Function at 0x140006920
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1eb0
call fcn.1400c0130
sub rsp, rax
lea rdi, [rsp + 0x40]
mov ecx, 0x79c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1ec0]
lea rcx, [rsp + 0x50]
call fcn.140004cd0
nop
lea rdx, str.a365
lea rcx, [rsp + 0x370]
call fcn.140004c00
mov qword [rsp + 0x1a10], rax
mov rax, qword [rsp + 0x1a10]
mov qword [rsp + 0x1a18], rax
mov rdx, qword [rsp + 0x1a18]
lea rcx, [rsp + 0x338]
call fcn.1400448a0
mov qword [rsp + 0x1a20], rax
mov rax, qword [rsp + 0x1a20]
mov qword [rsp + 0x1a28], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1a28]
mov rcx, rax
call fcn.14000a970
nop
lea rcx, [rsp + 0x338]
call fcn.140004d30
nop
lea rcx, [rsp + 0x370]
call fcn.140004d90
lea rcx, [rsp + 0x3c8]
call fcn.1400068a0
mov qword [rsp + 0x1a30], rax
mov rax, qword [rsp + 0x1a30]
mov qword [rsp + 0x1a38], rax
mov rdx, qword [rsp + 0x1a38]
lea rcx, [rsp + 0x50]
call fcn.140008980
nop
lea rcx, [rsp + 0x3c8]
call fcn.140004db0
mov r8d, 4
lea rdx, [rsp + 0x428]
lea rcx, [rsp + 0x50]
call fcn.140055590
mov qword [rsp + 0x1a40], rax
mov rax, qword [rsp + 0x1a40]
mov qword [rsp + 0x1a48], rax
lea rdx, [0x1401a66c8]
mov rcx, qword [rsp + 0x1a48]
call fcn.1400089b0
mov dword [rsp + 0x420], eax
lea rcx, [rsp + 0x428]
call fcn.140004db0
cmp dword [rsp + 0x420], 0
je 0x140007d57
lea rdx, str.2022_10_1_20:01:12
lea rcx, [rsp + 0x480]
call fcn.140004c00
mov qword [rsp + 0x1a50], rax
mov rax, qword [rsp + 0x1a50]
mov qword [rsp + 0x1a58], rax
mov rcx, qword [rsp + 0x1a58]
call fcn.140052720
mov edx, 1
mov rcx, rax
call fcn.140060b90
movsd qword [rsp + 0xb8], xmm0
lea rcx, [rsp + 0x480]
call fcn.140004d90
call fcn.1400625f0
movsd xmm1, qword [rsp + 0xb8]
comisd xmm1, xmm0
jbe 0x140006bbd
lea rdx, [0x1401a66d4]
lea rcx, [rsp + 0x510]
call fcn.140004c00
mov qword [rsp + 0x1a60], rax
mov rax, qword [rsp + 0x1a60]
mov qword [rsp + 0x1a68], rax
mov rdx, qword [rsp + 0x1a68]
lea rcx, [rsp + 0x4d8]
call fcn.1400448a0
mov qword [rsp + 0x1a70], rax
mov rax, qword [rsp + 0x1a70]
mov qword [rsp + 0x1a78], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1a78]
mov rcx, rax
call fcn.14000a970
nop
lea rcx, [rsp + 0x4d8]
call fcn.140004d30
nop
lea rcx, [rsp + 0x510]
call fcn.140004d90
mov dword [rsp + 0x568], 1
lea rcx, [rsp + 0x50]
call fcn.140004db0
mov eax, dword [rsp + 0x568]
jmp 0x1400082bc
lea rcx, [rsp + 0x570]
call fcn.140011270
mov qword [rsp + 0x1a80], rax
mov rax, qword [rsp + 0x1a80]
mov qword [rsp + 0x1a88], rax
mov r8d, 4
lea rdx, [rsp + 0x5c8]
mov rcx, qword [rsp + 0x1a88]
call fcn.140055590
mov qword [rsp + 0x1a90], rax
mov rax, qword [rsp + 0x1a90]
mov qword [rsp + 0x1a98], rax
mov r8d, 1
lea rdx, [rsp + 0x620]
mov rcx, qword [rsp + 0x1a98]
call fcn.140055400
mov qword [rsp + 0x1aa0], rax
mov rax, qword [rsp + 0x1aa0]
mov qword [rsp + 0x1aa8], rax
lea rdx, [0x1401a66c4]
mov rcx, qword [rsp + 0x1aa8]
call fcn.140008a20
mov dword [rsp + 0x56c], eax
lea rcx, [rsp + 0x620]
call fcn.140004db0
nop
lea rcx, [rsp + 0x5c8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x570]
call fcn.140004db0
cmp dword [rsp + 0x56c], 0
je 0x140006ca6
