Function at 0x18005a8c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x18017c280]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r12, r9
mov rbx, rdx
mov qword [rsp + 0x120], rdx
mov rdi, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x328]
xor r13d, r13d
cmp qword [rdi + 0x28], r13
jne 0x18005a941
cmp dword [rdi + 0x60], 5
jne 0x18005a941
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
mov r8d, Ordinal_26
lea rdx, str.____ftable_url_is_empty.
mov rcx, rbx
call fcn.180005520
jmp 0x18005afcc
mov rax, qword [rdi + 8]
cmp qword [rdi], rax
jne 0x18005a978
cmp dword [rdi + 0x60], 6
jne 0x18005a978
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
mov r8d, Ordinal_34
lea rdx, str.____ftable_binary_data_is_empty
mov rcx, rbx
call fcn.180005520
jmp 0x18005afcc
lea rdx, [rdi + 0x38]
lea rcx, [rsp + 0x88]
call fcn.180005870
mov r14, rax
lea rcx, [rsp + 0x68]
call fcn.180005620
mov rdx, rax
lea rax, [0x1801623f0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 8
lea rcx, [0x1801839e0]
cmp qword [0x1801839f8], 7
cmova rcx, qword [0x1801839e0]
mov qword [rsp + 0xf0], rcx
mov rax, qword [0x1801839f0]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x158], xmm0
movabs r15, 0xc000000000000000
mov qword [rsp + 0x140], r15
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x18005aa0b
mov rcx, qword [rdx]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x168], xmm0
movabs rax, 0xc000000000000010
mov qword [rsp + 0x148], rax
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x18005aa4e
mov rcx, qword [r14]
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x178], xmm0
movabs rax, 0xc000000000000020
mov qword [rsp + 0x150], rax
mov qword [rsp + 0xf0], 3
lea rax, [rsp + 0x140]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xf0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.18000d570
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x18005ab1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005ab17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b8a9
call fcn.180085240
movdqa xmm0, xmmword [0x180162980]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r13w
mov rdx, qword [rsp + 0xa0]
cmp rdx, 7
jbe 0x18005ab80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005ab73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b8af
call fcn.180085240
movdqa xmm0, xmmword [0x180162980]
movdqu xmmword [rsp + 0x98], xmm0
mov word [rsp + 0x88], r13w
mov eax, dword [rdi + 0x60]
cmp eax, 5
jne 0x18005af4a
lea rdx, [rdi + 0x18]
lea r8, [rsp + 0x100]
lea rcx, [rsp + 0x140]
call fcn.18002c350
nop
cmp byte [rsp + 0x160], 0
jne 0x18005aefe
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rdx, qword [rsp + 0x100]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], r13
mov r8, qword [rsp + 0x110]
lea rcx, [rsp + 0xd0]
call fcn.18000b080
nop
mov r8d, 3
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.180022500
movsd xmm0, qword [rax]
movsd qword [rsp + 0x50], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0xf0], ecx
lea rax, [0x18017d270]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xf0], xmm0
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x18005acb4
cmp eax, 1
setne dil
mov rdx, qword [rsp + 0xe8]
cmp rdx, 7
jbe 0x18005acc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005acc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b8b5
jmp 0x18005acc1
xor dil, dil
test ecx, ecx
jne 0x18005b8bb
jmp 0x18005ac6f
call fcn.180085240
test dil, dil
je 0x18005ad91
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rdx, qword [rsp + 0x100]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], r13
mov r8, qword [rsp + 0x110]
lea rcx, [rsp + 0xd0]
call fcn.18000b080
nop
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 7
cmova rcx, qword [rsp + 0xd0]
call fcn.1800842a4
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x18005b8d8
mov rdx, qword [rsp + 0xe8]
cmp rdx, 7
jbe 0x18005ad91
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005ad8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b8f1
call fcn.180085240
nop
jmp 0x18005ada5
lea rax, str.____handle_downloads:_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], Ordinal_26
lea rax, [rsp + 0x140]
cmp qword [rsp + 0x158], 0xf
cmova rax, qword [rsp + 0x140]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xf0], 1
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xf0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180019520
nop
mov rdx, qword [rsp + 0x158]
cmp rdx, 0xf
jbe 0x18005ae95
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005ae90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b8fd
call fcn.180085240
movdqa xmm0, xmmword [0x180162990]
movdqu xmmword [rsp + 0x150], xmm0
mov byte [rsp + 0x140], 0
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b8f7
jmp 0x18005afc7
mov rdx, qword [rsp + 0x158]
cmp rdx, 0xf
jbe 0x18005b26a
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005af40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b8fd
call fcn.180085240
jmp 0x18005b26a
cmp eax, 6
jne 0x18005b26a
mov rax, qword [rdi + 8]
cmp qword [rdi], rax
jne 0x18005affc
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, Ordinal_26
lea rdx, str.____Binary_data_is_empty.
mov rcx, rbx
call fcn.180005520
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b903
call fcn.180085240
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.180085220
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x1b0]
call fcn.1800b94b0
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x1b0]
call fcn.180027e10
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1b0], r14
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ac], edx
cmp qword [rsp + 0x238], 0
jne 0x18005b177
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, Ordinal_34
lea rdx, str.____Fstream_file_can_not_open.
