Function at 0x1400e3cd0
Capabilities:
Create process on windows
Encode data using base64
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x678
movdqa xmmword [rsp + 0x660], xmm6
mov rbx, rcx
mov dword [rsp + 0x200], 3
movzx eax, byte [rdx + 0x68]
test al, al
sete cl
mov qword [rsp + 0x140], rdx
mov r8, qword [rdx + 0x60]
test r8, r8
sete dl
and dl, cl
mov byte [rsp + 0x198], dl
je 0x1400e3d27
xor esi, esi
jmp 0x1400e4bb2
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x1c8], 0
mov qword [rsp + 0x1d8], 0
test al, al
je 0x1400e3d62
mov rax, qword [rsp + 0x140]
mov rax, qword [rax + 0x50]
test rax, rax
jne 0x1400e3fbd
jmp 0x1400e49ef
mov qword [rsp + 0x60], r8
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x1400e861b
mov qword [rsp + 0x148], rax
cmp word [rax], 0
je 0x1400e3f96
lea rbx, [rsp + 0x240]
lea r12, [rsp + 0x90]
lea r15, [rsp + 0x220]
mov rsi, qword [rsp + 0x148]
jmp 0x1400e3dba
cmp word [rsi], 0
je 0x1400e3f96
mov rdi, rsi
mov rcx, 0xfffffffffffffffe
xor edx, edx
nop word cs:[rax + rax]
mov rbp, rdx
mov rax, rcx
inc rdx
add rcx, 2
cmp word [rdi + rbp*2], 0
jne 0x1400e3dd0
lea rsi, [rdi + rdx*2]
cmp rbp, 1
je 0x1400e3db0
test rbp, rbp
je 0x1400e8816
xor r14d, r14d
nop word [rax + rax]
cmp word [rdi + r14*2 + 2], 0x3d
je 0x1400e3e20
inc r14
add rax, 0xfffffffffffffffe
jne 0x1400e3e00
jmp 0x1400e3db0
cmp r14, rbp
jae 0x1400e8816
lea r8, [r14 + 1]
mov rcx, r12
mov rdx, rdi
call fcn.1400ef8f0
add r14, 2
sub rbp, r14
jb 0x1400e8816
lea rdx, [rdi + r14*2]
mov rcx, rbx
mov r8, rbp
call fcn.1400ef8f0
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x230], xmm1
movaps xmmword [rsp + 0x220], xmm0
mov rdi, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x230]
movzx r13d, byte [rsp + 0x238]
movups xmm0, xmmword [rbx - 7]
movups xmm1, xmmword [rbx + 9]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm1
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0xef], rax
cmp r13b, 2
je 0x1400e3f96
lea rax, [rsp + 0xd7]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x160], xmm1
movdqa xmmword [rsp + 0x150], xmm0
lea rax, [rdi + rbp]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rax
mov word [rsp + 0xa0], 0
mov rcx, r15
mov rdx, r12
call fcn.1400ed0e0
mov qword [rsp + 0x238], rdi
mov qword [rsp + 0x240], r14
mov qword [rsp + 0x248], rbp
mov byte [rsp + 0x250], r13b
mov eax, dword [rsp + 0xd0]
mov ecx, dword [rsp + 0xd3]
mov dword [rbx + 0x14], ecx
mov dword [rbx + 0x11], eax
mov rcx, r12
lea rdx, [rsp + 0x1c8]
mov r8, r15
lea r9, [rsp + 0x150]
call fcn.1400e0940
cmp byte [rsp + 0xa8], 2
je 0x1400e3db0
cmp qword [rsp + 0x98], 0
je 0x1400e3db0
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1400e3db0
mov rcx, qword [rsp + 0x148]
call sub.KERNEL32.dll_FreeEnvironmentStringsW
mov r8, qword [rsp + 0x60]
mov rax, qword [rsp + 0x140]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x1400e49ef
test r8, r8
je 0x1400e49ef
mov rcx, qword [rsp + 0x140]
mov r9, qword [rcx + 0x58]
xor ebx, ebx
jmp 0x1400e4011
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov eax, 0
mov r8, qword [rsp + 0x60]
dec r8
mov r9, qword [rsp + 0x148]
je 0x1400e49ef
test rbx, rbx
jne 0x1400e40b3
test r9, r9
je 0x1400e4054
mov rdx, r9
and rdx, 7
je 0x1400e4059
mov rcx, r9
and rcx, 0xfffffffffffffff8
mov rbx, rax
nop word cs:[rax + rax]
mov rbx, qword [rbx + 0x3d8]
dec rdx
jne 0x1400e4040
cmp r9, 8
jae 0x1400e4070
jmp 0x1400e40ae
mov rbx, rax
jmp 0x1400e40ae
mov rbx, rax
mov rcx, r9
cmp r9, 8
jb 0x1400e40ae
nop word cs:[rax + rax]
mov rax, qword [rbx + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rbx, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1400e4070
xor r9d, r9d
xor eax, eax
movzx ecx, word [rbx + 0x3d2]
mov rbp, rbx
mov r14, r9
cmp r9, rcx
jb 0x1400e40f8
nop word cs:[rax + rax]
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400e8816
inc rax
movzx r14d, word [rbp + 0x3d0]
mov rbp, rcx
cmp r14w, word [rcx + 0x3d2]
jae 0x1400e40d0
test rax, rax
mov qword [rsp + 0x60], r8
je 0x1400e41a0
mov rbx, qword [rbp + r14*8 + 0x3e0]
mov rcx, rax
dec rcx
je 0x1400e418e
mov rdx, rcx
and rdx, 7
je 0x1400e4145
mov rcx, rdx
nop word cs:[rax + rax]
mov rbx, qword [rbx + 0x3d8]
dec rcx
jne 0x1400e4130
not rdx
add rdx, rax
mov rcx, rdx
add rax, 0xfffffffffffffffe
cmp rax, 7
jb 0x1400e418e
nop
mov rax, qword [rbx + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rbx, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1400e4150
xor r13d, r13d
jmp 0x1400e41a7
lea r13, [r14 + 1]
mov rbx, rbp
imul rax, r14, 0x38
lea r15, [rax + rbp]
add r15, 0x168
shl r14, 5
cmp byte [rbp + r14 + 0x18], 2
mov qword [rsp + 0x148], r13
jne 0x1400e42c0
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400e3ff6
mov rax, qword [rsp + 0x1d0]
mov r12, qword [r15]
mov edi, dword [r15 + 0x10]
lea ecx, [rax + 7]
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x88], rax
mov r15, qword [rsp + 0x70]
lea rcx, [r15 + 0x168]
movzx r13d, word [r15 + 0x3d2]
imul rbp, r13, 0x38
mov rsi, 0xffffffffffffffff
nop dword [rax]
test rbp, rbp
je 0x1400e4280
lea r14, [rcx + 0x38]
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x10]
mov dword [rsp + 0x20], 1
mov rcx, r12
mov edx, edi
call sub.KERNEL32.dll_CompareStringOrdinal
inc rsi
add rbp, 0xffffffffffffffc8
mov rcx, r14
cmp eax, 3
je 0x1400e4230
cmp eax, 1
jne 0x1400e4320
mov rax, qword [rsp + 0x88]
test rax, rax
jne 0x1400e4294
jmp 0x1400e3ff6
mov rsi, r13
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x1400e3ff6
mov r15, qword [r15 + rsi*8 + 0x3d8]
dec rax
mov qword [rsp + 0x88], rax
mov eax, dword [rsp + 0x58]
add al, 7
mov dword [rsp + 0x58], eax
jmp 0x1400e420f
mov rdi, qword [r15 + 0x18]
mov rsi, qword [r15 + 0x28]
test rsi, rsi
je 0x1400e451c
js 0x1400e8816
movzx eax, byte [0x1401a4170]
mov rax, qword [0x1401a4160]
test rax, rax
jne 0x1400e42ff
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov qword [0x1401a4160], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapAlloc
mov r12, rax
test rax, rax
jne 0x1400e4522
jmp 0x1400e8816
cmp eax, 2
mov r9, qword [rsp + 0x88]
jne 0x1400e861b
mov byte [rsp + 0x6f], 0
test r9, r9
je 0x1400e46d2
mov rax, qword [r15 + rsi*8 + 0x3d8]
mov rcx, r9
dec rcx
je 0x1400e441e
test cl, 7
je 0x1400e4396
movzx ecx, byte [rsp + 0x58]
and ecx, 7
neg rcx
mov edx, 1
nop dword [rax + rax]
movzx r8d, word [rax + 0x3d2]
mov rax, qword [rax + r8*8 + 0x3d8]
lea r8, [rcx + rdx]
inc r8
inc rdx
cmp r8, 1
jne 0x1400e4370
mov rcx, r9
sub rcx, rdx
add r9, 0xfffffffffffffffe
cmp r9, 7
jb 0x1400e441e
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1400e43a0
movzx ecx, word [rax + 0x3d2]
dec rcx
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], 0
mov qword [rsp + 0x1f0], rcx
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0x1e0]
lea r8, [rsp + 0x6f]
call fcn.1400ddc50
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x220]
movups xmm1, xmmword [rsp + 0x230]
movdqu xmm2, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0xb0], xmm2
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
lea rax, [rsp + 0x258]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmmword [rsp + 0x180], xmm1
mov r8, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x288]
movzx r9d, word [r8 + 0x3d2]
mov rax, r8
cmp rdx, r9
jb 0x1400e471d
nop
mov rax, qword [r8 + 0x160]
test rax, rax
je 0x1400e4715
inc rcx
movzx edx, word [r8 + 0x3d0]
mov r8, rax
cmp dx, word [rax + 0x3d2]
jae 0x1400e44f0
jmp 0x1400e471d
mov r12d, 1
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
movzx ecx, byte [r15 + 0x30]
mov rdx, qword [r15]
mov r15, qword [r15 + 0x10]
mov r13d, 2
test r15, r15
mov byte [rsp + 0x88], cl
je 0x1400e45b0
mov rax, r15
shr rax, 0x3e
jne 0x1400e8816
mov rdi, r15
add rdi, r15
je 0x1400e45b0
movzx eax, byte [0x1401a4170]
mov rax, qword [0x1401a4160]
test rax, rax
mov qword [rsp + 0x58], rdx
jne 0x1400e4590
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov qword [0x1401a4160], rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapAlloc
mov r13, rax
test rax, rax
mov rdx, qword [rsp + 0x58]
jne 0x1400e45b2
jmp 0x1400e8816
xor edi, edi
add rbp, r14
mov rcx, r13
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x228], r15
mov qword [rsp + 0x230], r15
mov qword [rsp + 0x238], r12
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], rsi
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x250], al
mov rdi, qword [rbp]
mov rsi, qword [rbp + 0x10]
test rsi, rsi
je 0x1400e4654
js 0x1400e8816
movzx eax, byte [0x1401a4170]
mov rax, qword [0x1401a4160]
test rax, rax
jne 0x1400e463a
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov qword [0x1401a4160], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapAlloc
mov r15, rax
test rax, rax
jne 0x1400e465a
jmp 0x1400e8816
mov r15d, 1
mov rcx, r15
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], rsi
movzx eax, byte [rbp + 0x18]
mov byte [rsp + 0xe8], al
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x1c8]
lea r8, [rsp + 0x220]
lea r9, [rsp + 0xd0]
call fcn.1400e0940
cmp byte [rsp + 0xa8], 2
je 0x1400e3ff6
cmp qword [rsp + 0x98], 0
jne 0x1400e3fe0
jmp 0x1400e3ff6
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], rsi
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0xd0]
lea r8, [rsp + 0x6f]
call fcn.1400ddc50
mov r9, qword [rsp + 0xc8]
jmp 0x1400e48f8
mov rdx, rcx
mov rcx, r8
xor eax, eax
imul r8, rdx, 0x38
mov r9, rdx
shl r9, 5
mov r10, qword [rax + r8 + 0x198]
mov qword [rsp + 0x100], r10
movups xmm0, xmmword [rax + r8 + 0x168]
movups xmm1, xmmword [rax + r8 + 0x178]
movups xmm2, xmmword [rax + r8 + 0x188]
movaps xmmword [rsp + 0xf0], xmm2
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xd0], xmm0
mov r10, qword [rsp + 0xc0]
mov qword [rax + r8 + 0x198], r10
movaps xmm0, xmmword [rsp + 0x90]
movaps xmm1, xmmword [rsp + 0xa0]
movdqa xmm2, xmmword [rsp + 0xb0]
movdqu xmmword [rax + r8 + 0x188], xmm2
movups xmmword [rax + r8 + 0x178], xmm1
movups xmmword [rax + r8 + 0x168], xmm0
movups xmm0, xmmword [rax + r9]
movups xmm1, xmmword [rax + r9 + 0x10]
lea r8, [rsp + 0x108]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
movdqa xmm0, xmmword [rsp + 0x170]
movdqa xmm1, xmmword [rsp + 0x180]
movdqu xmmword [rax + r9], xmm0
movdqu xmmword [rax + r9 + 0x10], xmm1
test rcx, rcx
je 0x1400e4880
mov rax, qword [rax + rdx*8 + 0x3e0]
mov rdx, rcx
dec rdx
mov r9, qword [rsp + 0xc8]
je 0x1400e4888
mov r8, rdx
and r8, 7
je 0x1400e4835
mov rdx, r8
nop dword [rax + rax]
mov rax, qword [rax + 0x3d8]
dec rdx
jne 0x1400e4820
not r8
add r8, rcx
mov rdx, r8
add rcx, 0xfffffffffffffffe
cmp rcx, 7
jb 0x1400e4888
nop
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
add rdx, 0xfffffffffffffff8
jne 0x1400e4840
jmp 0x1400e4888
mov r9, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x270], rcx
movaps xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x260], xmm0
movdqa xmm0, xmmword [rsp + 0xd0]
movdqa xmm1, xmmword [rsp + 0xe0]
movdqa xmm2, xmmword [rsp + 0xf0]
movdqa xmm3, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x250], xmm3
movdqa xmmword [rsp + 0x240], xmm2
movdqa xmmword [rsp + 0x230], xmm1
movdqa xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x278], rax
mov r12, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov r15, qword [rsp + 0x238]
mov r13, qword [rsp + 0x240]
movzx edi, byte [rsp + 0x250]
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x88], rax
dec qword [rsp + 0x1d8]
mov rsi, qword [rsp + 0x260]
movzx ebp, byte [rsp + 0x270]
cmp byte [rsp + 0x6f], 0
je 0x1400e4990
test r9, r9
je 0x1400e8816
mov r8, qword [rsp + 0x70]
mov rax, qword [r8 + 0x3d8]
mov qword [rsp + 0x1c8], rax
dec r9
mov qword [rsp + 0x1d0], r9
mov qword [rax + 0x160], 0
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp dil, 2
je 0x1400e3ff6
test r13, r13
je 0x1400e49b0
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
test r14, r14
je 0x1400e49c6
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
cmp bpl, 2
je 0x1400e3ff6
test rsi, rsi
je 0x1400e3ff6
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x88]
jmp 0x1400e3ff1
mov r14, qword [rsp + 0x1c8]
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x88], rax
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400e4a42
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 4
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400e8816
mov r15, rax
mov dword [rax], 0x48544150
add rax, 4
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], rax
mov word [rsp + 0xe0], 0
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0xd0]
call fcn.1400ed0e0
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], 4
mov qword [rsp + 0x248], 4
mov byte [rsp + 0x250], 0
test r14, r14
mov qword [rsp + 0x60], r14
je 0x1400e4b79
mov qword [rsp + 0x58], r15
mov rdi, qword [rsp + 0x220]
mov ebx, dword [rsp + 0x230]
mov r15, qword [rsp + 0x148]
lea rcx, [r14 + 0x168]
movzx ebp, word [r14 + 0x3d2]
imul r12, rbp, 0x38
mov r13, 0xffffffffffffffff
test r12, r12
je 0x1400e4b40
lea rsi, [rcx + 0x38]
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x10]
mov dword [rsp + 0x20], 1
mov rcx, rdi
mov edx, ebx
call sub.KERNEL32.dll_CompareStringOrdinal
inc r13
add r12, 0xffffffffffffffc8
mov rcx, rsi
cmp eax, 3
je 0x1400e4b00
cmp eax, 1
jne 0x1400e4b57
jmp 0x1400e4b43
mov r13, rbp
sub r15, 1
jb 0x1400e5578
mov r14, qword [r14 + r13*8 + 0x3d8]
jmp 0x1400e4ae6
cmp eax, 2
jne 0x1400e861b
shl r13, 5
mov rsi, qword [r14 + r13]
mov rdi, qword [r14 + r13 + 0x10]
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x58]
jmp 0x1400e4b80
xor esi, esi
mov rbx, qword [rsp + 0x78]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x228], 0
je 0x1400e4bb2
mov r8, qword [rsp + 0x220]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x140]
mov r14, qword [rax + 0x40]
lea rbp, str.program_path_has_no_file_name
test r14, r14
je 0x1400e4c12
mov r12, qword [rax + 0x30]
cmp r14, 4
jae 0x1400e4bec
lea rax, [0x1400efda0]
movzx ecx, byte [r14 + r12 - 1]
call rax
test al, al
jne 0x1400e4c12
jmp 0x1400e4c85
cmp dword [r12], 0x5c3f5c5c
lea rcx, [0x1400efdb0]
lea rax, [0x1400efda0]
cmove rax, rcx
movzx ecx, byte [r14 + r12 - 1]
call rax
test al, al
je 0x1400e4c85
mov r14, qword [rsp + 0x60]
movq xmm6, rbp
cmp byte [rsp + 0x198], 0
jne 0x1400e4db2
test r14, r14
je 0x1400e4d89
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x230], r14
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], r14
mov qword [rsp + 0x258], rax
mov eax, 1
mov rcx, qword [rsp + 0x88]
jmp 0x1400e4d8d
cmp r14, 3
jbe 0x1400e51b8
movzx eax, byte [r14 + r12 - 4]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x2e
jne 0x1400e5222
movzx eax, byte [r12 + r14 - 3]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
mov al, 1
cmp cl, 0x65
jne 0x1400e4cfa
movzx ecx, byte [r12 + r14 - 2]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x1400e4cfa
movzx eax, byte [r12 + r14 - 1]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x65
setne al
xor ecx, ecx
nop dword [rax]
cmp r14, rcx
je 0x1400e538a
movzx edx, byte [r12 + rcx]
cmp edx, 0x2f
je 0x1400e4d1b
inc rcx
cmp edx, 0x5c
jne 0x1400e4d00
test al, al
jne 0x1400e524b
lea rcx, [rsp + 0xd0]
mov rdx, r12
mov r8, r14
call fcn.1400e0020
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xd8]
test rcx, rcx
je 0x1400e5de0
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x220], rcx
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], rdx
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x220]
call fcn.1400ec660
jmp 0x1400e5df4
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x260], rcx
lea rcx, [rsp + 0x220]
call fcn.1400e1c40
cmp dword [rsp + 0x200], 3
ja 0x1400e4dc6
movq rdi, xmm6
jmp 0x1400e5dba
mov r14d, 2
mov rcx, qword [rsp + 0x208]
call sub.KERNEL32.dll_CloseHandle
movq rdi, xmm6
cmp r14, 2
je 0x1400e5dba
test r14, r14
je 0x1400e4df5
mov rcx, r12
call sub.KERNEL32.dll_CloseHandle
mov qword [rsp + 0x170], 1
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
mov qword [rsp + 0x90], 1
movdqu xmmword [rsp + 0x98], xmm0
test r13, r13
je 0x1400e51dd
test rbp, rbp
je 0x1400e54a2
mov rbp, rbx
xor ecx, ecx
mov edx, 1
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateEventW
test rax, rax
je 0x1400e8801
mov rbx, rax
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400e4e84
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x20
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400e8816
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], rbx
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xf8], rbx
xor ecx, ecx
mov edx, 1
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateEventW
test rax, rax
je 0x1400e54e3
mov r14, rax
