Function at 0x140005b00
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Query environment variable
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0xa68
mov r15, rcx
xor ebx, ebx
movabs r10, 0xffffffffffffffff
mov rax, qword [0x140024c20]
mov esi, r9d
xor rax, rsp
mov r12, r8
mov qword [rsp + 0xa58], rax
mov r14, rdx
xor ebp, ebp
mov rdi, qword [rsp + 0xb00]
test r15, r15
mov qword [rsp + 0xa30], r10
mov qword [rsp + 0xa38], r10
mov qword [rsp + 0xa40], r10
mov qword [rsp + 0xa48], r10
mov qword [rsp + 0xa50], r10
je 0x1400070cc
test r14, r14
je 0x1400070cc
test r12, r12
je 0x1400070cc
mov r13, qword [rsp + 0xad8]
test r13, r13
je 0x1400070cc
mov rax, qword [rsp + 0xad0]
test rax, rax
mov qword [rsp + 0x50], rax
je 0x1400070cc
cmp dword [r15], 1
jne 0x1400064b5
cmp dword [r14], 1
je 0x140005c45
mov dword [r12], 0xeb
mov r13d, 0xa
mov dword [r12 + 0xd4], 0
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov word [r12 + 0x35], 0x6c
mov dword [r12 + 0x31], 0x64682064
mov dword [r12 + 0x2d], 0x657a696c
mov dword [r12 + 0x29], 0x61697469
mov dword [r12 + 0x25], 0x6e696e75
jmp 0x140006530
movabs rax, 0
mov edx, 0x100
mov dword [rsp + 0x958], eax
movabs rax, 0
mov qword [rsp + rdx + 0x850], rax
mov qword [rsp + rdx + 0x848], rax
mov qword [rsp + rdx + 0x840], rax
mov qword [rsp + rdx + 0x838], rax
sub rdx, 0x20
jne 0x140005c5b
mov rdx, qword [rsp + 0xae0]
test rdx, rdx
je 0x1400070b0
mov r8d, 0x104
lea rcx, [rsp + 0x858]
call qword [sym.imp.MSVCR100.dll_strncpy]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x454]
mov r9, qword [rsp + 0x50]
xor edx, edx
mov r8, r13
mov byte [rsp + 0x95b], 0
call qword [sym.imp.MSVCR100.dll__makepath]
lea rcx, [rsp + 0x454]
lea rdx, [rsp + 0xa00]
call qword [sym.imp.MSVCR100.dll__stat64i32]
cmp eax, 0xffffffff
je 0x140007020
mov edx, 0x20
lea rcx, [rsp + 0x454]
call qword [sym.imp.MSVCR100.dll_strchr]
test rax, rax
je 0x140005d75
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x404
call fcn.140018800
mov r8d, 0x104
lea rcx, [rsp + 0x454]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov r13d, eax
test r13d, r13d
je 0x140006f50
xor edx, edx
lea rcx, [rsp + 0x454]
mov r8d, 0x404
call fcn.140018800
movsxd r13, r13d
lea rcx, [rsp + 0x454]
mov r8, r13
lea rdx, [rsp + 0x50]
call qword [sym.imp.MSVCR100.dll_strncpy]
movsxd rcx, dword [rsp + 0xae8]
mov edx, 4
mov qword [rsp + 0x9a0], rcx
xor r13d, r13d
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [rsp + 0x9a8], rax
mov rax, qword [rsp + 0x9a8]
test rax, rax
jne 0x140006b4e
mov dword [r12], 0xed
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov dword [r12 + 0x35], 0x64656c
mov dword [r12 + 0x31], 0x69616620
mov dword [r12 + 0x2d], 0x6873616c
mov dword [r12 + 0x29], 0x53622063
mov dword [r12 + 0x25], 0x6f6c6c61
mov r13d, 0xed
test r13d, r13d
jne 0x1400064a7
xor eax, eax
xor r13d, r13d
mov qword [rsp + 0x978], rax
test rdi, rdi
mov qword [rsp + 0x970], rax
je 0x14000612d
mov r11d, dword [rsp + 0xaf8]
xor r8d, r8d
mov qword [rsp + 0x968], r8
xor r9d, r9d
test r11d, r11d
jle 0x140005ec0
mov r10, qword [rsp + 0x968]
mov rdx, qword [rdi + r10*8]
test rdx, rdx
je 0x140005eb8
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140005ea5
mov rax, rdx
add rdx, rcx
call fcn.140018880
inc r9d
lea rdx, [r8 + rax + 1]
inc r10
movsxd r8, edx
cmp r9d, r11d
jl 0x140005e74
mov qword [rsp + 0x968], r10
movsxd r11, r11d
cmp r11, qword [rsp + 0x968]
je 0x140005ed8
mov r13d, 5
jmp 0x140006150
and esi, 1
je 0x140005f7c
mov qword [rsp + 0x960], r8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov r8, qword [rsp + 0x960]
mov qword [rsp + 0x970], rax
mov r9, qword [rsp + 0x970]
test r9, r9
je 0x140005f7c
movsx eax, byte [r9]
test eax, eax
je 0x140005f7c
mov rdx, r9
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140005f3f
mov rax, rdx
add rdx, rcx
call fcn.140018880
mov rdx, r9
lea rcx, [r8 + rax + 1]
movsxd r8, ecx
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140005f72
mov rax, rdx
add rdx, rcx
call fcn.140018880
lea r9, [r9 + rax + 1]
test r9, r9
jne 0x140005f0c
add r8, 2
mov qword [rsp + 0x960], r8
mov rcx, r8
call qword [sym.imp.MSVCR100.dll_malloc]
mov r8, qword [rsp + 0x960]
mov qword [rsp + 0x978], rax
mov rax, qword [rsp + 0x978]
test rax, rax
je 0x140006ad6
xor edx, edx
mov rcx, qword [rsp + 0x978]
call fcn.140018800
mov rdx, qword [rsp + 0x968]
xor eax, eax
mov rbp, qword [rsp + 0x978]
test rdx, rdx
jle 0x14000605b
mov qword [rsp + 0x990], r14
mov qword [rsp + 0x9f8], r12
mov r12, rdi
mov r14, qword [rsp + 0x968]
mov rdi, rax
mov r8, qword [r12]
mov rcx, rbp
lea rdx, [0x14001e308]
call qword [sym.imp.MSVCR100.dll_sprintf]
mov rdx, qword [r12]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14000603a
mov rax, rdx
add rdx, rcx
call fcn.140018880
inc rdi
add r12, 8
cmp rdi, r14
lea rbp, [rbp + rax + 1]
jl 0x140005ffa
mov r14, qword [rsp + 0x990]
mov r12, qword [rsp + 0x9f8]
test esi, esi
je 0x140006109
mov r8, qword [rsp + 0x970]
test r8, r8
je 0x140006109
movsx eax, byte [r8]
test eax, eax
je 0x140006109
mov rdi, rbp
mov rdx, r8
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte [rdi]
dec rdi
mov al, byte [rdx]
inc rdx
mov byte [rdi], al
inc rdi
test al, al
jne 0x140006092
mov rdx, r8
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1400060cb
mov rax, rdx
add rdx, rcx
call fcn.140018880
mov rdx, r8
lea rbp, [rbp + rax + 1]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1400060fb
mov rax, rdx
add rdx, rcx
call fcn.140018880
lea r8, [r8 + rax + 1]
test r8, r8
jne 0x140006074
mov rdi, rbp
lea rdx, [0x14001e95c]
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte [rdi]
dec rdi
mov al, byte [rdx]
inc rdx
mov byte [rdi], al
inc rdi
test al, al
jne 0x14000611f
mov rbp, qword [rsp + 0x978]
mov rax, qword [rsp + 0x970]
test rax, rax
je 0x140006150
mov rcx, qword [rsp + 0x970]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
test r13d, r13d
jne 0x1400064a7
movabs rax, 0
mov qword [rsp + 0x9e0], rax
mov qword [rsp + 0x9e8], rax
mov qword [rsp + 0x9f0], rax
xor r9d, r9d
lea rcx, [rsp + 0xa30]
mov dword [rsp + 0x9e0], 0x18
lea rdx, [rsp + 0xa38]
mov qword [rsp + 0x9e8], 0
lea r8, [rsp + 0x9e0]
mov dword [rsp + 0x9f0], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140006a54
mov rax, qword [rsp + 0xa38]
mov qword [r14 + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
mov rcx, rsi
mov rdx, qword [rsp + 0xa30]
mov r8, rax
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0xa48]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x30], 2
call qword [sym.imp.orauts.dll_DuplicateHandle]
test eax, eax
je 0x1400069c3
mov rcx, qword [rsp + 0xa30]
test rcx, rcx
je 0x14000623c
cmp rcx, 0xffffffffffffffff
je 0x14000623c
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [rsp + 0xa30], 0xffffffffffffffff
mov rax, qword [rsp + 0xa48]
mov edi, dword [rsp + 0xb08]
test edi, edi
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0xffffffffffffffff
mov dword [r14 + 0x38], 0
jle 0x14000628c
xor r9d, r9d
lea rcx, [rsp + 0xa50]
lea rdx, [rsp + 0xa40]
lea r8, [rsp + 0x9e0]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14000692e
movabs rax, 0
mov edx, 0x60
mov qword [rsp + 0x9c0], rax
movabs rax, 0
mov qword [rsp + rdx + 0x958], rax
mov qword [rsp + rdx + 0x950], rax
mov qword [rsp + rdx + 0x948], rax
mov qword [rsp + rdx + 0x940], rax
sub rdx, 0x20
jne 0x1400062a3
mov rdx, qword [rsp + 0xa38]
xor eax, eax
mov word [rsp + 0x9a0], ax
or dword [rsp + 0x99c], 0x100
mov rax, qword [rsp + 0xa50]
cmp rax, 0xffffffffffffffff
mov dword [rsp + 0x960], 0x68
mov qword [rsp + 0x9b8], rdx
mov qword [rsp + 0x9c0], rdx
je 0x140006337
mov qword [rsp + 0x9b0], rax
mov rax, qword [rsp + 0xa40]
mov qword [r14 + 0x28], rax
mov rax, qword [rsp + 0xa50]
jmp 0x140006349
mov qword [r14 + 0x28], 0xffffffffffffffff
movabs rax, 0xffffffffffffffff
xor ecx, ecx
mov rdx, rbx
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x8000000
xor r9d, r9d
mov qword [r14 + 0x30], rax
lea rax, [rsp + 0x858]
mov qword [rsp + 0x30], rbp
lea rsi, [rsp + 0x960]
mov qword [rsp + 0x38], rax
lea r10, [rsp + 0x9c8]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r10
call qword [sym.imp.orauts.dll_CreateProcessA]
test eax, eax
je 0x1400068a3
mov rax, qword [rsp + 0x9c8]
mov qword [r14 + 0x18], rax
mov dword [r14], 5
mov rcx, qword [rsp + 0x9d0]
cmp rcx, 0xffffffffffffffff
je 0x1400063c9
call qword [sym.imp.orauts.dll_CloseHandle]
cmp qword [rsp + 0xa40], 0xffffffffffffffff
je 0x1400064a7
mov dword [rsp + 0x95c], 0
xor eax, eax
test edi, edi
jle 0x1400064a7
mov rsi, qword [rsp + 0xb10]
movsxd rdi, edi
mov qword [rsp + 0x9f8], r12
mov r12, rax
mov r9, qword [rsi + r12*8]
mov rdx, r9
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140006432
mov rax, rdx
add rdx, rcx
call fcn.140018880
mov rdx, r9
mov rcx, qword [rsp + 0xa40]
mov r8d, eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x95c]
call qword [sym.imp.orauts.dll_WriteFile]
test eax, eax
je 0x1400067f5
mov rcx, qword [rsp + 0xa40]
lea rdx, [0x14001e948]
mov r8d, 1
lea r9, [rsp + 0x95c]
mov qword [rsp + 0x20], 0
call qword [sym.imp.orauts.dll_WriteFile]
test eax, eax
je 0x140006723
inc r12
cmp r12, rdi
jl 0x140006403
mov r12, qword [rsp + 0x9f8]
test r13d, r13d
jne 0x140006530
jmp 0x1400066e0
mov dword [r12], 0xeb
mov r13d, 6
mov dword [r12 + 0xd4], 0
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov word [r12 + 0x35], 0x78
mov dword [r12 + 0x31], 0x74632064
mov dword [r12 + 0x2d], 0x657a696c
mov dword [r12 + 0x29], 0x61697469
mov dword [r12 + 0x25], 0x6e696e75
mov rcx, qword [rsp + 0xa38]
test rcx, rcx
je 0x140006551
cmp rcx, 0xffffffffffffffff
je 0x140006551
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [r14 + 0x20], 0xffffffffffffffff
mov rcx, qword [rsp + 0xa30]
test rcx, rcx
je 0x14000656a
cmp rcx, 0xffffffffffffffff
je 0x14000656a
call qword [sym.imp.orauts.dll_CloseHandle]
mov rcx, qword [rsp + 0xa48]
test rcx, rcx
je 0x14000658b
cmp rcx, 0xffffffffffffffff
je 0x14000658b
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [r14 + 8], 0xffffffffffffffff
mov rcx, qword [rsp + 0xa40]
test rcx, rcx
je 0x1400065ac
cmp rcx, 0xffffffffffffffff
je 0x1400065ac
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [r14 + 0x28], 0xffffffffffffffff
mov rcx, qword [rsp + 0xa50]
test rcx, rcx
je 0x1400065cd
cmp rcx, 0xffffffffffffffff
je 0x1400065cd
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [r14 + 0x30], 0xffffffffffffffff
test r15, r15
je 0x1400066e0
test r14, r14
je 0x1400066e0
test byte [r15], 1
je 0x14000665b
mov rcx, qword [r14 + 8]
cmp rcx, 0xffffffffffffffff
je 0x140006602
test rcx, rcx
je 0x140006602
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [r14 + 8], 0xffffffffffffffff
mov rcx, qword [r14 + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14000661f
test rcx, rcx
je 0x14000661f
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [r14 + 0x10], 0xffffffffffffffff
mov rcx, qword [r14 + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x140006637
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [r14 + 0x28], 0xffffffffffffffff
mov rcx, qword [r14 + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x14000664f
call qword [sym.imp.orauts.dll_CloseHandle]
mov qword [r14 + 0x30], 0xffffffffffffffff
mov dword [r14], 2
jmp 0x1400066e0
mov dword [r12], 0xeb
mov dword [r12 + 0xd4], 0
mov byte [r12 + 0x20], 0
mov dword [r12 + 0x1c], 0x74757074
mov dword [r12 + 0x18], 0x756f5f65
mov dword [r12 + 0x14], 0x736f6c63
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov word [r12 + 0x35], 0x78
mov dword [r12 + 0x31], 0x74632064
mov dword [r12 + 0x2d], 0x657a696c
mov dword [r12 + 0x29], 0x61697469
mov dword [r12 + 0x25], 0x6e696e75
test rbp, rbp
je 0x1400066ee
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_free]
test rbx, rbx
je 0x1400066fc
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
mov rcx, qword [rsp + 0xa58]
xor rcx, rsp
call fcn.14001c150
mov eax, r13d
add rsp, 0xa68
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r12, qword [rsp + 0x9f8]
mov r13d, 0xed
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12], 0xed
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov word [r12 + 0x55], 0x6e
mov dword [r12 + 0x51], 0x5c20676e
mov dword [r12 + 0x4d], 0x69746972
mov dword [r12 + 0x49], 0x7720656c
mov dword [r12 + 0x45], 0x69687720
mov dword [r12 + 0x41], 0x64656c69
mov dword [r12 + 0x3d], 0x61662073
mov dword [r12 + 0x39], 0x7365636f
mov dword [r12 + 0x35], 0x72702066
mov dword [r12 + 0x31], 0x6f206e69
mov dword [r12 + 0x2d], 0x64747320
mov dword [r12 + 0x29], 0x6f742065
mov dword [r12 + 0x25], 0x74697257
jmp 0x140006530
mov r12, qword [rsp + 0x9f8]
mov r13d, 0xed
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12], 0xed
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov word [r12 + 0x45], 0x2e
mov dword [r12 + 0x41], 0x64656c69
mov dword [r12 + 0x3d], 0x61662073
mov dword [r12 + 0x39], 0x7365636f
mov dword [r12 + 0x35], 0x72702066
mov dword [r12 + 0x31], 0x6f206e69
mov dword [r12 + 0x2d], 0x64747320
mov dword [r12 + 0x29], 0x6f742065
mov dword [r12 + 0x25], 0x74697257
jmp 0x140006530
mov r13d, 0xed
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12], 0xed
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov word [r12 + 0x39], 0x2e
mov dword [r12 + 0x35], 0x64656c69
mov dword [r12 + 0x31], 0x61662073
mov dword [r12 + 0x2d], 0x7365636f
mov dword [r12 + 0x29], 0x72506574
mov dword [r12 + 0x25], 0x61657243
jmp 0x140006530
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12], 0xed
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov dword [r12 + 0x3d], 0x64656c
mov dword [r12 + 0x39], 0x69616620
mov dword [r12 + 0x35], 0x6e696474
mov dword [r12 + 0x31], 0x7320726f
mov dword [r12 + 0x2d], 0x66206570
mov dword [r12 + 0x29], 0x69506574
mov dword [r12 + 0x25], 0x61657243
mov r13d, 0xed
jmp 0x140006530
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12], 0xed
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov byte [r12 + 0x3b], 0
mov word [r12 + 0x39], 0x6465
mov dword [r12 + 0x35], 0x6c696166
mov dword [r12 + 0x31], 0x20656c64
mov dword [r12 + 0x2d], 0x6e614865
mov dword [r12 + 0x29], 0x74616369
mov dword [r12 + 0x25], 0x6c707544
mov r13d, 0xed
jmp 0x140006530
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12], 0xed
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov word [r12 + 0x35], 0x64
mov dword [r12 + 0x31], 0x656c6961
mov dword [r12 + 0x2d], 0x66206570
mov dword [r12 + 0x29], 0x69506574
mov dword [r12 + 0x25], 0x61657243
mov r13d, 0xed
jmp 0x140006530
mov dword [r12], 0xed
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12 + 0xd4], eax
mov byte [r12 + 0x14], 0
mov dword [r12 + 0x10], 0x766e655f
mov dword [r12 + 0xc], 0x656b616d
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov byte [r12 + 0x39], 0
mov dword [r12 + 0x35], 0x64656c69
mov dword [r12 + 0x31], 0x61662064
mov dword [r12 + 0x2d], 0x6d632072
mov dword [r12 + 0x29], 0x6f662063
mov dword [r12 + 0x25], 0x6f6c6c61
jmp 0x140006135
lea rcx, [rsp + 0x454]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140006b70
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140006b58
dec rax
add rax, 4
xor edx, edx
mov rcx, qword [rsp + 0x9a0]
test rcx, rcx
jle 0x140006c4d
mov qword [rsp + 0x968], rdi
mov qword [rsp + 0x990], r14
mov qword [rsp + 0x9f8], r12
mov dword [rsp + 0x978], esi
mov dword [rsp + 0x970], r13d
mov r13, rbp
mov qword [rsp + 0x960], r15
mov ebp, eax
mov r14, qword [rsp + 0xaf0]
mov r15, rdx
mov r12, qword [rsp + 0x9a8]
mov rdi, qword [rsp + 0x9a0]
mov rsi, qword [r14 + r15*8]
mov rcx, rsi
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140006bf7
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140006bdf
dec rax
movsxd rcx, eax
cmp byte [rcx + rsi - 1], 0x5c
je 0x140006f3f
mov dword [r12 + r15*4], 0
lea ebp, [rbp + rcx + 4]
inc r15
cmp r15, rdi
jl 0x140006bd6
mov esi, dword [rsp + 0x978]
mov eax, ebp
mov rdi, qword [rsp + 0x968]
mov rbp, r13
mov r13d, dword [rsp + 0x970]
mov r15, qword [rsp + 0x960]
mov r14, qword [rsp + 0x990]
mov r12, qword [rsp + 0x9f8]
movsxd rax, eax
mov edx, 1
mov qword [rsp + 0x988], rax
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [rsp + 0x980], rax
mov rcx, qword [rsp + 0x988]
mov edx, 1
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [rsp + 0x998], rax
mov rax, qword [rsp + 0x980]
test rax, rax
je 0x140006ea5
mov rax, qword [rsp + 0x998]
test rax, rax
je 0x140006ea5
mov rcx, qword [rsp + 0x980]
lea rdx, [0x14001e94c]
lea r8, [rsp + 0x454]
call qword [sym.imp.MSVCR100.dll_sprintf]
mov rdx, qword [rsp + 0x9a0]
xor eax, eax
test rdx, rdx
jle 0x140006e53
mov qword [rsp + 0x960], r15
lea rbx, [0x14001e950]
mov qword [rsp + 0x990], r14
mov qword [rsp + 0x9f8], r12
mov dword [rsp + 0x978], esi
mov dword [rsp + 0x970], r13d
mov r13, rbp
mov qword [rsp + 0x968], rdi
mov rbp, rax
mov r12, qword [rsp + 0x998]
mov r14, qword [rsp + 0x9a0]
mov r15, qword [rsp + 0xaf0]
mov rsi, r12
mov rdi, qword [r15 + rbp*8]
mov dl, byte [rdi]
inc rdi
mov byte [rsi], dl
inc rsi
test dl, dl
jne 0x140006d36
mov rcx, r12
mov rdx, rbx
call qword [sym.imp.MSVCR100.dll_strtok]
mov r8, rax
test r8, r8
je 0x140006e15
lea rax, [0x14001e958]
mov qword [rsp + 0x988], r13
mov r15, rax
mov r14, qword [rsp + 0x980]
mov r13, qword [rsp + 0x9a8]
mov rdi, r14
mov rdx, rbx
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte [rdi]
dec rdi
mov al, byte [rdx]
inc rdx
mov byte [rdi], al
inc rdi
test al, al
jne 0x140006d90
mov rdi, r14
mov rdx, r8
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte [rdi]
dec rdi
mov al, byte [rdx]
inc rdx
mov byte [rdi], al
inc rdi
test al, al
jne 0x140006db0
cmp dword [r13 + rbp*4], 1
je 0x140006e7c
mov rdi, r14
mov rdx, r15
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte [rdi]
dec rdi
mov al, byte [rdx]
inc rdx
mov byte [rdi], al
inc rdi
test al, al
jne 0x140006ddc
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.MSVCR100.dll_strtok]
mov r8, rax
test r8, r8
jne 0x140006d7e
mov r15, qword [rsp + 0xaf0]
mov r13, qword [rsp + 0x988]
mov r14, qword [rsp + 0x9a0]
inc rbp
cmp rbp, r14
jl 0x140006d2f
mov esi, dword [rsp + 0x978]
mov rbp, r13
mov r13d, dword [rsp + 0x970]
mov rdi, qword [rsp + 0x968]
mov r15, qword [rsp + 0x960]
mov r14, qword [rsp + 0x990]
mov r12, qword [rsp + 0x9f8]
mov rbx, qword [rsp + 0x980]
mov rcx, qword [rsp + 0x998]
call qword [sym.imp.MSVCR100.dll_free]
mov rcx, qword [rsp + 0x9a8]
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x140005e2a
lea rdx, [0x14001e954]
mov rdi, r14
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte [rdi]
dec rdi
mov al, byte [rdx]
inc rdx
mov byte [rdi], al
inc rdi
test al, al
jne 0x140006e92
jmp 0x140006dca
mov dword [r12], 0xed
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov byte [r12 + 0x39], 0
mov dword [r12 + 0x35], 0x64656c69
mov dword [r12 + 0x31], 0x61662064
mov dword [r12 + 0x2d], 0x6d632072
mov dword [r12 + 0x29], 0x6f662063
mov dword [r12 + 0x25], 0x6f6c6c61
mov rax, qword [rsp + 0x998]
mov r13d, 0xed
test rax, rax
jne 0x140006e5b
jmp 0x140006e69
mov dword [r12 + r15*4], 1
lea ebp, [rbp + rcx + 5]
jmp 0x140006c11
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [r12], 0xed
mov dword [r12 + 0xd4], eax
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov byte [r12 + 0x57], 0
mov word [r12 + 0x55], 0x6d72
mov dword [r12 + 0x51], 0x6f662068
mov dword [r12 + 0x4d], 0x74617020
mov dword [r12 + 0x49], 0x74726f68
mov dword [r12 + 0x45], 0x73206f74
mov dword [r12 + 0x41], 0x20687461
mov dword [r12 + 0x3d], 0x70206365
mov dword [r12 + 0x39], 0x78652065
mov dword [r12 + 0x35], 0x68742074
mov dword [r12 + 0x31], 0x7265766e
mov dword [r12 + 0x2d], 0x6f63206f
mov dword [r12 + 0x29], 0x74206465
mov dword [r12 + 0x25], 0x6c696166
mov r13d, 0xed
jmp 0x140006530
mov dword [r12], 0xeb
mov r13d, 9
mov dword [r12 + 0xd4], 0
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov byte [r12 + 0x3d], 0
mov dword [r12 + 0x39], 0x74736978
mov dword [r12 + 0x35], 0x65207427
mov dword [r12 + 0x31], 0x6e73656f
mov dword [r12 + 0x2d], 0x6420656c
mov dword [r12 + 0x29], 0x62617475
mov dword [r12 + 0x25], 0x63657865
jmp 0x140006530
mov rdx, r13
lea rcx, [rsp + 0x858]
mov r8d, 0x104
call qword [sym.imp.MSVCR100.dll_strncpy]
jmp 0x140005cb0
mov dword [r12], 0xeb
mov r13d, 5
mov dword [r12 + 0xd4], 0
mov word [r12 + 0x18], 0x6e
mov dword [r12 + 0x14], 0x77617073
mov dword [r12 + 0x10], 0x5f737365
mov dword [r12 + 0xc], 0x636f7270
mov dword [r12 + 8], 0x5f73706d
mov dword [r12 + 4], 0x76727073
mov word [r12 + 0x2d], 0x2e
mov dword [r12 + 0x29], 0x73677261
mov dword [r12 + 0x25], 0x20646162
jmp 0x140006530