Function at 0x14000d03c
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create directory
Create pipe
Create process on windows
Encode data using base64
Get common file path
Persist via run registry key
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xdd8
xor edi, edi
mov rbx, r9
mov rsi, rcx
mov dword [rsp + 0x78], 0x20
mov dword [rsp + 0x190], 0x61
mov dword [rsp + 0xa0], 0x63
lea ebp, [rdi + 0x2f]
mov dword [rsp + 0x268], edi
mov dword [rax - 0xba0], edi
mov byte [rsp + 0xa8], dil
mov qword [rax - 0xa60], rdi
mov qword [rax - 0x9c0], rdi
mov dword [rsp + 0xb4], 0xd
cmp r9, rdi
je 0x14000d3f6
lea rcx, [rax + 0x20]
call fcn.140052130
mov r11, qword [rsp + 0xe18]
cmp r11, rdi
je 0x14000d3f6
cmp bp, word [r11]
jne 0x14000d3f6
movzx ecx, word [r11 + 2]
lea edx, [rdi + 0x20]
lea ebp, [rdi + 0x69]
or cx, dx
lea r8d, [rdi + 0x73]
lea r9d, [rdi + 0x72]
lea r10d, [rdi + 0x76]
cmp bp, cx
jne 0x14000d223
movzx eax, word [r11 + 4]
or ax, dx
lea edx, [rdi + 0x6e]
cmp dx, ax
jne 0x14000d223
movzx eax, word [r11 + 6]
lea edx, [rdi + 0x20]
or ax, dx
cmp r8w, ax
jne 0x14000d223
movzx eax, word [r11 + 8]
or ax, dx
lea edx, [rdi + 0x74]
cmp dx, ax
jne 0x14000d223
movzx eax, word [r11 + 0xa]
lea edx, [rdi + 0x20]
or ax, dx
cmp word [rsp + 0x190], ax
jne 0x14000d223
movzx eax, word [r11 + 0xc]
or ax, dx
lea edx, [rdi + 0x6c]
cmp dx, ax
jne 0x14000d223
movzx eax, word [r11 + 0xe]
or ax, word [rsp + 0x78]
cmp dx, ax
jne 0x14000d223
movzx eax, word [r11 + 0x10]
lea edx, [rdi + 0x20]
or ax, dx
cmp r8w, ax
jne 0x14000d223
movzx eax, word [r11 + 0x12]
or ax, dx
lea edx, [rdi + 0x65]
cmp dx, ax
jne 0x14000d228
movzx eax, word [r11 + 0x14]
or ax, word [rsp + 0x78]
cmp r9w, ax
jne 0x14000d228
movzx eax, word [r11 + 0x16]
or ax, word [rsp + 0x78]
cmp r10w, ax
jne 0x14000d228
movzx eax, word [r11 + 0x18]
or ax, word [rsp + 0x78]
cmp bp, ax
jne 0x14000d228
movzx eax, word [r11 + 0x1a]
or ax, word [rsp + 0x78]
cmp word [rsp + 0xa0], ax
jne 0x14000d228
movzx eax, word [r11 + 0x1c]
or ax, word [rsp + 0x78]
cmp dx, ax
jne 0x14000d228
lea eax, [rdi + 9]
cmp ax, word [r11 + 0x1e]
ja 0x14000d211
lea eax, [rdi + 0xd]
cmp word [r11 + 0x1e], ax
jbe 0x14000d3be
mov eax, 0x20
cmp ax, word [r11 + 0x1e]
je 0x14000d3be
jmp 0x14000d228
mov edx, 0x65
cmp r8w, cx
jne 0x14000d2bf
movzx eax, word [r11 + 4]
or ax, word [rsp + 0x78]
cmp dx, ax
jne 0x14000d2bf
movzx eax, word [r11 + 6]
or ax, word [rsp + 0x78]
cmp r9w, ax
jne 0x14000d2bf
movzx eax, word [r11 + 8]
or ax, word [rsp + 0x78]
cmp r10w, ax
jne 0x14000d2bf
movzx eax, word [r11 + 0xa]
or ax, word [rsp + 0x78]
cmp bp, ax
jne 0x14000d2bf
movzx eax, word [r11 + 0xc]
or ax, word [rsp + 0x78]
cmp word [rsp + 0xa0], ax
jne 0x14000d2bf
movzx eax, word [r11 + 0xe]
or ax, word [rsp + 0x78]
cmp dx, ax
jne 0x14000d2bf
mov eax, 9
cmp ax, word [r11 + 0x10]
ja 0x14000d2af
mov eax, 0xd
cmp word [r11 + 0x10], ax
jbe 0x14000d3be
mov eax, 0x20
cmp ax, word [r11 + 0x10]
je 0x14000d3be
cmp r9w, cx
jne 0x14000d3f6
movzx eax, word [r11 + 4]
mov ecx, 0x20
or ax, cx
cmp dx, ax
jne 0x14000d3f6
movzx eax, word [r11 + 6]
or ax, cx
mov ecx, 0x6d
cmp cx, ax
jne 0x14000d3f6
movzx eax, word [r11 + 8]
mov ecx, 0x6f
or ax, 0x20
cmp cx, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0xa]
mov ecx, 0x20
or ax, cx
cmp r10w, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0xc]
or ax, cx
cmp dx, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0xe]
or ax, cx
cmp r8w, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0x10]
or ax, cx
cmp dx, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0x12]
or ax, cx
cmp r9w, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0x14]
or ax, cx
cmp r10w, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0x16]
or ax, cx
cmp bp, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0x18]
lea r8d, [rcx + 0x43]
or ax, cx
cmp r8w, ax
jne 0x14000d3f6
movzx eax, word [r11 + 0x1a]
or ax, cx
cmp dx, ax
jne 0x14000d3f6
lea eax, [rcx - 0x17]
cmp ax, word [r11 + 0x1c]
ja 0x14000d3b7
lea eax, [rcx - 0x13]
cmp word [r11 + 0x1c], ax
jbe 0x14000d3be
cmp cx, word [r11 + 0x1c]
jne 0x14000d3f6
lea rdx, str.PECMD_EXEC
lea rcx, [0x140117a00]
call fcn.140064e2c
mov rdx, qword [rsp + 0xe18]
lea rcx, [0x140117a00]
call fcn.14005a28c
mov eax, 2
mov word [rsi + 0xc8], ax
jmp 0x140014df0
mov eax, dword [rsp + 0xe20]
mov esi, 1
mov dword [rsp + 0x278], edi
mov ecx, eax
mov byte [rsp + 0x90], dil
mov byte [rsp + 0x81], dil
and ecx, esi
mov dword [rsp + 0x84], ecx
mov ecx, eax
shr eax, 2
shr ecx, 1
and al, sil
and ecx, esi
mov dword [rsp + 0xe20], eax
mov dword [rsp + 0x134], ecx
lea rcx, [rsp + 0x180]
call fcn.14005a150
mov rdx, qword [rsp + 0xe08]
cmp rdx, rdi
je 0x14000d482
lea rcx, [rsp + 0x180]
call fcn.140064e2c
mov r11, qword [rsp + 0x180]
lea rcx, [rsp + 0xe08]
mov qword [rsp + 0xe08], r11
call fcn.140052130
lea rcx, [rsp + 0x178]
call fcn.14005a150
mov rdx, qword [rsp + 0xe18]
cmp rdx, rdi
je 0x14000d4b9
lea rcx, [rsp + 0x178]
call fcn.140064e2c
mov rdx, qword [rsp + 0x178]
mov qword [rsp + 0xe18], rdx
cmp qword [rsp + 0xe28], rdi
lea rax, [rsp + 0x540]
mov ecx, 0x5e
cmovne rax, qword [rsp + 0xe28]
mov dword [rsp + 0x468], ecx
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0xe08]
mov qword [rsp + 0x360], rax
cmp rax, rdi
jne 0x14000d545
mov qword [rsp + 0xe08], rdx
cmp rdx, rdi
je 0x14000d545
lea r8d, [rcx - 0x59]
lea rcx, str._shel
call fcn.140053674
cmp al, dil
je 0x14000d545
lea rax, [rsp + 0x468]
mov dl, sil
mov dword [rsp + 0x84], esi
mov qword [rsp + 0xe18], rax
mov dword [rsp + 0x134], esi
mov dword [rsp + 0xe20], edx
lea rcx, [rsp + 0x168]
mov byte [rsp + 0x71], dil
mov qword [rsp + 0x390], rdi
mov byte [rsp + 0x73], dil
mov byte [rsp + 0x138], dil
mov byte [rsp + 0x130], dil
mov byte [rsp + 0x128], dil
mov byte [rsp + 0xfc], dil
mov byte [rsp + 0xc8], dil
mov byte [rsp + 0x74], dil
mov byte [rsp + 0x88], dil
mov byte [rsp + 0x80], dil
mov byte [rsp + 0x139], dil
call fcn.14005a150
mov al, byte [0x1401178e0]
neg al
lea rcx, [rsp + 0x188]
mov dword [rsp + 0x350], edi
sbb eax, eax
mov dword [rsp + 0x354], edi
mov byte [rsp + 0x13a], dil
and eax, 0x10000
mov byte [rsp + 0xac], dil
mov byte [rsp + 0xca], dil
mov byte [rsp + 0xcb], dil
mov byte [rsp + 0xcd], sil
mov byte [rsp + 0x129], dil
mov dword [rsp + 0xf8], eax
mov dword [rsp + 0xb0], edi
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0x12c], edi
call fcn.14005a150
lea rcx, [rsp + 0x118]
mov dword [rsp + 0x160], edi
mov byte [rsp + 0x72], dil
call fcn.14005a150
lea rcx, [rsp + 0x148]
call fcn.14005a150
lea rcx, [rsp + 0x120]
call fcn.14005a150
or dword [rsp + 0x1d8], 0xffffffff
lea rcx, [rsp + 0x1b0]
mov sil, dil
mov r11b, dil
mov byte [rsp + 0xcc], dil
mov dword [rsp + 0xa4], esi
mov qword [rsp + 0x478], rdi
call fcn.14005a150
xor edx, edx
lea rcx, [rsp + 0x580]
mov qword [rsp + 0x228], rdi
lea r8d, [rdx + 0x60]
mov qword [rsp + 0x280], rdi
mov dword [rsp + 0x570], 0x68
mov qword [rsp + 0x578], rdi
call fcn.1400dd9e0
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x5e0]
call fcn.1400dd9e0
xor eax, eax
lea rcx, [rsp + 0x3c0]
mov qword [rsp + 0x310], rdi
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x328], rax
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x338], rax
call fcn.140005ecc
mov ebp, 2
mov eax, edi
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0xe18]
lea ecx, [rbp + 1]
mov dword [rsp + 0xd0], edi
lea edx, [rbp + 0x21]
lea r9d, [rbp + 0x22]
mov dword [rsp + 0x10c], ecx
cmp rax, rdi
jne 0x14000d75b
lea r8d, [rbp - 1]
mov cl, r8b
mov dword [rsp + 0xa4], ecx
mov rcx, qword [rsp + 0xe08]
jmp 0x14000d816
cmp dx, word [rax]
jne 0x14000d785
mov rcx, qword [rsp + 0xe08]
cmp rax, rcx
jne 0x14000d778
add rcx, rbp
mov qword [rsp + 0xe08], rcx
add rax, rbp
mov qword [rsp + 0xe18], rax
jmp 0x14000d7a1
test byte [section.flag_dat], cl
movzx esi, sil
cmovne esi, ecx
mov rcx, qword [rsp + 0xe08]
mov dword [rsp + 0xa4], esi
cmp rax, rdi
je 0x14000d810
mov edx, 0x5e
cmp dx, word [rax]
jne 0x14000d7dd
cmp rax, rcx
jne 0x14000d7c0
add rcx, rbp
mov qword [rsp + 0xe08], rcx
mov r8d, 1
add rax, rbp
mov dl, r8b
mov qword [rsp + 0xe18], rax
mov dword [rsp + 0xe20], edx
jmp 0x14000d7e3
mov r8d, 1
cmp rax, rdi
je 0x14000d816
cmp r9w, word [rax]
jne 0x14000d816
cmp rax, rcx
jne 0x14000d7fe
add rcx, rbp
mov qword [rsp + 0xe08], rcx
add rax, rbp
mov byte [rsp + 0x74], r8b
mov qword [rsp + 0xe18], rax
jmp 0x14000d816
mov r8d, 1
mov esi, edi
mov dword [rsp + 0x108], edi
mov edx, 0x7c
cmp rax, rdi
je 0x14000d854
cmp dx, word [rax]
jne 0x14000d854
cmp rax, rcx
jne 0x14000d83e
add rcx, rbp
mov qword [rsp + 0xe08], rcx
add rax, rbp
mov esi, r8d
mov dword [rsp + 0x108], r8d
mov qword [rsp + 0xe18], rax
mov eax, 0x30
lea r10d, [rax - 6]
lea r9d, [rax - 3]
cmp rbx, rdi
je 0x14000d9d8
cmp r10w, word [rbx]
jne 0x14000d9d8
add rcx, rbp
mov byte [rsp + 0x71], 0x10
mov qword [rsp + 0xe08], rcx
cmp dx, word [rcx]
jne 0x14000d89f
add rcx, rbp
mov esi, r8d
mov dword [rsp + 0x108], r8d
mov qword [rsp + 0xe08], rcx
cmp ax, word [rcx]
ja 0x14000d8e9
cmp word [rcx], 0x39
ja 0x14000d8e9
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0xe08]
mov byte [rsp + 0x71], 0x11
call fcn.140006ef4
cmp qword [rsp + 0x390], rdi
mov rcx, qword [rsp + 0xe08]
mov ebx, 1
lea r8d, [rbx + 0x1f]
jg 0x14000d921
mov qword [rsp + 0x390], rbx
jmp 0x14000d921
movzx eax, word [rcx]
mov r8d, 0x20
lea edx, [r8 + 0x4e]
or ax, r8w
cmp dx, ax
jne 0x14000d906
mov byte [rsp + 0x71], 0x12
jmp 0x14000d911
cmp r9w, word [rcx]
jne 0x14000d91c
mov byte [rsp + 0x71], 0x14
add rcx, rbp
mov qword [rsp + 0xe08], rcx
mov ebx, 1
mov eax, 0x23
cmp ax, word [rcx]
jne 0x14000d93d
add rcx, rbp
mov byte [rsp + 0xa8], bl
mov qword [rsp + 0xe08], rcx
mov eax, 9
cmp ax, word [rcx]
ja 0x14000d955
mov eax, 0xd
cmp word [rcx], ax
jbe 0x14000d9d8
cmp r8w, word [rcx]
je 0x14000d9d8
lea rcx, [rsp + 0x3c0]
call fcn.140005ff8
lea rcx, [rsp + 0x1b0]
call fcn.140052160
lea rcx, [rsp + 0x120]
call fcn.140052160
lea rcx, [rsp + 0x148]
call fcn.140052160
lea rcx, [rsp + 0x118]
call fcn.140052160
lea rcx, [rsp + 0x188]
call fcn.140052160
lea rcx, [rsp + 0x168]
call fcn.140052160
lea rcx, [rsp + 0x178]
call fcn.140052160
lea rcx, [rsp + 0x180]
call fcn.140052160
mov rdi, rbx
jmp 0x140014df0
lea rcx, [rsp + 0xe08]
call fcn.140052130
mov dword [rsp + 0x1c8], 0x22
mov edx, 0x3d
cmp byte [rsp + 0x71], dil
je 0x14000db97
mov rcx, qword [rsp + 0xe08]
mov eax, 1
mov dword [rsp + 0x84], eax
movzx eax, word [rcx]
mov rbx, rcx
cmp ax, di
je 0x140014d76
cmp ax, dx
je 0x14000da33
add rbx, rbp
mov ax, word [rbx]
cmp ax, di
jne 0x14000da23
cmp rbx, rcx
je 0x140014d76
cmp dx, word [rbx]
jne 0x140014d76
sub rbx, rbp
mov eax, 0x2b
mov qword [rsp + 0x370], rbx
cmp ax, word [rbx]
jne 0x14000da6e
mov al, byte [rbx]
sub rbx, rbp
mov byte [rsp + 0x13a], al
mov qword [rsp + 0x370], rbx
mov r8, rbx
mov r10d, 9
cmp rbx, rcx
jbe 0x14000daac
lea esi, [r10 + 0x17]
lea ebx, [rsi - 0x13]
cmp r10w, word [r8]
ja 0x14000da8f
cmp word [r8], bx
jbe 0x14000da95
cmp si, word [r8]
jne 0x14000da9d
sub r8, rbp
cmp r8, rcx
ja 0x14000da83
mov rbx, qword [rsp + 0x370]
mov esi, dword [rsp + 0x108]
mov r11d, 0xd
cmp r10w, word [r8]
ja 0x14000dac2
cmp word [r8], r11w
jbe 0x140014d76
mov r9d, 0x20
cmp r9w, word [r8]
je 0x140014d76
mov rdx, r8
add r8, rbp
cmp rdx, rcx
jbe 0x14000dafb
lea rax, [rdx - 2]
cmp r10w, word [rax]
ja 0x14000daed
cmp word [rax], r11w
jbe 0x14000dafb
cmp r9w, word [rax]
je 0x14000dafb
mov rdx, rax
cmp rax, rcx
ja 0x14000dadd
sub r8, rdx
lea rcx, [rsp + 0x118]
sar r8, 1
call fcn.14005a3b8
mov r9, qword [rsp + 0xe00]
lea rdx, [rsp + 0x118]
mov rcx, r9
xor r8d, r8d
call fcn.14000397c
mov rax, qword [rsp + 0xe00]
cmp byte [rax + 0xda], dil
jne 0x14000db40
test byte [rax + 0xd], 0xf
je 0x14000db53
lea rdx, [rsp + 0x118]
xor r8d, r8d
mov rcx, rax
call fcn.14000397c
movzx eax, word [rbx]
cmp ax, di
je 0x14000db70
mov ecx, 0x3d
cmp ax, cx
je 0x14000db7e
add rbx, rbp
mov ax, word [rbx]
cmp ax, di
jne 0x14000db60
mov eax, 0x3d
cmp word [rbx], ax
jne 0x140014d76
lea rax, [rbx + 2]
lea rcx, [rsp + 0x478]
mov qword [rsp + 0x478], rax
call fcn.140052130
lea rcx, [rsp + 0xe08]
call fcn.140052130
mov rbx, qword [rsp + 0xe08]
mov qword [rsp + 0xe8], rbx
cmp qword [rsp + 0x228], rdi
je 0x14000dbc9
cmp byte [rsp + 0x71], dil
jne 0x14000dd5c
mov edx, 0x2d
cmp dx, word [rbx]
jne 0x14000dbe9
lea rcx, [rbx + 2]
mov rax, rbx
cmp dx, word [rcx]
cmove rax, rcx
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0xe8]
lea rcx, [0x1400fa940]
mov r8d, 1
call fcn.14005c928
cmp al, dil
jne 0x14000dd5c
mov rax, qword [rsp + 0xe8]
mov ecx, 0x2d
cmp cx, word [rax]
je 0x14000dc2c
mov ecx, 0x2f
cmp cx, word [rax]
jne 0x14000dd5c
add rax, rbp
lea rdx, [rsp + 0xe8]
lea rcx, str.catch
mov r8d, 5
mov qword [rsp + 0xe8], rax
call fcn.14005c9c4
cmp al, dil
je 0x14000dccc
mov cl, byte [rsp + 0x71]
mov al, cl
or cl, 0x10
mov byte [rsp + 0x71], cl
cmp al, dil
je 0x14000deb6
mov rax, qword [rsp + 0xe8]
movzx ecx, word [rax]
cmp cx, di
je 0x14000dcb2
mov edx, 0x20
lea esi, [rdx - 0x13]
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x14000dc93
cmp cx, si
jbe 0x14000dcab
cmp dx, cx
je 0x14000dcab
add rax, rbp
mov qword [rsp + 0xe8], rax
mov cx, word [rax]
cmp cx, di
jne 0x14000dc88
mov esi, dword [rsp + 0x108]
lea rcx, [rsp + 0xe8]
call fcn.140052130
mov rbx, qword [rsp + 0xe8]
jmp 0x14000dbc9
mov rdx, qword [rsp + 0xe8]
lea rcx, str.cmd:
mov r8d, 4
call fcn.140053674
cmp al, dil
je 0x14000ddad
mov rcx, qword [rsp + 0xe00]
add qword [rsp + 0xe8], 8
lea r9, [rsp + 0x1d8]
lea r8, [rsp + 0x1b0]
lea rdx, [rsp + 0xe8]
call fcn.140008fbc
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0xe8]
cmp rbx, rax
jae 0x14000dd51
mov esi, 0x20
mov word [rbx], si
mov rax, qword [rsp + 0xe8]
add rbx, rbp
cmp rbx, rax
jb 0x14000dd37
mov esi, dword [rsp + 0x108]
cmp byte [rsp + 0x71], dil
je 0x14000dc74
lea rcx, [rsp + 0xe08]
call fcn.140052130
mov rdx, qword [rsp + 0x228]
cmp rdx, rdi
je 0x14000dd8a
movzx eax, word [rdx]
neg ax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0x228], rcx
cmp esi, edi
jne 0x14000dec0
cmp qword [rsp + 0xe30], rdi
jne 0x14000dec0
mov bl, dil
mov esi, 1
jmp 0x14000dec8
mov rdx, qword [rsp + 0xe8]
lea rcx, [0x1400fa92c]
mov r8d, 3
call fcn.140053674
cmp al, dil
je 0x14000ddf1
mov rax, qword [rsp + 0xe8]
mov ecx, 0x2a
add rax, 6
jmp 0x14000dde2
add rax, rbp
mov qword [rsp + 0xe8], rax
cmp cx, word [rax]
je 0x14000dddf
jmp 0x14000de70
mov rdx, qword [rsp + 0xe8]
lea rcx, str.exe:
mov r8d, 4
call fcn.140053674
cmp al, dil
je 0x14000de35
mov rax, qword [rsp + 0xe8]
mov ecx, 0x2a
add rax, 8
jmp 0x14000de26
add rax, rbp
mov qword [rsp + 0xe8], rax
cmp cx, word [rax]
je 0x14000de23
jmp 0x14000de70
mov rdx, qword [rsp + 0xe8]
lea rcx, str.logs:
mov r8d, 5
call fcn.140053674
cmp al, dil
je 0x14000dc6c
mov rax, qword [rsp + 0xe8]
mov ecx, 0xa
add rax, rcx
mov qword [rsp + 0xe8], rax
mov edx, 0x22
cmp word [rax], dx
jne 0x14000dc74
add rax, rbp
mov qword [rsp + 0xe8], rax
movzx ecx, word [rax]
cmp cx, di
je 0x14000dcb2
add rax, rbp
mov qword [rsp + 0xe8], rax
cmp dx, cx
je 0x14000dc74
mov cx, word [rax]
cmp cx, di
jne 0x14000de95
jmp 0x14000dc74
mov edx, 0x3d
jmp 0x14000da00
mov esi, 1
mov bl, sil
lea rcx, [rsp + 0x1d0]
mov byte [rsp + 0xc9], bl
mov qword [rsp + 0x4e0], rdi
mov qword [rsp + 0x2f8], rdi
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x220], rdi
call fcn.14005a150
lea rcx, [rsp + 0x210]
call fcn.14005a150
mov bp, di
mov qword [rsp + 0x150], rdi
mov dword [rsp + 0x7c], ebp
mov qword [rsp + 0x1c0], rdi
mov byte [rsp + 0x75], dil
cmp bl, dil
jne 0x14000df81
cmp qword [rsp + 0x360], rdi
jne 0x14000df81
mov rdx, qword [rsp + 0xe08]
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x1c0]
xor r9d, r9d
mov byte [rsp + 0x20], sil
call fcn.14006e854
mov r11, qword [rsp + 0x1c0]
mov qword [rsp + 0xe08], r11
