Function at 0x140049c7c
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a8]
sub rsp, 0x6a8
mov rax, qword [0x1402142b0]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov rax, qword [rbp + 0x610]
mov r13, r9
mov rbx, qword [rdx]
mov r14, r8
mov rdi, qword [rdx + 8]
mov rsi, rdx
mov r15, qword [rbp + 0x620]
mov qword [rbp - 0x68], rcx
lea rcx, [rbp + 0xa0]
mov qword [rbp - 0x70], rax
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rdi
mov qword [rsp + 0x70], rdx
mov word [rbp + 0xc0], 0x105
call fcn.14003cb40
xor r12d, r12d
test al, al
jne 0x140049d46
test r15, r15
je 0x140049d3f
lea edx, [r12 + 0x16]
cmp qword [r15 + 0x18], rdx
jb 0x140049d2d
mov rbx, qword [r15]
mov r8d, edx
mov qword [r15 + 0x10], rdx
mov rcx, rbx
lea rdx, str.program_not_executable
call fcn.140116d20
mov byte [rbx + 0x16], r12b
jmp 0x140049d3f
lea r9, str.program_not_executable
mov r8b, r12b
mov rcx, r15
call fcn.140004f4c
xor al, al
jmp 0x14004a9c9
lea rax, [rbp + 0x108]
mov qword [rbp + 0xf8], r12
xor r8d, r8d
mov qword [rbp + 0xf0], rax
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0x100], 0x40
lea rcx, [rbp + 0x40]
mov word [rbp + 0xc0], 0x105
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rdi
call fcn.14003c47c
cmp dword [rax], r12d
je 0x140049df4
lea rax, str..exe
mov word [rbp + 0xc0], 0x305
lea rdx, [rbp + 0xf0]
mov qword [rbp + 0xb0], rax
lea rcx, [rbp + 0xa0]
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rdi
call fcn.14002d000
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x88], rax
movups xmm0, xmmword [rbp + 0x80]
movdqu xmmword [rsi], xmm0
movups xmm0, xmmword [r14]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x10]
movdqu xmmword [rbp + 0x80], xmm0
call fcn.14004c084
test byte [rbp + 0x30], 1
je 0x140049e24
movups xmm0, xmmword [rbp + 0x10]
movdqu xmmword [rbp + 0x80], xmm0
jmp 0x140049e37
mov dword [rbp + 0x80], r12d
call fcn.140004f44
mov qword [rbp + 0x88], rax
lea rax, [rbp + 0x80]
mov ecx, dword [rax]
test ecx, ecx
je 0x140049ec2
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0xf
mov qword [rbp + 0x60], r12
lea r9, str.Unable_to_convert_command_line_to_UTF_16
mov qword [rbp + 0x70], r12
mov r8b, r12b
mov qword [rbp + 0x78], rsi
lea rcx, [rbp + 0x60]
lea edx, [rsi + 0x19]
call fcn.140004f4c
lea rdx, [rbp + 0x60]
mov rcx, r15
call fcn.14004abbc
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140049eba
mov rcx, qword [rbp + 0x60]
inc rdx
mov r14d, 0x1000
mov rax, rcx
cmp rdx, r14
jb 0x140049eb5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aaa0
call fcn.1400690f4
mov sil, r12b
jmp 0x14004a99f
xorps xmm0, xmm0
mov qword [rbp + 0xc8], r12
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xc8]
movdqu xmmword [rbp + 0xd8], xmm0
call fcn.14004b678
xor ecx, ecx
mov qword [rbp + 0x70], r12
xorps xmm0, xmm0
mov r14d, 0x1000
movdqu xmmword [rbp + 0x60], xmm0
cmp byte [r13 + 0x10], cl
je 0x14004a0dd
mov rsi, qword [r13]
mov r13, qword [r13 + 8]
mov rdi, qword [rbp + 0x68]
shl r13, 4
add r13, rsi
cmp rsi, r13
je 0x140049ff5
mov bl, byte [rsp + 0x50]
movups xmm0, xmmword [rsi]
lea rax, [rbp + 0x168]
mov qword [rbp + 0x158], rcx
lea r8, [rbp + 0x150]
mov qword [rbp + 0x150], rax
lea rdx, [rbp + 0x80]
mov qword [rbp + 0x160], 0x104
lea rcx, [rbp + 0x40]
movdqu xmmword [rbp + 0x80], xmm0
call fcn.14003c44c
mov ecx, dword [rbp + 0x40]
test ecx, ecx
jne 0x14004a019
mov r8, qword [rbp + 0x150]
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0x158]
mov rdx, rdi
mov byte [rsp + 0x20], bl
lea r9, [r8 + rax*2]
call fcn.14003b510
mov rdi, qword [rbp + 0x68]
xor eax, eax
mov r12, qword [rbp + 0x70]
mov word [rsp + 0x50], ax
cmp rdi, r12
je 0x140049fb2
mov word [rdi], ax
add rdi, 2
mov qword [rbp + 0x68], rdi
jmp 0x140049fcb
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rbp + 0x60]
call fcn.1400229dc
mov r12, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x150]
lea rax, [rbp + 0x168]
cmp rcx, rax
je 0x140049fe3
call fcn.14011c590
add rsi, 0x10
mov ecx, 0
cmp rsi, r13
jne 0x140049f22
xor r13d, r13d
mov word [rsp + 0x50], r13w
cmp rdi, r12
je 0x14004a0c1
mov rsi, qword [rsp + 0x70]
mov word [rdi], r13w
add rdi, 2
jmp 0x14004a0e4
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r13d, r13d
lea r9, str.Unable_to_convert_environment_variable_to_UTF_16
mov r8b, r13b
mov qword [rbp + 0x80], r13
lea rcx, [rbp + 0x80]
mov qword [rbp + 0x90], r13
lea esi, [r13 + 0xf]
lea edx, [rsi + 0x21]
mov qword [rbp + 0x98], rsi
call fcn.140004f4c
lea rdx, [rbp + 0x80]
mov rcx, r15
call fcn.14004abbc
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14004a0a0
mov rcx, qword [rbp + 0x80]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a09b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aaa6
call fcn.1400690f4
mov rcx, qword [rbp + 0x150]
lea rax, [rbp + 0x168]
cmp rcx, rax
je 0x14004a43c
call fcn.14011c590
jmp 0x14004a43c
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rbp + 0x60]
call fcn.1400229dc
mov r12, qword [rbp + 0x70]
mov rsi, qword [rsp + 0x70]
jmp 0x14004a0e0
xor r13d, r13d
mov rdi, qword [rbp + 0x68]
mov ebx, 0x68
lea rcx, [rbp - 0x60]
mov r8d, ebx
xor edx, edx
call fcn.1401173d0
mov rax, qword [rbp - 0x70]
or qword [rbp], 0xffffffffffffffff
movdqa xmm0, xmmword [0x140161860]
mov dword [rbp - 0x60], ebx
movdqa xmmword [rbp - 0x10], xmm0
cmp qword [rax + 8], r13
je 0x14004a448
mov rbx, qword [rax]
lea rcx, [rbp + 0x40]
mov dword [rbp - 0x24], 0x100
mov r8, r15
xor edx, edx
movups xmm0, xmmword [rbx]
movsd xmm1, qword [rbx + 0x10]
movaps xmmword [rbp + 0x40], xmm0
movsd qword [rbp + 0x50], xmm1
call fcn.14004af78
mov qword [rbp - 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x14004a1bd
lea esi, [rax + 0x10]
mov qword [rbp + 0x40], r13
lea r9, str.cant_redirect_stdin
mov qword [rbp + 0x58], rsi
mov r8b, r13b
mov qword [rbp + 0x50], r13
lea edx, [rax + 0x15]
lea rcx, [rbp + 0x40]
call fcn.140004f4c
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.14004abbc
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x14004a43c
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a437
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aa8e
jmp 0x14004a437
movups xmm0, xmmword [rbx + 0x18]
lea rcx, [rbp + 0x40]
mov r8, r15
movsd xmm1, qword [rbx + 0x28]
mov edx, 1
movaps xmmword [rbp + 0x40], xmm0
movsd qword [rbp + 0x50], xmm1
call fcn.14004af78
mov qword [rbp - 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14004a266
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0xf
mov qword [rbp + 0x40], r13
lea r9, str.cant_redirect_stdout
mov qword [rbp + 0x50], r13
mov r8b, r13b
mov qword [rbp + 0x58], rsi
lea rcx, [rbp + 0x40]
lea edx, [rsi + 6]
call fcn.140004f4c
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.14004abbc
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x14004a43c
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a437
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aa94
jmp 0x14004a437
cmp byte [rbx + 0x28], r13b
je 0x14004a38d
cmp byte [rbx + 0x40], r13b
je 0x14004a38d
movups xmm0, xmmword [rbx + 0x18]
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x40], xmm1
psrldq xmm0, 8
psrldq xmm1, 8
movq rax, xmm0
movq r8, xmm1
cmp rax, r8
jne 0x14004a38d
test r8, r8
je 0x14004a2c7
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x80]
call fcn.140116c20
test eax, eax
jne 0x14004a38d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp - 8]
lea r9, [rbp]
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 1
mov r8, rbx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14004a448
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0xf
mov qword [rbp + 0x40], r13
lea r9, str.cant_dup_stderr_to_stdout
mov qword [rbp + 0x50], r13
mov r8b, r13b
mov qword [rbp + 0x58], rsi
lea rcx, [rbp + 0x40]
lea edx, [rsi + 0xb]
call fcn.140004f4c
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.14004abbc
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x14004a43c
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a437
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aa9a
jmp 0x14004a437
movups xmm0, xmmword [rbx + 0x30]
lea rcx, [rbp + 0x40]
mov r8, r15
movsd xmm1, qword [rbx + 0x40]
mov edx, 2
movaps xmmword [rbp + 0x40], xmm0
movsd qword [rbp + 0x50], xmm1
call fcn.14004af78
mov qword [rbp], rax
cmp rax, 0xffffffffffffffff
jne 0x14004a448
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0xf
mov qword [rbp + 0x40], r13
lea r9, str.cant_redirect_stderr
mov qword [rbp + 0x50], r13
mov r8b, r13b
mov qword [rbp + 0x58], rsi
lea rcx, [rbp + 0x40]
lea edx, [rsi + 6]
call fcn.140004f4c
lea rdx, [rbp + 0x40]
mov rcx, r15
call fcn.14004abbc
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x14004a43c
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a437
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aaac
call fcn.1400690f4
mov sil, r13b
mov r13, qword [rbp + 0x60]
jmp 0x14004a959
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
lea ecx, [rax + 1]
call fcn.14011c738
mov rcx, rax
call fcn.14011cd44
mov ecx, 2
call fcn.14011c738
mov rcx, rax
call fcn.14011cd44
lea rax, [rbp + 0x388]
mov word [rbp + 0xc0], 0x105
mov qword [rbp + 0x370], rax
lea r8, [rbp + 0x370]
mov rax, qword [rsi]
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0x40]
mov rax, qword [rsi + 8]
mov r9d, 0x104
xor r14d, r14d
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0x378], r14
mov qword [rbp + 0x380], r9
call fcn.14004260c
mov ecx, dword [rbp + 0x40]
mov r13, qword [rbp + 0x60]
test ecx, ecx
je 0x14004a55d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea esi, [r14 + 0xf]
mov qword [rbp + 0x60], r14
lea edx, [rsi + 0x1d]
mov qword [rbp + 0x70], r14
lea r9, str.Unable_to_convert_application_name_to_UTF_16
mov qword [rbp + 0x78], rsi
mov r8b, r14b
lea rcx, [rbp + 0x60]
call fcn.140004f4c
lea rdx, [rbp + 0x60]
mov rcx, r15
call fcn.14004abbc
mov rdx, qword [rbp + 0x78]
mov r14d, 0x1000
cmp rdx, 0x10
jb 0x14004a553
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a54e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aab2
call fcn.1400690f4
xor eax, eax
mov sil, al
jmp 0x14004a941
mov rdx, qword [rbp + 0xd8]
lea r8, [rsp + 0x50]
mov rax, qword [rbp + 0x628]
lea rcx, [rsp + 0x78]
neg rax
mov word [rsp + 0x50], r14w
xorps xmm0, xmm0
mov qword [rbp - 0x78], r14
sbb ebx, ebx
and ebx, 4
add ebx, 0x400
inc rdx
movdqu xmmword [rsp + 0x78], xmm0
call fcn.1400494bc
cmp qword [rbp + 0xe0], 8
lea rdx, [rbp + 0xc8]
mov rax, qword [rbp + 0xd8]
lea rcx, [rbp + 0xc8]
cmovae rdx, qword [rbp + 0xc8]
cmovae rcx, qword [rbp + 0xc8]
mov r8, qword [rsp + 0x78]
lea rdx, [rdx + rax*2]
call fcn.140004654
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
cmp r13, rdi
lea rcx, [rbp - 0x60]
mov rax, r13
mov qword [rsp + 0x40], rcx
cmove rax, r14
mov rcx, qword [rbp + 0x370]
xor r9d, r9d
mov qword [rsp + 0x38], r14
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x10]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14004a7fa
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call fcn.14000ed40
mov esi, 0xf
mov qword [rbp + 0x60], r14
lea r9, str.Couldnt_execute_program_
mov qword [rbp + 0x70], r14
mov r8b, r14b
mov qword [rbp + 0x78], rsi
lea rcx, [rbp + 0x60]
mov rbx, rax
lea edx, [rsi + 0xb]
call fcn.140004f4c
mov dl, byte [rsp + 0x50]
lea r8, [rbp + 0x60]
mov r9, rbx
lea rcx, [rbp + 0x40]
call fcn.14001e374
lea r8d, [rsi - 0xe]
lea rdx, [0x14015dd4c]
lea rcx, [rbp + 0x40]
call fcn.14000a3e4
lea rdx, [rbp + 0x80]
mov rcx, r15
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
movups xmmword [rbp + 0x80], xmm0
mov qword [rax + 0x18], rsi
movups xmmword [rbp + 0x90], xmm1
mov byte [rax], r14b
call fcn.14004abbc
mov rdx, qword [rbp + 0x98]
mov r14d, 0x1000
cmp rdx, 0x10
jb 0x14004a72f
mov rcx, qword [rbp + 0x80]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a72a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aab8
call fcn.1400690f4
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x14004a766
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a761
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aab8
call fcn.1400690f4
mov rdx, qword [rbp + 0x78]
xor ebx, ebx
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rsi
mov byte [rbp + 0x40], bl
cmp rdx, 0x10
jb 0x14004a7aa
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a7a5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aab8
call fcn.1400690f4
mov rdx, qword [rbp + 0xb8]
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], rsi
mov byte [rbp + 0x60], bl
cmp rdx, 0x10
jb 0x14004a7f2
mov rcx, qword [rbp + 0xa0]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004a7ed
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aab8
call fcn.1400690f4
mov sil, bl
jmp 0x14004a8f7
mov rdx, qword [rbp - 0x68]
mov rbx, r14
mov esi, dword [rbp + 0x618]
mov r14d, 0x1000
mov rcx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov dword [rdx], eax
mov qword [rdx + 8], rcx
test esi, esi
je 0x14004a8b1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, 0xffffffffffffffff
je 0x14004a9ec
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x90
call fcn.1401173d0
mov eax, esi
mov dword [rbp + 0x160], 0x100
shl rax, 0x14
lea r8, [rbp + 0x150]
mov r9d, 0x90
mov qword [rbp + 0x1c0], rax
mov edx, 9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
je 0x14004a9ec
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x14004a9ec
mov rcx, qword [rsp + 0x58]
mov rax, qword [rbp + 0x628]
test rax, rax
je 0x14004a8d4
mov rdx, qword [rax]
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov sil, 1
cmp rbx, 0xffffffffffffffff
je 0x14004a8e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x14004a8f5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14004a941
mov rdx, qword [rbp - 0x78]
mov rax, rcx
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, r14
jb 0x14004a92f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aabe
call fcn.1400690f4
xorps xmm0, xmm0
mov qword [rbp - 0x78], rbx
movdqu xmmword [rsp + 0x78], xmm0
mov rcx, qword [rbp + 0x370]
lea rax, [rbp + 0x388]
cmp rcx, rax
je 0x14004a959
call fcn.14011c590
test r13, r13
je 0x14004a993
sub r12, r13
mov rax, r13
sar r12, 1
add r12, r12
cmp r12, r14
jb 0x14004a988
mov r13, qword [r13 - 8]
add r12, 0x27
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aabe
mov rdx, r12
mov rcx, r13
call fcn.1400690f4
lea rcx, [rbp + 0xc8]
call fcn.14004b740
test byte [rbp + 0x30], 1
jne 0x14004a9ae
lea rcx, [rbp + 0x10]
call fcn.14004b740
mov rcx, qword [rbp + 0xf0]
lea rax, [rbp + 0x108]
cmp rcx, rax
je 0x14004a9c6
call fcn.14011c590
mov al, sil
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.140115e10
add rsp, 0x6a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
lea r9, str.Unable_to_set_memory_limit
mov r8b, al
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x60]
mov qword [rbp + 0x70], rax
lea esi, [rax + 0xf]
lea edx, [rax + 0x1a]
mov qword [rbp + 0x78], rsi
call fcn.140004f4c
lea rdx, [rbp + 0x60]
mov rcx, r15
call fcn.14004abbc
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14004aa60
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x14004aa5b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aa88
call fcn.1400690f4
mov rcx, qword [rsp + 0x58]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov sil, al
jmp 0x14004a8d7
call fcn.14011c518
int3
call fcn.14011c518
int3
call fcn.14011c518
int3
call fcn.14011c518
int3
call fcn.14011c518
int3
call fcn.14011c518
int3
call fcn.14011c518
int3
call fcn.14011c518
int3
call fcn.14011c518
int3
call fcn.14011c518
int3