Function at 0x14000cc28
Capabilities:
Copy file
Get keyboard layout
Query environment variable
Query or enumerate registry value
Set environment variable
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f8]
sub rsp, 0x5d0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov r15, rcx
mov qword [rbp - 0x48], rcx
call fcn.14004b6f4
nop
lea r14, [r15 + 0x128]
mov rdx, r15
mov rcx, r14
call fcn.1400f13d4
nop
lea r13, [r15 + 0x188]
mov rcx, r13
call fcn.140054fc0
nop
lea rsi, [r15 + 0x1d8]
mov rcx, rsi
call fcn.140056510
nop
lea rdi, [r15 + 0x218]
mov rcx, rdi
call fcn.14002d0c0
nop
lea rbx, [r15 + 0x260]
mov rcx, rbx
call fcn.14002fc90
nop
lea r12, [r15 + 0x4d8]
mov rdx, r15
mov rcx, r12
call fcn.14003bd8c
nop
lea rax, vtable.CConEmuMain.0
mov qword [r15], rax
lea rax, vtable.CConEmuMain.1.0
mov qword [r14], rax
lea rax, vtable.CConEmuMain.2.0
mov qword [r13], rax
lea rax, vtable.CConEmuMain.3.0
mov qword [rsi], rax
lea rax, vtable.CConEmuMain.4.0
mov qword [rdi], rax
lea rax, vtable.CConEmuMain.5.0
mov qword [rbx], rax
lea rax, vtable.CConEmuMain.6.0
mov qword [r12], rax
xor r13d, r13d
mov word [r15 + 0xa80], r13w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r15 + 0xa82], xmm0
movups xmmword [r15 + 0xa92], xmm0
movups xmmword [r15 + 0xaa2], xmm0
mov qword [r15 + 0xab2], rax
mov qword [r15 + 0xaba], rax
movups xmmword [r15 + 0xac2], xmm0
mov qword [r15 + 0xad2], rax
mov qword [r15 + 0xada], rax
lea rcx, [r15 + 0xae2]
mov ebx, 0x208
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
lea rdi, [r15 + 0xcea]
mov word [rdi], r13w
lea rcx, [r15 + 0xcec]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
lea rsi, [r15 + 0xef4]
mov word [rsi], r13w
lea rcx, [r15 + 0xef6]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
mov word [r15 + 0x10fe], r13w
lea rcx, [r15 + 0x1100]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
mov word [r15 + 0x1308], r13w
lea rcx, [r15 + 0x130a]
xor edx, edx
lea r8d, [r13 + 0x4e]
call fcn.14012d4b0
mov byte [r15 + 0x1358], r13b
mov qword [r15 + 0x1360], r13
mov word [r15 + 0x1368], r13w
lea rcx, [r15 + 0x136a]
xor edx, edx
lea r8d, [rbx - 2]
call fcn.14012d4b0
lea rcx, [r15 + 0x1570]
call fcn.140114c40
nop
lea rcx, [r15 + 0x1580]
call fcn.140114c40
nop
mov qword [r15 + 0x1590], r13
mov qword [r15 + 0x1598], r13
mov qword [r15 + 0x15a0], r13
mov byte [r15 + 0x15a8], r13b
mov dword [r15 + 0x15ac], r13d
mov word [r15 + 0x15b0], r13w
mov dword [r15 + 0x15b4], 0xff
mov word [r15 + 0x15b9], r13w
lea r14, [r15 + 0x15bc]
mov word [r14], r13w
lea rcx, [r15 + 0x15be]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
mov word [r15 + 0x17c6], r13w
lea rcx, [r15 + 0x17c8]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
lea r12, [r15 + 0x19d0]
mov word [r12], r13w
lea rcx, [r15 + 0x19d2]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
lea r13, [r15 + 0x1bda]
xor eax, eax
mov word [r13], ax
lea rcx, [r15 + 0x1bdc]
mov ebx, 0x21e
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
xor ecx, ecx
mov word [r15 + 0x1dfa], cx
lea rcx, [r15 + 0x1dfc]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
mov dword [r15 + 0x201a], 0x13c6
lea rcx, [r15 + 0x201e]
xor edx, edx
mov r8d, 0x13c2
call fcn.14012d4b0
xor ebx, ebx
mov qword [r15 + 0x33e0], rbx
mov dword [r15 + 0x33f0], ebx
mov qword [r15 + 0x33e8], rbx
or eax, 0xffffffff
mov dword [r15 + 0x33f4], eax
mov word [r15 + 0x33f8], bx
mov word [r15 + 0x34fc], bx
mov dword [r15 + 0x34f8], ebx
mov qword [r15 + 0x3910], rbx
