Function at 0x1400033a0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Execute command
Get session user name

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x730
movaps xmmword [r11 - 0x28], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x710], rax
xor esi, esi
mov dword [rsp + 0x1d0], 0x101
lea rdx, [r11 - 0x578]
lea rcx, [r11 - 0x258]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d8], xmm0
mov qword [rsp + 0x1e8], rsi
mov qword [rsp + 0x1f0], rsi
lea rax, [rsp + 0x4f0]
mov r13, 0xffffffffffffffff
mov r8, r13
inc r8
cmp byte [rax + r8], sil
jne 0x140003425
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0x1d8]
call fcn.140005b60
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r15, qword [rsp + 0x1e8]
sub rax, r15
cmp rax, 9
jb 0x140004799
lea r12, [rsp + 0x1d8]
cmp qword [rsp + 0x1f0], 0xf
cmova r12, qword [rsp + 0x1d8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r14, [r15 + 9]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp r14, rbx
jbe 0x140003522
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400034dc
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140007210
test rax, rax
je 0x14000350e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000351d
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400034f6
mov rdi, rsi
jmp 0x14000351d
cmp rcx, 0x1000
jb 0x140003515
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000479f
jmp 0x1400034c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007210
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
movsd xmm0, qword [str.C:_Users_]
movsd qword [rdi], xmm0
movzx eax, byte [0x1400096d8]
mov byte [rdi + 8], al
lea rcx, [rdi + 9]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 0x2a
lea rdx, str._AppData_Roaming_Stormworks_data_vehicles_
lea rcx, [rsp + 0x50]
call fcn.140004a50
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1c8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x1c0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400035ee
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
movdqa xmm6, xmmword [0x1400098b0]
movdqu xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
lea r8, [rsp + 0x1d8]
lea rcx, [rsp + 0x190]
call fcn.140005270
nop
mov r8d, 0x21
lea rdx, str._AppData_Roaming_std_Char_create_
mov rcx, rax
call fcn.140004a50
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x180], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x1400036b3
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
movdqu xmmword [rsp + 0x1a0], xmm6
mov byte [rsp + 0x190], 0
lea r8, [rsp + 0x1d8]
lea rcx, [rsp + 0xf0]
call fcn.140005270
nop
mov r8d, 0x1a
lea rdx, str._AppData_Roaming_arbuz.zip
mov rcx, rax
call fcn.140004a50
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x208], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x1f8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x208], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x140003772
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000376d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000376d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
movdqu xmmword [rsp + 0x100], xmm6
mov byte [rsp + 0xf0], 0
lea rax, [rsp + 0x170]
cmp qword [rsp + 0x188], 0xf
cmova rax, qword [rsp + 0x170]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x158], rax
call fcn.140006828
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x130], xmm0
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x190]
call fcn.140001950
nop
mov qword [rsp + 0x150], rsi
lea rdi, [0x14000d078]
mov qword [rsp + 0x158], rdi
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x190]
call fcn.140002ec0
movzx ebx, al
cmp dword [rsp + 0x150], 0
jne 0x1400047a5
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x14000386b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003866
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003866
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
test bl, bl
jne 0x140003951
lea rax, [rsp + 0x170]
cmp qword [rsp + 0x188], 0xf
cmova rax, qword [rsp + 0x170]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x158], rax
call fcn.140006828
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x130], xmm0
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x190]
call fcn.140001950
nop
mov qword [rsp + 0x150], rsi
mov qword [rsp + 0x158], rdi
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x190]
call fcn.1400030b0
cmp dword [rsp + 0x150], 0
jne 0x1400047c2
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x140003951
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000394c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000394c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
lea rax, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 0xf
cmova rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x158], rax
call fcn.140006828
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x130], xmm0
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140001950
nop
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rcx, qword [rsp + 0x80]
mov r9d, 0xffffffff
mov r8d, 0xb
lea rdx, [rsp + 0x190]
call fcn.140006e58
mov dword [rsp + 0x150], eax
mov qword [rsp + 0x158], rdi
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x160], xmm0
test eax, eax
je 0x140003a10
xor dil, dil
jmp 0x140003ac9
test byte [rsp + 0x1a0], 0x10
jne 0x140003a2c
cmp qword [rsp + 0x198], 0
