Function at 0x14008ce19
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5d8
movdqa xmmword [rsp + 0x5c0], xmm6
mov qword [rsp + 0x198], rcx
mov al, byte [rdx + 0x48]
test al, al
sete cl
mov qword [rsp + 0xa0], rdx
mov r13, qword [rdx + 0x40]
test r13, r13
sete dl
and dl, cl
mov byte [rsp + 0x108], dl
jne 0x14008d5e5
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
test al, al
jne 0x14008d060
mov qword [rsp + 0x50], r13
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14008f0c4
lea r15, [rsp + 0x1d8]
mov qword [rsp + 0x78], rax
mov rsi, rax
mov rcx, rsi
cmp word [rcx], 0
je 0x14008d050
mov r14, rcx
mov cx, 1
xor eax, eax
xor r13d, r13d
test cx, cx
je 0x14008cec9
movzx ecx, word [r14 + r13*2 + 2]
add rax, 0xfffffffffffffffe
inc r13
jmp 0x14008ceb5
mov rsi, r14
sub rsi, rax
lea rcx, [rsi + 2]
cmp r13, 1
je 0x14008ce9f
test r13, r13
je 0x14008f0c9
add rax, 2
xor r12d, r12d
xor ebp, ebp
cmp word [r14 + rbp*2 + 2], 0x3d
je 0x14008cf02
inc rbp
add r12, 0xfffffffffffffffe
cmp rax, r12
jne 0x14008ceeb
jmp 0x14008ce9f
cmp rbp, r13
jae 0x14008f0c9
lea r8, [rbp + 1]
lea rcx, [rsp + 0x130]
mov rdx, r14
call fcn.1400852ea
lea rax, [rbp + 2]
cmp r13, rax
jb 0x14008f0c9
sub r13, rbp
add r13, 0xfffffffffffffffe
sub r14, r12
add r14, 4
mov rcx, r15
mov rdx, r14
mov r8, r13
call fcn.1400852ea
mov rbp, qword [rsp + 0x140]
mov qword [rsp + 0x1d0], rbp
movups xmm0, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x1c0], xmm0
mov rbx, qword [rsp + 0x1c0]
mov rdi, qword [rsp + 0x1c8]
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x90], rax
test rbx, rbx
je 0x14008d050
lea rax, [rbx + rbp]
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], rax
mov word [rsp + 0x140], 0
mov rcx, r15
lea r14, [rsp + 0x130]
mov rdx, r14
call fcn.14008626e
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rdi
mov qword [rsp + 0x1d0], rbp
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x140], rax
movdqa xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x130], xmm0
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x1c0]
mov r9, r14
call fcn.140087af4
mov r8, qword [rsp + 0xb0]
test r8, r8
je 0x14008d047
cmp qword [rsp + 0xb8], 0
je 0x14008d047
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
add rsi, 2
jmp 0x14008ce9c
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov r13, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx + 0x30]
mov r14, qword [rcx + 0x38]
xor r15d, r15d
test r14, r14
sete r15b
cmove r13, r14
add r15, r15
mov rbx, r14
sub r13, 1
jb 0x14008d5bf
test r15, r15
je 0x14008d09e
cmp r15, 2
jne 0x14008d0ba
jmp 0x14008f0c9
test rax, rax
je 0x14008d0af
mov rbx, qword [rbx + 0x328]
dec rax
jne 0x14008d0a3
mov r15d, 1
xor r12d, r12d
xor eax, eax
movzx ecx, word [rbx + 0x322]
cmp r12, rcx
jae 0x14008d0cb
mov rcx, r12
jmp 0x14008d0f0
mov rdx, rbx
mov rbx, qword [rdx]
test rbx, rbx
je 0x14008f0c9
inc rax
movzx ecx, word [rdx + 0x320]
mov rdx, rbx
cmp cx, word [rbx + 0x322]
jae 0x14008d0ce
test rax, rax
je 0x14008d110
mov r14, qword [rbx + rcx*8 + 0x330]
dec rax
je 0x14008d10b
mov r14, qword [r14 + 0x328]
jmp 0x14008d0fd
xor r12d, r12d
jmp 0x14008d117
lea r12, [rcx + 1]
mov r14, rbx
lea rax, [rcx + rcx*2]
mov rbp, rax
shl rbp, 4
lea rsi, [rbx + rbp]
add rsi, 8
cmp qword [rbx + rax*8 + 0x218], 0
mov qword [rsp + 0x78], r12
je 0x14008d284
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0x50], r13
lea rax, [rbx + rax*8]
add rax, 0x218
mov qword [rsp + 0x100], rax
mov rsi, qword [rsi]
mov rdi, qword [rbx + rbp + 0x18]
mov rcx, rdi
xor edx, edx
call fcn.14000d520
mov r13, rax
mov qword [rsp + 0x70], rdx
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call fcn.1400931b0
mov rsi, qword [rbx + rbp + 0x20]
mov r15, qword [rbx + rbp + 0x30]
mov rcx, r15
call fcn.14008353a
mov r12, rax
mov rbx, rdx
lea r8, [r15 + r15]
mov rcx, rax
mov rdx, rsi
call fcn.1400931b0
mov qword [rsp + 0x1c0], r13
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0x1d8], r12
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], r15
mov rax, qword [rsp + 0x100]
mov rsi, qword [rax]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
xor edx, edx
call fcn.14000d520
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rdx
mov rcx, rax
mov rdx, rsi
mov r8, rdi
call fcn.1400931b0
mov qword [rsp + 0x140], rdi
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x1c0]
lea r9, [rsp + 0x130]
call fcn.140087af4
mov r8, qword [rsp + 0xb0]
test r8, r8
je 0x14008d268
cmp qword [rsp + 0xb8], 0
je 0x14008d268
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rbx, r14
xor eax, eax
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x78]
jmp 0x14008d084
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14008d2c8
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x1c8], rbx
lea rcx, [rsp + 0x1c0]
mov rdx, rsi
call fcn.1400884a0
test rax, rax
je 0x14008d2cf
sub rdi, 1
jb 0x14008d2c8
mov rbx, qword [rbx + rdx*8 + 0x328]
jmp 0x14008d293
xor esi, esi
jmp 0x14008d585
mov byte [rsp + 0x80], 0
test rdi, rdi
je 0x14008d3a5
mov rax, qword [rbx + rdx*8 + 0x328]
cmp rdi, 1
je 0x14008d30a
mov ecx, 1
movzx edx, word [rax + 0x322]
mov rax, qword [rax + rdx*8 + 0x328]
inc rcx
cmp rdi, rcx
jne 0x14008d2f3
movzx ecx, word [rax + 0x322]
dec rcx
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rcx
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
lea rdx, [rsp + 0x130]
lea r8, [rsp + 0x80]
call fcn.140087087
mov ecx, 9
lea rdi, [rsp + 0xb0]
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rsp + 0x208]
mov rbp, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x218]
movzx ecx, word [rbp + 0x322]
cmp rdx, rcx
jb 0x14008d3e5
mov rcx, qword [rbp]
test rcx, rcx
je 0x14008d3e3
inc rax
movzx edx, word [rbp + 0x320]
mov rbp, rcx
cmp dx, word [rcx + 0x322]
jae 0x14008d384
jmp 0x14008d3e5
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x140], rdx
lea rcx, [rsp + 0x1c0]
lea rdx, [rsp + 0x130]
lea r8, [rsp + 0x80]
call fcn.140087087
jmp 0x14008d4b4
xor ebp, ebp
lea rbx, [rdx + rdx*2]
mov rcx, rbx
shl rcx, 4
movups xmm0, xmmword [rbp + rcx + 8]
movups xmm1, xmmword [rbp + rcx + 0x18]
movups xmm2, xmmword [rbp + rcx + 0x28]
movaps xmmword [rsp + 0x150], xmm2
movaps xmmword [rsp + 0x140], xmm1
movaps xmmword [rsp + 0x130], xmm0
movups xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movups xmmword [rbp + rcx + 0x28], xmm2
movups xmmword [rbp + rcx + 0x18], xmm1
movups xmmword [rbp + rcx + 8], xmm0
mov rcx, qword [rbp + rbx*8 + 0x228]
lea rdi, [rsp + 0x160]
mov qword [rdi + 0x10], rcx
movups xmm0, xmmword [rbp + rbx*8 + 0x218]
movups xmmword [rdi], xmm0
lea rcx, [rsp + 0xe0]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rbp + rbx*8 + 0x218], xmm0
mov rcx, qword [rcx + 0x10]
mov qword [rbp + rbx*8 + 0x228], rcx
test rax, rax
je 0x14008d49c
dec rax
je 0x14008d49c
mov rcx, qword [rbp + rdx*8 + 0x330]
mov rcx, qword [rcx + 0x328]
dec rax
jne 0x14008d490
mov ecx, 9
lea rdi, [rsp + 0x1c0]
lea rsi, [rsp + 0x130]
rep movsq qword [rdi], qword [rsi]
mov rdi, qword [rsp + 0x1c0]
mov rbp, qword [rsp + 0x1c8]
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x1e0]
dec qword [rsp + 0x68]
mov rsi, qword [rsp + 0x1f0]
mov r12, qword [rsp + 0x1f8]
cmp byte [rsp + 0x80], 0
je 0x14008d53d
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x14008f0c9
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14008f0c9
mov rcx, qword [r8 + 0x328]
mov qword [rsp + 0x60], rcx
dec rax
mov qword [rsp + 0x58], rax
mov qword [rcx], 0
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
test rdi, rdi
je 0x14008d57e
test rbp, rbp
je 0x14008d558
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
shl rbx, 1
test rbx, rbx
je 0x14008d574
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, qword [rsp + 0x50]
call sub.kernel32.dll_HeapFree
mov qword [rsp + 0x98], r12
jmp 0x14008d580
xor esi, esi
mov r12, qword [rsp + 0x78]
mov eax, 0
test rsi, rsi
je 0x14008d081
mov eax, 0
cmp qword [rsp + 0x98], 0
je 0x14008d081
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
xor eax, eax
jmp 0x14008d081
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xa8], rax
mov r14, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x100], rax
mov dl, byte [rsp + 0x108]
mov qword [rsp + 0x178], 0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x164], xmm0
movdqu xmmword [rsp + 0x138], xmm0
movdqu xmmword [rsp + 0x148], xmm0
movdqu xmmword [rsp + 0x158], xmm0
pcmpeqd xmm0, xmm0
movdqu xmmword [rsp + 0x180], xmm0
mov qword [rsp + 0x190], 0xffffffffffffffff
mov dword [rsp + 0x130], 0x68
mov dword [rsp + 0x16c], 0x100
test dl, dl
mov qword [rsp + 0x78], r14
je 0x14008d658
xor esi, esi
jmp 0x14008d7c9
mov ecx, 4
xor edx, edx
call fcn.14000d520
lea rdi, [rsp + 0x1c0]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], 0
lea rdx, [0x14043d999]
mov r8d, 4
mov rcx, rdi
call fcn.140088e97
mov rbx, qword [rdi]
mov rbp, qword [rdi + 8]
mov rsi, qword [rdi + 0x10]
lea rax, [rbx + rsi]
lea rdx, [rsp + 0xb0]
mov qword [rdx], rbx
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
lea rdi, [rsp + 0x1d8]
mov rcx, rdi
call fcn.14008626e
mov qword [rdi - 0x18], rbx
mov qword [rdi - 0x10], rbp
mov qword [rdi - 8], rsi
test r14, r14
je 0x14008d78a
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x70], rbx
mov rdi, qword [rsp + 0x1d8]
mov rbx, qword [rsp + 0x1e8]
mov rbp, r14
mov r14, qword [rsp + 0xa8]
lea rcx, [rbp + 8]
movzx eax, word [rbp + 0x322]
mov qword [rsp + 0x50], rax
shl rax, 4
lea r12, [rax + rax*2]
lea r15, [rbp + 0x210]
mov rsi, 0xffffffffffffffff
test r12, r12
je 0x14008d75b
lea r13, [rcx + 0x30]
mov r8, qword [rcx + 0x18]
mov r9, qword [rcx + 0x28]
mov rcx, rdi
mov rdx, rbx
call fcn.140087acb
add r12, 0xffffffffffffffd0
add r15, 0x18
inc rsi
mov rcx, r13
cmp al, 1
je 0x14008d727
cmp al, 0xff
je 0x14008d760
jmp 0x14008d774
mov rsi, qword [rsp + 0x50]
sub r14, 1
jb 0x14008de0a
mov rbp, qword [rbp + rsi*8 + 0x328]
jmp 0x14008d701
mov rsi, qword [r15 - 0x10]
mov r15, qword [r15]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
jmp 0x14008d78c
xor esi, esi
test rbp, rbp
je 0x14008d7a2
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x1e0]
shl rax, 1
test rax, rax
je 0x14008d7c9
mov r8, qword [rsp + 0x1d8]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0xa0]
mov r12, qword [rax + 0x10]
mov ebx, 0x1402
lea r14, str.program_path_has_no_file_name
test r12, r12
je 0x14008d82d
mov r13, qword [rax]
cmp r12, 4
jae 0x14008d7f8
lea rdx, [0x14008f0d4]
jmp 0x14008d822
mov eax, dword [r13]
bswap eax
xor ecx, ecx
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
adc ecx, 0xffffffff
lea rax, [0x14008f0cd]
lea rdx, [0x14008f0d4]
cmove rdx, rax
mov cl, byte [r12 + r13 - 1]
call rdx
test al, al
je 0x14008d875
mov rsi, qword [rsp + 0x78]
cmp byte [rsp + 0x108], 0
jne 0x14008d8a4
test rsi, rsi
je 0x14008d885
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], rsi
xor eax, eax
mov rdx, qword [rsp + 0x100]
jmp 0x14008d88c
mov r14, rsi
cmp r12, 4
jae 0x14008d8d8
xor eax, eax
jmp 0x14008d91f
mov eax, 2
xor edx, edx
lea rcx, [rsp + 0x1c0]
mov qword [rcx], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x40], rdx
call fcn.1400877b4
mov rdi, qword [rsp + 0x198]
mov qword [rdi + 8], rbx
mov eax, 1
mov qword [rdi + 0x10], r14
mov qword [rdi], rax
movaps xmm6, xmmword [rsp + 0x5c0]
add rsp, 0x5d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [r12 + r13]
add rcx, 0xfffffffffffffffc
xor ebp, ebp
lea r8, str..exeprogram_not_found
cmp rbp, 4
sete al
je 0x14008d91f
mov bl, byte [rcx + rbp]
mov sil, byte [rbp + r8]
inc rbp
lea edi, [rbx - 0x41]
cmp dil, 0x1a
setb dl
shl dl, 5
or dl, bl
lea ebx, [rsi - 0x41]
cmp bl, 0x1a
setb bl
shl bl, 5
or bl, sil
cmp dl, bl
je 0x14008d8e9
xor ecx, ecx
cmp r12, rcx
je 0x14008d97b
mov dl, byte [r13 + rcx]
cmp dl, 0x2f
je 0x14008d938
inc rcx
cmp dl, 0x5c
jne 0x14008d921
mov rcx, r12
xor edx, edx
test al, al
je 0x14008d9af
call fcn.14000d520
lea rsi, [rsp + 0x1c0]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 0
mov rcx, rsi
mov rdx, r13
mov r8, r12
call fcn.140088e97
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x14008dac3
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
mov rdx, r13
mov r8, r12
call fcn.14008f0e3
cmp dword [rsi], 1
jne 0x14008da7a
mov rbx, qword [rsp + 0x1c8]
mov r14, qword [rsp + 0x1d0]
jmp 0x14008d82d
call fcn.14000d520
lea rsi, [rsp + 0x1c0]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 0
mov rcx, rsi
mov rdx, r13
mov r8, r12
call fcn.140088e97
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm0
lea rdx, str..exeprogram_not_found
lea rsi, [rsp + 0x1c0]
mov r8d, 4
mov rcx, rsi
call fcn.140088e97
mov rdi, qword [rsi + 0x10]
mov qword [rsp + 0xc0], rdi
movdqa xmm0, xmmword [rsi]
movdqa xmmword [rsp + 0xb0], xmm0
mov rdx, qword [rsp + 0xb0]
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
mov r8, rdi
call fcn.14008f1bc
cmp byte [rsi], 0
je 0x14008daa6
lea rcx, [rsp + 0x1c8]
call fcn.140001eb0
lea rdx, [0x14043e2d0]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
xor r8d, r8d
call fcn.14008ccee
mov rsi, qword [rsi + 0x10]
jmp 0x14008dab3
cmp r12, 0xf
ja 0x14008ddfb
xor eax, eax
mov qword [rsp + 0x70], rax
xor eax, eax
cmp byte [r13 + rax], 0x2e
je 0x14008de11
inc rax
cmp r12, rax
jne 0x14008da8d
jmp 0x14008de1b
cmp byte [rsp + 0x1c1], 0
mov rsi, rdi
je 0x14008da5a
mov r14, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xb8]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rbx
mov r13, qword [rax + 0x18]
mov rdi, qword [rax + 0x28]
mov r12b, byte [rax + 0x9d]
mov rax, qword [0x14043e2d0]
mov qword [rsp + 0x1c0], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1c8], xmm0
mov rcx, r14
mov rdx, rsi
call fcn.14008cc98
test rax, rax
je 0x14008db1c
cmp rdx, 2
jne 0x14008db24
movzx ecx, word [rax]
cmp ecx, 0x2e2e
jne 0x14008db24
xor r15d, r15d
jmp 0x14008dbc2
mov rbp, rsi
add rax, rdx
xor ecx, ecx
mov rbx, rdx
add rbx, rcx
je 0x14008dbbc
lea rsi, [rcx - 1]
cmp byte [rax + rcx - 1], 0x2e
mov rcx, rsi
jne 0x14008db2c
lea rcx, [rdx + rsi]
inc rcx
cmp rdx, rcx
jb 0x14008f0c9
add rdx, rsi
je 0x14008dbbc
lea rbx, [rax + rsi]
inc rbx
not rsi
lea r8, [0x14043e076]
mov rcx, rbx
mov rdx, rsi
call fcn.140088f8f
test al, al
jne 0x14008db91
lea r8, [0x14043e079]
mov rcx, rbx
mov rdx, rsi
call fcn.140088f8f
test al, al
je 0x14008dbbc
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
xor edx, edx
call fcn.1400836d8
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov word [rax + rcx*2], 0x22
inc rcx
mov qword [rsi + 0x10], rcx
mov r15b, 1
jmp 0x14008dbbf
xor r15d, r15d
mov rsi, rbp
lea rcx, [rsp + 0x1c0]
mov qword [rsp + 0x70], r14
mov rdx, r14
mov r8, rsi
xor r9d, r9d
call fcn.14008f2d4
mov rbx, rax
cmp bl, 4
jne 0x14008dc8c
mov qword [rsp + 0x98], rsi
xor r12b, 1
shl rdi, 5
movzx esi, r12b
mov r12d, 2
test rdi, rdi
je 0x14008dce1
mov rdx, qword [rsp + 0x1d0]
cmp rdx, qword [rsp + 0x1c8]
jne 0x14008dc38
lea rbx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.1400836d8
mov rdx, qword [rsp + 0x1d0]
jmp 0x14008dc40
lea rbx, [rsp + 0x1c0]
lea rbp, [r13 + 0x20]
mov rax, qword [rsp + 0x1c0]
mov word [rax + rdx*2], 0x20
inc rdx
mov qword [rsp + 0x1d0], rdx
cmp dword [r13], 1
mov r9d, esi
cmove r9d, r12d
mov rdx, qword [r13 + 8]
mov r8, qword [r13 + 0x18]
mov rcx, rbx
call fcn.14008f2d4
mov rbx, rax
add rdi, 0xffffffffffffffe0
mov r13, rbp
cmp bl, 4
je 0x14008dc03
mov r14, rdx
mov rax, qword [rsp + 0x1c8]
shl rax, 1
test rax, rax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x50]
je 0x14008dcc0
mov r8, qword [rsp + 0x1c0]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
test rdi, rdi
je 0x14008d832
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, qword [rsp + 0x70]
call sub.kernel32.dll_HeapFree
jmp 0x14008d832
mov rdx, qword [rsp + 0x1d0]
test r15b, r15b
mov bl, byte [rsp + 0x108]
je 0x14008dd32
cmp rdx, qword [rsp + 0x1c8]
mov rbp, qword [rsp + 0x78]
mov r13, qword [0x14043e2d0]
jne 0x14008dd1f
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
call fcn.1400836d8
mov rdx, qword [rsi + 0x10]
mov rax, qword [rsp + 0x1c0]
mov word [rax + rdx*2], 0x22
inc rdx
jmp 0x14008dd3e
mov rbp, qword [rsp + 0x78]
mov r13, qword [0x14043e2d0]
mov rax, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1c8]
mov qword [rsp + 0x118], rcx
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x120], rdx
cmp rdx, rcx
jne 0x14008dd82
lea rsi, [rsp + 0x110]
mov rcx, rsi
call fcn.1400836d8
mov rax, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov word [rax + rdx*2], 0
inc rdx
mov rcx, qword [rsp + 0xa0]
cmp byte [rcx + 0x9c], 0
mov eax, 0x400
mov edi, 0x608
cmove edi, eax
mov qword [rsp + 0x120], rdx
or edi, dword [rcx + 0x98]
mov dword [rsp + 0x128], edi
test bl, bl
je 0x14008ddd1
mov rax, rcx
xor r12d, r12d
mov r8, r13
xor r10d, r10d
jmp 0x14008e4fe
mov qword [rsp + 0x58], r13
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x14008e233
xor ebx, ebx
mov rdi, r13
jmp 0x14008e25e
mov cl, 0x2e
mov rdx, r13
mov r8, r12
call fcn.14001b051
jmp 0x14008de16
xor esi, esi
jmp 0x14008d77b
mov eax, 1
mov qword [rsp + 0x70], rax
test r14, r14
je 0x14008df4e
add r15, r14
lea rbx, [rsp + 0x1c0]
mov qword [rbx], r14
mov qword [rbx + 8], r15
mov word [rbx + 0x10], 0
mov byte [rbx + 0x18], 1
lea r15, [rsp + 0xb8]
lea rbp, [rsp + 0xb0]
lea rsi, [rsp + 0x80]
mov rcx, rbp
mov rdx, rbx
call fcn.140088578
mov r8, qword [rsp + 0xb0]
test r8, r8
je 0x14008df4e
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
jne 0x14008de9e
test rax, rax
je 0x14008de58
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x14008de58
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], r8
mov rcx, rsi
mov rdx, r13
mov r8, r12
call fcn.14008a238
cmp qword [rsp + 0x70], 1
je 0x14008dee1
mov r8d, 3
mov rcx, rsi
lea rdx, str.exeNULcmdbat
call fcn.14008ccee
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x90]
mov rcx, rbp
mov rdx, r14
mov r8, rdi
call fcn.14008f1bc
cmp byte [rsp + 0xb0], 0
je 0x14008df13
mov rcx, r15
call fcn.140001eb0
jmp 0x14008df29
cmp byte [rsp + 0xb1], 0
mov rax, qword [rsp + 0xa0]
jne 0x14008ef71
cmp qword [rsp + 0x88], 0
je 0x14008de58
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
jmp 0x14008de58
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
call fcn.14008871a
cmp qword [rsi], 0
jne 0x14008e03c
mov rsi, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1d0]
mov rdi, qword [rsp + 0x1d8]
mov rcx, rsi
mov rdx, rdi
call fcn.14008ab00
cmp rdi, rdx
cmovb rdx, rdi
test rax, rax
cmove rdx, rdi
lea rcx, [rsp + 0x80]
mov qword [rcx], rsi
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rdx
mov rdx, r13
mov r8, r12
call fcn.14008a238
cmp qword [rsp + 0x70], 1
je 0x14008dfd9
lea rdx, str.exeNULcmdbat
lea rcx, [rsp + 0x80]
mov r8d, 3
call fcn.14008ccee
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x90]
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.14008f1bc
cmp byte [rsi], 0
je 0x14008e850
lea rcx, [rsp + 0xb8]
call fcn.140001eb0
cmp qword [rsp + 0x88], 0
je 0x14008e031
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x1c0], 0
je 0x14008e049
lea rcx, [rsp + 0x1c0]
call fcn.1400852c0
mov qword [rsp + 0x98], r13
xor r15d, r15d
mov r8d, 0x400
lea rcx, [rsp + 0x1c0]
xor edx, edx
call fcn.140092ff0
mov r14, qword [0x14043e2d0]
lea rax, [rsp + 0x110]
mov qword [rax], r14
pxor xmm0, xmm0
movdqu xmmword [rax + 8], xmm0
mov ebx, 0x200
mov rdi, qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x50], r14
cmp rbx, 0x201
jae 0x14008e0b1
lea rsi, [rsp + 0x1c0]
mov rbp, rsi
mov r13d, 0x200
jmp 0x14008e0db
mov r8, rbx
sub r8, r15
mov rax, qword [rsp + 0x118]
sub rax, r15
cmp rax, r8
jb 0x14008e123
mov qword [rsp + 0x120], rbx
mov r15, rbx
mov rbp, r14
mov r13, rbx
mov rsi, r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, rsi
mov edx, ebx
call rdi
mov esi, eax
test eax, eax
jne 0x14008e0fe
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14008e1de
mov esi, esi
cmp rbx, rsi
jne 0x14008e115
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14008e115
add rbx, rbx
jmp 0x14008e095
cmp rbx, rsi
mov rbx, rsi
jbe 0x14008e095
jmp 0x14008e13d
lea rcx, [rsp + 0x110]
mov rdx, r15
call fcn.140096c66
mov r14, qword [rsp + 0x110]
jmp 0x14008e0c7
cmp r13, rsi
jb 0x14008f0c9
lea rdi, [rsp + 0x58]
mov rcx, rdi
mov rdx, rbp
mov r8, rsi
call fcn.1400852ea
mov rcx, rdi
mov rdx, qword [rsp + 0x98]
mov r8, r12
call fcn.14008a238
cmp qword [rsp + 0x70], 1
je 0x14008e18b
lea rdx, str.exeNULcmdbat
lea rcx, [rsp + 0x58]
mov r8d, 3
call fcn.14008ccee
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov rdx, rsi
call fcn.14008f1bc
cmp byte [rdi], 0
je 0x14008e212
lea rcx, [rsp + 0x88]
call fcn.140001eb0
cmp qword [rsp + 0x60], 0
je 0x14008e5db
mov rcx, qword [0x140443578]
xor edi, edi
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
jmp 0x14008e5dd
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], 1
mov eax, 1
jmp 0x14008e605
cmp byte [rsp + 0x81], 0
je 0x14008e1ba
movdqu xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x1a0], xmm0
mov rdi, rsi
jmp 0x14008e5dd
lea rsi, [rsp + 0x58]
mov rcx, rsi
xor edx, edx
call fcn.1400836d8
mov rcx, qword [rsp + 0x100]
mov rdi, qword [rsi]
mov rbx, qword [rsi + 0x10]
mov word [rdi + rbx*2], 0
inc rbx
mov qword [rsi + 0x10], rbx
xor eax, eax
test rbp, rbp
sete al
cmove rcx, rbp
add rax, rax
lea rsi, [rsp + 0x1c0]
mov qword [rsi], rax
mov rdx, qword [rsp + 0xa8]
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rdx
mov qword [rsi + 0x30], rbp
mov r13, rsi
mov qword [rsi + 0x40], rcx
lea r14, [rsp + 0xb0]
mov rcx, r14
mov rdx, r13
call fcn.140087843
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x14008e4b1
mov rcx, qword [rsp + 0xc0]
lea rdx, [rcx + rcx*2]
mov rcx, rdx
shl rcx, 4
mov rbp, qword [rax + rcx + 8]
test rbp, rbp
je 0x14008e4b1
mov r15, qword [rax + rcx + 0x20]
mov rdi, qword [rax + rcx + 0x28]
mov rsi, qword [rax + rcx + 0x30]
mov r12, qword [rax + rdx*8 + 0x218]
movdqu xmm6, xmmword [rax + rdx*8 + 0x220]
mov qword [rsp + 0x80], rbp
movdqu xmm0, xmmword [rax + rcx + 0x10]
lea rax, [rsp + 0x88]
movdqu xmmword [rax], xmm0
mov rcx, r14
lea rdx, [rsp + 0x80]
call fcn.14008f564
cmp dword [rsp + 0xb0], 1
je 0x14008ec18
cmp qword [rsp + 0xc0], 0
je 0x14008e35e
mov r8, qword [rsp + 0xb8]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rbx, qword [rsp + 0x68]
lea rbp, [rsi + rsi]
mov rax, qword [rsp + 0x60]
sub rax, rbx
cmp rax, rsi
jb 0x14008e497
lea rcx, [rbx + rbx]
add rcx, qword [rsp + 0x58]
mov rdx, r15
mov r8, rbp
call fcn.1400931b0
add rsi, rbx
mov qword [rsp + 0x68], rsi
shl rdi, 1
test rdi, rdi
je 0x14008e3ae
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
mov rsi, qword [rsp + 0x68]
cmp rsi, qword [rsp + 0x60]
jne 0x14008e3c7
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.1400836d8
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x58]
mov word [rax + rsi*2], 0x3d
inc rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x80], r12
movdqu xmmword [rsp + 0x88], xmm6
mov rcx, r14
lea rdx, [rsp + 0x80]
call fcn.14008f564
cmp dword [rsp + 0xb0], 1
je 0x14008ec5f
mov rsi, qword [rsp + 0xb8]
mov rax, qword [rsp + 0xc8]
add rax, rsi
mov rdi, qword [rsp + 0xc0]
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rax
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x58]
mov rdx, r14
call fcn.1400863dd
test rdi, rdi
je 0x14008e461
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rbx, qword [rsp + 0x68]
cmp rbx, qword [rsp + 0x60]
jne 0x14008e47f
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.1400836d8
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x58]
mov word [rdi + rbx*2], 0
inc rbx
mov qword [rsp + 0x68], rbx
jmp 0x14008e2a3
lea rcx, [rsp + 0x58]
mov rdx, rbx
mov r8, rsi
call fcn.140096c66
mov rbx, qword [rsp + 0x68]
jmp 0x14008e373
lea rcx, [rsp + 0x1c0]
call fcn.1400877b4
cmp rbx, qword [rsp + 0x60]
jne 0x14008e4dc
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov rdx, rbx
call fcn.1400836d8
mov rdi, qword [rsi]
mov rbx, qword [rsi + 0x10]
mov rax, qword [rsp + 0xa0]
mov r13, qword [0x14043e2d0]
mov word [rdi + rbx*2], 0
mov r8, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov r10, r8
mov r9, qword [rax + 0x50]
test r9, r9
je 0x14008e5c4
mov rcx, qword [rax + 0x60]
add rcx, r9
xor ebx, ebx
mov rdx, r9
mov bp, 1
test bx, bx
je 0x14008e524
xor ebx, ebx
jmp 0x14008e598
cmp rdx, rcx
je 0x14008e88e
movzx edi, byte [rdx]
test dil, dil
js 0x14008e53c
inc rdx
mov esi, edi
jmp 0x14008e594
mov esi, edi
and esi, 0x1f
movzx eax, byte [rdx + 1]
and eax, 0x3f
cmp dil, 0xdf
jbe 0x14008e578
movzx ebx, byte [rdx + 2]
shl eax, 6
and ebx, 0x3f
or ebx, eax
cmp dil, 0xf0
jb 0x14008e583
movzx eax, byte [rdx + 3]
add rdx, 4
and esi, 7
shl esi, 0x12
shl ebx, 6
and eax, 0x3f
or eax, ebx
jmp 0x14008e57f
add rdx, 2
shl esi, 6
or esi, eax
jmp 0x14008e58c
add rdx, 3
shl esi, 0xc
or esi, ebx
cmp esi, 0xffff
ja 0x14008e5a3
xor ebx, ebx
mov ebp, esi
test bp, bp
jne 0x14008e517
jmp 0x14008e5b3
and esi, 0x3ff
or esi, 0xdc00
mov ebx, esi
jmp 0x14008e598
mov ebx, 0x1402
lea r14, str.nul_byte_found_in_provided_data
jmp 0x14008f02f
mov qword [rsp + 0xa8], r10
mov qword [rsp + 0x78], r8
xor r15d, r15d
xor edi, edi
jmp 0x14008e8f6
xor edi, edi
mov qword [rsp + 0xb8], rdi
movdqa xmm0, xmmword [rsp + 0x1a0]
movdqu xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xb0], 0
xor eax, eax
mov rcx, qword [rsp + 0x118]
shl rcx, 1
test rcx, rcx
je 0x14008e634
mov r8, qword [rsp + 0x110]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x14008e7dd
lea rcx, [rsp + 0xb0]
call fcn.14008f2be
xor ebp, ebp
lea r15, [rsp + 0x1c0]
mov r8d, 0x400
mov rcx, r15
xor edx, edx
call fcn.140092ff0
lea rcx, [rsp + 0x110]
mov rax, qword [0x14043e2d0]
mov qword [rcx], rax
pxor xmm0, xmm0
movdqu xmmword [rcx + 8], xmm0
mov ebx, 0x200
mov r14, qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
cmp rbx, 0x201
jae 0x14008e6a1
mov r13, r15
mov esi, 0x200
mov rdi, r15
jmp 0x14008e6cd
mov r8, rbx
sub r8, rbp
mov rax, qword [rsp + 0x118]
sub rax, rbp
cmp rax, r8
jb 0x14008e716
mov qword [rsp + 0x120], rbx
mov rbp, rbx
mov rdi, qword [rsp + 0x50]
mov r13, rdi
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, rdi
mov edx, ebx
call r14
mov edi, eax
test eax, eax
jne 0x14008e6f1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14008e7f3
mov edi, edi
cmp rbx, rdi
jne 0x14008e708
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14008e708
add rbx, rbx
jmp 0x14008e68b
cmp rbx, rdi
mov rbx, rdi
jbe 0x14008e68b
jmp 0x14008e735
lea rcx, [rsp + 0x110]
mov rdx, rbp
call fcn.140096c66
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x50], rax
jmp 0x14008e6b7
cmp rsi, rdi
jb 0x14008f0c9
lea rbx, [rsp + 0x58]
mov rcx, rbx
mov rdx, r13
mov r8, rdi
call fcn.1400852ea
mov rcx, rbx
mov r14, qword [rsp + 0x98]
mov rdx, r14
mov r8, r12
call fcn.14008a238
cmp qword [rsp + 0x70], 1
je 0x14008e786
lea rdx, str.exeNULcmdbat
lea rcx, [rsp + 0x58]
mov r8d, 3
call fcn.14008ccee
mov rbx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
lea rsi, [rsp + 0x80]
mov rcx, rsi
mov rdx, rbx
call fcn.14008f1bc
cmp byte [rsi], 0
je 0x14008e82f
lea rcx, [rsp + 0x88]
call fcn.140001eb0
cmp qword [rsp + 0x60], 0
je 0x14008e9f8
mov rcx, qword [0x140443578]
xor esi, esi
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
jmp 0x14008e9fa
mov r14, qword [rsp + 0xb8]
test r14, r14
jne 0x14008ebce
jmp 0x14008e63d
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], 1
mov dil, 1
mov r14, qword [rsp + 0x98]
jmp 0x14008ea22
cmp byte [rsp + 0x81], 0
je 0x14008e7b9
movdqu xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x1a0], xmm0
mov rsi, rbx
jmp 0x14008e9fa
cmp byte [rsp + 0xb1], 0
je 0x14008e015
mov rbx, qword [rsp + 0x88]
cmp qword [rsp + 0x1c0], 0
je 0x14008e87e
lea rcx, [rsp + 0x1c0]
call fcn.1400852c0
mov rax, qword [rsp + 0xa0]
mov rsi, rdi
jmp 0x14008dacb
mov qword [rsp + 0xa8], r10
mov qword [rsp + 0x78], r8
lea rdx, [rsp + 0x1c0]
mov qword [rdx], r9
mov qword [rdx + 8], rcx
mov word [rdx + 0x10], 0
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call fcn.14008626e
mov r15, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
cmp rdx, r15
jne 0x14008e8e5
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call fcn.1400836d8
mov r15, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov rdi, qword [rsp + 0xb0]
mov word [rdi + rdx*2], 0
mov r13, rdi
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x80], xmm0
xor esi, esi
mov qword [rsp + 0x90], rsi
lea rcx, [0x140443598]
call qword [sym.imp.kernel32.dll_AcquireSRWLockExclusive]
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1e0], rsi
mov rbx, qword [rsp + 0xa0]
mov rdx, qword [rbx + 0x68]
mov rbp, qword [rbx + 0x78]
cmp rdx, 4
mov r14, qword [rbx + 0x88]
cmove rdx, rsi
mov r8, qword [rbx + 0x70]
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov r9d, 0xfffffff6
call fcn.14008f664
cmp dword [rsi], 1
jne 0x14008e992
mov rbx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
jmp 0x14008efb8
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x100], r13
lea rax, [rsp + 0x1d0]
xor edx, edx
cmp rbp, 4
lea rdi, [rsp + 0xb0]
mov r13, qword [rdi + 8]
cmovne rdx, rbp
mov r8, qword [rbx + 0x80]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r9d, 0xfffffff5
call fcn.14008f664
cmp dword [rdi], 1
jne 0x14008ecab
mov rbx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
jmp 0x14008efa7
xor esi, esi
mov qword [rsp + 0xb8], rsi
movdqa xmm0, xmmword [rsp + 0x1a0]
movdqu xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xb0], 0
xor edi, edi
mov rax, qword [rsp + 0x118]
shl rax, 1
test rax, rax
je 0x14008ea49
mov r8, qword [rsp + 0x110]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
test rsi, rsi
sete al
or dil, al
cmp dil, 1
jne 0x14008ebc6
lea rcx, [rsp + 0xb0]
call fcn.14008f2be
lea rdx, [0x14043d999]
lea rsi, [rsp + 0x58]
mov r8d, 4
mov rcx, rsi
call fcn.140085f2d
mov r13, qword [rsi]
test r13, r13
je 0x14008ec07
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
add rax, r13
lea rbx, [rsp + 0x1c0]
mov qword [rbx], r13
mov qword [rbx + 8], rax
mov word [rbx + 0x10], 0
mov byte [rbx + 0x18], 1
lea rbp, [rsp + 0xb0]
lea rdi, [rsp + 0x80]
mov rcx, rbp
mov rdx, rbx
call fcn.140088578
mov r8, qword [rsp + 0xb0]
test r8, r8
je 0x14008ebf1
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
jne 0x14008eb0b
test rax, rax
je 0x14008eac5
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x14008eac5
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], r8
mov rcx, rdi
mov rdx, r14
mov r8, r12
call fcn.14008a238
cmp qword [rsp + 0x70], 1
je 0x14008eb53
mov r8d, 3
mov rcx, rdi
lea rdx, str.exeNULcmdbat
call fcn.14008ccee
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x90]
mov rcx, rbp
mov rdx, r14
mov r8, r15
call fcn.14008f1bc
cmp byte [rsp + 0xb0], 0
je 0x14008eb8a
lea rcx, [rsp + 0xb8]
call fcn.140001eb0
jmp 0x14008eb98
cmp byte [rsp + 0xb1], 0
jne 0x14008f093
cmp qword [rsp + 0x88], 0
je 0x14008ebb4
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
mov rsi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x98]
jmp 0x14008eac5
mov r14, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
test r14, r14
mov rax, qword [rsp + 0xa0]
jne 0x14008dacb
jmp 0x14008ec07
test rsi, rsi
je 0x14008ec07
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
mov ebx, 2
lea r14, [0x14043e060]
jmp 0x14008d82d
mov rbx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
movq rax, xmm6
test rax, rax
je 0x14008ec43
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
shl rdi, 1
test rdi, rdi
je 0x14008ec6f
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
jmp 0x14008ec6f
mov rbx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0x50]
lea rcx, [rsp + 0x1c0]
call fcn.1400877b4
mov rax, qword [rsp + 0x60]
shl rax, 1
test rax, rax
je 0x14008f04b
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x14008f04b
lea rax, [rsp + 0x1e0]
xor edx, edx
cmp r14, 4
lea rsi, [rsp + 0xb0]
mov rdi, qword [rsi + 8]
cmovne rdx, r14
mov r8, qword [rbx + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r9d, 0xfffffff4
call fcn.14008f664
cmp dword [rsi], 1
jne 0x14008ecfd
mov rbx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
jmp 0x14008ef9e
lea rsi, [rsp + 0xb0]
mov rbp, qword [rsi + 8]
mov qword [rsp + 0x180], r13
mov qword [rsp + 0x188], rdi
mov qword [rsp + 0x190], rbp
mov rcx, rsi
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x98]
call fcn.140086139
cmp dword [rsi], 1
mov rbx, qword [rsi + 8]
mov r14, qword [rsi + 0x10]
je 0x14008ef95
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0x110]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x14008ef57
mov rsi, rbp
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xa8], rax
mov rbp, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x98], rax
shl r14, 1
test r14, r14
je 0x14008ee45
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rbx, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rsi
call rbx
mov rcx, rdi
call rbx
mov rcx, r13
call rbx
lea rcx, [0x140443598]
call qword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
shl r15, 1
test r15, r15
mov rbx, qword [rsp + 0x70]
je 0x14008ee8c
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, qword [rsp + 0x100]
call sub.kernel32.dll_HeapFree
shl r12, 1
test r12, r12
mov rdi, qword [rsp + 0x198]
je 0x14008eeb0
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, qword [rsp + 0x78]
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x118]
shl rax, 1
test rax, rax
mov rsi, qword [rsp + 0x50]
je 0x14008eedc
mov r8, qword [rsp + 0x110]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
test rsi, rsi
je 0x14008eef2
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
xor r14d, r14d
test rbp, rbp
setne r14b
xor eax, eax
cmp qword [rsp + 0x1b8], 0
setne al
xor ecx, ecx
cmp qword [rsp + 0x128], 0
setne cl
mov rdx, qword [rsp + 0xa8]
mov qword [rdi + 8], rdx
mov rdx, qword [rsp + 0xa0]
mov qword [rdi + 0x18], rdx
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x108]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rcx
mov rax, qword [rsp + 0x98]
mov qword [rdi + 0x38], rax
xor eax, eax
jmp 0x14008d8b5
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
shl r14, 1
test r14, r14
jne 0x14008ef7e
xor r14d, r14d
jmp 0x14008ef92
mov rbx, qword [rsp + 0x88]
jmp 0x14008e886
mov rcx, qword [0x140443578]
xor r14d, r14d
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rbx, rsi
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.kernel32.dll_CloseHandle]
mov r13, qword [rsp + 0x100]
cmp qword [rsp + 0x1c0], 0
je 0x14008efd1
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rsp + 0x1d0], 0
je 0x14008efea
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rsp + 0x1e0], 0
je 0x14008f003
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rcx, [0x140443598]
call qword [sym.imp.kernel32.dll_ReleaseSRWLockExclusive]
shl r15, 1
test r15, r15
je 0x14008f02a
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
mov r8, qword [rsp + 0x78]
shl r12, 1
test r12, r12
je 0x14008f046
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x118]
shl rax, 1
test rax, rax
je 0x14008f072
mov r8, qword [rsp + 0x110]
mov rcx, qword [0x140443578]
xor edx, edx
call sub.kernel32.dll_HeapFree
test rsi, rsi
je 0x14008d8a4
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, qword [rsp + 0x70]
call sub.kernel32.dll_HeapFree
jmp 0x14008d8a4
mov rbx, qword [rsp + 0x88]
cmp qword [rsp + 0x50], 0
je 0x14008f0b4
mov rcx, qword [0x140443578]
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0xa0]
mov rsi, r15
jmp 0x14008dacb
call sub.kernel32.dll_GetLastError
ud2