Function at 0x140007c60
Capabilities:
Create process on windows
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x14004a040]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rsi, rdx
mov qword [rbp - 0x70], rdx
movsxd rdi, ecx
xor r14d, r14d
cmp edi, 2
jge 0x140007cec
lea rdx, str.Too_few_arguments_n.
lea rcx, [0x14004bc00]
call fcn.14000b410
lea rdx, str.Usage:_RunInSandbox.exe__aclimihi__ProgID___g__n
lea rcx, [0x14004bc00]
call fcn.14000b410
lea rdx, str.Usage:_RunInSandbox.exe__aclimihi__ExePathURL_n
lea rcx, [0x14004bc00]
call fcn.14000b410
lea eax, [r14 - 1]
jmp 0x1400089e0
lea rdx, str.Host_is_running_in
lea rcx, [0x14004b9a0]
call fcn.14000ba20
mov rbx, rax
mov rcx, 0xfffffffffffffffc
call fcn.140003f70
test eax, eax
je 0x140007d60
sub eax, 1
je 0x140007d51
sub eax, 0x41
je 0x140007d42
sub eax, 1
je 0x140007d33
cmp eax, 1
jne 0x140008a16
lea rdx, str.high_IL
jmp 0x140007d67
mov r8d, 9
lea rdx, str.medium_IL
jmp 0x140007d6d
mov r8d, 6
lea rdx, str.low_IL
jmp 0x140007d6d
mov r8d, 0xc
lea rdx, str.AppContainer
jmp 0x140007d6d
lea rdx, str.default
mov r8d, 7
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
lea rcx, [rbp + 0x30]
call fcn.14000c000
nop
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, rbx
call fcn.14000e380
mov rcx, rax
lea rdx, [0x140041ff0]
call fcn.14000b410
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x140007df0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007deb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a1c
call fcn.140011900
mov rdx, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140007e10
lea rcx, [rsp + 0x68]
call fcn.14000c000
lea rcx, [rsp + 0x68]
call fcn.140003020
mov dword [rsp + 0x60], eax
mov ecx, r14d
test eax, eax
setne cl
inc ecx
mov ebx, ecx
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov rdx, qword [rsi + rcx*8]
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], r14
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140007e70
lea rcx, [rbp + 0x70]
call fcn.14000c000
nop
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0xf0]
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
shr eax, 0x1f
xor al, 1
mov dword [rsp + 0x58], eax
mov rdx, qword [rsi + rbx*8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140007ed0
lea rcx, [rbp + 0x30]
call fcn.14000c000
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], r14
mov r8d, 4
cmp qword [rbp + 0x40], r8
cmovb r8, qword [rbp + 0x40]
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0x90]
call fcn.14000c000
lea r8, [rbp + 0x90]
mov r10, qword [rbp + 0xa8]
cmp r10, 7
seta r11b
mov r9, qword [rbp + 0x90]
cmova r8, r9
mov rdx, qword [rbp + 0xa0]
cmp rdx, 4
jne 0x140007f7e
lea rcx, str.http
test rdx, rdx
je 0x140007f77
sub r8, rcx
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140007f7e
add rcx, 2
sub rdx, 1
jne 0x140007f63
mov byte [rsp + 0x50], 1
jmp 0x140007f83
mov byte [rsp + 0x50], 0
test r11b, r11b
je 0x140007fbe
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140007fb5
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a22
mov rcx, r9
call fcn.140011900
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x140007ffe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ff9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a2e
call fcn.140011900
lea r14d, [rbx + 1]
xor r15b, r15b
xor r13b, r13b
mov esi, r14d
mov r12, rdi
mov ebx, 1
cmp rsi, rdi
jae 0x1400081f5
mov rdi, qword [rbp - 0x70]
lea rbx, [0x1400422ec]
mov rdx, qword [rdi + rsi*8]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xor eax, eax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rax
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], ax
jne 0x140008050
lea rcx, [rbp + 0xb0]
call fcn.14000c000
lea r8, [rbp + 0xb0]
mov r10, qword [rbp + 0xc8]
cmp r10, 7
seta r11b
mov r9, qword [rbp + 0xb0]
cmova r8, r9
cmp qword [rbp + 0xc0], 2
jne 0x1400080b8
mov edx, 2
mov rcx, rbx
sub r8, rbx
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400080b8
add rcx, 2
sub rdx, 1
jne 0x1400080a0
mov bl, 1
jmp 0x1400080ba
xor bl, bl
test r11b, r11b
je 0x1400080f4
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x1400080ec
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a2e
mov rcx, r9
call fcn.140011900
test bl, bl
je 0x140008105
mov r13b, 1
mov ebx, 1
jmp 0x1400081e6
mov rdx, qword [rdi + rsi*8]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xor eax, eax
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], rax
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], ax
jne 0x140008130
lea rcx, [rbp + 0xd0]
call fcn.14000c000
lea r8, [rbp + 0xd0]
mov r10, qword [rbp + 0xe8]
cmp r10, 7
seta r11b
mov r9, qword [rbp + 0xd0]
cmova r8, r9
cmp qword [rbp + 0xe0], 2
jne 0x14000819b
mov edx, 2
lea rax, [0x1400422f4]
mov rcx, rax
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000819b
add rcx, 2
sub rdx, 1
jne 0x140008183
mov bl, 1
jmp 0x14000819d
xor bl, bl
test r11b, r11b
je 0x1400081d7
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x1400081cf
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a2e
mov rcx, r9
call fcn.140011900
movzx r15d, r15b
test bl, bl
mov ebx, 1
cmovne r15d, ebx
inc r14d
inc rsi
cmp rsi, r12
jl 0x140008020
cmp byte [rsp + 0x58], 0
je 0x14000840c
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rdx - 3]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rdi, rax
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea edx, [r14 - 1]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x140008a28
lea rdx, str.Enabling_OLE_drag_and_drop._n
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x58]
call fcn.14000e2e0
test eax, eax
js 0x140008a34
mov rbx, qword [rsp + 0x58]
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x140008298
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
nop
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ole32.dll_RegisterDragDrop]
test eax, eax
js 0x140008a7a
test rbx, rbx
je 0x1400082ba
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
lea rdx, str.Creating_COM_object
lea rcx, [0x14004b9a0]
call fcn.14000b410
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x80]
mov rcx, rax
call fcn.14000e380
lea rdx, str._in
mov rcx, rax
call fcn.14000b410
mov rbx, rax
mov esi, dword [rsp + 0x60]
mov edx, esi
test esi, esi
je 0x140008357
sub edx, 1
je 0x140008348
sub edx, 0x41
je 0x140008339
sub edx, 1
je 0x14000832a
cmp edx, 1
jne 0x140008ac0
lea rdx, str.high_IL
jmp 0x14000835e
mov r8d, 9
lea rdx, str.medium_IL
jmp 0x140008364
mov r8d, 6
lea rdx, str.low_IL
jmp 0x140008364
mov r8d, 0xc
lea rdx, str.AppContainer
jmp 0x140008364
lea rdx, str.default
mov r8d, 7
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
lea rcx, [rbp + 0x30]
call fcn.14000c000
nop
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rdx, qword [rbp + 0x30]
mov rcx, rbx
call fcn.14000b410
mov rcx, rax
lea rdx, str...._n
call fcn.14000b410
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x1400083e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008ac6
call fcn.140011900
movaps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x20], rdi
movzx r9d, r13b
movzx r8d, r15b
mov edx, esi
lea rcx, [rbp - 0x70]
call fcn.1400073f0
jmp 0x140008983
lea rcx, [0x14004b9a0]
cmp byte [rsp + 0x50], 0
je 0x140008522
lea rdx, str.Opening_URL
call fcn.14000b410
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x80]
mov rcx, rax
call fcn.14000e380
mov rcx, rax
lea rdx, str._in_default_browser_n
call fcn.14000ba20
mov rcx, 0xfffffffffffffffc
call fcn.140003f70
cmp eax, 0x42
jne 0x14000847d
lea rdx, str.WARNING:_Does_not_seem_to_work_in_low_integrity__n
lea rcx, [0x14004b9a0]
call fcn.14000b410
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova r8, qword [rbp + 0x70]
mov dword [rsp + 0x28], ebx
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
cmp eax, 0x20
jg 0x140008983
lea rdx, str.ShellExecute_failed_with_code
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov edx, ebx
mov rcx, rax
call fcn.140009440
mov rcx, rax
call fcn.14000b6d0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14000851b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008516
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a10
call fcn.140011900
mov eax, ebx
jmp 0x1400089e0
lea rdx, str.Starting_executable
call fcn.14000b410
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x80]
mov rcx, rax
call fcn.14000e380
lea rdx, str._in
mov rcx, rax
call fcn.14000b410
mov rbx, rax
mov r13d, dword [rsp + 0x60]
mov edx, r13d
test r13d, r13d
je 0x1400085bb
sub edx, 1
je 0x1400085ac
sub edx, 0x41
je 0x14000859d
sub edx, 1
je 0x14000858e
cmp edx, 1
jne 0x140008acc
lea rdx, str.high_IL
jmp 0x1400085c2
mov r8d, 9
lea rdx, str.medium_IL
jmp 0x1400085c8
mov r8d, 6
lea rdx, str.low_IL
jmp 0x1400085c8
mov r8d, 0xc
lea rdx, str.AppContainer
jmp 0x1400085c8
lea rdx, str.default
mov r8d, 7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x50]
call fcn.14000c000
nop
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rdx, qword [rbp + 0x50]
mov rcx, rbx
call fcn.14000b410
mov rcx, rax
lea rdx, str...._n
call fcn.14000b410
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x140008649
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008644
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008ad2
call fcn.140011900
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
xor eax, eax
mov esi, eax
mov qword [rbp - 0x50], rax
movsxd rdi, r14d
cmp rdi, r12
jge 0x140008733
mov rbx, qword [rbp - 0x58]
mov r14, qword [rbp - 0x70]
nop dword [rax]
mov rdx, qword [r14 + rdi*8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140008690
lea rcx, [rbp + 0x50]
call fcn.14000c000
nop
cmp rbx, rsi
je 0x1400086cc
xor eax, eax
movups xmm0, xmmword [rbp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x60]
movups xmmword [rbx + 0x10], xmm1
lea edx, [rax + 7]
mov word [rbp + 0x50], ax
add rbx, 0x20
mov qword [rbp - 0x58], rbx
jmp 0x1400086e8
lea r8, [rbp + 0x50]
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.14000e640
mov rsi, qword [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x140008724
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000871f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008ad8
call fcn.140011900
inc rdi
cmp rdi, r12
jge 0x140008733
xor eax, eax
jmp 0x140008670
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp - 0x40], 0x70
xor esi, esi
mov qword [rsp + 0x58], rsi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [rsi + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140011c68
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140033dd0
mov qword [rbp + 0x28], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [rsi + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov ecx, eax
call fcn.140002ce0
nop
mov ebx, esi
mov qword [rbp - 0x70], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
cmp r13d, 1
jne 0x140008856
lea ecx, [rsi + 0x20]
call fcn.140011908
mov qword [rsp + 0x58], rax
mov rcx, rax
call fcn.140002d70
mov rbx, rax
mov qword [rbp - 0x70], rax
mov dword [rbp + 0x64], esi
mov rax, qword [rax]
mov qword [rbp + 0x50], rax
mov rdx, qword [rbx + 0x10]
sub rdx, qword [rbx + 8]
sar rdx, 4
mov eax, esi
test rdx, rdx
cmovne rax, qword [rbx + 8]
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x60], edx
movups xmm0, xmmword [rbp + 0x50]
movups xmmword [rbp + 0x30], xmm0
movsd xmm1, qword [rbp + 0x60]
movsd qword [rbp + 0x40], xmm1
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x18
lea r9, [rbp + 0x30]
xor edx, edx
mov r8d, 0x20009
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x140008af8
mov r13d, esi
lea r8, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova r8, qword [rbp + 0x70]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
call fcn.1400051b0
nop
test r15b, r15b
je 0x1400088a7
lea rdx, str.Process_created_in_suspended_mode._You_can_now_attach_a_debugger_for_investigation_of_startup_problems._nPress_any_key_to_continue.
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rcx, rax
call fcn.14000b6d0
call fcn.140008da0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
lea rdi, vtable.Microsoft::WRL::Wrappers::HandleT_struct_Microsoft::WRL::Wrappers::HandleTraits::HANDLENullTraits_.0
mov qword [rsp + 0x78], rdi
cmp qword [rbp - 0x80], 0
je 0x1400088db
lea rcx, [rsp + 0x78]
call fcn.140009140
test al, al
je 0x140008ade
mov qword [rbp - 0x80], rsi
mov qword [rsp + 0x68], rdi
cmp qword [rsp + 0x70], 0
je 0x1400088ff
lea rcx, [rsp + 0x68]
call fcn.140009140
test al, al
je 0x140008b42
mov qword [rsp + 0x70], rsi
test rbx, rbx
je 0x14000891a
mov rcx, rbx
call fcn.140002f60
mov edx, 0x20
mov rcx, rbx
call fcn.140011900
nop
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140008936
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rbp + 0x28]
call fcn.140011900
mov qword [rbp + 0x28], rsi
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x140008983
mov rdx, qword [rbp - 0x58]
mov rcx, rbx
call fcn.14000ca70
mov rdx, qword [rbp - 0x50]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000897b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008b5c
mov rcx, rbx
call fcn.140011900
lea rdx, str._done_
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rcx, rax
call fcn.14000b6d0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x1400089de
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400089d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008a10
call fcn.140011900
xor eax, eax
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1400118e0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001d3f4
int3
call fcn.1400185d4
int3
call fcn.14001d3f4
nop
call fcn.14001d3f4
nop
call fcn.1400185d4
int3
call fcn.14001d3f4
int3
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140002ad0
nop
lea rcx, [rsp + 0x68]
call fcn.140002b90
mov rbx, rax
lea rdx, str.ERROR:
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rcx, rax
mov rdx, rbx
call fcn.14000b410
mov rcx, rax
call fcn.140009650
call fcn.1400185d4
nop
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140002ad0
nop
lea rcx, [rsp + 0x68]
call fcn.140002b90
mov rbx, rax
lea rdx, str.ERROR:
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rcx, rax
mov rdx, rbx
call fcn.14000b410
mov rcx, rax
call fcn.140009650
call fcn.1400185d4
nop
call fcn.1400185d4
int3
call fcn.14001d3f4
int3
call fcn.1400185d4
int3
call fcn.14001d3f4
nop
call fcn.14001d3f4
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140008af0
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.140002cc0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x50]
call fcn.140002ad0
nop
lea rdx, str.ERROR:
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rbx, rax
lea rcx, [rbp + 0x50]
call fcn.140002b90
mov rdx, rax
mov rcx, rbx
call fcn.14000b410
mov rcx, rax
call fcn.140009650
call fcn.1400185d4
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140008b54
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.140002cc0
nop
call fcn.14001d3f4
int3