Function at 0x1400d60b0
Capabilities:
Create process on windows
Encode data using base64
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x678
movdqa xmmword [rsp + 0x660], xmm6
mov rbx, rcx
mov dword [rsp + 0x200], 3
movzx eax, byte [rdx + 0x68]
test al, al
sete cl
mov qword [rsp + 0x140], rdx
mov r8, qword [rdx + 0x60]
test r8, r8
sete dl
and dl, cl
mov byte [rsp + 0x198], dl
je 0x1400d6107
xor esi, esi
jmp 0x1400d6f8c
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x1c8], 0
mov qword [rsp + 0x1d8], 0
test al, al
je 0x1400d6145
mov rax, qword [rsp + 0x140]
mov rax, qword [rax + 0x50]
test rax, rax
jne 0x1400d639a
jmp 0x1400d6da9
mov qword [rsp + 0x60], r8
call sub.kernel32.dll_GetEnvironmentStringsW
test rax, rax
je 0x1400daa6e
mov qword [rsp + 0x58], rax
cmp word [rax], 0
je 0x1400d6376
lea rbx, [rsp + 0x240]
lea r12, [rsp + 0x90]
lea r15, [rsp + 0x220]
mov rsi, qword [rsp + 0x58]
jmp 0x1400d619a
cmp word [rsi], 0
je 0x1400d6376
mov rdi, rsi
mov rcx, 0xfffffffffffffffe
xor edx, edx
nop word cs:[rax + rax]
mov rbp, rdx
mov rax, rcx
inc rdx
add rcx, 2
cmp word [rdi + rbp*2], 0
jne 0x1400d61b0
lea rsi, [rdi + rdx*2]
cmp rbp, 1
je 0x1400d6190
test rbp, rbp
je 0x1400dac66
xor r14d, r14d
nop word [rax + rax]
cmp word [rdi + r14*2 + 2], 0x3d
je 0x1400d6200
inc r14
add rax, 0xfffffffffffffffe
jne 0x1400d61e0
jmp 0x1400d6190
cmp r14, rbp
jae 0x1400dac66
lea r8, [r14 + 1]
mov rcx, r12
mov rdx, rdi
call fcn.1400e2640
add r14, 2
sub rbp, r14
jb 0x1400dac66
lea rdx, [rdi + r14*2]
mov rcx, rbx
mov r8, rbp
call fcn.1400e2640
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x230], xmm1
movaps xmmword [rsp + 0x220], xmm0
mov rdi, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x230]
movzx r13d, byte [rsp + 0x238]
movups xmm0, xmmword [rbx - 7]
movups xmm1, xmmword [rbx + 9]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xe0], xmm1
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0xef], rax
cmp r13b, 2
je 0x1400d6376
lea rax, [rsp + 0xd7]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x160], xmm1
movdqa xmmword [rsp + 0x150], xmm0
lea rax, [rdi + rbp]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rax
mov word [rsp + 0xa0], 0
mov rcx, r15
mov rdx, r12
call fcn.1400dfb50
mov qword [rsp + 0x238], rdi
mov qword [rsp + 0x240], r14
mov qword [rsp + 0x248], rbp
mov byte [rsp + 0x250], r13b
mov eax, dword [rsp + 0xd0]
mov ecx, dword [rsp + 0xd3]
mov dword [rbx + 0x14], ecx
mov dword [rbx + 0x11], eax
mov rcx, r12
lea rdx, [rsp + 0x1c8]
mov r8, r15
lea r9, [rsp + 0x150]
call fcn.1400d2890
cmp byte [rsp + 0xa8], 2
je 0x1400d6190
cmp qword [rsp + 0x98], 0
je 0x1400d6190
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
jmp 0x1400d6190
mov rcx, qword [rsp + 0x58]
call sub.kernel32.dll_FreeEnvironmentStringsW
mov r8, qword [rsp + 0x60]
mov rax, qword [rsp + 0x140]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x1400d6da9
test r8, r8
je 0x1400d6da9
mov rcx, qword [rsp + 0x140]
mov r9, qword [rcx + 0x58]
xor ebx, ebx
jmp 0x1400d63de
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x78]
call fcn.140104a84
mov eax, 0
mov r8, qword [rsp + 0x60]
dec r8
mov r9, qword [rsp + 0x58]
je 0x1400d6da9
test rbx, rbx
jne 0x1400d6473
test r9, r9
je 0x1400d6414
mov rdx, r9
and rdx, 7
je 0x1400d6419
mov rcx, r9
and rcx, 0xfffffffffffffff8
mov rbx, rax
nop
mov rbx, qword [rbx + 0x3d8]
dec rdx
jne 0x1400d6400
cmp r9, 8
jae 0x1400d6430
jmp 0x1400d646e
mov rbx, rax
jmp 0x1400d646e
mov rbx, rax
mov rcx, r9
cmp r9, 8
jb 0x1400d646e
nop word cs:[rax + rax]
mov rax, qword [rbx + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rbx, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1400d6430
xor r9d, r9d
xor eax, eax
movzx ecx, word [rbx + 0x3d2]
mov rbp, rbx
mov r14, r9
cmp r9, rcx
jb 0x1400d64b8
nop word cs:[rax + rax]
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400dac66
inc rax
movzx r14d, word [rbp + 0x3d0]
mov rbp, rcx
cmp r14w, word [rcx + 0x3d2]
jae 0x1400d6490
test rax, rax
mov qword [rsp + 0x60], r8
je 0x1400d6560
mov rbx, qword [rbp + r14*8 + 0x3e0]
mov rcx, rax
dec rcx
je 0x1400d654e
mov rdx, rcx
and rdx, 7
je 0x1400d6505
mov rcx, rdx
nop word cs:[rax + rax]
mov rbx, qword [rbx + 0x3d8]
dec rcx
jne 0x1400d64f0
not rdx
add rdx, rax
mov rcx, rdx
add rax, 0xfffffffffffffffe
cmp rax, 7
jb 0x1400d654e
nop
mov rax, qword [rbx + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rbx, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1400d6510
xor r13d, r13d
jmp 0x1400d6567
lea r13, [r14 + 1]
mov rbx, rbp
imul rax, r14, 0x38
lea r15, [rax + rbp]
add r15, 0x168
shl r14, 5
cmp byte [rbp + r14 + 0x18], 2
mov qword [rsp + 0x58], r13
jne 0x1400d6680
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400d63c6
mov rax, qword [rsp + 0x1d0]
mov r12, qword [r15]
mov edi, dword [r15 + 0x10]
lea ecx, [rax + 7]
mov dword [rsp + 0x138], ecx
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x78], rax
mov r15, qword [rsp + 0x68]
lea rcx, [r15 + 0x168]
movzx r13d, word [r15 + 0x3d2]
imul rbp, r13, 0x38
mov rsi, 0xffffffffffffffff
nop word cs:[rax + rax]
test rbp, rbp
je 0x1400d6640
lea r14, [rcx + 0x38]
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x10]
mov dword [rsp + 0x20], 1
mov rcx, r12
mov edx, edi
call sub.kernel32.dll_CompareStringOrdinal
inc rsi
add rbp, 0xffffffffffffffc8
mov rcx, r14
cmp eax, 3
je 0x1400d65f0
cmp eax, 1
jne 0x1400d66e0
mov rax, qword [rsp + 0x78]
test rax, rax
jne 0x1400d6651
jmp 0x1400d63c6
mov rsi, r13
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400d63c6
mov r15, qword [r15 + rsi*8 + 0x3d8]
dec rax
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x138]
add al, 7
mov dword [rsp + 0x138], eax
jmp 0x1400d65cc
mov rdi, qword [r15 + 0x18]
mov rsi, qword [r15 + 0x28]
test rsi, rsi
je 0x1400d68dc
js 0x1400dac66
movzx eax, byte [0x1401ee110]
mov rax, qword [0x1401ee100]
test rax, rax
jne 0x1400d66bf
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov qword [0x1401ee100], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapAlloc
mov r12, rax
test rax, rax
jne 0x1400d68e2
jmp 0x1400dac66
cmp eax, 2
mov r9, qword [rsp + 0x78]
jne 0x1400daa6e
mov byte [rsp + 0x77], 0
test r9, r9
je 0x1400d6ab0
mov rax, qword [r15 + rsi*8 + 0x3d8]
mov rcx, r9
dec rcx
je 0x1400d67de
test cl, 7
je 0x1400d6756
movzx ecx, byte [rsp + 0x138]
and ecx, 7
neg rcx
mov edx, 1
nop dword [rax + rax]
movzx r8d, word [rax + 0x3d2]
mov rax, qword [rax + r8*8 + 0x3d8]
lea r8, [rcx + rdx]
inc r8
inc rdx
cmp r8, 1
jne 0x1400d6730
mov rcx, r9
sub rcx, rdx
add r9, 0xfffffffffffffffe
cmp r9, 7
jb 0x1400d67de
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1400d6760
movzx ecx, word [rax + 0x3d2]
dec rcx
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], 0
mov qword [rsp + 0x1f0], rcx
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0x1e0]
lea r8, [rsp + 0x77]
call fcn.1400cfd10
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x220]
movups xmm1, xmmword [rsp + 0x230]
movdqu xmm2, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0xb0], xmm2
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
lea rax, [rsp + 0x258]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmmword [rsp + 0x180], xmm1
mov r8, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x288]
movzx r9d, word [r8 + 0x3d2]
mov rax, r8
cmp rdx, r9
jb 0x1400d6af3
nop
mov rax, qword [r8 + 0x160]
test rax, rax
je 0x1400d6aeb
inc rcx
movzx edx, word [r8 + 0x3d0]
mov r8, rax
cmp dx, word [rax + 0x3d2]
jae 0x1400d68b0
jmp 0x1400d6af3
mov r12d, 1
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
movzx ecx, byte [r15 + 0x30]
mov rdx, qword [r15]
mov r15, qword [r15 + 0x10]
mov r13d, 2
test r15, r15
mov byte [rsp + 0x78], cl
je 0x1400d6980
mov rax, r15
shr rax, 0x3e
jne 0x1400dac66
mov rdi, r15
add rdi, r15
je 0x1400d6980
movzx eax, byte [0x1401ee110]
mov rax, qword [0x1401ee100]
test rax, rax
mov qword [rsp + 0x138], rdx
jne 0x1400d6950
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov qword [0x1401ee100], rax
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
mov r13, rax
test rax, rax
mov rdx, qword [rsp + 0x138]
jne 0x1400d6982
jmp 0x1400dac66
xor edi, edi
add rbp, r14
mov rcx, r13
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x228], r15
mov qword [rsp + 0x230], r15
mov qword [rsp + 0x238], r12
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], rsi
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x250], al
mov rdi, qword [rbp]
mov rsi, qword [rbp + 0x10]
test rsi, rsi
je 0x1400d6a21
js 0x1400dac66
movzx eax, byte [0x1401ee110]
mov rax, qword [0x1401ee100]
test rax, rax
jne 0x1400d6a07
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov qword [0x1401ee100], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapAlloc
mov r15, rax
test rax, rax
jne 0x1400d6a27
jmp 0x1400dac66
mov r15d, 1
mov rcx, r15
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], rsi
movzx eax, byte [rbp + 0x18]
mov byte [rsp + 0xe8], al
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x1c8]
lea r8, [rsp + 0x220]
lea r9, [rsp + 0xd0]
call fcn.1400d2890
cmp byte [rsp + 0xa8], 2
je 0x1400d63c6
cmp qword [rsp + 0x98], 0
je 0x1400d63c6
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1401ee100]
xor edx, edx
jmp 0x1400d63c1
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], rsi
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0xd0]
lea r8, [rsp + 0x77]
call fcn.1400cfd10
jmp 0x1400d6cbe
mov rdx, rcx
mov rcx, r8
xor eax, eax
imul r8, rdx, 0x38
mov r9, rdx
shl r9, 5
mov r10, qword [rax + r8 + 0x198]
mov qword [rsp + 0x100], r10
movups xmm0, xmmword [rax + r8 + 0x168]
movups xmm1, xmmword [rax + r8 + 0x178]
movups xmm2, xmmword [rax + r8 + 0x188]
movaps xmmword [rsp + 0xf0], xmm2
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xd0], xmm0
mov r10, qword [rsp + 0xc0]
mov qword [rax + r8 + 0x198], r10
movaps xmm0, xmmword [rsp + 0x90]
movaps xmm1, xmmword [rsp + 0xa0]
movdqa xmm2, xmmword [rsp + 0xb0]
movdqu xmmword [rax + r8 + 0x188], xmm2
movups xmmword [rax + r8 + 0x178], xmm1
movups xmmword [rax + r8 + 0x168], xmm0
movups xmm0, xmmword [rax + r9]
movups xmm1, xmmword [rax + r9 + 0x10]
lea r8, [rsp + 0x108]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
movdqa xmm0, xmmword [rsp + 0x170]
movdqa xmm1, xmmword [rsp + 0x180]
movdqu xmmword [rax + r9], xmm0
movdqu xmmword [rax + r9 + 0x10], xmm1
test rcx, rcx
je 0x1400d6c4e
mov rax, qword [rax + rdx*8 + 0x3e0]
mov rdx, rcx
dec rdx
je 0x1400d6c4e
mov r8, rdx
and r8, 7
je 0x1400d6c05
mov rdx, r8
nop word cs:[rax + rax]
mov rax, qword [rax + 0x3d8]
dec rdx
jne 0x1400d6bf0
not r8
add r8, rcx
mov rdx, r8
add rcx, 0xfffffffffffffffe
cmp rcx, 7
jb 0x1400d6c4e
nop
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
add rdx, 0xfffffffffffffff8
jne 0x1400d6c10
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x270], rcx
movaps xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x260], xmm0
movdqa xmm0, xmmword [rsp + 0xd0]
movdqa xmm1, xmmword [rsp + 0xe0]
movdqa xmm2, xmmword [rsp + 0xf0]
movdqa xmm3, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x250], xmm3
movdqa xmmword [rsp + 0x240], xmm2
movdqa xmmword [rsp + 0x230], xmm1
movdqa xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x278], rax
mov r12, qword [rsp + 0x220]
mov r14, qword [rsp + 0x228]
mov r15, qword [rsp + 0x238]
mov r13, qword [rsp + 0x240]
movzx edi, byte [rsp + 0x250]
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x78], rax
dec qword [rsp + 0x1d8]
mov rsi, qword [rsp + 0x260]
movzx ebp, byte [rsp + 0x270]
cmp byte [rsp + 0x77], 0
mov rcx, qword [rsp + 0x148]
je 0x1400d6d5b
test rcx, rcx
je 0x1400dac66
mov r8, qword [rsp + 0x68]
mov rax, qword [r8 + 0x3d8]
mov qword [rsp + 0x1c8], rax
dec rcx
mov qword [rsp + 0x1d0], rcx
mov qword [rax + 0x160], 0
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
cmp dil, 2
je 0x1400d63c6
test r13, r13
je 0x1400d6d7b
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, r15
call fcn.140104a84
test r14, r14
je 0x1400d6d91
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, r12
call fcn.140104a84
cmp bpl, 2
je 0x1400d63c6
test rsi, rsi
jne 0x1400d63b3
jmp 0x1400d63c6
mov r14, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0x1d0]
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x138], rax
movzx eax, byte [0x1401ee110]
mov rcx, qword [0x1401ee100]
test rcx, rcx
jne 0x1400d6df4
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov rcx, rax
mov qword [0x1401ee100], rax
mov r8d, 4
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400dac66
mov rsi, rax
mov dword [rax], 0x48544150
add rax, 4
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rax
mov word [rsp + 0xe0], 0
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0xd0]
call fcn.1400dfb50
mov qword [rsp + 0x238], rsi
mov qword [rsp + 0x240], 4
mov qword [rsp + 0x248], 4
mov byte [rsp + 0x250], 0
test r14, r14
mov qword [rsp + 0x60], r14
je 0x1400d6f46
mov qword [rsp + 0x68], rsi
mov rdi, qword [rsp + 0x220]
mov ebx, dword [rsp + 0x230]
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x78], r15
lea rcx, [r14 + 0x168]
movzx ebp, word [r14 + 0x3d2]
imul r12, rbp, 0x38
mov r13, 0xffffffffffffffff
nop word cs:[rax + rax]
test r12, r12
je 0x1400d6f00
lea rsi, [rcx + 0x38]
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x10]
mov dword [rsp + 0x20], 1
mov rcx, rdi
mov edx, ebx
call sub.kernel32.dll_CompareStringOrdinal
inc r13
add r12, 0xffffffffffffffc8
mov rcx, rsi
cmp eax, 3
je 0x1400d6ec0
cmp eax, 1
jne 0x1400d6f17
jmp 0x1400d6f03
mov r13, rbp
sub r15, 1
jb 0x1400d7be0
mov r14, qword [r14 + r13*8 + 0x3d8]
jmp 0x1400d6e9c
cmp eax, 2
jne 0x1400daa6e
shl r13, 5
mov rax, qword [r14 + r13]
mov qword [rsp + 0x58], rax
mov rdi, qword [r14 + r13 + 0x10]
mov rbx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
jmp 0x1400d6f55
xor eax, eax
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x80]
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
cmp qword [rsp + 0x228], 0
je 0x1400d6f87
mov r8, qword [rsp + 0x220]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov rsi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x140]
mov r14, qword [rax + 0x40]
lea rbp, str._e_
test r14, r14
je 0x1400d6fec
mov r12, qword [rax + 0x30]
cmp r14, 4
jae 0x1400d6fc6
lea rax, [0x1400e2af0]
movzx ecx, byte [r14 + r12 - 1]
call rax
test al, al
jne 0x1400d6fec
jmp 0x1400d7057
cmp dword [r12], 0x5c3f5c5c
lea rcx, [0x1400e2b00]
lea rax, [0x1400e2af0]
cmove rax, rcx
movzx ecx, byte [r14 + r12 - 1]
call rax
test al, al
je 0x1400d7057
mov rdi, qword [rsp + 0x60]
movq xmm6, rbp
cmp byte [rsp + 0x198], 0
jne 0x1400d7192
test rdi, rdi
je 0x1400d7169
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x230], rdi
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x258], r15
mov eax, 1
mov rcx, qword [rsp + 0x138]
jmp 0x1400d716d
cmp r14, 3
mov qword [rsp + 0x78], r15
jbe 0x1400d7598
movzx eax, byte [r14 + r12 - 4]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x2e
jne 0x1400d7602
movzx eax, byte [r12 + r14 - 3]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
mov al, 1
cmp cl, 0x65
jne 0x1400d70d1
movzx ecx, byte [r12 + r14 - 2]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x1400d70d1
movzx eax, byte [r12 + r14 - 1]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x65
setne al
xor ecx, ecx
nop word cs:[rax + rax]
cmp r14, rcx
je 0x1400d78d8
movzx edx, byte [r12 + rcx]
cmp edx, 0x2f
je 0x1400d70fb
inc rcx
cmp edx, 0x5c
jne 0x1400d70e0
test al, al
jne 0x1400d762b
lea rcx, [rsp + 0xd0]
mov rdx, r12
mov r8, r14
call fcn.1400d1f70
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xd8]
test rcx, rcx
je 0x1400d8440
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0x220], rcx
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], rdx
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x220]
call fcn.1400df460
jmp 0x1400d8454
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x260], rcx
lea rcx, [rsp + 0x220]
call fcn.1400d3b90
cmp dword [rsp + 0x200], 3
ja 0x1400d71a6
movq rdi, xmm6
jmp 0x1400d841a
mov r14d, 2
mov rcx, qword [rsp + 0x208]
call sub.kernel32.dll_CloseHandle
movq rdi, xmm6
cmp r14, 2
je 0x1400d841a
test r14, r14
je 0x1400d71d5
mov rcx, r12
call sub.kernel32.dll_CloseHandle
mov qword [rsp + 0x170], 1
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
mov qword [rsp + 0x90], 1
movdqu xmmword [rsp + 0x98], xmm0
test r13, r13
je 0x1400d75bd
test rbp, rbp
je 0x1400d7b27
mov rbp, rbx
xor ecx, ecx
mov edx, 1
mov r8d, 1
xor r9d, r9d
call sub.kernel32.dll_CreateEventW
test rax, rax
je 0x1400dac51
mov rbx, rax
movzx eax, byte [0x1401ee110]
mov rcx, qword [0x1401ee100]
test rcx, rcx
jne 0x1400d7264
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov rcx, rax
mov qword [0x1401ee100], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400dac66
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], rbx
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xf8], rbx
xor ecx, ecx
mov edx, 1
mov r8d, 1
xor r9d, r9d
call sub.kernel32.dll_CreateEventW
test rax, rax
je 0x1400d7b68
mov r14, rax
movzx eax, byte [0x1401ee110]
mov rcx, qword [0x1401ee100]
test rcx, rcx
jne 0x1400d730e
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov rcx, rax
mov qword [0x1401ee100], rax
mov r8d, 0x20
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400dac66
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], r14
mov qword [rsp + 0x220], 0
mov qword [rsp + 0x230], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], r14
lea rsi, [rsp + 0x1e0]
lea rbx, [rsp + 0x150]
lea r14, [rsp + 0x220]
movabs r13, 0x6d00000000
lea r15, [rsp + 0xd0]
nop word cs:[rax + rax]
mov ecx, 2
mov rdx, rsi
xor r8d, r8d
mov r9d, 0xffffffff
call sub.kernel32.dll_WaitForMultipleObjects
cmp eax, 1
je 0x1400d7430
test eax, eax
jne 0x1400d8211
mov rax, qword [rsp + 0xd0]
test rax, rax
je 0x1400d74ad
cmp eax, 1
jne 0x1400d7484
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xf0]
mov dword [rsp + 0x150], 0
mov r8, rbx
mov r9d, 1
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
je 0x1400d752e
mov eax, dword [rsp + 0x150]
jmp 0x1400d748c
mov rax, qword [rsp + 0x220]
test rax, rax
je 0x1400d7502
cmp eax, 1
jne 0x1400d74d9
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x240]
mov dword [rsp + 0x150], 0
mov r8, rbx
mov r9d, 1
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
je 0x1400d755c
mov eax, dword [rsp + 0x150]
jmp 0x1400d74e1
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xd0], 0
mov rcx, qword [rsp + 0xe8]
add qword [rcx + 0x10], rax
test rax, rax
je 0x1400d7be5
mov rcx, rbx
mov rdx, r15
call fcn.1400dc480
cmp byte [rsp + 0x150], 0
jne 0x1400d7d90
cmp byte [rsp + 0x151], 0
jne 0x1400d73b0
jmp 0x1400d7be5
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x220], 0
mov rcx, qword [rsp + 0x238]
add qword [rcx + 0x10], rax
test rax, rax
je 0x1400d7cc0
mov rcx, rbx
mov rdx, r14
call fcn.1400dc480
cmp byte [rsp + 0x150], 0
jne 0x1400d7d90
cmp byte [rsp + 0x151], 0
jne 0x1400d73b0
jmp 0x1400d7cc0
call sub.kernel32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
cmp r12, r13
je 0x1400d758a
mov eax, 0
movabs rcx, 0x2600000000
cmp r12, rcx
je 0x1400d748c
jmp 0x1400d821d
call sub.kernel32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
cmp r12, r13
je 0x1400d7591
mov eax, 0
movabs rcx, 0x2600000000
cmp r12, rcx
je 0x1400d74e1
jmp 0x1400d821d
xor eax, eax
jmp 0x1400d748c
xor eax, eax
jmp 0x1400d74e1
xor eax, eax
nop word [rax + rax]
cmp r14, rax
je 0x1400d78d8
movzx ecx, byte [r12 + rax]
cmp ecx, 0x2f
je 0x1400d762b
inc rax
cmp ecx, 0x5c
jne 0x1400d75a0
jmp 0x1400d762b
test rbp, rbp
je 0x1400d82a7
mov qword [rsp + 0x220], rsi
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x220]
lea r8, [rsp + 0x90]
call fcn.1400de490
cmp qword [rsp + 0xd0], 0
jne 0x1400dac66
mov rcx, rsi
jmp 0x1400d7b5e
xor eax, eax
nop word cs:[rax + rax]
cmp r14, rax
je 0x1400d78d8
movzx ecx, byte [r12 + rax]
cmp ecx, 0x2f
je 0x1400d762b
inc rax
cmp ecx, 0x5c
jne 0x1400d7610
test r14, r14
js 0x1400dac66
movzx eax, byte [0x1401ee110]
mov rcx, qword [0x1401ee100]
test rcx, rcx
jne 0x1400d765f
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov rcx, rax
mov qword [0x1401ee100], rax
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400dac66
mov rsi, rax
mov rcx, rax
mov rdx, r12
mov r8, r14
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], r14
mov byte [rsp + 0xe8], 0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x230], rax
movzx eax, byte [rsp + 0xe8]
mov byte [rsp + 0x238], al
mov eax, dword [rsp + 0xe9]
mov dword [rsp + 0x239], eax
movzx eax, word [rsp + 0xed]
mov word [rsp + 0x23d], ax
movzx eax, byte [rsp + 0xef]
mov byte [rsp + 0x23f], al
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x228], rax
lea rdx, [0x1401b5e33]
lea rcx, [rsp + 0x220]
mov r8d, 4
call fcn.1400df530
movdqa xmm0, xmmword [rsp + 0x220]
movdqa xmm1, xmmword [rsp + 0x230]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmmword [rsp + 0xd0], xmm0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0x90]
mov rdx, rsi
call fcn.1400d3a60
cmp qword [rsp + 0x90], 0
je 0x1400d7a89
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x160], rax
movdqu xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x150], xmm0
mov rdi, qword [rsp + 0x60]
cmp qword [rsp + 0xd8], 0
je 0x1400d77bf
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
mov r13, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x158]
test r13, r13
je 0x1400d6ff1
mov r8, qword [rsp + 0x160]
mov qword [rsp + 0x80], rbx
cmp r8, 5
jb case.0x1400d782c.68
cmp word [r13 + r8*2 - 0xa], 0x2e
jne case.0x1400d782c.68
cmp word [r13 + r8*2 - 2], 0
jne case.0x1400d782c.68
movzx eax, word [r13 + r8*2 - 8]
lea ecx, [rax - 0x42]
cmp ecx, 0x21
ja case.0x1400d782c.68
lea rdx, [0x140187d60]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
movzx ecx, word [r13 + r8*2 - 6]
or ecx, 0x20
cmp ecx, 0x61
jne 0x1400d784a
movzx ecx, word [r13 + r8*2 - 4]
or ecx, 0x20
cmp ecx, 0x74
je 0x1400d787a
cmp ax, 0x43
jne case.0x1400d782c.68
movzx eax, word [r13 + r8*2 - 6]
or eax, 0x20
cmp eax, 0x6d
jne case.0x1400d782c.68
movzx eax, word [r13 + r8*2 - 4]
add eax, 0xffffffbc
test eax, 0xffdf
jne case.0x1400d782c.68
mov qword [rsp + 0x1f8], r8
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x58], rax
xor r14d, r14d
mov esi, 0xffffffff
xor r15d, r15d
xor r13d, r13d
cmp r8, 0x201
jb 0x1400d79ca
jmp 0x1400d79dc
lea rax, [r12 + r14]
xor r9d, r9d
lea rbp, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_found7e_
mov rcx, r12
jmp 0x1400d78fc
xor r9d, r9d
test dx, dx
je 0x1400d6fec
mov dx, 1
test r9w, r9w
jne 0x1400d78f0
cmp rcx, rax
je 0x1400d7b85
movzx r9d, byte [rcx]
test r9b, r9b
js 0x1400d7923
inc rcx
mov r8d, r9d
jmp 0x1400d79b0
mov r8d, r9d
and r8d, 0x1f
movzx r11d, byte [rcx + 1]
and r11d, 0x3f
cmp r9b, 0xdf
jbe 0x1400d7979
movzx r10d, byte [rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r9b, 0xf0
jb 0x1400d7986
movzx r9d, byte [rcx + 3]
add rcx, 4
and r8d, 7
shl r8d, 0x12
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
or r8d, r9d
cmp r8d, 0xffff
ja 0x1400d799a
jmp 0x1400d79b0
add rcx, 2
shl r8d, 6
or r8d, r11d
jmp 0x1400d79b0
add rcx, 3
shl r8d, 0xc
or r8d, r10d
cmp r8d, 0xffff
jbe 0x1400d79b0
and r8d, 0x3ff
or r8d, 0xdc00
mov r9d, r8d
jmp 0x1400d78f3
xor r9d, r9d
mov edx, r8d
jmp 0x1400d78f3
jae 0x1400d9417
cmp r8, 0x201
jae 0x1400d79dc
mov ebx, 0x200
lea r12, [rsp + 0x220]
mov rdi, r8
jmp 0x1400d7a0a
sub r8, r13
sub r15, r13
cmp r15, r8
jb 0x1400d7a5f
cmp r14, rsi
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rsp + 0xa0], r13
mov r15, r14
mov rbx, r13
mov r12, qword [rsp + 0x58]
mov rdi, r13
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r12
mov edx, edi
call sub.kernel32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400d7a2e
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1400d9a44
mov r8d, ebp
cmp rdi, r8
jne 0x1400d79bb
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400dac66
add rdi, rdi
cmp rdi, rsi
cmovae rdi, rsi
mov r8, rdi
cmp r8, 0x201
jae 0x1400d79dc
jmp 0x1400d79ca
lea rcx, [rsp + 0x90]
mov rdx, r13
call fcn.1400976d0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0x98]
jmp 0x1400d79e7
lea rdx, str.Invalid_checksumincomplete_frame
lea rcx, [rsp + 0xd0]
xor r8d, r8d
call fcn.1400e1dc0
mov rsi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0x220]
mov rdx, rsi
call fcn.1400d1f70
mov rcx, qword [rsp + 0x220]
mov rax, qword [rsp + 0x228]
test rcx, rcx
mov rdi, qword [rsp + 0x60]
je 0x1400d7bb8
mov rdx, qword [rsp + 0x230]
mov qword [rsp + 0x220], rcx
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], rdx
lea rcx, [rsp + 0x150]
lea rdx, [rsp + 0x220]
call fcn.1400df460
cmp qword [rsp + 0xd8], 0
jne 0x1400d77ae
jmp 0x1400d77bf
mov qword [rsp + 0x220], r15
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x220]
lea r8, [rsp + 0x170]
call fcn.1400de490
cmp qword [rsp + 0xd0], 0
jne 0x1400dac66
mov rcx, r15
call sub.kernel32.dll_CloseHandle
jmp 0x1400d82a7
call sub.kernel32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
or r12, 2
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
jmp 0x1400d825e
cmp r14, 0xf
mov qword [rsp + 0x80], rbx
ja 0x1400d7da5
xor eax, eax
nop dword [rax]
cmp byte [r12 + rax], 0x2e
je 0x1400d7e52
inc rax
cmp r14, rax
jne 0x1400d7ba0
jmp 0x1400d7e45
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], 0
cmp qword [rsp + 0xd8], 0
jne 0x1400d77ae
jmp 0x1400d77bf
jmp 0x1400d6f32
lea rsi, [rsp + 0x150]
lea rbx, [rsp + 0x220]
mov rax, qword [rsp + 0x220]
test rax, rax
je 0x1400d7c66
cmp eax, 1
jne 0x1400d7c3d
mov rdx, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x240]
mov dword [rsp + 0x150], 0
mov r8, rsi
mov r9d, 1
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
je 0x1400d7c92
mov eax, dword [rsp + 0x150]
jmp 0x1400d7c45
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x220], 0
mov rcx, qword [rsp + 0x238]
add qword [rcx + 0x10], rax
test rax, rax
je 0x1400d7d9d
mov rcx, rsi
mov rdx, rbx
call fcn.1400dc480
cmp byte [rsp + 0x150], 0
jne 0x1400d7d90
cmp byte [rsp + 0x151], 0
jne 0x1400d7bf5
jmp 0x1400d7d9d
call sub.kernel32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
cmp r12, r13
je 0x1400d7cbc
mov eax, 0
movabs rcx, 0x2600000000
cmp r12, rcx
je 0x1400d7c45
jmp 0x1400d821d
xor eax, eax
jmp 0x1400d7c45
lea rsi, [rsp + 0x150]
lea rbx, [rsp + 0xd0]
mov rax, qword [rsp + 0xd0]
test rax, rax
je 0x1400d7d3d
cmp eax, 1
jne 0x1400d7d18
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xf0]
mov dword [rsp + 0x150], 0
mov r8, rsi
mov r9d, 1
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
je 0x1400d7d62
mov eax, dword [rsp + 0x150]
jmp 0x1400d7d20
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xd0], 0
mov rcx, qword [rsp + 0xe8]
add qword [rcx + 0x10], rax
test rax, rax
je 0x1400d7d9d
mov rcx, rsi
mov rdx, rbx
call fcn.1400dc480
cmp byte [rsp + 0x150], 0
jne 0x1400d7d90
cmp byte [rsp + 0x151], 0
jne 0x1400d7cd0
jmp 0x1400d7d9d
call sub.kernel32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
cmp r12, r13
je 0x1400d7d8c
mov eax, 0
movabs rcx, 0x2600000000
cmp r12, rcx
je 0x1400d7d20
jmp 0x1400d821d
xor eax, eax
jmp 0x1400d7d20
mov r12, qword [rsp + 0x158]
jmp 0x1400d8221
xor r12d, r12d
jmp 0x1400d8221
lea rax, [r12 + 7]
and rax, 0xfffffffffffffff8
sub rax, r12
je 0x1400d7ddf
cmp rax, r14
cmovae rax, r14
test rax, rax
je 0x1400d7ddf
xor ecx, ecx
cmp byte [r12 + rcx], 0x2e
je 0x1400d7e52
inc rcx
cmp rax, rcx
jne 0x1400d7dc1
lea rcx, [r14 - 0x10]
cmp rax, rcx
jbe 0x1400d7de5
jmp 0x1400d7e31
lea rcx, [r14 - 0x10]
xor eax, eax
movabs rdx, 0x8080808080808080
movdqa xmm0, xmmword [str.................]
movdqa xmm1, xmmword [0x140187d50]
movdqu xmm2, xmmword [r12 + rax]
movdqa xmm3, xmm2
pxor xmm3, xmm0
paddq xmm3, xmm1
pandn xmm2, xmm3
pshufd xmm3, xmm2, 0xee
por xmm3, xmm2
movq r8, xmm3
test r8, rdx
jne 0x1400d7e31
add rax, 0x10
cmp rax, rcx
jbe 0x1400d7dff
cmp rax, r14
je 0x1400d7e45
cmp byte [r12 + rax], 0x2e
je 0x1400d7e52
inc rax
cmp r14, rax
jne 0x1400d7e36
mov dword [rsp + 0x88], 0
jmp 0x1400d7e5b
mov al, 1
mov dword [rsp + 0x88], eax
test rsi, rsi
mov qword [rsp + 0x148], r12
je 0x1400d7eba
add rdi, rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
mov word [rsp + 0xa0], 0
mov byte [rsp + 0xa8], 1
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0x90]
call fcn.1400e4720
movzx eax, byte [rsp + 0x238]
cmp al, 2
jne 0x1400d8477
mov r12, qword [rsp + 0x148]
lea rcx, [rsp + 0xd0]
call fcn.1400d2700
cmp byte [rsp + 0xe8], 2
jne 0x1400d7f3f
mov rax, qword [rsp + 0xd0]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400d802e
test rcx, rcx
je 0x1400d802e
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400d7f29
cmp qword [rbx + 0x10], 0x11
jb 0x1400d7f18
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rdi
call fcn.140104a84
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
jmp 0x1400d802e
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
mov rcx, rsi
mov rdx, rdi
call fcn.1400e1760
cmp rdi, rdx
cmovb rdx, rdi
test rax, rax
cmove rdx, rdi
mov qword [rsp + 0x220], rsi
mov qword [rsp + 0x228], rbx
mov qword [rsp + 0x230], rdx
mov qword [rsp + 0x238], r15
lea rcx, [rsp + 0x220]
mov rdx, r12
mov r8, r14
call fcn.1400e0b70
cmp byte [rsp + 0x88], 0
jne 0x1400d7fcf
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rsp + 0x220]
mov r8d, 3
call fcn.1400e1dc0
mov rsi, qword [rsp + 0x220]
mov r8, qword [rsp + 0x230]
lea rcx, [rsp + 0x90]
mov rdx, rsi
call fcn.1400d3a60
cmp qword [rsp + 0x228], 0
mov rbx, qword [rsp + 0x80]
je 0x1400d8013
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
mov r13, qword [rsp + 0x90]
test r13, r13
je 0x1400d802e
movdqu xmm0, xmmword [rsp + 0x98]
jmp 0x1400d8985
mov qword [rsp + 0x170], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov esi, 0xffffffff
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jb 0x1400d808f
jmp 0x1400d80b0
jae 0x1400d817b
cmp r8, 0x201
jae 0x1400d80b0
mov r15d, 0x200
lea rdi, [rsp + 0x220]
mov r13, r8
jmp 0x1400d80e4
sub r8, r12
sub rbx, r12
cmp rbx, r8
jb 0x1400d814c
mov rbx, qword [rsp + 0x58]
cmp rbx, rsi
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rsp + 0x180], r12
mov r15, r12
mov rdi, qword [rsp + 0x68]
mov r13, r12
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, rdi
mov edx, r13d
call sub.kernel32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400d8109
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1400d85d3
mov r8d, ebp
cmp r13, r8
jne 0x1400d8080
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400dac66
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
mov esi, 0xffffffff
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jae 0x1400d80b0
jmp 0x1400d808f
lea rcx, [rsp + 0x170]
mov rdx, r12
call fcn.1400976d0
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
jmp 0x1400d80bf
cmp r15, r8
jb 0x1400dac66
lea r12, [rsp + 0xd0]
mov rcx, r12
mov rdx, rdi
call fcn.1400e2640
mov rcx, r12
mov rdx, qword [rsp + 0x148]
mov r8, r14
call fcn.1400e0b70
cmp byte [rsp + 0x88], 0
jne 0x1400d81ce
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rsp + 0xd0]
mov r8d, 3
call fcn.1400e1dc0
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0x98]
mov rdx, rdi
call fcn.1400d3a60
cmp qword [rsp + 0xd8], 0
je 0x1400d820a
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rdi
call fcn.140104a84
xor eax, eax
jmp 0x1400d85ed
call sub.kernel32.dll_GetLastError
mov r12d, eax
shl r12, 0x20
or r12, 2
lea rcx, [rsp + 0x220]
call fcn.1400dc5b0
mov rcx, qword [rsp + 0x240]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x248]
call sub.kernel32.dll_CloseHandle
mov r8, qword [rsp + 0x230]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov rbx, rbp
lea rcx, [rsp + 0xd0]
call fcn.1400dc5b0
mov rcx, qword [rsp + 0xf0]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0xf8]
call sub.kernel32.dll_CloseHandle
mov r8, qword [rsp + 0xe0]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
test r12, r12
jne 0x1400dac66
pshufd xmm0, xmm6, 0xee
movq rsi, xmm0
mov rcx, rdi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov r12, rbx
test eax, eax
je 0x1400d831e
call sub.kernel32.dll_GetLastError
mov ebx, eax
shl rbx, 0x20
cmp qword [rsp + 0x98], 0
je 0x1400d82f1
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
or rbx, 2
cmp qword [rsp + 0x178], 0
je 0x1400d8316
mov r8, qword [rsp + 0x170]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
xor r14d, r14d
jmp 0x1400d83ae
mov dword [rsp + 0x220], 0
lea rdx, [rsp + 0x220]
mov rcx, rdi
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x1400d82c5
mov ebp, dword [rsp + 0x220]
mov r14, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x178]
mov r15, qword [rsp + 0x180]
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x224], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x234], rax
movdqu xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0x620], xmm0
mov rax, qword [rsp + 0x22c]
mov qword [rsp + 0x62c], rax
mov rax, qword [rsp + 0x234]
mov qword [rsp + 0x634], rax
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
test r14, r14
je 0x1400d8414
movups xmm0, xmmword [rsp + 0x62c]
movups xmmword [rsp + 0x64c], xmm0
movaps xmm0, xmmword [rsp + 0x620]
movaps xmmword [rsp + 0x640], xmm0
mov rax, qword [rsp + 0x654]
mov qword [r12 + 0x28], rax
movdqu xmm0, xmmword [rsp + 0x644]
movdqu xmmword [r12 + 0x18], xmm0
mov qword [r12 + 8], rbx
mov rbx, r12
mov qword [r12 + 0x10], r15
mov dword [r12 + 0x30], ebp
jmp 0x1400d8421
mov rdi, rbx
mov rbx, r12
mov qword [rbx + 8], rdi
xor r14d, r14d
mov qword [rbx], r14
movaps xmm6, xmmword [rsp + 0x660]
add rsp, 0x678
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], 0
mov rdi, qword [rsp + 0x60]
mov r13, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x158]
test r13, r13
jne 0x1400d77d8
jmp 0x1400d6ff1
lea rbx, [rsp + 0xe9]
lea rbp, [rsp + 0x239]
lea rsi, [rsp + 0x220]
lea r12, [rsp + 0x90]
lea r13, [rsp + 0xd0]
lea r15, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
cmp qword [rsp + 0x230], 0
jne 0x1400d8509
mov rcx, qword [rsp + 0x228]
nop dword [rax]
test rcx, rcx
je 0x1400d84db
mov r8, qword [rsp + 0x220]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov rcx, rsi
mov rdx, r12
call fcn.1400e4720
movzx eax, byte [rsp + 0x238]
cmp al, 2
je 0x1400d7eb2
mov rcx, qword [rsp + 0x228]
cmp qword [rsp + 0x230], 0
je 0x1400d84c0
mov ecx, dword [rbp]
mov edx, dword [rbp + 3]
mov dword [rbx + 3], edx
mov dword [rbx], ecx
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xe8], al
mov rcx, r13
mov rdx, qword [rsp + 0x148]
mov r8, r14
call fcn.1400e0b70
cmp byte [rsp + 0x88], 0
jne 0x1400d856b
mov r8d, 3
mov rcx, r13
mov rdx, r15
call fcn.1400e1dc0
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
mov rcx, rsi
mov rdx, rdi
call fcn.1400d3a60
cmp qword [rsp + 0xd8], 0
je 0x1400d85a2
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rdi
call fcn.140104a84
mov rax, qword [rsp + 0x220]
test rax, rax
jne 0x1400d9b9e
mov rcx, rsi
mov rdx, r12
call fcn.1400e4720
movzx eax, byte [rsp + 0x238]
cmp al, 2
jne 0x1400d84a6
jmp 0x1400d7eb2
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x98], rax
mov eax, 1
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x58], 0
je 0x1400d8618
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x68]
call fcn.140104a84
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x1400d8680
mov rax, qword [rsp + 0x98]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400d86ac
test rcx, rcx
je 0x1400d86ac
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400d866d
cmp qword [rbx + 0x10], 0x11
jb 0x1400d865c
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rdi
call fcn.140104a84
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
jmp 0x1400d86ac
mov r13, qword [rsp + 0x98]
test r13, r13
je 0x1400d86ac
movdqu xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x1e0], xmm0
mov rbx, qword [rsp + 0x80]
jmp 0x1400d898e
mov qword [rsp + 0x170], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x178], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov esi, 0xffffffff
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jb 0x1400d870f
jmp 0x1400d8730
jae 0x1400d87fb
cmp r8, 0x201
jae 0x1400d8730
mov r15d, 0x200
lea rdi, [rsp + 0x220]
mov r13, r8
jmp 0x1400d8764
sub r8, r12
sub rbx, r12
cmp rbx, r8
jb 0x1400d87cc
mov rbx, qword [rsp + 0x58]
cmp rbx, rsi
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rsp + 0x180], r12
mov r15, r12
mov rdi, qword [rsp + 0x68]
mov r13, r12
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, rdi
mov edx, r13d
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x1400d8789
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1400d889b
mov r8d, ebp
cmp r13, r8
jne 0x1400d8700
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400dac66
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
mov esi, 0xffffffff
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jae 0x1400d8730
jmp 0x1400d870f
lea rcx, [rsp + 0x170]
mov rdx, r12
call fcn.1400976d0
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
jmp 0x1400d873f
cmp r15, r8
jb 0x1400dac66
lea r12, [rsp + 0xd0]
mov rcx, r12
mov rdx, rdi
call fcn.1400e2640
mov rcx, r12
mov rdx, qword [rsp + 0x148]
mov r8, r14
call fcn.1400e0b70
cmp byte [rsp + 0x88], 0
mov rbx, qword [rsp + 0x80]
jne 0x1400d8856
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rsp + 0xd0]
mov r8d, 3
call fcn.1400e1dc0
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0x98]
mov rdx, rdi
call fcn.1400d3a60
cmp qword [rsp + 0xd8], 0
mov r15, qword [rsp + 0x78]
je 0x1400d8897
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rdi
call fcn.140104a84
xor eax, eax
jmp 0x1400d88c2
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x98], rax
mov eax, 1
mov rbx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x78]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x58], 0
je 0x1400d88ed
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x68]
call fcn.140104a84
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x1400d896b
mov rax, qword [rsp + 0x98]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x1400d94ae
test rcx, rcx
je 0x1400d94ae
mov r15, rbx
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400d894d
cmp qword [rbx + 0x10], 0x11
jb 0x1400d893c
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rdi
call fcn.140104a84
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
mov rbx, r15
mov r15, qword [rsp + 0x78]
jmp 0x1400d94ae
mov r13, qword [rsp + 0x98]
test r13, r13
je 0x1400d9488
movdqu xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x1e0], xmm0
movdqa xmm0, xmmword [rsp + 0x1e0]
movdqu xmmword [rsp + 0x158], xmm0
mov rbp, qword [rsp + 0x158]
mov r8, qword [rsp + 0x160]
mov qword [rsp + 0x80], rbx
cmp r8, 5
jae 0x1400d77f2
mov rax, qword [rsp + 0x140]
mov rbx, qword [rax + 0x30]
mov r14, qword [rax + 0x90]
mov r15, qword [rax + 0xa0]
movzx esi, byte [rax + 0xc5]
mov r12, qword [rax + 0x40]
add r12, rbx
mov qword [rsp + 0xd0], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
lea rdi, [rsp + 0xd0]
mov rcx, rdi
xor edx, edx
call fcn.1400e3a20
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xe0]
mov word [rax + rcx*2], 0x22
inc rcx
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0x220], rbx
mov qword [rsp + 0x228], r12
mov word [rsp + 0x230], 0
lea rdx, [rsp + 0x220]
mov rcx, rdi
call fcn.1400df9c0
mov rdx, qword [rsp + 0xe0]
cmp rdx, qword [rsp + 0xd8]
jne 0x1400d8a87
lea rcx, [rsp + 0xd0]
call fcn.1400e3a20
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x22
inc rdx
mov qword [rsp + 0xe0], rdx
shl r15, 3
lea rbx, [r15 + r15*4]
lea rdi, [rsp + 0xd0]
jmp 0x1400d8afb
lea r12, [r14 + 0x28]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x20
inc rdx
mov qword [rsp + 0xe0], rdx
mov rcx, rdi
mov rdx, r14
mov r8d, esi
call fcn.1400deff0
add rbx, 0xffffffffffffffd8
mov r14, r12
test rax, rax
jne 0x1400d9273
test rbx, rbx
je 0x1400d8b24
mov rdx, qword [rsp + 0xe0]
cmp rdx, qword [rsp + 0xd8]
jne 0x1400d8ac0
mov rcx, rdi
call fcn.1400e3a20
mov rdx, qword [rsp + 0xe0]
jmp 0x1400d8ac0
mov rax, qword [rsp + 0xd0]
mov r15, qword [rsp + 0xd8]
test rax, rax
je 0x1400d9297
mov rdx, qword [rsp + 0xe0]
mov r8b, 1
mov qword [rsp + 0x148], r13
mov rcx, rbp
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x160], rdx
cmp rdx, r15
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x60], r8d
jne 0x1400d8ba4
lea rcx, [rsp + 0x150]
call fcn.1400e3a20
mov rax, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x160]
mov r14, qword [rsp + 0x78]
mov word [rax + rdx*2], 0
inc qword [rsp + 0x160]
mov rcx, qword [rsp + 0x140]
cmp byte [rcx + 0xc4], 0
mov eax, 0x400
mov r12d, 0x608
cmove r12d, eax
mov rax, rcx
or r12d, dword [rcx + 0xc0]
mov ecx, 2
mov qword [rsp + 0x78], rcx
xor edi, edi
mov edx, 0
cmp byte [rsp + 0x198], 0
jne 0x1400d975a
mov qword [rsp + 0x90], 2
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov rdi, qword [rsp + 0x138]
test rdi, rdi
jne 0x1400d8c54
lea rcx, [rsp + 0x90]
xor edx, edx
call fcn.1400e3a20
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xa0]
mov word [rax + rcx*2], 0
inc rcx
mov qword [rsp + 0xa0], rcx
xor eax, eax
test rsi, rsi
setne al
mov rcx, rdi
cmove rcx, rsi
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], r14
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], r14
mov qword [rsp + 0x260], rcx
test rcx, rcx
je 0x1400d9369
lea r8, [rsp + 0x230]
pxor xmm6, xmm6
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x68], r13
dec rax
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x220]
mov rdi, qword [rsp + 0x228]
test rax, rax
je 0x1400d8d9f
test rdi, rdi
jne 0x1400d8d9f
mov rdi, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x238]
test rcx, rcx
je 0x1400d8d7f
mov rdx, rcx
mov rax, rcx
and rdx, 7
je 0x1400d8d3b
and rax, 0xfffffffffffffff8
mov rdi, qword [rdi + 0x3d8]
dec rdx
jne 0x1400d8d2f
cmp rcx, 8
jb 0x1400d8d7f
mov rcx, qword [rdi + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rdi, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x1400d8d41
movdqu xmmword [r8], xmm6
mov qword [rsp + 0x220], 1
mov qword [rsp + 0x228], rdi
xor r14d, r14d
xor esi, esi
jmp 0x1400d8db8
test rax, rax
je 0x1400dac66
mov rsi, qword [rsp + 0x230]
mov r14, qword [rsp + 0x238]
movzx eax, word [rdi + 0x3d2]
mov r8, rdi
cmp r14, rax
jb 0x1400d8e06
nop word [rax + rax]
mov rdi, qword [r8 + 0x160]
test rdi, rdi
je 0x1400dac40
inc rsi
movzx r14d, word [r8 + 0x3d0]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov r8, rdi
cmp r14w, word [rdi + 0x3d2]
jae 0x1400d8dd0
test rsi, rsi
je 0x1400d8ea7
mov rax, qword [rdi + r14*8 + 0x3e0]
mov rcx, rsi
dec rcx
je 0x1400d8eb0
mov rdx, rcx
and rdx, 7
je 0x1400d8e44
mov rcx, rdx
mov rax, qword [rax + 0x3d8]
dec rcx
jne 0x1400d8e2f
not rdx
add rdx, rsi
mov rcx, rdx
add rsi, 0xfffffffffffffffe
cmp rsi, 7
jb 0x1400d8e8c
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x1400d8e4e
mov qword [rsp + 0x228], rax
movdqu xmmword [rsp + 0x230], xmm6
test rdi, rdi
jne 0x1400d8ece
jmp 0x1400d9702
lea rcx, [r14 + 1]
mov rax, rdi
jmp 0x1400d8eb2
xor ecx, ecx
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], 0
mov qword [rsp + 0x238], rcx
imul rax, r14, 0x38
cmp byte [rdi + rax + 0x198], 2
je 0x1400d9702
lea rcx, [rdi + rax]
add rcx, 0x168
mov rsi, qword [rdi + rax + 0x168]
mov rdx, qword [rdi + rax + 0x170]
mov qword [rsp + 0x138], rdx
mov rbp, qword [rdi + rax + 0x178]
mov r8, qword [rdi + rax + 0x180]
mov rax, qword [rdi + rax + 0x188]
shl r14, 5
mov r15, qword [rdi + r14]
mov rdx, qword [rdi + r14 + 8]
mov qword [rsp + 0x198], rdx
mov r13, qword [rdi + r14 + 0x10]
movzx r14d, byte [rdi + r14 + 0x18]
mov rcx, qword [rcx + 0x28]
add rcx, r8
xor r11d, r11d
mov rdx, r8
jmp 0x1400d8f5d
xor r11d, r11d
test r9w, r9w
je 0x1400d92cd
mov r9w, 1
test r11w, r11w
jne 0x1400d8f50
cmp rdx, rcx
je 0x1400d901d
movzx r11d, byte [rdx]
test r11b, r11b
js 0x1400d8f85
inc rdx
mov r10d, r11d
jmp 0x1400d9012
mov r10d, r11d
and r10d, 0x1f
movzx ebx, byte [rdx + 1]
and ebx, 0x3f
cmp r11b, 0xdf
jbe 0x1400d8fcb
movzx edi, byte [rdx + 2]
shl ebx, 6
and edi, 0x3f
or edi, ebx
cmp r11b, 0xf0
jb 0x1400d8fe0
movzx r11d, byte [rdx + 3]
add rdx, 4
and r10d, 7
shl r10d, 0x12
shl edi, 6
and r11d, 0x3f
or r11d, edi
or r10d, r11d
jmp 0x1400d8feb
add rdx, 2
shl r10d, 6
or r10d, ebx
mov rbx, qword [rsp + 0x80]
jmp 0x1400d9012
add rdx, 3
shl r10d, 0xc
or r10d, edi
mov rbx, qword [rsp + 0x80]
cmp r10d, 0xffff
jbe 0x1400d9012
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x1400d8f53
xor r11d, r11d
mov r9d, r10d
jmp 0x1400d8f53
test rax, rax
je 0x1400d9030
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov rax, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
sub rax, rdi
cmp rax, rbp
jb 0x1400d9253
lea r8, [rbp*2]
lea rcx, [rdi + rdi]
add rcx, qword [rsp + 0x90]
mov rdx, rsi
call sub.msvcrt.dll_memcpy
add rdi, rbp
mov qword [rsp + 0xa0], rdi
cmp qword [rsp + 0x138], 0
je 0x1400d9097
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
mov rdi, qword [rsp + 0xa0]
cmp rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x88]
jne 0x1400d90c1
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.1400e3a20
mov rdi, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x90]
mov word [rax + rdi*2], 0x3d
inc rdi
mov qword [rsp + 0xa0], rdi
add r13, r15
xor r8d, r8d
mov rax, r15
jmp 0x1400d90f1
xor r8d, r8d
test cx, cx
je 0x1400d93f6
mov cx, 1
test r8w, r8w
jne 0x1400d90e5
cmp rax, r13
je 0x1400d919b
movzx r8d, byte [rax]
test r8b, r8b
js 0x1400d9115
inc rax
mov edx, r8d
jmp 0x1400d9191
mov edx, r8d
