Function at 0x140010940
Capabilities:
Accept command line arguments
Check if file exists
Create directory
Create process on windows
Create thread
Delete file
Extract resource via kernel32 functions
Get common file path
Get file attributes
Query environment variable
Set current directory
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rdi
sub rsp, 0x620
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x230], rax
mov dword [rsp + 0x210], 0
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x1e4], 0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [0x14001b880], rax
mov r9d, 0x104
lea r8, [0x14001bef0]
mov edx, 1
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r9d, 8
lea r8, [0x14001bcc8]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElemsize
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r8d, 0xc8
lea rdx, [rsp + 0x110]
lea rcx, [0x14001bcc8]
call fcn.14000f410
mov dword [rsp + 0x50], eax
mov r8d, 0x208
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x258], rax
cmp qword [rsp + 0x258], 0
jne 0x140010a0f
jmp 0x1400135c6
mov r8d, 0x79
mov edx, 5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
je 0x140010ab2
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 0
je 0x140010ab2
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x140010ab2
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x288], eax
cmp dword [rsp + 0x288], 1
jne 0x140010ab2
mov rax, qword [rsp + 0x1f0]
movzx eax, byte [rax]
cmp eax, 1
jne 0x140010ab2
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x108], 8
mov dword [rsp + 0x10c], 0x404
lea rcx, [rsp + 0x108]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov r8d, 0x79
mov edx, 7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
je 0x140010b75
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 0
je 0x140010b75
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x140010b75
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x288], eax
mov eax, dword [rsp + 0x288]
cmp rax, 4
jne 0x140010b75
mov rax, qword [rsp + 0x1f0]
mov eax, dword [rax]
mov dword [rsp + 0x1e4], eax
mov byte [0x14001b8a0], 0
mov r8d, 0x204
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x280], rax
mov r8d, 0x79
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
je 0x140010cd9
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 0
jne 0x140010bf1
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
jne 0x140010c1d
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28c], eax
mov eax, dword [rsp + 0x28c]
cmp rax, 0x100
jbe 0x140010c4e
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, 0x100
xor edx, edx
lea rcx, [0x14001bbc0]
call fcn.140013830
lea rdx, str.Everstrike_Software
lea rcx, [0x14001bbc0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8d, 0x100
lea rdx, [0x14001bbc0]
mov rcx, qword [rsp + 0x280]
call fcn.140001710
mov edx, dword [rsp + 0x28c]
lea rax, [0x14001b8a0]
mov byte [rax + rdx], 0
mov r8d, dword [rsp + 0x28c]
mov rdx, qword [rsp + 0x1f0]
lea rcx, [0x14001b8a0]
call fcn.140013950
mov r8, qword [rsp + 0x280]
mov edx, dword [rsp + 0x28c]
lea rcx, [0x14001b8a0]
call fcn.14000ec30
lea rcx, [0x14001b8a0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x140010e06
mov r9d, 0x104
lea r8, [0x14001bde0]
mov edx, 0x21
mov rcx, qword [rsp + 0x230]
call qword [sym.imp.USER32.dll_LoadStringA]
cmp dword [rsp + 0x54], 0
jne 0x140010d3a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r9d, r9d
lea r8, str.Warning
lea rdx, [0x14001bde0]
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140010e06
mov ecx, 0xfffffff5
call fcn.140007970
mov qword [rsp + 0x290], rax
mov ecx, 0xfffffff6
call fcn.140007970
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x290], 0xffffffffffffffff
je 0x140010e06
lea rdx, [0x14001bde0]
lea rcx, [0x14001bde0]
call qword [sym.imp.USER32.dll_CharToOemA]
lea rcx, [0x14001bde0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x288]
mov r8d, eax
lea rdx, [0x14001bde0]
mov rcx, qword [rsp + 0x290]
call fcn.1400079d0
xor eax, eax
cmp eax, 1
je 0x140010e06
lea r9, [rsp + 0x288]
mov r8d, 1
lea rdx, [rsp + 0x298]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
test eax, eax
jne 0x140010de7
jmp 0x140010e06
movzx eax, word [rsp + 0x298]
cmp eax, 1
je 0x140010df6
jmp 0x140010db6
cmp dword [rsp + 0x29c], 0
jne 0x140010e02
jmp 0x140010db6
jmp 0x140010e06
mov r8d, 0x79
mov edx, 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
je 0x140011229
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 0
jne 0x140010e5e
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
jne 0x140010e8a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x288], eax
cmp dword [rsp + 0x288], 0x10
je 0x140010eb6
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, SafeArrayGetLBound