mov eax, 1
mov ebx, 2
mov rsi, qword [rsp + 0xe08]
mov edx, 0x2d
cmp dx, word [rsi]
jne 0x14000dfb6
lea rcx, [rsi + 2]
mov rax, rsi
cmp dx, word [rcx]
cmove rax, rcx
mov qword [rsp + 0xe08], rax
lea eax, [rdx - 0x2c]
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa940]
mov r8d, eax
call fcn.14005c928
mov r8, qword [rsp + 0xe08]
cmp al, dil
jne 0x14000f579
mov ecx, 0x2d
cmp cx, word [r8]
je 0x14000dff6
lea eax, [rcx + 2]
cmp ax, word [r8]
jne 0x14000f579
add r8, rbx
lea rdx, [rsp + 0xe08]
lea rcx, str.catch
mov qword [rsp + 0xe08], r8
mov r8d, 5
call fcn.14005c928
cmp al, dil
je 0x14000e02a
mov byte [rsp + 0x71], 0x10
jmp 0x14000f470
mov rdx, qword [rsp + 0xe08]
lea rcx, str.clone:
mov r8d, 6
call fcn.140053674
cmp al, dil
je 0x14000e0c5
mov rax, qword [rsp + 0xe08]
add rax, 0xc
mov qword [rsp + 0xe08], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, di
je 0x14000e0af
mov r8d, 0x20
lea r9d, [r8 - 0x17]
cmp r9w, cx
ja 0x14000e084
mov r10d, 0xd
cmp cx, r10w
jbe 0x14000e09f
cmp r8w, cx
je 0x14000e09f
add rax, rbx
mov qword [rsp + 0xe08], rax
mov cx, word [rax]
cmp cx, di
je 0x14000e0af
jmp 0x14000e072
cmp word [rax], di
je 0x14000e0af
mov word [rax], di
add qword [rsp + 0xe08], rbx
cmp word [rdx], di
je 0x14000f564
mov qword [rsp + 0x280], rdx
jmp 0x14000f564
lea rdx, [rsp + 0xe08]
lea rcx, str.shel
mov r8d, 4
call fcn.14005c928
cmp al, dil
je 0x14000e10b
or byte [rsp + 0xe20], bl
and byte [rsp + 0xa4], 0xfe
mov eax, 1
mov dword [rsp + 0x134], eax
mov dword [rsp + 0x84], eax
jmp 0x14000df8b
mov rdx, qword [rsp + 0xe08]
lea rcx, str.shel:
mov r8d, 5
call fcn.140053674
cmp al, dil
je 0x14000e1c7
or byte [rsp + 0xe20], bl
and byte [rsp + 0xa4], 0xfe
mov eax, 1
mov dword [rsp + 0x134], eax
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0xe08]
add rax, 0xa
lea rdx, [rsp + 0x4d8]
lea rcx, [rsp + 0x4b0]
mov r8d, 5
mov qword [rsp + 0x4d8], rdi
mov qword [rsp + 0xe08], rax
mov qword [rsp + 0x4b0], rax
call fcn.1400256a8
mov r8, qword [rsp + 0x4d8]
cmp r8, rdi
mov qword [rsp + 0xe08], rax
mov eax, 1
jle 0x14000df8b
mov rdx, qword [rsp + 0x4b0]
lea rcx, [rsp + 0x438]
call fcn.14005a3b8
jmp 0x14000f470
mov rdx, qword [rsp + 0xe08]
lea rcx, str.runrmenu:
mov r8d, 9
call fcn.140053674
cmp al, dil
je 0x14000e247
mov r8, qword [rsp + 0xe08]
add r8, 0x12
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, di
je 0x14000e23a
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000e21d
cmp ax, bp
jbe 0x14000e236
cmp cx, ax
je 0x14000e236
add r8, rbx
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, di
jne 0x14000e212
mov ebp, dword [rsp + 0x7c]
lea rcx, [rsp + 0x168]
jmp 0x14000e3fb
mov rdx, qword [rsp + 0xe08]
lea rcx, str.poprmenu
mov r8d, 8
call fcn.140053674
cmp al, dil
je 0x14000e373
mov rax, qword [rsp + 0xe08]
add rax, 0x10
mov qword [rsp + 0xe08], rax
mov qword [rsp + 0x358], rax
movzx ecx, word [rax]
cmp cx, di
je 0x14000e2d3
mov edx, 0x20
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x14000e2a9
mov r9d, 0xd
cmp cx, r9w
jbe 0x14000e2c3
cmp dx, cx
je 0x14000e2c3
add rax, rbx
mov qword [rsp + 0xe08], rax
mov cx, word [rax]
cmp cx, di
je 0x14000e2d3
jmp 0x14000e297
cmp word [rax], di
je 0x14000e2d3
add rax, rbx
mov qword [rsp + 0xe08], rax
lea rcx, [rsp + 0xe08]
call fcn.140052130
lea rcx, [rsp + 0x350]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x358]
mov byte [rsp + 0x88], 1
mov esi, 0x30
cmp word [rax], di
je 0x14000e31e
cmp word [rax], si
jb 0x14000e313
cmp word [rax], 0x39
jbe 0x14000e31e
add rax, rbx
mov qword [rsp + 0x358], rax
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x358]
call fcn.140068da0
mov r11, qword [rsp + 0x358]
cmp word [r11], di
je 0x14000e359
cmp word [r11], si
jb 0x14000e34e
cmp word [r11], 0x39
jbe 0x14000e359
add r11, rbx
mov qword [rsp + 0x358], r11
lea rdx, [rsp + 0x354]
lea rcx, [rsp + 0x358]
call fcn.140068da0
jmp 0x14000f470
mov rdx, qword [rsp + 0xe08]
lea rcx, str.pid:
mov r8d, 4
call fcn.140053674
cmp al, dil
je 0x14000e40b
mov r8, qword [rsp + 0xe08]
add r8, 8
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, di
je 0x14000f564
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000e3cd
cmp ax, bp
jbe 0x14000e3e6
cmp cx, ax
je 0x14000e3e6
add r8, rbx
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, di
jne 0x14000e3c2
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f564
lea rcx, [rsp + 0x220]
sub r8, rdx
sar r8, 1
call fcn.14005a3b8
jmp 0x14000f564
mov rdx, qword [rsp + 0xe08]
lea rcx, str.hpid:
mov r8d, 5
call fcn.140053674
cmp al, dil
je 0x14000e49c
mov r8, qword [rsp + 0xe08]
mov eax, 0xa
add r8, rax
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, di
je 0x14000f564
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000e469
cmp ax, bp
jbe 0x14000e482
cmp cx, ax
je 0x14000e482
add r8, rbx
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, di
jne 0x14000e45e
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f564
lea rcx, [rsp + 0x1f0]
jmp 0x14000e3fb
mov rdx, qword [rsp + 0xe08]
lea rcx, str.ppid:
mov r8d, 5
call fcn.140053674
cmp al, dil
je 0x14000e513
mov eax, 0xa
lea rdx, [rsp + 0x500]
lea rcx, [rsp + 0xe08]
add qword [rsp + 0xe08], rax
mov qword [rsp + 0x500], rdi
call fcn.14005e350
mov rax, qword [rsp + 0x500]
cmp rax, rdi
mov qword [rsp + 0x240], rax
jge 0x14000f470
mov rcx, rax
call fcn.140009124
mov qword [rsp + 0x240], rax
jmp 0x14000f470
mov rdx, qword [rsp + 0xe08]
lea rcx, str.exe:
mov r8d, 4
call fcn.140053674
cmp al, dil
je 0x14000e6d1
mov rax, qword [rsp + 0xe08]
mov r8d, 0x23
mov ebx, edi
add rax, 8
mov edx, edi
lea r10d, [r8 - 0x22]
mov qword [rsp + 0xe08], rax
movzx ecx, word [rax]
mov r9, rax
cmp r8w, cx
jne 0x14000e56c
mov ebp, r10d
mov dword [rsp + 0x7c], r10d
mov esi, 0x22
cmp si, cx
jne 0x14000e631
add rax, 2
mov qword [rsp + 0xe08], rax
mov r8, rax
mov qword [rsp + 0x368], rax
movzx ecx, word [rax]
cmp cx, di
je 0x14000e5f4
lea ebx, [rsi - 2]
lea r8d, [rsi - 0x20]
lea r11d, [rsi - 0x19]
cmp si, cx
jne 0x14000e5d3
add edx, r10d
test r10b, dl
je 0x14000e5d3
movzx ecx, word [rax + 2]
cmp cx, di
je 0x14000e5e6
cmp r11w, cx
ja 0x14000e5ca
cmp cx, word [rsp + 0xb4]
jbe 0x14000e5e6
cmp bx, cx
je 0x14000e5e6
or bp, r8w
add rax, r8
mov qword [rsp + 0xe08], rax
mov cx, word [rax]
cmp cx, di
jne 0x14000e5a4
mov r8, qword [rsp + 0x368]
mov dword [rsp + 0x7c], ebp
mov ebx, edi
cmp si, word [rax]
jne 0x14000e66a
or ebx, 0xffffffff
mov r9, r8
lea ecx, [rbx + 3]
add rax, rcx
mov byte [rsp + 0x75], cl
mov qword [rsp + 0xe08], rax
cmp si, word [rax - 4]
je 0x14000e62a
cmp si, word [r8]
jne 0x14000e66a
cmp si, word [r8 + 2]
je 0x14000e62a
cmp si, word [r8]
jne 0x14000e66a
mov byte [rsp + 0x75], dil
jmp 0x14000e66a
cmp cx, di
je 0x14000e66a
mov edx, 0x20
lea ebp, [rdx - 0x13]
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x14000e64d
cmp cx, bp
jbe 0x14000e666
cmp dx, cx
je 0x14000e666
add rax, 2
mov qword [rsp + 0xe08], rax
mov cx, word [rax]
cmp cx, di
jne 0x14000e642
mov ebp, dword [rsp + 0x7c]
sub rax, r9
sar rax, 1
add ebx, eax
cmp ebx, edi
jle 0x14000e6c7
lea rdx, [r9 - 0xa]
lea rcx, [rsp + 0x170]
call fcn.140064e2c
mov r11, qword [rsp + 0x170]
movsxd rax, ebx
lea rcx, [r11 + 0xa]
mov qword [rsp + 0xf0], rcx
mov word [rcx + rax*2], di
mov eax, 0x2a
cmp ax, word [rcx]
jne 0x14000e6c7
cmp word [rcx + 2], di
jne 0x14000e6c7
lea rcx, [rsp + 0x170]
call fcn.140005e74
mov qword [rsp + 0xf0], rax
mov ebx, 2
jmp 0x14000f564
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400fa92c]
mov r8d, 3
call fcn.140053674
cmp al, dil
je 0x14000e87d
mov rax, qword [rsp + 0xe08]
mov ecx, 0x2a
mov ebx, edi
add rax, 6
lea esi, [rcx - 0x29]
mov qword [rsp + 0xe08], rax
cmp word [rax], cx
jne 0x14000e71f
add ebx, esi
add rax, 2
jmp 0x14000e70a
cmp ebx, 2
mov rdx, rdi
mov qword [rsp + 0x4c0], rax
mov qword [rsp + 0x460], rdx
jge 0x14000e824
cmp word [rax], di
je 0x14000e7bd
mov ecx, 9
cmp cx, word [rax]
ja 0x14000e754
mov ecx, 0xd
cmp word [rax], cx
jbe 0x14000e7bd
mov ecx, 0x20
cmp cx, word [rax]
je 0x14000e7bd
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x4c0]
mov r8d, esi
call fcn.1400256a8
mov rdx, qword [rsp + 0x460]
cmp rdx, rdi
mov qword [rsp + 0xe08], rax
jle 0x14000e7bd
mov r8, rdx
mov rdx, qword [rsp + 0x4c0]
lea rcx, [rsp + 0x150]
call fcn.14005a3b8
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x460]
mov qword [rsp + 0x110], rcx
jmp 0x14000e7c5
mov rcx, qword [rsp + 0x150]
cmp ebx, esi
jne 0x14000e808
cmp rdx, rdi
jle 0x14000e810
lea rdx, [rsp + 0x150]
mov r8, rsi
mov qword [rsp + 0x548], rcx
mov qword [rsp + 0x150], rdi
call fcn.1400c6a44
lea rcx, [rsp + 0x548]
mov qword [rsp + 0x110], rax
call fcn.140052160
jmp 0x14000e6c7
cmp ebx, edi
jle 0x14000e6c7
lea rsi, [0x1400fa8c8]
mov qword [rsp + 0x110], rsi
jmp 0x14000e6c7
lea rcx, [rsp + 0x150]
mov edx, 0x105
call fcn.14005a250
mov rdx, qword [rsp + 0x150]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x150]
xor edx, edx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp rax, rdi
je 0x14000e868
mov word [rax], di
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x110], rax
jmp 0x14000e6c7
mov rdx, qword [rsp + 0xe08]
lea rcx, str.logs:
mov r8d, 5
call fcn.140053674
cmp al, dil
je 0x14000e93c
mov rbx, qword [rsp + 0xe08]
mov esi, edi
mov eax, 0x3f
add rbx, 0xa
mov qword [rsp + 0xe08], rbx
mov qword [rsp + 0x378], rbx
cmp ax, word [rbx]
sete sil
cmp esi, edi
je 0x14000e8da
add rbx, 2
mov qword [rsp + 0x378], rbx
lea rdx, [rsp + 0x3a8]
lea rcx, [rsp + 0x378]
mov r8d, 1
mov qword [rsp + 0x3a8], rdi
call fcn.1400256a8
mov r8, qword [rsp + 0x3a8]
cmp r8, rdi
mov qword [rsp + 0xe08], rax
jle 0x14000e6c7
cmp esi, edi
je 0x14000e927
cmp qword [0x140117a58], rdi
je 0x14000e6c7
lea rcx, [rsp + 0x188]
mov rdx, rbx
call fcn.14005a3b8
jmp 0x14000e6c7
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa8c4]
mov r8d, ebx
call fcn.14005c928
cmp al, dil
je 0x14000e969
mov eax, 1
mov byte [rsp + 0x139], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.nowin
mov r8d, 5
call fcn.14005c928
cmp al, dil
je 0x14000e999
mov eax, 1
mov byte [rsp + 0x80], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.hide
mov r8d, 4
call fcn.14005c928
cmp al, dil
je 0x14000e9c2
mov edx, 0x10000000
jmp 0x14000eb59
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa8ac]
mov r8d, 4
call fcn.14005c928
cmp al, dil
je 0x14000e9f9
mov eax, 1
add dword [rsp + 0x278], eax
mov dword [rsp + 0x84], eax
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.waiti
mov r8d, 5
call fcn.14005c928
cmp al, dil
je 0x14000ea29
mov eax, 1
mov byte [rsp + 0x81], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa8a0]
mov r8d, 3
call fcn.14005c928
cmp al, dil
je 0x14000ea56
mov eax, 1
or byte [rsp + 0x73], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa898]
mov r8d, 4
call fcn.14005c928
cmp al, dil
je 0x14000ea7f
or byte [rsp + 0x73], 3
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.limit
mov r8d, 5
call fcn.14005c928
cmp al, dil
je 0x14000eaaf
mov eax, 1
mov byte [rsp + 0xfc], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa88c]
mov r8d, 3
call fcn.14005c928
cmp al, dil
je 0x14000eadf
mov eax, 1
mov byte [rsp + 0xc8], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.hook
mov r8d, 4
call fcn.14005c928
cmp al, dil
je 0x14000eb0f
mov eax, 1
mov dword [rsp + 0x134], eax
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa880]
mov r8d, 3
call fcn.14005c928
cmp al, dil
je 0x14000eb35
mov edx, 6
jmp 0x14000eb59
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa87c]
mov r8d, 3
call fcn.14005c928
cmp al, dil
je 0x14000eb65
mov edx, 3
mov dword [rsp + 0xb8], edx
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.show
mov r8d, 4
call fcn.14005c928
cmp al, dil
je 0x14000eb95
mov eax, 1
mov dword [rsp + 0xb8], eax
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.runs
mov r8d, 4
call fcn.14005c928
cmp al, dil
je 0x14000ebc5
mov eax, 1
mov byte [rsp + 0x128], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa868]
mov r8d, ebx
call fcn.14005c928
cmp al, dil
jne 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.no64
mov r8d, 4
call fcn.14005c928
cmp al, dil
jne 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa85c]
mov r8d, 3
call fcn.14005c928
cmp al, dil
je 0x14000ec38
mov eax, 1
mov byte [rsp + 0x138], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa858]
mov r8d, ebx
call fcn.14005c928
cmp al, dil
je 0x14000ec65
mov eax, 1
mov byte [rsp + 0x130], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.incmd
mov r8d, 5
call fcn.14005c928
cmp al, dil
je 0x14000ec95
mov eax, 1
mov byte [rsp + 0xcb], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.svr_
mov r8d, 3
call fcn.14005c928
cmp al, dil
je 0x14000ecc0
mov dword [rsp + 0xf8], edi
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.svrsys
mov r8d, 6
call fcn.14005c928
cmp al, dil
je 0x14000ece9
mov eax, 0x20000
jmp 0x14000ed74
lea rdx, [rsp + 0xe08]
lea rcx, str.svrsys_
mov r8d, 7
call fcn.14005c928
cmp al, dil
je 0x14000ed19
mov al, byte [0x1401178e0]
neg al
sbb eax, eax
and eax, 0x20000
jmp 0x14000ed74
lea rdx, [rsp + 0xe08]
lea rcx, str.svrusr
mov r8d, 6
call fcn.14005c928
cmp al, dil
je 0x14000ed49
mov eax, 1
or dword [rsp + 0xf8], eax
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.svrusr_
mov r8d, 7
call fcn.14005c928
cmp al, dil
je 0x14000ed80
cmp byte [0x1401178e0], dil
mov eax, edi
setne al
mov dword [rsp + 0xf8], eax
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.hidecmd
mov r8d, 7
call fcn.14005c928
cmp al, dil
je 0x14000edb0
mov eax, 1
mov byte [rsp + 0xcd], al
jmp 0x14000df8b
lea rdx, [rsp + 0xe08]
lea rcx, str.hidecmd_
mov r8d, 8
call fcn.14005c928
cmp al, dil
je 0x14000eddc
mov byte [rsp + 0xcd], dil
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa80c]
mov r8d, 3
call fcn.14005c928
cmp al, dil
je 0x14000ee0c
mov eax, 1
mov dword [rsp + 0xb0], eax
jmp 0x14000df8b
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400fa808]
mov r8d, 3
call fcn.140053674
cmp al, dil
je 0x14000ee3e
mov rsi, qword [rsp + 0xe08]
mov ecx, 0x108
add rsi, 6
jmp 0x14000ee71
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400fa804]
mov r8d, ebx
call fcn.140053674
cmp al, dil
je 0x14000ef19
mov rsi, qword [rsp + 0xe08]
mov eax, 4
add rsi, rax
lea ecx, [rax + 4]
mov qword [rsp + 0xe08], rsi
movzx eax, word [rsi]
mov dword [rsp + 0xb0], ecx
cmp ax, di
je 0x14000f564
mov r8d, 9
cmp r8w, ax
ja 0x14000eea6
mov edx, 0xd
cmp ax, dx
jbe 0x14000f52b
mov edx, 0x20
cmp dx, ax
je 0x14000f530
or ax, dx
mov edx, 0x61
cmp dx, ax
jne 0x14000eec8
lea eax, [rdx - 0x21]
or ecx, eax
jmp 0x14000eef6
mov edx, 0x65
cmp dx, ax
jne 0x14000eed8
bts ecx, 7
jmp 0x14000eef6
mov edx, 0x63
cmp dx, ax
jne 0x14000eee8
bts ecx, 8
jmp 0x14000eef6
mov edx, 0x64
cmp dx, ax
jne 0x14000eefd
bts ecx, 9
mov dword [rsp + 0xb0], ecx
add rsi, rbx
mov qword [rsp + 0xe08], rsi
mov ax, word [rsi]
cmp ax, di
je 0x14000f564
jmp 0x14000ee92
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400fa800]
mov r8d, 3
call fcn.140053674
cmp al, dil
je 0x14000efc9
mov r8, qword [rsp + 0xe08]
mov eax, 0x3a
mov byte [rsp + 0x74], 1
add r8, 6
mov qword [rsp + 0xe08], r8
cmp ax, word [r8]
jne 0x14000f564
add r8, rbx
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, di
je 0x14000f564
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000ef96
cmp ax, bp
jbe 0x14000efaf
cmp cx, ax
je 0x14000efaf
add r8, rbx
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, di
jne 0x14000ef8b
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f564
lea rcx, [rsp + 0x1d0]
jmp 0x14000e3fb
mov rdx, qword [rsp + 0xe08]
lea rcx, str.code:
mov r8d, 5
call fcn.140053674
cmp al, dil
je 0x14000f0b8
mov rax, qword [rsp + 0xe08]
lea rdx, [rsp + 0x2a0]
lea rcx, str.UTF8
add rax, 0xa
or r8d, 0xffffffff
mov qword [rsp + 0xe08], rax
mov qword [rsp + 0x2a0], rax
call fcn.14005c928
cmp al, dil
