Function at 0x1401bb8f0
Capabilities:
Create process on windows
Encode data using base64
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov byte [rsp + 0x238], r9b
mov r14, r8
mov qword [rsp + 0x100], rcx
movzx eax, byte [rdx + 0x68]
test al, al
sete cl
mov qword [rsp + 0x80], rdx
mov r8, qword [rdx + 0x60]
test r8, r8
sete dl
and dl, cl
mov byte [rsp + 0x228], dl
je 0x1401bb943
xor ebx, ebx
jmp 0x1401bc7d7
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x1e8], 0
mov qword [rsp + 0x1f8], 0
test al, al
je 0x1401bb981
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x50]
test rax, rax
jne 0x1401bbbf0
jmp 0x1401bc5f4
mov qword [rsp + 0x88], r8
call sub.kernel32.dll_GetEnvironmentStringsW
test rax, rax
je 0x1401be778
mov qword [rsp + 0x78], rax
cmp word [rax], 0
je 0x1401bbbc9
lea rdi, [rsp + 0xb0]
lea r14, [rsp + 0x1a0]
lea r15, [rsp + 0x90]
mov r12, qword [rsp + 0x78]
jmp 0x1401bb9dc
cmp word [r12], 0
je 0x1401bbbc9
mov rbp, r12
mov rcx, 0xfffffffffffffffe
xor edx, edx
nop dword [rax + rax]
mov rbx, rdx
mov rax, rcx
inc rdx
add rcx, 2
cmp word [rbp + rbx*2], 0
jne 0x1401bb9f0
lea r12, [rdx*2]
add r12, rbp
cmp rbx, 1
je 0x1401bb9d0
test rbx, rbx
je 0x1401be774
xor esi, esi
nop word cs:[rax + rax]
cmp word [rbp + rsi*2 + 2], 0x3d
je 0x1401bba50
inc rsi
add rax, 0xfffffffffffffffe
jne 0x1401bba30
jmp 0x1401bb9d0
cmp rsi, rbx
jae 0x1401be774
lea r8, [rsi + 1]
mov rcx, r14
mov rdx, rbp
call fcn.1401c8d80
add rsi, 2
sub rbx, rsi
jb 0x1401be774
lea rdx, [rsi*2]
add rdx, rbp
mov rcx, rdi
mov r8, rbx
call fcn.1401c8d80
movups xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
movzx r13d, byte [rsp + 0xa8]
movups xmm0, xmmword [rdi - 7]
movups xmm1, xmmword [rdi + 9]
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x120], xmm1
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x12f], rax
cmp r13b, 2
je 0x1401bbbc9
lea rax, [rsp + 0x117]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x210], xmm1
movaps xmmword [rsp + 0x200], xmm0
lea rax, [rsi + rbp]
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], rax
mov word [rsp + 0x1b0], 0
mov rcx, r15
mov rdx, r14
call fcn.1401c6590
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbp
mov byte [rsp + 0xc0], r13b
mov eax, dword [rsp + 0x110]
mov ecx, dword [rsp + 0x113]
mov dword [rdi + 0x14], ecx
mov dword [rdi + 0x11], eax
mov rcx, r14
lea rdx, [rsp + 0x1e8]
mov r8, r15
lea r9, [rsp + 0x200]
call fcn.1401ba720
cmp byte [rsp + 0x1b8], 2
je 0x1401bb9d0
cmp qword [rsp + 0x1a8], 0
je 0x1401bb9d0
mov r8, qword [rsp + 0x1a0]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x1401bb9d0
mov rcx, qword [rsp + 0x78]
call sub.kernel32.dll_FreeEnvironmentStringsW
mov r8, qword [rsp + 0x88]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x1401bc5f4
test r8, r8
je 0x1401bc5f4
mov rcx, qword [rsp + 0x80]
mov r9, qword [rcx + 0x58]
xor r14d, r14d
jmp 0x1401bbc38
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0x60]
call sub.kernel32.dll_HeapFree
mov eax, 0
mov r8, qword [rsp + 0x88]
dec r8
mov r9, qword [rsp + 0x78]
je 0x1401bc5f4
test r14, r14
jne 0x1401bbcd3
test r9, r9
je 0x1401bbc74
mov rdx, r9
and rdx, 7
je 0x1401bbc79
mov rcx, r9
and rcx, 0xfffffffffffffff8
mov r14, rax
nop dword [rax]
mov r14, qword [r14 + 0x3d8]
dec rdx
jne 0x1401bbc60
cmp r9, 8
jae 0x1401bbc90
jmp 0x1401bbcce
mov r14, rax
jmp 0x1401bbcce
mov r14, rax
mov rcx, r9
cmp r9, 8
jb 0x1401bbcce
nop word cs:[rax + rax]
mov rax, qword [r14 + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov r14, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1401bbc90
xor r9d, r9d
xor eax, eax
movzx ecx, word [r14 + 0x3d2]
mov r15, r14
mov rsi, r9
cmp r9, rcx
jb 0x1401bbd17
nop word cs:[rax + rax]
mov rcx, qword [r15 + 0x160]
test rcx, rcx
je 0x1401be774
inc rax
movzx esi, word [r15 + 0x3d0]
mov r15, rcx
cmp si, word [rcx + 0x3d2]
jae 0x1401bbcf0
test rax, rax
mov qword [rsp + 0x88], r8
je 0x1401bbdc0
mov r14, qword [r15 + rsi*8 + 0x3e0]
mov rcx, rax
dec rcx
je 0x1401bbdae
mov rdx, rcx
and rdx, 7
je 0x1401bbd65
mov rcx, rdx
nop word cs:[rax + rax]
mov r14, qword [r14 + 0x3d8]
dec rcx
jne 0x1401bbd50
not rdx
add rdx, rax
mov rcx, rdx
add rax, 0xfffffffffffffffe
cmp rax, 7
jb 0x1401bbdae
nop
mov rax, qword [r14 + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov r14, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1401bbd70
xor ebp, ebp
jmp 0x1401bbdc7
lea rbp, [rsi + 1]
mov r14, r15
imul rax, rsi, 0x38
lea r12, [r15 + rax]
add r12, 0x168
shl rsi, 5
cmp byte [r15 + rsi + 0x18], 2
mov qword [rsp + 0x78], rbp
jne 0x1401bbed0
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1401bbc1d
mov rax, qword [rsp + 0x1f0]
mov r13, qword [r12]
mov r12d, dword [r12 + 0x10]
lea ecx, [rax + 7]
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x70]
lea rcx, [r15 + 0x168]
movzx ebp, word [r15 + 0x3d2]
imul rbx, rbp, 0x38
mov rdi, 0xffffffffffffffff
nop word cs:[rax + rax]
test rbx, rbx
je 0x1401bbea0
lea rsi, [rcx + 0x38]
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x10]
mov dword [rsp + 0x20], 1
mov rcx, r13
mov edx, r12d
call sub.kernel32.dll_CompareStringOrdinal
inc rdi
add rbx, 0xffffffffffffffc8
mov rcx, rsi
cmp eax, 3
je 0x1401bbe50
cmp eax, 1
jne 0x1401bbf30
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x1401bbeb1
jmp 0x1401bbc1d
mov rdi, rbp
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1401bbc1d
mov r15, qword [r15 + rdi*8 + 0x3d8]
dec rax
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x68]
add al, 7
mov dword [rsp + 0x68], eax
jmp 0x1401bbe2b
mov rbx, qword [r12 + 0x18]
mov rdi, qword [r12 + 0x28]
test rdi, rdi
je 0x1401bc12c
js 0x1401be774
movzx eax, byte [0x1402d9160]
mov rax, qword [0x1402d9150]
test rax, rax
jne 0x1401bbf11
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401be774
mov qword [0x1402d9150], rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
mov r13, rax
test rax, rax
jne 0x1401bc132
jmp 0x1401be774
cmp eax, 2
mov r9, qword [rsp + 0x60]
jne 0x1401be778
mov byte [rsp + 0x5f], 0
test r9, r9
je 0x1401bc2f1
mov rax, qword [r15 + rdi*8 + 0x3d8]
mov rcx, r9
dec rcx
je 0x1401bc02e
test cl, 7
je 0x1401bbfa6
movzx ecx, byte [rsp + 0x68]
and ecx, 7
neg rcx
mov edx, 1
nop word cs:[rax + rax]
movzx r8d, word [rax + 0x3d2]
mov rax, qword [rax + r8*8 + 0x3d8]
lea r8, [rcx + rdx]
inc r8
inc rdx
cmp r8, 1
jne 0x1401bbf80
mov rcx, r9
sub rcx, rdx
add r9, 0xfffffffffffffffe
cmp r9, 7
jb 0x1401bc02e
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1401bbfb0
movzx ecx, word [rax + 0x3d2]
dec rcx
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], rcx
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x240]
lea r8, [rsp + 0x5f]
call fcn.1401b71a0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movups xmm2, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x1c0], xmm2
movaps xmmword [rsp + 0x1b0], xmm1
movaps xmmword [rsp + 0x1a0], xmm0
lea rax, [rsp + 0xc8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x190], xmm1
mov r8, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf8]
movzx r9d, word [r8 + 0x3d2]
mov rax, r8
cmp rdx, r9
jb 0x1401bc33c
nop dword [rax]
mov rax, qword [r8 + 0x160]
test rax, rax
je 0x1401bc334
inc rcx
movzx edx, word [r8 + 0x3d0]
mov r8, rax
cmp dx, word [rax + 0x3d2]
jae 0x1401bc100
jmp 0x1401bc33c
mov r13d, 1
mov rcx, r13
mov rdx, rbx
mov r8, rdi
call sub.msvcrt.dll_memcpy
movzx ecx, byte [r12 + 0x30]
mov rdx, qword [r12]
mov rbx, qword [r12 + 0x10]
mov ebp, 2
test rbx, rbx
mov byte [rsp + 0x60], cl
je 0x1401bc1c0
mov rax, rbx
shr rax, 0x3e
jne 0x1401be774
mov r12, rbx
add r12, rbx
je 0x1401bc1c0
movzx eax, byte [0x1402d9160]
mov rax, qword [0x1402d9150]
test rax, rax
mov qword [rsp + 0x68], rdx
jne 0x1401bc19f
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401be774
mov qword [0x1402d9150], rax
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapAlloc
mov rbp, rax
test rax, rax
mov rdx, qword [rsp + 0x68]
jne 0x1401bc1c3
jmp 0x1401be774
xor r12d, r12d
add r15, rsi
mov rcx, rbp
mov r8, r12
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rdi
movzx eax, byte [rsp + 0x60]
mov byte [rsp + 0xc0], al
mov rbx, qword [r15]
mov rdi, qword [r15 + 0x10]
test rdi, rdi
je 0x1401bc261
js 0x1401be774
movzx eax, byte [0x1402d9160]
mov rax, qword [0x1402d9150]
test rax, rax
jne 0x1401bc247
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401be774
mov qword [0x1402d9150], rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
mov r12, rax
test rax, rax
jne 0x1401bc267
jmp 0x1401be774
mov r12d, 1
mov rcx, r12
mov rdx, rbx
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rdi
movzx eax, byte [r15 + 0x18]
mov byte [rsp + 0x128], al
lea rcx, [rsp + 0x1a0]
lea rdx, [rsp + 0x1e8]
lea r8, [rsp + 0x90]
lea r9, [rsp + 0x110]
call fcn.1401ba720
cmp byte [rsp + 0x1b8], 2
je 0x1401bbc1d
cmp qword [rsp + 0x1a8], 0
je 0x1401bbc1d
mov r8, qword [rsp + 0x1a0]
mov rcx, qword [0x1402d9150]
xor edx, edx
jmp 0x1401bbc18
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], rdi
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x110]
lea r8, [rsp + 0x5f]
call fcn.1401b71a0
mov r9, qword [rsp + 0x1e0]
jmp 0x1401bc510
mov rdx, rcx
mov rcx, r8
xor eax, eax
imul r8, rdx, 0x38
mov r9, rdx
shl r9, 5
mov r10, qword [rax + r8 + 0x198]
mov qword [rsp + 0x140], r10
movups xmm0, xmmword [rax + r8 + 0x168]
movups xmm1, xmmword [rax + r8 + 0x178]
movups xmm2, xmmword [rax + r8 + 0x188]
movaps xmmword [rsp + 0x130], xmm2
movaps xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x110], xmm0
mov r10, qword [rsp + 0x1d0]
mov qword [rax + r8 + 0x198], r10
movaps xmm0, xmmword [rsp + 0x1a0]
movaps xmm1, xmmword [rsp + 0x1b0]
movaps xmm2, xmmword [rsp + 0x1c0]
movups xmmword [rax + r8 + 0x188], xmm2
movups xmmword [rax + r8 + 0x178], xmm1
movups xmmword [rax + r8 + 0x168], xmm0
movups xmm0, xmmword [rax + r9]
movups xmm1, xmmword [rax + r9 + 0x10]
lea r8, [rsp + 0x148]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
movaps xmm0, xmmword [rsp + 0x180]
movaps xmm1, xmmword [rsp + 0x190]
movups xmmword [rax + r9], xmm0
movups xmmword [rax + r9 + 0x10], xmm1
test rcx, rcx
je 0x1401bc4a0
mov rax, qword [rax + rdx*8 + 0x3e0]
mov rdx, rcx
dec rdx
mov r9, qword [rsp + 0x1e0]
je 0x1401bc4a8
mov r8, rdx
and r8, 7
je 0x1401bc455
mov rdx, r8
nop word cs:[rax + rax]
mov rax, qword [rax + 0x3d8]
dec rdx
jne 0x1401bc440
not r8
add r8, rcx
mov rdx, r8
add rcx, 0xfffffffffffffffe
cmp rcx, 7
jb 0x1401bc4a8
nop
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
add rdx, 0xfffffffffffffff8
jne 0x1401bc460
jmp 0x1401bc4a8
mov r9, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0xe0], rcx
movaps xmm0, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmm0, xmmword [rsp + 0x110]
movaps xmm1, xmmword [rsp + 0x120]
movaps xmm2, xmmword [rsp + 0x130]
movaps xmm3, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0xc0], xmm3
