Function at 0x140083dd0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2d8]
sub rsp, 0x3b0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402120d8]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor r15b, r15b
test rcx, rcx
jne 0x14007cfdf
xor al, al
jmp 0x14007e497
mov rdx, rcx
lea rcx, [rbp + 0x280]
call fcn.14007e4d0
nop
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x260]
call fcn.140089ce0
nop
lea rcx, [rbp + 0x260]
call fcn.14008cad0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rax
lea rax, vtable.neb::CJsonObject.0
mov qword [rbp + 0x160], rax
xor ebx, ebx
mov qword [rbp + 0x168], rbx
movdqa xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x198], rbx
mov qword [rbp + 0x1a0], reloc.WSOCK32.dll_ntohs
mov byte [rbp + 0x188], bl
mov qword [rbp + 0x1a8], rbx
mov qword [rbp + 0x1b0], rbx
lea ecx, [rbx + 0x30]
call fcn.140157540
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b8], rbx
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], rbx
lea ecx, [rbx + 0x48]
call fcn.140157540
mov rcx, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x1c0], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1d0], rcx
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x160]
call fcn.14008f5b0
nop
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], bl
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], bl
lea r8d, [rbx + 6]
lea rdx, str.action
lea rcx, [rbp + 0x80]
call fcn.140050e90
nop
lea r12, [rbx - 1]
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x14007d1aa
cmp dword [rbx + 0x18], 7
jne 0x14007d227
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d227
nop word [rax + rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d1f8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d190
jmp 0x14007d1f8
mov rbx, qword [rbp + 0x170]
test rbx, rbx
je 0x14007d227
cmp dword [rbx + 0x18], 7
jne 0x14007d227
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d227
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d1f8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d1e0
test rbx, rbx
je 0x14007d227
cmp dword [rbx + 0x18], 5
jne 0x14007d227
mov rdx, qword [rbx + 0x20]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007d210
lea rcx, [rbp + 0x140]
call fcn.140050e90
nop
lea rcx, [rbp + 0x80]
call fcn.140050e10
lea rcx, [rbp + 0x140]
mov rsi, qword [rbp + 0x140]
mov r14, qword [rbp + 0x158]
cmp r14, 0x10
cmovae rcx, rsi
mov rbx, qword [rbp + 0x150]
cmp rbx, 7
jne 0x14007d270
mov r8, rbx
lea rdx, str.openApp
call fcn.140175d80
test eax, eax
je 0x14007d2a0
lea rcx, [rbp + 0x140]
cmp r14, 0x10
cmovae rcx, rsi
cmp rbx, 7
jne 0x14007e3e9
mov r8, rbx
lea rdx, str.openUrl
call fcn.140175d80
test eax, eax
jne 0x14007e3e9
mov byte [rsp + 0x50], 1
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
movdqu xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], 0
movdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov r8d, 3
lea rdx, [0x1401d50c0]
lea rcx, [rbp + 0x80]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x14007d35a
cmp dword [rbx + 0x18], 7
jne 0x14007d3d7
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d3d7
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d3a8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d340
jmp 0x14007d3a8
mov rbx, qword [rbp + 0x170]
test rbx, rbx
je 0x14007d3d7
cmp dword [rbx + 0x18], 7
jne 0x14007d3d7
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d3d7
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d3a8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d390
test rbx, rbx
je 0x14007d3d7
cmp dword [rbx + 0x18], 5
