Function at 0x140007710
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
mov eax, 0x1138
call fcn.140009070
sub rsp, rax
mov qword [rsp + 0x400], 0xfffffffffffffffe
mov rax, qword [0x14002c018]
xor rax, rsp
mov qword [rsp + 0x1120], rax
mov dword [rsp + 0x288], 0
mov ecx, 1
call fcn.140010134
mov rcx, rax
call fcn.1400101bc
mov edx, 0x20000
mov ecx, eax
call fcn.14001060c
lea rcx, str.____________________________________________________________n
call fcn.140008ed0
lea rcx, str.____________________________________________________n
call fcn.140008ed0
lea rcx, str.___________________________________________________n
call fcn.140008ed0
lea rcx, str._____________________________________________n
call fcn.140008ed0
lea rcx, str.___________________________________________n
call fcn.140008ed0
lea rcx, str._______________________________________n_n
call fcn.140008ed0
cmp dword [rsp + 0x1150], 1
je 0x1400077cb
cmp dword [rsp + 0x1150], 4
jle 0x1400077ef
lea rcx, str.Please_use_the_following_format:_n
call fcn.140008ed0
lea rcx, str.OpenParrotLoader64.exe__DLL___EXE___param__n
call fcn.140008ed0
call fcn.14001033c
xor eax, eax
jmp 0x140008e4d
lea rcx, [rsp + 0x9e8]
call fcn.140004040
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004040
nop
lea rcx, [rsp + 0x9a8]
call fcn.140004040
nop
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0xa08]
movzx r8d, byte [rsp + 0x50]
lea rdx, section..data
mov rcx, rax
call fcn.1400017d0
nop
lea rdx, [rsp + 0xa08]
lea rcx, [rsp + 0xa48]
call fcn.140005e50
mov qword [rsp + 0x290], rax
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x9e8]
call fcn.1400043c0
lea rcx, [rsp + 0xa48]
call fcn.140004240
nop
lea rcx, [rsp + 0xa08]
call fcn.140004240
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x1158]
add rcx, rax
mov rax, rcx
lea rcx, [rsp + 0xa28]
movzx r8d, byte [rsp + 0x51]
mov rdx, rax
call fcn.1400018a0
nop
lea rdx, [rsp + 0xa28]
lea rcx, [rsp + 0xa68]
call fcn.140005e50
mov qword [rsp + 0x298], rax
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x9c8]
call fcn.1400043c0
lea rcx, [rsp + 0xa68]
call fcn.140004240
nop
lea rcx, [rsp + 0xa28]
call fcn.140004240
xor r8d, r8d
lea rdx, str..dll
lea rcx, [rsp + 0xa88]
call fcn.140001400
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x2a8], rax
mov rdx, qword [rsp + 0x2a8]
lea rcx, [rsp + 0x9c8]
call fcn.1400045b0
mov qword [rsp + 0x408], rax
lea rcx, [rsp + 0xa88]
call fcn.140004240
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rsp + 0x1158]
add rcx, rax
mov rax, rcx
mov rdx, rax
lea rcx, [rsp + 0x9a8]
call fcn.1400015b0
lea rdx, [rsp + 0xaa8]
lea rcx, [rsp + 0x9e8]
call fcn.1400076f0
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x2b8], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x168]
cmp qword [rax + 0x18], 8
jb 0x140007a17
mov dword [rsp + 0x68], 1
jmp 0x140007a1f
mov dword [rsp + 0x68], 0
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x140007a3b
mov rax, qword [rsp + 0x168]
mov rax, qword [rax]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0xf8], 0xffffffffffffffff
inc qword [rsp + 0xf8]
mov rax, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0xf8]
cmp word [rax + rcx*2], 0
jne 0x140007a67
mov rax, qword [rsp + 0xf8]
inc rax
mov qword [rsp + 0x2d8], rax
mov eax, 2
mov rcx, qword [rsp + 0x2d8]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov qword [rsp + 0x1c8], rax
mov rcx, qword [rsp + 0x1c8]
call fcn.140004b30
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x140007b38
mov rdi, qword [rsp + 0x90]
xor eax, eax
mov rcx, qword [rsp + 0x1c8]
rep stosb byte [rdi], al
cmp qword [rsp + 0x90], 0
je 0x140007b1a
xor eax, eax
mov rcx, qword [rsp + 0x90]
mov word [rcx], ax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x1d0], rax
jmp 0x140007b26
mov qword [rsp + 0x1d0], 0
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rax
jmp 0x140007b44