movaps xmmword [rsp + 0xb0], xmm2
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xe8], rax
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xb0]
movzx r12d, byte [rsp + 0xc0]
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x60], rax
dec qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0xd0]
movzx edi, byte [rsp + 0xe0]
cmp byte [rsp + 0x5f], 0
je 0x1401bc5a6
test r9, r9
je 0x1401be774
mov r8, qword [rsp + 0x70]
mov rax, qword [r8 + 0x3d8]
mov qword [rsp + 0x1e8], rax
dec r9
mov qword [rsp + 0x1f0], r9
mov qword [rax + 0x160], 0
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp r12b, 2
je 0x1401bbc1d
test rbp, rbp
je 0x1401bc5c6
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
test r15, r15
je 0x1401bc5dc
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
cmp dil, 2
je 0x1401bbc1d
test rsi, rsi
jne 0x1401bbc0a
jmp 0x1401bbc1d
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x88], rax
mov r14, qword [rsp + 0x1f0]
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x60], rax
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1401bc644
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401be774
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 4
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1401be774
mov rsi, rax
mov dword [rax], 0x48544150
add rax, 4
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], rax
mov word [rsp + 0x120], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x110]
call fcn.1401c6590
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], 4
mov qword [rsp + 0xb8], 4
mov byte [rsp + 0xc0], 0
mov r12, qword [rsp + 0x88]
test r12, r12
mov qword [rsp + 0x68], r14
je 0x1401bc791
mov qword [rsp + 0x70], rsi
mov rdi, qword [rsp + 0x90]
mov ebp, dword [rsp + 0xa0]
xor eax, eax
mov qword [rsp + 0x78], rax
lea rcx, [r12 + 0x168]
movzx r13d, word [r12 + 0x3d2]
imul rbx, r13, 0x38
mov r15, 0xffffffffffffffff
nop dword [rax + rax]
test rbx, rbx
je 0x1401bc750
lea rsi, [rcx + 0x38]
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x10]
mov dword [rsp + 0x20], 1
mov rcx, rdi
mov edx, ebp
call sub.kernel32.dll_CompareStringOrdinal
inc r15
add rbx, 0xffffffffffffffc8
mov rcx, rsi
cmp eax, 3
je 0x1401bc710
cmp eax, 1
jne 0x1401bc767
jmp 0x1401bc753
mov r15, r13
sub r14, 1
jb 0x1401bcc30
mov r12, qword [r12 + r15*8 + 0x3d8]
jmp 0x1401bc6ef
cmp eax, 2
jne 0x1401be778
shl r15, 5
mov rax, qword [r12 + r15]
mov qword [rsp + 0x78], rax
mov r12, qword [r12 + r15 + 0x10]
mov r14, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x70]
jmp 0x1401bc7a0
xor eax, eax
mov qword [rsp + 0x78], rax
mov r14, qword [rsp + 0x108]
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x98], 0
je 0x1401bc7d2
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rbx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rdi, qword [rax + 0x30]
mov rsi, qword [rax + 0x40]
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x1f0], rsi
lea rbp, str.program_path_has_no_file_name
test rsi, rsi
je 0x1401bd3b0
cmp rsi, 4
jae 0x1401bc824
lea rax, [0x1401c9230]
movzx ecx, byte [rsi + rdi - 1]
call rax
test al, al
je 0x1401bc84b
jmp 0x1401bd3b0
cmp dword [rdi], 0x5c3f5c5c
lea rcx, [0x1401c9240]
lea rax, [0x1401c9230]
cmove rax, rcx
movzx ecx, byte [rsi + rdi - 1]
call rax
test al, al
jne 0x1401bd3b0
cmp rsi, 3
jbe 0x1401bc948
movzx eax, byte [rsi + rdi - 4]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x2e
jne 0x1401bc96c
movzx eax, byte [rdi + rsi - 3]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
mov al, 1
cmp cl, 0x65
jne 0x1401bc8bc
movzx ecx, byte [rdi + rsi - 2]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x1401bc8bc
movzx eax, byte [rdi + rsi - 1]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x65
setne al
xor ecx, ecx
nop
cmp rsi, rcx
je 0x1401bcabc
movzx edx, byte [rdi + rcx]
cmp edx, 0x2f
je 0x1401bc8da
inc rcx
cmp edx, 0x5c
jne 0x1401bc8c0
test al, al
jne 0x1401bc98a
lea rcx, [rsp + 0x110]
mov rdx, rdi
mov r8, rsi
call fcn.1401b97d0
mov rcx, qword [rsp + 0x110]
mov rax, qword [rsp + 0x118]
test rcx, rcx
je 0x1401bcc51
mov rdx, qword [rsp + 0x120]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rdx
lea rcx, [rsp + 0x200]
lea rdx, [rsp + 0x90]
call fcn.1401c5830
jmp 0x1401bd1c7
xor eax, eax
nop word [rax + rax]
cmp rsi, rax
je 0x1401bcabc
movzx ecx, byte [rdi + rax]
cmp ecx, 0x2f
je 0x1401bc98a
inc rax
cmp ecx, 0x5c
jne 0x1401bc950
jmp 0x1401bc98a
xor eax, eax
nop
cmp rsi, rax
je 0x1401bcabc
movzx ecx, byte [rdi + rax]
cmp ecx, 0x2f
je 0x1401bc98a
inc rax
cmp ecx, 0x5c
jne 0x1401bc970
test rsi, rsi
js 0x1401be774
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1401bc9be
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1401be774
mov rcx, rax
mov qword [0x1402d9150], rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1401be774
mov rbx, rax
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0xa8], 0
mov eax, dword [rsp + 0x1a0]
mov ecx, dword [rsp + 0x1a3]
mov dword [rsp + 0xa9], eax
mov dword [rsp + 0xac], ecx
lea rdx, [0x1402a1763]
lea rcx, [rsp + 0x90]
mov r8d, 4
call fcn.1401c5900
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov eax, dword [rsp + 0xa9]
mov dword [rsp + 0x1a0], eax
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x1a3], eax
lea rcx, [rsp + 0x110]
mov rdx, rsi
mov r8, rdi
call fcn.1401be7c0
cmp qword [rsp + 0x110], 0
je 0x1401bcbab
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x210], rax
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x200], xmm0
test rbx, rbx
jne 0x1401bd1b6
jmp 0x1401bd1c7
lea rax, [rdi + rsi]
xor r9d, r9d
lea rbp, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_foundg
mov rcx, rdi
jmp 0x1401bcadc
xor r9d, r9d
test dx, dx
je 0x1401bd3b0
mov dx, 1
test r9w, r9w
jne 0x1401bcad0
cmp rcx, rax
je 0x1401bcc16
movzx r8d, byte [rcx]
test r8b, r8b
js 0x1401bcb00
inc rcx
jmp 0x1401bcba0
mov r9d, r8d
and r9d, 0x1f
movzx r11d, byte [rcx + 1]
and r11d, 0x3f
cmp r8b, 0xdf
jbe 0x1401bcb56
movzx r10d, byte [rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r8b, 0xf0
jb 0x1401bcb66
movzx r8d, byte [rcx + 3]
add rcx, 4
and r9d, 7
shl r9d, 0x12
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
or r8d, r9d
cmp r8d, 0xffff
ja 0x1401bcb7d
jmp 0x1401bcba0
add rcx, 2
shl r9d, 6
or r9d, r11d
mov r8d, r9d
jmp 0x1401bcba0
add rcx, 3
shl r9d, 0xc
or r10d, r9d
mov r8d, r10d
cmp r8d, 0xffff
jbe 0x1401bcba0
and r8d, 0x3ff
or r8d, 0xdc00
mov r9d, r8d
jmp 0x1401bcad3
xor r9d, r9d
mov edx, r8d
jmp 0x1401bcad3
mov rcx, rsi
mov rdx, rdi
call fcn.1401c8710
test rax, rax
je 0x1401bd150
cmp rdx, 2
jne 0x1401bcbdd
movzx ecx, word [rax]
cmp ecx, 0x2e2e
jne 0x1401bcbdd
mov ecx, 2
xor r8d, r8d
jmp 0x1401bd130
mov rcx, rdx
test rcx, rcx
je 0x1401bcc35
mov r9, rcx
dec rcx
cmp byte [rax + r9 - 1], 0x2e
jne 0x1401bcbe0
mov r10, rdx
sub r10, r9
jb 0x1401be774
test rcx, rcx
je 0x1401bd12a
mov r8, rax
add r8, r9
mov rdx, r10
jmp 0x1401bd130
cmp rsi, 0xf
ja 0x1401bcc3f
xor ebp, ebp
xor eax, eax
cmp byte [rdi + rax], 0x2e
je 0x1401bcc6a
inc rax
cmp rsi, rax
jne 0x1401bcc20
jmp 0x1401bcc6f
jmp 0x1401bc782
mov r8, rax
xor eax, eax
jmp 0x1401bd130
mov cl, 0x2e
mov rdx, rdi
mov r8, rsi
call fcn.14003c5c0
mov rbp, rax
jmp 0x1401bcc6f
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x200], 0
jmp 0x1401bd1c7
mov ebp, 1
cmp rbp, 1
sete byte [rsp + 0x5f]
test rbx, rbx
je 0x1401bccc7
add r12, rbx
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x1a8], r12
mov word [rsp + 0x1b0], 0
mov byte [rsp + 0x1b8], 1
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x1a0]
call fcn.1401cadb0
movzx eax, byte [rsp + 0xa8]
cmp al, 2
jne 0x1401bced6
lea rcx, [rsp + 0x110]
call fcn.1401ba590
cmp byte [rsp + 0x128], 2
jne 0x1401bcd4c
mov rax, qword [rsp + 0x110]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1401bce3f
test rcx, rcx
je 0x1401bce3f
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1401bcd36
cmp qword [rbx + 0x10], 0x11
jb 0x1401bcd25
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
jmp 0x1401bce3f
mov r15, r14
mov rsi, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x120]
mov r14, qword [rsp + 0x128]
mov rcx, rsi
mov rdx, rdi
call fcn.1401c80b0
cmp rdi, rdx
cmovb rdx, rdi
test rax, rax
cmove rdx, rdi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0xa8], r14
mov rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x90]
call fcn.1401c74e0
cmp byte [rsp + 0x5f], 0
jne 0x1401bcde6
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rsp + 0x90]
mov r8d, 3
call fcn.1401c8830
mov rsi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
lea rcx, [rsp + 0x1a0]
mov rdx, rsi
call fcn.1401be7c0
cmp qword [rsp + 0x98], 0
mov r14, r15
je 0x1401bce25
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x1a0]
test rax, rax
je 0x1401bce3f
movups xmm0, xmmword [rsp + 0x1a8]
jmp 0x1401bd4ab
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x1e8]
lea r8, [rsp + 0x5f]
call fcn.1401b9b90
cmp qword [rsp + 0x90], 0
je 0x1401bd03b
mov rax, qword [rsp + 0x98]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1401bd04c
test rcx, rcx
je 0x1401bd04c
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1401bcec0
cmp qword [rbx + 0x10], 0x11
jb 0x1401bceaf
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
jmp 0x1401bd04c
lea r15, [rsp + 0x129]
lea r12, [rsp + 0xa9]
lea rsi, [rsp + 0x90]
lea rdi, [rsp + 0x1a0]
lea r13, [rsp + 0x110]
cmp qword [rsp + 0xa0], 0
jne 0x1401bcf69
mov rcx, qword [rsp + 0x98]
nop word cs:[rax + rax]
test rcx, rcx
je 0x1401bcf3b
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, rsi
mov rdx, rdi
call fcn.1401cadb0
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x1401bccc7
mov rcx, qword [rsp + 0x98]
cmp qword [rsp + 0xa0], 0
je 0x1401bcf20
mov ecx, dword [r12]
mov edx, dword [r12 + 3]
mov dword [r15 + 3], edx
mov dword [r15], ecx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x120], rcx
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x128], al
mov rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x1f0]
mov rcx, r13
call fcn.1401c74e0
cmp rbp, 1
je 0x1401bcfd3
mov r8d, 3
mov rcx, r13
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
call fcn.1401c8830
mov rbx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x120]
mov rcx, rsi
mov rdx, rbx
call fcn.1401be7c0
cmp qword [rsp + 0x118], 0
je 0x1401bd00a
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x90]
test rax, rax
jne 0x1401be422
mov rcx, rsi
mov rdx, rdi
call fcn.1401cadb0
movzx eax, byte [rsp + 0xa8]
cmp al, 2
jne 0x1401bcefe
jmp 0x1401bccc7
mov rax, qword [rsp + 0x98]
test rax, rax
jne 0x1401bd4a3
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x1e8]
lea r8, [rsp + 0x5f]
call fcn.1401ba090
cmp qword [rsp + 0x90], 0
je 0x1401bd492
lea rcx, [rsp + 0x90]
call fcn.1401be8f0
lea rdx, [0x1402a175f]
lea rcx, [rsp + 0x180]
mov r8d, 4
call fcn.1401cafd0
cmp byte [rsp + 0x198], 2
je 0x1401bd11e
mov rsi, qword [rsp + 0x180]
