Function at 0x12867fa0
Capabilities:
Get common file path
Resume thread
Set current directory
Terminate process

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x570
mov qword [rsp + 0x288], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov rbp, rcx
mov qword [rsp + 0x138], rcx
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x1f0], rcx
mov r14, qword [rbp + 0x10]
mov r13, qword [rbp + 0x18]
mov qword [rsp + 0xb0], r13
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x170], rax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x160], rax
mov eax, dword [rbp + 0x30]
mov dword [rsp + 0xbc], eax
mov edx, dword [rbp + 0x34]
mov dword [rsp + 0x168], edx
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rbp + 0x40]
mov qword [rsp + 0x130], rcx
mov rbx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0xe8], rax
xor edi, edi
mov r12d, edi
mov dword [rsp + 0x94], edi
mov dword [rsp + 0xa8], edi
mov qword [rsp + 0x1f8], rcx
mov dword [rsp + 0xa4], edx
mov qword [r11 - 0x490], rbx
mov qword [r11 - 0x400], rdi
mov qword [r11 - 0x340], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0x1d8], edi
mov dword [rsp + 0x1dc], 6
lea rdx, [rsp + 0x1d8]
lea ecx, [rdi + 6]
call fcn.12885780
nop
mov dword [rsp + 0x200], edi
xor eax, eax
mov qword [rsp + 0x328], rax
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], rax
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x328]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
xor eax, eax
mov qword [rsp + 0x328], rax
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x328]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov dword [rsp + 0x238], edi
mov dword [rsp + 0xc0], edi
xor eax, eax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc0]
xor r8d, r8d
mov edx, 0x78
mov ecx, edx
call fcn.12886250
lea r8d, [rdi + 1]
test eax, eax
je 0x128681eb
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0xc0]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov dword [rsp + 0x220], 0x78
mov qword [rsp + 0x228], rdi
mov dword [rsp + 0x238], 0x78
mov dword [rsp + 0x200], r8d
test rbx, rbx
je 0x128681f6
mov edi, dword [rbx]
test edi, edi
jne 0x128681fb
mov edi, 0x68
mov esi, edi
mov ecx, edi
call fcn.12958238
mov qword [rsp + 0x1b0], rax
test rax, rax
je 0x12868220
xor ecx, ecx
call fcn.12958250
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x258], rax
test rax, rax
je 0x12868269
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.12959590
test rbx, rbx
je 0x12868257
mov r8, rsi
mov rdx, rbx
mov rbx, qword [rsp + 0x1b0]
mov rcx, rbx
call fcn.12959240
jmp 0x12868261
mov rbx, qword [rsp + 0x1b0]
mov dword [rbx], edi
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x508], 7
xor esi, esi
mov qword [rsp + 0x500], rsi
mov word [rsp + 0x4f0], si
mov dword [rsp + 0x290], 0x68
xor edx, edx
lea r8d, [rsi + 0x60]
lea rcx, [rsp + 0x298]
call fcn.12959590
lea rdx, [rsp + 0x290]
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x108]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x168]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r14
mov rdi, qword [rsp + 0x1f0]
mov rdx, rdi
lea rcx, [rsp + 0x4e8]
call fcn.12850200
mov qword [rsp + 0x148], rdi
mov dword [rsp + 0x180], esi
mov dword [rsp + 0x240], esi
xor eax, eax
mov qword [rsp + 0x248], rax
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x148]
mov r8, r13
mov rdx, r14
mov rcx, rdi
call fcn.12850e90
mov dword [rsp + 0x17c], esi
mov dword [rsp + 0x114], esi
mov dword [rsp + 0x184], esi
mov dword [rsp + 0x18c], esi
mov dword [rsp + 0x110], esi
mov qword [rsp + 0x438], 7
mov qword [rsp + 0x430], rsi
mov word [rsp + 0x420], si
mov qword [rsp + 0x398], 7
mov qword [rsp + 0x390], rsi
mov word [rsp + 0x380], si
mov qword [rsp + 0x3c0], 7
mov qword [rsp + 0x3b8], rsi
mov word [rsp + 0x3a8], si
mov rbx, qword [rsp + 0x130]
mov rdi, rbx
test rbx, rbx
je 0x128683e3
movzx eax, word [rbx]
test ax, ax
je 0x128683e3
cmp ax, 0x2e
jne 0x128684a2
cmp word [rbx + 2], si
jne 0x128684a2
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x128684a2
mov edx, eax
mov rax, qword [rsp + 0x3b8]
cmp rdx, rax
ja 0x12868417
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x3a0]
call fcn.128033a0
jmp 0x1286842a
xor r8d, r8d
sub rdx, rax
lea rcx, [rsp + 0x3a0]
call fcn.12803b90
lea rdx, [rsp + 0x3a8]
cmp qword [rsp + 0x3c0], 8
cmovae rdx, qword [rsp + 0x3a8]
mov ebx, dword [rsp + 0x3b8]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1286849f
