Function at 0x14002f0fc
Capabilities:
Check for time delay via gettickcount
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x4268
call fcn.1400d37c0
sub rsp, rax
mov rbp, rcx
lea rcx, [rsp + 0x42b8]
movaps xmmword [rsp + 0x4250], xmm6
call fcn.140011910
xor edi, edi
mov r12d, 1
mov r14d, r12d
mov dword [rsp + 0x38], r12d
mov byte [rsp + 0x42c0], dil
mov bl, dil
mov byte [rsp + 0x42c8], dil
mov r13d, edi
mov dword [rsp + 0x3c], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x42b8]
mov dword [rsp + 0x58], eax
lea r11d, [r12 + 0x2c]
mov dword [rsp + 0x40], 0x3e8
cmp r11w, word [rcx]
mov al, 0x2a
mov sil, dil
cmove eax, r11d
mov r15b, dil
lea r10d, [r12 + 0x3c]
movsx edi, al
movzx eax, word [rcx]
lea r9d, [r12 + 0x2f]
lea r8d, [r12 + 8]
cmp edi, eax
jne 0x14002f64b
xor ebp, ebp
mov r14d, r9d
jmp 0x14002f1ba
mov r8d, 9
lea rdx, [rcx + 2]
movzx eax, word [rdx]
cmp r10w, ax
je 0x14002f3f2
sub ax, r14w
cmp ax, r8w
jbe 0x14002f3f2
mov qword [rsp + 0x42b8], rdx
lea rcx, [0x1400da3fc]
lea rdx, [rsp + 0x42b8]
mov r8d, 3
call fcn.14004e558
cmp al, bpl
je 0x14002f208
mov r15b, r12b
jmp 0x14002f3d9
lea rdx, [rsp + 0x42b8]
lea rcx, str.InitSys
mov r8d, 8
call fcn.14004e558
cmp al, bpl
je 0x14002f234
mov byte [rsp + 0x42c8], r12b
jmp 0x14002f3d9
lea rdx, [rsp + 0x42b8]
lea rcx, [0x1400da3e8]
mov r8d, 3
call fcn.14004e558
cmp al, bpl
je 0x14002f25b
mov sil, r12b
jmp 0x14002f3d9
lea rdx, [rsp + 0x42b8]
lea rcx, str.sys0
mov r8d, 4
call fcn.14004e558
cmp al, bpl
je 0x14002f282
mov sil, 0x41
jmp 0x14002f3d9
lea rdx, [rsp + 0x42b8]
lea rcx, str.syscmd
mov r8d, 6
call fcn.14004e558
cmp al, bpl
je 0x14002f2a9
mov sil, 0x10
jmp 0x14002f3d9
lea rdx, [rsp + 0x42b8]
lea rcx, str.sys0cmd
mov r8d, 7
call fcn.14004e558
cmp al, bpl
je 0x14002f2d0
mov sil, 0x50
jmp 0x14002f3d9
lea rdx, [rsp + 0x42b8]
lea rcx, str.cont
mov r8d, 4
call fcn.14004e558
cmp al, bpl
je 0x14002f2fa
mov r13d, 0x10000
jmp 0x14002f3d9
lea rdx, [rsp + 0x42b8]
lea rcx, str.scanall
mov r8d, 7
call fcn.14004e558
cmp al, bpl
je 0x14002f321
mov bl, r12b
jmp 0x14002f3d9
lea rdx, [rsp + 0x42b8]
lea rcx, [0x1400da0e0]
mov r8d, 3
call fcn.14004e558
cmp al, bpl
je 0x14002f34d
mov dword [rsp + 0x3c], 0x40
jmp 0x14002f3d9
mov rdx, qword [rsp + 0x42b8]
lea rcx, str.cur:
mov r8d, 4
call fcn.140045fc8
xor edx, edx
cmp al, dl
je 0x14002f38a
add qword [rsp + 0x42b8], 8
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x42b8]
call fcn.14004fc04
jmp 0x14002f3d7
mov rcx, qword [rsp + 0x42b8]
movzx eax, word [rcx]
cmp ax, dx
je 0x14002f3ca
mov r8d, 9
lea r9d, [r8 + 0x17]
cmp r8w, ax
ja 0x14002f3b0
cmp ax, 0xd
jbe 0x14002f3ca
cmp r9w, ax
je 0x14002f3ca
add rcx, 2
mov qword [rsp + 0x42b8], rcx
mov ax, word [rcx]
cmp ax, dx
jne 0x14002f3a4
lea rcx, [rsp + 0x42b8]
call fcn.140011910
xor ebp, ebp
mov rcx, qword [rsp + 0x42b8]
mov r10d, 0x3d
movzx eax, word [rcx]
cmp edi, eax
je 0x14002f1b4
mov r14d, dword [rsp + 0x38]
mov rbp, qword [rsp + 0x42b0]
xor eax, eax
cmp sil, al
je 0x14002f55d
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, str.GlobalPECMD:main:lock
lea rcx, [rsp + 0xc0]
call fcn.140011e0c
movzx ebx, sil
and ebx, 0x40
mov ecx, ebx
call fcn.140014d90
xor r13d, r13d
mov rdi, rax
cmp rax, r13
jne 0x14002f451
mov edx, ebx
mov rcx, rbp
call fcn.14001ef08
mov rdi, rax
cmp rdi, r13
je 0x14002f53b
mov rcx, qword [rsp + 0x42b8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x60]
lea edx, [rax + 0x75]
mov ebx, eax
call fcn.14004bedc
mov rcx, qword [rsp + 0x60]
mov word [rcx], r13w
test sil, 0x10
jne 0x14002f49d
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea rdx, str.THREAD_WAIT__cur:_lu
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x42b8]
lea r8d, [rbx + 0x11]
movsxd rcx, eax
mov rax, qword [rsp + 0x60]
lea rcx, [rax + rcx*2]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rbx, 0xffffffff80000002
lea r8, str.HOTKEY9000000
add eax, eax
lea rdx, str.SOFTWAREPELOGONRAMDATA.HOTKEY
mov r9d, r12d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140045e70
xor r9d, r9d
mov edx, 0x312
mov r8d, 0x895440
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, str.HOTKEY9000000
lea rdx, str.SOFTWAREPELOGONRAMDATA.HOTKEY
mov rcx, rbx
mov r12d, eax
call fcn.140045ee4
lea rcx, [rsp + 0x60]
call fcn.140044f24
lea rcx, [rsp + 0xc0]
call fcn.140011e30
lea rcx, [0x1400f2c58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, r12d
jmp 0x140030093
xor esi, esi
cmp bl, sil
je 0x14002f64f
lea rcx, [rsp + 0xa8]
lea rbp, str.PressKey
call fcn.14004be6c
mov r11, qword [rsp + 0x42b8]
cmp word [r11], si
je 0x14002f5ab
lea r8d, [rsi + 0x2c]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x42b8]
call fcn.14004f5d4
mov rbp, qword [rsp + 0xa8]
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x140], sil
call fcn.1400b93b0
lea rcx, [rsp + 0x140]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov word [rsp + 0x240], si
mov esi, pe_nt_image_headers64
lea rbx, [rsp + 0x140]
lea rdi, [rsp + 0x240]
movzx r8d, byte [rbx]
lea rdx, str.0x_02X
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
add rdi, 0xa
add rbx, r12
sub rsi, r12
jne 0x14002f5f3
mov rbx, qword [rsp + 0x42b0]
lea r8, [rsp + 0x240]
mov rdx, rbp
mov rcx, rbx
mov word [rsp + 0xc3e], si
call fcn.14004b578
lea rcx, [rsp + 0xa8]
call fcn.140044f24
mov r14d, esi
jmp 0x140030056
xor esi, esi
jmp 0x14002f659
mov r9d, 0x30
lea r11d, [r9 - 3]
movsd xmm0, qword [0x1400da350]
mov r8d, 0x80000000
mov ebx, 0x64
movsd qword [rsp + 0xa0], xmm0
mov dword [rsp + 0x30], r8d
cmp r11w, word [rcx]
jne 0x14002f6c0
lea rdx, [rcx + 2]
movzx eax, word [rdx]
or ax, 0x20
cmp ax, 0x63
je 0x14002f6c0
cmp ax, bx
je 0x14002f6c0
lea rcx, [rsp + 0x42b8]
mov qword [rsp + 0x42b8], rdx
mov dil, r12b
mov byte [rsp + 0x42c0], r12b
call fcn.140011910
mov rcx, qword [rsp + 0x42b8]
jmp 0x14002f6c8
mov dil, byte [rsp + 0x42c0]
cmp r10w, word [rcx]
jne 0x14002f6de
mov bl, byte [rcx]
add rcx, 2
mov qword [rsp + 0x42b8], rcx
jmp 0x14002f6e1
mov bl, sil
movzx eax, word [rcx]
mov edx, 9
sub ax, r9w
cmp ax, dx
ja 0x14002f737
mov qword [rsp + 0xc8], rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xc8]
call fcn.14004fc04
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x42b8]
call fcn.14004f994
mov rcx, qword [rsp + 0x42b8]
mov r8d, dword [rsp + 0x30]
movsd xmm0, qword [rsp + 0xa0]
mov eax, 0x2a
cmp ax, word [rcx]
je 0x14002f991
xorpd xmm6, xmm6
cmp r8d, 0x80000000
jne 0x14002f75c
comisd xmm0, xmm6
jb 0x14002f991
lea rcx, [rsp + 0x88]
mov word [rsp + 0xd2], si
mov word [rsp + 0xd0], si
lea rbp, str.PressKey
call fcn.14004be6c
mov rax, qword [rsp + 0x42b8]
mov r8d, 0x2c
cmp r8w, word [rax]
jne 0x14002f7c4
add rax, 2
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x42b8]
mov qword [rsp + 0x42b8], rax
call fcn.14004f5d4
mov rax, qword [rsp + 0x88]
cmp word [rax], si
cmovne rbp, rax
mov ecx, dword [rsp + 0x30]
cmp dil, sil
jne 0x14002f871
movsd xmm0, qword [rsp + 0xa0]
cmp ecx, esi
jne 0x14002f7f0
comisd xmm6, xmm0
jb 0x14002f7ee
mov edx, 2
jmp 0x14002f874
cmp ecx, esi
jl 0x14002f94f
cmp bl, sil
je 0x14002f831
mov r14d, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x42b8]
mov dword [rsp + 0x30], 0x80000000
cmp word [rax], si
jne 0x14002f94f
lea rcx, [rsp + 0x88]
call fcn.140044f24
xor eax, eax
jmp 0x140030093
cmp ecx, esi
jg 0x14002f84a
comisd xmm0, xmm6
jbe 0x14002f84a
mulsd xmm0, qword [0x1400da348]
cvttsd2si rax, xmm0
jmp 0x14002f84c
mov eax, esi
mov rbp, qword [rsp + 0x42b0]
mov edx, ecx
mov r8d, eax
mov rcx, rbp
call fcn.140013908
mov dword [rsp + 0x30], 0x80000000
mov r14d, eax
jmp 0x14002f957
mov edx, r12d
or edx, r13d
call fcn.1400237f8
mov ebx, 9
cmp r15b, sil
mov r14d, eax
lea r15d, [rbx + 0x27]
jne 0x14002f897
add eax, 0xffffffa0
cmp eax, ebx
ja 0x14002f897
sub r14d, r15d
cmp r14d, esi
jle 0x14002f8b4
lea rdx, str.0x_X
lea rcx, [rsp + 0xd0]
mov r8d, r14d
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x42b0]
lea rax, [0x1400da340]
lea r8, [rsp + 0xd0]
cmp r14d, esi
lea rdx, str.PressKey.Hex
cmovle r8, rax
call fcn.14004b578
cmp r14d, esi
jle 0x14002f92a
cmp r14d, 0x41
jl 0x14002f8ef
cmp r14d, 0x5a
jle 0x14002f8fc
movzx eax, r14w
sub ax, r15w
cmp ax, bx
ja 0x14002f912
movsx eax, r14b
mov word [rsp + 0xd2], si
mov word [rsp + 0xd0], ax
jmp 0x14002f92a
lea rdx, str.0x_X
lea rcx, [rsp + 0xd0]
mov r8d, r14d
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, rbp
mov rbp, qword [rsp + 0x42b0]
lea r8, [rsp + 0xd0]
mov rcx, rbp
call fcn.14004b578
mov dword [rsp + 0x30], 0x80000000
jmp 0x14002f95d
mov rbp, qword [rsp + 0x42b0]
mov r15d, 0x30
lea rcx, [rsp + 0x42b8]
call fcn.140011910
lea rcx, [rsp + 0x88]
mov dword [rsp + 0x30], 0x80000000
mov r13b, sil
call fcn.140044f24
mov rcx, qword [rsp + 0x42b8]
mov eax, 0x2a
jmp 0x14002f99f
mov r13b, byte [rsp + 0x42c0]
mov r15d, 0x30
cmp word [rcx], si
je 0x14003004e
mov dword [rsp + 0x34], esi
or ebx, 0xffffffff
mov r8d, esi
mov dil, sil
cmp ax, word [rcx]
jne 0x14002f9dd
mov r8d, dword [rsp + 0x58]
mov ebx, r12d
mov dword [rsp + 0x34], r8d
jmp 0x14002f9cc
add ebx, r12d
add rcx, 2
mov qword [rsp + 0x42b8], rcx
cmp ax, word [rcx]
je 0x14002f9c9
cmp ebx, esi
mov r14d, 0x3d
jle 0x14002fa5a
lea eax, [r14 - 0x10]
cmp ax, word [rcx]
jne 0x14002fa05
add rcx, 2
mov r8d, esi
mov dword [rsp + 0x34], esi
mov qword [rsp + 0x42b8], rcx
jmp 0x14002fa5a
cmp r14w, word [rcx]
jne 0x14002fa1a
add rcx, 2
mov dil, r12b
mov qword [rsp + 0x42b8], rcx
movzx eax, word [rcx]
mov ecx, 9
sub ax, r15w
cmp ax, cx
ja 0x14002fa45
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x42b8]
call fcn.14004fc04
mov r8d, dword [rsp + 0x34]
sub ebx, r12d
cmp ebx, esi
jle 0x14002fa5a
mov edx, ebx
mov ecx, r8d
call fcn.140015a8c
mov r8d, eax
mov dword [rsp + 0x34], eax
or dword [rsp + 0x68], 0xffffffff
lea rcx, [rsp + 0x42b8]
call fcn.140011910
mov rax, qword [rsp + 0x42b8]
cmp r14w, word [rax]
jne 0x14002fa89
mov sil, byte [rax]
add rax, 2
mov qword [rsp + 0x42b8], rax
movzx eax, word [rax]
mov ecx, 9
sub ax, r15w
cmp ax, cx
ja 0x14002fab1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x42b8]
call fcn.14004fc04
mov r8d, dword [rsp + 0x34]
xor eax, eax
mov qword [rsp + 0x50], rax
mov r14d, eax
mov dword [rsp + 0x38], eax
cmp r8d, eax
je 0x14002faf9
xor edx, edx
mov ecx, 0x100000
cmp dil, al
je 0x14002fad8
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x14002fade
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
mov qword [rsp + 0x50], rax
cmp rax, rdi
jne 0x14002fafb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov dword [rsp + 0x38], eax
jmp 0x14002fafb
xor edi, edi
lea rcx, [rsp + 0x48]
mov edx, 0x209
call fcn.14004bedc
mov rax, qword [rsp + 0x48]
mov ebx, 0x208
mov word [rax], di
mov rdx, qword [rsp + 0x48]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x80]
call fcn.140058980
mov rcx, qword [rsp + 0x80]
mov edx, 0x5c
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rax, qword [rsp + 0x48]
lea rcx, str.SystemRoot
mov word [rax], di
mov rdx, qword [rsp + 0x48]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x42b8]
call fcn.140011910
lea rcx, [rsp + 0x70]
call fcn.14004c318
mov r15, rdi
mov qword [rsp + 0xb8], rdi
jmp 0x14002fd77
mov al, byte [0x1400ef217]
cmp al, dil
jle 0x14002fd9a
lea rdx, [rsp + 0x42b8]
lea rcx, str._delms:
mov r8d, 7
call fcn.14004e558
cmp al, dil
je 0x14002fbee
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x42b8]
call fcn.14004fc04
cmp dword [rsp + 0x40], edi
jge 0x14002fd77
mov dword [rsp + 0x40], edi
jmp 0x14002fd77
mov ebx, 4
lea rdx, [rsp + 0x42b8]
lea rcx, str._del
mov r8d, ebx
call fcn.14004e558
cmp al, dil
je 0x14002fd10
mov rax, qword [rsp + 0x42b8]
lea rdx, [rsp + 0x42c0]
lea rcx, [rsp + 0xb0]
mov r8d, r12d
mov dword [rsp + 0x42c0], edi
mov qword [rsp + 0xb0], rax
call fcn.140020840
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x42b8], rax
call fcn.14004be6c
lea rcx, [rsp + 0x98]
call fcn.14004be6c
mov ebx, dword [rsp + 0x42c0]
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x98]
mov r8d, ebx
call fcn.14004c0cc
mov rcx, qword [rsp + 0x98]
lea rdx, [rsp + 0x90]
call fcn.1400160d8
lea rcx, [rsp + 0x98]
call fcn.140044f24
cmp ebx, edi
jle 0x14002fcf4
mov ecx, 8
call fcn.1400b9688
mov rbx, rax
cmp rax, rdi
je 0x14002fcd0
mov rcx, qword [rsp + 0x90]
mov qword [rax], rcx
mov qword [rsp + 0x90], rdi
jmp 0x14002fcd3
mov rbx, rdi
mov ecx, dword [rsp + 0x7c]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x70]
mov r9d, 8
call fcn.14004c2bc
mov qword [rax], rbx
add dword [rsp + 0x7c], r12d
lea rcx, [rsp + 0x42b8]
call fcn.140011910
lea rcx, [rsp + 0x90]
call fcn.140044f24
jmp 0x14002fd77
lea rdx, [rsp + 0x42b8]
lea rcx, str._cmd
mov r8d, ebx
call fcn.14004e558
cmp al, dil
jne 0x14002fd8a
mov rcx, qword [rsp + 0x42b8]
movzx eax, word [rcx]
cmp ax, di
je 0x14002fd6a
mov edx, 9
lea r8d, [rdx + 0x17]
cmp dx, ax
ja 0x14002fd50
cmp ax, 0xd
jbe 0x14002fd6a
cmp r8w, ax
je 0x14002fd6a
add rcx, 2
mov qword [rsp + 0x42b8], rcx
mov ax, word [rcx]
cmp ax, di
jne 0x14002fd45
lea rcx, [rsp + 0x42b8]
call fcn.140011910
mov rax, qword [rsp + 0x42b8]
cmp word [rax], di
jne 0x14002fb9b
jmp 0x14002fd9a
mov r15, qword [rsp + 0x42b8]
mov qword [rsp + 0xb8], r15
cmp r13b, dil
je 0x14002fda3
neg dword [rsp + 0x30]
mov ebx, dword [rsp + 0x3c]
cmp ebx, edi
jne 0x14002fdbc
cmp qword [rsp + 0x50], rdi
je 0x14002fdbc
mov rcx, qword [rsp + 0x48]
call fcn.1400146f8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r13d, r13d
mov edi, eax
add edi, dword [rsp + 0x30]
cmp qword [rsp + 0x50], r13
je 0x14002feb0
mov cl, byte [0x1400ef217]
cmp cl, r13b
jle 0x14002feb0
mov ecx, dword [rsp + 0x30]
cmp ecx, r13d
je 0x14002feac
mov ebx, 0x3e8
jle 0x14002fe12
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
mov dword [rsp + 0x30], ecx
js 0x14002feac
cmp ecx, ebx
cmovl ebx, ecx
lea r8, [rsp + 0x50]
xor r9d, r9d
mov edx, r12d
mov rcx, rbp
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], ebx
call fcn.140015bb4
cmp eax, r13d
je 0x14002feac
mov al, byte [0x1400ef217]
mov ebx, 0x64
cmp al, r13b
jle 0x14002fe9d
lea rcx, [rsp + 0x110]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r13d
je 0x14002fe9d
sub ebx, r12d
je 0x14002fe9d
cmp dword [rsp + 0x118], 0x12
je 0x14002fe9d
lea rcx, [rsp + 0x110]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x110]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x1400ef217]
cmp r11b, r13b
jg 0x14002fe46
mov al, byte [0x1400ef217]
cmp al, r13b
jg 0x14002fde5
mov ebx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x68]
cmp edx, r13d
jl 0x14002fed3
cmp sil, r13b
je 0x14002fec8
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002fed3
xor r8d, r8d
mov rcx, rbp
call fcn.140013908
xor esi, esi
cmp dword [rsp + 0x7c], esi
jle 0x14002ffcc
mov al, byte [0x1400ef217]
cmp al, sil
jle 0x14002ffcc
cmp ebx, esi
jne 0x14002fefc
mov rcx, qword [rsp + 0x48]
call fcn.1400146f8
cmp dword [rsp + 0x7c], esi
mov rdi, qword [rsp + 0x70]
jle 0x14002ffcc
mov r14, qword [rsp + 0x42b0]
mov al, byte [0x1400ef217]
cmp al, sil
jle 0x14002ffbb
movsxd rax, dword [rsp + 0x7c]
mov ebp, esi
mov rbx, rsi
cmp eax, esi
jle 0x14002ffbb
mov r13, rax
mov r15d, 1
mov al, byte [0x1400ef217]
cmp al, sil
jle 0x14002ff9c
mov rcx, qword [rdi + rbx*8]
cmp rcx, rsi
je 0x14002ff91
mov rcx, qword [rcx]
xor edx, edx
call fcn.14001b390
mov r11, qword [rdi + rbx*8]
mov rcx, qword [r11]
call fcn.1400b8a78
cmp eax, esi
jne 0x14002ff8e
mov rsi, qword [rdi + rbx*8]
xor eax, eax
cmp rsi, rax
je 0x14002ff86
mov rcx, rsi
call fcn.140044f24
mov rcx, rsi
call fcn.1400b949c
xor esi, esi
mov qword [rdi + rbx*8], rsi
jmp 0x14002ff91
mov ebp, r12d
add rbx, r15
add r12d, r15d
cmp rbx, r13
jl 0x14002ff3d
cmp ebp, esi
jle 0x14002ffbb
mov edx, dword [rsp + 0x40]
xor r8d, r8d
mov rcx, r14
call fcn.140013908
mov dword [rsp + 0x7c], ebp
mov r12, r15
jmp 0x14002ff13
mov r14d, dword [rsp + 0x38]
mov r15, qword [rsp + 0xb8]
mov ebx, dword [rsp + 0x3c]
cmp ebx, esi
jne 0x14002ffe4
cmp qword [rsp + 0x50], rsi
je 0x14002ffe4
mov rcx, qword [rsp + 0x80]
call fcn.1400146f8
mov rbx, qword [rsp + 0x42b0]
cmp r15, rsi
je 0x140030010
cmp word [r15], si
je 0x140030010
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.1400367d4
mov r14d, eax
lea rcx, [rsp + 0x70]
call fcn.1400258d0
lea rcx, [rsp + 0x80]
call fcn.140044f24
lea rcx, [rsp + 0x48]
call fcn.140044f24
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x140030047
cmp rcx, 0xffffffffffffffff
je 0x140030047
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], rsi
jmp 0x140030056
mov rbx, qword [rsp + 0x42b0]
cmp byte [rsp + 0x42c8], sil
je 0x140030086
lea rcx, str.SysStartuped
call fcn.140015658
cmp eax, esi
jne 0x14003007f
lea rdx, str.exec
mov rcx, rbx
call fcn.140015790
xor ecx, ecx
call fcn.1400282b4
xor edx, edx
mov rcx, rbx
call fcn.1400620e4
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x4250]
add rsp, 0x4268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret