Function at 0x14009b0b0
Capabilities:
Check for foreground window switch
Check mutex on windows
Create directory
Create process on windows
Find taskbar
Log keystrokes
Read file via mapping
Set current directory

Disassembly:
mov rax, rsp
push rbp
push rsi
push r12
push r15
lea rbp, [rax - 0xd8]
sub rsp, 0x1b8
mov qword [rax + 8], rbx
lea rsi, [0x1401cfd60]
xor r15d, r15d
mov qword [rax + 0x10], rdi
mov edx, r15d
mov qword [rax + 0x18], r13
mov r12, rcx
movzx eax, word [r8 + rdx*2]
inc rdx
cmp ax, word [rsi + rdx*2 - 2]
jne 0x14009bd1c
cmp rdx, 5
jne 0x14009b0e3
xor ecx, ecx
mov qword [rsp + 0x1b0], r14
mov qword [0x14022f048], r12
call qword [sym.imp.ole32.dll_OleInitialize]
lea rcx, [rbp - 0x50]
call fcn.14007e5b0
cmp qword [rbp - 0x38], 8
lea rdx, [rbp - 0x50]
mov eax, dword [rbp - 0x40]
mov r13d, 1
cmovae rdx, qword [rbp - 0x50]
mov ebx, r13d
lea r8d, [rax + rax]
lea r9d, [r13 + 3]
test r8d, r8d
je 0x14009b175
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov ecx, ebx
and ecx, 0x3f
add ecx, r9d
add r9d, 3
imul ecx, eax
mov eax, ebx
shl eax, 8
add ecx, eax
xor ebx, ecx
add r8d, 0xffffffff
jne 0x14009b150
mov r8d, ebx
lea rdx, str.LucyMutex__08X
lea rcx, [rbp + 0x18]
call fcn.1400015b0
mov r8d, ebx
lea rdx, str.LucyShareMemory__08X
lea rcx, [rbp - 0x10]
call fcn.1400015b0
cmp qword [rbp + 0x30], 8
lea r8, [rbp + 0x18]
mov r14, r15
mov qword [rsp + 0x48], r15
cmovae r8, qword [rbp + 0x18]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14009b249
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp qword [rbp + 8], 8
lea r8, [rbp - 0x10]
mov ecx, 0xf001f
cmovae r8, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rdi, rax
test rax, rax
je 0x14009b241
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x14009b238
mov rcx, qword [rax]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x465
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r15d
jmp 0x14009bc08
lea rcx, str.kernel32
mov dword [rsp + 0x40], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14009b283
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x40]
call rbx
cmp dword [rsp + 0x40], r14d
je 0x14009b2a6
mov r9d, 0x40030
lea r8, [0x1401d3564]
lea rdx, [0x1401d3570]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp qword [rbp - 0x38], 8
lea rcx, [rbp - 0x50]
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x70]
movdqa xmm0, xmmword [0x1401f8bd0]
add rdx, 2
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r15w
call fcn.14000ec30
cmp qword [rbp - 0x38], 8
lea rdx, [rbp - 0x50]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp - 0x70]
cmovae rdx, qword [rbp - 0x50]
call fcn.140002740
mov r8d, 2
lea rdx, [0x1401d3594]
lea rcx, [rbp - 0x70]
call fcn.140002740
cmp qword [rbp - 0x58], 8
lea rcx, [rbp - 0x70]
cmovae rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x14009b33c
cmp qword [rbp - 0x58], 8
lea rcx, [rbp - 0x70]
cmovae rcx, qword [rbp - 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.14008f2f0
mov rcx, rax
call fcn.140095850
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rbx, rax
call fcn.14008f2f0
mov qword [rax + 0x18], rbx
call fcn.14008f2f0
xor r9d, r9d
lea r8, str.Progman
xor edx, edx
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
call fcn.14008f2f0
mov qword [rax + 0x20], rbx
call fcn.14008f2f0
xor r9d, r9d
lea r8, str.Shell_TrayWnd
xor edx, edx
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
call fcn.14008f2f0
mov qword [rax + 0x28], rbx
call fcn.14008f2f0
cmp qword [rax + 0x28], r14
je 0x14009b3db
call fcn.14008f2f0
xor r9d, r9d
lea r8, str.TrayNotifyWnd
xor edx, edx
mov rcx, qword [rax + 0x28]
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
call fcn.14008f2f0
mov qword [rax + 0x30], rbx
movdqa xmm0, xmmword [0x1401f8be0]
lea rdx, str.R7_qsSb_YB_y3T
mov r8d, InitCommonControls
mov byte [rsp + 0x50], r14b
lea rcx, [rsp + 0x50]
movdqu xmmword [rsp + 0x60], xmm0
call fcn.140002bb0
lea r8, [rsp + 0x50]
mov ecx, 0xc9
lea rdx, [0x1401ccba0]
call fcn.14000bf90
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14009b458
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009b453
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bed7
call fcn.14017b7ac
movdqa xmm0, xmmword [0x1401f8bd0]
lea rdx, str.langzh_CN
mov r8d, 0xa
mov word [rbp - 0x30], r15w
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.140003280
movdqa xmm0, xmmword [0x1401f8bd0]
lea rdx, str.gray
mov r8d, 4
mov word [rsp + 0x70], r15w
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x80], xmm0
call fcn.140003280
movdqa xmm0, xmmword [0x1401f8bd0]
lea rax, [0x1401d3708]
mov qword [rbp + 0x68], rax
lea rdx, str.skin_
lea rax, [0x140097030]
mov word [rsp + 0x50], r15w
mov qword [rbp + 0x70], rax
lea rcx, [rsp + 0x50]
lea rax, [rbp + 0x68]
mov r8d, 5
mov qword [rbp + 0xa0], rax
movdqu xmmword [rsp + 0x60], xmm0
call fcn.140003280
lea rax, [rbp - 0x30]
xor r8d, r8d
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.140009a90
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14009b557
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009b552
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bedd
call fcn.14017b7ac
mov rcx, qword [rbp + 0xa0]
movdqa xmm0, xmmword [0x1401f8bd0]
mov word [rsp + 0x50], r15w
movdqu xmmword [rsp + 0x60], xmm0
test rcx, rcx
je 0x14009b58e
mov rax, qword [rcx]
lea rdx, [rbp + 0x68]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0xa0], r15
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14009b5cf
mov rcx, qword [rsp + 0x70]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009b5ca
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bedd
call fcn.14017b7ac
mov rdx, qword [rbp - 0x18]
movdqa xmm0, xmmword [0x1401f8bd0]
mov word [rsp + 0x70], r15w
movdqu xmmword [rbp - 0x80], xmm0
cmp rdx, 8
jb 0x14009b622
mov rcx, qword [rbp - 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009b61d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bedd
call fcn.14017b7ac
call fcn.14008f2f0
cmp qword [rax + 0xc8], r14
je 0x14009b6d8
call fcn.14008f2f0
lea rcx, [rax + 0xb8]
call fcn.140096150
test al, al
jne 0x14009b6d8
call fcn.14008f2f0
add rax, 0xb8
cmp qword [rax + 0x18], 8
jb 0x14009b662
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x1401d35e0]
lea rcx, [rbp - 0x30]
call fcn.1400015b0
cmp qword [rbp - 0x18], 8
lea rdx, [rbp - 0x30]
mov r9d, 0x40030
lea r8, [0x1401d3564]
cmovae rdx, qword [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14009b6d8
mov rcx, qword [rbp - 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009b6d3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bee3
call fcn.14017b7ac
mov ecx, 0x368
call fcn.14017b770
mov rsi, rax
test rax, rax
je 0x14009b749
lea rax, [0x1401d3348]
xor edx, edx
mov qword [rsi + 8], rax
mov rcx, rsi
lea rax, vtable.nbase::SupportWeakCallback.0
mov qword [rsi + 0x350], rax
mov qword [rsi + 0x358], r15
mov qword [rsi + 0x360], r15
call fcn.14003f800
lea rax, vtable.CHideWnd.0
mov qword [rsi], rax
lea rax, vtable.CHideWnd.1.0
mov qword [rsi + 0x348], rax
mov rax, qword [rsi + 8]
movsxd rcx, dword [rax + 4]
lea rax, vtable.CHideWnd.2.0
mov qword [rcx + rsi + 8], rax
jmp 0x14009b750
mov rsi, r15
nop dword [rax]
cmp qword [0x140226c60], 8
lea rcx, [rsp + 0x70]
mov rax, qword [rsi]
lea rdi, [0x140226c48]
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
mov r8, rdi
mov byte [rsp + 0x28], r13b
cmovae r8, qword [0x140226c48]
mov r9d, 0x80880000
xor edx, edx
mov dword [rsp + 0x20], r15d
mov rcx, rsi
movdqu xmmword [rsp + 0x70], xmm0
call qword [rax + ILCombine]
mov rax, qword [rsi]
movzx r8d, r13b
xor edx, edx
mov rcx, rsi
call qword [rax + 0x28]
mov ecx, 0x1728
call fcn.14017b770
test rax, rax
je 0x14009b7d0
mov r8d, r13d
mov rdx, r12
mov rcx, rax
call fcn.14009e290
mov r15, rax
nop word [rax + rax]
cmp qword [0x140226c60], 8
xorps xmm0, xmm0
mov rbx, qword [r15]
mov rcx, rsi
cmovae rdi, qword [0x140226c48]
movdqu xmmword [rsp + 0x70], xmm0
call fcn.140026de0
mov rdx, rax
mov r9d, 0xce0000
lea rax, [rsp + 0x70]
mov r8, rdi
mov qword [rsp + 0x30], rax
mov rcx, r15
mov byte [rsp + 0x28], r13b
mov dword [rsp + 0x20], r14d
call qword [rbx + ILCombine]
mov rcx, r15
call fcn.140026de0
mov rbx, rax
call fcn.14008f2f0
mov qword [rax + 0x10], rbx
call fcn.14008f2f0
mov qword [rax + 8], r14
call fcn.14008f2f0
cmp byte [rax + 0x4b], r14b
jne 0x14009b86d
call fcn.14008f2f0
cmp byte [rax + 0x4c], r14b
jne 0x14009b86d
call fcn.14008f2f0
cmp byte [rax + 0x4a], r14b
jne 0x14009b86d
call fcn.14008f2f0
cmp byte [rax + 0x49], r14b
jne 0x14009b86d
call fcn.14008f2f0
cmp byte [rax], r14b
je 0x14009b890
xor r9d, r9d
lea rdx, [0x140096ce0]
mov r8, r12
lea ecx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rbx, rax
call fcn.14008f2f0
mov qword [rax + 8], rbx
lea rax, [rsp + 0x70]
mov r8d, r13d
lea r9, [0x1401e4e90]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x1401e4e60]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14009b8e8
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + ILCombine]
mov rax, qword [rsp + 0x70]
mov rcx, r15
mov rbx, qword [rax]
call fcn.140026de0
mov rcx, qword [rsp + 0x70]
mov rdx, rax
call qword [rbx + 0x28]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
call fcn.14008f2f0
mov rcx, r15
cmp byte [rax + 0x3f], r14b
je 0x14009b900
call fcn.1400a71f0
jmp 0x14009ba46
mov rax, qword [r15]
movzx r8d, r13b
movzx edx, r13b
call qword [rax + 0x28]
mov rcx, r15
call fcn.140026de0
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
setne bl
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rcx, r14
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14009b95c
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf120
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
test bl, bl
jne 0x14009ba05
xor r12d, r12d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp r14, rax
je 0x14009ba17
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, r13d
mov ecx, edi
mov edx, eax
mov ebx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, r14
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, r14
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, ebx
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r12d
cmp r12d, 0xa
jl 0x14009b967
jmp 0x14009ba17
mov rcx, r14
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, r14
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [r15 + 0x10]
call sub.IMM32.dll_ImmGetContext
xor edx, edx
mov qword [r15 + 0x1708], rax
mov rcx, rax
call sub.IMM32.dll_ImmSetOpenStatus
mov rdx, qword [r15 + 0x1708]
mov rcx, qword [r15 + 0x10]
call sub.IMM32.dll_ImmAssociateContext
mov r14, qword [rsp + 0x48]
call fcn.14008f2f0
cmp byte [rax + 0x3e], 0
je 0x14009ba63
movzx edx, r13b
mov rcx, rsi
call fcn.140041840
movzx edx, r13b
jmp 0x14009ba65
xor dl, dl
mov rcx, r15
call fcn.140041840
cmp qword [rbp + 8], 8
lea rax, [rbp - 0x10]
cmovae rax, qword [rbp - 0x10]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
je 0x14009bad2
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x14009bad2
mov rcx, r15
call fcn.140026de0
mov qword [r14], rax
xor eax, eax
lea rcx, [rbp + 0x38]
xor r9d, r9d
mov qword [rbp + 0x38], rax
xor r8d, r8d
mov qword [rbp + 0x40], rax
xor edx, edx
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14009bb2c
lea rcx, [rbp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14009bb02
call fcn.14008f2f0
cmp qword [rax + 8], 0
je 0x14009bb47
call fcn.14008f2f0
mov rcx, qword [rax + 8]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.14008f2f0
xor r15d, r15d
mov rcx, rsi
mov qword [rax + 8], r15
call fcn.14002aa00
mov rdx, rax
mov rcx, rsi
call fcn.140027d20
mov rax, qword [rsi + 8]
mov edx, r13d
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rsi
mov rax, qword [rcx]
call qword [rax]
call fcn.14000a480
test r14, r14
je 0x14009bb90
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test rbx, rbx
je 0x14009bb9e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x14009bbad
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call qword [sym.imp.ole32.dll_OleUninitialize]
mov rdx, qword [rbp - 0x58]
mov ebx, dword [rbp + 0x48]
cmp rdx, 8
jb 0x14009bbf6
mov rcx, qword [rbp - 0x70]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bbf1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bee9
call fcn.14017b7ac
movdqa xmm0, xmmword [0x1401f8bd0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r15w
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14009bc48
mov rcx, qword [rbp - 0x10]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bc43
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bee9
call fcn.14017b7ac
mov rdx, qword [rbp + 0x30]
movdqa xmm0, xmmword [0x1401f8bd0]
mov word [rbp - 0x10], r15w
movdqu xmmword [rbp], xmm0
cmp rdx, 8
jb 0x14009bc9a
mov rcx, qword [rbp + 0x18]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bc95
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bee9
call fcn.14017b7ac
mov rdx, qword [rbp - 0x38]
movdqa xmm0, xmmword [0x1401f8bd0]
mov word [rbp + 0x18], r15w
movdqu xmmword [rbp + 0x28], xmm0
cmp rdx, 8
jb 0x14009bcec
mov rcx, qword [rbp - 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bce7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bee9
call fcn.14017b7ac
mov r14, qword [rsp + 0x1b0]
mov eax, ebx
mov r13, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1b8
pop r15
pop r12
pop rsi
pop rbp
ret
xor r8d, r8d
mov qword [rsp + 0x60], r15
mov edx, 0x104
mov qword [rsp + 0x68], 7
lea rcx, [rsp + 0x50]
mov word [rsp + 0x50], r15w
call fcn.140003180
cmp qword [rsp + 0x68], 8
lea rbx, [rsp + 0x50]
cmovae rbx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, dword [rsp + 0x60]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp qword [rsp + 0x68], 8
lea rdi, [rsp + 0x50]
mov r13d, 1
mov qword [rsp + 0x48], r15
cmovae rdi, qword [rsp + 0x50]
mov dword [rsp + 0x40], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x48]
lea edx, [r13 + 7]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14009bddd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_open_process_token._Error_code:
mov ebx, eax
lea rcx, [0x14022fd50]
call fcn.1400932c0
mov rcx, rax
mov edx, ebx
call fcn.140094450
mov rcx, rax
call fcn.1400937a0
xor al, al
jmp 0x14009be60
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x70]
mov r9d, 4
mov dword [rsp + 0x70], 4
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xe]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14009be49
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_get_token_information._Error_code:
mov ebx, eax
lea rcx, [0x14022fd50]
call fcn.1400932c0
mov rcx, rax
mov edx, ebx
call fcn.140094450
mov rcx, rax
call fcn.1400937a0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14009be60
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 2
mov eax, r15d
cmove eax, r13d
test al, al
mov dword [rsp + 0x28], r13d
lea rcx, str.runas
mov qword [rsp + 0x20], r15
lea rdx, str.open
mov r9, rsi
cmovne rdx, rcx
mov r8, rdi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14009beca
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009bec5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009bed1
call fcn.14017b7ac
xor eax, eax
jmp 0x14009bcf6
call fcn.1401b08a0
int3
call fcn.1401b08a0
int3
call fcn.1401b08a0
int3
call fcn.1401b08a0
int3
call fcn.1401b08a0
int3