Function at 0x140004fe4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Enumerate processes
Get common file path
Get system information on windows
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7f8
movaps xmmword [rsp + 0x7e0], xmm6
mov qword [rsp + 0x20], 1
lea rdx, [0x1400241a0]
lea r9, [0x140024823]
lea rsi, [rsp + 0x70]
mov r8d, 0xa
mov rcx, rsi
call fcn.14000bd7e
and qword [rsi + 0x68], 0
mov qword [rsi + 0x70], 0xa
mov word [rsi + 0x78], 1
lea rax, [rsp + 0x260]
mov ecx, 0x10
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov rcx, rax
call fcn.14000f4b4
test rax, rax
je case.0x14000577e.0
mov rsi, rax
mov rdi, rdx
mov al, byte [0x14002d140]
mov ecx, 0x40
mov edx, 8
call fcn.140008750
mov qword [rsp + 0x100], rax
test rax, rax
je 0x14000857f
mov rax, qword [rsp + 0x100]
mov qword [rax], rsi
mov qword [rax + 8], rdi
lea rbx, [rsp + 0x3e0]
lea rsi, [rsp + 0x260]
mov ecx, 0x10
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov r12d, 4
mov r14d, 1
lea rsi, [rsp + 0x108]
mov eax, 4
mov qword [rsp + 0x238], rax
mov rcx, rbx
call fcn.14000f4b4
test rax, rax
je 0x1400051c4
mov rdi, rax
mov r15, rdx
mov rbp, qword [rsp + 0x238]
cmp r14, rbp
jne 0x14000519c
mov rcx, r14
inc rcx
je case.0x14000577e.0
lea rax, [r14 + r14]
cmp rax, rcx
cmova rcx, rax
cmp rcx, 5
cmovb rcx, r12
xor edx, edx
mov rax, rcx
shr rax, 0x3b
sete dl
mov rbp, rcx
mov r8, rcx
shl r8, 4
shl rdx, 3
test r14, r14
je 0x140005163
mov rax, r14
shl rax, 4
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x108], rcx
mov qword [rsp + 0x118], rax
mov eax, 8
jmp 0x140005165
xor eax, eax
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x180]
mov r9, rsi
call fcn.140008d19
cmp qword [rsp + 0x180], 0
jne 0x140008539
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x238], rbp
mov rax, r14
shl rax, 4
mov rcx, qword [rsp + 0x100]
mov qword [rcx + rax], rdi
mov qword [rcx + rax + 8], r15
inc r14
jmp 0x1400050d7
test r14, r14
je case.0x14000577e.0
mov rax, qword [rsp + 0x100]
mov rsi, qword [rax + 8]
test rsi, rsi
je case.0x14000577e.0
mov rax, qword [rsp + 0x100]
mov rdi, qword [rax]
movzx eax, byte [rdi]
cmp eax, 0x2d
je 0x140005208
cmp eax, 0x2b
jne 0x140005212
dec rsi
je case.0x14000577e.0
inc rdi
jmp 0x140005212
cmp rsi, 1
je case.0x14000577e.0
xor ebx, ebx
cmp rsi, 5
jae 0x140005244
xor r14d, r14d
cmp rsi, rbx
je 0x140005286
movzx ecx, byte [rdi + rbx]
mov edx, 0xa
call fcn.14000bcd8
test eax, eax
je case.0x14000577e.0
imul r14d, r14d, 0xa
add r14d, edx
inc rbx
jmp 0x14000521d
mov bp, 0xa
xor r14d, r14d
cmp rsi, rbx
je 0x140005286
movzx ecx, byte [rdi + rbx]
mov edx, 0xa
call fcn.14000bcd8
test eax, eax
je case.0x14000577e.0
mov ecx, edx
mov eax, r14d
mul bp
jo case.0x14000577e.0
mov r14d, eax
add r14w, cx
jb case.0x14000577e.0
inc rbx
jmp 0x14000524b
mov edi, 3
xor r15d, r15d
lea rsi, [rsp + 0x3e0]
sub edi, 1
jb 0x1400052b7
mov rcx, rsi
mov edx, r14d
call fcn.140001c14
cmp byte [rsp + 0x430], 2
jne 0x1400052c1
call fcn.1400199aa
jmp 0x140005296
mov esi, 1
jmp 0x140005451
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x290], rax
movups xmm0, xmmword [rsp + 0x3e0]
movups xmm1, xmmword [rsp + 0x3f0]
movups xmm2, xmmword [rsp + 0x400]
movaps xmmword [rsp + 0x280], xmm2
movaps xmmword [rsp + 0x270], xmm1
movaps xmmword [rsp + 0x260], xmm0
mov rsi, qword [rsp + 0x418]
mov r15, qword [rsp + 0x420]
mov rdi, qword [rsp + 0x428]
mov ebp, dword [rsp + 0x438]
mov rcx, qword [0x140023018]
mov rdx, qword [0x140023020]
call fcn.140008f6b
mov rax, qword [rsp + 0x290]
mov qword [0x140023028], rax
movaps xmm0, xmmword [rsp + 0x280]
movups xmmword [0x140023018], xmm0
mov rcx, qword [0x14002d030]
mov rdx, qword [0x14002d038]
call fcn.14000db00
movups xmm0, xmmword [rsp + 0x3e0]
movups xmm1, xmmword [rsp + 0x3f0]
movups xmmword [0x14002d040], xmm1
movups xmmword [0x14002d030], xmm0
mov ecx, 1
xor edx, edx
call fcn.140008f6b
test ebp, ebp
je 0x140005451
lea rcx, [rsp + 0x3e0]
and dword [rcx + 0x20], 0
and word [rcx + 0x24], 0
and dword [rcx], 0
xorps xmm6, xmm6
movups xmmword [rcx + 8], xmm6
mov qword [rcx + 0x18], 7
mov byte [rcx + 0x20], 1
mov qword [rsp + 0x200], rsi
mov rdx, rsi
mov qword [rsp + 0x1f8], rdi
mov r8, rdi
call fcn.140019cbb
test rax, rax
jne case.0x14000577e.0
mov rsi, rdx
lea rdx, [rsp + 0x3e0]
movaps xmmword [rdx + 0x20], xmm6
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
and dword [rdx + 0x30], 0
mov rcx, rsi
call sub.kernel32.dll_GetFileInformationByHandle
test eax, eax
je 0x14000548c
test byte [rsp + 0x3e1], 4
je 0x140005438
lea r8, [rsp + 0x260]
and qword [r8], 0
mov rcx, rsi
mov edx, 9
mov r9d, 8
call sub.kernel32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x14000548c
mov ebx, dword [rsp + 0x400]
mov eax, dword [rsp + 0x404]
shl rbx, 0x20
or rbx, rax
xor edi, edi
jmp 0x1400054a3
mov rcx, rsi
mov rdx, r15
call fcn.140008f6b
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x238]
movaps xmm6, xmmword [rsp + 0x7e0]
add rsp, 0x7f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14000197b
call fcn.140014b12
mov ecx, 1
mov rdx, rax
call fcn.140014a28
mov dil, 1
xor ebx, ebx
mov rcx, rbx
call fcn.140008f75
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x268], rdx
and qword [rsp + 0x270], 0
test dil, dil
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x33c], r14d
mov qword [rsp + 0x3d8], r15
jne 0x1400054ea
add rbx, 0x400
jae 0x140005963
xor edi, edi
xor r12d, r12d
xorps xmm6, xmm6
mov qword [rsp + 0x178], rdx
mov r15, rdx
xor r13d, r13d
cmp r12, r15
jne 0x140005527
mov edx, 0x20
lea rcx, [rsp + 0x260]
call fcn.140008c00
mov r15, qword [rsp + 0x268]
mov r12, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x260]
mov rax, r15
sub rax, r12
cmp rax, rbx
mov r14, rbx
cmovb r14, rax
test dil, dil
cmove r14, rax
lea r8, [rbp + r12]
lea rcx, [rsp + 0x3e0]
mov rdx, rsi
mov r9, r14
call fcn.140019bbd
cmp qword [rsp + 0x3e0], 0
je 0x14000559e
mov r14, qword [rsp + 0x3e8]
mov rcx, r14
call fcn.140014b28
cmp al, 0xb
je 0x1400056c9
mov rcx, r14
call fcn.140014b28
cmp al, 0x23
jne 0x140008561
mov rcx, r14
call fcn.140014778
jmp 0x140005500
mov rax, qword [rsp + 0x3e8]
cmp r13, rax
cmovbe r13, rax
test rax, rax
je 0x1400056d1
mov rcx, r13
sub rcx, rax
jb case.0x14000577e.0
cmp r13, r14
ja case.0x14000577e.0
cmp rax, r14
ja case.0x14000577e.0
add r12, rax
mov qword [rsp + 0x270], r12
mov r13, rcx
cmp r12, r15
jne 0x140005500
mov r13, rcx
cmp r15, qword [rsp + 0x178]
jne 0x140005500
mov qword [rsp + 0x170], rcx
movaps xmmword [rsp + 0x3f0], xmm6
movaps xmmword [rsp + 0x3e0], xmm6
mov r12d, dword [rsp + 0x50]
mov r13, qword [rsp + 0x178]
mov r9d, 0x20
lea rcx, [rsp + 0x70]
mov rdx, rsi
lea r8, [rsp + 0x3e0]
call fcn.140019bbd
cmp qword [rsp + 0x70], 0
je 0x140005678
mov r14, qword [rsp + 0x78]
mov rcx, r14
call fcn.140014b28
cmp al, 0xb
je 0x140008524
mov rcx, r14
call fcn.140014b28
cmp al, 0x23
jne 0x140008561
mov ecx, 1
mov rdx, r14
call fcn.140014a28
jmp 0x140005621
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400056d9
cmp rax, 0x21
jae case.0x14000577e.0
lea r8, [rsp + rax]
add r8, 0x3e0
lea rcx, [rsp + 0x260]
lea rdx, [rsp + 0x3e0]
call fcn.140008bbd
mov r15, qword [rsp + 0x268]
mov r12, qword [rsp + 0x270]
mov r13, qword [rsp + 0x170]
jmp 0x140005500
mov rcx, r14
call fcn.140014778
mov r13, r12
mov r12d, dword [rsp + 0x50]
mov rcx, rsi
call fcn.140020688
mov rcx, qword [section..data]
mov rdx, qword [0x140023008]
call fcn.140008f6b
mov qword [section..data], rbp
mov qword [0x140023008], r15
mov qword [0x140023010], r13
mov rax, qword [0x14002d060]
test rax, rax
lea rbp, [rsp + 0x3e0]
jne 0x140005770
mov ecx, 1
xor eax, eax
lock cmpxchg qword [0x14002d060], rcx
jne 0x140005770
xorps xmm0, xmm0
lea rsi, [rsp + 0x3e0]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [rsi + 0x20]
mov qword [0x14002d050], 1
mov qword [0x14002d058], rbx
mov eax, 2
xchg qword [0x14002d060], rax
jmp 0x140005799
lea rcx, [0x14000858c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
pause
mov rax, qword [0x14002d060]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rbx, qword [0x14002d058]
mov qword [rsp + 0x180], 8
xorps xmm6, xmm6
movups xmmword [rsp + 0x188], xmm6
mov ecx, 2
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
test rax, rax
jle 0x140005959
mov rsi, rax
lea rdi, [rsp + 0x40c]
mov r8d, 0x104
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rdi - 0x2c], 0x130
and dword [rdi - 0x24], 0
movups xmmword [rdi - 0x1c], xmm6
movups xmmword [rdi - 0x10], xmm6
lea rdx, [rsp + 0x3e0]
mov rcx, rsi
call sub.kernel32.dll_Process32First
test eax, eax
je 0x140005986
mov qword [rsp + 0x178], rbx
lea rbx, [rsp + 0x108]
lea r15, [rsp + 0x3e0]
lea rbp, [rsp + 0x260]
mov r14d, dword [rsp + 0x3e8]
mov r13d, dword [rsp + 0x400]
mov rcx, rdi
call fcn.14000f860
mov r8, rdx
mov rcx, rbx
mov rdx, rax
call fcn.1400090e5
mov ecx, 0x410
xor edx, edx
mov r8d, r14d
call sub.kernel32.dll_OpenProcess
test rax, rax
je 0x1400058de
mov r12, rax
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14000fbac
cmp qword [rsp + 0x70], 0
je 0x1400058d6
mov rcx, rbp
mov rdx, rbx
call fcn.14000dae8
mov dword [rsp + 0x2a0], r14d
mov dword [rsp + 0x2a4], r13d
mov qword [rsp + 0x278], r12
lea rax, [rsp + 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rsp + 0x280]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
and dword [rsp + 0x2a8], 0
lea rcx, [rsp + 0x180]
mov rdx, rbp
call fcn.14000fc44
jmp 0x1400058de
mov rcx, r12
call fcn.140020688
mov rcx, rsi
mov rdx, r15
call sub.kernel32.dll_Process32Next
mov r14d, eax
mov rcx, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
call fcn.14000db00
test r14d, r14d
jne 0x14000582c
mov rcx, rsi
call fcn.140020688
movups xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x240], xmm0
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x258], rax
mov rdx, qword [rsp + 0x1f8]
mov r12d, dword [rsp + 0x50]
lea rbp, [rsp + 0x3e0]
jmp 0x1400059cd
movups xmmword [rsp + 0x248], xmm6
jmp 0x140005999
mov rax, rbx
and rax, 0x1fff
je 0x140008531
mov ecx, 0x2000
sub rcx, rax
add rbx, rcx
setae dil
jmp 0x1400054ec
mov rcx, rsi
call fcn.140020688
xorps xmm0, xmm0
movups xmmword [rsp + 0x248], xmm0
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x240], 8
mov ecx, 8
xor edx, edx
call fcn.14000fb5f
mov ecx, 8
xor edx, edx
call fcn.14000fb98
mov rdx, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x200]
call fcn.140003cb8
lea r15, [rsp + 0x90]
xorps xmm6, xmm6
lea r13, [rsp + 0x108]
xor eax, eax
mov qword [rsp + 0x378], rax
xor eax, eax
mov qword [rsp + 0x178], rax
test byte [rsp + 0x378], 1
jne 0x140005a41
mov rcx, qword [rsp + 0x240]
imul rax, qword [rsp + 0x250], 0x50
test rax, rax
je 0x140005a37
lea rdx, [rcx + 0x50]
add rax, 0xffffffffffffffb0
cmp dword [rcx + 0x40], r12d
mov rcx, rdx
jne 0x140005a1c
jmp 0x14000667e
mov al, 1
mov qword [rsp + 0x378], rax
mov rsi, qword [rsp + 0x200]
mov rcx, rsi
mov rbx, qword [rsp + 0x1f8]
mov rdx, rbx
call fcn.140003cb8
lea rax, [rsp + 0x400]
and word [rax + 4], 0
mov rdi, qword [section..data]
and dword [rax], 0
mov r12, qword [0x140023010]
and dword [rsp + 0x3e0], 0
movups xmmword [rax - 0x18], xmm6
mov qword [rsp + 0x3f8], 7
mov byte [rsp + 0x401], 1
mov word [rsp + 0x403], 0x101
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.140019cbb
mov rsi, rdx
test rax, rax
jne 0x140005b2f
jmp 0x140005ac8
sub r12, rax
jb case.0x14000577e.0
add rdi, rax
test r12, r12
je 0x140005b1d
mov rcx, rbp
mov rdx, rsi
mov r8, rdi
mov r9, r12
call fcn.140015fce
cmp qword [rsp + 0x3e0], 0
je 0x140005b07
mov rbx, qword [rsp + 0x3e8]
mov rcx, rbx
call fcn.140014b28
cmp al, 0x23
jne 0x140005b1f
mov rcx, rbx
call fcn.140014778
jmp 0x140005ac8
mov rax, qword [rsp + 0x3e8]
test rax, rax
jne 0x140005abc
lea rbx, str.failed_to_write_whole_buffer
jmp 0x140005b1f
xor ebx, ebx
mov rcx, rsi
call fcn.140020688
mov rsi, rbx
test rbx, rbx
je 0x140005b37
mov rcx, rsi
call fcn.1400017fd
mov rbx, qword [rsp + 0x1f8]
mov rcx, rbx
call fcn.140008f75
mov rsi, rax
mov rdi, rdx
mov rcx, rax
mov rdx, qword [rsp + 0x200]
mov r8, rbx
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0x2f8]
movups xmmword [rax], xmm6
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x2a0], rbx
mov byte [rsp + 0x2a8], 0
mov qword [rsp + 0x2f0], 8
and qword [rsp + 0x2b0], 0
and qword [rsp + 0x2c0], 0
and word [rsp + 0x2c8], 0
mov byte [rsp + 0x2e8], 2
and dword [rsp + 0x308], 0
and word [rsp + 0x30c], 0
mov eax, 5
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x280], rax
mov r14, qword [0x140023018]
mov rsi, qword [0x140023028]
mov rcx, rsi
call fcn.140008f75
mov rdi, rax
mov rbx, rdx
mov rcx, rax
mov rdx, r14
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x300]
cmp rdx, qword [rsp + 0x2f8]
jne 0x140005c39
lea rcx, [rsp + 0x2f0]
call fcn.140018547
mov rdx, qword [rsp + 0x300]
mov rax, qword [rsp + 0x2f0]
imul rcx, rdx, 0x28
and qword [rax + rcx], 0
mov qword [rax + rcx + 8], rdi
mov qword [rax + rcx + 0x10], rbx
mov qword [rax + rcx + 0x18], rsi
mov byte [rax + rcx + 0x20], 0
mov r8d, dword [rsp + 0x3e0]
mov r9d, dword [rsp + 0x3e3]
mov dword [rax + rcx + 0x21], r8d
mov dword [rax + rcx + 0x24], r9d
inc rdx
mov qword [rsp + 0x300], rdx
mov rcx, qword [rsp + 0x200]
mov rdx, qword [rsp + 0x1f8]
call fcn.14001a905
test rax, rax
je 0x140005cec
mov rdi, rax
mov rsi, rdx
mov rcx, rdx
call fcn.140008f75
mov rbx, rax
mov r14, rdx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x2d0]
call fcn.140015351
mov qword [rsp + 0x2d0], rbx
mov qword [rsp + 0x2d8], r14
mov qword [rsp + 0x2e0], rsi
mov byte [rsp + 0x2e8], 0
mov al, byte [rsp + 0x2c8]
test al, al
sete cl
