Function at 0x14000a168
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create directory
Create pipe
Create process on windows
Encode data using base64
Get common file path
Persist via run registry key
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xcb8
xor esi, esi
mov rbx, r9
mov rdi, rcx
mov dword [rsp + 0x68], 0x20
mov dword [rsp + 0x210], 0x61
mov dword [rsp + 0x1fc], 0x63
lea ebp, [rsi + 0x2f]
mov qword [rax - 0x998], rsi
mov qword [rax - 0x920], rsi
mov dword [rsp + 0x2b8], 0xd
cmp r9, rsi
je 0x14000a406
lea rcx, [rax + 0x20]
call fcn.140044ef4
mov r11, qword [rsp + 0xcf8]
cmp r11, rsi
je 0x14000a406
cmp bp, word [r11]
jne 0x14000a406
movzx ecx, word [r11 + 2]
lea edx, [rsi + 0x20]
lea r9d, [rsi + 0x69]
or cx, dx
lea ebp, [rsi + 0x76]
lea r8d, [rsi + 0x73]
lea r10d, [rsi + 0x72]
cmp r9w, cx
jne 0x14000a338
movzx eax, word [r11 + 4]
or ax, dx
lea edx, [rsi + 0x6e]
cmp dx, ax
jne 0x14000a338
movzx eax, word [r11 + 6]
lea edx, [rsi + 0x20]
or ax, dx
cmp r8w, ax
jne 0x14000a338
movzx eax, word [r11 + 8]
or ax, dx
lea edx, [rsi + 0x74]
cmp dx, ax
jne 0x14000a338
movzx eax, word [r11 + 0xa]
lea edx, [rsi + 0x61]
or ax, 0x20
cmp dx, ax
jne 0x14000a338
movzx eax, word [r11 + 0xc]
lea edx, [rsi + 0x6c]
or ax, 0x20
cmp dx, ax
jne 0x14000a338
movzx eax, word [r11 + 0xe]
or ax, word [rsp + 0x68]
cmp dx, ax
jne 0x14000a338
movzx eax, word [r11 + 0x10]
lea edx, [rsi + 0x20]
or ax, dx
cmp r8w, ax
jne 0x14000a338
movzx eax, word [r11 + 0x12]
or ax, dx
lea edx, [rsi + 0x65]
cmp dx, ax
jne 0x14000a33d
movzx eax, word [r11 + 0x14]
or ax, word [rsp + 0x68]
cmp r10w, ax
jne 0x14000a33d
movzx eax, word [r11 + 0x16]
or ax, word [rsp + 0x68]
cmp bp, ax
jne 0x14000a33d
movzx eax, word [r11 + 0x18]
or ax, word [rsp + 0x68]
cmp r9w, ax
jne 0x14000a33d
movzx eax, word [r11 + 0x1a]
or ax, word [rsp + 0x68]
cmp word [rsp + 0x1fc], ax
jne 0x14000a33d
movzx eax, word [r11 + 0x1c]
or ax, word [rsp + 0x68]
cmp dx, ax
jne 0x14000a33d
lea eax, [rsi + 9]
cmp ax, word [r11 + 0x1e]
ja 0x14000a326
lea eax, [rsi + 0xd]
cmp word [r11 + 0x1e], ax
jbe 0x14000a3ce
mov eax, 0x20
cmp ax, word [r11 + 0x1e]
je 0x14000a3ce
jmp 0x14000a33d
mov edx, 0x65
cmp r8w, cx
jne 0x14000a406
movzx eax, word [r11 + 4]
mov r8d, 0x20
or ax, r8w
cmp dx, ax
jne 0x14000a406
movzx eax, word [r11 + 6]
or ax, r8w
cmp r10w, ax
jne 0x14000a406
movzx eax, word [r11 + 8]
or ax, r8w
cmp bp, ax
jne 0x14000a406
movzx eax, word [r11 + 0xa]
or ax, r8w
cmp r9w, ax
jne 0x14000a406
movzx eax, word [r11 + 0xc]
lea ecx, [r8 + 0x43]
or ax, r8w
cmp cx, ax
jne 0x14000a406
movzx eax, word [r11 + 0xe]
or ax, r8w
cmp dx, ax
jne 0x14000a406
lea eax, [rcx - 0x5a]
cmp ax, word [r11 + 0x10]
ja 0x14000a3c7
lea eax, [rcx - 0x56]
cmp word [r11 + 0x10], ax
jbe 0x14000a3ce
cmp r8w, word [r11 + 0x10]
jne 0x14000a406
lea rdx, str.PECMD_EXEC
lea rcx, [0x1400f19b0]
call fcn.140058a38
mov rdx, qword [rsp + 0xcf8]
lea rcx, [0x1400f19b0]
call fcn.14004bfa8
mov eax, 2
mov word [rdi + 0xc8], ax
jmp 0x140011093
mov eax, dword [rsp + 0xd00]
mov edi, 1
mov byte [rsp + 0x71], sil
mov ecx, eax
and ecx, edi
mov dword [rsp + 0x74], ecx
mov ecx, eax
shr eax, 2
shr ecx, 1
and al, dil
and ecx, edi
mov dword [rsp + 0xd00], eax
mov dword [rsp + 0xfc], ecx
lea rcx, [rsp + 0x160]
call fcn.14004be6c
mov rdx, qword [rsp + 0xce8]
cmp rdx, rsi
je 0x14000a47d
lea rcx, [rsp + 0x160]
call fcn.140058a38
mov r11, qword [rsp + 0x160]
lea rcx, [rsp + 0xce8]
mov qword [rsp + 0xce8], r11
call fcn.140044ef4
lea rcx, [rsp + 0x168]
call fcn.14004be6c
mov rdx, qword [rsp + 0xcf8]
cmp rdx, rsi
je 0x14000a4b4
lea rcx, [rsp + 0x168]
call fcn.140058a38
mov rdx, qword [rsp + 0x168]
mov qword [rsp + 0xcf8], rdx
cmp qword [rsp + 0xd08], rsi
lea rax, [rsp + 0x480]
mov ecx, 0x5e
cmovne rax, qword [rsp + 0xd08]
mov dword [rsp + 0x3c0], ecx
mov qword [rsp + 0x3c8], rax
mov rax, qword [rsp + 0xce8]
mov qword [rsp + 0x2f8], rax
cmp rax, rsi
jne 0x14000a53b
mov qword [rsp + 0xce8], rdx
cmp rdx, rsi
je 0x14000a53b
lea r8d, [rcx - 0x59]
lea rcx, str._shel
call fcn.140045fc8
cmp al, sil
je 0x14000a53b
lea rax, [rsp + 0x3c0]
mov dword [rsp + 0x74], edi
mov dword [rsp + 0xfc], edi
mov qword [rsp + 0xcf8], rax
mov byte [rsp + 0xd00], dil
lea rcx, [rsp + 0x140]
mov byte [rsp + 0x61], sil
mov byte [rsp + 0x70], sil
mov byte [rsp + 0x100], sil
mov byte [rsp + 0xc4], sil
mov byte [rsp + 0xf1], sil
mov byte [rsp + 0xdc], sil
mov byte [rsp + 0x66], sil
mov byte [rsp + 0x62], sil
mov byte [rsp + 0x101], sil
mov byte [rsp + 0xf0], sil
call fcn.14004be6c
lea rcx, [rsp + 0x150]
mov dword [rsp + 0x2e8], esi
mov dword [rsp + 0x2ec], esi
mov byte [rsp + 0x102], sil
mov byte [rsp + 0x104], sil
mov byte [rsp + 0xa8], sil
mov byte [rsp + 0x8c], sil
mov byte [rsp + 0x65], dil
mov byte [rsp + 0xf8], sil
mov dword [rsp + 0xa0], esi
mov dword [rsp + 0xf4], esi
call fcn.14004be6c
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0x158], esi
mov byte [rsp + 0x63], sil
call fcn.14004be6c
lea rcx, [rsp + 0x110]
call fcn.14004be6c
lea rcx, [rsp + 0xe8]
call fcn.14004be6c
or dword [rsp + 0x1f8], 0xffffffff
lea rcx, [rsp + 0x170]
mov dil, sil
mov r11b, sil
mov byte [rsp + 0xa9], sil
mov dword [rsp + 0x88], edi
mov qword [rsp + 0x3f8], rsi
call fcn.14004be6c
mov ebp, 0x68
lea rcx, [rsp + 0x550]
xor edx, edx
lea r8d, [rbp - 0x10]
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x230], rsi
mov dword [rsp + 0x540], ebp
mov qword [rsp + 0x548], rsi
call fcn.1400b93b0
lea rcx, [rsp + 0x5a8]
mov r8, rbp
xor edx, edx
call fcn.1400b93b0
xor eax, eax
mov qword [rsp + 0x310], rsi
lea ecx, [rax + 3]
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x320], rax
lea ebp, [rax + 2]
lea edx, [rax + 0x23]
lea r8d, [rax + 0x24]
mov qword [rsp + 0x328], rax
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0xcf8]
mov dword [rsp + 0xd8], ecx
cmp rax, rsi
jne 0x14000a6fc
lea edx, [rbp - 1]
mov cl, dl
mov dword [rsp + 0x88], ecx
mov rcx, qword [rsp + 0xce8]
jmp 0x14000a7b0
cmp dx, word [rax]
jne 0x14000a726
mov rcx, qword [rsp + 0xce8]
cmp rax, rcx
jne 0x14000a719
add rcx, rbp
mov qword [rsp + 0xce8], rcx
add rax, rbp
mov qword [rsp + 0xcf8], rax
jmp 0x14000a742
test byte [section.flag_dat], cl
movzx edi, dil
cmovne edi, ecx
mov rcx, qword [rsp + 0xce8]
mov dword [rsp + 0x88], edi
cmp rax, rsi
je 0x14000a7ab
mov edx, 0x5e
cmp dx, word [rax]
jne 0x14000a77a
cmp rax, rcx
jne 0x14000a761
add rcx, rbp
mov qword [rsp + 0xce8], rcx
add rax, rbp
mov edx, 1
mov qword [rsp + 0xcf8], rax
mov byte [rsp + 0xd00], dl
jmp 0x14000a77f
mov edx, 1
cmp rax, rsi
je 0x14000a7b0
cmp r8w, word [rax]
jne 0x14000a7b0
cmp rax, rcx
jne 0x14000a79a
add rcx, rbp
mov qword [rsp + 0xce8], rcx
add rax, rbp
mov byte [rsp + 0x62], dl
mov qword [rsp + 0xcf8], rax
jmp 0x14000a7b0
mov edx, 1
mov edi, esi
mov dword [rsp + 0xc0], esi
mov r9d, 0x7c
cmp rax, rsi
je 0x14000a7ee
cmp r9w, word [rax]
jne 0x14000a7ee
cmp rax, rcx
jne 0x14000a7da
add rcx, rbp
mov qword [rsp + 0xce8], rcx
add rax, rbp
mov edi, edx
mov dword [rsp + 0xc0], edx
mov qword [rsp + 0xcf8], rax
mov eax, 0x2a
lea r8d, [rax + 3]
cmp rbx, rsi
je 0x14000a894
cmp ax, word [rbx]
jne 0x14000a894
add rcx, rbp
mov byte [rsp + 0x61], 0x10
mov qword [rsp + 0xce8], rcx
cmp r9w, word [rcx]
jne 0x14000a833
add rcx, rbp
mov edi, edx
mov dword [rsp + 0xc0], edx
mov qword [rsp + 0xce8], rcx
mov eax, 0x31
lea r9d, [rax - 0x11]
cmp ax, word [rcx]
jne 0x14000a848
mov byte [rsp + 0x61], 0x11
jmp 0x14000a86b
movzx eax, word [rcx]
mov edx, 0x6e
or ax, r9w
cmp dx, ax
jne 0x14000a860
mov byte [rsp + 0x61], 0x12
jmp 0x14000a86b
cmp r8w, word [rcx]
jne 0x14000a876
mov byte [rsp + 0x61], 0x14
add rcx, rbp
mov qword [rsp + 0xce8], rcx
mov eax, 9
cmp ax, word [rcx]
ja 0x14000a88a
mov eax, 0xd
cmp word [rcx], ax
jbe 0x14000a894
cmp r9w, word [rcx]
jne 0x140011026
lea rcx, [rsp + 0xce8]
call fcn.140044ef4
mov dword [rsp + 0x130], 0x22
mov edx, 0x3d
cmp byte [rsp + 0x61], sil
je 0x14000aa51
mov rcx, qword [rsp + 0xce8]
mov eax, 1
mov dword [rsp + 0x74], eax
movzx eax, word [rcx]
mov rbx, rcx
cmp ax, si
je 0x140011026
cmp ax, dx
je 0x14000a8ec
add rbx, rbp
mov ax, word [rbx]
cmp ax, si
jne 0x14000a8dc
cmp rbx, rcx
je 0x140011026
cmp dx, word [rbx]
jne 0x140011026
sub rbx, rbp
mov eax, 0x2b
mov qword [rsp + 0x308], rbx
cmp ax, word [rbx]
jne 0x14000a927
mov al, byte [rbx]
sub rbx, rbp
mov byte [rsp + 0x102], al
mov qword [rsp + 0x308], rbx
mov rax, rbx
mov r10d, 9
cmp rbx, rcx
jbe 0x14000a963
lea edi, [r10 + 0x17]
lea ebx, [rdi - 0x13]
cmp r10w, word [rax]
ja 0x14000a947
cmp word [rax], bx
jbe 0x14000a94c
cmp di, word [rax]
jne 0x14000a954
sub rax, rbp
cmp rax, rcx
ja 0x14000a93c
mov rbx, qword [rsp + 0x308]
mov edi, dword [rsp + 0xc0]
mov r11d, 0xd
cmp r10w, word [rax]
ja 0x14000a979
cmp word [rax], r11w
jbe 0x140011026
mov r9d, 0x20
cmp r9w, word [rax]
je 0x140011026
mov rdx, rax
add rax, rbp
cmp rdx, rcx
jbe 0x14000a9b2
lea r8, [rdx - 2]
cmp r10w, word [r8]
ja 0x14000a9a4
cmp word [r8], r11w
jbe 0x14000a9b2
cmp r9w, word [r8]
je 0x14000a9b2
mov rdx, r8
cmp r8, rcx
ja 0x14000a994
sub rax, rdx
lea rcx, [rsp + 0xe0]
sar rax, 1
mov r8d, eax
call fcn.14004c0cc
mov r9, qword [rsp + 0xce0]
lea rdx, [rsp + 0xe0]
mov rcx, r9
xor r8d, r8d
call fcn.1400035d0
mov rax, qword [rsp + 0xce0]
cmp byte [rax + 0xd2], sil
jne 0x14000a9fa
test byte [rax + 0xd], 0xf
je 0x14000aa0d
lea rdx, [rsp + 0xe0]
xor r8d, r8d
mov rcx, rax
call fcn.1400035d0
movzx eax, word [rbx]
cmp ax, si
je 0x14000aa2a
mov ecx, 0x3d
cmp ax, cx
je 0x14000aa38
add rbx, rbp
mov ax, word [rbx]
cmp ax, si
jne 0x14000aa1a
mov eax, 0x3d
cmp word [rbx], ax
jne 0x140011026
lea rax, [rbx + 2]
lea rcx, [rsp + 0x3f8]
mov qword [rsp + 0x3f8], rax
call fcn.140044ef4
lea rcx, [rsp + 0xce8]
call fcn.140044ef4
mov rbx, qword [rsp + 0xce8]
mov qword [rsp + 0xb0], rbx
cmp qword [rsp + 0x2c0], rsi
je 0x14000aa83
cmp byte [rsp + 0x61], sil
jne 0x14000ac16
mov edx, 0x2d
cmp dx, word [rbx]
jne 0x14000aaa3
lea rcx, [rbx + 2]
mov rax, rbx
cmp dx, word [rcx]
cmove rax, rcx
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0xb0]
lea rcx, [0x1400d7440]
mov r8d, 1
call fcn.14004e558
cmp al, sil
jne 0x14000ac16
mov rax, qword [rsp + 0xb0]
mov ecx, 0x2d
cmp cx, word [rax]
je 0x14000aae6
mov ecx, 0x2f
cmp cx, word [rax]
jne 0x14000ac16
add rax, rbp
lea rdx, [rsp + 0xb0]
lea rcx, str.catch
mov r8d, 5
mov qword [rsp + 0xb0], rax
call fcn.14004e5bc
cmp al, sil
je 0x14000ab86
mov cl, byte [rsp + 0x61]
mov al, cl
or cl, 0x10
mov byte [rsp + 0x61], cl
cmp al, sil
je 0x14000ad73
mov rax, qword [rsp + 0xb0]
movzx ecx, word [rax]
cmp cx, si
je 0x14000ab6c
mov edx, 0x20
lea edi, [rdx - 0x13]
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x14000ab4d
cmp cx, di
jbe 0x14000ab65
cmp dx, cx
je 0x14000ab65
add rax, rbp
mov qword [rsp + 0xb0], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000ab42
mov edi, dword [rsp + 0xc0]
lea rcx, [rsp + 0xb0]
call fcn.140044ef4
mov rbx, qword [rsp + 0xb0]
jmp 0x14000aa83
mov rdx, qword [rsp + 0xb0]
lea rcx, str.cmd:
mov r8d, 4
call fcn.140045fc8
cmp al, sil
je 0x14000ac6a
mov rcx, qword [rsp + 0xce0]
add qword [rsp + 0xb0], 8
lea r9, [rsp + 0x1f8]
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0xb0]
call fcn.140004d3c
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0xb0]
cmp rbx, rax
jae 0x14000ac0b
mov edi, 0x20
mov word [rbx], di
mov rax, qword [rsp + 0xb0]
add rbx, rbp
cmp rbx, rax
jb 0x14000abf1
mov edi, dword [rsp + 0xc0]
cmp byte [rsp + 0x61], sil
je 0x14000ab2e
lea rcx, [rsp + 0xce8]
call fcn.140044ef4
mov rdx, qword [rsp + 0x2c0]
cmp rdx, rsi
je 0x14000ac44
movzx eax, word [rdx]
neg ax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0x2c0], rcx
cmp edi, esi
jne 0x14000ad7d
cmp qword [rsp + 0xd10], rsi
jne 0x14000ad7d
mov dil, sil
mov byte [rsp + 0xaa], sil
jmp 0x14000ad8c
mov rdx, qword [rsp + 0xb0]
lea rcx, [0x1400d742c]
mov r8d, 3
call fcn.140045fc8
cmp al, sil
je 0x14000acae
mov rax, qword [rsp + 0xb0]
mov ecx, 0x2a
add rax, 6
jmp 0x14000ac9f
add rax, rbp
mov qword [rsp + 0xb0], rax
cmp cx, word [rax]
je 0x14000ac9c
jmp 0x14000ad2d
mov rdx, qword [rsp + 0xb0]
lea rcx, str.exe:
mov r8d, 4
call fcn.140045fc8
cmp al, sil
je 0x14000acf2
mov rax, qword [rsp + 0xb0]
mov ecx, 0x2a
add rax, 8
jmp 0x14000ace3
add rax, rbp
mov qword [rsp + 0xb0], rax
cmp cx, word [rax]
je 0x14000ace0
jmp 0x14000ad2d
mov rdx, qword [rsp + 0xb0]
lea rcx, str.logs:
mov r8d, 5
call fcn.140045fc8
cmp al, sil
je 0x14000ab26
mov rax, qword [rsp + 0xb0]
mov ecx, 0xa
add rax, rcx
mov qword [rsp + 0xb0], rax
mov edx, 0x22
cmp word [rax], dx
jne 0x14000ab2e
add rax, rbp
mov qword [rsp + 0xb0], rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000ab6c
add rax, rbp
mov qword [rsp + 0xb0], rax
cmp dx, cx
je 0x14000ab2e
mov cx, word [rax]
cmp cx, si
jne 0x14000ad52
jmp 0x14000ab2e
mov edx, 0x3d
jmp 0x14000a8bc
mov eax, 1
mov dil, al
mov byte [rsp + 0xaa], al
lea rcx, [rsp + 0x1a8]
mov rbx, rsi
mov qword [rsp + 0x440], rsi
mov qword [rsp + 0x2f0], rsi
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rbx
call fcn.14004be6c
lea rcx, [rsp + 0x198]
call fcn.14004be6c
lea rcx, [rsp + 0x1b0]
call fcn.14004be6c
mov bp, si
mov qword [rsp + 0x120], rsi
mov dword [rsp + 0x6c], ebp
mov qword [rsp + 0x188], rsi
mov byte [rsp + 0x64], sil
cmp dil, sil
jne 0x14000ae3f
cmp qword [rsp + 0x2f8], rsi
jne 0x14000ae3f
mov rdx, qword [rsp + 0xce8]
mov rcx, qword [rsp + 0xce0]
mov eax, 1
lea r8, [rsp + 0x188]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.140056690
mov r11, qword [rsp + 0x188]
mov qword [rsp + 0xce8], r11
mov eax, 1
mov rdi, qword [rsp + 0xce8]
mov edx, 0x2d
cmp dx, word [rdi]
jne 0x14000ae6f
lea rcx, [rdi + 2]
mov rax, rdi
cmp dx, word [rcx]
cmove rax, rcx
mov qword [rsp + 0xce8], rax
lea eax, [rdx - 0x2c]
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d7440]
mov r8d, eax
call fcn.14004e558
mov r8, qword [rsp + 0xce8]
cmp al, sil
jne 0x14000bfcb
mov ecx, 0x2d
cmp cx, word [r8]
je 0x14000aeaf
lea eax, [rcx + 2]
cmp ax, word [r8]
jne 0x14000bfcb
add r8, 2
lea rdx, [rsp + 0xce8]
lea rcx, str.catch
mov qword [rsp + 0xce8], r8
mov r8d, 5
call fcn.14004e558
cmp al, sil
