, byte [rsp + 0x140]
cmp al, 6
je 0x14008ed9b
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x3af], rcx
movups xmm0, xmmword [rsp + 0x141]
movups xmm1, xmmword [rsp + 0x151]
movaps xmmword [rsp + 0x3a0], xmm1
movaps xmmword [rsp + 0x390], xmm0
mov cl, byte [rsp + 0x16a]
mov dl, byte [rsp + 0x168]
mov bpl, byte [rsp + 0x169]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r13
mov byte [rsp + 0xb0], al
movaps xmm0, xmmword [rsp + 0x390]
movaps xmm1, xmmword [rsp + 0x3a0]
movups xmmword [rsp + 0xb1], xmm0
movups xmmword [rsp + 0xc1], xmm1
mov rax, qword [rsp + 0x3af]
mov qword [rsp + 0xd0], rax
mov byte [rsp + 0xda], cl
mov byte [rsp + 0xd8], dl
mov byte [rsp + 0xd9], bpl
cmp dl, 2
jne 0x14008f3ea
lea rdi, [rsp + 0x390]
lea r15, [rsp + 0xa0]
test r13, r13
je 0x14008f3ea
mov rcx, rdi
mov rdx, r15
call fcn.140084f83
cmp byte [rsp + 0x398], 0xa
jne 0x14008f3ea
mov rax, qword [rsp + 0x390]
sub r13, rax
jb 0x140090583
add rsi, rax
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r13
jmp 0x14008ee27
movzx eax, word [r8 + r9*2 - 8]
cmp eax, 0x42
je 0x14008f27f
cmp eax, 0x43
je 0x14008f2a5
cmp eax, 0x62
je 0x14008f27f
cmp eax, 0x63
je 0x14008f2a5
jmp 0x14008e44d
mov rdi, qword [rsp + 0x3a0]
jmp 0x14008f5ee
lea rcx, [rsp + 0x390]
call fcn.1400895fb
lea rsi, [rsp + 0x190]
mov rcx, rsi
xor edx, edx
call fcn.14008a076
mov r12, qword [rsi]
mov rbp, qword [rsi + 8]
mov r14, r12
mov rdx, qword [rsp + 0x80]
xor eax, eax
cmp byte [rdx + 0x88], 2
mov r15d, 0
je 0x14008f0fc
lea rcx, [rdx + 0x70]
mov rdi, rdx
call fcn.14008cf56
mov r13, rdx
test rax, rax
je 0x14008f0b1
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
jmp 0x14009051a
call fcn.14003f61f
mov rdi, rax
lea rcx, [rsp + 0xa0]
call fcn.140090871
lea rcx, [rsp + 0x130]
call fcn.140090871
test rdi, rdi
jne 0x140090583
mov rcx, r13
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x14008ef94
call fcn.14003f61f
mov rdi, rax
mov rcx, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x1f8]
call fcn.140010c6f
mov rcx, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x198]
call fcn.140010c6f
xor r14d, r14d
jmp 0x14008f01b
lea rdx, [rsp + 0x390]
and dword [rdx], 0
mov rcx, r13
call qword [sym.imp.kernel32.dll_GetExitCodeProcess]
test eax, eax
je 0x14008ef5a
mov ebx, dword [rsp + 0x390]
mov r14, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x198]
mov r15, qword [rsp + 0x1a0]
movups xmm0, xmmword [rsp + 0x1f0]
movups xmmword [rsp + 0x394], xmm0
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x3a4], rax
movups xmm0, xmmword [rsp + 0x390]
movaps xmmword [rsp + 0x320], xmm0
mov rax, qword [rsp + 0x39c]
mov qword [rsp + 0x32c], rax
mov rax, qword [rsp + 0x3a4]
mov qword [rsp + 0x334], rax
lea rcx, [rsp + 0x2f0]
call fcn.14008d33e
mov rcx, r13
mov rdx, rsi
call case.0x14007c078.86
test r14, r14
je 0x14008f088
movups xmm0, xmmword [rsp + 0x32c]
movups xmmword [rsp + 0x37c], xmm0
movaps xmm0, xmmword [rsp + 0x320]
movaps xmmword [rsp + 0x370], xmm0
mov rax, qword [rsp + 0x384]
mov qword [r12 + 0x28], rax
movups xmm0, xmmword [rsp + 0x374]