jne 0x14007d3d7
mov rdx, qword [rbx + 0x20]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007d3c0
lea rcx, [rbp + 0x1e0]
call fcn.140050e90
nop
lea rcx, [rbp + 0x80]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov r8d, 3
lea rdx, [0x1401d50bc]
lea rcx, [rbp + 0x80]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x14007d46a
cmp dword [rbx + 0x18], 7
jne 0x14007d4e7
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d4e7
nop
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d4b8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d450
jmp 0x14007d4b8
mov rbx, qword [rbp + 0x170]
test rbx, rbx
je 0x14007d4e7
cmp dword [rbx + 0x18], 7
jne 0x14007d4e7
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d4e7
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d4b8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d4a0
test rbx, rbx
je 0x14007d4e7
cmp dword [rbx + 0x18], 5
jne 0x14007d4e7
mov rdx, qword [rbx + 0x20]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007d4d0
lea rcx, [rbp + 0x240]
call fcn.140050e90
nop
lea rcx, [rbp + 0x80]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov r8d, 3
lea rdx, [0x1401d551c]
lea rcx, [rbp + 0x80]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x14007d57a
cmp dword [rbx + 0x18], 7
jne 0x14007d5f7
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d5f7
nop
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d5c8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d560
jmp 0x14007d5c8
mov rbx, qword [rbp + 0x170]
test rbx, rbx
je 0x14007d5f7
cmp dword [rbx + 0x18], 7
jne 0x14007d5f7
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d5f7
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d5c8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d5b0
test rbx, rbx
je 0x14007d5f7
cmp dword [rbx + 0x18], 5
jne 0x14007d5f7
mov rdx, qword [rbx + 0x20]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007d5e0
lea rcx, [rbp + 0x220]
call fcn.140050e90
nop
lea rcx, [rbp + 0x80]
call fcn.140050e10
mov r14d, 4
mov rax, qword gs:[0x58]
add r14, qword [rax]
mov qword [rsp + 0x58], r14
mov eax, dword [r14]
cmp dword [0x14021e5b8], eax
jle 0x14007d65c
lea rcx, [0x14021e5b8]
call fcn.140157410
cmp dword [0x14021e5b8], 0xffffffff
jne 0x14007d65c
xorps xmm0, xmm0
movups xmmword [0x14021e5c0], xmm0
lea rcx, [0x1401ac1a0]
call fcn.140157820
lea rcx, [0x14021e5b8]
call fcn.1401573b0
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x120]
lea rcx, [0x14021e5c0]
call fcn.140078fd0
nop
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xe0]
call fcn.140089df0
nop
xor edx, edx
lea r13d, [rdx + 1]
mov r8d, 0x110
lea rcx, [rsp + 0x70]
call fcn.140175ab0
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rdx, qword [rbp + 0xe0]
lea rcx, [rsp + 0x70]
call fcn.14008dcb0
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 4]
mov ebx, dword [rbp + rax - 0x80]
lea rcx, [rsp + 0x70]
call fcn.14006df00
test ebx, ebx
jne 0x14007d6f3
lea rcx, [rbp + 0xe0]
call fcn.14008b4d0
test al, al
je 0x14007d6f9
lea r13d, [rbx + 2]
jmp 0x14007d6f9
mov r13d, 3
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x14007d7a3
mov rax, qword [rax]
mov r15, qword [rax]
lea r14, [rbp + 0x220]
cmp qword [rbp + 0x238], 0x10
cmovae r14, qword [rbp + 0x220]
lea rsi, [rbp + 0x240]
cmp qword [rbp + 0x258], 0x10
cmovae rsi, qword [rbp + 0x240]
lea rdi, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0x10
cmovae rdi, qword [rbp + 0x1e0]
lea rbx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae rbx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._INFO___d___on_action__s___pid__s___uid__s___nid__s_.
