Function at 0x140023208
Capabilities:
Check for time delay via gettickcount
Connect pipe
Create pipe
Create process on windows
Get common file path
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Resume thread
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x978
mov qword [rsp + 0x460], 0xfffffffffffffffe
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov rbx, r9
mov qword [rsp + 0x270], r8
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x68], rdx
mov rdi, qword [rsp + 0x9c8]
lea rcx, [rsp + 0x278]
call fcn.140063500
nop
mov rdx, qword [rsp + 0x68]
xor esi, esi
cmp rdx, rsi
je 0x140023290
lea rcx, [rsp + 0x278]
call fcn.140071480
mov r11, qword [rsp + 0x278]
mov qword [rsp + 0x68], r11
lea rcx, [rsp + 0x68]
call fcn.14005b560
lea rcx, [rsp + 0x138]
call fcn.140063500
nop
cmp rbx, rsi
je 0x1400232bb
mov rdx, rbx
lea rcx, [rsp + 0x138]
call fcn.140071480
mov rbx, qword [rsp + 0x138]
lea rax, [rsp + 0x430]
cmp rdi, rsi
cmovne rax, rdi
mov qword [rsp + 0x360], rax
mov rbp, qword [rsp + 0x68]
mov qword [rsp + 0xb0], rbp
mov rax, rbp
xor edi, edi
cmp rbp, rdi
cmove rax, rbx
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
mov byte [rsp + 0x70], dil
mov byte [rsp + 0x76], dil
mov byte [rsp + 0xea], dil
mov byte [rsp + 0x72], dil
mov byte [rsp + 0xe9], dil
mov byte [rsp + 0xd9], dil
mov byte [rsp + 0xa5], dil
mov byte [rsp + 0x75], dil
mov byte [rsp + 0xe8], dil
mov byte [rsp + 0xd8], dil
lea rcx, [rsp + 0x130]
call fcn.140063500
nop
mov dword [rsp + 0x280], edi
mov dword [rsp + 0x284], edi
mov byte [rsp + 0x74], dil
mov byte [rsp + 0x71], dil
mov byte [rsp + 0xa4], dil
mov byte [rsp + 0x78], dil
mov byte [rsp + 0x73], 1
mov byte [rsp + 0xeb], dil
mov dword [rsp + 0x90], edi
mov dword [rsp + 0xc8], edi
lea rcx, [rsp + 0x140]
call fcn.140063500
nop
mov dword [rsp + 0x120], edi
mov sil, dil
mov byte [rsp + 0x60], dil
lea rcx, [rsp + 0xe0]
call fcn.140063500
nop
lea rcx, [rsp + 0x108]
call fcn.140063500
nop
lea rcx, [rsp + 0xf0]
call fcn.140063500
nop
mov byte [rsp + 0xa6], dil
mov qword [rsp + 0x370], rdi
or dword [rsp + 0x1d0], 0xffffffff
lea rcx, [rsp + 0x160]
call fcn.140063500
nop
mov qword [rsp + 0x228], rdi
mov qword [rsp + 0x1e0], rdi
mov dword [rsp + 0x4e0], 0x68
mov qword [rsp + 0x4e8], rdi
xor edx, edx
lea r8d, [rdi + 0x58]
lea rcx, [rsp + 0x4f0]
call fcn.14010c6c0
xor edx, edx
lea r8d, [rdi + 0x68]
lea rcx, [rsp + 0x548]
call fcn.14010c6c0
mov qword [rsp + 0x320], rdi
xor eax, eax
mov qword [rsp + 0x328], rax
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], rax
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x348], rax
mov qword [rsp + 0x128], rdi
lea eax, [rdi + 3]
mov dword [rsp + 0x7c], eax
cmp rbx, rdi
je 0x14002348e
test byte [section.flag_dat], al
je 0x1400234b2
lea rdx, str.WinSta0Default
lea rcx, [rsp + 0x128]
call fcn.140071480
mov r11, qword [rsp + 0x128]
mov qword [rsp + 0x4f0], r11
mov eax, 0x24
cmp rbx, rdi
je 0x1400234d1
cmp ax, word [rbx]
jne 0x1400234d1
mov dword [rsp + 0x9c0], 1
mov byte [rsp + 0x72], 1
mov edx, 0x7c
xor eax, eax
lea r10d, [rdx - 0x5c]
lea r8d, [rdx - 0x4f]
lea r11d, [rdx - 0x73]
lea r9d, [rdx - 0x7a]
cmp rbx, rax
je 0x140023635
cmp dx, word [rbx]
jne 0x14002350b
mov rcx, qword [rsp + 0x68]
add rcx, r9
mov qword [rsp + 0x68], rcx
add rbx, r9
lea edi, [rdx - 0x7b]
jmp 0x140023510
mov rcx, qword [rsp + 0x68]
cmp rbx, rax
je 0x140023635
mov eax, 0x2a
cmp ax, word [rbx]
jne 0x140023635
add rcx, r9
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], 0x10
cmp dx, word [rcx]
jne 0x140023544
add rcx, r9
mov qword [rsp + 0x68], rcx
lea edi, [rax - 0x29]
mov eax, 0x31
cmp ax, word [rcx]
jne 0x14002355d
add rcx, r9
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], 0x11
jmp 0x140023590
movzx eax, word [rcx]
or ax, r10w
mov edx, 0x6e
cmp dx, ax
jne 0x14002357d
add rcx, r9
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], 0x12
jmp 0x140023590
cmp r8w, word [rcx]
jne 0x140023590
add rcx, r9
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], 0x14
cmp r11w, word [rcx]
ja 0x1400235a4
mov eax, 0xd
cmp word [rcx], ax
jbe 0x140023635
cmp r10w, word [rcx]
je 0x140023635
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0x278]
call fcn.14005b520
mov eax, 1
jmp 0x140029248
lea rcx, [rsp + 0x68]
call fcn.14005b560
xor edx, edx
lea r9d, [rdx + 0x3d]
cmp byte [rsp + 0x70], dl
je 0x1400237ea
mov dword [rsp + 0x9c0], 1
mov rcx, qword [rsp + 0x68]
mov rbx, rcx
movzx eax, word [rcx]
cmp ax, dx
je 0x1400291c6
mov r8d, 2
cmp ax, r9w
je 0x140023685
add rbx, r8
mov ax, word [rbx]
cmp ax, dx
jne 0x140023674
cmp rbx, rcx
je 0x1400291c6
cmp r9w, word [rbx]
jne 0x1400291c6
sub rbx, r8
mov eax, 0x2b
cmp ax, word [rbx]
jne 0x1400236ae
mov al, byte [rbx]
mov byte [rsp + 0x74], al
sub rbx, r8
mov rax, rbx
cmp rbx, rcx
jbe 0x1400236e9
mov ebp, 0x20
lea esi, [rbp - 0x13]
lea r10d, [rbp - 0x17]
cmp r10w, word [rax]
ja 0x1400236cd
cmp word [rax], si
jbe 0x1400236d2
cmp bp, word [rax]
jne 0x1400236da
sub rax, r8
cmp rax, rcx
ja 0x1400236c2
mov sil, byte [rsp + 0x60]
mov rbp, qword [rsp + 0xb0]
jmp 0x1400236ef
mov r10d, 9
cmp r10w, word [rax]
ja 0x140023707
mov r11d, 0xd
cmp word [rax], r11w
jbe 0x14002913f
jmp 0x14002370d
mov r11d, 0xd
mov r9d, 0x20
cmp r9w, word [rax]
je 0x14002913f
mov rdx, rax
add rax, r8
cmp rdx, rcx
jbe 0x140023746
lea r8, [rdx - 2]
cmp r10w, word [r8]
ja 0x140023738
cmp word [r8], r11w
jbe 0x140023746
cmp r9w, word [r8]
je 0x140023746
mov rdx, r8
cmp r8, rcx
ja 0x140023728
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0xe0]
call fcn.140063740
xor r8d, r8d
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x98]
call fcn.14001c9cc
mov rax, qword [rsp + 0x98]
xor ecx, ecx
cmp byte [rax + 0xba], cl
jne 0x14002378c
test byte [rax + 0xf], 0xf
je 0x1400237a1
xor r8d, r8d
lea rdx, [rsp + 0xe0]
mov rcx, rax
call fcn.14001c9cc
xor ecx, ecx
movzx eax, word [rbx]
cmp ax, cx
je 0x1400237c3
mov edx, 0x3d
cmp ax, dx
je 0x1400237d1
mov eax, 2
add rbx, rax
mov ax, word [rbx]
cmp ax, cx
jne 0x1400237ae
mov eax, 0x3d
cmp word [rbx], ax
jne 0x1400290b6
lea rax, [rbx + 2]
mov qword [rsp + 0x370], rax
lea rcx, [rsp + 0x370]
call fcn.14005b560
lea rcx, [rsp + 0x68]
call fcn.14005b560
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0xb8], rbx
xor eax, eax
cmp qword [rsp + 0x228], rax
je 0x140023817
cmp byte [rsp + 0x70], al
jne 0x140023ae8
mov edx, 0x2d
cmp dx, word [rbx]
jne 0x140023837
lea rcx, [rbx + 2]
mov rax, rbx
cmp dx, word [rcx]
cmove rax, rcx
mov qword [rsp + 0xb8], rax
mov r8d, 1
lea rdx, [rsp + 0xb8]
lea rcx, [0x140147298]
call fcn.140065780
xor r8d, r8d
cmp al, r8b
jne 0x140023ae8
mov rax, qword [rsp + 0xb8]
lea edx, [r8 + 0x2d]
cmp dx, word [rax]
je 0x14002387a
lea ecx, [rdx + 2]
cmp cx, word [rax]
jne 0x140023ae8
add rax, 2
mov qword [rsp + 0xb8], rax
mov r8d, 5
lea rdx, [rsp + 0xb8]
lea rcx, str.catch
call fcn.1400657f0
xor edx, edx
cmp al, dl
je 0x1400238c8
mov cl, byte [rsp + 0x70]
mov al, cl
or cl, 0x10
mov byte [rsp + 0x70], cl
cmp al, dl
je 0x140023add
mov rax, qword [rsp + 0xb8]
jmp 0x140023a7a
mov r8d, 4
mov rdx, qword [rsp + 0xb8]
lea rcx, str.cmd:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x140023966
add qword [rsp + 0xb8], 8
lea r9, [rsp + 0x1d0]
lea r8, [rsp + 0x160]
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x98]
call fcn.14001e050
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0xb8]
cmp rbx, rax
jae 0x140023955
mov esi, 2
lea ebp, [rsi + 0x1e]
mov word [rbx], bp
add rbx, rsi
mov rax, qword [rsp + 0xb8]
cmp rbx, rax
jb 0x140023935
mov sil, byte [rsp + 0x60]
mov rbp, qword [rsp + 0xb0]
xor edx, edx
cmp byte [rsp + 0x70], dl
jne 0x140023ae8
jmp 0x140023a7a
mov r8d, 3
mov rdx, qword [rsp + 0xb8]
lea rcx, [0x140147284]
call fcn.14005c510
xor edx, edx
cmp al, dl
je 0x1400239bc
mov rax, qword [rsp + 0xb8]
add rax, 6
mov qword [rsp + 0xb8], rax
lea ecx, [rdx + 0x2a]
cmp cx, word [rax]
jne 0x140023a32
lea r8d, [rdx + 2]
add rax, r8
mov qword [rsp + 0xb8], rax
cmp cx, word [rax]
je 0x1400239aa
jmp 0x140023a38
mov r8d, 4
mov rdx, qword [rsp + 0xb8]
lea rcx, str.exe:
call fcn.14005c510
xor edx, edx
cmp al, dl
je 0x1400239f6
mov rax, qword [rsp + 0xb8]
add rax, 8
mov qword [rsp + 0xb8], rax
lea r8d, [rdx + 2]
jmp 0x140023a38
mov r8d, 5
mov rdx, qword [rsp + 0xb8]
lea rcx, str.logs:
call fcn.14005c510
xor edx, edx
cmp al, dl
je 0x140023a72
mov rax, qword [rsp + 0xb8]
lea ecx, [rdx + 0xa]
add rax, rcx
mov qword [rsp + 0xb8], rax
lea r8d, [rdx + 2]
jmp 0x140023a38
mov r8d, 2
mov r9d, 0x22
cmp word [rax], r9w
jne 0x140023a7a
add rax, r8
mov qword [rsp + 0xb8], rax
movzx ecx, word [rax]
cmp cx, dx
je 0x140023ac3
add rax, r8
mov qword [rsp + 0xb8], rax
cmp r9w, cx
je 0x140023a7a
mov cx, word [rax]
cmp cx, dx
jne 0x140023a57
jmp 0x140023a7a
mov rax, qword [rsp + 0xb8]
movzx ecx, word [rax]
cmp cx, dx
je 0x140023ac3
mov esi, 2
lea ebp, [rsi + 0xb]
lea r8d, [rsi + 0x1e]
lea r9d, [rsi + 7]
cmp r9w, cx
ja 0x140023a9d
cmp cx, bp
jbe 0x140023ab6
cmp r8w, cx
je 0x140023ab6
add rax, rsi
mov qword [rsp + 0xb8], rax
mov cx, word [rax]
cmp cx, dx
jne 0x140023a92
mov sil, byte [rsp + 0x60]
mov rbp, qword [rsp + 0xb0]
lea rcx, [rsp + 0xb8]
call fcn.14005b560
mov rbx, qword [rsp + 0xb8]
jmp 0x140023817
mov r9d, 0x3d
jmp 0x14002364f
lea rcx, [rsp + 0x68]
call fcn.14005b560
mov rdx, qword [rsp + 0x228]
xor r8d, r8d
cmp rdx, r8
je 0x140023b16
movzx eax, word [rdx]
neg ax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0x228], rcx
cmp edi, r8d
jne 0x140023b31
cmp qword [rsp + 0x9d0], r8
jne 0x140023b31
mov bl, r8b
mov byte [rsp + 0x84], bl
jmp 0x140023b3a
mov bl, 1
mov byte [rsp + 0x84], bl
mov qword [rsp + 0x388], r8
mov qword [rsp + 0x2b8], r8
mov qword [rsp + 0x150], r8
mov qword [rsp + 0x170], r8
mov qword [rsp + 0x88], r8
lea rcx, [rsp + 0x1a8]
call fcn.140063500
nop
lea rcx, [rsp + 0x190]
call fcn.140063500
nop
lea rcx, [rsp + 0x1c0]
call fcn.140063500
nop
xor r8d, r8d
mov qword [rsp + 0x110], r8
mov qword [rsp + 0x180], r8
cmp bl, r8b
jne 0x140023bd8
cmp rbp, r8
jne 0x140023bd8
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x180]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x98]
call fcn.14006d870
mov r11, qword [rsp + 0x180]
mov qword [rsp + 0x68], r11
mov ebx, 3
mov rdi, qword [rsp + 0x68]
mov edx, 0x2d
cmp dx, word [rdi]
jne 0x140023bff
lea rcx, [rdi + 2]
mov rax, rdi
cmp dx, word [rcx]
cmove rax, rcx
mov qword [rsp + 0x68], rax
mov r8d, 1
lea rdx, [rsp + 0x68]
lea rcx, [0x140147298]
call fcn.140065780
xor r8d, r8d
cmp al, r8b
jne 0x140024ab8
mov rcx, qword [rsp + 0x68]
lea edx, [r8 + 0x2d]
cmp dx, word [rcx]
je 0x140023c3c
lea eax, [rdx + 2]
cmp ax, word [rcx]
jne 0x140024abd
add rcx, 2
mov qword [rsp + 0x68], rcx
mov r8d, 5
lea rdx, [rsp + 0x68]
lea rcx, str.catch
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x140023c6e
mov byte [rsp + 0x70], 0x10
jmp 0x140023bdd
mov r8d, 6
mov rdx, qword [rsp + 0x68]
lea rcx, str.clone:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x140023d02
mov rax, qword [rsp + 0x68]
add rax, 0xc
mov qword [rsp + 0x68], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140023ceb
lea r9d, [r8 + 2]
lea r10d, [r8 + 0x20]
lea r11d, [r8 + 9]
cmp r11w, cx
ja 0x140023cc3
mov ebx, 0xd
cmp cx, bx
jbe 0x140023cdc
cmp r10w, cx
je 0x140023cdc
add rax, r9
mov qword [rsp + 0x68], rax
mov cx, word [rax]
cmp cx, r8w