mov rcx, rbx
call fcn.180005520
nop
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1b0], r14
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ac], edx
lea rcx, [rsp + 0x1b8]
call fcn.1800273e0
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x1ac], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x258]
call fcn.1800830ac
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b903
jmp 0x18005afc7
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rdx
lea rcx, [rsp + 0x1b0]
call fcn.180026670
lea rcx, [rsp + 0x1b8]
call fcn.180027d10
test rax, rax
jne 0x18005b1e2
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
mov eax, 6
mov edx, 2
cmp qword [rsp + rcx + 0x1f8], 0
cmovne eax, edx
or eax, dword [rsp + rcx + 0x1c0]
and eax, 0x17
mov dword [rsp + rcx + 0x1c0], eax
mov edx, dword [rsp + rcx + 0x1c4]
and edx, eax
jne 0x18005b909
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1b0], r14
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ac], edx
lea rcx, [rsp + 0x1b8]
call fcn.1800273e0
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x1ac], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x258]
call fcn.1800830ac
nop
mov eax, dword [rdi + 0x58]
cmp eax, 2
jne 0x18005b2e6
mov r8d, Ordinal_26
lea rdx, str.___Download_completed.
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x10], r13
mov rcx, rbx
call fcn.180005520
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b8a3
jmp 0x18005afc7
test eax, eax
jne 0x18005b79c
mov eax, dword [rdi + 0x5c]
xorps xmm0, xmm0
cmp eax, 3
jne 0x18005b56d
movups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], reloc.LIBPQ.dll_Ordinal_15
mov byte [rsp + 0x120], 0
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x100]
call fcn.180022f00
test al, al
jne 0x18005b49a
lea rax, str.____Process_as_user_can_not_created:_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], Ordinal_47
lea rax, [rsp + 0x120]
cmp qword [rsp + 0x138], 0xf
cmova rax, qword [rsp + 0x120]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xf0], 1
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xf0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180019520
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x18005b42e
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b429
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b966
call fcn.180085240
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], reloc.LIBPQ.dll_Ordinal_15
mov byte [rsp + 0x120], 0
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b96c
jmp 0x18005afc7
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, Ordinal_45
lea rdx, str.___Process_created_as_user_successfully.
mov rcx, rbx
call fcn.180005520
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x18005b501
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b4fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b966
call fcn.180085240
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], reloc.LIBPQ.dll_Ordinal_15
mov byte [rsp + 0x120], 0
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b96c
jmp 0x18005afc7
cmp eax, 4
jne 0x18005b78a
xor eax, eax
movups xmmword [rsp + 0x144], xmm0
movups xmmword [rsp + 0x154], xmm0
movups xmmword [rsp + 0x164], xmm0
movups xmmword [rsp + 0x174], xmm0
movups xmmword [rsp + 0x184], xmm0
movups xmmword [rsp + 0x194], xmm0
mov dword [rsp + 0x1a4], eax
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x140], Ordinal_106
lea rcx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rcx, qword [rsp + 0x100]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x18005b6fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Process_can_not_created_Error_code:_
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], Ordinal_47
mov dword [rsp + 0xf8], eax
movabs rax, 0x2000000000000000
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x120], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.180019520
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b972
jmp 0x18005afc7
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, Ordinal_45
lea rdx, str.___Process_created_default_successfully.
mov rcx, rbx
call fcn.180005520
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b972
jmp 0x18005afc7
mov r8d, reloc.LIBPQ.dll_Ordinal_22
lea rdx, str.____Wrong_execute_code
jmp 0x18005b282
cmp eax, 1
jne 0x18005b834
mov byte [r12], al
lea rax, [rsp + 0x100]
cmp rsi, rax
je 0x18005b822
mov rdi, qword [rsp + 0x110]
lea r9, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova r9, qword [rsp + 0x100]
mov rax, qword [rsi + 0x18]
cmp rdi, rax
ja 0x18005b817
mov r14, rsi
cmp rax, 7
jbe 0x18005b7ed
mov r14, qword [rsi]
mov qword [rsi + 0x10], rdi
lea r8, [rdi + rdi]
mov rdx, r9
mov rcx, r14
call fcn.1800b8e10
mov word [r14 + rdi*2], r13w
mov r8d, Ordinal_34
lea rdx, str.___Update_process_is_starting.
jmp 0x18005b27f
mov rdx, rdi
mov rcx, rsi
call fcn.180028b10
mov r8d, Ordinal_34
lea rdx, str.___Update_process_is_starting.
jmp 0x18005b27f
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, reloc.LIBPQ.dll_Ordinal_22
lea rdx, str.____Wrong_command_code
mov rcx, rbx
call fcn.180005520
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x18005afcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005afc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005afc7
call fcn.18009a08c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xf0]
lea rcx, [0x1800f71e8]
call fcn.180021a70
nop
shr rdx, 0x20
lea r8, [rsp + 0xd0]
lea rcx, str.remove
call fcn.18002d9b0
nop
call fcn.18009a08c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
nop
test dl, 4
je 0x18005b917
lea rbx, [0x1800f3cb8]
jmp 0x18005b92c
test dl, 2
lea rbx, [0x1800f3cd0]
lea rax, [0x1800f3ce8]
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0xf0]
call fcn.180002fa0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xa8]
call fcn.180003970
lea rdx, [0x180179b68]
lea rcx, [rsp + 0xa8]
call fcn.18008788c
nop
call fcn.18009a08c
nop
call fcn.18009a08c
int3
call fcn.18009a08c
int3