mov r15, qword [rsp + 0x188]
mov rax, qword [rsp + 0x190]
add rax, rsi
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], rax
mov word [rsp + 0x1b0], 0
mov byte [rsp + 0x1b8], 1
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x1a0]
call fcn.1401cadb0
movzx eax, byte [rsp + 0xa8]
cmp al, 2
jne 0x1401bdd53
test r15, r15
je 0x1401bd11e
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
lea rbp, [0x1402a1778]
jmp 0x1401bd3b0
xor r8d, r8d
mov rcx, rdx
test rax, rax
cmovne r8, rax
test r8, r8
je 0x1401bd150
test rax, rax
cmove rcx, rdx
add r8, rcx
sub r8, rsi
cmp rdi, r8
cmovae rdi, r8
lea rcx, [rsp + 0x90]
mov rdx, rsi
mov r8, rdi
call fcn.1401b97d0
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x98]
test rcx, rcx
je 0x1401bd470
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rdx
lea rcx, [rsp + 0x200]
lea rdx, [rsp + 0x90]
call fcn.1401c5830
test rbx, rbx
je 0x1401bd1c7
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x200]
mov rbp, qword [rsp + 0x208]
test rax, rax
je 0x1401bd3b0
mov rsi, qword [rsp + 0x210]
cmp rsi, 5
mov qword [rsp + 0x78], rax
jb case.0x1401bd233.68
cmp word [rax + rsi*2 - 0xa], 0x2e
jne case.0x1401bd233.68
cmp word [rax + rsi*2 - 2], 0
jne case.0x1401bd233.68
movzx eax, word [rax + rsi*2 - 8]
lea ecx, [rax - 0x42]
cmp ecx, 0x21
ja case.0x1401bd233.68
lea rdx, [0x1401fd950]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
mov rdx, qword [rsp + 0x78]
jmp rcx
movzx ecx, word [rdx + rsi*2 - 6]
or ecx, 0x20
cmp ecx, 0x61
jne 0x1401bd24f
movzx ecx, word [rdx + rsi*2 - 4]
or ecx, 0x20
cmp ecx, 0x74
je 0x1401bd27d
cmp ax, 0x43
jne case.0x1401bd233.68
movzx eax, word [rdx + rsi*2 - 6]
or eax, 0x20
cmp eax, 0x6d
jne case.0x1401bd233.68
movzx eax, word [rdx + rsi*2 - 4]
add eax, 0xffffffbc
test eax, 0xffdf
jne case.0x1401bd233.68
lea rcx, [rsp + 0x110]
call fcn.1401b9980
mov rax, qword [rsp + 0x110]
mov r15, qword [rsp + 0x118]
test rax, rax
je 0x1401bdec6
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], r15
mov qword [rsp + 0x1b0], rcx
lea rax, [0x1402a17ce]
mov qword [rsp + 0xb0], rax
lea rax, [0x1402a17d6]
mov qword [rsp + 0xb8], rax
mov word [rsp + 0xc0], 0
mov qword [rsp + 0x90], 1
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 1
mov word [rsp + 0xa8], 0
lea rcx, [rsp + 0x1a0]
lea rdx, [rsp + 0x90]
call fcn.1401c61c0
mov rax, qword [rsp + 0x1a0]
mov r15, qword [rsp + 0x1a8]
test rax, rax
je 0x1401bdec6
mov rdi, rax
mov rcx, qword [rsp + 0x80]
mov r9, qword [rcx + 0x90]
mov rax, qword [rcx + 0xa0]
movzx ecx, byte [rcx + 0xc5]
mov byte [rsp + 0x28], cl
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
mov r8, rsi
call fcn.1401c52b0
mov rax, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
test rax, rax
je 0x1401be42f
xor ebx, ebx
mov rdx, qword [rsp + 0xa0]
mov rsi, rdi
jmp 0x1401bd672
mov rax, qword [rsp + 0x100]
mov qword [rax], rbp
mov qword [rax + 0x10], 2
cmp byte [rsp + 0x228], 0
jne 0x1401bd44c
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x1401bd423
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rcx
mov eax, 1
mov rcx, qword [rsp + 0x60]
jmp 0x1401bd427
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xd0], rcx
lea rcx, [rsp + 0x90]
call fcn.1401be990
cmp dword [r14], 4
jb 0x1401bd45b
mov rcx, qword [r14 + 8]
call sub.kernel32.dll_CloseHandle
nop
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x200], 0
test rbx, rbx
jne 0x1401bd1b6
jmp 0x1401bd1c7
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x1401bd075
movups xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x240], xmm0
movaps xmm0, xmmword [rsp + 0x240]
movups xmmword [rsp + 0x208], xmm0
mov rbp, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x210]
cmp rsi, 5
mov qword [rsp + 0x78], rax
jae 0x1401bd1f7
mov r13, r14
mov rax, qword [rsp + 0x80]
mov r15, qword [rax + 0x30]
mov rdi, qword [rax + 0x90]
mov r14, qword [rax + 0xa0]
movzx esi, byte [rax + 0xc5]
mov r12, qword [rax + 0x40]
add r12, r15
mov qword [rsp + 0x110], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
lea rbx, [rsp + 0x110]
mov rcx, rbx
xor edx, edx
call fcn.1401d1f90
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
mov word [rax + rcx*2], 0x22
inc rcx
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], r12
mov word [rsp + 0xa0], 0
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.1401c6400
mov rdx, qword [rsp + 0x120]
cmp rdx, qword [rsp + 0x118]
jne 0x1401bd5a8
lea rcx, [rsp + 0x110]
call fcn.1401d1f90
mov rdx, qword [rsp + 0x120]
mov rax, qword [rsp + 0x110]
mov word [rax + rdx*2], 0x22
inc rdx
mov qword [rsp + 0x120], rdx
shl r14, 3
lea r14, [r14 + r14*4]
lea rbx, [rsp + 0x110]
jmp 0x1401bd61b
lea r15, [rdi + 0x28]
mov rax, qword [rsp + 0x110]
mov word [rax + rdx*2], 0x20
inc rdx
mov qword [rsp + 0x120], rdx
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
call fcn.1401c4e40
add r14, 0xffffffffffffffd8
mov rdi, r15
test rax, rax
jne 0x1401bd73b
test r14, r14
je 0x1401bd644
mov rdx, qword [rsp + 0x120]
cmp rdx, qword [rsp + 0x118]
jne 0x1401bd5e0
mov rcx, rbx
call fcn.1401d1f90
mov rdx, qword [rsp + 0x120]
jmp 0x1401bd5e0
mov rax, qword [rsp + 0x110]
mov r12, qword [rsp + 0x118]
test rax, rax
je 0x1401bd75f
mov rdx, qword [rsp + 0x120]
mov bl, 1
mov rsi, qword [rsp + 0x78]
mov r15, rbp
mov r14, r13
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], r12
mov qword [rsp + 0x210], rdx
cmp rdx, r12
jne 0x1401bd6ac
lea rcx, [rsp + 0x200]