je 0x14000aee4
mov byte [rsp + 0x61], 0x10
jmp 0x14000ae3f
mov rdx, qword [rsp + 0xce8]
lea rcx, str.clone:
mov r8d, 6
call fcn.140045fc8
cmp al, sil
je 0x14000af87
mov rax, qword [rsp + 0xce8]
add rax, 0xc
mov qword [rsp + 0xce8], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000af71
mov r8d, 2
lea r9d, [r8 + 0x1e]
lea r10d, [r8 + 7]
cmp r10w, cx
ja 0x14000af46
mov r11d, 0xd
cmp cx, r11w
jbe 0x14000af61
cmp r9w, cx
je 0x14000af61
add rax, r8
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
je 0x14000af71
jmp 0x14000af34
cmp word [rax], si
je 0x14000af71
mov word [rax], si
add qword [rsp + 0xce8], r8
cmp word [rdx], si
je 0x14000bfb6
mov qword [rsp + 0x230], rdx
jmp 0x14000bfb6
lea rdx, [rsp + 0xce8]
lea rcx, str.shel
mov r8d, 4
call fcn.14004e558
cmp al, sil
je 0x14000afcb
or byte [rsp + 0xd00], 2
and byte [rsp + 0x88], 0xfe
mov eax, 1
mov dword [rsp + 0xfc], eax
mov dword [rsp + 0x74], eax
jmp 0x14000ae44
mov rdx, qword [rsp + 0xce8]
lea rcx, str.shel:
mov r8d, 5
call fcn.140045fc8
cmp al, sil
je 0x14000b084
or byte [rsp + 0xd00], 2
and byte [rsp + 0x88], 0xfe
mov eax, 1
mov dword [rsp + 0xfc], eax
mov dword [rsp + 0x74], eax
mov rax, qword [rsp + 0xce8]
add rax, 0xa
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x350]
mov r8d, 5
mov dword [rsp + 0xc8], esi
mov qword [rsp + 0xce8], rax
mov qword [rsp + 0x350], rax
call fcn.140020840
mov r8d, dword [rsp + 0xc8]
cmp r8d, esi
mov qword [rsp + 0xce8], rax
mov eax, 1
jle 0x14000ae44
mov rdx, qword [rsp + 0x350]
lea rcx, [rsp + 0x3b8]
call fcn.14004c0cc
jmp 0x14000ae3f
mov rdx, qword [rsp + 0xce8]
lea rcx, str.runrmenu:
mov r8d, 9
call fcn.140045fc8
cmp al, sil
je 0x14000b10d
mov rax, qword [rsp + 0xce8]
add rax, 0x12
mov qword [rsp + 0xce8], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000b100
mov ebp, 0xd
lea r8d, [rbp + 0x13]
lea r9d, [rbp - 4]
cmp r9w, cx
ja 0x14000b0da
cmp cx, bp
jbe 0x14000b0f4
cmp r8w, cx
je 0x14000b0f4
add rax, 2
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000b0cf
mov ebp, dword [rsp + 0x6c]
mov rbx, qword [rsp + 0x80]
lea rcx, [rsp + 0x140]
jmp 0x14000b2d2
mov rdx, qword [rsp + 0xce8]
lea rcx, str.poprmenu
mov r8d, 8
call fcn.140045fc8
cmp al, sil
je 0x14000b23d
mov rax, qword [rsp + 0xce8]
add rax, 0x10
mov qword [rsp + 0xce8], rax
mov qword [rsp + 0x2d8], rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000b19e
mov edx, 2
lea r8d, [rdx + 0x1e]
lea r9d, [rdx + 7]
cmp r9w, cx
ja 0x14000b173
mov r10d, 0xd
cmp cx, r10w
jbe 0x14000b18e
cmp r8w, cx
je 0x14000b18e
add rax, rdx
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
je 0x14000b19e
jmp 0x14000b161
cmp word [rax], si
je 0x14000b19e
add rax, rdx
mov qword [rsp + 0xce8], rax
lea rcx, [rsp + 0xce8]
call fcn.140044ef4
lea rcx, [rsp + 0x2e8]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x2d8]
mov byte [rsp + 0x101], 1
cmp word [rax], si
je 0x14000b1e6
cmp word [rax], 0x30
jb 0x14000b1da
cmp word [rax], 0x39
jbe 0x14000b1e6
add rax, 2
mov qword [rsp + 0x2d8], rax
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0x2d8]
call fcn.14004fc04
mov r11, qword [rsp + 0x2d8]
cmp word [r11], si
je 0x14000b223
cmp word [r11], 0x30
jb 0x14000b217
cmp word [r11], 0x39
jbe 0x14000b223
add r11, 2
mov qword [rsp + 0x2d8], r11
lea rdx, [rsp + 0x2ec]
lea rcx, [rsp + 0x2d8]
call fcn.14004fc04
jmp 0x14000ae3f
mov rdx, qword [rsp + 0xce8]
lea rcx, str.pid:
mov r8d, 4
call fcn.140045fc8
cmp al, sil
je 0x14000b2e5
mov rax, qword [rsp + 0xce8]
add rax, 8
mov qword [rsp + 0xce8], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000bfb6
mov ebp, 0xd
lea r8d, [rbp + 0x13]
lea r9d, [rbp - 4]
cmp r9w, cx
ja 0x14000b29b
cmp cx, bp
jbe 0x14000b2b5
cmp r8w, cx
je 0x14000b2b5
add rax, 2
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000b290
mov ebp, dword [rsp + 0x6c]
mov rbx, qword [rsp + 0x80]
cmp rdx, rax
je 0x14000bfb6
lea rcx, [rsp + 0x1a8]
sub rax, rdx
sar rax, 1
mov r8d, eax
call fcn.14004c0cc
jmp 0x14000bfb6
mov rdx, qword [rsp + 0xce8]
lea rcx, str.exe:
mov r8d, 4
call fcn.140045fc8
cmp al, sil
je 0x14000b4b1
mov rax, qword [rsp + 0xce8]
mov r8d, 0x23
mov ebx, esi
add rax, 8
mov edx, esi
lea r10d, [r8 - 0x22]
mov qword [rsp + 0xce8], rax
movzx ecx, word [rax]
mov r9, rax
cmp r8w, cx
jne 0x14000b33e
mov ebp, r10d
mov dword [rsp + 0x6c], r10d
mov edi, 0x22
cmp di, cx
jne 0x14000b403
add rax, 2
mov qword [rsp + 0xce8], rax
mov r8, rax
mov qword [rsp + 0x270], rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000b3c6
lea ebx, [rdi - 2]
lea r8d, [rdi - 0x20]
lea r11d, [rdi - 0x19]
cmp di, cx
jne 0x14000b3a5
add edx, r10d
test r10b, dl
je 0x14000b3a5
movzx ecx, word [rax + 2]
cmp cx, si
je 0x14000b3b8
cmp r11w, cx
ja 0x14000b39c
cmp cx, word [rsp + 0x2b8]
jbe 0x14000b3b8
cmp bx, cx
je 0x14000b3b8
or bp, r8w
add rax, r8
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000b376
mov r8, qword [rsp + 0x270]
mov dword [rsp + 0x6c], ebp
mov ebx, esi
cmp di, word [rax]
jne 0x14000b43c
or ebx, 0xffffffff
mov r9, r8
lea ecx, [rbx + 3]
add rax, rcx
mov byte [rsp + 0x64], cl
mov qword [rsp + 0xce8], rax
cmp di, word [rax - 4]
je 0x14000b3fc
cmp di, word [r8]
jne 0x14000b43c
cmp di, word [r8 + 2]
je 0x14000b3fc
cmp di, word [r8]
jne 0x14000b43c
mov byte [rsp + 0x64], sil
jmp 0x14000b43c
cmp cx, si
je 0x14000b43c
mov edx, 0x20
lea ebp, [rdx - 0x13]
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x14000b41f
cmp cx, bp
jbe 0x14000b438
cmp dx, cx
je 0x14000b438
add rax, 2
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000b414
mov ebp, dword [rsp + 0x6c]
sub rax, r9
sar rax, 1
add ebx, eax
cmp ebx, esi
jle 0x14000bfae
lea rdx, [r9 - 0xa]
lea rcx, [rsp + 0x148]
call fcn.140058a38
mov r11, qword [rsp + 0x148]
lea rax, [r11 + 0xa]
mov qword [rsp + 0x80], rax
movsxd rax, ebx
lea rbx, [r11 + 0xa]
mov word [rbx + rax*2], si
mov eax, 0x2a
cmp ax, word [rbx]
jne 0x14000bfb6
cmp word [rbx + 2], si
jne 0x14000bfb6
lea rcx, [rsp + 0x148]
call fcn.140004ea4
mov rbx, rax
mov qword [rsp + 0x80], rax
jmp 0x14000bfb6
mov rdx, qword [rsp + 0xce8]
lea rcx, [0x1400d742c]
mov r8d, 3
call fcn.140045fc8
cmp al, sil
je 0x14000b615
mov rax, qword [rsp + 0xce8]
mov ecx, 0x2a
mov ebx, esi
add rax, 6
lea edi, [rcx - 0x29]
mov qword [rsp + 0xce8], rax
cmp word [rax], cx
jne 0x14000b4ff
add ebx, edi
add rax, 2
jmp 0x14000b4ea
cmp ebx, 2
mov qword [rsp + 0x410], rax
mov dword [rsp + 0x1fc], esi
jge 0x14000b5bf
lea rdx, [rsp + 0x1fc]
lea rcx, [rsp + 0x410]
mov r8d, edi
call fcn.140020840
mov qword [rsp + 0xce8], rax
mov eax, dword [rsp + 0x1fc]
cmp eax, esi
jle 0x14000b570
mov rdx, qword [rsp + 0x410]
lea rcx, [rsp + 0x120]
mov r8d, eax
call fcn.14004c0cc
mov rcx, qword [rsp + 0x120]
mov eax, dword [rsp + 0x1fc]
mov qword [rsp + 0x78], rcx
jmp 0x14000b578
mov rcx, qword [rsp + 0x120]
cmp ebx, edi
jne 0x14000bfae
cmp eax, esi
jle 0x14000bfae
lea rdx, [rsp + 0x120]
mov r8, rdi
mov qword [rsp + 0x490], rcx
mov qword [rsp + 0x120], rsi
call fcn.1400a6f3c
lea rcx, [rsp + 0x490]
mov qword [rsp + 0x78], rax
call fcn.140044f24
jmp 0x14000bfae
lea rcx, [rsp + 0x120]
mov edx, 0x105
call fcn.14004bf70
mov rdx, qword [rsp + 0x120]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x120]
xor edx, edx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp rax, rsi
je 0x14000b603
mov word [rax], si
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x78], rax
jmp 0x14000bfae
mov rdx, qword [rsp + 0xce8]
lea rcx, str.logs:
mov r8d, 5
call fcn.140045fc8
cmp al, sil
je 0x14000b6d3
mov rbx, qword [rsp + 0xce8]
mov edi, esi
mov eax, 0x3f
add rbx, 0xa
mov qword [rsp + 0xce8], rbx
mov qword [rsp + 0x360], rbx
cmp ax, word [rbx]
sete dil
cmp edi, esi
je 0x14000b672
add rbx, 2
mov qword [rsp + 0x360], rbx
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x360]
mov r8d, 1
mov dword [rsp + 0x90], esi
call fcn.140020840
mov r8d, dword [rsp + 0x90]
cmp r8d, esi
mov qword [rsp + 0xce8], rax
jle 0x14000bfae
cmp edi, esi
je 0x14000b6be
cmp qword [0x1400f1cb8], rsi
je 0x14000bfae
lea rcx, [rsp + 0x150]
mov rdx, rbx
call fcn.14004c0cc
jmp 0x14000bfae
lea rdx, [rsp + 0xce8]
lea rcx, str.nowin
mov r8d, 5
call fcn.14004e558
cmp al, sil
je 0x14000b703
mov eax, 1
mov byte [rsp + 0xf0], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, str.hide
mov r8d, 4
call fcn.14004e558
cmp al, sil
je 0x14000b72c
mov edx, 0x10000000
jmp 0x14000b886
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d73c4]
mov r8d, 4
call fcn.14004e558
cmp al, sil
je 0x14000b759
mov eax, 1
mov dword [rsp + 0x74], eax
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d73c0]
mov r8d, 3
call fcn.14004e558
cmp al, sil
je 0x14000b786
mov eax, 1
or byte [rsp + 0x70], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, str.err
mov r8d, 4
call fcn.14004e558
cmp al, sil
je 0x14000b7af
or byte [rsp + 0x70], 3
jmp 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, str.limit
mov r8d, 5
call fcn.14004e558
cmp al, sil
je 0x14000b7df
mov eax, 1
mov byte [rsp + 0xdc], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d73ac]
mov r8d, 3
call fcn.14004e558
cmp al, sil
je 0x14000b80c
mov eax, 1
mov byte [rsp + 0x66], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, str.hook
mov r8d, 4
call fcn.14004e558
cmp al, sil
je 0x14000b83c
mov eax, 1
mov dword [rsp + 0xfc], eax
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d73a0]
mov r8d, 3
call fcn.14004e558
cmp al, sil
je 0x14000b862
mov edx, 6
jmp 0x14000b886
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d739c]
mov r8d, 3
call fcn.14004e558
cmp al, sil
je 0x14000b892
mov edx, 3
mov dword [rsp + 0xa0], edx
jmp 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, str.show
mov r8d, 4
call fcn.14004e558
cmp al, sil
je 0x14000b8c2
mov eax, 1
mov dword [rsp + 0xa0], eax
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, str.runs
mov r8d, 4
call fcn.14004e558
cmp al, sil
je 0x14000b8f2
mov eax, 1
mov byte [rsp + 0xf1], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d7388]
mov r8d, 2
call fcn.14004e558
cmp al, sil
jne 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, str.no64
mov r8d, 4
call fcn.14004e558
cmp al, sil
jne 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d737c]
mov r8d, 3
call fcn.14004e558
cmp al, sil
je 0x14000b968
mov eax, 1
mov byte [rsp + 0x100], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d7378]
mov r8d, 2
call fcn.14004e558
cmp al, sil
je 0x14000b998
mov eax, 1
mov byte [rsp + 0xc4], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, str.incmd
mov r8d, 5
call fcn.14004e558
cmp al, sil
je 0x14000b9c8
mov eax, 1
mov byte [rsp + 0x8c], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, str.hidecmd
mov r8d, 7
call fcn.14004e558
cmp al, sil
je 0x14000b9f5
mov eax, 1
mov byte [rsp + 0x65], al
jmp 0x14000ae44
lea rdx, [rsp + 0xce8]
lea rcx, str.hidecmd_
mov r8d, 8
call fcn.14004e558
cmp al, sil
je 0x14000ba1e
mov byte [rsp + 0x65], sil
jmp 0x14000ae3f
mov rdx, qword [rsp + 0xce8]
lea rcx, [0x1400d7354]
mov r8d, 3
call fcn.140045fc8
cmp al, sil
je 0x14000bad5
mov rax, qword [rsp + 0xce8]
mov r9d, 1
add rax, 6
lea ecx, [r9 + 0x39]
mov byte [rsp + 0x62], r9b
mov qword [rsp + 0xce8], rax
cmp cx, word [rax]
jne 0x14000bfb6
lea r8d, [r9 + 1]
add rax, r8
mov qword [rsp + 0xce8], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000bfb6
lea ebp, [r9 + 0xc]
lea r10d, [r8 + 7]
lea r9d, [r8 + 0x1e]
cmp r10w, cx
ja 0x14000baa2
cmp cx, bp
jbe 0x14000babb
cmp r9w, cx
je 0x14000babb
add rax, r8
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000ba97
mov ebp, dword [rsp + 0x6c]
cmp rdx, rax
je 0x14000bfb6
lea rcx, [rsp + 0x198]
jmp 0x14000b2d2
mov rdx, qword [rsp + 0xce8]
lea rcx, str.code:
mov r8d, 5
call fcn.140045fc8
cmp al, sil
je 0x14000bbcd
mov rax, qword [rsp + 0xce8]
lea rdx, [rsp + 0x250]
lea rcx, str.UTF8
add rax, 0xa
or r8d, 0xffffffff
mov qword [rsp + 0xce8], rax
mov qword [rsp + 0x250], rax
call fcn.14004e558
cmp al, sil
je 0x14000bb46
mov byte [rsp + 0x63], 1
mov dword [rsp + 0x158], 0xfde9
jmp 0x14000bf62
lea rdx, [rsp + 0x250]
lea rcx, str.ANSI
or r8d, 0xffffffff
call fcn.14004e558
cmp al, sil
je 0x14000bb74
mov byte [rsp + 0x63], 1
mov dword [rsp + 0x158], esi
jmp 0x14000bf62
lea rdx, [rsp + 0x250]
lea rcx, [0x1400d7338]
or r8d, 0xffffffff
call fcn.14004e558
cmp al, sil
je 0x14000bba6
mov byte [rsp + 0x63], 2
mov dword [rsp + 0x158], 0x4b0
jmp 0x14000bf62
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x250]
call fcn.14004fc04
cmp eax, esi
jle 0x14000bf62
mov byte [rsp + 0x63], 1
jmp 0x14000bf62
mov rdx, qword [rsp + 0xce8]
lea rcx, str.user:
mov r8d, 5
call fcn.140045fc8
cmp al, sil
je 0x14000bc67
mov rax, qword [rsp + 0xce8]
mov ecx, 0xa
add rax, rcx
mov qword [rsp + 0xce8], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000bfb6
mov ebp, 0xd
lea r8d, [rbp + 0x13]
lea r9d, [rbp - 4]
cmp r9w, cx
ja 0x14000bc2b
cmp cx, bp
jbe 0x14000bc45
cmp r8w, cx
je 0x14000bc45
add rax, 2
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000bc20
mov ebp, dword [rsp + 0x6c]
mov rbx, qword [rsp + 0x80]
cmp rdx, rax
je 0x14000bfb6
lea rcx, [rsp + 0x110]
jmp 0x14000b2d2
mov rdx, qword [rsp + 0xce8]
lea rcx, str.passwd:
mov r8d, 7
call fcn.140045fc8
cmp al, sil
je 0x14000bc90
mov byte [rsp + 0xa9], sil
jmp 0x14000bcb7
mov rdx, qword [rsp + 0xce8]
lea rcx, str.passwd
mov r8d, 7
call fcn.140045fc8
cmp al, sil
je 0x14000bd2e
mov byte [rsp + 0xa9], 1
mov rax, qword [rsp + 0xce8]
add rax, 0xe
mov qword [rsp + 0xce8], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, si
je 0x14000bfb6
mov ebp, 0xd
lea r8d, [rbp + 0x13]
lea r9d, [rbp - 4]
cmp r9w, cx
ja 0x14000bcf2
cmp cx, bp
jbe 0x14000bd0c
cmp r8w, cx
je 0x14000bd0c
add rax, 2
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000bce7
mov ebp, dword [rsp + 0x6c]
mov rbx, qword [rsp + 0x80]
cmp rdx, rax
je 0x14000bfb6
lea rcx, [rsp + 0xe8]
jmp 0x14000b2d2
lea rdx, [rsp + 0xce8]
lea rcx, str.REALTIME
mov r8d, 8
call fcn.14004e558
cmp al, sil
je 0x14000bd5e
mov eax, pe_nt_image_headers64
mov dword [rsp + 0xf4], eax
jmp 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, str.HIGH
mov r8d, 4
call fcn.14004e558
cmp al, sil
je 0x14000bd8d
mov dword [rsp + 0xf4], 0x80
jmp 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, str.ABOVENORMAL
mov r8d, 0xb
call fcn.14004e558
cmp al, sil
je 0x14000bdbc
mov dword [rsp + 0xf4], 0x8000
jmp 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, str.NORMAL
mov r8d, 6
call fcn.14004e558
cmp al, sil
je 0x14000bdeb
mov dword [rsp + 0xf4], 0x20
jmp 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, str.BELOWNORMAL
mov r8d, 0xb
call fcn.14004e558
cmp al, sil
je 0x14000be1a
mov dword [rsp + 0xf4], 0x4000
jmp 0x14000ae3f
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d72dc]
mov r8d, 3
call fcn.14004e558
cmp al, sil
jne 0x14000bea0
mov rbx, qword [rsp + 0xce8]
lea rcx, [0x1400d72d0]
mov r8d, 4
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, esi
jne 0x14000beb0
movzx eax, word [rbx + 8]
mov ecx, 9
cmp cx, ax
ja 0x14000be73
mov ecx, 0xd
cmp ax, cx
jbe 0x14000be82
mov ecx, 0x20
cmp cx, ax
je 0x14000be82
cmp ax, si
jne 0x14000beb0
add qword [rsp + 0xce8], 8
lea rcx, [rsp + 0xce8]
call fcn.140044ef4
mov rbx, qword [rsp + 0x80]
mov dword [rsp + 0xf4], 0x40
jmp 0x14000ae3f
mov ebx, 3
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d72cc]
mov r8d, ebx
call fcn.14004e558
cmp al, sil
je 0x14000bedd
lea eax, [rbx - 2]
mov byte [rsp + 0x104], al
jmp 0x14000bf3b
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d72c8]
mov r8d, ebx
call fcn.14004e558
cmp al, sil
je 0x14000bf13
mov eax, 1
mov byte [rsp + 0x63], sil
mov dword [rsp + 0x158], esi
mov byte [rsp + 0xa8], al
jmp 0x14000bf3b
lea rdx, [rsp + 0xce8]
lea rcx, [0x1400d72c4]
mov r8d, ebx
call fcn.14004e558
cmp al, sil
je 0x14000bf48
mov eax, 1
mov byte [rsp + 0xf8], al
mov rbx, qword [rsp + 0x80]
jmp 0x14000ae44
mov rbx, qword [rsp + 0x80]
mov eax, 0x2d
cmp ax, word [rdi]
mov qword [rsp + 0xce8], rdi
jne 0x14000bfc8
mov rax, qword [rsp + 0xce8]
movzx ecx, word [rax]
cmp cx, si
je 0x14000bfb6
mov ebx, 0x20
lea ebp, [rbx - 0x17]
cmp bp, cx
ja 0x14000bf89
mov eax, 0xd
cmp cx, ax
jbe 0x14000bfaa
cmp bx, cx
je 0x14000bfaa
mov rax, qword [rsp + 0xce8]
add rax, 2
mov qword [rsp + 0xce8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000bf7a
mov ebp, dword [rsp + 0x6c]
mov rbx, qword [rsp + 0x80]
lea rcx, [rsp + 0xce8]
call fcn.140044ef4
jmp 0x14000ae3f
mov r8, rdi
cmp dword [rsp + 0x158], 0x4b0
movzx eax, byte [rsp + 0x63]
mov rdx, qword [rsp + 0x3f8]
mov edi, 2
cmove eax, edi
mov dword [rsp + 0x3d8], eax
cmp rdx, rsi
je 0x14000c045
mov r8, rdx
mov qword [rsp + 0xce8], rdx
cmp byte [rsp + 0xaa], sil
jne 0x14000c045
cmp qword [rsp + 0x2f8], rsi
jne 0x14000c045
mov rcx, qword [rsp + 0xce0]
lea eax, [rdi - 1]
lea r8, [rsp + 0x188]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.140056690
mov r8, qword [rsp + 0x188]
mov qword [rsp + 0xce8], r8
mov qword [rsp + 0x288], rsi
mov dword [rsp + 0x290], esi
mov dword [rsp + 0x294], esi
mov qword [rsp + 0x258], rsi
cmp rbx, rsi
je 0x14000c072
cmp word [rbx], si
je 0x14000c072
cmp bp, si
je 0x14000c07e
mov bpl, sil
mov dword [rsp + 0x104], ebp
jmp 0x14000c085
mov ebp, dword [rsp + 0x104]
lea rax, [0x1400d6970]
mov r11w, si
mov r10w, si
mov r9w, si
mov qword [rsp + 0x350], rax
mov dword [rsp + 0xc8], r11d
mov dword [rsp + 0x6c], r10d
mov dword [rsp + 0xa4], r9d
cmp rbx, rsi
je 0x14000c1dc
mov eax, 0x2a
lea edx, [rax - 0x29]
cmp word [rbx], ax
jne 0x14000c0e7
add rbx, rdi
add r11w, dx
cmp word [rbx], ax
je 0x14000c0cb
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0xc8], r11d
mov eax, 0x3f
cmp word [rbx], ax
jne 0x14000c137
add rbx, rdi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x350], rbx
movzx eax, word [rbx]
cmp ax, si
je 0x14000c137
mov ecx, 0x3a
add rbx, rdi
mov qword [rsp + 0x80], rbx
cmp cx, ax
je 0x14000c12b
mov ax, word [rbx]
cmp ax, si
jne 0x14000c111
jmp 0x14000c137
mov word [rbx - 2], si
mov r8, qword [rsp + 0xce8]
movzx ecx, word [rbx]
mov eax, 0x63
or cx, 0x20
cmp cx, ax
jne 0x14000c46a
movzx eax, word [rbx + 2]
or ax, word [rsp + 0x68]
cmp ax, word [rsp + 0x210]
jne 0x14000c46a
movzx eax, word [rbx + 4]
or ax, word [rsp + 0x68]
cmp ax, 0x62
jne 0x14000c46a
mov eax, 0x3a
cmp word [rbx + 6], ax
jne 0x14000c46a
add rbx, 8
mov r10d, edx
mov dword [rsp + 0x6c], edx
mov qword [rsp + 0x80], rbx
mov ecx, 0x20
cmp rbx, rsi
je 0x14000c1dc
movzx eax, word [rbx]
or ax, cx
cmp ax, 0x75
jne 0x14000c1dc
movzx eax, word [rbx + 2]
or ax, cx
cmp ax, 0x64
jne 0x14000c1dc
mov eax, 0x3a
cmp word [rbx + 4], ax
jne 0x14000c1dc
add rbx, 6
mov r9d, edx
mov dword [rsp + 0xa4], edx
mov qword [rsp + 0x80], rbx
cmp bpl, sil
je 0x14000c243
cmp rbx, rsi
je 0x14000c243
cmp r10w, si
jne 0x14000c243
cmp r9w, si
jne 0x14000c243
cmp byte [rsp + 0x64], sil
movzx eax, word [rbx]
mov edx, esi
setne dl
mov rcx, rbx
cmp ax, si
je 0x14000c243
mov r11d, 1
cmp word [rsp + 0x130], ax
jne 0x14000c229
add edx, r11d
cmp edx, edi
jl 0x14000c229
cmp word [rcx + 2], si
movzx ebp, bpl
cmovne ebp, esi
add rcx, rdi
mov ax, word [rcx]
cmp ax, si
jne 0x14000c20d
mov r11d, dword [rsp + 0xc8]
mov dword [rsp + 0x104], ebp
cmp r11w, si
jne 0x14000c255
cmp r10w, si
jne 0x14000c255
cmp r9w, si
je 0x14000c25a
mov byte [rsp + 0x64], sil
cmp bpl, sil
je 0x14000c2bd
cmp r9w, si
mov ecx, esi
mov eax, esi
sete cl
cmp r10w, si
sete al
test eax, ecx
je 0x14000c2bd
mov edx, 0x2a
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x258], rax
cmp rax, rsi
je 0x14000c29e
mov word [rax], si
add rax, rdi
mov qword [rsp + 0x258], rax
lea rdx, [rsp + 0x288]
mov rcx, rbx
call fcn.140017960
mov r8, qword [rsp + 0xce8]
mov dword [rsp + 0xc8], esi
mov rax, qword [rsp + 0x3c8]
mov r11d, 1
mov ecx, esi
mov dword [rax], r11d
xor eax, eax
cmp qword [rsp + 0x230], rsi
setne cl
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x458], rax
mov qword [rsp + 0x460], rax
mov al, byte [rsp + 0xc4]
mov rbx, rsi
mov qword [rsp + 0x128], rsi
mov dword [rsp + 0x90], esi
mov dword [rsp + 0xc0], esi
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x238], rsi
mov qword [rsp + 0x308], rsi
mov rdi, rsi
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x1d0], rbx
mov rbp, rsi
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0x418], rsi
mov qword [rsp + 0x448], rsi
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x498], 0x18
mov qword [rsp + 0x4a0], rsi
mov dword [rsp + 0x4a8], r11d
mov qword [rsp + 0x1b8], rsi
cmp al, sil
je 0x14000c3d2
mov rax, qword [0x1400ef2c8]
lea rcx, [rsp + 0x540]
mov dword [rsp + 0x68], r11d
bts dword [rcx + 0x3c], 8
mov qword [rcx + 0x58], rax
mov rax, qword [0x1400ef2d0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1400ef2c0]
mov qword [rcx + 0x50], rax
mov eax, 0x26
cmp byte [rsp + 0xaa], sil
je 0x14000cc14
lea ecx, [rax + 0x56]
mov qword [rsp + 0x250], rsi
lea eax, [rcx - 0x7a]
cmp cx, word [r8]
jne 0x14000c433
lea ebp, [rcx - 0x5c]
lea edi, [rcx - 0x73]
lea ebx, [rcx - 0x6f]
add r8, rax
mov qword [rsp + 0xce8], r8
cmp cx, word [r8]
je 0x14000c402
cmp di, word [r8]
ja 0x14000c41f
cmp word [r8], bx
jbe 0x14000c402
cmp bp, word [r8]
je 0x14000c402
mov rdi, qword [rsp + 0x180]
mov rbx, rsi
mov rbp, rsi
mov qword [rsp + 0x268], r8
mov qword [rsp + 0x98], rsi
mov r10, rsi
cmp word [r8], si
je 0x14000c5bb
cmp cx, word [r8]
jne 0x14000c4c3
cmp cx, word [r8 + 2]
je 0x14000c4ba
mov r10, r8
mov qword [rsp + 0x98], r8
jmp 0x14000c4c3
mov eax, 0x65
cmp cx, ax
jne 0x14000c198
movzx eax, word [rbx + 2]
mov ecx, 0x20
or ax, cx
cmp ax, 0x78
jne 0x14000c19d
lea eax, [rcx + 0x1a]
cmp word [rbx + 4], ax
jne 0x14000c19d
mov eax, pe_nt_image_headers64
add rbx, 6
mov r10w, ax
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x6c], r10d
jmp 0x14000c19d
add r8, rax
cmp cx, word [r8]
je 0x14000c4ba
add r8, rax
cmp word [r8], si
jne 0x14000c450
cmp r10, rsi
je 0x14000c5bb
mov word [r10], si
add qword [rsp + 0x98], rax
lea rcx, [rsp + 0x98]
call fcn.140044ef4
mov rax, qword [rsp + 0x98]
movzx ecx, word [rax]
mov qword [rsp + 0x1d8], rax
cmp cx, si
je 0x14000c58b
mov edx, 0x7c
cmp dx, cx
jne 0x14000c561
lea rcx, [rax + 2]
mov qword [rsp + 0x270], rcx
cmp dx, word [rcx]
jne 0x14000c561
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x1d8]
movsxd r8, eax
add r8, r8
call fcn.1400177b0
mov rax, qword [rsp + 0x1d8]
mov edx, 0x7c
jmp 0x14000c55c
add rax, 2
cmp dx, word [rax]
je 0x14000c558
add rax, 2
mov qword [rsp + 0x1d8], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000c50f
mov r10, qword [rsp + 0x98]
mov qword [rsp + 0x220], r10
cmp word [r10], si
jne 0x14000c5a0
mov r8, qword [rsp + 0xce8]
mov eax, 2
lea ecx, [rax + 0x7a]
jmp 0x14000c43b
mov rdx, qword [rsp + 0x268]
mov r11d, 1
mov al, r11b
cmp word [rdx], si
je 0x14000c5c6
mov cl, r11b
jmp 0x14000c5e0
mov rdx, qword [rsp + 0x268]
mov al, sil
cmp al, sil
mov cl, sil
cmove r10, rdx
mov qword [rsp + 0x220], r10
mov qword [rsp + 0x98], r10
cmp cl, sil
je 0x14000c74c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x4b0]
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x360], rax
mov eax, 1
lea rcx, [rsp + 0xb8]
xor r9d, r9d
mov dword [rsp + 0x4b0], 0x18
mov qword [rsp + 0x4b8], rsi
mov dword [rsp + 0x4c0], eax
call qword [sym.imp.KERNEL32.dll_CreatePipe]
cmp eax, esi
jne 0x14000c64f
mov rcx, qword [rsp + 0xce0]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.140013908
mov rax, qword [rsp + 0x360]
mov rdx, qword [rsp + 0xb8]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0xb8]
mov r8, rax
mov rcx, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rax, qword [rsp + 0xd0]
mov word [rsp + 0xc4], si
cmp rax, rsi
je 0x14000c6dc
mov rdx, qword [rsp + 0x268]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xce0]
lea r9, [rsp + 0xc4]
mov r8, rax
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call fcn.14000a168
mov rcx, qword [rsp + 0xd0]
cmp rcx, rsi
je 0x14000c6dc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xb8]
mov eax, 1
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x360]
lea r9, [rsp + 0xb8]
mov r8, rax
mov rcx, rax
mov qword [rsp + 0xd0], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r11, qword [rsp + 0xb8]
mov r10, qword [rsp + 0x220]
cmp r11, rsi
je 0x14000c74c
mov eax, 1
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x540]
bts dword [rax + 0x3c], 8
mov qword [rax + 0x50], r11
mov rax, r10
mov qword [rsp + 0x98], rax
mov r8d, 0x3e
lea r9d, [r8 - 2]
movzx ecx, word [rax]
cmp cx, si
je 0x14000cb87
mov edx, 2
cmp cx, r9w
je 0x14000c791
cmp cx, r8w
je 0x14000c791
add rax, rdx
mov qword [rsp + 0x98], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000c772
cmp word [rax], si
je 0x14000cb87
cmp r9w, word [rax]
jne 0x14000c911
mov word [rax], si
add qword [rsp + 0x98], rdx
lea rcx, [rsp + 0x98]
call fcn.140044ef4
mov rax, qword [rsp + 0x98]
cmp word [rax], si
je 0x14000c907
mov qword [rsp + 0x3a0], rax
movzx ecx, word [rax]
mov rdx, rax
cmp cx, si
je 0x14000c812
mov r8d, 0x3e
lea r9d, [r8 - 2]
cmp cx, r9w
je 0x14000c80a
cmp cx, r8w
je 0x14000c80a
add rax, 2
mov qword [rsp + 0x98], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000c7ea
mov rbx, qword [rsp + 0x1d0]
sub rax, rdx
lea rcx, [rsp + 0x2b0]
sar rax, 1
mov r8d, eax
call fcn.140058944
lea rcx, [rsp + 0x298]
call fcn.14004be6c
mov rdx, qword [rsp + 0x3a0]
mov rcx, qword [rsp + 0xce0]
mov eax, 1
lea r8, [rsp + 0x298]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.140056690
mov rcx, qword [rsp + 0x298]
mov qword [rsp + 0x3a0], rcx
call fcn.140012d94
lea rcx, [rsp + 0x3a0]
call fcn.140044ef4
cmp rdi, rsi
je 0x14000c88e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x3a0]
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x498]
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x180]
mov r9d, 7
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x20], rax
call fcn.1400034e0
mov rdi, qword [rsp + 0x180]
lea rcx, [rsp + 0x298]
mov qword [rsp + 0x180], rdi
call fcn.140044f24
lea rcx, [rsp + 0x2b0]
call fcn.140044f24
mov rax, qword [rsp + 0x98]
mov r9d, 0x3c
lea r8d, [r9 + 2]
cmp r8w, word [rax]
jne 0x14000c761
mov r9d, 1
mov word [rax], si
mov rax, qword [rsp + 0x98]
lea ecx, [r9 + 0x31]
mov dword [rsp + 0xc4], esi
mov byte [rsp + 0x63], r9b
lea edx, [rcx - 0x30]
cmp cx, word [rax - 2]
jne 0x14000c955
mov word [rax - 2], si
mov rax, qword [rsp + 0x98]
mov byte [rsp + 0x63], dl
add rax, rdx
mov qword [rsp + 0x98], rax
cmp r8w, word [rax]
jne 0x14000c979
add rax, rdx
mov dword [rsp + 0xc4], r9d
mov qword [rsp + 0x98], rax
mov ecx, 0x26
cmp cx, word [rax]
jne 0x14000c993
add rax, rdx
mov byte [rsp + 0x63], 3
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x98]
call fcn.140044ef4
mov rax, qword [rsp + 0x98]
mov r8d, 0x3e
lea r9d, [r8 - 2]
cmp word [rax], si
je 0x14000c761
mov qword [rsp + 0x3a8], rax
movzx ecx, word [rax]
mov rdx, rax
cmp cx, si
je 0x14000c9f6
cmp cx, r9w
je 0x14000c9ee
cmp cx, r8w
je 0x14000c9ee
add rax, 2
mov qword [rsp + 0x98], rax
mov cx, word [rax]
cmp cx, si
jne 0x14000c9ce
mov rbp, qword [rsp + 0x200]
sub rax, rdx
lea rcx, [rsp + 0x280]
sar rax, 1
mov r8d, eax
call fcn.140058944
lea rcx, [rsp + 0x380]
call fcn.14004be6c
mov rdx, qword [rsp + 0x3a8]
mov rcx, qword [rsp + 0xce0]
mov eax, 1
lea r8, [rsp + 0x380]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.140056690
mov rcx, qword [rsp + 0x380]
mov qword [rsp + 0x3a8], rcx
call fcn.140012d94
lea rcx, [rsp + 0x3a8]
call fcn.140044ef4
mov al, byte [rsp + 0x63]
mov ecx, 1
test cl, al
je 0x14000ca8e
cmp rbx, rsi
je 0x14000ca83
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [rsp + 0x63]
mov rbx, rsi
mov qword [rsp + 0x1d0], rbx
test al, 2
je 0x14000cab3
cmp rbp, rsi
je 0x14000caa0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, rsi
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x250], rsi
mov rdx, qword [rsp + 0x3a8]
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x498]
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x118]
mov r9d, 7
mov r8d, 0x40000000
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x20], rax
call fcn.1400034e0
mov qword [rsp + 0x118], rax
cmp rax, rsi
je 0x14000cb60
cmp dword [rsp + 0xc4], esi
je 0x14000cb2c
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, qword [rsp + 0x118]
mov cl, byte [rsp + 0x63]
mov r9d, 1
cmp cl, r9b
je 0x14000cb48
mov qword [rsp + 0x250], rax
cmp cl, 3
jne 0x14000cb55
mov rbx, rax
mov qword [rsp + 0x1d0], rax
jmp 0x14000cb60
mov rbp, rax
mov qword [rsp + 0x200], rax
lea rcx, [rsp + 0x380]
call fcn.140044f24
lea rcx, [rsp + 0x280]
call fcn.140044f24
mov rax, qword [rsp + 0x98]
jmp 0x14000c757
mov r11d, 1
lea rcx, [rsp + 0x540]
cmp rdi, rsi
je 0x14000cba8
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x68], r11d
mov qword [rcx + 0x50], rdi
cmp rbx, rsi
je 0x14000cbbb
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x68], r11d
mov qword [rcx + 0x58], rbx
mov rax, qword [rsp + 0x250]
cmp rax, rsi
je 0x14000cbd6
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x68], r11d
mov qword [rcx + 0x60], rax
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0xce0]
lea r8, [rsp + 0x1b8]
xor r9d, r9d
mov byte [rsp + 0x20], r11b
call fcn.140056690
mov r8, qword [rsp + 0x1b8]
mov eax, 0x26
mov qword [rsp + 0xce8], r8
lea r11d, [rax - 0x25]
mov ebx, dword [rsp + 0xa0]
mov dil, sil
mov ebp, 0x24
cmp word [r8], 0x21
je 0x14000cc79
mov ecx, 0x2a
cmp word [r8], cx
je 0x14000cc79
mov ecx, 0x40
cmp word [r8], cx
jne 0x14000cc91
lea rdx, str.WinSta0WinLogon
lea rcx, [rsp + 0x340]
call fcn.140058a38
mov r11, qword [rsp + 0x340]
mov r8, qword [rsp + 0xce8]
lea rax, [rsp + 0x540]
mov qword [rax + 0x10], r11
mov r11d, 1
add dil, r11b
mov ebx, 0x10000000
add r8, 2
mov eax, 0x26
mov qword [rsp + 0xce8], r8
jmp 0x14000cc23
mov ecx, 0x3d
cmp word [r8], cx
jne 0x14000cca3
mov dword [rsp + 0x74], r11d
jmp 0x14000cc7e
cmp word [r8], bp
jne 0x14000ccb0
mov byte [rsp + 0x62], r11b
jmp 0x14000cc7e
cmp word [r8], ax
jne 0x14000ccbd
mov ebx, 3
jmp 0x14000cc7e
mov eax, 0x5e
cmp word [r8], ax
je 0x14000cccf
cmp word [r8], 0x5f
jne 0x14000ccd6
mov ebx, 6
jmp 0x14000cc7e
mov rbp, qword [rsp + 0x200]
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0xa0], ebx
mov byte [rsp + 0x60], dil
mov rdi, qword [rsp + 0x180]
mov dword [rsp + 0xa0], ebx
cmp ebx, 0x10000000
mov rbx, qword [rsp + 0x1d0]
je 0x14000cd5a
mov ecx, dword [rsp + 0x88]
cmp cl, sil
je 0x14000cd5a
lea rdx, str.WinSta0Default
lea rcx, [rsp + 0x340]
call fcn.140058a38
mov r11, qword [rsp + 0x340]
mov r8, qword [rsp + 0xce8]
lea rax, [rsp + 0x540]
mov qword [rax + 0x10], r11
lea r11, [rsp + 0x540]
mov ecx, 1
cmp qword [r11 + 0x10], rsi
je 0x14000cd95
test byte [rsp + 0x60], cl
je 0x14000cd95
call fcn.140004c54
mov r8, qword [rsp + 0xce8]
mov ecx, 1
cmp eax, ecx
lea r11, [rsp + 0x540]
jge 0x14000cd95
mov qword [r11 + 0x10], rsi
mov rax, qword [rsp + 0xd10]
cmp rax, rsi
je 0x14000cdb9
bts dword [r11 + 0x3c], 8
mov dword [rsp + 0x74], esi
mov byte [rsp + 0x61], sil
mov dword [rsp + 0x68], ecx
mov qword [r11 + 0x58], rax
cmp byte [rsp + 0x62], sil
je 0x14000cde9
mov rax, qword [rsp + 0x198]
cmp word [rax], si
jne 0x14000cde9
lea rdx, str.open
lea rcx, [rsp + 0x198]
call fcn.1400589a0
mov r8, qword [rsp + 0xce8]
mov cl, byte [rsp + 0xf1]
cmp cl, sil
je 0x14000cfd1
mov edx, 0x5c
mov rcx, r8
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rcx, qword [rsp + 0xce8]
xor edx, edx
mov r11, rax
add rax, 2
mov rsi, rcx
cmp r11, rdx
cmovne rsi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
add eax, eax
neg dword [rsp + 0x74]
mov r9d, 1
sbb rcx, rcx
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xce8]
neg rcx
mov r8, rsi
mov qword [rsp + 0x20], rax
add rcx, 0xffffffff80000001
call fcn.140045e70
mov dword [rsp + 0xd00], eax
lea rcx, [rsp + 0x1b8]
call fcn.140044f24
xor esi, esi
mov rcx, qword [rsp + 0xd0]
cmp rcx, rsi
je 0x14000ce90
cmp rcx, 0xffffffffffffffff
je 0x14000ce90
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xd0], rsi
cmp rcx, rsi
je 0x14000ceb1
cmp rcx, 0xffffffffffffffff
je 0x14000ceb1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], rsi
cmp rbp, rsi
je 0x14000cecd
cmp rbp, 0xffffffffffffffff
je 0x14000cecd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rsi
je 0x14000cee1
cmp rbx, 0xffffffffffffffff
je 0x14000cee1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rsi
je 0x14000cef5
cmp rdi, 0xffffffffffffffff
je 0x14000cef5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x128]
call fcn.140044f24
lea rcx, [rsp + 0x288]
call fcn.140044f24
lea rcx, [rsp + 0x188]
call fcn.140044f24
lea rcx, [rsp + 0x120]
call fcn.140044f24
lea rcx, [rsp + 0x1b0]
call fcn.140044f24
lea rcx, [rsp + 0x198]
call fcn.140044f24
lea rcx, [rsp + 0x1a8]
call fcn.140044f24
lea rcx, [rsp + 0x148]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xe0]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.140044f24
lea rcx, [rsp + 0x140]
call fcn.140044f24
lea rcx, [rsp + 0x168]
call fcn.140044f24
lea rcx, [rsp + 0x160]
call fcn.140044f24
mov esi, dword [rsp + 0xd00]
jmp 0x140011093
lea rcx, [rsp + 0xce8]
call fcn.140044ef4
xor ecx, ecx
mov qword [rsp + 0x260], rsi
mov qword [rsp + 0x1a0], rcx
cmp qword [rsp + 0x230], rcx
je 0x14000d270
lea rcx, [rsp + 0x348]
mov byte [rsp + 0x62], sil
call fcn.14004be6c
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0xce0]
or r9d, 0xffffffff
xor r8d, r8d
call fcn.140017d60
mov rdx, rax
cmp rax, rsi
je 0x14000d329
mov rax, qword [rax]
cmp word [rax], si
je 0x14000d329
lea rcx, [rsp + 0x348]
call fcn.1400589ec
mov rdx, qword [rsp + 0xce8]
lea rcx, [rsp + 0x1a0]
call fcn.140058a38
mov r11, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x348]
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x1a0]
mov qword [rsp + 0x20], r11
call fcn.140007f98
lea rcx, [rsp + 0x348]
cmp eax, esi
mov dword [rsp + 0x130], eax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xce8], rax
je 0x14000d261
call fcn.140044f24
lea rcx, [rsp + 0x1a0]
call fcn.140044f24
mov rcx, qword [rsp + 0x260]
cmp rcx, rsi
je 0x14000d0fa
cmp rcx, 0xffffffffffffffff
je 0x14000d0fa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1b8]
call fcn.140044f24
mov rcx, qword [rsp + 0xd0]
cmp rcx, rsi
je 0x14000d120
cmp rcx, 0xffffffffffffffff
je 0x14000d120
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xd0], rsi
cmp rcx, rsi
je 0x14000d141
cmp rcx, 0xffffffffffffffff
je 0x14000d141
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], rsi
cmp rbp, rsi
je 0x14000d15d
cmp rbp, 0xffffffffffffffff
je 0x14000d15d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rsi
je 0x14000d171
cmp rbx, 0xffffffffffffffff
je 0x14000d171
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rsi
je 0x14000d185
cmp rdi, 0xffffffffffffffff
je 0x14000d185
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x128]
call fcn.140044f24
lea rcx, [rsp + 0x288]
call fcn.140044f24
lea rcx, [rsp + 0x188]
call fcn.140044f24
lea rcx, [rsp + 0x120]
call fcn.140044f24
lea rcx, [rsp + 0x1b0]
call fcn.140044f24
lea rcx, [rsp + 0x198]
call fcn.140044f24
lea rcx, [rsp + 0x1a8]
call fcn.140044f24
lea rcx, [rsp + 0x148]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xe0]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.140044f24
lea rcx, [rsp + 0x140]
call fcn.140044f24
lea rcx, [rsp + 0x168]
call fcn.140044f24
lea rcx, [rsp + 0x160]
call fcn.140044f24
mov esi, dword [rsp + 0x130]
jmp 0x140011093
call fcn.140044f24
mov rsi, qword [rsp + 0x260]
xor ecx, ecx
mov rax, qword [rsp + 0x140]
cmp word [rax], cx
je 0x14000d4a8
mov rcx, qword [rsp + 0xce8]
call fcn.140015cb4
lea rcx, [rsp + 0x390]
mov rdx, rax
mov qword [rsp + 0xce8], rax
call fcn.140058920
lea rdx, [0x1400d7204]
lea rcx, [rsp + 0x390]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0x390]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x390]
mov rcx, qword [rsp + 0xce0]
xor r8d, r8d
call fcn.140061608
lea rcx, [rsp + 0x390]
mov dword [rsp + 0xd00], eax
call fcn.140044f24
lea rcx, [rsp + 0x1a0]
call fcn.140044f24
test rsi, rsi
je 0x14000ce68
cmp rsi, 0xffffffffffffffff
je 0x14000ce68
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ce68
lea rcx, [rsp + 0x348]
call fcn.140044f24
lea rcx, [rsp + 0x1a0]
call fcn.140044f24
lea rcx, [rsp + 0x1b8]
call fcn.140044f24
mov rcx, qword [rsp + 0xd0]
cmp rcx, rsi
je 0x14000d369
cmp rcx, 0xffffffffffffffff
je 0x14000d369
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xd0], rsi
cmp rcx, rsi
je 0x14000d38a
cmp rcx, 0xffffffffffffffff
je 0x14000d38a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], rsi
cmp rbp, rsi
je 0x14000d3a6
cmp rbp, 0xffffffffffffffff
je 0x14000d3a6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rsi
je 0x14000d3ba
cmp rbx, 0xffffffffffffffff
je 0x14000d3ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rsi
je 0x14000d3ce
cmp rdi, 0xffffffffffffffff
je 0x14000d3ce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x128]
call fcn.140044f24
lea rcx, [rsp + 0x288]
call fcn.140044f24
lea rcx, [rsp + 0x188]
call fcn.140044f24
lea rcx, [rsp + 0x120]
call fcn.140044f24
lea rcx, [rsp + 0x1b0]
call fcn.140044f24
lea rcx, [rsp + 0x198]
call fcn.140044f24
lea rcx, [rsp + 0x1a8]
call fcn.140044f24
lea rcx, [rsp + 0x148]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xe0]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.140044f24
lea rcx, [rsp + 0x140]
call fcn.140044f24
lea rcx, [rsp + 0x168]
call fcn.140044f24
lea rcx, [rsp + 0x160]
call fcn.140044f24
mov esi, 0x80070057
jmp 0x140011093
mov al, byte [rsp + 0x101]
cmp al, cl
je 0x14000d93d
lea rcx, [rsp + 0x1c0]
call fcn.14004be6c
mov rcx, qword [rsp + 0xce8]
and dword [rsp + 0xfc], 0
call fcn.140015cb4
lea rcx, [rsp + 0x2e0]
mov qword [rsp + 0xce8], rax
call fcn.14004be6c
mov rcx, qword [rsp + 0xce8]
and qword [rsp + 0x208], 0
lea r8, [rsp + 0x208]
lea rdx, [rsp + 0x2e0]
call fcn.1400a6f3c
mov r11, qword [rsp + 0x208]
xor eax, eax
cmp r11, rax
jne 0x14000d572
lea rcx, [rsp + 0x2e0]
call fcn.140044f24
lea rcx, [rsp + 0x1c0]
call fcn.140044f24
lea rcx, [rsp + 0x1a0]
call fcn.140044f24
test rsi, rsi
je 0x14000d55e
cmp rsi, 0xffffffffffffffff
je 0x14000d55e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1b8]
call fcn.140044f24
xor esi, esi
jmp 0x14000d350
mov word [r11 - 2], ax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rdx, qword [rsp + 0x2e0]
lea rcx, [rsp + 0x258]
mov qword [rsp + 0x1d8], rax
call fcn.140058920
mov rax, qword [rsp + 0x258]
mov rdx, qword [rsp + 0x208]
lea rcx, [rsp + 0x3b0]
mov qword [rsp + 0x118], rax
call fcn.140058920
mov r11, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x118]
lea r9, [rsp + 0x1c0]
lea r8, [rsp + 0xfc]
mov qword [rsp + 0x20], r11
call fcn.140007814
xor eax, eax
cmp dword [rsp + 0xfc], eax
jle 0x14000d67b
mov r9, qword [rsp + 0xce0]
mov rcx, rax
mov qword [rsp + 0x298], rax
mov rdx, qword [r9 + 0x40]
cmp rdx, rax
je 0x14000d624
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x298], rcx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rsp + 0x298]
mov r9d, dword [rsp + 0x2ec]
mov r8d, dword [rsp + 0x2e8]
xor eax, eax
mov edx, 0x128
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x1d8]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rcx, qword [rsp + 0x298]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
cmp dword [rsp + 0xfc], eax
jle 0x14000d786
mov rcx, qword [rsp + 0x1c0]
mov r8, rcx
mov qword [rsp + 0x118], rcx
movzx edx, word [rcx]
cmp dx, ax
je 0x14000d6db
lea r9d, [rax + 0xd]
lea r10d, [rax + 0xa]
cmp dx, r9w
je 0x14000d6d3
cmp dx, r10w
je 0x14000d6d3
add rcx, 2
mov dx, word [rcx]
cmp dx, ax
jne 0x14000d6bb
mov rdi, qword [rsp + 0x180]
mov word [rcx], ax
cmp word [r8], ax
je 0x14000d786
mov rdx, qword [rsp + 0xce8]
lea rcx, [rsp + 0x378]
call fcn.140058920
lea rdx, [0x1400d7204]
lea rcx, [rsp + 0x378]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x378]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x378]
mov rcx, qword [rsp + 0xce0]
xor r8d, r8d
call fcn.140061608
lea rcx, [rsp + 0x378]
mov dword [rsp + 0xd00], eax
call fcn.140044f24
lea rcx, [rsp + 0x3b0]
call fcn.140044f24
lea rcx, [rsp + 0x258]
call fcn.140044f24
lea rcx, [rsp + 0x2e0]
call fcn.140044f24
lea rcx, [rsp + 0x1c0]
jmp 0x14000d2f6
lea rcx, [rsp + 0x3b0]
call fcn.140044f24
lea rcx, [rsp + 0x258]
call fcn.140044f24
lea rcx, [rsp + 0x2e0]
call fcn.140044f24
lea rcx, [rsp + 0x1c0]
call fcn.140044f24
lea rcx, [rsp + 0x1a0]
call fcn.140044f24
test rsi, rsi
je 0x14000d7db
cmp rsi, 0xffffffffffffffff
je 0x14000d7db
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1b8]
call fcn.140044f24
mov rcx, qword [rsp + 0xd0]
xor esi, esi
cmp rcx, rsi
je 0x14000d803
cmp rcx, 0xffffffffffffffff
je 0x14000d803
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xd0], rsi
cmp rcx, rsi
je 0x14000d824
cmp rcx, 0xffffffffffffffff
je 0x14000d824
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], rsi
cmp rbp, rsi
je 0x14000d840
cmp rbp, 0xffffffffffffffff
je 0x14000d840
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rsi
je 0x14000d854
cmp rbx, 0xffffffffffffffff
je 0x14000d854
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rsi
je 0x14000d868
cmp rdi, 0xffffffffffffffff
je 0x14000d868
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x128]
call fcn.140044f24
lea rcx, [rsp + 0x288]
call fcn.140044f24
lea rcx, [rsp + 0x188]
call fcn.140044f24
lea rcx, [rsp + 0x120]
call fcn.140044f24
lea rcx, [rsp + 0x1b0]
call fcn.140044f24
lea rcx, [rsp + 0x198]
call fcn.140044f24
lea rcx, [rsp + 0x1a8]
call fcn.140044f24
lea rcx, [rsp + 0x148]
call fcn.140044f24
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xe0]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.140044f24
lea rcx, [rsp + 0x140]
call fcn.140044f24
lea rcx, [rsp + 0x168]
call fcn.140044f24
lea rcx, [rsp + 0x160]
call fcn.140044f24
jmp 0x140011093
mov rdx, qword [rsp + 0xce8]
lea rcx, [rsp + 0x2a8]
call fcn.140058920
mov al, byte [rsp + 0x8c]
xor esi, esi
cmp al, sil
je 0x14000d9f9
lea rdx, [0x1400d6a78]
lea rcx, [rsp + 0x2a8]
call fcn.140058a38
lea r8d, [rsi + 1]
lea rcx, [rsp + 0xce8]
xor edx, edx
call fcn.140020840
lea rcx, [rsp + 0x2a8]
mov rdx, rax
mov qword [rsp + 0xce8], rax
call fcn.14004bfa8
lea rcx, [rsp + 0x148]
call fcn.140004ea4
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0xce8], rax
mov eax, dword [rsp + 0xa0]
cmp eax, 0x10000000
je 0x14000d9e6
mov cl, byte [rsp + 0xf8]
cmp cl, sil
je 0x14000def4
lea r9, [rsp + 0x540]
bts dword [r9 + 0x3c], 7
jmp 0x14000defc
mov al, byte [rsp + 0x65]
cmp al, sil
je 0x14000d9b8
mov edx, dword [rsp + 0xa0]
cmp edx, 0x10000000
je 0x14000d9b8
mov rax, qword [rsp + 0x2a8]
lea rcx, [rsp + 0xce8]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0xce8], rax
call fcn.140020840
lea rdx, [rsp + 0x1f0]
lea rcx, [0x1400d7200]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0xce8]
mov r8d, 3
mov qword [rsp + 0x1f0], rax
call fcn.14004e558
cmp al, sil
jne 0x14000db87
lea rdx, [rsp + 0x1f0]
lea rcx, str.cmd.exe
mov r8d, 7
call fcn.14004e558
cmp al, sil
jne 0x14000db87
mov rcx, qword [0x1400f1978]
cmp rcx, rsi
jne 0x14000db08
xor r9d, r9d
lea rdx, [rsp + 0xaa0]
xor ecx, ecx
lea r8d, [r9 + 0x24]
mov word [rsp + 0xaa0], si
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rsp + 0xaa0]
lea rcx, [0x1400f1978]
call fcn.140058a38
lea rdx, str.System32cmd.exe
lea rcx, [0x1400f1978]
call fcn.14004bfa8
mov rcx, qword [0x1400f1978]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x1400f1978]
mov word [0x1400f192c], ax
jmp 0x14000db0f
mov ax, word [0x1400f192c]
mov rdx, qword [rsp + 0x1f0]
movsx r8d, ax
mov dword [rsp + 0x88], esi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, esi
jne 0x14000dc5e
mov rax, qword [rsp + 0x1f0]
movsx rcx, word [0x1400f192c]
lea rdx, [rax + rcx*2]
mov eax, 0x22
cmp ax, word [rdx]
je 0x14000db70
mov eax, 9
cmp ax, word [rdx]
ja 0x14000db62
mov eax, 0xd
cmp word [rdx], ax
jbe 0x14000db70
mov eax, 0x20
cmp ax, word [rdx]
jne 0x14000dc5e
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x1f0], rdx
call fcn.140005b98
jmp 0x14000db95
mov eax, dword [rsp + 0xd00]
mov dword [rsp + 0x88], eax
lea rdx, [rsp + 0x1f0]
lea rcx, [0x1400d71cc]
mov r8d, 2
call fcn.14004e558
cmp al, sil
je 0x14000dc5e
mov rax, qword [rsp + 0x1f0]
mov ecx, 0x22
cmp cx, word [rax]
jne 0x14000dc22
add rax, 2
lea rcx, [rsp + 0x398]
mov qword [rsp + 0x398], rax
call fcn.140044ef4
mov rax, qword [rsp + 0x398]
mov ecx, 0x22
cmp cx, word [rax]
je 0x14000dc1a
lea r8d, [rcx - 0x1e]
lea rdx, [rsp + 0x398]
lea rcx, str.call
call fcn.14004e558
cmp al, sil
je 0x14000dc54
mov rax, qword [rsp + 0x398]
mov qword [rsp + 0x1f0], rax
lea rcx, [rsp + 0xce8]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xce8], rax
call fcn.140020840
mov dword [rsp + 0x88], 1
mov r11, rax
mov qword [rsp + 0x178], rax
jmp 0x14000dc66
mov rax, qword [rsp + 0x1f0]
jmp 0x14000dc22
mov r11, qword [rsp + 0x178]
mov rax, r11
sub rax, qword [rsp + 0xce8]
sar rax, 1
cmp eax, 4
jle 0x14000d9b8
lea rdx, str..cmd
lea rcx, [r11 - 8]
mov r8d, 4
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, esi
je 0x14000dcbf
mov rcx, qword [rsp + 0x178]
lea rdx, str..bat
mov r8d, 4
add rcx, 0xfffffffffffffff8
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, esi
jne 0x14000d9b8
mov rcx, qword [rsp + 0x178]
xor edx, edx
mov r8d, 0x191
movzx eax, word [rcx]
mov word [rcx], si
lea rcx, [rsp + 0x830]
mov word [rsp + 0x8c], ax
call fcn.1400b93b0
mov rdx, qword [rsp + 0xce8]
mov qword [rsp + 0x38], rsi
lea r11, [rsp + 0x830]
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0x218]
mov r9d, 7
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x280], r11
mov byte [rsp + 0xc4], sil
mov qword [rsp + 0x218], rsi
mov qword [rsp + 0x20], rsi
call fcn.1400034e0
mov qword [rsp + 0x20], rsi
mov rsi, qword [rsp + 0x218]
lea r9, [rsp + 0x240]
lea rdx, [rsp + 0x830]
mov r8d, 0x190
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, [rsp + 0x830]
lea rcx, str.::hidecmd::
mov r8d, 0xb
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
xor ecx, ecx
cmp eax, ecx
jne 0x14000ddf4
mov edx, 0x10000000
lea r9d, [rcx + 1]
lea r8d, [rcx + 0xd]
mov dword [rsp + 0xa0], edx
mov dl, byte [rsp + 0x830]
lea r10d, [rcx + 0xa]
cmp dl, cl
je 0x14000ddd8
lea rax, [rsp + 0x830]
cmp dl, r8b
je 0x14000ddd0
cmp dl, r10b
je 0x14000ddd0
add rax, r9
mov dl, byte [rax]
cmp dl, cl
jne 0x14000ddbd
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
movsx edx, byte [rax]
cmp dx, r10w
je 0x14000ddef
cmp dx, r8w
jne 0x14000ddfc
add rax, r9
jmp 0x14000dde0
lea rax, [rsp + 0x830]
cmp dword [rsp + 0x88], ecx
jne 0x14000de5b
mov ecx, 0x3a
cmp byte [rax], cl
jne 0x14000de17
cmp byte [rax + 1], cl
jne 0x14000de17
add rax, 2
mov edx, 0x40
cmp byte [rax], dl
jne 0x14000de2a
lea ecx, [rdx - 0x3f]
add rax, rcx
cmp byte [rax], dl
je 0x14000de23
lea rcx, str._pecmd
mov r8d, 7
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
mov edx, dword [rsp + 0xc4]
xor ecx, ecx
cmp eax, ecx
lea eax, [rcx + 1]
movzx edx, dl
cmove edx, eax
mov dword [rsp + 0xc4], edx
cmp rsi, rcx
je 0x14000de6f
cmp rsi, 0xffffffffffffffff
je 0x14000de6f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x178]
mov ax, word [rsp + 0x8c]
xor esi, esi
mov word [r11], ax
cmp byte [rsp + 0xc4], sil
je 0x14000d9b8
mov rdx, qword [rsp + 0xce8]
mov rcx, qword [rsp + 0xce0]
call fcn.140039598
lea rcx, [rsp + 0x2a8]
mov dword [rsp + 0xd00], eax
call fcn.140044f24
lea rcx, [rsp + 0x1a0]
call fcn.140044f24
mov rcx, qword [rsp + 0x260]
cmp rcx, rsi
je 0x14000dee2
cmp rcx, 0xffffffffffffffff
je 0x14000dee2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1b8]
call fcn.140044f24
jmp 0x14000ce77
lea r9, [rsp + 0x540]
mov r8d, 1
cmp eax, esi
je 0x14000df0f
or dword [r9 + 0x3c], r8d
mov word [r9 + 0x40], ax
mov cl, byte [rsp + 0x60]
mov edx, 3
mov al, cl
and al, dl
cmp al, dl
je 0x14000df2c
mov dl, byte [rsp + 0xf0]
cmp dl, sil
je 0x14000df32
bts dword [r9 + 0x3c], 0x1b
cmp qword [r9 + 0x10], rsi
je 0x14000df40
cmp cl, sil
mov ecx, r8d
jg 0x14000df42
mov ecx, esi
mov dword [rsp + 0x8c], esi
mov dword [rsp + 0xc4], esi
cmp ecx, esi
je 0x14000df67
mov dword [rsp + 0xc4], r8d
mov dword [rsp + 0x8c], 4
xor eax, eax
mov byte [rsp + 0x60], sil
cmp cl, al
je 0x14000df9f
mov cl, byte [0x1400f2ccc]
test cl, 4
jne 0x14000df9f
or cl, 4
lea edx, [rax + 2]
mov sil, r8b
mov byte [0x1400f2ccc], cl
lea rcx, str.SeDebugPrivilege
mov byte [rsp + 0x60], r8b
call fcn.140016130
xor eax, eax
lea rcx, [0x1400f1e30]
mov qword [rsp + 0x218], rcx
cmp byte [0x1400f1b37], al
jne 0x14000dfe8
mov rcx, qword [rsp + 0xcf0]
cmp rcx, rax
je 0x14000dfc8
cmp byte [rcx + 0xc], al
jne 0x14000dfe8
mov dl, byte [rsp + 0x100]
mov byte [rsp + 0x65], al
cmp dl, al
je 0x14000dfed
cmp rcx, rax
je 0x14000dfed
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x218], rax
mov byte [rsp + 0x65], 1
lea rcx, [rsp + 0x268]
xor edx, edx
call fcn.140058920
xor edx, edx
mov qword [rsp + 0x240], rdx
cmp byte [rsp + 0x65], dl
je 0x14000e4a2
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x690]
xor edx, edx
call fcn.140017bf0
mov rax, qword [rsp + 0xcf0]
test rax, rax
je 0x14000e051
mov r8, qword [rsp + 0x218]
lea rcx, [rsp + 0x690]
mov rdx, rax
call fcn.140047998
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x438]
mov edx, 0x106
mov qword [rsp + 0x218], rax
call fcn.14004bedc
mov rcx, qword [rsp + 0x218]
mov r11, qword [rsp + 0x438]
xor eax, eax
cmp word [rcx], ax
je 0x14000e1aa
mov rdi, r11
lea r10d, [rax + 2]
mov r9, rcx
mov qword [rsp + 0x388], rcx
add rcx, r10
movzx edx, word [rcx]
mov qword [rsp + 0x138], rcx
cmp dx, ax
je 0x14000e0d0
mov r8d, 0x3d
cmp dx, r8w
je 0x14000e0c8
add rcx, r10
mov dx, word [rcx]
cmp dx, ax
jne 0x14000e0b7
mov qword [rsp + 0x138], rcx
mov rdx, rcx
sub rdx, r9
sar rdx, 1
mov qword [rsp + 0x2b0], rdx
cmp word [rcx], ax
je 0x14000e196
lea r8, [rcx + 2]
mov qword [rsp + 0x270], r8
cmp word [r8], ax
je 0x14000e191
cmp edx, 0x104
jg 0x14000e191
movsxd rax, edx
mov rcx, rdi
mov rdx, r9
add rax, rax
mov r8, rax
mov qword [rsp + 0x118], rax
call fcn.1400177f8
mov rax, qword [rsp + 0x118]
xor edx, edx
mov word [rax + rdi], dx
lea rcx, [rsp + 0x690]
or r9d, 0xffffffff
mov rdx, rdi
xor r8d, r8d
call fcn.140012bb4
test rax, rax
jne 0x14000e17c
mov r9d, dword [rsp + 0x2b0]
mov r8, qword [rsp + 0x270]
mov rdx, qword [rsp + 0x388]
or dword [rsp + 0x20], 0xffffffff
lea rcx, [rsp + 0x690]
call fcn.140017c80
mov rcx, qword [rsp + 0x138]
mov r10d, 2
xor eax, eax
jmp 0x14000e191
add rcx, r10
cmp word [rcx], ax
jne 0x14000e18e
add rcx, r10
cmp word [rcx], ax
jne 0x14000e093
mov rdi, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
movsxd rdx, dword [rsp + 0x698]
xor eax, eax
cmp rdx, rax
mov dword [rsp + 0x88], eax
mov rcx, rax
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x138], rdx
jle 0x14000e33a
mov rsi, rdx
lea rax, [rcx + 1]
mov rbp, rcx
cmp rax, rsi
mov qword [rsp + 0x218], rax
mov rdi, rax
jge 0x14000e27d
mov rax, rcx
shl rax, 3
mov qword [rsp + 0x118], rax
mov rbx, rax
mov rcx, qword [rsp + 0x690]
mov rax, qword [rbx + rcx]
mov rdx, qword [rax]
mov rax, qword [rcx + rdi*8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jns 0x14000e23b
mov rbx, rdi
mov rbp, rdi
shl rbx, 3
inc rdi
cmp rdi, rsi
jl 0x14000e211
cmp rbp, qword [rsp + 0x280]
je 0x14000e275
mov rcx, qword [rsp + 0x690]
mov r8, qword [rsp + 0x118]
mov rax, qword [rcx + rbp*8]
mov rdx, qword [r8 + rcx]
mov qword [r8 + rcx], rax
mov rax, qword [rsp + 0x690]
mov qword [rax + rbp*8], rdx
mov rax, qword [rsp + 0x218]
cmp rax, rsi
mov rcx, rax
mov qword [rsp + 0x280], rax
jl 0x14000e1e8
mov rdx, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x1d0]
mov rdi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x200]
mov sil, byte [rsp + 0x60]
xor eax, eax
cmp rdx, rax
jle 0x14000e33a
mov ebx, dword [rsp + 0x88]
mov rdi, rax
mov rbp, rdx
lea esi, [rax + 1]
mov rax, qword [rsp + 0x690]
mov rcx, qword [rax + rdi*8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rbx + rax + 1]
mov dword [rsp + 0x130], eax
mov rax, qword [rsp + 0x690]
mov rcx, qword [rax + rdi*8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [rsp + 0x130]
add rdi, rsi
cmp rdi, rbp
lea ebx, [rcx + rax + 3]
jl 0x14000e2cd
mov rdi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x200]
mov sil, byte [rsp + 0x60]
mov dword [rsp + 0x88], ebx
mov rbx, qword [rsp + 0x1d0]
mov edx, dword [rsp + 0x88]
lea rcx, [rsp + 0x268]
add edx, 4
call fcn.14004bf70
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x240], rax
mov rcx, rax
xor eax, eax
cmp qword [rsp + 0x138], rax
jle 0x14000e463
mov rbp, qword [rsp + 0x138]
xor edi, edi
mov rsi, rcx
mov rbx, rax
mov rax, qword [rsp + 0x690]
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx]
mov rcx, rax
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x118]
mov rcx, rsi
cdqe
add rax, rax
mov r8, rax
mov qword [rsp + 0x2b0], rax
call fcn.1400177f8
add rsi, qword [rsp + 0x2b0]
mov eax, 0x3d
mov word [rsi], ax
mov rax, qword [rsp + 0x690]
add rsi, 2
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx + 8]
mov rcx, rax
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x118]
mov rcx, rsi
cdqe
add rax, rax
mov r8, rax
mov qword [rsp + 0x2b0], rax
call fcn.1400177f8
add rsi, qword [rsp + 0x2b0]
inc rbx
mov word [rsi], di
add rsi, 2
cmp rbx, rbp
jl 0x14000e384
mov rbx, qword [rsp + 0x1d0]
mov rdi, qword [rsp + 0x180]
mov rbp, qword [rsp + 0x200]
mov qword [rsp + 0x208], rsi
mov sil, byte [rsp + 0x60]
mov rcx, qword [rsp + 0x208]
xor eax, eax
mov word [rcx], ax
mov word [rcx + 2], ax
lea rcx, [rsp + 0x438]
call fcn.140044f24
lea rcx, [rsp + 0x690]
xor edx, edx
call fcn.140038fd4
lea rcx, [rsp + 0x700]
call fcn.140044f24
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rax, qword [rsp + 0xe0]
mov ecx, 0x40
lea r8d, [rcx - 0x3f]
cmp cx, word [rax]
jne 0x14000e4bd
mov al, r8b
jmp 0x14000e4d0
cmp qword [rsp + 0x2c0], rdx
movzx eax, dl
mov ecx, 2
cmovne eax, ecx
mov cl, byte [rsp + 0x61]
cmp cl, dl
je 0x14000e672
or cl, 8
neg al
mov dword [rsp + 0x74], r8d
sbb eax, eax
mov byte [rsp + 0x61], cl
and eax, 0xfff01000
add eax, 0x100000
mov dword [rsp + 0x130], eax
call fcn.1400475f0
lea rdx, str..pipepecmd_exec__u
lea rcx, [rsp + 0x610]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfA]
and qword [rsp + 0x38], 0
mov eax, 1
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x130]
lea rcx, [rsp + 0x610]
mov dword [rsp + 0x28], eax
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 6
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsp + 0x228], rax
test rax, rax
je 0x14000e5ce
cmp rax, 0xffffffffffffffff
je 0x14000e5ce
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0x248]
or r8d, 0xffffffff
call fcn.140058960
xor ecx, ecx
mov r9d, 7
mov rdx, qword [rax]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x498]
mov dword [rsp + 0x28], 3
mov r8d, 0xc0000000
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x238]
call fcn.1400034e0
lea rcx, [rsp + 0x248]
call fcn.140044f24
jmp 0x14000e5d9
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x238]
lea rdx, [rsp + 0x210]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x210], 2
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r8d, 1
lea r9, [rsp + 0x540]
bts dword [r9 + 0x3c], 8
mov ecx, r8d
xor edx, edx
mov dword [rsp + 0xc0], ecx
mov cl, byte [rsp + 0x70]
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x418], rax
mov dword [rsp + 0x68], r8d
test cl, 2
jne 0x14000e653
cmp cl, dl
jne 0x14000e661
mov rax, qword [rsp + 0x238]
mov qword [r9 + 0x58], rax
jmp 0x14000e669
mov rax, qword [rsp + 0x238]
test r8b, cl
je 0x14000e693
mov qword [r9 + 0x60], rax
cmp dword [rsp + 0x74], edx
jne 0x14000e693
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor edx, edx
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x178], rdx
mov qword [rsp + 0x190], rdx
neg rax
mov eax, dword [rsp + 0xf4]
mov qword [rsp + 0x138], rdx
sbb ecx, ecx
and ecx, 0x400
or ecx, eax
mov eax, dword [rsp + 0x8c]
or eax, ecx
mov dword [rsp + 0x8c], eax
cmp byte [rsp + 0x66], dl
je 0x14000e6e7
or eax, 4
mov dword [rsp + 0x8c], eax
mov r9, qword [rsp + 0x80]
cmp byte [rsp + 0x62], dl
je 0x14000e6fe
cmp r9, rdx
je 0x14000fb89
mov al, byte [rsp + 0xdc]
mov r8d, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0xa4]
cmp al, dl
je 0x14000e7e1
cmp r8w, dx
jne 0x14000e7e1
cmp cx, dx
jne 0x14000e7e1
call fcn.140007e84
mov r9, qword [rsp + 0xce8]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x178]
mov rbx, rax
mov qword [rsp + 0x440], rax
call fcn.140004b34
mov rcx, rax
mov rdi, rax
call fcn.140004ed4
xor ebp, ebp
cmp eax, ebp
jne 0x14000fd19
mov r8, qword [rsp + 0xce8]
mov rdx, qword [rsp + 0x80]
lea rax, [rsp + 0x310]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x540]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x8c]
mov rcx, rbx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, eax
mov dword [rsp + 0x90], eax
jmp 0x14000fcf1
mov rax, qword [rsp + 0x110]
cmp word [rax], dx
je 0x14000ea69
cmp r8w, dx
jne 0x14000ea69
cmp cx, dx
jne 0x14000ea69
mov r11b, byte [rsp + 0xa9]
xor ebp, ebp
mov edi, ebp
mov dword [rsp + 0x90], ebp
cmp r11b, bpl
je 0x14000e91a
mov rdx, qword [rsp + 0xe8]
or r9d, 0xffffffff
lea rcx, [rsp + 0x370]
or r8d, r9d
mov qword [rsp + 0x370], rbp
call fcn.14004bdac
lea rcx, [rsp + 0x358]
call fcn.14004bc1c
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xe8]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400b93b0
mov rcx, qword [rsp + 0x370]
lea rdx, [rsp + 0x358]
call fcn.1400527c0
mov rdx, qword [rsp + 0x358]
mov ebx, ebp
cmp rax, rbp
lea rcx, [rsp + 0xe8]
setne bl
or r9d, 0xffffffff
or r8d, r9d
call fcn.14004c024
mov rcx, qword [rsp + 0x370]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x370]
xor edx, edx
movsxd r8, eax
call fcn.1400b93b0
mov rcx, qword [rsp + 0x358]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x358]
xor edx, edx
movsxd r8, eax
call fcn.1400b93b0
lea rcx, [rsp + 0x358]
call fcn.140044f24
lea rcx, [rsp + 0x370]
call fcn.140044f24
cmp ebx, ebp
je 0x14000ea1e
mov rbx, qword [rsp + 0x110]
jmp 0x14000e91d
mov rbx, rax
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, rbp
jne 0x14000e94c
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, rbp
jne 0x14000e94c
lea rdi, [0x1400d7174]
jmp 0x14000e95b
mov word [rax], bp
mov rdi, qword [rsp + 0x110]
lea rbx, [rax + 2]
mov r9, qword [rsp + 0xce8]
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x178]
call fcn.140004b34
mov rcx, rax
mov qword [rsp + 0x248], rax
call fcn.140004ed4
cmp eax, ebp
je 0x14000e9a2
mov ebx, 3
mov dword [rsp + 0xd8], ebx
jmp 0x14000fd19
mov r8, qword [rsp + 0xe8]
lea rax, [rsp + 0x310]
mov r9d, 1
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x540]
mov rdx, rdi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x248]
mov rcx, rbx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xce8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov edi, eax
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0xe8]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400b93b0
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x110]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400b93b0
jmp 0x14000fcf1
cmp byte [rsp + 0x104], dl
je 0x14000eb3b
cmp r9, rdx
je 0x14000ea8a
mov eax, 0x26
cmp ax, word [r9]
je 0x14000eb3b
cmp word [rsp + 0xc8], dx
jne 0x14000eb3b
cmp r8w, dx
jne 0x14000eb3b
cmp cx, dx
jne 0x14000eb3b
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.140004ed4
xor ebp, ebp
cmp eax, ebp
jne 0x14000e991
mov rax, qword [rsp + 0x258]
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0xce8]
mov edx, dword [rsp + 0x290]
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x310]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x540]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x20], eax
call fcn.1400a98ac
mov edi, ebp
cmp eax, ebp
setg dil
mov dword [rsp + 0x90], edi
jmp 0x14000fcf1
lea rcx, [rsp + 0x1e0]
mov qword [rsp + 0x98], rdx
mov dword [rsp + 0x90], edx
mov qword [rsp + 0x2a0], rdx
mov qword [rsp + 0x278], rdx
mov qword [rsp + 0x1c8], r9
mov qword [rsp + 0x300], r9
call fcn.14004bc1c
xor eax, eax
lea rcx, [rsp + 0x408]
mov dword [rsp + 0x1e8], eax
mov dword [rsp + 0x1ec], eax
mov qword [rsp + 0x208], rcx
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x408], rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x368], rcx
cmp word [rsp + 0xa4], ax
je 0x14000ecd2
mov rbx, qword [rsp + 0x1c8]
lea r10d, [rax + 0x22]
lea r9d, [rax + 2]
cmp r10w, word [rbx]
jne 0x14000ebee
add rbx, r9
mov qword [rsp + 0x1c8], rbx
lea rcx, [rsp + 0x1c8]
mov edx, 0x3a
call fcn.1400588ac
mov rcx, qword [rsp + 0x1c8]
xor ebp, ebp
cmp rcx, rbx
je 0x14000ec22
cmp word [rcx - 2], r10w
jne 0x14000ec22
mov word [rcx - 2], bp
mov rcx, qword [rsp + 0x1c8]
cmp dx, word [rcx]
jne 0x14000ec3d
mov word [rcx], bp
mov rcx, qword [rsp + 0x1c8]
add rcx, r9
mov qword [rsp + 0x1c8], rcx
mov rdi, rcx
cmp r10w, word [rcx]
jne 0x14000ec6b
lea rdi, [rcx + 2]
add rcx, r9
mov qword [rsp + 0x1c8], rcx
cmp r10w, word [rcx]
jne 0x14000ec66
mov word [rcx], bp
mov rcx, qword [rsp + 0x1c8]
cmp word [rcx], bp
jne 0x14000ec4a
cmp word [rsp + 0x6c], bp
je 0x14000ec97
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x98], rax
cmp rax, rbp
je 0x14000ec97
mov word [rax], bp
add rax, 2
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x1e0]
mov r9d, 0x10000
mov r8, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call fcn.1400407e8
movsxd rdi, dword [rsp + 0x1ec]
add rdi, qword [rsp + 0x1e0]
mov qword [rsp + 0x1c0], rdi
jmp 0x14000f3f8
mov rdx, qword [rsp + 0x1c8]
cmp rdx, rax
je 0x14000ef08
mov eax, 0x26
cmp word [rdx], ax
jne 0x14000eee4
mov rcx, qword [rsp + 0xce0]
or r9d, 0xffffffff
xor r8d, r8d
call fcn.140012bb4
mov qword [rsp + 0x248], rax
test rax, rax
jne 0x14000ee8d
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x1e0]
call fcn.140044f24
lea rcx, [rsp + 0x278]
call fcn.140044f24
lea rcx, [rsp + 0x138]
call fcn.140044f24
lea rcx, [rsp + 0x190]
call fcn.140044f24
lea rcx, [rsp + 0x178]
call fcn.140044f24
lea rcx, [rsp + 0x268]
call fcn.140044f24
test sil, sil
je 0x14000ed8e
and byte [0x1400f2ccc], 0xfb
lea rcx, str.SeDebugPrivilege
mov edx, 4
call fcn.140016130
lea rcx, [rsp + 0x2a8]
call fcn.140044f24
lea rcx, [rsp + 0x1a0]
call fcn.140044f24
mov rcx, qword [rsp + 0x260]
xor esi, esi
cmp rcx, rsi
je 0x14000edc3
cmp rcx, 0xffffffffffffffff
je 0x14000edc3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1b8]
call fcn.140044f24
mov rcx, qword [rsp + 0xd0]
cmp rcx, rsi
je 0x14000ede9
cmp rcx, 0xffffffffffffffff
je 0x14000ede9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xd0], rsi
cmp rcx, rsi
je 0x14000ee0a
cmp rcx, 0xffffffffffffffff
je 0x14000ee0a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], rsi
cmp rbp, rsi
je 0x14000ee26
cmp rbp, 0xffffffffffffffff
je 0x14000ee26
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rsi
je 0x14000ee3a
cmp rbx, 0xffffffffffffffff
je 0x14000ee3a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rsi
je 0x14000ee4e
cmp rdi, 0xffffffffffffffff
je 0x14000ee4e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x238]
cmp rax, rsi
je 0x14000ee6a
cmp rax, 0xffffffffffffffff
je 0x14000ee6a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x228]
cmp rax, rsi
je 0x14000d3ce
cmp rax, 0xffffffffffffffff
je 0x14000d3ce
mov rcx, rax
jmp 0x14000d3c8
mov edx, dword [rax + 0x18]
lea rcx, [rsp + 0x1e0]
and edx, 0x3fffffff
mov dword [rsp + 0x1e8], edx
add edx, 0x10
call fcn.14004bd00
mov rdx, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x1e0]
mov rdx, qword [rdx + 8]
mov rdi, rax
mov qword [rsp + 0x1c0], rax
mov eax, dword [rsp + 0x1e8]
inc eax
movsxd r8, eax
call fcn.1400177f8
xor ebp, ebp
jmp 0x14000f3f8
neg byte [rsp + 0x64]
mov ebx, 2
lea rcx, [rsp + 0x300]
sbb edx, edx
and edx, ebx
call fcn.1400631e4
mov qword [rsp + 0x2a0], rax
jmp 0x14000ef15
mov rax, qword [rsp + 0x2a0]
mov ebx, 2
xor ebp, ebp
mov qword [rsp + 0x1c8], rbp
mov qword [rsp + 0x428], rbp
cmp rax, rbp
jne 0x14000f2e0
mov r9, qword [rsp + 0xce8]
mov qword [rsp + 0x1c8], r9
cmp r9, rbp
je 0x14000ef65
lea eax, [rbp + 0x2a]
cmp word [r9], ax
jne 0x14000ef65
lea eax, [rbp + 1]
add word [rsp + 0xc8], ax
lea rax, [r9 + 2]
mov qword [rsp + 0x1c8], rax
cmp byte [rsp + 0x104], bpl
je 0x14000ef77
mov word [rsp + 0xc8], bp
cmp word [rsp + 0x6c], bp
je 0x14000f048
mov rcx, qword [rsp + 0x300]
xor edx, edx
lea r8d, [rdx + 0x3a]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdi, rax
mov qword [rsp + 0x98], rax
cmp rax, rbp
je 0x14000f02f
add rdi, rbx
mov word [rax], bp
mov qword [rsp + 0x98], rdi
je 0x14000f02f
mov r9, qword [rsp + 0x300]
mov eax, 0x22
mov dword [rsp + 0xa4], ebx
mov qword [rsp + 0x208], rbp
mov rbx, rbp
cmp ax, word [r9]
jne 0x14000f01a
add r9, 2
lea rcx, [rsp + 0x368]
mov edx, eax
mov qword [rsp + 0x300], r9
mov qword [rsp + 0x368], r9
call fcn.1400588ac
mov rcx, qword [rsp + 0x368]
cmp word [rcx], bp
je 0x14000f01a
mov word [rcx], bp
mov r9, qword [rsp + 0x300]
lea rcx, [rsp + 0x108]
mov rdx, r9
call fcn.1400589a0
jmp 0x14000f43e
mov rax, qword [rsp + 0x2a0]
cmp rax, rbp
jne 0x14000f2e0
mov r9, qword [rsp + 0xce8]
mov rbx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x178]
mov r8, rbx
call fcn.140004b34
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x78], rax
call fcn.140004ed4
cmp eax, ebp
jne 0x14000fb49
cmp byte [rsp + 0x61], bpl
jne 0x14000f16a
mov rcx, qword [rsp + 0xce8]
xor edx, edx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
cmp rax, rbp
je 0x14000f0aa
add rbx, 2
jmp 0x14000f0b2
mov rbx, qword [rsp + 0xce8]
lea rcx, str.winpeshl
mov r8d, 8
mov rdx, rbx
call fcn.140045fc8
mov ecx, 0x2e
cmp al, bpl
je 0x14000f102
movzx eax, word [rbx + 0x10]
cmp bp, ax
je 0x14000f0fd
cmp cx, ax
je 0x14000f0fd
mov ecx, 9
cmp cx, ax
ja 0x14000f0f3
mov ecx, 0xd
cmp ax, cx
jbe 0x14000f0fd
mov ecx, 0x20
cmp cx, ax
jne 0x14000f102
mov byte [rsp + 0x71], 1
lea rcx, str.wpeinit
mov r8d, 8
mov rdx, rbx
call fcn.140045fc8
cmp al, bpl
je 0x14000f162
movzx eax, word [rbx + 0xe]
cmp bp, ax
je 0x14000f14d
mov ecx, 0x2e
cmp cx, ax
je 0x14000f14d
mov ecx, 9
cmp cx, ax
ja 0x14000f143
mov ecx, 0xd
cmp ax, cx
jbe 0x14000f14d
mov ecx, 0x20
cmp cx, ax
jne 0x14000f162
mov rbx, qword [rsp + 0x80]
mov r9d, 1
mov byte [rsp + 0x71], r9b
jmp 0x14000f170
mov rbx, qword [rsp + 0x80]
mov r9d, 1
test byte [rsp + 0xd00], r9b
jne 0x14000f183
cmp dword [rsp + 0xfc], ebp
je 0x14000f1c4
mov rcx, qword [rsp + 0xce8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.Shell.x
lea rdx, str.SOFTWAREPELOGON
add eax, eax
mov r9d, 1
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xce8]
mov qword [rsp + 0x20], rax
call fcn.140045e70
mov rdx, qword [rsp + 0xce8]
lea rax, [rsp + 0x310]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x540]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x8c]
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
call fcn.1400b8af0
mov edi, eax
mov dword [rsp + 0x90], eax
neg eax
sbb cl, cl
and cl, byte [rsp + 0x71]
mov byte [rsp + 0x71], cl
cmp cl, bpl
je 0x14000f25e
call fcn.1400a7124
mov ecx, dword [rsp + 0x74]
cmp eax, ebp
mov eax, 1
cmovle ecx, eax
mov dword [rsp + 0x74], ecx
cmp ecx, ebp
jne 0x14000f25e
lea rcx, str.waitpeinit.pecmd
call fcn.1400b8b5c
mov dword [rsp + 0x74], eax
cmp edi, ebp
jne 0x14000fcca
mov eax, dword [rsp + 0xfc]
mov r8, qword [rsp + 0xce8]
lea rdx, str._CreateProcess__s__d___d__r_n
lea rcx, [0x1400f1e30]
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.140012fac
cmp byte [rsp + 0x62], bpl
jne 0x14000fcca
cmp rbx, rbp
jne 0x14000fcca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x14000fcca
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x1e0]
call fcn.140044f24
lea rcx, [rsp + 0x278]
call fcn.140044f24
jmp 0x14000fb8b
mov rdi, rax
cmp word [rsp + 0x6c], bp
je 0x14000f31c
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x3a]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov qword [rsp + 0x98], rax
cmp rax, rbp
je 0x14000f314
mov word [rax], bp
add rax, rbx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x2a0]
add rax, rbx
lea rdx, [rsp + 0x428]
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x2a0], rax
call fcn.1400630f4
mov rcx, qword [0x1400f1ca0]
mov rdx, rax
mov qword [rsp + 0x248], rax
movzx eax, word [rdi]
mov word [rdi], bp
mov word [rsp + 0xdc], ax
mov rax, qword [rsp + 0x300]
mov r8d, 0x20
mov rbx, rbp
mov dword [rsp + 0xd8], r8d
cmp word [rax], bp
je 0x14000f39d
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdx, qword [rsp + 0x248]
mov r8d, 0x20
mov rbx, rax
mov rcx, rax
mov ax, word [rsp + 0xdc]
mov word [rdi], ax
cmp rcx, rbp
je 0x14000f3e7
mov dword [rsp + 0xd8], r8d
mov r8, rdx
mov rdx, qword [rsp + 0x428]
lea rax, [rsp + 0xd8]
lea r9, [rsp + 0x1e0]
mov qword [rsp + 0x20], rax
call fcn.140017f3c
mov rdi, rax
mov qword [rsp + 0x1c0], rax
jmp 0x14000f3ea
mov rdi, rbp
cmp rbx, rbp
je 0x14000f3f8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x1e8], ebp
je 0x14000fcc3
cmp rdi, rbp
je 0x14000fcc3
mov dword [rsp + 0xa4], 1
cmp word [rsp + 0xc8], bp
ja 0x14000f42e
cmp word [rsp + 0x6c], bp
je 0x14000fa14
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x368]
mov r8, qword [rsp + 0x208]
lea rax, [0x1400d6970]
cmp rbx, rbp
cmovne rax, qword [rsp + 0x350]
lea r9, str.exedat
lea rcx, [rsp + 0x128]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140005c7c
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x190]
call fcn.1400589ec
mov rbx, qword [rsp + 0x408]
lea rax, [rsp + 0x408]
cmp rbx, rbp
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x208], rax
setne al
mov dword [rsp + 0x130], ebp
mov qword [rsp + 0x368], rcx
cmp al, bpl
je 0x14000f4fd
mov r8d, dword [rsp + 0x1e8]
mov rdx, qword [rsp + 0x1c0]
lea r9, [rsp + 0x130]
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.1400494c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f50f
mov eax, 1
cmp dword [rsp + 0xa4], eax
jle 0x14000fcc3
mov rdx, qword [rsp + 0x128]
mov byte [rsp + 0x60], bpl
cmp rdi, rbp
je 0x14000f731
mov rax, qword [rsp + 0x108]
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0x3d0], rax
call fcn.140058a38
lea rdx, str..ex
lea rcx, [rsp + 0x108]
call fcn.14004bfa8
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x190]
call fcn.1400589ec
mov eax, 0x5c
mov rbx, rdi
cmp ax, word [rdi]
je 0x14000f587
lea rbx, [rdi - 2]
mov word [rbx], ax
mov rcx, qword [rsp + 0x190]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [rsp + 0x6c]
mov ecx, 1
cmp cx, ax
jne 0x14000f61e
lea rdx, [0x1400d7088]
lea rcx, [rsp + 0x230]
