Function at 0x1800f52a0
Capabilities:
Create process on windows
Delete file
Execute command

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x778]
sub rsp, 0x838
lea rcx, [rbp + 0x780]
movaps xmmword [rax - 0x58], xmm7
mov dword [rbp + 0x780], 0x433c0000
mov dword [rbp + 0x784], 0x42a40000
call fcn.18010ac44
lea rax, [0x18009f4f8]
mov dword [rbp + 0x788], 0x44064000
xor r12d, r12d
mov dword [rbp + 0x78c], 0x43bf0000
cmp byte [0x18028e44f], r12b
lea rcx, [0x18009f510]
lea rdx, [rbp + 0x788]
cmovne rcx, rax
call fcn.180104d28
mov rcx, qword [0x18028e880]
lea esi, [r12 + 1]
mov rax, qword [rcx + 0x3eb8]
movss xmm2, dword [rax + 0xe4]
movss xmm0, dword [rax + 0x18]
movss xmm3, dword [rax + 0x64]
subss xmm2, xmm0
addss xmm3, dword [0x1800a12d0]
mov byte [rax + 0x98], sil
mov rax, qword [rcx + 0x3eb8]
movss xmm1, dword [rax + 0x18]
subss xmm1, dword [rax + 0x64]
mov byte [rax + 0x125], sil
addss xmm1, xmm2
addss xmm1, xmm3
movss dword [rax + 0xe4], xmm1
call fcn.18010af14
mov rcx, qword [0x18028e880]
lea rdx, [rbp + 0x790]
movabs rdi, 0x90f0c0bd3a4df788
mov rax, qword [rcx + 0x3eb8]
mov byte [rax + 0x98], sil
mov rax, qword [rcx + 0x3eb8]
movabs rcx, 0x901b38c319be968a
movss xmm0, dword [rax + 0x20]
movss xmm7, dword [rax + 0x24]
movabs rax, 0x4366c2b9e1c29828
subss xmm0, dword [0x1800a1328]
mulss xmm7, dword [0x1800a1144]
movss dword [rbp + 0x790], xmm0
movss dword [rbp + 0x794], xmm7
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xc0], rax
movabs rax, 0xfc99a8fe4e2e92e4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xc8], rax
movabs rax, 0x639887661408acf9
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x40], rcx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xd8], rax
movabs rax, 0x2635a5d087acf76b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1e0], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x639887661408ac9d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0xc0]
mov qword [rbp + 0x1f0], rax
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0xc0]
movdqa xmm1, xmmword [rbp + 0xd0]
xorps xmm0, xmmword [rbp + 0x1e0]
mov qword [rbp + 0x1f8], rax
xorps xmm1, xmmword [rbp + 0x1f0]
movdqa xmmword [rbp + 0xd0], xmm1
movdqa xmmword [rbp + 0xc0], xmm0
call fcn.18010488c
xorps xmm0, xmm0
mov qword [rbp - 0x70], r12
lea r8d, [r12 + 0x10]
mov qword [rbp - 0x68], r12
lea rdx, [0x18009df10]
lea rcx, [rbp - 0x80]
movups xmmword [rbp - 0x80], xmm0
call fcn.1800aada0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x200]
call fcn.1800fade4
cmp qword [rbp + 0x218], 7
lea rcx, [rbp + 0x200]
lea r8d, [r12 + 3]
cmova rcx, qword [rbp + 0x200]
lea rdx, [rbp + 0x290]
or r9d, 0xffffffff
call fcn.18012d110
mov r8d, eax
test eax, eax
jne 0x1800f557c
mov edx, dword [rbp + 0x2a0]
mov ecx, edx
shr ecx, 0xa
test sil, cl
je 0x1800f5572
cmp dword [rbp + 0x2a4], 0xa000000c
jne 0x1800f555f
lea edx, [rsi + 3]
jmp 0x1800f5594
cmp dword [rbp + 0x2a4], 0xa0000003
jne 0x1800f5572
mov edx, 0xa
jmp 0x1800f5594
shr edx, 4
and edx, esi
add edx, 2
jmp 0x1800f5594
sub eax, 2
je 0x1800f5592
sub eax, esi
je 0x1800f5592
sub eax, 0x32
je 0x1800f5592
mov edx, r12d
cmp eax, 0x46
jne 0x1800f5594
mov edx, esi
mov dword [rbp - 0x60], r8d
lea rax, [0x180275a08]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
