Function at 0x14011aca0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x1402d4040]
xor rax, rsp
mov qword [rbp + 0x530], rax
mov rdi, r9
mov r15, r8
mov qword [rsp + 0x70], r8
mov rsi, rdx
mov r13, rcx
mov qword [rbp - 0x50], rcx
mov r12, qword [rbp + 0x5a0]
mov qword [rsp + 0x58], r12
mov r14, qword [rbp + 0x5a8]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
lea rdx, str.Dflt
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14011ad36
mov eax, dword [rbp + 0x5b0]
mov dword [rsp + 0x20], eax
mov r9, r14
mov r8, r12
lea rdx, str.Default
call fcn.140116c00
or byte [r15], al
jmp 0x14011bdd1
lea rdx, str.Replace_With_Str
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14011ae6e
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xor eax, eax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
xor r8d, r8d
lea rdx, [0x140262727]
lea rcx, [rbp + 0x70]
call fcn.140007c30
mov r15, 0xffffffffffffffff
mov dword [rbp + 0x90], r15d
lea rax, [rbp + 0x70]
cmp rax, r14
je 0x14011ade0
mov rdi, qword [r14 + 0x10]
mov r9, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14011ada0
mov r9, qword [r14]
mov rax, qword [rbp + 0x88]
cmp rdi, rax
ja 0x14011add4
lea rbx, [rbp + 0x70]
cmp rax, 0xf
cmova rbx, qword [rbp + 0x70]
mov qword [rbp + 0x80], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x14011ade0
mov rdx, rdi
lea rcx, [rbp + 0x70]
call fcn.140005c70
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, str.Replace_With
mov r8, qword [rsp + 0x70]
mov rcx, r13
call fcn.140119cd0
mov esi, eax
lea rax, [rbp + 0x70]
cmp r14, rax
je 0x14011ae5e
mov rbx, qword [rbp + 0x80]
lea r9, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova r9, qword [rbp + 0x70]
mov rcx, qword [r14 + 0x18]
cmp rbx, rcx
ja 0x14011ae52
mov rdi, r14
cmp rcx, 0xf
jbe 0x14011ae3a
mov rdi, qword [r14]
mov qword [r14 + 0x10], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x14011ae5e
mov rdx, rbx
mov rcx, r14
call fcn.140005c70
nop
lea rcx, [rbp + 0x70]
call fcn.1400050e0
mov eax, esi
jmp 0x14011bdd3
lea rdx, str.fileName
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14011b67d
lea rdx, str.File_Name
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14011b67d
mov eax, dword [rbp + 0x5b0]
cmp eax, 0x5c1c3f3a
ja 0x14011af56
je 0x14011aee8
cmp eax, 0x3a626f6a
ja 0x14011aed6
je 0x14011afe8
cmp eax, 0x898a375
je 0x14011aee8
cmp eax, 0xb0d629b
je 0x14011aee8
cmp eax, 0x2517edd0
jmp 0x14011af7b
cmp eax, 0x48464ac7
je 0x14011aee8
cmp eax, 0x4ab07710
jne 0x14011af81
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14011aef5
mov rdx, qword [r14]
xor r8d, r8d
mov rcx, rdi
call fcn.14009a210
test al, al
je 0x14011b643
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
xor ecx, ecx
mov qword [rbp - 0x40], rcx
mov rsi, qword [r13 + 0x88]
mov rdi, qword [r13 + 0x80]
mov rax, qword [rbp - 0x48]
cmp rdi, rsi
je 0x14011b367
cmp rax, rcx
je 0x14011b33f
mov rdx, rdi
mov rcx, rax
call fcn.140004b20
mov rax, qword [rbp - 0x48]
add rax, 0x20
mov qword [rbp - 0x48], rax
jmp 0x14011b352
cmp eax, 0x83a1fd03
je 0x14011aee8
cmp eax, 0xd247248a
je 0x14011aee8
cmp eax, 0xdf3f4066
je 0x14011afe8
cmp eax, 0xf004b031
je 0x14011aee8
cmp eax, 0xf13f14ad
je 0x14011aee8
test sil, 0x10
je 0x14011afde
mov qword [rsp + 0x70], rbx
mov r9, qword [r14 + 0x18]
mov r8, r14
cmp r9, 0xf
jbe 0x14011af9c
mov r8, qword [r14]
mov qword [rsp + 0x38], r14
lea rax, [0x14011be30]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x4040000
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call fcn.1400a1c20
or byte [r15], al
test r12, r12
je 0x14011bdd1
cmp byte [r12], bl
jmp 0x14011b651
mov eax, 1
jmp 0x14011bdd3
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14011aff5
mov rdx, qword [r14]
xor r8d, r8d
mov rcx, rdi
call fcn.14009a210
test al, al
je 0x14011b643
xor r11d, r11d
mov r9d, r11d
mov dword [rsp + 0x68], r11d