call fcn.140058920
mov rdx, qword [rsp + 0x3d0]
lea rcx, [rsp + 0x230]
call fcn.14004bfa8
lea rdx, [0x1400d7080]
lea rcx, [rsp + 0x230]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x230]
call fcn.14004bfa8
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0xce0]
call fcn.140032808
lea rcx, [rsp + 0x230]
call fcn.140044f24
jmp 0x14000f6fd
mov ecx, pe_nt_image_headers64
cmp cx, ax
jne 0x14000f6fd
xor edx, edx
lea rcx, [rsp + 0x790]
mov dword [rsp + 0x780], 0x68
lea r8d, [rdx + 0x58]
mov qword [rsp + 0x788], rbp
call fcn.1400b93b0
mov rcx, qword [rsp + 0x3d0]
xor eax, eax
mov qword [rsp + 0x470], rax
mov qword [rsp + 0x478], rax
lea rax, [rsp + 0x468]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x780]
lea rdx, [0x1400d7078]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x190]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x7bc], 0x80
mov qword [rsp + 0x468], rbp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x468]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x468]
cmp rcx, rbp
je 0x14000f6ea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x470]
cmp rcx, rbp
je 0x14000f6fd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x108]
mov rdx, rbx
call fcn.14004bfa8
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x178]
call fcn.1400589ec
lea rcx, [rsp + 0x3d0]
call fcn.140044f24
jmp 0x14000f73e
lea rcx, [rsp + 0x190]
call fcn.140058a38
mov r9, qword [rsp + 0xce8]
mov edx, 0x22
mov rax, r9
cmp dx, word [r9]
jne 0x14000f758
lea rax, [r9 + 2]
mov ecx, 0x3f
cmp cx, word [rax]
jne 0x14000f858
lea rdi, [rax + 2]
cmp cx, word [rdi]
jne 0x14000f780
mov rbx, qword [rsp + 0x108]
lea rdi, [rax + 4]
jmp 0x14000f806
mov eax, 0x5c
cmp ax, word [rdi]
jne 0x14000f850
cmp dx, word [r9]
je 0x14000f7fe
mov rax, qword [rsp + 0x190]
mov ebx, 0x104
lea rcx, [rsp + 0x190]
mov edx, ebx
mov qword [rsp + 0x190], rbp
mov qword [rsp + 0x430], rax
call fcn.14004bf70
mov rax, qword [rsp + 0x190]
mov r8d, ebx
mov word [rax], bp
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rcx, [rsp + 0x430]
call fcn.140044f24
mov r9, qword [rsp + 0xce8]
mov edx, 0x22
mov rbx, qword [rsp + 0x190]
cmp dx, word [r9]
jne 0x14000f820
lea rdx, [0x1400d6c70]
lea rcx, [rsp + 0x138]
call fcn.140058a38
lea rcx, [rsp + 0x138]
mov rdx, rbx
call fcn.14004bfa8
lea rcx, [rsp + 0x138]
mov rdx, rdi
call fcn.14004bfa8
mov r9, qword [rsp + 0x138]
mov qword [rsp + 0xce8], r9
mov rdi, qword [rsp + 0x98]
cmp rdi, rbp
je 0x14000f8c5
mov ecx, dword [rsp + 0xc8]
cmp cx, bp
ja 0x14000f9a2
mov rcx, qword [rsp + 0x178]
lea rdx, [rsp + 0x1e0]
mov rdi, rbp
mov qword [rsp + 0x98], rbp
call fcn.140017960
cmp dword [rsp + 0x1e8], ebp
je 0x14000f8bd
mov eax, 1
mov bl, al
mov byte [rsp + 0x60], al
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1c0], rax
mov edi, dword [rsp + 0x90]
jmp 0x14000f994
mov r9, qword [rsp + 0xce8]
mov r8, qword [rsp + 0x108]
mov rbx, r8
cmp rdi, rbp
je 0x14000f8e1
movzx eax, word [rdi]
neg ax
sbb rcx, rcx
and rbx, rcx
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x178]
cmp rax, rbp
cmove rax, qword [rsp + 0x190]
mov rdx, rax
call fcn.140004b34
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x78], rax
call fcn.140004ed4
cmp eax, ebp
jne 0x14000fcb2
mov rdx, qword [rsp + 0xce8]
lea rax, [rsp + 0x310]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x540]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x8c]
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
call fcn.1400b8af0
cmp byte [rsp + 0xc8], 2
mov edi, eax
mov dword [rsp + 0x90], eax
jl 0x14000fcca
cmp word [rsp + 0x6c], bp
jne 0x14000fcca
mov bl, bpl
mov eax, 1
cmp bl, al
jne 0x14000f9e4
or edx, 0xffffffff
jmp 0x14000f9ef
cmp byte [rsp + 0x62], bpl
je 0x14000f8c5
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x98], rbp
cmp rax, rbp
cmove rax, qword [rsp + 0x190]
mov qword [rsp + 0x78], rax
mov eax, 2
mov bl, al
mov byte [rsp + 0x60], al
cmp cx, ax
jb 0x14000f2b4
jmp 0x14000f8b1
lea rax, [rsp + 0x310]
mov edx, dword [rax + 0x10]
mov rcx, qword [rsp + 0x128]
call fcn.14000365c
mov rax, qword [rsp + 0x128]
mov word [rax], bp
mov eax, 1
cmp bl, al
jne 0x14000fb81
mov rbx, qword [rsp + 0xce8]
mov edx, 0x22
mov rax, rbx
cmp dx, word [rbx]
jne 0x14000fa2d
lea rax, [rbx + 2]
mov ecx, 0x3f
movzx edi, bp
cmp cx, word [rax]
jne 0x14000fa58
mov ecx, 0x5c
cmp cx, word [rax + 2]
jne 0x14000fa58
lea rbx, [rax + 4]
cmp dx, word [rbx]
jne 0x14000fa58
sub rbx, 2
mov di, word [rbx]
mov word [rbx], dx
mov rcx, qword [rsp + 0x78]
call fcn.140004ed4
cmp eax, ebp
jne 0x14000fb49
mov r9d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1c0]
mov qword [rsp + 0x48], rbp
lea rax, [rsp + 0x310]
mov r8, rbx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x540]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x20], eax
call fcn.1400a98ac
mov dword [rsp + 0x210], eax
cmp di, bp
je 0x14000fad6
mov word [rbx], di
cmp eax, ebp
jl 0x14000f42e
lea rax, [rsp + 0x310]
mov r8d, dword [rax + 0x10]
cmp r8d, ebp
je 0x14000f42e
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rbp
je 0x14000f42e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x210], ebp
mov rax, qword [rsp + 0x128]
mov edi, ebp
setg dil
mov dword [rsp + 0x90], edi
cmp rax, rbp
je 0x14000fcca
cmp word [rax], bp
je 0x14000fcca
mov bl, byte [rsp + 0x60]
jmp 0x14000f994
mov ebx, 3
mov dword [rsp + 0xd8], ebx
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x1e0]
call fcn.140044f24
lea rcx, [rsp + 0x278]
call fcn.140044f24
jmp 0x14000fd19
cmp bl, 2
jmp 0x14000f2ae
xor ebp, ebp
xor edx, edx
lea rcx, [rsp + 0x4d8]
mov dword [rsp + 0x4d0], 0x70
lea r8d, [rdx + 0x68]
call fcn.1400b93b0
mov edx, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
cmp edx, ebp
mov eax, 5
mov dword [rsp + 0x4d4], 0x4540
cmovne ax, dx
movzx eax, ax
mov dword [rsp + 0x500], eax
cmp rcx, rbp
je 0x14000fbf1
mov rax, qword [rsp + 0x4f8]
cmp word [rcx], bp
cmovne rax, rcx
mov qword [rsp + 0x4f8], rax
mov rax, qword [rsp + 0x198]
mov ecx, 0x22
mov dword [rsp + 0x6c], ebp
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0xce8]
mov qword [rsp + 0x388], rax
mov qword [rsp + 0x4e8], rax
cmp cx, word [rax]
jne 0x14000fc72
lea r8d, [rcx - 0x21]
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x388]
call fcn.140020840
mov r8d, dword [rsp + 0x6c]
mov rdx, qword [rsp + 0x388]
lea rcx, [rsp + 0x1b0]
mov rbx, rax
call fcn.14004c0cc
mov r11, qword [rsp + 0x1b0]
mov qword [rsp + 0x4f0], rbx
mov qword [rsp + 0x4e8], r11
lea rcx, [rsp + 0x4d0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rbx, [rsp + 0x310]
mov edi, eax
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x538]
mov rcx, rax
mov qword [rbx], rax
mov qword [rsp + 0x538], rbp
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x10], eax
jmp 0x14000fcf1
mov eax, 3
mov dword [rsp + 0xd8], eax
jmp 0x14000fb55
mov edi, dword [rsp + 0x90]
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0x1e0]
call fcn.140044f24
lea rcx, [rsp + 0x278]
call fcn.140044f24
cmp edi, ebp
je 0x14000fd00
mov ebx, ebp
mov dword [rsp + 0xd8], ebx
jmp 0x14000fd0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0xd8], eax
mov rax, qword [rsp + 0x3c8]
mov dword [rax], ebx
mov rcx, qword [rsp + 0x260]
cmp rcx, rbp
je 0x14000fd32
cmp rcx, 0xffffffffffffffff
je 0x14000fd32
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rsp + 0xd0]
mov rbx, rbp
mov qword [rsp + 0x260], rbx
cmp qword [rdi], rbp
je 0x14000fd53
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x1a8]
mov qword [rdi], rbp
lea rdi, [rsp + 0x310]
cmp word [r8], bp
je 0x14000fd7c
mov edx, dword [rdi + 0x10]
mov rcx, qword [rsp + 0xce0]
call fcn.14004ed18
cmp byte [rsp + 0x66], bpl
je 0x14000fdb3
cmp qword [rdi], rbp
je 0x14000fdb3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rdi, rax
mov qword [rsp + 0x2f0], rax
lea rax, [rsp + 0x310]
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
jmp 0x14000fdbb
mov rdi, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0xce0]
lea rax, [rsp + 0x310]
lea r8, str.__LastPID
mov edx, dword [rax + 0x10]
call fcn.14004ed18
mov rcx, qword [rsp + 0xce0]
lea rax, [rsp + 0x310]
mov edx, dword [rax + 0x14]
lea r8, str.__LastTID
call fcn.14004ed18
cmp dword [rsp + 0xc4], ebp
je 0x14000fe1e
lea rax, [rsp + 0x310]
lea rcx, str.SeDebugPrivilege
mov edx, 4
mov r8, qword [rax]
call fcn.1400161a8
test byte [rsp + 0x8c], 4
je 0x14000fe3f
lea rax, [rsp + 0x310]
mov rcx, qword [rax + 8]
cmp rcx, rbp
je 0x14000fe3f
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [rsp + 0x138]
call fcn.140044f24
lea rcx, [rsp + 0x190]
call fcn.140044f24
lea rcx, [rsp + 0x178]
call fcn.140044f24
lea rcx, [rsp + 0x268]
call fcn.140044f24
cmp sil, bpl
je 0x14000fe90
and byte [0x1400f2ccc], 0xfb
lea rcx, str.SeDebugPrivilege
mov edx, 4
call fcn.140016130
lea rsi, [rsp + 0x238]
cmp qword [rsi], rbp
je 0x14000fea6
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rbp
lea rsi, [rsp + 0xb8]
cmp qword [rsi], rbp
je 0x14000febf
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rbp
lea rsi, [rsp + 0x180]
cmp qword [rsi], rbp
je 0x14000fed8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rbp
lea rsi, [rsp + 0x1d0]
cmp qword [rsi], rbp
je 0x14000fef1
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rbp
lea rsi, [rsp + 0x200]
cmp qword [rsi], rbp
je 0x14000ff0a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], rbp
mov esi, dword [rsp + 0xd00]
cmp sil, bpl
je 0x14000ff86
lea r8, [rsp + 0x310]
cmp qword [r8], rbp
je 0x14000ff3c
mov rcx, qword [r8]
mov edx, 0x1388
call qword [sym.imp.USER32.dll_WaitForInputIdle]
lea r8, [rsp + 0x310]
mov edx, 1
test dl, sil
je 0x14000ff5c
mov rax, qword [r8]
neg rax
sbb ecx, ecx
and ecx, 2
or ecx, edx
mov edx, dword [r8 + 0x10]
call fcn.140014c38
mov rdx, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0xce0]
cmp rdx, rbp
je 0x14000ff8e
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call fcn.1400367d4
jmp 0x14000ff8e
mov rsi, qword [rsp + 0xce0]
cmp dword [rsp + 0x90], ebp
je 0x140010af0
lea r8, [rsp + 0x310]
mov rdx, qword [r8]
mov rax, rdx
neg rax
sbb ecx, ecx
and ecx, dword [rsp + 0x74]
mov dword [rsp + 0x74], ecx
movsxd rcx, dword [rsp + 0xc0]
mov qword [rsp + rcx*8 + 0x418], rdx
inc ecx
mov dword [rsp + 0xc0], ecx
mov rcx, qword [r8 + 8]
cmp rcx, rbp
je 0x14000ffe6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x310]
mov qword [r8 + 8], rbp
mov eax, 0x3e8
cmp dword [rsp + 0xfc], ebp
je 0x140010015
xor r8d, r8d
mov edx, eax
mov rcx, rsi
call fcn.140013908
lea rax, [rsp + 0x310]
mov rcx, qword [rax]
call fcn.14001e2b4
cmp dword [rsp + 0x74], ebp
je 0x140010b0c
mov al, byte [0x1400ef217]
mov ebx, 0x100000
lea rcx, [rsp + 0x78]
lea edx, [rbx + 4]
mov byte [rsp + 0x62], al
mov esi, ebp
call fcn.14004bc80
mov rax, qword [rsp + 0xe0]
mov r8d, 0x40
lea rcx, [rax + 2]
mov qword [rsp + 0x3e0], rax
mov byte [rsp + 0xd00], bpl
mov qword [rsp + 0x488], rcx
cmp r8w, word [rax]
jne 0x140010082
mov byte [rsp + 0xd00], 1
mov rax, rcx
mov qword [rsp + 0x3e0], rcx
jmp 0x140010094
cmp qword [rsp + 0x2c0], rbp
je 0x140010094
mov byte [rsp + 0xd00], 2
cmp byte [rsp + 0x102], bpl
je 0x140010113
mov rcx, qword [rsp + 0xce0]
lea r8, [rsp + 0x3f0]
xor r9d, r9d
mov rdx, rax
mov qword [rsp + 0x3f0], rbp
call fcn.140055688
mov rdx, qword [rsp + 0x3f0]
or r9d, 0xffffffff
lea rcx, [rsp + 0x78]
or r8d, r9d
call fcn.14004bdac
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x78]
lea ebx, [rax + 0x3ff]
mov esi, eax
and ebx, 0xfffffc00
add ebx, 0x100000
lea edx, [rbx + 8]
call fcn.14004bd00
lea rcx, [rsp + 0x3f0]
call fcn.140044f24
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test byte [rsp + 0x61], 8
je 0x1400105fa
mov rax, qword [rsp + 0xe0]
mov ecx, 0x40
cmp cx, word [rax]
je 0x140010172
cmp byte [rsp + 0xa8], bpl
je 0x140010172
mov ecx, 0x26
cmp word [rax], cx
je 0x14001016b
mov rax, qword [rsp + 0xce0]
test byte [rax + 0xd], 0xf
je 0x140010172
mov byte [rsp + 0x60], 1
jmp 0x140010177
mov byte [rsp + 0x60], bpl
xor ecx, ecx
mov dword [rsp + 0x2b8], ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x228]
lea rdx, [rsp + 0x448]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [rsp + 0x3e8], esi
cmp byte [rsp + 0xd00], bpl
je 0x1400101b6
mov edi, ebx
sub edi, esi
jmp 0x1400101bb
mov edi, 0x100000
lea rax, [rsp + 0x448]
movsxd rdx, esi
lea r9, [rsp + 0x2b8]
add rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x228]
mov rcx, qword [rax]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e8
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x1f8]
mov dword [rsp + 0x68], ebp
cmp eax, ebp
mov dword [rsp + 0x104], ebp
mov byte [rsp + 0x66], bpl
cmovle eax, ecx
lea rcx, [rsp + 0x2f8]
mov dword [rsp + 0x1f8], eax
call fcn.14004be6c
mov al, byte [0x1400ef217]
cmp al, bpl
mov byte [rsp + 0x62], al
jle 0x1400103b8
mov eax, dword [rsp + 0x1f8]
mov edx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0xce0]
lea r8, [rsp + 0x418]
xor r9d, r9d
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], eax
call fcn.140015bb4
mov edx, eax
mov dword [rsp + 0x8c], eax
cmp eax, ebp
jne 0x140010344
lea rax, [rsp + 0x228]
lea r8, [rsp + 0xa4]
lea rdx, [rsp + 0x448]
mov rcx, qword [rax]
xor r9d, r9d
mov dword [rsp + 0xa4], ebp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov r11d, dword [rsp + 0xa4]
cmp r11d, ebp
jle 0x1400102da
mov rax, qword [rsp + 0x78]
cmp r11d, edi
cmovg r11d, edi
add esi, r11d
mov dword [rsp + 0xa4], r11d
movsxd rcx, esi
mov byte [rcx + rax], bpl
lea eax, [rsi + 0x100000]
cmp eax, ebx
jl 0x1400102f7
add ebx, 0x100000
lea rcx, [rsp + 0x78]
lea edx, [rbx + 4]
call fcn.14004bd00
cmp byte [rsp + 0xd00], bpl
je 0x140010307
mov edi, ebx
sub edi, esi
jmp 0x14001030c
mov edi, 0x100000
lea rax, [rsp + 0x448]
movsxd rdx, esi
lea r9, [rsp + 0xa4]
add rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x228]
mov rcx, qword [rax]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x8c]
mov cl, byte [rsp + 0xd00]
cmp cl, bpl
je 0x140010389
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x68], eax
sub eax, dword [rsp + 0xa0]
cmp eax, dword [rsp + 0x1f8]
jge 0x1400104a2
cmp esi, dword [rsp + 0x104]