test edx, edx
je 0x1800f56e0
cmp edx, esi
mov dword [rbp - 0x60], r12d
mov qword [rbp - 0x58], rax
setne bl
lea rcx, [rbp + 0x200]
call fcn.1800f9078
or r14, 0xffffffffffffffff
lea rdx, [rbp - 0x80]
mov r13d, 0xf
mov r15d, 0x1000
test bl, bl
je 0x1800f5ef1
lea rcx, [rbp + 0x2b0]
call fcn.1800fade4
xorps xmm0, xmm0
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
call fcn.1800faa84
test eax, eax
jne 0x1800f67e2
lea rcx, [rbp + 0x2b0]
call fcn.1800f9078
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x1800f5636
lock add dword [rbx + 8], esi
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
test rbx, rbx
je 0x1800f5644
lock add dword [rbx + 8], esi
movaps xmm0, xmmword [rsp + 0x70]
lea rcx, [rbp + 0x270]
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x270], xmm0
movdqu xmmword [rbp + 0x310], xmm1
call fcn.1800d8768
test r15, r15
je 0x1800f5a90
lea rcx, [r15 + 0x20]
lea rdx, [rbp - 0x30]
call fcn.1800fa664
cmp qword [rbp - 0x18], r13
lea rsi, [rbp - 0x30]
mov rdi, qword [rbp - 0x20]
cmova rsi, qword [rbp - 0x30]
test rdi, rdi
je 0x1800f570b
xor edx, edx
lea rcx, [rbp + 0x3d0]
mov r8d, pe_nt_image_headers64
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x18009f9bc]
mov edx, 1
movzx eax, byte [rcx]
add rcx, rdx
mov byte [rbp + rax + 0x3d0], dl
lea rax, [0x18009f9be]
cmp rcx, rax
jne 0x1800f56b4
lea rax, [rdi - 1]
mov rcx, r14
cmp rax, r14
cmovb rcx, rax
add rcx, rsi
jmp 0x1800f56f9
mov bl, r12b
test r8d, r8d
jne 0x1800f67d1
jmp 0x1800f55c1
cmp rcx, rsi
je 0x1800f570b
sub rcx, rdx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x3d0], r12b
je 0x1800f56f1
sub rcx, rsi
jmp 0x1800f570e
mov rcx, r14
inc rcx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
cmp rdi, rcx
jb 0x1800f6800
sub rdi, rcx
lea rdx, [rbp - 0x30]
cmp rdi, r14
mov r8, r14
cmovb r8, rdi
cmp qword [rbp - 0x18], r13
cmova rdx, qword [rbp - 0x30]
add rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.1800aada0
cmp qword [rsp + 0x60], r13
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
cmova rcx, qword [rsp + 0x48]
test rdx, rdx
je 0x1800f579c
lea rax, [rdx - 1]
mov r8, r14
cmp rax, r14
cmovb r8, rax
add r8, rcx
cmp byte [r8], 0x2e
je 0x1800f5797
mov eax, 1
cmp r8, rcx
je 0x1800f579c
sub r8, rax
cmp byte [r8], 0x2e
jne 0x1800f5789
sub r8, rcx
jmp 0x1800f579f
mov r8, r14
cmp rdx, r8
mov qword [rbp + 0xf0], r12
xorps xmm0, xmm0
mov qword [rbp + 0xf8], r12
cmovb r8, rdx
lea rcx, [rbp + 0xe0]
cmp qword [rsp + 0x60], r13
lea rdx, [rsp + 0x48]
movups xmmword [rbp + 0xe0], xmm0
cmova rdx, qword [rsp + 0x48]
call fcn.1800aada0
mov rdx, qword [rsp + 0x60]
cmp rdx, r13
jbe 0x1800f5816
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f5811
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f5a89
call fcn.18012d4cc
movups xmm1, xmmword [rbp + 0xf0]
mov rsi, qword [0x1802c4940]
mov r14b, r12b
movups xmm0, xmmword [rbp + 0xe0]
mov rdi, qword [0x1802c4948]
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r13
mov byte [rbp + 0xe0], r12b
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm1
cmp rsi, rdi
je 0x1800f590e
mov rdx, rsi
lea rcx, [rbp + 0x2d0]
call fcn.1800aac34
cmp qword [rsp + 0x60], r13
lea rdx, [rsp + 0x48]
mov r10, qword [rbp + 0x2e8]
lea rax, [rbp + 0x2d0]
cmova rdx, qword [rsp + 0x48]
mov r11d, 1
mov rcx, qword [rbp + 0x2d0]
cmp r10, r13
cmova rax, rcx
sub rdx, rax
movzx r9d, byte [rax]
movzx r8d, byte [rax + rdx]
sub r9d, r8d
jne 0x1800f58b7
add rax, r11
test r8d, r8d
jne 0x1800f58a1
test r9d, r9d
movzx r14d, r14b
cmove r14d, r11d
cmp r10, r13
jbe 0x1800f58f5
lea rdx, [r10 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f58f0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f5a89
call fcn.18012d4cc
add rsi, 0x20
cmp rsi, rdi
jne 0x1800f585d
test r14b, r14b
jne 0x1800f593b
mov rdi, qword [0x1802c4948]
cmp rdi, qword [0x1802c4950]
je 0x1800f592e
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1800aac34
add qword [0x1802c4948], 0x20
jmp 0x1800f593b
lea r8, [rsp + 0x48]
mov rdx, rdi
call fcn.1800fc7b8
mov rdx, qword [rsp + 0x60]
cmp rdx, r13
jbe 0x1800f5977
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f5972
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f5a89
call fcn.18012d4cc
mov rdx, qword [rbp - 0x18]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x48], r12b
cmp rdx, r13
jbe 0x1800f59c0
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f59bb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f5a89
call fcn.18012d4cc
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r13
mov byte [rbp - 0x30], r12b
mov rcx, qword [r15 + 0x40]
lea rdx, [rbp + 0x4d0]
call fcn.18012d05c
cmp eax, 0x12
je 0x1800f5a27
test eax, eax
jne 0x1800f67f8
cmp word [rbp + 0x4fc], 0x2e
jne 0x1800f5a0f
movzx eax, word [rbp + 0x4fe]
test ax, ax
je 0x1800f59cc
cmp ax, 0x2e
jne 0x1800f5a0f
cmp word [rbp + 0x500], r12w
je 0x1800f59cc
lea rdx, [rbp + 0x4d0]
mov rcx, r15
call fcn.1800d860c
or r14, 0xffffffffffffffff
jmp 0x1800f5668
mov rdi, rbx
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], rbx
mov r15, r12
mov rbx, r12
mov r14, 0xffffffffffffffff
test rdi, rdi
je 0x1800f5668
or r14, r14
mov eax, r14d
lock xadd dword [rdi + 8], eax
add eax, r14d
jne 0x1800f5668
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, r14d
lock xadd dword [rdi + 0xc], eax
add eax, r14d
jne 0x1800f5668
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
jmp 0x1800f5668
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x1800f5ac0
mov eax, r14d
lock xadd dword [rbx + 8], eax
add eax, r14d
jne 0x1800f5ac0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1800f5ac0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1800f5afc
mov eax, r14d
lock xadd dword [rcx + 8], eax
add eax, r14d
jne 0x1800f5afc
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
add eax, r14d
jne 0x1800f5afc
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [0x18028e880]
mov esi, 1
or dword [rax + 0x3f70], esi
mov dword [rax + 0x3f74], 0x43020000
mov rdi, qword [0x1802c4940]
mov r15, qword [0x1802c4948]
cmp rdi, r15
je 0x1800f5c76
and dword [rbp + 0x798], r12d
and dword [rbp + 0x79c], r12d
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.1800aac34
cmp qword [0x18028d9c8], r13
lea rdx, str.None
mov r8, qword [rbp - 0x40]
lea rcx, [rbp - 0x50]
cmova rdx, qword [str.None]
cmp qword [rbp - 0x38], r13
cmova rcx, qword [rbp - 0x50]
cmp r8, qword [0x18028d9c0]
jne 0x1800f5b85
call sub.VCRUNTIME140.dll_memcmp
mov r14b, sil
test eax, eax
je 0x1800f5b88
mov r14b, r12b
cmp qword [rbp - 0x38], r13
lea rcx, [rbp - 0x50]