je 0x140023ceb
jmp 0x140023cb3
cmp word [rax], r8w
je 0x140023ceb
mov word [rax], r8w
add qword [rsp + 0x68], r9
cmp word [rdx], r8w
je 0x140024836
mov qword [rsp + 0x1e0], rdx
jmp 0x140024836
mov r8d, 9
mov rdx, qword [rsp + 0x68]
lea rcx, str.runrmenu:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x140023d9e
mov rax, qword [rsp + 0x68]
add rax, 0x12
mov qword [rsp + 0x68], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140023d79
lea ebp, [r8 + 2]
lea esi, [rbp + 0xb]
lea r9d, [r8 + 0x20]
lea r10d, [r8 + 9]
cmp r10w, cx
ja 0x140023d55
cmp cx, si
jbe 0x140023d6c
cmp r9w, cx
je 0x140023d6c
add rax, rbp
mov qword [rsp + 0x68], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x140023d4a
mov sil, byte [rsp + 0x60]
mov rbp, qword [rsp + 0xb0]
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0x130]
call fcn.140063740
lea rcx, [rsp + 0x68]
call fcn.14005b560
jmp 0x140023bdd
mov r8d, 8
mov rdx, qword [rsp + 0x68]
lea rcx, str.poprmenu
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x140023ebf
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x288], rax
movzx ecx, word [rax]
xor edi, edi
cmp cx, di
je 0x140023e23
lea edx, [rdi + 2]
lea r8d, [rdi + 0x20]
lea r9d, [rdi + 9]
cmp r9w, cx
ja 0x140023dfe
mov r10d, 0xd
cmp cx, r10w
jbe 0x140023e16
cmp r8w, cx
je 0x140023e16
add rax, rdx
mov qword [rsp + 0x68], rax
mov cx, word [rax]
cmp cx, di
je 0x140023e23
jmp 0x140023dec
cmp word [rax], di
je 0x140023e23
add rax, rdx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
call fcn.14005b560
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov byte [rsp + 0xe8], 1
mov rax, qword [rsp + 0x288]
cmp word [rax], di
je 0x140023e68
cmp word [rax], 0x30
jb 0x140023e5c
cmp word [rax], 0x39
jbe 0x140023e68
add rax, 2
mov qword [rsp + 0x288], rax
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x288]
call fcn.140066e40
mov r11, qword [rsp + 0x288]
cmp word [r11], di
je 0x140023ea5
cmp word [r11], 0x30
jb 0x140023e99
cmp word [r11], 0x39
jbe 0x140023ea5
add r11, 2
mov qword [rsp + 0x288], r11
lea rdx, [rsp + 0x284]
lea rcx, [rsp + 0x288]
call fcn.140066e40
jmp 0x140023bdd
mov r8d, 4
mov rdx, qword [rsp + 0x68]
lea rcx, str.pid:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x140023f62
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x68], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140024836
lea ebp, [r8 + 2]
lea esi, [rbp + 0xb]
lea r9d, [r8 + 0x20]
lea r10d, [r8 + 9]
cmp r10w, cx
ja 0x140023f1a
cmp cx, si
jbe 0x140023f31
cmp r9w, cx
je 0x140023f31
add rax, rbp
mov qword [rsp + 0x68], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x140023f0f
cmp rdx, rax
mov sil, byte [rsp + 0x60]
mov rbp, qword [rsp + 0xb0]
je 0x140024836
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0x1a8]
call fcn.140063740
jmp 0x140024836
mov r8d, 4
mov rdx, qword [rsp + 0x68]
lea rcx, str.exe:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x140024028
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x3b8], rax
xor edi, edi
mov dword [rsp + 0x2c8], edi
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x2c8]
lea rcx, [rsp + 0x3b8]
call fcn.140036bcc
mov qword [rsp + 0x68], rax
mov r8d, dword [rsp + 0x2c8]
cmp r8d, edi
jle 0x140024836
mov rdx, qword [rsp + 0x3b8]
lea rcx, [rsp + 0x150]
call fcn.140063740
mov rbx, qword [rsp + 0x150]
mov qword [rsp + 0x170], rbx
lea eax, [rdi + 0x2a]
cmp ax, word [rbx]
jne 0x140024836
cmp word [rbx + 2], di
jne 0x140024836
lea rcx, [rsp + 0x150]
call fcn.14001e1dc
mov qword [rsp + 0x170], rax
jmp 0x140024836
mov r8d, ebx
mov rdx, qword [rsp + 0x68]
lea rcx, [0x140147284]
call fcn.14005c510
xor ecx, ecx
cmp al, cl
je 0x140024194
xor edi, edi
mov ebx, edi
mov rax, qword [rsp + 0x68]
add rax, 6
mov qword [rsp + 0x68], rax
lea edx, [rcx + 0x2a]
cmp word [rax], dx
jne 0x140024072
lea ecx, [rdi + 2]
inc ebx
add rax, rcx
mov qword [rsp + 0x68], rax
cmp word [rax], dx
je 0x140024063
mov qword [rsp + 0x3c8], rax
mov dword [rsp + 0x218], edi
mov eax, 2
cmp ebx, eax
jge 0x14002413b
lea r8d, [rax - 1]
lea rdx, [rsp + 0x218]
lea rcx, [rsp + 0x3c8]
call fcn.140036bcc
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x218]
cmp eax, edi
jle 0x1400240e8
mov r8d, eax
mov rdx, qword [rsp + 0x3c8]
lea rcx, [rsp + 0x110]
call fcn.140063740
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x88], rcx
mov eax, dword [rsp + 0x218]
jmp 0x1400240f0
mov rcx, qword [rsp + 0x110]
cmp ebx, 1
jne 0x140024836
cmp eax, edi
jle 0x140024836
mov qword [rsp + 0x438], rcx
mov qword [rsp + 0x110], rdi
mov r8d, ebx
lea rdx, [rsp + 0x110]
call fcn.14006f2b0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x438]
call fcn.14005b520
jmp 0x140024836
mov edx, 0x105
lea rcx, [rsp + 0x110]
call fcn.1400635c0
mov r8d, 0x104
mov rdx, qword [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp rax, rdi
je 0x14002417f
mov word [rax], di
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x88], rax
jmp 0x140024836
mov r8d, 5
mov rdx, qword [rsp + 0x68]
lea rcx, str.logs:
call fcn.14005c510
xor ecx, ecx
cmp al, cl
je 0x140024247
mov rbx, qword [rsp + 0x68]
add rbx, 0xa
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x3d0], rbx
lea eax, [rcx + 0x3f]
mov edi, ecx
cmp ax, word [rbx]
sete dil
cmp edi, ecx
je 0x1400241e7
add rbx, 2
mov qword [rsp + 0x3d0], rbx
mov dword [rsp + 0x1cc], ecx
mov r8d, 1
lea rdx, [rsp + 0x1cc]
lea rcx, [rsp + 0x3d0]
call fcn.140036bcc
mov qword [rsp + 0x68], rax
mov r8d, dword [rsp + 0x1cc]
xor eax, eax
cmp r8d, eax
jle 0x140024836
cmp edi, eax
je 0x140024232
cmp qword [0x14019c058], rax
je 0x140024836
mov rdx, rbx
lea rcx, [rsp + 0x140]
call fcn.140063740
jmp 0x140024836
mov r8d, 5
lea rdx, [rsp + 0x68]
lea rcx, str.nowin
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x140024271
mov byte [rsp + 0xd8], 1
jmp 0x140023bdd
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, str.hide
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x14002429f
mov eax, 0x10000000
mov dword [rsp + 0x90], eax
jmp 0x140023bdd
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, [0x14014722c]
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400242cc
mov dword [rsp + 0x9c0], 1
jmp 0x140023bdd
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x140147228]
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400242f0
or byte [rsp + 0x76], 1
jmp 0x140023bdd
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, str.err
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x140024316
or byte [rsp + 0x76], bl
jmp 0x140023bdd
mov r8d, 5
lea rdx, [rsp + 0x68]
lea rcx, str.limit
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x140024340
mov byte [rsp + 0xd9], 1
jmp 0x140023bdd
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x140147214]
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x140024367
mov byte [rsp + 0xa5], 1
jmp 0x140023bdd
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, str.hook
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x14002438e
mov byte [rsp + 0x72], 1
jmp 0x140023bdd
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x140147208]
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400243b8
mov dword [rsp + 0x90], 6
jmp 0x140023bdd
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x140147204]
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400243de
mov dword [rsp + 0x90], ebx
jmp 0x140023bdd
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, str.show
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x14002440a
lea edx, [rcx + 1]
mov dword [rsp + 0x90], edx
jmp 0x140023bdd
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, str.runs
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x140024434
mov byte [rsp + 0xe9], 1
jmp 0x140023bdd
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, str.no64
call fcn.140065780
xor ecx, ecx
cmp al, cl
jne 0x140023bdd
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x1401471e8]
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x14002447c
mov byte [rsp + 0xea], 1
jmp 0x140023bdd
mov r8d, 5
lea rdx, [rsp + 0x68]
lea rcx, str.incmd
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400244a3
mov byte [rsp + 0x78], 1
jmp 0x140023bdd
mov r8d, 7
lea rdx, [rsp + 0x68]
lea rcx, str.hidecmd
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400244ca
mov byte [rsp + 0x73], 1
jmp 0x140023bdd
mov r8d, 8
lea rdx, [rsp + 0x68]
lea rcx, str.hidecmd_
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x1400244f3
mov byte [rsp + 0x73], r8b
jmp 0x140023bdd
mov r8d, ebx
mov rdx, qword [rsp + 0x68]
lea rcx, [0x1401471c4]
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x1400245a9
mov rax, qword [rsp + 0x68]
add rax, 6
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x75], 1
lea ecx, [r8 + 0x3a]
cmp cx, word [rax]
jne 0x140024836
lea r9d, [r8 + 2]
add rax, r9
mov qword [rsp + 0x68], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140024836
lea ebp, [r8 + 0xd]
lea r10d, [r8 + 0x20]
lea r11d, [r8 + 9]
cmp r11w, cx
ja 0x140024566
cmp cx, bp
jbe 0x14002457d
cmp r10w, cx
je 0x14002457d
add rax, r9
mov qword [rsp + 0x68], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x14002455b
cmp rdx, rax
mov rbp, qword [rsp + 0xb0]
je 0x140024836
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0x190]
call fcn.140063740
jmp 0x140024836
mov r8d, 5
mov rdx, qword [rsp + 0x68]
lea rcx, str.code:
call fcn.14005c510
xor ecx, ecx
cmp al, cl
je 0x1400246c8
mov rax, qword [rsp + 0x68]
add rax, 0xa
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x1f8], rax
or r8d, 0xffffffff
lea rdx, [rsp + 0x1f8]
lea rcx, str.UTF8
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x14002461c
mov sil, 1
mov byte [rsp + 0x60], sil
mov dword [rsp + 0x120], 0xfde9
lea edx, [r8 + 2]
jmp 0x140024a42
or r8d, 0xffffffff
lea rdx, [rsp + 0x1f8]
lea rcx, str.ANSI
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x140024655
mov sil, 1
mov byte [rsp + 0x60], sil
mov dword [rsp + 0x120], r8d
lea edx, [r8 + 2]
jmp 0x140024a42
or r8d, 0xffffffff
lea rdx, [rsp + 0x1f8]
lea rcx, [0x1401471a8]
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x140024690
lea edx, [r8 + 2]
mov sil, dl
mov byte [rsp + 0x60], dl
mov dword [rsp + 0x120], 0x4b0
jmp 0x140024a42
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x1f8]
call fcn.140066e40
xor r8d, r8d
cmp eax, r8d
jle 0x1400246be
mov sil, 1
mov byte [rsp + 0x60], sil
lea edx, [r8 + 2]
jmp 0x140024a42
mov edx, 2
jmp 0x140024a42
mov r8d, 5
mov rdx, qword [rsp + 0x68]
lea rcx, str.user:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14002476e
mov rax, qword [rsp + 0x68]
lea ecx, [r8 + 0xa]
add rax, rcx
mov qword [rsp + 0x68], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140024836
lea ebp, [r8 + 2]
lea esi, [rbp + 0xb]
lea r9d, [r8 + 0x20]
lea r10d, [r8 + 9]
cmp r10w, cx
ja 0x140024726
cmp cx, si
jbe 0x14002473d
cmp r9w, cx
je 0x14002473d
add rax, rbp
mov qword [rsp + 0x68], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x14002471b
cmp rdx, rax
mov sil, byte [rsp + 0x60]
mov rbp, qword [rsp + 0xb0]
je 0x140024836
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0x108]
call fcn.140063740
jmp 0x140024836
mov r8d, 7
mov rdx, qword [rsp + 0x68]
lea rcx, str.passwd:
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x140024797
mov byte [rsp + 0xa6], r8b
jmp 0x1400247c2
mov r8d, 7
mov rdx, qword [rsp + 0x68]
lea rcx, str.passwd
call fcn.14005c510
xor r8d, r8d
cmp al, r8b
je 0x14002484a
mov byte [rsp + 0xa6], 1
mov rax, qword [rsp + 0x68]
add rax, 0xe
mov qword [rsp + 0x68], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140024836
mov ebp, 2
lea esi, [rbp + 0xb]
lea r9d, [rbp + 0x1e]
lea r10d, [rbp + 7]
cmp r10w, cx
ja 0x1400247f7
cmp cx, si
jbe 0x14002480e
cmp r9w, cx
je 0x14002480e
add rax, rbp
mov qword [rsp + 0x68], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x1400247ec
cmp rdx, rax
mov sil, byte [rsp + 0x60]
mov rbp, qword [rsp + 0xb0]
je 0x140024836
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0xf0]
call fcn.140063740
lea rcx, [rsp + 0x68]
call fcn.14005b560
mov ebx, 3
jmp 0x140023bdd
mov r8d, 8
lea rdx, [rsp + 0x68]
lea rcx, str.REALTIME
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x140024877
mov dword [rsp + 0xc8], 0x100
jmp 0x140023bdd
mov r8d, 4
lea rdx, [rsp + 0x68]
lea rcx, str.HIGH
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400248a4
mov dword [rsp + 0xc8], 0x80
jmp 0x140023bdd
mov r8d, VariantTimeToDosDateTime
lea rdx, [rsp + 0x68]
lea rcx, str.ABOVENORMAL
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400248d1
mov dword [rsp + 0xc8], 0x8000
jmp 0x140023bdd
mov r8d, 6
lea rdx, [rsp + 0x68]
lea rcx, str.NORMAL
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400248fe
mov dword [rsp + 0xc8], 0x20
jmp 0x140023bdd
mov r8d, VariantTimeToDosDateTime
lea rdx, [rsp + 0x68]
lea rcx, str.BELOWNORMAL
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x14002492b
mov dword [rsp + 0xc8], 0x4000
jmp 0x140023bdd
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x14014714c]
call fcn.140065780
xor ecx, ecx
cmp al, cl
jne 0x140024a9e
mov rbx, qword [rsp + 0x68]
lea r8d, [rcx + 4]
mov rdx, rbx
lea rcx, [0x140147140]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor ecx, ecx
cmp eax, ecx
jne 0x1400249a5
movzx eax, word [rbx + 8]
lea edx, [rcx + 9]
cmp dx, ax
ja 0x14002497c
lea edx, [rcx + 0xd]
cmp ax, dx
jbe 0x14002498b
mov edx, 0x20
cmp dx, ax
je 0x14002498b
cmp ax, cx
jne 0x1400249a5
add qword [rsp + 0x68], 8
lea rcx, [rsp + 0x68]
call fcn.14005b560
mov ebx, 3
jmp 0x140024a9e
mov ebx, 3
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x14014713c]
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x1400249ce
mov byte [rsp + 0x71], 1
jmp 0x140023bdd
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x140147138]
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x140024a07
mov byte [rsp + 0xa4], 1
mov sil, r8b
mov byte [rsp + 0x60], r8b
mov dword [rsp + 0x120], r8d
jmp 0x140023bdd
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea rcx, [0x140147134]
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x140024a30
mov byte [rsp + 0xeb], 1
jmp 0x140023bdd
mov eax, 0x2d
cmp ax, word [rdi]
jne 0x140024aae
mov qword [rsp + 0x68], rdi
lea edx, [rax - 0x2b]
mov rax, qword [rsp + 0x68]
movzx ecx, word [rax]
cmp cx, r8w
je 0x140024a8f
mov ebp, 0x20
lea esi, [rbp - 0x17]
cmp si, cx
ja 0x140024a67
mov eax, 0xd
cmp cx, ax
jbe 0x140024a82
cmp bp, cx
je 0x140024a82
mov rax, qword [rsp + 0x68]
add rax, rdx
mov qword [rsp + 0x68], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x140024a58
mov sil, byte [rsp + 0x60]
mov rbp, qword [rsp + 0xb0]
lea rcx, [rsp + 0x68]
call fcn.14005b560
jmp 0x140023bdd
mov dword [rsp + 0xc8], 0x40
jmp 0x140023bdd
mov rcx, rdi
mov qword [rsp + 0x68], rcx
jmp 0x140024abd
mov rcx, qword [rsp + 0x68]
movzx eax, sil
cmp dword [rsp + 0x120], 0x4b0
mov esi, 2
cmove eax, esi
mov dword [rsp + 0x3a8], eax
mov rdx, qword [rsp + 0x370]
cmp rdx, r8
je 0x140024b30
mov rcx, rdx
mov qword [rsp + 0x68], rdx
mov bl, byte [rsp + 0x84]
cmp bl, r8b
jne 0x140024b37
cmp rbp, r8
jne 0x140024b37
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x180]
mov rcx, qword [rsp + 0x98]
call fcn.14006d870
mov rcx, qword [rsp + 0x180]
mov qword [rsp + 0x68], rcx
xor r8d, r8d
jmp 0x140024b37
mov bl, byte [rsp + 0x84]
mov qword [rsp + 0x240], r8
mov dword [rsp + 0x248], r8d
mov dword [rsp + 0x24c], r8d
mov qword [rsp + 0x1a0], r8
mov rdi, qword [rsp + 0x170]
cmp rdi, r8
je 0x140024b6a
cmp word [rdi], r8w
jne 0x140024b73
mov al, r8b
mov byte [rsp + 0x71], al
jmp 0x140024b77
mov al, byte [rsp + 0x71]
cmp al, r8b
je 0x140024bbf
mov edx, 0x2a
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x1a0], rax
xor ecx, ecx
cmp rax, rcx
je 0x140024ba7
mov word [rax], cx
add rax, rsi
mov qword [rsp + 0x1a0], rax
lea rdx, [rsp + 0x240]
mov rcx, rdi
call fcn.140030590
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x178], r8
mov dword [rsp + 0x94], r8d
mov rax, qword [rsp + 0x360]
mov dword [rax], 1
mov dword [rsp + 0x124], r8d
mov qword [rsp + 0x200], r8
mov qword [rsp + 0x1f0], r8
mov qword [rsp + 0x3a0], r8
mov rbp, r8
mov qword [rsp + 0x148], r8
mov rsi, r8
mov qword [rsp + 0x188], r8
mov rdi, r8
mov qword [rsp + 0x158], r8
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xd0], r8
mov qword [rsp + 0x3d8], r8
xor eax, eax
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], r8
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x3f8], rax
mov qword [rsp + 0x400], rax
mov eax, r8d
cmp qword [rsp + 0x1e0], r8
setne al
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x410], 0x18
mov qword [rsp + 0x418], r8
mov dword [rsp + 0x420], 1
mov qword [rsp + 0x1b0], r8
cmp bl, r8b
je 0x140025450
mov qword [rsp + 0x1f8], r8
mov eax, 0x7c
cmp ax, word [rcx]
jne 0x140024cf8
lea edx, [rax - 0x7a]
add rcx, rdx
mov qword [rsp + 0x68], rcx
lea edi, [rax - 0x5c]
lea ebp, [rax - 0x6f]
lea r8d, [rax - 0x73]
cmp ax, word [rcx]
je 0x140024ce0
cmp r8w, word [rcx]
ja 0x140024cdb
cmp word [rcx], bp
jbe 0x140024ce0
cmp di, word [rcx]
jne 0x140024cea
add rcx, rdx
mov qword [rsp + 0x68], rcx
jmp 0x140024ccb
mov rbp, qword [rsp + 0x148]
xor r8d, r8d
mov rdi, r8
mov rbx, rcx
mov qword [rsp + 0x268], rcx
mov r8d, eax
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdx, rax
mov qword [rsp + 0xa8], rax
xor r8d, r8d
cmp rax, r8
je 0x140024d74
mov word [rax], r8w
lea eax, [r8 + 2]
add qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa8]
call fcn.14005b560
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x1e8], rdx
xor r8d, r8d
cmp word [rdx], r8w
jne 0x140024d62
mov rcx, qword [rsp + 0x68]
lea eax, [r8 + 0x7c]
jmp 0x140024d03
cmp word [rdx], r8w
je 0x140024d74
mov al, 1
cmp word [rbx], r8w
je 0x140024d77
mov cl, al
jmp 0x140024d91
mov al, r8b
mov cl, r8b
cmp al, r8b
cmove rdx, rbx
mov qword [rsp + 0x1e8], rdx
mov qword [rsp + 0xa8], rdx
cmp cl, r8b
je 0x140024f02
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov dword [rsp + 0x440], 0x18
xor eax, eax
mov qword [rsp + 0x448], rax
mov dword [rsp + 0x450], 1
xor r9d, r9d
lea r8, [rsp + 0x440]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor ecx, ecx
cmp eax, ecx
jne 0x140024dfa
lea edx, [rcx + 1]
mov rcx, qword [rsp + 0x98]
call fcn.14002bb1c
mov dword [rsp + 0x30], 3
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0xc0]
mov r8, rbx
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
mov word [rsp + 0x84], cx
mov rax, qword [rsp + 0xd0]
cmp rax, rcx
je 0x140024e8b
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x84]
mov rax, qword [rsp + 0x98]
mov r8, rax
mov rdx, qword [rsp + 0x268]
mov rcx, rax
call fcn.140023208
mov rcx, qword [rsp + 0xd0]
xor eax, eax
cmp rcx, rax
je 0x140024e89
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
jmp 0x140024e8b
xor ecx, ecx
mov qword [rsp + 0xd0], rcx
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0xc0]
mov r8, rbx
mov rdx, qword [rsp + 0xc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r11, qword [rsp + 0xc0]
xor r8d, r8d
cmp r11, r8
je 0x140024efa
mov dword [rsp + 0xa0], 1
lea r10, [rsp + 0x4e0]
bts dword [r10 + 0x3c], 8
mov qword [r10 + 0x50], r11
mov rdx, qword [rsp + 0x1e8]
jmp 0x140024f02
mov rdx, qword [rsp + 0x1e8]
mov rax, rdx
mov qword [rsp + 0xa8], rdx
mov edx, 0x3c
lea ebx, [rdx + 2]
jmp 0x140024f1c
mov ebx, 0x3e
movzx ecx, word [rax]
cmp cx, r8w
je 0x1400253b6
mov r9d, 2
cmp cx, dx
je 0x140024f4d
cmp cx, bx
je 0x140024f4d
add rax, r9
mov qword [rsp + 0xa8], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x140024f2f
cmp word [rax], r8w
je 0x1400253b6
cmp dx, word [rax]
jne 0x1400250d8
mov word [rax], r8w
add qword [rsp + 0xa8], r9
lea rcx, [rsp + 0xa8]
call fcn.14005b560
mov rax, qword [rsp + 0xa8]
xor r8d, r8d
cmp word [rax], r8w
je 0x1400250d3
mov rdx, rax
mov qword [rsp + 0x300], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140024fd1
lea esi, [r8 + 2]
lea r10d, [r8 + 0x3c]
cmp cx, r10w
je 0x140024fc9
cmp cx, bx
je 0x140024fc9
add rax, rsi
mov qword [rsp + 0xa8], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x140024faa
mov rsi, qword [rsp + 0x188]
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0x230]
call fcn.1400712b0
nop
lea rcx, [rsp + 0x220]
call fcn.140063500
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x220]
mov rdx, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x98]
call fcn.14006d870
mov rcx, qword [rsp + 0x220]
mov qword [rsp + 0x300], rcx
call fcn.14002b47c
lea rcx, [rsp + 0x300]
call fcn.14005b560
xor ebx, ebx
cmp rbp, rbx
je 0x14002504d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
lea rax, [rsp + 0x410]
mov qword [rsp + 0x20], rax
mov r9d, 7
mov r8d, 0xc0000000
mov rdx, qword [rsp + 0x300]
lea rcx, [rsp + 0x148]
call fcn.14001c898
mov rbp, qword [rsp + 0x148]
mov qword [rsp + 0x148], rbp
lea rcx, [rsp + 0x220]
call fcn.14005b520
nop
lea rcx, [rsp + 0x230]
call fcn.14005b520
mov rax, qword [rsp + 0xa8]
xor r8d, r8d
lea ebx, [r8 + 0x3e]
lea edx, [rbx - 2]
jmp 0x1400250d8
mov edx, 0x3c
cmp bx, word [rax]
jne 0x140024f1c
mov word [rax], r8w
mov dword [rsp + 0x1cc], r8d
mov bl, 1
mov byte [rsp + 0x84], bl
mov rax, qword [rsp + 0xa8]
mov ecx, 0x32
cmp cx, word [rax - 2]
jne 0x140025124
lea edx, [rcx - 0x30]
mov bl, dl
mov byte [rsp + 0x84], dl
mov word [rax - 2], r8w
mov rax, qword [rsp + 0xa8]
jmp 0x140025129
mov edx, 2
add rax, rdx
mov qword [rsp + 0xa8], rax
mov ecx, 0x3e
cmp cx, word [rax]
jne 0x140025154
mov dword [rsp + 0x1cc], 1
add rax, rdx
mov qword [rsp + 0xa8], rax
mov ecx, 0x26
cmp cx, word [rax]
jne 0x140025172
mov bl, 3
mov byte [rsp + 0x84], bl
add rax, rdx
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa8]
call fcn.14005b560
mov rax, qword [rsp + 0xa8]
xor r8d, r8d
cmp word [rax], r8w
lea edx, [r8 + 0x3c]
je 0x140024f17
mov rdx, rax
mov qword [rsp + 0x310], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x1400251e0
lea edi, [r8 + 2]
lea r9d, [r8 + 0x3e]
lea r10d, [r8 + 0x3c]
cmp cx, r10w
je 0x1400251d8
cmp cx, r9w
je 0x1400251d8
add rax, rdi
mov qword [rsp + 0xa8], rax
mov cx, word [rax]
cmp cx, r8w
jne 0x1400251b8
mov rdi, qword [rsp + 0x158]
sub rax, rdx
sar rax, 1
mov r8d, eax
lea rcx, [rsp + 0x2c0]
call fcn.1400712b0
nop
lea rcx, [rsp + 0x2f0]
call fcn.140063500
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x2f0]
mov rdx, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x98]
call fcn.14006d870
mov rcx, qword [rsp + 0x2f0]
mov qword [rsp + 0x310], rcx
call fcn.14002b47c
lea rcx, [rsp + 0x310]
call fcn.14005b560
test bl, 1
je 0x140025270
xor ecx, ecx
cmp rsi, rcx
je 0x140025263
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov rsi, rcx
mov qword [rsp + 0x188], rcx
jmp 0x140025272
xor ecx, ecx
mov eax, 2
test al, bl
je 0x14002529e
cmp rdi, rcx
je 0x14002528b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov rdi, rcx
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x1f8], rcx
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x410]
mov qword [rsp + 0x20], rax
mov r9d, 7
mov r8d, 0x40000000
mov rdx, qword [rsp + 0x310]
lea rcx, [rsp + 0xf8]
call fcn.14001c898
mov rbx, rax
xor eax, eax
cmp rbx, rax
jne 0x140025321
lea rcx, [rsp + 0x2f0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x2c0]
call fcn.14005b520
mov rax, qword [rsp + 0xa8]
xor r8d, r8d
lea ebx, [r8 + 0x3e]
lea edx, [rbx - 2]
jmp 0x140024f1c
cmp dword [rsp + 0x1cc], eax
je 0x140025340
mov eax, 2
mov r9d, eax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [rsp + 0x84]
cmp al, 1
jne 0x140025358
mov rsi, rbx
mov qword [rsp + 0x188], rbx
jmp 0x140025384
cmp al, 3
jne 0x140025371
mov qword [rsp + 0x1f8], rbx
mov rsi, rbx
mov qword [rsp + 0x188], rbx
jmp 0x140025384
mov qword [rsp + 0x1f8], rbx
mov rdi, rbx
mov qword [rsp + 0x158], rbx
lea rcx, [rsp + 0x2f0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x2c0]
call fcn.14005b520
mov rax, qword [rsp + 0xa8]
xor r8d, r8d
lea ebx, [r8 + 0x3e]
lea edx, [rbx - 2]
jmp 0x140024f1c
cmp rbp, r8
je 0x1400253da
mov dword [rsp + 0xa0], 1
lea r10, [rsp + 0x4e0]
bts dword [r10 + 0x3c], 8
mov qword [r10 + 0x50], rbp
jmp 0x1400253e2
lea r10, [rsp + 0x4e0]
cmp rsi, r8
je 0x1400253fc
mov dword [rsp + 0xa0], 1
bts dword [r10 + 0x3c], 8
mov qword [r10 + 0x58], rsi
mov rax, qword [rsp + 0x1f8]
cmp rax, r8
je 0x14002541e
mov dword [rsp + 0xa0], 1
bts dword [r10 + 0x3c], 8
mov qword [r10 + 0x60], rax
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x98]
call fcn.14006d870
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x68], rcx
mov dil, byte [rsp + 0x80]
mov eax, 2
lea esi, [rax + 0x24]
lea ebx, [rax + 0x22]
lea rbp, [rsp + 0x4e0]
cmp word [rcx], 0x21
je 0x140025523
mov edx, 0x2a
cmp word [rcx], dx
je 0x140025523
mov edx, 0x40
cmp word [rcx], dx
jne 0x1400254c8
lea rdx, str.WinSta0WinLogon
lea rcx, [rsp + 0x128]
call fcn.140071480
mov r11, qword [rsp + 0x128]
mov qword [rbp + 0x10], r11
mov eax, 0x10000000
mov dword [rsp + 0x90], eax
inc dil
mov rcx, qword [rsp + 0x68]
mov eax, 2
jmp 0x14002552e
mov edx, 0x3d
cmp word [rcx], dx
jne 0x1400254df
mov dword [rsp + 0x9c0], 1
jmp 0x14002552e
cmp word [rcx], bx
jne 0x1400254eb
mov byte [rsp + 0x75], 1
jmp 0x14002552e
cmp word [rcx], si
jne 0x1400254fd
mov dword [rsp + 0x90], 3
jmp 0x14002552e
cmp word [rcx], 0x5e
jne 0x140025510
mov dword [rsp + 0x90], 6
jmp 0x14002552e
cmp word [rcx], 0x5f
jne 0x14002553b
mov dword [rsp + 0x90], 6
jmp 0x14002552e
mov dword [rsp + 0x90], 0x10000000
add rcx, rax
mov qword [rsp + 0x68], rcx
jmp 0x14002546b
mov byte [rsp + 0x80], dil
xor r8d, r8d
lea rdx, [rsp + 0x4e0]
cmp qword [rdx + 0x10], r8
mov rsi, qword [rsp + 0x188]
mov rbp, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x158]
je 0x1400255a7
mov al, byte [rsp + 0x80]
test al, 1
je 0x1400255a7
call fcn.14001dfb0
cmp eax, 1
jge 0x140025597
xor r8d, r8d
lea rdx, [rsp + 0x4e0]
mov qword [rdx + 0x10], r8
mov rcx, qword [rsp + 0x68]
jmp 0x1400255a7
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
lea rdx, [rsp + 0x4e0]
mov rax, qword [rsp + 0x9d0]
cmp rax, r8
je 0x1400255d9
mov ebx, r8d
mov dword [rsp + 0x9c0], ebx
mov byte [rsp + 0x70], r8b
mov dword [rsp + 0xa0], 1
bts dword [rdx + 0x3c], 8
mov qword [rdx + 0x58], rax
jmp 0x1400255e0
mov ebx, dword [rsp + 0x9c0]
cmp byte [rsp + 0x75], r8b
je 0x140025611
mov rax, qword [rsp + 0x190]
cmp word [rax], r8w
jne 0x140025611
lea rdx, str.open
lea rcx, [rsp + 0x190]
call fcn.140071360
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov al, byte [rsp + 0xe9]
cmp al, r8b
je 0x14002580a
mov edx, 0x5c
call qword [sym.imp.SHLWAPI.dll_StrChrW]
lea rcx, [rax + 2]
mov rdx, qword [rsp + 0x68]
xor r8d, r8d
cmp rax, r8
cmovne rdx, rcx
mov qword [rsp + 0xf8], rdx
neg ebx
sbb rbx, rbx
neg rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0xf8]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbx - 0x7fffffff]
call qword [0x14019c378]
mov ebx, eax
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
xor eax, eax
cmp rcx, rax
je 0x1400256b9
cmp rcx, 0xffffffffffffffff
je 0x1400256b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xc0]
cmp rcx, rax
je 0x1400256dc
cmp rcx, 0xffffffffffffffff
je 0x1400256dc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rsp + 0xc0], rax
cmp rdi, rax
je 0x1400256fa
cmp rdi, 0xffffffffffffffff
je 0x1400256fa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp rsi, rax
je 0x140025710
cmp rsi, 0xffffffffffffffff
je 0x140025710
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp rbp, rax
je 0x140025725
cmp rbp, 0xffffffffffffffff
je 0x140025725
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
jmp 0x14002912b
lea rcx, [rsp + 0x68]
call fcn.14005b560
xor ecx, ecx
mov rbx, rcx
mov qword [rsp + 0x208], rcx
mov qword [rsp + 0x1d8], rcx
cmp qword [rsp + 0x1e0], rcx
je 0x140025c5c
mov byte [rsp + 0x75], bl
lea rcx, [rsp + 0x2d0]
call fcn.140063500
nop
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x98]
call fcn.1400307c0
cmp rax, rbx
je 0x140025ac7
mov rcx, qword [rax]
cmp word [rcx], bx
je 0x140025ac7
mov rdx, rax
lea rcx, [rsp + 0x2d0]
call fcn.1400713f0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x1d8]
call fcn.140071480
mov r11, qword [rsp + 0x140]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x208]
lea r8, [rsp + 0x150]
lea rdx, [rsp + 0x1d8]
mov rcx, qword [rsp + 0x2d0]
call fcn.140020fa0
mov ebx, eax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0x1d8]
mov qword [rsp + 0x68], rcx
xor eax, eax
cmp ebx, eax
je 0x140025aab
lea rcx, [rsp + 0x2d0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1d8]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0x208]
xor eax, eax
cmp rcx, rax
je 0x14002592f
cmp rcx, 0xffffffffffffffff
je 0x14002592f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
xor eax, eax
cmp rcx, rax
je 0x14002595a
cmp rcx, 0xffffffffffffffff
je 0x14002595a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xc0]
cmp rcx, rax
je 0x14002597d
cmp rcx, 0xffffffffffffffff
je 0x14002597d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rsp + 0xc0], rax
cmp rdi, rax
je 0x14002599b
cmp rdi, 0xffffffffffffffff
je 0x14002599b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp rsi, rax
je 0x1400259b1
cmp rsi, 0xffffffffffffffff
je 0x1400259b1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp rbp, rax
je 0x1400259c6
cmp rbp, 0xffffffffffffffff
je 0x1400259c6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
jmp 0x14002912b
lea rcx, [rsp + 0x2d0]
call fcn.14005b520
mov rbx, qword [rsp + 0x208]
xor ecx, ecx
jmp 0x140025c5c
lea rcx, [rsp + 0x2d0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1d8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
cmp rcx, rbx
je 0x140025b0a
cmp rcx, 0xffffffffffffffff
je 0x140025b0a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd0], rbx
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x140025b2b
cmp rcx, 0xffffffffffffffff
je 0x140025b2b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc0], rbx
cmp rdi, rbx
je 0x140025b48
cmp rdi, 0xffffffffffffffff
je 0x140025b48
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rsi, rbx
je 0x140025b5d
cmp rsi, 0xffffffffffffffff
je 0x140025b5d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbp, rbx
je 0x140025b72
cmp rbp, 0xffffffffffffffff
je 0x140025b72
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
mov ebx, 0x80070057
jmp 0x14002912b
mov rax, qword [rsp + 0x130]
cmp word [rax], cx
je 0x140025e85
mov rcx, qword [rsp + 0x68]
call fcn.14002e004
mov qword [rsp + 0x68], rax
mov rdx, rax
lea rcx, [rsp + 0x358]
call fcn.140071240
nop
lea rdx, [0x1401470a8]
lea rcx, [rsp + 0x358]
call fcn.140063600
mov rdx, qword [rsp + 0x130]
lea rcx, [rsp + 0x358]
call fcn.140063600
xor r8d, r8d
mov rdx, qword [rsp + 0x358]
mov rcx, qword [rsp + 0x98]
call fcn.14007bd20
mov dword [rsp + 0x100], eax
lea rcx, [rsp + 0x358]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1d8]
call fcn.14005b520
nop
xor eax, eax
cmp rbx, rax
je 0x140025d08
cmp rbx, 0xffffffffffffffff
je 0x140025d08
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
xor ebx, ebx
cmp rcx, rbx
je 0x140025d31
cmp rcx, 0xffffffffffffffff
je 0x140025d31
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd0], rbx
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x140025d52
cmp rcx, 0xffffffffffffffff
je 0x140025d52
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc0], rbx
cmp rdi, rbx
je 0x140025d6f
cmp rdi, 0xffffffffffffffff
je 0x140025d6f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rsi, rbx
je 0x140025d84
cmp rsi, 0xffffffffffffffff
je 0x140025d84
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbp, rbx
je 0x140025d99
cmp rbp, 0xffffffffffffffff
je 0x140025d99
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
mov ebx, dword [rsp + 0x100]
jmp 0x14002912b
mov al, byte [rsp + 0xe8]
cmp al, cl
je 0x14002682b
lea rcx, [rsp + 0x118]
call fcn.140063500
nop
xor eax, eax
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0x68]
call fcn.14002e004
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x260]
call fcn.140063500
nop
xor eax, eax
mov qword [rsp + 0x210], rax
lea r8, [rsp + 0x210]
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x68]
call fcn.14006f2b0
mov r11, qword [rsp + 0x210]
xor eax, eax
cmp r11, rax
jne 0x1400260bb
lea rcx, [rsp + 0x260]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1d8]
call fcn.14005b520
nop
xor eax, eax
cmp rbx, rax
je 0x140025f40
cmp rbx, 0xffffffffffffffff
je 0x140025f40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
xor ebx, ebx
cmp rcx, rbx
je 0x140025f69
cmp rcx, 0xffffffffffffffff
je 0x140025f69
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd0], rbx
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x140025f8a
cmp rcx, 0xffffffffffffffff
je 0x140025f8a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc0], rbx
cmp rdi, rbx
je 0x140025fa7
cmp rdi, 0xffffffffffffffff
je 0x140025fa7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rsi, rbx
je 0x140025fbc
cmp rsi, 0xffffffffffffffff
je 0x140025fbc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbp, rbx
je 0x140025fd1
cmp rbp, 0xffffffffffffffff
je 0x140025fd1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
mov ebx, 0x80070057
jmp 0x14002912b
mov word [r11 - 2], ax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x260]
lea rcx, [rsp + 0x350]
call fcn.140071240
nop
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0xf8], rax
mov rdx, qword [rsp + 0x210]
lea rcx, [rsp + 0x308]
call fcn.140071240
nop
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x118]
lea r8, [rsp + 0x94]
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0xf8]
call fcn.1400206f8
xor edx, edx
cmp dword [rsp + 0x94], edx
jle 0x1400261cd
mov rax, rdx
mov qword [rsp + 0x220], rdx
mov rcx, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x40]
cmp rcx, rdx
je 0x140026173
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x220], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsp + 0x284]
mov r8d, dword [rsp + 0x280]
mov edx, 0x128
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_TrackPopupMenu]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.USER32.dll_DestroyMenu]
xor r8d, r8d
cmp dword [rsp + 0x94], r8d
jle 0x140026658
mov rax, qword [rsp + 0x118]
mov rdx, rax
mov qword [rsp + 0xf8], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140026234
lea ebp, [r8 + 2]
lea r9d, [r8 + 0xd]
lea r10d, [r8 + 0xa]
cmp cx, r9w
je 0x14002622c
cmp cx, r10w
je 0x14002622c
add rax, rbp
mov cx, word [rax]
cmp cx, r8w
jne 0x140026214
mov rbp, qword [rsp + 0x148]
mov word [rax], r8w
cmp word [rdx], r8w
jne 0x140026415
lea rcx, [rsp + 0x308]
call fcn.14005b520
nop
lea rcx, [rsp + 0x350]
call fcn.14005b520
nop
lea rcx, [rsp + 0x260]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1d8]
call fcn.14005b520
nop
xor eax, eax
cmp rbx, rax
je 0x14002629f
cmp rbx, 0xffffffffffffffff
je 0x14002629f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
xor ebx, ebx
cmp rcx, rbx
je 0x1400262c8
cmp rcx, 0xffffffffffffffff
je 0x1400262c8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd0], rbx
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x1400262e9
cmp rcx, 0xffffffffffffffff
je 0x1400262e9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc0], rbx
cmp rdi, rbx
je 0x140026306
cmp rdi, 0xffffffffffffffff
je 0x140026306
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rsi, rbx
je 0x14002631b
cmp rsi, 0xffffffffffffffff
je 0x14002631b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbp, rbx
je 0x140026330
cmp rbp, 0xffffffffffffffff
je 0x140026330
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
jmp 0x14002912b
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x318]
call fcn.140071240
nop
lea rdx, [0x1401470a8]
lea rcx, [rsp + 0x318]
call fcn.140063600
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x318]
call fcn.140063600
xor r8d, r8d
mov rdx, qword [rsp + 0x318]
mov rcx, qword [rsp + 0x98]
call fcn.14007bd20
mov dword [rsp + 0x100], eax
lea rcx, [rsp + 0x318]
call fcn.14005b520
nop
lea rcx, [rsp + 0x308]
call fcn.14005b520
nop
lea rcx, [rsp + 0x350]
call fcn.14005b520
nop
lea rcx, [rsp + 0x260]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1d8]
call fcn.14005b520
nop
xor eax, eax
cmp rbx, rax
je 0x1400264db
cmp rbx, 0xffffffffffffffff
je 0x1400264db
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
xor ebx, ebx
cmp rcx, rbx
je 0x140026504
cmp rcx, 0xffffffffffffffff
je 0x140026504
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd0], rbx
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x140026525
cmp rcx, 0xffffffffffffffff
je 0x140026525
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc0], rbx
cmp rdi, rbx
je 0x140026542
cmp rdi, 0xffffffffffffffff
je 0x140026542
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rsi, rbx
je 0x140026557
cmp rsi, 0xffffffffffffffff
je 0x140026557
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbp, rbx
je 0x14002656c
cmp rbp, 0xffffffffffffffff
je 0x14002656c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
mov ebx, dword [rsp + 0x100]
jmp 0x14002912b
lea rcx, [rsp + 0x308]
call fcn.14005b520
nop
lea rcx, [rsp + 0x350]
call fcn.14005b520
nop
lea rcx, [rsp + 0x260]
call fcn.14005b520
nop
lea rcx, [rsp + 0x118]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1d8]
call fcn.14005b520
nop
xor eax, eax
cmp rbx, rax
je 0x1400266b5
cmp rbx, 0xffffffffffffffff
je 0x1400266b5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
xor ebx, ebx
cmp rcx, rbx
je 0x1400266de
cmp rcx, 0xffffffffffffffff
je 0x1400266de
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd0], rbx
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x1400266ff
cmp rcx, 0xffffffffffffffff
je 0x1400266ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc0], rbx
cmp rdi, rbx
je 0x14002671c
cmp rdi, 0xffffffffffffffff
je 0x14002671c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rsi, rbx
je 0x140026731
cmp rsi, 0xffffffffffffffff
je 0x140026731
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rbp, rbx
je 0x140026746
cmp rbp, 0xffffffffffffffff
je 0x140026746
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
jmp 0x14002912b
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x290]
call fcn.140071240
nop
mov al, byte [rsp + 0x78]
xor r8d, r8d
cmp al, r8b
je 0x1400268a0
lea rdx, [0x140147080]
lea rcx, [rsp + 0x290]
call fcn.140071480
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rsp + 0x68]
call fcn.140036bcc
mov qword [rsp + 0x68], rax
mov rdx, rax
lea rcx, [rsp + 0x290]
call fcn.140063600
lea rcx, [rsp + 0x150]
call fcn.14001e1dc
mov qword [rsp + 0x170], rax
xor r8d, r8d
jmp 0x140026cc8
mov al, byte [rsp + 0x73]
cmp al, r8b
je 0x140026cc8
mov edx, dword [rsp + 0x90]
mov eax, 0x10000000
cmp edx, eax
je 0x140026cc8
mov qword [rsp + 0xb0], r8
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x68], rax
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140036bcc
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0xb0], rcx
mov r8d, 3
lea rdx, [rsp + 0xb0]
lea rcx, [0x140147078]
call fcn.140065780
xor ecx, ecx
cmp al, cl
jne 0x140026a7b
lea r8d, [rcx + 7]
lea rdx, [rsp + 0xb0]
lea rcx, str.cmd.exe
call fcn.140065780
xor edx, edx
cmp al, dl
jne 0x140026a7b
mov rcx, qword [0x14019bd50]
cmp rcx, rdx
jne 0x1400269ac
mov word [rsp + 0x750], dx
xor r9d, r9d
lea r8d, [rdx + 0x24]
lea rdx, [rsp + 0x750]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rsp + 0x750]
lea rcx, [0x14019bd50]
call fcn.140071480
lea rdx, str.System32cmd.exe
lea rcx, [0x14019bd50]
call fcn.140063600
mov rcx, qword [0x14019bd50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [0x14019bd30], ax
mov rcx, qword [0x14019bd50]
jmp 0x1400269b3
mov ax, word [0x14019bd30]
movsx r8d, ax
mov rdx, qword [rsp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r8d, r8d
cmp eax, r8d
jne 0x140026b45
movsx rcx, word [0x14019bd30]
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + rcx*2]
lea eax, [r8 + 0x22]
cmp ax, word [rdx]
je 0x140026a11
lea r9d, [r8 + 9]
cmp r9w, word [rdx]
ja 0x140026a01
lea eax, [r8 + 0xd]
cmp word [rdx], ax
jbe 0x140026a1c
mov ecx, 0x20
cmp cx, word [rdx]
jne 0x140026b3b
jmp 0x140026a21
mov ecx, 0x20
lea r9d, [rcx - 0x17]
jmp 0x140026a21
mov ecx, 0x20
mov qword [rsp + 0xb0], rdx
movzx eax, word [rdx]
cmp ax, r8w
je 0x140026a6e
mov esi, 2
lea ebx, [rsi + 0xb]
cmp r9w, ax
ja 0x140026a45
cmp ax, bx
jbe 0x140026a5e
cmp cx, ax
je 0x140026a5e
add rdx, rsi
mov qword [rsp + 0xb0], rdx
mov ax, word [rdx]
cmp ax, r8w
jne 0x140026a3a
mov rbx, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x188]
lea rcx, [rsp + 0xb0]
call fcn.14005b560
mov r8d, 2
lea rdx, [rsp + 0xb0]
lea rcx, [0x140147044]
call fcn.140065780
xor r8d, r8d
cmp al, r8b
je 0x140026b4f
mov rax, qword [rsp + 0xb0]
lea ecx, [r8 + 0x22]
cmp cx, word [rax]
jne 0x140026b17
add rax, 2
mov qword [rsp + 0x168], rax
lea rcx, [rsp + 0x168]
call fcn.14005b560
mov rax, qword [rsp + 0x168]
mov ecx, 0x22
cmp cx, word [rax]
je 0x140026b0f
lea r8d, [rcx - 0x1e]
lea rdx, [rsp + 0x168]
lea rcx, str.call
call fcn.140065780
xor ecx, ecx
cmp al, cl
je 0x140026b05
mov rax, qword [rsp + 0x168]
jmp 0x140026b0f
mov rax, qword [rsp + 0xb0]
jmp 0x140026b17
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x68], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140036bcc
mov r11, rax
mov qword [rsp + 0xa8], rax
xor r8d, r8d
jmp 0x140026b57
mov r11, qword [rsp + 0xa8]
jmp 0x140026b57
mov r11, qword [rsp + 0xa8]
jmp 0x140026b57
mov r11, qword [rsp + 0xa8]
mov rax, r11
sub rax, qword [rsp + 0x68]
sar rax, 1
cmp eax, 4
jle 0x140026cc8
mov r8d, 4
lea rdx, str..cmd
lea rcx, [r11 - 8]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r8d, r8d
cmp eax, r8d
je 0x140026bb5
mov r8d, 4
lea rdx, str..bat
mov rcx, qword [rsp + 0xa8]
add rcx, 0xfffffffffffffff8
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
xor r8d, r8d
cmp eax, r8d
jne 0x140026cc8
mov rcx, qword [rsp + 0xa8]
movzx eax, word [rcx]
mov word [rsp + 0x78], ax
mov word [rcx], r8w
xor eax, eax
mov dword [rsp + 0x6e0], eax
mov dword [rsp + 0x6e4], eax
mov dword [rsp + 0x6e8], eax
mov qword [rsp + 0x1b8], r8
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], 0x80
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r8
lea r9d, [rax + 7]
mov r8d, 0xc0000000
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x1b8]
call fcn.14001c898
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x408]
lea r8d, [rax + 0xb]
lea rdx, [rsp + 0x6e0]
mov rdi, qword [rsp + 0x1b8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, VariantTimeToDosDateTime
lea rdx, [rsp + 0x6e0]
lea rcx, str.::hidecmd::
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
mov r11d, dword [rsp + 0x90]
xor r8d, r8d
cmp eax, r8d
mov eax, 0x10000000
cmove r11d, eax
mov dword [rsp + 0x90], r11d
mov ax, word [rsp + 0x78]
mov r11, qword [rsp + 0xa8]
mov word [r11], ax
cmp rdi, r8
je 0x140026cc0
cmp rdi, 0xffffffffffffffff
je 0x140026cb6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x158]
xor r8d, r8d
jmp 0x140026cc8
mov rdi, qword [rsp + 0x158]
jmp 0x140026cc8
mov rdi, qword [rsp + 0x158]
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x90]
mov ecx, 0x10000000
cmp eax, ecx
je 0x140026cf1
mov cl, byte [rsp + 0xeb]
cmp cl, r8b
je 0x140026d00
lea rdx, [rsp + 0x4e0]
bts dword [rdx + 0x3c], 7
jmp 0x140026d08
lea rdx, [rsp + 0x4e0]
cmp eax, r8d
je 0x140026d15
or dword [rdx + 0x3c], 1
mov word [rdx + 0x40], ax
mov eax, 3
mov cl, byte [rsp + 0x80]
and cl, al
cmp cl, al
je 0x140026d33
mov cl, byte [rsp + 0xd8]
cmp cl, r8b
je 0x140026d38
bts dword [rdx + 0x3c], 0x1b
lea rax, [0x14019c170]
mov qword [rsp + 0x1b8], rax
cmp byte [0x14019bf23], r8b
jne 0x140026d8c
mov rax, qword [rsp + 0x270]
cmp rax, r8
je 0x140026d63
cmp byte [rax + 0xe], r8b
jne 0x140026d8c
mov byte [rsp + 0x73], r8b
mov cl, byte [rsp + 0xea]
cmp cl, r8b
je 0x140026d91
cmp rax, r8
je 0x140026d91
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x1b8], rax
mov byte [rsp + 0x73], 1
jmp 0x140026d91
mov byte [rsp + 0x73], 1
xor edx, edx
lea rcx, [rsp + 0x378]
call fcn.140071240
nop
xor r9d, r9d
mov qword [rsp + 0xb0], r9
cmp byte [rsp + 0x73], r9b
je 0x14002728e
lea rax, [0x14019cf50]
mov qword [rsp + 0x458], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
xor edx, edx
lea rcx, [rsp + 0x610]
call fcn.140030768
nop
mov rax, qword [rsp + 0x270]
xor ecx, ecx
cmp rax, rcx
je 0x140026e07
mov r8, qword [rsp + 0x1b8]
mov rdx, rax
lea rcx, [rsp + 0x610]
call fcn.14005dc70
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x1b8], rax
mov edx, 0x106
lea rcx, [rsp + 0x3c0]
call fcn.140063580
nop
mov rax, qword [rsp + 0x3c0]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x1b8]
xor r8d, r8d
cmp word [rax], r8w
je 0x140026f91
mov rbp, qword [rsp + 0xf8]
lea r10d, [r8 + 2]
mov r9, rax
mov qword [rsp + 0x238], rax
add rax, r10
mov qword [rsp + 0x118], rax
movzx ecx, word [rax]
cmp cx, r8w
je 0x140026e96
mov edx, 0x3d
cmp cx, dx
je 0x140026e8e
add rax, r10
mov cx, word [rax]
cmp cx, r8w
jne 0x140026e7d
mov qword [rsp + 0x118], rax
mov rcx, rax
sub rcx, r9
sar rcx, 1
mov qword [rsp + 0x230], rcx
cmp word [rax], r8w
je 0x140026f74
lea rdx, [rax + 2]
mov qword [rsp + 0x268], rdx
cmp word [rdx], r8w
je 0x140026f65
cmp ecx, 0x104
jg 0x140026f65
movsxd rax, ecx
add rax, rax
mov qword [rsp + 0xf8], rax
mov r8, rax
mov rdx, r9