mov dword [r15 + 0x3920], ebx
mov qword [r15 + 0x3918], rbx
mov dword [r15 + 0x3924], eax
mov word [r15 + 0x3928], bx
mov word [r15 + 0x3a2c], bx
mov dword [r15 + 0x3a28], ebx
mov byte [r15 + 0x3e40], bl
mov qword [r15 + 0x3e58], rbx
mov qword [r15 + 0x3e68], rbx
mov qword [r15 + 0x3e70], rbx
mov qword [r15 + 0x3e98], rbx
mov qword [r15 + 0x3ea0], rbx
mov dword [r15 + 0x3ea8], ebx
xorps xmm0, xmm0
movups xmmword [r15 + 0x3eac], xmm0
movups xmmword [r15 + 0x3ebc], xmm0
mov qword [r15 + 0x3ecc], rbx
mov byte [r15 + 0x3ed4], bl
xor eax, eax
movups xmmword [r15 + 0x3ed6], xmm0
mov word [r15 + 0x3ee6], ax
mov dword [r15 + 0x3ee8], ebx
mov qword [r15 + 0x3eec], rax
mov dword [r15 + 0x3ef4], ebx
xor ecx, ecx
mov qword [r15 + 0x3ef8], rcx
mov dword [r15 + 0x3f00], ebx
or rax, 0xffffffffffffffff
mov qword [r15 + 0x3f08], rax
mov qword [r15 + 0x3f10], rax
xor eax, eax
mov qword [r15 + 0x3f18], rax
mov dword [r15 + 0x3f20], ebx
mov word [r15 + 0x3f24], bx
movups xmmword [r15 + 0x3f28], xmm0
mov qword [r15 + 0x3f38], rax
mov qword [r15 + 0x3f40], rbx
lea rcx, [r15 + 0x3f48]
xor edx, edx
mov r8d, 0x830
call fcn.14012d4b0
mov byte [r15 + 0x4779], bl
mov qword [r15 + 0x4780], rbx
mov byte [r15 + 0x4788], bl
mov dword [r15 + 0x478c], ebx
xorps xmm0, xmm0
movups xmmword [r15 + 0x4790], xmm0
mov qword [r15 + 0x47a0], rbx
mov dword [r15 + 0x47a8], ebx
mov dword [r15 + 0x47ac], 1
movups xmmword [r15 + 0x47b0], xmm0
mov byte [r15 + 0x47c0], bl
mov dword [r15 + 0x47c4], ebx
movups xmmword [r15 + 0x47c8], xmm0
mov dword [r15 + 0x47d8], ebx
mov byte [r15 + 0x47dc], bl
mov qword [r15 + 0x4808], rbx
mov qword [r15 + 0x4810], rbx
mov qword [r15 + 0x4818], rbx
mov qword [r15 + 0x4820], rbx
mov qword [r15 + 0x4828], rbx
mov word [r15 + 0x4830], bx
mov dword [r15 + 0x4834], ebx
mov word [r15 + 0x4838], bx
lea rcx, [r15 + 0x4840]
call fcn.140057080
nop
mov word [r15 + 0x4c68], bx
lea rcx, [r15 + 0x4c6a]
xor edx, edx
mov r8d, 0x97e
call fcn.14012d4b0
mov word [r15 + 0x55e8], bx
lea rcx, [r15 + 0x55ea]
xor edx, edx
mov r8d, 0xfe
call fcn.14012d4b0
or rax, 0xffffffffffffffff
mov word [r15 + 0x56e8], ax
mov dword [r15 + 0x56ea], ebx
mov qword [r15 + 0x56f0], rbx
mov qword [r15 + 0x56f8], rbx
mov dword [r15 + 0x5700], ebx
xor eax, eax
mov qword [r15 + 0x5704], rax
mov dword [r15 + 0x570c], eax
mov byte [r15 + 0x5710], bl
mov dword [r15 + 0x5714], ebx
mov qword [r15 + 0x5718], rbx
mov qword [r15 + 0x5720], rbx
lea rcx, [r15 + 0x5728]
xor edx, edx
mov r8d, 0x2150
call fcn.14012d4b0
mov word [r15 + 0x7878], bx
mov byte [r15 + 0x787a], bl
mov word [r15 + 0x787c], bx
lea rcx, [r15 + 0x787e]
xor edx, edx
mov r8d, 0x206
call fcn.14012d4b0
mov byte [r15 + 0x7a84], bl
mov qword [r15 + 0x7a88], rbx
mov byte [r15 + 0x7a90], bl
mov dword [r15 + 0x7a94], ebx
mov qword [r15 + 0x7a98], rbx
mov byte [r15 + 0x7aa0], bl
mov dword [r15 + 0x7aa4], ebx
mov byte [r15 + 0x7aa8], bl
mov qword [r15 + 0x7ab0], rbx
mov qword [r15 + 0x7ab8], rbx
mov qword [r15 + 0x7ac0], rbx
mov qword [r15 + 0x7ac8], rbx
mov qword [r15 + 0x7ad0], rbx
xor eax, eax
mov qword [r15 + 0x7ad8], rax
mov dword [r15 + 0x7ae0], ebx
or rax, 0xffffffffffffffff
mov dword [r15 + 0x7ae4], eax
mov word [r15 + 0x7ae8], bx
mov byte [r15 + 0x7aea], bl
mov qword [r15 + 0x7af0], rbx
mov qword [r15 + 0x7b00], rbx
mov qword [r15 + 0x7b08], rbx
mov qword [r15 + 0x7b10], rbx
mov qword [r15 + 0x7b18], rbx
mov dword [r15 + 0x7bc0], ebx
xorps xmm0, xmm0
movups xmmword [r15 + 0x7bc8], xmm0
movups xmmword [r15 + 0x7bd8], xmm0
