Function at 0x140131430
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov r12, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx + 8]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.140127590
nop
mov rdx, rax
lea rcx, [r12 + 8]
call fcn.140017ba0
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov r15, 0xffffffffffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401314d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov eax, dword [r12]
add eax, 0xfffffffe
cmp eax, 0x2a
ja case.0x1401314fe.23
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x132748]
mov ecx, dword [rdx + rax*4 + 0x1326f0]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x130], r15d
mov qword [rbp + 0x138], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x150], xmm1
mov byte [rbp + 0x160], 0
mov qword [rbp + 0x168], r14
movdqa xmmword [rbp + 0x170], xmm0
mov dword [rbp + 0x180], r14d
lea rcx, [rbp + 0x130]
call fcn.1401885e0
xor eax, eax
jmp 0x140131685
mov rcx, 0xffffffff80000000
call fcn.140121740
mov dword [rbp + 0xd0], r15d
mov qword [rbp + 0xd8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
mov qword [rbp + 0x108], r14
movdqa xmmword [rbp + 0x110], xmm0
mov dword [rbp + 0x120], r14d
movzx eax, byte [r12 + 0x133]
mov byte [rbp + 0x100], al
call fcn.140163500
cmp dword [rax + 0xb8], 0
je 0x14013163b
mov ecx, 1
call fcn.14011fc20
lea rcx, [rbp + 0xd0]
call fcn.1401885e0
call fcn.140163500
mov rcx, rax
xor edx, edx
call fcn.14016a570
lea rcx, [rsp + 0x40]
call fcn.140022cc0
nop
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, qword [rax]
lea rdx, str.Open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg case.0x1401314fe.20
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor eax, eax
jmp 0x140131685
call fcn.140125240
test eax, eax
jne 0x14013167a
lea ecx, [rax + 1]
call fcn.14011fc20
call fcn.1401285c0
mov dword [rax + 0xc0], 1
lea rcx, [rbp + 0xd0]
call fcn.1401885e0
call fcn.140163500
mov rcx, rax
xor edx, edx
call fcn.14016a570
xor eax, eax
jmp 0x140131685
mov rcx, r12
call fcn.1400d77c0
mov eax, r15d
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1401285c0
mov dword [rax + 0xc8], 1
xor ecx, ecx
call fcn.140120100
xor ecx, ecx
call fcn.14018a910
mov ecx, 1
call fcn.14018a910
xor eax, eax
jmp 0x140131685
call fcn.1401285c0
mov dword [rax + 0xc8], 1
mov rcx, 0xffffffff80000000
call fcn.140121740
mov rcx, 0xffffffff80000002
call fcn.140121740
mov ecx, 1
call fcn.140120100
mov edx, 1
mov r8d, edx
call fcn.14018be20
xor edx, edx
lea r8d, [rdx + 1]
call fcn.14018be20
xor eax, eax
jmp 0x140131685
call fcn.1401285c0
mov dword [rax + 0xc8], 1
call fcn.14018b2a0
xor eax, eax
jmp 0x140131685
call fcn.1401285c0
mov dword [rax + 0xc8], 1
call fcn.14018bac0
xor eax, eax
jmp 0x140131685
lea rcx, str.__rCheckLicValid
call fcn.140021520
call fcn.1401285c0
cmp dword [rax + 4], 0
je case.0x1401314fe.20
call fcn.1400e10f0
mov r9, qword [rax + 0x20]
mov rdx, r14
lea r8, [0x14029c538]
nop
movzx ecx, word [r9 + rdx*2]
inc rdx
cmp cx, word [r8 + rdx*2 - 2]
jne case.0x1401314fe.20
cmp rdx, 4
jne 0x140131790
lea rcx, [rax + 0x10]
mov r8d, edx
lea rdx, [rbp - 0x50]
call fcn.1400290e0
nop
mov rcx, qword [rax]
lea rdx, str.2099
nop word [rax + rax]
movzx ebx, word [rcx + r14*2]
inc r14
movzx eax, word [rdx + r14*2 - 2]
sub ebx, eax
jne 0x1401317e8
cmp r14, 5
jne 0x1401317d0
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013180d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
test ebx, ebx
jne case.0x1401314fe.20
lea rax, [rsp + 0x38]
mov qword [rsp + 0x58], rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401326b9
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rbx, str.SOFTWAREBandizipl
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140018bd0
test al, al
jne 0x14013187c
nop word [rax + rax]
inc r15
cmp word [rbx + r15*2], 0
jne 0x140131860
mov r8d, r15d
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140018f70
nop
lea rdx, [rsp + 0x38]
mov rcx, 0xffffffff80000002
call fcn.140062470
xor eax, eax
jmp 0x140131685
call fcn.1401285c0
mov dword [rax + 0xc8], 1
mov qword [rbp + 0xc0], r14
mov rcx, qword [r12 + 0x60]
sub rcx, 0x18
call fcn.1400191a0
lea rbx, [rax + 0x18]
mov qword [rbp + 0xc0], rbx
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x310]
call fcn.1401f6840
lea rcx, [rbp + 0x310]
call fcn.14005c840
nop
lea rcx, [rbp - 0x30]
call fcn.14005b5e0
nop
lea rdx, str.BandizipAgent