mov rcx, rbp
call fcn.14010cd30
mov rax, qword [rsp + 0xf8]
xor ecx, ecx
mov word [rax + rbp], cx
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbp
lea rcx, [rsp + 0x610]
call fcn.14002b14c
xor r8d, r8d
cmp rax, r8
jne 0x140026f57
or dword [rsp + 0x20], 0xffffffff
mov r9d, dword [rsp + 0x230]
mov r8, qword [rsp + 0x268]
mov rdx, qword [rsp + 0x238]
lea rcx, [rsp + 0x610]
call fcn.14002b058
mov rax, qword [rsp + 0x118]
xor r8d, r8d
lea r10d, [r8 + 2]
jmp 0x140026f65
mov rax, qword [rsp + 0x118]
mov r10d, 2
cmp word [rax], r8w
je 0x140026f74
add rax, r10
cmp word [rax], r8w
jne 0x140026f6b
add rax, r10
cmp word [rax], r8w
jne 0x140026e59
mov rbp, qword [rsp + 0x148]
mov rax, qword [rsp + 0x1b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor edx, edx
mov dword [rsp + 0x78], edx
mov rax, rdx
mov qword [rsp + 0x2c0], rdx
movsxd rcx, dword [rsp + 0x618]
mov qword [rsp + 0x118], rcx
cmp rcx, rdx
jle 0x1400270a7
mov rbp, rcx
mov rbx, rax
lea rcx, [rax + 1]
mov qword [rsp + 0x1b8], rcx
mov rdi, rcx
cmp rcx, rbp
jge 0x140027069
shl rax, 3
mov qword [rsp + 0xf8], rax
mov rsi, rax
mov rcx, qword [rsp + 0x610]
mov rax, qword [rcx + rsi]
mov rdx, qword [rax]
mov rax, qword [rcx + rdi*8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor ecx, ecx
cmp eax, ecx
jge 0x14002701d
mov rbx, rdi
mov rsi, rdi
shl rsi, 3
inc rdi
cmp rdi, rbp
jl 0x140026ff1
cmp rbx, qword [rsp + 0x2c0]
je 0x140027061
mov rcx, qword [rsp + 0x610]
mov r8, qword [rsp + 0xf8]
mov rdx, qword [r8 + rcx]
mov rax, qword [rcx + rbx*8]
mov qword [r8 + rcx], rax
mov rax, qword [rsp + 0x610]
mov qword [rax + rbx*8], rdx
mov rcx, qword [rsp + 0x1b8]
jmp 0x140027069
mov rcx, qword [rsp + 0x1b8]
mov rax, rcx
mov qword [rsp + 0x2c0], rcx
cmp rcx, rbp
jl 0x140026fc7
mov rbx, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x188]
mov rbp, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x118]
xor edx, edx
cmp rcx, rdx
jle 0x140027120
mov rbp, qword [rsp + 0x118]
mov rdi, rdx
mov esi, dword [rsp + 0x78]
mov rax, qword [rsp + 0x610]
mov rcx, qword [rax + rdi*8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rsi + rax + 1]
mov dword [rsp + 0x100], eax
mov rax, qword [rsp + 0x610]
mov rcx, qword [rax + rdi*8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [rsp + 0x100]
lea esi, [rcx + rax + 3]
inc rdi
cmp rdi, rbp
jl 0x1400270bb
mov dword [rsp + 0x78], esi
mov rsi, qword [rsp + 0x188]
mov rbp, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x158]
mov edx, dword [rsp + 0x78]
add edx, 4
lea rcx, [rsp + 0x378]
call fcn.1400635c0
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0xb0], rax
xor ecx, ecx
cmp qword [rsp + 0x118], rcx
jle 0x140027246
mov rdi, rax
mov rbp, qword [rsp + 0x118]
mov rbx, rcx
xor esi, esi
mov rax, qword [rsp + 0x610]
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx]
mov qword [rsp + 0xf8], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
add rax, rax
mov qword [rsp + 0x230], rax
mov r8, rax
mov rdx, qword [rsp + 0xf8]
mov rcx, rdi
call fcn.14010cd30
add rdi, qword [rsp + 0x230]
mov eax, 0x3d
mov word [rdi], ax
add rdi, 2
mov rax, qword [rsp + 0x610]
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx + 8]
mov qword [rsp + 0xf8], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
add rax, rax
mov qword [rsp + 0x230], rax
mov r8, rax
mov rdx, qword [rsp + 0xf8]
mov rcx, rdi
call fcn.14010cd30
add rdi, qword [rsp + 0x230]
mov word [rdi], si
add rdi, 2
inc rbx
cmp rbx, rbp
jl 0x140027164
mov qword [rsp + 0x210], rdi
mov rbx, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x188]
mov rbp, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x158]
mov rax, qword [rsp + 0x210]
xor ecx, ecx
mov word [rax], cx
mov edx, 2
mov word [rax + rdx], cx
lea rcx, [rsp + 0x3c0]
call fcn.14005b520
nop
xor edx, edx
lea rcx, [rsp + 0x610]
call fcn.140045e0c
nop
lea rcx, [rsp + 0x668]
call fcn.14005b520
nop
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r9d, r9d
mov rax, qword [rsp + 0xe0]
mov ecx, 0x40
cmp cx, word [rax]
jne 0x1400272a8
mov al, 1
lea r10d, [rcx - 0x3e]
jmp 0x1400272be
movzx eax, r9b
cmp qword [rsp + 0x228], r9
mov r10d, 2
cmovne eax, r10d
mov cl, byte [rsp + 0x70]
cmp cl, r9b
je 0x140027477
mov dword [rsp + 0x9c0], 1
or cl, 8
mov byte [rsp + 0x70], cl
neg al
sbb eax, eax
and eax, 0xfff01000
add eax, 0x100000
mov dword [rsp + 0x100], eax
call fcn.14005d820
mov r8, rax
lea rdx, str..pipepecmd_exec__u
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 6
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsp + 0x200], rax
xor ecx, ecx
cmp rax, rcx
je 0x1400273c5
cmp rax, 0xffffffffffffffff
je 0x1400273c5
or r8d, 0xffffffff
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0x198]
call fcn.1400712d0
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], 3
lea rcx, [rsp + 0x410]
mov qword [rsp + 0x20], rcx
mov r9d, 7
mov r8d, 0xc0000000
mov rdx, qword [rax]
lea rcx, [rsp + 0x1f0]
call fcn.14001c898
lea rcx, [rsp + 0x198]
call fcn.14005b520
jmp 0x1400273d0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 2
mov dword [rsp + 0x1c8], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1c8]
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x3d8], rax
mov dword [rsp + 0x124], 1
mov dword [rsp + 0xa0], 1
lea rdx, [rsp + 0x4e0]
bts dword [rdx + 0x3c], 8
mov cl, byte [rsp + 0x76]
mov r10d, 2
test r10b, cl
jne 0x140027455
xor r9d, r9d
cmp cl, r9b
jne 0x140027466
jmp 0x140027458
xor r9d, r9d
mov rax, qword [rsp + 0x1f0]
mov qword [rdx + 0x58], rax
jmp 0x14002746e
mov rax, qword [rsp + 0x1f0]
test cl, 1
je 0x1400274a1
mov qword [rdx + 0x60], rax
cmp dword [rsp + 0x9c0], r9d
jne 0x1400274a1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r9d, r9d
lea r10d, [r9 + 2]
mov qword [rsp + 0x1e8], r9
mov rax, qword [rsp + 0xb0]
neg rax
sbb eax, eax
and eax, 0x400
mov ecx, dword [rsp + 0xc8]
or eax, ecx
mov dword [rsp + 0x78], eax
cmp byte [rsp + 0xa5], r9b
je 0x1400274d9
or eax, 4
mov dword [rsp + 0x78], eax
cmp byte [rsp + 0x75], r9b
je 0x140027617
mov dword [rsp + 0x470], 0x70
mov dword [rsp + 0x474], r9d
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x478]
call fcn.14010c6c0
or dword [rsp + 0x474], 0x4540
mov eax, 5
mov edx, dword [rsp + 0x90]
xor ecx, ecx
cmp edx, ecx
cmovne ax, dx
movzx eax, ax
mov dword [rsp + 0x4a0], eax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x480], rax
mov dword [rsp + 0x2d8], ecx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x488], rax
mov ecx, 0x22
cmp cx, word [rax]
jne 0x1400275c7
lea r8d, [rcx - 0x21]
lea rdx, [rsp + 0x2d8]
lea rcx, [rsp + 0x238]
call fcn.140036bcc
mov qword [rsp + 0x198], rax
mov r8d, dword [rsp + 0x2d8]
mov rdx, qword [rsp + 0x238]
lea rcx, [rsp + 0x1c0]
call fcn.140063740
mov r11, qword [rsp + 0x1c0]
mov qword [rsp + 0x488], r11
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x490], rax
lea rcx, [rsp + 0x470]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0x4d8]
lea rdx, [rsp + 0x320]
mov qword [rdx], rcx
xor eax, eax
mov qword [rsp + 0x4d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
lea rcx, [rsp + 0x320]
mov dword [rcx + 0x10], eax
mov r11d, dword [rsp + 0x94]
jmp 0x140027f5e
mov cl, byte [rsp + 0xd9]
cmp cl, r9b
je 0x1400276eb
call fcn.140020e8c
mov qword [rsp + 0x388], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x1e8]
call fcn.14001de60
mov qword [rsp + 0x198], rax
mov rcx, rax
call fcn.14001e20c
xor ecx, ecx
cmp eax, ecx
jne 0x140027f7f
lea rax, [rsp + 0x320]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov r9d, dword [rsp + 0xa0]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov r11d, eax
mov dword [rsp + 0x94], eax
jmp 0x140027f5e
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x168], rax
cmp word [rax], r9w
je 0x1400279a2
mov dword [rsp + 0x94], r9d
mov cl, byte [rsp + 0xa6]
cmp cl, r9b
je 0x140027830
mov qword [rsp + 0x2b0], r9
or r9d, 0xffffffff
or r8d, r9d
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x2b0]
call fcn.140063440
nop
lea rcx, [rsp + 0x2a0]
call fcn.140063230
nop
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
add r8, r8
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call fcn.14010c6c0
lea rdx, [rsp + 0x2a0]
mov rcx, qword [rsp + 0x2b0]
call fcn.1400697e0
xor edx, edx
mov ecx, edx
cmp rax, rdx
setne cl
mov dword [rsp + 0x1c8], ecx
or r9d, 0xffffffff
or r8d, r9d
mov rdx, qword [rsp + 0x2a0]
lea rcx, [rsp + 0xf0]
call fcn.140063690
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
xor edx, edx
mov rcx, qword [rsp + 0x2b0]
call fcn.14010c6c0
mov rcx, qword [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
xor edx, edx
mov rcx, qword [rsp + 0x2a0]
call fcn.14010c6c0
nop
lea rcx, [rsp + 0x2a0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x2b0]
call fcn.14005b520
xor eax, eax
cmp dword [rsp + 0x1c8], eax
je 0x14002794f
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x168], rax
mov edx, 0x40
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrChrW]
xor ecx, ecx
cmp rax, rcx
jne 0x14002786e
lea edx, [rcx + 0x5c]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.SHLWAPI.dll_StrChrW]
xor ecx, ecx
cmp rax, rcx
jne 0x14002786e
lea rax, [0x140146ff0]
mov qword [rsp + 0x238], rax
jmp 0x14002788d
mov word [rax], cx
add rax, 2
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x238], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x1e8]
call fcn.14001de60
mov qword [rsp + 0x198], rax
mov rcx, rax
call fcn.14001e20c
xor ecx, ecx
cmp eax, ecx
je 0x1400278d1
lea eax, [rcx + 3]
mov dword [rsp + 0x7c], eax
jmp 0x140027f7f
lea rax, [rsp + 0x320]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
add r8, r8
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call fcn.14010c6c0
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
add r8, r8
xor edx, edx
mov rcx, qword [rsp + 0x108]
call fcn.14010c6c0
mov r11d, dword [rsp + 0x94]
jmp 0x140027f5e
mov al, byte [rsp + 0x71]
cmp al, r9b
je 0x140027a50
mov rcx, qword [rsp + 0x88]
call fcn.14001e20c
xor ecx, ecx
cmp eax, ecx
je 0x1400279ce
lea eax, [rcx + 3]
mov dword [rsp + 0x7c], eax
jmp 0x140027f7f
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x320]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xa0]
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x248]
mov rcx, qword [rsp + 0x240]
call fcn.14006faf0
xor ecx, ecx
mov r11d, ecx
cmp eax, ecx
setg r11b
mov dword [rsp + 0x94], r11d
jmp 0x140027f5e
mov dword [rsp + 0x94], r9d
mov rcx, r9
mov qword [rsp + 0x380], rcx
mov qword [rsp + 0x1a0], r9
mov eax, r9d
mov dword [rsp + 0x7c], eax
mov r8, qword [rsp + 0x170]
mov rdx, r8
cmp r8, r9
je 0x140027ac5
mov r11d, 0x2a
cmp word [r8], r11w
jne 0x140027a9d
add rdx, r10
inc eax
cmp word [rdx], r11w
je 0x140027a8e
mov dword [rsp + 0x7c], eax
mov eax, 0x23
cmp ax, word [rdx]
jne 0x140027ac5
movzx eax, word [rdx + 2]
sub ax, 0x30
mov r11d, 9
cmp ax, r11w
cmovbe rcx, rdx
mov qword [rsp + 0x380], rcx
mov qword [rsp + 0x368], r9
cmp rcx, r9
je 0x140027e9a
add rcx, r10
mov qword [rsp + 0x380], rcx
lea rdx, [rsp + 0x368]
lea rcx, [rsp + 0x380]
call fcn.14007d340
mov qword [rsp + 0x198], rax
mov eax, 0x20
mov dword [rsp + 0xc8], eax
lea rcx, [rsp + 0x2e0]
call fcn.140063230
xor eax, eax
mov dword [rsp + 0x2e8], eax
mov dword [rsp + 0x2ec], eax
mov eax, 0x20
mov dword [rsp + 0xc8], eax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e0]
mov r8, qword [rsp + 0x198]
mov rdx, qword [rsp + 0x368]
xor ecx, ecx
call fcn.140030854
mov qword [rsp + 0x168], rax
xor ecx, ecx
cmp rax, rcx
jne 0x140027bcb
mov rdx, qword [rsp + 0x368]
lea rcx, [0x140146fe8]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor ecx, ecx
cmp eax, ecx
jne 0x140027bc3
lea eax, [rcx + 0x20]
mov dword [rsp + 0xc8], eax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e0]
lea r8, str.INDATA
lea edx, [rcx + 2]
call fcn.140030854
mov qword [rsp + 0x168], rax
xor ecx, ecx
jmp 0x140027bcb
mov rax, qword [rsp + 0x168]
cmp dword [rsp + 0x2e8], ecx
jle 0x140027e88
cmp rax, rcx
je 0x140027e88
cmp dword [rsp + 0x7c], ecx
jg 0x140027cdc
mov rcx, qword [rsp + 0x88]
call fcn.14001e20c
xor ecx, ecx
cmp eax, ecx
je 0x140027c25
lea eax, [rcx + 3]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x2e0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a0]
call fcn.14005b520
jmp 0x140027f7f
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x320]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xa0]
mov r8, qword [rsp + 0x68]
mov edx, dword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x168]
call fcn.14006faf0
mov dword [rsp + 0x1c8], eax
xor ecx, ecx
cmp eax, ecx
jl 0x140027cdc
lea rax, [rsp + 0x320]
mov r8d, dword [rax + 0x10]
cmp r8d, ecx
je 0x140027cdc
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ecx, ecx
cmp rax, rcx
je 0x140027cdc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov eax, ecx
cmp dword [rsp + 0x1c8], ecx
setg al
mov dword [rsp + 0x94], eax
jmp 0x140027e88
mov qword [rsp + 0x2f8], rcx
mov qword [rsp + 0x1e0], rcx
lea rax, [0x140146770]
mov qword [rsp + 0x20], rax
lea r9, str.exedat
lea r8, [rsp + 0x2f8]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x178]
call fcn.14001ea34
mov rax, qword [rsp + 0x2f8]
xor ecx, ecx
cmp rax, rcx
je 0x140027e7a
mov dword [rsp + 0x390], ecx
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x390]
mov r8d, dword [rsp + 0x2e8]
mov rdx, qword [rsp + 0x168]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x2f8]
call fcn.14005f4c0
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x1e8]
call fcn.14001de60
mov qword [rsp + 0x198], rax
mov rcx, rax
call fcn.14001e20c
xor ecx, ecx
cmp eax, ecx
je 0x140027de4
lea eax, [rcx + 3]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x1e0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x2e0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a0]
call fcn.14005b520
jmp 0x140027f7f
lea rax, [rsp + 0x320]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x1e0]
call fcn.1400cf400
mov dword [rsp + 0x94], eax
mov eax, 2
cmp dword [rsp + 0x7c], eax
jl 0x140027e7a
lea rax, [rsp + 0x320]
mov edx, dword [rax + 0x10]
mov rcx, qword [rsp + 0x178]
call fcn.14001ca64
mov rax, qword [rsp + 0x178]
xor ecx, ecx
mov word [rax], cx
lea rcx, [rsp + 0x1e0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x2e0]
call fcn.14005b520
jmp 0x140027f49
mov r9, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x1e8]
call fcn.14001de60
mov qword [rsp + 0x198], rax
mov rcx, rax
call fcn.14001e20c
xor ecx, ecx
cmp eax, ecx
je 0x140027ee3
lea eax, [rcx + 3]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x1a0]
call fcn.14005b520
jmp 0x140027f7f
lea rax, [rsp + 0x320]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x170]
call fcn.1400cf400
mov dword [rsp + 0x94], eax
lea rcx, [rsp + 0x1a0]
call fcn.14005b520
mov r11d, dword [rsp + 0x94]
xor eax, eax
cmp r11d, eax
je 0x140027f6b
mov dword [rsp + 0x7c], eax
jmp 0x140027f75
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x7c], eax
mov rcx, qword [rsp + 0x360]
mov dword [rcx], eax
xor eax, eax
cmp rbx, rax
je 0x140027f97
cmp rbx, 0xffffffffffffffff
je 0x140027f97
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, rax
mov qword [rsp + 0x208], rax
mov rcx, qword [rsp + 0xd0]
cmp rcx, rax
je 0x140027fb7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rsp + 0xd0], rax
mov r8, qword [rsp + 0x1a8]
cmp word [r8], ax
je 0x140027fe7
lea rax, [rsp + 0x320]
mov edx, dword [rax + 0x10]
mov rcx, qword [rsp + 0x98]
call fcn.140065eb0
xor eax, eax
cmp byte [rsp + 0xa5], al
je 0x140028023
lea rcx, [rsp + 0x320]
cmp qword [rcx], rax
je 0x140028023
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov qword [rsp + 0x2b8], rax
lea rcx, [rsp + 0x320]
mov rdx, qword [rcx]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea r8, str.__LastPID
lea rax, [rsp + 0x320]
mov edx, dword [rax + 0x10]
mov rcx, qword [rsp + 0x98]
call fcn.140065eb0
lea r8, str.__LastTID
lea rax, [rsp + 0x320]
mov edx, dword [rax + 0x14]
mov rcx, qword [rsp + 0x98]
call fcn.140065eb0
test byte [rsp + 0x78], 4
je 0x140028082
lea rax, [rsp + 0x320]
mov rcx, qword [rax + 8]
xor eax, eax
cmp rcx, rax
je 0x140028082
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
lea rcx, [rsp + 0x1e8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x378]
call fcn.14005b520
mov rax, qword [rsp + 0x1f0]
xor r8d, r8d
cmp rax, r8
je 0x1400280b9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsp + 0x1f0], r8
mov rcx, qword [rsp + 0xc0]
cmp rcx, r8
je 0x1400280d7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsp + 0xc0], r8
cmp rbp, r8
je 0x1400280f0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsp + 0x148], r8
cmp rsi, r8
je 0x140028109
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsp + 0x188], r8
cmp rdi, r8
je 0x140028122
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsp + 0x158], r8
cmp dword [rsp + 0x94], r8d
je 0x140028cb9
lea rsi, [rsp + 0x320]
mov rcx, qword [rsi]
mov rax, rcx
neg rax
sbb edi, edi
and edi, dword [rsp + 0x9c0]
mov dword [rsp + 0x100], edi
movsxd rdx, dword [rsp + 0x124]
mov qword [rsp + rdx*8 + 0x3d8], rcx
inc edx
mov dword [rsp + 0x124], edx
mov rcx, qword [rsi + 8]
cmp rcx, r8
je 0x140028184
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsi + 8], r8
mov ecx, 0x3e8
mov al, byte [rsp + 0x72]
cmp al, r8b
je 0x1400281b0
mov edx, ecx
mov rcx, qword [rsp + 0x98]
call fcn.14002bb1c
mov rcx, qword [rsi]
call fcn.14002c6c4
xor r8d, r8d
cmp edi, r8d
je 0x140028cef
mov bpl, byte [0x1401958af]
mov ebx, 0x100000
mov edi, r8d
lea edx, [rbx + 4]
lea rcx, [rsp + 0x88]
call fcn.1400632b0
nop
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x398], rax
lea rcx, [rax + 2]
mov qword [rsp + 0x428], rcx
xor edx, edx
mov sil, dl
mov byte [rsp + 0x60], dl
lea r8d, [rdx + 0x40]
cmp r8w, word [rax]
jne 0x14002821d
mov sil, 1
mov byte [rsp + 0x60], sil
mov rax, rcx
mov qword [rsp + 0x398], rcx
jmp 0x140028233
cmp qword [rsp + 0x228], rdx
je 0x140028233
mov ecx, 2
mov sil, cl
mov byte [rsp + 0x60], cl
cmp byte [rsp + 0x74], dl
je 0x1400282b8
mov qword [rsp + 0x3b0], rdx
xor r9d, r9d
lea r8, [rsp + 0x3b0]
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.14006c7b0
or r9d, 0xffffffff
or r8d, r9d
mov rdx, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x88]
call fcn.140063440
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea ebx, [rax + 0x3ff]
and ebx, 0xfffffc00
add ebx, 0x100000
lea edx, [rbx + 8]
lea rcx, [rsp + 0x88]
call fcn.1400632e0
nop
lea rcx, [rsp + 0x3b0]
call fcn.14005b520
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [rsp + 0x70], 8
je 0x1400287be
mov rax, qword [rsp + 0xe0]
mov ecx, 0x40
cmp cx, word [rax]
je 0x140028317
xor ebp, ebp
cmp byte [rsp + 0xa4], bpl
je 0x140028319
lea ecx, [rbp + 0x26]
cmp word [rax], cx
je 0x140028310
mov rax, qword [rsp + 0x98]
test byte [rax + 0xf], 0xf
je 0x140028319
mov byte [rsp + 0x71], 1
jmp 0x14002831e
xor ebp, ebp
mov byte [rsp + 0x71], bpl
mov dword [rsp + 0x394], ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rsp + 0x3e8]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [rsp + 0x170], edi
cmp sil, bpl
je 0x140028355
mov esi, ebx
sub esi, edi
jmp 0x14002835a
mov esi, 0x100000
movsxd rdx, edi
add rdx, qword [rsp + 0x88]
lea rax, [rsp + 0x3e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x394]
mov r8d, esi
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_ReadFile]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x298], eax
mov dword [rsp + 0x78], ebp
mov dword [rsp + 0xa0], ebp
mov ecx, dword [rsp + 0x1d0]
cmp ecx, ebp
mov eax, 0x3e8
cmovle ecx, eax
mov dword [rsp + 0x1d0], ecx
mov byte [rsp + 0x72], bpl
lea rcx, [rsp + 0x270]
call fcn.140063500
nop
xor r10d, r10d
mov bpl, byte [0x1401958af]
cmp bpl, r10b
jle 0x1400287ac
mov dword [rsp + 0x28], 0x4ff
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea r8, [rsp + 0x3d8]
mov edx, dword [rsp + 0x124]
mov rcx, qword [rsp + 0x98]
call fcn.14002dfd4
mov edx, eax
mov dword [rsp + 0x2a8], eax
xor r10d, r10d
cmp eax, r10d
jne 0x1400284e5
mov dword [rsp + 0x7c], r10d
xor r9d, r9d
lea r8, [rsp + 0x7c]
lea rdx, [rsp + 0x3e8]
lea rcx, [rsp + 0x200]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov r11d, dword [rsp + 0x7c]
xor edx, edx
cmp r11d, edx
jle 0x140028477
cmp r11d, esi
cmovg r11d, esi
mov dword [rsp + 0x7c], r11d
add edi, r11d
movsxd rcx, edi
mov rax, qword [rsp + 0x88]
mov byte [rcx + rax], dl
lea eax, [rdi + 0x100000]
cmp eax, ebx
jl 0x140028499
add ebx, 0x100000
lea edx, [rbx + 4]
lea rcx, [rsp + 0x88]
call fcn.1400632e0
xor edx, edx
cmp byte [rsp + 0x60], dl
je 0x1400284a5
mov esi, ebx
sub esi, edi
jmp 0x1400284aa
mov esi, 0x100000
movsxd rdx, edi
add rdx, qword [rsp + 0x88]
lea rax, [rsp + 0x3e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
mov r8d, esi
lea rax, [rsp + 0x200]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x2a8]
xor r10d, r10d
mov cl, byte [rsp + 0x60]
cmp cl, r10b
je 0x14002852c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x78], eax
mov ecx, eax
sub ecx, dword [rsp + 0x298]
cmp ecx, dword [rsp + 0x1d0]
jge 0x140028630
cmp edi, dword [rsp + 0xa0]
je 0x140028792
cmp ecx, 0x14
jl 0x14002878d
xor r10d, r10d
jmp 0x140028633
mov eax, dword [rsp + 0x124]
cmp eax, 1
jle 0x14002855e
dec eax
cmp eax, edx
jne 0x14002855e
mov byte [rsp + 0x72], 1
cmp cl, r10b
je 0x1400287ac
cmp edi, dword [rsp + 0xa0]
je 0x1400287ac
jmp 0x140028633
test byte [rsp + 0x70], 1
je 0x14002859c
movsxd rax, dword [rsp + 0x170]
cmp edi, eax
jle 0x14002859c
mov rcx, rax
movsxd rdx, edi
cmp rax, rdx
jge 0x14002859c
mov rax, qword [rsp + 0x88]
mov r8d, 0xa
cmp byte [rax + rcx], r8b
je 0x1400287ac
inc rcx
cmp rcx, rdx
jl 0x14002858a
mov ebp, 5
sub ebp, 1
js 0x1400283d1
mov al, byte [0x1401958af]
cmp al, r10b
jle 0x1400283d1
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.USER32.dll_PeekMessageW]
xor r10d, r10d
cmp eax, r10d
je 0x1400283d1
cmp dword [rsp + 0x5e8], 0x12
je 0x14002860e
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x5e0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r10d, r10d
jmp 0x1400285a1
mov bpl, r10b
mov byte [rsp + 0x72], 1
cmp byte [rsp + 0x60], r10b
je 0x1400283d1
cmp edi, dword [rsp + 0xa0]
je 0x1400283d1
jmp 0x140028633
xor r10d, r10d
mov rax, qword [rsp + 0x88]
mov r8, rax
mov dword [rsp + 0xa0], edi
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x298], ecx
mov cl, byte [rsp + 0x71]
cmp cl, r10b
jne 0x1400286b9
mov r9d, dword [rsp + 0x120]
cmp r9d, 0x4b0
je 0x140028696
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x270]
call fcn.140063690
mov r8, qword [rsp + 0x270]
mov rax, qword [rsp + 0x88]
mov cl, byte [rsp + 0x71]
xor r10d, r10d
jmp 0x1400286b9
movsxd rcx, edi
mov word [rax + rcx + 2], r10w
mov rax, qword [rsp + 0x88]
mov word [rax + rcx + 2], r10w
mov rax, qword [rsp + 0x88]
mov cl, byte [rsp + 0x71]
cmp byte [rsp + 0x60], 1
jne 0x1400286ee
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
lea r9, [0x14014f7a8]
mov rax, qword [rsp + 0x398]
mov r8, rax
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.14005e300
jmp 0x140028737
cmp cl, r10b
je 0x140028722
mov byte [rsp + 0x28], r10b
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, edi
mov r8, rax
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x98]
call fcn.1400779e0
jmp 0x140028737
mov rdx, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x98]
call fcn.140061290
mov rax, qword [rsp + 0x228]
xor r10d, r10d
cmp rax, r10
je 0x140028795
mov rdx, rax
lea rcx, [rsp + 0x268]
call fcn.140071240
nop
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x98]
call fcn.14004d38c
nop
lea rcx, [rsp + 0x268]
call fcn.14005b520
xor r10d, r10d
jmp 0x140028795
xor r10d, r10d
jmp 0x140028795
xor r10d, r10d
cmp byte [rsp + 0x72], r10b
jne 0x1400287ac
mov cl, byte [rsp + 0x60]
mov edx, dword [rsp + 0x2a8]
jmp 0x14002852c
lea rcx, [rsp + 0x270]
call fcn.14005b520
jmp 0x14002891b
cmp dword [rsp + 0x100], 0xffffff9c
je 0x14002891b
mov bpl, byte [0x1401958af]
xor eax, eax
cmp bpl, al
jle 0x14002891b
mov eax, dword [rsp + 0x124]
lea esi, [rax - 1]
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], 0x3e8
xor r9d, r9d
lea r8, [rsp + 0x3d8]
mov edx, eax
mov rcx, qword [rsp + 0x98]
call fcn.14002dfd4
cmp esi, eax
je 0x14002891b
mov edx, dword [rsp + 0x124]
cmp edx, 1
jle 0x1400288a1
xor ebp, ebp
cmp eax, ebp
jne 0x1400288a3
lea eax, [rdi + 0x100000]
cmp eax, ebx
jl 0x14002884c
add ebx, 0x100000
lea edx, [rbx + 4]
lea rcx, [rsp + 0x88]
call fcn.1400632e0
mov dword [rsp + 0x2cc], ebp
movsxd rdx, edi
add rdx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x2cc]
mov r8d, 1
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
je 0x1400288a3
mov eax, dword [rsp + 0x2cc]
cmp eax, ebp
jbe 0x1400288a3
add edi, eax
movsxd rcx, edi
mov rax, qword [rsp + 0x88]
mov byte [rcx + rax], bpl
jmp 0x1400288a3
xor ebp, ebp
mov al, byte [0x1401958af]
cmp al, bpl
jle 0x140028902
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, ebp
je 0x140028902
cmp dword [rsp + 0x5b8], 0x12
je 0x140028902
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x1401958af]
cmp r11b, bpl
jg 0x1400288ae
mov bpl, byte [0x1401958af]
xor eax, eax
cmp bpl, al
mov eax, dword [rsp + 0x124]
jg 0x1400287e8
movsxd rsi, edi
mov rax, qword [rsp + 0x88]
xor ebx, ebx
mov byte [rax + rsi + 2], bl
mov rax, qword [rsp + 0x88]
mov byte [rax + rsi + 1], bl
mov rax, qword [rsp + 0x88]
mov byte [rax + rsi], bl
mov dword [rsp + 0x90], ebx
cmp dword [rsp + 0x100], 0xffffff9c
je 0x14002896c
cmp bpl, bl
jle 0x14002896c
xor edx, edx
lea rax, [rsp + 0x320]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, [rsp + 0x90]
lea rax, [rsp + 0x320]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebp, dword [rsp + 0x90]
mov rax, qword [rsp + 0x360]
mov dword [rax], ebp
cmp byte [rsp + 0x70], bl
je 0x140028c44
mov rax, qword [rsp + 0xe0]
mov ecx, 0x40
cmp cx, word [rax]
je 0x1400289df
xor ecx, ecx
cmp byte [rsp + 0xa4], cl
je 0x1400289df
mov ecx, 0x26
cmp word [rax], cx
je 0x1400289d5
mov rax, qword [rsp + 0x98]
test byte [rax + 0xf], 0xf
je 0x1400289df
mov bpl, 1
mov byte [rsp + 0x74], bpl
jmp 0x1400289e8
xor eax, eax
mov bpl, al
mov byte [rsp + 0x74], al
lea rcx, [rsp + 0x250]
call fcn.140063230
xor ecx, ecx
mov dword [rsp + 0x258], ecx
mov dword [rsp + 0x25c], ecx
cmp bpl, cl
jne 0x140028ba0
mov eax, dword [rsp + 0x3a8]
lea edx, [rcx + 2]
cmp al, dl
jne 0x140028a35
mov rax, qword [rsp + 0x88]
mov word [rax + rsi], cx
mov rbx, qword [rsp + 0x88]
jmp 0x140028abe
cmp al, 1
jne 0x140028a5d
mov r9d, dword [rsp + 0x120]
mov r8d, edi
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x250]
call fcn.140063690
xor ecx, ecx
jmp 0x140028ac3
lea edx, [rdi + 0x18]
lea rcx, [rsp + 0x250]
call fcn.1400635c0
mov dword [rsp + 0x25c], edi
mov dword [rsp + 0x258], edi
lea eax, [rdi + 1]
movsxd r8, eax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x250]
call fcn.14010cd30
mov r11, qword [rsp + 0x250]
lea rcx, [rsi + r11]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14010c6c0
xor edx, edx
lea rcx, [rsp + 0x250]
call fcn.140081dc0
xor ecx, ecx
cmp rbx, rcx
jne 0x140028acb
mov rbx, qword [rsp + 0x250]
mov al, byte [rsp + 0x70]
test al, 4
je 0x140028b1a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2 - 2]
cmp rax, rbx
jb 0x140028ba0
xor ecx, ecx
lea edx, [rcx + 2]
lea r8d, [rcx + 0xd]
lea r10d, [rcx + 0xa]
cmp r8w, word [rax]
je 0x140028b0a
cmp r10w, word [rax]
jne 0x140028ba0
mov word [rax], cx
sub rax, rdx
cmp rax, rbx
jae 0x140028afa
jmp 0x140028ba0
test al, 1
je 0x140028b47
cmp word [rbx], cx
je 0x140028b42
mov eax, 2
lea edx, [rax + 0xb]
lea r8d, [rax + 8]
cmp word [rbx], dx
je 0x140028b42
cmp word [rbx], r8w
je 0x140028b42
add rbx, rax
cmp word [rbx], cx
jne 0x140028b2f
mov word [rbx], cx
jmp 0x140028ba0
mov edx, 2
test dl, al
je 0x140028ba0
movzx eax, word [rbx]
cmp ax, cx
je 0x140028ba0
lea ebp, [rdx + 8]
lea r8d, [rdx + 0xb]
cmp ax, r8w
je 0x140028b6f
cmp ax, bp
je 0x140028b6f
add rbx, rdx
jmp 0x140028b93
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
add r8, r8
lea rdx, [rbx + 2]
mov rcx, rbx
call fcn.14010cd30
xor ecx, ecx
lea edx, [rcx + 2]
lea r8d, [rcx + 0xd]
mov ax, word [rbx]
cmp ax, cx
jne 0x140028b5f
mov bpl, byte [rsp + 0x74]
mov rdx, qword [rsp + 0xe0]
mov eax, 0x40
cmp ax, word [rdx]
jne 0x140028be7
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [0x14014f7a8]
mov rdx, qword [rsp + 0x428]
mov r8, rdx
mov rcx, qword [rsp + 0x98]
call fcn.14005e300
xor ebx, ebx
jmp 0x140028c30
xor ebx, ebx
cmp bpl, bl
je 0x140028c1a
mov byte [rsp + 0x28], 1
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x98]
call fcn.1400779e0
jmp 0x140028c30
mov r8, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x98]
call fcn.140061290
nop
lea rcx, [rsp + 0x250]
call fcn.14005b520
mov ebp, dword [rsp + 0x90]
mov word [rsp + 0x710], bx
mov r8d, ebp
lea rdx, [0x140146fa0]
lea rcx, [rsp + 0x710]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x710]
lea rdx, [0x140146f80]
mov rsi, qword [rsp + 0x98]
mov rcx, rsi
call fcn.140061290
mov rdi, qword [rsp + 0x2b8]
cmp rdi, rbx
je 0x140028c9f
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
nop
lea rcx, [rsp + 0x88]
call fcn.14005b520
mov rbx, qword [rsp + 0x208]
xor r8d, r8d
jmp 0x140028d19
mov rdx, qword [rsp + 0xe0]
cmp word [rdx], r8w
je 0x140028d05
lea r8, [0x14014f7a8]
mov rsi, qword [rsp + 0x98]
mov rcx, rsi
call fcn.140061290
mov rdi, qword [rsp + 0x2b8]
mov ebp, dword [rsp + 0x7c]
xor r8d, r8d
jmp 0x140028d19
mov rdi, qword [rsp + 0x2b8]
mov ebp, dword [rsp + 0x7c]
mov rsi, qword [rsp + 0x98]
jmp 0x140028d19
mov rdi, qword [rsp + 0x2b8]
mov ebp, dword [rsp + 0x7c]
mov rsi, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x178]
cmp rcx, r8
je 0x140028d3f
cmp word [rcx], r8w
je 0x140028d3f
lea rax, [rsp + 0x320]
mov edx, dword [rax + 0x10]
call fcn.14001ca64
xor r8d, r8d
lea rax, [rsp + 0x320]
mov rcx, qword [rax]
cmp rcx, r8
je 0x140028d60
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x320]
mov qword [rax], r8
lea rax, [rsp + 0x148]
mov rcx, qword [rax]
cmp rcx, r8
je 0x140028d84
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x148]
mov qword [rax], r8
lea rax, [rsp + 0x188]
mov rcx, qword [rax]
cmp rcx, r8
je 0x140028da8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x188]
mov qword [rax], r8
lea rax, [rsp + 0x158]
cmp qword [rax], r8
je 0x140028dcb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x158]
mov qword [rax], r8
lea rax, [rsp + 0x1f0]
mov rcx, qword [rax]
cmp rcx, r8
je 0x140028def
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x1f0]
mov qword [rax], r8
lea rax, [rsp + 0x200]
mov rcx, qword [rax]
cmp rcx, r8
je 0x140028e13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x200]
mov qword [rax], r8
lea rax, [rsp + 0x3a0]
mov rcx, qword [rax]
cmp rcx, r8
je 0x140028e37
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x3a0]
mov qword [rax], r8
mov rcx, qword [rsp + 0x400]
cmp rcx, r8
je 0x140028e50
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x320]
mov rcx, qword [rax + 8]
cmp rcx, r8
je 0x140028e72
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rax, [rsp + 0x320]
mov qword [rax + 8], r8
xor edx, edx
mov rcx, rsi
call fcn.14009aae0
nop
lea rcx, [rsp + 0x290]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1d8]
call fcn.14005b520
nop
xor esi, esi
cmp rbx, rsi
je 0x140028eb4
cmp rbx, 0xffffffffffffffff
je 0x140028eb4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x1b0]
call fcn.14005b520
nop
mov rcx, qword [rsp + 0xd0]
cmp rcx, rsi
je 0x140028edb
cmp rcx, 0xffffffffffffffff
je 0x140028edb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd0], rsi
mov rcx, qword [rsp + 0xc0]
cmp rcx, rsi
je 0x140028efc
cmp rcx, 0xffffffffffffffff
je 0x140028efc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc0], rsi
mov rcx, qword [rsp + 0x158]
cmp rcx, rsi
je 0x140028f1e
cmp rcx, 0xffffffffffffffff
je 0x140028f1e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x188]
cmp rcx, rsi
je 0x140028f38
cmp rcx, 0xffffffffffffffff
je 0x140028f38
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x148]
cmp rcx, rsi
je 0x140028f52
cmp rcx, 0xffffffffffffffff
je 0x140028f52
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x3a0]
cmp rcx, rsi
je 0x140028f6c
cmp rcx, 0xffffffffffffffff
je 0x140028f6c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x1f0]
cmp rcx, rsi
je 0x140028f86
cmp rcx, 0xffffffffffffffff
je 0x140028f86
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x200]
cmp rcx, rsi
je 0x140028fa0
cmp rcx, 0xffffffffffffffff
je 0x140028fa0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14005b520
nop
lea rcx, [rsp + 0x240]
call fcn.14005b520
nop
lea rcx, [rsp + 0x180]
call fcn.14005b520
nop
lea rcx, [rsp + 0x110]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1c0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x190]
call fcn.14005b520
nop
lea rcx, [rsp + 0x1a8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x150]
call fcn.14005b520
nop
cmp rdi, rsi
je 0x140029025
cmp rdi, 0xffffffffffffffff
je 0x140029025
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rsp + 0x388]
cmp rax, rsi
je 0x140029042
cmp rax, 0xffffffffffffffff
je 0x140029042
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
mov ebx, ebp
jmp 0x14002912b
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
mov ebx, 1
lea rcx, [rsp + 0x278]
call fcn.14005b520
mov eax, ebx
jmp 0x140029248
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0x278]
call fcn.14005b520
mov eax, 1
jmp 0x140029248
lea rcx, [rsp + 0x128]
call fcn.14005b520
nop
lea rcx, [rsp + 0x160]
call fcn.14005b520
nop
lea rcx, [rsp + 0xf0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x108]
call fcn.14005b520
nop
lea rcx, [rsp + 0xe0]
call fcn.14005b520
nop
lea rcx, [rsp + 0x140]
call fcn.14005b520
nop
lea rcx, [rsp + 0x130]
call fcn.14005b520
nop
lea rcx, [rsp + 0x138]
call fcn.14005b520
nop
lea rcx, [rsp + 0x278]
call fcn.14005b520
mov eax, 1
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x978
pop rdi
pop rsi
pop rbp
pop rbx
ret