movups xmmword [r12 + 0x18], xmm0
mov qword [r12], r14
mov qword [r12 + 8], rdi
mov qword [r12 + 0x10], r15
mov dword [r12 + 0x30], ebx
jmp 0x14008f095
mov r13, rdi
mov qword [r12 + 8], r13
and qword [r12], 0
movaps xmm6, xmmword [rsp + 0x790]
add rsp, 0x7a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [r13]
mov rcx, qword [r13 + 0x10]
add rcx, rax
lea rdx, [rsp + 0x390]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
and word [rdx + 0x10], 0
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.14008cfae
mov rcx, rsi
xor edx, edx
call fcn.14008a076
mov r15, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x90], r15
mov rdx, rdi
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x88], rbp
xorps xmm0, xmm0
movaps xmmword [rsp + 0x270], xmm0
and qword [rsp + 0x280], 0
mov rbp, rdx
lea rdx, [0x140101390]
lea rcx, [rsp + 0x240]
call fcn.14008aba0
lea r8, [rsp + 0x1f0]
and qword [r8], 0
and qword [r8 + 0x10], 0
and qword [r8 + 0x20], 0
lea rcx, [rsp + 0x2c8]
mov dword [rcx], 2
mov edi, dword [rbp + 0x10]
cmp dword [rbp], 6
cmovne rcx, rbp
cmp dword [rbp + 0x20], 6
lea rsi, [rbp + 0x20]
lea rbx, [rsp + 0x2e0]
cmove rsi, rbx
mov edx, 0xfffffff6
call case.0x140086a58.15
mov r13, rdx
test rax, rax
je 0x14008f1c2
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x120]
jmp 0x1400904dc
lea r8, [rsp + 0x200]
lea rcx, [rbp + 0x10]
cmp edi, 6
cmove rcx, rbx
mov edx, 0xfffffff5
call case.0x140086a58.15
mov rbx, rdx
test rax, rax
mov qword [rsp + 0x268], r13
je 0x14008f951
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
mov r13, rbx
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x120]
jmp 0x1400904ce
mov rcx, r15
mov rdx, qword [rsp + 0x58]
call fcn.140010c6f
mov rcx, rsi
mov rdx, qword [rsp + 0x88]
call fcn.140085aa1
mov r12, qword [rsp + 0x68]
lea rcx, [rsp + 0x390]
call fcn.1400895fb
mov rcx, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x198]
call fcn.140085aa1
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
jmp 0x14009052a
movzx ecx, word [r8 + r9*2 - 6]
or ecx, 0x20
cmp ecx, 0x61
jne 0x14008f29b
movzx ecx, word [r8 + r9*2 - 4]
or ecx, 0x20
cmp ecx, 0x74
je 0x14008f2ca
cmp ax, 0x43
jne 0x14008e44d
movzx eax, word [r8 + r9*2 - 6]
or eax, 0x20
cmp eax, 0x6d
jne 0x14008e44d
movzx eax, word [r8 + r9*2 - 4]
add eax, 0xffffffbc
test ax, 0xffdf
jne 0x14008e44d
mov qword [rsp + 0x90], r9
lea rax, [rsp + 0xa0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov ebx, 0x200
mov r15d, 2
xor ebp, ebp
mov r13d, 0xffffffff
xor r12d, r12d
cmp rbx, 0x201
jae 0x14008f319
lea r14, [rsp + 0x390]
mov esi, 0x200
mov rdi, rbx
jmp 0x14008f35a
sub rbx, r12
lea rcx, [rsp + 0xa0]
mov rdx, rbx
call fcn.140084968
mov r15, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
cmp rbp, r13
mov r12d, 0xffffffff
cmovb r12, rbp
mov qword [rsp + 0xb0], r12
mov r14, r15
mov rsi, r12
mov rdi, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r14
mov edx, edi
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov ebx, eax
test eax, eax
jne 0x14008f381
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14008f9c7
mov ebx, ebx
cmp rdi, rbx
jne 0x14008f3a9
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140090583
add rdi, rdi
cmp rdi, r13
cmovae rdi, r13
mov rbx, rdi
jmp 0x14008f2fe
jb 0x14008f2fe
cmp rsi, rbx
jb 0x140090583
mov rcx, rbx
call fcn.1400848a1
mov rsi, rax
mov r13, rdx
lea r8, [rbx + rbx]
mov rcx, rax
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r15, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
jmp 0x14008f9d1
cmp bpl, 2
jne 0x14008f43a
lea rdi, [rsp + 0xa0]
lea r15, [rsp + 0x390]
mov rcx, rdi
call fcn.140086025
cmp r13, rax
jbe 0x14008f43a
mov rcx, r15
mov rdx, rdi
call fcn.14008605e
cmp byte [rsp + 0x398], 0xa
jne 0x14008f43a
sub r13, qword [rsp + 0x390]
jb 0x140090583
mov qword [rsp + 0xa8], r13
jmp 0x14008f400
cmp r14, r13
cmovae r14, r13
lea r9, [rsp + 0x390]
mov qword [r9], rbx
mov qword [r9 + 8], r12
mov qword [r9 + 0x10], r14
mov rax, qword [rsp + 0x1a8]
mov qword [r9 + 0x18], rax
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0x270]
lea r8, [rsp + 0x290]
mov rcx, rdi
call fcn.14008cce9
mov rsi, qword [rdi]
mov r12, qword [rdi + 8]
test rsi, rsi
mov rax, qword [rsp + 0x68]
je 0x14008f49e
mov rdi, qword [rsp + 0xb0]
jmp 0x14008f777
xor ecx, ecx
mov rdx, r12
call fcn.14008cd4a
lea rax, [rsp + 0x1f0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov r14d, 2
xor ebx, ebx
mov esi, 0xffffffff
xor r15d, r15d
cmp r8, 0x201
jae 0x14008f4f0
lea r12, [rsp + 0x390]
mov r13d, 0x200
mov rdi, r8
jmp 0x14008f531
sub r8, r15
lea rcx, [rsp + 0x1f0]
mov rdx, r8
call fcn.140084968
mov r14, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x1f8]
cmp rbx, rsi
mov r15d, 0xffffffff
cmovb r15, rbx
mov qword [rsp + 0x200], r15
mov r12, r14
mov r13, r15
mov rdi, r15
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r12
mov edx, edi
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov ebp, eax
test eax, eax
jne 0x14008f558
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14008f5f8
mov r8d, ebp
cmp rdi, r8
jne 0x14008f581
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140090583
add rdi, rdi
cmp rdi, rsi
cmovae rdi, rsi
mov r8, rdi
jmp 0x14008f4d4
jb 0x14008f4d4
cmp r13, r8
jb 0x140090583
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov rdx, r12
call fcn.140085ad0
lea r15, [rsp + 0x138]
lea rdx, [rsp + 0x270]
lea r8, [rsp + 0x290]
mov rcx, r15
mov r9, rdi
call fcn.14008cce9
and qword [r15 - 8], 0
mov rcx, r14
mov rdx, rbx
call fcn.140085aa1
mov rsi, qword [r15]
test rsi, rsi
je 0x14008f61c
mov r12, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rax, qword [rsp + 0x68]
jmp 0x14008f777
call fcn.14003f61f
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x130], 1
mov rcx, r14
mov rdx, rbx
call fcn.140085aa1
lea rcx, [rsp + 0x130]
call fcn.14008cd54
lea rax, [rsp + 0x1f0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov r14d, 2
xor ebx, ebx
mov esi, 0xffffffff
xor r15d, r15d
cmp r8, 0x201
jae 0x14008f671
lea r12, [rsp + 0x390]
mov r13d, 0x200
mov rdi, r8
jmp 0x14008f6b2
sub r8, r15
lea rcx, [rsp + 0x1f0]