mov qword [rsp + 0x1d8], 0
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x1a8], rax
lea rcx, [rsp + 0xaa8]
call fcn.140005c40
nop
lea rdx, [rsp + 0xac8]
lea rcx, [rsp + 0x9e8]
call fcn.1400076f0
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x170]
cmp qword [rax + 0x18], 8
jb 0x140007bd8
mov dword [rsp + 0x6c], 1
jmp 0x140007be0
mov dword [rsp + 0x6c], 0
movzx eax, byte [rsp + 0x6c]
test eax, eax
je 0x140007bfc
mov rax, qword [rsp + 0x170]
mov rax, qword [rax]
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x100]
movzx eax, word [rax]
mov word [rsp + 0x52], ax
mov rax, qword [rsp + 0xf0]
movzx ecx, word [rsp + 0x52]
mov word [rax], cx
mov rax, qword [rsp + 0x100]
add rax, 2
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0xf0]
add rax, 2
mov qword [rsp + 0xf0], rax
cmp word [rsp + 0x52], 0
jne 0x140007c2c
lea rcx, [rsp + 0xac8]
call fcn.140005c40
nop
lea rdx, [rsp + 0xae8]
lea rcx, [rsp + 0x9c8]
call fcn.1400076f0
mov qword [rsp + 0x2f0], rax
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x2f8], rax
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x178]
cmp qword [rax + 0x18], 8
jb 0x140007d00
mov dword [rsp + 0x70], 1
jmp 0x140007d08
mov dword [rsp + 0x70], 0
movzx eax, byte [rsp + 0x70]
test eax, eax
je 0x140007d24
mov rax, qword [rsp + 0x178]
mov rax, qword [rax]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x108], 0xffffffffffffffff
inc qword [rsp + 0x108]
mov rax, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x108]
cmp word [rax + rcx*2], 0
jne 0x140007d50
mov rax, qword [rsp + 0x108]
inc rax
mov qword [rsp + 0x318], rax
mov eax, 2
mov rcx, qword [rsp + 0x318]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov qword [rsp + 0x1f0], rax
mov rcx, qword [rsp + 0x1f0]
call fcn.140004b30
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
je 0x140007e21
mov rdi, qword [rsp + 0xb0]
xor eax, eax
mov rcx, qword [rsp + 0x1f0]
rep stosb byte [rdi], al
cmp qword [rsp + 0xb0], 0
je 0x140007e03
xor eax, eax
mov rcx, qword [rsp + 0xb0]
mov word [rcx], ax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x1f8], rax
jmp 0x140007e0f
mov qword [rsp + 0x1f8], 0
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x200], rax
jmp 0x140007e2d
mov qword [rsp + 0x200], 0
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xae8]
call fcn.140005c40
nop
lea rdx, [rsp + 0xbc8]
lea rcx, [rsp + 0x9c8]
call fcn.1400076f0
mov qword [rsp + 0x320], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x320]
mov qword [rsp + 0x328], rax
mov rax, qword [rsp + 0x328]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x180]
cmp qword [rax + 0x18], 8
jb 0x140007ec1
mov dword [rsp + 0x74], 1
jmp 0x140007ec9
mov dword [rsp + 0x74], 0
movzx eax, byte [rsp + 0x74]
test eax, eax
je 0x140007ee5
mov rax, qword [rsp + 0x180]
mov rax, qword [rax]
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x110]
movzx eax, word [rax]
mov word [rsp + 0x54], ax
mov rax, qword [rsp + 0x118]
movzx ecx, word [rsp + 0x54]
mov word [rax], cx
mov rax, qword [rsp + 0x110]
add rax, 2
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x118]
add rax, 2
mov qword [rsp + 0x118], rax
cmp word [rsp + 0x54], 0
jne 0x140007f15
lea rcx, [rsp + 0xbc8]
call fcn.140005c40
nop
lea rdx, [rsp + 0xb08]
lea rcx, [rsp + 0x9a8]
call fcn.1400076f0
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x340], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x188]
cmp qword [rax + 0x18], 8
jb 0x140007fe9
mov dword [rsp + 0x78], 1
jmp 0x140007ff1
mov dword [rsp + 0x78], 0
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x14000800d
mov rax, qword [rsp + 0x188]
mov rax, qword [rax]
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x350], rax
mov qword [rsp + 0xd8], 0xffffffffffffffff
inc qword [rsp + 0xd8]
mov rax, qword [rsp + 0x350]
mov rcx, qword [rsp + 0xd8]
cmp word [rax + rcx*2], 0
jne 0x140008039
mov rax, qword [rsp + 0xd8]
inc rax
mov qword [rsp + 0x358], rax
mov eax, 2
mov rcx, qword [rsp + 0x358]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov qword [rsp + 0x218], rax
mov rcx, qword [rsp + 0x218]
call fcn.140004b30
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x14000810a
mov rdi, qword [rsp + 0xa8]
xor eax, eax
mov rcx, qword [rsp + 0x218]
rep stosb byte [rdi], al
cmp qword [rsp + 0xa8], 0
je 0x1400080ec
xor eax, eax
mov rcx, qword [rsp + 0xa8]
mov word [rcx], ax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x220], rax
jmp 0x1400080f8
mov qword [rsp + 0x220], 0
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x228], rax
jmp 0x140008116
mov qword [rsp + 0x228], 0
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0xb08]
call fcn.140005c40
nop
lea rdx, [rsp + 0xb28]
lea rcx, [rsp + 0x9a8]
call fcn.1400076f0
mov qword [rsp + 0x360], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x368], rax
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x190]
cmp qword [rax + 0x18], 8
jb 0x1400081a7
mov dword [rsp + 0x7c], 1
jmp 0x1400081af
mov dword [rsp + 0x7c], 0
movzx eax, byte [rsp + 0x7c]
test eax, eax
je 0x1400081cb
mov rax, qword [rsp + 0x190]
mov rax, qword [rax]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x438], rax
mov rax, qword [rsp + 0x120]
movzx eax, word [rax]
mov word [rsp + 0x56], ax
mov rax, qword [rsp + 0x128]
movzx ecx, word [rsp + 0x56]
mov word [rax], cx
mov rax, qword [rsp + 0x120]
add rax, 2
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x128]
add rax, 2
mov qword [rsp + 0x128], rax
cmp word [rsp + 0x56], 0
jne 0x1400081f8
lea rcx, [rsp + 0xb28]
call fcn.140005c40
nop
lea rdx, [rsp + 0xb68]
lea rcx, [rsp + 0x9a8]
call fcn.140006ff0
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x378], rax
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0x380], rax
lea rdx, [rsp + 0xb48]
mov rcx, qword [rsp + 0x380]
call fcn.1400076f0
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x390]
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x198]
cmp qword [rax + 0x18], 8
jb 0x14000830c
mov dword [rsp + 0x80], 1
jmp 0x140008317
mov dword [rsp + 0x80], 0
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x140008336
mov rax, qword [rsp + 0x198]
mov rax, qword [rax]
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x3a0]
mov qword [rsp + 0x3a8], rax
mov qword [rsp + 0xb8], 0xffffffffffffffff
inc qword [rsp + 0xb8]
mov rax, qword [rsp + 0x3a8]
mov rcx, qword [rsp + 0xb8]
cmp word [rax + rcx*2], 0
jne 0x140008362
mov rax, qword [rsp + 0xb8]
inc rax
mov qword [rsp + 0x3b0], rax
mov eax, 2
mov rcx, qword [rsp + 0x3b0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov qword [rsp + 0x240], rax
mov rcx, qword [rsp + 0x240]
call fcn.140004b30
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x140008433
mov rdi, qword [rsp + 0xa0]
xor eax, eax
mov rcx, qword [rsp + 0x240]
rep stosb byte [rdi], al
cmp qword [rsp + 0xa0], 0
je 0x140008415
xor eax, eax
mov rcx, qword [rsp + 0xa0]
mov word [rcx], ax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x248], rax
jmp 0x140008421
mov qword [rsp + 0x248], 0
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x250], rax
jmp 0x14000843f
mov qword [rsp + 0x250], 0
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0xb48]
call fcn.140005c40
nop
lea rcx, [rsp + 0xb68]
call fcn.140004240
lea rdx, [rsp + 0xba8]
lea rcx, [rsp + 0x9a8]
call fcn.140006ff0
mov qword [rsp + 0x3b8], rax
mov rax, qword [rsp + 0x3b8]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
mov qword [rsp + 0x3c8], rax
lea rdx, [rsp + 0xb88]
mov rcx, qword [rsp + 0x3c8]
call fcn.1400076f0
mov qword [rsp + 0x3d0], rax
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x3d0]
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x1a0]
cmp qword [rax + 0x18], 8
jb 0x140008520
mov dword [rsp + 0x84], 1
jmp 0x14000852b
mov dword [rsp + 0x84], 0
movzx eax, byte [rsp + 0x84]
test eax, eax
je 0x14000854a
mov rax, qword [rsp + 0x1a0]
mov rax, qword [rax]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0xc0]
movzx eax, word [rax]
mov word [rsp + 0x58], ax
mov rax, qword [rsp + 0xc8]
movzx ecx, word [rsp + 0x58]
mov word [rax], cx
mov rax, qword [rsp + 0xc0]
add rax, 2
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc8]
add rax, 2
mov qword [rsp + 0xc8], rax
cmp word [rsp + 0x58], 0
jne 0x14000857a
lea rcx, [rsp + 0xb88]
call fcn.140005c40
nop
lea rcx, [rsp + 0xba8]
call fcn.140004240
mov rcx, qword [rsp + 0x1a8]
call fcn.140001240
mov r8, rax
mov rdx, qword [rsp + 0x1a8]
lea rcx, str.Loader:__ls___ls__n
call fcn.140008ed0
mov rcx, qword [rsp + 0xe8]
call fcn.140001240
mov r8, rax
mov rdx, qword [rsp + 0xe8]
lea rcx, str.Core:____ls___ls__n
call fcn.140008ed0
mov rcx, qword [rsp + 0x60]
call fcn.140001240
mov r8, rax
mov rdx, qword [rsp + 0x60]
lea rcx, str.Game:____ls___ls__n
call fcn.140008ed0
cmp dword [rsp + 0x1150], 4
jne 0x140008676
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x1158]
mov rdx, qword [rcx + rax]
lea rcx, str.Arguments:__ls_n
call fcn.140008ed0
lea rcx, [rsp + 0x9c8]
call fcn.140006c30
movzx eax, al
test eax, eax
jne 0x1400086db
lea rcx, str.Unable_to_find_core_DLL__n
call fcn.140008ed0
call fcn.14001033c
mov dword [rsp + 0x130], 0
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x130]
jmp 0x140008e4d
lea rcx, [rsp + 0x9a8]
call fcn.140006c30
movzx eax, al
test eax, eax
jne 0x140008740
lea rcx, str.Unable_to_find_game_EXE__n
call fcn.140008ed0
call fcn.14001033c
mov dword [rsp + 0x134], 0
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x134]
jmp 0x140008e4d
lea rcx, str._nLoading_game..._n
call fcn.140008ed0
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x480]
call fcn.140001000
lea rcx, [rsp + 0xbf0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x528
rep movsb byte [rdi], byte [rsi]
lea rax, [0x14002d2a0]
lea rcx, [rsp + 0xbf0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x528
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x1150], 4
jne 0x140008a18
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0xd0], 0xffffffffffffffff
inc qword [rsp + 0xd0]
mov rax, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0xd0]
cmp word [rax + rcx*2], 0
jne 0x1400087b6
mov rax, qword [rsp + 0xd0]
mov ecx, 8
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x1158]
mov rcx, qword [rdx + rcx]
mov qword [rsp + 0x3e8], rcx
mov qword [rsp + 0xe0], 0xffffffffffffffff
inc qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x3e8]
mov rdx, qword [rsp + 0xe0]
cmp word [rcx + rdx*2], 0
jne 0x140008806
mov rcx, qword [rsp + 0xe0]
lea rax, [rax + rcx + 4]
mov qword [rsp + 0x278], rax
mov eax, 2
mul qword [rsp + 0x278]
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov qword [rsp + 0x260], rax
mov rcx, qword [rsp + 0x260]
call fcn.140004b30
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x1400088d6
mov rdi, qword [rsp + 0x98]
xor eax, eax
mov rcx, qword [rsp + 0x260]
rep stosb byte [rdi], al
cmp qword [rsp + 0x98], 0
je 0x1400088b8
xor eax, eax
mov rcx, qword [rsp + 0x98]
mov word [rcx], ax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x268], rax
jmp 0x1400088c4
mov qword [rsp + 0x268], 0
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x270], rax
jmp 0x1400088e2
mov qword [rsp + 0x270], 0
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x280], rax
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x1158]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
lea r8, str.__ls___ls
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x280]
call fcn.1400013a0
lea rax, [0x14002cdb8]
mov qword [rsp + 0x48], rax
lea rax, [0x14002cd50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x204
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140008a13
lea rcx, str.Failed_to_load_process__n
call fcn.140008ed0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x138], eax
call fcn.140001330
mov qword [rsp + 0x3f0], rax
mov r8d, dword [rsp + 0x138]
mov rdx, qword [rsp + 0x3f0]
lea rcx, str.Error:__ls_0x_X__n
call fcn.140008ed0
call fcn.14001033c
mov dword [rsp + 0x13c], 1
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x13c]
jmp 0x140008e4d
jmp 0x140008b0b
cmp dword [rsp + 0x1150], 3
jne 0x140008b0b
lea rax, [0x14002cdb8]
mov qword [rsp + 0x48], rax
lea rax, [0x14002cd50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x204
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14001e3b0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140008b0b
lea rcx, str.Failed_to_load_process__n
call fcn.140008ed0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x158], eax
call fcn.140001330
mov qword [rsp + 0x3f8], rax
mov r8d, dword [rsp + 0x158]
mov rdx, qword [rsp + 0x3f8]
lea rcx, str.Error:__ls_0x_X__n
call fcn.140008ed0
call fcn.14001033c
mov dword [rsp + 0x140], 1
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x140]
jmp 0x140008e4d
mov dword [0x14002ce00], 0x1001f
lea rdx, [0x14002cdd0]
mov rcx, qword [0x14002cdc0]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [rsp + 0x450]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x88], 0x30
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x88]
lea r8, [rsp + 0x450]
xor edx, edx
mov rcx, qword [0x14002cdb8]
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
jge 0x140008bc8
lea rcx, str.Failed_to_get_process_information__n
call fcn.140008ed0
call fcn.14001033c
mov dword [rsp + 0x160], 1
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x160]
jmp 0x140008e4d
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x1b8], 0
mov rax, qword [rsp + 0x458]
add rax, 0x10
lea rcx, [rsp + 0x1b8]
mov qword [rsp + 0x20], rcx
mov r9d, 8
lea r8, [rsp + 0x150]
mov rdx, rax
mov rcx, qword [0x14002cdb8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp qword [rsp + 0x1b8], 8
je 0x140008c73
lea rcx, str.Failed_to_get_process_environment__n
call fcn.140008ed0
call fcn.14001033c
mov dword [rsp + 0x144], 1
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x144]
jmp 0x140008e4d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x14002d318]
mov rcx, qword [rsp + 0x150]
add rcx, rax
mov rax, rcx
xor r8d, r8d
mov edx, 1
mov rcx, rax
call fcn.140004980
test eax, eax
jne 0x140008d06
lea rcx, str.Failed_to_run_the_process_n
call fcn.140008ed0
xor edx, edx
mov rcx, qword [0x14002cdb8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.14001033c
mov dword [rsp + 0x14c], 1
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x14c]
jmp 0x140008e4d
lea rcx, str.Success__n
call fcn.140008ed0
lea rcx, str.Loading_core..._n
call fcn.140008ed0
mov eax, dword [0x14002d318]
mov rcx, qword [rsp + 0x150]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0xe8]
call fcn.140004710
test eax, eax
jne 0x140008d9a
xor edx, edx
mov rcx, qword [0x14002cdb8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.14001033c
mov dword [rsp + 0x148], 0
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x148]
jmp 0x140008e4d
lea rcx, str.Success__n
call fcn.140008ed0
lea rcx, str._nHave_fun_:__n
call fcn.140008ed0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14002cdc0]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rdx, [0x14002cdd0]
mov rcx, qword [0x14002cdc0]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140008def
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140008dca
mov dword [rsp + 0x8c], 1
lea rdx, [rsp + 0x8c]
mov rcx, qword [0x14002cdc0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x15c], eax
lea rcx, [rsp + 0x9a8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9c8]
call fcn.140004240
nop
lea rcx, [rsp + 0x9e8]
call fcn.140004240
mov eax, dword [rsp + 0x15c]
mov rcx, qword [rsp + 0x1120]
xor rcx, rsp
call fcn.1400090e0
add rsp, 0x1138
pop rdi
pop rsi
ret