Function at 0x140002080
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1768
call fcn.140006f40
sub rsp, rax
movaps xmmword [rsp + 0x1750], xmm6
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x80], rcx
mov rax, qword [0x140030440]
xor rax, rsp
mov qword [rsp + 0x1748], rax
movabs r12, 0x2c2a3a4c91b8ffd3
movabs r14, 0x2c2a3a4c31e20a3b
lea rax, [rsp + 0x3c4]
mov dword [rax], 0
lea rax, [r12 - 0x8238ebb]
lea r15, [r12 - 0xa2a7e20]
xorps xmm6, xmm6
lea rbx, str.____Invalid_argument:__ls_n
lea rbp, str.____Missing_value_for_option:__i_n
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xc8], rcx
mov ecx, 0
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x90], rcx
xor ecx, ecx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xa0], rcx
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0x108], rax
mov r9, rax
mov dword [rsp + 0x8c], ecx
cmp r9, r15
jge 0x1400021f5
lea rdx, [r14 + 0x8263773]
nop dword [rax]
cmp r9, rdx
jge 0x140002285
lea rcx, [r14 - 0x197c1cb]
cmp r9, rcx
jge 0x140002345
lea rcx, [r14 - 0x1c947761]
cmp r9, rcx
jge 0x1400024b5
lea rcx, [r14 - 0x2293af14]
cmp r9, rcx
jge 0x14000278e
lea rcx, [r14 - 0x2c7a2657]
cmp r9, rcx
jge 0x140002d10
lea rcx, [r14 - 0x2c90ab1a]
cmp r9, rcx
jne 0x14000216c
lea r9, [r14 - 0x1acbd46a]
lea rcx, [r12 + 0x2e971809]
cmp dword [rsp + 0x3c4], 4
cmovge r9, rcx
jmp 0x14000216c
lea rcx, [r12 + 0x300d6818]
nop dword [rax]
cmp r9, rcx
jae 0x1400022d6
lea rdx, [r12 + 0xf4a4782]
cmp r9, rdx
jae 0x14000238e
lea rsi, [r12 - 0x54442d9]
cmp r9, rsi
jae 0x140002511
lea rdx, [r12 - 0x9193271]
cmp r9, rdx
jae 0x1400027cf
lea rcx, [r12 - 0x94ec365]
cmp r9, rcx
jae 0x140002d25
cmp r9, r15
jne 0x14000216c
mov rax, qword [0x140030178]
movabs rcx, 0xaeea1fdeaedf7f5f
movzx ecx, word [rax + rcx]
lea r9, [r12 + 0x3c6f277a]
lea rdx, [r12 + 0x491f5c38]
nop dword [rax + rax]
jmp 0x140003aee
lea rsi, [r14 + 0x316e0486]
cmp r9, rsi
jae 0x1400023da
lea r13, [r14 + 0x1eeabfd2]
nop dword [rax]
cmp r9, r13
jae 0x140002550
lea rcx, [r14 + 0xff79cdb]
cmp r9, rcx
jae 0x14000281c
lea rcx, [r14 + 0xec24751]
cmp r9, rcx
jae 0x140002d65
lea rcx, [r12 + 0x37a08418]
jmp 0x140003dc1
lea rdx, [r12 + 0x491f5c38]
nop
cmp r9, rdx
jae 0x14000243b
lea rdx, [r12 + 0x3c6f277a]
cmp r9, rdx
jae 0x1400025be
lea rdx, [r12 + 0x357a21e8]
cmp r9, rdx
jae 0x1400028cb
lea rdx, [r12 + 0x356a3f7a]
cmp r9, rdx
jae 0x140002f05
lea rdx, [r12 + 0x3fa4cd7e]
lea r8, [r12 + 0x68bf47a7]
test byte [rsp + 0x8c], 1
cmovne r8, rdx
cmp r9, rcx
cmove r9, r8
nop
jmp 0x14000216c
lea r8, [r14 + 0x2a7b078]
cmp r9, r8
jae 0x14000260b
cmp r9, r14
jae 0x140002907
lea rdx, [r14 - 0x10cb180]
cmp r9, rdx
jae 0x140002f25
cmp r9, rcx
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r14 + 0x2397b900]
cmp ecx, 0x49
cmovne r9, r14
jmp 0x14000216c
lea rcx, [r12 + 0x19a6fd0c]
cmp r9, rcx
jae 0x140002659
lea rcx, [r12 + 0x109e4b34]
cmp r9, rcx
jae 0x14000292b
lea rcx, [r12 + 0xfd91e85]
nop dword [rax + rax]
cmp r9, rcx
jae 0x140002f4b
cmp r9, rdx
jne 0x14000216c
mov rcx, rbp
jmp 0x140002c06
lea rcx, [r14 + 0x39c3fdc3]
cmp r9, rcx
jae 0x1400026bd
lea rdx, [r14 + 0x33155648]
cmp r9, rdx
jae 0x14000295d
lea rdx, [r14 + 0x327b3f3a]
cmp r9, rdx
jae 0x140002fa5
cmp r9, rsi
jne 0x14000216c
mov rax, qword [rsp + 0x100]
add rax, 0x20
mov qword [rsp + 0x100], rax
cmp rax, qword [rsp + 0x110]
cmove rsi, rcx
mov r9, rsi
jmp 0x14000216c
lea rcx, [r12 + 0x5d30d259]
cmp r9, rcx
jae 0x14000273d
lea rcx, [r12 + 0x4c93d7ef]
cmp r9, rcx
jae 0x1400029f8
lea rcx, [r12 + 0x49ae3477]
cmp r9, rcx
jae 0x140003007
cmp r9, rdx
jne 0x14000216c
lea rcx, str.___Redirect_the_Child_Processs_Standard_File_IO_via_ProcessParameters__n
call fcn.140001000
mov rcx, qword [rsp + 0xb8]
mov rax, qword [rcx + 0x20]
mov rdx, qword [rsp + 0x78]
mov qword [rdx + 0x20], rax
mov rax, qword [rcx + 0x28]
mov qword [rdx + 0x28], rax
mov rax, qword [rcx + 0x30]