call fcn.1401d1f90
mov rax, qword [rsp + 0x200]
mov rdx, qword [rsp + 0x210]
mov word [rax + rdx*2], 0
inc qword [rsp + 0x210]
mov rdi, qword [rsp + 0x80]
cmp byte [rdi + 0xc4], 0
mov eax, 0x400
mov r12d, 0x608
cmove r12d, eax
or r12d, dword [rdi + 0xc0]
mov ecx, 2
mov qword [rsp + 0x1e0], rcx
xor ecx, ecx
mov r13d, 2
mov edx, 0
cmp byte [rsp + 0x228], 0
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x25c], r12d
jne 0x1401bdf9f
mov qword [rsp + 0x180], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x188], xmm0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1401bd796
xor ebx, ebx
jmp 0x1401bd7cd
mov r12, rax
cmp qword [rsp + 0x118], 0
je 0x1401bd75f
mov r8, qword [rsp + 0x110]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov r14, r13
mov rax, qword [rsp + 0x100]
mov qword [rax], r12
mov qword [rax + 0x10], 2
test rbp, rbp
je 0x1401bd3c3
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0x78]
call sub.kernel32.dll_HeapFree
jmp 0x1401bd3c3
lea rcx, [rsp + 0x180]
xor edx, edx
call fcn.1401d1f90
mov rcx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x190]
mov word [r13 + rbx*2], 0
inc rbx
mov qword [rsp + 0x190], rbx
xor eax, eax
mov rdx, qword [rsp + 0x88]
test rdx, rdx
setne al
cmove rcx, rdx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], rdx
mov r8, qword [rsp + 0x68]
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], rcx
test rcx, rcx
je 0x1401bdd00
lea rcx, [rsp + 0x90]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x220], r15
dec rax
mov qword [rsp + 0xd0], rax
mov r12, rcx
call fcn.1401b8b10
test rax, rax
je 0x1401be774
lea rcx, [rsp + 0x110]
mov rdx, rax
call fcn.1401b8670
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x1401bdf49
mov r9, qword [rsp + 0x120]
imul rdx, r9, 0x38
cmp byte [rcx + rdx + 0x198], 2
je 0x1401bdf49
mov rbx, qword [rcx + rdx + 0x168]
mov rax, qword [rcx + rdx + 0x170]
mov qword [rsp + 0x88], rax
mov rax, qword [rcx + rdx + 0x178]
mov qword [rsp + 0x68], rax
mov r8, qword [rcx + rdx + 0x180]
mov rax, qword [rcx + rdx + 0x188]
shl r9, 5
mov rsi, qword [rcx + r9]
mov r10, qword [rcx + r9 + 8]
mov qword [rsp + 0x60], r10
mov r15, qword [rcx + r9 + 0x10]
movzx r9d, byte [rcx + r9 + 0x18]
mov byte [rsp + 0x228], r9b
mov rcx, qword [rcx + rdx + 0x190]
add rcx, r8
xor r11d, r11d
mov rdx, r8
jmp 0x1401bd92d
xor r11d, r11d
test r9w, r9w
je 0x1401bdc57
mov r9w, 1
test r11w, r11w
jne 0x1401bd920
cmp rdx, rcx
je 0x1401bd9ea
movzx r10d, byte [rdx]
test r10b, r10b
js 0x1401bd952
inc rdx
jmp 0x1401bd9df
mov r11d, r10d
and r11d, 0x1f
movzx edi, byte [rdx + 1]
and edi, 0x3f
cmp r10b, 0xdf
jbe 0x1401bd99f
mov r13, r14
movzx r14d, byte [rdx + 2]
shl edi, 6
and r14d, 0x3f
or r14d, edi
cmp r10b, 0xf0
jb 0x1401bd9af
movzx r10d, byte [rdx + 3]
add rdx, 4
and r11d, 7
shl r11d, 0x12
shl r14d, 6
and r10d, 0x3f
or r10d, r14d
or r10d, r11d
jmp 0x1401bd9bd
add rdx, 2
shl r11d, 6
or r11d, edi
mov r10d, r11d
jmp 0x1401bd9df
add rdx, 3
shl r11d, 0xc
or r14d, r11d
mov r10d, r14d
cmp r10d, 0xffff
mov r14, r13
jbe 0x1401bd9df
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x1401bd923
xor r11d, r11d
mov r9d, r10d
jmp 0x1401bd923
test rax, rax
je 0x1401bd9fd
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x68]
lea rax, [rbx + rax*2]
mov qword [rsp + 0x110], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x118], rcx
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], rax
lea rdi, [rsp + 0x180]
mov rcx, rdi
lea rdx, [rsp + 0x110]
call fcn.1401c6120
mov rdx, qword [rsp + 0x190]
cmp rdx, qword [rsp + 0x188]
jne 0x1401bda68
mov rcx, rdi
call fcn.1401d1f90
mov rdx, qword [rsp + 0x190]
mov rax, qword [rsp + 0x180]
mov word [rax + rdx*2], 0x3d
inc rdx
mov qword [rsp + 0x190], rdx
add r15, rsi
xor r8d, r8d
mov rax, rsi
jmp 0x1401bda98
xor r8d, r8d
test cx, cx
je 0x1401bdeaa
mov cx, 1
test r8w, r8w
jne 0x1401bda8c
cmp rax, r15
je 0x1401bdb47
movzx edx, byte [rax]
test dl, dl
js 0x1401bdaba
inc rax
jmp 0x1401bdb3d
mov r8d, edx
and r8d, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp dl, 0xdf
jbe 0x1401bdb03
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp dl, 0xf0
jb 0x1401bdb13
movzx edx, byte [rax + 3]
add rax, 4
and r8d, 7
shl r8d, 0x12
shl r9d, 6
and edx, 0x3f
or edx, r9d
or edx, r8d
jmp 0x1401bdb21
add rax, 2
shl r8d, 6
or r8d, r10d
mov edx, r8d
jmp 0x1401bdb3d
add rax, 3
shl r8d, 0xc
or r9d, r8d
mov edx, r9d
cmp edx, 0xffff
jbe 0x1401bdb3d
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x1401bda8f
xor r8d, r8d
mov ecx, edx
jmp 0x1401bda8f
cmp byte [rsp + 0x228], 2
je 0x1401be781
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1a8], r15
mov word [rsp + 0x1b0], 0
mov rcx, rdi
lea rdx, [rsp + 0x1a0]
call fcn.1401c6400
cmp qword [rsp + 0x60], 0
je 0x1401bdb98
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rbx, qword [rsp + 0x190]
cmp rbx, qword [rsp + 0x188]
mov r15, qword [rsp + 0x220]
jne 0x1401bdbca
lea rcx, [rsp + 0x180]
mov rdx, rbx
call fcn.1401d1f90
mov rbx, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x230]
mov rcx, r12
mov r13, qword [rsp + 0x180]
mov word [r13 + rbx*2], 0
inc rbx
mov qword [rsp + 0x190], rbx
mov rax, qword [rsp + 0xd0]
test rax, rax
jne 0x1401bd85c
mov rcx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x68], rdx
cmp qword [rsp + 0x90], 0
mov qword [rsp + 0x90], 0
je 0x1401be78e
test rcx, rcx
mov rsi, qword [rsp + 0x230]
mov r15, qword [rsp + 0x220]
jne 0x1401bdf44
jmp 0x1401bdd18
test rax, rax
mov r15, qword [rsp + 0x220]
je 0x1401bdc72
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x60], 0
je 0x1401bdc8b
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x88], 0
je 0x1401bdca7
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
lea rsi, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_foundg
mov ebx, dword [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.1401be990
cmp qword [rsp + 0x188], 0
je 0x1401bdce0
mov r8, qword [rsp + 0x180]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x100]
mov qword [rax], rsi
mov qword [rax + 0x10], 2
mov rsi, qword [rsp + 0x230]
jmp 0x1401be6e2
mov rax, rdx
mov qword [rsp + 0x90], 0
test rdx, rdx
je 0x1401bdf49
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x1401bded6
mov rdx, rax
mov rcx, r8
and rcx, 7
je 0x1401bdefa
mov rax, r8
and rax, 0xfffffffffffffff8
mov rdx, qword [rdx + 0x3d8]
dec rcx
jne 0x1401bdd3d
mov r8, qword [rsp + 0x68]
jmp 0x1401bdefd
lea r13, [rsp + 0x129]
lea rbp, [rsp + 0xa9]
lea rdi, [rsp + 0x90]
lea r12, [rsp + 0x1a0]
cmp qword [rsp + 0xa0], 0
jne 0x1401bddcf
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1401bdda1
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, rdi
mov rdx, r12
call fcn.1401cadb0
movzx eax, byte [rsp + 0xa8]
cmp al, 2
je 0x1401bd108
mov rcx, qword [rsp + 0x98]
cmp qword [rsp + 0xa0], 0
je 0x1401bdd86
mov ecx, dword [rbp]
mov edx, dword [rbp + 3]
mov dword [r13 + 3], edx
mov dword [r13], ecx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x120], rcx
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x110], xmm0
mov byte [rsp + 0x128], al
mov rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x110]
call fcn.1401c74e0
cmp byte [rsp + 0x5f], 0
jne 0x1401bde42
mov r8d, 3
lea rcx, [rsp + 0x110]
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
call fcn.1401c8830
mov rbx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x120]
mov rcx, rdi
mov rdx, rbx
call fcn.1401be7c0
cmp qword [rsp + 0x118], 0
je 0x1401bde79
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x90]
test rax, rax
jne 0x1401be73f
mov rcx, rdi
mov rdx, r12
call fcn.1401cadb0
movzx eax, byte [rsp + 0xa8]
cmp al, 2
jne 0x1401bdd73
jmp 0x1401bd108
mov rbx, rsi
cmp qword [rsp + 0x60], 0
mov r15, qword [rsp + 0x220]
jne 0x1401bdc96
jmp 0x1401bdca7
mov rax, qword [rsp + 0x100]
mov qword [rax], r15
jmp 0x1401bd76d
mov rcx, rax
call fcn.1401b8610
lea rcx, [rsp + 0x90]
call fcn.1401be990
cmp rbx, qword [rsp + 0x188]
je 0x1401bdf60
jmp 0x1401bdf80
mov rax, r8
mov rcx, rdx
cmp r8, 8
jb 0x1401bdf44
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x1401bdf06
call fcn.1401b8610
lea rcx, [rsp + 0x90]
call fcn.1401be990
cmp rbx, qword [rsp + 0x188]
jne 0x1401bdf80
lea rcx, [rsp + 0x180]
mov rdx, rbx
call fcn.1401d1f90
mov r13, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x80]
mov word [r13 + rbx*2], 0
mov rcx, qword [rsp + 0x188]
mov rdx, r13
mov ebx, dword [rsp + 0x70]
mov qword [rsp + 0x228], rdx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x108], r14
xor ecx, ecx
cmp byte [rdi + 0x88], 2
mov r14d, 0
je 0x1401be153
mov rax, qword [rdi + 0x70]
mov rcx, qword [rdi + 0x80]
add rcx, rax
xor r10d, r10d
mov rdx, rax
mov r14, qword [rsp + 0x108]
jmp 0x1401bdffd
xor r10d, r10d
test r8w, r8w
je 0x1401be0b4
mov r8w, 1
test r10w, r10w
jne 0x1401bdff0
cmp rdx, rcx
je 0x1401be0d3
movzx r9d, byte [rdx]
test r9b, r9b
js 0x1401be022
inc rdx
jmp 0x1401be0a9
mov r10d, r9d
and r10d, 0x1f
movzx edi, byte [rdx + 1]
and edi, 0x3f
cmp r9b, 0xdf
jbe 0x1401be06c
movzx r11d, byte [rdx + 2]
shl edi, 6
and r11d, 0x3f
or r11d, edi
cmp r9b, 0xf0
jb 0x1401be07c
movzx r9d, byte [rdx + 3]
add rdx, 4
and r10d, 7
shl r10d, 0x12
shl r11d, 6
and r9d, 0x3f
or r9d, r11d
or r9d, r10d
jmp 0x1401be08a
add rdx, 2
shl r10d, 6
or r10d, edi
mov r9d, r10d
jmp 0x1401be0a9
add rdx, 3
shl r10d, 0xc
or r11d, r10d
mov r9d, r11d
cmp r9d, 0xffff
jbe 0x1401be0a9
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x1401bdff3
xor r10d, r10d
mov r8d, r9d
jmp 0x1401bdff3
lea rax, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_foundg
mov rcx, qword [rsp + 0x100]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
jmp 0x1401be6c6
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rcx
mov word [rsp + 0xa0], 0
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x90]
call fcn.1401c6590
mov rcx, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x120]
cmp rdx, rcx
jne 0x1401be134
lea rcx, [rsp + 0x110]
call fcn.1401d1f90
mov rcx, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x110]
mov word [r14 + rdx*2], 0
mov qword [rsp + 0x1e0], r14
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r13
mov r12, r15
mov r15, rsi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x180], xmm0
mov qword [rsp + 0x190], 0
lea rcx, [0x1402d9078]
call sub.kernel32.dll_AcquireSRWLockExclusive
movzx eax, byte [0x1402d9080]
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1c0], 0
mov dword [rsp + 0x1e8], 2
cmp byte [rsp + 0x238], 0
lea rcx, [rsp + 0x1e8]
mov rsi, qword [rsp + 0x108]
cmovne rcx, rsi
cmp dword [rdi], 6
mov r13d, dword [rdi + 0x10]
cmovne rcx, rdi
lea rbx, [rdi + 0x20]
cmp dword [rdi + 0x20], 6
cmove rbx, rsi
lea r8, [rsp + 0x1a0]
mov edx, 0xfffffff6
call fcn.1401bed70
cmp rax, 1
jne 0x1401be22c
mov rax, qword [rsp + 0x100]
mov qword [rax], rdx
mov qword [rax + 0x10], 2
mov r14, rsi
mov rsi, r15
mov r15, r12
mov ebx, dword [rsp + 0x70]
jmp 0x1401be64f
mov qword [rsp + 0x238], rdx
lea r8, [rsp + 0x1b0]
lea rcx, [rdi + 0x10]
cmp r13d, 6
cmove rcx, rsi
mov edx, 0xfffffff5
call fcn.1401bed70
mov r13, rdx
test rax, rax
je 0x1401be280
mov rax, qword [rsp + 0x100]
mov qword [rax], r13
mov qword [rax + 0x10], 2
mov r14, qword [rsp + 0x108]
mov rsi, r15
mov r15, r12
jmp 0x1401be63e
lea r8, [rsp + 0x1c0]
mov rcx, rbx
mov edx, 0xfffffff4
call fcn.1401bed70
mov rbx, rdx
test rax, rax
mov rsi, r15
je 0x1401be2c3
mov rax, qword [rsp + 0x100]
mov qword [rax], rbx
mov qword [rax + 0x10], 2
mov r14, qword [rsp + 0x108]
mov r15, r12
jmp 0x1401be636
xorps xmm0, xmm0
movups xmmword [rsp + 0x144], xmm0
movups xmmword [rsp + 0x138], xmm0
movups xmmword [rsp + 0x128], xmm0
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x158], xmm0
movups xmmword [rsp + 0x168], xmm0
test rbx, rbx
mov r15, r12
mov rax, qword [rsp + 0x238]
jne 0x1401be310
test r13, r13
jne 0x1401be310
test rax, rax
je 0x1401be333
mov dword [rsp + 0x14c], 0x100
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], r13
mov qword [rsp + 0x170], rbx
mov rdx, qword [rsp + 0x80]
mov r12, qword [rdx + 0xb8]
test r12, r12
mov edi, dword [rsp + 0x25c]
je 0x1401be461
add rdx, 0xa8
mov dword [rsp + 0x110], 0x70
lea rcx, [rsp + 0x240]
call fcn.1401bf2b0
mov rdx, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x248]
test rdx, rdx
je 0x1401be613
mov qword [rsp + 0x80], rcx
or edi, 0x80000
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0xf0], rax
movups xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0xe0], xmm0
movups xmm0, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0xd0], xmm0
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmm2, xmmword [rsp + 0x130]
movups xmm3, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0xc0], xmm3
movaps xmmword [rsp + 0xb0], xmm2
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0xf8], rdx
lea rax, [rsp + 0x90]
jmp 0x1401be474
movups xmm0, xmmword [rsp + 0x98]
jmp 0x1401bd4ab
mov rax, qword [rsp + 0x100]
mov qword [rax], r12
mov qword [rax + 0x10], 2
test r15, r15
je 0x1401bd775
mov r8, rdi
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x1401bd775
mov dword [rsp + 0x110], 0x68
lea rax, [rsp + 0x110]
mov rdx, qword [rsp + 0x200]
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x1401be5cf
movups xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
mov rax, qword [rsp + 0x100]
movups xmmword [rax + 0x30], xmm2
movups xmmword [rax + 0x20], xmm1
movups xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x180]
movups xmmword [rax], xmm0
test r12, r12
mov r14, qword [rsp + 0x108]
je 0x1401be51b
mov rcx, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x80]
call fcn.1401bf5d0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rcx, r13
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x238]
call sub.kernel32.dll_CloseHandle
lea rcx, [0x1402d9078]
call fcn.1401f2d54
cmp qword [rsp + 0x60], 0
je 0x1401be562
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0x1e0]
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x88], 0
mov edi, dword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
je 0x1401be584
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x208], 0
je 0x1401be5a5
mov r8, qword [rsp + 0x200]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
test r15, r15
je 0x1401be5bb
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
test rbp, rbp
sete al
or dil, al
jne 0x1401bd44c
jmp 0x1401be727
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x100]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
test r12, r12
mov r14, qword [rsp + 0x108]
je 0x1401be62e
mov rcx, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x80]
call fcn.1401bf5d0
jmp 0x1401be62e
mov rax, qword [rsp + 0x100]
mov qword [rax], rcx
mov qword [rax + 0x10], 2
mov r14, qword [rsp + 0x108]
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rcx, r13
call sub.kernel32.dll_CloseHandle
mov ebx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x238]
call sub.kernel32.dll_CloseHandle
mov r13, qword [rsp + 0x68]
cmp qword [rsp + 0x1a0], 0
je 0x1401be66c
mov rcx, qword [rsp + 0x1a8]
call sub.kernel32.dll_CloseHandle
cmp qword [rsp + 0x1b0], 0
je 0x1401be684
mov rcx, qword [rsp + 0x1b8]
call sub.kernel32.dll_CloseHandle
cmp qword [rsp + 0x1c0], 0
je 0x1401be69c
mov rcx, qword [rsp + 0x1c8]
call sub.kernel32.dll_CloseHandle
lea rcx, [0x1402d9078]
call fcn.1401f2d54
cmp qword [rsp + 0x60], 0
je 0x1401be6c6
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0x1e0]
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x88], 0
je 0x1401be6e2
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x208], 0
je 0x1401be703
mov r8, qword [rsp + 0x200]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
test r15, r15
je 0x1401be719
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
test rbp, rbp
sete al
or bl, al
jne 0x1401bd44c
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0x78]
call sub.kernel32.dll_HeapFree
jmp 0x1401bd44c
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x240], xmm0
test r15, r15
je 0x1401bd4b3
mov rcx, qword [0x1402d9150]
mov rdi, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rax, rdi
jmp 0x1401bd4b3
ud2
call fcn.1401ca810
ud2
mov r15, qword [rsp + 0x220]
jmp 0x1401bdcae
mov rsi, qword [rsp + 0x230]
mov r15, qword [rsp + 0x220]
lea rcx, [rsp + 0x90]
call fcn.1401be990
cmp rbx, qword [rsp + 0x188]
je 0x1401bdf60
jmp 0x1401bdf80