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp r8b, 0xdf
jbe 0x1400d915f
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r8b, 0xf0
jb 0x1400d916b
movzx r8d, byte [rax + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
or edx, r8d
jmp 0x1400d9175
add rax, 2
shl edx, 6
or edx, r10d
jmp 0x1400d9191
add rax, 3
shl edx, 0xc
or edx, r9d
cmp edx, 0xffff
jbe 0x1400d9191
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x1400d90e8
xor r8d, r8d
mov ecx, edx
jmp 0x1400d90e8
cmp r14b, 2
je 0x1400daba4
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], r13
mov word [rsp + 0xe0], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xd0]
call fcn.1400df9c0
cmp qword [rsp + 0x198], 0
je 0x1400d91f0
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, r15
call fcn.140104a84
mov rdx, qword [rsp + 0xa0]
cmp rdx, qword [rsp + 0x98]
mov r13, qword [rsp + 0x68]
jne 0x1400d921c
lea rcx, [rsp + 0x90]
call fcn.1400e3a20
mov rdx, qword [rsp + 0xa0]
lea r8, [rsp + 0x230]
mov rax, qword [rsp + 0x90]
mov word [rax + rdx*2], 0
inc rdx
mov qword [rsp + 0xa0], rdx
mov rax, qword [rsp + 0x260]
test rax, rax
jne 0x1400d8cdd
jmp 0x1400dabcf
lea rcx, [rsp + 0x90]
mov rdx, rdi
mov r8, rbp
call fcn.1400976d0
mov rdi, qword [rsp + 0xa0]
jmp 0x1400d904c
mov r15, rax
cmp qword [rsp + 0xd8], 0
je 0x1400d9297
mov r8, qword [rsp + 0xd0]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x60]
movq xmm6, r15
mov r15, qword [rsp + 0x78]
test rbp, rbp
je 0x1400d6ff6
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, r13
call fcn.140104a84
jmp 0x1400d6ff6
test rax, rax
je 0x1400d92e0
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
cmp qword [rsp + 0x198], 0
mov rbp, qword [rsp + 0x88]
mov r13, qword [rsp + 0x68]
mov r14d, dword [rsp + 0x60]
je 0x1400d930e
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, r15
call fcn.140104a84
cmp qword [rsp + 0x138], 0
je 0x1400d932a
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
lea r15, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_found7e_
lea rcx, [rsp + 0x220]
call fcn.1400d3b90
cmp qword [rsp + 0x98], 0
je 0x1400d935f
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
movq xmm6, r15
jmp 0x1400dab40
mov qword [rsp + 0x220], 0
test rsi, rsi
je 0x1400d9702
test r14, r14
je 0x1400d96bd
mov rcx, r14
mov rax, r14
and rcx, 7
je 0x1400d93a3
and rax, 0xfffffffffffffff8
mov rsi, qword [rsi + 0x3d8]
dec rcx
jne 0x1400d9397
mov r8, rsi
cmp r14, 8
jb 0x1400d96c0
mov r8, rsi
mov rcx, qword [r8 + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov r8, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x1400d93b3
jmp 0x1400d96c0
mov rsi, r15
cmp qword [rsp + 0x198], 0
mov r13, qword [rsp + 0x68]
mov r14d, dword [rsp + 0x60]
jne 0x1400d9319
jmp 0x1400d932a
cmp rbx, r8
jb 0x1400dac66
test ebp, ebp
mov rbx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x78]
je 0x1400d9bbe
movzx eax, byte [0x1401ee110]
mov rcx, qword [0x1401ee100]
test rcx, rcx
jne 0x1400d9466
mov rsi, r8
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov rcx, rax
mov qword [0x1401ee100], rax
mov r8, rsi
mov r13, r8
lea rdi, [r8 + r8]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
mov rsi, rax
test rax, rax
jne 0x1400d9bc8
jmp 0x1400dac66
mov r8, qword [rsp + 0x98]
test r8, r8
je 0x1400d94ae
cmp qword [rsp + 0xa0], 0
je 0x1400d94ae
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
lea rdx, [0x1401b5e2f]
lea rcx, [rsp + 0x170]
mov r8d, 4
call fcn.1400e4940
cmp byte [rsp + 0x188], 2
je 0x1400d955d
mov r15, rbx
mov rsi, qword [rsp + 0x170]
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x180]
add rax, rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rax
mov word [rsp + 0xa0], 0
mov byte [rsp + 0xa8], 1
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0x90]
call fcn.1400e4720
movzx eax, byte [rsp + 0x238]
cmp al, 2
jne 0x1400d9569
cmp qword [rsp + 0x58], 0
mov rbx, r15
mov r15, qword [rsp + 0x78]
je 0x1400d955d
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
lea rbp, [0x1401b5e48]
jmp 0x1400d6fec
lea rbp, [rsp + 0xe9]
lea rbx, [rsp + 0x239]
lea r12, [rsp + 0x220]
lea r13, [rsp + 0x90]
cmp qword [rsp + 0x230], 0
jne 0x1400d95e5
mov rcx, qword [rsp + 0x228]
test rcx, rcx
je 0x1400d95b7
mov r8, qword [rsp + 0x220]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov rcx, r12
mov rdx, r13
call fcn.1400e4720
movzx eax, byte [rsp + 0x238]
cmp al, 2
je 0x1400d953c
mov rcx, qword [rsp + 0x228]
cmp qword [rsp + 0x230], 0
je 0x1400d959c
mov ecx, dword [rbx]
mov edx, dword [rbx + 3]
mov dword [rbp + 3], edx
mov dword [rbp], ecx
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0xe0], rcx
movdqu xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xe8], al
lea rcx, [rsp + 0xd0]
mov rdx, qword [rsp + 0x148]
mov r8, r14
call fcn.1400e0b70
cmp byte [rsp + 0x88], 0
jne 0x1400d9655
mov r8d, 3
lea rcx, [rsp + 0xd0]
lea rdx, str.exeNULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
call fcn.1400e1dc0
mov rdi, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
mov rcx, r12
mov rdx, rdi
call fcn.1400d3a60
cmp qword [rsp + 0xd8], 0
je 0x1400d968c
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rdi
call fcn.140104a84
mov rax, qword [rsp + 0x220]
test rax, rax
jne 0x1400da42d
mov rcx, r12
mov rdx, r13
call fcn.1400e4720
movzx eax, byte [rsp + 0x238]
cmp al, 2
jne 0x1400d9589
jmp 0x1400d953c
mov r8, rsi
mov rax, qword [r8 + 0x160]
test rax, rax
je 0x1400d96ee
mov rsi, rax
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov rax, qword [rsi + 0x160]
mov r8, rsi
test rax, rax
jne 0x1400d96cc
jmp 0x1400d96f1
mov rsi, r8
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
lea rcx, [rsp + 0x220]
call fcn.1400d3b90
mov rdi, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
cmp rdx, rdi
jne 0x1400d9741
lea rcx, [rsp + 0x90]
call fcn.1400e3a20
mov rdi, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x90]
mov word [rcx + rdx*2], 0
mov rdx, rcx
mov qword [rsp + 0x1f8], rdx
mov qword [rsp + 0x138], rcx
xor ecx, ecx
cmp byte [rax + 0x88], 2
mov r15d, 0
je 0x1400d98f4
mov rcx, rax
mov rax, qword [rax + 0x70]
mov rcx, qword [rcx + 0x80]
add rcx, rax
xor r10d, r10d
mov rdx, rax
jmp 0x1400d97ad
xor r10d, r10d
test r8w, r8w
je 0x1400d9861
mov r8w, 1
test r10w, r10w
jne 0x1400d97a0
cmp rdx, rcx
je 0x1400d9877
movzx r10d, byte [rdx]
test r10b, r10b
js 0x1400d97d5
inc rdx
mov r9d, r10d
jmp 0x1400d9856
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rdx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x1400d981f
movzx r11d, byte [rdx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x1400d982c
movzx r10d, byte [rdx + 3]
add rdx, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r9d, r10d
jmp 0x1400d9837
add rdx, 2
shl r9d, 6
or r9d, esi
jmp 0x1400d9856
add rdx, 3
shl r9d, 0xc
or r9d, r11d
cmp r9d, 0xffff
jbe 0x1400d9856
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x1400d97a3
xor r10d, r10d
mov r8d, r9d
jmp 0x1400d97a3
lea rax, str.nul_byte_found_in_provided_dataPATH.exeprogram_not_found7e_
movq xmm6, rax
mov r14d, dword [rsp + 0x60]
jmp 0x1400dab25
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], rcx
mov word [rsp + 0x230], 0
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x220]
call fcn.1400dfb50
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
cmp rdx, rcx
jne 0x1400d98d8
lea rcx, [rsp + 0xd0]
call fcn.1400e3a20
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0x140]
mov r15, qword [rsp + 0xd0]
mov word [r15 + rdx*2], 0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x198], rcx
mov qword [rsp + 0x68], r13
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], 0
lea rcx, [0x1401ee050]
mov r13, rax
call sub.kernel32.dll_AcquireSRWLockExclusive
movzx eax, byte [0x1401ee058]
mov qword [rsp + 0x90], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0x1e0], 2
mov ebx, dword [r13 + 0x10]
cmp dword [r13], 6
lea rcx, [rsp + 0x1e0]
cmovne rcx, r13
cmp dword [r13 + 0x20], 6
lea rsi, [r13 + 0x20]
lea r14, [rsp + 0x200]
cmove rsi, r14
lea r8, [rsp + 0x90]
mov edx, 0xfffffff6
call fcn.1400d3f70
cmp rax, 1
jne 0x1400d99bd
movq xmm6, rdx
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x68]
mov r14d, dword [rsp + 0x60]
jmp 0x1400daab3
mov qword [rsp + 0x1b0], rdx
lea r8, [rsp + 0xa0]
lea rcx, [r13 + 0x10]
cmp ebx, 6
cmove rcx, r14
mov edx, 0xfffffff5
call fcn.1400d3f70
mov r14, rdx
test rax, rax
je 0x1400d9a06
movq xmm6, r14
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x68]
mov r14d, dword [rsp + 0x60]
jmp 0x1400daaa6
lea r8, [rsp + 0xb0]
mov rcx, rsi
mov edx, 0xfffffff4
call fcn.1400d3f70
test rax, rax
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x68]
mov qword [rsp + 0x1c0], r14
je 0x1400d9a68
movq xmm6, rdx
mov r14d, dword [rsp + 0x60]
jmp 0x1400daa99
call sub.kernel32.dll_GetLastError
mov r10d, eax
shl r10, 0x20
or r10, 2
xor esi, esi
mov rbx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x78]
jmp 0x1400d9bd9
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x104], xmm0
movdqu xmmword [rsp + 0xf8], xmm0
movdqu xmmword [rsp + 0xe8], xmm0
movdqu xmmword [rsp + 0xd8], xmm0
movdqu xmmword [rsp + 0x118], xmm0
movdqu xmmword [rsp + 0x128], xmm0
test rdx, rdx
mov rax, qword [rsp + 0x1b0]
jne 0x1400d9ab9
test r14, r14
jne 0x1400d9ab9
test rax, rax
je 0x1400d9adc
mov dword [rsp + 0x10c], 0x100
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x130], rdx
mov rax, qword [rsp + 0x140]
mov rsi, qword [rax + 0xb8]
test rsi, rsi
je 0x1400da261
mov dword [rsp + 0xd0], 0x70
mov qword [rsp + 0x1c8], 0
mov rax, rsi
shr rax, 0x20
jne 0x1400da41c
mov qword [rsp + 0x1a0], rdx
lea r9, [rsp + 0x1c8]
xor ecx, ecx
mov edx, esi
xor r8d, r8d
call sub.kernel32.dll_InitializeProcThreadAttributeList
mov r8, qword [rsp + 0x1c8]
test r8, r8
mov qword [rsp + 0x1b8], r8
je 0x1400da4de
js 0x1400dac66
movzx eax, byte [0x1401ee110]
mov rcx, qword [0x1401ee100]
test rcx, rcx
jne 0x1400d9b86
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov rcx, rax
mov qword [0x1401ee100], rax
mov r8, qword [rsp + 0x1b8]
xor edx, edx
call sub.kernel32.dll_HeapAlloc
mov rcx, rax
test rax, rax
jne 0x1400da4e3
jmp 0x1400dac66
movups xmm0, xmmword [rsp + 0x228]
movaps xmmword [rsp + 0x1e0], xmm0
mov rbx, qword [rsp + 0x80]
mov r13, rax
jmp 0x1400d898e
mov r13, r8
mov esi, 2
xor edi, edi
mov rcx, rsi
mov rdx, r12
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov r10, r13
test r14, r14
je 0x1400d9bf7
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x58]
mov rdi, r10
call fcn.140104a84
mov r10, rdi
test rsi, rsi
je 0x1400da11c
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], r10
mov qword [rsp + 0x180], r10
lea r14, [0x1401b5e9e]
mov qword [rsp + 0xf0], r14
lea r13, [0x1401b5ea6]
mov qword [rsp + 0xf8], r13
mov word [rsp + 0x100], 0
mov qword [rsp + 0xd0], 1
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 1
mov word [rsp + 0xe8], 0
xor ebp, ebp
lea rdi, [rsp + 0x170]
xor eax, eax
jmp 0x1400d9cb2
mov word [rsp + 0x100], 0
xor r12d, r12d
mov r15d, eax
cmp r10, qword [rsp + 0x178]
je 0x1400d9dc6
mov word [rsi + r10*2], r15w
inc r10
mov qword [rsp + 0x180], r10
mov eax, r12d
mov r15, qword [rsp + 0x78]
test r14, r14
je 0x1400d9d70
test ax, ax
jne 0x1400d9c7c
cmp r14, r13
je 0x1400d9d5f
lea rcx, [r14 + 1]
mov qword [rsp + 0xf0], rcx
movzx r15d, byte [r14]
test r15b, r15b
jns 0x1400d9e77
mov edx, r15d
and edx, 0x1f
lea rcx, [r14 + 2]
mov qword [rsp + 0xf0], rcx
movzx r9d, byte [r14 + 1]
and r9d, 0x3f
cmp r15b, 0xdf
jbe 0x1400d9da7
lea rcx, [r14 + 3]
mov qword [rsp + 0xf0], rcx
movzx r8d, byte [r14 + 2]
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
cmp r15b, 0xf0
jb 0x1400d9e31
lea rcx, [r14 + 4]
mov qword [rsp + 0xf0], rcx
movzx r15d, byte [r14 + 3]
and edx, 7
shl edx, 0x12
shl r8d, 6
and r15d, 0x3f
or r15d, r8d
or r15d, edx
cmp r15d, 0x110000
jne 0x1400d9e3a
mov qword [rsp + 0xf0], 0
mov r15, qword [rsp + 0x78]
cmp rbp, 1
je 0x1400d9e82
lea rdx, [rbp + 1]
mov qword [rsp + 0xd8], rdx
movzx r15d, word [rsp + rbp*2 + 0xe8]
cmp r10, qword [rsp + 0x178]
je 0x1400d9db5
xor r14d, r14d
mov r12d, eax
mov rbp, rdx
jmp 0x1400d9c9a
shl edx, 6
or edx, r9d
mov r15d, edx
jmp 0x1400d9e77
mov rcx, rbp
neg rcx
mov rbp, rdx
mov r12d, eax
xor r14d, r14d
jmp 0x1400d9e04
lea rax, [0x1401b5e9e]
sub rax, r14
add rax, 0xa
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp r12w, 1
sbb rdx, 0xffffffffffffffff
mov eax, 1
sub rax, rbp
mov rcx, 0xffffffffffffffff
add rax, rdx
jb 0x1400d9e04
mov rcx, rax
mov r8, 0xffffffffffffffff
inc rcx
je 0x1400d9e13
mov r8, rcx
mov rcx, rdi
mov rdx, r10
mov rsi, r10
call fcn.1400976d0
mov r10, rsi
mov rsi, qword [rsp + 0x170]
jmp 0x1400d9c9a
shl edx, 0xc
or r8d, edx
mov r15d, r8d
cmp r15d, 0xffff
jbe 0x1400d9e77
lea eax, [r15 + 0xff0000]
shr eax, 0xa
or eax, 0xd800
and r15d, 0x3ff
or r15d, 0xdc00
mov word [rsp + 0x100], r15w
mov r12d, r15d
mov r14, rcx
mov r15d, eax
jmp 0x1400d9c8c
xor r12d, r12d
mov r14, rcx
jmp 0x1400d9c8c
mov rsi, qword [rsp + 0x170]
mov r10, qword [rsp + 0x178]
test rsi, rsi
mov rdi, qword [rsp + 0x60]
je 0x1400da12b
mov qword [rsp + 0x58], r10
mov rax, qword [rsp + 0x140]
mov r13, qword [rax + 0x90]
mov rdi, qword [rax + 0xa0]
movzx ebp, byte [rax + 0xc5]
movzx eax, byte [0x1401ee110]
mov rcx, qword [0x1401ee100]
test rcx, rcx
jne 0x1400d9eed
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400dac66
mov rcx, rax
mov qword [0x1401ee100], rax
mov r8d, 0xc
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400dac66
mov byte [rsp + 0x1b0], bpl
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x148], rsi
mov word [rax], 0x63
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], 6
lea rdi, [0x1401b6dc1]
mov esi, 1
xor ebp, ebp
lea r15, [0x1401b6dcf]
lea r14, str.cmd.exe__d__c__Windows_file_names_may_not_contain_____or_end_with___
lea r12, [rsp + 0x220]
mov r9, qword [rsp + 0x58]
jmp 0x1400d9f70
mov word [rax + rsi*2], bp
inc rsi
mov ebp, ebx
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x230], rsi
test bp, bp
jne 0x1400da02a
cmp rdi, r15
je 0x1400da07d
movzx ebp, byte [rdi]
test bpl, bpl
js 0x1400d9f9a
inc rdi
jmp 0x1400da02a
mov ecx, ebp
and ecx, 0x1f
movzx r8d, byte [rdi + 1]
and r8d, 0x3f
cmp bpl, 0xdf
jbe 0x1400d9fe8
movzx edx, byte [rdi + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp bpl, 0xf0
jb 0x1400d9ff6
movzx ebp, byte [rdi + 3]
and ecx, 7
shl ecx, 0x12
shl edx, 6
and ebp, 0x3f
or ebp, edx
or ebp, ecx
cmp ebp, 0x110000
je 0x1400da07d
add rdi, 4
jmp 0x1400da001
add rdi, 2
shl ecx, 6
or ecx, r8d
mov ebp, ecx
jmp 0x1400da02a
add rdi, 3
shl ecx, 0xc
or edx, ecx
mov ebp, edx
cmp ebp, 0xffff
jbe 0x1400da02a
lea ecx, [rbp + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and ebp, 0x3ff
or ebp, 0xdc00
mov ebx, ebp
mov ebp, ecx
jmp 0x1400da02c
xor ebx, ebx
cmp rsi, qword [rsp + 0x228]
jne 0x1400d9f5f
mov rax, r14
sub rax, rdi
add rax, 0x11
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp bx, 1
sbb rdx, 0
lea r8, [rdx + 2]
mov rcx, r12
mov rdx, rsi
call fcn.1400976d0
mov r9, qword [rsp + 0x58]
mov rax, qword [rsp + 0x220]
jmp 0x1400d9f5f
mov rsi, qword [rsp + 0x230]
mov qword [rsp + 0xe0], rsi
movdqu xmm0, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0xd0], xmm0
mov rdx, qword [rsp + 0xd8]
cmp rsi, rdx
jne 0x1400da0c6
lea rcx, [rsp + 0xd0]
call fcn.1400e3a20
mov r9, qword [rsp + 0x58]
mov rsi, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xd0]
mov word [r14 + rsi*2], 0x22
inc rsi
mov qword [rsp + 0xe0], rsi
mov r8, qword [rsp + 0x1f8]
lea rax, [r8 + r8]
xor ecx, ecx
lea rdi, [0x1401b6e08]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x68]
cmp rax, rcx
je 0x1400da142
cmp word [rdx + rcx], 0x22
lea rcx, [rcx + 2]
jne 0x1400da107
jmp 0x1400daa06
mov rbp, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x60]
jmp 0x1400da133
mov rbp, qword [rsp + 0x88]
movq xmm6, r10
mov r13, qword [rsp + 0x68]
jmp 0x1400d92ae
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + r8*2 - 2]
cmp ax, 0x5c
je 0x1400daa06
lea rdi, [r8 - 1]
test ax, ax
cmovne rdi, r8
mov r12, qword [rsp + 0xd8]
mov rax, r12
sub rax, rsi
cmp rax, rdi
jb 0x1400dac10
movzx ebx, byte [rsp + 0x1b0]
lea r8, [rdi + rdi]
lea rcx, [r14 + rsi*2]
mov rdx, qword [rsp + 0x68]
call sub.msvcrt.dll_memcpy
add rsi, rdi
mov qword [rsp + 0xe0], rsi
cmp rsi, r12
jne 0x1400da1c3
lea rcx, [rsp + 0xd0]
mov rdx, r12
call fcn.1400e3a20
mov r14, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xe0]
mov word [r14 + rsi*2], 0x22
inc qword [rsp + 0xe0]
test bl, bl
je 0x1400da7f5
mov rax, qword [rsp + 0x1c0]
shl rax, 3
lea rbx, [rax + rax*4]
lea rsi, [rsp + 0xd0]
jmp 0x1400da234
lea r14, [r13 + 0x28]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x20
inc rdx
mov qword [rsp + 0xe0], rdx
mov rcx, rsi
mov rdx, r13
mov r8b, 1
call fcn.1400deff0
add rbx, 0xffffffffffffffd8
mov r13, r14
test rax, rax
mov r9, qword [rsp + 0x58]
jne 0x1400da9ee
test rbx, rbx
je 0x1400da984
mov rdx, qword [rsp + 0xe0]
cmp rdx, qword [rsp + 0xd8]
jne 0x1400da1f4
mov rcx, rsi
call fcn.1400e3a20
mov rdx, qword [rsp + 0xe0]
jmp 0x1400da1f4
mov qword [rsp + 0x1a0], rdx
mov dword [rsp + 0xd0], 0x68
lea rax, [rsp + 0xd0]
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x170]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x148]
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x1400da463
mov qword [rsp + 0x88], rbp
mov r14, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xb0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
movaps xmm6, xmmword [rsp + 0x170]
test rax, rax
je 0x1400da346
mov rcx, qword [rsp + 0x1a8]
call sub.kernel32.dll_DeleteProcThreadAttributeList
cmp qword [rsp + 0x1b8], 0
je 0x1400da346
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x1a8]
call fcn.140104a84
mov rcx, qword [rsp + 0x1a0]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x1c0]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x1b0]
call sub.kernel32.dll_CloseHandle
lea rcx, [0x1401ee050]
call fcn.140104ae4
cmp qword [rsp + 0x198], 0
je 0x1400da397
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x78]
call fcn.140104a84
test rdi, rdi
je 0x1400da3b2
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x138]
call fcn.140104a84
cmp qword [rsp + 0x158], 0
je 0x1400da3d3
mov r8, qword [rsp + 0x150]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
cmp qword [rsp + 0x58], 0
je 0x1400da3f1
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x148]
call fcn.140104a84
cmp qword [rsp + 0x88], 0
sete al
mov ecx, dword [rsp + 0x60]
or cl, al
je 0x1400da4b8
cmp dword [rsp + 0x200], 4
jae 0x1400d71ac
jmp 0x1400d71b9
lea rsi, [0x1401b5ed8]
mov r14d, dword [rsp + 0x60]
jmp 0x1400daa8c
mov r13, rax
movdqu xmm0, xmmword [rsp + 0x228]
movdqa xmmword [rsp + 0x1e0], xmm0
cmp qword [rsp + 0x58], 0
je 0x1400da45b
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
mov rbx, r15
jmp 0x1400d898e
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
movq xmm6, rax
test rsi, rsi
je 0x1400daa5f
mov rsi, qword [rsp + 0x1a8]
mov rcx, rsi
call sub.kernel32.dll_DeleteProcThreadAttributeList
cmp qword [rsp + 0x1b8], 0
mov r14d, dword [rsp + 0x60]
je 0x1400daa64
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, rsi
call fcn.140104a84
jmp 0x1400daa64
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x68]
call fcn.140104a84
cmp dword [rsp + 0x200], 4
jae 0x1400d71ac
jmp 0x1400d71b9
mov ecx, 1
mov qword [rsp + 0x218], r15
lea r9, [rsp + 0x1c8]
mov qword [rsp + 0x1a8], rcx
mov edx, esi
xor r8d, r8d
call sub.kernel32.dll_InitializeProcThreadAttributeList
test eax, eax
je 0x1400da7a8
mov rcx, qword [rsp + 0x140]
mov rax, qword [rcx + 0xa8]
mov r14, qword [rcx + 0xb0]
xor ecx, ecx
test rax, rax
mov r15, rsi
mov r9, rsi
cmove r9, rax
setne cl
xor esi, esi
pxor xmm6, xmm6
mov qword [rsp + 0x210], r15
sub r9, 1
jb 0x1400da6f3
test rcx, rcx
je 0x1400da57d
test rsi, rsi
jne 0x1400da57d
test r14, r14
je 0x1400da587
mov rdx, r14
and rdx, 7
je 0x1400da58c
mov rcx, r14
and rcx, 0xfffffffffffffff8
mov rsi, rax
mov rsi, qword [rsi + 0x170]
dec rdx
jne 0x1400da56f
jmp 0x1400da592
test rcx, rcx
jne 0x1400da5db
jmp 0x1400dac66
mov rsi, rax
jmp 0x1400da5d6
mov rsi, rax
mov rcx, r14
cmp r14, 8
jb 0x1400da5d6
mov rax, qword [rsi + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rsi, qword [rax + 0x170]
add rcx, 0xfffffffffffffff8
jne 0x1400da598
xor eax, eax
xor r14d, r14d
movzx r8d, word [rsi + 0x16a]
mov rcx, rsi
mov rdx, r14
cmp r14, r8
jb 0x1400da611
mov r8, qword [rcx]
test r8, r8
je 0x1400dac66
inc rax
movzx edx, word [rcx + 0x168]
mov rcx, r8
cmp dx, word [r8 + 0x16a]
jae 0x1400da5ee
test rax, rax
mov qword [rsp + 0x140], r9
je 0x1400da69c
mov rsi, qword [rcx + rdx*8 + 0x178]
mov r8, rax
dec r8
je 0x1400da697
mov r9, r8
and r9, 7
je 0x1400da64f
mov r8, r9
mov rsi, qword [rsi + 0x170]
dec r8
jne 0x1400da63a
not r9
add r9, rax
mov r8, r9
add rax, 0xfffffffffffffffe
cmp rax, 7
jb 0x1400da697
mov rax, qword [rsi + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rsi, qword [rax + 0x170]
add r8, 0xfffffffffffffff8
jne 0x1400da659
xor r14d, r14d
jmp 0x1400da6a3
lea r14, [rdx + 1]
mov rsi, rcx
lea rax, [rdx + rdx*2]
mov r8, qword [rcx + rdx*8 + 8]
mov r9, qword [rcx + rax*8 + 0x60]
mov rax, qword [rcx + rax*8 + 0x70]
movdqu xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x1a8]
xor edx, edx
call sub.kernel32.dll_UpdateProcThreadAttribute
test eax, eax
je 0x1400da7a8
mov ecx, 1
mov eax, 0
dec r15
mov r9, qword [rsp + 0x140]
jne 0x1400da543
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
je 0x1400daa77
or r12d, 0x80000
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x280], rax
movups xmm0, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x270], xmm0
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x260], xmm0
movdqu xmm0, xmmword [rsp + 0xd0]
movdqu xmm1, xmmword [rsp + 0xe0]
movdqu xmm2, xmmword [rsp + 0xf0]
movdqu xmm3, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x250], xmm3
movdqa xmmword [rsp + 0x240], xmm2
movdqa xmmword [rsp + 0x230], xmm1
movdqa xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x288], rcx
lea rax, [rsp + 0x220]
mov rsi, qword [rsp + 0x210]
mov r15, qword [rsp + 0x218]
jmp 0x1400da27c
call sub.kernel32.dll_GetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov r14, qword [rsp + 0x1a8]
mov rcx, r14
call sub.kernel32.dll_DeleteProcThreadAttributeList
cmp qword [rsp + 0x1b8], 0
je 0x1400da7e3
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, r14
call fcn.140104a84
mov r14d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x1a0]
jmp 0x1400daa8c
mov rax, qword [rsp + 0x1c0]
lea rax, [rax + rax*4]
lea r15, [rax*8]
add r15, r13
lea rbp, [0x1401b6e27]
and rbp, 0xfffffffffffffff8
lea r12, str._t____________
sub rbp, r12
sete al
cmp rbp, 0x16
mov ecx, 0x16
cmovae rbp, rcx
test rbp, rbp
sete sil
or sil, al
movabs r14, 0x101010101010101
jmp 0x1400da86f
xor r8d, r8d
lea rbx, [r13 + 0x28]
lea rcx, [rsp + 0xd0]
mov rdx, r13
call fcn.1400deff0
mov r13, rbx
test rax, rax
mov r9, qword [rsp + 0x58]
jne 0x1400da9ee
cmp r13, r15
je 0x1400da984
mov rdx, qword [rsp + 0xe0]
cmp rdx, qword [rsp + 0xd8]
jne 0x1400da89f
lea rcx, [rsp + 0xd0]
call fcn.1400e3a20
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x20
inc rdx
mov qword [rsp + 0xe0], rdx
cmp qword [r13], 0
jne 0x1400da847
mov rax, qword [r13 + 8]
mov rcx, qword [r13 + 0x18]
add rcx, rax
cmp rax, rcx
je 0x1400da847
movzx edx, byte [rax]
inc rax
xor r8d, r8d
test sil, sil
je 0x1400da933
mov r9, rdx
imul r9, r14
mov r10, qword [r8 + r12]
xor r10, r9
movabs rdi, 0xfefefefefefefeff
lea r11, [r10 + rdi]
not r10
and r10, r11
xor r9, qword [r8 + r12 + 8]
lea r11, [r9 + rdi]
not r9
and r9, r11
or r9, r10
movabs r10, 0x8080808080808080
test r9, r10
je 0x1400da94c
lea r10, [r12 + r8]
mov r9d, 0x16
sub r9, r8
jmp 0x1400da966
cmp byte [r8 + r12], dl
je 0x1400da97c
inc r8
cmp rbp, r8
jne 0x1400da933
mov r8, rbp
cmp rbp, 6
jbe 0x1400da8e1
jmp 0x1400da950
add r8, 0x10
mov r9, r8
sub r9, 0x16
je 0x1400da8ca
add r8, r12
neg r9
mov r10, r8
xor r8d, r8d
cmp byte [r10 + r8], dl
je 0x1400da97c
inc r8
cmp r9, r8
jne 0x1400da969
jmp 0x1400da8ca
mov r8b, 1
jmp 0x1400da84a
mov r15, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
cmp rdx, r15
jne 0x1400da9b6
lea rcx, [rsp + 0xd0]
call fcn.1400e3a20
mov r15, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r13, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0xd0]
mov word [rax + rdx*2], 0x22
inc rdx
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
jmp 0x1400d8b60
mov rdi, rax
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r15, qword [rsp + 0x78]
cmp qword [rsp + 0xd8], 0
je 0x1400daa2c
mov r8, qword [rsp + 0xd0]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
mov r9, qword [rsp + 0x58]
movq xmm6, rdi
test r9, r9
mov r13, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
je 0x1400d92ae
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x148]
call fcn.140104a84
jmp 0x1400d92ae
mov r14d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x1a0]
jmp 0x1400daa91
call fcn.1400e4180
ud2
mov r14d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1b8]
movq xmm6, rsi
mov rcx, rdx
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x1c0]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x1b0]
call sub.kernel32.dll_CloseHandle
cmp qword [rsp + 0x90], 0
je 0x1400daacb
mov rcx, qword [rsp + 0x98]
call sub.kernel32.dll_CloseHandle
cmp qword [rsp + 0xa0], 0
je 0x1400daae3
mov rcx, qword [rsp + 0xa8]
call sub.kernel32.dll_CloseHandle
cmp qword [rsp + 0xb0], 0
je 0x1400daafb
mov rcx, qword [rsp + 0xb8]
call sub.kernel32.dll_CloseHandle
lea rcx, [0x1401ee050]
call fcn.140104ae4
cmp qword [rsp + 0x198], 0
je 0x1400dab25
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x78]
call fcn.140104a84
test rdi, rdi
je 0x1400dab40
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x138]
call fcn.140104a84
cmp qword [rsp + 0x158], 0
je 0x1400dab61
mov r8, qword [rsp + 0x150]
mov rcx, qword [0x1401ee100]
xor edx, edx
call fcn.140104a84
cmp qword [rsp + 0x58], 0
je 0x1400dab7f
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, qword [rsp + 0x148]
call fcn.140104a84
test rbp, rbp
sete al
or r14b, al
jne 0x1400d7192
mov rcx, qword [0x1401ee100]
xor edx, edx
mov r8, r13
call fcn.140104a84
jmp 0x1400d7192
mov r13, qword [rsp + 0x68]
mov r14d, dword [rsp + 0x60]
lea rcx, [rsp + 0x220]
call fcn.1400d3b90
cmp qword [rsp + 0x98], 0
jne 0x1400d9349
jmp 0x1400d935f
mov r8, qword [rsp + 0x228]
mov rsi, qword [rsp + 0x230]
mov r14, qword [rsp + 0x238]
cmp qword [rsp + 0x220], 0
mov qword [rsp + 0x220], 0
je 0x1400d9702
test r8, r8
jne 0x1400d96c0
jmp 0x1400d937e
lea rcx, [rsp + 0xd0]
mov rdx, rsi
mov r8, rdi
call fcn.1400976d0
mov rsi, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xd0]
mov r12, qword [rsp + 0xd8]
jmp 0x1400da179
mov edx, 8
mov rcx, r8
call fcn.1400024b0
ud2
call sub.kernel32.dll_GetLastError
mov rcx, r15
call sub.kernel32.dll_CloseHandle
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
ud2