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400e4f2e
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x20
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400e8816
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], r14
mov qword [rsp + 0x220], 0
mov qword [rsp + 0x230], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], r14
lea rsi, [rsp + 0x1e0]
lea rbx, [rsp + 0x150]
lea r14, [rsp + 0x220]
movabs r13, 0x6d00000000
lea r15, [rsp + 0xd0]
nop word cs:[rax + rax]
mov ecx, 2
mov rdx, rsi
xor r8d, r8d
mov r9d, 0xffffffff
call sub.KERNEL32.dll_WaitForMultipleObjects
cmp eax, 1
je 0x1400e5050
test eax, eax
jne 0x1400e5bb1
mov rax, qword [rsp + 0xd0]
test rax, rax
je 0x1400e50cd
cmp eax, 1
jne 0x1400e50a4
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xf0]
mov dword [rsp + 0x150], 0
mov r8, rbx
mov r9d, 1
call sub.KERNEL32.dll_GetOverlappedResult
test eax, eax
je 0x1400e514e
mov eax, dword [rsp + 0x150]
jmp 0x1400e50ac
mov rax, qword [rsp + 0x220]
test rax, rax
je 0x1400e5122
cmp eax, 1
jne 0x1400e50f9
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x240]
mov dword [rsp + 0x150], 0
mov r8, rbx
mov r9d, 1
call sub.KERNEL32.dll_GetOverlappedResult
test eax, eax
je 0x1400e517c
mov eax, dword [rsp + 0x150]
jmp 0x1400e5101
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xd0], 0
mov rcx, qword [rsp + 0xe8]
add qword [rcx + 0x10], rax
test rax, rax
je 0x1400e558e
mov rcx, rbx
mov rdx, r15
call fcn.1400e96e0
cmp byte [rsp + 0x150], 0
jne 0x1400e5739
cmp byte [rsp + 0x151], 0
jne 0x1400e4fd0
jmp 0x1400e558e
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x220], 0
mov rcx, qword [rsp + 0x238]
add qword [rcx + 0x10], rax
test rax, rax
je 0x1400e5669
mov rcx, rbx
mov rdx, r14
call fcn.1400e96e0
cmp byte [rsp + 0x150], 0
jne 0x1400e5739
cmp byte [rsp + 0x151], 0
jne 0x1400e4fd0
jmp 0x1400e5669
call sub.KERNEL32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
cmp r12, r13
je 0x1400e51aa
mov eax, 0
movabs rcx, 0x2600000000
cmp r12, rcx
je 0x1400e50ac
jmp 0x1400e5bbd
call sub.KERNEL32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
cmp r12, r13
je 0x1400e51b1
mov eax, 0
movabs rcx, 0x2600000000
cmp r12, rcx
je 0x1400e5101
jmp 0x1400e5bbd
xor eax, eax
jmp 0x1400e50ac
xor eax, eax
jmp 0x1400e5101
xor eax, eax
nop word [rax + rax]
cmp r14, rax
je 0x1400e538a
movzx ecx, byte [r12 + rax]
cmp ecx, 0x2f
je 0x1400e524b
inc rax
cmp ecx, 0x5c
jne 0x1400e51c0
jmp 0x1400e524b
test rbp, rbp
je 0x1400e5c47
mov qword [rsp + 0x220], rsi
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x220]
lea r8, [rsp + 0x90]
call fcn.1400eb600
cmp qword [rsp + 0xd0], 0
jne 0x1400e8816
mov rcx, rsi
jmp 0x1400e54d9
xor eax, eax
nop word cs:[rax + rax]
cmp r14, rax
je 0x1400e538a
movzx ecx, byte [r12 + rax]
cmp ecx, 0x2f
je 0x1400e524b
inc rax
cmp ecx, 0x5c
jne 0x1400e5230
test r14, r14
js 0x1400e8816
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400e527f
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov rcx, rax
mov qword [0x1401a4160], rax
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400e8816
mov rsi, rax
mov r15, rbx
mov rcx, rax
mov rdx, r12
mov r8, r14
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x220], rsi
mov qword [rsp + 0x228], r14
mov qword [rsp + 0x230], r14
mov byte [rsp + 0x238], 0
mov eax, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x93]
mov dword [rsp + 0x239], eax
mov dword [rsp + 0x23c], ecx
lea rdx, [0x140172603]
lea rcx, [rsp + 0x220]
mov r8d, 4
call fcn.1400ec730
mov rsi, qword [rsp + 0x220]
mov rdi, qword [rsp + 0x228]
mov rbx, qword [rsp + 0x230]
mov eax, dword [rsp + 0x239]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x23c]
mov dword [rsp + 0x93], eax
lea rcx, [rsp + 0xd0]
mov rdx, rsi
mov r8, rbx
call fcn.1400e1b10
cmp qword [rsp + 0xd0], 0
je 0x1400e546b
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x160], rax
movdqu xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0x150], xmm0
mov rbx, r15
mov r14, qword [rsp + 0x60]
test rdi, rdi
jne 0x1400e6359
jmp 0x1400e636a
lea rax, [r12 + r14]
xor r9d, r9d
lea rbp, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_found_a
mov rcx, r12
jmp 0x1400e53ac
xor r9d, r9d
test dx, dx
je 0x1400e4c12
mov dx, 1
test r9w, r9w
jne 0x1400e53a0
cmp rcx, rax
je 0x1400e5546
movzx r9d, byte [rcx]
test r9b, r9b
js 0x1400e53d3
inc rcx
mov r8d, r9d
jmp 0x1400e5460
mov r8d, r9d
and r8d, 0x1f
movzx r11d, byte [rcx + 1]
and r11d, 0x3f
cmp r9b, 0xdf
jbe 0x1400e5429
movzx r10d, byte [rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r9b, 0xf0
jb 0x1400e5436
movzx r9d, byte [rcx + 3]
add rcx, 4
and r8d, 7
shl r8d, 0x12
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
or r8d, r9d
cmp r8d, 0xffff
ja 0x1400e544a
jmp 0x1400e5460
add rcx, 2
shl r8d, 6
or r8d, r11d
jmp 0x1400e5460
add rcx, 3
shl r8d, 0xc
or r8d, r10d
cmp r8d, 0xffff
jbe 0x1400e5460
and r8d, 0x3ff
or r8d, 0xdc00
mov r9d, r8d
jmp 0x1400e53a3
xor r9d, r9d
mov edx, r8d
jmp 0x1400e53a3
mov rcx, rsi
mov rdx, rbx
call fcn.1400ef260
test rax, rax
mov r14, qword [rsp + 0x60]
je 0x1400e62f0
cmp rdx, 2
jne 0x1400e5500
movzx ecx, word [rax]
cmp ecx, 0x2e2e
jne 0x1400e5500
mov ecx, 2
xor r8d, r8d
jmp 0x1400e62d0
mov qword [rsp + 0x220], r15
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x220]
lea r8, [rsp + 0x170]
call fcn.1400eb600
cmp qword [rsp + 0xd0], 0
jne 0x1400e8816
mov rcx, r15
call sub.KERNEL32.dll_CloseHandle
jmp 0x1400e5c47
call sub.KERNEL32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
or r12, 2
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
jmp 0x1400e5bfe
mov rcx, rdx
nop word cs:[rax + rax]
test rcx, rcx
je 0x1400e5584
mov r9, rcx
dec rcx
cmp byte [rax + r9 - 1], 0x2e
jne 0x1400e5510
mov r10, rdx
sub r10, r9
jb 0x1400e8816
test rcx, rcx
je 0x1400e62ca
mov r8, rax
add r8, r9
mov rdx, r10
jmp 0x1400e62d0
cmp r14, 0xf
mov qword [rsp + 0x78], rbx
ja 0x1400e574e
xor eax, eax
nop word [rax + rax]
cmp byte [r12 + rax], 0x2e
je 0x1400e57fb
inc rax
cmp r14, rax
jne 0x1400e5560
jmp 0x1400e57ee
mov rbx, qword [rsp + 0x78]
xor esi, esi
jmp 0x1400e4b72
mov r8, rax
xor eax, eax
jmp 0x1400e62d0
lea rsi, [rsp + 0x150]
lea rbx, [rsp + 0x220]
mov rax, qword [rsp + 0x220]
test rax, rax
je 0x1400e560f
cmp eax, 1
jne 0x1400e55e6
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x240]
mov dword [rsp + 0x150], 0
mov r8, rsi
mov r9d, 1
call sub.KERNEL32.dll_GetOverlappedResult
test eax, eax
je 0x1400e563b
mov eax, dword [rsp + 0x150]
jmp 0x1400e55ee
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x220], 0
mov rcx, qword [rsp + 0x238]
add qword [rcx + 0x10], rax
test rax, rax
je 0x1400e5746
mov rcx, rsi
mov rdx, rbx
call fcn.1400e96e0
cmp byte [rsp + 0x150], 0
jne 0x1400e5739
cmp byte [rsp + 0x151], 0
jne 0x1400e559e
jmp 0x1400e5746
call sub.KERNEL32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
cmp r12, r13
je 0x1400e5665
mov eax, 0
movabs rcx, 0x2600000000
cmp r12, rcx
je 0x1400e55ee
jmp 0x1400e5bbd
xor eax, eax
jmp 0x1400e55ee
lea rsi, [rsp + 0x150]
lea rbx, [rsp + 0xd0]
mov rax, qword [rsp + 0xd0]
test rax, rax
je 0x1400e56e6
cmp eax, 1
jne 0x1400e56c1
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xf0]
mov dword [rsp + 0x150], 0
mov r8, rsi
mov r9d, 1
call sub.KERNEL32.dll_GetOverlappedResult
test eax, eax
je 0x1400e570b
mov eax, dword [rsp + 0x150]
jmp 0x1400e56c9
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xd0], 0
mov rcx, qword [rsp + 0xe8]
add qword [rcx + 0x10], rax
test rax, rax
je 0x1400e5746
mov rcx, rsi
mov rdx, rbx
call fcn.1400e96e0
cmp byte [rsp + 0x150], 0
jne 0x1400e5739
cmp byte [rsp + 0x151], 0
jne 0x1400e5679
jmp 0x1400e5746
call sub.KERNEL32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
cmp r12, r13
je 0x1400e5735
mov eax, 0
movabs rcx, 0x2600000000
cmp r12, rcx
je 0x1400e56c9
jmp 0x1400e5bbd
xor eax, eax
jmp 0x1400e56c9
mov r12, qword [rsp + 0x158]
jmp 0x1400e5bc1
xor r12d, r12d
jmp 0x1400e5bc1
lea rax, [r12 + 7]
and rax, 0xfffffffffffffff8
sub rax, r12
je 0x1400e5788
cmp rax, r14
cmovae rax, r14
test rax, rax
je 0x1400e5788
xor ecx, ecx
cmp byte [r12 + rcx], 0x2e
je 0x1400e57fb
inc rcx
cmp rax, rcx
jne 0x1400e576a
lea rcx, [r14 - 0x10]
cmp rax, rcx
jbe 0x1400e578e
jmp 0x1400e57da
lea rcx, [r14 - 0x10]
xor eax, eax
movabs rdx, 0x8080808080808080
movdqa xmm0, xmmword [str.................]
movdqa xmm1, xmmword [0x1401281c0]
movdqu xmm2, xmmword [r12 + rax]
movdqa xmm3, xmm2
pxor xmm3, xmm0
paddq xmm3, xmm1
pandn xmm2, xmm3
pshufd xmm3, xmm2, 0xee
por xmm3, xmm2
movq r8, xmm3
test r8, rdx
jne 0x1400e57da
add rax, 0x10
cmp rax, rcx
jbe 0x1400e57a8
cmp rax, r14
je 0x1400e57ee
cmp byte [r12 + rax], 0x2e
je 0x1400e57fb
inc rax
cmp r14, rax
jne 0x1400e57df
mov dword [rsp + 0x80], 0
jmp 0x1400e5804
mov al, 1
mov dword [rsp + 0x80], eax
test rsi, rsi
mov qword [rsp + 0xc8], r12
je 0x1400e5863
add rdi, rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
mov word [rsp + 0xa0], 0
mov byte [rsp + 0xa8], 1
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0x90]
call fcn.1400f1920
movzx eax, byte [rsp + 0x238]
cmp al, 2
jne 0x1400e5dfe
mov r12, qword [rsp + 0xc8]
lea rcx, [rsp + 0xd0]
call fcn.1400e07b0
cmp byte [rsp + 0xe8], 2
jne 0x1400e58e8
mov rax, qword [rsp + 0xd0]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400e59d4
test rcx, rcx
je 0x1400e59d4
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400e58d2
cmp qword [rbx + 0x10], 0x11
jb 0x1400e58c1
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
jmp 0x1400e59d4
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
mov rcx, rsi
mov rdx, rdi
call fcn.1400eec00
cmp rdi, rdx
cmovb rdx, rdi
test rax, rax
cmove rdx, rdi
mov qword [rsp + 0x220], rsi
mov qword [rsp + 0x228], rbx
mov qword [rsp + 0x230], rdx
mov qword [rsp + 0x238], r15
lea rcx, [rsp + 0x220]
mov rdx, r12
mov r8, r14
call fcn.1400ee030
cmp byte [rsp + 0x80], 0
jne 0x1400e5978
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rsp + 0x220]
mov r8d, 3
call fcn.1400ef380
mov rsi, qword [rsp + 0x220]
mov r8, qword [rsp + 0x230]
lea rcx, [rsp + 0x90]
mov rdx, rsi
call fcn.1400e1b10
cmp qword [rsp + 0x228], 0
mov rbx, qword [rsp + 0x78]
je 0x1400e59b9
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov r13, qword [rsp + 0x90]
test r13, r13
je 0x1400e59d4
movdqu xmm0, xmmword [rsp + 0x98]
jmp 0x1400e6586
mov qword [rsp + 0x170], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov esi, 0xffffffff
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jb 0x1400e5a2f
jmp 0x1400e5a50
jae 0x1400e5b1b
cmp r8, 0x201
jae 0x1400e5a50
mov r15d, 0x200
lea rdi, [rsp + 0x220]
mov r13, r8
jmp 0x1400e5a84
sub r8, r12
sub rbx, r12
cmp rbx, r8
jb 0x1400e5aec
mov rbx, qword [rsp + 0x58]
cmp rbx, rsi
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rsp + 0x180], r12
mov r15, r12
mov rdi, qword [rsp + 0x70]
mov r13, r12
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov edx, r13d
call sub.KERNEL32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400e5aa9
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400e5f53
mov r8d, ebp
cmp r13, r8
jne 0x1400e5a20
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400e8816
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
mov esi, 0xffffffff
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jae 0x1400e5a50
jmp 0x1400e5a2f
lea rcx, [rsp + 0x170]
mov rdx, r12
call fcn.1400dc760
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
jmp 0x1400e5a5f
cmp r15, r8
jb 0x1400e8816
lea r12, [rsp + 0xd0]
mov rcx, r12
mov rdx, rdi
call fcn.1400ef8f0
mov rcx, r12
mov rdx, qword [rsp + 0xc8]
mov r8, r14
call fcn.1400ee030
cmp byte [rsp + 0x80], 0
jne 0x1400e5b6e
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rsp + 0xd0]
mov r8d, 3
call fcn.1400ef380
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0x98]
mov rdx, rdi
call fcn.1400e1b10
cmp qword [rsp + 0xd8], 0
je 0x1400e5baa
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
xor eax, eax
jmp 0x1400e5f6d
call sub.KERNEL32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
or r12, 2
lea rcx, [rsp + 0x220]
call fcn.1400e9810
mov rcx, qword [rsp + 0x240]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x248]
call sub.KERNEL32.dll_CloseHandle
mov r8, qword [rsp + 0x230]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rbx, rbp
lea rcx, [rsp + 0xd0]
call fcn.1400e9810
mov rcx, qword [rsp + 0xf0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0xf8]
call sub.KERNEL32.dll_CloseHandle
mov r8, qword [rsp + 0xe0]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
test r12, r12
jne 0x1400e8816
pshufd xmm0, xmm6, 0xee
movq rsi, xmm0
mov rcx, rdi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov r12, rbx
test eax, eax
je 0x1400e5cbe
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
cmp qword [rsp + 0x98], 0
je 0x1400e5c91
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
or rbx, 2
cmp qword [rsp + 0x178], 0
je 0x1400e5cb6
mov r8, qword [rsp + 0x170]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
xor r14d, r14d
jmp 0x1400e5d4e
mov dword [rsp + 0x220], 0
lea rdx, [rsp + 0x220]
mov rcx, rdi
call sub.KERNEL32.dll_GetExitCodeProcess
test eax, eax
je 0x1400e5c65
mov ebp, dword [rsp + 0x220]
mov r14, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x178]
mov r15, qword [rsp + 0x180]
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x224], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x234], rax
movdqu xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0x620], xmm0
mov rax, qword [rsp + 0x22c]
mov qword [rsp + 0x62c], rax
mov rax, qword [rsp + 0x234]
mov qword [rsp + 0x634], rax
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
test r14, r14
je 0x1400e5db4
movups xmm0, xmmword [rsp + 0x62c]
movups xmmword [rsp + 0x64c], xmm0
movaps xmm0, xmmword [rsp + 0x620]
movaps xmmword [rsp + 0x640], xmm0
mov rax, qword [rsp + 0x654]
mov qword [r12 + 0x28], rax
movdqu xmm0, xmmword [rsp + 0x644]
movdqu xmmword [r12 + 0x18], xmm0
mov qword [r12 + 8], rbx
mov rbx, r12
mov qword [r12 + 0x10], r15
mov dword [r12 + 0x30], ebp
jmp 0x1400e5dc1
mov rdi, rbx
mov rbx, r12
mov qword [rbx + 8], rdi
xor r14d, r14d
mov qword [rbx], r14
movaps xmm6, xmmword [rsp + 0x660]
add rsp, 0x678
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], 0
mov r14, qword [rsp + 0x60]
jmp 0x1400e636a
lea rbx, [rsp + 0xe9]
lea rbp, [rsp + 0x239]
lea rsi, [rsp + 0x220]
lea r12, [rsp + 0x90]
lea r13, [rsp + 0xd0]
lea r15, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
cmp qword [rsp + 0x230], 0
jne 0x1400e5e89
mov rcx, qword [rsp + 0x228]
test rcx, rcx
je 0x1400e5e5b
mov r8, qword [rsp + 0x220]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rcx, rsi
mov rdx, r12
call fcn.1400f1920
movzx eax, byte [rsp + 0x238]
cmp al, 2
je 0x1400e585b
mov rcx, qword [rsp + 0x228]
cmp qword [rsp + 0x230], 0
je 0x1400e5e40
mov ecx, dword [rbp]
mov edx, dword [rbp + 3]
mov dword [rbx + 3], edx
mov dword [rbx], ecx
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xe8], al
mov rcx, r13
mov rdx, qword [rsp + 0xc8]
mov r8, r14
call fcn.1400ee030
cmp byte [rsp + 0x80], 0
jne 0x1400e5eeb
mov r8d, 3
mov rcx, r13
mov rdx, r15
call fcn.1400ef380
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
mov rcx, rsi
mov rdx, rdi
call fcn.1400e1b10
cmp qword [rsp + 0xd8], 0
je 0x1400e5f22
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x220]
test rax, rax
jne 0x1400e7760
mov rcx, rsi
mov rdx, r12
call fcn.1400f1920
movzx eax, byte [rsp + 0x238]
cmp al, 2
jne 0x1400e5e2d
jmp 0x1400e585b
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x98], rax
mov eax, 1
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x58], 0
je 0x1400e5f98
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x70]
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x1400e6000
mov rax, qword [rsp + 0x98]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400e6029
test rcx, rcx
je 0x1400e6029
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400e5fed
cmp qword [rbx + 0x10], 0x11
jb 0x1400e5fdc
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
jmp 0x1400e6029
mov r13, qword [rsp + 0x98]
test r13, r13
je 0x1400e6029
movdqu xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x1e0], xmm0
mov rbx, qword [rsp + 0x78]
jmp 0x1400e658f
mov qword [rsp + 0x170], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov esi, 0xffffffff
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jb 0x1400e607f
jmp 0x1400e60a0
jae 0x1400e616b
cmp r8, 0x201
jae 0x1400e60a0
mov r15d, 0x200
lea rdi, [rsp + 0x220]
mov r13, r8
jmp 0x1400e60d4
sub r8, r12
sub rbx, r12
cmp rbx, r8
jb 0x1400e613c
mov rbx, qword [rsp + 0x58]
cmp rbx, rsi
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rsp + 0x180], r12
mov r15, r12
mov rdi, qword [rsp + 0x70]
mov r13, r12
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov edx, r13d
call sub.KERNEL32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400e60f9
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400e6203
mov r8d, ebp
cmp r13, r8
jne 0x1400e6070
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400e8816
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
mov esi, 0xffffffff
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jae 0x1400e60a0
jmp 0x1400e607f
lea rcx, [rsp + 0x170]
mov rdx, r12
call fcn.1400dc760
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
jmp 0x1400e60af
cmp r15, r8
jb 0x1400e8816
lea r12, [rsp + 0xd0]
mov rcx, r12
mov rdx, rdi
call fcn.1400ef8f0
mov rcx, r12
mov rdx, qword [rsp + 0xc8]
mov r8, r14
call fcn.1400ee030
cmp byte [rsp + 0x80], 0
mov rbx, qword [rsp + 0x78]
jne 0x1400e61c3
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rsp + 0xd0]
mov r8d, 3
call fcn.1400ef380
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0x98]
mov rdx, rdi
call fcn.1400e1b10
cmp qword [rsp + 0xd8], 0
je 0x1400e61ff
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
xor eax, eax
jmp 0x1400e6222
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x98], rax
mov eax, 1
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x58], 0
je 0x1400e624d
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x70]
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x1400e656c
mov rax, qword [rsp + 0x98]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400e7088
test rcx, rcx
je 0x1400e7088
mov r15, rbx
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400e62b1
cmp qword [rbx + 0x10], 0x11
jb 0x1400e62a0
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rbx, r15
jmp 0x1400e7088
xor r8d, r8d
mov rcx, rdx
test rax, rax
cmovne r8, rax
test r8, r8
je 0x1400e62f0
test rax, rax
cmove rcx, rdx
add r8, rcx
sub r8, rsi
cmp rbx, r8
cmovae rbx, r8
lea rcx, [rsp + 0x220]
mov rdx, rsi
mov r8, rbx
call fcn.1400e0020
mov rcx, qword [rsp + 0x220]
mov rax, qword [rsp + 0x228]
test rcx, rcx
je 0x1400e6547
mov rdx, qword [rsp + 0x230]
mov qword [rsp + 0x220], rcx
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], rdx
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x220]
call fcn.1400ec660
mov rbx, r15
test rdi, rdi
je 0x1400e636a
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov r13, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x158]
test r13, r13
je 0x1400e4c17
mov r8, qword [rsp + 0x160]
mov qword [rsp + 0x78], rbx
cmp r8, 5
jb case.0x1400e63d4.68
cmp word [r13 + r8*2 - 0xa], 0x2e
jne case.0x1400e63d4.68
cmp word [r13 + r8*2 - 2], 0
jne case.0x1400e63d4.68
movzx eax, word [r13 + r8*2 - 8]
lea ecx, [rax - 0x42]
cmp ecx, 0x21
ja case.0x1400e63d4.68
lea rdx, [0x1401281d0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
movzx ecx, word [r13 + r8*2 - 6]
or ecx, 0x20
cmp ecx, 0x61
jne 0x1400e63f2
movzx ecx, word [r13 + r8*2 - 4]
or ecx, 0x20
cmp ecx, 0x74
je 0x1400e6422
cmp ax, 0x43
jne case.0x1400e63d4.68
movzx eax, word [r13 + r8*2 - 6]
or eax, 0x20
cmp eax, 0x6d
jne case.0x1400e63d4.68
movzx eax, word [r13 + r8*2 - 4]
add eax, 0xffffffbc
test eax, 0xffdf
jne case.0x1400e63d4.68
mov qword [rsp + 0x1f8], r8
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x90], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x58], rax
xor r14d, r14d
mov esi, 0xffffffff
xor r15d, r15d
xor r13d, r13d
cmp r8, 0x201
jb 0x1400e6488
jmp 0x1400e649a
jae 0x1400e6ff9
cmp r8, 0x201
jae 0x1400e649a
mov ebx, 0x200
lea r12, [rsp + 0x220]
mov rdi, r8
jmp 0x1400e64c8
sub r8, r13
sub r15, r13
cmp r15, r8
jb 0x1400e651d
cmp r14, rsi
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rsp + 0xa0], r13
mov r15, r14
mov rbx, r13
mov r12, qword [rsp + 0x58]
mov rdi, r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r12
mov edx, edi
call sub.KERNEL32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400e64ec
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x1400e760e
mov r8d, ebp
cmp rdi, r8
jne 0x1400e6479
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400e8816
add rdi, rdi
cmp rdi, rsi
cmovae rdi, rsi
mov r8, rdi
cmp r8, 0x201
jae 0x1400e649a
jmp 0x1400e6488
lea rcx, [rsp + 0x90]
mov rdx, r13
call fcn.1400dc760
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0x98]
jmp 0x1400e64a5
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], 0
mov rbx, r15
test rdi, rdi
jne 0x1400e6359
jmp 0x1400e636a
mov r13, qword [rsp + 0x98]
test r13, r13
je 0x1400e7062
movdqu xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x1e0], xmm0
movdqa xmm0, xmmword [rsp + 0x1e0]
movdqu xmmword [rsp + 0x158], xmm0
mov rbp, qword [rsp + 0x158]
mov r8, qword [rsp + 0x160]
mov qword [rsp + 0x78], rbx
cmp r8, 5
jae 0x1400e639a
mov rax, qword [rsp + 0x140]
mov rbx, qword [rax + 0x30]
mov r14, qword [rax + 0x90]
mov r15, qword [rax + 0xa0]
movzx esi, byte [rax + 0xc5]
mov r12, qword [rax + 0x40]
add r12, rbx
mov qword [rsp + 0xd0], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
lea rdi, [rsp + 0xd0]
mov rcx, rdi
xor edx, edx
call fcn.1400f8c80
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xe0]
mov word [rax + rcx*2], 0x22
inc rcx
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0x220], rbx
mov qword [rsp + 0x228], r12
mov word [rsp + 0x230], 0
lea rdx, [rsp + 0x220]
mov rcx, rdi
call fcn.1400ecf50
mov rdx, qword [rsp + 0xe0]
cmp rdx, qword [rsp + 0xd8]
jne 0x1400e6685
lea rcx, [rsp + 0xd0]
call fcn.1400f8c80
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x22
inc rdx
mov qword [rsp + 0xe0], rdx
shl r15, 3
lea rbx, [r15 + r15*4]
lea rdi, [rsp + 0xd0]
jmp 0x1400e66eb
lea r12, [r14 + 0x28]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x20
inc rdx
mov qword [rsp + 0xe0], rdx
mov rcx, rdi
mov rdx, r14
mov r8d, esi
call fcn.1400ec1f0
add rbx, 0xffffffffffffffd8
mov r14, r12
test rax, rax
jne 0x1400e6e5d
test rbx, rbx
je 0x1400e6714
mov rdx, qword [rsp + 0xe0]
cmp rdx, qword [rsp + 0xd8]
jne 0x1400e66b0
mov rcx, rdi
call fcn.1400f8c80
mov rdx, qword [rsp + 0xe0]
jmp 0x1400e66b0
mov rax, qword [rsp + 0xd0]
mov r15, qword [rsp + 0xd8]
test rax, rax
je 0x1400e6e81
mov rdx, qword [rsp + 0xe0]
mov r8b, 1
mov qword [rsp + 0xc8], r13
mov rcx, rbp
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x148]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x160], rdx
cmp rdx, r15
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x60], r8d
jne 0x1400e6799
lea rcx, [rsp + 0x150]
call fcn.1400f8c80
mov rax, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x160]
mov word [rax + rdx*2], 0
inc qword [rsp + 0x160]
mov rcx, qword [rsp + 0x140]
cmp byte [rcx + 0xc4], 0
mov eax, 0x400
mov r12d, 0x608
cmove r12d, eax
mov rax, rcx
or r12d, dword [rcx + 0xc0]
mov ecx, 2
mov qword [rsp + 0x148], rcx
xor edi, edi
mov edx, 0
cmp byte [rsp + 0x198], 0
jne 0x1400e732f
mov qword [rsp + 0x90], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov rdi, qword [rsp + 0x88]
test rdi, rdi
jne 0x1400e6847
lea rcx, [rsp + 0x90]
xor edx, edx
call fcn.1400f8c80
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
mov word [rax + rcx*2], 0
inc rcx
mov qword [rsp + 0xa0], rcx
xor eax, eax
test rsi, rsi
setne al
mov rcx, rdi
cmove rcx, rsi
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], r14
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], r14
mov qword [rsp + 0x260], rcx
test rcx, rcx
je 0x1400e6f4b
lea r8, [rsp + 0x230]
pxor xmm6, xmm6
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x70], r13
dec rax
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x220]
mov rdi, qword [rsp + 0x228]
test rax, rax
je 0x1400e6992
test rdi, rdi
jne 0x1400e6992
mov rdi, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x238]
test rcx, rcx
je 0x1400e6972
mov rdx, rcx
mov rax, rcx
and rdx, 7
je 0x1400e692e
and rax, 0xfffffffffffffff8
mov rdi, qword [rdi + 0x3d8]
dec rdx
jne 0x1400e6922
cmp rcx, 8
jb 0x1400e6972
mov rcx, qword [rdi + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rdi, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x1400e6934
movdqu xmmword [r8], xmm6
mov qword [rsp + 0x220], 1
mov qword [rsp + 0x228], rdi
xor r14d, r14d
xor esi, esi
jmp 0x1400e69ab
test rax, rax
je 0x1400e8816
mov rsi, qword [rsp + 0x230]
mov r14, qword [rsp + 0x238]
movzx eax, word [rdi + 0x3d2]
mov r8, rdi
cmp r14, rax
jb 0x1400e69f6
nop word [rax + rax]
mov rdi, qword [r8 + 0x160]
test rdi, rdi
je 0x1400e87f0
inc rsi
movzx r14d, word [r8 + 0x3d0]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r8, rdi
cmp r14w, word [rdi + 0x3d2]
jae 0x1400e69c0
test rsi, rsi
je 0x1400e6a97
mov rax, qword [rdi + r14*8 + 0x3e0]
mov rcx, rsi
dec rcx
je 0x1400e6aa0
mov rdx, rcx
and rdx, 7
je 0x1400e6a34
mov rcx, rdx
mov rax, qword [rax + 0x3d8]
dec rcx
jne 0x1400e6a1f
not rdx
add rdx, rsi
mov rcx, rdx
add rsi, 0xfffffffffffffffe
cmp rsi, 7
jb 0x1400e6a7c
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1400e6a3e
mov qword [rsp + 0x228], rax
movdqu xmmword [rsp + 0x230], xmm6
test rdi, rdi
jne 0x1400e6abe
jmp 0x1400e72d7
lea rcx, [r14 + 1]
mov rax, rdi
jmp 0x1400e6aa2
xor ecx, ecx
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], 0
mov qword [rsp + 0x238], rcx
imul rax, r14, 0x38
cmp byte [rdi + rax + 0x198], 2
je 0x1400e72d7
lea rcx, [rdi + rax]
add rcx, 0x168
mov rsi, qword [rdi + rax + 0x168]
mov rdx, qword [rdi + rax + 0x170]
mov qword [rsp + 0x88], rdx
mov rbp, qword [rdi + rax + 0x178]
mov r8, qword [rdi + rax + 0x180]
mov rax, qword [rdi + rax + 0x188]
shl r14, 5
mov r15, qword [rdi + r14]
mov rdx, qword [rdi + r14 + 8]
mov qword [rsp + 0x198], rdx
mov r13, qword [rdi + r14 + 0x10]
movzx r14d, byte [rdi + r14 + 0x18]
mov rcx, qword [rcx + 0x28]
add rcx, r8
xor r11d, r11d
mov rdx, r8
jmp 0x1400e6b4d
xor r11d, r11d
test r9w, r9w
je 0x1400e6eaf
mov r9w, 1
test r11w, r11w
jne 0x1400e6b40
cmp rdx, rcx
je 0x1400e6c07
movzx r11d, byte [rdx]
test r11b, r11b
js 0x1400e6b75
inc rdx
mov r10d, r11d
jmp 0x1400e6bfc
mov r10d, r11d
and r10d, 0x1f
movzx ebx, byte [rdx + 1]
and ebx, 0x3f
cmp r11b, 0xdf
jbe 0x1400e6bbb
movzx edi, byte [rdx + 2]
shl ebx, 6
and edi, 0x3f
or edi, ebx
cmp r11b, 0xf0
jb 0x1400e6bcd
movzx r11d, byte [rdx + 3]
add rdx, 4
and r10d, 7
shl r10d, 0x12
shl edi, 6
and r11d, 0x3f
or r11d, edi
or r10d, r11d
jmp 0x1400e6bd8
add rdx, 2
shl r10d, 6
or r10d, ebx
mov rbx, qword [rsp + 0x78]
jmp 0x1400e6bfc
add rdx, 3
shl r10d, 0xc
or r10d, edi
mov rbx, qword [rsp + 0x78]
cmp r10d, 0xffff
jbe 0x1400e6bfc
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x1400e6b43
xor r11d, r11d
mov r9d, r10d
jmp 0x1400e6b43
test rax, rax
je 0x1400e6c1a
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
sub rax, rdi
cmp rax, rbp
jb 0x1400e6e3d
lea r8, [rbp*2]
lea rcx, [rdi + rdi]
add rcx, qword [rsp + 0x90]
mov rdx, rsi
call sub.msvcrt.dll_memcpy
add rdi, rbp
mov qword [rsp + 0xa0], rdi
cmp qword [rsp + 0x88], 0
je 0x1400e6c81
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rdi, qword [rsp + 0xa0]
cmp rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x80]
jne 0x1400e6cab
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.1400f8c80
mov rdi, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x90]
mov word [rax + rdi*2], 0x3d
inc rdi
mov qword [rsp + 0xa0], rdi
add r13, r15
xor r8d, r8d
mov rax, r15
jmp 0x1400e6cdb
xor r8d, r8d
test cx, cx
je 0x1400e6fd8
mov cx, 1
test r8w, r8w
jne 0x1400e6ccf
cmp rax, r13
je 0x1400e6d85
movzx r8d, byte [rax]
test r8b, r8b
js 0x1400e6cff
inc rax
mov edx, r8d
jmp 0x1400e6d7b
mov edx, r8d
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp r8b, 0xdf
jbe 0x1400e6d49
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r8b, 0xf0
jb 0x1400e6d55
movzx r8d, byte [rax + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
or edx, r8d
jmp 0x1400e6d5f
add rax, 2
shl edx, 6
or edx, r10d
jmp 0x1400e6d7b
add rax, 3
shl edx, 0xc
or edx, r9d
cmp edx, 0xffff
jbe 0x1400e6d7b
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x1400e6cd2
xor r8d, r8d
mov ecx, edx
jmp 0x1400e6cd2
cmp r14b, 2
je 0x1400e8754
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], r13
mov word [rsp + 0xe0], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xd0]
call fcn.1400ecf50
cmp qword [rsp + 0x198], 0
je 0x1400e6dda
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov rdx, qword [rsp + 0xa0]
cmp rdx, qword [rsp + 0x98]
mov r13, qword [rsp + 0x70]
jne 0x1400e6e06
lea rcx, [rsp + 0x90]
call fcn.1400f8c80
mov rdx, qword [rsp + 0xa0]
lea r8, [rsp + 0x230]
mov rax, qword [rsp + 0x90]
mov word [rax + rdx*2], 0
inc rdx
mov qword [rsp + 0xa0], rdx
mov rax, qword [rsp + 0x260]
test rax, rax
jne 0x1400e68d0
jmp 0x1400e877f
lea rcx, [rsp + 0x90]
mov rdx, rdi
mov r8, rbp
call fcn.1400dc760
mov rdi, qword [rsp + 0xa0]
jmp 0x1400e6c36
mov r15, rax
cmp qword [rsp + 0xd8], 0
je 0x1400e6e81
mov r8, qword [rsp + 0xd0]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rbx, qword [rsp + 0x78]
mov r14, qword [rsp + 0x60]
movq xmm6, r15
test rbp, rbp
je 0x1400e4c1c
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
jmp 0x1400e4c1c
test rax, rax
je 0x1400e6ec2
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x198], 0
mov rbp, qword [rsp + 0x80]
mov r13, qword [rsp + 0x70]
mov r14d, dword [rsp + 0x60]
je 0x1400e6ef0
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x88], 0
je 0x1400e6f0c
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
lea r15, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_found_a
lea rcx, [rsp + 0x220]
call fcn.1400e1c40
cmp qword [rsp + 0x98], 0
je 0x1400e6f41
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
movq xmm6, r15
jmp 0x1400e86f0
mov qword [rsp + 0x220], 0
test rsi, rsi
je 0x1400e72d7
test r14, r14
je 0x1400e7292
mov rcx, r14
mov rax, r14
and rcx, 7
je 0x1400e6f85
and rax, 0xfffffffffffffff8
mov rsi, qword [rsi + 0x3d8]
dec rcx
jne 0x1400e6f79
mov r8, rsi
cmp r14, 8
jb 0x1400e7295
mov r8, rsi
mov rcx, qword [r8 + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov r8, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x1400e6f95
jmp 0x1400e7295
mov rsi, r15
cmp qword [rsp + 0x198], 0
mov r13, qword [rsp + 0x70]
mov r14d, dword [rsp + 0x60]
jne 0x1400e6efb
jmp 0x1400e6f0c
cmp rbx, r8
jb 0x1400e8816
test ebp, ebp
mov rbx, qword [rsp + 0x78]
je 0x1400e777d
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400e7040
mov rsi, r8
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8, rsi
mov r15, r8
lea rdi, [r8 + r8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapAlloc
mov rsi, rax
test rax, rax
jne 0x1400e7787
jmp 0x1400e8816
mov r8, qword [rsp + 0x98]
test r8, r8
je 0x1400e7088
cmp qword [rsp + 0xa0], 0
je 0x1400e7088
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rdx, [0x1401725ff]
lea rcx, [rsp + 0x170]
mov r8d, 4
call fcn.1400f1b40
cmp byte [rsp + 0x188], 2
je 0x1400e7132
mov r15, rbx
mov rsi, qword [rsp + 0x170]
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x180]
add rax, rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rax
mov word [rsp + 0xa0], 0
mov byte [rsp + 0xa8], 1
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0x90]
call fcn.1400f1920
movzx eax, byte [rsp + 0x238]
cmp al, 2
jne 0x1400e713e
cmp qword [rsp + 0x58], 0
mov rbx, r15
je 0x1400e7132
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
lea rbp, [0x140172618]
jmp 0x1400e4c12
lea rbp, [rsp + 0xe9]
lea rbx, [rsp + 0x239]
lea r12, [rsp + 0x220]
lea r13, [rsp + 0x90]
cmp qword [rsp + 0x230], 0
jne 0x1400e71ba
mov rcx, qword [rsp + 0x228]
test rcx, rcx
je 0x1400e718c
mov r8, qword [rsp + 0x220]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rcx, r12
mov rdx, r13
call fcn.1400f1920
movzx eax, byte [rsp + 0x238]
cmp al, 2
je 0x1400e7116
mov rcx, qword [rsp + 0x228]
cmp qword [rsp + 0x230], 0
je 0x1400e7171
mov ecx, dword [rbx]
mov edx, dword [rbx + 3]
mov dword [rbp + 3], edx
mov dword [rbp], ecx
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xe8], al
lea rcx, [rsp + 0xd0]
mov rdx, qword [rsp + 0xc8]
mov r8, r14
call fcn.1400ee030
cmp byte [rsp + 0x80], 0
jne 0x1400e722a
mov r8d, 3
lea rcx, [rsp + 0xd0]
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
call fcn.1400ef380
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
mov rcx, r12
mov rdx, rdi
call fcn.1400e1b10
cmp qword [rsp + 0xd8], 0
je 0x1400e7261
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x220]
test rax, rax
jne 0x1400e7fdd
mov rcx, r12
mov rdx, r13
call fcn.1400f1920
movzx eax, byte [rsp + 0x238]
cmp al, 2
jne 0x1400e715e
jmp 0x1400e7116
mov r8, rsi
mov rax, qword [r8 + 0x160]
test rax, rax
je 0x1400e72c3
mov rsi, rax
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsi + 0x160]
mov r8, rsi
test rax, rax
jne 0x1400e72a1
jmp 0x1400e72c6
mov rsi, r8
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
lea rcx, [rsp + 0x220]
call fcn.1400e1c40
mov rdi, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
cmp rdx, rdi
jne 0x1400e7316
lea rcx, [rsp + 0x90]
call fcn.1400f8c80
mov rdi, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x90]
mov word [rcx + rdx*2], 0
mov rdx, rcx
mov qword [rsp + 0x1f8], rdx
mov qword [rsp + 0x88], rcx
xor ecx, ecx
cmp byte [rax + 0x88], 2
mov r15d, 0
je 0x1400e74c7
mov rcx, rax
mov rax, qword [rax + 0x70]
mov rcx, qword [rcx + 0x80]
add rcx, rax
xor r10d, r10d
mov rdx, rax
jmp 0x1400e737d
xor r10d, r10d
test r8w, r8w
je 0x1400e7431
mov r8w, 1
test r10w, r10w
jne 0x1400e7370
cmp rdx, rcx
je 0x1400e7447
movzx r10d, byte [rdx]
test r10b, r10b
js 0x1400e73a5
inc rdx
mov r9d, r10d
jmp 0x1400e7426
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rdx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x1400e73ef
movzx r11d, byte [rdx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x1400e73fc
movzx r10d, byte [rdx + 3]
add rdx, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r9d, r10d
jmp 0x1400e7407
add rdx, 2
shl r9d, 6
or r9d, esi
jmp 0x1400e7426
add rdx, 3
shl r9d, 0xc
or r9d, r11d
cmp r9d, 0xffff
jbe 0x1400e7426
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x1400e7373
xor r10d, r10d
mov r8d, r9d
jmp 0x1400e7373
lea rax, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_found_a
movq xmm6, rax
mov r14d, dword [rsp + 0x60]
jmp 0x1400e86d5
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], rcx
mov word [rsp + 0x230], 0
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x220]
call fcn.1400ed0e0
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
cmp rdx, rcx
jne 0x1400e74a8
lea rcx, [rsp + 0xd0]
call fcn.1400f8c80
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0x140]
mov r15, qword [rsp + 0xd0]
mov word [r15 + rdx*2], 0
mov qword [rsp + 0x148], r15
mov qword [rsp + 0x198], rcx
mov qword [rsp + 0x70], r13
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], 0
lea rcx, [0x1401a4088]
mov r13, rax
call sub.KERNEL32.dll_AcquireSRWLockExclusive
movzx eax, byte [0x1401a4090]
mov qword [rsp + 0x90], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x1e0], 2
mov ebx, dword [r13 + 0x10]
cmp dword [r13], 6
lea rcx, [rsp + 0x1e0]
cmovne rcx, r13
cmp dword [r13 + 0x20], 6
lea rsi, [r13 + 0x20]
lea r14, [rsp + 0x200]
cmove rsi, r14
lea r8, [rsp + 0x90]
mov edx, 0xfffffff6
call fcn.1400e2020
cmp rax, 1
jne 0x1400e758d
movq xmm6, rdx
mov rbx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov r14d, dword [rsp + 0x60]
jmp 0x1400e8660
mov qword [rsp + 0x1b0], rdx
lea r8, [rsp + 0xa0]
lea rcx, [r13 + 0x10]
cmp ebx, 6
cmove rcx, r14
mov edx, 0xfffffff5
call fcn.1400e2020
mov r14, rdx
test rax, rax
je 0x1400e75d3
movq xmm6, r14
mov rbx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov r14d, dword [rsp + 0x60]
jmp 0x1400e8653
lea r8, [rsp + 0xb0]
mov rcx, rsi
mov edx, 0xfffffff4
call fcn.1400e2020
test rax, rax
mov rbx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov qword [rsp + 0x1c0], r14
je 0x1400e762a
movq xmm6, rdx
mov r14d, dword [rsp + 0x60]
jmp 0x1400e8646
call sub.KERNEL32.dll_GetLastError
mov r10d, eax
shl r10, 0x20
or r10, 2
xor esi, esi
mov rbx, qword [rsp + 0x78]
jmp 0x1400e7798
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x104], xmm0
movdqu xmmword [rsp + 0xf8], xmm0
movdqu xmmword [rsp + 0xe8], xmm0
movdqu xmmword [rsp + 0xd8], xmm0
movdqu xmmword [rsp + 0x118], xmm0
movdqu xmmword [rsp + 0x128], xmm0
test rdx, rdx
mov rax, qword [rsp + 0x1b0]
jne 0x1400e767b
test r14, r14
jne 0x1400e767b
test rax, rax
je 0x1400e769e
mov dword [rsp + 0x10c], 0x100
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x130], rdx
mov rax, qword [rsp + 0x140]
mov rsi, qword [rax + 0xb8]
test rsi, rsi
je 0x1400e7e0e
mov dword [rsp + 0xd0], 0x70
mov qword [rsp + 0x1c8], 0
mov rax, rsi
shr rax, 0x20
jne 0x1400e7fcc
mov qword [rsp + 0x1a0], rdx
lea r9, [rsp + 0x1c8]
xor ecx, ecx
mov edx, esi
xor r8d, r8d
call sub.KERNEL32.dll_InitializeProcThreadAttributeList
mov r8, qword [rsp + 0x1c8]
test r8, r8
mov qword [rsp + 0x1b8], r8
je 0x1400e808e
js 0x1400e8816
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400e7748
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8, qword [rsp + 0x1b8]
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
mov rcx, rax
test rax, rax
jne 0x1400e8093
jmp 0x1400e8816
movups xmm0, xmmword [rsp + 0x228]
movaps xmmword [rsp + 0x1e0], xmm0
mov rbx, qword [rsp + 0x78]
mov r13, rax
jmp 0x1400e658f
mov r15, r8
mov esi, 2
xor edi, edi
mov rcx, rsi
mov rdx, r12
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov r10, r15
test r14, r14
je 0x1400e77b6
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x58]
mov rdi, r10
call sub.KERNEL32.dll_HeapFree
mov r10, rdi
test rsi, rsi
je 0x1400e7cc9
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], r10
mov qword [rsp + 0x180], r10
lea r14, [0x14017266e]
mov qword [rsp + 0xf0], r14
lea r13, [0x140172676]
mov qword [rsp + 0xf8], r13
mov word [rsp + 0x100], 0
mov qword [rsp + 0xd0], 1
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 1
mov word [rsp + 0xe8], 0
xor ebp, ebp
lea rdi, [rsp + 0x170]
xor eax, eax
jmp 0x1400e786c
mov word [rsp + 0x100], 0
xor r12d, r12d
mov r15d, eax
cmp r10, qword [rsp + 0x178]
je 0x1400e797b
mov word [rsi + r10*2], r15w
inc r10
mov qword [rsp + 0x180], r10
mov eax, r12d
test r14, r14
je 0x1400e7925
test ax, ax
jne 0x1400e783b
cmp r14, r13
je 0x1400e7919
lea rcx, [r14 + 1]
mov qword [rsp + 0xf0], rcx
movzx r15d, byte [r14]
test r15b, r15b
jns 0x1400e7a2c
mov edx, r15d
and edx, 0x1f
lea rcx, [r14 + 2]
mov qword [rsp + 0xf0], rcx
movzx r9d, byte [r14 + 1]
and r9d, 0x3f
cmp r15b, 0xdf
jbe 0x1400e795c
lea rcx, [r14 + 3]
mov qword [rsp + 0xf0], rcx
movzx r8d, byte [r14 + 2]
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
cmp r15b, 0xf0
jb 0x1400e79e6
lea rcx, [r14 + 4]
mov qword [rsp + 0xf0], rcx
movzx r15d, byte [r14 + 3]
and edx, 7
shl edx, 0x12
shl r8d, 6
and r15d, 0x3f
or r15d, r8d
or r15d, edx
cmp r15d, 0x110000
jne 0x1400e79ef
mov qword [rsp + 0xf0], 0
cmp rbp, 1
je 0x1400e7a37
lea rdx, [rbp + 1]
mov qword [rsp + 0xd8], rdx
movzx r15d, word [rsp + rbp*2 + 0xe8]
cmp r10, qword [rsp + 0x178]
je 0x1400e796a
xor r14d, r14d
mov r12d, eax
mov rbp, rdx
jmp 0x1400e7859
shl edx, 6
or edx, r9d
mov r15d, edx
jmp 0x1400e7a2c
mov rcx, rbp
neg rcx
mov rbp, rdx
mov r12d, eax
xor r14d, r14d
jmp 0x1400e79b9
lea rax, [0x14017266e]
sub rax, r14
add rax, 0xa
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp r12w, 1
sbb rdx, 0xffffffffffffffff
mov eax, 1
sub rax, rbp
mov rcx, 0xffffffffffffffff
add rax, rdx
jb 0x1400e79b9
mov rcx, rax
mov r8, 0xffffffffffffffff
inc rcx
je 0x1400e79c8
mov r8, rcx
mov rcx, rdi
mov rdx, r10
mov rsi, r10
call fcn.1400dc760
mov r10, rsi
mov rsi, qword [rsp + 0x170]
jmp 0x1400e7859
shl edx, 0xc
or r8d, edx
mov r15d, r8d
cmp r15d, 0xffff
jbe 0x1400e7a2c
lea eax, [r15 + 0xff0000]
shr eax, 0xa
or eax, 0xd800
and r15d, 0x3ff
or r15d, 0xdc00
mov word [rsp + 0x100], r15w
mov r12d, r15d
mov r14, rcx
mov r15d, eax
jmp 0x1400e784b
xor r12d, r12d
mov r14, rcx
jmp 0x1400e784b
mov rsi, qword [rsp + 0x170]
mov r10, qword [rsp + 0x178]
test rsi, rsi
mov r14, qword [rsp + 0x60]
je 0x1400e7cd8
mov qword [rsp + 0x58], r10
mov rax, qword [rsp + 0x140]
mov r13, qword [rax + 0x90]
mov rdi, qword [rax + 0xa0]
movzx ebp, byte [rax + 0xc5]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400e7aa2
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x1400e8816
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xc
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x1400e8816
mov byte [rsp + 0x1c0], bpl
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0xc8], rsi
mov word [rax], 0x63
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], 6
lea rdi, [0x140173531]
mov esi, 1
xor ebp, ebp
lea r15, [0x14017353f]
lea r14, str.cmd.exe__d__c__Windows_file_names_may_not_contain_____or_end_with___
lea r12, [rsp + 0x220]
mov r9, qword [rsp + 0x58]
jmp 0x1400e7b22
mov word [rax + rsi*2], bp
inc rsi
mov ebp, ebx
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x230], rsi
test bp, bp
jne 0x1400e7bdc
cmp rdi, r15
je 0x1400e7c2f
movzx ebp, byte [rdi]
test bpl, bpl
js 0x1400e7b4c
inc rdi
jmp 0x1400e7bdc
mov ecx, ebp
and ecx, 0x1f
movzx r8d, byte [rdi + 1]
and r8d, 0x3f
cmp bpl, 0xdf
jbe 0x1400e7b9a
movzx edx, byte [rdi + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp bpl, 0xf0
jb 0x1400e7ba8
movzx ebp, byte [rdi + 3]
and ecx, 7
shl ecx, 0x12
shl edx, 6
and ebp, 0x3f
or ebp, edx
or ebp, ecx
cmp ebp, 0x110000
je 0x1400e7c2f
add rdi, 4
jmp 0x1400e7bb3
add rdi, 2
shl ecx, 6
or ecx, r8d
mov ebp, ecx
jmp 0x1400e7bdc
add rdi, 3
shl ecx, 0xc
or edx, ecx
mov ebp, edx
cmp ebp, 0xffff
jbe 0x1400e7bdc
lea ecx, [rbp + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and ebp, 0x3ff
or ebp, 0xdc00
mov ebx, ebp
mov ebp, ecx
jmp 0x1400e7bde
xor ebx, ebx
cmp rsi, qword [rsp + 0x228]
jne 0x1400e7b14
mov rax, r14
sub rax, rdi
add rax, 0x11
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp bx, 1
sbb rdx, 0
lea r8, [rdx + 2]
mov rcx, r12
mov rdx, rsi
call fcn.1400dc760
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x220]
jmp 0x1400e7b14
mov rsi, qword [rsp + 0x230]
mov qword [rsp + 0xe0], rsi
movdqu xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0xd0], xmm0
mov rdx, qword [rsp + 0xd8]
cmp rsi, rdx
jne 0x1400e7c78
lea rcx, [rsp + 0xd0]
call fcn.1400f8c80
mov r9, qword [rsp + 0x58]
mov rsi, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xd0]
mov word [r14 + rsi*2], 0x22
inc rsi
mov qword [rsp + 0xe0], rsi
mov r8, qword [rsp + 0x1f8]
lea rax, [r8 + r8]
xor ecx, ecx
lea rdi, [0x140173578]
mov rbp, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
cmp rax, rcx
je 0x1400e7cef
cmp word [rdx + rcx], 0x22
lea rcx, [rcx + 2]
jne 0x1400e7cb4
jmp 0x1400e85b3
mov rbp, qword [rsp + 0x80]
mov r14, qword [rsp + 0x60]
jmp 0x1400e7ce0
mov rbp, qword [rsp + 0x80]
movq xmm6, r10
mov r13, qword [rsp + 0x70]
jmp 0x1400e6e90
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + r8*2 - 2]
cmp ax, 0x5c
je 0x1400e85b3
lea rdi, [r8 - 1]
test ax, ax
cmovne rdi, r8
mov r12, qword [rsp + 0xd8]
mov rax, r12
sub rax, rsi
cmp rax, rdi
jb 0x1400e87c0
movzx ebx, byte [rsp + 0x1c0]
lea r8, [rdi + rdi]
lea rcx, [r14 + rsi*2]
mov rdx, qword [rsp + 0x70]
call sub.msvcrt.dll_memcpy
add rsi, rdi
mov qword [rsp + 0xe0], rsi
cmp rsi, r12
jne 0x1400e7d70
lea rcx, [rsp + 0xd0]
mov rdx, r12
call fcn.1400f8c80
mov r14, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xe0]
mov word [r14 + rsi*2], 0x22
inc qword [rsp + 0xe0]
test bl, bl
je 0x1400e83a5
mov rax, qword [rsp + 0x1b0]
shl rax, 3
lea rbx, [rax + rax*4]
lea rsi, [rsp + 0xd0]
jmp 0x1400e7de1
lea r14, [r13 + 0x28]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x20
inc rdx
mov qword [rsp + 0xe0], rdx
mov rcx, rsi
mov rdx, r13
mov r8b, 1
call fcn.1400ec1f0
add rbx, 0xffffffffffffffd8
mov r13, r14
test rax, rax
mov r9, qword [rsp + 0x58]
jne 0x1400e85a3
test rbx, rbx
je 0x1400e8534
mov rdx, qword [rsp + 0xe0]
cmp rdx, qword [rsp + 0xd8]
jne 0x1400e7da1
mov rcx, rsi
call fcn.1400f8c80
mov rdx, qword [rsp + 0xe0]
jmp 0x1400e7da1
mov qword [rsp + 0x1a0], rdx
mov dword [rsp + 0xd0], 0x68
lea rax, [rsp + 0xd0]
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0xc8]
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x1400e8013
mov qword [rsp + 0x80], rbp
mov r14, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xb0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
movaps xmm6, xmmword [rsp + 0x170]
test rax, rax
je 0x1400e7ef3
mov rcx, qword [rsp + 0x1a8]
call sub.KERNEL32.dll_DeleteProcThreadAttributeList
cmp qword [rsp + 0x1b8], 0
je 0x1400e7ef3
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x1a8]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x1a0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x1c0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [0x1401a4088]
call fcn.140118b6c
cmp qword [rsp + 0x198], 0
je 0x1400e7f47
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x148]
call sub.KERNEL32.dll_HeapFree
test rdi, rdi
je 0x1400e7f62
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x88]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x158], 0
je 0x1400e7f83
mov r8, qword [rsp + 0x150]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x58], 0
je 0x1400e7fa1
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0xc8]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x80], 0
sete al
mov ecx, dword [rsp + 0x60]
or cl, al
je 0x1400e8068
cmp dword [rsp + 0x200], 4
jae 0x1400e4dcc
jmp 0x1400e4dd9
lea rsi, [0x1401726a8]
mov r14d, dword [rsp + 0x60]
jmp 0x1400e8639
mov r13, rax
movdqu xmm0, xmmword [rsp + 0x228]
movdqa xmmword [rsp + 0x1e0], xmm0
cmp qword [rsp + 0x58], 0
je 0x1400e800b
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rbx, r15
jmp 0x1400e658f
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
movq xmm6, rax
test rsi, rsi
je 0x1400e860c
mov rsi, qword [rsp + 0x1a8]
mov rcx, rsi
call sub.KERNEL32.dll_DeleteProcThreadAttributeList
cmp qword [rsp + 0x1b8], 0
mov r14d, dword [rsp + 0x60]
je 0x1400e8611
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
jmp 0x1400e8611
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x70]
call sub.KERNEL32.dll_HeapFree
cmp dword [rsp + 0x200], 4
jae 0x1400e4dcc
jmp 0x1400e4dd9
mov ecx, 1
mov qword [rsp + 0x218], r15
lea r9, [rsp + 0x1c8]
mov qword [rsp + 0x1a8], rcx
mov edx, esi
xor r8d, r8d
call sub.KERNEL32.dll_InitializeProcThreadAttributeList
test eax, eax
je 0x1400e8358
mov rcx, qword [rsp + 0x140]
mov rax, qword [rcx + 0xa8]
mov r14, qword [rcx + 0xb0]
xor ecx, ecx
test rax, rax
mov r15, rsi
mov r9, rsi
cmove r9, rax
setne cl
xor esi, esi
pxor xmm6, xmm6
mov qword [rsp + 0x210], r15
sub r9, 1
jb 0x1400e82a3
test rcx, rcx
je 0x1400e812d
test rsi, rsi
jne 0x1400e812d
test r14, r14
je 0x1400e8137
mov rdx, r14
and rdx, 7
je 0x1400e813c
mov rcx, r14
and rcx, 0xfffffffffffffff8
mov rsi, rax
mov rsi, qword [rsi + 0x170]
dec rdx
jne 0x1400e811f
jmp 0x1400e8142
test rcx, rcx
jne 0x1400e818b
jmp 0x1400e8816
mov rsi, rax
jmp 0x1400e8186
mov rsi, rax
mov rcx, r14
cmp r14, 8
jb 0x1400e8186
mov rax, qword [rsi + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rsi, qword [rax + 0x170]
add rcx, 0xfffffffffffffff8
jne 0x1400e8148
xor eax, eax
xor r14d, r14d
movzx r8d, word [rsi + 0x16a]
mov rcx, rsi
mov rdx, r14
cmp r14, r8
jb 0x1400e81c1
mov r8, qword [rcx]
test r8, r8
je 0x1400e8816
inc rax
movzx edx, word [rcx + 0x168]
mov rcx, r8
cmp dx, word [r8 + 0x16a]
jae 0x1400e819e
test rax, rax
mov qword [rsp + 0x140], r9
je 0x1400e824c
mov rsi, qword [rcx + rdx*8 + 0x178]
mov r8, rax
dec r8
je 0x1400e8247
mov r9, r8
and r9, 7
je 0x1400e81ff
mov r8, r9
mov rsi, qword [rsi + 0x170]
dec r8
jne 0x1400e81ea
not r9
add r9, rax
mov r8, r9
add rax, 0xfffffffffffffffe
cmp rax, 7
jb 0x1400e8247
mov rax, qword [rsi + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rsi, qword [rax + 0x170]
add r8, 0xfffffffffffffff8
jne 0x1400e8209
xor r14d, r14d
jmp 0x1400e8253
lea r14, [rdx + 1]
mov rsi, rcx
lea rax, [rdx + rdx*2]
mov r8, qword [rcx + rdx*8 + 8]
mov r9, qword [rcx + rax*8 + 0x60]
mov rax, qword [rcx + rax*8 + 0x70]
movdqu xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x1a8]
xor edx, edx
call sub.KERNEL32.dll_UpdateProcThreadAttribute
test eax, eax
je 0x1400e8358
mov ecx, 1
mov eax, 0
dec r15
mov r9, qword [rsp + 0x140]
jne 0x1400e80f3
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
je 0x1400e8624
or r12d, 0x80000
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x280], rax
movups xmm0, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x270], xmm0
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x260], xmm0
movdqu xmm0, xmmword [rsp + 0xd0]
movdqu xmm1, xmmword [rsp + 0xe0]
movdqu xmm2, xmmword [rsp + 0xf0]
movdqu xmm3, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x250], xmm3
movdqa xmmword [rsp + 0x240], xmm2
movdqa xmmword [rsp + 0x230], xmm1
movdqa xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x288], rcx
lea rax, [rsp + 0x220]
mov rsi, qword [rsp + 0x210]
mov r15, qword [rsp + 0x218]
jmp 0x1400e7e29
call sub.KERNEL32.dll_GetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov r14, qword [rsp + 0x1a8]
mov rcx, r14
call sub.KERNEL32.dll_DeleteProcThreadAttributeList
cmp qword [rsp + 0x1b8], 0
je 0x1400e8393
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov r14d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x1a0]
jmp 0x1400e8639
mov rax, qword [rsp + 0x1b0]
lea rax, [rax + rax*4]
lea r15, [rax*8]
add r15, r13
lea rbp, [0x140173597]
and rbp, 0xfffffffffffffff8
lea r12, str._t____________
sub rbp, r12
sete al
cmp rbp, 0x16
mov ecx, 0x16
cmovae rbp, rcx
test rbp, rbp
sete sil
or sil, al
movabs r14, 0x101010101010101
jmp 0x1400e841f
xor r8d, r8d
lea rbx, [r13 + 0x28]
lea rcx, [rsp + 0xd0]
mov rdx, r13
call fcn.1400ec1f0
mov r13, rbx
test rax, rax
mov r9, qword [rsp + 0x58]
jne 0x1400e85a3
cmp r13, r15
je 0x1400e8534
mov rdx, qword [rsp + 0xe0]
cmp rdx, qword [rsp + 0xd8]
jne 0x1400e844f
lea rcx, [rsp + 0xd0]
call fcn.1400f8c80
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x20
inc rdx
mov qword [rsp + 0xe0], rdx
cmp qword [r13], 0
jne 0x1400e83f7
mov rax, qword [r13 + 8]
mov rcx, qword [r13 + 0x18]
add rcx, rax
cmp rax, rcx
je 0x1400e83f7
movzx edx, byte [rax]
inc rax
xor r8d, r8d
test sil, sil
je 0x1400e84e3
mov r9, rdx
imul r9, r14
mov r10, qword [r8 + r12]
xor r10, r9
movabs rdi, 0xfefefefefefefeff
lea r11, [r10 + rdi]
not r10
and r10, r11
xor r9, qword [r8 + r12 + 8]
lea r11, [r9 + rdi]
not r9
and r9, r11
or r9, r10
movabs r10, 0x8080808080808080
test r9, r10
je 0x1400e84fc
lea r10, [r12 + r8]
mov r9d, 0x16
sub r9, r8
jmp 0x1400e8516
cmp byte [r8 + r12], dl
je 0x1400e852c
inc r8
cmp rbp, r8
jne 0x1400e84e3
mov r8, rbp
cmp rbp, 6
jbe 0x1400e8491
jmp 0x1400e8500
add r8, 0x10
mov r9, r8
sub r9, 0x16
je 0x1400e847a
add r8, r12
neg r9
mov r10, r8
xor r8d, r8d
cmp byte [r10 + r8], dl
je 0x1400e852c
inc r8
cmp r9, r8
jne 0x1400e8519
jmp 0x1400e847a
mov r8b, 1
jmp 0x1400e83fa
mov r15, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
cmp rdx, r15
jne 0x1400e8566
lea rcx, [rsp + 0xd0]
call fcn.1400f8c80
mov r15, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x148]
mov r13, qword [rsp + 0x70]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x22
inc rdx
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
jmp 0x1400e6755
mov rdi, rax
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
cmp qword [rsp + 0xd8], 0
je 0x1400e85d9
mov r8, qword [rsp + 0xd0]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r9, qword [rsp + 0x58]
movq xmm6, rdi
test r9, r9
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
je 0x1400e6e90
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0xc8]
call sub.KERNEL32.dll_HeapFree
jmp 0x1400e6e90
mov r14d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x1a0]
jmp 0x1400e863e
call fcn.1400f1380
ud2
mov r14d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1b8]
movq xmm6, rsi
mov rcx, rdx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x1c0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x90], 0
je 0x1400e8678
mov rcx, qword [rsp + 0x98]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0xa0], 0
je 0x1400e8690
mov rcx, qword [rsp + 0xa8]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0xb0], 0
je 0x1400e86a8
mov rcx, qword [rsp + 0xb8]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [0x1401a4088]
call fcn.140118b6c
cmp qword [rsp + 0x198], 0
je 0x1400e86d5
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x148]
call sub.KERNEL32.dll_HeapFree
test rdi, rdi
je 0x1400e86f0
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x88]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x158], 0
je 0x1400e8711
mov r8, qword [rsp + 0x150]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x58], 0
je 0x1400e872f
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0xc8]
call sub.KERNEL32.dll_HeapFree
test rbp, rbp
sete al
or r14b, al
jne 0x1400e4db2
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
jmp 0x1400e4db2
mov r13, qword [rsp + 0x70]
mov r14d, dword [rsp + 0x60]
lea rcx, [rsp + 0x220]
call fcn.1400e1c40
cmp qword [rsp + 0x98], 0
jne 0x1400e6f2b
jmp 0x1400e6f41
mov r8, qword [rsp + 0x228]
mov rsi, qword [rsp + 0x230]
mov r14, qword [rsp + 0x238]
cmp qword [rsp + 0x220], 0
mov qword [rsp + 0x220], 0
je 0x1400e72d7
test r8, r8
jne 0x1400e7295
jmp 0x1400e6f60
lea rcx, [rsp + 0xd0]
mov rdx, rsi
mov r8, rdi
call fcn.1400dc760
mov rsi, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xd8]
jmp 0x1400e7d26
mov edx, 8
mov rcx, r8
call fcn.14000da40
ud2
call sub.KERNEL32.dll_GetLastError
mov rcx, r15
call sub.KERNEL32.dll_CloseHandle
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
ud2