sete dil
jmp 0x140003ac9
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x150], xmm1
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x150]
call fcn.140004e20
mov dword [rsp + 0x160], eax
mov qword [rsp + 0x168], rdi
movaps xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0x160], xmm0
test eax, eax
jne 0x140003a81
cmp qword [rsp + 0x150], 0
jne 0x140003a81
mov dil, 1
jmp 0x140003a84
xor dil, dil
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x140003ac9
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003ac9
mov rbx, qword [rsp + 0x158]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140003ac9
mov rcx, qword [rsp + 0x158]
mov rax, qword [rcx]
call qword [rax + 8]
cmp dword [rsp + 0x160], 0
jne 0x1400047df
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140003b22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
test dil, dil
je 0x140003ca3
mov rdx, qword [rsp + 0x210]
cmp rdx, 0xf
jbe 0x140003b6e
inc rdx
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004554
call fcn.14000724c
movdqu xmmword [rsp + 0x208], xmm6
mov byte [rsp + 0x1f8], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140003bc2
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400045ab
call fcn.14000724c
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], 0xf
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 0xf
jbe 0x140003c21
inc rdx
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000460d
call fcn.14000724c
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1c8], 0xf
mov byte [rsp + 0x1b0], 0
mov rdx, qword [rsp + 0x1f0]
cmp rdx, 0xf
jbe 0x140003c80
inc rdx
mov rcx, qword [rsp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000466f
call fcn.14000724c
mov qword [rsp + 0x1e8], rsi
mov qword [rsp + 0x1f0], 0xf
mov byte [rsp + 0x1d8], 0
xor eax, eax
jmp 0x140004762
lea rax, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 0xf
cmova rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x158], rax
call fcn.140006828
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x130], xmm0
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x190]
call fcn.140001950
nop
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x150], xmm0
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x150]
call fcn.140004e20
test eax, eax
jne 0x1400047fc
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x140003d77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d72
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
xorps xmm0, xmm0
movups xmmword [rsp + 0x160], xmm0
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x140003d93
lock inc dword [rcx + 8]
movaps xmm0, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x160], xmm0
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x140003db5
lock inc dword [rcx + 8]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x218], xmm1
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x140003e0c
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140003e0c
mov rbx, qword [rsp + 0x158]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140003e0c
mov rcx, qword [rsp + 0x158]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov r13, qword [rsp + 0x160]
nop dword [rax]
nop dword [rax + rax]
cmp r13, qword [rsp + 0x218]
je 0x140004330
lea rdx, [r13 + 0x20]
lea rcx, [rsp + 0x118]
call fcn.140002fd0
movsd xmm0, qword [rax]
movsd qword [rsp + 0xc0], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rsp + 0xc0]
test edx, edx
je 0x140003e68
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x140004813
cmp ecx, 2
jne 0x140004270
lea rcx, [r13 + 0x20]
cmp qword [r13 + 0x38], 7
jbe 0x140003e80
mov rcx, qword [r13 + 0x20]
mov rax, qword [r13 + 0x30]
lea rdi, [rcx + rax*2]
mov rbx, rdi
mov rdx, rdi
call fcn.140001ab0
cmp rax, rdi
je 0x140003edb
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140003eaf
cmp cx, 0x2f
jne 0x140003eb8
add rax, 2
cmp rax, rdi
jne 0x140003ea0
cmp rax, rdi
je 0x140003edb
nop dword [rax]
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x140003edb
cmp cx, 0x2f
je 0x140003edb
mov rbx, rdx
cmp rax, rdx
jne 0x140003ec0
mov qword [rsp + 0xd0], rbx
sub rdi, rbx
sar rdi, 1
mov qword [rsp + 0xd8], rdi
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x190]
call fcn.140006310
nop
lea rax, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 7
cmova rax, qword [rsp + 0x190]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xe8], rax
call fcn.140006828
movaps xmm0, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0xa0]
call fcn.140004b60
nop
mov r12, qword [rsp + 0x180]
lea rbx, [rsp + 0x170]
cmp qword [rsp + 0x188], 0xf
cmova rbx, qword [rsp + 0x170]
mov r8, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
sub rax, r8
cmp r12, rax
ja 0x140004027
lea rax, [r8 + r12]
mov qword [rsp + 0xb0], rax
lea rdi, [rsp + 0xa0]
cmp rcx, 0xf
cmova rdi, qword [rsp + 0xa0]
lea rax, [r12 + rbx]
cmp rax, rdi
jbe 0x140003fe7
lea rax, [rdi + r8]
cmp rbx, rax
ja 0x140003fe7
cmp rdi, rbx
ja 0x140003fdf
mov r15, rsi
jmp 0x140003fea
mov r15, rdi
sub r15, rbx
jmp 0x140003fea
mov r15, r12
lea rcx, [r12 + rdi]
inc r8
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, r15
mov rdx, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + r15]
mov r8, r12
sub r8, r15
lea rdx, [r15 + r12]
add rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0xa0]
jmp 0x140004041
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rdx, r12
lea rcx, [rsp + 0xa0]
call fcn.140006460
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rax, qword [rsp + 0x50]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x138], rax
call fcn.140006828
movaps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140001950
nop
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rdx, qword [rsp + 0x80]
lea rcx, [r13 + 0x20]
cmp qword [r13 + 0x38], 7
jbe 0x1400040ea
mov rcx, qword [r13 + 0x20]
mov r8d, 2
call fcn.140006a88
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140004824
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x14000414f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000414a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000414a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], 7
mov word [rsp + 0x80], si
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400041ab
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x140004204
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x140004270
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004266
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004266
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
nop dword [rax + rax]
lea rdx, [rsp + 0x2a0]
mov rcx, qword [r13 + 0x40]
call fcn.140006da4
cmp eax, 0x12
je 0x1400042c9
test eax, eax
jne 0x14000483a
cmp word [rsp + 0x2cc], 0x2e
jne 0x1400042b7
movzx eax, word [rsp + 0x2ce]
test ax, ax
je 0x140004270
cmp ax, 0x2e
jne 0x1400042b7
cmp word [rsp + 0x2d0], 0
je 0x140004270
lea rdx, [rsp + 0x2a0]
mov rcx, r13
call fcn.140002c80
jmp 0x140004321
mov r13, rsi
mov qword [rsp + 0x160], rsi
mov rbx, qword [rsp + 0x168]
mov qword [rsp + 0x168], rsi
test rbx, rbx
je 0x140004321
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140004319
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140004319
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov r13, qword [rsp + 0x160]
mov eax, esi
test eax, eax
jne 0x14000483a
jmp 0x140003e20
mov rcx, qword [rsp + 0x168]
mov rdi, 0xffffffffffffffff
test rcx, rcx
je 0x14000437b
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000437b
mov rbx, qword [rsp + 0x168]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000437b
mov rcx, qword [rsp + 0x168]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x1400043bc
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400043bc
mov rbx, qword [rsp + 0x158]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400043bc
mov rcx, qword [rsp + 0x158]
mov rax, qword [rcx]
call qword [rax + 8]
lea r9, [rsp + 0x170]
cmp qword [rsp + 0x188], 0xf
cmova r9, qword [rsp + 0x170]
lea r8, [rsp + 0x1f8]
cmp qword [rsp + 0x210], 0xf
cmova r8, qword [rsp + 0x1f8]
lea rdx, str.tar.exe__a__c__f___s____directory__s__.__nul
lea rcx, [rsp + 0x600]
call fcn.140001010
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x234], xmm0
movups xmmword [rsp + 0x244], xmm0
movups xmmword [rsp + 0x254], xmm0
movups xmmword [rsp + 0x264], xmm0
movups xmmword [rsp + 0x274], xmm0
movups xmmword [rsp + 0x284], xmm0
mov dword [rsp + 0x294], eax
mov dword [rsp + 0x230], 0x68
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x600]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400044dd
lea rdx, str.CreateProcess_failed__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140005090
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140009684]
mov rcx, rax
call fcn.140005090
jmp 0x14000450c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.HTTP_Handler.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0x210]
cmp rdx, 0xf
jbe 0x140004560
inc rdx
mov rcx, qword [rsp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000455b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000455b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
movdqu xmmword [rsp + 0x208], xmm6
mov byte [rsp + 0x1f8], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x1400045b7
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], 0xf
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 0xf
jbe 0x140004619
inc rdx
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004614
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004614
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1c8], 0xf
mov byte [rsp + 0x1b0], 0
mov rdx, qword [rsp + 0x1f0]
cmp rdx, 0xf
jbe 0x14000467b
inc rdx
mov rcx, qword [rsp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004676
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004676
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000724c
mov qword [rsp + 0x1e8], rsi
mov qword [rsp + 0x1f0], 0xf
mov byte [rsp + 0x1d8], 0
xor eax, eax
jmp 0x140004762
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.1400071f0
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.140001210
nop
call fcn.140001170
nop
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x150]
lea rcx, str.exists
call fcn.140002a30
nop
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x150]
lea rcx, str.create_directories
call fcn.140002a30
nop
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x160]
lea rcx, str.is_empty
call fcn.140002a30
nop
lea r8, [rsp + 0x190]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.140002940
nop
lea r8, [r13 + 0x20]
lea rcx, str.status
call fcn.140002940
nop
shr rdx, 0x20
lea r9, [rsp + 0x80]
lea r8, [r13 + 0x20]
call fcn.1400029b0
nop
mov edx, eax
call fcn.140002850
int3