Function at 0x140004f70
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Create process on windows
Delete file
Move file
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x870]
sub rsp, 0x970
mov rax, qword [0x1400590c0]
xor rax, rsp
mov qword [rbp + 0x860], rax
mov rbx, r8
mov qword [rbp + 0x60], rdx
mov dword [rbp - 0x38], ecx
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov dword [rbp - 0x80], r14d
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
mov ecx, 0x38
call fcn.14001d5b0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x48], 8
mov dword [rbp - 0x80], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rbp - 0x68]
call fcn.140007d90
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x140043b80]
movdqu xmmword [rbp + 0x50], xmm1
movsd xmm0, qword [str.createDuration]
movsd qword [rbp + 0x40], xmm0
mov eax, dword [0x140043990]
mov dword [rbp + 0x48], eax
movzx eax, word [0x140043994]
mov word [rbp + 0x4c], ax
mov byte [rbp + 0x4e], r14b
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x80]
call fcn.140001af0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140005097
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005092
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000648d
call fcn.14001d5ec
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r12, rax
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400038c0
nop
mov edx, 0x5c
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.14001e9c8
mov rdi, rax
mov rsi, 0xffffffffffffffff
test rax, rax
jne 0x1400050db
mov edi, esi
jmp 0x1400050e1
sub rdi, rbx
sar rdi, 1
mov edx, 0x2f
mov rcx, rbx
call fcn.14001e9c8
test rax, rax
jne 0x1400050f7
mov eax, esi
jmp 0x1400050fd
sub rax, rbx
sar rax, 1
cmp edi, eax
cmovg eax, edi
lea r8d, [rax + 1]
mov r9d, dword [rbx - 0x10]
sub r9d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.140004440
mov dword [rsp + 0x60], 3
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000513e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rdx, str.new_Aliworkbench.exe
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140024094
nop
lea rdx, [rbx - 0x18]
test eax, eax
mov eax, esi
jne 0x1400052e1
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005175
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x140006493
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x60], rax
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14000649e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x68], rax
mov dword [rsp + 0x68], r14d
lea rdx, [rsp + 0x68]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
xor edx, edx
mov r8d, 0x258
lea rcx, [rbp + 0x600]
call fcn.14003fd50
mov ecx, dword [rsp + 0x68]
test ecx, ecx
jle 0x14000522b
mov r9, r14
mov r10d, ecx
nop dword [rax + rax]
test r9, r9
je 0x140005222
lea rcx, [rbp + 0x600]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140005200
mov r8, qword [rbx + r9*8]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140005210
inc r9
sub r10, 1
jne 0x1400051f0
lea rdx, [rbp + 0x600]
lea rcx, [rbp + 0x60]
call fcn.140014cc0
nop
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005259
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140005275
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400052bf
mov rdx, qword [rbp - 0x58]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064a9
call fcn.14001d5ec
mov qword [rbp - 0x68], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140001a50
mov edx, 0x38
mov rcx, qword [rbp - 0x78]
call fcn.14001d5ec
xor eax, eax
jmp 0x14000645d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400052f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [rsp + 0x6c], r14d
lea rdx, [rsp + 0x6c]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
cmp word [r12], 0
jne 0x140005317
mov dword [rsp + 0x6c], r14d
mov edi, esi
mov dword [rsp + 0x68], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1e0]
call fcn.14003fd50
lea rcx, [rbp - 0x40]
call fcn.140003c00
nop
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SetDllDirectoryW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005377
lea rcx, [rbp + 0x1e0]
call rax
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.140003510
nop
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x1400064af
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x70]
cmp dword [rax - 0x10], 0
jle 0x140005418
call fcn.140002ac0
mov rdx, qword [rsp + 0x70]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 8
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov rdx, qword [str.AliEntry]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400063a0
xor r9d, r9d
mov r8, r12
xor edx, edx
mov ecx, ebx
call rax
mov edi, eax
jmp 0x1400063a0
movsxd r14, dword [rsp + 0x6c]
mov r11, qword [str._noupdate]
test r11, r11
je 0x140005495
test r15, r15
je 0x140005495
xor r8d, r8d
mov edi, r8d
mov r9, rsi
nop word [rax + rax]
inc r9
cmp word [r11 + r9*2], r8w
jne 0x140005440
test r14d, r14d
jle 0x14000548d