mov qword [rdx + 0x30], rax
lea r9, [r12 + 0x3c6f277a]
jmp 0x14000216c
lea rdx, [r14 - 0xea57b14]
nop dword [rax]
cmp r9, rdx
jae 0x140002b32
lea rdx, [r14 - 0x1acbd46a]
cmp r9, rdx
jae 0x140003036
nop dword [rax]
cmp r9, rcx
jne 0x14000216c
lea rcx, str.___Example:__nNtCreateUserProcess_Native.exe__c_C:Windows_system32_notepad.exe_nNtCreateUserProcess_Native.exe__c_C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe__i_1_n_n____c__Optional__ImagePath__Notice_double_quote_is_requied_when_blankspace_in_path_like_n_C:Program_FilesGoogleChromeApplicationchrome.exe_n_n____i__Optional__Interact_for_console_process_like_C:Windows_system32cmd.exe_n_i_0:__Default__None_of_any_interact_mode_will_be_used__like_CREATE_NEW_CONSOLE_n_i_1:_StdHandle_via_AttributeList__like_bInheritHandles__FALSE_n_i_2:_Set_ProcessParameters_Std_Input_Output_OutError_with_CurrentProcessParameters_Value__like_bInheritHandles__TRUE_n_n
call fcn.140001000
lea rcx, str.____On_Windows_11_Notepad.exe_is_AppX_so_it_doesnt_work.__AppX_isnt_supported_in_this_project__n
call fcn.140001000
mov dword [rsp + 0x5c], 0
mov r9, r12
jmp 0x14000216c
lea rcx, [r12 + 0x48d75d]
nop dword [rax]
cmp r9, rcx
jae 0x140002b6a
lea rcx, [r12 - 0x37472a9]
cmp r9, rcx
jae 0x140003055
lea rcx, [r12 - 0x54442d9]
cmp r9, rcx
jne 0x14000216c
jmp 0x140002d5c
lea rcx, [r14 + 0x2d37b528]
nop word [rax + rax]
cmp r9, rcx
jae 0x140002bb8
lea rcx, [r14 + 0x21435cbd]
cmp r9, rcx
jae 0x140003085
nop dword [rax]
cmp r9, r13
jne 0x14000216c
mov rdx, qword [rsp + 0x1270]
lea rcx, str.___ActivationContextData_0x_p_n
call fcn.140001000
mov rdx, qword [rsp + 0x1280]
lea rcx, str.___SystemDefaultActivationContextData_0x_p_n
call fcn.140001000
lea r9, [r12 + 0x61966cdc]
jmp 0x14000216c
lea rcx, [r12 + 0x40b5cbfe]
cmp r9, rcx
jae 0x140002be5
lea rcx, [r12 + 0x3eb3ba48]
nop word [rax + rax]
cmp r9, rcx
jae 0x1400030c5
cmp r9, rdx
jne 0x14000216c
lea r9, [r12 + 0x356a3f7a]
cmp dword [rsp + 0x3c4], 2
cmove r9, rcx
jmp 0x14000216c
lea rdx, [r14 + 0x47a17b6]
cmp r9, rdx
jae 0x140002c10
lea rcx, [r14 + 0x2c90e75]
cmp r9, rcx
jae 0x1400030f1
cmp r9, r8
jne 0x14000216c
add qword [rsp + 0x68], 8
mov rax, qword [rsp + 0x80]
cmp eax, 3
lea ecx, [rax - 1]
lea r9, [r12 + 0x40b5cbfe]
cmovge r9, rdx
jmp 0x140003a8e
lea rdx, [r12 + 0x264f2d36]
cmp r9, rdx
jae 0x140002c50
lea rdx, [r12 + 0x1f33867c]
cmp r9, rdx
jae 0x140003129
nop dword [rax + rax]
cmp r9, rcx
jne 0x14000216c
mov rdx, qword [0x140030130]
movabs rax, 0xaeea1fdeaedf7f5f
add rdx, rax
lea rcx, str.___Default_ImageName:__ls_n
mov qword [rsp + 0x98], rdx
call fcn.140001000
lea r9, [r14 - 0x9637708]
jmp 0x14000216c
lea rdx, [r14 + 0x4da693cb]
cmp r9, rdx
jae 0x140002c92
lea rdx, [r14 + 0x3b87ab1a]
cmp r9, rdx
jae 0x140003167
nop dword [rax]
cmp r9, rcx
jne 0x14000216c
mov r8d, 0x3c8
lea rsi, [rsp + 0xbb0]
mov rcx, rsi
lea rdx, [rsp + 0x3c8]
call fcn.1400219b0
mov rdx, qword [rsp + 0xbb0]
mov rcx, rsi
call fcn.140004020
mov edx, 0x30
lea rcx, [rsp + 0x2e0]
call fcn.140004020
lea r9, [r14 - 0x39a170e]
mov dword [rsp + 0x5c], 0
jmp 0x14000216c
lea rsi, [r12 + 0x63a5c890]
cmp r9, rsi
jae 0x140002cdb
lea rdx, [r12 + 0x5ec1e997]
cmp r9, rdx
jae 0x140003185
nop
cmp r9, rcx
jne 0x14000216c
add qword [rsp + 0x68], 8
mov rax, qword [rsp + 0x80]
dec eax
mov qword [rsp + 0x80], rax
mov r9, qword [rsp + 0x108]
jmp 0x14000216c
lea r8, [r14 - 0x1fada120]
cmp r9, r8
jae 0x1400031f0
nop
cmp r9, rcx
jne 0x14000216c
lea rcx, str.___Separate_I_O_Buffers_n
call fcn.140001000
mov rax, qword [rsp + 0x78]
mov qword [rax + 0x10], 0xfffffffffffffffe
lea r9, [r12 - 0x37472a9]
jmp 0x14000216c
lea r8, [r12 - 0x8238ebb]
nop word [rax + rax]
cmp r9, r8
jae 0x1400032f6
cmp r9, rdx
jne 0x14000216c
mov rax, qword [0x140030178]
movabs rcx, 0xaeea1fdeaedf7f5f
movzx ecx, word [rax + rcx]
lea r9, [r12 + 0xfd91e85]
lea rdx, [r12 + 0x4759fa21]
jmp 0x140003aee
lea rdx, [r14 + 0x19f25a77]
cmp r9, rdx
jae 0x140003338
cmp r9, rcx
jne 0x14000216c
mov rcx, qword [rsp + 0x378]
call fcn.140006e81
mov rcx, qword [rsp + 0x328]
call fcn.140006e81
mov rcx, qword [rsp + 0x320]
call fcn.140006e81
mov rcx, qword [rsp + 0x298]
call fcn.140006e81
mov rcx, qword [rsp + 0x2a0]
call fcn.140006e81
mov edx, dword [rsp + 0xd8]
mov rcx, qword [rsp + 0x78]
call fcn.140004020
mov r8d, 0x3c8
lea rcx, [rsp + 0x3c8]
xor edx, edx
call fcn.140022070
lea rax, [rsp + 0x790]
mov qword [rsp + 0x110], rax
xor eax, eax
mov qword [rsp + 0x78], rax
mov r9, rsi
lea rcx, [rsp + 0x3d0]
mov qword [rsp + 0x100], rcx
jmp 0x14000216c
lea rcx, [r12 + 0x3647bb93]
cmp r9, rcx
jae 0x1400033fd
nop dword [rax]
cmp r9, rdx
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r14 - 0xea57b14]
lea rdx, [r14 - 0x16909294]
cmp ecx, 0x44
cmovl r9, rdx
jmp 0x14000216c
lea rcx, [r14 + 0x255ee20]
cmp r9, rcx
jae 0x14000344b
lea rcx, [r12 - 0x94ec365]
cmp r9, r14
cmove r9, rcx
jmp 0x14000216c
lea rdx, [r12 + 0x10db8c7e]
cmp r9, rdx
jae 0x1400034a6
nop dword [rax]
cmp r9, rcx
jne 0x14000216c
lea r9, [r14 + 0x19f25a77]
lea rcx, [r12 + 0x1f33867c]
jmp 0x140003bfe
lea rcx, [r14 + 0x34a77d1d]
cmp r9, rcx
jae 0x1400034e8
cmp r9, rdx
jne 0x14000216c
mov ecx, 0xb
lea rdx, [rsp + 0x220]
mov rax, rdi
mov rdi, rdx
lea rsi, [rsp + 0x280]
rep movsq qword [rdi], qword [rsi]
mov rdi, rax
mov rcx, rdx
call fcn.140004479
movups xmm0, xmmword [rsp + 0x380]
movups xmm1, xmmword [rsp + 0x390]
movups xmm2, xmmword [rsp + 0x3a0]
movups xmm3, xmmword [rsp + 0x3b0]
movaps xmmword [rsp + 0x210], xmm3
movaps xmmword [rsp + 0x200], xmm2
movaps xmmword [rsp + 0x1f0], xmm1
movaps xmmword [rsp + 0x1e0], xmm0
lea rcx, [rsp + 0x1e0]
call fcn.14000461d
lea r9, [r14 + 0x7e49ea9]
jmp 0x14000216c
lea rdx, [r12 + 0x571e5ada]
cmp r9, rdx
jae 0x140003527
cmp r9, rcx
jne 0x14000216c
mov rax, qword [rsp + 0xd8]
mov r9, qword [rsp + 0x78]
mov dword [r9 + 4], eax
mov dword [r9], eax
mov dword [r9 + 8], 0x6001
mov rax, qword [rsp + 0xb0]
mov word [r9 + 0x60], ax
mov r8, qword [rsp + 0x90]
mov word [r9 + 0x62], r8w
xor edx, edx
mov dword [r9 + 0x64], edx
mov r10, qword [rsp + 0xe0]
mov qword [r9 + 0x68], r10
mov rcx, qword [rsp + 0xc0]
mov word [r9 + 0x70], cx
mov rcx, qword [rsp + 0xa0]
mov word [r9 + 0x72], cx
mov dword [r9 + 0x74], edx
mov rcx, qword [rsp + 0xf0]
mov qword [r9 + 0x78], rcx
mov rcx, qword [rsp + 0xb8]
movups xmm0, xmmword [rcx + 0x50]
movups xmmword [r9 + 0x50], xmm0
movups xmm0, xmmword [rcx + 0xc0]
movups xmmword [r9 + 0xc0], xmm0
movups xmm0, xmmword [rcx + 0x38]
movups xmmword [r9 + 0x38], xmm0
mov word [r9 + 0xb0], ax
mov word [r9 + 0xb2], r8w
mov dword [r9 + 0xb4], edx
mov qword [r9 + 0xb8], r10
mov rax, qword [rcx + 0x80]
mov qword [r9 + 0x80], rax
mov rax, qword [rcx + 0x3f0]
mov qword [r9 + 0x3f0], rax
mov rax, qword [rcx + 0x3f8]
mov qword [r9 + 0x3f8], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov eax, dword [rax + 0x408]
mov dword [r9 + 0x408], eax
lea rcx, [r14 - 0x2293af14]
lea r9, [r12 + 0x25f3bf0a]
cmp dword [rsp + 0x3c4], edx
cmove r9, rcx
jmp 0x14000216c
lea rcx, [r14 - 0x9637708]
nop dword [rax]
cmp r9, rcx
jae 0x14000356e
cmp r9, rdx
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r12 + 0x48d75d]
cmp ecx, 0x44
cmovne r9, r14
jmp 0x14000216c
lea rdx, [r12 + 0x4182957]
cmp r9, rdx
jae 0x140003773
nop dword [rax + rax]
cmp r9, rcx
jne 0x14000216c
add qword [rsp + 0x68], 8
mov rax, qword [rsp + 0x80]
dec eax
mov qword [rsp + 0x80], rax
lea r9, [r12 + 0x5d30d259]
mov cl, 1
mov qword [rsp + 0xe8], rcx
jmp 0x14000216c
lea rdx, [r14 + 0x2e459681]
nop
cmp r9, rdx
jae 0x1400037b1
cmp r9, rcx
jne 0x14000216c
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x10]
nop
jmp 0x140002cc7
lea rdx, [r12 + 0x42a9a460]
cmp r9, rdx
jae 0x1400037ea
cmp r9, rcx
jne 0x14000216c
lea rcx, str.____Missing_value_for_option:__c_n
call fcn.140001000
jmp 0x140002d3c
lea r8, [r14 + 0x5a77f65]
nop word [rax + rax]
cmp r9, r8
jae 0x140003827
cmp r9, rdx
jne 0x14000216c
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
lea r9, [r12 + 0x49ae3477]
lea rdx, [r12 + 0x40b5cbfe]
jmp 0x140003561
lea rcx, [r12 + 0x269cfdc7]
nop dword [rax + rax]
cmp r9, rcx
jae 0x140003865
cmp r9, rdx
jne 0x14000216c
lea r9, [r14 + 0x19f25a77]
lea rcx, [r12 + 0x3647bb93]
cmp dword [rsp + 0x3c4], 1
cmove r9, rcx
jmp 0x14000216c
lea rcx, [r14 + 0x5070b94b]
nop dword [rax]
cmp r9, rcx
jae 0x1400038a5
cmp r9, rdx
jne 0x14000216c
mov rax, qword [0x140030190]
movabs rcx, 0xaeea1fdeaedf7f5f
mov rax, qword [rax + rcx]
mov qword [rsp + 0xf8], rax
lea r9, [r14 + 0x2f34fce6]
jmp 0x14000216c
lea rcx, [r12 + 0x68bf47a7]
cmp r9, rcx
jae 0x1400039f6
lea rcx, [r12 - 0x54442d9]
cmp r9, rsi
mov edx, 0xffffffff
mov eax, dword [rsp + 0x5c]
cmove eax, edx
mov dword [rsp + 0x5c], eax
cmove r9, rcx
jmp 0x14000216c
lea rdx, [r12 + 0x5d30d259]
cmp r9, rcx
nop dword [rax + rax]
jmp 0x140003565
jne 0x14000216c
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 8]
mov rcx, rbx
call fcn.140001000
lea rcx, str.___Example:__nNtCreateUserProcess_Native.exe__c_C:Windows_system32_notepad.exe_nNtCreateUserProcess_Native.exe__c_C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe__i_1_n_n____c__Optional__ImagePath__Notice_double_quote_is_requied_when_blankspace_in_path_like_n_C:Program_FilesGoogleChromeApplicationchrome.exe_n_n____i__Optional__Interact_for_console_process_like_C:Windows_system32cmd.exe_n_i_0:__Default__None_of_any_interact_mode_will_be_used__like_CREATE_NEW_CONSOLE_n_i_1:_StdHandle_via_AttributeList__like_bInheritHandles__FALSE_n_i_2:_Set_ProcessParameters_Std_Input_Output_OutError_with_CurrentProcessParameters_Value__like_bInheritHandles__TRUE_n_n
call fcn.140001000
lea rcx, str.____On_Windows_11_Notepad.exe_is_AppX_so_it_doesnt_work.__AppX_isnt_supported_in_this_project__n
call fcn.140001000
mov dword [rsp + 0x5c], 0xffffffff
mov r9, r12
nop
jmp 0x14000216c
jne 0x14000216c
mov rdx, qword [rsp + 0x330]
mov r8, qword [rsp + 0x338]
lea rcx, str.___PID_lld__TID_lld_n
call fcn.140001000
movups xmm0, xmmword [rsp + 0x380]
movups xmm1, xmmword [rsp + 0x390]
movups xmm2, xmmword [rsp + 0x3a0]
movups xmm3, xmmword [rsp + 0x3b0]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x1b0], xmm1
movaps xmmword [rsp + 0x1c0], xmm2
movaps xmmword [rsp + 0x1d0], xmm3
movups xmm0, xmmword [rsp + 0x330]
movaps xmmword [rsp + 0x190], xmm0
mov rax, qword [rsp + 0xa8]
mov word [rsp + 0x180], ax
mov rax, qword [rsp + 0xc8]
mov word [rsp + 0x182], ax
mov eax, 0
mov dword [rsp + 0x184], eax
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x188], rcx
mov rcx, qword [rsp + 0xb0]
mov word [rsp + 0x170], cx
mov rcx, qword [rsp + 0x90]
mov word [rsp + 0x172], cx
mov dword [rsp + 0x174], eax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x178], rax
mov ecx, 0xb
lea r8, [rsp + 0x118]
mov rax, rdi
mov rdi, r8
lea rsi, [rsp + 0x280]
rep movsq qword [rdi], qword [rsi]
mov rdi, rax
mov rdx, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x328]
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x190]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x170]
call fcn.140001080
lea rcx, str.___CustomCallCsrss:_0x_08x_n
mov edx, eax
call fcn.140001000
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x328]
mov qword [rsp + 0x20], 0
mov r9d, 0x7d0
lea r8, [rsp + 0xf78]
call fcn.140006ec6
lea r9, [r12 + 0x61966cdc]
mov dword [rsp + 0x64], eax
test eax, eax
cmovns r9, r13
nop dword [rax + rax]
jmp 0x14000216c
mov ecx, edi
and ecx, 0xfffffffb
lea r8, [r14 - 0x1fada120]
cmp r9, rdx
cmove edi, ecx
cmove r9, r8
nop dword [rax + rax]
jmp 0x14000216c
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r12 + 0x4182957]
lea rdx, [r12 + 0x5a3253be]
cmp ecx, 0x63
cmovl r9, rdx
jmp 0x14000216c
jne 0x14000216c
mov edx, dword [rsp + 0x74]
mov eax, edx
shl rax, 5
mov qword [rsp + rax + 0xbb8], 0x2000a
mov qword [rsp + rax + 0xbc0], 8
mov qword [rsp + rax + 0xbd0], 0
lea rcx, [rsp + 0x278]
mov qword [rsp + rax + 0xbc8], rcx
inc edx
mov dword [rsp + 0x74], edx
lea r9, [r14 + 0x19f25a77]
nop dword [rax]
jmp 0x14000216c
jne 0x14000216c
mov rcx, qword [rsp + 0x320]
xor edx, edx
xor r8d, r8d
call fcn.140006ef1
lea rcx, str.____New_Process_Exited:
call fcn.140001000
mov rcx, qword [rsp + 0x328]
lea rax, [rsp + 0x31c]
mov qword [rsp + 0x20], rax
xor edx, edx
lea r8, [rsp + 0x2e0]
mov r9d, 0x30
call fcn.140006ed9
lea r9, [r14 - 0x1d9597a7]
lea rcx, [r12 + 0x10db8c7e]
jmp 0x140003c54
jne 0x14000216c
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 8]
lea rcx, str.___ImageName___ls_n
mov qword [rsp + 0x98], rdx
call fcn.140001000
lea r9, [r14 - 0x2c7a2657]
jmp 0x14000216c
lea rcx, [r14 - 0x16909294]
nop dword [rax]
cmp r9, rcx
jae 0x140003a33
lea rcx, [r14 + 0x3b87ab1a]
jmp 0x140003dc1
cmp r9, r12
jae 0x140003a50
nop
cmp r9, rcx
jne 0x14000216c
lea r9, [r12 + 0x491f5c38]
cmp dword [rsp + 0x3c4], 2
cmovne r9, r15
nop dword [rax]
jmp 0x14000216c
lea rdx, [r14 + 0x2397b900]
cmp r9, rdx
jae 0x140003a5b
cmp r9, rcx
jne 0x14000216c
lea r9, [r14 + 0x255ee20]
lea rcx, [r12 + 0xf4a4782]
mov rdx, qword [rsp + 0x68]
cmp qword [rdx + 8], 0
cmove r9, rcx
nop dword [rax + rax]
jmp 0x14000216c
lea rdx, [r12 + 0x3fa4cd7e]
cmp r9, rdx
jae 0x140003a9b
mov edx, edi
or edx, 4
lea r8, [r14 - 0x1fada120]
cmp r9, rcx
cmove edi, edx
cmove r9, r8
jmp 0x14000216c
lea rdx, [r14 + 0x3a9ee7d]
nop dword [rax + rax]
cmp r9, rdx
jae 0x140003ac5
cmp r9, rcx
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r14 + 0x2397b900]
cmp ecx, 0x69
cmovne r9, r14
jmp 0x14000216c
lea rcx, [r12 + 0x25f3bf0a]
cmp r9, rcx
jae 0x140003afd
nop word [rax + rax]
cmp r9, rdx
jne 0x14000216c
mov dword [rsp + 0x27c], 3
lea r9, [r14 + 0x1ca37af6]
lea rcx, [r14 + 0x5303829d]
jmp 0x140003bfe
lea rcx, [r14 + 0x4a9d3006]
cmp r9, rcx
jae 0x140003b33
lea rcx, [r12 + 0x5d30d259]
nop
jmp 0x140003dc1
lea rcx, [r12 + 0x61966cdc]
cmp r9, rcx
jae 0x140003b56
cmp r9, rdx
jne 0x14000216c
lea rcx, str.___Set_ParentProcess_Handle__n
call fcn.140001000
mov edx, dword [rsp + 0x74]
mov eax, edx
shl rax, 5
mov qword [rsp + rax + 0xbb8], 0x60000
mov qword [rsp + rax + 0xbc0], 8
mov rcx, qword [rsp + 0x370]
mov qword [rsp + rax + 0xbc8], rcx
inc edx
mov dword [rsp + 0x74], edx
lea r9, [r12 + 0x264f2d36]
jmp 0x14000216c
lea rcx, [r14 - 0x1d9597a7]
nop word [rax + rax]
cmp r9, rcx
jae 0x140003565
cmp r9, r8
jne 0x14000216c
movabs rax, 0x100000000
mov rcx, qword [rsp + 0x78]
mov qword [rcx + 0xa4], rax
mov qword [rsp + 0xbb8], 0x20005
movzx eax, word [rsp + 0xa8]
mov qword [rsp + 0xbc0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xbc8], rax
mov qword [rsp + 0xbd8], 6
mov qword [rsp + 0xbe0], 0x40
lea rax, [rsp + 0x380]
mov qword [rsp + 0xbe8], rax
mov qword [rsp + 0xbf8], 0x10003
mov qword [rsp + 0xc00], 0x10
lea rax, [rsp + 0x330]
mov qword [rsp + 0xc08], rax
mov qword [rsp + 0xc18], 0x60002
mov qword [rsp + 0xc20], 8
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0xc28], rax
lea r9, [r12 + 0x5ec1e997]
cmp qword [rsp + 0x370], 0
lea rcx, [r12 + 0x264f2d36]
cmove r9, rcx
mov dword [rsp + 0x74], 4
jmp 0x14000216c
lea rdx, [r12 - 0x7390942]
nop
cmp r9, rdx
jae 0x140003b98
cmp r9, r8
jne 0x14000216c
lea rax, [r14 + 0x3793a206]
cmp dword [rsp + 0x80], 2
cmovge rcx, rax
mov dword [rsp + 0x8c], 0
mov r9, rcx
jmp 0x14000216c
lea rcx, [r14 + 0x1ca37af6]
nop
cmp r9, rcx
jae 0x140003bc5
cmp r9, rdx
jne 0x14000216c
mov r8d, dword [rsp + 0x74]
mov edx, r8d
shl rdx, 5
or rdx, 8
mov qword [rsp + 0xbb0], rdx
lea rcx, str.___AttributeList.TotalLength___lld__AttributeCount___ld_n
call fcn.140001000
lea rax, [rsp + 0xbb0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x280]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], edi
movups xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x328]
lea rdx, [rsp + 0x320]
mov r8d, 0x2000000
mov r9d, 0x2000000
call fcn.140006e09
lea rcx, str.___NtCreateUserProcess:_0x_08x_n
mov dword [rsp + 0x64], eax
mov edx, eax
call fcn.140001000
lea r9, [r14 + 0x33155648]
lea rcx, [r14 + 0x7e49ea9]
cmp byte [rsp + 0xe8], 0
cmove r9, rcx
jmp 0x14000216c
lea rdx, [r12 + 0x37a08418]
cmp r9, rdx
jae 0x140003be9
cmp r9, rcx
jne 0x14000216c
mov rax, qword [0x140030178]
movabs rcx, 0xaeea1fdeaedf7f5f
movzx ecx, word [rax + rcx]
lea r9, [r12 + 0x109e4b34]
lea rdx, [r12 + 0x1f33867c]
cmp ecx, 0x2581
cmovae r9, rdx
jmp 0x14000216c
lea rdx, [r14 + 0x27e3da8]
cmp r9, rdx
jae 0x140003c10
nop dword [rax + rax]
cmp r9, rcx
jne 0x14000216c
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
lea rdx, [0x1400291d0]
lea r8, [rsp + 0x3c4]
call fcn.140003f8f
lea r9, [r14 - 0x2c90ab1a]
lea rcx, [r12 + 0x2e971809]
cmp dword [rsp + 0x3c4], 0
cmovs r9, rcx
jmp 0x14000216c
lea rcx, [r12 + 0x19001c0a]
cmp r9, rcx
jae 0x140003c65
nop word [rax + rax]
cmp r9, rdx
jne 0x14000216c
mov edx, dword [rsp + 0x2e0]
lea rcx, str.0x_08lx_n
call fcn.140001000
lea r9, [r14 - 0x1d9597a7]
jmp 0x14000216c
lea rdx, [r14 + 0x3793a206]
cmp r9, rdx
jae 0x140003d6a
nop dword [rax + rax]
cmp r9, rcx
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r14 + 0x2c90e75]
lea rdx, [r14 - 0x1c947761]
cmp ecx, 0x69
cmovl r9, rdx
jmp 0x14000216c
lea rcx, [r12 + 0x5a3253be]
cmp r9, rcx
jae 0x140003d94
nop dword [rax + rax]
cmp r9, rdx
jne 0x14000216c
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
lea r9, [r14 + 0x21435cbd]
lea rdx, [r12 + 0xf4a4782]
cmp word [rcx], 0x2d
cmove r9, rdx
jmp 0x14000216c
lea rdx, [r14 - 0x39a170e]
cmp r9, rdx
jae 0x140003db9
nop
cmp r9, rcx
jne 0x14000216c
mov edx, dword [rsp + 0x3c4]
lea rcx, str.___Interact_Mode___d_n
call fcn.140001000
movaps xmmword [rsp + 0x3b0], xmm6
movaps xmmword [rsp + 0x3a0], xmm6
movaps xmmword [rsp + 0x390], xmm6
movaps xmmword [rsp + 0x380], xmm6
xor edi, edi
mov qword [rsp + 0x378], rdi
mov qword [rsp + 0x370], rdi
movaps xmmword [rsp + 0x340], xmm6
movaps xmmword [rsp + 0x350], xmm6
mov dword [rsp + 0x340], 0x30
lea rax, [rsp + 0x348]
mov dword [rax + 0x10], edi
movups xmmword [rax], xmm6
movups xmmword [rax + 0x18], xmm6
movaps xmmword [rsp + 0x330], xmm6
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], rdi
mov qword [rsp + 0x328], rdi
mov qword [rsp + 0x320], rdi
mov dword [rsp + 0x31c], edi
mov r8d, 0x7d0
lea rcx, [rsp + 0xf78]
xor edx, edx
call fcn.140022070
movaps xmmword [rsp + 0x300], xmm6
movaps xmmword [rsp + 0x2f0], xmm6
movaps xmmword [rsp + 0x2e0], xmm6
mov qword [rsp + 0x2d0], rdi
movaps xmmword [rsp + 0x2c0], xmm6
movaps xmmword [rsp + 0x2b0], xmm6
movaps xmmword [rsp + 0x2a0], xmm6
movaps xmmword [rsp + 0x290], xmm6
movaps xmmword [rsp + 0x280], xmm6
mov r8d, 0x3c8
lea rcx, [rsp + 0xbb0]
xor edx, edx
call fcn.140022070
mov qword [rsp + 0x278], rdi
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x370]
mov edx, 0x1fffff
lea r8, [rsp + 0x340]
lea r9, [rsp + 0x330]
call fcn.140006ddf
lea rcx, [r14 + 0x27e3da8]
lea r9, [r12 + 0xa07139f]
mov dword [rsp + 0x64], eax
test eax, eax
cmovns r9, rcx
movaps xmmword [rsp + 0x330], xmm6
xor eax, eax
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rsp + 0xa8], rcx
xor ecx, ecx
mov qword [rsp + 0xc8], rcx
xor eax, eax
mov qword [rsp + 0xd0], rax
xor ecx, ecx
mov qword [rsp + 0xb0], rcx
xor ecx, ecx
mov qword [rsp + 0x90], rcx
xor eax, eax
mov qword [rsp + 0xe0], rax
xor eax, eax
mov qword [rsp + 0xc0], rax
xor eax, eax
mov qword [rsp + 0xa0], rax
xor eax, eax
mov qword [rsp + 0xf0], rax
jmp 0x14000216c
lea rcx, [r12 + 0xa07139f]
nop dword [rax + rax]
cmp r9, rcx
jae 0x140003dcd
cmp r9, rdx
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r14 + 0x34a77d1d]
