Function at 0x14000dc20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
movzx r15d, dl
mov r14, rcx
xor r12d, r12d
mov dword [rbp + 0x80], r12d
lea rax, str.true
lea r8, str.false
test dl, dl
cmovne r8, rax
lea rdx, [0x140045430]
mov ecx, 3
call fcn.140013b30
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140010010
nop
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.140003800
nop
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14000ec36
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.new_
mov rsi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x14000dcd4
movzx edx, dx
lea rcx, [rsp + 0x78]
call fcn.140007210
jmp 0x14000dcf6
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000dce0
lea rcx, [rsp + 0x78]
call fcn.1400048b0
nop
mov rbx, qword [rbp - 0x80]
mov ecx, dword [rbx - 0x10]
mov rax, qword [rsp + 0x78]
sub ecx, dword [rax - 0x10]
mov edi, r12d
cmovns edi, ecx
cmp edi, dword [rbx - 0x10]
jl 0x14000dd26
lea rcx, [rbx - 0x18]
call fcn.140002eb0
add rax, 0x18
mov qword [rbp - 0x78], rax
jmp 0x14000ddb9
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14000dd3d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000dd57
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x14000ec41
mov rax, qword [rcx]
mov r8d, 2
mov edx, edi
call qword [rax]
test rax, rax
je 0x14000ec4c
lea rcx, [rax + 0x18]
mov qword [rbp - 0x78], rcx
test edi, edi
js 0x14000ec2b
cmp edi, dword [rcx - 0xc]
jg 0x14000ec2b
mov dword [rcx - 0x10], edi
movsxd rax, edi
lea r8, [rax + rax]
mov word [r8 + rcx], r12w
test r8, r8
je 0x14000ddb9
test rcx, rcx
jne 0x14000ddb1
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000ddb9
mov rdx, rbx
call fcn.14003f6b0
mov r13d, 1
mov dword [rbp + 0x80], r13d
mov rcx, qword [r14]
cmp dword [rcx - 0x10], 0
jl 0x14000ddef
lea rdx, str._deploy
call fcn.14001ea78
test rax, rax
je 0x14000ddef
sub rax, qword [r14]
sar rax, 1
cmp eax, 0xffffffff
jne 0x14000eb8f
lea rdx, [0x140045468]
mov ecx, 3
call fcn.140013b30
lea r8, [0x140045170]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x60]
call fcn.140002620
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
mov dword [rbp + 0x24], eax
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rax
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14000ec52
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x88], rax
mov rbx, qword [r14]
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14000ec5d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
test rbx, rbx
je 0x14000debd
cmp rbx, 0x10000
jae 0x14000dea7
movzx edx, bx
lea rcx, [rsp + 0x68]
call fcn.140007210
jmp 0x14000dece
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14000deb0
jmp 0x14000dec0
mov r8d, r12d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1400048b0
nop
mov rbx, qword [rsp + 0x68]
mov rdx, qword [0x14005a718]
test rdx, rdx
jne 0x14000dee4
mov r14d, esi
jmp 0x14000df0a
cmp dword [rbx - 0x10], 0
jge 0x14000deef
mov r14d, esi
jmp 0x14000df0a
mov rcx, rbx
call fcn.14001ea78
mov r14, rax
test rax, rax
jne 0x14000df04
mov r14d, esi
jmp 0x14000df0a
sub r14, rbx
sar r14, 1
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14000ec68
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x70], rdi
cmp r14d, 0xffffffff
je 0x14000e04f
test r14d, r14d
js 0x14000df5f
cmp r14d, dword [rbx - 0x10]
jg 0x14000df5f
movsxd rax, r14d
lea rcx, [rbx + rax*2]
lea rdx, [0x1400439c8]
call fcn.14001ea78
test rax, rax
je 0x14000df5f
sub rax, rbx
sar rax, 1
jmp 0x14000df61
mov eax, esi
mov r8d, eax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.140004750
mov rbx, rax
mov r8d, r14d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.140004320
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14000c400
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000dff2
cmp dword [rdi + 0x10], 0
jl 0x14000dfe3
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000dfe3
call fcn.140002eb0
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14000dfd8
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14000dff2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400048b0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e011
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e030
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e0a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14000e0a7
lea rcx, [rbx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000e0a7
cmp dword [rdi + 0x10], 0
jl 0x14000e096
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000e096
call fcn.140002eb0
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14000e08b
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14000e0a7
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400048b0
test r15b, r15b
je 0x14000e372
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14000e0cc
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000e0dd
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000ec73
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov dword [rbp + 0x80], 5
mov r15, qword [rsp + 0x60]
movsxd r12, dword [r15 - 0x10]
lea rdx, [0x14004548c]
mov rbx, rsi
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14000e112
lea r14d, [rbx + r12]
test r14d, r14d
js 0x14000ec94
mov ecx, r13d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14000e152
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.1400045e0
mov rdi, qword [rsp + 0x58]
lea rdx, [0x14004548c]
movsxd rax, ebx
lea rbx, [rax + rax]
test rbx, rbx
je 0x14000e180
test rdi, rdi
jne 0x14000e175
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000e180
mov r8, rbx
mov rcx, rdi
call fcn.14003f6b0
mov r8, r12
add r8, r8
lea rcx, [rbx + rdi]
je 0x14000e1b7
test rcx, rcx
je 0x14000e1a7
test r15, r15
je 0x14000e1a0
mov rdx, r15
call fcn.14003f6b0
jmp 0x14000e1b7
xor edx, edx
call fcn.14003fd50
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
cmp r14d, dword [rdi - 0xc]
jg 0x14000ec94
mov dword [rdi - 0x10], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rdi + rax*2], cx
lea r13, [rdi - 0x18]
mov rcx, qword [r13]
test rcx, rcx
je 0x14000e1e9
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000e1fa
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000ec7e
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov dword [rbp + 0x80], 0xd
lea rax, [0x140045484]
mov r14, rsi
nop word [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x14000e230
movsxd r12, dword [rdi - 0x10]
lea r15d, [r12 + r14]
test r15d, r15d
js 0x14000ec89
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14000e270
mov edx, r15d
lea rcx, [rsp + 0x50]
call fcn.1400045e0
mov rbx, qword [rsp + 0x50]
add r12, r12
je 0x14000e29a
test rbx, rbx
jne 0x14000e28c
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000e29a
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.14003f6b0
movsxd r8, r14d
add r8, r8
lea rcx, [r12 + rbx]
je 0x14000e2c9
test rcx, rcx
jne 0x14000e2bd
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000e2c9
lea rdx, [0x140045484]
call fcn.14003f6b0
cmp r15d, dword [rbx - 0xc]
jg 0x14000ec89
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rbx + rax*2], cx
lea rdi, [rbx - 0x18]
mov r14, qword [rbp + 0x88]
add r14, 0xffffffffffffffe8
cmp rdi, r14
je 0x14000e348
cmp dword [r14 + 0x10], ecx
jl 0x14000e334
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x14000e334
mov rcx, rdi
call fcn.140002eb0
mov rbx, rax
mov ecx, esi
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x14000e327
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp + 0x88], rax
jmp 0x14000e348
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.1400048b0
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x14000e360
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
mov r15d, 1
mov dword [rbp + 0x80], r15d
jmp 0x14000e62d
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14000e38e
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000e39f
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000ec9f
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov dword [rbp + 0x80], 0x81
mov r15, qword [rsp + 0x60]
movsxd r12, dword [r15 - 0x10]
lea rdx, [0x14004548c]
mov rbx, rsi
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14000e3d4
lea r14d, [r12 + rbx]
test r14d, r14d
js 0x14000ec20
mov ecx, r13d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14000e414
mov edx, r14d
lea rcx, [rsp + 0x58]
call fcn.1400045e0
mov rdi, qword [rsp + 0x58]
lea rdx, [0x14004548c]
movsxd rax, ebx
lea rbx, [rax + rax]
test rbx, rbx
je 0x14000e442
test rdi, rdi
jne 0x14000e437
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000e442
mov r8, rbx
mov rcx, rdi
call fcn.14003f6b0
mov r8, r12
add r8, r8
lea rcx, [rbx + rdi]
je 0x14000e479
test rcx, rcx
je 0x14000e469
test r15, r15
je 0x14000e462
mov rdx, r15
call fcn.14003f6b0
jmp 0x14000e479
xor edx, edx
call fcn.14003fd50
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
cmp r14d, dword [rdi - 0xc]
jg 0x14000ec20
mov dword [rdi - 0x10], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rdi + rax*2], cx
lea r13, [rdi - 0x18]
mov rcx, qword [r13]
test rcx, rcx
je 0x14000e4ab
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000e4bc
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000ecaa
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov dword [rbp + 0x80], 0xc1
lea rax, [0x140045490]
mov r14, rsi
nop dword [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x14000e4f0
movsxd r12, dword [rdi - 0x10]
lea r15d, [r12 + r14]
test r15d, r15d
js 0x14000ecec
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14000e530
mov edx, r15d
lea rcx, [rsp + 0x50]
call fcn.1400045e0
mov rbx, qword [rsp + 0x50]
add r12, r12
je 0x14000e55a
test rbx, rbx
jne 0x14000e54c
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000e55a
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.14003f6b0
movsxd r8, r14d
add r8, r8
lea rcx, [r12 + rbx]
je 0x14000e589
test rcx, rcx
jne 0x14000e57d
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000e589
lea rdx, [0x140045490]
call fcn.14003f6b0
cmp r15d, dword [rbx - 0xc]
jg 0x14000ecec
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rbx + rax*2], cx
lea rdi, [rbx - 0x18]
mov r14, qword [rbp + 0x88]
add r14, 0xffffffffffffffe8
cmp rdi, r14
je 0x14000e608
cmp dword [r14 + 0x10], ecx
jl 0x14000e5f4
mov rax, qword [r14]
cmp qword [rdi], rax
jne 0x14000e5f4
mov rcx, rdi
call fcn.140002eb0
mov rbx, rax
mov ecx, esi
lock xadd dword [r14 + 0x10], ecx
sub ecx, 1
jg 0x14000e5e7
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 8]
lea rax, [rbx + 0x18]
mov qword [rbp + 0x88], rax
jmp 0x14000e608
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.1400048b0
nop
mov eax, esi
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x14000e620
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
mov r15d, 1
mov dword [rbp + 0x80], r15d
mov eax, esi
lock xadd dword [r13 + 0x10], eax
sub eax, 1
jg 0x14000e647
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rdx, r13
call qword [rax + 8]
mov rbx, qword [rbp + 0x88]
mov r8, rbx
lea rdx, [0x1400454b0]
mov ecx, 3
call fcn.140013b30
lea rdx, [0x1400454d0]
mov ecx, 3
call fcn.140013b30
lea rax, [rsp + 0x50]
mov qword [rbp - 0x70], rax
call fcn.1400033f0
mov rcx, rax
test rax, rax
je 0x14000ecb5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, str.explorer.exe
cmp rdx, 0x10000
jae 0x14000e6bb
movzx edx, dx
lea rcx, [rsp + 0x50]
call fcn.140007210
jmp 0x14000e6d6
mov r8, rsi
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000e6c0
lea rcx, [rsp + 0x50]
call fcn.1400048b0
nop
lea rcx, [rsp + 0x50]
call fcn.140012140
mov r14, rax
mov rdi, qword [rbp - 0x80]
xor r13d, r13d
test rax, rax
je 0x14000e7bb
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2000000
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov r12d, r13d
lea rcx, str.ADVAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r15, rax
test rax, rax
je 0x14000e787
lea rdx, str.CreateProcessWithTokenW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e77e
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, rbx
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x58]
call rax
mov r12d, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000e7a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x14000e7bb
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000e817
lea rdx, [0x140045500]
mov ecx, 3
call fcn.140013b30
lea rax, [rbp - 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r8, rbx
lea rdx, [0x140045558]
mov ecx, 3
call fcn.140013b30
cmp byte [rbp + 0x78], 0
je 0x14000eb11
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14000e849
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000e85a
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000ecc0
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov dword [rbp + 0x80], 0x11
mov r15, qword [rsp + 0x60]
movsxd r12, dword [r15 - 0x10]
mov rdi, rsi
lea r13, [0x14004548c]
nop
inc rdi
cmp word [r13 + rdi*2], 0
jne 0x14000e890
lea r14d, [r12 + rdi]
test r14d, r14d
js 0x14000ece1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14000e8cd
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.1400045e0
mov rbx, qword [rsp + 0x50]
movsxd rax, edi
lea rdi, [rax + rax]
test rdi, rdi
je 0x14000e8fe
test rbx, rbx
jne 0x14000e8f0
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000e8fe
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call fcn.14003f6b0
mov r8, r12
add r8, r8
lea rcx, [rdi + rbx]
je 0x14000e935
test rcx, rcx
je 0x14000e925
test r15, r15
je 0x14000e91e
mov rdx, r15
call fcn.14003f6b0
jmp 0x14000e935
xor edx, edx
call fcn.14003fd50
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
cmp r14d, dword [rbx - 0xc]
jg 0x14000ece1
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rbx + rax*2], cx
lea r12, [rbx - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x14000e967
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14000e978
call fcn.1400033f0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14000eccb
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
mov dword [rbp + 0x80], 0x31
lea rax, str.___removenew2
mov r14, rsi
inc r14
cmp word [rax + r14*2], 0
jne 0x14000e9a4
movsxd r13, dword [rbx - 0x10]
lea r15d, [r14 + r13]
test r15d, r15d
js 0x14000ecd6
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14000e9e4
mov edx, r15d
lea rcx, [rsp + 0x58]
call fcn.1400045e0
mov rdi, qword [rsp + 0x58]
add r13, r13
je 0x14000ea0e
test rdi, rdi
jne 0x14000ea00
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000ea0e
mov r8, r13
mov rdx, rbx
mov rcx, rdi
call fcn.14003f6b0
movsxd r8, r14d
add r8, r8
lea rcx, [rdi + r13]
je 0x14000ea3d
test rcx, rcx
jne 0x14000ea31
call fcn.140023c08
mov dword [rax], 0x16
call fcn.140023ae4
jmp 0x14000ea3d
lea rdx, str.___removenew2
call fcn.14003f6b0
cmp r15d, dword [rdi - 0xc]
jg 0x14000ecd6
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
xor ebx, ebx
mov word [rdi + rax*2], bx
mov dword [rbp + 0x80], 0x21
mov eax, esi
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x14000ea79
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000ead1
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000eae5
mov r8, rbx
lea rdx, [0x1400455a0]
mov ecx, 3
call fcn.140013b30
lea rdx, [0x1400455d0]
mov ecx, 3
call fcn.140013b30
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb30
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb4f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ebad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ebcc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ebea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14000ec05
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
int3
call fcn.140004a70
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80004005
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
nop
mov ecx, 0x80070057
call fcn.140002a90
int3