mov rdx, r8
call fcn.140084968
mov r14, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x1f8]
cmp rbx, rsi
mov r15d, 0xffffffff
cmovb r15, rbx
mov qword [rsp + 0x200], r15
mov r12, r14
mov r13, r15
mov rdi, r15
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r12
mov edx, edi
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov ebp, eax
test eax, eax
jne 0x14008f6d9
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14008f7a4
mov r8d, ebp
cmp rdi, r8
jne 0x14008f702
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140090583
add rdi, rdi
cmp rdi, rsi
cmovae rdi, rsi
mov r8, rdi
jmp 0x14008f655
jb 0x14008f655
cmp r13, r8
jb 0x140090583
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov rdx, r12
call fcn.140085ad0
lea r15, [rsp + 0x138]
lea rdx, [rsp + 0x270]
lea r8, [rsp + 0x290]
mov rcx, r15
mov r9, rdi
call fcn.14008cce9
and qword [r15 - 8], 0
mov rcx, r14
mov rdx, rbx
call fcn.140085aa1
mov rsi, qword [r15]
test rsi, rsi
mov r12, qword [rsp + 0x68]
je 0x14008f7cd
mov rax, r12
mov r12, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], r12
mov qword [rsp + 0x250], rdi
mov rdx, qword [rsp + 0x80]
mov r12, rax
jmp 0x14008e3fe
call fcn.14003f61f
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x130], 1
mov rcx, r14
mov rdx, rbx
call fcn.140085aa1
mov r12, qword [rsp + 0x68]
lea rcx, [rsp + 0x130]
call fcn.14008cd54
lea rdx, [0x1400d7791]
lea rdi, [rsp + 0x1f0]
mov r8d, 4
mov rcx, rdi
call fcn.14008a761
cmp byte [rdi + 0x18], 2
je 0x14008f93e
mov rcx, qword [rsp + 0x1f0]
mov rax, qword [rsp + 0x200]
add rax, rcx
lea r15, [rsp + 0x130]
mov qword [rsp + 0x60], rcx
mov qword [r15], rcx
mov qword [r15 + 8], rax
and word [r15 + 0x10], 0
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x128], rax
mov byte [r15 + 0x18], 1
lea rbx, [rsp + 0xb9]
lea rbp, [rsp + 0x3a9]
lea r13, [rsp + 0x390]
lea rdi, [rsp + 0x290]
lea r14, [rsp + 0xa0]
mov rcx, r13
mov rdx, r15
call fcn.14008abde
mov al, byte [rsp + 0x3a8]
cmp al, 2
je 0x14008f91a
cmp qword [rsp + 0x3a0], 0
je 0x14008f900
mov rcx, qword [rsp + 0x3a0]
mov qword [rsp + 0xb0], rcx
movups xmm0, xmmword [rsp + 0x390]
movaps xmmword [rsp + 0xa0], xmm0
mov ecx, dword [rbp]
mov edx, dword [rbp + 3]
mov dword [rbx + 3], edx
mov dword [rbx], ecx
mov byte [rsp + 0xb8], al
mov rcx, r13
lea rdx, [rsp + 0x270]
mov r8, rdi
mov r9, r14
call fcn.14008cce9
mov rsi, qword [rsp + 0x390]
mov r12, qword [rsp + 0x398]
test rsi, rsi
jne 0x14008f9a8
xor ecx, ecx
mov rdx, r12
call fcn.14008cd4a
jmp 0x14008f86b
mov rcx, qword [rsp + 0x390]
mov rdx, qword [rsp + 0x398]
call fcn.140010c6f
jmp 0x14008f86b
lea rcx, [rsp + 0x390]
call fcn.14007cfec
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x128]
call fcn.140010c6f
mov r12, qword [rsp + 0x68]
xor ecx, ecx
call fcn.14008cd4a
lea r13, [0x1400d7db8]
jmp 0x14008e179
lea r8, [rsp + 0x210]
mov rcx, rsi
mov edx, 0xfffffff4
call case.0x140086a58.15
test rax, rax
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x88]
mov qword [rsp + 0x2c0], rbx
je 0x14008fcf7
mov qword [rsp + 0x118], rdx
mov r15, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x90]
mov r12, qword [rsp + 0x58]
jmp 0x1400904b0
mov rdi, qword [rsp + 0x3a0]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x128]
call fcn.140010c6f
jmp 0x14008f5ee
call fcn.14003f61f
mov r13, rax
xor esi, esi
mov rdi, qword [rsp + 0x60]
mov rcx, r15
mov rdx, rbp
call fcn.140085aa1
test rsi, rsi
je 0x14008fced
lea r14, [rsp + 0x130]
mov qword [r14], rsi
mov qword [r14 + 8], r13
mov qword [r14 + 0x10], rbx
mov eax, 1
lea r13, [rsp + 0x3b0]
mov qword [r13 - 0x20], rax
and qword [r13 - 0x18], 0
mov qword [r13 - 0x10], rax
and word [r13 - 8], 0
lea rax, [0x1400d7e0e]
mov qword [r13], rax
lea rcx, [0x1400d7e16]
mov qword [r13 + 8], rcx
and word [r13 + 0x10], 0
mov edi, 3
mov rdx, qword [rsp + 0x80]
test rax, rax
je 0x14008fa75
mov rcx, r13
call fcn.1400852e3
test ax, ax
je 0x14008fa64
mov ebp, edx
mov rdx, qword [rsp + 0x80]
jmp 0x14008faae
and qword [rsp + 0x3b0], 0
mov rdx, qword [rsp + 0x80]
cmp qword [rsp + 0x390], 0
je 0x14008fb7c
mov rax, qword [rsp + 0x398]
cmp qword [rsp + 0x3a0], rax
je 0x14008fb7c
lea rcx, [rax + 1]
mov qword [rsp + 0x398], rcx
movzx ebp, word [rsp + rax*2 + 0x3a8]
cmp rbx, qword [rsp + 0x138]
jne 0x14008fb60
mov rcx, qword [rsp + 0x390]
mov rdx, qword [rsp + 0x3b0]
test rdx, rdx
je 0x14008fb20
mov rax, qword [rsp + 0x3b8]
sub rax, rdx
movzx r8d, word [rsp + 0x3c0]
add rax, 2
xor edx, edx
div rdi
cmp r8w, 1
sbb rax, 0xffffffffffffffff
test rcx, rcx
je 0x14008fb39
mov rdx, qword [rsp + 0x3a0]
sub rdx, qword [rsp + 0x398]
mov rcx, 0xffffffffffffffff
add rax, rdx
jb 0x14008fb1b
mov rcx, rax
mov rax, rcx
jmp 0x14008fb39
test rcx, rcx
je 0x14008fb37
mov rax, qword [rsp + 0x3a0]
sub rax, qword [rsp + 0x398]
jmp 0x14008fb39
xor eax, eax
mov rdx, 0xffffffffffffffff
inc rax
je 0x14008fb48
mov rdx, rax
mov rcx, r14
call fcn.140084968
mov rsi, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x80]
mov word [rsi + rbx*2], bp
inc rbx
mov qword [rsp + 0x140], rbx
mov rax, qword [rsp + 0x3b0]
jmp 0x14008fa46
mov rsi, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
test rsi, rsi
je 0x14008fe2a
mov rbx, qword [rdx + 0x90]
mov rbp, qword [rdx + 0xa0]
mov al, byte [rdx + 0xc5]
mov byte [rsp + 0x9c], al
test al, al
setne byte [rsp + 0x70]
lea rax, str.cmd.exe__d__c__
lea rcx, [rsp + 0x130]
mov qword [rcx], rax
lea rax, [0x1400d7b09]
mov qword [rcx + 8], rax
and word [rcx + 0x10], 0
call fcn.1400852e3
test ax, ax
je 0x14008fe3e
mov r14d, edx
mov qword [rsp + 0x260], rbp
mov qword [rsp + 0x78], rsi
mov rax, qword [rsp + 0x138]
sub rax, qword [rsp + 0x130]
movzx ecx, word [rsp + 0x140]
add rax, 2
mov r8d, 3
xor edx, edx
div r8
cmp cx, 1
sbb rax, 0xffffffffffffffff
cmp rax, 4
mov esi, 3
cmovb rax, r8
lea rcx, [rax + 1]
call fcn.1400848a1
mov rdi, rax
mov word [rax], r14w
lea r14, [rsp + 0xa0]
mov qword [r14], rax
mov qword [r14 + 8], rdx
mov qword [r14 + 0x10], 1
mov rax, qword [rsp + 0x140]
lea r15, [rsp + 0x390]
mov qword [r15 + 0x10], rax
movups xmm0, xmmword [rsp + 0x130]
movaps xmmword [r15], xmm0
mov r12d, 1
mov rcx, r15