mov rbx, qword [rsp + 0x2c0]
test rbx, rbx
sete dl
and dl, cl
mov byte [rsp + 0x170], dl
je 0x140005d18
xor ebx, ebx
jmp 0x14000651d
and qword [rsp + 0x320], 0
and qword [rsp + 0x330], 0
test al, al
lea r12, [rsp + 0x70]
jne 0x140005f21
call sub.kernel32.dll_GetEnvironmentStringsW
mov rsi, rax
mov r14, rax
test rax, rax
je 0x140008578
mov rdx, r14
cmp word [rdx], 0
je 0x140005f19
mov rdi, 0xfffffffffffffffd
mov rcx, 0xfffffffffffffffe
mov r14, rdx
mov rax, rcx
inc rdi
cmp word [r14], 0
lea r14, [r14 + 2]
lea rcx, [rcx + 2]
jne 0x140005d69
cmp rdi, 0xfffffffffffffffe
je case.0x14000577e.0
lea r12, [rdx + 4]
xor r15d, r15d
test rax, rax
je 0x140005daa
cmp word [r12 - 2], 0x3d
je 0x140005dbc
inc r15
add rax, 0xfffffffffffffffe
add r12, 2
jmp 0x140005d8f
mov rdx, r14
lea r15, [rsp + 0x90]
lea r12, [rsp + 0x70]
jmp 0x140005d4e
lea r13, [rdi + 2]
cmp r15, r13
jae case.0x14000577e.0
lea r8, [r15 + 1]
lea rcx, [rsp + 0x108]
call fcn.1400152c3
lea rax, [r15 + 2]
cmp r13, rax
jb case.0x14000577e.0
sub rdi, r15
lea rcx, [rsp + 0x400]
mov rdx, r12
mov r8, rdi
call fcn.1400152c3
movups xmm0, xmmword [rsp + 0x108]
movups xmm1, xmmword [rsp + 0x118]
movaps xmmword [rsp + 0x3f0], xmm1
movaps xmmword [rsp + 0x3e0], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
movaps xmm0, xmmword [rsp + 0x400]
movaps xmmword [rsp + 0x90], xmm0
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0xa0], rax
mov al, byte [rsp + 0x418]
lea rdx, [rsp + 0x400]
mov ecx, dword [rdx + 0x19]
mov edx, dword [rdx + 0x1c]
mov dword [rsp + 0x180], ecx
mov dword [rsp + 0x183], edx
cmp al, 2
lea r15, [rsp + 0x90]
lea r12, [rsp + 0x70]
lea r13, [rsp + 0x108]
je 0x140005f19
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x350], xmm1
movaps xmmword [rsp + 0x340], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x210], xmm0
mov rcx, qword [r15 + 0x10]
mov qword [rsp + 0x220], rcx
mov byte [rsp + 0x228], al
mov eax, dword [rsp + 0x180]
mov ecx, dword [rsp + 0x183]
lea rdx, [rsp + 0x229]
mov dword [rdx + 3], ecx
mov dword [rdx], eax
mov rcx, rbp
lea rdx, [rsp + 0x340]
call fcn.14001b219
mov rcx, r13
lea rdx, [rsp + 0x320]
mov r8, rbp
lea r9, [rsp + 0x210]
call fcn.14001771c
mov rcx, r13
call fcn.140015351
jmp 0x140005d4b
mov rcx, rsi
call sub.kernel32.dll_FreeEnvironmentStringsW
and qword [rsp + 0x188], 0
mov rax, qword [rsp + 0x2b0]
and qword [rsp + 0x1a8], 0
mov rcx, qword [rsp + 0x2b8]
xor edx, edx
test rax, rax
setne dl
mov qword [rsp + 0x180], rdx
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rcx
mov qword [rsp + 0x1a0], rdx
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rcx
cmove rbx, rax
test rbx, rbx
je 0x140006454
dec rbx
mov qword [rsp + 0x1c0], rbx
lea rcx, [rsp + 0x180]
call fcn.1400140e5
test rax, rax
je case.0x14000577e.0
mov rdi, rax
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3f0], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x3e0], xmm0
mov rcx, r12
mov rdx, rbp
call fcn.14001412b
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je case.0x14000577e.0
mov rax, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r14
mov rcx, rbp
mov rdx, r12
call fcn.140014178
imul rax, r14, 0x38
lea rbx, [rsi + rax]
add rbx, 0x168
shl r14, 5
mov rax, qword [rsp + 0x3f0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x3e0]
movups xmmword [rdi], xmm0
cmp byte [rsi + r14 + 0x18], 2
jne 0x14000608c
mov r12, qword [rsp + 0x320]
test r12, r12
je 0x1400063ac
mov rbp, qword [rsp + 0x328]
mov r9, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1d0]
mov rdx, r12
mov r8, rbp
call fcn.140016f98
cmp qword [rsp + 0x1d0], 0
je 0x14000610d
lea rbp, [rsp + 0x3e0]
jmp 0x1400063ac
add rsi, r14
lea rdx, [rbx + 0x18]
lea rcx, [rsp + 0x3f8]
call fcn.14001b25e
mov rdi, qword [rbx]
mov rbx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.140014648
mov r14, rax
mov r13, rdx
lea r8, [rbx + rbx]
mov rcx, rax
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x3e0], r14
mov qword [rsp + 0x3e8], r13
lea r13, [rsp + 0x108]
mov qword [rsp + 0x3f0], rbx
mov rcx, r12
mov rdx, rsi
call fcn.14001b25e
mov rcx, r13
lea rdx, [rsp + 0x320]
mov r8, rbp
mov r9, r12
call fcn.14001771c
mov rcx, r13
jmp 0x1400063bc
mov rax, qword [rsp + 0x1d8]
mov rdx, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1e8]
mov byte [rsp + 0x57], 0
test rdx, rdx
je 0x1400062c6
dec rdx
mov rax, qword [rax + rcx*8 + 0x3d8]
movzx ecx, word [rax + 0x3d2]
sub rdx, 1
jae 0x140006136
dec rcx
mov qword [rsp + 0x108], rax
and qword [rsp + 0x110], 0
mov qword [rsp + 0x118], rcx
lea rbx, [rsp + 0x3e0]
mov rcx, rbx
mov rdx, r13
lea r8, [rsp + 0x57]
call fcn.140017062
mov ecx, 0xb
mov rdi, r13
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x400]
mov rax, qword [rsi + 0x48]
mov qword [rsp + 0x390], rax
movups xmm0, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x380], xmm0
mov rcx, rbx
lea rdx, [rsp + 0x380]
call fcn.14001412b
mov rcx, qword [rsp + 0x3e0]
mov rax, qword [rsp + 0x3e8]
mov rdx, qword [rsp + 0x3f0]
imul r8, rdx, 0x38
mov r9, rdx
shl r9, 5
mov r10, qword [rcx + r8 + 0x198]
mov qword [rsp + 0x410], r10
movups xmm0, xmmword [rcx + r8 + 0x168]
movups xmm1, xmmword [rcx + r8 + 0x178]
movups xmm2, xmmword [rcx + r8 + 0x188]
movaps xmmword [rsp + 0x400], xmm2
movaps xmmword [rsp + 0x3f0], xmm1
movaps xmmword [rsp + 0x3e0], xmm0
mov r10, qword [rsp + 0x138]
mov qword [rcx + r8 + 0x198], r10
movups xmm0, xmmword [rsp + 0x108]
movups xmm1, xmmword [rsp + 0x118]
movups xmm2, xmmword [rsp + 0x128]
movups xmmword [rcx + r8 + 0x188], xmm2
movups xmmword [rcx + r8 + 0x178], xmm1
movups xmmword [rcx + r8 + 0x168], xmm0
movups xmm0, xmmword [rcx + r9]
movups xmm1, xmmword [rcx + r9 + 0x10]
movups xmmword [rsi + 0x28], xmm1
movups xmmword [rsi + 0x18], xmm0
lea r8, [rsp + 0x140]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rcx + r9 + 0x10], xmm1
movups xmmword [rcx + r9], xmm0
inc rdx
test rax, rax
je 0x1400062fb
lea rcx, [rcx + rdx*8]
add rcx, 0x3d8
mov rdx, qword [rcx]
lea rcx, [rdx + 0x3d8]
dec rax
jne 0x1400062a8
mov qword [rsp + 0xc8], rdx
movups xmmword [r15 + 0x40], xmm6
jmp 0x140006314
mov qword [rsp + 0x3e0], rax
and qword [rsp + 0x3e8], 0
mov qword [rsp + 0x3f0], rcx
lea rbx, [rsp + 0x70]
mov rcx, rbx
lea rdx, [rsp + 0x3e0]
lea r8, [rsp + 0x57]
call fcn.140017062
jmp 0x14000632c
mov qword [rsp + 0xc8], rcx
and qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], rdx
mov ecx, 0xb
lea rbx, [rsp + 0x70]
mov rdi, rbx
lea rsi, [rsp + 0x3e0]
rep movsq qword [rdi], qword [rsi]
mov ecx, 0xa
mov rdi, r13
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
mov bl, byte [rsp + 0xc0]
mov eax, dword [r15 + 0x31]
mov ecx, dword [r15 + 0x34]
dec qword [rsp + 0x330]
mov dword [rsp + 0x380], eax
mov dword [rsp + 0x383], ecx
cmp byte [rsp + 0x57], 0
je 0x14000639f
test rbp, rbp
je case.0x14000577e.0
mov rax, qword [r12 + 0x3d8]
mov qword [rsp + 0x320], rax
dec rbp
mov qword [rsp + 0x328], rbp
and qword [rax + 0x160], 0
mov edx, 8
mov rcx, r12
call fcn.1400087e0
cmp bl, 2
lea rbp, [rsp + 0x3e0]
jne 0x1400063ce
mov byte [rsp + 0x88], 2
lea r12, [rsp + 0x70]
mov rcx, r12
call fcn.140015351
mov rbx, qword [rsp + 0x1c0]
jmp 0x140005f7f
mov ecx, 0xa
mov rdi, rbp
mov rsi, r13
rep movsq qword [rdi], qword [rsi]
mov byte [rsp + 0x430], bl
mov eax, dword [rsp + 0x380]
mov ecx, dword [rsp + 0x383]
lea r9, [rsp + 0x400]
mov dword [r9 + 0x34], ecx
mov dword [r9 + 0x31], eax
movups xmm0, xmmword [r9 + 0x18]
mov rax, qword [r9 + 0x28]
mov cl, byte [r9 + 0x30]
mov edx, dword [r9 + 0x31]
movzx r8d, word [r9 + 0x35]
mov r9b, byte [r9 + 0x37]
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x88], cl
mov dword [rsp + 0x89], edx
mov word [rsp + 0x8d], r8w
mov byte [rsp + 0x8f], r9b
mov rcx, rbp
call fcn.140016486
jmp 0x1400063b4
mov rdi, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x328]
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x318], rax
mov ecx, 4
call fcn.140008f75
mov dword [rax], 0x48544150
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], 4
mov byte [rsp + 0x88], 0
mov rcx, rbp
mov rdx, r12
call fcn.14001b219
test rdi, rdi
mov qword [rsp + 0x370], rdi
je 0x14000650b
mov r9, qword [rsp + 0x3e0]
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call fcn.140016f98
cmp qword [rsp + 0x70], 0
jne 0x14000650b
mov rax, qword [rsp + 0x78]
mov ebx, 0
test rax, rax
je 0x14000650d
mov rcx, qword [rsp + 0x88]
shl rcx, 5
mov rbx, qword [rax + rcx]
mov rdi, qword [rax + rcx + 0x10]
jmp 0x14000650d
xor ebx, ebx
mov qword [rsp + 0x368], rsi
mov rcx, rbp
call fcn.140016486
mov r12, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x2a0]
mov qword [rsp + 0x210], r12
mov qword [rsp + 0x218], rsi
lea rdx, str.program_path_has_no_file_name
test rsi, rsi
je 0x140006587
mov r9d, 4
mov rcx, r12
mov rdx, rsi
lea r8, str.__UNC._
call fcn.140012d2f
test al, al
lea rdx, [0x14001b2ba]
lea rax, [0x14001b2b3]
cmovne rdx, rax
mov cl, byte [rsi + r12 - 1]
call rdx
lea rdx, str.program_path_has_no_file_name
test al, al
je 0x1400065f8
mov r12d, dword [rsp + 0x50]
mov rsi, rdx
mov edi, 2
cmp byte [rsp + 0x170], 0
jne 0x14000662d
mov rcx, qword [rsp + 0x370]
test rcx, rcx
je 0x140006609
and qword [rsp + 0x3e8], 0
mov qword [rsp + 0x3f0], rcx
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0x3f8], rax
and qword [rsp + 0x408], 0
mov qword [rsp + 0x410], rcx
mov qword [rsp + 0x418], rax
mov eax, 1
mov rcx, qword [rsp + 0x318]
jmp 0x14000660d
cmp rsi, 4
jae 0x1400067b8
xor eax, eax
jmp 0x140006818
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x420], rcx
mov rcx, rbp
call fcn.1400186a7
xor ecx, ecx
call fcn.14001bf48
cmp rdi, 2
jne 0x14000843b
mov al, byte [0x14002d140]
mov ecx, 8
mov edx, 8
call fcn.140008750
test rax, rax
je 0x140008550
mov rdi, rax
mov qword [rax], rsi
lea rcx, [rsp + 0x260]
call fcn.140001842
mov rcx, rdi
lea rdx, fcn.14000da7c
call fcn.1400017a8
mov rax, qword [rsp + 0x178]
inc rax
cmp qword [0x14002d030], 0
mov qword [rsp + 0x178], rax
je 0x1400066a7
xor edx, edx
mov ecx, 0x3c
div rcx
jmp 0x1400066ca
mov r8, rax
xor edx, edx
mov ecx, 3
div rcx
mov rcx, rdx
mov rax, r8
xor edx, edx
mov r8d, 0x3c
div r8
test rcx, rcx
je 0x1400066d3
test rdx, rdx
jne 0x1400069be
mov rcx, rbp
mov edx, dword [rsp + 0x33c]
call fcn.140001c14
cmp byte [rsp + 0x430], 2
je 0x1400069be
mov r14, qword [rsp + 0x3e0]
mov rsi, qword [rsp + 0x3e8]
lea r13, [rsp + 0x400]
movups xmm0, xmmword [r13 - 0x10]
movups xmm1, xmmword [r13]
movaps xmmword [rsp + 0x260], xmm0
movaps xmmword [rsp + 0x270], xmm1
mov rax, qword [r13 + 0x10]
mov qword [rsp + 0x280], rax
mov rbx, qword [rsp + 0x418]
mov rdi, qword [rsp + 0x420]
mov rcx, qword [0x140023018]
mov rdx, qword [0x140023020]
call fcn.140008f6b
lea rcx, [rsp + 0x2f8]
mov rax, qword [rcx - 0x78]
mov qword [0x140023028], rax
movups xmm0, xmmword [rcx - 0x88]
movups xmmword [0x140023018], xmm0
test r14, r14
je 0x140006999
mov rcx, qword [0x14002d030]
mov rdx, qword [0x14002d038]
call fcn.14000db00
mov qword [0x14002d030], r14
mov qword [0x14002d038], rsi
movups xmm0, xmmword [r13 - 0x10]
movups xmmword [0x14002d040], xmm0
mov rcx, rbx
mov rdx, rdi
call fcn.140008f6b
jmp 0x1400069ae
lea rcx, [rsi + r12]
add rcx, 0xfffffffffffffffc
xor edx, edx
lea r11, str..exeprogram_not_found
cmp rdx, 4
sete al
je 0x140006808
mov r8b, byte [rcx + rdx]
mov r9b, byte [rdx + r11]
inc rdx
lea r10d, [r8 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
or r10b, r8b
lea r8d, [r9 - 0x41]
cmp r8b, 0x1a
setb r8b
shl r8b, 5
or r8b, r9b
cmp r10b, r8b
je 0x1400067c9
mov r12, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x218]
lea rcx, [r12 + rsi]
xor edx, edx
cmp rsi, rdx
je 0x14000685c
movzx r8d, byte [r12 + rdx]
cmp r8d, 0x2f
je 0x140006837
inc rdx
cmp r8d, 0x5c
jne 0x14000681e
test al, al
je 0x140006b3e
lea rcx, [rsp + 0x1d0]
mov rdx, r12
mov r8, rsi
call fcn.14001b3df
mov r12d, dword [rsp + 0x50]
jmp 0x140006c92
mov qword [rsp + 0x3e0], r12
mov qword [rsp + 0x3e8], rcx
and word [rsp + 0x3f0], 0
mov rcx, rbp
call fcn.1400148cf
cmp ax, 1
jne 0x140006888
test dx, dx
jne 0x140006875
lea rdx, str.nul_byte_found_in_provided_data
cmp ax, 1
je 0x140006587
mov rcx, r12
mov rdx, rsi
mov r8b, 0x2e
call fcn.14001b2c9
mov byte [rsp + 0x340], al
test rbx, rbx
je 0x140006cc0
add rdi, rbx
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x110], rdi
and word [rsp + 0x118], 0
mov byte [rsp + 0x120], 1
lea rsi, [rsp + 0x70]
mov rcx, rbp
mov rdx, r13
call fcn.1400199b4
mov al, byte [rsp + 0x3f8]
cmp al, 2
je 0x140006cb8
cmp qword [rsp + 0x3f0], 0
je 0x14000697f
mov rcx, qword [rsp + 0x3f0]
mov qword [rsp + 0x80], rcx
movups xmm0, xmmword [rsp + 0x3e0]
movaps xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x400]
mov ecx, dword [rdx - 7]
mov edx, dword [rdx - 4]
mov dword [r15 - 4], edx
mov dword [r15 - 7], ecx
mov byte [rsp + 0x88], al
mov rcx, rbp
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x340]
mov r9, rsi
call fcn.14001b2e9
mov rdi, qword [rsp + 0x3e0]
mov rdx, qword [rsp + 0x3e8]
test rdi, rdi
jne 0x140006e9d
xor ecx, ecx
call fcn.14001b34a
jmp 0x1400068e0
mov rcx, qword [rsp + 0x3e0]
mov rdx, qword [rsp + 0x3e8]
call fcn.140008f6b
jmp 0x1400068e0
mov rcx, rbx
mov rdx, rdi
call fcn.140008f6b
xor ecx, ecx
mov rdx, rsi
call fcn.14000db00
lea r15, [rsp + 0x90]
lea r13, [rsp + 0x108]
call fcn.1400199aa
mov rcx, qword [rsp + 0x240]
mov rdx, qword [rsp + 0x250]
and qword [rsp + 0x250], 0
call fcn.14000fb64
mov ecx, 2
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
test rax, rax
jle 0x140005a01
mov rsi, rax
mov r8d, 0x104
lea rcx, [rsp + 0x40c]
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rsp + 0x3e0], 0x130
and dword [rsp + 0x3e8], 0
lea rax, [rsp + 0x400]
movups xmmword [rax - 0x10], xmm6
movups xmmword [rax - 4], xmm6
mov rcx, rsi
mov rdx, rbp
call sub.kernel32.dll_Process32First
test eax, eax
je 0x140006b31
mov edi, dword [rsp + 0x3e8]
mov ebp, dword [rsp + 0x400]
lea rcx, [rsp + 0x40c]
call fcn.14000f860
mov r8, rdx
mov rcx, r13
mov rdx, rax
call fcn.1400090e5
mov ecx, 0x410
xor edx, edx
mov r8d, edi
call sub.kernel32.dll_OpenProcess
test rax, rax
je 0x140006aff
mov rbx, rax
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14000fbac
cmp qword [rsp + 0x70], 0
je 0x140006af7
lea r14, [rsp + 0x260]
mov rcx, r14
mov rdx, r13
call fcn.14000dae8
mov dword [rsp + 0x2a0], edi
mov dword [rsp + 0x2a4], ebp
mov qword [rsp + 0x278], rbx
movups xmm0, xmmword [r15 - 0x18]
movups xmm1, xmmword [r15 - 8]
lea rax, [rsp + 0x2f8]
movups xmmword [rax - 0x68], xmm1
movups xmmword [rax - 0x78], xmm0
and dword [rsp + 0x2a8], 0
lea rcx, [rsp + 0x240]
mov rdx, r14
call fcn.14000fc44
jmp 0x140006aff
mov rcx, rbx
call fcn.140020688
mov rcx, rsi
lea rbp, [rsp + 0x3e0]
mov rdx, rbp
call sub.kernel32.dll_Process32Next
mov edi, eax
mov rcx, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
call fcn.14000db00
test edi, edi
jne 0x140006a45
mov rcx, rsi
call fcn.140020688
jmp 0x140005a01
mov rcx, rsi
call fcn.140008f75
mov rdi, rax
mov rbx, rdx
mov rcx, rax
mov rdx, r12
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x88], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x3f0], rax
mov al, byte [rsp + 0x88]
mov byte [rsp + 0x3f8], al
mov eax, dword [rsp + 0x89]
mov dword [rsp + 0x3f9], eax
movzx eax, word [rsp + 0x8d]
mov word [rsp + 0x3fd], ax
mov al, byte [rsp + 0x8f]
mov byte [rsp + 0x3ff], al
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x3e8], rax
mov r8d, 4
mov rcx, rbp
lea rdx, str..exeprogram_not_found
call fcn.140019aa8
movaps xmm0, xmmword [rsp + 0x3e0]
movaps xmm1, xmmword [rsp + 0x3f0]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x80]
mov rcx, rbp
mov rdx, rsi
call fcn.14001b373
cmp qword [rsp + 0x3e0], 0
je 0x140006c4f
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x1e0], rax
movups xmm0, xmmword [rsp + 0x3e0]
movaps xmmword [rsp + 0x1d0], xmm0
jmp 0x140006c80
lea rcx, [rsp + 0x70]
lea rdx, [0x140026f40]
xor r8d, r8d
call fcn.14001afeb
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x1d0]
mov rdx, rsi
call fcn.14001b3df
mov r12d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x78]
mov rcx, rsi
call fcn.140008f6b
mov rdi, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1d8]
test rdi, rdi
je 0x14000658c
mov r14, qword [rsp + 0x1e0]
jmp 0x1400071be
mov rcx, rbp
call fcn.140015351
mov qword [rsp + 0x108], 2
lea rax, [rsp + 0x140]
movups xmmword [rax - 0x30], xmm6
mov r8d, 0x200
mov esi, 2
xor edi, edi
xor r14d, r14d
cmp r8, 0x201
jae 0x140006cff
mov r12, rbp
mov r13d, 0x200
mov rbp, r8
jmp 0x140006d45
sub r8, r14
lea rcx, [rsp + 0x108]
mov rdx, r8
call fcn.1400146a0
mov rsi, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x110]
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x118], r14
mov r12, rsi
mov r13, r14
mov rbp, r14
xor ecx, ecx
call sub.kernel32.dll_SetLastError
xor ecx, ecx
mov rdx, r12
mov r8d, ebp
call sub.kernel32.dll_GetModuleFileNameW
mov ebx, eax
test eax, eax
jne 0x140006d68
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140006dca
mov r8d, ebx
cmp rbp, r8
jne 0x140006d9d
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne case.0x14000577e.0
add rbp, rbp
mov eax, 0xffffffff
cmp rbp, rax
cmovae rbp, rax
mov r8, rbp
lea rbp, [rsp + 0x3e0]
jmp 0x140006ce8
lea rbp, [rsp + 0x3e0]
jb 0x140006ce8
cmp r13, r8
jb case.0x14000577e.0
lea rcx, [rsp + 0x70]
mov rdx, r12
call fcn.1400152c3
mov bl, byte [rsp + 0x88]
jmp 0x140006de6
call fcn.140014b12
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x88], 2
mov bl, 2
lea rbp, [rsp + 0x3e0]
lea r14, [rsp + 0x108]
mov rcx, rsi
mov rdx, rdi
call fcn.1400150e9
cmp bl, 2
jne 0x140006e0d
lea rcx, [rsp + 0x70]
call fcn.1400152aa
jmp 0x140006eb1
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, rsi
mov rdx, rdi
call fcn.14001a905
cmp rdi, rdx
cmovb rdx, rdi
test rax, rax
cmove rdx, rdi
mov qword [rsp + 0x3e0], rsi
mov qword [rsp + 0x3e8], rbx
mov qword [rsp + 0x3f0], rdx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x3f8], rax
mov rcx, r14
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x340]
mov r9, rbp
call fcn.14001b2e9
mov rdi, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
test rdi, rdi
je 0x140006eaa
mov r14, qword [rsp + 0x118]
jmp 0x14000719e
mov r14, qword [rsp + 0x3f0]
jmp 0x14000719e
xor ecx, ecx
call fcn.14001b34a
mov qword [rsp + 0x180], 2
lea rax, [rsp + 0x188]
movups xmmword [rax], xmm6
mov r8d, 0x200
mov esi, 2
xor edi, edi
xor r14d, r14d
cmp r8, 0x201
jae 0x140006eef
mov r12, rbp
mov r13d, 0x200
mov rbp, r8
jmp 0x140006f35
sub r8, r14
lea rcx, [rsp + 0x180]
mov rdx, r8
call fcn.1400146a0
mov rsi, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x188]
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x190], r14
mov r12, rsi
mov r13, r14
mov rbp, r14
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r12
mov edx, ebp
call sub.kernel32.dll_GetSystemDirectoryW
mov ebx, eax
test eax, eax
jne 0x140006f59
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140007004
mov r8d, ebx
cmp rbp, r8
jne 0x140006f8e
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne case.0x14000577e.0
add rbp, rbp
mov eax, 0xffffffff
cmp rbp, rax
cmovae rbp, rax
mov r8, rbp
lea rbp, [rsp + 0x3e0]
jmp 0x140006ed8
lea rbp, [rsp + 0x3e0]
jb 0x140006ed8
cmp r13, r8
jb case.0x14000577e.0
lea rbx, [rsp + 0x70]
mov rcx, rbx
mov rdx, r12
call fcn.1400152c3
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x340]
mov r9, rbx
call fcn.14001b2e9
and qword [rsp + 0x108], 0
mov rcx, rsi
mov rdx, rdi
call fcn.1400150e9
mov rdi, qword [rsp + 0x110]
test rdi, rdi
lea rcx, [rsp + 0x108]
jne 0x14000718e
jmp 0x140007038
call fcn.140014b12
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], 1
mov rcx, rsi
mov rdx, rdi
call fcn.1400150e9
lea rbp, [rsp + 0x3e0]
lea rcx, [rsp + 0x108]
call fcn.14001b354
mov qword [rsp + 0x180], 2
lea rax, [rsp + 0x188]
movups xmmword [rax], xmm6
mov r8d, 0x200
mov esi, 2
xor edi, edi
xor r14d, r14d
cmp r8, 0x201
jae 0x14000707b
mov r12, rbp
mov r13d, 0x200
mov rbp, r8
jmp 0x1400070c1
sub r8, r14
lea rcx, [rsp + 0x180]
mov rdx, r8
call fcn.1400146a0
mov rsi, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x188]
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x190], r14
mov r12, rsi
mov r13, r14
mov rbp, r14
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r12
mov edx, ebp
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebx, eax
test eax, eax
jne 0x1400070e5
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1400076d2
mov r8d, ebx
cmp rbp, r8
jne 0x14000711a
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne case.0x14000577e.0
add rbp, rbp
mov eax, 0xffffffff
cmp rbp, rax
cmovae rbp, rax
mov r8, rbp
lea rbp, [rsp + 0x3e0]
jmp 0x140007064
lea rbp, [rsp + 0x3e0]
jb 0x140007064
cmp r13, r8
jb case.0x14000577e.0
lea rbx, [rsp + 0x70]
mov rcx, rbx
mov rdx, r12
call fcn.1400152c3
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x340]
mov r9, rbx
call fcn.14001b2e9
and qword [rsp + 0x108], 0
mov rcx, rsi
mov rdx, rdi
call fcn.1400150e9
mov rdi, qword [rsp + 0x110]
test rdi, rdi
lea r13, [rsp + 0x108]
je 0x140007706
mov rdx, qword [rsp + 0x118]
mov r14, qword [rsp + 0x120]
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0x1d8], rdx
mov qword [rsp + 0x1e0], r14
mov qword [rsp + 0x3d0], rdx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xf8], rdx
lea rax, [rdi + r14*2]
add rax, 0xfffffffffffffff6
cmp r14, 5
mov ecx, 0
cmovb rax, rcx
jb 0x1400071f3
cmp word [rax], 0x2e
jne 0x1400071f3
cmp word [rax + 8], 0
je 0x140007623
mov rsi, qword [rsp + 0x290]
mov r12, qword [rsp + 0x2f0]
mov r14, rbp
mov bpl, byte [rsp + 0x30d]
mov rbx, qword [rsp + 0x2a0]
add rbx, rsi
imul rdi, qword [rsp + 0x300], 0x28
mov qword [rsp + 0x70], 2
movups xmmword [r15 - 0x18], xmm6
lea r13, [rsp + 0x70]
mov rcx, r13
mov dx, 0x22
call fcn.140019380
mov qword [rsp + 0x3e0], rsi
mov qword [rsp + 0x3e8], rbx
and word [rsp + 0x3f0], 0
mov rcx, r13
mov rdx, r14
call fcn.14001935b
mov rcx, r13
mov dx, 0x22
call fcn.140019380
test rdi, rdi
je 0x1400072d2
lea rbx, [r12 + 0x28]
lea rsi, [rsp + 0x70]
mov rcx, rsi
mov dx, 0x20
call fcn.140019380
mov rcx, rsi
mov rdx, r12
mov r8d, ebp
call fcn.14001b89c
add rdi, 0xffffffffffffffd8
mov r12, rbx
test rax, rax
je 0x140007271
mov rsi, rax
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
call fcn.1400150e9
mov r12d, dword [rsp + 0x50]
lea rbp, [rsp + 0x3e0]
lea r13, [rsp + 0x108]
jmp 0x140007609
mov rax, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
test rax, rax
lea r13, [rsp + 0x108]
je 0x1400075f9
mov rcx, qword [rsp + 0x80]
mov dl, 1
mov dword [rsp + 0x168], edx
mov dword [rsp + 0x20c], 0
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0xf8]
mov qword [rsp + 0x68], rdx
lea rbp, [rsp + 0x3e0]
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r12
mov qword [rsp + 0x220], rcx
lea rcx, [rsp + 0x210]
xor edx, edx
call fcn.140019380
cmp byte [rsp + 0x30c], 0
mov ecx, 0x608
mov eax, 0x400
cmove ecx, eax
or ecx, dword [rsp + 0x308]
mov dword [rsp + 0x338], ecx
mov eax, 2
mov qword [rsp + 0x160], rax
mov r14d, 0
mov esi, 0
cmp byte [rsp + 0x170], 0
mov r12d, dword [rsp + 0x50]
jne 0x14000768f
mov qword [rsp + 0x1d0], 2
lea rax, [rsp + 0x1d8]
movups xmmword [rax], xmm6
mov rcx, qword [rsp + 0x318]
test rcx, rcx
mov rsi, qword [rsp + 0x370]
jne 0x1400073e0
lea rcx, [rsp + 0x1d0]
xor edx, edx
call fcn.140019380
mov rcx, qword [rsp + 0x318]
xor eax, eax
test rsi, rsi
setne al
cmove rcx, rsi
mov qword [rsp + 0x3e0], rax
and qword [rsp + 0x3e8], 0
mov qword [rsp + 0x3f0], rsi
mov rdx, qword [rsp + 0x368]
mov qword [rsp + 0x3f8], rdx
mov qword [rsp + 0x400], rax
and qword [rsp + 0x408], 0
mov qword [rsp + 0x410], rsi
mov qword [rsp + 0x418], rdx
mov qword [rsp + 0x420], rcx
lea rcx, [rsp + 0x70]
mov rdx, rbp
call fcn.140014ed3
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140007650
mov rdx, qword [rsp + 0x80]
mov rcx, rdx
shl rcx, 5
mov r13b, byte [rax + rcx + 0x18]
cmp r13b, 2
je 0x140007650
imul rdx, rdx, 0x38
add rdx, rax
add rdx, 0x168
mov rdi, qword [rdx]
mov r12, qword [rdx + 8]
mov rbx, qword [rdx + 0x10]
lea r8, [rax + rcx]
mov r14, qword [rax + rcx]
mov rbp, qword [rax + rcx + 8]
mov r15, qword [rax + rcx + 0x10]
movups xmm0, xmmword [rdx + 0x18]
movups xmm1, xmmword [rdx + 0x28]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov eax, dword [r8 + 0x19]
mov ecx, dword [r8 + 0x1c]
mov dword [rsp + 0x343], ecx
mov dword [rsp + 0x340], eax
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x70]
call fcn.14001b9ff
cmp byte [rsp + 0x120], 2
mov rsi, qword [rsp + 0x108]
je 0x14000796a
mov rdx, qword [rsp + 0x110]
mov rcx, rsi
call fcn.140008f6b
lea rsi, [rsp + 0x1d0]
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call fcn.1400150a7
mov rcx, rdi
mov rdx, r12
mov rbx, rsi
call fcn.1400150e9
mov rcx, rsi
mov dx, 0x3d
call fcn.140019380
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], r15
mov byte [rsp + 0x88], r13b
mov eax, dword [rsp + 0x340]
mov ecx, dword [rsp + 0x343]
lea rdx, [rsp + 0x90]
mov dword [rdx - 4], ecx
mov dword [rdx - 7], eax
lea r13, [rsp + 0x108]
mov rcx, r13
lea rdx, [rsp + 0x70]
call fcn.14001b9ff
cmp byte [rsp + 0x120], 2
mov rsi, qword [rsp + 0x108]
je 0x140007b07
mov rdi, qword [rsp + 0x110]
mov rax, qword [rsp + 0x118]
add rax, rsi
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rax
and word [rsp + 0x190], 0
mov rcx, rbx
lea rdx, [rsp + 0x180]
call fcn.14001935b
mov rcx, rsi
mov rdx, rdi
call fcn.140008f6b
mov rcx, rbx
xor edx, edx
call fcn.140019380
mov r12d, dword [rsp + 0x50]
lea rbp, [rsp + 0x3e0]
jmp 0x14000743e
mov rsi, r12
mov r12d, dword [rsp + 0x50]
lea rbp, [rsp + 0x3e0]
mov rdx, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.1400150e9
jmp 0x14000658f
movzx ecx, word [rax + 2]
cmp ecx, 0x42
je 0x14000799a
cmp ecx, 0x43
je 0x1400079bc
cmp ecx, 0x62
je 0x14000799a
cmp ecx, 0x63
je 0x1400079bc
jmp 0x1400071f3
mov rcx, rbp
call fcn.1400186a7
lea rcx, [rsp + 0x1d0]
xor edx, edx
call fcn.140019380
mov rsi, qword [rsp + 0x1d0]
mov r14, qword [rsp + 0x1d8]
mov rax, rsi
lea r15, [rsp + 0x90]
lea r13, [rsp + 0x108]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x170], rax
cmp byte [rsp + 0x2e8], 2
mov eax, 0
mov edi, 0
je 0x14000787f
lea rcx, [rsp + 0x2d0]
call fcn.14001ba7e
test rax, rax
je 0x140007830
mov rsi, rdx
mov rdi, qword [rsp + 0x58]
jmp 0x140007fb6
call fcn.140014b12
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x108], 1
mov rcx, rsi
mov rdx, rdi
call fcn.1400150e9
lea rbp, [rsp + 0x3e0]
lea r13, [rsp + 0x108]
mov rcx, r13
call fcn.14001b354
mov r8d, 4
lea rcx, [rsp + 0x180]
lea rdx, [0x1400275d9]
call fcn.1400197c5
cmp byte [rsp + 0x198], 2
je 0x140007ba8
mov r12, qword [rsp + 0x180]
mov rsi, qword [rsp + 0x188]
mov rax, qword [rsp + 0x190]
add rax, r12
mov qword [rsp + 0x108], r12
mov qword [rsp + 0x110], rax
and word [rsp + 0x118], 0
mov byte [rsp + 0x120], 1
mov rcx, rbp
mov rdx, r13
call fcn.1400199b4
mov al, byte [rsp + 0x3f8]
cmp al, 2
je 0x140007b95
cmp qword [rsp + 0x3f0], 0
je 0x140007816
mov rcx, qword [rsp + 0x3f0]
mov qword [rsp + 0x80], rcx
movups xmm0, xmmword [rsp + 0x3e0]
movaps xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x400]
mov ecx, dword [rdx - 7]
mov edx, dword [rdx - 4]
mov dword [r15 - 4], edx
mov dword [r15 - 7], ecx
mov byte [rsp + 0x88], al
mov rcx, rbp
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x340]
lea r9, [rsp + 0x70]
call fcn.14001b2e9
mov rdi, qword [rsp + 0x3e0]
mov rax, qword [rsp + 0x3e8]
test rdi, rdi
jne 0x140007bc3
xor ecx, ecx
mov rdx, rax
call fcn.14001b34a
jmp 0x140007772
mov rcx, qword [rsp + 0x3e0]
mov rdx, qword [rsp + 0x3e8]
call fcn.140008f6b
jmp 0x140007772
mov rax, qword [rdx]
mov rcx, qword [rdx + 0x10]
add rcx, rax
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], rcx
and word [rsp + 0x3f0], 0
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov rdx, rbp
call fcn.14001bad6
mov rcx, rdi
xor edx, edx
call fcn.140019380
mov rdi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x1f0], r14
movaps xmmword [rsp + 0x180], xmm6
and qword [rsp + 0x190], 0
lea rbx, [0x14002d110]
mov rcx, rbx
call sub.kernel32.dll_AcquireSRWLockExclusive
mov al, byte [0x14002d118]
xor ecx, ecx
test al, al
setne cl
mov qword [rsp + 0x110], rbx
and qword [rsp + 0x70], 0
mov byte [rsp + 0x118], 0
and qword [rsp + 0x80], 0
mov qword [rsp + 0x108], rcx
and qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x268]
cmp rax, 5
mov r14, qword [rsp + 0x270]
mov rbx, qword [rsp + 0x280]
mov ecx, 0
cmovne rcx, rax
mov r8d, 0xfffffff6
lea r9, [rsp + 0x70]
call fcn.14001bb94
test rax, rax
je 0x14000794b
mov rsi, rdx
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x160]
mov r14, qword [rsp + 0x1f0]
jmp 0x140007f56
cmp r14d, 5
mov qword [rsp + 0x230], rdx
je 0x140007b48
mov rcx, qword [rsp + 0x270]
jmp 0x140007b4a
mov rcx, r14
mov rdx, rbp
call fcn.140008f6b
mov rcx, rdi
mov rdx, r12
call fcn.1400150e9
mov r12d, dword [rsp + 0x50]
lea rbp, [rsp + 0x3e0]
lea r13, [rsp + 0x108]
jmp 0x140007b14
movzx edx, word [rax + 4]
or edx, 0x20
cmp edx, 0x61
jne 0x1400079b2
movzx edx, word [rax + 6]
or edx, 0x20
cmp edx, 0x74
je 0x1400079dd
cmp cx, 0x43
jne 0x1400071f3
movzx ecx, word [rax + 4]
or ecx, 0x20
cmp ecx, 0x6d
jne 0x1400071f3
movzx eax, word [rax + 6]
add eax, 0xffffffbc
test ax, 0xffdf
jne 0x1400071f3
mov qword [rsp + 0x70], 2
movups xmmword [r15 - 0x18], xmm6
mov ebp, 0x200
mov eax, 2
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x68], rax
xor ebx, ebx
cmp rbp, 0x201
jae 0x140007a1f
lea r12, [rsp + 0x3e0]
mov r13d, 0x200
mov rsi, rbp
jmp 0x140007a65
sub rbp, rbx
lea rcx, [rsp + 0x70]
mov rdx, rbp
call fcn.1400146a0
mov r12, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov eax, 0xffffffff
cmp rcx, rax
mov ebx, 0xffffffff
mov rax, rcx
mov qword [rsp + 0x68], rcx
cmovb rbx, rcx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x58], r12
mov r13, rbx
mov rsi, rbx
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r12
mov edx, esi
call sub.kernel32.dll_GetSystemDirectoryW
mov edi, eax
test eax, eax
jne 0x140007a89
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140007be1
mov ebp, edi
cmp rsi, rbp
jne 0x140007ab5
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne case.0x14000577e.0
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov rbp, rsi
jmp 0x140007a03
jb 0x140007a03
cmp r13, rbp
jb case.0x14000577e.0
mov rcx, rbp
call fcn.140014648
mov rsi, rdx
mov r8, rbp
add r8, rbp
mov rcx, rax
mov qword [rsp + 0x168], rax
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rdi, rbp
lea r13, [rsp + 0x108]
mov rbx, qword [rsp + 0x60]
jmp 0x140007c12
mov r12d, dword [rsp + 0x50]
lea rbp, [rsp + 0x3e0]
mov rcx, rbp
call fcn.1400186a7
mov rcx, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1d8]
call fcn.1400150e9
lea r15, [rsp + 0x90]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x140007fc6
xor ecx, ecx
mov r14, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x278]
mov r8d, 0xfffffff5
lea r9, [rsp + 0x80]
call fcn.14001bb94
mov r12, rdx
test rax, rax
je 0x140007b7f
mov rdi, qword [rsp + 0x58]
jmp 0x140007f39
cmp ebx, 5
je 0x140007ef3
mov rcx, qword [rsp + 0x280]
jmp 0x140007ef5
mov rcx, rbp
call fcn.140015351
mov rcx, r12
mov rdx, rsi
call fcn.140008f6b
xor ecx, ecx
mov rdx, qword [rsp + 0x3d0]
call fcn.14001b34a
lea rdx, [0x140027bd0]
jmp 0x140006587
mov r14, qword [rsp + 0x3f0]
mov rcx, r12
mov rdx, rsi
mov rsi, rax
call fcn.140008f6b
mov rdx, rsi
jmp 0x14000719e
call fcn.140014b12
mov rsi, rax
xor eax, eax
mov qword [rsp + 0x168], rax
lea r13, [rsp + 0x108]
mov rdi, qword [rsp + 0x398]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
call fcn.1400150e9
mov rdx, qword [rsp + 0x168]
test rdx, rdx
mov r12d, dword [rsp + 0x50]
lea rbp, [rsp + 0x3e0]
mov qword [rsp + 0x398], rdi
je 0x1400083ae
mov qword [rsp + 0x108], rdx
mov eax, 1
mov qword [rsp + 0x3e0], rax
and qword [rsp + 0x3e8], 0
mov qword [rsp + 0x3f0], rax
and word [rsp + 0x3f8], 0
lea rbx, [0x140027c26]
mov qword [rsp + 0x400], rbx
lea rax, [0x140027c2e]
mov qword [rsp + 0x408], rax
and word [rsp + 0x410], 0
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], rdi
test rbx, rbx
je 0x140007cd0
mov rbx, rdx
lea rcx, [rsp + 0x400]
call fcn.1400147d0
test ax, ax
je 0x140007cc4
mov esi, edx
mov rdx, rbx
jmp 0x140007d09
and qword [rsp + 0x400], 0
mov rdx, rbx
cmp qword [rsp + 0x3e0], 0
je 0x140007da3
mov rax, qword [rsp + 0x3e8]
cmp qword [rsp + 0x3f0], rax
je 0x140007da3
lea rcx, [rax + 1]
mov qword [rsp + 0x3e8], rcx
movzx esi, word [rsp + rax*2 + 0x3f8]
mov rbx, qword [rsp + 0x400]
cmp rdi, qword [rsp + 0x110]
jne 0x140007d97
mov rax, qword [rsp + 0x3e0]
test rbx, rbx
je 0x140007d60
mov rdx, qword [rsp + 0x408]
sub rdx, rbx
add rdx, 3
shr rdx, 2
test rax, rax
je 0x140007d79
mov rax, qword [rsp + 0x3f0]
sub rax, qword [rsp + 0x3e8]
add rdx, rax
mov rax, 0xffffffffffffffff
cmovb rdx, rax
jmp 0x140007d80
test rax, rax
je 0x140007d77
mov rdx, qword [rsp + 0x3f0]
sub rdx, qword [rsp + 0x3e8]
jmp 0x140007d79
xor edx, edx
mov rax, 0xffffffffffffffff
inc rdx
cmove rdx, rax
mov rcx, r13
call fcn.1400146a0
mov rdx, qword [rsp + 0x108]
mov word [rdx + rdi*2], si
inc rdi
jmp 0x140007c9b
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x110]
test rdi, rdi
je 0x140007609
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x160], rax
mov rbp, qword [rsp + 0x300]
mov al, byte [rsp + 0x30d]
mov byte [rsp + 0x168], al
test al, al
setne byte [rsp + 0x68]
lea rax, str.cmd.exe__d__c__
mov qword [rsp + 0x108], rax
lea rax, [0x1400278f7]
mov qword [rsp + 0x110], rax
and word [rsp + 0x118], 0
mov rcx, r13
call fcn.1400147d0
test ax, ax
je 0x14000820e
mov ebx, edx
mov qword [rsp + 0x58], rdi
mov rcx, qword [rsp + 0x110]
sub rcx, qword [rsp + 0x108]
add rcx, 3
shr rcx, 2
cmp rcx, 4
mov eax, 3
cmovb rcx, rax
inc rcx
call fcn.140014648
mov rdi, rax
mov word [rax], bx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], 1
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x3f0], rax
movups xmm0, xmmword [rsp + 0x108]
movaps xmmword [rsp + 0x3e0], xmm0
mov r12d, 1
lea rcx, [rsp + 0x3e0]
call fcn.1400147d0
cmp ax, 1
jne 0x1400081ea
mov ebx, edx
cmp r12, qword [rsp + 0x78]
jne 0x140007ee1
mov rdx, qword [rsp + 0x3e8]
sub rdx, qword [rsp + 0x3e0]
add rdx, 3
shr rdx, 2
inc rdx
lea rcx, [rsp + 0x70]
call fcn.1400146a0
mov rdi, qword [rsp + 0x70]
mov word [rdi + r12*2], bx
inc r12
mov qword [rsp + 0x80], r12
jmp 0x140007e97
xor ecx, ecx
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x288]
mov r8d, 0xfffffff4
lea r9, [rsp + 0x90]
call fcn.14001bb94
mov rbp, rdx
test rax, rax
je 0x140008010
mov rdi, qword [rsp + 0x58]
mov rcx, r12
call fcn.140020688
mov r12, rbp
lea rbp, [rsp + 0x3e0]
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x230]
call fcn.140020688
mov rsi, r12
mov r12d, dword [rsp + 0x50]
mov ecx, 1
call fcn.14001bf48
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
call fcn.14001bf60
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
call fcn.14001bf60
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
call fcn.14001bf60
mov rcx, r13
call fcn.14001bf57
mov rcx, rbx
mov rdx, qword [rsp + 0x360]
call fcn.1400150e9
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x170]
mov rdx, r14
call fcn.1400150e9
mov rcx, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x218]
call fcn.1400150e9
mov rcx, rdi
mov rdx, qword [rsp + 0x68]
call fcn.1400150e9
mov edi, 2
cmp byte [rsp + 0x168], 0
jne 0x14000662d
mov rcx, rbx
mov rdx, qword [rsp + 0xf8]
call fcn.1400150e9
jmp 0x14000662d
lea rax, [rsp + 0x400]
movups xmmword [rax + 0x14], xmm6
movups xmmword [rax + 8], xmm6
movups xmmword [rax - 8], xmm6
movups xmmword [rax - 0x18], xmm6
movups xmmword [rax + 0x38], xmm6
movups xmmword [rax + 0x28], xmm6
mov dword [rsp + 0x3e0], 0x68
test rbp, rbp
mov rax, qword [rsp + 0x230]
jne 0x140008052
test r12, r12
jne 0x140008052
test rax, rax
je 0x140008075
mov dword [rsp + 0x41c], 0x100
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], r12
mov qword [rsp + 0x440], rbp
mov rdx, qword [rsp + 0x210]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov eax, dword [rsp + 0x338]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov qword [rsp + 0x1f0], rdx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x1400083bb
mov rsi, qword [rsp + 0x180]
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x3b0], rax
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x3b8], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x3c8], rax
mov rcx, rbp
call fcn.140020688
mov rcx, r12
call fcn.140020688
mov rcx, qword [rsp + 0x230]
call fcn.140020688
mov ecx, 1
call fcn.14001bf48
mov rcx, r13
call fcn.14001bf57
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rsp + 0x360]
call fcn.1400150e9
mov rcx, qword [rsp + 0x170]
mov rdx, r14
call fcn.1400150e9
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x1f0]
call fcn.1400150e9
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
call fcn.1400150e9
cmp byte [rsp + 0x20c], 0
je 0x1400081d8
mov rcx, rbx
mov rdx, qword [rsp + 0xf8]
call fcn.1400150e9
mov r12d, dword [rsp + 0x50]
lea rbp, [rsp + 0x3e0]
jmp 0x14000662d
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x180], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x190], rax
mov rdi, qword [rsp + 0x58]
jmp 0x140008225
mov qword [rsp + 0x180], 2
lea rax, [rsp + 0x188]
movups xmmword [rax], xmm6
lea rcx, [rsp + 0x180]
mov dx, 0x22
call fcn.140019380
lea rax, [r14 + r14]
xor ecx, ecx
mov rbx, qword [rsp + 0x60]
cmp rax, rcx
je 0x14000825d
cmp word [rbx + rcx], 0x22
lea rcx, [rcx + 2]
jne 0x140008241
lea r12, str.Windows_file_names_may_not_contain_____or_end_with___
jmp 0x14000837e
cmp word [rbx + r14*2 - 2], 0x5c
lea r12, str.Windows_file_names_may_not_contain_____or_end_with___
je 0x14000837e
mov qword [rsp + 0x58], rdi
lea rdi, [r14 - 1]
lea rcx, [rbx + r14*2]
add rcx, 0xfffffffffffffffe
mov edx, 1
mov r9d, 1
lea r8, [0x1400278f8]
call fcn.14001667b
test al, al
mov edx, 0
cmovne rdx, rbx
test rdx, rdx
cmove rdx, rbx
cmove rdi, r14
lea r8, [rdx + rdi*2]
lea rdi, [rsp + 0x180]
mov rcx, rdi
call fcn.14001509c
mov rcx, rdi
mov dx, 0x22
call fcn.140019380
imul rbx, rbp, 0x28
mov rbp, qword [rsp + 0x160]
add rbx, rbp
lea rcx, [rsp + 0x180]
cmp rbp, rbx
je 0x1400083d3
mov dx, 0x20
call fcn.140019380
mov dil, byte [rsp + 0x68]
cmp byte [rsp + 0x168], 0
jne 0x140008346
cmp qword [rbp], 0
mov dil, byte [rsp + 0x68]
jne 0x140008346
mov rax, rbp
mov r14, qword [rbp + 8]
mov r15, qword [rbp + 0x18]
xor r12d, r12d
cmp r15, r12
setne dil
je 0x140008346
mov r8b, byte [r14 + r12]
mov edx, 0x16
lea rcx, str._t_____________
call fcn.14001b2c9
inc r12
test al, al
je 0x140008321
lea r14, [rbp + 0x28]
lea rcx, [rsp + 0x180]
mov rdx, rbp
mov r8d, edi
call fcn.14001b89c
mov rbp, r14
test rax, rax
lea r15, [rsp + 0x90]
je 0x1400082de
mov r12, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x180]
mov rdx, qword [rsp + 0x188]
call fcn.1400150e9
lea rbp, [rsp + 0x3e0]
mov rcx, rdi
mov rdx, rsi
call fcn.1400150e9
mov rsi, r12
mov r12d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0xf8]
jmp 0x140007616
call fcn.140014b12
mov rsi, rax
mov rcx, rbp
call fcn.140020688
mov rbp, rsi
jmp 0x140007f26
mov dx, 0x22
call fcn.140019380
mov rax, qword [rsp + 0x180]
mov r12, qword [rsp + 0x188]
test rax, rax
je 0x140008424
mov rcx, qword [rsp + 0x190]
mov dl, 1
mov dword [rsp + 0x20c], edx
mov dword [rsp + 0x168], 0
mov qword [rsp + 0x68], rsi
lea rbp, [rsp + 0x3e0]
mov rbx, qword [rsp + 0x60]
jmp 0x140007328
lea rbp, [rsp + 0x3e0]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
jmp 0x14000839b
mov rcx, rsi
call fcn.140020688
mov rcx, qword [rsp + 0x3b0]
call fcn.140020688
test rdi, rdi
je 0x140008462
mov rcx, qword [rsp + 0x3a0]
call fcn.140020688
cmp qword [rsp + 0x3b8], 0
mov rdi, qword [rsp + 0x3d8]
mov rbx, qword [rsp + 0x200]
mov rsi, qword [rsp + 0x3c8]
je 0x140008492
mov rcx, qword [rsp + 0x3a8]
call fcn.140020688
cmp qword [rsp + 0x3c0], 0
je 0x1400084a5
mov rcx, rsi
call fcn.140020688
lea rcx, [rsp + 0x260]
call fcn.140001842
lea rdx, fcn.14000da7c
xor ecx, ecx
call fcn.1400017a8
mov rsi, qword [rsp + 0x240]
mov rdx, qword [rsp + 0x250]
mov rcx, rsi
call fcn.14000fb5f
mov rdx, qword [rsp + 0x248]
mov rcx, rsi
call fcn.14000fb98
mov rcx, rbx
mov rdx, rdi
call fcn.140008f6b
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x238]
call fcn.14000197b
movaps xmm6, xmmword [rsp + 0x7e0]
add rsp, 0x7f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r14
call fcn.140014778
jmp 0x1400056d9
mov dil, 1
jmp 0x1400054ec
mov rcx, qword [rsp + 0x188]
test rcx, rcx
je case.0x14000577e.0
mov rdx, qword [rsp + 0x190]
jmp 0x14000855a
mov ecx, 8
mov edx, 8
call fcn.140008cfa
ud2
mov rcx, rbp
mov rdx, r15
call fcn.140008f6b
mov rcx, rsi
call fcn.140020688
ud2
call fcn.140014b12
jmp case.0x14000577e.0
mov ecx, 8
mov edx, 0x40
jmp 0x14000855a