mov r8, qword [r13 + 0xf8]
mov rcx, qword [r13 + 0x100]
sub rcx, r8
movabs rax, 0x6bca1af286bca1b
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
inc rax
add rax, rdx
je 0x14011b335
mov r10d, r11d
mov qword [rsp + 0x78], r11
lea r15, [r11 - 1]
test r9d, r9d
jne 0x14011b062
lea rdx, [0x1402761f0]
jmp 0x14011b076
lea rdx, [r10 - 0x98]
add rdx, r8
cmp qword [rdx + 0x18], 0xf
jbe 0x14011b076
mov rdx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r11
mov qword [rbp + 0x28], r11
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14011b090
lea rcx, [rbp + 0x10]
call fcn.140007c30
nop
lea rdx, [rbp + 0x10]
mov rsi, qword [rbp + 0x10]
mov r12, qword [rbp + 0x28]
cmp r12, 0xf
cmova rdx, rsi
mov r8, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14011b0c9
mov rcx, qword [r14]
mov rdi, qword [rbp + 0x20]
cmp r8, rdi
jne 0x14011b0e0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14011b0e0
mov r13b, 1
jmp 0x14011b0e3
xor r13b, r13b
movabs rax, 0x7fffffffffffffff
sub rax, rdi
cmp rax, 2
jb 0x14011be1e
lea r9, [rbp + 0x10]
cmp r12, 0xf
cmova r9, rsi
mov qword [rsp + 0x30], 2
lea rax, [0x140271b60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea rcx, [rbp - 0x10]
call fcn.140007d30
bts ebx, 0x19
mov dword [rsp + 0x50], ebx
mov qword [rbp - 0x60], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
lea r9, [rbp - 0x60]
xor r8d, r8d
movzx edx, r13b
call fcn.1400ac290
test al, al
je 0x14011b2aa
xorps xmm0, xmm0
cmp dword [rsp + 0x68], 0
jne 0x14011b196
movups xmmword [rbp + 0x30], xmm0
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
xor r8d, r8d
lea rdx, [0x140262727]
lea rcx, [rbp + 0x30]
call fcn.140007c30
lea rdx, [rbp + 0x30]
or ebx, 0x10
jmp 0x14011b277
movups xmmword [rbp + 0x50], xmm0
lea r12, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r12, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x20]
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x14011be18
cmp rsi, 0xf
ja 0x14011b1df
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], recv
movups xmm0, xmmword [r12]
movups xmmword [rbp + 0x50], xmm0
jmp 0x14011b270
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x14011b1fe
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14011b225
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14011b247
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14011be12
mov rcx, rax
call fcn.140244f20
mov rcx, rax
test rax, rax
je 0x14011b329
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14011b255
test rcx, rcx
je 0x14011b253
call fcn.140244f20
jmp 0x14011b255
xor eax, eax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rdi
lea r8, [rsi + 1]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x50]
or ebx, 0x20
mov rcx, r14
call fcn.1400079a0
test bl, 0x20
je 0x14011b291
and ebx, 0xffffffdf
lea rcx, [rbp + 0x50]
call fcn.1400050e0
nop
test bl, 0x10
je 0x14011b2a2
and ebx, 0xffffffef
lea rcx, [rbp + 0x30]
call fcn.1400050e0
mov rax, qword [rsp + 0x70]
mov byte [rax], 1
test r13b, r13b
je 0x14011b2b5
call fcn.140022010
nop
lea rcx, [rbp - 0x10]
call fcn.1400050e0
nop
lea rcx, [rbp + 0x10]
call fcn.1400050e0
mov r9d, dword [rsp + 0x68]
inc r9d
mov dword [rsp + 0x68], r9d
mov r10, qword [rsp + 0x78]
add r10, 0x98
mov qword [rsp + 0x78], r10
mov r13, qword [rbp - 0x50]
mov r8, qword [r13 + 0xf8]
mov rcx, qword [r13 + 0x100]
sub rcx, r8
movabs rax, 0x6bca1af286bca1b
imul rcx
sar rdx, 2
mov rcx, rdx
shr rcx, 0x3f
inc rcx
add rcx, rdx
movsxd rax, r9d
cmp rax, rcx
jae 0x14011b330
xor r11d, r11d
jmp 0x14011b054
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r12, qword [rsp + 0x58]
call fcn.140027280
jmp 0x14011b643
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1401794d0
mov rax, qword [rbp - 0x48]
add rdi, 0x170
cmp rdi, rsi
je 0x14011b367
mov rcx, qword [rbp - 0x40]
jmp 0x14011af31
mov r8, rax
mov rcx, qword [rbp - 0x50]
sub r8, rcx
sar r8, 5
movzx r9d, byte [rsp + 0x60]
mov rdx, rax
call fcn.1401716e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov r8d, 1
lea rdx, [0x1402761f0]
lea rcx, [rbp + 0x10]
call fcn.140007c30
nop
mov r15, qword [rbp - 0x50]
mov rsi, qword [rbp - 0x48]
cmp rsi, qword [rbp - 0x40]
je 0x14011b485
cmp r15, rsi
jne 0x14011b3ea
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [rsi + 0x10], xmm1
movdqa xmm0, xmmword [0x1402a60d0]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
add qword [rbp - 0x48], 0x20
jmp 0x14011b496
lea rax, [rbp - 0x50]
mov qword [rbp + 0x98], rax
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbp + 0xb0], xmm0
movdqa xmm1, xmmword [0x1402a60d0]
movdqu xmmword [rbp + 0x20], xmm1
mov byte [rbp + 0x10], 0
lea rdi, [rsi - 0x20]
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], recv
mov byte [rdi], 0
add qword [rbp - 0x48], 0x20
cmp rdi, r15
je 0x14011b468
nop dword [rax + rax]
sub rdi, 0x20
sub rsi, 0x20
mov rdx, rdi
mov rcx, rsi
call fcn.1400079a0
cmp rdi, r15
jne 0x14011b450
lea rdx, [rbp + 0xa0]
mov rcx, r15
call fcn.1400079a0
lea rcx, [rbp + 0xa0]
call fcn.1400050e0
jmp 0x14011b496
lea r8, [rbp + 0x10]
mov rdx, r15
lea rcx, [rbp - 0x50]
call fcn.1401792f0
nop
lea rcx, [rbp + 0x10]
call fcn.1400050e0
mov rdi, qword [rbp - 0x50]
mov r13, qword [rbp - 0x48]
cmp rdi, r13
je 0x14011b634
mov rsi, qword [rdi + 0x10]
mov rdx, rdi
mov r12, qword [rdi + 0x18]
cmp r12, 0xf
jbe 0x14011b4c4
mov rdx, qword [rdi]
mov r8, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14011b4d5
mov rcx, qword [r14]
cmp r8, rsi
jne 0x14011b4e8
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14011b4e8
mov r15b, 1
jmp 0x14011b4eb
xor r15b, r15b
movabs rax, 0x7fffffffffffffff
sub rax, rsi
cmp rax, 2
jb 0x14011be24
mov r9, rdi
cmp r12, 0xf
jbe 0x14011b50e
mov r9, qword [rdi]
mov qword [rsp + 0x30], 2
lea rax, [0x140271b60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea rcx, [rbp - 0x10]
call fcn.140007d30
bts ebx, 8
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x78], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
lea r9, [rsp + 0x78]
xor r8d, r8d
movzx edx, r15b
call fcn.1400ac290
test al, al
je 0x14011b60e
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14011b576
mov rax, qword [rdi]
cmp qword [rdi + 0x10], 1
jne 0x14011b5c2
cmp byte [rax], 0x20
jne 0x14011b586
xor eax, eax
jmp 0x14011b58b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14011b5c2
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
xor r8d, r8d
lea rdx, [0x140262727]
lea rcx, [rbp + 0x30]
call fcn.140007c30
lea rax, [rbp + 0x30]
or ebx, 0x40
jmp 0x14011b5d3
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.140004b20
nop
bts ebx, 7
mov dword [rsp + 0x50], ebx
mov rdx, rax
mov rcx, r14
call fcn.140154f60
nop
test bl, bl
jns 0x14011b5f5
btr ebx, 7
lea rcx, [rbp - 0x80]
call fcn.1400050e0
nop
test bl, 0x40
je 0x14011b606
and ebx, 0xffffffbf
lea rcx, [rbp + 0x30]
call fcn.1400050e0
mov rax, qword [rsp + 0x70]
mov byte [rax], 1
test r15b, r15b
je 0x14011b619
call fcn.140022010
nop
lea rcx, [rbp - 0x10]
call fcn.1400050e0
add rdi, 0x20
cmp rdi, r13
jne 0x14011b4b0
mov r12, qword [rsp + 0x58]
call fcn.140027280
nop
lea rcx, [rbp - 0x50]
call fcn.1401561d0
test r12, r12
je 0x14011bdd1
cmp byte [r12], 0
je 0x14011bdd1
mov ecx, 0x400
call fcn.1400163c0
test al, al
je 0x14011bdd1
mov rdx, r12
lea rcx, [0x1402641f4]
call fcn.140026740
jmp 0x14011bdd1
mov eax, dword [rbp + 0x5b0]
mov dword [rsp + 0x20], eax
mov r9, r14
xor r8d, r8d
mov rdx, rdi
call fcn.140116c00
or byte [r15], al
test r12, r12
je 0x14011b6c0
cmp byte [r12], bl
je 0x14011b6c0
mov ecx, 0x400
call fcn.1400163c0
test al, al
je 0x14011b6c0
mov rdx, r12
lea rcx, [0x1402641f4]
call fcn.140026740
lea rbx, [r13 + 0x2f0]
mov rdi, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14011b6d5
mov rbx, qword [rbx]
call fcn.140244468
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.140113950
mov esi, 0x600
lea rcx, [rbp - 0x10]
call fcn.140113e90
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140154cb0
nop
lea rcx, [rbp - 0x10]
call fcn.14000d450
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor r15d, r15d
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], recv
mov byte [rbp - 0x30], r15b
mov rdi, qword [r14 + 0x10]
test rdi, rdi
jne 0x14011b7cf
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x50]
call fcn.140113bc0
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x14011b7c1
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14011b793
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011b78e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011b78e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140244f5c
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], recv
mov byte [rbp - 0x30], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
lea rcx, [rbp - 0x80]
call fcn.1400050e0
jmp 0x14011b8cd
mov rbx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x14011b7dc
mov rbx, qword [r14]
call fcn.140244468
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.140113950
mov esi, 0xc0600
mov dword [rsp + 0x50], esi
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140154cb0
mov dword [rsp + 0x50], 0xe0600
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.140113cb0
lea rcx, [rbp - 0x10]
call fcn.140113e90
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.140113bc0
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x14011b8b0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14011b882
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011b87d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011b87d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140244f5c
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], recv
mov byte [rbp - 0x30], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
lea rcx, [rbp - 0x80]
call fcn.1400050e0
nop
lea rcx, [rbp - 0x10]
call fcn.14000d450
nop
lea rcx, [rbp + 0x30]
call fcn.14000d450
mov rdi, qword [rbp - 0x20]
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rbx, qword [rbp - 0x30]
call fcn.140244468
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.140113950
or esi, 0x1800
mov dword [rsp + 0x50], esi
mov qword [rbp - 0x50], r15
lea rax, str.___r_
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.140115dd0
bts esi, 0xd
mov dword [rsp + 0x50], esi
cmp dword [rbp - 0x50], 0
jne 0x14011bdfd
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x30]
call fcn.140113bc0
mov rbx, rax
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x14011b9bc
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14011b98e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011b989
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011b989
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140244f5c
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], recv
mov byte [rbp - 0x30], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
lea rcx, [rbp - 0x80]
call fcn.1400050e0
btr esi, 0xd
mov dword [rsp + 0x50], esi
lea rcx, [rbp + 0x30]
call fcn.14000d450
nop
lea rcx, [rbp - 0x10]
call fcn.14000d450
mov qword [rsp + 0x58], 0
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [0x140262ec0]
call fcn.1400958e0
test al, al
je 0x14011bb76
mov qword [rsp + 0x68], r15
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
lea r8, [rsp + 0x68]
xor ecx, ecx
call fcn.1400d5a00
cmp eax, 1
jne 0x14011bb76
mov r15, 0xffffffffffffffff
cmp qword [rbp + 0x60], 0
jne 0x14011ba72
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov rdx, qword [rsp + 0x68]
nop
inc r15
cmp byte [rdx + r15], 0
jne 0x14011ba50
mov r8, r15
lea rcx, [rbp - 0x10]
call fcn.140007c30
lea rax, [rbp - 0x10]
or esi, 1
jmp 0x14011bb12
mov rbx, qword [rsp + 0x68]
nop word [rax + rax]
inc r15
cmp byte [rbx + r15], 0
jne 0x14011ba80
call fcn.140244468
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], r15
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.140113950
or esi, 0x1800000
or esi, 2
mov dword [rsp + 0x50], esi
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.140116aa0
nop
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x10]
call fcn.140116aa0
nop
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x50]
call fcn.140114b20
bts esi, 0x14
lea rcx, [rbp + 0x10]
call fcn.14000d450
nop
lea rcx, [rbp - 0x50]
call fcn.14000d450
nop
or esi, 4
mov dword [rsp + 0x50], esi
lea rdx, [rbp + 0x98]
lea rcx, [rbp - 0x80]
call fcn.140113bc0
or esi, 8
mov rdx, rax
mov rcx, r14
call fcn.1400079a0
test sil, 8
je 0x14011bb33
and esi, 0xfffffff7
lea rcx, [rbp + 0x98]
call fcn.1400050e0
nop
test sil, 4
je 0x14011bb46
and esi, 0xfffffffb
lea rcx, [rbp - 0x80]
call fcn.14000d450
nop
test sil, 2
je 0x14011bb59
and esi, 0xfffffffd
lea rcx, [rbp + 0x30]
call fcn.14000d450
nop
test sil, 1
je 0x14011bb6b
and esi, 0xfffffffe
lea rcx, [rbp - 0x10]
call fcn.1400050e0
mov rax, qword [rsp + 0x70]
mov byte [rax], 1
xor r15d, r15d
movss xmm1, dword [0x1402a6014]
xorps xmm0, xmm0
call fcn.1400251f0
mov qword [rsp + 0x58], 0
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, str.Edit
call fcn.1400958e0
test al, al
je 0x14011bd5f
mov rbx, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0xf
jbe 0x14011bbb9
mov r14, qword [r14]
call fcn.140244468
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rbx
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.140113950
or esi, 0xc000
mov dword [rsp + 0x50], esi
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140154cb0
bts esi, 0x10
mov dword [rsp + 0x50], esi
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.140113cb0
nop
lea rcx, [rbp - 0x10]
call fcn.14000d450
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x30]
call fcn.140114350
nop
lea rdx, [rbp + 0x98]
mov rcx, rax
call fcn.140114050
cmp qword [rax + 0x18], 0xf
jbe 0x14011bc32
mov rax, qword [rax]
lea rdx, [0x14027d914]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ebx, eax
lea rcx, [rbp + 0x98]
call fcn.1400050e0
nop
lea rcx, [rbp - 0x80]
call fcn.14000d450
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x30]
call fcn.140114050
test ebx, ebx
jne 0x14011bd1d
cmp qword [rax + 0x18], 0xf
jbe 0x14011bc7c
mov rax, qword [rax]
mov r8, rax
lea rdx, str._GigiEdit.exe____s_
lea rcx, [rbp + 0x130]
call fcn.140157c40
lea rcx, [rbp + 0x98]
call fcn.1400050e0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
movups xmmword [rbp + 0xf4], xmm0
movups xmmword [rbp + 0x104], xmm0
movups xmmword [rbp + 0x114], xmm0
mov dword [rbp + 0x124], eax
mov dword [rbp + 0xc0], WSAGetLastError
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x14011bd56
cmp qword [rax + 0x18], 0xf
jbe 0x14011bd27
mov rax, qword [rax]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp + 0x98]
call fcn.1400050e0
nop
lea rcx, [rbp + 0x30]
call fcn.14000d450
movss xmm1, dword [0x1402a6014]
xorps xmm0, xmm0
call fcn.1400251f0
mov qword [rsp + 0x58], 0
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, str.Explore
call fcn.1400958e0
test al, al
je 0x14011bdbe
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova r8, qword [rbp - 0x30]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.explore
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rbp - 0x30]
call fcn.1400050e0
nop
lea rcx, [rbp + 0x50]
call fcn.14000d450
xor eax, eax
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.140244f00
mov rbx, qword [rsp + 0x688]
add rsp, 0x640
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x50]
lea rcx, str.absolute
call fcn.140115d70
nop
call fcn.140001710
int3
call fcn.1400017b0
nop
call fcn.1400017b0
nop
call fcn.1400017b0
int3