call fcn.1400852e3
cmp ax, 1
jne 0x14008fdfb
mov ebp, edx
cmp r12, qword [rsp + 0xa8]
jne 0x14008fcdb
mov rax, qword [rsp + 0x398]
sub rax, qword [rsp + 0x390]
movzx ecx, word [rsp + 0x3a0]
add rax, 2
xor edx, edx
div rsi
cmp cx, 1
sbb rax, 0xffffffffffffffff
lea rdx, [rax + 1]
mov rcx, r14
call fcn.140084968
mov rdi, qword [rsp + 0xa0]
mov word [rdi + r12*2], bp
inc r12
mov qword [rsp + 0xb0], r12
jmp 0x14008fc80
mov r12, qword [rsp + 0x68]
jmp 0x14008ffc7
xorps xmm0, xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xf8], xmm0
test rdx, rdx
jne 0x14008fd39
test rbx, rbx
jne 0x14008fd39
test r13, r13
je 0x14008fd5c
mov dword [rsp + 0xdc], 0x100
mov qword [rsp + 0xf0], r13
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], rdx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x14008ffd1
and qword [rsp + 0x1d8], 0
mov dword [rsp + 0xa0], 0x70
mov rax, rcx
shr rax, 0x20
jne 0x14008ffec
mov qword [rsp + 0x118], rdx
mov rdx, rcx
lea rsi, [rsp + 0x1d8]
xor ecx, ecx
mov qword [rsp + 0x2b8], rdx
xor r8d, r8d
mov r9, rsi
call qword [sym.imp.kernel32.dll_InitializeProcThreadAttributeList]
mov rsi, qword [rsi]
test rsi, rsi
je 0x14009005e
js 0x140090587
mov rdi, rsi
not rdi
shr rdi, 0x3f
mov rcx, rdi
mov rdx, rsi
call fcn.140084a40
test rax, rax
jne 0x140090063
mov rcx, rdi
mov rdx, rsi
call fcn.1400a2916
ud2
movups xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x1f0], xmm0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x200], rax
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x260]
jmp 0x14008fe55
mov r12, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
jmp 0x14008e824
mov qword [rsp + 0x1f0], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f8], xmm0
lea rcx, [rsp + 0x1f0]
mov dx, 0x22
call fcn.14008a076
mov r15, qword [rsp + 0x90]
lea rax, [r15 + r15]
xor ecx, ecx
lea r14, str._f_r_
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
cmp rax, rcx
je 0x14008fe9a
cmp word [rdi + rcx], 0x22
lea rcx, [rcx + 2]
jne 0x14008fe85
jmp 0x14008ffa4
cmp word [rdi + r15*2 - 2], 0x5c
je 0x14008ffa4
mov qword [rsp + 0x78], rsi
lea rsi, [r15 - 1]
lea rcx, [rdi + r15*2]
add rcx, 0xfffffffffffffffe
lea r8, [0x1400d7b0a]
mov edx, 1
mov r9d, 1
call fcn.140087477
xor edx, edx
test al, al
cmovne rdx, rdi
test rdx, rdx
cmove rdx, rdi
cmove rsi, r15
lea r8, [rdx + rsi*2]
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call fcn.140085a54
mov rcx, rsi
mov dx, 0x22
call fcn.14008a076
imul rsi, rbp, 0x28
add rsi, rbx
lea r15, str._t_____________
cmp rbx, rsi
je 0x14009000f
lea rcx, [rsp + 0x1f0]
mov dx, 0x20
call fcn.14008a076
mov dil, byte [rsp + 0x70]
cmp byte [rsp + 0x9c], 0
jne 0x14008ff6f
cmp qword [rbx], 0
mov dil, byte [rsp + 0x70]
jne 0x14008ff6f
mov r14, qword [rbx + 8]
mov r12, qword [rbx + 0x18]
xor ebp, ebp
cmp r12, rbp
setne dil
je 0x14008ff6f
mov r8b, byte [r14 + rbp]
mov edx, 0x16
mov rcx, r15
call fcn.14008ccc9
inc rbp
test al, al
je 0x14008ff4e
lea r12, [rbx + 0x28]
lea rcx, [rsp + 0x1f0]
mov rdx, rbx
mov r8d, edi
call fcn.14008cd73
mov rbx, r12
test rax, rax