je 0x1400105dc
cmp eax, 0x14
jl 0x1400105dc
jmp 0x1400104a2
mov eax, dword [rsp + 0xc0]
mov r8d, 1
cmp eax, r8d
jle 0x1400103ca
dec eax
cmp eax, edx
jne 0x1400103ca
mov byte [rsp + 0x66], r8b
cmp cl, bpl
je 0x1400103b8
cmp esi, dword [rsp + 0x104]
jne 0x1400104a2
lea rcx, [rsp + 0x2f8]
call fcn.140044f24
jmp 0x14001075b
test byte [rsp + 0x61], r8b
je 0x140010401
movsxd rax, dword [rsp + 0x3e8]
cmp esi, eax
jle 0x140010401
movsxd rdx, esi
mov rcx, rax
cmp rax, rdx
jge 0x140010401
mov rax, qword [rsp + 0x78]
mov r9d, 0xa
cmp byte [rcx + rax], r9b
je 0x1400103b8
add rcx, r8
cmp rcx, rdx
jl 0x1400103f3
mov eax, 5
sub eax, r8d
mov dword [rsp + 0x400], eax
js 0x14001022e
mov al, byte [0x1400ef217]
cmp al, bpl
jle 0x14001022e
mov dword [rsp + 0x20], r8d
lea rcx, [rsp + 0x630]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, ebp
je 0x14001022e
cmp dword [rsp + 0x638], 0x12
je 0x14001047d
lea rcx, [rsp + 0x630]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x630]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [rsp + 0x400]
mov r8d, 1
jmp 0x140010406
mov byte [rsp + 0x62], bpl
mov byte [rsp + 0x66], 1
cmp byte [rsp + 0xd00], bpl
je 0x14001022e
cmp esi, dword [rsp + 0x104]
je 0x14001022e
mov ecx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov dword [rsp + 0x104], esi
mov dword [rsp + 0xa0], ecx
mov cl, byte [rsp + 0x60]
mov r8, rax
cmp cl, bpl
jne 0x14001050e
mov r9d, dword [rsp + 0x158]
cmp r9d, 0x4b0
je 0x1400104f3
lea rcx, [rsp + 0x2f8]
mov r8d, esi
mov rdx, rax
call fcn.14004c024
mov r8, qword [rsp + 0x2f8]
jmp 0x140010505
movsxd rcx, esi
mov word [rcx + rax + 2], bp
mov rax, qword [rsp + 0x78]
mov word [rcx + rax + 2], bp
mov cl, byte [rsp + 0x60]
mov rax, qword [rsp + 0x78]
mov r9d, 1
cmp byte [rsp + 0xd00], r9b
jne 0x14001054c
mov rax, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0xce0]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
lea r9, [0x1400d63f4]
mov rdx, rax
mov r8, rax
call fcn.140048048
jmp 0x140010592
cmp cl, bpl
je 0x14001057d
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x78]
mov byte [rsp + 0x28], bpl
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xce0]
mov r9d, esi
mov r8, rax
call fcn.14005e494
jmp 0x140010592
mov rdx, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0xce0]
call fcn.14004b578
mov rax, qword [rsp + 0x2c0]
cmp rax, rbp
je 0x1400105dc
lea rcx, [rsp + 0x270]
mov rdx, rax
call fcn.140058920
mov rdx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0xce0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call fcn.1400367d4
lea rcx, [rsp + 0x270]
call fcn.140044f24
cmp byte [rsp + 0x66], bpl
jne 0x1400103b8
mov cl, byte [rsp + 0xd00]
mov edx, dword [rsp + 0x8c]
jmp 0x140010389
cmp dword [rsp + 0x74], 0xffffff9c
je 0x140010763
mov dl, byte [0x1400ef217]
cmp dl, bpl
mov byte [rsp + 0x62], dl
jle 0x140010767
mov eax, dword [rsp + 0xc0]
lea edi, [rax - 1]
mov dword [rsp + 0xd00], edi
mov ecx, 0x3e8
mov dword [rsp + 0x28], 0x4ff
lea r8, [rsp + 0x418]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0xce0]
xor r9d, r9d
mov edx, eax
call fcn.140015bb4
cmp edi, eax
je 0x14001075b
mov ecx, dword [rsp + 0xc0]
mov edi, 1
cmp ecx, edi
jle 0x1400106dd
cmp eax, ebp
jne 0x1400106dd
lea eax, [rsi + 0x100000]
cmp eax, ebx
jl 0x14001068d
add ebx, 0x100000
lea rcx, [rsp + 0x78]
lea edx, [rbx + 4]
call fcn.14004bd00
lea rax, [rsp + 0x228]
movsxd rdx, esi
lea r9, [rsp + 0xf4]
mov rcx, qword [rax]
add rdx, qword [rsp + 0x78]
mov r8d, edi
mov dword [rsp + 0xf4], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
je 0x1400106dd
cmp dword [rsp + 0xf4], ebp
jbe 0x1400106dd
add esi, dword [rsp + 0xf4]
mov rax, qword [rsp + 0x78]
movsxd rcx, esi
mov byte [rcx + rax], bpl
mov al, byte [0x1400ef217]
cmp al, bpl
jle 0x140010738
lea rcx, [rsp + 0x660]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, ebp
je 0x140010738
cmp dword [rsp + 0x668], 0x12
je 0x140010738
lea rcx, [rsp + 0x660]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x660]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x1400ef217]
cmp r11b, bpl
jg 0x1400106e8
mov dil, byte [0x1400ef217]
mov eax, dword [rsp + 0xc0]
mov byte [rsp + 0x62], dil
cmp dil, bpl
mov edi, dword [rsp + 0xd00]
jg 0x140010629
mov rdi, qword [rsp + 0x2f0]
mov dl, byte [rsp + 0x62]
cmp dword [rsp + 0x74], 0xffffff9c
mov rax, qword [rsp + 0x78]
movsxd rcx, esi
mov byte [rcx + rax + 2], bpl
mov rax, qword [rsp + 0x78]
mov byte [rcx + rax + 1], bpl
mov rax, qword [rsp + 0x78]
mov byte [rcx + rax], bpl
mov dword [rsp + 0x88], ebp
je 0x1400107ad
cmp dl, bpl
jle 0x1400107ad
lea rax, [rsp + 0x310]
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rax, [rsp + 0x310]
lea rdx, [rsp + 0x88]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x3c8]
mov dword [rcx], eax
mov dword [rsp + 0xd8], eax
cmp byte [rsp + 0x61], bpl
je 0x140010a8a
mov rax, qword [rsp + 0xe0]
mov ecx, 0x40
mov rbx, rbp
cmp cx, word [rax]
je 0x140010827
cmp byte [rsp + 0xa8], bpl
je 0x140010827
mov ecx, 0x26
cmp word [rax], cx
je 0x140010820
mov rax, qword [rsp + 0xce0]
test byte [rax + 0xd], 0xf
je 0x140010827
mov eax, 1
jmp 0x14001082a
mov al, bpl
lea rcx, [rsp + 0x2c8]
mov byte [rsp + 0xd00], al
call fcn.14004bc1c
mov al, byte [rsp + 0xd00]
mov dword [rsp + 0x2d0], ebp
mov dword [rsp + 0x2d4], ebp
cmp al, bpl
jne 0x1400109e4
mov eax, dword [rsp + 0x3d8]
cmp al, 2
jne 0x14001087d
mov rax, qword [rsp + 0x78]
movsxd rcx, esi
mov word [rcx + rax], bp
mov rbx, qword [rsp + 0x78]
jmp 0x1400108fe
mov ecx, 1
cmp al, cl
lea rcx, [rsp + 0x2c8]
jne 0x1400108a5
mov r9d, dword [rsp + 0x158]
mov rdx, qword [rsp + 0x78]
mov r8d, esi
call fcn.14004c024
jmp 0x140010903
lea edx, [rsi + 0x18]
call fcn.14004bf70
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x2c8]
lea eax, [rsi + 1]
mov dword [rsp + 0x2d4], esi
mov dword [rsp + 0x2d0], esi
movsxd r8, eax
call fcn.1400177f8
mov r11, qword [rsp + 0x2c8]
xor edx, edx
movsxd rcx, esi
lea r8d, [rdx + 0x10]
add rcx, r11
call fcn.1400b93b0
lea rcx, [rsp + 0x2c8]
mov edx, 4
call fcn.1400aa188
cmp rbx, rbp
jne 0x14001090b
mov rbx, qword [rsp + 0x2c8]
mov al, byte [rsp + 0x61]
test al, 4
je 0x140010956
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2 - 2]
cmp rax, rbx
jb 0x1400109dd
mov ecx, 0xd
cmp cx, word [rax]
je 0x140010945
mov edx, 0xa
cmp dx, word [rax]
jne 0x1400109dd
mov word [rax], bp
sub rax, 2
cmp rax, rbx
jae 0x140010932
jmp 0x1400109dd
mov ecx, 1
test cl, al
je 0x140010989
cmp word [rbx], bp
je 0x14001097d
lea eax, [rcx + 0xc]
lea edx, [rcx + 9]
cmp word [rbx], ax
je 0x14001097d
cmp word [rbx], dx
je 0x14001097d
add rbx, 2
cmp word [rbx], bp
jne 0x14001096a
mov word [rbx], bp
mov al, byte [rsp + 0xd00]
jmp 0x1400109e9
test al, 2
je 0x140010980
movzx eax, word [rbx]
cmp ax, bp
je 0x140010980
mov ecx, 0xd
lea edi, [rcx - 3]
cmp ax, cx
je 0x1400109ad
cmp ax, di
je 0x1400109ad
add rbx, 2
jmp 0x1400109cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rbx + 2]
mov rcx, rbx
movsxd r8, eax
add r8, r8
call fcn.1400177b0
mov ecx, 0xd
mov ax, word [rbx]
cmp ax, bp
jne 0x14001099d
mov rdi, qword [rsp + 0x2f0]
mov al, byte [rsp + 0xd00]
mov ecx, 1
mov rdx, qword [rsp + 0xe0]
mov r8d, 0x40
cmp r8w, word [rdx]
jne 0x140010a30
mov rax, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0xce0]
mov qword [rsp + 0x28], rax
lea r9, [0x1400d63f4]
mov r8, rdx
mov qword [rsp + 0x20], rax
call fcn.140048048
jmp 0x140010a6f
cmp al, bpl
je 0x140010a5a
mov r8, qword [rsp + 0x78]
mov byte [rsp + 0x28], cl
mov rcx, qword [rsp + 0xce0]
lea rax, [rsp + 0x78]
mov r9d, esi
mov qword [rsp + 0x20], rax
call fcn.14005e494
jmp 0x140010a6f
mov r8, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0xce0]
call fcn.14004b578
lea rcx, [rsp + 0x2c8]
call fcn.140044f24
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0xd8], eax
lea rdx, [0x1400d7040]
lea rcx, [rsp + 0x7f0]
mov r8d, eax
mov word [rsp + 0x7f0], bp
call qword [sym.imp.USER32.dll_wsprintfW]
mov rsi, qword [rsp + 0xce0]
lea r8, [rsp + 0x7f0]
lea rdx, [0x1400d7020]
mov rcx, rsi
call fcn.14004b578
cmp rdi, rbp
je 0x140010adc
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea rcx, [rsp + 0x78]
call fcn.140044f24
mov rbx, qword [rsp + 0x260]
jmp 0x140010b0c
mov rdx, qword [rsp + 0xe0]
cmp word [rdx], bp
je 0x140010b0c
lea r8, [0x1400d63f4]
mov rcx, rsi
call fcn.14004b578
lea rax, [rsp + 0x310]
cmp qword [rax], rbp
je 0x140010b2a
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x310]
mov qword [rax], rbp
cmp byte [rsp + 0x71], bpl
je 0x140010ceb
cmp dword [rax + 0x10], ebp
je 0x140010ceb
cmp byte [0x1400f19cb], bpl
jne 0x140010ceb
mov eax, 1
mov byte [0x1400f19cb], al
cmp dword [rsp + 0x74], ebp
jne 0x140010cbd
lea rcx, [rsp + 0x1d8]
mov edx, 0x1000
call fcn.14004bedc
mov rax, qword [rsp + 0x1d8]
mov dword [rsp + 0x80], ebp
mov word [rax], bp
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x1d8]
lea r8, str.SystemStartOptions
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.140050ee8
mov r11, qword [rsp + 0x1d8]
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x220], r11
call fcn.140044ef4
jmp 0x140010c20
lea rcx, str.PECMDHB
mov r8d, 8
mov rdx, r11
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
je 0x140010c30
mov rdx, qword [rsp + 0x220]
lea rcx, str.WIMHB
mov r8d, 6
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
je 0x140010c30
lea rcx, [rsp + 0x220]
call fcn.140005b98
mov r11, qword [rsp + 0x220]
cmp word [r11], bp
jne 0x140010bda
jmp 0x140010c38
mov dword [rsp + 0x74], 1
lea rcx, [rsp + 0x1d8]
call fcn.140044f24
cmp dword [rsp + 0x74], ebp
jne 0x140010cbd
lea rax, [rsp + 0x310]
lea rdx, str.__nfb__incmd_pecmd_TEAM_WAIT__InitSys__ncd__lu
lea rcx, [rsp + 0x9d0]
mov r8d, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x9d0]
lea rdx, str.DELAY_bwinpeshl____s__r_n
mov rcx, rsi
call fcn.140012fac
lea rax, [0x1400f18e8]
lea r9, [rsp + 0xdc]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x9d0]
mov r8, rsi
mov rcx, rsi
mov qword [rsp + 0x28], rbp
mov word [rsp + 0xdc], bp
mov dword [rsp + 0x20], ebp
call fcn.14000a168
jmp 0x140010ce3
lea rcx, str.SysStartuped
call fcn.140015658
cmp eax, ebp
jne 0x140010cdc
lea rdx, str.exec
mov rcx, rsi
call fcn.140015790
xor ecx, ecx
call fcn.1400282b4
lea rax, [rsp + 0x310]
mov rcx, qword [rsp + 0x128]
cmp rcx, rbp
je 0x140010d05
cmp word [rcx], bp
je 0x140010d05
mov edx, dword [rax + 0x10]
call fcn.14000365c
lea rax, [rsp + 0x180]
cmp qword [rax], rbp
je 0x140010d23
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x180]
mov qword [rax], rbp
lea rax, [rsp + 0x1d0]
cmp qword [rax], rbp
je 0x140010d44
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x1d0]
mov qword [rax], rbp
lea rax, [rsp + 0x200]
cmp qword [rax], rbp
je 0x140010d64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x200]
mov qword [rax], rbp
lea rax, [rsp + 0x238]
cmp qword [rax], rbp
je 0x140010d85
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x238]
mov qword [rax], rbp
lea rax, [rsp + 0x228]
cmp qword [rax], rbp
je 0x140010da6
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x228]
mov qword [rax], rbp
lea rax, [rsp + 0x308]
cmp qword [rax], rbp
je 0x140010dc7
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x308]
mov rcx, qword [rsp + 0x460]
mov qword [rax], rbp
cmp rcx, rbp
je 0x140010ddd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x310]
mov rcx, qword [rax + 8]
cmp rcx, rbp
je 0x140010dfc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x310]
xor edx, edx
mov rcx, rsi
mov qword [rax + 8], rbp
call fcn.1400620e4
lea rcx, [rsp + 0x2a8]
call fcn.140044f24
lea rcx, [rsp + 0x1a0]
call fcn.140044f24
cmp rbx, rbp
je 0x140010e38
cmp rbx, 0xffffffffffffffff
je 0x140010e38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1b8]
call fcn.140044f24
mov rcx, qword [rsp + 0xd0]
cmp rcx, rbp
je 0x140010e5e
cmp rcx, 0xffffffffffffffff
je 0x140010e5e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xd0], rbp
cmp rcx, rbp
je 0x140010e7f
cmp rcx, 0xffffffffffffffff
je 0x140010e7f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x200]
mov qword [rsp + 0xb8], rbp
cmp rcx, rbp
je 0x140010ea0
cmp rcx, 0xffffffffffffffff
je 0x140010ea0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1d0]
cmp rcx, rbp
je 0x140010eb9
cmp rcx, 0xffffffffffffffff
je 0x140010eb9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x180]
cmp rcx, rbp
je 0x140010ed2
cmp rcx, 0xffffffffffffffff
je 0x140010ed2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x308]
cmp rcx, rbp
je 0x140010eeb
cmp rcx, 0xffffffffffffffff
je 0x140010eeb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x238]
cmp rcx, rbp
je 0x140010f04
cmp rcx, 0xffffffffffffffff
je 0x140010f04
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x228]
cmp rcx, rbp
je 0x140010f1d
cmp rcx, 0xffffffffffffffff
je 0x140010f1d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x128]
call fcn.140044f24
lea rcx, [rsp + 0x288]
call fcn.140044f24
lea rcx, [rsp + 0x188]
call fcn.140044f24
lea rcx, [rsp + 0x120]
call fcn.140044f24
lea rcx, [rsp + 0x1b0]
call fcn.140044f24
lea rcx, [rsp + 0x198]
call fcn.140044f24
lea rcx, [rsp + 0x1a8]
call fcn.140044f24
lea rcx, [rsp + 0x148]
call fcn.140044f24
cmp rdi, rbp
je 0x140010f99
cmp rdi, 0xffffffffffffffff
je 0x140010f99
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x440]
cmp rax, rbp
je 0x140010fb5
cmp rax, 0xffffffffffffffff
je 0x140010fb5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xe0]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.140044f24
lea rcx, [rsp + 0x140]
call fcn.140044f24
lea rcx, [rsp + 0x168]
call fcn.140044f24
lea rcx, [rsp + 0x160]
call fcn.140044f24
mov esi, dword [rsp + 0xd8]
jmp 0x140011093
lea rcx, [rsp + 0x170]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
lea rcx, [rsp + 0xe0]
call fcn.140044f24
lea rcx, [rsp + 0x150]
call fcn.140044f24
lea rcx, [rsp + 0x140]
call fcn.140044f24
lea rcx, [rsp + 0x168]
call fcn.140044f24
lea rcx, [rsp + 0x160]
call fcn.140044f24
mov esi, 1
lea rcx, [rsp + 0x3b8]
call fcn.140044f24
lea rcx, [rsp + 0x340]
call fcn.140044f24
mov eax, esi
add rsp, 0xcb8
pop rdi
pop rsi
pop rbp
pop rbx
ret