Function at 0x140003e70
Capabilities:
Copy file
Create process on windows
Get token membership
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r15, rdx
xor r13d, r13d
mov r14d, 1
mov edx, r14d
lea rcx, [0x140003930]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rdx, [0x140003910]
mov r12d, 2
mov ecx, r12d
call fcn.140017e78
lea rdx, [0x140003910]
mov edi, 0xf
mov ecx, edi
call fcn.140017e78
lea rcx, [fcn.140003820]
call fcn.14000d44c
lea rcx, [fcn.140003820]
call fcn.14000d46c
lea rcx, [0x14003d5c0]
call fcn.140016a48
lea rcx, [0x14003d5d0]
call fcn.140016a48
lea rcx, [0x14003d5d8]
call fcn.140016a48
lea rcx, [0x14003d5e8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
movdqa xmm1, xmmword [0x14003d790]
movdqu xmmword [rbp + 0x148], xmm1
mov byte [rbp + 0x138], r13b
lea r8, [0x14003d428]
lea rdx, [rbp + 0x128]
lea rcx, [rbp - 0x38]
call fcn.14001897c
mov rax, qword [rbp - 0x38]
lea rsi, [0x14003d3ad]
mov rdx, rsi
test rax, rax
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x118], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140003fa1
lea rcx, [rbp + 0x108]
call fcn.14000aac0
nop
mov rcx, qword [rbp - 0x38]
call fcn.140017474
lea rdx, [rbp + 0x108]
lea rcx, [rbp]
call fcn.140001e90
nop
lea r8, [0x14003d4c8]
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x30]
call fcn.14001897c
mov rax, qword [rbp - 0x30]
test rax, rax
cmovne rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
mov r8, rbx
inc r8
cmp byte [rsi + r8], 0
jne 0x140004006
mov rdx, rsi
lea rcx, [rbp + 0x48]
call fcn.14000aac0
nop
mov rcx, qword [rbp - 0x30]
call fcn.140017474
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0xe8]
call fcn.140001e90
mov rsi, rax
lea rax, [rbp + 0x48]
cmp rax, rsi
je 0x1400040a8
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x14000407d
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004078
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005632
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d790]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], rdi
mov byte [rsi], 0
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x1400040e9
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005632
call fcn.14000d1d0
mov r8d, 0x1d
lea rdx, [0x14003d4d0]
lea rcx, [rbp + 0x48]
call fcn.140008d70
xor esi, esi
mov dword [rbp + 0x20], esi
mov dword [rbp - 8], esi
mov word [rbp - 4], 0x500
mov qword [rbp - 0x40], rsi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov r9d, 0x220
lea r8d, [rsi + 0x20]
mov dl, 2
lea rcx, [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000416a
lea r8, [rbp + 0x20]
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x14000416a
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov r13, qword [rbp]
cmp dword [rbp + 0x20], esi
jne 0x140004642
mov rdx, qword [r15]
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
nop
inc rbx
cmp byte [rdx + rbx], sil
jne 0x140004190
mov r8, rbx
lea rcx, [rbp + 0x88]
call fcn.14000aac0
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14000423d
lea ebx, [rax + 4]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x14003d618]
call fcn.14000a4d0
mov rcx, rax
mov edx, ebx
call fcn.140005a20
mov rcx, rax
call fcn.14000a7b0
mov ebx, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14003d518]
call fcn.140016a48
jmp 0x1400045b7
cmp dword [rbp - 0x10], 0x103
jne 0x140004601
lea rdx, [rbp + 0x88]
lea rcx, [rbp - 0x60]
call fcn.140002080
nop
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.1400025f0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400042ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005638
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d780]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], si
lea rdx, [rbp + 0xe8]
lea rcx, [rbp - 0x80]
call fcn.140002220
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
lea r15, [0x14003d650]
cmp rax, 1
jb 0x14000436f
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rsi, rdi
cmp rdx, 8
jb 0x140004302
mov rsi, qword [rdi]
lea r8, [rcx + rcx]
lea rax, [0x14003d652]
cmp rax, rsi
jbe 0x140004331
lea rax, [rsi + r8]
cmp r15, rax
ja 0x140004331
cmp rsi, r15
ja 0x140004326
xor ecx, ecx
mov ebx, ecx
jmp 0x140004334
mov rbx, rsi
sub rbx, r15
sar rbx, 1
jmp 0x140004334
mov rbx, r14
lea rcx, [rsi + 2]
add r8, 2
mov rdx, rsi
call fcn.14000f110
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call fcn.14000f110
lea rcx, [rsi + rbx]
sub r12, rbx
lea rdx, [r15 + 2]
add rdx, rbx
mov r8, r12
call fcn.14000f110
xor esi, esi
jmp 0x140004382
mov qword [rsp + 0x28], r14
mov rdx, r14
mov rcx, rdi
call fcn.14000bec0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.140008ce0
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000442f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000442a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000563e
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d780]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140004482
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000447d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005644
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d780]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], si
lea r8, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae r8, qword [rbp + 0x28]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [0x14003d658]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x14000451c
mov ebx, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x14003d668]
call fcn.14000a4d0
mov rcx, rax
call fcn.14000a7b0
mov ebx, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14003d518]
call fcn.140016a48
jmp 0x14000451f
mov r14d, esi
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x14000455f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000455a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000564a
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d780]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], si
mov rdx, qword [rbp + 0x100]
cmp rdx, 8
jb 0x1400045b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005650
call fcn.14000d1d0
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x1400045f8
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005656
call fcn.14000d1d0
mov r15, qword [rbp + 0x18]
jmp 0x140005501
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x140004642
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000463d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000565c
call fcn.14000d1d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x10], rax
movabs rax, 0x7fffffffffffffff
mov r15, rax
mov r14, qword [rbp + 0x10]
sub r15, r14
cmp r15, 0xd
jb 0x140005662
lea r13, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r13, qword [rbp]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r12, [r14 + 0xd]
mov rbx, rdi
lea rsi, [rsp + 0x60]
movabs rcx, 0x8000000000000000
mov edx, 0x16
cmp r12, rdi
jbe 0x140004716
mov rbx, r12
or rbx, 0xf
cmp rbx, rax
jbe 0x1400046dd
mov rbx, rax
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x140005668
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004711
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004700
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400055fc
jmp 0x1400046be
test rcx, rcx
je 0x14000470c
call fcn.14000d1d8
jmp 0x14000470e
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rbx
mov r8, r14
mov rdx, r13
mov rcx, rsi
call fcn.14000f110
movsd xmm0, qword [0x14003d430]
movsd qword [rsi + r14], xmm0
mov eax, dword [0x14003d438]
mov dword [rsi + r14 + 8], eax
movzx eax, byte [0x14003d43c]
mov byte [rsi + r14 + 0xc], al
mov byte [rsi + r12], 0
lea r8, [rsp + 0x60]
mov edx, 0x83
mov rcx, qword [rbp - 0x10]
call fcn.140003950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400047a9
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005668
call fcn.14000d1d0
cmp r15, 0x11
jb 0x14000566e
lea r13, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r13, qword [rbp]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r12, [r14 + 0x11]
mov rbx, rdi
lea rsi, [rsp + 0x60]
cmp r12, rdi
jbe 0x14000486c
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x14000482d
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x140005674
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004867
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004856
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005602
jmp 0x14000480e
test rcx, rcx
je 0x140004862
call fcn.14000d1d8
jmp 0x140004864
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rbx
mov r8, r14
mov rdx, r13
mov rcx, rsi
call fcn.14000f110
movups xmm0, xmmword [str._vcruntime140.dll]
movups xmmword [r14 + rsi], xmm0
movzx eax, byte [0x14003d450]
mov byte [r14 + rsi + 0x10], al
mov byte [rsi + r12], 0
lea r8, [rsp + 0x60]
mov edx, 0x84
mov rcx, qword [rbp - 0x10]
call fcn.140003950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400048f2
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005674
call fcn.14000d1d0
cmp r15, 0x13
jb 0x14000567a
lea r13, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r13, qword [rbp]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r12, [r14 + 0x13]
mov rbx, rdi
lea rsi, [rsp + 0x60]
cmp r12, rdi
jbe 0x1400049b5
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140004976
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x140005680
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400049b0
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000499f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005608
jmp 0x140004957
test rcx, rcx
je 0x1400049ab
call fcn.14000d1d8
jmp 0x1400049ad
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rbx
mov r8, r14
mov rdx, r13
mov rcx, rsi
call fcn.14000f110
movups xmm0, xmmword [str._vcruntime140_1.dll]
movups xmmword [r14 + rsi], xmm0
movzx eax, word [0x14003d468]
mov word [r14 + rsi + 0x10], ax
movzx eax, byte [0x14003d46a]
mov byte [r14 + rsi + 0x12], al
mov byte [rsi + r12], 0
lea r8, [rsp + 0x60]
mov edx, 0x85
mov rcx, qword [rbp - 0x10]
call fcn.140003950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140004a48
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005680
call fcn.14000d1d0
lea r13, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r13, qword [rbp]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r12, [r14 + 9]
mov rbx, rdi
lea rsi, [rsp + 0x60]
cmp r12, rdi
jbe 0x140004b01
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140004ac2
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x140005686
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004afc
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004aeb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000560e
jmp 0x140004aa3
test rcx, rcx
je 0x140004af7
call fcn.14000d1d8
jmp 0x140004af9
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rbx
mov r8, r14
mov rdx, r13
mov rcx, rsi
call fcn.14000f110
movsd xmm0, qword [0x14003d470]
movsd qword [r14 + rsi], xmm0
movzx eax, byte [0x14003d478]
mov byte [r14 + rsi + 8], al
mov byte [rsi + r12], 0
lea r8, [rsp + 0x60]
mov edx, 0x7e
mov rcx, qword [rbp - 0x10]
call fcn.140003950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140004b89
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005686
call fcn.14000d1d0
cmp r15, 0x14
jb 0x14000568c
lea r12, [rbp]
cmp qword [rbp + 0x18], 0x10
mov r13, qword [rbp]
cmovae r12, r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r15, [r14 + 0x14]
mov rbx, rdi
lea rsi, [rsp + 0x60]
cmp r15, rdi
jbe 0x140004c4f
mov rbx, r15
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140004c10
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x140005692
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004c4a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004c39
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005614
jmp 0x140004bf1
test rcx, rcx
je 0x140004c45
call fcn.14000d1d8
jmp 0x140004c47
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
mov r8, r14
mov rdx, r12
mov rcx, rsi
call fcn.14000f110
movups xmm0, xmmword [0x14003d480]
movups xmmword [r14 + rsi], xmm0
mov eax, dword [0x14003d490]
mov dword [r14 + rsi + 0x10], eax
mov byte [rsi + r15], 0
lea r8, [rsp + 0x60]
mov edx, 4
mov rcx, qword [rbp - 0x10]
call fcn.140003950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140004cd4
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ccf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005692
call fcn.14000d1d0
lea r12, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r12, r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r15, [r14 + 0xa]
mov rbx, rdi
lea rsi, [rsp + 0x60]
cmp r15, rdi
jbe 0x140004d8c
mov rbx, r15
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140004d4d
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x140005698
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004d87
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004d76
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000561a
jmp 0x140004d2e
test rcx, rcx
je 0x140004d82
call fcn.14000d1d8
jmp 0x140004d84
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rbx
mov r8, r14
mov rdx, r12
mov rcx, rsi
call fcn.14000f110
movsd xmm0, qword [0x14003d498]
movsd qword [rsi + r14], xmm0
movzx eax, word [0x14003d4a0]
mov word [rsi + r14 + 8], ax
mov byte [rsi + r15], 0
lea r8, [rsp + 0x60]
mov edx, 0x7a
mov rcx, qword [rbp - 0x10]
call fcn.140003950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140004e15
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005698
call fcn.14000d1d0
lea r13, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r13, qword [rbp]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r12, [r14 + 0xe]
mov rbx, rdi
lea rsi, [rsp + 0x60]
cmp r12, rdi
jbe 0x140004ece
mov rbx, r12
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140004e8f
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x14000569e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140004ec9
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140004eb8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005620
jmp 0x140004e70
test rcx, rcx
je 0x140004ec4
call fcn.14000d1d8
jmp 0x140004ec6
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rbx
mov r8, r14
mov rdx, r13
mov rcx, rsi
call fcn.14000f110
movsd xmm0, qword [str.Automacao.exe]
movsd qword [rsi + r14], xmm0
mov eax, dword [0x14003d4b0]
mov dword [rsi + r14 + 8], eax
movzx eax, word [0x14003d4b4]
mov word [rsi + r14 + 0xc], ax
mov byte [rsi + r12], 0
lea r8, [rsp + 0x60]
mov edx, 0x7f
mov rcx, qword [rbp - 0x10]
call fcn.140003950
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140004f62
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000569e
call fcn.14000d1d0
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0x1d0]
call fcn.14000ef84
test rax, rax
je 0x140004f92
xor ecx, ecx
mov word [rax], cx
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x68]
call fcn.140007000
nop
lea rdx, [0x14003d698]
lea rcx, [rbp + 0x68]
call fcn.140008ce0
lea r13, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r13, qword [rbp]
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov rbx, rdi
lea rsi, [rbp + 0x28]
cmp r15, rdi
jbe 0x140005064
mov rbx, r15
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140005026
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x1400056a4
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140005060
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000504f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005626
jmp 0x140005007
test rcx, rcx
je 0x14000505b
call fcn.14000d1d8
jmp 0x14000505d
xor eax, eax
mov rsi, rax
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], rbx
mov r8, r14
mov rdx, r13
mov rcx, rsi
call fcn.14000f110
movsd xmm0, qword [0x14003d4b8]
movsd qword [rsi + r14], xmm0
movzx eax, word [0x14003d4c0]
mov word [rsi + r14 + 8], ax
mov byte [rsi + r15], 0
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xc8]
call fcn.140002080
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x1400050e6
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056aa
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d790]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], 8
cmovae rcx, qword [rbp + 0x68]
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rdx, qword [rbp + 0xc8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rsi, [rbp]
mov r15, qword [rbp + 0x18]
cmp r15, 0x10
mov r13, qword [rbp]
cmovae rsi, r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rbx, [rsp + 0x60]
cmp r12, 0xf
jbe 0x1400051e1
mov rdi, r12
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jbe 0x1400051a2
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000d1d8
test rax, rax
je 0x1400056b0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400051dc
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400051cb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000562c
jmp 0x140005183
test rcx, rcx
je 0x1400051d7
call fcn.14000d1d8
jmp 0x1400051d9
xor eax, eax
mov rbx, rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rdi
mov r8, r14
mov rdx, rsi
mov rcx, rbx
call fcn.14000f110
movsd xmm0, qword [str.Automacao.exe]
movsd qword [rbx + r14], xmm0
mov eax, dword [0x14003d4b0]
mov dword [rbx + r14 + 8], eax
movzx eax, word [0x14003d4b4]
mov word [rbx + r14 + 0xc], ax
mov byte [rbx + r12], 0
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140002080
nop
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400025f0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140005283
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000527e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056b6
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d780]
movdqu xmmword [rbp - 0x70], xmm0
xor edi, edi
mov word [rbp - 0x80], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400052d3
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056bc
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d790]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov dword [rbp + 0x160], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
movups xmmword [rbp + 0x178], xmm0
movups xmmword [rbp + 0x188], xmm0
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
lea rcx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 8
cmovae rcx, qword [rbp + 0xa8]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140005392
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400053e7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.ERRO:_Ao_criar_processo_filho.
call fcn.14000a4d0
mov rcx, rax
call fcn.14000a7b0
mov ebx, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x14003d518]
call fcn.140016a48
lea rcx, [rbp + 0x48]
call fcn.1400027a0
mov r14d, edi
mov rdx, qword [rbp + 0xc0]
cmp rdx, 8
jb 0x140005439
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005434
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056c2
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d780]
movdqu xmmword [rbp + 0xb8], xmm0
mov word [rbp + 0xa8], di
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x140005496
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005491
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056c8
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d780]
movdqu xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xc8], di
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x1400054f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056ce
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d780]
movdqu xmmword [rbp + 0x78], xmm0
mov word [rbp + 0x68], di
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x14000553c
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005537
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056d4
call fcn.14000d1d0
movdqa xmm0, xmmword [0x14003d790]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
cmp r15, 0x10
jb 0x140005585
lea rdx, [r15 + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000557c
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400056da
mov rcx, r13
call fcn.14000d1d0
nop
mov rdx, qword [rbp + 0x120]
cmp rdx, 0x10
jb 0x1400055c3
inc rdx
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400055f6
call fcn.14000d1d0
nop
mov eax, r14d
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14000d1b0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140018784
nop
call fcn.1400012d0
int3
call fcn.1400012d0
int3
call fcn.1400012d0
int3
call fcn.1400012d0
int3
call fcn.1400012d0
int3
call fcn.1400012d0
int3
call fcn.1400012d0
nop
call fcn.1400012d0
nop
call fcn.1400012d0
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
int3
call fcn.140018784
int3
call fcn.140001370
int3
call fcn.140018784
int3
call fcn.140001370
int3
call fcn.140018784
int3
call fcn.140001370
int3
call fcn.140018784
int3
call fcn.140018784
int3
call fcn.140001370
int3
call fcn.140018784
int3
call fcn.140018784
int3
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
int3
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
nop
call fcn.140018784
int3