mov r12, qword [rsp + 0x68]
je 0x14008ff10
mov r14, rax
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x1f8]
call fcn.140085aa1
mov rcx, rsi
mov rdx, r13
call fcn.140085aa1
mov r13, r14
mov rbx, qword [rsp + 0x58]
jmp 0x14008e824
mov qword [rsp + 0x118], rdx
lea rax, [rsp + 0xa0]
mov dword [rax], 0x68
jmp 0x14009029e
lea rsi, [0x1400d7e48]
mov r15, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x90]
mov r12, qword [rsp + 0x58]
jmp 0x14009049f
lea rdi, [rsp + 0x1f0]
mov rcx, rdi
mov dx, 0x22
call fcn.14008a076
mov rax, qword [rdi]
mov r14, qword [rdi + 8]
test rax, rax
je 0x140090447
mov rdx, qword [rsp + 0x200]
mov cl, 1
mov dword [rsp + 0x1d4], ecx
mov dword [rsp + 0x9c], 0
mov qword [rsp + 0x70], r13
mov rbx, qword [rsp + 0x58]
jmp 0x14008e566
mov eax, 1
cmp rsi, 1
mov rcx, rsi
adc rcx, 0
test rsi, rsi
cmove rcx, rsi
mov qword [rsp + 0x2b0], rcx
lea r9, [rsp + 0x1d8]
mov qword [rsp + 0x1c8], rax
mov rcx, rax
mov rsi, qword [rsp + 0x2b8]
mov edx, esi
xor r8d, r8d
call qword [sym.imp.kernel32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x140090438
mov rdx, qword [rsp + 0x80]
mov rax, qword [rdx + 0xa8]
xor ebx, ebx
test rax, rax
setne bl
mov rcx, rsi
cmove rcx, rax
mov r8, rsi
lea rsi, [rsp + 0x138]
mov qword [rsi - 8], rbx
and qword [rsi], 0
mov rdx, qword [rdx + 0xb0]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rbx
and qword [rsi + 0x20], 0
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rdx
mov qword [rsi + 0x38], rcx
xorps xmm6, xmm6
mov rax, r8
test rax, rax
je 0x140090264
dec rax
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x170]
test rax, rax
je 0x140090264
dec rax
mov qword [rsp + 0x170], rax
mov rdi, qword [rsp + 0x138]
test rbx, rbx
je 0x14009017b
test rdi, rdi
jne 0x14009017b
mov rdx, qword [rsp + 0x140]
mov r8, qword [rsp + 0x148]
mov rcx, rsi
call fcn.140004b20
mov qword [rsp + 0x130], 1
mov ebx, 1
mov rdi, qword [rsp + 0x138]
jmp 0x140090184
test rbx, rbx
je 0x140090583
mov r8, qword [rsp + 0x140]
mov rbp, qword [rsp + 0x148]
movzx eax, word [rdi + 0x16a]
cmp rbp, rax
jb 0x1400901bb
mov rax, qword [rdi]
test rax, rax
je 0x140090583
inc r8
movzx ebp, word [rdi + 0x168]
mov rdi, rax
jmp 0x140090194
test r8, r8
je 0x1400901da
mov rdx, qword [rdi + rbp*8 + 0x178]
dec r8
lea rcx, [rsp + 0x190]
call fcn.140004b20
jmp 0x1400901f7
lea rax, [rbp + 1]
mov qword [rsp + 0x190], rdi
and qword [rsp + 0x198], 0
mov qword [rsp + 0x1a0], rax
imul rax, rbp, 0x18
mov rcx, qword [rsp + 0x1a0]
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0x190]
mov qword [rsi], rcx
mov rcx, qword [rsp + 0x198]
mov qword [rsi + 8], rcx
mov r8, qword [rdi + rbp*8 + 8]
mov r9, qword [rdi + rax + 0x60]
mov rax, qword [rdi + rax + 0x70]
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x1c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x140090456
mov rax, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x88]
jmp 0x140090106
or dword [rsp + 0x260], 0x80000
lea rax, [rsp + 0x390]
lea rsi, [rsp + 0xa0]
mov ecx, 0xd
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [rsp + 0x1c8]
mov qword [rax + 0x68], rcx
mov rcx, qword [rsp + 0x2b8]
mov rdi, rcx
mov rsi, qword [rsp + 0x290]
lea rcx, [rsp + 0x270]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r14
mov eax, dword [rsp + 0x260]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov r15, qword [rsp + 0x78]
mov rcx, r15
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x14009040f
mov rbp, rsi
mov r12, r13
mov r13, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x278]
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x360], rax
mov r14, qword [rsp + 0x1f0]
movups xmm0, xmmword [rsp + 0x1f8]
movaps xmmword [rsp + 0x340], xmm0
movups xmm0, xmmword [rsp + 0x208]
movaps xmmword [rsp + 0x350], xmm0
test rdi, rdi
je 0x14009035f
mov rcx, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x2b0]
call fcn.14008d2fb
mov rbx, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x118]
call rbx
mov rcx, qword [rsp + 0x2c0]
call rbx
mov rcx, r12
call rbx
mov rdx, qword [rsp + 0x2d0]
mov ecx, 2
call fcn.14008d330
mov rcx, qword [rsp + 0x248]
mov dl, byte [rsp + 0x250]
call fcn.14003f644
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x120]
call fcn.140085aa1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x88]
call fcn.140085aa1
mov rdx, qword [rsp + 0x298]
mov rcx, rbp
call fcn.140085aa1
mov rcx, r15
mov rdx, qword [rsp + 0x70]
call fcn.140085aa1
cmp byte [rsp + 0x1d4], 0
je 0x140090405
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x128]
call fcn.140085aa1
mov r12, qword [rsp + 0x68]
jmp 0x14008e8ae
call fcn.14003f61f
mov rsi, rax
test rdi, rdi
je 0x140090431
mov rcx, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x2b0]
call fcn.14008d2fb
mov rdi, qword [rsp + 0x60]
jmp 0x140090485
call fcn.14003f61f
mov rsi, rax
mov rdi, qword [rsp + 0x60]
jmp 0x14009046b
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
jmp 0x14008ffb9
call fcn.14003f61f
mov rsi, rax
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x2b0]
call fcn.14008d2fb
mov r15, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x90]
mov r12, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x118]
mov rcx, rdx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rsp + 0x118], rsi
mov rsi, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x2c0]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov r13, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rdx, qword [rsp + 0x2d0]
mov ecx, 2
call fcn.14008d330
lea rcx, [rsp + 0x1f0]
call fcn.14008d33e
mov rcx, qword [rsp + 0x248]
mov dl, byte [rsp + 0x250]
call fcn.14003f644
mov rcx, r14
mov rdx, rsi
call fcn.140085aa1
mov rcx, r12
mov rdx, rbp
call fcn.140085aa1
mov r12, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x290]
mov rdx, qword [rsp + 0x298]
call fcn.140085aa1
mov rcx, r15
mov rdx, rbx
call fcn.140085aa1
mov r14d, 2
cmp byte [rsp + 0x9c], 0
jne 0x14008e8ae
mov rcx, rdi
mov rdx, qword [rsp + 0x128]
call fcn.140085aa1
jmp 0x14008e8ae
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x140090583
call fcn.14003f61f
ud2
call fcn.140010a13
ud2