mov edx, 3
mov rcx, qword [0x14021d9a8]
call r15
mov r14, qword [rsp + 0x58]
mov rcx, qword [0x14021d998]
test rcx, rcx
je 0x14007d7de
mov rax, qword [rcx]
lea rdx, [rbp + 0x140]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x220]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x240]
mov r8d, r13d
lea rdx, [rbp + 0x1e0]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
lea rcx, [rbp + 0x140]
mov rbx, qword [rbp + 0x140]
mov rdi, qword [rbp + 0x158]
cmp rdi, 0x10
cmovae rcx, rbx
mov rsi, qword [rbp + 0x150]
cmp rsi, 7
jne 0x14007e0dd
mov r8, rsi
lea rdx, str.openApp
call fcn.140175d80
test eax, eax
jne 0x14007e0dd
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], al
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], al
movdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], al
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], al
lea r8d, [rsi - 4]
lea rdx, [0x1401dc414]
lea rcx, [rbp + 0xa0]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x14007d8ce
cmp dword [rbx + 0x18], esi
jne 0x14007d947
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d947
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d918
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d8b4
jmp 0x14007d918
mov rbx, qword [rbp + 0x170]
test rbx, rbx
je 0x14007d947
cmp dword [rbx + 0x18], 7
jne 0x14007d947
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007d947
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007d918
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d900
test rbx, rbx
je 0x14007d947
cmp dword [rbx + 0x18], 5
jne 0x14007d947
mov rdx, qword [rbx + 0x20]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007d930
lea rcx, [rbp + 0xc0]
call fcn.140050e90
nop
lea rcx, [rbp + 0xa0]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov r8d, 9
lea rdx, str.arguments
lea rcx, [rbp + 0xa0]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x14007d9da
cmp dword [rbx + 0x18], 7
jne 0x14007da57
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007da57
nop
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007da28
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007d9c0
jmp 0x14007da28
mov rbx, qword [rbp + 0x170]
test rbx, rbx
je 0x14007da57
cmp dword [rbx + 0x18], 7
jne 0x14007da57
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007da57
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007da28
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007da10
test rbx, rbx
je 0x14007da57
cmp dword [rbx + 0x18], 5
jne 0x14007da57
mov rdx, qword [rbx + 0x20]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14007da40
lea rcx, [rbp + 0x80]
call fcn.140050e90
nop
lea rcx, [rbp + 0xa0]
call fcn.140050e10
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov r8d, 7
lea rdx, str.invoker
lea rcx, [rbp + 0xa0]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x14007daea
cmp dword [rbx + 0x18], 7
jne 0x14007db6a
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007db6a
nop
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007db38
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007dad0
jmp 0x14007db38
mov rbx, qword [rbp + 0x170]
test rbx, rbx
je 0x14007db6a
cmp dword [rbx + 0x18], 7
jne 0x14007db6a
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007db6a
nop dword [rax]
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007db38
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007db20
test rbx, rbx
je 0x14007db6a
cmp dword [rbx + 0x18], 5
jne 0x14007db6a
mov rdx, qword [rbx + 0x20]
nop word [rax + rax]
inc r12
cmp byte [rdx + r12], 0
jne 0x14007db50
mov r8, r12
lea rcx, [rbp + 0x200]
call fcn.140050e90
nop
lea rcx, [rbp + 0xa0]
call fcn.140050e10
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x70]
call fcn.140175ab0
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rdx, qword [rbp + 0xe0]
lea rcx, [rsp + 0x70]
call fcn.14008dcb0
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 4]
mov ebx, dword [rbp + rax - 0x80]
lea rcx, [rsp + 0x70]
call fcn.14006df00
test ebx, ebx
je 0x14007dd3d
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x14007dc30
mov rax, qword [rax]
mov rsi, qword [rax]
lea rdi, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rdi, qword [rbp + 0x120]
lea rbx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0x10
cmovae rbx, qword [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._WARN___d___open_app__pid__s___path__s__not_exist.
mov edx, 2
mov rcx, qword [0x14021d9a8]
call rsi
mov eax, dword [r14]
cmp dword [0x14021e5b8], eax
jle 0x14007dc72
lea rcx, [0x14021e5b8]
call fcn.140157410
cmp dword [0x14021e5b8], 0xffffffff
jne 0x14007dc72
xorps xmm0, xmm0
movups xmmword [0x14021e5c0], xmm0
lea rcx, [0x1401ac1a0]
call fcn.140157820
lea rcx, [0x14021e5b8]
call fcn.1401573b0
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x100]
lea rcx, [0x14021e5c0]
call fcn.1400790f0
mov rbx, rax
lea rax, [rbp + 0x120]
cmp rax, rbx
je 0x14007dccf
lea rcx, [rbp + 0x120]
call fcn.140050e10
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x130], xmm1
xor edi, edi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WSOCK32.dll_ntohs
mov byte [rbx], dil
jmp 0x14007dcd1
xor edi, edi
lea rcx, [rbp + 0x100]
call fcn.140050e10
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x100]
call fcn.140089df0
mov rbx, rax
lea rax, [rbp + 0xe0]
cmp rax, rbx
je 0x14007dd2f
lea rcx, [rbp + 0xe0]
call fcn.140050da0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rcx, [rbp + 0x100]
call fcn.140050da0
jmp 0x14007dd3f
xor edi, edi
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x70]
call fcn.140175ab0
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rdx, qword [rbp + 0xe0]
lea rcx, [rsp + 0x70]
call fcn.14008dcb0
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 4]
mov ebx, dword [rbp + rax - 0x80]
lea rcx, [rsp + 0x70]
call fcn.14006df00
test ebx, ebx
je 0x14007ddfe
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x14007e0be
mov rax, qword [rax]
mov rsi, qword [rax]
lea rdi, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rdi, qword [rbp + 0x120]
lea rbx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rbx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._ERROR___d___open_app_failed__app__s___path__s__not_exist.
mov edx, 1
mov rcx, qword [0x14021d9a8]
call rsi
jmp 0x14007e0be
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xa0]
call fcn.140089df0
nop
lea rdx, [rbp + 0x200]
cmp qword [rbp + 0x218], 0x10
cmovae rdx, qword [rbp + 0x200]
cmp qword [rbp + 0x210], 5
jne 0x14007df96
mov rcx, rdi
lea r8, str.admin
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x14007de59
cmp rcx, 5
jne 0x14007de41
mov eax, edi
jmp 0x14007de5e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14007df96
movdqa xmm0, xmmword [0x1401e3790]
movdqu xmmword [rbp + 0x110], xmm0
mov word [rbp + 0x100], di
xor r8d, r8d
lea rdx, [0x1401dc7ac]
lea rcx, [rbp + 0x100]
call fcn.1400550f0
lea rax, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rax, qword [rbp + 0x100]
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae r9, qword [rbp + 0xa0]
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r15, rax
lea rcx, [rbp + 0x100]
call fcn.140050da0
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x14007e0b1
mov rax, qword [rax]
mov r14, qword [rax]
lea rsi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rsi, qword [rbp + 0x80]
lea rdi, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rdi, qword [rbp + 0x120]
lea rbx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rbx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._INFO___d___open_app_as_admin__app__s___path__s___args__s___result__d_.
mov edx, 3
mov rcx, qword [0x14021d9a8]
call r14
jmp 0x14007e0b1
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x100]
call fcn.140089ef0
nop
lea rax, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rax, qword [rbp + 0x100]
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae r9, qword [rbp + 0xa0]
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r12, rax
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x14007e0a4
mov rax, qword [rax]
mov r15, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea r14, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae r14, qword [rbp + 0x80]
lea rdi, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rdi, qword [rbp + 0x120]
lea rbx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rbx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._INFO___d___open_app__app__s___path__s___args__s___result__d___err__d_.
mov edx, 3
mov rcx, qword [0x14021d9a8]
call r15
nop
lea rcx, [rbp + 0x100]
call fcn.140050da0
nop
lea rcx, [rbp + 0xa0]
call fcn.140050da0
nop
lea rcx, [rbp + 0x200]
call fcn.140050e10
nop
lea rcx, [rbp + 0x80]
call fcn.140050e10
nop
jmp 0x14007e394
lea rcx, [rbp + 0x140]
cmp rdi, 0x10
cmovae rcx, rbx
cmp rsi, 7
jne 0x14007e3a1
mov r8, rsi
lea rdx, str.openUrl
call fcn.140175d80
test eax, eax
jne 0x14007e3a1
movdqa xmm0, xmmword [0x1401e37a0]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], al
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], al
lea r8d, [rsi - 4]
lea rdx, [0x1401dcaf0]
lea rcx, [rbp + 0xa0]
call fcn.140050e90
nop
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x14007e19c
cmp dword [rbx + 0x18], esi
jne 0x14007e21a
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007e21a
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007e1e8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007e182
jmp 0x14007e1e8
mov rbx, qword [rbp + 0x170]
test rbx, rbx
je 0x14007e21a
cmp dword [rbx + 0x18], 7
jne 0x14007e21a
lea rdi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdi, qword [rbp + 0xa0]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x14007e21a
nop
mov rdx, rdi
mov rcx, qword [rbx + 0x40]
call fcn.140091b80
test eax, eax
je 0x14007e1e8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14007e1d0
test rbx, rbx
je 0x14007e21a
cmp dword [rbx + 0x18], 5
jne 0x14007e21a
mov rdx, qword [rbx + 0x20]
nop word [rax + rax]
inc r12
cmp byte [rdx + r12], 0
jne 0x14007e200
mov r8, r12
lea rcx, [rbp + 0xc0]
call fcn.140050e90
nop
lea rcx, [rbp + 0xa0]
call fcn.140050e10
lea rcx, [rbp + 0xc0]
mov rsi, qword [rbp + 0xc0]
mov r14, qword [rbp + 0xd8]
cmp r14, 0x10
cmovae rcx, rsi
mov qword [rsp + 0x20], 7
lea r9, str.http:__
xor r8d, r8d
mov rbx, qword [rbp + 0xd0]
mov rdx, rbx
call fcn.140057570
test rax, rax
je 0x14007e2e6
lea rcx, [rbp + 0xc0]
cmp r14, 0x10
cmovae rcx, rsi
mov qword [rsp + 0x20], 8
lea r9, str.https:__
xor r8d, r8d
mov rdx, rbx
call fcn.140057570
test rax, rax
je 0x14007e2e6
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x14007e394
mov rax, qword [rax]
mov rdi, qword [rax]
lea rbx, [rbp + 0xc0]
cmp r14, 0x10
cmovae rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._ERROR___d___open_url_failed__addr__s__is_invalid.
mov edx, 1
mov rcx, qword [0x14021d9a8]
call rdi
jmp 0x14007e394
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x100]
call fcn.140089df0
nop
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae r8, qword [rbp + 0x100]
mov dword [rsp + 0x28], 5
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.Open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rsi, rax
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x14007e387
mov rax, qword [rax]
mov rdi, qword [rax]
lea rbx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rbx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._INFO___d___open_url__addr__s___result__d_.
mov edx, 3
mov rcx, qword [0x14021d9a8]
call rdi
nop
lea rcx, [rbp + 0x100]
call fcn.140050da0
nop
lea rcx, [rbp + 0xc0]
call fcn.140050e10
nop
lea rcx, [rbp + 0xe0]
call fcn.140050da0
nop
lea rcx, [rbp + 0x120]
call fcn.140050e10
nop
lea rcx, [rbp + 0x220]
call fcn.140050e10
nop
lea rcx, [rbp + 0x240]
call fcn.140050e10
nop
lea rcx, [rbp + 0x1e0]
call fcn.140050e10
movzx r15d, byte [rsp + 0x50]
jmp 0x14007e42e
mov rax, qword [0x14021d9a8]
test rax, rax
je 0x14007e42e
mov rax, qword [rax]
mov rdi, qword [rax]
lea rbx, [rbp + 0x140]
cmp r14, 0x10
cmovae rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x20], rbx
mov r9d, eax
lea r8, str._WARN___d___not_support_action__s_.
mov edx, 2
mov rcx, qword [0x14021d9a8]
call rdi
nop
lea rcx, [rbp + 0x140]
call fcn.140050e10
nop
lea rax, vtable.neb::CJsonObject.0
mov qword [rbp + 0x160], rax
lea rcx, [rbp + 0x160]
call fcn.14008f6f0
lea rcx, [rbp + 0x1c0]
call fcn.140058c60
lea rcx, [rbp + 0x1a8]
call fcn.140090a00
lea rcx, [rbp + 0x188]
call fcn.140050e10
nop
lea rcx, [rbp + 0x260]
call fcn.140050e10
nop
lea rcx, [rbp + 0x280]
call fcn.140050da0
movzx eax, r15b
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.1401571e0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, qword [rdx]
call fcn.14004fb40
test rax, rax
je 0x140083de7
add rax, 8
mov rcx, rbx
mov qword [0x14021d998], rax
add rsp, 0x20
pop rbx
jmp 0x14007cf90