je 0x14000f046
mov dword [rsp + 0x160], 0xfde9
mov eax, 1
mov byte [rsp + 0x72], al
mov rsi, qword [rsp + 0xe08]
jmp 0x14000f525
lea rdx, [rsp + 0x2a0]
lea rcx, str.ANSI
or r8d, 0xffffffff
call fcn.14005c928
cmp al, dil
je 0x14000f06c
mov dword [rsp + 0x160], edi
jmp 0x14000f030
lea rdx, [rsp + 0x2a0]
lea rcx, [0x1400fa7e4]
or r8d, 0xffffffff
call fcn.14005c928
cmp al, dil
je 0x14000f09a
mov byte [rsp + 0x72], bl
mov dword [rsp + 0x160], 0x4b0
jmp 0x14000f039
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x2a0]
call fcn.14005e4b0
cmp eax, edi
jle 0x14000f039
jmp 0x14000f030
lea rdx, [rsp + 0xe08]
lea rcx, str.timeout:
mov r8d, 7
call fcn.14005ca04
cmp al, dil
je 0x14000f1a3
mov rax, qword [rsp + 0xe08]
mov ecx, 0x23
mov bl, dil
mov qword [rsp + 0x348], rax
cmp cx, word [rax]
jne 0x14000f0fc
mov bl, 1
jmp 0x14000f108
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14000f114
mov bl, 2
add rax, 2
mov qword [rsp + 0x348], rax
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x348]
mov qword [rsp + 0x260], rdi
call fcn.14005e3b0
cmp eax, edi
jle 0x14000f199
cmp dword [rsp + 0x260], edi
jle 0x14000f199
mov eax, dword [rsp + 0x260]
or dword [rsp + 0x84], 0x10
mov ecx, 0x3a
mov dword [rsp + 0x268], eax
mov rax, qword [rsp + 0x348]
mov byte [rsp + 0xa8], bl
lea ebx, [rcx - 0x38]
cmp cx, word [rax]
jne 0x14000f039
add rax, rbx
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x348]
mov qword [rsp + 0x348], rax
call fcn.14005e4b0
jmp 0x14000f039
mov ebx, 2
jmp 0x14000f039
mov rdx, qword [rsp + 0xe08]
lea rcx, str.user:
mov r8d, 5
call fcn.140053674
cmp al, dil
je 0x14000f234
mov r8, qword [rsp + 0xe08]
mov eax, 0xa
add r8, rax
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, di
je 0x14000f564
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000f201
cmp ax, bp
jbe 0x14000f21a
cmp cx, ax
je 0x14000f21a
add r8, rbx
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, di
jne 0x14000f1f6
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f564
lea rcx, [rsp + 0x148]
jmp 0x14000e3fb
mov rdx, qword [rsp + 0xe08]
lea rcx, str.passwd:
mov r8d, 7
call fcn.140053674
cmp al, dil
je 0x14000f25d
mov byte [rsp + 0xcc], dil
jmp 0x14000f288
mov rdx, qword [rsp + 0xe08]
lea rcx, str.passwd
mov r8d, 7
call fcn.140053674
cmp al, dil
je 0x14000f2f6
mov eax, 1
mov byte [rsp + 0xcc], al
mov r8, qword [rsp + 0xe08]
add r8, 0xe
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, di
je 0x14000f564
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000f2c3
cmp ax, bp
jbe 0x14000f2dc
cmp cx, ax
je 0x14000f2dc
add r8, rbx
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, di
jne 0x14000f2b8
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f564
lea rcx, [rsp + 0x120]
jmp 0x14000e3fb
lea rdx, [rsp + 0xe08]
lea rcx, str.REALTIME
mov r8d, 8
call fcn.14005c928
cmp al, dil
je 0x14000f326
mov eax, pe_nt_image_headers64
mov dword [rsp + 0x12c], eax
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.HIGH
mov r8d, 4
call fcn.14005c928
cmp al, dil
je 0x14000f355
mov dword [rsp + 0x12c], 0x80
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.ABOVENORMAL
mov r8d, 0xb
call fcn.14005c928
cmp al, dil
je 0x14000f384
mov dword [rsp + 0x12c], 0x8000
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.NORMAL
mov r8d, 6
call fcn.14005c928
cmp al, dil
je 0x14000f3b3
mov dword [rsp + 0x12c], 0x20
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, str.BELOWNORMAL
mov r8d, 0xb
call fcn.14005c928
cmp al, dil
je 0x14000f3e2
mov dword [rsp + 0x12c], 0x4000
jmp 0x14000f470
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa77c]
mov r8d, 3
call fcn.14005c928
cmp al, dil
jne 0x14000f465
mov rbx, qword [rsp + 0xe08]
lea rcx, [0x1400fa770]
mov r8d, 4
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, edi
jne 0x14000f47a
movzx eax, word [rbx + 8]
mov ecx, 9
cmp cx, ax
ja 0x14000f43b
mov ecx, 0xd
cmp ax, cx
jbe 0x14000f44a
mov ecx, 0x20
cmp cx, ax
je 0x14000f44a
cmp ax, di
jne 0x14000f47a
add qword [rsp + 0xe08], 8
lea rcx, [rsp + 0xe08]
call fcn.140052130
mov ebx, 2
mov dword [rsp + 0x12c], 0x40
mov eax, 1
jmp 0x14000df8b
mov ebx, 3
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa76c]
mov r8d, ebx
call fcn.14005c928
cmp al, dil
je 0x14000f4aa
lea eax, [rbx - 2]
mov byte [rsp + 0xac], al
jmp 0x14000df86
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa768]
mov r8d, ebx
call fcn.14005c928
cmp al, dil
je 0x14000f4e3
mov eax, 1
mov byte [rsp + 0x72], dil
mov dword [rsp + 0x160], edi
mov byte [rsp + 0xca], al
jmp 0x14000df86
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fa764]
mov r8d, ebx
call fcn.14005c928
cmp al, dil
je 0x14000f510
mov eax, 1
mov byte [rsp + 0x129], al
jmp 0x14000df86
mov eax, 0x2d
cmp ax, word [rsi]
mov qword [rsp + 0xe08], rsi
jne 0x14000f576
lea ebx, [rax - 0x2b]
mov r8d, 9
mov edx, 0x20
movzx eax, word [rsi]
cmp ax, di
je 0x14000f564
mov ebp, 0xd
cmp r8w, ax
ja 0x14000f548
cmp ax, bp
jbe 0x14000f560
cmp dx, ax
je 0x14000f560
add rsi, rbx
mov qword [rsp + 0xe08], rsi
mov ax, word [rsi]
cmp ax, di
jne 0x14000f53d
mov ebp, dword [rsp + 0x7c]
lea rcx, [rsp + 0xe08]
call fcn.140052130
jmp 0x14000f470
mov r8, rsi
mov eax, dword [rsp + 0xb0]
cmp eax, edi
je 0x14000f5d1
cmp byte [rsp + 0x80], dil
je 0x14000f59c
mov ecx, 4
or eax, ecx
mov dword [rsp + 0xb0], eax
cmp eax, edi
je 0x14000f5d1
cmp byte [rsp + 0x81], dil
je 0x14000f5b8
mov ecx, 0x20
or eax, ecx
mov dword [rsp + 0xb0], eax
cmp eax, edi
je 0x14000f5d1
cmp byte [rsp + 0xcb], dil
je 0x14000f5d1
bts eax, 0xa
mov dword [rsp + 0xb0], eax
mov rax, qword [rsp + 0x240]
cmp eax, edi
je 0x14000f61c
lea r8, [rsp + 0x570]
lea rcx, [rsp + 0x3c0]
mov edx, eax
mov dword [r8], 0x70
call fcn.140005ee0
mov r11, qword [rsp + 0x3c8]
mov r8, qword [rsp + 0xe08]
neg r11
sbb eax, eax
and eax, 0x80000
mov dword [rsp + 0xd0], eax
cmp dword [rsp + 0x160], 0x4b0
movzx eax, byte [rsp + 0x72]
mov rdx, qword [rsp + 0x478]
mov esi, 2
cmove eax, esi
mov dword [rsp + 0x440], eax
cmp rdx, rdi
je 0x14000f696
mov r8, rdx
mov qword [rsp + 0xe08], rdx
cmp byte [rsp + 0xc9], dil
jne 0x14000f696
cmp qword [rsp + 0x360], rdi
jne 0x14000f696
mov rcx, qword [rsp + 0xe00]
lea eax, [rsi - 1]
lea r8, [rsp + 0x1c0]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14006e854
mov r8, qword [rsp + 0x1c0]
mov qword [rsp + 0xe08], r8
mov rbx, qword [rsp + 0xf0]
mov qword [rsp + 0x3e0], rdi
mov qword [rsp + 0x3e8], rdi
mov qword [rsp + 0x3f0], rdi
mov qword [rsp + 0x2b8], rdi
cmp rbx, rdi
je 0x14000f6cd
cmp word [rbx], di
je 0x14000f6cd
cmp bp, di
je 0x14000f6d9
mov bpl, dil
mov dword [rsp + 0xac], ebp
jmp 0x14000f6e0
mov ebp, dword [rsp + 0xac]
lea rax, [0x1400f9d98]
mov r11w, di
mov r10w, di
mov r9w, di
mov qword [rsp + 0x378], rax
mov dword [rsp + 0xe0], r11d
mov dword [rsp + 0xb4], r10d
mov dword [rsp + 0xa0], r9d
cmp rbx, rdi
je 0x14000f83f
mov eax, 0x2a
lea edx, [rax - 0x29]
cmp word [rbx], ax
jne 0x14000f745
add rbx, rsi
add r11w, dx
cmp word [rbx], ax
je 0x14000f729
mov qword [rsp + 0xf0], rbx
mov dword [rsp + 0xe0], r11d
mov eax, 0x3f
cmp word [rbx], ax
jne 0x14000f795
add rbx, rsi
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0x378], rbx
movzx eax, word [rbx]
cmp ax, di
je 0x14000f795
mov ecx, 0x3a
add rbx, rsi
mov qword [rsp + 0xf0], rbx
cmp cx, ax
je 0x14000f789
mov ax, word [rbx]
cmp ax, di
jne 0x14000f76f
jmp 0x14000f795
mov word [rbx - 2], di
mov r8, qword [rsp + 0xe08]
movzx ecx, word [rbx]
mov eax, 0x63
or cx, 0x20
cmp cx, ax
jne 0x14000faca
movzx eax, word [rbx + 2]
or ax, word [rsp + 0x78]
cmp ax, word [rsp + 0x190]
jne 0x14000faca
movzx eax, word [rbx + 4]
or ax, word [rsp + 0x78]
cmp ax, 0x62
jne 0x14000faca
mov eax, 0x3a
cmp word [rbx + 6], ax
jne 0x14000faca
add rbx, 8
mov r10d, edx
mov dword [rsp + 0xb4], edx
mov qword [rsp + 0xf0], rbx
mov ecx, 0x20
cmp rbx, rdi
je 0x14000f83f
movzx eax, word [rbx]
or ax, cx
cmp ax, 0x75
jne 0x14000f83f
movzx eax, word [rbx + 2]
or ax, cx
mov ecx, 0x64
cmp ax, cx
jne 0x14000f83f
lea eax, [rcx - 0x2a]
cmp word [rbx + 4], ax
jne 0x14000f83f
add rbx, 6
mov r9d, edx
mov dword [rsp + 0xa0], edx
mov qword [rsp + 0xf0], rbx
cmp bpl, dil
je 0x14000f8a6
cmp rbx, rdi
je 0x14000f8a6
cmp r10w, di
jne 0x14000f8a6
cmp r9w, di
jne 0x14000f8a6
cmp byte [rsp + 0x75], dil
movzx eax, word [rbx]
mov edx, edi
setne dl
mov rcx, rbx
cmp ax, di
je 0x14000f8a6
mov r11d, 1
cmp word [rsp + 0x1c8], ax
jne 0x14000f88c
add edx, r11d
cmp edx, esi
jl 0x14000f88c
cmp word [rcx + 2], di
movzx ebp, bpl
cmovne ebp, edi
add rcx, rsi
mov ax, word [rcx]
cmp ax, di
jne 0x14000f870
mov r11d, dword [rsp + 0xe0]
mov dword [rsp + 0xac], ebp
cmp r11w, di
jne 0x14000f8b8
cmp r10w, di
jne 0x14000f8b8
cmp r9w, di
je 0x14000f8bd
mov byte [rsp + 0x75], dil
cmp bpl, dil
je 0x14000f920
cmp r9w, di
mov ecx, edi
mov eax, edi
sete cl
cmp r10w, di
sete al
test eax, ecx
je 0x14000f920
mov edx, 0x2a
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x2b8], rax
cmp rax, rdi
je 0x14000f901
mov word [rax], di
add rax, rsi
mov qword [rsp + 0x2b8], rax
lea rdx, [rsp + 0x3e0]
mov rcx, rbx
call fcn.14001c168
mov r8, qword [rsp + 0xe08]
mov dword [rsp + 0xe0], edi
mov rax, qword [rsp + 0x480]
mov r11d, 1
mov ecx, edi
mov dword [rax], r11d
xor eax, eax
cmp qword [rsp + 0x280], rdi
setne cl
mov qword [rsp + 0x4a0], rax
mov qword [rsp + 0x510], rax
mov qword [rsp + 0x518], rax
mov qword [rsp + 0x520], rax
mov al, byte [rsp + 0x130]
mov rbx, rdi
mov qword [rsp + 0x158], rdi
mov dword [rsp + 0x7c], edi
mov dword [rsp + 0x108], edi
mov qword [rsp + 0x288], rdi
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x370], rdi
mov rsi, rdi
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x208], rbx
mov rbp, rdi
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x498], rdi
mov qword [rsp + 0x508], rdi
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x4e8], 0x18
mov qword [rsp + 0x4f0], rdi
mov dword [rsp + 0x4f8], r11d
mov qword [rsp + 0x1e8], rdi
cmp al, dil
je 0x14000fa32
mov rax, qword [0x1401152d8]
lea rcx, [rsp + 0x570]
mov dword [rsp + 0x78], r11d
bts dword [rcx + 0x3c], 8
mov qword [rcx + 0x58], rax
mov rax, qword [0x1401152e0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1401152d0]
mov qword [rcx + 0x50], rax
mov eax, 0x26
cmp byte [rsp + 0xc9], dil
je 0x140010395
lea ecx, [rax + 0x56]
mov qword [rsp + 0x2a0], rdi
lea eax, [rcx - 0x7a]
cmp cx, word [r8]
jne 0x14000fa93
lea ebp, [rcx - 0x5c]
lea esi, [rcx - 0x73]
lea ebx, [rcx - 0x6f]
add r8, rax
mov qword [rsp + 0xe08], r8
cmp cx, word [r8]
je 0x14000fa62
cmp si, word [r8]
ja 0x14000fa7f
cmp word [r8], bx
jbe 0x14000fa62
cmp bp, word [r8]
je 0x14000fa62
mov rsi, qword [rsp + 0x198]
mov rbx, rdi
mov rbp, rdi
mov qword [rsp + 0x240], r8
mov qword [rsp + 0x98], rdi
mov r10, rdi
cmp word [r8], di
je 0x14000fc1e
cmp cx, word [r8]
jne 0x14000fb26
cmp cx, word [r8 + 2]
je 0x14000fb1d
mov r10, r8
mov qword [rsp + 0x98], r8
jmp 0x14000fb26
mov eax, 0x65
cmp cx, ax
jne 0x14000f7f9
movzx eax, word [rbx + 2]
mov ecx, 0x20
or ax, cx
cmp ax, 0x78
jne 0x14000f7fe
lea eax, [rcx + 0x1a]
cmp word [rbx + 4], ax
jne 0x14000f7fe
mov eax, pe_nt_image_headers64
add rbx, 6
mov r10w, ax
mov qword [rsp + 0xf0], rbx
mov dword [rsp + 0xb4], r10d
jmp 0x14000f7fe
add r8, rax
cmp cx, word [r8]
je 0x14000fb1d
add r8, rax
cmp word [r8], di
jne 0x14000fab0
cmp r10, rdi
je 0x14000fc1e
mov word [r10], di
add qword [rsp + 0x98], rax
lea rcx, [rsp + 0x98]
call fcn.140052130
mov rax, qword [rsp + 0x98]
movzx ecx, word [rax]
mov qword [rsp + 0x260], rax
cmp cx, di
je 0x14000fbee
mov edx, 0x7c
cmp dx, cx
jne 0x14000fbc4
lea rcx, [rax + 2]
mov qword [rsp + 0x368], rcx
cmp dx, word [rcx]
jne 0x14000fbc4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x368]
mov rcx, qword [rsp + 0x260]
movsxd r8, eax
add r8, r8
call fcn.14001b760
mov rax, qword [rsp + 0x260]
mov edx, 0x7c
jmp 0x14000fbbf
add rax, 2
cmp dx, word [rax]
je 0x14000fbbb
add rax, 2
mov qword [rsp + 0x260], rax
mov cx, word [rax]
cmp cx, di
jne 0x14000fb72
mov r10, qword [rsp + 0x98]
mov qword [rsp + 0x290], r10
cmp word [r10], di
jne 0x14000fc03
mov r8, qword [rsp + 0xe08]
mov eax, 2
lea ecx, [rax + 0x7a]
jmp 0x14000fa9b
mov rdx, qword [rsp + 0x240]
mov r11d, 1
mov al, r11b
cmp word [rdx], di
je 0x14000fc29
mov cl, r11b
jmp 0x14000fc43
mov rdx, qword [rsp + 0x240]
mov al, dil
cmp al, dil
mov cl, dil
cmove r10, rdx
mov qword [rsp + 0x290], r10
mov qword [rsp + 0x98], r10
cmp cl, dil
je 0x14000fdb7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x558]
lea rdx, [rsp + 0x100]
mov qword [rsp + 0x3a8], rax
mov eax, 1
lea rcx, [rsp + 0xd8]
xor r9d, r9d
mov dword [rsp + 0x558], 0x18
mov qword [rsp + 0x560], rdi
mov dword [rsp + 0x568], eax
call qword [sym.imp.KERNEL32.dll_CreatePipe]
cmp eax, edi
jne 0x14000fcb5
mov rcx, qword [rsp + 0xe00]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call fcn.14001d848
mov rax, qword [rsp + 0x3a8]
mov rdx, qword [rsp + 0xd8]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0xd8]
mov r8, rax
mov rcx, rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rax, qword [rsp + 0x100]
mov word [rsp + 0x130], di
cmp rax, rdi
je 0x14000fd47
mov rdx, qword [rsp + 0x240]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xe00]
lea r9, [rsp + 0x130]
mov qword [rsp + 0x28], rdi
mov r8, rax
mov rcx, rax
mov dword [rsp + 0x20], edi
call fcn.14000d03c
mov rcx, qword [rsp + 0x100]
cmp rcx, rdi
je 0x14000fd47
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xd8]
mov eax, 1
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x3a8]
lea r9, [rsp + 0xd8]
mov r8, rax
mov rcx, rax
mov qword [rsp + 0x100], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r11, qword [rsp + 0xd8]
mov r10, qword [rsp + 0x290]
cmp r11, rdi
je 0x14000fdb7
mov eax, 1
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x570]
bts dword [rax + 0x3c], 8
mov qword [rax + 0x50], r11
mov r8, r10
mov qword [rsp + 0x98], r10
mov r9d, 0x3e
lea edx, [r9 - 2]
movzx eax, word [r8]
cmp ax, di
je 0x140010308
mov ecx, 2
cmp ax, dx
je 0x14000fdfd
cmp ax, r9w
je 0x14000fdfd
add r8, rcx
mov qword [rsp + 0x98], r8
mov ax, word [r8]
cmp ax, di
jne 0x14000fdde
cmp word [r8], di
je 0x140010308
cmp dx, word [r8]
jne 0x14000ffcd
mov word [r8], di
add qword [rsp + 0x98], rcx
lea rcx, [rsp + 0x98]
call fcn.140052130
mov r8, qword [rsp + 0x98]
cmp word [r8], di
je 0x14000ffc3
mov rdx, r8
mov qword [rsp + 0x3b8], rdx
movzx eax, word [r8]
cmp ax, di
je 0x14000fe81
mov ecx, 0x3e
lea r9d, [rcx - 2]
cmp ax, r9w
je 0x14000fe79
cmp ax, cx
je 0x14000fe79
add r8, 2
mov qword [rsp + 0x98], r8
mov ax, word [r8]
cmp ax, di
jne 0x14000fe59
mov rbx, qword [rsp + 0x208]
sub r8, rdx
lea rcx, [rsp + 0x450]
sar r8, 1
call fcn.140064d38
lea rcx, [rsp + 0x2e0]
call fcn.14005a150
mov rdx, qword [rsp + 0x3b8]
mov rcx, qword [rsp + 0xe00]
mov eax, 1
lea r8, [rsp + 0x2e0]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14006e854
mov rcx, qword [rsp + 0x2e0]
mov qword [rsp + 0x3b8], rcx
call fcn.140017094
lea rcx, [rsp + 0x3b8]
call fcn.140052130
cmp rsi, rdi
je 0x14000fefa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x3b8]
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x4e8]
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x198]
mov r9d, 7
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x20], rax
call fcn.1400037e4
mov rsi, qword [rsp + 0x198]
cmp rsi, rdi
jne 0x14000ffa1
mov rdx, qword [rsp + 0x3b8]
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x4e8]
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x198]
mov r9d, 7
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rax
call fcn.1400037e4
mov rsi, qword [rsp + 0x198]
mov qword [rsp + 0x198], rsi
lea rcx, [rsp + 0x2e0]
call fcn.140052160
lea rcx, [rsp + 0x450]
call fcn.140052160
mov r8, qword [rsp + 0x98]
mov r9d, 0x3e
lea edx, [r9 - 2]
cmp r9w, word [r8]
jne 0x14000fdcc
mov word [r8], di
mov rax, qword [rsp + 0x98]
mov r8d, 1
lea ecx, [r8 + 0x31]
mov dword [rsp + 0x190], edi
mov byte [rsp + 0x72], r8b
lea edx, [rcx - 0x30]
cmp cx, word [rax - 2]
jne 0x140010012
mov word [rax - 2], di
mov rax, qword [rsp + 0x98]
mov byte [rsp + 0x72], dl
add rax, rdx
mov qword [rsp + 0x98], rax
cmp r9w, word [rax]
jne 0x140010036
add rax, rdx
mov dword [rsp + 0x190], r8d
mov qword [rsp + 0x98], rax
mov ecx, 0x26
cmp cx, word [rax]
jne 0x140010050
add rax, rdx
mov byte [rsp + 0x72], 3
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x98]
call fcn.140052130
mov r8, qword [rsp + 0x98]
mov edx, 0x3c
lea r9d, [rdx + 2]
cmp word [r8], di
je 0x14000fdcc
mov rdx, r8
mov qword [rsp + 0x218], rdx
movzx eax, word [r8]
cmp ax, di
je 0x1400100bb
mov ecx, r9d
lea r9d, [rcx - 2]
cmp ax, r9w
je 0x1400100b3
cmp ax, cx
je 0x1400100b3
add r8, 2
mov qword [rsp + 0x98], r8
mov ax, word [r8]
cmp ax, di
jne 0x140010093
mov rbp, qword [rsp + 0x250]
sub r8, rdx
lea rcx, [rsp + 0x2a8]
sar r8, 1
call fcn.140064d38
lea rcx, [rsp + 0x408]
call fcn.14005a150
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rsp + 0xe00]
mov eax, 1
lea r8, [rsp + 0x408]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14006e854
mov rcx, qword [rsp + 0x408]
mov qword [rsp + 0x218], rcx
call fcn.140017094
lea rcx, [rsp + 0x218]
call fcn.140052130
mov al, byte [rsp + 0x72]
mov r9d, 1
test r9b, al
je 0x140010152
cmp rbx, rdi
je 0x140010147
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [rsp + 0x72]
mov rbx, rdi
mov qword [rsp + 0x208], rbx
test al, 2
je 0x140010177
cmp rbp, rdi
je 0x140010164
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, rdi
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x2a0], rdi
mov rdx, qword [rsp + 0x218]
mov qword [rsp + 0x38], rdi
mov eax, 4
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x4e8]
lea rcx, [rsp + 0x470]
mov r9d, 7
mov r8d, 0x40000000
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x470], rdi
call fcn.1400037e4
mov qword [rsp + 0x230], rax
cmp rax, rdi
jne 0x140010281
mov rdx, qword [rsp + 0x218]
mov qword [rsp + 0x38], rdi
mov eax, 4
mov dword [rsp + 0x30], 0x2000000
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x4e8]
lea rcx, [rsp + 0x300]
mov r9d, 7
mov r8d, 0x40000000
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x300], rdi
call fcn.1400037e4
mov qword [rsp + 0x230], rax
cmp rax, rdi
jne 0x140010281
mov rdx, qword [rsp + 0x218]
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x4e8]
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0xc0]
mov r9d, 7
mov r8d, 0x40000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0x20], rax
call fcn.1400037e4
mov qword [rsp + 0x230], rax
cmp rax, rdi
je 0x1400102e1
cmp dword [rsp + 0x190], edi
je 0x14001029e
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [rsp + 0x72]
mov ecx, 1
cmp al, cl
jne 0x1400102b5
mov rax, qword [rsp + 0x230]
jmp 0x1400102c9
cmp al, 3
mov rax, qword [rsp + 0x230]
mov qword [rsp + 0x2a0], rax
jne 0x1400102d6
mov rbx, rax
mov qword [rsp + 0x208], rax
jmp 0x1400102e1
mov rbp, rax
mov qword [rsp + 0x250], rax
lea rcx, [rsp + 0x408]
call fcn.140052160
lea rcx, [rsp + 0x2a8]
call fcn.140052160
mov r8, qword [rsp + 0x98]
jmp 0x14000fdc2
mov r11d, 1
lea rcx, [rsp + 0x570]
cmp rsi, rdi
je 0x140010329
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x78], r11d
mov qword [rcx + 0x50], rsi
cmp rbx, rdi
je 0x14001033c
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x78], r11d
mov qword [rcx + 0x58], rbx
mov rax, qword [rsp + 0x2a0]
cmp rax, rdi
je 0x140010357
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x78], r11d
mov qword [rcx + 0x60], rax
mov rdx, qword [rsp + 0x290]
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x1e8]
xor r9d, r9d
mov byte [rsp + 0x20], r11b
call fcn.14006e854
mov r8, qword [rsp + 0x1e8]
mov eax, 0x26
mov qword [rsp + 0xe08], r8
lea r11d, [rax - 0x25]
mov ebx, dword [rsp + 0xb8]
mov sil, dil
mov ebp, 0x24
cmp word [r8], 0x21
je 0x1400103fa
mov ecx, 0x2a
cmp word [r8], cx
je 0x1400103fa
mov ecx, 0x40
cmp word [r8], cx
jne 0x140010412
lea rdx, str.WinSta0WinLogon
lea rcx, [rsp + 0x398]
call fcn.140064e2c
mov r11, qword [rsp + 0x398]
mov r8, qword [rsp + 0xe08]
lea rax, [rsp + 0x570]
mov qword [rax + 0x10], r11
mov r11d, 1
add sil, r11b
mov ebx, 0x10000000
add r8, 2
mov eax, 0x26
mov qword [rsp + 0xe08], r8
jmp 0x1400103a4
mov ecx, 0x3d
cmp word [r8], cx
jne 0x14001042f
or dword [rsp + 0x84], r11d
add dword [rsp + 0x278], r11d
jmp 0x1400103ff
cmp word [r8], bp
jne 0x14001043c
mov byte [rsp + 0x74], r11b
jmp 0x1400103ff
cmp word [r8], ax
jne 0x140010449
mov ebx, 3
jmp 0x1400103ff
mov eax, 0x5e
cmp word [r8], ax
je 0x14001045b
cmp word [r8], 0x5f
jne 0x140010462
mov ebx, 6
jmp 0x1400103ff
mov rbp, qword [rsp + 0x250]
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0xb8], ebx
mov byte [rsp + 0x70], sil
mov rsi, qword [rsp + 0x198]
mov dword [rsp + 0xb8], ebx
cmp ebx, 0x10000000
mov rbx, qword [rsp + 0x208]
je 0x1400104e6
mov ecx, dword [rsp + 0xa4]
cmp cl, dil
je 0x1400104e6
lea rdx, str.WinSta0Default
lea rcx, [rsp + 0x398]
call fcn.140064e2c
mov r11, qword [rsp + 0x398]
mov r8, qword [rsp + 0xe08]
lea rax, [rsp + 0x570]
mov qword [rax + 0x10], r11
lea r11, [rsp + 0x570]
mov edx, 1
cmp qword [r11 + 0x10], rdi
je 0x140010521
test byte [rsp + 0x70], dl
je 0x140010521
call fcn.14000ce8c
mov r8, qword [rsp + 0xe08]
mov edx, 1
cmp eax, edx
lea r11, [rsp + 0x570]
jge 0x140010521
mov qword [r11 + 0x10], rdi
mov rax, qword [rsp + 0xe30]
cmp rax, rdi
je 0x14001054c
bts dword [r11 + 0x3c], 8
mov ecx, edi
mov byte [rsp + 0x71], dil
mov dword [rsp + 0x84], ecx
mov dword [rsp + 0x78], edx
mov qword [r11 + 0x58], rax
jmp 0x140010553
mov ecx, dword [rsp + 0x84]
mov eax, dword [rsp + 0xb0]
cmp eax, edi
je 0x14001056c
cmp ecx, edi
je 0x14001056c
or eax, 0x10
mov dword [rsp + 0xb0], eax
cmp byte [rsp + 0x74], dil
je 0x14001059c
mov rax, qword [rsp + 0x1d0]
cmp word [rax], di
jne 0x14001059c
lea rdx, str.open
lea rcx, [rsp + 0x1d0]
call fcn.140064d94
mov r8, qword [rsp + 0xe08]
mov cl, byte [rsp + 0x128]
cmp cl, dil
je 0x1400107a7
mov edx, 0x5c
mov rcx, r8
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rcx, qword [rsp + 0xe08]
mov r11, rax
add rax, 2
mov rdi, rcx
test r11, r11
cmovne rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
neg dword [rsp + 0x84]
movsxd rcx, eax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 1
lea eax, [rcx + rcx]
sbb rcx, rcx
mov r8, rdi
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xe08]
neg rcx
add rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.14005349c
cdqe
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x1e8]
call fcn.140052160
xor edi, edi
mov rcx, qword [rsp + 0x100]
cmp rcx, rdi
je 0x14001064b
cmp rcx, 0xffffffffffffffff
je 0x14001064b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x100], rdi
cmp rcx, rdi
je 0x14001066c
cmp rcx, 0xffffffffffffffff
je 0x14001066c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd8], rdi
cmp rbp, rdi
je 0x140010688
cmp rbp, 0xffffffffffffffff
je 0x140010688
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rdi
je 0x14001069c
cmp rbx, 0xffffffffffffffff
je 0x14001069c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rdi
je 0x1400106b0
cmp rsi, 0xffffffffffffffff
je 0x1400106b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x158]
call fcn.140052160
lea rcx, [rsp + 0x3e0]
call fcn.140052160
lea rcx, [rsp + 0x1c0]
call fcn.140052160
lea rcx, [rsp + 0x150]
call fcn.140052160
lea rcx, [rsp + 0x210]
call fcn.140052160
lea rcx, [rsp + 0x1d0]
call fcn.140052160
lea rcx, [rsp + 0x220]
call fcn.140052160
lea rcx, [rsp + 0x1f0]
call fcn.140052160
lea rcx, [rsp + 0x170]
call fcn.140052160
lea rcx, [rsp + 0x3c0]
call fcn.140005ff8
lea rcx, [rsp + 0x1b0]
call fcn.140052160
lea rcx, [rsp + 0x120]
call fcn.140052160
lea rcx, [rsp + 0x148]
call fcn.140052160
lea rcx, [rsp + 0x118]
call fcn.140052160
lea rcx, [rsp + 0x188]
call fcn.140052160
lea rcx, [rsp + 0x168]
call fcn.140052160
lea rcx, [rsp + 0x178]
call fcn.140052160
lea rcx, [rsp + 0x180]
call fcn.140052160
mov rdi, qword [rsp + 0xc0]
jmp 0x140014df0
lea rcx, [rsp + 0xe08]
call fcn.140052130
xor ecx, ecx
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x1f8], rcx
cmp qword [rsp + 0x280], rcx
je 0x1400108f2
lea rcx, [rsp + 0x3a0]
mov byte [rsp + 0x74], dil
call fcn.14005a150
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0xe00]
or r9d, 0xffffffff
xor r8d, r8d
call fcn.14001c5dc
mov rdx, rax
cmp rax, rdi
je 0x1400109c9
mov rax, qword [rax]
cmp word [rax], di
je 0x1400109c9
lea rcx, [rsp + 0x3a0]
call fcn.140064de0
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x1f8]
call fcn.140064e2c
mov r11, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x3a0]
lea r9, [rsp + 0x2b0]
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x1f8]
mov qword [rsp + 0x20], r11
call fcn.140008c78
lea rcx, [rsp + 0x3a0]
movsxd r11, eax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0xe08], rax
cmp r11d, edi
je 0x1400108e3
mov qword [rsp + 0xc0], r11
call fcn.140052160
lea rcx, [rsp + 0x1f8]
call fcn.140052160
mov rcx, qword [rsp + 0x2b0]
cmp rcx, rdi
je 0x1400108d1
cmp rcx, 0xffffffffffffffff
je 0x1400108d1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140052160
jmp 0x140010632
call fcn.140052160
mov rdi, qword [rsp + 0x2b0]
xor ecx, ecx
mov rax, qword [rsp + 0x168]
cmp word [rax], cx
je 0x140010b64
mov rcx, qword [rsp + 0xe08]
call fcn.140019d38
lea rdx, str.__k:0
lea rcx, [rsp + 0x3d8]
or r8, 0xffffffffffffffff
mov qword [rsp + 0xe08], rax
call fcn.140064d54
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x3d8]
call fcn.14005a28c
lea rdx, [0x1400fa6a4]
lea rcx, [rsp + 0x3d8]
call fcn.14005a28c
mov rdx, qword [rsp + 0x168]
lea rcx, [rsp + 0x3d8]
call fcn.14005a28c
mov rdx, qword [rsp + 0x3d8]
mov rcx, qword [rsp + 0xe00]
xor r8d, r8d
call fcn.14008b398
lea rcx, [rsp + 0x3d8]
mov qword [rsp + 0xc0], rax
call fcn.140052160
lea rcx, [rsp + 0x1f8]
call fcn.140052160
test rdi, rdi
je 0x140010623
cmp rdi, 0xffffffffffffffff
je 0x140010623
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010623
lea rcx, [rsp + 0x3a0]
call fcn.140052160
lea rcx, [rsp + 0x1f8]
call fcn.140052160
lea rcx, [rsp + 0x1e8]
call fcn.140052160
mov rcx, qword [rsp + 0x100]
cmp rcx, rdi
je 0x140010a09
cmp rcx, 0xffffffffffffffff
je 0x140010a09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x100], rdi
cmp rcx, rdi
je 0x140010a2a
cmp rcx, 0xffffffffffffffff
je 0x140010a2a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd8], rdi
cmp rbp, rdi
je 0x140010a46
cmp rbp, 0xffffffffffffffff
je 0x140010a46
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rdi
je 0x140010a5a
cmp rbx, 0xffffffffffffffff
je 0x140010a5a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rdi
je 0x140010a6e
cmp rsi, 0xffffffffffffffff
je 0x140010a6e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x158]
call fcn.140052160
lea rcx, [rsp + 0x3e0]
call fcn.140052160
lea rcx, [rsp + 0x1c0]
call fcn.140052160
lea rcx, [rsp + 0x150]
call fcn.140052160
lea rcx, [rsp + 0x210]
call fcn.140052160
lea rcx, [rsp + 0x1d0]
call fcn.140052160
lea rcx, [rsp + 0x220]
call fcn.140052160
lea rcx, [rsp + 0x1f0]
call fcn.140052160
lea rcx, [rsp + 0x170]
call fcn.140052160
lea rcx, [rsp + 0x3c0]
call fcn.140005ff8
lea rcx, [rsp + 0x1b0]
call fcn.140052160
lea rcx, [rsp + 0x120]
call fcn.140052160
lea rcx, [rsp + 0x148]
call fcn.140052160
lea rcx, [rsp + 0x118]
call fcn.140052160
lea rcx, [rsp + 0x188]
call fcn.140052160
lea rcx, [rsp + 0x168]
call fcn.140052160
lea rcx, [rsp + 0x178]
call fcn.140052160
lea rcx, [rsp + 0x180]
call fcn.140052160
mov rdi, 0xffffffff80070057
jmp 0x140014df0
mov al, byte [rsp + 0x88]
cmp al, cl
je 0x140011047
lea rcx, [rsp + 0xf0]
call fcn.14005a150
mov rcx, qword [rsp + 0xe08]
and dword [rsp + 0x134], 0
call fcn.140019d38
lea rcx, [rsp + 0x110]
mov qword [rsp + 0xe08], rax
call fcn.14005a150
mov rcx, qword [rsp + 0xe08]
and qword [rsp + 0x1e0], 0
lea r8, [rsp + 0x1e0]
lea rdx, [rsp + 0x110]
call fcn.1400c6a44
mov r11, qword [rsp + 0x1e0]
xor eax, eax
cmp r11, rax
jne 0x140010c2e
lea rcx, [rsp + 0x110]
call fcn.140052160
lea rcx, [rsp + 0xf0]
call fcn.140052160
lea rcx, [rsp + 0x1f8]
call fcn.140052160
test rdi, rdi
je 0x140010c1a
cmp rdi, 0xffffffffffffffff
je 0x140010c1a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140052160
xor edi, edi
jmp 0x1400109f0
mov word [r11 - 2], ax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x2b8]
mov qword [rsp + 0x260], rax
call fcn.140064d14
mov rax, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0x400]
mov qword [rsp + 0xc0], rax
call fcn.140064d14
mov r11, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x400]
mov rcx, qword [rsp + 0xc0]
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x134]
mov qword [rsp + 0x20], r11
call fcn.140008588
xor eax, eax
cmp dword [rsp + 0x134], eax
jle 0x140010d52
mov rcx, qword [rsp + 0xe00]
cmp qword [rcx + 0x40], rax
jne 0x140010cd3
xor edx, edx
call fcn.1400192c4
xor eax, eax
mov r9, qword [rsp + 0xe00]
mov rcx, rax
mov qword [rsp + 0x2e0], rax
mov rdx, qword [r9 + 0x40]
cmp rdx, rax
je 0x140010cfb
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x2e0], rcx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rsp + 0x2e0]
mov r9d, dword [rsp + 0x354]
mov r8d, dword [rsp + 0x350]
xor eax, eax
mov edx, 0x128
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x260]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rcx, qword [rsp + 0x2e0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.USER32.dll_DestroyMenu]
xor eax, eax
cmp dword [rsp + 0x134], eax
jle 0x140010e76
mov rcx, qword [rsp + 0xf0]
mov r8, rcx
mov qword [rsp + 0xc0], rcx
movzx edx, word [rcx]
cmp dx, ax
je 0x140010db2
lea r9d, [rax + 0xd]
lea r10d, [rax + 0xa]
cmp dx, r9w
je 0x140010daa
cmp dx, r10w
je 0x140010daa
add rcx, 2
mov dx, word [rcx]
cmp dx, ax
jne 0x140010d92
mov rsi, qword [rsp + 0x198]
mov word [rcx], ax
cmp word [r8], ax
je 0x140010e76
lea rdx, str.__k:0
lea rcx, [rsp + 0x1a0]
or r8, 0xffffffffffffffff
call fcn.140064d54
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x1a0]
call fcn.14005a28c
lea rdx, [0x1400fa6a4]
lea rcx, [rsp + 0x1a0]
call fcn.14005a28c
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x1a0]
call fcn.14005a28c
mov rdx, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0xe00]
xor r8d, r8d
call fcn.14008b398
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0xc0], rax
call fcn.140052160
lea rcx, [rsp + 0x400]
call fcn.140052160
lea rcx, [rsp + 0x2b8]
call fcn.140052160
lea rcx, [rsp + 0x110]
call fcn.140052160
lea rcx, [rsp + 0xf0]
jmp 0x140010996
lea rcx, [rsp + 0x400]
call fcn.140052160
lea rcx, [rsp + 0x2b8]
call fcn.140052160
lea rcx, [rsp + 0x110]
call fcn.140052160
lea rcx, [rsp + 0xf0]
call fcn.140052160
lea rcx, [rsp + 0x1f8]
call fcn.140052160
test rdi, rdi
je 0x140010ecb
cmp rdi, 0xffffffffffffffff
je 0x140010ecb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140052160
mov rcx, qword [rsp + 0x100]
xor edi, edi
cmp rcx, rdi
je 0x140010ef3
cmp rcx, 0xffffffffffffffff
je 0x140010ef3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x100], rdi
cmp rcx, rdi
je 0x140010f14
cmp rcx, 0xffffffffffffffff
je 0x140010f14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd8], rdi
cmp rbp, rdi
je 0x140010f30
cmp rbp, 0xffffffffffffffff
je 0x140010f30
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rdi
je 0x140010f44
cmp rbx, 0xffffffffffffffff
je 0x140010f44
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rdi
je 0x140010f58
cmp rsi, 0xffffffffffffffff
je 0x140010f58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x158]
call fcn.140052160
lea rcx, [rsp + 0x3e0]
call fcn.140052160
lea rcx, [rsp + 0x1c0]
call fcn.140052160
lea rcx, [rsp + 0x150]
call fcn.140052160
lea rcx, [rsp + 0x210]
call fcn.140052160
lea rcx, [rsp + 0x1d0]
call fcn.140052160
lea rcx, [rsp + 0x220]
call fcn.140052160
lea rcx, [rsp + 0x1f0]
call fcn.140052160
lea rcx, [rsp + 0x170]
call fcn.140052160
lea rcx, [rsp + 0x3c0]
call fcn.140005ff8
lea rcx, [rsp + 0x1b0]
call fcn.140052160
lea rcx, [rsp + 0x120]
call fcn.140052160
lea rcx, [rsp + 0x148]
call fcn.140052160
lea rcx, [rsp + 0x118]
call fcn.140052160
lea rcx, [rsp + 0x188]
call fcn.140052160
lea rcx, [rsp + 0x168]
call fcn.140052160
lea rcx, [rsp + 0x178]
call fcn.140052160
lea rcx, [rsp + 0x180]
call fcn.140052160
jmp 0x140014df0
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x2e8]
call fcn.140064d14
xor edi, edi
cmp byte [rsp + 0xcb], dil
je 0x140011107
lea rdx, str.PECMDpecmd_cmd
lea rcx, [rsp + 0x2e8]
call fcn.140064e2c
lea r8d, [rdi + 1]
lea rcx, [rsp + 0xe08]
xor edx, edx
call fcn.1400256a8
lea rcx, [rsp + 0x2e8]
mov rdx, rax
mov qword [rsp + 0xe08], rax
call fcn.14005a28c
lea rcx, [rsp + 0x170]
call fcn.140005e74
mov qword [rsp + 0xf0], rax
mov r10d, 4
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0xe08], rax
mov eax, dword [rsp + 0xb8]
cmp eax, 0x10000000
je 0x1400110f4
mov cl, byte [rsp + 0x129]
cmp cl, dil
je 0x1400115d1
lea r9, [rsp + 0x570]
bts dword [r9 + 0x3c], 7
jmp 0x1400115d9
mov al, byte [rsp + 0xcd]
cmp al, dil
je 0x1400110c0
mov edx, dword [rsp + 0xb8]
cmp edx, 0x10000000
je 0x1400110c0
mov rax, qword [rsp + 0x2e8]
lea rcx, [rsp + 0xe08]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0xe08], rax
call fcn.1400256a8
lea rdx, [rsp + 0x248]
lea rcx, [0x1400fa6a0]
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0xe08]
mov r8d, 3
mov qword [rsp + 0x248], rax
call fcn.14005c928
cmp al, dil
jne 0x140011298
lea rdx, [rsp + 0x248]
lea rcx, str.cmd.exe
mov r8d, 7
call fcn.14005c928
cmp al, dil
jne 0x140011298
mov rcx, qword [0x1401179c8]
cmp rcx, rdi
jne 0x140011219
xor r9d, r9d
lea rdx, [rsp + 0xbc0]
xor ecx, ecx
lea r8d, [r9 + 0x24]
mov word [rsp + 0xbc0], di
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rsp + 0xbc0]
lea rcx, [0x1401179c8]
call fcn.140064e2c
lea rdx, str.System32cmd.exe
lea rcx, [0x1401179c8]
call fcn.14005a28c
mov rcx, qword [0x1401179c8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x1401179c8]
mov word [0x140117990], ax
jmp 0x140011220
mov ax, word [0x140117990]
mov rdx, qword [rsp + 0x248]
movsx r8d, ax
mov dword [rsp + 0xa4], edi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, edi
jne 0x14001136f
mov rax, qword [rsp + 0x248]
movsx rcx, word [0x140117990]
lea rdx, [rax + rcx*2]
mov eax, 0x22
cmp ax, word [rdx]
je 0x140011281
mov eax, 9
cmp ax, word [rdx]
ja 0x140011273
mov eax, 0xd
cmp word [rdx], ax
jbe 0x140011281
mov eax, 0x20
cmp ax, word [rdx]
jne 0x14001136f
lea rcx, [rsp + 0x248]
mov qword [rsp + 0x248], rdx
call fcn.140006ea8
jmp 0x1400112a6
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0xa4], eax
lea rdx, [rsp + 0x248]
lea rcx, [0x1400fa66c]
mov r8d, 2
call fcn.14005c928
cmp al, dil
je 0x14001136f
mov rax, qword [rsp + 0x248]
mov ecx, 0x22
cmp cx, word [rax]
jne 0x140011333
add rax, 2
lea rcx, [rsp + 0x3f8]
mov qword [rsp + 0x3f8], rax
call fcn.140052130
mov rax, qword [rsp + 0x3f8]
mov ecx, 0x22
cmp cx, word [rax]
je 0x14001132b
lea r8d, [rcx - 0x1e]
lea rdx, [rsp + 0x3f8]
lea rcx, str.call
call fcn.14005c928
cmp al, dil
je 0x140011365
mov rax, qword [rsp + 0x3f8]
mov qword [rsp + 0x248], rax
lea rcx, [rsp + 0xe08]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xe08], rax
call fcn.1400256a8
mov dword [rsp + 0xa4], 1
mov r11, rax
mov qword [rsp + 0x1a8], rax
jmp 0x140011377
mov rax, qword [rsp + 0x248]
jmp 0x140011333
mov r11, qword [rsp + 0x1a8]
mov rax, r11
mov r10d, 4
sub rax, qword [rsp + 0xe08]
sar rax, 1
cmp eax, r10d
jle 0x1400110c6
lea rdx, str..cmd
lea rcx, [r11 - 8]
mov r8d, r10d
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, edi
je 0x1400113d3
mov rcx, qword [rsp + 0x1a8]
lea rdx, str..bat
mov r8d, 4
add rcx, 0xfffffffffffffff8
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, edi
jne 0x1400110c0
mov rcx, qword [rsp + 0x1a8]
xor edx, edx
mov r8d, 0x191
movzx eax, word [rcx]
mov word [rcx], di
lea rcx, [rsp + 0x950]
mov word [rsp + 0x88], ax
call fcn.1400dd9e0
mov rdx, qword [rsp + 0xe08]
mov qword [rsp + 0x38], rdi
lea r11, [rsp + 0x950]
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0x270]
mov r9d, 7
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x2a8], r11
mov byte [rsp + 0x130], dil
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x20], rdi
call fcn.1400037e4
mov qword [rsp + 0x20], rdi
mov rdi, qword [rsp + 0x270]
lea r9, [rsp + 0x238]
lea rdx, [rsp + 0x950]
mov r8d, 0x190
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, [rsp + 0x950]
lea rcx, str.::hidecmd::
mov r8d, 0xb
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
xor ecx, ecx
cmp eax, ecx
jne 0x140011508
mov edx, 0x10000000
lea r9d, [rcx + 1]
lea r8d, [rcx + 0xd]
mov dword [rsp + 0xb8], edx
mov dl, byte [rsp + 0x950]
lea r10d, [rcx + 0xa]
cmp dl, cl
je 0x1400114ec
lea rax, [rsp + 0x950]
cmp dl, r8b
je 0x1400114e4
cmp dl, r10b
je 0x1400114e4
add rax, r9
mov dl, byte [rax]
cmp dl, cl
jne 0x1400114d1
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x2a8]
movsx edx, byte [rax]
cmp dx, r10w
je 0x140011503
cmp dx, r8w
jne 0x140011510
add rax, r9
jmp 0x1400114f4
lea rax, [rsp + 0x950]
cmp dword [rsp + 0xa4], ecx
jne 0x14001156f
mov ecx, 0x3a
cmp byte [rax], cl
jne 0x14001152b
cmp byte [rax + 1], cl
jne 0x14001152b
add rax, 2
mov edx, 0x40
cmp byte [rax], dl
jne 0x14001153e
lea ecx, [rdx - 0x3f]
add rax, rcx
cmp byte [rax], dl
je 0x140011537
lea rcx, [0x1400fa630]
mov r8d, 7
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
mov edx, dword [rsp + 0x130]
xor ecx, ecx
cmp eax, ecx
lea eax, [rcx + 1]
movzx edx, dl
cmove edx, eax
mov dword [rsp + 0x130], edx
cmp rdi, rcx
je 0x140011583
cmp rdi, 0xffffffffffffffff
je 0x140011583
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x1a8]
mov ax, word [rsp + 0x88]
xor edi, edi
mov word [r11], ax
cmp byte [rsp + 0x130], dil
je 0x1400110c0
mov rdx, qword [rsp + 0xe08]
mov rcx, qword [rsp + 0xe00]
call fcn.140045210
lea rcx, [rsp + 0x2e8]
mov qword [rsp + 0xc0], rax
jmp 0x1400108a6
lea r9, [rsp + 0x570]
mov r8d, 1
cmp eax, edi
je 0x1400115ec
or dword [r9 + 0x3c], r8d
mov word [r9 + 0x40], ax
mov cl, byte [rsp + 0x70]
mov edx, 3
mov al, cl
and al, dl
cmp al, dl
je 0x140011607
cmp byte [rsp + 0x80], dil
je 0x14001160d
bts dword [r9 + 0x3c], 0x1b
cmp qword [r9 + 0x10], rdi
je 0x14001161b
cmp cl, dil
mov ecx, r8d
jg 0x14001161d
mov ecx, edi
mov eax, edi
mov dword [rsp + 0x130], edi
mov dword [rsp + 0x88], eax
cmp ecx, edi
je 0x140011643
mov eax, r10d
mov dword [rsp + 0x130], r8d
mov dword [rsp + 0x88], eax
mov dl, byte [rsp + 0x139]
cmp dl, dil
je 0x140011659
or eax, 0x10
mov dword [rsp + 0x88], eax
xor eax, eax
mov byte [rsp + 0x70], dil
cmp cl, al
je 0x140011697
movzx ecx, word [0x140118f8c]
test r10b, cl
jne 0x140011697
or cx, r10w
mov dil, r8b
mov byte [rsp + 0x70], r8b
mov word [0x140118f8c], cx
lea edx, [rax + 2]
lea rcx, str.SeDebugPrivilege
xor r8d, r8d
call fcn.14001a1f0
xor eax, eax
lea rcx, [0x140117fa0]
mov qword [rsp + 0x270], rcx
cmp byte [0x140117c40], al
jne 0x1400116e3
mov rcx, qword [rsp + 0xe10]
cmp rcx, rax
je 0x1400116c0
cmp byte [rcx + 0xc], al
jne 0x1400116e3
mov dl, byte [rsp + 0x138]
mov byte [rsp + 0x80], al
cmp dl, al
je 0x1400116eb
cmp rcx, rax
je 0x1400116eb
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x270], rax
mov byte [rsp + 0x80], 1
lea rcx, [rsp + 0x410]
xor edx, edx
call fcn.140064d14
xor edx, edx
mov qword [rsp + 0x98], rdx
cmp byte [rsp + 0x80], dl
je 0x140011bb4
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x740]
xor edx, edx
call fcn.14001c400
mov rax, qword [rsp + 0xe10]
test rax, rax
je 0x140011752
mov r8, qword [rsp + 0x270]
lea rcx, [rsp + 0x740]
mov rdx, rax
call fcn.140054e54
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x490]
mov edx, 0x106
mov qword [rsp + 0x270], rax
call fcn.14005a1c4
mov rcx, qword [rsp + 0x270]
mov r11, qword [rsp + 0x490]
xor eax, eax
cmp word [rcx], ax
je 0x1400118b9
mov rbx, r11
lea r10d, [rax + 2]
mov r9, rcx
mov qword [rsp + 0x450], rcx
add rcx, r10
movzx edx, word [rcx]
mov qword [rsp + 0x1a0], rcx
cmp dx, ax
je 0x1400117d1
mov r8d, 0x3d
cmp dx, r8w
je 0x1400117c9
add rcx, r10
mov dx, word [rcx]
cmp dx, ax
jne 0x1400117b8
mov qword [rsp + 0x1a0], rcx
mov rdx, rcx
sub rdx, r9
sar rdx, 1
mov qword [rsp + 0x300], rdx
cmp word [rcx], ax
je 0x14001189d
lea r8, [rcx + 2]
mov qword [rsp + 0x470], r8
cmp word [r8], ax
je 0x140011898
cmp edx, 0x104
jg 0x140011898
movsxd rax, edx
mov rcx, rbx
mov rdx, r9
add rax, rax
mov r8, rax
mov qword [rsp + 0xc0], rax
call fcn.14001b7a8
mov rax, qword [rsp + 0xc0]
xor esi, esi
lea rcx, [rsp + 0x740]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbx
mov word [rax + rbx], si
mov qword [rsp + 0x20], rsi
call fcn.140016e9c
cmp rax, rsi
jne 0x140011883
mov r9d, dword [rsp + 0x300]
mov r8, qword [rsp + 0x470]
mov rdx, qword [rsp + 0x450]
or qword [rsp + 0x20], 0xffffffffffffffff
lea rcx, [rsp + 0x740]
call fcn.14001c4f8
mov rcx, qword [rsp + 0x1a0]
mov r10d, 2
xor eax, eax
jmp 0x140011898
add rcx, r10
cmp word [rcx], ax
jne 0x140011895
add rcx, r10
cmp word [rcx], ax
jne 0x140011794
mov rbx, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
movsxd rdx, dword [rsp + 0x748]
xor eax, eax
cmp rdx, rax
mov dword [rsp + 0xa4], eax
mov rcx, rax
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x1a0], rdx
jle 0x140011a49
mov rdi, rdx
lea rax, [rcx + 1]
mov rbp, rcx
cmp rax, rdi
mov qword [rsp + 0x270], rax
mov rsi, rax
jge 0x14001198c
mov rax, rcx
shl rax, 3
mov qword [rsp + 0xc0], rax
mov rbx, rax
mov rcx, qword [rsp + 0x740]
mov rax, qword [rbx + rcx]
mov rdx, qword [rax]
mov rax, qword [rcx + rsi*8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jns 0x14001194a
mov rbx, rsi
mov rbp, rsi
shl rbx, 3
inc rsi
cmp rsi, rdi
jl 0x140011920
cmp rbp, qword [rsp + 0x2a8]
je 0x140011984
mov rcx, qword [rsp + 0x740]
mov r8, qword [rsp + 0xc0]
mov rax, qword [rcx + rbp*8]
mov rdx, qword [r8 + rcx]
mov qword [r8 + rcx], rax
mov rax, qword [rsp + 0x740]
mov qword [rax + rbp*8], rdx
mov rax, qword [rsp + 0x270]
cmp rax, rdi
mov rcx, rax
mov qword [rsp + 0x2a8], rax
jl 0x1400118f7
mov rdx, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x198]
mov rbp, qword [rsp + 0x250]
mov dil, byte [rsp + 0x70]
xor eax, eax
cmp rdx, rax
jle 0x140011a49
mov esi, dword [rsp + 0xa4]
mov rdi, rax
mov rbp, rdx
lea ebx, [rax + 1]
mov rax, qword [rsp + 0x740]
mov rcx, qword [rax + rdi*8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rsi + rax + 1]
mov dword [rsp + 0x1c8], eax
mov rax, qword [rsp + 0x740]
mov rcx, qword [rax + rdi*8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [rsp + 0x1c8]
add rdi, rbx
cmp rdi, rbp
lea esi, [rcx + rax + 3]
jl 0x1400119dc
mov rbx, qword [rsp + 0x208]
mov rbp, qword [rsp + 0x250]
mov dil, byte [rsp + 0x70]
mov dword [rsp + 0xa4], esi
mov rsi, qword [rsp + 0x198]
mov eax, dword [rsp + 0xa4]
lea rcx, [rsp + 0x410]
add eax, 4
movsxd rdx, eax
call fcn.14005a250
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x98], rax
mov rcx, rax
xor eax, eax
cmp qword [rsp + 0x1a0], rax
jle 0x140011b75
mov rbp, qword [rsp + 0x1a0]
xor esi, esi
mov rdi, rcx
mov rbx, rax
mov rax, qword [rsp + 0x740]
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx]
mov rcx, rax
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0xc0]
mov rcx, rdi
cdqe
add rax, rax
mov r8, rax
mov qword [rsp + 0x300], rax
call fcn.14001b7a8
add rdi, qword [rsp + 0x300]
mov eax, 0x3d
mov word [rdi], ax
mov rax, qword [rsp + 0x740]
add rdi, 2
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx + 8]
mov rcx, rax
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0xc0]
mov rcx, rdi
cdqe
add rax, rax
mov r8, rax
mov qword [rsp + 0x300], rax
call fcn.14001b7a8
add rdi, qword [rsp + 0x300]
inc rbx
mov word [rdi], si
add rdi, 2
cmp rbx, rbp
jl 0x140011a96
mov rbx, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x198]
mov rbp, qword [rsp + 0x250]
mov qword [rsp + 0x1e0], rdi
mov dil, byte [rsp + 0x70]
mov rcx, qword [rsp + 0x1e0]
xor eax, eax
mov word [rcx], ax
mov word [rcx + 2], ax
lea rcx, [rsp + 0x490]
call fcn.140052160
lea rcx, [rsp + 0x740]
xor edx, edx
call fcn.140044c48
lea rcx, [rsp + 0x7b0]
call fcn.140052160
lea rcx, [0x140118f08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rax, qword [rsp + 0x118]
mov ecx, 0x40
lea r8d, [rcx - 0x3f]
cmp cx, word [rax]
jne 0x140011bcf
mov al, r8b
jmp 0x140011be2
cmp qword [rsp + 0x228], rdx
movzx eax, dl
mov ecx, 2
cmovne eax, ecx
mov cl, byte [rsp + 0x71]
cmp cl, dl
je 0x140011d7f
or dword [rsp + 0x84], r8d
or cl, 8
neg al
sbb eax, eax
mov byte [rsp + 0x71], cl
and eax, 0xfff01000
add eax, 0x100000
mov dword [rsp + 0x1c8], eax
call fcn.140054c4c
lea rdx, str..pipepecmd_exec__u
lea rcx, [rsp + 0x6c0]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfA]
and qword [rsp + 0x38], 0
mov eax, 1
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x1c8]
lea rcx, [rsp + 0x6c0]
mov dword [rsp + 0x28], eax
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 6
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsp + 0x288], rax
test rax, rax
je 0x140011ce3
cmp rax, 0xffffffffffffffff
je 0x140011ce3
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x2f0]
or r8, 0xffffffffffffffff
call fcn.140064d54
xor ecx, ecx
mov r9d, 7
mov rdx, qword [rax]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x4e8]
mov dword [rsp + 0x28], 3
mov r8d, 0xc0000000
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x298]
call fcn.1400037e4
lea rcx, [rsp + 0x2f0]
call fcn.140052160
jmp 0x140011cee
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x298]
lea rdx, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x78], 2
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov cl, byte [rsp + 0x73]
mov r8d, 1
lea r9, [rsp + 0x570]
xor edx, edx
mov dword [rsp + 0x108], r8d
bts dword [r9 + 0x3c], 8
mov qword [rsp + 0x520], rax
mov qword [rsp + 0x498], rax
mov dword [rsp + 0x78], r8d
test cl, 2
jne 0x140011d60
cmp cl, dl
jne 0x140011d6e
mov rax, qword [rsp + 0x298]
mov qword [r9 + 0x58], rax
jmp 0x140011d76
mov rax, qword [rsp + 0x298]
test r8b, cl
je 0x140011d7f
mov qword [r9 + 0x60], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x1a8], rdx
mov qword [rsp + 0x1b8], rdx
neg rax
mov eax, dword [rsp + 0x12c]
mov qword [rsp + 0x230], rdx
sbb ecx, ecx
and ecx, 0x400
or ecx, eax
mov eax, dword [rsp + 0x88]
or eax, ecx
mov dword [rsp + 0x88], eax
cmp byte [rsp + 0xc8], dl
je 0x140011dd8
or eax, 0x1000004
mov dword [rsp + 0x88], eax
mov r10, qword [rsp + 0xf0]
cmp byte [rsp + 0x74], dl
je 0x140011def
cmp r10, rdx
je 0x140013610
mov al, byte [rsp + 0xfc]
mov r8d, dword [rsp + 0xb4]
mov ecx, dword [rsp + 0xa0]
cmp al, dl
je 0x140011f72
cmp r8w, dx
jne 0x140011f72
cmp cx, dx
jne 0x140011f72
mov r9, qword [rsp + 0xe08]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x1a8]
mov r8, r10
call fcn.140005d54
mov rcx, rax
mov rbx, rax
call fcn.140005ea4
xor ebp, ebp
cmp eax, ebp
jne 0x1400137bd
mov eax, dword [rsp + 0xf8]
cmp eax, ebp
je 0x140011eec
mov edx, dword [rsp + 0x88]
mov r8d, dword [rsp + 0xd0]
mov qword [rsp + 0x68], rbp
movzx eax, ax
or r8d, edx
mov rdx, qword [rsp + 0xe08]
or eax, 2
lea rcx, [0x1400f9e60]
xor r9d, r9d
mov qword [rsp + 0x60], rcx
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x310]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x570]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0xf0]
xor r8d, r8d
call fcn.140006f48
jmp 0x140011f67
xor ecx, ecx
call fcn.140005c38
mov edx, dword [rsp + 0x88]
mov r8d, dword [rsp + 0xd0]
or r8d, edx
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x310]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x570]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rcx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x30], r8d
mov r8, qword [rsp + 0xe08]
mov dword [rsp + 0x28], ecx
mov rcx, rax
mov qword [rsp + 0x4e0], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov esi, eax
mov dword [rsp + 0x7c], eax
jmp 0x140013795
mov rax, qword [rsp + 0x148]
cmp word [rax], dx
je 0x140012293
cmp r8w, dx
jne 0x140012293
cmp cx, dx
jne 0x140012293
mov r11b, byte [rsp + 0xcc]
xor ebp, ebp
mov esi, ebp
mov dword [rsp + 0x7c], ebp
cmp r11b, bpl
je 0x1400120ae
mov rdx, qword [rsp + 0x120]
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x3b0]
mov r9, rax
mov r8, rax
mov qword [rsp + 0x3b0], rbp
call fcn.14005a08c
lea rcx, [rsp + 0x380]
call fcn.140059e74
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x120]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400dd9e0
mov rcx, qword [rsp + 0x3b0]
lea rdx, [rsp + 0x380]
call fcn.140060764
mov rdx, qword [rsp + 0x380]
mov ebx, ebp
cmp rax, rbp
lea rcx, [rsp + 0x120]
setne bl
or rax, 0xffffffffffffffff
mov r9, rax
mov r8, rax
call fcn.14005a30c
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x3b0]
xor edx, edx
movsxd r8, eax
call fcn.1400dd9e0
mov rcx, qword [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x380]
xor edx, edx
movsxd r8, eax
call fcn.1400dd9e0
lea rcx, [rsp + 0x380]
call fcn.140052160
lea rcx, [rsp + 0x3b0]
call fcn.140052160
cmp ebx, ebp
je 0x140012248
mov rbx, qword [rsp + 0x148]
jmp 0x1400120b1
mov rbx, rax
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, rbp
jne 0x1400120e0
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, rbp
jne 0x1400120e0
lea rax, [0x1400f9e60]
jmp 0x1400120ef
mov word [rax], bp
lea rbx, [rax + 2]
mov rax, qword [rsp + 0x148]
mov r9, qword [rsp + 0xe08]
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x1a8]
mov qword [rsp + 0x1e0], rax
call fcn.140005d54
mov rcx, rax
mov rsi, rax
call fcn.140005ea4
cmp eax, ebp
je 0x14001213c
mov ebx, 3
mov dword [rsp + 0x10c], ebx
jmp 0x1400137bd
mov eax, dword [rsp + 0xf8]
cmp eax, ebp
je 0x1400121cc
mov edx, dword [rsp + 0xd0]
movzx ecx, ax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x1e0]
or edx, 1
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], ecx
mov rcx, qword [rsp + 0xf0]
lea rax, [rsp + 0x310]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x570]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov rdx, qword [rsp + 0xe08]
mov dword [rsp + 0x20], ebp
call fcn.140006f48
jmp 0x140012242
mov edx, dword [rsp + 0x88]
mov r9d, dword [rsp + 0xd0]
mov r8, qword [rsp + 0x120]
lea rax, [rsp + 0x310]
or r9d, 1
mov rcx, rbx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x570]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xe08]
mov dword [rsp + 0x30], edx
mov rdx, qword [rsp + 0x1e0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [rsp + 0x7c], eax
mov esi, eax
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x120]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400dd9e0
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x148]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400dd9e0
jmp 0x140013795
cmp byte [rsp + 0xac], dl
je 0x140012365
cmp r10, rdx
je 0x1400122b4
mov eax, 0x26
cmp ax, word [r10]
je 0x140012365
cmp word [rsp + 0xe0], dx
jne 0x140012365
cmp r8w, dx
jne 0x140012365
cmp cx, dx
jne 0x140012365
mov rbx, qword [rsp + 0x110]
mov rcx, rbx
call fcn.140005ea4
xor ebp, ebp
cmp eax, ebp
jne 0x14001212b
mov edx, dword [rsp + 0x88]
mov rax, qword [rsp + 0x2b8]
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0xe08]
mov rcx, qword [rsp + 0x3e0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x310]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x570]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
mov edx, dword [rsp + 0x3e8]
call fcn.1400c9698
mov esi, ebp
cmp eax, ebp
setg sil
mov dword [rsp + 0x7c], esi
jmp 0x140013795
lea rcx, [rsp + 0x2c8]
mov qword [rsp + 0x238], rdx
mov dword [rsp + 0x7c], edx
mov qword [rsp + 0x308], rdx
mov qword [rsp + 0x2c0], rdx
mov qword [rsp + 0x200], r10
mov qword [rsp + 0x340], r10
call fcn.140059e74
xor eax, eax
lea rcx, [rsp + 0x448]
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], rax
mov qword [rsp + 0x1e0], rcx
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x218], rax
mov qword [rsp + 0x448], rax
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x388], rcx
cmp word [rsp + 0xa0], ax
je 0x140012501
mov rbx, qword [rsp + 0x200]
lea r10d, [rax + 0x22]
lea r9d, [rax + 2]
cmp r10w, word [rbx]
jne 0x140012417
add rbx, r9
mov qword [rsp + 0x200], rbx
lea rcx, [rsp + 0x200]
mov edx, 0x3a
call fcn.1400cb7a8
mov rcx, qword [rsp + 0x200]
xor ebp, ebp
cmp rcx, rbx
je 0x14001244b
cmp word [rcx - 2], r10w
jne 0x14001244b
mov word [rcx - 2], bp
mov rcx, qword [rsp + 0x200]
cmp dx, word [rcx]
jne 0x140012466
mov word [rcx], bp
mov rcx, qword [rsp + 0x200]
add rcx, r9
mov qword [rsp + 0x200], rcx
mov rsi, rcx
cmp r10w, word [rcx]
jne 0x140012494
lea rsi, [rcx + 2]
add rcx, r9
mov qword [rsp + 0x200], rcx
cmp r10w, word [rcx]
jne 0x14001248f
mov word [rcx], bp
mov rcx, qword [rsp + 0x200]
cmp word [rcx], bp
jne 0x140012473
cmp word [rsp + 0xb4], bp
je 0x1400124c3
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x238], rax
cmp rax, rbp
je 0x1400124c3
mov word [rax], bp
add rax, 2
mov qword [rsp + 0x238], rax
lea rdx, [rsp + 0x2c8]
mov r9d, 0x10000
mov r8, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call fcn.14004c6bc
mov r11, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2c8]
add rsi, r11
mov qword [rsp + 0x218], rsi
jmp 0x140012d76
mov rdx, qword [rsp + 0x200]
cmp rdx, rax
je 0x14001274c
mov ecx, 0x26
cmp word [rdx], cx
jne 0x140012728
mov rcx, qword [rsp + 0xe00]
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.140016e9c
mov qword [rsp + 0x2f0], rax
test rax, rax
jne 0x1400126c8
lea rcx, [rsp + 0x140]
call fcn.140052160
lea rcx, [rsp + 0x2c8]
call fcn.140052160
lea rcx, [rsp + 0x2c0]
call fcn.140052160
lea rcx, [rsp + 0x230]
call fcn.140052160
lea rcx, [rsp + 0x1b8]
call fcn.140052160
lea rcx, [rsp + 0x1a8]
call fcn.140052160
lea rcx, [rsp + 0x410]
call fcn.140052160
test dil, dil
je 0x1400125c9
xor r8d, r8d
mov eax, 0xfffb
lea rcx, str.SeDebugPrivilege
and word [0x140118f8c], ax
lea edx, [r8 + 4]
call fcn.14001a1f0
lea rcx, [rsp + 0x2e8]
call fcn.140052160
lea rcx, [rsp + 0x1f8]
call fcn.140052160
mov rcx, qword [rsp + 0x2b0]
xor edi, edi
cmp rcx, rdi
je 0x1400125fe
cmp rcx, 0xffffffffffffffff
je 0x1400125fe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140052160
mov rcx, qword [rsp + 0x100]
cmp rcx, rdi
je 0x140012624
cmp rcx, 0xffffffffffffffff
je 0x140012624
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x100], rdi
cmp rcx, rdi
je 0x140012645
cmp rcx, 0xffffffffffffffff
je 0x140012645
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xd8], rdi
cmp rbp, rdi
je 0x140012661
cmp rbp, 0xffffffffffffffff
je 0x140012661
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, rdi
je 0x140012675
cmp rbx, 0xffffffffffffffff
je 0x140012675
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rdi
je 0x140012689
cmp rsi, 0xffffffffffffffff
je 0x140012689
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x298]
cmp rax, rdi
je 0x1400126a5
cmp rax, 0xffffffffffffffff
je 0x1400126a5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x288]
cmp rax, rdi
je 0x140010a6e
cmp rax, 0xffffffffffffffff
je 0x140010a6e
mov rcx, rax
jmp 0x140010a68
mov rdx, qword [rax + 0x18]
movabs rax, 0x3fffffffffffffff
lea rcx, [rsp + 0x2c8]
and rdx, rax
mov qword [rsp + 0x2d0], rdx
add rdx, 0x10
call fcn.140059f54
mov r8, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2f0]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x2c8]
inc r8
mov rsi, rax
mov qword [rsp + 0x218], rax
call fcn.14001b7a8
xor ebp, ebp
jmp 0x140012d76
neg byte [rsp + 0x75]
mov ebx, 2
lea rcx, [rsp + 0x340]
sbb edx, edx
and edx, ebx
call fcn.14006cd5c
mov qword [rsp + 0x308], rax
jmp 0x140012759
mov rax, qword [rsp + 0x308]
mov ebx, 2
xor ebp, ebp
mov qword [rsp + 0x200], rbp
mov qword [rsp + 0x4d0], rbp
cmp rax, rbp
jne 0x140012c42
mov r9, qword [rsp + 0xe08]
mov qword [rsp + 0x200], r9
cmp r9, rbp
je 0x1400127a9
lea eax, [rbp + 0x2a]
cmp word [r9], ax
jne 0x1400127a9
lea eax, [rbp + 1]
add word [rsp + 0xe0], ax
lea rax, [r9 + 2]
mov qword [rsp + 0x200], rax
cmp byte [rsp + 0xac], bpl
je 0x1400127bb
mov word [rsp + 0xe0], bp
cmp word [rsp + 0xb4], bp
je 0x14001288f
mov rcx, qword [rsp + 0x340]
xor edx, edx
lea r8d, [rdx + 0x3a]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rsi, rax
mov qword [rsp + 0x238], rax
cmp rax, rbp
je 0x140012876
add rsi, rbx
mov word [rax], bp
mov qword [rsp + 0x238], rsi
je 0x140012876
mov r9, qword [rsp + 0x340]
mov eax, 0x22
mov dword [rsp + 0xa0], ebx
mov qword [rsp + 0x1e0], rbp
mov rbx, rbp
cmp ax, word [r9]
jne 0x140012861
add r9, 2
lea rcx, [rsp + 0x388]
mov edx, eax
mov qword [rsp + 0x340], r9
mov qword [rsp + 0x388], r9
call fcn.1400cb7a8
mov rcx, qword [rsp + 0x388]
cmp word [rcx], bp
je 0x140012861
mov word [rcx], bp
mov r9, qword [rsp + 0x340]
lea rcx, [rsp + 0x140]
mov rdx, r9
call fcn.140064d94
jmp 0x140012dc0
mov rax, qword [rsp + 0x308]
cmp rax, rbp
jne 0x140012c42
mov r9, qword [rsp + 0xe08]
mov rbx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x1a8]
mov r8, rbx
call fcn.140005d54
mov rcx, rax
mov rsi, rax
mov qword [rsp + 0x110], rax
call fcn.140005ea4
cmp eax, ebp
jne 0x1400135d0
cmp byte [rsp + 0x71], bpl
jne 0x1400129c4
mov rcx, qword [rsp + 0xe08]
xor edx, edx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
cmp rax, rbp
je 0x1400128f7
add rbx, 2
jmp 0x1400128ff
mov rbx, qword [rsp + 0xe08]
lea rcx, str.winpeshl
mov r8d, 8
mov rdx, rbx
call fcn.140053674
mov esi, 0x2e
cmp al, bpl
je 0x14001294e
movzx eax, word [rbx + 0x10]
cmp bp, ax
je 0x140012946
cmp si, ax
je 0x140012946
lea ecx, [rsi - 0x25]
cmp cx, ax
ja 0x14001293c
lea ecx, [rsi - 0x21]
cmp ax, cx
jbe 0x140012946
mov ecx, 0x20
cmp cx, ax
jne 0x14001294e
mov byte [rsp + 0x90], 1
lea rcx, str.wpeinit
mov r8d, 8
mov rdx, rbx
call fcn.140053674
cmp al, bpl
je 0x1400129b4
movzx eax, word [rbx + 0xe]
cmp bp, ax
je 0x140012994
cmp si, ax
je 0x140012994
mov ecx, 9
cmp cx, ax
ja 0x14001298a
mov ecx, 0xd
cmp ax, cx
jbe 0x140012994
mov ecx, 0x20
cmp cx, ax
jne 0x1400129b4
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x110]
mov r9d, 1
mov byte [rsp + 0x90], r9b
jmp 0x1400129ca
mov rsi, qword [rsp + 0x110]
mov rbx, qword [rsp + 0xf0]
mov r9d, 1
mov edx, dword [rsp + 0xe20]
test r9b, dl
jne 0x1400129df
cmp dword [rsp + 0x134], ebp
je 0x140012a24
mov rcx, qword [rsp + 0xe08]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.Shell.x
lea rdx, str.SOFTWAREPELOGON
movsxd rcx, eax
mov r9d, 1
lea eax, [rcx + rcx]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xe08]
mov qword [rsp + 0x20], rax
call fcn.14005349c
mov eax, dword [rsp + 0xb0]
mov edx, dword [rsp + 0x88]
xor r9d, r9d
cmp eax, ebp
je 0x140012a96
mov ecx, dword [rsp + 0xd0]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x310]
mov qword [rsp + 0x48], rax
or ecx, edx
mov rdx, qword [rsp + 0xe08]
lea rax, [rsp + 0x570]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.140003bc4
jmp 0x140012b6b
mov eax, dword [rsp + 0xf8]
cmp eax, ebp
je 0x140012b17
mov r8d, dword [rsp + 0xd0]
mov qword [rsp + 0x68], rbp
movzx eax, ax
or r8d, edx
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400f9e60]
mov qword [rsp + 0x60], rcx
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x310]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x570]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], ecx
mov rcx, rbx
xor r8d, r8d
call fcn.140006f48
jmp 0x140012b6b
mov ecx, dword [rsp + 0xd0]
lea rax, [rsp + 0x310]
xor r8d, r8d
mov qword [rsp + 0x48], rax
or ecx, edx
mov rdx, qword [rsp + 0xe08]
lea rax, [rsp + 0x570]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1400dcefc
mov esi, eax
mov dword [rsp + 0x7c], eax
neg eax
sbb cl, cl
and cl, byte [rsp + 0x90]
mov byte [rsp + 0x90], cl
cmp cl, bpl
je 0x140012bc0
call fcn.140025a3c
mov ecx, dword [rsp + 0x84]
cmp eax, ebp
je 0x140012ba2
or ecx, 1
mov dword [rsp + 0x84], ecx
cmp ecx, ebp
jne 0x140012bc0
lea rcx, str.waitpeinit.pecmd
call fcn.1400dcf68
mov ecx, ebp
cmp eax, ebp
setne cl
mov dword [rsp + 0x84], ecx
cmp esi, ebp
jne 0x14001376e
mov eax, dword [rsp + 0x134]
mov r8, qword [rsp + 0xe08]
lea rdx, str._CreateProcess__s__d___d__r_n
lea rcx, [0x140117fa0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
call fcn.1400172b0
cmp byte [rsp + 0x74], bpl
jne 0x14001376e
cmp rbx, rbp
jne 0x14001376e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x14001376e
lea rcx, [rsp + 0x140]
call fcn.140052160
lea rcx, [rsp + 0x2c8]
call fcn.140052160
lea rcx, [rsp + 0x2c0]
call fcn.140052160
jmp 0x140013612
mov rsi, rax
mov qword [rsp + 0xc0], rax
cmp word [rsp + 0xb4], bp
je 0x140012c89
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x3a]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov qword [rsp + 0x238], rax
cmp rax, rbp
je 0x140012c81
mov word [rax], bp
add rax, rbx
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x308]
add rax, rbx
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x308]
mov qword [rsp + 0x308], rax
call fcn.14006cc6c
movzx ecx, word [rsi]
mov r9d, 0x20
mov r8, rax
mov qword [rsp + 0x2f0], rax
mov rax, qword [0x140117df0]
mov word [rsi], bp
mov word [rsp + 0xfc], cx
mov rcx, qword [rsp + 0x340]
lea esi, [r9 + 0xe]
mov dword [rsp + 0x190], r9d
mov rbx, rbp
cmp si, word [rcx]
jne 0x140012cf1
cmp word [rcx + 2], bp
je 0x140012d13
cmp word [rcx], bp
je 0x140012d13
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r8, qword [rsp + 0x2f0]
mov r9d, 0x20
mov rbx, rax
mov rcx, qword [rsp + 0xc0]
mov dx, word [rsp + 0xfc]
mov word [rcx], dx
cmp rax, rbp
je 0x140012d65
mov rdx, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x190]
mov dword [rsp + 0x190], r9d
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x2c8]
mov rcx, rax
call fcn.14001c914
mov rsi, rax
mov qword [rsp + 0x218], rax
jmp 0x140012d68
mov rsi, rbp
cmp rbx, rbp
je 0x140012d76
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp qword [rsp + 0x2d0], rbp
je 0x14001376a
cmp rsi, rbp
je 0x14001376a
mov dword [rsp + 0xa0], 1
cmp word [rsp + 0xe0], bp
ja 0x140012db0
cmp word [rsp + 0xb4], bp
je 0x140013498
mov rsi, qword [rsp + 0x238]
mov rbx, qword [rsp + 0x388]
mov r8, qword [rsp + 0x1e0]
lea rax, [0x1400f9d98]
cmp rbx, rbp
cmovne rax, qword [rsp + 0x378]
lea r9, str.exedat
lea rcx, [rsp + 0x158]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140007428
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x1b8]
call fcn.140064de0
mov rbx, qword [rsp + 0x448]
lea rax, [rsp + 0x448]
cmp rbx, rbp
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x1e0], rax
setne al
mov dword [rsp + 0x1c8], ebp
mov qword [rsp + 0x388], rcx
cmp al, bpl
je 0x140012e7f
mov r8d, dword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x218]
lea r9, [rsp + 0x1c8]
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.140056fc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140012e91
mov eax, 1
cmp dword [rsp + 0xa0], eax
jle 0x14001376a
mov rdx, qword [rsp + 0x158]
mov byte [rsp + 0x70], bpl
cmp rsi, rbp
je 0x1400130bd
mov rax, qword [rsp + 0x140]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x140], rbp
mov qword [rsp + 0x458], rax
call fcn.140064e2c
lea rdx, str..ex
lea rcx, [rsp + 0x140]
call fcn.14005a28c
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x1b8]
call fcn.140064de0
mov eax, 0x5c
mov rbx, rsi
cmp ax, word [rsi]
je 0x140012f09
lea rbx, [rsi - 2]
mov word [rbx], ax
mov rcx, qword [rsp + 0x1b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [rsp + 0xb4]
mov ecx, 1
cmp cx, ax
jne 0x140012fa3
lea rdx, [0x1400fa528]
lea rcx, [rsp + 0x280]
call fcn.140064d14
mov rdx, qword [rsp + 0x458]
lea rcx, [rsp + 0x280]
call fcn.14005a28c
lea rdx, [0x1400fa520]
lea rcx, [rsp + 0x280]
call fcn.14005a28c
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0x280]
call fcn.14005a28c
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0xe00]
call fcn.140039248
lea rcx, [rsp + 0x280]
call fcn.140052160
jmp 0x140013089
mov ecx, pe_nt_image_headers64
cmp cx, ax
jne 0x140013089
xor edx, edx
lea rcx, [rsp + 0x840]
mov dword [rsp + 0x830], 0x68
lea r8d, [rdx + 0x58]
mov qword [rsp + 0x838], rbp
call fcn.1400dd9e0
mov rcx, qword [rsp + 0x458]
xor eax, eax
mov qword [rsp + 0x530], rax
mov qword [rsp + 0x538], rax
lea rax, [rsp + 0x528]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x830]
lea rdx, [0x1400fa518]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1b8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xd0]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov dword [rsp + 0x86c], 0x80
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x528], rbp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x528]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x528]
cmp rcx, rbp
je 0x140013076
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x530]
cmp rcx, rbp
je 0x140013089
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x140]
mov rdx, rbx
call fcn.14005a28c
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x1a8]
call fcn.140064de0
lea rcx, [rsp + 0x458]
call fcn.140052160
jmp 0x1400130ca
lea rcx, [rsp + 0x1b8]
call fcn.140064e2c
mov r9, qword [rsp + 0xe08]
mov edx, 0x22
mov rax, r9
cmp dx, word [r9]
jne 0x1400130e4
lea rax, [r9 + 2]
mov ecx, 0x3f
cmp cx, word [rax]
jne 0x1400131e5
lea rsi, [rax + 2]
cmp cx, word [rsi]
jne 0x14001310c
mov rbx, qword [rsp + 0x140]
lea rsi, [rax + 4]
jmp 0x140013193
mov eax, 0x5c
cmp ax, word [rsi]
jne 0x1400131dd
cmp dx, word [r9]
je 0x14001318b
mov rax, qword [rsp + 0x1b8]
mov ebx, 0x104
lea rcx, [rsp + 0x1b8]
mov rdx, rbx
mov qword [rsp + 0x1b8], rbp
mov qword [rsp + 0x4a8], rax
call fcn.14005a250
mov rax, qword [rsp + 0x1b8]
mov r8d, ebx
mov word [rax], bp
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rcx, [rsp + 0x4a8]
call fcn.140052160
mov r9, qword [rsp + 0xe08]
mov edx, 0x22
mov rbx, qword [rsp + 0x1b8]
cmp dx, word [r9]
jne 0x1400131ad
lea rdx, [0x1400f97c4]
lea rcx, [rsp + 0x230]
call fcn.140064e2c
lea rcx, [rsp + 0x230]
mov rdx, rbx
call fcn.14005a28c
lea rcx, [rsp + 0x230]
mov rdx, rsi
call fcn.14005a28c
mov r9, qword [rsp + 0x230]
mov qword [rsp + 0xe08], r9
mov rsi, qword [rsp + 0x238]
cmp rsi, rbp
je 0x140013250
mov ecx, dword [rsp + 0xe0]
cmp cx, bp
ja 0x140013321
mov rcx, qword [rsp + 0x1a8]
lea rdx, [rsp + 0x2c8]
mov rsi, rbp
mov qword [rsp + 0x238], rbp
call fcn.14001c168
cmp qword [rsp + 0x2d0], rbp
je 0x140013248
mov eax, 1
mov bl, al
mov byte [rsp + 0x70], al
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x218], rax
mov esi, dword [rsp + 0x7c]
jmp 0x14001345a
mov r9, qword [rsp + 0xe08]
mov r8, qword [rsp + 0x140]
mov rbx, r8
cmp rsi, rbp
je 0x14001326c
movzx eax, word [rsi]
neg ax
sbb rcx, rcx
and rbx, rcx
mov rax, qword [rsp + 0x110]
lea rcx, [rsp + 0x1a8]
cmp rax, rbp
cmove rax, qword [rsp + 0x1b8]
mov rdx, rax
call fcn.140005d54
mov rcx, rax
mov rsi, rax
mov qword [rsp + 0x110], rax
call fcn.140005ea4
cmp eax, ebp
jne 0x140013759
mov ecx, dword [rsp + 0xb0]
mov edx, dword [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
cmp ecx, ebp
je 0x140013369
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x50], ecx
lea rcx, [rsp + 0x570]
or eax, edx
lea rdx, [rsp + 0x310]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0xe08]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.140003bc4
jmp 0x140013435
cmp byte [rsp + 0x74], bpl
je 0x140013250
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x238], rbp
cmp rax, rbp
cmove rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x110], rax
mov eax, 2
mov bl, al
mov byte [rsp + 0x70], al
cmp cx, ax
jb 0x140012c16
jmp 0x14001323f
mov eax, dword [rsp + 0xf8]
cmp eax, ebp
je 0x1400133e4
mov ecx, dword [rsp + 0xd0]
mov qword [rsp + 0x68], rbp
movzx eax, ax
or ecx, edx
lea rdx, [0x1400f9e60]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x310]
lea rax, [rsp + 0x570]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0xe08]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.140006f48
jmp 0x140013435
mov eax, dword [rsp + 0xd0]
lea rcx, [rsp + 0x570]
or eax, edx
lea rdx, [rsp + 0x310]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0xe08]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1400dcefc
cmp byte [rsp + 0xe0], 2
mov esi, eax
mov dword [rsp + 0x7c], eax
jl 0x14001376e
cmp word [rsp + 0xb4], bp
jne 0x14001376e
mov bl, bpl
mov eax, 1
cmp bl, al
jne 0x140013468
or edx, 0xffffffff
jmp 0x140013473
lea rax, [rsp + 0x310]
mov edx, dword [rax + 0x10]
mov rcx, qword [rsp + 0x158]
call fcn.14000470c
mov rax, qword [rsp + 0x158]
mov word [rax], bp
mov eax, 1
cmp bl, al
jne 0x140013608
mov rbx, qword [rsp + 0xe08]
mov edx, 0x22
mov rax, rbx
cmp dx, word [rbx]
jne 0x1400134b1
lea rax, [rbx + 2]
mov ecx, 0x3f
movzx esi, bp
cmp cx, word [rax]
jne 0x1400134dc
mov ecx, 0x5c
cmp cx, word [rax + 2]
jne 0x1400134dc
lea rbx, [rax + 4]
cmp dx, word [rbx]
jne 0x1400134dc
sub rbx, 2
mov si, word [rbx]
mov word [rbx], dx
mov rcx, qword [rsp + 0x110]
call fcn.140005ea4
cmp eax, ebp
jne 0x1400135d0
mov r9d, dword [rsp + 0x78]
mov edx, dword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x218]
mov qword [rsp + 0x48], rbp
lea rax, [rsp + 0x310]
mov r8, rbx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x570]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
call fcn.1400c9698
mov dword [rsp + 0xac], eax
cmp si, bp
je 0x140013560
mov word [rbx], si
cmp eax, ebp
jl 0x140012db0
lea rax, [rsp + 0x310]
mov r8d, dword [rax + 0x10]
cmp r8d, ebp
je 0x140012db0
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rbp
je 0x140012db0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0xac], ebp
mov rax, qword [rsp + 0x158]
mov esi, ebp
setg sil
mov dword [rsp + 0x7c], esi
cmp rax, rbp
je 0x14001376e
cmp word [rax], bp
je 0x14001376e
mov bl, byte [rsp + 0x70]
jmp 0x14001345a
mov ebx, 3
mov dword [rsp + 0x10c], ebx
lea rcx, [rsp + 0x140]
call fcn.140052160
lea rcx, [rsp + 0x2c8]
call fcn.140052160
lea rcx, [rsp + 0x2c0]
call fcn.140052160
jmp 0x1400137bd
cmp bl, 2
jmp 0x140012c10
xor ebp, ebp
xor edx, edx
lea rcx, [rsp + 0x658]
mov dword [rsp + 0x650], 0x70
lea r8d, [rdx + 0x68]
call fcn.1400dd9e0
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x110]
cmp edx, ebp
mov eax, 5
mov dword [rsp + 0x654], 0x4540
cmovne ax, dx
movzx eax, ax
mov dword [rsp + 0x680], eax
cmp rcx, rbp
je 0x14001367b
mov rax, qword [rsp + 0x678]
cmp word [rcx], bp
cmovne rax, rcx
mov qword [rsp + 0x678], rax
mov rax, qword [rsp + 0x1d0]
lea rdx, [rsp + 0x4c8]
lea rcx, [rsp + 0x4b8]
mov qword [rsp + 0x660], rax
mov rax, qword [rsp + 0xe08]
mov r8d, 1
mov qword [rsp + 0x4b8], rax
mov qword [rsp + 0x668], rax
mov qword [rsp + 0x4c8], rbp
call fcn.1400256a8
mov rdx, qword [rsp + 0x4b8]
mov rbx, rax
cmp word [rax], bp
jne 0x1400136e0
cmp rdx, qword [rsp + 0xe08]
je 0x140013705
mov r8, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x210]
call fcn.14005a3b8
mov r11, qword [rsp + 0x210]
mov qword [rsp + 0x668], r11
mov rax, qword [rsp + 0x670]
cmp word [rbx], bp
lea rcx, [rsp + 0x650]
cmovne rax, rbx
mov qword [rsp + 0x670], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rbx, [rsp + 0x310]
mov esi, eax
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x6b8]
mov rcx, rax
mov qword [rbx], rax
mov qword [rsp + 0x6b8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x10], eax
jmp 0x140013795
mov eax, 3
mov dword [rsp + 0x10c], eax
jmp 0x1400135dc
mov esi, dword [rsp + 0x7c]
lea rcx, [rsp + 0x140]
call fcn.140052160
lea rcx, [rsp + 0x2c8]
call fcn.140052160
lea rcx, [rsp + 0x2c0]
call fcn.140052160
cmp esi, ebp
je 0x1400137a4
mov ebx, ebp
mov dword [rsp + 0x10c], ebx
jmp 0x1400137b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x10c], eax
mov rax, qword [rsp + 0x480]
mov dword [rax], ebx
mov rcx, qword [rsp + 0x2b0]
cmp rcx, rbp
je 0x1400137d6
cmp rcx, 0xffffffffffffffff
je 0x1400137d6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + 0x100]
mov rbx, rbp
mov qword [rsp + 0x2b0], rbx
cmp qword [rsi], rbp
je 0x1400137f7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x220]
mov qword [rsi], rbp
mov rsi, qword [rsp + 0xe00]
cmp r8, rbp
je 0x140013822
lea rax, [rsp + 0x310]
mov rcx, rsi
mov edx, dword [rax + 0x10]
call fcn.14005d18c
mov r8, qword [rsp + 0x1f0]
cmp r8, rbp
je 0x140013880
mov edx, 0x26
mov rax, r8
cmp dx, word [r8]
jne 0x14001384f
lea rcx, [r8 + 2]
jmp 0x14001384a
mov rax, rcx
add rcx, 2
cmp dx, word [rcx]
je 0x140013843
cmp dx, word [rax]
jne 0x140013858
add rax, 2
mov ecx, 0x3a
jmp 0x140013863
add rax, 2
cmp cx, word [rax]
je 0x14001385f
cmp word [rax], bp
je 0x140013880
lea rax, [rsp + 0x310]
mov rcx, rsi
mov rdx, qword [rax]
call fcn.14003dab8
lea rax, [rsp + 0x310]
cmp byte [rsp + 0xc8], bpl
je 0x1400138ca
cmp qword [rax], rbp
je 0x1400138ca
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rsi, rax
mov qword [rsp + 0x2f8], rax
lea rax, [rsp + 0x310]
mov rdx, qword [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x310]
jmp 0x1400138d2
mov rsi, qword [rsp + 0x2f8]
mov edx, dword [rax + 0x10]
mov rcx, qword [rsp + 0xe00]
lea r8, str.__LastPID
call fcn.14005d18c
mov rcx, qword [rsp + 0xe00]
lea rax, [rsp + 0x310]
mov edx, dword [rax + 0x14]
lea r8, str.__LastTID
call fcn.14005d18c
cmp dword [rsp + 0x130], ebp
je 0x14001392d
lea rax, [rsp + 0x310]
lea rcx, str.SeDebugPrivilege
mov edx, 4
mov r8, qword [rax]
call fcn.14001a2d0
mov eax, 4
test byte [rsp + 0x88], al
je 0x140013952
lea rax, [rsp + 0x310]
mov rcx, qword [rax + 8]
cmp rcx, rbp
je 0x140013952
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [rsp + 0x230]
call fcn.140052160
lea rcx, [rsp + 0x1b8]
call fcn.140052160
lea rcx, [rsp + 0x1a8]
call fcn.140052160
lea rcx, [rsp + 0x410]
call fcn.140052160
cmp dil, bpl
je 0x1400139aa
xor r8d, r8d
mov eax, 0xfffb
lea rcx, str.SeDebugPrivilege
and word [0x140118f8c], ax
lea edx, [r8 + 4]
call fcn.14001a1f0
lea rdi, [rsp + 0x298]
cmp qword [rdi], rbp
je 0x1400139c0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
lea rdi, [rsp + 0xd8]
cmp qword [rdi], rbp
je 0x1400139d9
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
lea rdi, [rsp + 0x198]
cmp qword [rdi], rbp
je 0x1400139f2
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
lea rdi, [rsp + 0x208]
cmp qword [rdi], rbp
je 0x140013a0b
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
lea rdi, [rsp + 0x250]
cmp qword [rdi], rbp
je 0x140013a24
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov edi, dword [rsp + 0xe20]
cmp dil, bpl
jne 0x140013a3d
cmp byte [rsp + 0x81], bpl
je 0x140013aaf
lea r8, [rsp + 0x310]
cmp qword [r8], rbp
je 0x140013a60
mov rcx, qword [r8]
mov edx, 0x1388
call qword [sym.imp.USER32.dll_WaitForInputIdle]
lea r8, [rsp + 0x310]
cmp dil, bpl
je 0x140013aaf
mov edx, 1
test dl, dil
je 0x140013a85
mov rax, qword [r8]
neg rax
sbb ecx, ecx
and ecx, 2
or ecx, edx
mov edx, dword [r8 + 0x10]
call fcn.140023c00
mov rdx, qword [rsp + 0x438]
mov rdi, qword [rsp + 0xe00]
cmp rdx, rbp
je 0x140013ab7
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rbp
call fcn.1400422a0
jmp 0x140013ab7
mov rdi, qword [rsp + 0xe00]
cmp dword [rsp + 0x7c], ebp
je 0x140014884
lea r8, [rsp + 0x310]
mov rdx, qword [r8]
mov rax, rdx
neg rax
sbb ecx, ecx
and ecx, dword [rsp + 0x84]
mov dword [rsp + 0x84], ecx
movsxd rcx, dword [rsp + 0x108]
mov qword [rsp + rcx*8 + 0x498], rdx
inc ecx
mov dword [rsp + 0x108], ecx
mov rcx, qword [r8 + 8]
cmp rcx, rbp
je 0x140013b12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x310]
mov qword [r8 + 8], rbp
mov eax, 0x3e8
cmp dword [rsp + 0x134], ebp
je 0x140013b45
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.14001d848
lea rax, [rsp + 0x310]
mov rcx, qword [rax]
call fcn.140022c90
mov edx, dword [rsp + 0x84]
cmp edx, ebp
je 0x1400148a7
mov al, byte [0x14011521f]
mov ebx, 0x100000
lea rcx, [rsp + 0x88]
lea edx, [rbx + 4]
mov edi, ebp
mov dword [rsp + 0xac], ebp
mov byte [rsp + 0x73], al
call fcn.140059ed8
mov rax, qword [rsp + 0x118]
lea rcx, [rax + 2]
mov edx, 0x40
mov qword [rsp + 0x488], rax
mov qword [rsp + 0x550], rcx
mov byte [rsp + 0xe20], bpl
cmp dx, word [rax]
jne 0x140013bbf
mov byte [rsp + 0xe20], 1
mov rax, rcx
mov qword [rsp + 0x488], rcx
jmp 0x140013bd1
cmp qword [rsp + 0x228], rbp
je 0x140013bd1
mov byte [rsp + 0xe20], 2
cmp byte [rsp + 0x13a], bpl
je 0x140013c6a
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x430]
xor r9d, r9d
mov rdx, rax
mov qword [rsp + 0x430], rbp
call fcn.140062d18
mov rdx, qword [rsp + 0x430]
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x88]
mov r9, rax
mov r8, rax
call fcn.14005a08c
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov dword [rsp + 0xac], eax
lea ebx, [rax + 0x3ff]
and ebx, 0xfffffc00
add ebx, 0x100000
lea ecx, [rbx + 8]
movsxd rdx, ecx
lea rcx, [rsp + 0x88]
call fcn.140059f54
lea rcx, [rsp + 0x430]
call fcn.140052160
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [rsp + 0x71], 8
mov dword [rsp + 0xa4], eax
mov dword [rsp + 0x12c], ebp
je 0x1400141fe
mov rcx, qword [rsp + 0x118]
mov eax, 0x40
cmp ax, word [rcx]
je 0x140013cdd
cmp byte [rsp + 0xca], bpl
je 0x140013cdd
mov eax, 0x26
cmp word [rcx], ax
je 0x140013cd6
mov rax, qword [rsp + 0xe00]
test byte [rax + 0xd], 0xf
je 0x140013cdd
mov byte [rsp + 0x70], 1
jmp 0x140013ce2
mov byte [rsp + 0x70], bpl
xor ecx, ecx
mov dword [rsp + 0xd0], ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x288]
lea rdx, [rsp + 0x508]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [rsp + 0xb8], edi
cmp byte [rsp + 0xe20], bpl
je 0x140013d21
mov esi, ebx
sub esi, edi
jmp 0x140013d26
mov esi, 0x100000
lea rax, [rsp + 0x508]
movsxd rdx, edi
lea r9, [rsp + 0xd0]
add rdx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x288]
mov rcx, qword [rax]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0xa4]
mov edx, 0x3e8
mov dword [rsp + 0x10c], eax
mov eax, dword [rsp + 0x1d8]
lea rcx, [rsp + 0x360]
cmp eax, ebp
mov dword [rsp + 0xac], ebp
mov byte [rsp + 0x81], bpl
cmovle eax, edx
mov dword [rsp + 0x1d8], eax
call fcn.14005a150
mov al, byte [0x14011521f]
cmp al, bpl
mov byte [rsp + 0x73], al
jg 0x140013db9
cmp dword [rsp + 0x278], 2
jl 0x140013f89
cmp dword [rsp + 0x268], ebp
jle 0x140013e00
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0x268]
sub edx, dword [rsp + 0xa4]
cmp edx, eax
jae 0x140013f89
mov ecx, eax
sub ecx, edx
mov edx, dword [rsp + 0x1d8]
cmp edx, ecx
cmova edx, ecx
mov dword [rsp + 0x1d8], edx
jmp 0x140013e07
mov edx, dword [rsp + 0x1d8]
mov rcx, qword [rsp + 0xe00]
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], edx
mov edx, dword [rsp + 0x108]
lea r8, [rsp + 0x498]
xor r9d, r9d
call fcn.140019ad0
mov edx, eax
mov dword [rsp + 0xf8], eax
cmp eax, ebp
jne 0x140013f0f
lea rax, [rsp + 0x288]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x508]
mov rcx, qword [rax]
xor r9d, r9d
mov dword [rsp + 0xa0], ebp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov r11d, dword [rsp + 0xa0]
cmp r11d, ebp
jle 0x140013e9c
mov rax, qword [rsp + 0x88]
cmp r11d, esi
cmovg r11d, esi
add edi, r11d
mov dword [rsp + 0xa0], r11d
movsxd rcx, edi
mov byte [rcx + rax], bpl
lea eax, [rdi + 0x100000]
cmp eax, ebx
jl 0x140013ebf
add ebx, 0x100000
lea rcx, [rsp + 0x88]
lea eax, [rbx + 4]
movsxd rdx, eax
call fcn.140059f54
cmp byte [rsp + 0xe20], bpl
je 0x140013ecf
mov esi, ebx
sub esi, edi
jmp 0x140013ed4
mov esi, 0x100000
lea rax, [rsp + 0x508]
movsxd rdx, edi
lea r9, [rsp + 0xa0]
add rdx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x288]
mov rcx, qword [rax]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0xf8]
mov cl, byte [rsp + 0xe20]
cmp cl, bpl
je 0x140013f57
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x12c], eax
sub eax, dword [rsp + 0x10c]
cmp eax, dword [rsp + 0x1d8]
jge 0x140014090
cmp edi, dword [rsp + 0xac]
je 0x1400141dd
cmp eax, 0x14
jl 0x1400141dd
jmp 0x140014090
mov eax, dword [rsp + 0x108]
mov r9d, 1
cmp eax, r9d
jle 0x140013fa2
dec eax
cmp eax, edx
jne 0x140013fa2
mov byte [rsp + 0x81], r9b
cmp cl, bpl
je 0x140013f89
cmp edi, dword [rsp + 0xac]
jne 0x140014090
lea rcx, [rsp + 0x360]
mov dword [rsp + 0xac], edi
call fcn.140052160
jmp 0x140014406
test byte [rsp + 0x71], r9b
je 0x140013fec
movsxd rax, dword [rsp + 0xb8]
cmp edi, eax
jle 0x140013fec
mov rdx, qword [rsp + 0x390]
movsxd r8, edi
mov rcx, rax
cmp rax, r8
jge 0x140013fec
mov rax, qword [rsp + 0x88]
mov r10d, 0xa
cmp byte [rax + rcx], r10b
jne 0x140013fe4
sub rdx, r9
cmp rdx, rbp
jle 0x140013f89
add rcx, r9
cmp rcx, r8
jl 0x140013fd6
mov eax, 5
sub eax, r9d
mov dword [rsp + 0xb0], eax
js 0x140013d9c
mov al, byte [0x14011521f]
cmp al, bpl
jle 0x140013d9c
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x710]
xor r8d, r8d
xor r9d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, ebp
je 0x140013d9c
cmp dword [rsp + 0x718], 0x12
je 0x140014068
lea rcx, [rsp + 0x710]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x710]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [rsp + 0xb0]
mov r9d, 1
jmp 0x140013ff1
mov byte [rsp + 0x73], bpl
mov byte [rsp + 0x81], 1
cmp byte [rsp + 0xe20], bpl
je 0x140013d9c
cmp edi, dword [rsp + 0xac]
je 0x140013d9c
mov ecx, dword [rsp + 0x12c]
mov rax, qword [rsp + 0x88]
mov dword [rsp + 0xac], edi
mov dword [rsp + 0x10c], ecx
mov cl, byte [rsp + 0x70]
mov r8, rax
cmp cl, bpl
jne 0x14001410c
cmp dword [rsp + 0x160], 0x4b0
je 0x1400140eb
movsxd r9, dword [rsp + 0x160]
lea rcx, [rsp + 0x360]
movsxd r8, edi
mov rdx, rax
call fcn.14005a30c
mov r8, qword [rsp + 0x360]
jmp 0x140014100
movsxd rcx, edi
mov word [rax + rcx + 2], bp
mov rax, qword [rsp + 0x88]
mov word [rax + rcx + 2], bp
mov cl, byte [rsp + 0x70]
mov rax, qword [rsp + 0x88]
mov r9d, 1
cmp byte [rsp + 0xe20], r9b
jne 0x14001414a
mov rax, qword [rsp + 0x488]
mov rcx, qword [rsp + 0xe00]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
lea r9, [0x1400f9548]
mov rdx, rax
mov r8, rax
call fcn.1400556e0
jmp 0x140014193
cmp cl, bpl
je 0x14001417e
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x88]
mov byte [rsp + 0x28], bpl
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xe00]
mov r9d, edi
mov r8, rax
call fcn.1400694b8
jmp 0x140014193
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0xe00]
call fcn.1400596c4
mov rax, qword [rsp + 0x228]
cmp rax, rbp
je 0x1400141dd
lea rcx, [rsp + 0x368]
mov rdx, rax
call fcn.140064d14
mov rdx, qword [rsp + 0x368]
mov rcx, qword [rsp + 0xe00]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call fcn.1400422a0
lea rcx, [rsp + 0x368]
call fcn.140052160
cmp byte [rsp + 0x81], bpl
jne 0x140013f89
mov cl, byte [rsp + 0xe20]
mov edx, dword [rsp + 0xf8]
jmp 0x140013f57
cmp dword [rsp + 0x84], 0xffffff9c
je 0x14001440e
movsxd rcx, dword [rsp + 0x278]
movsxd rdx, dword [rsp + 0x268]
lea esi, [rbx + 4]
mov qword [rsp + 0x228], rcx
mov qword [rsp + 0x278], rdx
mov al, byte [0x14011521f]
cmp al, bpl
mov byte [rsp + 0x73], al
jg 0x140014248
cmp rcx, 2
jl 0x1400143ff
cmp rdx, rbp
mov eax, 0x3e8
mov dword [rsp + 0xe20], eax
jle 0x140014286
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0x268]
sub eax, dword [rsp + 0xa4]
cmp eax, ecx
jae 0x1400143ff
sub ecx, eax
mov eax, dword [rsp + 0xe20]
mov rdx, rax
cmp ecx, edx
cmovb eax, ecx
mov edx, dword [rsp + 0x108]
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x498]
xor r9d, r9d
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], eax
call fcn.140019ad0
mov edx, dword [rsp + 0x108]
lea ecx, [rdx - 1]
cmp ecx, eax
je 0x1400143ff
mov r8d, 1
cmp edx, r8d
jle 0x14001435c
cmp eax, ebp
jne 0x14001435c
lea eax, [rdi + 0x100000]
cmp eax, ebx
jl 0x140014303
mov eax, 0x100000
lea rcx, [rsp + 0x88]
add esi, eax
add ebx, eax
movsxd rdx, esi
call fcn.140059f54
mov r8d, 1
lea rax, [rsp + 0x288]
movsxd rdx, edi
lea r9, [rsp + 0xb4]
mov rcx, qword [rax]
add rdx, qword [rsp + 0x88]
mov dword [rsp + 0xb4], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, 1
cmp eax, ebp
je 0x14001435c
cmp dword [rsp + 0xb4], ebp
jbe 0x14001435c
add edi, dword [rsp + 0xb4]
mov rax, qword [rsp + 0x88]
movsxd rcx, edi
mov byte [rcx + rax], bpl
mov al, byte [0x14011521f]
mov rcx, qword [rsp + 0x228]
mov rdx, qword [rsp + 0x278]
cmp al, bpl
jle 0x14001422f
mov dword [rsp + 0x20], r8d
lea rcx, [rsp + 0x6e0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
mov rcx, qword [rsp + 0x228]
mov rdx, qword [rsp + 0x278]
cmp eax, ebp
je 0x14001422f
cmp dword [rsp + 0x6e8], 0x12
je 0x14001422f
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x14011521f]
mov r8d, 1
cmp r11b, bpl
jg 0x14001437b
mov rcx, qword [rsp + 0x228]
mov rdx, qword [rsp + 0x278]
jmp 0x14001422f
mov dword [rsp + 0xac], edi
mov rsi, qword [rsp + 0x2f8]
cmp dword [rsp + 0x84], 0xffffff9c
mov rax, qword [rsp + 0x88]
movsxd rcx, edi
mov byte [rax + rcx + 2], bpl
mov rax, qword [rsp + 0x88]
mov byte [rax + rcx + 1], bpl
mov rax, qword [rsp + 0x88]
mov byte [rax + rcx], bpl
mov dword [rsp + 0xe0], ebp
je 0x1400144d8
cmp byte [rsp + 0x73], bpl
jle 0x1400144d8
mov al, byte [rsp + 0xa8]
mov ecx, 1
cmp al, cl
je 0x1400144d8
cmp al, 2
jne 0x1400144ab
mov r8d, dword [rsp + 0x258]
lea rax, [rsp + 0x310]
lea rdx, str._force__exitcode_d__tree__d
mov r9d, dword [rax + 0x10]
lea rcx, [rsp + 0x8e0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0xe00]
lea rdx, [rsp + 0x8e0]
call fcn.1400219cc
jmp 0x1400144d8
cmp rsi, rbp
je 0x1400144c0
mov edx, dword [rsp + 0x258]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov edx, dword [rsp + 0x258]
lea rax, [rsp + 0x310]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rax, [rsp + 0x310]
lea rdx, [rsp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0xe0]
mov rcx, qword [rsp + 0x480]
mov dword [rcx], eax
mov dword [rsp + 0x10c], eax
cmp byte [rsp + 0x71], bpl
je 0x140014809
mov rax, qword [rsp + 0x118]
mov ecx, 0x40
mov rbx, rbp
cmp cx, word [rax]
je 0x140014552
cmp byte [rsp + 0xca], bpl
je 0x140014552
mov ecx, 0x26
cmp word [rax], cx
je 0x14001454b
mov rax, qword [rsp + 0xe00]
test byte [rax + 0xd], 0xf
je 0x140014552
mov eax, 1
jmp 0x140014555
mov al, bpl
lea rcx, [rsp + 0x418]
mov byte [rsp + 0xe20], al
call fcn.140059e74
mov al, byte [rsp + 0xe20]
mov qword [rsp + 0x420], rbp
mov qword [rsp + 0x428], rbp
cmp al, bpl
jne 0x14001476d
mov eax, dword [rsp + 0x440]
cmp al, 2
jne 0x1400145b0
mov rax, qword [rsp + 0x88]
movsxd rcx, edi
mov word [rax + rcx], bp
mov rbx, qword [rsp + 0x88]
jmp 0x14001463f
mov ecx, 1
cmp al, cl
lea rcx, [rsp + 0x418]
jne 0x1400145db
movsxd r9, dword [rsp + 0x160]
mov rdx, qword [rsp + 0x88]
movsxd r8, edi
call fcn.14005a30c
jmp 0x140014644
lea eax, [rdi + 0x18]
movsxd rdx, eax
call fcn.14005a250
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x418]
movsxd rax, edi
mov qword [rsp + 0x428], rax
mov qword [rsp + 0x420], rax
lea eax, [rdi + 1]
movsxd r8, eax
call fcn.14001b7a8
mov r11, qword [rsp + 0x418]
xor edx, edx
movsxd rcx, edi
lea r8d, [rdx + 0x10]
add rcx, r11
call fcn.1400dd9e0
lea rcx, [rsp + 0x418]
mov edx, 0x2004
call fcn.1400c9f94
cmp rbx, rbp
jne 0x14001464c
mov rbx, qword [rsp + 0x418]
mov al, byte [rsp + 0x71]
mov ecx, 4
test cl, al
je 0x14001469c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2 - 2]
cmp rax, rbx
jb 0x140014766
mov ecx, 0xd
cmp cx, word [rax]
je 0x14001468b
mov edx, 0xa
cmp dx, word [rax]
jne 0x140014766
mov word [rax], bp
sub rax, 2
cmp rax, rbx
jae 0x140014678
jmp 0x140014766
mov r8d, 1
test r8b, al
je 0x140014712
movzx eax, word [rbx]
mov rcx, qword [rsp + 0x390]
cmp ax, bp
je 0x140014706
lea esi, [r8 + 1]
lea edi, [rsi + 0xb]
cmp di, ax
jne 0x1400146da
mov r9d, 0xa
cmp r9w, word [rbx + 2]
jne 0x1400146da
cmp rcx, r8
jle 0x1400146e4
add rbx, rsi
jmp 0x1400146e4
mov edx, 0xa
cmp dx, ax
jne 0x1400146ec
sub rcx, r8
cmp rcx, rbp
jle 0x1400146f7
add rbx, rsi
mov ax, word [rbx]
cmp ax, bp
jne 0x1400146be
mov rsi, qword [rsp + 0x2f8]
mov edi, dword [rsp + 0xac]
mov word [rbx], bp
mov al, byte [rsp + 0xe20]
jmp 0x140014773
test al, 2
je 0x140014709
movzx eax, word [rbx]
cmp ax, bp
je 0x140014709
mov ecx, 0xd
lea esi, [rcx - 3]
cmp ax, cx
je 0x140014736
cmp ax, si
je 0x140014736
add rbx, 2
jmp 0x140014756
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rbx + 2]
mov rcx, rbx
movsxd r8, eax
add r8, r8
call fcn.14001b760
mov ecx, 0xd
mov ax, word [rbx]
cmp ax, bp
jne 0x140014726
mov rsi, qword [rsp + 0x2f8]
mov al, byte [rsp + 0xe20]
mov r8d, 1
mov rdx, qword [rsp + 0x118]
mov ecx, 0x40
cmp cx, word [rdx]
mov rcx, qword [rsp + 0xe00]
jne 0x1400147b8
mov rax, qword [rsp + 0x418]
mov rdx, qword [rsp + 0x550]
lea r9, [0x1400f9548]
mov qword [rsp + 0x28], rax
mov r8, rdx
mov qword [rsp + 0x20], rax
call fcn.1400556e0
jmp 0x1400147ee
cmp al, bpl
je 0x1400147e1
mov byte [rsp + 0x28], r8b
mov r8, qword [rsp + 0x88]
lea rax, [rsp + 0x88]
mov r9d, edi
mov qword [rsp + 0x20], rax
call fcn.1400694b8
jmp 0x1400147ee
mov r8, qword [rsp + 0x418]
call fcn.1400596c4
lea rcx, [rsp + 0x418]
call fcn.140052160
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x10c], eax
lea rdx, [0x1400fa4a0]
lea rcx, [rsp + 0x8a0]
mov r8d, eax
mov word [rsp + 0x8a0], bp
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdi, qword [rsp + 0xe00]
lea r8, [rsp + 0x8a0]
lea rdx, [0x1400fa480]
mov rcx, rdi
call fcn.1400596c4
cmp rsi, rbp
je 0x14001486d
mov al, byte [rsp + 0xa8]
mov ecx, 1
cmp al, cl
je 0x14001486d
mov edx, dword [rsp + 0x258]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea rcx, [rsp + 0x88]
call fcn.140052160
mov rbx, qword [rsp + 0x2b0]
jmp 0x1400148a0
mov rdx, qword [rsp + 0x118]
cmp word [rdx], bp
je 0x1400148a0
lea r8, [0x1400f9548]
mov rcx, rdi
call fcn.1400596c4
mov edx, dword [rsp + 0x84]
mov rcx, qword [rsp + 0xe38]
cmp rcx, rbp
je 0x1400148c2
lea rax, [rsp + 0x310]
mov rax, qword [rax]
mov qword [rcx], rax
lea rax, [rsp + 0x310]
mov qword [rax], rbp
cmp byte [rsp + 0x90], bpl
je 0x140014a8b
cmp dword [rax + 0x10], ebp
je 0x140014a8b
cmp byte [0x140117a41], bpl
jne 0x140014a8b
mov eax, 1
mov byte [0x140117a41], al
cmp edx, ebp
jne 0x140014a64
lea rcx, [rsp + 0x240]
mov edx, 0x1000
call fcn.14005a1c4
mov rax, qword [rsp + 0x240]
mov dword [rsp + 0x7c], ebp
mov word [rax], bp
lea rax, [rsp + 0x7c]
lea r9, [rsp + 0x240]
lea r8, str.SystemStartOptions
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.14005f34c
mov r11, qword [rsp + 0x240]
lea rcx, [rsp + 0x290]
mov qword [rsp + 0x290], r11
call fcn.140052130
jmp 0x1400149bb
lea rcx, str.PECMDHB
mov r8d, 8
mov rdx, r11
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
je 0x1400149cb
mov rdx, qword [rsp + 0x290]
lea rcx, str.WIMHB
mov r8d, 6
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebp
je 0x1400149cb
lea rcx, [rsp + 0x290]
call fcn.140006ea8
mov r11, qword [rsp + 0x290]
cmp word [r11], bp
jne 0x140014975
jmp 0x1400149d7
mov eax, 1
mov dword [rsp + 0x84], eax
lea rcx, [rsp + 0x240]
call fcn.140052160
cmp dword [rsp + 0x84], ebp
jne 0x140014a64
lea rax, [rsp + 0x310]
lea rdx, str.__nfb__incmd_pecmd_TEAM_WAIT__InitSys__ncd__lu
lea rcx, [rsp + 0xaf0]
mov r8d, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0xaf0]
lea rdx, str.DELAY_bwinpeshl____s__r_n
mov rcx, rdi
call fcn.1400172b0
lea rax, [0x140117920]
lea r9, [rsp + 0xfc]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0xaf0]
mov r8, rdi
mov rcx, rdi
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov word [rsp + 0xfc], bp
call fcn.14000d03c
jmp 0x140014a83
call fcn.140025a3c
cmp eax, ebp
je 0x140014a7c
lea rdx, str.exec
mov rcx, rdi
call fcn.140025b00
xor ecx, ecx
call fcn.14002ede4
lea rax, [rsp + 0x310]
mov rcx, qword [rsp + 0x158]
cmp rcx, rbp
je 0x140014aa5
cmp word [rcx], bp
je 0x140014aa5
mov edx, dword [rax + 0x10]
call fcn.14000470c
lea rax, [rsp + 0x198]
cmp qword [rax], rbp
je 0x140014ac3
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x198]
mov qword [rax], rbp
lea rax, [rsp + 0x208]
cmp qword [rax], rbp
je 0x140014ae4
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x208]
mov qword [rax], rbp
lea rax, [rsp + 0x250]
cmp qword [rax], rbp
je 0x140014b04
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x250]
mov qword [rax], rbp
lea rax, [rsp + 0x298]
cmp qword [rax], rbp
je 0x140014b25
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x298]
mov qword [rax], rbp
lea rax, [rsp + 0x288]
cmp qword [rax], rbp
je 0x140014b46
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x288]
mov qword [rax], rbp
lea rax, [rsp + 0x370]
cmp qword [rax], rbp
je 0x140014b67
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x370]
mov rcx, qword [rsp + 0x520]
mov qword [rax], rbp
cmp rcx, rbp
je 0x140014b7d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x310]
mov rcx, qword [rax + 8]
cmp rcx, rbp
je 0x140014b9c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x310]
xor edx, edx
mov rcx, rdi
mov qword [rax + 8], rbp
call fcn.14008df1c
mov edi, dword [rsp + 0x10c]
lea rcx, [rsp + 0x2e8]
call fcn.140052160
lea rcx, [rsp + 0x1f8]
call fcn.140052160
cmp rbx, rbp
je 0x140014bdf
cmp rbx, 0xffffffffffffffff
je 0x140014bdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140052160
mov rcx, qword [rsp + 0x100]
cmp rcx, rbp
je 0x140014c05
cmp rcx, 0xffffffffffffffff
je 0x140014c05
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x100], rbp
cmp rcx, rbp
je 0x140014c26
cmp rcx, 0xffffffffffffffff
je 0x140014c26
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x250]
mov qword [rsp + 0xd8], rbp
cmp rcx, rbp
je 0x140014c47
cmp rcx, 0xffffffffffffffff
je 0x140014c47
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x208]
cmp rcx, rbp
je 0x140014c60
cmp rcx, 0xffffffffffffffff
je 0x140014c60
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x198]
cmp rcx, rbp
je 0x140014c79
cmp rcx, 0xffffffffffffffff
je 0x140014c79
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x370]
cmp rcx, rbp
je 0x140014c92
cmp rcx, 0xffffffffffffffff
je 0x140014c92
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x298]
cmp rcx, rbp
je 0x140014cab
cmp rcx, 0xffffffffffffffff
je 0x140014cab
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x288]
cmp rcx, rbp
je 0x140014cc4
cmp rcx, 0xffffffffffffffff
je 0x140014cc4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x158]
call fcn.140052160
lea rcx, [rsp + 0x3e0]
call fcn.140052160
lea rcx, [rsp + 0x1c0]
call fcn.140052160
lea rcx, [rsp + 0x150]
call fcn.140052160
lea rcx, [rsp + 0x210]
call fcn.140052160
lea rcx, [rsp + 0x1d0]
call fcn.140052160
lea rcx, [rsp + 0x220]
call fcn.140052160
lea rcx, [rsp + 0x1f0]
call fcn.140052160
lea rcx, [rsp + 0x170]
call fcn.140052160
cmp rsi, rbp
je 0x140014d4d
cmp rsi, 0xffffffffffffffff
je 0x140014d4d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x4e0]
cmp rax, rbp
je 0x140010fcd
cmp rax, 0xffffffffffffffff
je 0x140010fcd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010fcd
lea rcx, [rsp + 0x3c0]
call fcn.140005ff8
lea rcx, [rsp + 0x1b0]
call fcn.140052160
lea rcx, [rsp + 0x120]
call fcn.140052160
lea rcx, [rsp + 0x148]
call fcn.140052160
lea rcx, [rsp + 0x118]
call fcn.140052160
lea rcx, [rsp + 0x188]
call fcn.140052160
lea rcx, [rsp + 0x168]
call fcn.140052160
lea rcx, [rsp + 0x178]
call fcn.140052160
lea rcx, [rsp + 0x180]
call fcn.140052160
mov edi, 1
lea rcx, [rsp + 0x438]
call fcn.140052160
lea rcx, [rsp + 0x398]
call fcn.140052160
mov rax, rdi
add rsp, 0xdd8
pop rdi
pop rsi
pop rbp
pop rbx
ret