lea r9, [rbp + 0x798]
mov dl, r14b
cmova rcx, qword [rbp - 0x50]
call fcn.1801278ac
test al, al
je 0x1800f5c21
cmp qword [rbp - 0x38], r13
lea r9, [rbp - 0x50]
mov rsi, qword [rbp - 0x40]
mov rax, qword [0x18028d9c8]
cmova r9, qword [rbp - 0x50]
cmp rsi, rax
ja 0x1800f5bf2
cmp rax, r13
mov qword [0x18028d9c0], rsi
lea rbx, str.None
mov r8, rsi
cmova rbx, qword [str.None]
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], r12b
jmp 0x1800f5c01
mov rdx, rsi
lea rcx, str.None
call fcn.1800fb584
lea rdx, str.None
lea rcx, [rbp + 0x390]
call fcn.1800aac34
mov rdx, rax
call fcn.1800d8ed0
mov esi, 1
test r14b, r14b
je 0x1800f5c2b
call fcn.180109bd4
mov rdx, qword [rbp - 0x38]
cmp rdx, r13
jbe 0x1800f5c65
mov rcx, qword [rbp - 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f5c60
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f5eea
call fcn.18012d4cc
add rdi, 0x20
cmp rdi, r15
jne 0x1800f5b3d
or r14, 0xffffffffffffffff
mov r15d, 0x1000
movabs rdi, 0x90f0c0bd3a4df788
call fcn.180104d74
mov rcx, qword [0x18028e880]
movabs rbx, 0x2635a5d087acf76b
or dword [rcx + 0x3f70], esi
mov rax, qword [rcx + 0x3eb8]
mov dword [rcx + 0x3f74], 0xbf800000
mov byte [rax + 0x98], sil
mov rax, qword [rcx + 0x3eb8]
lea rcx, [rbp + 0x40]
movss xmm0, dword [rax + 0x1c]
subss xmm0, dword [rax + 0x68]
movss xmm1, dword [rax + 0x18]
subss xmm1, dword [rax + 0x64]
mov byte [rax + 0x125], sil
addss xmm0, xmm7
addss xmm1, dword [0x1800a1300]
addss xmm0, dword [0x1800a1384]
movss dword [rax + 0xe4], xmm1
movss dword [rax + 0xe8], xmm0
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x160], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x168], rax
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x40], xmm0
call fcn.18011fb28
mov rcx, qword [0x18028e880]
lea rdx, [rbp + 0x18]
and dword [rbp + 0x18], r12d
and dword [rbp + 0x1c], r12d
mov rax, qword [rcx + 0x3eb8]
mov byte [rax + 0x98], sil
mov rax, qword [rcx + 0x3eb8]
lea rcx, [rbp + 0x50]
movss xmm0, dword [rax + 0x1c]
subss xmm0, dword [rax + 0x68]
movss xmm1, dword [rax + 0x18]
subss xmm1, dword [rax + 0x64]
mov byte [rax + 0x125], sil
addss xmm0, xmm7
addss xmm1, dword [0x1800a1300]
addss xmm0, dword [0x1800a1390]
movss dword [rax + 0xe4], xmm1
movss dword [rax + 0xe8], xmm0
movabs rax, 0x6815c0a4e6c98528
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x50], rax
movabs rax, 0x90f0c0bd3a4d80ed
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x170], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x50]
mov qword [rbp + 0x178], rax
xorps xmm0, xmmword [rbp + 0x170]
movdqa xmmword [rbp + 0x50], xmm0
call fcn.18011ccb0
test al, al
je 0x1800f5f63
xorps xmm0, xmm0
lea rdx, [0x18028e4e0]
xorps xmm1, xmm1
mov r8, r14
movups xmmword [rbp + 0x110], xmm0
movdqu xmmword [rbp + 0x120], xmm1
inc r8
cmp byte [rdx + r8], r12b
jne 0x1800f5e52
lea rcx, [rbp + 0x110]
call fcn.1800aada0
cmp qword [rbp - 0x68], r13
lea r8, [rbp - 0x80]
mov r9, qword [rbp - 0x70]
lea rcx, [rbp + 0x110]
cmova r8, qword [rbp - 0x80]
call fcn.1800fbdac
lea rdx, [rbp + 0x2f0]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
movups xmmword [rbp + 0x2f0], xmm0
mov qword [rax + 0x18], r13
movups xmmword [rbp + 0x300], xmm1
mov byte [rax], r12b
call fcn.1800d87a8
mov rdx, qword [rbp + 0x128]
