Function at 0x14014cae0
Capabilities:
Check if file exists
Create process on windows
Encode data using base64
Get common file path
Get file attributes
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5f8
movaps xmmword [rsp + 0x5e0], xmm6
mov rbx, rdx
mov qword [rsp + 0x1c0], rcx
mov dword [rsp + 0x1c8], 0
movzx eax, byte [rdx + 0xa0]
test al, al
sete cl
mov rdx, qword [rdx + 0x98]
test rdx, rdx
sete bpl
and bpl, cl
je 0x14014cb38
xor r14d, r14d
jmp 0x14014d94c
mov byte [rsp + 0x60], bpl
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xc0], 0
test al, al
mov qword [rsp + 0x78], rbx
jne 0x14014cd79
mov qword [rsp + 0x58], rdx
call sub.KERNEL32.dll_GetEnvironmentStringsW
test rax, rax
je 0x14014f83c
mov rsi, rax
lea rbx, [rsp + 0x200]
lea r12, [rsp + 0xd0]
lea r15, [rsp + 0x1e0]
mov rbp, rax
nop word cs:[rax + rax]
cmp word [rbp], 0
je 0x14014cd67
mov rdi, rbp
mov r14, 0xffffffffffffffff
mov rcx, 0xfffffffffffffffe
nop dword [rax]
mov rax, rcx
cmp word [rdi + r14*2 + 2], 0
lea r14, [r14 + 1]
lea rcx, [rcx + 2]
jne 0x14014cbc0
lea rbp, [rdi + r14*2]
add rbp, 2
cmp r14, 1
je 0x14014cba0
test r14, r14
je 0x14014f64f
xor r13d, r13d
nop
cmp word [rdi + r13*2 + 2], 0x3d
je 0x14014cc10
inc r13
add rax, 0xfffffffffffffffe
jne 0x14014cbf0
jmp 0x14014cba0
cmp r13, r14
jae 0x14014f64f
lea r8, [r13 + 1]
mov rcx, r12
mov rdx, rdi
call fcn.140154120
add r13, 2
sub r14, r13
jb 0x14014f64f
lea rdx, [rdi + r13*2]
mov rcx, rbx
mov r8, r14
call fcn.140154120
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x1f0], xmm1
movaps xmmword [rsp + 0x1e0], xmm0
mov rdi, qword [rsp + 0x1e0]
mov r14, qword [rsp + 0x1e8]
mov r13, qword [rsp + 0x1f0]
movdqu xmm0, xmmword [rbx - 8]
movdqu xmm1, xmmword [rbx + 8]
movdqa xmmword [rsp + 0x120], xmm0
movdqa xmmword [rsp + 0x130], xmm1
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x140], rax
movabs rax, 0x8000000000000000
cmp rdi, rax
je 0x14014cd67
lea rax, [r14 + r13]
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xd8], rax
mov word [rsp + 0xe0], 0
lea rcx, [rsp + 0x200]
mov rdx, r12
call fcn.140153f60
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x1e8], r14
mov qword [rsp + 0x1f0], r13
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x1f8], rax
mov rcx, r12
lea rdx, [rsp + 0xb0]
mov r8, r15
lea r9, [rsp + 0x128]
call fcn.1401510f0
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14014cba0
test rax, rax
je 0x14014cba0
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x14014cba0
mov rcx, rsi
call sub.KERNEL32.dll_FreeEnvironmentStringsW
mov rbx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rbx + 0x88]
mov rcx, qword [rbx + 0x90]
mov qword [rsp + 0x70], rcx
xor ecx, ecx
test rax, rax
setne cl
mov qword [rsp + 0xc8], rcx
cmove rdx, rax
mov qword [rsp + 0x58], rdx
xor ebp, ebp
jmp 0x14014cdb2
xor eax, eax
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x14014d789
cmp qword [rsp + 0xc8], 0
je 0x14014f64f
test rbp, rbp
mov r14, qword [rsp + 0x70]
je 0x14014ce00
movzx ecx, word [rbp + 0x3d2]
cmp r14, rcx
jae 0x14014ceb0
mov rbx, rbp
jmp 0x14014ced8
mov ecx, 1
mov qword [rsp + 0xc8], rcx
test r14, r14
je 0x14014ce3d
mov rcx, r14
and rcx, 7
je 0x14014ce42
mov rbp, rax
xor eax, eax
mov rbp, qword [rbp + 0x3d8]
inc rax
cmp rcx, rax
jne 0x14014ce20
mov rcx, r14
sub rcx, rax
cmp r14, 8
jae 0x14014ce50
jmp 0x14014ce8e
mov rbp, rax
jmp 0x14014ce8e
mov rcx, r14
mov rbp, rax
cmp r14, 8
jb 0x14014ce8e
nop
mov rax, qword [rbp + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rbp, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14014ce50
xor r14d, r14d
xor eax, eax
movzx ecx, word [rbp + 0x3d2]
cmp r14, rcx
jb 0x14014cde9
nop word cs:[rax + rax]
mov rbx, qword [rbp + 0x160]
test rbx, rbx
je 0x14014f64f
inc rax
movzx r14d, word [rbp + 0x3d0]
mov rbp, rbx
cmp r14w, word [rbx + 0x3d2]
jae 0x14014ceb0
test rax, rax
je 0x14014cf70
mov rbp, qword [rbx + r14*8 + 0x3e0]
mov rcx, rax
dec rcx
je 0x14014cf5e
mov rdx, rcx
and rdx, 7
je 0x14014cf12
xor r8d, r8d
nop dword [rax]
mov rbp, qword [rbp + 0x3d8]
inc r8
cmp rdx, r8
jne 0x14014cf00
sub rcx, r8
add rax, 0xfffffffffffffffe
cmp rax, 7
jb 0x14014cf5e
nop dword [rax]
mov rax, qword [rbp + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rbp, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14014cf20
xor eax, eax
mov qword [rsp + 0x70], rax
jmp 0x14014cf7c
lea rax, [r14 + 1]
mov qword [rsp + 0x70], rax
mov rbp, rbx
dec rsi
imul rax, r14, 0x38
lea r12, [rbx + rax]
add r12, 0x168
shl r14, 5
movabs rax, 0x8000000000000000
cmp qword [rbx + r14], rax
mov qword [rsp + 0x58], rsi
jne 0x14014d080
mov r15, qword [rsp + 0xb0]
mov eax, 0
test r15, r15
je 0x14014cdb2
mov rbx, qword [rsp + 0xb8]
lea eax, [rbx + 7]
mov dword [rsp + 0x68], eax
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x190], r15
lea rdi, [r15 + 0x168]
movzx r13d, word [r15 + 0x3d2]
imul r14, r13, 0x38
xor esi, esi
test r14, r14
je 0x14014d044
nop word cs:[rax + rax]
mov rcx, qword [r12 + 0x28]
mov edx, dword [r12 + 0x30]
mov r8, qword [rdi + 0x28]
mov r9d, dword [rdi + 0x30]
mov dword [rsp + 0x20], 1
call sub.KERNEL32.dll_CompareStringOrdinal
cmp eax, 3
jne 0x14014d050
inc rsi
add rdi, 0x38
add r14, 0xffffffffffffffc8
test r14, r14
jne 0x14014d010
mov rsi, r13
jmp 0x14014d055
cmp eax, 1
jne 0x14014d0d0
test rbx, rbx
je 0x14014d782
mov r15, qword [r15 + rsi*8 + 0x3d8]
dec rbx
inc qword [rsp + 0xa0]
mov eax, dword [rsp + 0x68]
add al, 7
mov dword [rsp + 0x68], eax
jmp 0x14014cfea
mov r15, qword [r12 + 8]
mov r13, qword [r12 + 0x10]
test r13, r13
je 0x14014d2cc
js 0x14014f64f
movzx eax, byte [0x141af8129]
xor ecx, ecx
mov rdx, r13
call fcn.140146820
test rax, rax
je 0x14014f64f
mov rdi, rax
mov rax, r13
mov qword [rsp + 0xa8], r13
jmp 0x14014d2db
cmp eax, 2
jne 0x14014f83c
mov byte [rsp + 0x57], 0
test rbx, rbx
je 0x14014d47e
mov rax, qword [r15 + rsi*8 + 0x3d8]
mov rcx, rbx
dec rcx
je 0x14014d1ce
test cl, 7
je 0x14014d136
movzx ecx, byte [rsp + 0x68]
and ecx, 7
neg rcx
mov edx, 1
movzx r8d, word [rax + 0x3d2]
mov rax, qword [rax + r8*8 + 0x3d8]
lea r8, [rcx + rdx]
inc r8
inc rdx
cmp r8, 1
jne 0x14014d110
sub rbx, rdx
mov rcx, rbx
mov rdx, qword [rsp + 0xa8]
sub rdx, qword [rsp + 0xa0]
add rdx, 0xfffffffffffffffe
cmp rdx, 7
jb 0x14014d1ce
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14014d150
movzx ecx, word [rax + 0x3d2]
dec rcx
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], rcx
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x108]
lea r8, [rsp + 0x57]
call fcn.140144e80
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0x1e0]
movups xmm1, xmmword [rsp + 0x1f0]
movdqu xmm2, xmmword [rsp + 0x200]
movdqa xmmword [rsp + 0xf0], xmm2
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xd0], xmm0
lea rax, [rsp + 0x218]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x90], xmm1
mov r8, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x240]
mov rdx, qword [rsp + 0x248]
movzx eax, word [r8 + 0x3d2]
cmp rdx, rax
jae 0x14014d2a0
mov rax, r8
jmp 0x14014d4c1
mov rax, qword [r8 + 0x160]
test rax, rax
je 0x14014d4b9
inc rcx
movzx edx, word [r8 + 0x3d0]
mov r8, rax
cmp dx, word [rax + 0x3d2]
jae 0x14014d2a0
jmp 0x14014d4c1
mov edi, 1
xor eax, eax
mov qword [rsp + 0xa8], rax
mov rcx, rdi
mov rdx, r15
mov qword [rsp + 0x68], r13
mov r8, r13
call sub.msvcrt.dll_memcpy
movzx eax, byte [r12 + 0x18]
mov byte [rsp + 0xa0], al
mov rdx, qword [r12 + 0x28]
mov r15, qword [r12 + 0x30]
test r15, r15
je 0x14014d346
mov rax, r15
shr rax, 0x3e
jne 0x14014f64f
mov rsi, rdx
lea r12, [r15 + r15]
movzx eax, byte [0x141af8129]
xor ecx, ecx
mov rdx, r12
call fcn.140146820
test rax, rax
je 0x14014f64f
mov r13, rax
mov rax, r15
mov rdx, rsi
mov rsi, r15
jmp 0x14014d351
mov r13d, 2
xor r12d, r12d
xor esi, esi
add rbx, r14
mov rcx, r13
mov r8, r12
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], r13
mov qword [rsp + 0x210], r15
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rdi
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x1f0], rax
movzx eax, byte [rsp + 0xa0]
mov byte [rsp + 0x1f8], al
mov rdi, qword [rbx + 8]
mov rsi, qword [rbx + 0x10]
test rsi, rsi
je 0x14014d3e0
js 0x14014f64f
movzx eax, byte [0x141af8129]
xor ecx, ecx
mov rdx, rsi
call fcn.140146820
test rax, rax
je 0x14014f64f
mov r15, rax
mov r14, rsi
jmp 0x14014d3e9
mov r15d, 1
xor r14d, r14d
mov rcx, r15
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x120], r14
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x130], rsi
movzx eax, byte [rbx + 0x18]
mov byte [rsp + 0x138], al
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x1e0]
lea r9, [rsp + 0x120]
call fcn.1401510f0
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14014cdb0
test rax, rax
je 0x14014cdb0
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x14014cdb0
mov qword [rsp + 0x120], r15
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], rsi
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x120]
lea r8, [rsp + 0x57]
call fcn.140144e80
jmp 0x14014d68a
mov rdx, rcx
mov rcx, r8
xor eax, eax
imul r8, rdx, 0x38
mov r9, rdx
shl r9, 5
mov r10, qword [rax + r8 + 0x198]
mov qword [rsp + 0x150], r10
movups xmm0, xmmword [rax + r8 + 0x168]
movups xmm1, xmmword [rax + r8 + 0x178]
movups xmm2, xmmword [rax + r8 + 0x188]
movaps xmmword [rsp + 0x140], xmm2
movaps xmmword [rsp + 0x130], xmm1
movaps xmmword [rsp + 0x120], xmm0
mov r10, qword [rsp + 0x100]
mov qword [rax + r8 + 0x198], r10
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmm1, xmmword [rsp + 0xe0]
movdqa xmm2, xmmword [rsp + 0xf0]
movdqu xmmword [rax + r8 + 0x188], xmm2
movups xmmword [rax + r8 + 0x178], xmm1
movups xmmword [rax + r8 + 0x168], xmm0
movups xmm0, xmmword [rax + r9]
movups xmm1, xmmword [rax + r9 + 0x10]
lea r8, [rsp + 0x158]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
movdqa xmm0, xmmword [rsp + 0x80]
movdqa xmm1, xmmword [rsp + 0x90]
movdqu xmmword [rax + r9], xmm0
movdqu xmmword [rax + r9 + 0x10], xmm1
test rcx, rcx
je 0x14014d60e
mov rax, qword [rax + rdx*8 + 0x3e0]
mov rdx, rcx
dec rdx
je 0x14014d60e
mov r8, rdx
and r8, 7
je 0x14014d5c2
xor r9d, r9d
mov rax, qword [rax + 0x3d8]
inc r9
cmp r8, r9
jne 0x14014d5b0
sub rdx, r9
add rcx, 0xfffffffffffffffe
cmp rcx, 7
jb 0x14014d60e
nop dword [rax]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
add rdx, 0xfffffffffffffff8
jne 0x14014d5d0
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x230], rcx
movaps xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x220], xmm0
movdqa xmm0, xmmword [rsp + 0x120]
movdqa xmm1, xmmword [rsp + 0x130]
movdqa xmm2, xmmword [rsp + 0x140]
movdqa xmm3, xmmword [rsp + 0x150]
movdqa xmmword [rsp + 0x210], xmm3
movdqa xmmword [rsp + 0x200], xmm2
movdqa xmmword [rsp + 0x1f0], xmm1
movdqa xmmword [rsp + 0x1e0], xmm0
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x240], 0
mov r14, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x200]
mov r12, qword [rsp + 0x208]
dec qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x218]
mov rdi, qword [rsp + 0x220]
cmp byte [rsp + 0x57], 0
je 0x14014d715
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x14014f64f
mov r8, qword [rsp + 0x190]
mov rax, qword [r8 + 0x3d8]
mov qword [rsp + 0xb0], rax
dec rcx
mov qword [rsp + 0xb8], rcx
mov qword [rax + 0x160], 0
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov eax, 0
movabs rcx, 0x8000000000000000
cmp r14, rcx
je 0x14014cdb2
test r14, r14
je 0x14014d743
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
test rsi, rsi
je 0x14014d759
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
shl rbx, 1
mov eax, 0
test rbx, rbx
je 0x14014cdb2
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
xor eax, eax
jmp 0x14014cdb2
xor eax, eax
jmp 0x14014cdb2
mov r14, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
movzx eax, byte [0x141af8129]
mov edx, 4
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x14014f64f
mov r12, rax
mov qword [rsp + 0x68], rsi
mov dword [rax], 0x48544150
add rax, 4
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x128], rax
mov word [rsp + 0x130], 0
lea rcx, [rsp + 0x200]
lea rdx, [rsp + 0x120]
call fcn.140153f60
mov qword [rsp + 0x1e0], 4
mov qword [rsp + 0x1e8], r12
mov qword [rsp + 0x1f0], 4
mov byte [rsp + 0x1f8], 0
test r14, r14
mov qword [rsp + 0xc8], r15
mov qword [rsp + 0x70], r14
je 0x14014d904
mov qword [rsp + 0xa0], r12
mov rdi, qword [rsp + 0x208]
mov ebx, dword [rsp + 0x210]
xor eax, eax
mov qword [rsp + 0x58], rax
lea r12, [r14 + 0x168]
movzx ebp, word [r14 + 0x3d2]
imul rsi, rbp, 0x38
xor r13d, r13d
test rsi, rsi
je 0x14014d8b1
nop word cs:[rax + rax]
mov r8, qword [r12 + 0x28]
mov r9d, dword [r12 + 0x30]
mov dword [rsp + 0x20], 1
mov rcx, rdi
mov edx, ebx
call sub.KERNEL32.dll_CompareStringOrdinal
cmp eax, 3
jne 0x14014d8c0
inc r13
add r12, 0x38
add rsi, 0xffffffffffffffc8
test rsi, rsi
jne 0x14014d880
mov r13, rbp
jmp 0x14014d8c5
cmp eax, 1
jne 0x14014d8d9
sub r15, 1
jb 0x14014e2db
mov r14, qword [r14 + r13*8 + 0x3d8]
jmp 0x14014d85a
cmp eax, 2
jne 0x14014f83c
shl r13, 5
mov rax, qword [r14 + r13 + 8]
mov qword [rsp + 0x58], rax
mov rdi, qword [r14 + r13 + 0x10]
mov rbx, qword [rsp + 0x78]
mov r12, qword [rsp + 0xa0]
jmp 0x14014d910
xor eax, eax
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x78]
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x200], 0
movzx ebp, byte [rsp + 0x60]
je 0x14014d947
mov r8, qword [rsp + 0x208]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r14, qword [rsp + 0x58]
mov r15, qword [rbx + 8]
mov rsi, qword [rbx + 0x10]
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], rsi
lea r13, [0x141a7ac88]
test rsi, rsi
je 0x14014e1e0
cmp rsi, 4
jae 0x14014d992
lea rax, [0x14014a8e0]
movzx ecx, byte [rsi + r15 - 1]
call rax
test al, al
je 0x14014d9cb
jmp 0x14014e1e0
mov eax, dword [r15]
bswap eax
xor ecx, ecx
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
adc ecx, 0xffffffff
lea rcx, [0x14014a8d0]
lea rax, [0x14014a8e0]
cmove rax, rcx
movzx ecx, byte [rsi + r15 - 1]
call rax
test al, al
jne 0x14014e1e0
cmp rsi, 3
jbe 0x14014daba
add r15, rsi
lea rax, [r15 - 4]
mov rcx, r15
sub rcx, rax
cmp rcx, 4
mov eax, 4
cmovb rax, rcx
movzx ecx, byte [r15 - 4]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x2e
jne 0x14014dad9
movzx ecx, byte [r15 - 3]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
mov ecx, 1
cmp dl, 0x65
jne 0x14014da64
movzx ecx, byte [r15 - 2]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
mov ecx, 2
cmp dl, 0x78
jne 0x14014da64
movzx ecx, byte [r15 - 1]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
xor ecx, ecx
cmp dl, 0x65
sete cl
add rcx, 3
mov r15, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
xor edx, edx
nop word cs:[rax + rax]
cmp rsi, rdx
je 0x14014db3e
movzx r8d, byte [r15 + rdx]
cmp r8d, 0x2f
je 0x14014da9d
inc rdx
cmp r8d, 0x5c
jne 0x14014da80
cmp rcx, rax
jb 0x14014db07
lea rcx, [rsp + 0x108]
mov rdx, r15
mov r8, rsi
call fcn.1401481b0
jmp 0x14014de3d
xor eax, eax
nop dword [rax]
cmp rsi, rax
je 0x14014db3e
movzx ecx, byte [r15 + rax]
cmp ecx, 0x2f
je 0x14014db07
inc rax
cmp ecx, 0x5c
jne 0x14014dac0
jmp 0x14014db07
mov r15, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
xor eax, eax
nop dword [rax + rax]
cmp rsi, rax
je 0x14014db3e
movzx ecx, byte [r15 + rax]
cmp ecx, 0x2f
je 0x14014db07
inc rax
cmp ecx, 0x5c
jne 0x14014daf0
test rsi, rsi
je 0x14014dc26
js 0x14014f64f
mov r13, rbx
movzx eax, byte [0x141af8129]
xor ecx, ecx
mov rdx, rsi
call fcn.140146820
test rax, rax
je 0x14014f64f
mov rdi, rax
mov rbx, rsi
jmp 0x14014dc30
lea rax, [r15 + rsi]
xor r9d, r9d
lea r13, [0x141a7ac48]
mov rcx, r15
jmp 0x14014db6c
xor r9d, r9d
test dx, dx
je 0x14014e1e0
mov dx, 1
test r9w, r9w
jne 0x14014db60
cmp rcx, rax
je 0x14014dda9
movzx r9d, byte [rcx]
test r9b, r9b
js 0x14014db90
inc rcx
mov r8d, r9d
jmp 0x14014dbf1
mov r8d, r9d
and r8d, 0x1f
movzx r11d, byte [rcx + 1]
and r11d, 0x3f
cmp r9b, 0xdf
jbe 0x14014dbe6
movzx r10d, byte [rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r9b, 0xf0
jb 0x14014dbfc
movzx r9d, byte [rcx + 3]
add rcx, 4
and r8d, 7
shl r8d, 0x12
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
or r8d, r9d
cmp r8d, 0xffff
jbe 0x14014dbf1
jmp 0x14014dc10
add rcx, 2
shl r8d, 6
or r8d, r11d
xor r9d, r9d
mov edx, r8d
jmp 0x14014db63
add rcx, 3
shl r8d, 0xc
or r8d, r10d
cmp r8d, 0xffff
jbe 0x14014dbf1
and r8d, 0x3ff
or r8d, 0xdc00
mov r9d, r8d
jmp 0x14014db63
mov r13, rbx
mov edi, 1
xor ebx, ebx
mov rcx, rdi
mov rdx, r15
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x1f0], rsi
mov byte [rsp + 0x1f8], 0
lea rdx, [0x141a7aca0]
lea rcx, [rsp + 0x1e0]
mov r8d, 4
call fcn.14014a350
mov r15, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x1e8]
mov r14, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x1e0]
mov rdx, rsi
mov r8, r14
call fcn.1401481b0
mov rbx, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1e8]
movabs rcx, 0x8000000000000000
cmp rbx, rcx
jne 0x14014dd0f
mov rdx, rdi
call fcn.1401528f0
mov rcx, rsi
mov rdx, r14
call fcn.140155f40
test rax, rax
mov rbx, r13
je 0x14014de14
cmp rdx, 2
jne 0x14014dd4d
movzx ecx, word [rax]
cmp ecx, 0x2e2e
jne 0x14014dd4d
mov ecx, 2
xor r8d, r8d
test rax, rax
cmovne r8, rax
test r8, r8
jne 0x14014de00
jmp 0x14014de14
mov r12, qword [rsp + 0x1f0]
mov rcx, rdi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x14014dd8a
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], r12
test r15, r15
mov rbx, r13
jne 0x14014de2c
jmp 0x14014de3d
mov rcx, rdx
test rcx, rcx
je 0x14014ddef
mov r9, rcx
dec rcx
cmp byte [rax + r9 - 1], 0x2e
jne 0x14014dd50
test rcx, rcx
je 0x14014e99c
sub rdx, r9
mov r8, rax
add r8, r9
test rax, rax
cmovne r8, rax
test r8, r8
jne 0x14014de00
jmp 0x14014de14
test rbx, rbx
je 0x14014dcca
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
jmp 0x14014dcca
cmp rsi, 0x10
jae 0x14014e930
test rsi, rsi
je 0x14014eb50
dec rsi
xor ecx, ecx
nop word cs:[rax + rax]
cmp byte [r15 + rcx], 0x2e
sete al
je 0x14014ebff
lea rdx, [rcx + 1]
cmp rsi, rcx
mov rcx, rdx
jne 0x14014ddd0
jmp 0x14014ebff
mov r8, rax
xor eax, eax
test rax, rax
cmovne r8, rax
test r8, r8
je 0x14014de14
test rax, rax
cmove rcx, rdx
add r8, rcx
sub r8, rsi
cmp r14, r8
cmovae r14, r8
lea rcx, [rsp + 0x108]
mov rdx, rsi
mov r8, r14
call fcn.1401481b0
test r15, r15
je 0x14014de3d
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x108]
mov r13, qword [rsp + 0x110]
movabs rax, 0x8000000000000000
mov qword [rsp + 0x58], rcx
cmp rcx, rax
je 0x14014e1e0
mov rsi, qword [rsp + 0x118]
cmp rsi, 5
mov qword [rsp + 0xa0], r13
jb case.0x14014eb75.68
lea rax, [rsi*2]
add rax, r13
mov rcx, rax
add rcx, 0xfffffffffffffff6
je case.0x14014eb75.68
cmp word [rcx], 0x2e
jne case.0x14014eb75.68
cmp word [rax - 2], 0
je 0x14014eb57
mov r14, qword [rbx + 8]
mov rdi, qword [rbx + 0x28]
mov rax, rbx
mov rbx, qword [rbx + 0x30]
movzx esi, byte [rax + 0xc5]
mov qword [rsp + 0x78], rax
mov r15, qword [rax + 0x10]
add r15, r14
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 2
mov qword [rsp + 0x130], 0
lea r12, [rsp + 0x120]
mov rcx, r12
call fcn.14016c000
mov rax, qword [rsp + 0x128]
mov word [rax], 0x22
mov qword [rsp + 0x130], 1
mov qword [rsp + 0x1e0], r14
mov qword [rsp + 0x1e8], r15
mov word [rsp + 0x1f0], 0
lea rdx, [rsp + 0x1e0]
mov rcx, r12
call fcn.140153c50
mov r14, qword [rsp + 0x130]
cmp r14, qword [rsp + 0x120]
jne 0x14014df58
lea rcx, [rsp + 0x120]
call fcn.14016c000
mov rax, qword [rsp + 0x128]
mov word [rax + r14*2], 0x22
inc r14
mov qword [rsp + 0x130], r14
shl rbx, 3
lea rbx, [rbx + rbx*4]
lea r12, [rsp + 0x120]
jmp 0x14014dfcc
lea r15, [rdi + 0x28]
mov rax, qword [rsp + 0x128]
mov word [rax + r14*2], 0x20
inc r14
mov qword [rsp + 0x130], r14
mov rcx, r12
mov rdx, rdi
mov r8d, esi
call fcn.140147310
add rbx, 0xffffffffffffffd8
mov rdi, r15
test rax, rax
jne 0x14014e19e
test rbx, rbx
je 0x14014dfed
mov r14, qword [rsp + 0x130]
cmp r14, qword [rsp + 0x120]
jne 0x14014df90
mov rcx, r12
call fcn.14016c000
jmp 0x14014df90
mov rax, qword [rsp + 0x120]
mov r13, qword [rsp + 0x128]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14014e1c2
mov rdi, qword [rsp + 0x130]
mov cl, 1
mov dword [rsp + 0xa8], ecx
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x118], rdi
cmp rdi, rax
jne 0x14014e065
lea rcx, [rsp + 0x108]
call fcn.14016c000
mov r13, qword [rsp + 0x110]
mov qword [rsp + 0x190], r14
mov word [r13 + rdi*2], 0
inc rdi
cmp byte [rbx + 0xc4], 0
mov eax, 0x400
mov esi, 0x608
cmove esi, eax
mov qword [rsp + 0x118], rdi
or esi, dword [rbx + 0xc0]
test bpl, bpl
je 0x14014e2e0
mov r14d, 2
xor eax, eax
xor ecx, ecx
movabs r12, 0x8000000000000000
mov rbp, qword [rsp + 0x58]
mov qword [rsp + 0x1a0], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rbx + 0x38]
xor eax, eax
cmp qword [rbx + 0x38], r12
cmovne rax, rcx
jne 0x14014e9b7
mov r12d, 2
xor r13d, r13d
xor ecx, ecx
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x141af80f8], cl
jne 0x14014f4d2
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xf0], 0
lea rcx, [rbx + 0x58]
mov r15, rbx
mov ebx, dword [rbx + 0x68]
cmp dword [r15 + 0x58], 6
lea r14, [rsp + 0x1c8]
cmove rcx, r14
lea rdi, [r15 + 0x78]
cmp dword [r15 + 0x78], 6
cmove rdi, r14
lea r8, [rsp + 0xd0]
mov edx, 0xfffffff6
call fcn.1401531e0
test rax, rax
je 0x14014f2de
mov r13, rdx
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
jmp 0x14014f89a
mov r13, rax
cmp qword [rsp + 0x120], 0
je 0x14014e1c2
mov r8, qword [rsp + 0x128]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x58], 0
je 0x14014e1e0
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0xa0]
call sub.KERNEL32.dll_HeapFree
test bpl, bpl
jne 0x14014e264
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14014e23b
mov qword [rsp + 0x1e8], 0
mov qword [rsp + 0x1f0], rcx
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x208], 0
mov qword [rsp + 0x210], rcx
mov qword [rsp + 0x218], rax
mov eax, 1
mov rcx, qword [rsp + 0x68]
jmp 0x14014e23f
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x220], rcx
lea rcx, [rsp + 0x1e0]
call fcn.140152df0
cmp dword [rsp + 0x1c8], 3
ja 0x14014e275
mov esi, 2
jmp 0x14014e2b0
mov esi, 2
mov rcx, qword [rsp + 0x1d0]
call sub.KERNEL32.dll_CloseHandle
cmp rsi, 2
je 0x14014e2b0
mov rax, qword [rsp + 0x1c0]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], r13
mov qword [rax + 0x38], rbp
mov r13, rdi
mov rax, qword [rsp + 0x1c0]
mov qword [rax + 8], r13
mov qword [rax], rsi
movaps xmm6, xmmword [rsp + 0x5e0]
add rsp, 0x5f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x14014d8f5
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 2
mov qword [rsp + 0x90], 0
mov rdi, qword [rsp + 0x68]
test rdi, rdi
movabs r12, 0x8000000000000000
mov rbp, qword [rsp + 0x58]
jne 0x14014e343
lea rcx, [rsp + 0x80]
call fcn.14016c000
mov rax, qword [rsp + 0x88]
mov word [rax], 0
mov qword [rsp + 0x90], 1
xor eax, eax
mov r8, qword [rsp + 0x70]
test r8, r8
setne al
mov rcx, rdi
cmove rcx, r8
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], 0
mov qword [rsp + 0x1f0], r8
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0x1f8], rdx
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], 0
mov qword [rsp + 0x210], r8
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x220], rcx
test rcx, rcx
je 0x14014f018
xorps xmm6, xmm6
mov qword [rsp + 0x60], r15
dec rdi
mov qword [rsp + 0x220], rdi
cmp qword [rsp + 0x1e0], 0
je 0x14014f64f
mov r8, qword [rsp + 0x1e8]
test r8, r8
je 0x14014e402
mov r13, r15
mov r15, rbx
mov rbx, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1f8]
jmp 0x14014e4b4
mov r8, qword [rsp + 0x1f0]
mov rax, qword [rsp + 0x1f8]
test rax, rax
je 0x14014e43c
mov rcx, rax
and rcx, 7
je 0x14014e444
xor edx, edx
mov r8, qword [r8 + 0x3d8]
inc rdx
cmp rcx, rdx
jne 0x14014e422
mov r13, r15
mov rcx, rax
sub rcx, rdx
jmp 0x14014e44a
mov r13, r15
mov r15, rbx
jmp 0x14014e491
mov r13, r15
mov rcx, rax
mov r15, rbx
cmp rax, 8
jb 0x14014e491
mov rax, qword [r8 + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov r8, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14014e453
mov qword [rsp + 0x1e0], 1
mov qword [rsp + 0x1e8], r8
lea rax, [rsp + 0x1f0]
movups xmmword [rax], xmm6
xor edi, edi
xor ebx, ebx
movzx eax, word [r8 + 0x3d2]
cmp rdi, rax
jae 0x14014e4c6
mov r14, r8
jmp 0x14014e4fc
mov r14, qword [r8 + 0x160]
test r14, r14
je 0x14014f9bd
inc rbx
movzx edi, word [r8 + 0x3d0]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r8, r14
cmp di, word [r14 + 0x3d2]
jae 0x14014e4c6
test rbx, rbx
je 0x14014e540
mov rax, qword [r14 + rdi*8 + 0x3e0]
mov rcx, rbx
dec rcx
je 0x14014e539
mov rdx, rcx
and rdx, 7
je 0x14014e52f
xor r8d, r8d
mov rax, qword [rax + 0x3d8]
inc r8
cmp rdx, r8
jne 0x14014e51d
sub rcx, r8
add rbx, 0xfffffffffffffffe
cmp rbx, 7
jae 0x14014e54c
xor ecx, ecx
mov rbx, r15
jmp 0x14014e58f
lea rcx, [rdi + 1]
mov rax, r14
mov rbx, r15
jmp 0x14014e58f
mov rbx, r15
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14014e54f
xor ecx, ecx
mov r15, r13
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], rcx
imul rcx, rdi, 0x38
mov rax, qword [r14 + rcx + 0x168]
cmp rax, r12
je 0x14014f03f
lea rdx, [r14 + rcx]
add rdx, 0x168
mov r8, qword [r14 + rcx + 0x170]
mov r15, qword [r14 + rcx + 0x188]
mov rbp, qword [r14 + rcx + 0x190]
mov r12, qword [r14 + rcx + 0x198]
shl rdi, 5
mov rcx, qword [r14 + rdi]
mov qword [rsp + 0x68], rcx
mov rcx, qword [r14 + rdi + 8]
mov qword [rsp + 0x70], rcx
mov r13, qword [r14 + rdi + 0x10]
mov rcx, qword [rdx + 0x10]
add rcx, r8
xor r11d, r11d
mov rdx, r8
jmp 0x14014e626
xor r11d, r11d
test r9w, r9w
je 0x14014ea88
mov r9w, 1
test r11w, r11w
jne 0x14014e619
cmp rdx, rcx
je 0x14014e6df
movzx r11d, byte [rdx]
test r11b, r11b
js 0x14014e64e
inc rdx
mov r10d, r11d
jmp 0x14014e6d4
mov r14, rbx
mov r10d, r11d
and r10d, 0x1f
movzx ebx, byte [rdx + 1]
and ebx, 0x3f
cmp r11b, 0xdf
jbe 0x14014e697
movzx edi, byte [rdx + 2]
shl ebx, 6
and edi, 0x3f
or edi, ebx
cmp r11b, 0xf0
jb 0x14014e6a7
movzx r11d, byte [rdx + 3]
add rdx, 4
and r10d, 7
shl r10d, 0x12
shl edi, 6
and r11d, 0x3f
or r11d, edi
or r10d, r11d
jmp 0x14014e6b2
add rdx, 2
shl r10d, 6
or r10d, ebx
mov rbx, r14
jmp 0x14014e6d4
add rdx, 3
shl r10d, 0xc
or r10d, edi
mov rbx, r14
cmp r10d, 0xffff
jbe 0x14014e6d4
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x14014e61c
xor r11d, r11d
mov r9d, r10d
jmp 0x14014e61c
test rax, rax
je 0x14014e705
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14014f99c
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x90]
sub rax, rdi
cmp rax, r12
jb 0x14014e910
lea r8, [r12 + r12]
lea rcx, [rdi + rdi]
add rcx, qword [rsp + 0x88]
mov rdx, rbp
call sub.msvcrt.dll_memcpy
add rdi, r12
mov qword [rsp + 0x90], rdi
test r15, r15
je 0x14014e762
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbp
call sub.KERNEL32.dll_HeapFree
mov rdi, qword [rsp + 0x90]
cmp rdi, qword [rsp + 0x80]
movabs r12, 0x8000000000000000
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
jne 0x14014e78d
lea rcx, [rsp + 0x80]
call fcn.14016c000
mov rax, qword [rsp + 0x88]
mov word [rax + rdi*2], 0x3d
inc rdi
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x70]
add r13, rdi
xor r8d, r8d
mov rax, rdi
mov r11, qword [rsp + 0x68]
jmp 0x14014e7c7
xor r8d, r8d
test cx, cx
je 0x14014f3a6
mov cx, 1
test r8w, r8w
jne 0x14014e7bb
cmp rax, r13
je 0x14014e871
movzx r8d, byte [rax]
test r8b, r8b
js 0x14014e7eb
inc rax
mov edx, r8d
jmp 0x14014e867
mov edx, r8d
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp r8b, 0xdf
jbe 0x14014e835
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r8b, 0xf0
jb 0x14014e841
movzx r8d, byte [rax + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
or edx, r8d
jmp 0x14014e84b
add rax, 2
shl edx, 6
or edx, r10d
jmp 0x14014e867
add rax, 3
shl edx, 0xc
or edx, r9d
cmp edx, 0xffff
jbe 0x14014e867
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x14014e7be
xor r8d, r8d
mov ecx, edx
jmp 0x14014e7be
cmp r11, r12
je 0x14014f9b5
mov r14, r11
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], r13
mov word [rsp + 0xe0], 0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
call fcn.140153c50
test r14, r14
je 0x14014e8c2
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rdi, qword [rsp + 0x90]
cmp rdi, qword [rsp + 0x80]
jne 0x14014e8e1
lea rcx, [rsp + 0x80]
call fcn.14016c000
mov rax, qword [rsp + 0x88]
mov word [rax + rdi*2], 0
inc rdi
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x220]
test rdi, rdi
jne 0x14014e3c0
jmp 0x14014f018
lea rcx, [rsp + 0x80]
mov rdx, rdi
mov r8, r12
call fcn.140056cf0
mov rdi, qword [rsp + 0x90]
jmp 0x14014e721
lea rax, [r15 + 7]
and rax, 0xfffffffffffffff8
sub rax, r15
jne 0x14014eb0f
lea rcx, [rsi - 0x10]
xor eax, eax
movdqa xmm0, xmmword [0x14021a410]
movdqa xmm1, xmmword [0x14021a420]
movabs rdx, 0x8080808080808080
movdqu xmm2, xmmword [r15 + rax]
movdqa xmm3, xmm2
pxor xmm3, xmm0
paddq xmm3, xmm1
pandn xmm2, xmm3
pshufd xmm3, xmm2, 0xee
por xmm3, xmm2
movq r8, xmm3
test r8, rdx
jne 0x14014eb38
add rax, 0x10
cmp rax, rcx
jbe 0x14014e961
jmp 0x14014eb38
xor r8d, r8d
mov rcx, rdx
test rax, rax
cmovne r8, rax
test r8, r8
jne 0x14014de00
jmp 0x14014de14
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rbx + 0x48]
add rdx, rcx
xor r10d, r10d
jmp 0x14014e9d4
xor r10d, r10d
test r8w, r8w
je 0x14014ebf1
mov r8w, 1
test r10w, r10w
jne 0x14014e9c7
cmp rcx, rdx
je 0x14014f31e
movzx r10d, byte [rcx]
test r10b, r10b
js 0x14014e9fc
inc rcx
mov r9d, r10d
jmp 0x14014ea7d
mov r9d, r10d
and r9d, 0x1f
movzx edi, byte [rcx + 1]
and edi, 0x3f
cmp r10b, 0xdf
jbe 0x14014ea46
movzx r11d, byte [rcx + 2]
shl edi, 6
and r11d, 0x3f
or r11d, edi
cmp r10b, 0xf0
jb 0x14014ea53
movzx r10d, byte [rcx + 3]
add rcx, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r9d, r10d
jmp 0x14014ea5e
add rcx, 2
shl r9d, 6
or r9d, edi
jmp 0x14014ea7d
add rcx, 3
shl r9d, 0xc
or r9d, r11d
cmp r9d, 0xffff
jbe 0x14014ea7d
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x14014e9ca
xor r10d, r10d
mov r8d, r9d
jmp 0x14014e9ca
lea r13, [0x141a7ac48]
test rax, rax
je 0x14014eaa2
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r8, qword [rsp + 0x70]
cmp qword [rsp + 0x68], 0
je 0x14014eabd
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
test r15, r15
je 0x14014ead3
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbp
call sub.KERNEL32.dll_HeapFree
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
lea rcx, [rsp + 0x1e0]
call fcn.140152df0
cmp qword [rsp + 0x80], 0
je 0x14014f92f
mov r8, qword [rsp + 0x88]
mov rcx, qword [0x141af8068]
xor edx, edx
jmp 0x14014f92a
cmp rax, rsi
cmovae rax, rsi
xor ecx, ecx
cmp byte [r15 + rcx], 0x2e
je 0x14014ebfd
inc rcx
cmp rax, rcx
jne 0x14014eb18
lea rcx, [rsi - 0x10]
cmp rax, rcx
jbe 0x14014e947
cmp rsi, rax
je 0x14014eb50
cmp byte [r15 + rax], 0x2e
je 0x14014ebfd
inc rax
cmp rsi, rax
jne 0x14014eb3d
xor eax, eax
jmp 0x14014ebff
movzx ecx, word [rax - 8]
lea edx, [rcx - 0x42]
cmp edx, 0x21
ja case.0x14014eb75.68
lea r8, [0x14021a430]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
movzx edx, word [rax - 6]
or edx, 0x20
cmp edx, 0x61
jne 0x14014eb8f
movzx edx, word [rax - 4]
or edx, 0x20
cmp edx, 0x74
je 0x14014ebb9
cmp cx, 0x43
jne case.0x14014eb75.68
movzx ecx, word [rax - 6]
or ecx, 0x20
cmp ecx, 0x6d
jne case.0x14014eb75.68
movzx eax, word [rax - 4]
or eax, 0x20
cmp eax, 0x64
jne case.0x14014eb75.68
lea rcx, [rsp + 0x1e0]
call fcn.140152a30
mov r14, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x1e8]
movabs rdi, 0x8000000000000000
cmp r14, rdi
jne 0x14014f42c
mov r13, r15
jmp 0x14014e1c2
lea r13, [0x141a7ac48]
jmp 0x14014f916
mov al, 1
mov byte [rsp + 0x60], bpl
mov byte [rsp + 0x57], al
test r14, r14
movabs r15, 0x8000000000000000
je 0x14014ecfc
add rdi, r14
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xd8], rdi
mov word [rsp + 0xe0], 0
mov byte [rsp + 0xe8], 1
lea rsi, [rsp + 0x1e0]
lea rdi, [rsp + 0xd0]
lea r14, [rsp + 0xb0]
lea r12, [rsp + 0x57]
lea r13, [rsp + 0x120]
jmp 0x14014ecba
mov rdx, qword [rsp + 0x1f8]
mov qword [rsp + 0x128], r8
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdx
mov qword [rsp + 0x120], rax
mov rcx, rsi
mov rdx, r14
mov r8, r12
mov r9, r13
call fcn.140152800
mov rax, qword [rsp + 0x1e0]
cmp rax, r15
jne 0x14014eff9
mov rcx, rsi
mov rdx, rdi
call fcn.140148cc0
mov rax, qword [rsp + 0x1e0]
cmp rax, r15
je 0x14014ecfc
mov r8, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1f0]
test rcx, rcx
jne 0x14014ec70
test rax, rax
je 0x14014ecba
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x14014ecba
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x120]
call fcn.140148ef0
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
cmp rdi, r15
jne 0x14014ed30
mov rcx, rdi
mov rdx, rsi
call fcn.1401528f0
jmp 0x14014edac
mov r14, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x138]
mov rcx, rsi
mov rdx, r14
call fcn.1401558c0
cmp r14, rdx
cmovb rdx, r14
test rax, rax
cmove rdx, r14
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x1e8], rsi
mov qword [rsp + 0x1f0], rdx
mov qword [rsp + 0x1f8], rbx
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x57]
lea r9, [rsp + 0x1e0]
call fcn.140152800
mov rax, qword [rsp + 0xd0]
cmp rax, r15
jne 0x14014f099
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 2
mov qword [rsp + 0x90], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x58], rax
xor r12d, r12d
mov r13d, 0xffffffff
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jb 0x14014ee0f
jmp 0x14014ee30
jae 0x14014eeee
cmp r8, 0x201
jae 0x14014ee30
mov ebp, 0x200
lea rdi, [rsp + 0x1e0]
mov r15, r8
jmp 0x14014ee62
sub r8, r14
sub rbx, r14
cmp rbx, r8
jb 0x14014eec4
cmp r12, r13
mov r14d, 0xffffffff
cmovb r14, r12
mov qword [rsp + 0x90], r14
mov rbx, r12
mov rbp, r14
mov rdi, qword [rsp + 0x58]
mov r15, r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov edx, r15d
call sub.KERNEL32.dll_GetSystemDirectoryW
test eax, eax
jne 0x14014ee8b
mov esi, eax
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
mov eax, esi
test ecx, ecx
jne 0x14014efa7
mov r8d, eax
cmp r15, r8
jne 0x14014ee00
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14014f64f
add r15, r15
cmp r15, r13
cmovae r15, r13
mov r8, r15
cmp r8, 0x201
jae 0x14014ee30
jmp 0x14014ee0f
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140056cf0
mov r12, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
jmp 0x14014ee3f
cmp rbp, r8
jb 0x14014f64f
lea rsi, [rsp + 0x120]
mov rcx, rsi
mov rdx, rdi
call fcn.140154120
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xb8]
mov rcx, rsi
call fcn.140154dc0
cmp byte [rsp + 0x57], 0
mov rbx, qword [rsp + 0x78]
movzx ebp, byte [rsp + 0x60]
jne 0x14014ef4d
lea rdx, [0x141a7acd0]
lea rcx, [rsp + 0x120]
mov r8d, 3
call fcn.140156060
mov rdx, qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
lea rcx, [rsp + 0xd0]
call fcn.1401481b0
mov rax, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
movabs rsi, 0x8000000000000000
mov qword [rsp + 0x58], rax
cmp rax, rsi
jne 0x14014f0bd
mov rcx, rsi
mov rdx, r13
call fcn.1401528f0
mov qword [rsp + 0x58], rsi
jmp 0x14014f0fa
call sub.KERNEL32.dll_GetLastError
mov r13d, eax
shl r13, 0x20
cmp qword [rsp + 0x80], 0
je 0x14014efd4
mov r8, qword [rsp + 0x88]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
or r13, 2
movabs rax, 0x8000000000000000
inc rax
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x78]
movzx ebp, byte [rsp + 0x60]
jmp 0x14014f155
mov qword [rsp + 0x58], rax
mov r13, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1f0]
movzx ebp, byte [rsp + 0x60]
jmp 0x14014de6d
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x1e0]
call fcn.140150150
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x14014f03f
call fcn.1401462e0
lea rcx, [rsp + 0x1e0]
call fcn.140152df0
mov rax, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x90]
cmp rdi, rax
jne 0x14014f076
lea rcx, [rsp + 0x80]
call fcn.14016c000
mov rax, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov word [r14 + rdi*2], 0
mov rcx, r14
mov r13, r14
cmp rax, r12
jne 0x14014e0bc
jmp 0x14014f92f
mov qword [rsp + 0x58], rax
mov r13, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0x78]
movzx ebp, byte [rsp + 0x60]
jmp 0x14014de6d
mov rsi, qword [rsp + 0xe0]
mov rcx, r13
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x14014f0fa
cmp qword [rsp + 0x58], 0
je 0x14014f0eb
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
movabs rax, 0x8000000000000000
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x120], 0
je 0x14014f11b
mov r8, qword [rsp + 0x128]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x80], 0
je 0x14014f13c
mov r8, qword [rsp + 0x88]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
movabs rax, 0x8000000000000000
add rax, 2
cmp qword [rsp + 0x58], rax
jge 0x14014de6d
mov rcx, qword [rsp + 0x58]
mov rdx, r13
call fcn.140152980
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x57]
call fcn.140146f80
mov rcx, qword [rsp + 0x1e0]
mov r13, qword [rsp + 0x1e8]
movabs rsi, 0x8000000000000000
lea rax, [rsi + 2]
cmp rcx, rax
jge 0x14014f2cc
mov rdx, r13
call fcn.140152980
lea rdx, [0x141a7ac60]
lea rcx, [rsp + 0x80]
mov r8d, 4
call fcn.140149e80
mov rbx, qword [rsp + 0x80]
cmp rbx, rsi
je 0x14014f3e7
mov rbp, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
add rax, rbp
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xd8], rax
mov word [rsp + 0xe0], 0
mov byte [rsp + 0xe8], 1
lea rsi, [rsp + 0x1e0]
lea rdi, [rsp + 0xd0]
lea r14, [rsp + 0xb0]
lea r13, [rsp + 0x57]
lea r12, [rsp + 0x120]
movabs r15, 0x8000000000000000
jmp 0x14014f286
mov rdx, qword [rsp + 0x1f8]
mov qword [rsp + 0x128], r8
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdx
mov qword [rsp + 0x120], rax
mov rcx, rsi
mov rdx, r14
mov r8, r13
mov r9, r12
call fcn.140152800
mov rax, qword [rsp + 0x1e0]
cmp rax, r15
jne 0x14014f486
mov rcx, rsi
mov rdx, rdi
call fcn.140148cc0
mov rax, qword [rsp + 0x1e0]
cmp rax, r15
je 0x14014f3cc
mov r8, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1f0]
test rcx, rcx
jne 0x14014f23c
test rax, rax
je 0x14014f286
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x14014f286
mov qword [rsp + 0x58], rcx
mov rsi, qword [rsp + 0x1f0]
jmp 0x14014de6d
mov qword [rsp + 0x198], rdx
lea r8, [rsp + 0xe0]
lea rcx, [r15 + 0x68]
cmp ebx, 6
cmove rcx, r14
mov edx, 0xfffffff5
call fcn.1401531e0
mov rbx, rdx
test rax, rax
je 0x14014f3fc
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
jmp 0x14014f88a
mov rcx, qword [rax + 8]
mov rax, qword [rax + 0x10]
add rax, rcx
mov qword [rsp + 0x1e0], rcx
mov qword [rsp + 0x1e8], rax
mov word [rsp + 0x1f0], 0
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x1e0]
call fcn.140153f60
mov rcx, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x130]
cmp rdi, rcx
jne 0x14014f382
lea rcx, [rsp + 0x120]
call fcn.14016c000
mov rcx, qword [rsp + 0x120]
mov r13, qword [rsp + 0x128]
mov word [r13 + rdi*2], 0
mov rax, r13
cmp rcx, r12
mov r12, r13
jne 0x14014e0e8
jmp 0x14014f916
lea r13, [0x141a7ac48]
test r11, r11
je 0x14014eadd
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
jmp 0x14014eadd
mov r8, rbp
test rbx, rbx
movzx ebp, byte [rsp + 0x60]
je 0x14014f3e7
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea r13, [0x141a7acb8]
test bpl, bpl
je 0x14014e1e5
jmp 0x14014e264
lea r8, [rsp + 0xf0]
mov rcx, rdi
mov edx, 0xfffffff4
call fcn.1401531e0
mov rdi, rdx
test rax, rax
mov r14, qword [rsp + 0x68]
je 0x14014f4e3
mov r15, qword [rsp + 0x60]
jmp 0x14014f87f
mov r9, qword [rbx + 0x28]
mov rax, qword [rbx + 0x30]
movzx ecx, byte [rbx + 0xc5]
mov byte [rsp + 0x28], cl
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1e0]
mov rdx, r13
mov r8, rsi
call fcn.140147780
mov rax, qword [rsp + 0x1e0]
mov r13, qword [rsp + 0x1e8]
cmp rax, rdi
jne 0x14014f4ba
test r14, r14
je 0x14014e1c2
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r15
jmp 0x14014e1bd
mov qword [rsp + 0x58], rax
mov r13, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1f0]
test rbx, rbx
je 0x14014f0ae
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbp
call sub.KERNEL32.dll_HeapFree
jmp 0x14014f0ae
mov rdi, qword [rsp + 0x1f0]
mov dword [rsp + 0xa8], 0
jmp 0x14014e033
lea rcx, [0x141af80f8]
call fcn.14014a190
jmp 0x14014e125
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x154], xmm0
movdqu xmmword [rsp + 0x148], xmm0
movdqu xmmword [rsp + 0x138], xmm0
movdqu xmmword [rsp + 0x128], xmm0
movdqu xmmword [rsp + 0x168], xmm0
movdqu xmmword [rsp + 0x178], xmm0
test rdi, rdi
mov rax, qword [rsp + 0x198]
jne 0x14014f534
test rbx, rbx
jne 0x14014f534
test rax, rax
je 0x14014f557
mov dword [rsp + 0x15c], 0x100
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x180], rdi
mov rax, qword [r15 + 0xb8]
mov qword [rsp + 0x1b8], rax
test rax, rax
je 0x14014f651
mov rdx, r15
add rdx, 0xa8
mov dword [rsp + 0x120], 0x70
lea rcx, [rsp + 0xb0]
call fcn.140153860
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
mov r15, qword [rsp + 0x60]
je 0x14014f86c
or esi, 0x80000
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x1a8], rax
movups xmm0, xmmword [rsp + 0x120]
movdqu xmm1, xmmword [rsp + 0x130]
movdqu xmm2, xmmword [rsp + 0x140]
movdqu xmm3, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x1e0], xmm0
movdqa xmmword [rsp + 0x1f0], xmm1
movdqa xmmword [rsp + 0x200], xmm2
movdqa xmmword [rsp + 0x210], xmm3
movups xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x220], xmm0
movdqu xmm0, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0x230], xmm0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x248], rcx
lea rax, [rsp + 0x1e0]
jmp 0x14014f669
ud2
mov dword [rsp + 0x120], 0x68
lea rax, [rsp + 0x120]
mov r15, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
mov rcx, r15
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x14014f80a
mov qword [rsp + 0x1a0], rdi
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x1d8], r12
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov r14, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xf8]
cmp qword [rsp + 0x1b8], 0
je 0x14014f72c
mov rcx, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1a8]
call fcn.140153bb0
mov rcx, qword [rsp + 0x1a0]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x78]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x198]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
xchg byte [0x141af80f8], al
cmp al, 2
jne 0x14014f768
lea rcx, [0x141af80f8]
call fcn.1401e62f0
cmp qword [rsp + 0xc8], 0
je 0x14014f789
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x1d8]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x70], 0
je 0x14014f7a4
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x68]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x108], 0
je 0x14014f7c5
mov r8, qword [rsp + 0x110]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x190], 0
je 0x14014f7e3
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x60]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x58], 0
sete al
mov ecx, dword [rsp + 0xa8]
or cl, al
je 0x14014f843
cmp dword [rsp + 0x1c8], 4
jae 0x14014e27a
jmp 0x14014e287
call sub.KERNEL32.dll_GetLastError
mov r13d, eax
shl r13, 0x20
or r13, 2
cmp qword [rsp + 0x1b8], 0
je 0x14014f874
mov rcx, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1a8]
call fcn.140153bb0
jmp 0x14014f874
call fcn.140149e70
ud2
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0xa0]
call sub.KERNEL32.dll_HeapFree
cmp dword [rsp + 0x1c8], 4
jae 0x14014e27a
jmp 0x14014e287
mov r13, qword [rsp + 0xb8]
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
mov rdi, r13
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rbx, rdi
mov rcx, qword [rsp + 0x198]
call sub.KERNEL32.dll_CloseHandle
mov r13, rbx
cmp qword [rsp + 0xd0], 0
je 0x14014f8b2
mov rcx, qword [rsp + 0xd8]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0xe0], 0
je 0x14014f8ca
mov rcx, qword [rsp + 0xe8]
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0xf0], 0
je 0x14014f8e2
mov rcx, qword [rsp + 0xf8]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
xchg byte [0x141af80f8], al
cmp al, 2
jne 0x14014f8fa
lea rcx, [0x141af80f8]
call fcn.1401e62f0
cmp qword [rsp + 0xc8], 0
je 0x14014f916
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x70], 0
je 0x14014f92f
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x108], 0
je 0x14014f950
mov r8, qword [rsp + 0x110]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x190], 0
je 0x14014f96c
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
test rbp, rbp
sete al
mov ecx, dword [rsp + 0xa8]
or cl, al
jne 0x14014e264
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0xa0]
call sub.KERNEL32.dll_HeapFree
jmp 0x14014e264
mov r13, r8
mov r8, qword [rsp + 0x70]
cmp qword [rsp + 0x68], 0
jne 0x14014eaaf
jmp 0x14014eabd
mov r13, rdi
jmp 0x14014eadd
mov edx, 8
mov rcx, r8
call fcn.140037420
ud2