cmp eax, ebx
jae 0x1286849a
mov edx, eax
lea rcx, [rsp + 0x3a0]
call fcn.1280d350
lea rdi, [rsp + 0x3a8]
cmp qword [rsp + 0x3c0], 8
cmovae rdi, qword [rsp + 0x3a8]
mov rax, qword [rsp + 0x3b8]
lea rsi, [rdi + rax*2]
mov rbx, qword [rsp + 0x130]
jmp 0x128684a2
mov rbx, rdi
jmp 0x128684a2
mov rbx, rdi
xor eax, eax
mov dword [rsp + 0x80], eax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], eax
mov byte [rsp + 0x68], 1
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 1
lea rax, [rsp + 0x110]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x18c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x184]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x114]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x378]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x418]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x17c]
mov rdx, rsi
mov rcx, rdi
call fcn.12888cb0
mov esi, eax
test eax, eax
je 0x12868557
lea rax, [rsp + 0x380]
cmp qword [rsp + 0x398], 8
cmovae rax, qword [rsp + 0x380]
mov qword [rsp + 0x1f8], rax
cmp dword [0x129ade0c], 0
je 0x1286a10f
xor eax, eax
mov dword [rsp + 0x178], eax
lea rdx, [rsp + 0x178]
lea ecx, [rax + 1]
call fcn.128852e0
test eax, eax
jne 0x128685cc
cmp dword [rsp + 0x178], eax
jne 0x128685cc
mov r15d, 5
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov r9d, r15d
xor r8d, r8d
mov edx, dword [rsp + 0xa8]
lea rcx, str.CreateProcessInternalW__VOS_is_resting_________M_d_ret_d_Err0x_x__App_s__Cmd_s__Wrk_s_
call fcn.12805270
mov rdi, qword [rsp + 0x210]
mov ebx, dword [rsp + 0x208]
jmp 0x1286a436
mov byte [rsp + 0x91], 1
mov byte [rsp + 0x92], 0
xor edx, edx
mov dword [rsp + 0x188], edx
mov byte [rsp + 0x90], dl
mov byte [rsp + 0x93], dl
mov qword [rsp + 0x190], rdx
mov rbp, rdx
mov qword [rsp + 0x1c0], rdx
mov r12, rdx
mov qword [rsp + 0x158], rdx
mov qword [rsp + 0xf0], rdx
mov rbx, rdx
mov qword [rsp + 0xf8], rdx
test r13, r13
je 0x12868645
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
mov qword [rsp + 0x140], rcx
jmp 0x1286864d
mov qword [rsp + 0x140], rdx
test r14, r14
je 0x1286866e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
dec rcx
mov qword [rsp + 0x150], rcx
jmp 0x12868676
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x4e0], 7
mov qword [rsp + 0x4d8], rdx
mov word [rsp + 0x4c8], dx
mov dword [rsp + 0xa0], edx
mov dword [rsp + 0x1c8], edx
mov dword [rsp + 0xb8], edx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x11c], edx
mov dword [rsp + 0x100], edx
mov qword [rsp + 0x1b8], rdx
mov qword [rsp + 0x1d0], rdx
mov qword [rsp + 0x490], 7
mov qword [rsp + 0x488], rdx
mov word [rsp + 0x478], dx
mov qword [rsp + 0x4b8], 7
mov qword [rsp + 0x4b0], rdx
mov word [rsp + 0x4a0], dx
mov dword [rsp + 0x440], edx
lea rax, [rsp + 0x448]
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x468], 7
mov qword [rsp + 0x460], rdx
mov word [rsp + 0x450], dx
lea rdx, [rsp + 0x448]
mov rcx, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.12836d20
nop
test r14, r14
je 0x12868808
cmp word [r14], 0
je 0x12868808
mov dil, 1
mov byte [rsp + 0x91], dil
mov qword [rsp + 0x190], r14
mov rbp, r14
mov qword [rsp + 0x1c0], r14
mov rcx, qword [rsp + 0x150]
lea r12, [r14 + rcx*2]
mov qword [rsp + 0x158], r12
cmp dword [0x12a21878], 0
je 0x128688bb
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x128688bb
xor r8d, r8d
lea rdx, [rsp + 0x4c0]
mov rcx, r14
call fcn.12886e80
mov rdx, qword [rsp + 0x4d8]
test rdx, rdx
je 0x128688bb
lea rbp, [rsp + 0x4c8]
cmp qword [rsp + 0x4e0], 8
cmovae rbp, qword [rsp + 0x4c8]
mov qword [rsp + 0x1c0], rbp
lea r12, [rbp + rdx*2]
mov qword [rsp + 0x158], r12
jmp 0x128688bb
test r13, r13
je 0x128688b8
cmp word [r13], 0
je 0x128688b3
xor dil, dil
mov byte [rsp + 0x91], dil
mov qword [rsp + 0x190], r13
lea r9, [rsp + 0xf8]
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0xf0]
mov rcx, r13
call fcn.1283e080
mov rbp, rax
mov qword [rsp + 0x1c0], rax
cmp word [r13], 0x22
je 0x12868891
cmp rax, r13
je 0x1286886f
cmp word [rax - 2], 0x22
je 0x12868891
mov byte [rsp + 0x92], 0
mov r12, qword [rsp + 0xf0]
mov qword [rsp + 0x158], r12
mov rbx, qword [rsp + 0xf8]
jmp 0x128688bb
mov byte [rsp + 0x92], 1
mov r12, qword [rsp + 0xf0]
mov qword [rsp + 0x158], r12
mov rbx, qword [rsp + 0xf8]
jmp 0x128688bb
mov dil, 1
jmp 0x128688bb
mov dil, 1
xor eax, eax
mov dword [rsp + 0x118], eax
mov dword [rsp + 0x1e8], eax