lea rdx, [r12 + 0x42a9a460]
cmp ecx, 0x68
cmovl r9, rdx
jmp 0x14000216c
lea rcx, [r14 + 0x2f34fce6]
nop dword [rax + rax]
cmp r9, rcx
jae 0x140003df4
cmp r9, rdx
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r12 + 0x48d75d]
cmp ecx, 0x64
cmovne r9, r14
jmp 0x14000216c
lea rcx, [r12 + 0x4759fa21]
cmp r9, rcx
jae 0x140003e18
nop dword [rax + rax]
cmp r9, rdx
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r14 + 0x2e459681]
lea rdx, [r14 + 0x2a7b078]
cmp ecx, 0x64
cmovl r9, rdx
jmp 0x14000216c
lea rdx, [r14 + 0x7e49ea9]
cmp r9, rdx
jae 0x140003ea5
nop word [rax + rax]
cmp r9, r8
jne 0x14000216c
mov eax, dword [rsp + 0x60]
lea rdx, [r14 - 0x1c947761]
cmp eax, 0x49
cmovl rcx, rdx
mov r9, rcx
nop
jmp 0x14000216c
lea rdx, [r12 + 0x2e971809]
cmp r9, rdx
jae 0x140003ec8
cmp r9, rcx
jne 0x14000216c
lea rcx, str.____NtOpenProcessToken:_0x_08x_n
mov esi, dword [rsp + 0x64]
mov edx, esi
call fcn.140001000
lea r9, [r12 - 0x54442d9]
mov dword [rsp + 0x5c], esi
nop dword [rax]
jmp 0x14000216c
lea rdx, [r14 + 0x5303829d]
cmp r9, rdx
jae 0x140003eda
cmp r9, rcx
jne 0x14000216c
mov r8d, 0x208
lea rbx, [rsp + 0x9a0]
mov rcx, rbx
xor edx, edx
call fcn.140022070
mov edx, 0x104
mov rcx, rbx
lea r8, str.___
call fcn.140012614
mov edx, 0x104
mov rcx, rbx
mov rsi, qword [rsp + 0x98]
mov r8, rsi
call fcn.140012614
mov rcx, rbx
mov r13, qword [sym.imp.KERNEL32.dll_lstrlenW]
call r13
lea ecx, [rax*2 + 2]
mov qword [rsp + 0xc8], rcx
add eax, eax
mov qword [rsp + 0xa8], rax
mov rcx, rsi
call r13
lea ecx, [rax*2 + 2]
mov qword [rsp + 0x90], rcx
add eax, eax
mov qword [rsp + 0xb0], rax
mov r8d, 0x208
lea rbx, [rsp + 0x790]
mov rcx, rbx
xor edx, edx
call fcn.140022070
mov edx, 0x104
mov rcx, rbx
mov rbp, rdi
lea rdi, [0x140029258]
mov r8, rdi
call fcn.140012614
mov edx, 0x104
mov rcx, rbx
mov r8, rsi
call fcn.140012614
mov edx, 0x104
mov rcx, rbx
mov r8, rdi
mov rdi, rbp
call fcn.140012614
mov rcx, rbx
call r13
lea ecx, [rax*2 + 2]
mov qword [rsp + 0xa0], rcx
add eax, eax
mov qword [rsp + 0xc0], rax
lea r9, [r12 + 0x19001c0a]
lea rax, [rsp + 0x9a0]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xf0], rbx
lea rbx, str.____Invalid_argument:__ls_n
lea rbp, str.____Missing_value_for_option:__i_n
jmp 0x14000216c
lea rdx, [r12 + 0x6c86e283]
nop
cmp r9, rdx
jae 0x140003f13
cmp r9, rcx
jne 0x14000216c
lea r9, [r14 - 0x9637708]
lea rcx, [r12 + 0x19a6fd0c]
cmp qword [rsp + 0x98], 0
cmove r9, rcx
jmp 0x14000216c
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r14 + 0x2a7b078]
cmp ecx, 0x43
cmovne r9, r14
jmp 0x14000216c
jne 0x14000216c
jmp 0x140003f5f
nop dword [rax + rax]
jne 0x14000216c
add qword [rsp + 0x68], 8
mov rax, qword [rsp + 0x80]
cmp eax, 3
lea ecx, [rax - 1]
lea rdx, [r12 + 0xf4a4782]
lea r9, [r12 + 0x571e5ada]
cmovl r9, rdx
mov qword [rsp + 0x80], rcx
jmp 0x14000216c
nop dword [rax + rax]
jne 0x14000216c
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
movzx eax, word [rax + 2]
mov dword [rsp + 0x60], eax
lea r9, [r14 - 0x10cb180]
nop
jmp 0x14000216c
jne 0x14000216c
mov rax, qword [0x140030178]
movabs rcx, 0xaeea1fdeaedf7f5f
movzx ecx, word [rax + rcx]
lea r9, [r14 + 0x4da693cb]
lea rdx, [r14 + 0x2d37b528]
cmp ecx, 0x1db2
cmovb r9, rdx
jmp 0x14000216c
nop dword [rax]
jne 0x14000216c
mov rcx, qword [0x140030190]
lea r9, [r14 + 0x3a9ee7d]
lea rdx, [r14 + 0x2d37b528]
movabs r8, 0xaeea1fdeaedf7f5f
cmp qword [rcx + r8], 0
cmove r9, rdx
jmp 0x14000216c
lea rdx, [r14 - 0x39a170e]
cmp r9, rcx
mov ecx, 0xc0000017
mov eax, dword [rsp + 0x5c]
cmove eax, ecx
mov dword [rsp + 0x5c], eax
cmove r9, rdx
jmp 0x14000216c
jne 0x14000216c
mov rcx, qword [rsp + 0x320]
xor edx, edx
call fcn.140006f04
lea rcx, str.___NtResumeThread:_0x_08x_n
mov edx, eax
call fcn.140001000
lea r9, [r14 + 0x327b3f3a]
lea rcx, [r14 + 0x8263773]
cmp dword [rsp + 0x3c4], 0
cmove r9, rcx
jmp 0x14000216c
jne 0x14000216c
mov rcx, qword [rsp + 0x370]
call fcn.140006e81
mov qword [rsp + 0x370], 0
lea r9, [r14 + 0xff79cdb]
nop
jmp 0x14000216c
jne 0x14000216c
lea rcx, str.___StdHandle_Mode_2__not_work..._n
call fcn.140001000
mov eax, dword [rsp + 0x278]
and eax, 0xffffffe0
or eax, 2
jmp 0x140003eff
jne 0x14000216c
lea rcx, [r14 + 0xff79cdb]
lea r9, [r12 - 0x7390942]
cmp qword [rsp + 0x370], 0
cmove r9, rcx
jmp 0x14000216c
jne 0x14000216c
mov rdx, qword [rsp + 0x370]
lea rcx, str.___Parent_process_handle:__p_n
call fcn.140001000
mov rcx, qword [rsp + 0x370]
mov edx, 0xf01ff
lea r8, [rsp + 0x378]
call fcn.140006eb3
lea r9, [r12 + 0x269cfdc7]
lea rcx, [r12 + 0x6c86e283]
mov dword [rsp + 0x64], eax
test eax, eax
cmovns r9, rcx
nop
jmp 0x14000216c
jne 0x14000216c
mov edx, 0x58
lea rcx, [rsp + 0x280]
call fcn.140004020
mov dword [rsp + 0x288], 0
mov qword [rsp + 0x280], 0x58
or byte [rsp + 0x290], 3
mov dword [rsp + 0x294], 0x81
mov rax, qword [0x140030178]
movabs rsi, 0xaeea1fdeaedf7f5f
movzx ecx, word [rax + rsi]
call fcn.140004080
mov r9, qword [rsp + 0xb8]
movzx ecx, word [r9 + 0xc2]
add ecx, 7
and ecx, 0xfffffff8
movzx edx, word [rsp + 0x90]
lea edx, [rdx*2 + 0xe]
and edx, 0xfffffff0
movzx r8d, word [rsp + 0xa0]
add r8d, 7
and r8d, 0xfffffff8
add r8d, edx
add r8d, ecx
movzx ecx, word [r9 + 0x52]
add ecx, 7
and ecx, 0xfffffff8
add r8d, eax
add r8d, ecx
add r8d, 0x208
mov rax, qword [0x140030180]
mov rax, qword [rax + rsi]
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
mov edx, 8
mov qword [rsp + 0xd8], r8
call qword [0x14002dcc0]
lea rcx, [r14 + 0x4a9d3006]
lea r9, [r12 + 0x4c93d7ef]
mov rdx, rax
mov qword [rsp + 0x78], rax
test rax, rax
cmove r9, rcx
jmp 0x14000216c
jne 0x14000216c
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 8]
cmp word [rax], 0x2d
sete al
mov dword [rsp + 0x8c], eax
lea r9, [r12 + 0x300d6818]
jmp 0x14000216c
jne 0x14000216c
mov ecx, dword [rsp + 0x60]
lea r9, [r14 + 0x5a77f65]
lea rdx, [r12 + 0x357a21e8]
cmp ecx, 0x48
cmovl r9, rdx
jmp 0x14000216c
lea rcx, [r12 - 0x54442d9]
cmp r9, rdx
cmove r9, rcx
jmp 0x14000216c
jne 0x14000216c
lea rcx, str.____NtOpenProcess:_0x_08x_n
mov r13d, dword [rsp + 0x64]
mov edx, r13d
call fcn.140001000
mov dword [rsp + 0x5c], r13d
mov r9, rsi
jmp 0x14000216c
jne 0x14000216c
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x78]
mov qword [rcx + 0x10], rax
lea r9, [r12 - 0x37472a9]
jmp 0x14000216c
jne 0x14000216c
mov r10, qword [rsp + 0x78]
mov eax, dword [r10 + 0x20]
mov r9d, 0x10000003
and eax, r9d
xor ecx, ecx
cmp eax, 3
sete cl
mov eax, dword [rsp + 0x278]
shl ecx, 2
mov edx, dword [r10 + 0x28]
and edx, r9d
xor r8d, r8d
cmp edx, 3
sete r8b
shl r8d, 3
mov edx, eax
and edx, 0x1c
or edx, ecx
or edx, r8d
and eax, 0xffffffe3
mov ecx, dword [r10 + 0x30]
and ecx, r9d
xor r8d, r8d
cmp ecx, 3
sete r8b
shl r8d, 4
or r8d, eax
or r8d, edx
mov dword [rsp + 0x278], r8d
lea rcx, str.___Old_StdHandle.HandleMask_Set__n
call fcn.140001000
lea r9, [r12 + 0xfd91e85]
nop dword [rax + rax]
jmp 0x14000216c
jne 0x14000216c
lea rcx, [r14 + 0xec24751]
lea r9, [r12 + 0x37a08418]
cmp dword [rsp + 0x64], 0
cmovns r9, rcx
jmp 0x14000216c
jne 0x14000216c
lea rcx, str.____Invaid_value_for_option:__i_n
jmp 0x140002d4f
nop word [rax + rax]
jne 0x14000216c
lea rcx, str.___StdHandle_Mode_1_n
call fcn.140001000
mov eax, dword [rsp + 0x278]
and eax, 0xffffffe0
or eax, 1
mov dword [rsp + 0x278], eax
lea r9, [r12 - 0x9193271]
jmp 0x14000216c
jne 0x14000216c
mov rdx, qword [rsp + 0x378]
lea rcx, str.___TokenHandle:_0x_p_n
call fcn.140001000
mov rcx, qword [rsp + 0x370]
call fcn.140006e81
mov qword [rsp + 0x370], 0
lea r9, [r14 + 0x5070b94b]
cmp qword [rsp + 0x98], 0
cmove r9, rsi
jmp 0x14000216c
mov rcx, qword [rsp + 0x1748]
xor rcx, rsp
call fcn.140006fa0
mov eax, dword [rsp + 0x5c]
movaps xmm6, xmmword [rsp + 0x1750]
add rsp, 0x1768
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret