Function at 0x140002090
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rax, qword [0x140066010]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ecx, 0x210
call fcn.14000f4e4
mov rsi, rax
mov qword [rsp + 0xb0], rax
movabs rax, 0x8000000000000108
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xb8], 0x104
mov edi, 0x20a
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140011f10
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp rdi, 2
je 0x14000212c
lea r9, [rdi - 2]
cmp word [rsi + rdi - 4], 0x5c
mov rdi, r9
jne 0x14000210e
test r9, r9
jne 0x140002472
movaps xmm0, xmmword [0x140059ea0]
lea rcx, [rsp + 0x90]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
lea rdx, [0x1400693e8]
call fcn.1400014e0
cmp byte [rsp + 0xc7], 0
js 0x140002453
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x80], rax
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call fcn.140001b00
lea rcx, [rsp + 0x90]
mov edx, 0xea60
call fcn.140001570
test al, al
je 0x1400023b2
xorps xmm0, xmm0
lea rsi, [rsp + 0x50]
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
lea rcx, [rsp + 0x90]
mov rdx, rsi
call fcn.1400016b0
lea rcx, str.ReadMessageFromPipe
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, qword [rsi]
mov rax, qword [rsi + 8]
cmp rbx, rax
je 0x1400023cd
mov cl, byte [0x1400693e7]
mov rdx, qword [0x1400693d8]
mov r8, qword [0x1400693d0]
lea rbp, [0x1400693d0]
lea r13, str.ShellExecute_path_to_dragon
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r12, [rsp + 0xb0]
test cl, cl
movzx r9d, cl
cmovs r9, rdx
mov r10, rbp
cmovs r10, r8
movzx edi, byte [rbx + 0x17]
mov r15, rbx
test dil, dil
jns 0x140002232
mov r15, qword [rbx]
mov rdi, qword [rbx + 8]
test r9, r9
je 0x140002327
cmp rdi, r9
jl 0x140002394
mov qword [rsp + 0x38], rdx
lea rdx, [r15 + rdi*2]
mov qword [rsp + 0x40], rdx
movzx esi, word [r10]
lea rdx, [r15 + rdi*2]
add rdx, 0xfffffffffffffffe
mov qword [rsp + 0x48], rdx
mov r11, r15
mov r14, rdi
sub r14, r9
inc r14
je 0x1400022da
mov rdx, r12
inc rdi
xor r12d, r12d
cmp word [r11 + r12], si
je 0x14000228f
add r12, 2
dec rdi
cmp r9, rdi
jne 0x14000227a
jmp 0x1400022e3
mov rdi, r11
add rdi, r12
je 0x1400022e3
mov r13, rbp
xor r14d, r14d
movzx ebp, word [rdi + r14*2]
cmp bp, word [r10 + r14*2]
jne 0x1400022b3
inc r14
cmp r9, r14
jne 0x14000229d
jmp 0x1400022f7
mov rdi, qword [rsp + 0x48]
sub rdi, r11
add r11, r12
add r11, 2
sub rdi, r12
sar rdi, 1
cmp rdi, r9
mov rbp, r13
lea r13, str.ShellExecute_path_to_dragon
mov r12, rdx
jge 0x140002266
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1400022ed
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r12, rdx
mov rdx, qword [rsp + 0x38]
jmp 0x140002394
cmp rdi, qword [rsp + 0x40]
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
je 0x1400023a3
sub r15, r11
add r15, 0xfffffffffffffffe
cmp r15, r12
mov rbp, r13
lea r13, str.ShellExecute_path_to_dragon
mov r12, rdx
mov rdx, qword [rsp + 0x38]
je 0x140002394
mov rcx, r13
call rsi
cmp byte [rsp + 0xc7], 0
mov rcx, r12
jns 0x140002341
mov rcx, qword [rsp + 0xb0]
call rsi
cmp byte [rsp + 0xc7], 0
mov r8, r12
jns 0x140002358
mov r8, qword [rsp + 0xb0]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor ecx, ecx
lea rdx, str.open
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov cl, byte [0x1400693e7]
mov rdx, qword [0x1400693d8]
mov r8, qword [0x1400693d0]
mov rax, qword [rsp + 0x58]
add rbx, 0x18
cmp rbx, rax
jne 0x14000220e
jmp 0x1400023c6
mov rbp, r13
lea r13, str.ShellExecute_path_to_dragon
jmp 0x1400022ea
lea rcx, str.Named_pipe_does_not_exist
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, 1
jmp 0x140002409
mov rbx, qword [rsp + 0x50]
jmp 0x1400023d0
mov rax, rbx
test rbx, rbx
je 0x140002407
mov rcx, rbx
cmp rax, rbx
je 0x1400023fd
lea rsi, [rax - 0x18]
cmp byte [rax - 1], 0
jns 0x1400023f0
mov rcx, qword [rax - 0x18]
call fcn.14000f520
mov rax, rsi
cmp rsi, rbx
jne 0x1400023dd
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbx
call fcn.14000f520
xor esi, esi
lea rcx, [rsp + 0x90]
call fcn.1400019a0
cmp byte [rsp + 0xc7], 0
jns 0x14000242d
mov rcx, qword [rsp + 0xb0]
call fcn.14000f520
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400101c0
mov eax, esi
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xb8]
lea rcx, [rsp + 0x70]
call fcn.14000c6d0
jmp 0x140002179
add r9, 0xfffffffffffffffe
sar r9, 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x90]
lea rsi, [rsp + 0xb0]
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.14000c980
movzx r8d, byte [0x140069417]
test r8b, r8b
jns 0x1400024be
mov r8, qword [0x140069408]
mov rdx, qword [0x140069400]
jmp 0x1400024c5
lea rdx, [0x140069400]
mov rcx, rdi
call fcn.14000c7d0
cmp rsi, rax
je 0x140002513
cmp byte [rsp + 0xc7], 0
movzx r8d, byte [rax + 0x17]
js 0x140002533
test r8b, r8b
jns 0x1400024fc
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0xb0]
call fcn.14000cbb0
jmp 0x140002513
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xc0], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xb0], xmm0
cmp byte [rsp + 0xa7], 0
jns 0x14000212c
mov rcx, qword [rsp + 0x90]
call fcn.14000f520
jmp 0x14000212c
test r8b, r8b
jns 0x14000253f
mov r8, qword [rax + 8]
mov rax, qword [rax]
lea rcx, [rsp + 0xb0]
mov rdx, rax
call fcn.14000cac0
jmp 0x140002513