Function at 0x1400032d0
Capabilities:
Create process on windows
Execute command
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
xor r12d, r12d
mov edi, r12d
mov dword [rbp - 0x20], r12d
lea rax, [rbp + 0x290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rbp + 0x290]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x140003350
lea rdx, [rbp + 0x290]
lea rcx, [rsp + 0x30]
call fcn.1400063c0
nop
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rsi
cmp rax, 5
jb 0x1400033bd
lea rax, [rsi + 5]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 7
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rsi*2]
mov r8d, 0xa
lea rdx, str.Temp
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi*2 + 0xa], r12w
lea rax, [rsp + 0x30]
jmp 0x1400033dc
mov qword [rsp + 0x20], 5
lea r9, str.Temp
mov edx, 5
lea rcx, [rsp + 0x30]
call fcn.1400061e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or edi, 1
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003452
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000344d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000344d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rdx, qword [rbp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
mov r8, qword [rbp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400063c0
or edi, 6
lea rcx, [rbp + 0x160]
call fcn.140002b20
nop
call fcn.1400073f8
lea rcx, str.helper.dll
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 0xa
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001910
or edi, 0x18
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x80]
call fcn.140001e40
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003535
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003530
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003530
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rcx, qword [rbp + 0x80]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp]
call fcn.140007814
mov edx, eax
test eax, eax
jne 0x1400035c5
mov eax, dword [rbp + 0x10]
test al, 1
mov ecx, 0x1ff
mov r8d, 0x16d
cmovne ecx, r8d
mov dword [rbp - 0x1c], ecx
bt eax, 0xa
jae 0x1400035b7
mov ecx, dword [rbp + 0x14]
cmp ecx, 0xa000000c
jne 0x1400035a8
lea eax, [rdx + 4]
jmp 0x1400035e8
cmp ecx, 0xa0000003
jne 0x1400035b7
mov eax, 0xa
jmp 0x1400035e8
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x1400035e8
mov dword [rbp - 0x1c], 0xffff
sub eax, 2
je 0x1400035e3
sub eax, 1
je 0x1400035e3
sub eax, 0x32
je 0x1400035e3
cmp eax, 0x46
mov eax, r12d
jne 0x1400035e8
mov eax, 1
mov dword [rbp - 0x20], edx
lea rcx, [0x14000f080]
mov qword [rbp - 0x18], rcx
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
test eax, eax
jne 0x14000360d
test edx, edx
jne 0x1400045f2
jmp 0x140003612
cmp eax, 1
jne 0x14000362e
mov r9d, 0x10
lea r8, str.DLL_not_found
lea rdx, str.Improper_installation._helper.dll_not_found.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea r8, str._run.exe
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.140005c20
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x1400036b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rcx, qword [rbp + 0x80]
mov r8d, 2
call fcn.140007534
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140004603
call fcn.1400073f8
lea rcx, str.routine.dll
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 0xb
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001910
or edi, 0xc0
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x140]
call fcn.140001e40
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003790
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000378b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000378b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
call fcn.1400073f8
lea rcx, str.libhelp.dll
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 0xb
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x78]
call fcn.140001910
or edi, 0x600
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x120]
call fcn.140001e40
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x14000382f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000382a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000382a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r12w
lea r8, [0x14000a808]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140005c20
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1400038d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r12w
lea r8, [0x14000a828]
lea rdx, [rbp + 0x40]
lea rcx, [rbp]
call fcn.140005c20
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x140003976
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003971
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003971
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r12w
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 7
cmova rcx, qword [rbp + 0x140]
mov r8d, 2
call fcn.140007534
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14000461f
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 7
cmova rcx, qword [rbp + 0x120]
lea r8d, [rax + 2]
call fcn.140007534
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14000463e
lea rcx, [rbp + 0x20]
call fcn.140002c80
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
mov r8d, 0x9d7
lea rdx, str.local_efalse_local_ftrue_function_instructionize_g_local_hlocal_i1_local_j__for_k1_g_do_local_lg:sub_k_k_if_l___then_h_i_j..___ii1_j__else_jj..g:sub_k_k_end_end_return_h_end_math.randomseed_os.time___math.random__math.random__math.random__math.random__math.random__function_a_g_local_mfor_k1_g_do_local_nmath.random_1_1000_m_k____..n..__..string.byte_g:sub_k_k__n..___end_return_m_end_function_mergeinstructions_h_local_o0_for_k1_h_do_if_o3_then_o0_h_k_1_h_k_1_..h_k_h_k_nil_else_oo1_end_end_return_h_end_function_fixtable_p_local_q1_for_k_r_in_pairs_p_do_p_q_p_k_qq1_end_return_p_end_function_c_g_for_k_r_in_pairs_g_do_local_smath.random_1_2_if_s1_then_local_tmath.random_1001_2000_g_k_g_k_..___..t..__..string.byte__a__t..___end_end_return_g_end_function_d_u_for_k_r_in_pairs_u_do_local_vmath.random_1_2_if_v1_then_if_u_k_1_then_u_k_u_k_..___..u_k_1_1_.._.__..u_k_1_end_end_end_return_u_end_function_b_g_local_wfalse_local_n__local_m__local_x__local_yfalse_local_z0_local_A__for_k1_g_do_local_lg:sub_k_k_if_l___then_A__ytrue_end_if_l_._then_yfalse_ztonumber_A_1_end_if_y_then_if_l___then_AA..l_end_end_if_not_y_then_if_z0_then_if_l___then_wtrue_elseif_l__then_wfalse_end_if_w_then_if_l___then_nn..l_end_else_if_l__then_if_l___then_if_tonumber_n__1000_then_mm..string.char_tonumber_x_n__end_n__x__else_xx..l_end_end_end_else_zz_1_end_end_end_return_m_end_local_Bio.open__run.exe___rb__local_CB:read__all__B:close__if_e_then_local_Dos.clock__print__Step_1:_Applying_Letters_to_Numbers_with_Offsets...__local_Eos.clock__local_Fa_C_print__Applied_in__..os.clock___E.._s._n_nStep_2:_Applying_fake_Instructions_with_Offsets_not_equal_to_the_real_offsets...__Eos.clock__local_Gc_F_print__Applied_in__..os.clock___E.._s._n_nStep_3:_Applying_skip_Instructions...__Eos.clock__local_Hd_G_print__Applied_in__..os.clock___E.._s._n_nStep_4:_Merging_Instructions__Performance_increase_...__Eos.clock__local_IH_Hfixtable_mergeinstructions_H__print_I..______..H.._____Applied_in__..os.clock___E.._s._n_n__print__Time_Took_Obfuscating:__..os.clock___D.._s__print__Converting_Instructions_to_Text...__Eos.clock__local_g__for_k1_H_do_gg..H_k_end_print__Converted_in__..os.clock___E.._s__print___nWriting_Output...__local_Jio.open__output.lua___wb__J:write_g_J:close__end_if_f_then_local_Jio.open__run.exe___rb__local_KJ:read__all__J:close__local_Dos.clock__local_cio.open__run.exe___wb__c:write_b_K__c:close__end
lea rcx, [rbp + 0x60]
call fcn.1400067c0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x180]
call sub.VCRUNTIME140.dll_memset
call fcn.1400073f8
lea r14, str.decrypt.lua
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xb
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001910
or edi, 0x3000
mov dword [rbp - 0x20], edi
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x78]
call fcn.1400052e0
bts edi, 0xe
mov dword [rbp - 0x20], edi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.140001b60
mov r8d, 2
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x180]
call fcn.140005af0
nop
btr edi, 0xe
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140003b11
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r12w
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003b69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
lea rcx, [rbp + 0x180]
call fcn.140006f10
lea rcx, [rbp + 0x188]
call fcn.1400057d0
test rax, rax
jne 0x140003bce
mov rax, qword [rbp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x180]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x68]
call fcn.1400052e0
bts edi, 0xf
mov r8, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
sub rax, r8
mov r15d, 6
cmp rax, r15
jb 0x140003c93
lea rax, [r8 + 6]
mov qword [rbp - 0x58], rax
lea r14, [rbp - 0x68]
cmp rcx, 7
cmova r14, qword [rbp - 0x68]
lea rax, [0x14000b26c]
lea r13, str.cd__d
cmp rax, r14
jbe 0x140003c45
lea rax, [r14 + r8*2]
cmp r13, rax
ja 0x140003c45
cmp r14, r13
ja 0x140003c3a
mov rsi, r12
jmp 0x140003c48
mov rsi, r14
sub rsi, r13
sar rsi, 1
jmp 0x140003c48
mov rsi, r15
lea rcx, [r14 + 0xc]
lea r8, [r8*2 + 2]
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [r13 + 0xc]
lea rdx, [rdx + rsi*2]
lea rcx, [rbx + r14]
sub r15, rsi
lea r8, [r15 + r15]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x68]
lea r14, str.decrypt.lua
jmp 0x140003ca4
mov qword [rsp + 0x28], r15
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.1400070d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
bts edi, 0x10
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
sub rax, rsi
cmp rax, 0x1a
jb 0x140003d2b
lea rax, [rsi + 0x1a]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x58]
cmp rcx, 7
cmova rbx, qword [rsp + 0x58]
lea rcx, [rbx + rsi*2]
mov r8d, 0x34
lea rdx, str.__luaexecute_decrypt.lua
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi*2 + 0x34], r12w
lea rax, [rsp + 0x58]
jmp 0x140003d4a
mov qword [rsp + 0x20], 0x1a
lea r9, str.__luaexecute_decrypt.lua
mov edx, 0x1a
lea rcx, [rsp + 0x58]
call fcn.1400061e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
bts edi, 0x11
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140003dcd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003dc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], r12w
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x140003e24
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp - 0x58], xmm0
mov word [rbp - 0x68], r12w
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova rcx, qword [rbp + 0x100]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
call fcn.1400073f8
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xb
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp]
call fcn.140001910
or edi, 0xc0000
mov dword [rbp - 0x20], edi
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x30]
call fcn.1400052e0
bts edi, 0x14
mov dword [rbp - 0x20], edi
lea rdx, [rbp]
lea rcx, [rsp + 0x30]
call fcn.140001b60
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call fcn.140007b94
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14000465d
btr edi, 0x14
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140003f10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x140003f67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
call fcn.1400073f8
lea rcx, str.lua5.1.dll
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 0xa
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp]
call fcn.140001910
or edi, 0x600000
mov dword [rbp - 0x20], edi
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x30]
call fcn.1400052e0
bts edi, 0x17
mov dword [rbp - 0x20], edi
lea rdx, [rbp]
lea rcx, [rsp + 0x30]
call fcn.140001b60
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call fcn.140007b94
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14000466c
btr edi, 0x17
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14000402b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004026
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004026
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x140004082
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000407d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000407d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
call fcn.1400073f8
lea rcx, str.luaexecute.exe
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 0xe
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp]
call fcn.140001910
or edi, 0x3000000
mov dword [rbp - 0x20], edi
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x30]
call fcn.1400052e0
bts edi, 0x1a
mov dword [rbp - 0x20], edi
lea rdx, [rbp]
lea rcx, [rsp + 0x30]
call fcn.140001b60
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call fcn.140007b94
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x1400045e3
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140004142
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000413d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000413d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x140004199
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004194
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004194
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova r8, qword [rbp + 0x20]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov ebx, r12d
cmp eax, 0x20
setg bl
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x140004216
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004211
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004211
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0x110], xmm0
mov word [rbp + 0x100], r12w
lea rcx, [rbp + 0x180]
call fcn.140003210
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140004279
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004274
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004274
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x1400042d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400042cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r12w
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x140004333
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000432e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000432e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0xd0], xmm0
mov word [rbp + 0xc0], r12w
mov rdx, qword [rbp + 0x138]
cmp rdx, 7
jbe 0x140004394
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000438f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000438f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], r12w
mov rdx, qword [rbp + 0x158]
cmp rdx, 7
jbe 0x1400043f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0x150], xmm0
mov word [rbp + 0x140], r12w
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140004450
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000444b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000444b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r12w
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x1400044ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0x90], xmm0
mov word [rbp + 0x80], r12w
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x14000450c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004507
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
movdqa xmm0, xmmword [0x14000b460]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r12w
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x14000456e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004568
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004568
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x1400045b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400045ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007f44
mov eax, ebx
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.140007ee0
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.140002980
nop
lea r8, [rbp + 0x80]
lea rdx, [rbp - 0x20]
call fcn.140002ac0
nop
shr rdx, 0x20
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x80]
lea rcx, str.copy_file
call fcn.1400029f0
nop
shr rdx, 0x20
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x140]
lea rcx, str.copy_file
call fcn.1400029f0
int3
shr rdx, 0x20
lea r9, [rbp + 0xa0]
lea r8, [rbp + 0x120]
lea rcx, str.copy_file
call fcn.1400029f0
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.140002980
nop
shr rdx, 0x20
lea r8, [rsp + 0x30]
call fcn.140002980
int3