mov rdx, r9
mov rcx, r11
mov rax, r11
mov r10, r8
test r9, r9
je 0x140005488
mov r8, qword [r15 + r10*8]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x140005671
add rcx, 2
sub rdx, 1
jne 0x140005470
mov edi, 1
test edi, edi
jne 0x140005d85
mov r11, qword [str._removenew]
test r11, r11
je 0x140005501
test r15, r15
je 0x140005501
xor r8d, r8d
mov edi, r8d
mov r9, rsi
nop
inc r9
cmp word [r11 + r9*2], r8w
jne 0x1400054b0
test r14d, r14d
jle 0x1400054fd
mov rdx, r9
mov rcx, r11
mov rax, r11
mov r10, r8
test r9, r9
je 0x1400054f8
mov r8, qword [r15 + r10*8]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [rcx + r8], ax
jne 0x14000568b
add rcx, 2
sub rdx, 1
jne 0x1400054e0
mov edi, 1
test edi, edi
jne 0x140005575
mov r11, qword [str._removenew2]
test r11, r11
je 0x140005832
test r15, r15
je 0x140005832
xor r8d, r8d
mov edi, r8d
mov r9, rsi
inc r9
cmp word [r11 + r9*2], r8w
jne 0x140005523
test r14d, r14d
jle 0x14000556d
mov rdx, r9
mov rcx, r11
mov rax, r11
mov r10, r8
test r9, r9
je 0x140005568
mov r8, qword [r15 + r10*8]
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1400056a5
add rcx, 2
sub rdx, 1
jne 0x140005550
mov edi, 1
test edi, edi
je 0x140005832
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3f0]
call fcn.14003fd50
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140003800
nop
lea r8, [0x1400439c0]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140002620
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400055c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r8, qword [rsp + 0x60]
mov edx, 0x104
lea rcx, [rbp + 0x3f0]
call fcn.140023c28
mov rax, qword [rsp + 0x60]
movsxd rdx, dword [rax - 0x10]
lea ecx, [rdx + 1]
cmp ecx, 0x104
jge 0x1400056bf
lea rax, [rdx*2 + 2]
cmp rax, 0x208
jae 0x1400064ba
xor r12d, r12d
mov word [rbp + rax + 0x3f0], r12w
mov qword [rbp + 0x1a8], 3
mov dword [rbp + 0x1c0], 0x614
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1c8], xmm0
mov qword [rbp + 0x1a0], r12
lea rax, [rbp + 0x3f0]
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], r12
mov dword [rbp + 0x1c4], 1
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rax, qword [rsp + 0x60]
jmp 0x1400056c2
inc r10
cmp r10, r14
jge 0x14000548d
mov rcx, r11
mov rdx, r9
mov rax, r11
jmp 0x140005460
inc r10
cmp r10, r14
jge 0x1400054fd
mov rcx, r11
mov rdx, r9
mov rax, r11
jmp 0x1400054d0
inc r10
cmp r10, r14
jge 0x14000556d
mov rcx, r11
mov rdx, r9
mov rax, r11
jmp 0x140005543
xor r12d, r12d
mov rbx, qword [str._removenew2]
test rbx, rbx
je 0x140005810
test r15, r15
je 0x140005810
mov r14d, r12d
mov r10, rsi
inc r10
cmp word [rbx + r10*2], 0
jne 0x1400056e1
movsxd rdi, dword [rsp + 0x6c]
test rdi, rdi
jle 0x14000572e
mov r8, r10
mov rdx, rbx
mov rcx, rbx
mov r11, r12
test r10, r10
je 0x140005728
mov r9, qword [r15 + r11*8]
sub r9, rcx
nop
movzx ecx, word [rdx]
cmp word [r9 + rdx], cx
jne 0x1400057f6
add rdx, 2
sub r8, 1
jne 0x140005710
mov r14d, 1
test r14d, r14d
je 0x140005810
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005751
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005770
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000578f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400057ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400052bf
mov rdx, qword [rbp - 0x58]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064c0
call fcn.14001d5ec
mov qword [rbp - 0x68], r12
jmp 0x1400052b7
inc r11
cmp r11, rdi
jge 0x14000572e
mov rdx, rbx
mov r8, r10
mov rcx, rbx
jmp 0x140005707
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005d85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140005d85
mov r11, qword [str._updateNow]
test r11, r11
je 0x140005a5e
test r15, r15
je 0x140005a5e
xor r8d, r8d
mov edi, r8d
mov r9, rsi
inc r9
cmp word [r11 + r9*2], r8w
jne 0x140005854
test r14d, r14d
jle 0x14000589d
mov rdx, r9
mov rcx, r11
mov rax, r11
mov r10, r8
test r9, r9
je 0x140005898
mov r8, qword [r15 + r10*8]
sub r8, rax
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x14000592a
add rcx, 2
sub rdx, 1
jne 0x140005880
mov edi, 1
test edi, edi
je 0x140005a5e
lea rcx, [rbp + 0x1a0]
call fcn.1400190f0
nop
lea rdx, [0x1400439c8]
lea rcx, [rbp + 0x40]
call fcn.140001e90
mov rdi, rax
mov rbx, qword [str._updateNow]
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x1400058e6
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400058f7
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1400064c6
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x60], 0x43
mov r9, qword [rdi]
mov eax, dword [r9 - 0x10]
test rbx, rbx
jne 0x140005944
xor edi, edi
mov r8d, edi
jmp 0x14000595d
inc r10
cmp r10, r14
jge 0x14000589d
mov rcx, r11
mov rdx, r9
mov rax, r11
jmp 0x140005874
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140005950
xor edi, edi
mov dword [rsp + 0x20], eax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140002fa0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x1a0]
call fcn.14001b9f0
movzx ebx, al
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400059a8
mov r9, qword [rdx]
mov rcx, qword [r9]
mov r8, qword [rcx + 8]
mov rcx, r9
call r8
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400059c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400192d0
test bl, bl
je 0x140005d85
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400059f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005a18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140005a34
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x1400052bf
mov r8, qword [rbp - 0x58]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x68]
call fcn.140004f20
mov qword [rbp - 0x68], rdi
jmp 0x1400052b7
mov r8d, r14d
mov rdx, r15
mov rcx, qword [str._uninstall]
call fcn.140004280
test eax, eax
je 0x140005d0f
lea rcx, [rsp + 0x60]
call fcn.140003c00
nop
lea rdx, str.SafeGuardAlibabaProtectCon.exe
lea rcx, [rsp + 0x60]
call fcn.140002880
nop
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x1400064d1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.140003800
nop
mov r8, qword [rax]
lea rdx, str._unload___s_
lea rcx, [rbp - 0x38]
call fcn.1400031a0
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005af1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140005bca
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005b25
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005b44
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005b63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005b82
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140005b9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x1400052bf
mov r8, qword [rbp - 0x58]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x68]
call fcn.140004f20
xor ebx, ebx
mov qword [rbp - 0x68], rbx
jmp 0x1400052b7
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x1400064dc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r9, qword [rbp - 0x38]
mov r8, rbx
lea rdx, str.__s___s
lea rcx, [rsp + 0x50]
call fcn.1400031a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rax
mov dword [rbp - 0x30], 0x68
xor edi, edi
mov word [rbp + 0x10], di
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140005cde
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005c99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005cb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400059da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400059da
mov edx, 0x2710
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005c7f
lea rcx, [rbp + 0x40]
call fcn.1400190f0
nop
lea rcx, [rbp + 0x40]
call fcn.14001b190
test al, al
je 0x140005d7c
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140001e90
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.14001b9f0
movzx ebx, al
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140005d6a
mov r9, qword [rdx]
mov rcx, qword [r9]
mov r8, qword [rcx + 8]
mov rcx, r9
call r8
test bl, bl
je 0x140005d7c
lea rcx, [rbp + 0x40]
call fcn.1400192d0
jmp 0x140005b44
lea rcx, [rbp + 0x40]
call fcn.1400192d0
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0x84]
call fcn.14003fd50
mov dword [rbp + 0x80], 0x11c
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdi, rax
mov r14, rax
cmp dword [rbp + 0x84], 6
jne 0x140005e96
cmp dword [rbp + 0x88], 1
jne 0x140005e96
cmp dword [rbp + 0x90], 2
jne 0x140005e96
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r14, rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3f0]
call fcn.14003fd50
lea r8, [rbp + 0x1e0]
mov edx, 0x104
lea rcx, [rbp + 0x3f0]
call fcn.140023c28
lea rdx, str.ucrtbase.dll
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 8
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x600]
call fcn.14003fd50
lea r8, [rbp + 0x1e0]
mov edx, 0x104
lea rcx, [rbp + 0x600]
call fcn.140023c28
lea rdx, str.prgnet.dll
lea rcx, [rbp + 0x600]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 8
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
lea rdx, str.AppFramework.dll
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 8
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x1400061bd
mov rdx, qword [section..data]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140006399
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r15, rax
cmp r13, rdi
ja 0x140005f83
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x140043b60]
movdqu xmmword [rbp + 0x50], xmm1
movabs rax, 0x7472617453657270
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x80]
call fcn.140001af0
mov rcx, rdi
sub rcx, r13
mov rax, qword [rax]
mov qword [rax + 0x30], rcx
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140005f83
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064e7
call fcn.14001d5ec
cmp rdi, r14
ja 0x14000601f
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x140043b50]
movdqu xmmword [rbp + 0x50], xmm1
mov rax, qword [str.loadCef]
mov dword [rbp + 0x40], eax
movzx eax, word [0x140043aac]
mov word [rbp + 0x44], ax
movzx eax, byte [0x140043aae]
mov byte [rbp + 0x46], al
mov byte [rbp + 0x47], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x80]
call fcn.140001af0
mov rcx, r14
sub rcx, rdi
mov rax, qword [rax]
mov qword [rax + 0x30], rcx
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000601f
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000601a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064ed
call fcn.14001d5ec
cmp r14, rbx
ja 0x14000607e
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x140043b70]
movdqu xmmword [rbp + 0x50], xmm1
movsd xmm0, qword [str.loadPrgNet]
movsd qword [rbp + 0x40], xmm0
movzx eax, word [0x140043ab8]
mov word [rbp + 0x48], ax
mov byte [rbp + 0x4a], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x80]
call fcn.140001af0
mov rcx, rbx
sub rcx, r14
mov rax, qword [rax]
mov qword [rax + 0x30], rcx
lea rcx, [rbp + 0x40]
call fcn.1400023f0
cmp rbx, r15
ja 0x140006102
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, 0x14
lea rdx, str.loadLoadAppFrameWork
lea rcx, [rbp + 0x40]
call fcn.140001740
nop
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x80]
call fcn.140001af0
sub rbx, r14
mov rax, qword [rax]
mov qword [rax + 0x30], rbx
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140006102
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064f3
call fcn.14001d5ec
mov r12, qword [rbp - 0x70]
lea rcx, [r12*8]
call fcn.1400244e8
mov r13, rax
lea rcx, [r12*8]
call fcn.1400244e8
mov r14, rax
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140006172
mov r15, rax
mov rax, r13
sub rax, r15
mov rsi, rax
nop
lea rcx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0xf
jbe 0x14000614f
mov rcx, qword [rbx + 0x10]
call fcn.14002445c
mov qword [r15 + rsi], rax
mov rax, qword [rbx + 0x30]
mov qword [r15], rax
add r15, 8
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140006140
mov rsi, 0xffffffffffffffff
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
mov r9, r13
xor r8d, r8d
mov rdx, qword [rbp + 0x60]
mov ecx, dword [rbp - 0x38]
call qword [rsp + 0x60]
mov edi, eax
xor ebx, ebx
test r12, r12
je 0x1400061a8
mov rcx, qword [r13 + rbx*8]
call fcn.1400244d4
inc rbx
cmp rbx, r12
jb 0x140006196
mov rcx, r13
call fcn.1400244d4
mov rcx, r14
call fcn.1400244d4
jmp 0x14000639d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r10, [rbp + 0x1ca]
test eax, eax
jns 0x140006220
neg r8d
nop dword [rax]
nop dword [rax + rax]
sub r10, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r10], r8w
mov r8d, edx
test edx, edx
jne 0x1400061e0
add r10, 0xfffffffffffffffe
mov word [r10], 0x2d
jmp 0x140006250
sub r10, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r10], r8w
mov r8d, edx
test edx, edx
jne 0x140006220
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x1ca]
mov rdx, r10
lea rcx, [rbp + 0x40]
call fcn.1400015e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1b0], xmm1
mov r8d, 0x14
lea rdx, str.CS_r_T
lea rcx, [rbp + 0x1a0]
call fcn.140001850
nop
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x1a0]
movzx edx, byte [rsp + 0x58]
lea rcx, [rbp + 0x60]
call fcn.140001f10
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 7
jbe 0x1400062f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064f9
call fcn.14001d5ec
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140006339
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006334
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064ff
call fcn.14001d5ec
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rdx, qword [rbp + 0x60]
xor r9d, r9d
lea r8, [0x140043b04]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x140006399
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006394
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064ff
call fcn.14001d5ec
mov edi, dword [rsp + 0x68]
xor r14d, r14d
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400063bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400063de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400063fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140006440
mov rdx, qword [rbp - 0x58]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000642f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006487
call fcn.14001d5ec
mov qword [rbp - 0x68], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140001a50
mov edx, 0x38
mov rcx, qword [rbp - 0x78]
call fcn.14001d5ec
mov eax, edi
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.14001d590
mov rbx, qword [rsp + 0x9c0]
add rsp, 0x970
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140023b04
nop
call fcn.140023b04
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
call fcn.140023b04
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
call fcn.14001d93c
nop
call fcn.140023b04
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
call fcn.140023b04
int3
call fcn.140023b04
int3
call fcn.140023b04
nop
call fcn.140023b04
nop
call fcn.140023b04
int3