mov dword [r15 + 0x7be8], ebx
mov qword [r15 + 0x7bf0], rbx
mov qword [r15 + 0x7bf8], rbx
mov qword [r15 + 0x7c00], rbx
mov qword [r15 + 0x7c08], rbx
mov qword [r15 + 0x7c10], rbx
lea rbx, [r15 + 0x7c18]
mov qword [rsp + 0x40], rbx
call fcn.140113da0
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
xor ebx, ebx
mov qword [r15 + 0x7c30], rbx
xorps xmm0, xmm0
movups xmmword [r15 + 0x7c38], xmm0
mov qword [r15 + 0x7c48], rax
mov qword [r15 + 0x7c50], rbx
mov qword [r15 + 0x7c58], rbx
lea rcx, [r15 + 0x7c60]
lea edx, [rax + 2]
call fcn.14012a85c
nop
mov qword [0x14022a9e0], r15
call fcn.140104008
call fcn.14002bef0
lea ecx, [rbx + 0x30]
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d34f
mov dl, 1
mov rcx, rax
call fcn.14011b65c
jmp 0x14000d352
mov rax, rbx
mov qword [r15 + 0x3e78], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov r8d, 8
lea rdx, [0x1401759d0]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
cmp word [rbp - 0x30], bx
je 0x14000d38a
cmp word [rbp - 0x2e], bx
lea rax, [0x140175b8c]
jne 0x14000d391
lea rax, [0x1401759d0]
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd
mov r9d, 7
lea r8d, [r9 + 0xd]
lea rdx, [0x140175b90]
lea rbx, [r15 + 0xac0]
mov rcx, rbx
call fcn.14000c788
lea rax, [0x1401759d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rbx
lea rdx, [0x1401788e0]
lea rcx, [r15 + 0xa80]
call fcn.1400011a0
mov rcx, r15
call fcn.14001eec8
mov ecx, 0xc0
call fcn.140113d08
mov qword [rsp + 0x40], rax
xor ebx, ebx
test rax, rax
je 0x14000d417
mov rcx, rax
call fcn.14006d678
jmp 0x14000d41a
mov rax, rbx
mov qword [r15 + 0x3e48], rax
mov ecx, 0xff00
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d442
mov rdx, r15
mov rcx, rax
call fcn.1400e44ec
jmp 0x14000d445
mov rax, rbx
mov qword [r15 + 0x3e60], rax
mov ecx, 0xac8
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d46a
mov rcx, rax
call fcn.1400e91d0
jmp 0x14000d46d
mov rax, rbx
mov qword [r15 + 0x3e50], rax
mov ecx, 0xd0
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d492
mov rcx, rax
call fcn.140042c08
jmp 0x14000d495
mov rax, rbx
mov qword [r15 + 0x3e80], rax
mov ecx, 0x18
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d4ba
mov rcx, rax
call fcn.14004cf94
jmp 0x14000d4bd
mov rax, rbx
mov qword [r15 + 0x3e88], rax
mov ecx, 0x60
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d4e2
mov rcx, rax
call fcn.1400bea84
jmp 0x14000d4e5
mov rax, rbx
mov qword [r15 + 0x3e90], rax
mov ecx, 0x28
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d50d
mov rdx, r15
mov rcx, rax
call fcn.140003adc
jmp 0x14000d510
mov rax, rbx
mov qword [r15 + 0x5718], rax
mov ecx, 8
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d535
mov rcx, rax
call fcn.1400563e4
jmp 0x14000d538
mov rax, rbx
mov qword [r15 + 0x3e98], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [r15 + 0x7af8], eax
mov eax, 0x601
cmp word [0x1401f11c0], ax
jne 0x14000d5ac
mov ecx, 0x10
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d578
mov rcx, rax
call fcn.140116c08
jmp 0x14000d57b
mov rax, rbx
mov qword [r15 + 0x7c40], rax
mov ecx, 0x30
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d5a2
mov dl, 1
mov rcx, rax
call fcn.14011b65c
jmp 0x14000d5a5
mov rax, rbx
mov qword [r15 + 0x7c38], rax
mov ecx, 0x30
call fcn.140113d08
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d5cc
mov dl, 1
mov rcx, rax
call fcn.14011b65c
jmp 0x14000d5cf
mov rax, rbx
mov qword [r15 + 0x7c30], rax
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x47e0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x47e8], rax
mov edx, 0x7f86
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x47f8], rax
mov edx, 0x7f01
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4800], rax
mov edx, 0x7f8a
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x47f0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x7c
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4808], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x7e
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4810], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x7d
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [r15 + 0x4818], rax
lea rcx, [r15 + 0x3ef8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [r15 + 0x7af8]
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [r15 + 0x5720], rax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d6d6
lea rdx, str.GetLayeredWindowAttributes
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14000d6d9
mov rax, rbx
mov qword [r15 + 0x7bf0], rax
mov eax, 0x501
cmp word [0x1401f11c0], ax
jb 0x14000d79c
lea rcx, str.Imm32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [r15 + 0x7bf8], rax
test rax, rax
je 0x14000d79c
lea rdx, str.ImmSetCompositionFontW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x7c00], rax
lea rdx, str.ImmSetCompositionWindow
mov rcx, qword [r15 + 0x7bf8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x7c08], rax
lea rdx, str.ImmGetContext
mov rcx, qword [r15 + 0x7bf8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15 + 0x7c10], rax
cmp qword [r15 + 0x7c00], rbx
je 0x14000d773
cmp qword [r15 + 0x7c08], rbx
je 0x14000d773
test rax, rax
jne 0x14000d79c
mov qword [r15 + 0x7c00], rbx
mov qword [r15 + 0x7c08], rbx
mov qword [r15 + 0x7c10], rbx
mov rcx, qword [r15 + 0x7bf8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [r15 + 0x7bf8], rbx
lea rcx, [rbp - 0x40]
call fcn.14000c66c
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rcx + 8]
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [r15 + 0x7c50], rax
mov rbx, qword [r15 + 0x7c58]
mov qword [r15 + 0x7c58], rdx
or rcx, 0xffffffffffffffff
test rbx, rbx
je 0x14000d803
mov eax, ecx
lock xadd dword [rbx + 8], eax
add eax, ecx
jne 0x14000d803
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rbx + 0xc], eax
add eax, ecx
jne 0x14000d803
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.COMCTL32.dll_CreateMappedBitmap]
or rcx, 0xffffffffffffffff
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x14000d837
mov eax, ecx
lock xadd dword [rbx + 8], eax
add eax, ecx
jne 0x14000d837
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rbx + 0xc], eax
add eax, ecx
jne 0x14000d837
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.COMCTL32.dll_CreateMappedBitmap]
mov rcx, qword [r15 + 0x7c50]
call fcn.1400e87d0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbx, [r15 + 0x1368]
test eax, eax
jne 0x14000d8b8
mov dword [rsp + 0x48], 0x206
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ComSpec
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
test eax, eax
je 0x14000d8ad
mov word [rbx], cx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp word [rbx], ax
jne 0x14000d8cf
xor r8d, r8d
mov edx, 0x104
mov rcx, rbx
call fcn.140115c84
lea rcx, [rsp + 0x50]
call fcn.140114c40
nop
lea rcx, [rsp + 0x68]
call fcn.140114c40
nop
mov ebx, 0x104
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140114fb4
mov rdx, rax
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
test eax, eax
je 0x14000deed
lea edx, [rbx + 0x5c]
mov rcx, qword [rsp + 0x50]
call fcn.14012dd3c
test rax, rax
je 0x14000deed
lea rcx, [rsp + 0x50]
call fcn.140054ee8
mov rcx, rax
call fcn.140123700
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140114cd0
lea rcx, [rsp + 0x68]
call fcn.140054ee8
mov rcx, rax
xor edx, edx
call fcn.140115770
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x50]
test al, al
cmove rcx, rdx
call fcn.140054ee8
mov rdx, rax
lea rbx, [r15 + 0xae0]
mov rcx, rbx
call fcn.14000c940
mov rdx, rbx
mov rcx, rdi
call fcn.14000c940
mov edx, 0x5c
mov rcx, rdi
call fcn.14012dd3c
xor ecx, ecx
test rax, rax
je 0x14000d9a5
mov word [rax], cx
xor edx, edx
mov rcx, r15
call fcn.140022924
lea rcx, [rsp + 0x78]
call fcn.140114c40
nop
lea rdx, [rsp + 0x78]
lea rbx, [r15 + 0x4d8]
mov rcx, rbx
call fcn.14003c414
test al, al
je 0x14000d9db
bts dword [r15 + 0x15ac], 0xc
mov rdx, rdi
mov rcx, rsi
call fcn.14000c940
lea r8, [0x140178a68]
mov edx, 0x105
mov rcx, rsi
call fcn.140001e48
mov rcx, r15
call fcn.14000f038
xor edx, edx
test al, al
jne 0x14000dabd
mov rdx, rdi
mov rcx, rsi
call fcn.14000c940
mov rcx, r15
call fcn.14000f038
xor edx, edx
test al, al
jne 0x14000dabd
mov edx, 0x5c
mov rcx, rdi
call fcn.14012dd3c
mov rbx, rax
xor edx, edx
test rax, rax
je 0x14000dab6
lea rdx, str._bin
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
test eax, eax
jne 0x14000dab6
sub rbx, r15
sub rbx, 0xcea
sar rbx, 1
lea r8, [rbx + rbx]
mov rdx, rdi
mov rcx, rsi
call fcn.14012d940
xor eax, eax
mov word [r15 + rbx*2 + 0xef4], ax
lea r8, str.libexecConEmu
mov edx, 0x105
mov rcx, rsi
call fcn.140001e48
mov rcx, r15
call fcn.14000f038
xor edx, edx
test al, al
je 0x14000daa9
or dword [r15 + 0x15ac], 1
jmp 0x14000dab6
mov rdx, rdi
mov rcx, rsi
call fcn.14000c940
xor edx, edx
lea rbx, [r15 + 0x4d8]
mov eax, dword [r15 + 0x15ac]
shr eax, 0xc
test al, 1
je 0x14000db11
xor r8d, r8d
lea rdx, str.....git_bash.exe
mov rcx, rdi
call fcn.1401186ec
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x78]
call fcn.140114cd0
lea rcx, [rsp + 0x78]
call fcn.140054ee8
mov rcx, rax
xor edx, edx
call fcn.140115770
xor edx, edx
test al, al
je 0x14000db11
or dword [r15 + 0x15ac], 5
mov eax, dword [r15 + 0x15ac]
mov ecx, 0x1001
and eax, ecx
cmp eax, ecx
jne 0x14000db2f
xor edx, edx
mov rcx, rbx
call fcn.14003f590
xor edx, edx
test byte [r15 + 0x15ac], 1
jne 0x14000dc3d
lea rax, str...AppInfoLauncherConEmuPortable.ini
mov qword [rbp - 0x58], rax
lea rax, str...DefaultData_settingsConEmu.xml
mov qword [rbp - 0x50], rax
mov rbx, rdx
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.140004824
mov r8, qword [rbp + rbx*8 - 0x58]
mov edx, 0x144
lea rcx, [rbp + 0x20]
call fcn.140001e48
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.140115770
test al, al
je 0x14000dc3d
inc rbx
cmp rbx, 2
jb 0x14000db56
mov rdx, rdi
mov rcx, r14
call fcn.14000c940
mov edx, 0x5c
mov rcx, r14
call fcn.14012dd3c
xor ebx, ebx
test rax, rax
je 0x14000dc3f
mov word [rax], bx
lea edx, [rbx + 0x5c]
mov rcx, r14
call fcn.14012dd3c
test rax, rax
je 0x14000dc2c
mov word [rax], bx
lea r8, [0x140178b74]
mov edx, 0x105
mov rcx, r14
call fcn.140001e48
mov rcx, r14
call fcn.140123044
test al, al
jne 0x14000dbf2
mov rcx, r14
call fcn.140123a38
lea r8, str.ConEmu.xml
mov edx, 0x105
mov rcx, r14
call fcn.140001e48
xor edx, edx
mov rcx, r14
call fcn.140115770
test al, al
jne 0x14000dc24
xor r8d, r8d
mov rdx, r14
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
or dword [r15 + 0x15ac], 2
mov eax, dword [r15 + 0x15ac]
test al, 2
jne 0x14000dc3f
mov word [r14], bx
jmp 0x14000dc3f
xor ebx, ebx
mov byte [r15 + 0x15b8], bl
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000dc88
mov r8d, 0x20
lea rdx, [rbp - 0x20]
lea rcx, str.ConEmuBlockChildDebuggers
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000dc88
lea rdx, [0x140178be8]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
sete al
mov byte [r15 + 0x15b8], al
xor edx, edx
lea rcx, str.ConEmuBlockChildDebuggers
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call fcn.14011e4a8
mov byte [r15 + 0x47dc], al
mov rdx, rdi
lea rcx, str.ConEmuDir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rsi
lea rcx, str.ConEmuBaseDir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
mov rcx, rsi
call fcn.1401160b8
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140114b38
nop
lea rcx, [rbp - 0x68]
call fcn.14011513c
mov rdx, qword [rbp - 0x68]
test al, al
cmovne rdx, rsi
lea rcx, str.ConEmuBaseDirShort
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [r15 + 0xac0]
lea rcx, str.ConEmuBuild
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea r14, [0x1401759d0]
mov rdx, r14
lea rcx, str.ConEmuConfig
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuCfgDir
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuArgs
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuArgs2
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [r15 + 0x47dc]
lea r9, str.ADMIN
neg al
sbb rdx, rdx
and rdx, r9
lea rcx, str.ConEmuIsAdmin
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuArgs
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.ConEmuArgs2
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, 0x104
lea rdx, [rbp + 0x2b0]
mov rcx, rdi
call fcn.1401175e8
mov rdx, rax
lea rcx, str.ConEmuDrive
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
mov rcx, r15
call fcn.1400109e0
mov rcx, r15
call fcn.1400108c8
mov rdx, rsi
mov rcx, r12
call fcn.14000c940
lea rdx, str.ConEmu.chm
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, r12
call fcn.140115770
test al, al
jne 0x14000de3d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14000de38
mov rdx, rdi
mov rcx, r12
call fcn.14000c940
lea rdx, str.ConEmu.chm
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, r12
call fcn.140115770
test al, al
jne 0x14000de3d
mov word [r12], bx
mov rdx, rsi
mov rcx, r13
call fcn.14000c98c
lea r8, [0x140177440]
mov edi, 0x110
mov edx, edi
mov rcx, r13
call fcn.140001e48
call fcn.140116890
test al, al
je 0x14000deb3
mov rdx, rsi
lea rbx, [r15 + 0x1dfa]
mov rcx, rbx
call fcn.14000c98c
lea r8, [0x140177420]
mov edx, edi
mov rcx, rbx
call fcn.140001e48
xor edx, edx
mov rcx, rbx
call fcn.140115770
test al, al
jne 0x14000de9d
mov rcx, rbx
jmp 0x14000deba
xor edx, edx
mov rcx, r13
call fcn.140115770
test al, al
jne 0x14000dec2
mov rdx, rbx
mov rcx, r13
jmp 0x14000debd
lea rcx, [r15 + 0x1dfa]
mov rdx, r13
call fcn.14000c98c
mov rcx, r15
call fcn.14000f104
lea rcx, [r15 + 0x188]
call fcn.140055374
nop
lea rcx, [rbp - 0x68]
call fcn.140114ca4
nop
lea rcx, [rsp + 0x78]
call fcn.140114ca4
jmp 0x14000df1b
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.GetModuleFileName_failed
call fcn.140113304
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x68]
call fcn.140114ca4
nop
lea rcx, [rsp + 0x50]
call fcn.140114ca4
nop
mov rax, r15
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret