Function at 0x1400015a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x600
movaps xmmword [r11 - 0x38], xmm6
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
mov r13, rdx
mov dword [rsp + 0xa0], ecx
lea rcx, str.1.2.0
lea rdx, str.1.0.0
lea rax, [0x14001d970]
cmp rcx, rax
cmovne rdx, rcx
xor esi, esi
mov qword [r11 - 0x3a0], rsi
mov qword [r11 - 0x390], rsi
mov qword [r11 - 0x388], 0xf
mov byte [rsp + 0x288], sil
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rdx + r8], sil
jne 0x140001625
lea rcx, [rsp + 0x288]
call fcn.1400036f0
nop
lea rdx, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 0x10
cmovae rdx, qword [rsp + 0x288]
mov rdi, qword [rsp + 0x298]
add rdi, rdx
lea rbx, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 0x10
cmovae rbx, qword [rsp + 0x288]
mov qword [rsp + 0x128], rsi
mov rcx, rsi
mov qword [rsp + 0x138], rcx
mov r8d, 7
mov qword [rsp + 0x140], r8
mov word [rsp + 0x128], si
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x1400016d0
lea rcx, [rsp + 0x128]
call fcn.140003cc0
mov rcx, rsi
mov qword [rsp + 0x138], rcx
mov r8, qword [rsp + 0x140]
lea rax, [rsp + 0x128]
mov qword [rsp + 0x50], rax
nop dword [rax]
cmp rbx, rdi
je 0x140001750
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x14000172e
lea rax, [rcx + 1]
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x128]
cmp r8, 8
cmovae rax, qword [rsp + 0x128]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], si
inc rbx
mov r8, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x138]
jmp 0x1400016e0
lea rcx, [rsp + 0x128]
call fcn.140003e30
inc rbx
mov r8, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x138]
jmp 0x1400016e0
lea r8, [rsp + 0x128]
lea rdx, [0x14001d98c]
lea rcx, [rsp + 0x2a8]
call fcn.1400039d0
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x1400017b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003313
call fcn.140004aec
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], si
lea r8, [rsp + 0x2a8]
lea rdx, [0x14001d990]
lea rcx, [rsp + 0x1e8]
call fcn.140003850
mov rbx, rax
mov rdx, qword [rax + 0x18]
cmp rdx, 8
jb 0x14000182f
mov rcx, qword [rax]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000182a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003319
mov rcx, r8
call fcn.140004aec
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x1d8], rsi
mov qword [rsp + 0x1e0], 0xf
mov byte [rsp + 0x1c8], 0
mov r8d, 3
lea rdx, [0x14001d9c0]
lea rcx, [rsp + 0x1c8]
call fcn.1400036f0
nop
lea rdx, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 0x10
cmovae rdx, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x1d8]
add rdi, rdx
lea rbx, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 0x10
cmovae rbx, qword [rsp + 0x1c8]
mov qword [rsp + 0x1a8], rsi
mov rcx, rsi
mov qword [rsp + 0x1b8], rcx
mov r8d, 7
mov qword [rsp + 0x1c0], r8
mov word [rsp + 0x1a8], si
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x140001911
lea rcx, [rsp + 0x1a8]
call fcn.140003cc0
mov rcx, rsi
mov qword [rsp + 0x1b8], rcx
mov r8, qword [rsp + 0x1c0]
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x50], rax
nop
cmp rbx, rdi
je 0x140001990
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x14000196e
lea rax, [rcx + 1]
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0x1a8]
cmp r8, 8
cmovae rax, qword [rsp + 0x1a8]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], si
inc rbx
mov r8, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1b8]
jmp 0x140001920
lea rcx, [rsp + 0x1a8]
call fcn.140003e30
inc rbx
mov r8, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1b8]
jmp 0x140001920
mov r15, qword [rsp + 0x1d8]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0xe
jb 0x14000331f
lea r14, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 0x10
cmovae r14, qword [rsp + 0x1c8]
mov qword [rsp + 0x128], rsi
mov rsi, qword [rsp + 0x1d8]
add rsi, 0xe
mov edi, 0xf
lea rbx, [rsp + 0x128]
cmp rsi, rdi
jbe 0x140001a6a
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x140001a03
mov rdi, rcx
jmp 0x140001a0f
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x140001a4f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003324
mov rcx, rax
call fcn.140004ab0
test rax, rax
je 0x140003348
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001a62
test rcx, rcx
je 0x140001a5e
call fcn.140004ab0
mov rbx, rax
jmp 0x140001a62
xor eax, eax
mov ebx, eax
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0x140], rdi
movsd xmm0, qword [str.Product_Name:]
movsd qword [rbx], xmm0
mov eax, dword [0x14001d9d0]
mov dword [rbx + 8], eax
movzx eax, word [0x14001d9d4]
mov word [rbx + 0xc], ax
lea rcx, [rbx + 0xe]
mov r8, r15
mov rdx, r14
call fcn.14000a000
mov byte [rbx + rsi], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x140001ae8
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ae3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003348
call fcn.140004aec
xor r15d, r15d
mov qword [rsp + 0x228], r15
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], 0xf
mov byte [rsp + 0x228], r15b
lea r8d, [r15 + 0xa]
lea rdx, str.ReasonLabs
lea rcx, [rsp + 0x228]
call fcn.1400036f0
nop
lea rdx, [rsp + 0x228]
cmp qword [rsp + 0x240], 0x10
cmovae rdx, qword [rsp + 0x228]
mov rdi, qword [rsp + 0x238]
add rdi, rdx
lea rbx, [rsp + 0x228]
cmp qword [rsp + 0x240], 0x10
cmovae rbx, qword [rsp + 0x228]
mov qword [rsp + 0x148], r15
mov ecx, r15d
mov qword [rsp + 0x158], rcx
mov r8d, 7
mov qword [rsp + 0x160], r8
mov word [rsp + 0x148], r15w
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x140001bbd
lea rcx, [rsp + 0x148]
call fcn.140003cc0
mov ecx, r15d
mov qword [rsp + 0x158], rcx
mov r8, qword [rsp + 0x160]
lea rax, [rsp + 0x148]
mov qword [rsp + 0x50], rax
nop word [rax + rax]
cmp rbx, rdi
je 0x140001c41
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x140001c1f
lea rax, [rcx + 1]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x148]
cmp r8, 8
cmovae rax, qword [rsp + 0x148]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
inc rbx
mov r8, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x158]
jmp 0x140001bd0
lea rcx, [rsp + 0x148]
call fcn.140003e30
inc rbx
mov r8, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x158]
jmp 0x140001bd0
mov qword [rsp + 0x248], r15
mov qword [rsp + 0x258], r15
mov qword [rsp + 0x260], 7
mov word [rsp + 0x248], r15w
mov r8d, 0xb
lea rdx, str.rsAppUI.exe
lea rcx, [rsp + 0x248]
call fcn.140003570
nop
mov qword [rsp + 0x208], r15
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x220], 0xf
mov byte [rsp + 0x208], 0
mov r8d, 0xd
lea rdx, str.CommonClient
lea rcx, [rsp + 0x208]
call fcn.1400036f0
nop
lea rdx, [rsp + 0x208]
cmp qword [rsp + 0x220], 0x10
cmovae rdx, qword [rsp + 0x208]
mov rdi, qword [rsp + 0x218]
add rdi, rdx
lea rbx, [rsp + 0x208]
cmp qword [rsp + 0x220], 0x10
cmovae rbx, qword [rsp + 0x208]
mov qword [rsp + 0x188], r15
mov rcx, r15
mov qword [rsp + 0x198], rcx
mov r8d, 7
mov qword [rsp + 0x1a0], r8
mov word [rsp + 0x188], r15w
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x140001d55
lea rcx, [rsp + 0x188]
call fcn.140003cc0
mov rcx, r15
mov qword [rsp + 0x198], rcx
mov r8, qword [rsp + 0x1a0]
lea rax, [rsp + 0x188]
mov qword [rsp + 0x50], rax
cmp rbx, rdi
je 0x140001dd3
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x140001db1
lea rax, [rcx + 1]
mov qword [rsp + 0x198], rax
lea rax, [rsp + 0x188]
cmp r8, 8
cmovae rax, qword [rsp + 0x188]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
inc rbx
mov r8, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x198]
jmp 0x140001d62
lea rcx, [rsp + 0x188]
call fcn.140003e30
inc rbx
mov r8, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x198]
jmp 0x140001d62
mov qword [rsp + 0x108], r15
lea r9, [rsp + 0x108]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140016320]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x1400021dd
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], 7
mov r8d, 0x23
lea rdx, str.Failed_getting_program_files_folder
lea rcx, [rsp + 0x128]
call fcn.140003570
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x140001e7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000332a
call fcn.140004aec
nop
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 8
jb 0x140001ec4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ebf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003330
call fcn.140004aec
mov qword [rsp + 0x198], r15
mov qword [rsp + 0x1a0], 7
mov word [rsp + 0x188], r15w
mov rdx, qword [rsp + 0x220]
cmp rdx, 0x10
jb 0x140001f24
inc rdx
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003336
call fcn.140004aec
mov qword [rsp + 0x218], r15
mov qword [rsp + 0x220], 0xf
mov byte [rsp + 0x208], 0
mov rdx, qword [rsp + 0x260]
cmp rdx, 8
jb 0x140001f88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000333c
call fcn.140004aec
mov qword [rsp + 0x258], r15
mov qword [rsp + 0x260], 7
mov word [rsp + 0x248], r15w
mov rdx, qword [rsp + 0x160]
cmp rdx, 8
jb 0x140001fed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fe8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003342
call fcn.140004aec
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x160], 7
mov word [rsp + 0x148], r15w
mov rdx, qword [rsp + 0x240]
cmp rdx, 0x10
jb 0x14000204d
inc rdx
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002048
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003348
call fcn.140004aec
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], 0xf
mov byte [rsp + 0x228], 0
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 8
jb 0x1400020b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000334e
call fcn.140004aec
mov qword [rsp + 0x1b8], r15
mov qword [rsp + 0x1c0], 7
mov word [rsp + 0x1a8], r15w
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 0x10
jb 0x140002111
inc rdx
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000210c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003354
call fcn.140004aec
mov qword [rsp + 0x1d8], r15
mov qword [rsp + 0x1e0], 0xf
mov byte [rsp + 0x1c8], 0
mov rdx, qword [rsp + 0x2c0]
cmp rdx, 8
jb 0x140002175
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002170
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000335a
call fcn.140004aec
mov qword [rsp + 0x2b8], r15
mov qword [rsp + 0x2c0], 7
mov word [rsp + 0x2a8], r15w
mov rdx, qword [rsp + 0x2a0]
cmp rdx, 0x10
jb 0x1400021d5
inc rdx
mov rcx, qword [rsp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003360
call fcn.140004aec
mov eax, r12d
jmp 0x1400032e1
mov qword [rsp + 0x268], r15
mov qword [rsp + 0x278], r15
mov qword [rsp + 0x280], 7
mov word [rsp + 0x268], r15w
mov rdx, qword [rsp + 0x108]
mov r8, r12
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140002210
lea rcx, [rsp + 0x268]
call fcn.140003570
nop
lea rax, [rsp + 0x268]
cmp qword [rsp + 0x280], 8
cmovae rax, qword [rsp + 0x268]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 8
cmovae rax, qword [rsp + 0x148]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 8
cmovae rax, qword [rsp + 0x188]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x2a8]
cmp qword [rsp + 0x2c0], 8
cmovae rax, qword [rsp + 0x2a8]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x248]
cmp qword [rsp + 0x260], 8
cmovae rax, qword [rsp + 0x248]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2e0]
call fcn.140001410
nop
lea r8, [rsp + 0x2e0]
lea rdx, str.Client_Shell_Path:
lea rcx, [rsp + 0x1e8]
call fcn.140003850
mov rbx, rax
mov rdx, qword [rax + 0x18]
cmp rdx, 8
jb 0x1400023ae
mov rcx, qword [rax]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400023a9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003366
mov rcx, r8
call fcn.140004aec
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x3d0]
call fcn.1400067a0
mov r8d, 0x104
lea rdx, [rsp + 0x3d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], r15w
test eax, eax
je 0x140002819
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140002819
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], 7
lea rax, [rsp + 0x3d0]
mov r8, r12
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002450
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x70]
call fcn.140003570
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x1e8], xmm0
movups xmm1, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x1f8], xmm1
lea rbx, [rsp + 0x1e8]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rbx, rcx
movq rax, xmm1
lea rdx, [rbx + rax*2]
mov rcx, rbx
call fcn.1400011c0
mov r11, rax
cmp rax, rdx
je 0x14000250b
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400024e2
cmp cx, 0x2f
je 0x1400024e2
mov rdx, r8
cmp r11, r8
jmp 0x1400024c4
cmp r11, rdx
je 0x14000250b
nop word [rax + rax]
lea rcx, [rdx - 2]
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x140002503
cmp ax, 0x2f
jne 0x14000250b
mov rdx, rcx
cmp r11, rcx
jne 0x1400024f0
sub rdx, rbx
sar rdx, 1
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], r15w
mov r8, rdx
mov rdx, rbx
lea rcx, [rsp + 0x128]
call fcn.140003570
nop
lea rbx, [rsp + 0x128]
cmp qword [rsp + 0x140], 8
cmovae rbx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x138]
lea rdx, [rbx + rax*2]
mov rcx, rbx
call fcn.1400011c0
mov r11, rax
cmp rax, rdx
je 0x1400025bc
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14000259c
cmp cx, 0x2f
je 0x14000259c
mov rdx, r8
cmp r11, r8
jmp 0x14000257e
cmp r11, rdx
je 0x1400025bc
lea rcx, [rdx - 2]
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x1400025b4
cmp ax, 0x2f
jne 0x1400025bc
mov rdx, rcx
cmp r11, rcx
jne 0x1400025a1
sub rdx, rbx
sar rdx, 1
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov r8, rdx
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140003570
nop
lea r14, [rsp + 0x50]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
cmp r15, 8
cmovae r14, rbx
mov rsi, qword [rsp + 0x60]
cmp rsi, 8
jae 0x140002623
movups xmm6, xmmword [r14]
mov qword [rsp + 0x88], 7
jmp 0x1400026c0
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000336c
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000268d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003371
mov rcx, rax
call fcn.140004ab0
mov rcx, rax
test rax, rax
je 0x140003376
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000269b
test rcx, rcx
je 0x140002699
call fcn.140004ab0
jmp 0x14000269b
xor eax, eax
mov qword [rsp + 0x70], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14000a000
mov qword [rsp + 0x88], rdi
movups xmm6, xmmword [rsp + 0x70]
mov qword [rsp + 0x80], rsi
mov rdx, qword [rsp + 0x180]
cmp rdx, 8
jb 0x140002710
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000270b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003376
call fcn.140004aec
movups xmmword [rsp + 0x168], xmm6
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x178], xmm0
cmp r15, 8
jb 0x140002764
lea rdx, [r15*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000275b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000337c
mov rcx, rbx
call fcn.140004aec
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x1400027ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003382
call fcn.140004aec
movdqa xmm0, xmmword [0x14001db90]
movdqu xmmword [rsp + 0x138], xmm0
xor r15d, r15d
mov word [rsp + 0x128], r15w
mov rdx, qword [rsp + 0x200]
cmp rdx, 8
jb 0x140002a2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003388
jmp 0x140002a2a
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], 7
mov r8d, 0x1b
lea rdx, str.Failed_getting_current_path
lea rcx, [rsp + 0x70]
call fcn.140003570
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x14000288e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002889
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000338e
call fcn.140004aec
lea rax, [rsp + 0x268]
cmp qword [rsp + 0x280], 8
cmovae rax, qword [rsp + 0x268]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 8
cmovae rax, qword [rsp + 0x148]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 8
cmovae rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1e8]
call fcn.140001410
mov rbx, rax
lea rax, [rsp + 0x168]
cmp rax, rbx
je 0x1400029e7
mov rdx, qword [rsp + 0x180]
cmp rdx, 8
jb 0x1400029a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000299e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003394
call fcn.140004aec
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x180], 7
mov word [rsp + 0x168], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x168], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x178], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x200]
cmp rdx, 8
jb 0x140002a2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003394
call fcn.140004aec
lea r8, [rsp + 0x168]
lea rdx, str.App_Path:
lea rcx, [rsp + 0x1e8]
call fcn.140003850
mov rbx, rax
mov rdx, qword [rax + 0x18]
cmp rdx, 8
jb 0x140002a8d
mov rcx, qword [rax]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140002a88
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000339a
mov rcx, r8
call fcn.140004aec
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
lea rax, [rsp + 0x168]
cmp qword [rsp + 0x180], 8
cmovae rax, qword [rsp + 0x168]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0xb8], rax
lea rax, [0x14001dad0]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 2
lea rax, str.app.asar
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 8
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x340]
call fcn.140001410
nop
lea r8, [rsp + 0x340]
lea rdx, str.ASAR_Path:
lea rcx, [rsp + 0x1e8]
call fcn.140003850
mov rbx, rax
mov rdx, qword [rax + 0x18]
cmp rdx, 8
jb 0x140002b90
mov rcx, qword [rax]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140002b8b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400033a0
mov rcx, r8
call fcn.140004aec
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
lea r8, [rsp + 0x340]
lea rdx, [0x14001db08]
lea rcx, [rsp + 0x70]
call fcn.140003850
mov rbx, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x140002c03
lea r14, [rcx + 0x11]
mov qword [rbx + 0x10], r14
mov rdi, rbx
cmp rdx, 8
jb 0x140002be4
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov esi, 0x22
mov r8d, esi
lea rdx, str.____engine_path_
call fcn.14000a000
mov word [rdi + r14*2], r15w
jmp 0x140002c28
mov qword [rsp + 0x20], 0x11
lea r9, str.____engine_path_
mov edx, 0x11
mov rcx, rbx
call fcn.140003fd0
mov rbx, rax
mov esi, 0x22
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdi, qword [rsp + 0x178]
lea r9, [rsp + 0x168]
cmp qword [rsp + 0x180], 8
cmovae r9, qword [rsp + 0x168]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x140002cc7
lea rax, [r14 + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
mov rdx, r9
call fcn.14000a000
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r15w
lea rax, [rsp + 0x50]
jmp 0x140002cd9
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140003fd0
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x128], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x138], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x138]
mov r8, qword [rsp + 0x140]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x140002d68
lea rcx, [rdx + 1]
mov qword [rsp + 0x138], rcx
lea rax, [rsp + 0x128]
cmp r8, 8
cmovae rax, qword [rsp + 0x128]
mov word [rax + rdx*2], si
mov word [rax + rcx*2], r15w
lea rax, [rsp + 0x128]
jmp 0x140002d8a
mov qword [rsp + 0x20], 1
lea r9, [0x14001db08]
mov edx, 1
lea rcx, [rsp + 0x128]
call fcn.140003fd0
mov qword [rsp + 0x300], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x310], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x300], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x310], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rsp + 0x140]
cmp rdx, 8
jb 0x140002e0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033a6
call fcn.140004aec
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140002e6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033ac
call fcn.140004aec
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x140002ec5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ec0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033b2
call fcn.140004aec
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], r15w
mov rdx, qword [r13]
mov qword [rsp + 0x1e8], r15
movdqa xmm0, xmmword [0x14001dba0]
movdqu xmmword [rsp + 0x1f8], xmm0
mov byte [rsp + 0x1e8], 0
inc r12
cmp byte [rdx + r12], 0
jne 0x140002f04
mov r8, r12
lea rcx, [rsp + 0x1e8]
call fcn.1400036f0
nop
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2c8], xmm1
mov qword [rsp + 0x2d8], r15
movsxd rax, dword [rsp + 0xa0]
cmp eax, 1
jle 0x1400030bd
lea r8, [rax*8]
add r8, r13
lea rdx, [r13 + 8]
lea rcx, [rsp + 0x2c8]
call fcn.140004220
mov rdi, qword [rsp + 0x2c8]
mov r14, qword [rsp + 0x2d0]
cmp rdi, r14
je 0x1400030bd
mov rcx, qword [rdi + 0x18]
mov rsi, qword [rdi + 0x10]
cmp rcx, 0x10
jb 0x140002f8c
add rsi, qword [rdi]
jmp 0x140002f98
add rsi, rdi
mov rbx, rdi
cmp rcx, 0x10
jb 0x140002f9b
mov rbx, qword [rdi]
mov qword [rsp + 0x128], r15
mov rcx, r15
mov qword [rsp + 0x138], rcx
mov r8d, 7
mov qword [rsp + 0x140], r8
mov word [rsp + 0x128], r15w
mov rdx, rsi
sub rdx, rbx
cmp rdx, 8
jb 0x140002ff1
lea rcx, [rsp + 0x128]
call fcn.140003cc0
mov rcx, r15
mov qword [rsp + 0x138], rcx
mov r8, qword [rsp + 0x140]
lea rax, [rsp + 0x128]
mov qword [rsp + 0x50], rax
nop
cmp rbx, rsi
je 0x140003071
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x14000304f
lea rax, [rcx + 1]
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x128]
cmp r8, 8
cmovae rax, qword [rsp + 0x128]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r15w
inc rbx
mov r8, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x138]
jmp 0x140003000
lea rcx, [rsp + 0x128]
call fcn.140003e30
inc rbx
mov r8, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x138]
jmp 0x140003000
lea r8, [rsp + 0x128]
lea rdx, [0x14001db34]
lea rcx, [rsp + 0x70]
call fcn.1400039d0
nop
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.140003440
nop
lea rcx, [rsp + 0x70]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x128]
call fcn.1400012d0
add rdi, 0x20
jmp 0x140002f70
lea r8, [rsp + 0x2e0]
lea rdx, [0x14001db08]
lea rcx, [rsp + 0x128]
call fcn.140003850
nop
lea r8, [0x14001db38]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003b20
nop
lea r8, [rsp + 0x300]
mov rdx, rax
lea rcx, [rsp + 0x320]
call fcn.140003bf0
nop
lea rcx, [rsp + 0x70]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x128]
call fcn.1400012d0
lea r8, [rsp + 0x320]
lea rdx, str.Running:
lea rcx, [rsp + 0x50]
call fcn.140003850
mov rdx, rax
call fcn.1400013a0
mov dword [rsp + 0x360], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x368], xmm0
movups xmmword [rsp + 0x378], xmm0
movups xmmword [rsp + 0x388], xmm0
movups xmmword [rsp + 0x398], xmm0
movups xmmword [rsp + 0x3a8], xmm0
movups xmmword [rsp + 0x3b8], xmm0
lea rcx, [rsp + 0x320]
call fcn.140003430
mov rdx, rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x360]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x320]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x2c8]
call fcn.1400033c0
nop
lea rcx, [rsp + 0x1e8]
call fcn.1400034d0
nop
lea rcx, [rsp + 0x300]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x340]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x168]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x2e0]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x268]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x188]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x208]
call fcn.1400034d0
nop
lea rcx, [rsp + 0x248]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x148]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x228]
call fcn.1400034d0
nop
lea rcx, [rsp + 0x1a8]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x1c8]
call fcn.1400034d0
nop
lea rcx, [rsp + 0x2a8]
call fcn.1400012d0
nop
lea rcx, [rsp + 0x288]
call fcn.1400034d0
mov eax, ebx
mov rcx, qword [rsp + 0x5e0]
xor rcx, rsp
call fcn.140004a90
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14000aab0
int3
call fcn.14000aab0
nop
call fcn.1400011a0
call fcn.140001100
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.140001100
call fcn.140001100
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
int3
call fcn.14000aab0
int3
call fcn.14000aab0
int3
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
nop
call fcn.14000aab0
int3