mov dword [rsp + 0x128], eax
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], eax
mov qword [rsp + 0x3e8], 7
mov qword [rsp + 0x3e0], rax
mov word [rsp + 0x3d0], ax
mov qword [rsp + 0x410], 7
mov qword [rsp + 0x408], rax
mov word [rsp + 0x3f8], ax
mov qword [rsp + 0x530], 7
mov qword [rsp + 0x528], rax
mov word [rsp + 0x518], ax
test rbp, rbp
je 0x12869f76
cmp word [rbp], ax
je 0x12869f5f
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x12868ce8
xor esi, esi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc0], rsi
mov ecx, 0x2012
call fcn.12958238
mov rdi, rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x128689a7
mov word [rax], si
add rax, 0x10
mov qword [rdi + 8], rax
mov eax, 0x2002
mov word [rdi + 2], ax
movzx ecx, word [rdi]
shr rcx, 1
mov rax, qword [rdi + 8]
mov word [rax + rcx*2], si
xor ecx, ecx
call fcn.1295c768
test rdi, rdi
je 0x128689c6
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x128689c6
movzx eax, word [rdi]
shr rax, 1
mov word [rcx + rax*2], si
mov edx, 0x7e
mov rcx, rbp
call fcn.1295be3c
test rax, rax
je 0x128689ea
cmp rax, r12
jae 0x128689ea
mov dword [rsp + 0x128], 1
jmp 0x128689f1
mov dword [rsp + 0x128], esi
mov r8, r12
sub r8, rbp
sar r8, 1
xor r9d, r9d
mov rdx, rbp
lea rcx, [rsp + 0xc0]
call fcn.128252a0
mov rdi, qword [rsp + 0xc0]
mov rcx, qword [rdi + 8]
call fcn.1283df90
sub eax, dword [rdi + 8]
sar rax, 1
add ax, ax
mov word [rdi], ax
mov rdi, qword [rdi + 8]
test rdi, rdi
je 0x12868a3b
movzx ecx, ax
shr rcx, 1
jmp 0x12868a3e
mov rcx, rsi
movzx eax, cx
lea rdx, [rdi + rax*2]
mov dword [rsp + 0x80], esi
mov qword [rsp + 0x78], rsi
mov ebp, 1
mov dword [rsp + 0x70], ebp
mov byte [rsp + 0x68], bpl
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov rcx, rdi
call fcn.12888cb0
test rbx, rbx
je 0x12868c75
mov qword [rsp + 0x320], 7
mov qword [rsp + 0x318], rsi
mov word [rsp + 0x308], si
mov rdx, qword [rsp + 0x408]
mov rax, qword [rsp + 0x3e0]
cmp rdx, rax
cmovb rdx, rax
add rdx, 0x10
mov rdi, qword [rsp + 0x318]
cmp rdi, rdx
ja 0x12868b50
cmp qword [rsp + 0x320], rdx
je 0x12868b50
movzx r8d, bpl
lea rcx, [rsp + 0x300]
call fcn.128037d0
test al, al
je 0x12868b50
mov qword [rsp + 0x318], rdi
lea rax, [rsp + 0x308]
cmp qword [rsp + 0x320], 8
cmovae rax, qword [rsp + 0x308]
mov word [rax + rdi*2], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x300]
call fcn.12803c90
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x300]
call fcn.12803a10
mov dword [rsp + 0x98], esi
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x300]
call fcn.12864090
test eax, eax
je 0x12868bba
cmp eax, 0xc0000010
je 0x12868bba
mov eax, esi
jmp 0x12868bbc
mov eax, ebp
test eax, eax
setne byte [rsp + 0x90]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x300]
call fcn.12803c90
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x300]
call fcn.12803a10
mov dword [rsp + 0x98], esi
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x300]
call fcn.12864090
test eax, eax
je 0x12868c30
cmp eax, 0xc0000010
je 0x12868c30
mov eax, esi
jmp 0x12868c32
mov eax, ebp
test eax, eax
setne byte [rsp + 0x93]
cmp qword [rsp + 0x320], 8
jb 0x12868c54
mov rcx, qword [rsp + 0x308]
call fcn.12958250
mov qword [rsp + 0x320], 7
mov qword [rsp + 0x318], rsi
mov word [rsp + 0x308], si
jmp 0x1286918e
mov dword [rsp + 0x98], esi
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x3f0]
call fcn.12864090
test eax, eax
je 0x12868ca0
cmp eax, 0xc0000010
je 0x12868ca0
mov eax, esi
jmp 0x12868ca2
mov eax, ebp
test eax, eax
setne byte [rsp + 0x90]
mov dword [rsp + 0x98], esi
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x3c8]
call fcn.12864090
test eax, eax
je 0x12868cd7
cmp eax, 0xc0000010
je 0x12868cd7
mov eax, esi
jmp 0x12868cd9
mov eax, ebp
test eax, eax
setne byte [rsp + 0x93]
jmp 0x1286918e
cmp dword [0x12a21878], 0
je 0x12869184
test dil, dil
je 0x12869188
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x1286918c
lea rdx, [rsp + 0x3a8]
cmp qword [rsp + 0x3c0], 8
cmovae rdx, qword [rsp + 0x3a8]
lea rcx, [rsp + 0x450]
cmp qword [rsp + 0x468], 8
cmovae rcx, qword [rsp + 0x450]
call fcn.1295a6e4
test eax, eax
je 0x12868e88
mov r8, qword [rsp + 0x460]
test r8, r8
je 0x12869180
lea rdx, [rsp + 0x450]
mov rcx, qword [rsp + 0x450]
mov rax, qword [rsp + 0x468]
cmp rax, 8
cmovae rdx, rcx
lea rdi, [rsp + 0x450]
cmp rax, 8
cmovae rdi, rcx
lea rdx, [rdx + r8*2]
xor esi, esi
mov dword [rsp + 0x80], esi
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x70], esi
mov byte [rsp + 0x68], 1
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov ebp, 1
mov dword [rsp + 0x50], ebp
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x11c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x498]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x470]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x1c8]
mov rcx, rdi
call fcn.12888cb0
test eax, eax
je 0x1286918e
lea rcx, [rsp + 0x4a0]
cmp qword [rsp + 0x4b8], 8
cmovae rcx, qword [rsp + 0x4a0]
mov qword [rsp + 0x1d0], rcx
lea rdx, [rsp + 0x478]
cmp qword [rsp + 0x490], 8
cmovae rdx, qword [rsp + 0x478]
mov qword [rsp + 0x1b8], rdx
mov r8, qword [rsp + 0x4b0]
mov r13, qword [rsp + 0x488]
mov dword [rsp + 0xa0], ebp
jmp 0x12868f29
test esi, esi
je 0x1286917c
lea rcx, [rsp + 0x380]
cmp qword [rsp + 0x398], 8
cmovae rcx, qword [rsp + 0x380]
mov qword [rsp + 0x1d0], rcx
lea rax, [rsp + 0x420]
cmp qword [rsp + 0x438], 8
cmovae rax, qword [rsp + 0x420]
mov qword [rsp + 0x1b8], rax
mov eax, dword [rsp + 0x184]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x114]
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x100], eax
mov eax, dword [rsp + 0x18c]
mov dword [rsp + 0x11c], eax
mov r8, qword [rsp + 0x390]
mov r13, qword [rsp + 0x430]
mov dword [rsp + 0xa0], 1
xor esi, esi
mov qword [rsp + 0x320], 7
mov qword [rsp + 0x318], rsi
mov word [rsp + 0x308], si
mov ebx, 0x5c
lea rsi, [0x129bcb5c]
cmp dword [rsp + 0x120], 0
je 0x12869048
mov rdx, rcx
lea rcx, [rsp + 0x300]
call fcn.12803dc0
test r14, r14
je 0x1286902a
cmp word [r14], 0
je 0x1286902a
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r12, [r14 + rcx*2 - 2]
mov rbp, r14
cmp r14, r12
je 0x1286902a
mov rax, qword [rsp + 0x318]
test rax, rax
je 0x12868fde
lea rdi, [rax - 1]
cmp rax, rdi
ja 0x12868fbe
call fcn.129581ac
lea rax, [rsp + 0x308]
cmp qword [rsp + 0x320], 8
cmovae rax, qword [rsp + 0x308]
cmp word [rax + rdi*2], bx
je 0x12868ff3
mov r8d, ebx
mov edx, 1
lea rcx, [rsp + 0x300]
call fcn.12803b90
mov rcx, rsi
movzx edx, word [r14]
mov eax, ebx
nop dword [rax]
cmp dx, ax
je 0x12869013
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x12869000
jmp 0x12869017
lea rbp, [r14 + 2]
mov r8, r12
mov rdx, rbp
lea rcx, [rsp + 0x300]
call fcn.1281aed0
xor eax, eax
mov dword [rsp + 0x98], eax
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x300]
call fcn.12864090
cmp dword [rsp + 0xb8], 0
je 0x1286913c
mov r8, r13
mov rdx, qword [rsp + 0x1b8]
lea rcx, [rsp + 0x300]
call fcn.12803dc0
test r14, r14
je 0x1286911c
cmp word [r14], 0
je 0x1286911c
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r12, [r14 + rcx*2 - 2]
mov rbp, r14
cmp r14, r12
je 0x1286911c
mov rax, qword [rsp + 0x318]
test rax, rax
je 0x128690d9
lea rdi, [rax - 1]
cmp rax, rdi
ja 0x128690b9
call fcn.129581ac
lea rax, [rsp + 0x308]
cmp qword [rsp + 0x320], 8
cmovae rax, qword [rsp + 0x308]
cmp word [rax + rdi*2], bx
je 0x128690ee
mov r8d, ebx
mov edx, 1
lea rcx, [rsp + 0x300]
call fcn.12803b90
movzx eax, word [r14]
cmp ax, bx
je 0x12869105
add rsi, 2
mov bx, word [rsi]
test bx, bx
jne 0x128690f2
jmp 0x12869109
lea rbp, [r14 + 2]
mov r8, r12
mov rdx, rbp
lea rcx, [rsp + 0x300]
call fcn.1281aed0
xor esi, esi
mov dword [rsp + 0x98], esi
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x300]
call fcn.12864090
jmp 0x1286913e
xor esi, esi
cmp qword [rsp + 0x320], 8
jb 0x12869156
mov rcx, qword [rsp + 0x308]
call fcn.12958250
mov qword [rsp + 0x320], 7
mov qword [rsp + 0x318], rsi
mov word [rsp + 0x308], si
mov r13, qword [rsp + 0xb0]
jmp 0x1286918e
xor esi, esi
jmp 0x1286918e
xor esi, esi
jmp 0x1286918e
xor esi, esi
jmp 0x1286918e
xor esi, esi
jmp 0x1286918e
xor esi, esi
mov eax, dword [rsp + 0xa8]
cmp eax, 2
jae 0x128691a8
cmp dword [rsp + 0xa0], 0
je 0x12869f8d
mov rbp, rsi
xor edx, edx
mov r12, rdx
mov rdi, rdx
mov qword [rsp + 0xf8], rdx
mov r13, rdx
mov qword [rsp + 0xf0], rdx
mov qword [rsp + 0xe0], rdx
mov rcx, qword [rsp + 0x130]
mov r15, rcx
mov qword [rsp + 0x98], rcx
test rcx, rcx
je 0x12869233
cmp word [rcx], dx
je 0x12869233
cmp dword [rsp + 0x17c], 2
jb 0x1286925f
lea r15, [rsp + 0x380]
cmp qword [rsp + 0x398], 8
cmovae r15, qword [rsp + 0x380]
lea rcx, [rsp + 0x420]
cmp qword [rsp + 0x438], 8
cmovae rcx, qword [rsp + 0x420]
mov qword [rsp + 0x98], rcx
jmp 0x1286925f
cmp qword [rsp + 0x390], rdx
je 0x1286925f
lea r15, [rsp + 0x380]
cmp qword [rsp + 0x398], 8
cmovae r15, qword [rsp + 0x380]
mov qword [rsp + 0x98], r15
cmp eax, 2
jb 0x128692a0
movzx ebx, byte [rsp + 0x91]
test bl, bl
jne 0x128692a7
cmp byte [rsp + 0x92], dl
jne 0x128692a7
cmp dword [rsp + 0x128], edx
je 0x128692a7
lea rcx, [rsp + 0x3c8]
call fcn.1285f2a0
lea rcx, [rsp + 0x3f0]
call fcn.1285f2a0
xor edx, edx
jmp 0x128692a7
mov bl, byte [rsp + 0x91]
mov qword [rsp + 0x1a8], rdx
mov qword [rsp + 0x1e0], rdx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x370], 7
mov qword [rsp + 0x368], rdx
mov word [rsp + 0x358], dx
mov qword [rsp + 0x348], 7
mov qword [rsp + 0x340], rdx
mov word [rsp + 0x330], dx
mov qword [rsp + 0x558], 7
mov qword [rsp + 0x550], rdx
mov word [rsp + 0x540], dx
cmp dword [rsp + 0xa8], 2
jb 0x128697d4
test bl, bl
je 0x1286959d
lea rbp, [rsp + 0x3f8]
cmp qword [rsp + 0x410], 8
cmovae rbp, qword [rsp + 0x3f8]
lea rcx, [rsp + 0x3d0]
cmp qword [rsp + 0x3e8], 8
cmovae rcx, qword [rsp + 0x3d0]
mov qword [rsp + 0xf8], rcx
mov r12, qword [rsp + 0x408]
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xe0], rax
mov rdi, rax
mov rax, qword [rsp + 0xb0]
mov r13, rax
mov rsi, rax
test rax, rax
je 0x12869798
mov rdx, r14
mov rcx, rax
call fcn.1295bec0
mov rbx, rax
test rax, rax
je 0x12869798
mov rcx, qword [rsp + 0x150]
lea rsi, [rax + rcx*2]
mov rax, qword [rsp + 0x3e0]
sub rax, rcx
mov rcx, rdi
lea rdx, [rax + rcx + 2]
mov rdi, qword [rsp + 0x368]
cmp rdi, rdx
ja 0x12869430
cmp qword [rsp + 0x370], rdx
je 0x12869430
mov r8b, 1
lea rcx, [rsp + 0x350]
call fcn.128037d0
test al, al
je 0x12869430
mov qword [rsp + 0x368], rdi
lea rax, [rsp + 0x358]
cmp qword [rsp + 0x370], 8
cmovae rax, qword [rsp + 0x358]
xor ecx, ecx
mov word [rax + rdi*2], cx
mov r8, rbx
mov rdx, r13
lea rcx, [rsp + 0x350]
call fcn.1281aff0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x350]
call fcn.128038c0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x350]
call fcn.12803a10
lea r13, [rsp + 0x358]
cmp qword [rsp + 0x370], 8
cmovae r13, qword [rsp + 0x358]
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x408]
mov rcx, qword [rsp + 0x150]
sub rax, rcx
mov rcx, qword [rsp + 0x140]
lea rdx, [rax + rcx + 2]
mov rdi, qword [rsp + 0x340]
cmp rdi, rdx
ja 0x1286951f
cmp qword [rsp + 0x348], rdx
je 0x1286951f
mov r8b, 1
lea rcx, [rsp + 0x328]
call fcn.128037d0
test al, al
je 0x1286951f
mov qword [rsp + 0x340], rdi
lea rax, [rsp + 0x330]
cmp qword [rsp + 0x348], 8
cmovae rax, qword [rsp + 0x330]
xor ecx, ecx
mov word [rax + rdi*2], cx
mov r8, rbx
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x328]
call fcn.1281aff0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x328]
call fcn.128038c0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x328]
call fcn.12803a10
lea rsi, [rsp + 0x330]
cmp qword [rsp + 0x348], 8
cmovae rsi, qword [rsp + 0x330]
mov rdi, qword [rsp + 0x340]
jmp 0x12869798
mov rbp, qword [rsp + 0x158]
mov rbx, rbp
mov rsi, qword [rsp + 0x1c0]
sub rbx, rsi
sar rbx, 1
mov rax, qword [rsp + 0x3e0]
sub rax, rbx
mov r12, qword [rsp + 0x140]
lea rdx, [rax + r12 + 2]
mov rdi, qword [rsp + 0x368]
cmp rdi, rdx
ja 0x12869621
cmp qword [rsp + 0x370], rdx
je 0x12869621
mov r8b, 1
lea rcx, [rsp + 0x350]
call fcn.128037d0
test al, al
je 0x12869621
mov qword [rsp + 0x368], rdi
lea rax, [rsp + 0x358]
cmp qword [rsp + 0x370], 8
cmovae rax, qword [rsp + 0x358]
xor ecx, ecx
mov word [rax + rdi*2], cx
mov r8, rsi
mov rdx, qword [rsp + 0x190]
lea rcx, [rsp + 0x350]
call fcn.1281aff0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x350]
call fcn.128038c0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x350]
call fcn.12803a10
mov qword [rsp + 0xf8], r14
lea r13, [rsp + 0x358]
cmp qword [rsp + 0x370], 8
cmovae r13, qword [rsp + 0x358]
xor eax, eax
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x408]
sub rax, rbx
lea rdx, [rax + r12 + 2]
mov rdi, qword [rsp + 0x340]
cmp rdi, rdx
ja 0x12869717
cmp qword [rsp + 0x348], rdx
je 0x12869717
mov r8b, 1
lea rcx, [rsp + 0x328]
call fcn.128037d0
test al, al
je 0x12869717
mov qword [rsp + 0x340], rdi
lea rax, [rsp + 0x330]
cmp qword [rsp + 0x348], 8
cmovae rax, qword [rsp + 0x330]
xor ecx, ecx
mov word [rax + rdi*2], cx
mov r8, rsi
mov rdx, qword [rsp + 0x190]
lea rcx, [rsp + 0x328]
call fcn.1281aff0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x3f0]
lea rcx, [rsp + 0x328]
call fcn.128038c0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x328]
call fcn.12803a10
mov rbp, r14
lea rsi, [rsp + 0x330]
cmp qword [rsp + 0x348], 8
cmovae rsi, qword [rsp + 0x330]
xor eax, eax
mov r12, rax
mov rdi, qword [rsp + 0x340]
cmp dword [rsp + 0xa8], 3
jne 0x1286981f
cmp byte [rsp + 0x90], 0
jne 0x12869833
cmp byte [rsp + 0x93], 0
jne 0x12869829
cmp dword [rsp + 0x188], 0
setne byte [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
jmp 0x12869845
cmp dword [rsp + 0xa0], 0
je 0x1286983d
mov qword [rsp + 0xf8], r14
mov rbp, r14
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0xf0], rax
mov r12, rax
mov rbx, qword [rsp + 0xb0]
mov r13, rbx
mov rsi, rbx
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xe0], rax
mov rdi, rax
jmp 0x12869845
mov rbx, qword [rsp + 0xb0]
jmp 0x12869845
mov rbx, qword [rsp + 0xb0]
jmp 0x12869845
mov rbx, qword [rsp + 0xb0]
jmp 0x12869845
mov rbx, qword [rsp + 0xb0]
cmp dword [rsp + 0x110], 0
je 0x1286986e
test dword [rsp + 0x114], 0xd01301bf
mov rax, qword [rsp + 0x98]
cmove rax, r15
mov qword [rsp + 0x98], rax
mov ecx, dword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x308], rax
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x320], rax
cmp byte [rsp + 0x90], al
jne 0x128698f8
mov eax, dword [rsp + 0x118]
test eax, 0xd01301bf
je 0x128698f8
mov ecx, dword [rsp + 0xa0]
test ecx, ecx
je 0x128698eb
cmp dword [rsp + 0x100], 0
jne 0x128698f8
test dword [rsp + 0xb8], 0xd01301bf
je 0x128698f8
mov r12, qword [rsp + 0x138]
jmp 0x12869b33
mov r12, qword [rsp + 0x138]
jmp 0x12869b33
mov qword [rsp + 0x1a8], rbp
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x128], r15
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
mov r9, r14
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xa4]
mov rcx, rax
call fcn.12867030
cmp dword [0x129abb88], 0
je 0x128699a3
cmp rbp, r14
je 0x12869977
mov qword [rsp + 0x300], rbp
mov qword [rsp + 0x308], r12
jmp 0x1286998c
cmp rsi, rbx
je 0x1286998c
mov qword [rsp + 0x300], rsi
mov qword [rsp + 0x308], rdi
xor r9d, r9d
lea r8, [rsp + 0x300]
lea edx, [r9 + 0x70]
lea ecx, [rdx - 0x20]
call fcn.128868c0
cmp dword [rsp + 0xa0], 0
je 0x128699d3
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [rsp + 0x440]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [rsp + 0x440], ecx
mov edi, dword [rsp + 0xa4]
or edi, 4
mov r12, qword [rsp + 0x138]
mov rax, qword [r12]
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r15
mov rbx, qword [rsp + 0xd8]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], edi
mov edx, dword [rsp + 0xbc]
mov dword [rsp + 0x30], edx
mov rdx, qword [rsp + 0x160]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x170]
mov qword [rsp + 0x20], rdx
mov r9, rsi
mov r8, rbp
mov rdx, qword [rsp + 0x148]
mov rcx, r12
call qword [rax + 8]
mov dword [rsp + 0x94], eax
test eax, eax
jne 0x12869e3b
cmp dword [0x129abb88], eax
je 0x12869b1d
cmp qword [rsp + 0x310], 0
je 0x12869b1d
cmp dword [rsp + 0x320], 2
je 0x12869b1d
test dword [rsp + 0x31c], 0xd01301bf
je 0x12869b1d
xor r9d, r9d
lea r8, [rsp + 0x300]
lea edx, [rax + 0x70]
lea ecx, [rax + 0x60]
call fcn.128868c0
mov rax, qword [r12]
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], edi
mov ecx, dword [rsp + 0xbc]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x20], rcx
mov r9, rsi
mov r8, rbp
mov rdx, qword [rsp + 0x148]
mov rcx, r12
call qword [rax + 8]
mov dword [rsp + 0x94], eax
test eax, eax
jne 0x12869e31
mov eax, dword [rsp + 0x118]
mov ecx, dword [rsp + 0xa0]
test eax, 0xd01301bf
jne 0x12869b6e
test dword [rsp + 0x31c], 0xd01301bf
jne 0x12869b6e
test ecx, ecx
je 0x12869e27
cmp dword [rsp + 0x11c], 0
je 0x12869e1d
test dword [rsp + 0xb8], 0xd01301bf
je 0x12869e13
mov rsi, qword [rsp + 0xf8]
mov qword [rsp + 0x1a8], rsi
mov qword [rsp + 0x1e0], r13
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x128], rbp
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r13
mov rdi, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
mov r9, r14
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xa4]
mov rcx, rax
call fcn.12867030
cmp dword [0x129abb88], 0
je 0x12869ca5
xor eax, eax
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], rax
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x260]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rdx + 0x18], rax
mov rax, qword [rcx + 0x20]
mov qword [rdx + 0x20], rax
cmp rsi, r14
je 0x12869c71
mov qword [rsp + 0x300], rsi
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x308], rax