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140131900
lea rcx, [rbp - 0x30]
call fcn.140018f70
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x3a0]
call fcn.140017ba0
mov eax, dword [rbp - 0x28]
mov dword [rbp + 0x3a8], eax
mov eax, dword [rbp - 0x24]
mov dword [rbp + 0x3ac], eax
mov eax, dword [rbp - 0x20]
mov dword [rbp + 0x3b0], eax
mov eax, dword [rbp - 0x1c]
mov dword [rbp + 0x3b4], eax
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x3b8], eax
mov eax, dword [rbp - 0x14]
mov dword [rbp + 0x3bc], eax
mov eax, dword [rbp - 0x10]
mov dword [rbp + 0x3c0], eax
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x3c8]
call fcn.140017ba0
movaps xmm0, xmmword [rbp]
movaps xmmword [rbp + 0x3d0], xmm0
mov eax, dword [rbp + 0x10]
mov dword [rbp + 0x3e0], eax
mov eax, dword [rbp + 0x14]
mov dword [rbp + 0x3e4], eax
mov rdx, rbx
lea rcx, [rbp + 0x310]
call fcn.14005ca60
lea rcx, [rbp + 0x310]
call fcn.14005cf80
nop
lea rcx, [rbp - 0x30]
call fcn.14005b7f0
nop
lea rcx, [rbp + 0x310]
call fcn.14005c970
nop
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbp + 0x3f0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401319f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
lea rcx, [rbp + 0x3a0]
call fcn.14005b7f0
nop
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg case.0x1401314fe.20
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor eax, eax
jmp 0x140131685
mov qword [rbp + 0x70], r14
mov rcx, qword [r12 + 0x60]
sub rcx, 0x18
call fcn.1400191a0
lea rdi, [rax + 0x18]
mov qword [rbp + 0x70], rdi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x88], r14
lea r8, str._event
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x88]
call fcn.1400179d0
nop
mov r9, qword [rbp + 0x88]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov qword [rbp + 0x28], rax
mov rdx, rdi
lea rcx, [rbp + 0x30]
call fcn.1400622b0
test eax, eax
jne 0x140131db2
mov rbx, qword [rbp + 0x50]
shr rbx, 0x20
mov qword [rbp + 0xa8], r14
mov qword [rsp + 0x70], r14
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401326c4
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov esi, 2
mov dword [rsp + 0x30], esi
mov r8d, dword [rbp + 0x50]
lea rcx, [rsp + 0x70]
test ebx, ebx
jne 0x140131b2d
lea rdx, str.0x_x
call fcn.14001c3d0
jmp 0x140131b3d
mov r9d, dword [rbp + 0x54]
lea rdx, str.0x_x__u_
call fcn.14001c3d0
mov rbx, qword [rsp + 0x70]
mov r9, rbx
mov r8, rdi
lea rdx, str._s__err:_s
lea rcx, [rbp + 0xa8]
call fcn.1400283d0
nop
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140131b84
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov qword [rbp + 0xb0], r14
mov qword [rsp + 0x78], r14
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401326cf
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov edi, dword [rsp + 0x30]
or edi, 4
mov dword [rsp + 0x30], edi
mov r9d, dword [rbp + 0x54]
mov r8d, dword [rbp + 0x50]
lea rcx, [rsp + 0x78]
test r9d, r9d
jne 0x140131be2
lea rdx, str.0x_x
call fcn.14001c3d0
jmp 0x140131bee
lea rdx, str.0x_x__u_
call fcn.14001c3d0
mov rbx, qword [rsp + 0x78]
mov r9, rbx
mov r8, qword [rbp + 0x70]
lea rdx, str.error_at_mmf.OpenExisting______s__err:_s
lea rcx, [rbp + 0xb0]
call fcn.1400283d0
nop
and edi, 0xfffffffb
mov dword [rsp + 0x30], edi
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140131c36
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rax
mov rcx, qword [rbp + 0xb0]
add rcx, 0xffffffffffffffe8
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x68]
call fcn.1401ab6b0
lea rax, [rbp - 0x48]
mov qword [rsp + 0x50], rax
lea r9, str.TEXT
mov r8, qword [rbp + 0xa8]
lea rdx, str.TEXT_ERR_AT_CANT_OPEN_MMF
lea rcx, [rbp - 0x48]
call fcn.140044a00
mov rbx, rax
call fcn.1401285c0
lea rcx, [0x1402620b8]
lea r8, [0x1402620c0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call fcn.14005fae0
nop
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140131cdf
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140131d08
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140131d31
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140131d44
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x28], r14
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x140131d84
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140131d60
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x40], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x38], r14
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140131d80
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x48], r14
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140131da8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov eax, 0x66
jmp 0x140131685
mov qword [rbp + 0x80], r14
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401326da
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp + 0x80], rax
mov rbx, qword [rbp + 0x40]
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140018bd0
test al, al
jne 0x140131e2b
test rbx, rbx
jne 0x140131e03
mov r8d, r14d
jmp 0x140131e1b
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140131e10
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140018f70
nop
mov rdx, r12
mov rbx, qword [rbp + 0x80]
mov rcx, rbx
call fcn.1400dbca0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140131e69
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140131e92
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140131ea5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x28], r14
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x140131ee5
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140131ec1
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x40], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x38], r14
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140131ee1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x48], r14
mov rdx, qword [rbp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg case.0x1401314fe.23
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
jmp case.0x1401314fe.23
mov qword [rbp + 0x98], r14
mov rcx, qword [r12 + 0x60]
sub rcx, 0x18
call fcn.1400191a0
lea rbx, [rax + 0x18]
mov qword [rbp + 0x98], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x58], r14
mov byte [rbp + 0x68], al
mov word [rbp + 0x6a], r14w
mov dword [rbp + 0x6c], r14d
mov qword [rbp + 0x58], r14
mov dword [rbp + 0x58], r14d
mov qword [rbp + 0x60], r14
mov rdx, rbx
lea rcx, [rbp + 0x58]
call fcn.14004b2c0
test al, al
jne 0x14013206e
mov qword [rbp + 0xa0], r14
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401326e5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp + 0xa0], rax
mov r8, rbx
lea rdx, str.Error._Cannot_open__ls
lea rcx, [rbp + 0xa0]
call fcn.14001c3d0
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp + 0xa0]
lea rcx, [rbx - 0x18]
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x70], rax
call fcn.1401285c0
lea rcx, [0x1402620b8]
lea r8, [0x1402620c0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
lea rdx, [rbp - 0x70]
xor ecx, ecx
call fcn.14005fae0
nop
mov eax, r15d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140132027
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140132039
call fcn.140203254
mov qword [rbp + 0x60], r14
mov dword [rbp + 0x6c], r14d
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140132064
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov eax, 0x68
jmp 0x140131685
mov qword [rbp + 0x90], r14
lea rbx, [0x140262520]
mov rax, qword [rbp + 0x60]
test rax, rax
cmovne rbx, rax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401326e5
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp + 0x90], rax
mov rdx, rbx
lea rcx, [rbp + 0x90]
call fcn.140018bd0
test al, al
jne 0x1401320eb
test rbx, rbx
jne 0x1401320cd
mov r8d, r14d
jmp 0x1401320db
mov r8, r15
inc r8
cmp word [rbx + r8*2], 0
jne 0x1401320d0
mov rdx, rbx
lea rcx, [rbp + 0x90]
call fcn.140018f70
nop
mov rdx, r12
mov rbx, qword [rbp + 0x90]
mov rcx, rbx
call fcn.1400dbca0
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140132120
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140132132
call fcn.140203254
mov qword [rbp + 0x60], r14
mov dword [rbp + 0x6c], r14d
mov rdx, qword [rbp + 0x98]
jmp 0x140131ee9
mov qword [rbp + 0xb8], r14
mov rcx, qword [r12 + 0x60]
sub rcx, 0x18
call fcn.1400191a0
lea rbx, [rax + 0x18]
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0x78], r14
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1401326ae
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp + 0x78], rax
mov r8, rbx
lea rdx, str._iconpackadmin___s_
lea rcx, [rbp + 0x78]
call fcn.14001c3d0
call fcn.140022780
cmp eax, 7
jl 0x1401321d6
call fcn.14002eed0
test eax, eax
jne 0x1401321d6
lea rcx, [rbp - 0x40]
call fcn.140022cc0
nop
mov qword [rsp + 0x20], r14
mov r9, qword [rbp + 0x78]
mov r8, qword [rax]
xor ecx, ecx
call fcn.14002ef90
nop
mov rdx, qword [rbp - 0x40]
jmp 0x140132208
lea rcx, [rbp - 0x38]
call fcn.140022cc0
nop
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
mov r9, qword [rbp + 0x78]
mov r8, qword [rax]
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013222a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140132250
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg case.0x1401314fe.20
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor eax, eax
jmp 0x140131685
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [r12 + 0x60]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
call fcn.140125c00
xor eax, eax
jmp 0x140131685
call fcn.1401285c0
mov dword [rax + 0xc8], 1
lea rax, [rbp - 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x20], rax
mov rcx, qword [r12 + 0x70]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x60], rax
mov rcx, qword [r12 + 0x68]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rbp - 0x80], rax
mov rcx, qword [r12 + 0x60]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x20], r14
mov rcx, qword [rsp + 0x60]
cmp dword [rcx - 0x10], 0
je 0x14013234e
lea r8, [rbp + 0x20]
lea rdx, [0x14029bd18]
call fcn.14002c650
mov r14, qword [rbp + 0x20]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140132374
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.14012fc30
xor eax, eax
jmp 0x140131685
call fcn.1401285c0
mov dword [rax + 0xc8], 1
call fcn.14012c9e0
jmp 0x140131685
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_help_parameter_
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x140131685
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x190]
call fcn.1401f6840
mov qword [rbp + 0x198], r14
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x1b8], r14
mov qword [rbp + 0x1c0], r14
mov dword [rbp + 0x1c8], r14d
lea rbx, vtable.CPassManDlg.0
mov qword [rbp + 0x190], rbx
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x1e0], r14
mov qword [rbp + 0x1e8], r14
mov qword [rbp + 0x1f0], r14
mov dword [rbp + 0x1f8], r14d
mov dword [rbp + 0x200], r14d
lea rcx, [rbp + 0x208]
call fcn.1400f1680
nop
mov dword [rbp + 0x1d8], r14d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140132c10
nop
mov qword [rbp + 0x190], rbx
lea rcx, [rbp + 0x208]
call fcn.1400f17a0
nop
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x58], rax
mov rbx, qword [rbp + 0x1e0]
test rbx, rbx
je 0x1401324d2
mov rdi, qword [rbp + 0x1e8]
test rdi, rdi
je 0x1401324c9
nop dword [rax]
mov rcx, rbx
call fcn.14003e740
add rbx, 0x10
sub rdi, 1
jne 0x1401324b0
mov rbx, qword [rbp + 0x1e0]
mov rcx, rbx
call fcn.140203254
nop
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rbp + 0x1b8]
test rcx, rcx
je case.0x1401314fe.20
call fcn.1401f3988
xor eax, eax
jmp 0x140131685
call fcn.1401285c0
mov dword [rax + 0xc8], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov rcx, qword [r12 + 0x68]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rcx, qword [r12 + 0x60]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.14012ffb0
jmp 0x140131685
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x190]
call fcn.1401f6840
lea rcx, [rbp + 0x190]
call fcn.140184440
nop
lea rdx, [r12 + 0x60]
lea rcx, [rbp + 0x1d8]
call fcn.140017ba0
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
mov rax, qword [rbp + 0x1b8]
test rax, rax
jne 0x1401325c5
call fcn.1401f38b8
mov qword [rbp + 0x1b8], rax
test rax, rax
jne 0x1401325c5
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140132657
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1401f39e8
lea rax, [rbp + 0x190]
mov qword [rbp + 0x1a0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x1a8], eax
lea rdi, [0x14030fbd8]
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x48], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x48], 1
mov rax, qword [0x14030fc00]
mov qword [rbp + 0x1b0], rax
lea rax, [rbp + 0x1a0]
mov qword [0x14030fc00], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x20], r14
lea r9, [0x140017d90]
mov r8, rbx
mov edx, 0xe4
mov rcx, qword [0x1403043d0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop
lea rcx, [rbp + 0x190]
call fcn.140184710
xor eax, eax
jmp 0x140131685
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov rcx, qword [r12 + 0x60]
sub rcx, 0x18
call fcn.1400191a0
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.140175380
xor eax, eax
jmp 0x140131685
call fcn.140163500
mov rcx, rax
call fcn.1401641c0
jmp 0x140131667
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3