Function at 0x413aa6
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6e8
movaps xmmword [rsp + 0x6d0], xmm6
mov r12, rdx
and dword [rsp + 0x2c0], 0
mov qword [rsp + 0x2b8], rcx
mov al, byte [rdx + 0x68]
test al, al
sete cl
mov rdi, qword [rdx + 0x60]
test rdi, rdi
sete dl
and dl, cl
mov byte [rsp + 0x88], dl
je 0x413afd
xor eax, eax
mov qword [rsp + 0x60], rax
jmp 0x414380
and qword [rsp + 0x280], 0
and qword [rsp + 0x290], 0
test al, al
mov qword [rsp + 0x68], r12
jne 0x413c77
call sub.kernel32.dll_GetEnvironmentStringsW
test rax, rax
je 0x4163fd
lea r14, [rsp + 0x170]
lea r15, [rsp + 0x2d0]
lea r13, [rsp + 0x280]
mov qword [rsp + 0x60], rax
mov r12, rax
mov rbp, r12
cmp word [r12], 0
je 0x413c68
mov rdx, 0xfffffffffffffffe
xor ecx, ecx
mov rsi, rcx
mov rax, rdx
inc rcx
add rdx, 2
cmp word [rbp + rsi*2], 0
jne 0x413b62
test rsi, rsi
je 0x416402
lea r12, [rcx*2]
add r12, rbp
xor ebx, ebx
test rax, rax
je 0x413b4a
cmp word [rbp + rbx*2 + 2], 0x3d
je 0x413ba3
inc rbx
add rax, 0xfffffffffffffffe
jmp 0x413b8d
cmp rbx, rsi
jae 0x416402
lea r8, [rbx + 1]
mov rcx, r14
mov rdx, rbp
call fcn.0040e551
add rbx, 2
sub rsi, rbx
jb 0x416402
lea rdx, [rbx*2]
add rdx, rbp
lea rcx, [rsp + 0x2f0]
mov r8, rsi
call fcn.0040e551
movups xmm0, xmmword [rsp + 0x170]
movups xmm1, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x2d0], xmm0
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0x2f0]
movaps xmm1, xmmword [rsp + 0x300]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
cmp byte [rsp + 0xb8], 2
je 0x413c68
mov rcx, r15
lea rdx, [rsp + 0xa0]
call fcn.00416406
mov rcx, r14
mov rdx, r13
mov r8, r15
lea r9, [rsp + 0xc0]
call fcn.004108fd
mov rcx, r14
call fcn.004130af
jmp 0x413b4a
mov rcx, qword [rsp + 0x60]
call sub.kernel32.dll_FreeEnvironmentStringsW
mov r12, qword [rsp + 0x68]
lea r15, [rsp + 0x128]
and qword [r15], 0
and qword [r15 + 0x20], 0
mov rax, qword [r12 + 0x50]
mov rcx, qword [r12 + 0x58]
xor edx, edx
test rax, rax
setne dl
mov qword [r15 - 8], rdx
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], rcx
mov qword [r15 + 0x18], rdx
mov qword [r15 + 0x28], rax
mov qword [r15 + 0x30], rcx
lea r12, [rsp + 0x2e8]
cmove rdi, rax
lea r13, [rsp + 0xa0]
lea rbx, [rsp + 0x2d0]
lea r14, [rsp + 0x170]
xorps xmm6, xmm6
test rdi, rdi
je 0x414268
dec rdi
mov qword [rsp + 0x160], rdi
mov rax, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
test rax, rax
je 0x413d35
test rsi, rsi
jne 0x413d35
mov rdx, qword [rsp + 0x130]
mov r8, qword [rsp + 0x138]
mov rcx, r15
call fcn.0040e3ec
mov qword [rsp + 0x120], 1
mov rsi, qword [rsp + 0x128]
jmp 0x413d3e
test rax, rax
je 0x416402
mov r8, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
movzx eax, word [rsi + 0x3d2]
cmp rdi, rax
jb 0x413d79
mov rax, qword [rsi + 0x160]
test rax, rax
je 0x416402
inc r8
movzx edi, word [rsi + 0x3d0]
mov rsi, rax
jmp 0x413d4e
test r8, r8
je 0x413d93
mov rdx, qword [rsi + rdi*8 + 0x3e0]
dec r8
mov rcx, rbx
call fcn.0040e3ec
jmp 0x413db0
lea rax, [rdi + 1]
mov qword [rsp + 0x2d0], rsi
and qword [rsp + 0x2d8], 0
mov qword [rsp + 0x2e0], rax
imul rax, rdi, 0x38
lea rbp, [rsi + rax]
add rbp, 0x168
shl rdi, 5
mov rax, qword [rsp + 0x2e0]
mov qword [r15 + 0x10], rax
mov rax, qword [rsp + 0x2d0]
mov qword [r15], rax
mov rax, qword [rsp + 0x2d8]
mov qword [r15 + 8], rax
cmp byte [rsi + rdi + 0x18], 2
jne 0x413f46
mov rdx, qword [rsp + 0x280]
test rdx, rdx
je 0x4141b5
mov r8, qword [rsp + 0x288]
mov r9, qword [rbp]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x260]
call fcn.00410222
cmp qword [rsp + 0x260], 0
jne 0x4141b5
mov rax, qword [rsp + 0x268]
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x278]
mov byte [rsp + 0x5f], 0
test rdx, rdx
je 0x413f8e
dec rdx
mov rax, qword [rax + rcx*8 + 0x3d8]
movzx ecx, word [rax + 0x3d2]
sub rdx, 1
jae 0x413e5c
dec rcx
mov qword [rsp + 0x298], rax
and qword [rsp + 0x2a0], 0
mov qword [rsp + 0x2a8], rcx
mov rcx, rbx
lea rdx, [rsp + 0x298]
lea r8, [rsp + 0x5f]
call fcn.004102d7
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x240], rax
movups xmm0, xmmword [rsp + 0x2d0]
movups xmm1, xmmword [rsp + 0x2e0]
movups xmm2, xmmword [rsp + 0x2f0]
movaps xmmword [rsp + 0x230], xmm2
movaps xmmword [rsp + 0x220], xmm1
movaps xmmword [rsp + 0x210], xmm0
movups xmm0, xmmword [r12 + 0x20]
movups xmm1, xmmword [r12 + 0x30]
movaps xmmword [rsp + 0x1f0], xmm0
movaps xmmword [rsp + 0x200], xmm1
mov rcx, qword [rsp + 0x328]
mov rax, qword [rsp + 0x330]
mov r8, qword [rsp + 0x338]
movzx edx, word [rcx + 0x3d2]
cmp r8, rdx
jb 0x413fbc
mov rdx, qword [rcx + 0x160]
test rdx, rdx
je 0x413fc4
inc rax
movzx r8d, word [rcx + 0x3d0]
mov rcx, rdx
jmp 0x413f16
add rsi, rdi
lea rdx, [rbp + 0x18]
mov rcx, r12
call fcn.0041644b
mov rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, rbx
call fcn.00411881
mov rcx, r13
mov rdx, rsi
call fcn.0041644b
mov rcx, r14
lea rdx, [rsp + 0x280]
mov r8, rbx
mov r9, r13
call fcn.004108fd
mov rcx, r14
jmp 0x4141c0
mov qword [rsp + 0x2d0], rax
and qword [rsp + 0x2d8], 0
mov qword [rsp + 0x2e0], rcx
mov rcx, r13
mov rdx, rbx
lea r8, [rsp + 0x5f]
call fcn.004102d7
jmp 0x4140ee
mov rdx, rax
mov rax, r8
jmp 0x413fc9
mov rdx, rcx
xor ecx, ecx
imul r8, rax, 0x38
mov r9, rax
shl r9, 5
mov r10, qword [rcx + r8 + 0x198]
mov qword [rsp + 0x1a0], r10
movups xmm0, xmmword [rcx + r8 + 0x168]
movups xmm1, xmmword [rcx + r8 + 0x178]
movups xmm2, xmmword [rcx + r8 + 0x188]
movaps xmmword [rsp + 0x190], xmm2
movaps xmmword [rsp + 0x180], xmm1
movaps xmmword [rsp + 0x170], xmm0
mov r10, qword [rsp + 0x240]
mov qword [rcx + r8 + 0x198], r10
movaps xmm0, xmmword [rsp + 0x210]
movaps xmm1, xmmword [rsp + 0x220]
movaps xmm2, xmmword [rsp + 0x230]
movups xmmword [rcx + r8 + 0x188], xmm2
movups xmmword [rcx + r8 + 0x178], xmm1
movups xmmword [rcx + r8 + 0x168], xmm0
movups xmm0, xmmword [rcx + r9]
movups xmm1, xmmword [rcx + r9 + 0x10]
lea r8, [rsp + 0x1a8]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
movaps xmm0, xmmword [rsp + 0x1f0]
movaps xmm1, xmmword [rsp + 0x200]
movups xmmword [rcx + r9], xmm0
movups xmmword [rcx + r9 + 0x10], xmm1
inc rax
test rdx, rdx
je 0x4140c7
lea rax, [rcx + rax*8]
add rax, 0x3d8
mov rcx, qword [rax]
lea rax, [rcx + 0x3d8]
dec rdx
jne 0x4140a3
mov qword [rsp + 0xf8], rcx
lea rax, [rsp + 0x100]
movups xmmword [rax], xmm6
jmp 0x4140e0
mov qword [rsp + 0xf8], rcx
and qword [rsp + 0x100], 0
mov qword [rsp + 0x108], rax
mov ecx, 0xb
mov rdi, r13
mov rsi, r14
rep movsq qword [rdi], qword [rsi]
movups xmm0, xmmword [rsp + 0xa0]
movups xmm1, xmmword [rsp + 0xb0]
movups xmm2, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x190], xmm2
movaps xmmword [rsp + 0x180], xmm1
movaps xmmword [rsp + 0x170], xmm0
mov sil, byte [rsp + 0xd0]
lea rax, [rsp + 0x100]
movups xmm0, xmmword [rax - 0x2f]
movups xmm1, xmmword [rax - 0x1f]
movaps xmmword [rsp + 0x210], xmm0
movaps xmmword [rsp + 0x220], xmm1
dec qword [rsp + 0x290]
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x22f], rax
cmp byte [rsp + 0x5f], 0
je 0x4141af
mov rcx, qword [rsp + 0x280]
test rcx, rcx
je 0x416402
mov rax, qword [rsp + 0x288]
test rax, rax
je 0x416402
mov rdx, qword [rcx + 0x3d8]
mov qword [rsp + 0x280], rdx
dec rax
mov qword [rsp + 0x288], rax
and qword [rdx + 0x160], 0
mov edx, 8
call fcn.00404990
cmp sil, 2
jne 0x4141d2
mov byte [rsp + 0xb8], 2
mov rcx, r13
call fcn.004130af
mov rdi, qword [rsp + 0x160]
jmp 0x413cd9
movaps xmm0, xmmword [rsp + 0x170]
movaps xmm1, xmmword [rsp + 0x180]
movaps xmm2, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0x2f0], xmm2
movaps xmmword [rsp + 0x2e0], xmm1
movaps xmmword [rsp + 0x2d0], xmm0
mov byte [rsp + 0x300], sil
mov rax, qword [rsp + 0x22f]
mov qword [r12 + 0x38], rax
movaps xmm0, xmmword [rsp + 0x210]
movaps xmm1, xmmword [rsp + 0x220]
movups xmmword [r12 + 0x29], xmm1
movups xmmword [r12 + 0x19], xmm0
movups xmm0, xmmword [r12 + 0x20]
mov rax, qword [r12 + 0x30]
mov rcx, qword [r12 + 0x38]
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rcx
mov rcx, rbx
call fcn.0040f613
jmp 0x4141bd
mov rbx, qword [rsp + 0x280]
mov r15, qword [rsp + 0x288]
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x98], rax
mov ecx, 4
call fcn.0040ec0d
mov dword [rax], 0x48544150
lea r8, [rsp + 0xa0]
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov qword [r8 + 0x10], 4
mov byte [r8 + 0x18], 0
lea rcx, [rsp + 0x2d0]
mov rdx, r8
call fcn.00416406
test rbx, rbx
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x90], r15
je 0x414367
mov rsi, qword [rsp + 0x2d0]
mov rdi, qword [rsp + 0x2e0]
xor eax, eax
mov qword [rsp + 0x60], rax
lea rcx, [rbx + 0x168]
movzx r13d, word [rbx + 0x3d2]
imul rbp, r13, 0x38
mov r12, 0xffffffffffffffff
test rbp, rbp
je 0x414340
lea r14, [rcx + 0x38]
mov r8, qword [rcx]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.004101fa
add rbp, 0xffffffffffffffc8
inc r12
mov rcx, r14
cmp al, 1
je 0x41430e
movzx eax, al
test eax, eax
jne 0x414343
jmp 0x414353
mov r12, r13
sub r15, 1
jb 0x41436e
mov rbx, qword [rbx + r12*8 + 0x3d8]
jmp 0x4142f4
shl r12, 5
mov rax, qword [rbx + r12]
mov qword [rsp + 0x60], rax
mov r15, qword [rbx + r12 + 0x10]
jmp 0x41436e
xor eax, eax
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x2d0]
call fcn.0040f613
mov r12, qword [rsp + 0x68]
mov rdi, qword [r12 + 0x30]
mov rbx, qword [r12 + 0x40]
mov qword [rsp + 0x260], rdi
mov qword [rsp + 0x268], rbx
lea rsi, str.program_path_has_no_file_name
test rbx, rbx
je 0x414efd
lea r8, str.__UNC._
mov r9d, 4
mov rcx, rdi
mov rdx, rbx
call fcn.0040d7d5
lea rcx, [0x004164a2]
lea rdx, [0x004164a9]
test al, al
cmovne rdx, rcx
mov cl, byte [rbx + rdi - 1]
call rdx
test al, al
jne 0x414efd
cmp rbx, 4
jae 0x4143f1
xor eax, eax
jmp 0x41447d
lea rdx, [rdi + rbx]
add rdx, 0xfffffffffffffffc
add rdi, rbx
lea rax, [0x00c009fc]
mov qword [rsp + 0x20], rax
lea r9, str..exeprogram_not_found
lea rsi, [rsp + 0x2d0]
mov rcx, rsi
mov r8, rdi
call fcn.0040e195
mov rcx, qword [rsi + 0x28]
mov r9, qword [rsi + 0x20]
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
cmp r9, rcx
setae al
jae 0x41446d
mov r10b, byte [rdx + r9]
mov r11b, byte [r8 + r9]
inc r9
lea esi, [r10 - 0x41]
cmp sil, 0x1a
setb bl
shl bl, 5
or bl, r10b
lea r10d, [r11 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
or r10b, r11b
cmp bl, r10b
je 0x414431
mov rdi, qword [rsp + 0x260]
mov rbx, qword [rsp + 0x268]
lea rcx, [rdi + rbx]
xor edx, edx
cmp rbx, rdx
je 0x4144b8
movzx r8d, byte [rdi + rdx]
cmp r8d, 0x5c
je 0x41449c
inc rdx
cmp r8d, 0x2f
jne 0x414483
test al, al
je 0x4144f5
lea rcx, [rsp + 0x1f0]
mov rdx, rdi
mov r8, rbx
call fcn.00416524
jmp 0x414de3
lea rsi, [rsp + 0x2d0]
mov qword [rsi], rdi
mov qword [rsi + 8], rcx
and word [rsi + 0x10], 0
mov rcx, rsi
call fcn.0040d9f8
cmp ax, 1
jne 0x4144df
test dx, dx
jne 0x4144cc
cmp ax, 1
jne 0x414608
lea rsi, str.nul_byte_found_in_provided_data
jmp 0x414efd
mov rcx, rbx
call fcn.0040ec0d
mov rsi, rax
mov r14, rdx
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call sub.ntdll.dll_memcpy
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0xb0], rbx
mov byte [rsp + 0xb8], 0
mov rax, qword [rsp + 0xb0]
mov cl, byte [rsp + 0xb8]
mov edx, dword [rsp + 0xb9]
movzx r8d, word [rsp + 0xbd]
mov r9b, byte [rsp + 0xbf]
lea rsi, [rsp + 0x2d0]
mov qword [rsi + 0x10], rax
mov byte [rsi + 0x18], cl
mov dword [rsi + 0x19], edx
mov word [rsi + 0x1d], r8w
mov byte [rsi + 0x1f], r9b
mov rax, qword [rsp + 0xa0]
mov qword [rsi], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsi + 8], rax
lea rdx, str..exeprogram_not_found
mov r8d, 4
mov rcx, rsi
call fcn.00413116
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
mov rsi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb0]
lea rdi, [rsp + 0x2d0]
mov rcx, rdi
mov rdx, rsi
call fcn.004164b8
cmp qword [rdi], 0
je 0x414727
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x200], rax
movups xmm0, xmmword [rsp + 0x2d0]
movaps xmmword [rsp + 0x1f0], xmm0
jmp 0x414758
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov rdx, rbx
mov r8b, 0x2e
call fcn.0041699d
mov byte [rsp + 0x298], al
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x41477a
add r15, rax
lea rdi, [rsp + 0x170]
mov qword [rdi], rax
mov qword [rdi + 8], r15
and word [rdi + 0x10], 0
mov byte [rdi + 0x18], 1
lea r15, [rsp + 0xb9]
lea r12, [rsp + 0x2e9]
lea rbx, [rsp + 0x2d0]
lea rsi, [rsp + 0x260]
lea r13, [rsp + 0xa0]
mov rcx, rbx
mov rdx, rdi
call fcn.00413008
mov al, byte [rsp + 0x2e8]
cmp al, 2
je 0x41476d
cmp qword [rsp + 0x2e0], 0
je 0x41470d
mov rcx, qword [rsp + 0x2e0]
mov qword [rsp + 0xb0], rcx
movups xmm0, xmmword [rsp + 0x2d0]
movaps xmmword [rsp + 0xa0], xmm0
mov ecx, dword [r12]
mov edx, dword [r12 + 3]
mov dword [r15 + 3], edx
mov dword [r15], ecx
mov byte [rsp + 0xb8], al
mov rcx, rbx
mov rdx, rsi
lea r8, [rsp + 0x298]
mov r9, r13
call fcn.004169bd
mov rbp, qword [rsp + 0x2d0]
mov r14, qword [rsp + 0x2d8]
test rbp, rbp
jne 0x414a38
xor ecx, ecx
mov rdx, r14
call fcn.00416fe0
jmp 0x414673
mov rcx, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2d8]
call fcn.00404ef9
jmp 0x414673
lea rdx, [0x00c003d8]
lea rdi, [rsp + 0xa0]
mov rcx, rdi
xor r8d, r8d
call fcn.00413893
mov rsi, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x1f0]
mov rdx, rsi
call fcn.00416524
mov rdx, qword [rsp + 0xa8]
mov rcx, rsi
call fcn.00404ef9
jmp 0x414de3
lea rcx, [rsp + 0x2d0]
call fcn.004130af
lea rax, [rsp + 0xa0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov edi, 2
xor ebx, ebx
mov esi, 0xffffffff
xor r14d, r14d
cmp r8, 0x201
jae 0x4147c1
lea r15, [rsp + 0x2d0]
mov r13d, 0x200
mov r12, r8
jmp 0x414802
sub r8, r14
lea rcx, [rsp + 0xa0]
mov rdx, r8
call fcn.0040ecda
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
cmp rbx, rsi
mov r14d, 0xffffffff
cmovb r14, rbx
mov qword [rsp + 0xb0], r14
mov r15, rdi
mov r13, r14
mov r12, r14
xor ecx, ecx
call sub.kernel32.dll_SetLastError
xor ecx, ecx
mov rdx, r15
mov r8d, r12d
call sub.kernel32.dll_GetModuleFileNameW
mov ebp, eax
test eax, eax
jne 0x414825
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x41487f
mov r8d, ebp
cmp r12, r8
jne 0x414857
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x416402
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
mov esi, 0xffffffff
cmovae r12, rax
mov r8, r12
jmp 0x4147a5
jb 0x4147a5
cmp r13, r8
jb 0x416402
lea rsi, [rsp + 0x210]
mov rcx, rsi
mov rdx, r15
call fcn.0040e551
mov sil, byte [rsi + 0x18]
jmp 0x414897
call fcn.0040ed84
mov qword [rsp + 0x210], rax
mov byte [rsp + 0x228], 2
mov sil, 2
mov rcx, rdi
mov rdx, rbx
call fcn.0040ed9a
cmp sil, 2
jne 0x4148ba
lea rcx, [rsp + 0x210]
call fcn.0040e538
jmp 0x414b03
mov rsi, qword [rsp + 0x210]
mov r15, qword [rsp + 0x218]
mov rdi, qword [rsp + 0x220]
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.0040e67f
lea r14, [rsp + 0x120]
mov rcx, r14
mov rdx, rbx
call fcn.0040f702
mov al, byte [r14]
cmp al, 0xa
mov r12, qword [rsp + 0x68]
je 0x414aa1
add al, 0xfa
cmp al, 3
ja 0x414aa1
movzx eax, al
dec rax
cmp rax, 2
ja 0x414aa1
mov r13, qword [rsp + 0x170]
mov r12, qword [rsp + 0x178]
mov al, byte [rsp + 0x180]
cmp al, 6
je 0x414970
mov rcx, qword [rsp + 0x1a0]
mov qword [rsp + 0x2ef], rcx
movups xmm0, xmmword [rsp + 0x181]
movups xmm1, xmmword [rsp + 0x191]
movaps xmmword [rsp + 0x2e0], xmm1
movaps xmmword [rsp + 0x2d0], xmm0
mov cl, byte [rsp + 0x1aa]
mov dl, byte [rsp + 0x1a8]
mov bpl, byte [rsp + 0x1a9]
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], r12
mov byte [rsp + 0xb0], al
movaps xmm0, xmmword [rsp + 0x2d0]
movaps xmm1, xmmword [rsp + 0x2e0]
movups xmmword [rsp + 0xb1], xmm0
movups xmmword [rsp + 0xc1], xmm1
mov rax, qword [rsp + 0x2ef]
mov qword [rsp + 0xd0], rax
mov byte [rsp + 0xda], cl
mov byte [rsp + 0xd8], dl
mov byte [rsp + 0xd9], bpl
cmp dl, 2
jne 0x414a45
lea rbx, [rsp + 0x2d0]
lea r14, [rsp + 0xa0]
test r12, r12
je 0x414a45
mov rcx, rbx
mov rdx, r14
call fcn.0040deed
cmp byte [rsp + 0x2d8], 0xa
jne 0x414a45
mov rax, qword [rsp + 0x2d0]
sub r12, rax
jb 0x416402
add r13, rax
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], r12
jmp 0x4149f8
mov rsi, qword [rsp + 0x2e0]
jmp 0x414c45
cmp bpl, 2
jne 0x414a95
lea rbx, [rsp + 0xa0]
lea r14, [rsp + 0x2d0]
mov rcx, rbx
call fcn.0040ea50
cmp r12, rax
jbe 0x414a95
mov rcx, r14
mov rdx, rbx
call fcn.0040ea89
cmp byte [rsp + 0x2d8], 0xa
jne 0x414a95
sub r12, qword [rsp + 0x2d0]
jb 0x416402
mov qword [rsp + 0xa8], r12
jmp 0x414a5b
cmp rdi, r12
cmovae rdi, r12
mov r12, qword [rsp + 0x68]
lea r9, [rsp + 0x2d0]
mov qword [r9], rsi
mov qword [r9 + 8], r15
mov qword [r9 + 0x10], rdi
mov rax, qword [rsp + 0x228]
mov qword [r9 + 0x18], rax
lea rsi, [rsp + 0xa0]
lea rdx, [rsp + 0x260]
lea r8, [rsp + 0x298]
mov rcx, rsi
call fcn.004169bd
mov rbp, qword [rsi]
mov r14, qword [rsi + 8]
test rbp, rbp
je 0x414af9
mov rsi, qword [rsp + 0xb0]
jmp 0x414dcb
xor ecx, ecx
mov rdx, r14
call fcn.00416fe0
lea rax, [rsp + 0x120]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov edi, 2
xor esi, esi
mov r13d, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x414b4a
lea r14, [rsp + 0x2d0]
mov ebx, 0x200
mov r15, r8
jmp 0x414b8b
sub r8, r12
lea rcx, [rsp + 0x120]
mov rdx, r8
call fcn.0040ecda
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
cmp rsi, r13
mov r12d, 0xffffffff
cmovb r12, rsi
mov qword [rsp + 0x130], r12
mov r14, rdi
mov rbx, r12
mov r15, r12
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r14
mov edx, r15d
call sub.kernel32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x414bb0
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x414c4f
mov r8d, ebp
cmp r15, r8
jne 0x414bd8
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x416402
add r15, r15
cmp r15, r13
cmovae r15, r13
mov r8, r15
jmp 0x414b2f
jb 0x414b2f
cmp rbx, r8
jb 0x416402
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, r14
call fcn.0040e551
lea r14, [rsp + 0x178]
lea rdx, [rsp + 0x260]
lea r8, [rsp + 0x298]
mov rcx, r14
mov r9, rbx
call fcn.004169bd
and qword [r14 - 8], 0
mov rcx, rdi
mov rdx, rsi
call fcn.0040ed9a
mov rbp, qword [r14]
test rbp, rbp
je 0x414c73
mov r14, qword [rsp + 0x180]
mov rsi, qword [rsp + 0x188]
mov r12, qword [rsp + 0x68]
jmp 0x414dcb
call fcn.0040ed84
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x170], 1
mov rcx, rdi
mov rdx, rsi
call fcn.0040ed9a
lea rcx, [rsp + 0x170]
call fcn.00416fea
lea rax, [rsp + 0x120]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov edi, 2
xor esi, esi
mov r13d, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x414cc7
lea r14, [rsp + 0x2d0]
mov ebx, 0x200
mov r15, r8
jmp 0x414d08
sub r8, r12
lea rcx, [rsp + 0x120]
mov rdx, r8
call fcn.0040ecda
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
cmp rsi, r13
mov r12d, 0xffffffff
cmovb r12, rsi
mov qword [rsp + 0x130], r12
mov r14, rdi
mov rbx, r12
mov r15, r12
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r14
mov edx, r15d
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x414d2d
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4153c3
mov r8d, ebp
cmp r15, r8
jne 0x414d55
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x416402
add r15, r15
cmp r15, r13
cmovae r15, r13
mov r8, r15
jmp 0x414cac
jb 0x414cac
cmp rbx, r8
jb 0x416402
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, r14
call fcn.0040e551
lea r14, [rsp + 0x178]
lea rdx, [rsp + 0x260]
lea r8, [rsp + 0x298]
mov rcx, r14
mov r9, rbx
call fcn.004169bd
and qword [r14 - 8], 0
mov rcx, rdi
mov rdx, rsi
call fcn.0040ed9a
mov rbp, qword [r14]
test rbp, rbp
mov r12, qword [rsp + 0x68]
je 0x4153e7
mov r14, qword [rsp + 0x180]
mov rsi, qword [rsp + 0x188]
mov qword [rsp + 0x1f0], rbp
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x200], rsi
mov rdx, qword [rsp + 0x1f0]
test rdx, rdx
je 0x414ef5
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x258], rax
mov r8, qword [rsp + 0x200]
cmp r8, 4
mov qword [rsp + 0x80], rdx
jbe 0x414e30
cmp word [rdx + r8*2 - 0xa], 0x2e
jne 0x414e30
cmp word [rdx + r8*2 - 2], 0
je 0x415313
mov rsi, qword [r12 + 0x30]
mov r14, qword [r12 + 0x90]
mov bl, byte [r12 + 0xc5]
mov rax, r12
mov r12, qword [r12 + 0x40]
add r12, rsi
mov r13, rax
imul r15, qword [rax + 0xa0], 0x28
lea rdi, [rsp + 0xa0]
mov qword [rdi], 2
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
mov rcx, rdi
mov dx, 0x22
call fcn.0041269b
lea rdx, [rsp + 0x2d0]
mov qword [rdx], rsi
mov qword [rdx + 8], r12
and word [rdx + 0x10], 0
mov rcx, rdi
call fcn.00412676
mov rcx, rdi
mov dx, 0x22
call fcn.0041269b
test r15, r15
je 0x414feb
lea r12, [r14 + 0x28]
mov rcx, rdi
mov dx, 0x20
call fcn.0041269b
mov rcx, rdi
mov rdx, r14
mov r8d, ebx
call fcn.00417009
add r15, 0xffffffffffffffd8
mov r14, r12
test rax, rax
je 0x414ea5
mov rsi, rax
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
call fcn.0040ed9a
jmp 0x4152ef
mov rsi, qword [rsp + 0x1f8]
mov bl, byte [rsp + 0x88]
mov r15d, 2
test bl, bl
jne 0x414f80
mov rax, qword [rsp + 0x1e0]
test rax, rax
je 0x414f64
and qword [rsp + 0x2d8], 0
mov qword [rsp + 0x2e0], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x2e8], rcx
and qword [rsp + 0x2f8], 0
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x308], rcx
mov eax, 1
mov rdx, qword [rsp + 0x98]
jmp 0x414f68
xor eax, eax
xor edx, edx
lea rcx, [rsp + 0x2d0]
mov qword [rcx], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x40], rdx
call fcn.00411a3b
mov ecx, dword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2c8]
call fcn.004175b5
cmp r15, 2
jne 0x414fa8
mov rax, qword [rsp + 0x2b8]
mov qword [rax + 8], rsi
jmp 0x414fcc
mov rax, qword [rsp + 0x2b8]
mov qword [rax + 8], r13
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], r12
mov qword [rax + 0x30], rsi
mov qword [rax + 0x38], rbp
mov qword [rax], r15
movaps xmm6, xmmword [rsp + 0x6d0]
add rsp, 0x6e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
test rax, rax
je 0x4152ec
mov rdx, qword [rsp + 0xb0]
mov cl, 1
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x1ec], 0
mov rcx, qword [rsp + 0x258]
mov qword [rsp + 0x78], rcx
mov rbp, qword [rsp + 0x80]
mov r12, r13
lea rcx, [rsp + 0x260]
mov qword [rcx], rax
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rdx
xor esi, esi
xor edx, edx
call fcn.0041269b
cmp byte [r12 + 0xc4], 0
mov eax, 0x400
mov ecx, 0x608
cmove ecx, eax
or ecx, dword [r12 + 0xc0]
mov dword [rsp + 0x250], ecx
mov r13d, 2
mov eax, 2
mov r15d, 0
cmp byte [rsp + 0x88], 0
jne 0x41537e
mov qword [rsp + 0x118], rbp
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x210], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x218], xmm0
mov rsi, qword [rsp + 0x98]
test rsi, rsi
jne 0x4150d5
lea rcx, [rsp + 0x210]
xor edx, edx
call fcn.0041269b
xor eax, eax
mov rcx, qword [rsp + 0x1e0]
test rcx, rcx
setne al
cmove rsi, rcx
lea r8, [rsp + 0x2d0]
mov qword [r8], rax
and qword [r8 + 8], 0
mov qword [r8 + 0x10], rcx
mov rdx, qword [rsp + 0x90]
mov qword [r8 + 0x18], rdx
mov qword [r8 + 0x20], rax
and qword [r8 + 0x28], 0
mov qword [r8 + 0x30], rcx
mov qword [r8 + 0x38], rdx
mov qword [r8 + 0x40], rsi
lea rsi, [rsp + 0xb9]
lea r12, [rsp + 0xa0]
lea r13, [rsp + 0x170]
lea rbp, [rsp + 0x210]
mov rcx, r12
lea rdx, [rsp + 0x2d0]
call fcn.0040e1c7
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x415342
mov rdx, qword [rsp + 0xb0]
imul r8, rdx, 0x38
mov cl, byte [rax + r8 + 0x198]
cmp cl, 2
je 0x415342
add r8, rax
add r8, 0x168
mov r15, qword [r8]
mov r9, qword [r8 + 8]
mov qword [rsp + 0x88], r9
mov rdi, qword [r8 + 0x10]
shl rdx, 5
lea r9, [rax + rdx]
mov rbx, qword [rax + rdx]
mov rax, qword [rax + rdx + 8]
mov qword [rsp + 0x60], rax
mov rax, qword [r8 + 0x28]
mov qword [rsp + 0xb0], rax
movups xmm0, xmmword [r8 + 0x18]
movaps xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0xb8], cl
mov eax, dword [r8 + 0x31]
mov ecx, dword [r8 + 0x34]
mov dword [rsi + 3], ecx
mov dword [rsi], eax
movups xmm0, xmmword [r9 + 0x10]
movaps xmmword [rsp + 0x1f0], xmm0
mov rcx, r13
mov rdx, r12
call fcn.0041716d
cmp byte [rsp + 0x188], 2
mov r14, rsi
mov rsi, qword [rsp + 0x170]
je 0x41566f
mov rdx, qword [rsp + 0x178]
mov rcx, rsi
call fcn.00404ef9
mov rcx, rbp
mov rdx, r15
mov r8, rdi
call fcn.0040e411
mov rcx, r15
mov rdx, qword [rsp + 0x88]
call fcn.0040ed9a
mov rcx, rbp
mov dx, 0x3d
call fcn.0041269b
mov qword [rsp + 0xa0], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0x1f0]
mov rbx, r14
movups xmmword [r14 - 9], xmm0
mov r15, r13
mov rcx, r13
mov rdx, r12
call fcn.0041716d
cmp byte [rsp + 0x188], 2
mov rsi, qword [rsp + 0x170]
je 0x41568c
mov rdi, qword [rsp + 0x178]
mov rax, qword [rsp + 0x180]
add rax, rsi
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], rax
and word [rsp + 0x130], 0
mov rcx, rbp
lea rdx, [rsp + 0x120]
call fcn.00412676
mov rcx, rsi
mov rdx, rdi
call fcn.00404ef9
mov rcx, rbp
xor edx, edx
call fcn.0041269b
mov rsi, rbx
mov r13, r15
jmp 0x41513e
mov rsi, rbx
mov bl, byte [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov rcx, r14
mov rdx, qword [rsp + 0x258]
call fcn.0040ed9a
jmp 0x414f04
movzx eax, word [rdx + r8*2 - 8]
cmp eax, 0x42
je 0x4156c4
cmp eax, 0x43
je 0x4156ea
cmp eax, 0x62
je 0x4156c4
cmp eax, 0x63
je 0x4156ea
jmp 0x414e30
lea rcx, [rsp + 0x2d0]
call fcn.00411a3b
lea rsi, [rsp + 0x210]
mov rcx, rsi
xor edx, edx
call fcn.0041269b
mov rax, qword [rsi]
mov rsi, qword [rsi + 8]
mov r15, rax
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x118]
mov r13d, 2
mov qword [rsp + 0x88], rax
xor eax, eax
cmp byte [r12 + 0x88], 2
mov r14, r12
mov r12d, 0
je 0x41557f
lea rcx, [r14 + 0x70]
call fcn.004171ec
mov r12, rdx
test rax, rax
je 0x415535
mov rdi, qword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
jmp 0x416395
call fcn.0040ed84
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x170], 1
mov rcx, rdi
mov rdx, rsi
call fcn.0040ed9a
lea rcx, [rsp + 0x170]
call fcn.00416fea
lea rdx, [0x00c006d9]
lea rsi, [rsp + 0x120]
mov r8d, 4
mov rcx, rsi
call fcn.00412daf
cmp byte [rsi + 0x18], 2
je 0x415836
mov rcx, qword [rsp + 0x120]
mov rax, qword [rsp + 0x130]
add rax, rcx
lea rbx, [rsp + 0x170]
mov qword [rsp + 0x60], rcx
mov qword [rbx], rcx
mov qword [rbx + 8], rax
and word [rbx + 0x10], 0
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x80], rax
mov byte [rbx + 0x18], 1
lea rsi, [rsp + 0xb9]
lea r12, [rsp + 0x2e9]
lea r15, [rsp + 0x2d0]
lea r13, [rsp + 0x298]
lea rdi, [rsp + 0xa0]
mov rcx, r15
mov rdx, rbx
call fcn.00413008
mov al, byte [rsp + 0x2e8]
cmp al, 2
je 0x415817
cmp qword [rsp + 0x2e0], 0
je 0x41551b
mov rcx, qword [rsp + 0x2e0]
mov qword [rsp + 0xb0], rcx
movups xmm0, xmmword [rsp + 0x2d0]
movaps xmmword [rsp + 0xa0], xmm0
mov ecx, dword [r12]
mov edx, dword [r12 + 3]
mov dword [rsi + 3], edx
mov dword [rsi], ecx
mov byte [rsp + 0xb8], al
mov rcx, r15
lea rdx, [rsp + 0x260]
mov r8, r13
mov r9, rdi
call fcn.004169bd
mov rbp, qword [rsp + 0x2d0]
mov r14, qword [rsp + 0x2d8]
test rbp, rbp
jne 0x415890
xor ecx, ecx
mov rdx, r14
call fcn.00416fe0
jmp 0x415483
mov rcx, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2d8]
call fcn.00404ef9
jmp 0x415483
mov rax, qword [r12]
mov rcx, qword [r12 + 0x10]
add rcx, rax
lea rdx, [rsp + 0x2d0]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
and word [rdx + 0x10], 0
mov rdi, rsi
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.00417244
mov rcx, rsi
xor edx, edx
call fcn.0041269b
mov r12, qword [rsi]
mov rax, qword [rsi + 8]
mov rsi, rdi
mov r13, r12
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x98], rsi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1f0], xmm0
and qword [rsp + 0x200], 0
lea rcx, [0x00c060b0]
call sub.kernel32.dll_AcquireSRWLockExclusive
mov al, byte [0x00c060b8]
lea r8, [rsp + 0x120]
and qword [r8], 0
and qword [r8 + 0x10], 0
and qword [r8 + 0x20], 0
mov edi, dword [r14 + 0x10]
cmp dword [r14], 6
lea rbx, [rsp + 0x2c0]
mov rcx, r14
cmove rcx, rbx
lea rsi, [r14 + 0x20]
cmp dword [r14 + 0x20], 6
cmove rsi, rbx
mov edx, 0xfffffff6
call case.0x417d9c.9
mov qword [rsp + 0x60], rdx
test rax, rax
je 0x41561e
mov rdi, qword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r12, qword [rsp + 0x60]
jmp 0x416330
lea r8, [rsp + 0x130]
lea rcx, [r14 + 0x10]
cmp edi, 6
cmove rcx, rbx
mov edx, 0xfffffff5
call case.0x417d9c.9
mov qword [rsp + 0x90], rdx
test rax, rax
je 0x415849
mov rdi, qword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x90]
jmp 0x416328
mov rcx, rbx
mov rdx, qword [rsp + 0x60]
call fcn.00404ef9
mov rcx, r15
mov rdx, qword [rsp + 0x88]
call fcn.0040ed9a
mov rdi, qword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
lea rcx, [rsp + 0x2d0]
call fcn.00411a3b
mov rcx, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x218]
call fcn.0040ed9a
mov rbp, qword [rsp + 0x118]
jmp 0x4163a8
movzx ecx, word [rdx + r8*2 - 6]
or ecx, 0x20
cmp ecx, 0x61
jne 0x4156e0
movzx ecx, word [rdx + r8*2 - 4]
or ecx, 0x20
cmp ecx, 0x74
je 0x41570f
cmp ax, 0x43
jne 0x414e30
movzx eax, word [rdx + r8*2 - 6]
or eax, 0x20
cmp eax, 0x6d
jne 0x414e30
movzx eax, word [rdx + r8*2 - 4]
add eax, 0xffffffbc
test ax, 0xffdf
jne 0x414e30
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], r12
lea rax, [rsp + 0xa0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov esi, 2
xor edi, edi
mov r15d, 0xffffffff
xor ebx, ebx
cmp r8, 0x201
jae 0x415760
lea r14, [rsp + 0x2d0]
mov r12d, 0x200
mov r13, r8
jmp 0x4157a0
sub r8, rbx
lea rcx, [rsp + 0xa0]
mov rdx, r8
call fcn.0040ecda
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
cmp rdi, r15
mov ebx, 0xffffffff
cmovb rbx, rdi
mov qword [rsp + 0xb0], rbx
mov r14, rsi
mov r12, rbx
mov r13, rbx
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r14
mov edx, r13d
call sub.kernel32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x4157c5
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x4158af
mov r8d, ebp
cmp r13, r8
jne 0x4157ed
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x416402
add r13, r13
cmp r13, r15
cmovae r13, r15
mov r8, r13
jmp 0x415744
jb 0x415744
cmp r12, r8
jb 0x416402
lea rbx, [rsp + 0x170]
mov rcx, rbx
mov rdx, r14
call fcn.00411881
mov r13, qword [rbx]
jmp 0x4158bf
lea rcx, [rsp + 0x2d0]
call fcn.004130af
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x80]
call fcn.00404ef9
xor ecx, ecx
call fcn.00416fe0
lea rsi, [0x00c00a10]
jmp 0x414efd
mov rdi, r14
lea r8, [rsp + 0x140]
mov rcx, rsi
mov edx, 0xfffffff4
call case.0x417d9c.9
test rax, rax
je 0x415be5
mov r12, rdx
mov rdi, qword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x60]
mov r15, qword [rsp + 0x90]
jmp 0x416320
mov rsi, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x80]
call fcn.00404ef9
jmp 0x414c45
call fcn.0040ed84
mov qword [rsp + 0x178], rax
xor r13d, r13d
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x80]
mov rcx, rsi
mov rdx, rdi
call fcn.0040ed9a
test r13, r13
je 0x415bd8
mov rax, qword [rsp + 0x178]
mov r14, qword [rsp + 0x180]
lea rsi, [rsp + 0x120]
mov qword [rsi], r13
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r14
mov eax, 1
lea rdi, [rsp + 0x2f0]
mov qword [rdi - 0x20], rax
and qword [rdi - 0x18], 0
mov qword [rdi - 0x10], rax
and word [rdi - 8], 0
lea rax, [0x00c00a66]
mov qword [rdi], rax
lea rcx, [0x00c00a6e]
mov qword [rdi + 8], rcx
and word [rdi + 0x10], 0
mov r15d, 3
test rax, rax
je 0x415961
mov rcx, rdi
call fcn.0040e12c
test ax, ax
je 0x415958
mov ebx, edx
jmp 0x41599a
and qword [rsp + 0x2f0], 0
cmp qword [rsp + 0x2d0], 0
je 0x415a62
mov rax, qword [rsp + 0x2d8]
cmp qword [rsp + 0x2e0], rax
je 0x415a62
lea rcx, [rax + 1]
mov qword [rsp + 0x2d8], rcx
movzx ebx, word [rsp + rax*2 + 0x2e8]
cmp r14, qword [rsp + 0x128]
jne 0x415a44
mov rcx, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2f0]
test rdx, rdx
je 0x415a0c
mov rax, qword [rsp + 0x2f8]
sub rax, rdx
movzx r8d, word [rsp + 0x300]
add rax, 2
xor edx, edx
div r15
cmp r8w, 1
sbb rax, 0xffffffffffffffff
test rcx, rcx
je 0x415a25
mov rdx, qword [rsp + 0x2e0]
sub rdx, qword [rsp + 0x2d8]
mov rcx, 0xffffffffffffffff
add rax, rdx
jb 0x415a07
mov rcx, rax
mov rax, rcx
jmp 0x415a25
test rcx, rcx
je 0x415a23
mov rax, qword [rsp + 0x2e0]
sub rax, qword [rsp + 0x2d8]
jmp 0x415a25
xor eax, eax
mov rdx, 0xffffffffffffffff
inc rax
je 0x415a34
mov rdx, rax
mov rcx, rsi
call fcn.0040d917
mov r13, qword [rsp + 0x120]
mov word [r13 + r14*2], bx
inc r14
mov qword [rsp + 0x130], r14
mov rax, qword [rsp + 0x2f0]
jmp 0x415942
mov rbp, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
test rbp, rbp
je 0x4152ef
mov rdi, qword [r12 + 0x90]
mov r13, qword [r12 + 0xa0]
mov al, byte [r12 + 0xc5]
mov byte [rsp + 0x78], al
test al, al
setne byte [rsp + 0x60]
lea rax, str.cmd.exe__d__c__
lea rcx, [rsp + 0x170]
mov qword [rcx], rax
lea rax, [0x00c00826]
mov qword [rcx + 8], rax
and word [rcx + 0x10], 0
call fcn.0040e12c
test ax, ax
mov qword [rsp + 0x118], rbp
je 0x415d1b
mov ebx, edx
mov qword [rsp + 0x250], r13
mov rax, qword [rsp + 0x178]
sub rax, qword [rsp + 0x170]
movzx ecx, word [rsp + 0x180]
add rax, 2
mov r8d, 3
xor edx, edx
div r8
cmp cx, 1
sbb rax, 0xffffffffffffffff
cmp rax, 4
cmovb rax, r8
lea rcx, [rax + 1]
xor edx, edx
call fcn.0040d8ca
mov r15, rax
mov word [rax], bx
lea rbx, [rsp + 0xa0]
mov qword [rbx], rax
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], 1
mov rax, qword [rsp + 0x180]
lea r14, [rsp + 0x2d0]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x170]
movaps xmmword [r14], xmm0
mov r13d, 1
mov rcx, r14
call fcn.0040e12c
cmp ax, 1
jne 0x415ce9
mov ebp, edx
cmp r13, qword [rsp + 0xa8]
jne 0x415bc6
mov rax, qword [rsp + 0x2d8]
sub rax, qword [rsp + 0x2d0]
movzx ecx, word [rsp + 0x2e0]
add rax, 2
xor edx, edx
mov r8d, 3
div r8
cmp cx, 1
sbb rax, 0xffffffffffffffff
lea rdx, [rax + 1]
mov rcx, rbx
call fcn.0040d917
mov r15, qword [rsp + 0xa0]
mov word [r15 + r13*2], bp
inc r13
mov qword [rsp + 0xb0], r13
jmp 0x415b65
mov rsi, qword [rsp + 0x178]
jmp 0x415e9c
xorps xmm0, xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xa8], xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xf8], xmm0
test rdx, rdx
jne 0x415c30
cmp qword [rsp + 0x90], 0
jne 0x415c30
cmp qword [rsp + 0x60], 0
je 0x415c60
mov dword [rsp + 0xdc], 0x100
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rdx
mov rcx, qword [rdi + 0xb8]
test rcx, rcx
je 0x415ea8
and qword [rsp + 0x298], 0
mov dword [rsp + 0xa0], 0x70
mov rax, rcx
shr rax, 0x20
jne 0x415ec3
mov qword [rsp + 0x1d0], rdx
mov rdx, rcx
lea rsi, [rsp + 0x298]
xor ecx, ecx
mov qword [rsp + 0x1d8], rdx
xor r8d, r8d
mov r9, rsi
call sub.kernel32.dll_InitializeProcThreadAttributeList
mov rsi, qword [rsi]
test rsi, rsi
je 0x415f2c
js 0x416402
mov ecx, 1
mov rdx, rsi
call fcn.00404c5b
mov rbx, rax
test rax, rax
jne 0x415f31
jmp 0x416402
movups xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x120], xmm0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x130], rax
mov rbp, qword [rsp + 0x118]
mov r13, qword [rsp + 0x250]
jmp 0x415d32
mov qword [rsp + 0x120], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
lea rcx, [rsp + 0x120]
mov dx, 0x22
call fcn.0041269b
mov r15, qword [rsp + 0x70]
lea rax, [r15 + r15]
xor ecx, ecx
lea rbx, str.Windows_file_names_may_not_contain_____or_end_with___
mov r14, qword [rsp + 0x80]
cmp rax, rcx
je 0x415d73
cmp word [r14 + rcx], 0x22
lea rcx, [rcx + 2]
jne 0x415d5d
jmp 0x415e79
cmp word [r14 + r15*2 - 2], 0x5c
je 0x415e79
lea rbx, [r15 - 1]
lea rcx, [r14 + r15*2]
add rcx, 0xfffffffffffffffe
lea r8, [0x00c00826]
mov edx, 1
mov r9d, 1
call fcn.0040f8d1
xor edx, edx
test al, al
cmovne rdx, r14
test rdx, rdx
cmove rdx, r14
cmove rbx, r15
lea r8, [rdx + rbx*2]
lea rbx, [rsp + 0x120]
mov rcx, rbx
call fcn.0040e406
mov rcx, rbx
mov dx, 0x22
call fcn.0041269b
imul r15, r13, 0x28
add r15, rdi
lea r13, str._t_____________
cmp rdi, r15
je 0x415ee5
lea rcx, [rsp + 0x120]
mov dx, 0x20
call fcn.0041269b
mov bl, byte [rsp + 0x60]
cmp byte [rsp + 0x78], 0
jne 0x415e3e
cmp qword [rdi], 0
mov bl, byte [rsp + 0x60]
jne 0x415e3e
mov r12, qword [rdi + 8]
mov rbp, qword [rdi + 0x18]
xor r14d, r14d
cmp rbp, r14
setne bl
je 0x415e3e
mov r8b, byte [r12 + r14]
mov edx, 0x16
mov rcx, r13
call fcn.0041699d
inc r14
test al, al
je 0x415e1e
lea r14, [rdi + 0x28]
lea rcx, [rsp + 0x120]
mov rdx, rdi
mov r8d, ebx
call fcn.00417009
mov rdi, r14
test rax, rax
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x118]
je 0x415de4
mov rbx, rax
mov r14, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x128]
call fcn.0040ed9a
mov rcx, rbp
mov rdx, rsi
call fcn.0040ed9a
mov rsi, rbx
mov bl, byte [rsp + 0x88]
jmp 0x4152fe
mov qword [rsp + 0x1d0], rdx
lea rax, [rsp + 0xa0]
mov dword [rax], 0x68
jmp 0x41615d
lea r12, [0x00c00aa0]
mov rdi, qword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
mov r15, qword [rsp + 0x90]
jmp 0x416310
lea rdi, [rsp + 0x120]
mov rcx, rdi
mov dx, 0x22
call fcn.0041269b
mov rax, qword [rdi]
mov rbx, qword [rdi + 8]
test rax, rax
je 0x4163f0
mov rdx, qword [rsp + 0x130]
mov cl, 1
mov dword [rsp + 0x1ec], ecx
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x78], rsi
jmp 0x415035
mov ebx, 1
cmp rsi, 1
mov rax, rsi
adc rax, 0
test rsi, rsi
cmove rax, rsi
mov qword [rsp + 0x2b0], rax
lea r9, [rsp + 0x298]
mov rcx, rbx
mov rsi, qword [rsp + 0x1d8]
mov edx, esi
xor r8d, r8d
call sub.kernel32.dll_InitializeProcThreadAttributeList
test eax, eax
je 0x41611e
mov rdx, rdi
mov rax, qword [rdi + 0xa8]
xor edi, edi
test rax, rax
setne dil
mov rcx, rsi
cmove rcx, rax
mov r8, rsi
lea rsi, [rsp + 0x178]
mov qword [rsi - 8], rdi
and qword [rsi], 0
mov rdx, qword [rdx + 0xb0]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rdi
and qword [rsi + 0x20], 0
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rdx
mov qword [rsi + 0x38], rcx
xorps xmm6, xmm6
mov rax, r8
mov qword [rsp + 0x68], rbx
test rax, rax
je 0x41612b
dec rax
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1b0]
test rax, rax
je 0x41612b
dec rax
mov qword [rsp + 0x1b0], rax
mov rbx, qword [rsp + 0x178]
test rdi, rdi
je 0x416041
test rbx, rbx
jne 0x416041
mov rdx, qword [rsp + 0x180]
mov r8, qword [rsp + 0x188]
mov rcx, rsi
call fcn.00401740
mov qword [rsp + 0x170], 1
mov edi, 1
mov rbx, qword [rsp + 0x178]
jmp 0x41604a
test rdi, rdi
je 0x416402
mov r8, qword [rsp + 0x180]
mov r14, qword [rsp + 0x188]
movzx eax, word [rbx + 0x16a]
cmp r14, rax
jb 0x416082
mov rax, qword [rbx]
test rax, rax
je 0x416402
inc r8
movzx r14d, word [rbx + 0x168]
mov rbx, rax
jmp 0x41605a
test r8, r8
je 0x4160a1
mov rdx, qword [rbx + r14*8 + 0x178]
dec r8
lea rcx, [rsp + 0x210]
call fcn.00401740
jmp 0x4160be
lea rax, [r14 + 1]
mov qword [rsp + 0x210], rbx
and qword [rsp + 0x218], 0
mov qword [rsp + 0x220], rax
imul rax, r14, 0x18
mov rcx, qword [rsp + 0x220]
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0x210]
mov qword [rsi], rcx
mov rcx, qword [rsp + 0x218]
mov qword [rsi + 8], rcx
mov r8, qword [rbx + r14*8 + 8]
mov r9, qword [rbx + rax + 0x60]
mov rax, qword [rbx + rax + 0x70]
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
xor edx, edx
call sub.kernel32.dll_UpdateProcThreadAttribute
test eax, eax
je 0x41611e
mov rax, qword [rsp + 0x1b8]
jmp 0x415fcc
call fcn.0040ed84
mov r12, rax
jmp 0x4162e2
or dword [rsp + 0x250], 0x80000
lea rax, [rsp + 0x2d0]
lea rsi, [rsp + 0xa0]
mov ecx, 0xd
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov qword [rax + 0x68], rbx
mov rcx, qword [rsp + 0x1d8]
mov qword [rsp + 0x1d8], rcx
mov rsi, qword [rsp + 0x260]
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
mov eax, dword [rsp + 0x250]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov rcx, rbp
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4162cf
mov qword [rsp + 0x70], rsi
mov rcx, rbx
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x118], rbp
mov rsi, qword [rsp + 0x1f0]
mov rbp, qword [rsp + 0x1f8]
mov r15, qword [rsp + 0x120]
mov r13, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x130]
mov r14, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov r12, qword [rsp + 0x148]
cmp qword [rsp + 0x1d8], 0
je 0x416222
mov rdx, qword [rsp + 0x2b0]
call fcn.00417581
mov rcx, qword [rsp + 0x1d0]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x90]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x60]
call sub.kernel32.dll_CloseHandle
mov ecx, 2
call fcn.004175b5
lea rcx, [0x00c060b0]
call sub.kernel32.dll_ReleaseSRWLockExclusive
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x1e0]
call fcn.0040ed9a
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x98]
call fcn.0040ed9a
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x70]
call fcn.0040ed9a
mov rcx, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x78]
call fcn.0040ed9a
cmp byte [rsp + 0x1ec], 0
je 0x414f80
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x258]
call fcn.0040ed9a
jmp 0x414f80
call fcn.0040ed84
mov r12, rax
cmp qword [rsp + 0x1d8], 0
je 0x4162f2
mov rcx, rbx
mov rdx, qword [rsp + 0x2b0]
call fcn.00417581
mov rdi, qword [rsp + 0x78]
mov ebx, dword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
mov r15, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x1d0]
mov rcx, rdx
call sub.kernel32.dll_CloseHandle
mov rsi, qword [rsp + 0x98]
mov rcx, r15
call sub.kernel32.dll_CloseHandle
mov rcx, r14
call sub.kernel32.dll_CloseHandle
mov ecx, 2
call fcn.004175b5
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x128]
call fcn.004175c3
mov rcx, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x138]
call fcn.004175c3
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
call fcn.004175c3
lea rcx, [0x00c060b0]
call sub.kernel32.dll_ReleaseSRWLockExclusive
mov rcx, r13
mov rdx, qword [rsp + 0x1e0]
call fcn.0040ed9a
mov rcx, qword [rsp + 0x88]
mov rdx, rsi
call fcn.0040ed9a
mov rsi, r12
mov rcx, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x268]
call fcn.0040ed9a
mov rcx, rbp
mov rdx, rdi
call fcn.0040ed9a
mov r15d, 2
test bl, bl
jne 0x414f80
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x258]
call fcn.0040ed9a
jmp 0x414f80
mov r14, qword [rsp + 0x80]
jmp 0x415e8e
call fcn.0040ed84
ud2