cmp rdx, r13
jbe 0x1800f5f3b
mov rcx, qword [rbp + 0x110]
inc rdx
mov rax, rcx
cmp rdx, r15
jb 0x1800f5f36
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800f5f36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp + 0x220]
call fcn.1800fade4
cmp qword [rbp + 0x238], 7
lea rcx, [rbp + 0x220]
cmova rcx, qword [rbp + 0x220]
call fcn.18012cfe4
shr rax, 0x20
test eax, eax
jne 0x1800f6806
lea rcx, [rbp + 0x220]
call fcn.1800f9078
jmp 0x1800f5c86
call fcn.18012d4cc
movdqa xmm0, xmmword [0x1800a1510]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], r12b
movups xmmword [0x18028e4e0], xmm1
movups xmmword [0x18028e4f0], xmm1
movss xmm1, dword [0x1800a1490]
call fcn.18010abd8
and dword [rbp - 0x10], r12d
lea rdx, [rbp - 0x10]
and dword [rbp - 0xc], r12d
lea rcx, [rbp + 0x60]
movabs rax, 0x6515c0a4e2c0922f
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x60], rax
movabs rax, 0x90f0c0da532b99e7
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x180], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x60]
mov qword [rbp + 0x188], rax
xorps xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x60], xmm0
call fcn.18011ccb0
test al, al
je 0x1800f6270
movabs rax, 0x2635a5d087f8a345
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x78], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x150], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x70]
mov rcx, qword [0x18028d9c0]
mov qword [rbp + 0x158], rax
movabs rax, 0x7fffffffffffffff
movdqa xmm0, xmmword [rbp + 0x150]
sub rax, rdx
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x70], xmm0
cmp rax, rcx
jb 0x1800f67cb
cmp qword [rbp - 0x68], r13
lea r9, [rbp - 0x80]
mov qword [rsp + 0x30], rcx
lea rax, str.None
cmova r9, qword [rbp - 0x80]
lea rcx, [rbp + 0x240]
cmp qword [0x18028d9c8], r13
cmova rax, qword [str.None]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
call fcn.1800fbc70
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x240]
call fcn.1800f9198
xorps xmm0, xmm0
lea rcx, [rbp + 0x20]
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r13
mov byte [rax], r12b
cmp qword [rbp + 0x38], r13
cmova rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rbp + 0x38]
mov ebx, eax
cmp rdx, r13
jbe 0x1800f6128
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, r15
jb 0x1800f6123
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f616c
call fcn.18012d4cc
mov rdx, qword [rbp + 0x258]
movdqa xmm0, xmmword [0x1800a1510]
mov byte [rbp + 0x20], r12b
movdqu xmmword [rbp + 0x30], xmm0
cmp rdx, r13
jbe 0x1800f6178
mov rcx, qword [rbp + 0x240]
inc rdx
mov rax, rcx
cmp rdx, r15
jb 0x1800f6173
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800f6173
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18012d4cc
movdqa xmm0, xmmword [0x1800a1510]
mov byte [rbp + 0x240], r12b
movdqu xmmword [rbp + 0x250], xmm0
test ebx, ebx
je 0x1800f6266
mov rdi, qword [0x1802c4940]
mov rbx, qword [0x1802c4948]
jmp 0x1800f61e3
cmp qword [0x18028d9c8], r13
lea rdx, str.None
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmova rdx, qword [str.None]
cmp qword [rdi + 0x18], r13
jbe 0x1800f61cd
mov rcx, qword [rdi]
cmp r8, qword [0x18028d9c0]
jne 0x1800f61df
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800f61e8
add rdi, 0x20
cmp rdi, rbx
jne 0x1800f61a7
cmp rdi, rbx
je 0x1800f625c
add rdi, 0x20
cmp rdi, rbx
je 0x1800f6212
lea rcx, [rdi - 0x20]
mov rdx, rdi
call fcn.1800aab74
add rdi, 0x20
cmp rdi, rbx
jne 0x1800f61f6
mov rbx, qword [0x1802c4948]
mov rdx, qword [rbx - 8]
cmp rdx, r13
jbe 0x1800f6248
mov rcx, qword [rbx - 0x20]
inc rdx
cmp rdx, r15
jb 0x1800f6243
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800f679a
mov rcx, r8
call fcn.18012d4cc
mov qword [rbx - 0x10], r12
mov qword [rbx - 8], r13
mov byte [rbx - 0x20], r12b
sub qword [0x1802c4948], 0x20
movabs rdi, 0x90f0c0bd3a4df788
movabs rbx, 0x2635a5d087acf76b
movss xmm1, dword [0x1800a1490]
call fcn.18010abd8
and dword [rbp - 8], r12d
lea rdx, [rbp - 8]
and dword [rbp - 4], r12d
lea rcx, [rbp + 0x80]
movabs rax, 0x485ae6f0e2da9638
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x80], rax
movabs rax, 0x90f0c0bd3a2a9eee
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x88], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x190], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0x198], rax
xorps xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x80], xmm0
call fcn.18011ccb0
test al, al
je 0x1800f6323
lea rdx, str.None
lea rcx, [rbp + 0x3b0]
call fcn.1800aac34
mov rdx, rax
call fcn.1800d8b00
and dword [rbp], r12d
lea rdx, [rbp]
and dword [rbp + 4], r12d
lea rcx, [rbp + 0x90]
movabs rax, 0x4a5ae3f0e9c98724
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x90], rax
movabs rax, 0x90f0c0bd3a3f92ec
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x98], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1a0], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0x90]
mov qword [rbp + 0x1a8], rax
xorps xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x90], xmm0
call fcn.18011ccb0
test al, al
je 0x1800f63bb
lea rcx, [0x18009f9c0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movss xmm1, dword [0x1800a1490]
call fcn.18010abd8
and dword [rbp + 8], r12d
lea rdx, [rbp + 8]
and dword [rbp + 0xc], r12d
lea rcx, [rbp + 0xa0]
movabs rax, 0x6515c1b1e8c0993e
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xa0], rax
movabs rax, 0x90f0c0bd4e2c92e0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov qword [rbp + 0x1b0], rax
mov qword [rsp + 0x40], rdi
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0x1b8], rax
xorps xmm0, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp + 0xa0], xmm0
call fcn.18011ccb0
test al, al
je 0x1800f65f0
mov rax, qword [0x1802afe88]
xorps xmm0, xmm0
mov byte [0x18028e750], sil
movups xmmword [rbp + 0x330], xmm0
movups xmmword [rbp + 0x340], xmm0
movups xmmword [rbp + 0x350], xmm0
test rax, rax
je 0x1800f65f0
mov qword [rax + 0x10], r12
mov rax, qword [0x1802afe88]
movups xmmword [rbp + 0x360], xmm0
movups xmmword [rbp + 0x370], xmm0
mov qword [rax + 0x18], r12
mov eax, r12d
movups xmmword [rbp + 0x380], xmm0
mov qword [0x1802affc0], r12
movups xmmword [0x1802aff90], xmm0
movups xmmword [0x1802affa0], xmm0
movups xmmword [0x1802affb0], xmm0
xchg byte [0x18028f998], al
mov rbx, qword [0x1802afe80]
test rbx, rbx
je 0x1800f6579
mov eax, r12d
lea rcx, [rbx + 0x58]
xchg byte [rbx], al
call qword [sym.imp.MSVCP140.dll__Cnd_broadcast]
cmp dword [rbx + 0xa8], r12d
je 0x1800f6551
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbx + 0xa8], eax
jne 0x1800f6511
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movups xmm0, xmmword [rbx + 0xa0]
xor edx, edx
lea rcx, [rbp + 0x280]
movdqu xmmword [rbp + 0x280], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x1800f653f
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0x320], xmm0
movdqu xmmword [rbx + 0xa0], xmm0
mov rbx, qword [0x1802afe80]
test rbx, rbx
je 0x1800f6572
mov rcx, rbx
call fcn.1800ac2f0
mov edx, 0xb0
mov rcx, rbx
call fcn.18012d4cc
mov qword [0x1802afe80], r12
mov rdi, qword [0x1802afe88]
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x1800f659f
mov eax, dword [rdi + 8]
sub eax, esi
test eax, 0xfffffffd
jne 0x1800f659f
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], r14
mov byte [rbx], r12b
mov dword [rdi + 8], r12d
mov rdi, qword [0x1802afe88]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], r14
mov byte [rbx], r12b
movabs rbx, 0x2635a5d087acf76b
mov qword [rdi], r12
movabs rdi, 0x90f0c0bd3a4df788
mov qword [0x1802afe88], r12
and dword [rbp + 0x10], r12d
lea rdx, [rbp + 0x10]
and dword [rbp + 0x14], r12d
lea rcx, [rbp + 0xb0]
movabs rax, 0x4f7185a4e6c99f28
mov qword [rbp + 0x780], rax
mov rax, qword [rbp + 0x780]
mov qword [rbp + 0xb0], rax
movabs rax, 0x90f0c0d9482294fb
mov qword [rbp + 0x780], rax
mov rax, qword [rbp + 0x780]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x780], rbx
mov rax, qword [rbp + 0x780]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x780], rdi
mov rax, qword [rbp + 0x780]
movdqa xmm0, xmmword [rbp + 0xb0]
mov qword [rbp + 0x1c8], rax
xorps xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0xb0], xmm0
call fcn.18011ccb0
test al, al
je 0x1800f66ac
mov dword [rsp + 0x28], 5
lea r8, [0x18009f9d8]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rax, [0x18009e440]
mov qword [rbp + 0x100], rax
lea rdx, [rbp + 0x1d0]
lea rax, [0x18009fa18]
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x130]
lea rax, [rbp + 0x100]
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x110]
mov qword [rbp + 0x1d8], rax
call fcn.1800f8644
mov rax, qword [rbp + 0x138]
lea r8, [0x18011efe8]
mov r9, qword [rbp + 0x130]
lea rdx, [0x18028e758]
sub rax, r9
lea rcx, [0x18009fa20]
sar rax, 3
mov dword [rsp + 0x20], eax
call fcn.18011f038
mov rcx, qword [rbp + 0x130]
test rcx, rcx
je 0x1800f676d
mov rdx, qword [rbp + 0x140]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, r15
jb 0x1800f6768
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800f6768
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18012d4cc
mov rdx, qword [rbp - 0x68]
cmp rdx, r13
jbe 0x1800f67a6
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, r15
jb 0x1800f67a1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800f67a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18012d4cc
call fcn.18010b03c
movaps xmm7, xmmword [rsp + 0x820]
add rsp, 0x838
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp fcn.180104d74
call fcn.1800aaa74
int3
lea r8, [rbp + 0x200]
lea rdx, [rbp - 0x60]
call fcn.1800d85b4
int3
lea r8, [rbp + 0x2b0]
mov edx, eax
lea rcx, [0x18009dea8]
call fcn.1800d8554
int3
mov edx, eax
call fcn.1800d847c
int3
call fcn.1800aad54
int3
lea r8, [rbp + 0x220]
mov edx, eax
lea rcx, [0x18009def8]
call fcn.1800d8554
int3