mov rdx, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x270]
call fcn.140013950
mov dword [rsp + 0x210], 1
mov dword [rsp + 0x340], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [rsp + 0x338], rax
lea rcx, [rsp + 0x2c0]
call fcn.140015480
mov dword [rsp + 0x330], 0
mov byte [rsp + 0x350], 0x20
mov dword [rsp + 0x2b8], 0
mov rax, qword [rsp + 0x338]
movsx eax, byte [rax]
cmp eax, 0x22
jne 0x140010f43
mov byte [rsp + 0x350], 0x22
mov dword [rsp + 0x330], 1
jmp 0x140010f56
mov eax, dword [rsp + 0x330]
add eax, 1
mov dword [rsp + 0x330], eax
movsxd rcx, dword [rsp + 0x330]
mov rax, qword [rsp + 0x338]
movsx eax, byte [rax + rcx]
test eax, eax
je 0x140010fa3
movsxd rcx, dword [rsp + 0x330]
mov rax, qword [rsp + 0x338]
movsx ecx, byte [rax + rcx]
movsx eax, byte [rsp + 0x350]
cmp ecx, eax
jne 0x140010fa1
mov eax, dword [rsp + 0x330]
add eax, 1
mov dword [rsp + 0x330], eax
jmp 0x140010fa3
jmp 0x140010f45
movsxd rcx, dword [rsp + 0x330]
mov rax, qword [rsp + 0x338]
movsx eax, byte [rax + rcx]
cmp eax, 0x20
jne 0x140010fcf
mov eax, dword [rsp + 0x330]
add eax, 1
mov dword [rsp + 0x330], eax
jmp 0x140010fa3
movsxd rax, dword [rsp + 0x330]
mov rdx, qword [rsp + 0x338]
add rdx, rax
lea rcx, [rsp + 0x2c0]
call fcn.140009480
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x2c0]
call fcn.140009d30
mov dword [rsp + 0x330], 0
jmp 0x140011022
mov eax, dword [rsp + 0x330]
add eax, 1
mov dword [rsp + 0x330], eax
mov eax, dword [rsp + 0x2b8]
cmp dword [rsp + 0x330], eax
jge 0x1400111ea
lea r8, [rsp + 0x348]
mov edx, dword [rsp + 0x330]
lea rcx, [rsp + 0x2c0]
call fcn.140009c50
lea rdx, str._pass
mov rcx, qword [rsp + 0x348]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400111d7
mov eax, dword [rsp + 0x2b8]
sub eax, 1
cmp dword [rsp + 0x330], eax
jge 0x1400111d7
mov edx, dword [rsp + 0x330]
add edx, 1
lea r8, [rsp + 0x3e0]
lea rcx, [rsp + 0x2c0]
call fcn.140009c50
mov rcx, qword [rsp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [rsp + 0x3c0], eax
movsxd r8, dword [rsp + 0x3c0]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x3c8], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x3c0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x3c8]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x3e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsp + 0x3c8]
lea rcx, [0x14001bde0]
call fcn.140013a30
mov rcx, qword [rsp + 0x3e0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x360]
call fcn.140005100
lea rcx, [0x14001bde0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
lea rdx, [0x14001bde0]
lea rcx, [rsp + 0x360]
call fcn.140006550
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x360]
call fcn.140006690
mov r8d, SafeArrayGetLBound
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x270]
call fcn.1400138a0
test eax, eax
jne 0x1400111b0
mov dword [rsp + 0x340], 1
mov rcx, qword [rsp + 0x348]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov r8, qword [rsp + 0x3c8]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400111ea
mov rcx, qword [rsp + 0x348]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x140011011
lea rcx, [rsp + 0x2c0]
call fcn.140009930
cmp dword [rsp + 0x340], 0
jne 0x140011229
mov r8d, dword [rsp + 0x54]
lea rdx, [rsp + 0x270]
lea rcx, [0x14001bde0]
call fcn.14000efa0
test eax, eax
jne 0x140011229
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x14001b8a0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1400112e5
mov r8d, 0x100
xor edx, edx
lea rcx, [0x14001bbc0]
call fcn.140013830
cmp dword [rsp + 0x210], 0
jne 0x1400112cf
lea rcx, [0x14001b8a0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x3e8], eax
mov dword [rsp + 0x3ec], 0
jmp 0x14001128e
mov eax, dword [rsp + 0x3ec]
add eax, 1
mov dword [rsp + 0x3ec], eax
mov eax, dword [rsp + 0x3e8]
cmp dword [rsp + 0x3ec], eax
jae 0x1400112cd
mov ecx, dword [rsp + 0x3ec]
lea rax, [0x14001b8a0]
movsx edx, byte [rax + rcx]
movsx eax, byte [rsp + 0x3ec]
xor edx, eax
mov ecx, dword [rsp + 0x3ec]
lea rax, [0x14001bbc0]
mov byte [rax + rcx], dl
jmp 0x14001127d
jmp 0x1400112e3
lea rdx, [0x14001bde0]
lea rcx, [0x14001bbc0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x14001130d
mov r8d, 0x100
xor edx, edx
lea rcx, [0x14001bbc0]
call fcn.140013830
lea rdx, [0x1400166e8]
lea rcx, [0x14001bbc0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8d, 0x100
lea rdx, [0x14001bbc0]
mov rcx, qword [rsp + 0x280]
call fcn.140001710
mov r8d, 0x79
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
jne 0x14001136f
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 0
jne 0x1400113b4
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
jne 0x1400113f7
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x70], eax
movsxd r8, dword [rsp + 0x70]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x250], rax
cmp qword [rsp + 0x250], 0
jne 0x14001145f
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [rsp + 0x70]
sub eax, 4
movsxd r8, eax
mov rdx, qword [rsp + 0x1f0]
add rdx, 4
mov rcx, qword [rsp + 0x250]
call fcn.140013950
mov edx, dword [rsp + 0x70]
sub edx, 4
mov r8, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x250]
call fcn.14000ec30
mov rdx, qword [rsp + 0x1f0]
mov eax, dword [rdx]
mov dword [rsp + 0x70], eax
movsxd rcx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x250]
mov byte [rax + rcx], 0
mov r8d, 0x79
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
jne 0x14001151c
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 0
jne 0x140011578
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
jne 0x1400115d2
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x5c], eax
movsxd r8, dword [rsp + 0x5c]
add r8, 1
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x208], rax
cmp qword [rsp + 0x208], 0
jne 0x14001164a
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movsxd r8, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x208]
call fcn.140013950
mov r8, qword [rsp + 0x280]
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x208]
call fcn.14000ec30
movsxd rdx, dword [rsp + 0x5c]
mov rax, qword [rsp + 0x208]
mov byte [rax + rdx], 0
mov ecx, 0x38
call fcn.1400137c0
mov qword [rsp + 0x4e8], rax
cmp qword [rsp + 0x4e8], 0
je 0x1400116ca
mov rdx, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x4e8]
call fcn.140006d70
mov qword [rsp + 0x5a8], rax
jmp 0x1400116d6
mov qword [rsp + 0x5a8], 0
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x5b0], eax
cmp dword [rsp + 0x5b0], 0
je 0x14001171b
cmp dword [rsp + 0x5b0], 1
je 0x140011732
cmp dword [rsp + 0x5b0], 2
je 0x140011749
jmp 0x140011809
lea rdx, [0x14001bcd0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x140011809
lea rdx, [0x14001bcd0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x140011809
mov rcx, qword [rsp + 0x1e8]
call fcn.140007140
mov rdx, rax
lea rcx, [0x14001bcd0]
call fcn.140013a30
mov r8d, 0x104
lea rdx, [0x14001bde0]
lea rcx, [0x14001bcd0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, qword [rsp + 0x1e8]
call fcn.140007140
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x3f0], eax
cmp dword [rsp + 0x3f0], 0xffffffff
jne 0x1400117b5
xor edx, edx
lea rcx, [0x14001bde0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [0x14001bde0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x3f0], eax
cmp dword [rsp + 0x3f0], 0xffffffff
je 0x1400117f7
mov eax, dword [rsp + 0x3f0]
and eax, 0x10
test eax, eax
je 0x1400117f7
lea rdx, [0x14001bde0]
lea rcx, [0x14001bcd0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x140011809
lea rdx, [0x14001bcd0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, [0x14001bcd0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x1f8], eax
cmp dword [rsp + 0x1f8], 0
jle 0x14001185c
mov eax, dword [rsp + 0x1f8]
sub eax, 1
movsxd rcx, eax
lea rax, [0x14001bcd0]
movsx eax, byte [rax + rcx]
cmp eax, 0x5c
jne 0x14001185c
mov eax, dword [rsp + 0x1f8]
sub eax, 1
movsxd rcx, eax
lea rax, [0x14001bcd0]
mov byte [rax + rcx], 0
call fcn.1400136e0
mov qword [rsp + 0x248], rax
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x140011890
mov rcx, qword [rsp + 0x1e8]
call fcn.140007170
mov qword [rsp + 0x248], rax
mov dword [rsp + 0xf8], 0
lea rax, [0x14001bcc8]
mov qword [rsp + 0x20], rax
lea r9, [0x14001bef0]
lea r8, [0x14001bcd0]
lea rdx, [0x1400166f8]
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x40000000
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0xffffffffffffffff
jne 0x14001195a
mov dword [rsp + 0xf8], 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, 7
mov edx, 0x40000000
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0xffffffffffffffff
jne 0x1400119cc
lea rdx, [0x14001bcd0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [0x14001bcd0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rsp + 0x1f8], eax
cmp dword [rsp + 0x1f8], 0
jle 0x1400119ca
mov eax, dword [rsp + 0x1f8]
sub eax, 1
movsxd rcx, eax
lea rax, [0x14001bcd0]
movsx eax, byte [rax + rcx]
cmp eax, 0x5c
jne 0x1400119ca
mov eax, dword [rsp + 0x1f8]
sub eax, 1
movsxd rcx, eax
lea rax, [0x14001bcd0]
mov byte [rax + rcx], 0
jmp 0x1400119f2
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0xf8], 0
je 0x1400119f2
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rax, qword [rsp + 0x1e8]
mov qword [0x14001c110], rax
mov rax, qword [rsp + 0x280]
mov qword [0x14001bbb8], rax
mov r8d, 0x104
lea rdx, [0x14001bde0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [0x14001bde0]
call fcn.140010710
lea r9, [0x14001bde0]
lea r8, str.ES.exe.pathname
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x250]
call fcn.140010560
mov qword [rsp + 0x250], rax
lea rcx, [0x14001bde0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 1
mov dword [rsp + 0x74], eax
jmp 0x140011a7a
mov eax, dword [rsp + 0x74]
sub eax, 1
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jl 0x140011b79
movsxd rcx, dword [rsp + 0x74]
lea rax, [0x14001bde0]
movsx eax, byte [rax + rcx]
cmp eax, 0x5c
jne 0x140011b74
movsxd rcx, dword [rsp + 0x74]
lea rax, [0x14001bde0]
lea r9, [rax + rcx + 1]
lea r8, str.ES.exe.name
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x250]
call fcn.140010560
mov qword [rsp + 0x250], rax
movsxd rcx, dword [rsp + 0x74]
lea rax, [0x14001bde0]
mov byte [rax + rcx], 0
lea rdx, [0x1400166b4]
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140011b0d
mov eax, dword [rsp + 0x74]
sub eax, 1
movsxd rcx, eax
lea rax, [0x14001bde0]
mov byte [rax + rcx], 0
lea r9, [0x14001bde0]
lea r8, str.ES.exe.path
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x250]
call fcn.140010560
mov qword [rsp + 0x250], rax
movsxd rcx, dword [rsp + 0x74]
lea rax, [0x14001bde0]
mov byte [rax + rcx], 0x5c
lea rdx, [0x1400166cc]
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140011b72
mov eax, dword [rsp + 0x74]
sub eax, 1
movsxd rcx, eax
lea rax, [0x14001bde0]
mov byte [rax + rcx], 0x5c
jmp 0x140011b79
jmp 0x140011a6f
lea rcx, [0x14001bde0]
call fcn.140010830
lea rdx, [0x14001bcc8]
mov qword [rsp + 0x20], rdx
lea r9, [0x14001bef0]
lea r8, [0x14001bcd0]
lea rdx, [0x140016738]
lea rcx, [0x14001bde0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [0x14001bde0]
call fcn.140010710
lea r9, [0x14001bde0]
lea r8, str.ES.script.pathname
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x250]
call fcn.140010560
mov qword [rsp + 0x250], rax
lea rcx, [0x14001bde0]
call fcn.140010830
lea r9, [0x14001bcc8]
lea r8, [0x14001bef0]
lea rdx, [0x140016754]
lea rcx, [0x14001bde0]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [0x14001bde0]
call fcn.140010710
lea r9, [0x14001bde0]
lea r8, str.ES.script.name
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x250]
call fcn.140010560
mov qword [rsp + 0x250], rax
lea rcx, [0x14001bde0]
call fcn.140010830
lea rcx, [0x14001bcd0]
call fcn.140010710
lea r9, [0x14001bcd0]
lea r8, str.ES.res.path
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x250]
call fcn.140010560
mov qword [rsp + 0x250], rax
lea r9, [0x14001bcd0]
lea r8, str.ES.script.path
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x250]
call fcn.140010560
mov qword [rsp + 0x250], rax
lea rcx, [0x14001bcd0]
call fcn.140010830
cmp dword [rsp + 0x1e4], 0
jne 0x140012330
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x20]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x3f4], eax
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x408], 0
mov r8d, 0x208
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x3f8], rax
mov dword [rsp + 0x74], 0
jmp 0x140011d36
mov eax, dword [rsp + 0x74]
add eax, 1
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x3f4]
cmp dword [rsp + 0x74], eax
jge 0x140011ef0
mov r9, qword [rsp + 0x400]
lea r8, [0x14001bcd0]
lea rdx, [0x140016790]
mov rcx, qword [rsp + 0x3f8]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [rsp + 0x3f8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140011eb4
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x400], rax
jne 0x140011dd0
mov rcx, qword [rsp + 0x1e8]
mov rcx, qword [rcx + 0x20]
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rcx], rax
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 8]
cmp qword [rsp + 0x400], rax
jne 0x140011e02
mov rcx, qword [rsp + 0x1e8]
mov rcx, qword [rcx + 0x20]
mov rax, qword [rsp + 0x408]
mov qword [rcx + 8], rax
cmp qword [rsp + 0x408], 0
je 0x140011e2b
mov rcx, qword [rsp + 0x408]
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rcx + 0x108], rax
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x20]
mov ecx, dword [rax + 0x10]
sub ecx, 1
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x20]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x4f8], rax
mov rax, qword [rsp + 0x4f8]
mov qword [rsp + 0x4f0], rax
cmp qword [rsp + 0x4f0], 0
je 0x140011e93
mov edx, 1
mov rcx, qword [rsp + 0x4f0]
call fcn.140007690
mov qword [rsp + 0x5b8], rax
jmp 0x140011e9f
mov qword [rsp + 0x5b8], 0
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x400], rax
jmp 0x140011d2b
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x408], rax
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rsp + 0x400], rax
xor edx, edx
mov rcx, qword [rsp + 0x3f8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x140011d2b
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x18]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x3f4], eax
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x408], 0
mov dword [rsp + 0x74], 0
jmp 0x140011f3e
mov eax, dword [rsp + 0x74]
add eax, 1
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x3f4]
cmp dword [rsp + 0x74], eax
jge 0x140012319
mov rax, qword [rsp + 0x400]
movsx eax, byte [rax]
test eax, eax
jne 0x140011f87
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x408], rax
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rsp + 0x400], rax
jmp 0x140011f33
mov dword [rsp + 0x418], 0
mov eax, dword [rsp + 0x74]
add eax, 1
movzx edx, ax
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x240], rax
cmp qword [rsp + 0x240], 0
je 0x140012018
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x238], rax
cmp qword [rsp + 0x238], 0
je 0x140012018
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x140012018
mov rdx, qword [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x418], eax
cmp dword [rsp + 0x418], 0
je 0x1400120c5
cmp dword [rsp + 0x418], 0
je 0x140012056
mov eax, dword [rsp + 0x418]
sub eax, 4
movsxd r8, eax
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x420], rax
jmp 0x140012062
mov qword [rsp + 0x420], 0
cmp qword [rsp + 0x420], 0
je 0x1400120c3
mov eax, dword [rsp + 0x418]
sub eax, 4
movsxd r8, eax
mov rdx, qword [rsp + 0x1f0]
add rdx, 4
mov rcx, qword [rsp + 0x420]
call fcn.140013950
mov edx, dword [rsp + 0x418]
sub edx, 4
mov r8, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x420]
call fcn.14000ec30
mov rdx, qword [rsp + 0x1f0]
mov eax, dword [rdx]
mov dword [rsp + 0x418], eax
jmp 0x1400120d1
mov qword [rsp + 0x420], 0
mov r9, qword [rsp + 0x400]
lea r8, [0x14001bcd0]
lea rdx, [0x140016798]
mov rcx, qword [rsp + 0x3f8]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [rsp + 0x3f8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14001223e
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
cmp qword [rsp + 0x400], rax
jne 0x14001215a
mov rcx, qword [rsp + 0x1e8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rcx], rax
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 8]
cmp qword [rsp + 0x400], rax
jne 0x14001218c
mov rcx, qword [rsp + 0x1e8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x408]
mov qword [rcx + 8], rax
cmp qword [rsp + 0x408], 0
je 0x1400121b5
mov rcx, qword [rsp + 0x408]
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rcx + 0x108], rax
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x18]
mov ecx, dword [rax + 0x10]
sub ecx, 1
mov rax, qword [rsp + 0x1e8]
mov rax, qword [rax + 0x18]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x508], rax
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x500], rax
cmp qword [rsp + 0x500], 0
je 0x14001221d
mov edx, 1
mov rcx, qword [rsp + 0x500]
call fcn.140007690
mov qword [rsp + 0x5c0], rax
jmp 0x140012229
mov qword [rsp + 0x5c0], 0
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x400], rax
jmp 0x140011f33
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x408], rax
mov rax, qword [rsp + 0x400]
mov rax, qword [rax + 0x108]
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x3f8]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0xffffffffffffffff
je 0x1400122f2
cmp qword [rsp + 0x420], 0
je 0x1400122e4
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x288]
mov r8d, dword [rsp + 0x418]
mov rdx, qword [rsp + 0x420]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x420], 0
je 0x140012314
mov r8, qword [rsp + 0x420]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140011f33
mov r8, qword [rsp + 0x3f8]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x1400167a0]
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14001247d
mov rax, qword [rsp + 0x1e8]
mov eax, dword [rax + 0x2c]
and eax, 0x20
test eax, eax
je 0x14001247d
lea rcx, [0x14001bcd0]
call fcn.14000ebb0
lea rcx, [0x14001bcd0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [0x14001bcd0]
call fcn.14000ebf0
mov rdx, qword [rsp + 0x1e8]
mov eax, dword [rdx + 0x2c]
and eax, 0x10
test eax, eax
je 0x1400123a3
mov byte [rsp + 0x5c8], 1
jmp 0x1400123ab
mov byte [rsp + 0x5c8], 0
movzx r8d, byte [rsp + 0x5c8]
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x250]
call fcn.14000f590
mov r8, qword [rsp + 0x208]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x14001bcd0]
mov rcx, qword [rsp + 0x1e8]
call fcn.1400135e0
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x518], rax
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x510], rax
cmp qword [rsp + 0x510], 0
je 0x140012469
mov edx, 1
mov rcx, qword [rsp + 0x510]
call fcn.140015570
mov qword [rsp + 0x5d0], rax
jmp 0x140012475
mov qword [rsp + 0x5d0], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [rsp + 0x1e8]
mov eax, dword [rax + 0x2c]
and eax, 0x20
test eax, eax
je 0x140012b75
mov qword [rsp + 0x460], 0
mov qword [rsp + 0x458], 0
xor eax, eax
mov word [rsp + 0x470], ax
lea rdi, [rsp + 0x472]
xor eax, eax
mov ecx, 0x3e
rep stosb byte [rdi], al
lea rcx, [0x14001bcd0]
call fcn.14000ebb0
lea rcx, [0x14001bcd0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rcx, [0x14001bcd0]
call fcn.14000ebf0
cmp dword [rsp + 0x50], 0
je 0x14001250d
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x110]
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
jmp 0x1400125c4
mov r8, qword [rsp + 0x208]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x14001bcd0]
mov rcx, qword [rsp + 0x1e8]
call fcn.1400135e0
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x528], rax
mov rax, qword [rsp + 0x528]
mov qword [rsp + 0x520], rax
cmp qword [rsp + 0x520], 0
je 0x1400125ad
mov edx, 1
mov rcx, qword [rsp + 0x520]
call fcn.140015570
mov qword [rsp + 0x5d8], rax
jmp 0x1400125b9
mov qword [rsp + 0x5d8], 0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x878
call fcn.1400137c0
mov qword [rsp + 0x530], rax
cmp qword [rsp + 0x530], 0
je 0x140012600
mov rcx, qword [rsp + 0x530]
call fcn.1400155b0
mov qword [rsp + 0x5e0], rax
jmp 0x14001260c
mov qword [rsp + 0x5e0], 0
mov rax, qword [rsp + 0x5e0]
mov qword [rsp + 0x438], rax
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x28], rax
lea rax, [0x14001bcc8]
mov qword [rsp + 0x20], rax
lea r9, [0x14001bef0]
lea r8, [0x14001bcd0]
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x438]
call fcn.14000bd50
mov dword [rsp + 0x4b0], eax
cmp dword [rsp + 0x4b0], 0
je 0x140012777
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x540], rax
mov rax, qword [rsp + 0x540]
mov qword [rsp + 0x538], rax
cmp qword [rsp + 0x538], 0
je 0x1400126b4
mov edx, 1
mov rcx, qword [rsp + 0x538]
call fcn.140015640
mov qword [rsp + 0x5e8], rax
jmp 0x1400126c0
mov qword [rsp + 0x5e8], 0
mov r8, qword [rsp + 0x208]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x14001bcd0]
mov rcx, qword [rsp + 0x1e8]
call fcn.1400135e0
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x550], rax
mov rax, qword [rsp + 0x550]
mov qword [rsp + 0x548], rax
cmp qword [rsp + 0x548], 0
je 0x140012760
mov edx, 1
mov rcx, qword [rsp + 0x548]
call fcn.140015570
mov qword [rsp + 0x5f0], rax
jmp 0x14001276c
mov qword [rsp + 0x5f0], 0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rsp + 0x460]
mov qword [rsp + 0x20], rax
lea r9, [0x140016f70]
mov r8d, 1
xor edx, edx
lea rcx, [rsp + 0x440]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x4b0], eax
mov rcx, qword [rsp + 0x438]
mov rax, qword [rsp + 0x460]
mov qword [rcx + 0x830], rax
mov rax, qword [rsp + 0x460]
mov rax, qword [rax]
lea r8, [rsp + 0x458]
lea rdx, [0x140016f80]
mov rcx, qword [rsp + 0x460]
call qword [rax]
mov dword [rsp + 0x4b0], eax
mov eax, dword [rsp + 0x70]
add eax, 1
movsxd r8, eax
shl r8, 1
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x430], rax
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x250]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400137c0
mov qword [rsp + 0x558], rax
cmp qword [rsp + 0x558], 0
je 0x140012872
mov rcx, qword [rsp + 0x558]
call fcn.140015680
mov qword [rsp + 0x5f8], rax
jmp 0x14001287e
mov qword [rsp + 0x5f8], 0
mov rax, qword [rsp + 0x5f8]
mov qword [rsp + 0x450], rax
mov rcx, qword [rsp + 0x450]
mov rax, qword [rsp + 0x438]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x460]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x460]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov dword [rsp + 0x4b0], eax
mov rax, qword [rsp + 0x458]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x458]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov dword [rsp + 0x4b0], eax
mov rax, qword [rsp + 0x460]
mov rax, qword [rax]
mov r8d, 6
lea rdx, str.WScript
mov rcx, qword [rsp + 0x460]
call qword [rax + 0x40]
mov rdi, qword [rsp + 0x458]
mov rdi, qword [rdi]
lea rax, [rsp + 0x470]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x430]
mov rcx, qword [rsp + 0x458]
call qword [rdi + 0x28]
mov dword [rsp + 0x4b0], eax
mov rax, qword [rsp + 0x1e8]
cmp dword [rax + 0x30], 0
je 0x1400129a6
mov rax, qword [rsp + 0x1e8]
movsxd r9, dword [rax + 0x30]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14000cc40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [rsp + 0x460]
mov rax, qword [rax]
mov edx, 2
mov rcx, qword [rsp + 0x460]
call qword [rax + 0x28]
mov dword [rsp + 0x4b0], eax
mov r8, qword [rsp + 0x430]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x460]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x460]
call qword [rax + 0x38]
mov rax, qword [rsp + 0x458]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x458]
call qword [rax + SafeArrayGetElemsize]
mov rax, qword [rsp + 0x460]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x460]
call qword [rax + SafeArrayGetElemsize]
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x560], rax
mov rcx, qword [rsp + 0x560]
call fcn.140013800
mov rcx, qword [rsp + 0x438]
call fcn.14000c150
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x570], rax
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x568], rax
cmp qword [rsp + 0x568], 0
je 0x140012a92
mov edx, 1
mov rcx, qword [rsp + 0x568]
call fcn.140015640
mov qword [rsp + 0x600], rax
jmp 0x140012a9e
mov qword [rsp + 0x600], 0
mov eax, dword [0x14001b890]
mov dword [rsp + 0x260], eax
mov r8, qword [rsp + 0x208]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14001bcd0]
mov rcx, qword [rsp + 0x1e8]
call fcn.1400135e0
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x580], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0x578], rax
cmp qword [rsp + 0x578], 0
je 0x140012b56
mov edx, 1
mov rcx, qword [rsp + 0x578]
call fcn.140015570
mov qword [rsp + 0x608], rax
jmp 0x140012b62
mov qword [rsp + 0x608], 0
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [0x14001bcc8]
mov qword [rsp + 0x20], rax
lea r9, [0x14001bef0]
lea r8, [0x14001bcd0]
lea rdx, str._s_s_s
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x200], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x260], eax
cmp qword [rsp + 0x200], 0xffffffffffffffff
jne 0x140012c81
cmp dword [rsp + 0x260], 0xb7
je 0x140012c11
cmp dword [rsp + 0x260], 0x50
jne 0x140012c81
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
lea rax, [0x14001bcc8]
mov qword [rsp + 0x20], rax
lea r8, [0x14001bcd0]
lea rdx, str._s_d_s
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.USER32.dll_wsprintfA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x200], rax
jmp 0x140012beb
cmp qword [rsp + 0x200], 0xffffffffffffffff
jne 0x140012d47
mov r8, qword [rsp + 0x208]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x14001bcd0]
mov rcx, qword [rsp + 0x1e8]
call fcn.1400135e0
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x590], rax
mov rax, qword [rsp + 0x590]
mov qword [rsp + 0x588], rax
cmp qword [rsp + 0x588], 0
je 0x140012d30
mov edx, 1
mov rcx, qword [rsp + 0x588]
call fcn.140015570
mov qword [rsp + 0x610], rax
jmp 0x140012d3c
mov qword [rsp + 0x610], 0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, [0x1400167c8]
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140012ee6
lea rax, str.___________ExeScript_Options_Begin______
mov qword [rsp + 0x4d0], rax
lea rax, str.______ExeScript_Options_End__________
mov qword [rsp + 0x4b8], rax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x4c0], eax
mov rdx, qword [rsp + 0x4d0]
mov rcx, qword [rsp + 0x250]
call fcn.140013d90
mov qword [rsp + 0x4d8], rax
cmp qword [rsp + 0x4d8], 0
je 0x140012dfe
mov rcx, qword [rsp + 0x250]
mov rax, qword [rsp + 0x4d8]
sub rax, rcx
mov qword [rsp + 0x4c8], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x288]
mov r8d, dword [rsp + 0x4c8]
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x4b8]
mov rcx, qword [rsp + 0x250]
call fcn.140013d90
mov qword [rsp + 0x4d8], rax
cmp qword [rsp + 0x4d8], 0
je 0x140012ea5
mov rcx, qword [rsp + 0x250]
mov rax, qword [rsp + 0x4d8]
sub rax, rcx
mov qword [rsp + 0x4c8], rax
mov eax, dword [rsp + 0x4c0]
sub rax, qword [rsp + 0x4c8]
mov dword [rsp + 0x4c0], eax
mov rcx, qword [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
movsxd rcx, eax
mov eax, dword [rsp + 0x4c0]
sub rax, rcx
mov dword [rsp + 0x4c0], eax
mov rcx, qword [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 2
movsxd rcx, eax
mov rax, qword [rsp + 0x4d8]
add rax, rcx
mov qword [rsp + 0x4d8], rax
jmp 0x140012eb5
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x4d8], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x288]
mov r8d, dword [rsp + 0x4c0]
mov rdx, qword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140012f12
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x288]
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
xor edx, edx
lea rcx, [rsp + 0x218]
call fcn.140013830
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140013830
mov dword [rsp + 0xbc], 1
mov eax, 0xa
mov word [rsp + 0xc0], ax
mov dword [rsp + 0x80], VarBstrFromDate
mov r8d, 0x104
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x60], rax
mov r8d, 0x104
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x58], 0
lea rdx, [0x140016828]
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140012ff4
lea rdx, str..cmd
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140012ff4
lea rdx, [0x140016838]
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14001304e
mov rax, qword [rsp + 0x1e8]
mov eax, dword [rax + 0x2c]
and eax, 0x10
test eax, eax
je 0x14001304e
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [rsp + 0x4e0], eax
lea rdx, str.___NUL
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [rsp + 0x4e0], 0x80000000
jb 0x140013041
xor eax, eax
mov word [rsp + 0xc0], ax
jmp 0x14001304e
mov eax, dword [rsp + 0x58]
or eax, 0x8000000
mov dword [rsp + 0x58], eax
mov r8, qword [rsp + 0xf0]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [rsp + 0x50], 0
jne 0x14001309c
lea rdx, str..wsf
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14001309c
lea rdx, str..wsh
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140013116
mov rax, qword [rsp + 0x1e8]
mov eax, dword [rax + 0x2c]
and eax, 8
test eax, eax
je 0x1400130e2
mov rax, qword [rsp + 0x1e8]
mov eax, dword [rax + 0x2c]
and eax, 0x10
test eax, eax
je 0x1400130d1
lea rax, str.wscript.exe__B
mov qword [rsp + 0x268], rax
jmp 0x1400130e0
lea rax, str.wscript.exe
mov qword [rsp + 0x268], rax
jmp 0x140013114
mov rax, qword [rsp + 0x1e8]
mov eax, dword [rax + 0x2c]
and eax, 0x10
test eax, eax
je 0x140013105
lea rax, str.cscript.exe__B
mov qword [rsp + 0x268], rax
jmp 0x140013114
lea rax, str.cscript.exe
mov qword [rsp + 0x268], rax
jmp 0x140013180
lea rdx, str..hta
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14001313f
lea rax, str.mshta.exe
mov qword [rsp + 0x268], rax
jmp 0x140013180
lea rdx, [0x1400168ac]
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140013174
lea rcx, [0x14001b9b0]
call fcn.140007710
lea rdx, [0x14001b9b0]
mov qword [rsp + 0x268], rdx
jmp 0x140013180
mov qword [rsp + 0x268], 0
cmp qword [rsp + 0x268], 0
je 0x1400132e2
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [rdi + rax + 0xa]
movsxd r8, eax
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x100], rax
lea rdx, str..ps1
lea rcx, [0x14001bcc8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140013269
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x140013242
mov r9, qword [rsp + 0x258]
mov r8, qword [rsp + 0x268]
lea rdx, [0x1400168c0]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x140013267
mov r9, qword [rsp + 0x258]
mov r8, qword [rsp + 0x268]
lea rdx, str._s__s
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x1400132dd
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1400132b8
mov r9, qword [rsp + 0x258]
mov r8, qword [rsp + 0x268]
lea rdx, [0x1400168e0]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x1400132dd
mov r9, qword [rsp + 0x258]
mov r8, qword [rsp + 0x268]
lea rdx, str._s___s_
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x14001338a
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [rdi + rax + 0xa]
movsxd r8, eax
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x100], rax
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x14001336d
mov r9, qword [rsp + 0x248]
mov r8, qword [rsp + 0x258]
lea rdx, [0x1400168f8]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfA]
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x14001338a
mov r8, qword [rsp + 0x258]
lea rdx, str.__s_
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [0x14001bcd0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.14000ebb0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [rsp + 0x1e0], 1
lea rax, [rsp + 0x218]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x100]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400134a0
mov dword [rsp + 0x4e4], 0xffffffff
mov rax, qword [rsp + 0x1e8]
cmp dword [rax + 0x30], 0
je 0x140013442
mov rax, qword [rsp + 0x1e8]
mov eax, dword [rax + 0x30]
imul eax, eax, 0x3e8
mov dword [rsp + 0x4e4], eax
mov edx, dword [rsp + 0x4e4]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001346e
xor edx, edx
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call fcn.14000ebf0
lea rax, [0x14001bcd0]
cmp qword [rsp + 0x68], rax
je 0x1400134d4
cmp qword [rsp + 0x68], 0
je 0x1400134d4
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x208]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x250]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x100]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x280]
xor edx, edx
mov rcx, qword [0x14001b880]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [0x14001bcd0]
mov rcx, qword [rsp + 0x1e8]
call fcn.1400135e0
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x598], rax
cmp qword [rsp + 0x598], 0
je 0x1400135ad
mov edx, 1
mov rcx, qword [rsp + 0x598]
call fcn.140015570
mov qword [rsp + 0x618], rax
jmp 0x1400135b9
mov qword [rsp + 0x618], 0
mov ecx, dword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1400135ca
xor eax, eax
add rsp, 0x620
pop rdi
ret