xor edx, edx
lea rcx, [0x140259aa0]
call fcn.1400114d0
jmp 0x140006cc7
mov dword [rsp + 0x678], 1
lea rcx, [rsp + 0x50]
call fcn.140004db0
mov eax, dword [rsp + 0x678]
jmp 0x1400082bc
lea rcx, [rsp + 0xd0]
call fcn.140004cd0
nop
lea rcx, [rsp + 0x150]
call fcn.140004cd0
nop
lea rcx, [rsp + 0x50]
call fcn.1400527a0
mov qword [rsp + 0x1ab0], rax
lea rdx, [0x1401a66dc]
lea rcx, [rsp + 0x680]
call fcn.140004c00
mov qword [rsp + 0x1ab8], rax
mov rax, qword [rsp + 0x1ab8]
mov qword [rsp + 0x1ac0], rax
mov rcx, qword [rsp + 0x1ac0]
call fcn.140052720
mov qword [rsp + 0x20], 1
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140056030
mov rcx, qword [rsp + 0x1ab0]
sub ecx, eax
mov eax, ecx
dec eax
cdqe
mov r8, rax
lea rdx, [rsp + 0x6d8]
lea rcx, [rsp + 0x50]
call fcn.140055590
mov qword [rsp + 0x1ac8], rax
mov rax, qword [rsp + 0x1ac8]
mov qword [rsp + 0x1ad0], rax
mov rdx, qword [rsp + 0x1ad0]
lea rcx, [rsp + 0x150]
call fcn.140008980
nop
lea rcx, [rsp + 0x6d8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x680]
call fcn.140004d90
lea rcx, [rsp + 0x150]
call fcn.1400527a0
sub eax, 7
cdqe
mov r8, rax
lea rdx, [rsp + 0x730]
lea rcx, [rsp + 0x150]
call fcn.140055400
mov qword [rsp + 0x1ad8], rax
mov rax, qword [rsp + 0x1ad8]
mov qword [rsp + 0x1ae0], rax
mov rdx, qword [rsp + 0x1ae0]
lea rcx, [rsp + 0x150]
call fcn.140008980
nop
lea rcx, [rsp + 0x730]
call fcn.140004db0
call fcn.1400161a0
mov dword [rsp + 0x1ae8], eax
lea rcx, [rsp + 0x788]
call fcn.140044830
mov qword [rsp + 0x1af0], rax
mov rax, qword [rsp + 0x1af0]
mov qword [rsp + 0x1af8], rax
lea rcx, [rsp + 0x150]
call fcn.140052720
mov rdx, qword [rsp + 0x1af8]
mov rcx, rax
call fcn.1400095e0
mov ecx, dword [rsp + 0x1ae8]
mov r8d, ecx
mov rdx, rax
lea rcx, [rsp + 0x7c0]
call fcn.140006770
mov qword [rsp + 0x1b00], rax
mov rax, qword [rsp + 0x1b00]
mov qword [rsp + 0x1b08], rax
mov rdx, qword [rsp + 0x1b08]
lea rcx, [rsp + 0x7f8]
call fcn.140012e90
mov qword [rsp + 0x1b10], rax
mov rax, qword [rsp + 0x1b10]
mov qword [rsp + 0x1b18], rax
mov rdx, qword [rsp + 0x1b18]
lea rcx, [rsp + 0x150]
call fcn.140008980
nop
lea rcx, [rsp + 0x7f8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x7c0]
call fcn.140004d30
nop
lea rcx, [rsp + 0x788]
call fcn.140004d30
lea rcx, [rsp + 0x150]
call fcn.1400527a0
mov qword [rsp + 0x1b20], rax
lea rdx, [0x1401a66e0]
lea rcx, [rsp + 0x850]
call fcn.140004c00
mov qword [rsp + 0x1b28], rax
mov rax, qword [rsp + 0x1b28]
mov qword [rsp + 0x1b30], rax
mov rcx, qword [rsp + 0x1b30]
call fcn.140052720
mov qword [rsp + 0x20], 1
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140056030
mov rcx, qword [rsp + 0x1b20]
sub ecx, eax
mov eax, ecx
dec eax
cdqe
mov r8, rax
lea rdx, [rsp + 0x8a8]
lea rcx, [rsp + 0x150]
call fcn.140055590
mov qword [rsp + 0x1b38], rax
mov rax, qword [rsp + 0x1b38]
mov qword [rsp + 0x1b40], rax
mov rdx, qword [rsp + 0x1b40]
lea rcx, [rsp + 0xd0]
call fcn.140008980
nop
lea rcx, [rsp + 0x8a8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x850]
call fcn.140004d90
lea rcx, [rsp + 0x150]
call fcn.1400527a0
mov qword [rsp + 0x1b48], rax
lea rcx, [rsp + 0xd0]
call fcn.1400527a0
mov rcx, qword [rsp + 0x1b48]
sub ecx, eax
mov eax, ecx
cdqe
mov r8, rax
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x150]
call fcn.140055400
mov qword [rsp + 0x1b50], rax
mov rax, qword [rsp + 0x1b50]
mov qword [rsp + 0x1b58], rax
mov rdx, qword [rsp + 0x1b58]
lea rcx, [rsp + 0x150]
call fcn.140008980
nop
lea rcx, [rsp + 0x900]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.140036d60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x958]
call fcn.140058800
mov qword [rsp + 0x1b60], rax
mov rax, qword [rsp + 0x1b60]
mov qword [rsp + 0x1b68], rax
lea r8, str..exe
mov rdx, qword [rsp + 0x1b68]
lea rcx, [rsp + 0x9b0]
call fcn.140058a70
mov qword [rsp + 0x1b70], rax
mov rax, qword [rsp + 0x1b70]
mov qword [rsp + 0x1b78], rax
mov rcx, qword [rsp + 0x1b78]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x9b0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x958]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.140036d60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xa08]
call fcn.1400066c0
mov qword [rsp + 0x1b80], rax
mov rax, qword [rsp + 0x1b80]
mov qword [rsp + 0x1b88], rax
mov rdx, qword [rsp + 0x1b88]
mov rcx, qword [rsp + 0x1b8]
call fcn.1400160d0
nop
lea rcx, [rsp + 0xa08]
call fcn.140004d30
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.140036d60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1401a6720]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xa40]
call fcn.140058a70
mov qword [rsp + 0x1b90], rax
mov rax, qword [rsp + 0x1b90]
mov qword [rsp + 0x1b98], rax
mov rcx, qword [rsp + 0x1b98]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xa40]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.140036d60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xa98]
call fcn.140006610
mov qword [rsp + 0x1ba0], rax
mov rax, qword [rsp + 0x1ba0]
mov qword [rsp + 0x1ba8], rax
mov rdx, qword [rsp + 0x1ba8]
mov rcx, qword [rsp + 0x1b8]
call fcn.1400160d0
nop
lea rcx, [rsp + 0xa98]
call fcn.140004d30
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xad0]
call fcn.140058800
mov qword [rsp + 0x1bb0], rax
mov rax, qword [rsp + 0x1bb0]
mov qword [rsp + 0x1bb8], rax
lea r8, [0x1401a6778]
mov rdx, qword [rsp + 0x1bb8]
lea rcx, [rsp + 0xb28]
call fcn.140058a70
mov qword [rsp + 0x1bc0], rax
mov rax, qword [rsp + 0x1bc0]
mov qword [rsp + 0x1bc8], rax
mov rcx, qword [rsp + 0x1bc8]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xb28]
call fcn.140004db0
nop
lea rcx, [rsp + 0xad0]
call fcn.140004db0
mov rdx, qword [rsp + 0x1ec0]
mov rcx, qword [rsp + 0x1b8]
call fcn.1400160d0
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1401a66e4]
lea rcx, [rsp + 0xbb8]
call fcn.140004c00
mov qword [rsp + 0x1bd0], rax
mov rax, qword [rsp + 0x1bd0]
mov qword [rsp + 0x1bd8], rax
mov rdx, qword [rsp + 0x1bd8]
lea rcx, [rsp + 0xb80]
call fcn.1400448a0
mov qword [rsp + 0x1be0], rax
mov rax, qword [rsp + 0x1be0]
mov qword [rsp + 0x1be8], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1be8]
mov rcx, rax
call fcn.14000a970
nop
lea rcx, [rsp + 0xb80]
call fcn.140004d30
nop
lea rcx, [rsp + 0xbb8]
call fcn.140004d90
mov ecx, 0x5669
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401a6704]
lea rcx, [rsp + 0xc10]
call fcn.140004c00
mov qword [rsp + 0x1bf0], rax
mov rax, qword [rsp + 0x1bf0]
mov qword [rsp + 0x1bf8], rax
lea r8, [rsp + 0x150]
mov rdx, qword [rsp + 0x1bf8]
lea rcx, [rsp + 0xc68]
call fcn.140058800
mov qword [rsp + 0x1c00], rax
mov rax, qword [rsp + 0x1c00]
mov qword [rsp + 0x1c08], rax
lea r8, [rsp + 0xd0]
mov rdx, qword [rsp + 0x1c08]
lea rcx, [rsp + 0xcc0]
call fcn.140058800
mov qword [rsp + 0x1c10], rax
mov rax, qword [rsp + 0x1c10]
mov qword [rsp + 0x1c18], rax
lea r8, [0x1401a66f8]
mov rdx, qword [rsp + 0x1c18]
lea rcx, [rsp + 0xd18]
call fcn.140058a70
mov qword [rsp + 0x1c20], rax
mov rax, qword [rsp + 0x1c20]
mov qword [rsp + 0x1c28], rax
mov rcx, qword [rsp + 0x1c28]
call fcn.140052720
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1401a6788]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xd18]
call fcn.140004db0
nop
lea rcx, [rsp + 0xcc0]
call fcn.140004db0
nop
lea rcx, [rsp + 0xc68]
call fcn.140004db0
nop
lea rcx, [rsp + 0xc10]
call fcn.140004d90
cmp dword [rsp + 0x1ec8], 0x5f1
jle 0x140007d1a
mov edx, 0x3a98
mov ecx, 0x2710
call fcn.140036d60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x1d0]
call fcn.140004cd0
nop
lea rcx, [rsp + 0x250]
call fcn.140004cd0
nop
mov edx, 8
lea rcx, [rsp + 0xd70]
call fcn.140010e50
mov qword [rsp + 0x1c30], rax
mov rax, qword [rsp + 0x1c30]
mov qword [rsp + 0x1c38], rax
lea r8, [0x1401a6708]
mov rdx, qword [rsp + 0x1c38]
lea rcx, [rsp + 0xdc8]
call fcn.140058a70
mov qword [rsp + 0x1c40], rax
mov rax, qword [rsp + 0x1c40]
mov qword [rsp + 0x1c48], rax
mov rdx, qword [rsp + 0x1c48]
lea rcx, [rsp + 0x1d0]
call fcn.140008980
nop
lea rcx, [rsp + 0xdc8]
call fcn.140004db0
nop
lea rcx, [rsp + 0xd70]
call fcn.140004db0
mov edx, 5
lea rcx, [rsp + 0xe20]
call fcn.140012c10
mov qword [rsp + 0x1c50], rax
mov rax, qword [rsp + 0x1c50]
mov qword [rsp + 0x1c58], rax
mov rdx, qword [rsp + 0x1c58]
lea rcx, [rsp + 0x250]
call fcn.140008980
nop
lea rcx, [rsp + 0xe20]
call fcn.140004db0
lea rcx, [rsp + 0x1d0]
call fcn.140052720
mov rcx, rax
call fcn.140037d50
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0xe78]
call fcn.140058800
mov qword [rsp + 0x1c60], rax
mov rax, qword [rsp + 0x1c60]
mov qword [rsp + 0x1c68], rax
lea r8, [0x1401a6798]
mov rdx, qword [rsp + 0x1c68]
lea rcx, [rsp + 0xed0]
call fcn.140058a70
mov qword [rsp + 0x1c70], rax
mov rax, qword [rsp + 0x1c70]
mov qword [rsp + 0x1c78], rax
mov rcx, qword [rsp + 0x1c78]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xed0]
call fcn.140004db0
nop
lea rcx, [rsp + 0xe78]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.140036d60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xf28]
call fcn.1400066c0
mov qword [rsp + 0x1c80], rax
mov rax, qword [rsp + 0x1c80]
mov qword [rsp + 0x1c88], rax
mov rdx, qword [rsp + 0x1c88]
mov rcx, qword [rsp + 0x1b8]
call fcn.1400160d0
nop
lea rcx, [rsp + 0xf28]
call fcn.140004d30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.140036d60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.Microsoft.WindowsAppRuntime.Bootstrap.dll
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0xf60]
call fcn.140058a70
mov qword [rsp + 0x1c90], rax
mov rax, qword [rsp + 0x1c90]
mov qword [rsp + 0x1c98], rax
mov rcx, qword [rsp + 0x1c98]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xf60]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.140036d60
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xfb8]
call fcn.140006610
mov qword [rsp + 0x1ca0], rax
mov rax, qword [rsp + 0x1ca0]
mov qword [rsp + 0x1ca8], rax
mov rdx, qword [rsp + 0x1ca8]
mov rcx, qword [rsp + 0x1b8]
call fcn.1400160d0
nop
lea rcx, [rsp + 0xfb8]
call fcn.140004d30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0xff0]
call fcn.140058800
mov qword [rsp + 0x1cb0], rax
mov rax, qword [rsp + 0x1cb0]
mov qword [rsp + 0x1cb8], rax
lea r8, [0x1401a6808]
mov rdx, qword [rsp + 0x1cb8]
lea rcx, [rsp + 0x1048]
call fcn.140058a70
mov qword [rsp + 0x1cc0], rax
mov rax, qword [rsp + 0x1cc0]
mov qword [rsp + 0x1cc8], rax
mov rcx, qword [rsp + 0x1cc8]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x1048]
call fcn.140004db0
nop
lea rcx, [rsp + 0xff0]
call fcn.140004db0
mov dword [rsp + 0x10a0], 0
mov dword [rsp + 0x10a4], 0
lea rdx, str.95BBFFFFE16ACD15355D7F0C57E87F12B725A20B6365AD096A71998F71E272D4FD2F6C403FB63B5A32F489185E4915614CBEA3841BCE6C98874980B2CD0104990C7320E0
lea rcx, [rsp + 0x10a8]
call fcn.140004c00
mov qword [rsp + 0x1cd0], rax
mov rax, qword [rsp + 0x1cd0]
mov qword [rsp + 0x1cd8], rax
lea r9, [rsp + 0x10a0]
lea r8, [rsp + 0x10a4]
mov rdx, qword [rsp + 0x1cd8]
lea rcx, [rsp + 0x1100]
call fcn.140006510
mov qword [rsp + 0x1ce0], rax
mov rax, qword [rsp + 0x1ce0]
mov qword [rsp + 0x1ce8], rax
mov rdx, qword [rsp + 0x1ce8]
mov rcx, qword [rsp + 0x1b8]
call fcn.1400160d0
nop
lea rcx, [rsp + 0x1100]
call fcn.140004d30
nop
lea rcx, [rsp + 0x10a8]
call fcn.140004d90
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401a67a8]
lea rcx, [rsp + 0x1170]
call fcn.140004c00
mov qword [rsp + 0x1cf0], rax
mov rax, qword [rsp + 0x1cf0]
mov qword [rsp + 0x1cf8], rax
mov rdx, qword [rsp + 0x1cf8]
lea rcx, [rsp + 0x1138]
call fcn.1400448a0
mov qword [rsp + 0x1d00], rax
mov rax, qword [rsp + 0x1d00]
mov qword [rsp + 0x1d08], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1d08]
mov rcx, rax
call fcn.14000a970
nop
lea rcx, [rsp + 0x1138]
call fcn.140004d30
nop
lea rcx, [rsp + 0x1170]
call fcn.140004d90
lea rdx, [0x1401a6774]
lea rcx, [rsp + 0x11c8]
call fcn.140004c00
mov qword [rsp + 0x1d10], rax
mov rax, qword [rsp + 0x1d10]
mov qword [rsp + 0x1d18], rax
lea r8, [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1d18]
lea rcx, [rsp + 0x1220]
call fcn.140058800
mov qword [rsp + 0x1d20], rax
mov rax, qword [rsp + 0x1d20]
mov qword [rsp + 0x1d28], rax
lea r8, [rsp + 0x250]
mov rdx, qword [rsp + 0x1d28]
lea rcx, [rsp + 0x1278]
call fcn.140058800
mov qword [rsp + 0x1d30], rax
mov rax, qword [rsp + 0x1d30]
mov qword [rsp + 0x1d38], rax
lea r8, str..exe_
mov rdx, qword [rsp + 0x1d38]
lea rcx, [rsp + 0x12d0]
call fcn.140058a70
mov qword [rsp + 0x1d40], rax
mov rax, qword [rsp + 0x1d40]
mov qword [rsp + 0x1d48], rax
mov rcx, qword [rsp + 0x1d48]
call fcn.140052720
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1401a6968]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x12d0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1278]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1220]
call fcn.140004db0
nop
lea rcx, [rsp + 0x11c8]
call fcn.140004d90
lea rdx, [0x1401a6784]
lea rcx, [rsp + 0x1360]
call fcn.140004c00
mov qword [rsp + 0x1d50], rax
mov rax, qword [rsp + 0x1d50]
mov qword [rsp + 0x1d58], rax
mov rdx, qword [rsp + 0x1d58]
lea rcx, [rsp + 0x1328]
call fcn.1400448a0
mov qword [rsp + 0x1d60], rax
mov rax, qword [rsp + 0x1d60]
mov qword [rsp + 0x1d68], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1d68]
mov rcx, rax
call fcn.14000a970
nop
lea rcx, [rsp + 0x1328]
call fcn.140004d30
nop
lea rcx, [rsp + 0x1360]
call fcn.140004d90
nop
lea rcx, [rsp + 0x250]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1d0]
call fcn.140004db0
mov dword [rsp + 0x13b8], 1
lea rcx, [rsp + 0x150]
call fcn.140004db0
nop
lea rcx, [rsp + 0xd0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x50]
call fcn.140004db0
mov eax, dword [rsp + 0x13b8]
jmp 0x1400082bc
lea rcx, [rsp + 0x2d0]
call fcn.140004cd0
nop
xor ecx, ecx
call fcn.140036a90
mov edx, 0xa
mov ecx, 5
call fcn.140036d60
mov edx, eax
lea rcx, [rsp + 0x13c0]
call fcn.140012c10
mov qword [rsp + 0x1d70], rax
mov rax, qword [rsp + 0x1d70]
mov qword [rsp + 0x1d78], rax
mov edx, 0xa
mov ecx, 5
call fcn.140036d60
mov edx, eax
lea rcx, [rsp + 0x1418]
call fcn.140012c10
mov qword [rsp + 0x1d80], rax
mov rax, qword [rsp + 0x1d80]
mov qword [rsp + 0x1d88], rax
mov edx, 8
lea rcx, [rsp + 0x1470]
call fcn.140010e50
mov qword [rsp + 0x1d90], rax
mov rax, qword [rsp + 0x1d90]
mov qword [rsp + 0x1d98], rax
lea r8, str.aokhn_
mov rdx, qword [rsp + 0x1d98]
lea rcx, [rsp + 0x14c8]
call fcn.140058a70
mov qword [rsp + 0x1da0], rax
mov rax, qword [rsp + 0x1da0]
mov qword [rsp + 0x1da8], rax
mov r8, qword [rsp + 0x1d88]
mov rdx, qword [rsp + 0x1da8]
lea rcx, [rsp + 0x1520]
call fcn.140058800
mov qword [rsp + 0x1db0], rax
mov rax, qword [rsp + 0x1db0]
mov qword [rsp + 0x1db8], rax
lea r8, [0x1401a6804]
mov rdx, qword [rsp + 0x1db8]
lea rcx, [rsp + 0x1578]
call fcn.140058a70
mov qword [rsp + 0x1dc0], rax
mov rax, qword [rsp + 0x1dc0]
mov qword [rsp + 0x1dc8], rax
mov r8, qword [rsp + 0x1d78]
mov rdx, qword [rsp + 0x1dc8]
lea rcx, [rsp + 0x15d0]
call fcn.140058800
mov qword [rsp + 0x1dd0], rax
mov rax, qword [rsp + 0x1dd0]
mov qword [rsp + 0x1dd8], rax
lea r8, [0x1401a6794]
mov rdx, qword [rsp + 0x1dd8]
lea rcx, [rsp + 0x1628]
call fcn.140058a70
mov qword [rsp + 0x1de0], rax
mov rax, qword [rsp + 0x1de0]
mov qword [rsp + 0x1de8], rax
mov rdx, qword [rsp + 0x1de8]
lea rcx, [rsp + 0x2d0]
call fcn.140008980
nop
lea rcx, [rsp + 0x1628]
call fcn.140004db0
nop
lea rcx, [rsp + 0x15d0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1578]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1520]
call fcn.140004db0
nop
lea rcx, [rsp + 0x14c8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1470]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1418]
call fcn.140004db0
nop
lea rcx, [rsp + 0x13c0]
call fcn.140004db0
lea rcx, [rsp + 0x2d0]
call fcn.140052720
mov rcx, rax
call fcn.140037d50
lea rcx, [rsp + 0x17a0]
call fcn.140004cd0
mov qword [rsp + 0x1df0], rax
mov rax, qword [rsp + 0x1df0]
mov qword [rsp + 0x1df8], rax
call fcn.1400161a0
mov dword [rsp + 0x1e00], eax
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov ecx, 5
call fcn.140036d60
mov edx, eax
lea rcx, [rsp + 0x16b8]
call fcn.140012c10
mov qword [rsp + 0x1e08], rax
mov rax, qword [rsp + 0x1e08]
mov qword [rsp + 0x1e10], rax
mov r8, qword [rsp + 0x1e10]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x1710]
call fcn.140058800
mov qword [rsp + 0x1e18], rax
mov rax, qword [rsp + 0x1e18]
mov qword [rsp + 0x1e20], rax
mov rdx, qword [rsp + 0x1e20]
lea rcx, [rsp + 0x1680]
call fcn.1400448a0
mov qword [rsp + 0x1e28], rax
mov rax, qword [rsp + 0x1e28]
mov qword [rsp + 0x1e30], rax
mov eax, dword [rsp + 0x1e00]
mov r8d, eax
mov rdx, qword [rsp + 0x1e30]
lea rcx, [rsp + 0x1768]
call fcn.140006770
mov qword [rsp + 0x1e38], rax
mov rax, qword [rsp + 0x1e38]
mov qword [rsp + 0x1e40], rax
mov rdx, qword [rsp + 0x1df8]
mov rcx, qword [rsp + 0x1e40]
call fcn.1400477f0
mov qword [rsp + 0x1e48], rax
lea rcx, [rsp + 0x17f8]
call fcn.140011270
mov qword [rsp + 0x1e50], rax
mov rax, qword [rsp + 0x1e50]
mov qword [rsp + 0x1e58], rax
lea rcx, [rsp + 0x1850]
call fcn.1400111d0
mov qword [rsp + 0x1e60], rax
mov rax, qword [rsp + 0x1e60]
mov qword [rsp + 0x1e68], rax
mov r8, qword [rsp + 0x1e58]
mov rdx, qword [rsp + 0x1e68]
lea rcx, [rsp + 0x18a8]
call fcn.140058800
mov qword [rsp + 0x1e70], rax
mov rax, qword [rsp + 0x1e70]
mov qword [rsp + 0x1e78], rax
lea r8, [0x1401a6824]
mov rdx, qword [rsp + 0x1e78]
lea rcx, [rsp + 0x1900]
call fcn.140058a70
mov qword [rsp + 0x1e80], rax
mov rax, qword [rsp + 0x1e80]
mov qword [rsp + 0x1e88], rax
mov rax, qword [rsp + 0x1e48]
mov r8, rax
mov rdx, qword [rsp + 0x1e88]
lea rcx, [rsp + 0x1958]
call fcn.140058800
mov qword [rsp + 0x1e90], rax
mov rax, qword [rsp + 0x1e90]
mov qword [rsp + 0x1e98], rax
lea r8, str.__aa_
mov rdx, qword [rsp + 0x1e98]
lea rcx, [rsp + 0x19b0]
call fcn.140058a70
mov qword [rsp + 0x1ea0], rax
mov rax, qword [rsp + 0x1ea0]
mov qword [rsp + 0x1ea8], rax
mov rcx, qword [rsp + 0x1ea8]
call fcn.140052720
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.140039f50
nop
lea rcx, [rsp + 0x19b0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1958]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1900]
call fcn.140004db0
nop
lea rcx, [rsp + 0x18a8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1850]
call fcn.140004db0
nop
lea rcx, [rsp + 0x17f8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1768]
call fcn.140004d30
nop
lea rcx, [rsp + 0x1680]
call fcn.140004d30
nop
lea rcx, [rsp + 0x1710]
call fcn.140004db0
nop
lea rcx, [rsp + 0x16b8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x17a0]
call fcn.140004db0
mov dword [rsp + 0x1a08], 1
lea rcx, [rsp + 0x2d0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x50]
call fcn.140004db0
mov eax, dword [rsp + 0x1a08]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.1400bfd90
mov rax, rdi
add rsp, 0x1eb0
pop rdi
ret