jmp 0x12869c8e
cmp r13, rdi
je 0x12869c8e
mov qword [rsp + 0x300], r13
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x308], rax
xor r9d, r9d
lea r8, [rsp + 0x300]
lea edx, [r9 + 0x70]
lea ecx, [rdx - 0x10]
call fcn.128868c0
cmp dword [rsp + 0xa0], 0
je 0x12869cd5
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [rsp + 0x440]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [rsp + 0x440], ecx
mov edi, dword [rsp + 0xa4]
or edi, 4
mov rax, qword [r12]
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbp
mov rbx, qword [rsp + 0xd8]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], edi
mov ecx, dword [rsp + 0xbc]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x20], rcx
mov r9, r13
mov r8, rsi
mov r15, qword [rsp + 0x148]
mov rdx, r15
mov rcx, r12
call qword [rax + 8]
mov r12d, eax
test eax, eax
jne 0x12869e3e
cmp dword [0x129abb88], eax
je 0x12869e3e
cmp qword [rsp + 0x310], 0
je 0x12869e3e
cmp dword [rsp + 0x320], 1
je 0x12869e3e
test dword [rsp + 0x318], 0xd01301bf
je 0x12869e3e
xor r9d, r9d
lea r8, [rsp + 0x300]
lea edx, [rax + 0x70]
lea ecx, [rax + 0x50]
call fcn.128868c0
mov rcx, qword [rsp + 0x138]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rdx
mov rdx, qword [rsp + 0x108]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], edi
mov edx, dword [rsp + 0xbc]
mov dword [rsp + 0x30], edx
mov rdx, qword [rsp + 0x160]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x170]
mov qword [rsp + 0x20], rdx
mov r9, r13
mov r8, rsi
mov rdx, r15
call qword [rax + 8]
mov r12d, eax
jmp 0x12869e3e
mov r12d, dword [rsp + 0x94]
jmp 0x12869e3e
mov r12d, dword [rsp + 0x94]
jmp 0x12869e3e
mov r12d, dword [rsp + 0x94]
jmp 0x12869e3e
mov r12d, dword [rsp + 0x94]
jmp 0x12869e3e
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov edi, 1
mov rbx, qword [rsp + 0xe8]
mov eax, dword [rbx + 0x10]
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x58], rcx
mov r13, qword [rsp + 0xb0]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r14
mov rcx, qword [rsp + 0x128]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x1e0]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x1a8]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9d, r15d
mov r8d, r12d
mov edx, dword [rsp + 0xa8]
lea rcx, str.CreateProcessInternalW_M_d_ret_d_Err0x_x_PID_u_0x_x__App_s_Cmd_s_CurDir_s___App_s__Cmd_s__Wrk_s_
call fcn.12805270
nop
cmp qword [rsp + 0x558], 8
jb 0x12869ed7
mov rcx, qword [rsp + 0x540]
call fcn.12958250
mov qword [rsp + 0x558], 7
xor esi, esi
mov qword [rsp + 0x550], rsi
mov word [rsp + 0x540], si
cmp qword [rsp + 0x348], 8
jb 0x12869f0d
mov rcx, qword [rsp + 0x330]
call fcn.12958250
mov qword [rsp + 0x348], 7
mov qword [rsp + 0x340], rsi
mov word [rsp + 0x330], si
cmp qword [rsp + 0x370], 8
jb 0x12869f41
mov rcx, qword [rsp + 0x358]
call fcn.12958250
mov qword [rsp + 0x370], 7
mov qword [rsp + 0x368], rsi
mov word [rsp + 0x358], si
jmp 0x12869fa2
mov r12d, dword [rsp + 0x94]
mov edi, r12d
mov rbx, qword [rsp + 0xe8]
xor esi, esi
jmp 0x12869fa2
mov r12d, dword [rsp + 0x94]
mov edi, r12d
mov rbx, qword [rsp + 0xe8]
xor esi, esi
jmp 0x12869fa2
mov r12d, dword [rsp + 0x94]
mov edi, r12d
mov rbx, qword [rsp + 0xe8]
xor esi, esi
cmp qword [rsp + 0x530], 8
jb 0x12869fba
mov rcx, qword [rsp + 0x518]
call fcn.12958250
mov qword [rsp + 0x530], 7
mov qword [rsp + 0x528], rsi
mov word [rsp + 0x518], si
cmp qword [rsp + 0x410], 8
jb 0x12869fee
mov rcx, qword [rsp + 0x3f8]
call fcn.12958250
mov qword [rsp + 0x410], 7
mov qword [rsp + 0x408], rsi
mov word [rsp + 0x3f8], si
cmp qword [rsp + 0x3e8], 8
jb 0x1286a022
mov rcx, qword [rsp + 0x3d0]
call fcn.12958250
mov qword [rsp + 0x3e8], 7
mov qword [rsp + 0x3e0], rsi
mov word [rsp + 0x3d0], si
mov rcx, qword [rsp + 0xc0]
call fcn.1295c768
mov qword [rsp + 0xc0], rsi
lea rcx, [rsp + 0x440]
call fcn.128300e0
nop
cmp qword [rsp + 0x4b8], 8
jb 0x1286a079
mov rcx, qword [rsp + 0x4a0]
call fcn.12958250
mov qword [rsp + 0x4b8], 7
mov qword [rsp + 0x4b0], rsi
mov word [rsp + 0x4a0], si
cmp qword [rsp + 0x490], 8
jb 0x1286a0ad
mov rcx, qword [rsp + 0x478]
call fcn.12958250
mov qword [rsp + 0x490], 7
mov qword [rsp + 0x488], rsi
mov word [rsp + 0x478], si
cmp qword [rsp + 0x4e0], 8
jb 0x1286a0e1
mov rcx, qword [rsp + 0x4c8]
call fcn.12958250
mov qword [rsp + 0x4e0], 7
mov qword [rsp + 0x4d8], rsi
mov word [rsp + 0x4c8], si
test edi, edi
jne 0x1286a235
mov rbp, qword [rsp + 0x138]
jmp 0x1286a111
xor esi, esi
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9, r14
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xa4]
mov rcx, rax
call fcn.12867030
cmp dword [0x129abb88], 0
je 0x1286a17c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x30
mov ecx, edx
call fcn.128868c0
mov rdi, qword [rbp]
mov ecx, dword [rsp + 0xa4]
or ecx, 4
mov rbx, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rbx
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x50], rax
mov rsi, qword [rsp + 0x1f8]
mov qword [rsp + 0x48], rsi
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ecx
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x20], rax
mov r9, r13
mov r8, r14
mov rdx, qword [rsp + 0x148]
mov rcx, rbp
call qword [rdi + 8]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov r9d, dword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r9d
mov r8d, eax
mov edx, r12d
lea rcx, str.CreateProcessInternalW_ret_d_Err0x_x_PID_u_0x_x__App_s_Cmd_s_Wrk_s
call fcn.12805270
xor esi, esi
jmp 0x1286a23d
mov rbp, qword [rsp + 0x138]
test r12d, r12d
je 0x1286a402
mov qword [rsp + 0xc0], rsi
xor eax, eax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x328], rsi
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], rax
lea r8, [rsp + 0x328]
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.1281f300
mov r8, qword [rsp + 0xc0]
mov rdx, r13
mov rcx, r14
call fcn.12836350
mov edi, eax
cmp dword [0x129adcc4], 6
jl 0x1286a2dc
mov r8d, dword [rsp + 0xd0]
mov rdx, r13
mov rcx, r14
call fcn.12836260
test eax, eax
jne 0x1286a2dc
xor r9d, r9d
xor r8d, r8d
mov edx, edi
lea rcx, [rsp + 0xc0]
call fcn.1284b3f0
jmp 0x1286a303
lea rcx, str.KIVHIP__
call fcn.12805270
mov r8, qword [rsp + 0xc8]
mov edx, dword [rsp + 0xd4]
mov ecx, dword [rsp + 0xd0]
call fcn.1284b110
test eax, eax
jne 0x1286a34c
or edx, 0xffffffff
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0xd0]
lea rcx, str._E__CP._in.failed__kill_created_process__u__
call fcn.12805270
mov r12d, esi
jmp 0x1286a364
test byte [rsp + 0x168], 4
jne 0x1286a364
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x328]
test rcx, rcx
je 0x1286a384
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rsi
mov qword [rsp + 0xc0], rdx
jmp 0x1286a38c
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x330]
test rcx, rcx
je 0x1286a3ac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rdx, qword [rsp + 0xc0]
jmp 0x1286a3b4
mov rcx, qword [rsp + 0xc8]
test r12d, r12d
je 0x1286a413
cmp dword [rsp + 0x180], 0
je 0x1286a3de
mov dword [rsp + 0x240], 3
mov qword [rsp + 0x248], rcx
mov qword [rsp + 0x250], rdx
mov ebx, dword [rsp + 0x208]
bt ebx, 0xe
jae 0x1286a424
test rdx, rdx
je 0x1286a42e
mov rdi, qword [rsp + 0x210]
test rdi, rdi
je 0x1286a436
mov qword [rdi], rdx
jmp 0x1286a436
mov rdi, qword [rsp + 0x210]
mov ebx, dword [rsp + 0x208]
jmp 0x1286a436
mov rdi, qword [rsp + 0x210]
mov ebx, dword [rsp + 0x208]
jmp 0x1286a436
mov rdi, qword [rsp + 0x210]
jmp 0x1286a436
mov rdi, qword [rsp + 0x210]
mov rax, qword [rsp + 0x148]
test rax, rax
je 0x1286a459
mov rcx, qword [rsp + 0x1f0]
cmp rcx, rax
je 0x1286a459
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.12885900
test r12d, r12d
jne 0x1286a479
mov eax, 0x646
test r15d, r15d
cmove r15d, eax
mov dword [rbp + 0x58], r15d
cmp qword [rsp + 0x3c0], 8
jb 0x1286a495
mov rcx, qword [rsp + 0x3a8]
call fcn.12958250
mov qword [rsp + 0x3c0], 7
xor esi, esi
mov qword [rsp + 0x3b8], rsi
mov word [rsp + 0x3a8], si
cmp qword [rsp + 0x398], 8
jb 0x1286a4cb
mov rcx, qword [rsp + 0x380]
call fcn.12958250
mov qword [rsp + 0x398], 7
mov qword [rsp + 0x390], rsi
mov word [rsp + 0x380], si
cmp qword [rsp + 0x438], 8
jb 0x1286a4ff
mov rcx, qword [rsp + 0x420]
call fcn.12958250
mov qword [rsp + 0x438], 7
mov qword [rsp + 0x430], rsi
mov word [rsp + 0x420], si
cmp qword [rsp + 0x508], 8
jb 0x1286a533
mov rcx, qword [rsp + 0x4f0]
call fcn.12958250
mov qword [rsp + 0x508], 7
mov qword [rsp + 0x500], rsi
mov word [rsp + 0x4f0], si
cmp dword [rsp + 0x200], 0
je 0x1286a574
xor r9d, r9d
mov r8, rdi
mov edx, dword [rsp + 0x238]
mov ecx, ebx
call fcn.128868c0
mov dword [rsp + 0x200], esi
mov ecx, dword [rsp + 0x1d8]
call fcn.12885700
nop
mov rcx, qword [rsp + 0x1b0]
call fcn.12958250
nop
mov rcx, qword [rsp + 0x198]
call fcn.12958250
mov eax, r12d
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.12959850
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret