Function at 0x140003b10
Capabilities:
Get common file path
Move file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f0
mov rax, qword [0x140017010]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rsi, rcx
call fcn.140005170
movabs r15, 0x24b73e163c8ff833
mov qword [rsp + 0x190], r15
movabs r14, 0xf315c9c31bcd6fe4
mov qword [rsp + 0x198], r14
movabs rax, 0x4df15b625dea8a70
mov qword [rsp + 0x90], rax
movabs rax, 0xf315c9c31b9a0a88
mov qword [rsp + 0x98], rax
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x90], xmm1
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
movabs r13, 0x1684527352fd9d58
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r14
vmovdqu xmm0, xmmword [rsp + 0x70]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x70]
call fcn.140002490
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
movabs rcx, 0x24eb3e383cd3f86f
mov qword [rsp + 0xf0], rcx
movabs rcx, 0xf315c9af1bac6faa
mov qword [rsp + 0xf8], rcx
vmovdqu xmm0, xmmword [rsp + 0xf0]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0xf0], xmm1
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0xf0]
call rax
mov qword [rsi], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140003c8f
mov rcx, rsi
call fcn.140005cc0
jmp 0x140005138
lea rdx, [rsp + 0x2d0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], r12w
lea rax, [rsp + 0x2d0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], r12w
jne 0x140003cd1
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0xd0]
call fcn.140006a80
nop
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rdx, qword [rsp + 0xd0]
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r12w
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0xb0]
call fcn.140006a80
nop
lea rcx, [rsp + 0xb0]
call fcn.1400033f0
test al, al
sete dil
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x140003d9c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010864
test dil, dil
jne 0x1400050e8
lea rcx, [rsi + 8]
call fcn.14000e840
nop
inc rbx
cmp word [rsi + rbx*2 + 8], 0
jne 0x140003db0
mov r8, rbx
lea rdx, [rsi + 8]
lea rcx, [rsp + 0xd0]
call fcn.1400065c0
lea rdi, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rdi, qword [rsp + 0xd0]
mov dword [rsp + 0xa0], 1
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
movabs rax, 0x4df15b625dea8a70
mov qword [rsp + 0x70], rax
movabs rax, 0xf315c9c31b9a0a88
mov qword [rsp + 0x78], rax
vmovdqu xmm0, xmmword [rsp + 0x70]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x70], xmm1
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r14
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x90], xmm1
lea rcx, [rsp + 0x90]
call fcn.140002490
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
call rax
mov rbx, rax
call fcn.140002460
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xa0]
mov r8d, 0x8708
lea rdx, [0x140088960]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea r8d, [rdx + 4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
movabs rax, 0x4ad676734fe09470
mov qword [rsp + 0x70], rax
movabs rax, 0xf315c9c31ba80380
mov qword [rsp + 0x78], rax
vmovdqu xmm0, xmmword [rsp + 0x70]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x70], xmm1
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x98], r14
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x90], xmm1
lea rcx, [rsp + 0x90]
call fcn.140002490
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.140002540
mov rcx, rbx
call rax
xor edx, edx
mov r8d, 0x8708
lea rcx, [0x140088960]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rdx, qword [rsp + 0xd0]
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], r12w
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0xb0]
call fcn.140006a80
nop
lea rcx, [rsp + 0xb0]
call fcn.1400033f0
test al, al
sete bl
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x140004046
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004041
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004041
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010864
test bl, bl
jne 0x1400050e8
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
movabs rax, 0x6fd95b6673e89d61
mov qword [rsp + 0x70], rax
movabs rax, 0xf315c99463881681
mov qword [rsp + 0x78], rax
vmovdqu xmm0, xmmword [rsp + 0x70]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x70], xmm1
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
movabs rbx, 0x168457665df99c52
mov qword [rsp + 0x90], rbx
movabs rdi, 0xf315c9c377a10bca
mov qword [rsp + 0x98], rdi
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x90], xmm1
lea rcx, [rsp + 0x90]
call fcn.140002490
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x1f0], r15
mov qword [rsp + 0x1f8], r14
movabs rcx, 0xa30c32200ae4a645
mov qword [rsp + 0x200], rcx
movabs rcx, 0xfe1b07fd93e380be
mov qword [rsp + 0x208], rcx
movabs rcx, 0x7b405e22e4e6e657
mov qword [rsp + 0x210], rcx
movabs r13, 0x1247326fa7705a78
mov qword [rsp + 0x218], r13
movabs rcx, 0x8c917bfc3c9a2269
mov qword [rsp + 0x220], rcx
movabs rcx, 0xd9ac56d9840d7bd2
mov qword [rsp + 0x228], rcx
movabs rcx, 0x7f952dae42a5ab3b
mov qword [rsp + 0x230], rcx
movabs rdx, 0x7268869b6e76476c
mov qword [rsp + 0x238], rdx
movabs rcx, 0x24e33e453cd6f860
mov qword [rsp + 0x130], rcx
movabs rcx, 0xf356c99f1b806fa1
mov qword [rsp + 0x138], rcx
movabs rcx, 0xa36932520a96a630
mov qword [rsp + 0x140], rcx
movabs rcx, 0xfe7407be939780d0
mov qword [rsp + 0x148], rcx
movabs rcx, 0x7b2f5e50e492e639
mov qword [rsp + 0x150], rcx
movabs rcx, 0x1233320aa7235a14
mov qword [rsp + 0x158], rcx
movabs rcx, 0x8ce37b993cc92235
mov qword [rsp + 0x160], rcx
movabs rcx, 0xd9c956ba84647ba4
mov qword [rsp + 0x168], rcx
movabs rcx, 0x7f952dae42a5ab48
mov qword [rsp + 0x170], rcx
mov qword [rsp + 0x178], rdx
vmovdqu xmm0, xmmword [rsp + 0x130]
vpxor xmm1, xmm0, xmmword [rsp + 0x1f0]
vmovdqu xmmword [rsp + 0x130], xmm1
vmovdqu xmm2, xmmword [rsp + 0x200]
vpxor xmm0, xmm2, xmmword [rsp + 0x140]
vmovdqu xmmword [rsp + 0x140], xmm0
vmovdqu xmm1, xmmword [rsp + 0x210]
vpxor xmm2, xmm1, xmmword [rsp + 0x150]
vmovdqu xmmword [rsp + 0x150], xmm2
vmovdqu xmm0, xmmword [rsp + 0x220]
vpxor xmm1, xmm0, xmmword [rsp + 0x160]
vmovdqu xmmword [rsp + 0x160], xmm1
vmovdqu xmm2, xmmword [rsp + 0x230]
vpxor xmm0, xmm2, xmmword [rsp + 0x170]
vmovdqu xmmword [rsp + 0x170], xmm0
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x130]
mov rcx, 0xffffffff80000002
call rax
test eax, eax
jne 0x1400050e8
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], r14
movabs rax, 0x50d65b647fe89d61
mov qword [rsp + 0x180], rax
movabs rax, 0xf342b18662a82481
mov qword [rsp + 0x188], rax
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x1a0]
vmovdqu xmmword [rsp + 0x180], xmm1
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], r14
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rdi
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x1a0]
vmovdqu xmmword [rsp + 0x90], xmm1
lea rcx, [rsp + 0x90]
call fcn.140002490
lea rdx, [rsp + 0x180]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
movabs rcx, 0x24b73e7a3ceef87d
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], r14
vmovdqu xmm0, xmmword [rsp + 0x120]
vpxor xmm1, xmm0, xmmword [rsp + 0x190]
vmovdqu xmmword [rsp + 0x120], xmm1
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x80]
call rax
test eax, eax
jne 0x140004f39
mov dword [rsp + 0xa0], 1
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], r14
movabs rax, 0x45e14a736fe89d61
mov qword [rsp + 0x90], rax
movabs rax, 0xf3159ebb5ea81a88
mov qword [rsp + 0x98], rax
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x180]
vmovdqu xmmword [rsp + 0x90], xmm1
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rdi
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x180], xmm1
lea rcx, [rsp + 0x180]
call fcn.140002490
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs rcx, 0x24d23e663cf6f867
mov qword [rsp + 0x1a0], rcx
mov qword [rsp + 0x1a8], r14
vmovdqu xmm0, xmmword [rsp + 0x1a0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x1a0], xmm1
mov dword [rsp + 0x28], 4
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x20], rcx
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x1a0]
mov rcx, qword [rsp + 0x70]
call rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r12w
mov r8d, 4
lea rdx, [0x140013848]
lea rcx, [rsp + 0x50]
call fcn.140006a80
nop
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xe0]
lea rcx, [rsp + 0x50]
call fcn.1400065c0
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x118], r12
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x100], ymm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140004628
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004620
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004620
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.140010864
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r12w
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs rax, 0x45e14a736fe89d61
mov qword [rsp + 0x90], rax
movabs rax, 0xf3159ebb5ea81a88
mov qword [rsp + 0x98], rax
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x90], xmm1
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rdi
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x180], xmm1
lea rcx, [rsp + 0x180]
vzeroupper
call fcn.140002490
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140002540
mov ecx, dword [rsp + 0x110]
lea ecx, [rcx*2 + 2]
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 8
cmovae rdx, qword [rsp + 0x100]
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs r8, 0xa30c32200ae4a645
mov qword [rsp + 0x1d0], r8
movabs r9, 0xfe1b07fd93e380be
mov qword [rsp + 0x1d8], r9
movabs r8, 0x24d03e773ce2f87a
mov qword [rsp + 0xb0], r8
movabs r8, 0xf361c9a21b9d6f81
mov qword [rsp + 0xb8], r8
movabs r8, 0xa30c32200ae4a62d
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xc8], r9
vmovdqu xmm0, xmmword [rsp + 0xb0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0xb0], xmm1
vmovdqu xmm2, xmmword [rsp + 0x1d0]
vpxor xmm0, xmm2, xmmword [rsp + 0xc0]
vmovdqu xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
call rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x260], r15
mov qword [rsp + 0x268], r14
movabs rax, 0xa30c32200ae4a645
mov qword [rsp + 0x270], rax
movabs rax, 0xfe1b07fd93e380be
mov qword [rsp + 0x278], rax
movabs rax, 0x7b405e22e4e6e657
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x288], r13
movabs rax, 0x8c917bfc3c9a2269
mov qword [rsp + 0x290], rax
movabs rax, 0xd9ac56d9840d7bd2
mov qword [rsp + 0x298], rax
movabs rax, 0x7f952dae42a5ab3b
mov qword [rsp + 0x2a0], rax
movabs rax, 0x7268869b6e76476c
mov qword [rsp + 0x2a8], rax
movabs rax, 0x8eb2ca9891d1d16d
mov qword [rsp + 0x2b0], rax
movabs rax, 0xa468cdd5fc4fab46
mov qword [rsp + 0x2b8], rax
movabs rax, 0xa08591fa6e722d7f
mov qword [rsp + 0x2c0], rax
movabs rax, 0xc22648672c1bee80
mov qword [rsp + 0x2c8], rax
movabs rax, 0x24d03e733cddf86f
mov qword [rsp + 0x1f0], rax
movabs rax, 0xf367c9b71bbe6f8d
mov qword [rsp + 0x1f8], rax
movabs rax, 0xa36d326d0ab8a63c
mov qword [rsp + 0x200], rax
movabs rax, 0xfe750794938b80dd
mov qword [rsp + 0x208], rax
movabs rax, 0x7b195e71e4bae632
mov qword [rsp + 0x210], rax
movabs rax, 0x120a322aa7245a2b
mov qword [rsp + 0x218], rax
movabs rax, 0x8ce37b893cd92235
mov qword [rsp + 0x220], rax
movabs rax, 0xd9d856b784687ba0
mov qword [rsp + 0x228], rax
movabs rax, 0x7fe12dc042caab78
mov qword [rsp + 0x230], rax
movabs rax, 0x723b86f76e19471e
mov qword [rsp + 0x238], rax
movabs rax, 0x8ee1cac491a5d108
mov qword [rsp + 0x240], rax
movabs rax, 0xa401cda3fc3dab23
mov qword [rsp + 0x248], rax
movabs rax, 0xa0d991896e172d1c
mov qword [rsp + 0x250], rax
movabs rax, 0xc226480b2c7aeece
mov qword [rsp + 0x258], rax
vmovdqu xmm0, xmmword [rsp + 0x1f0]
vpxor xmm1, xmm0, xmmword [rsp + 0x260]
vmovdqu xmmword [rsp + 0x1f0], xmm1
vmovdqu xmm2, xmmword [rsp + 0x270]
vpxor xmm0, xmm2, xmmword [rsp + 0x200]
vmovdqu xmmword [rsp + 0x200], xmm0
vmovdqu xmm1, xmmword [rsp + 0x280]
vpxor xmm2, xmm1, xmmword [rsp + 0x210]
vmovdqu xmmword [rsp + 0x210], xmm2
vmovdqu xmm0, xmmword [rsp + 0x290]
vpxor xmm1, xmm0, xmmword [rsp + 0x220]
vmovdqu xmmword [rsp + 0x220], xmm1
vmovdqu xmm2, xmmword [rsp + 0x2a0]
vpxor xmm0, xmm2, xmmword [rsp + 0x230]
vmovdqu xmmword [rsp + 0x230], xmm0
vmovdqu xmm1, xmmword [rsp + 0x2b0]
vpxor xmm2, xmm1, xmmword [rsp + 0x240]
vmovdqu xmmword [rsp + 0x240], xmm2
vmovdqu xmm0, xmmword [rsp + 0x2c0]
vpxor xmm1, xmm0, xmmword [rsp + 0x250]
vmovdqu xmmword [rsp + 0x250], xmm1
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs rax, 0x56f35a7753c38c7d
mov qword [rsp + 0x90], rax
movabs rax, 0xf315c9c369a8198d
mov qword [rsp + 0x98], rax
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x90], xmm1
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs rax, 0x48d3107a50eb8c5d
mov qword [rsp + 0x180], rax
movabs rax, 0xf315c9c31bcd6f88
mov qword [rsp + 0x188], rax
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x180], xmm1
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004b58
mov eax, dword [rax + 4]
jmp 0x140004b5d
mov eax, 0xffffffff
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x1b0]
call fcn.1400101f0
test eax, eax
js 0x140004d25
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs rax, 0x4df15b625dea8a70
mov qword [rsp + 0x90], rax
movabs rax, 0xf315c9c31b9a0a88
mov qword [rsp + 0x98], rax
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x90], xmm1
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs rax, 0x1684527352fd9d58
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], r14
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x180], xmm1
lea rcx, [rsp + 0x180]
call fcn.140002490
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs rcx, 0x24eb3e383cd3f86f
mov qword [rsp + 0xf0], rcx
movabs rcx, 0xf315c9af1bac6faa
mov qword [rsp + 0xf8], rcx
vmovdqu xmm0, xmmword [rsp + 0xf0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0xf0], xmm1
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0xf0]
call rax
mov qword [rsi], rax
mov rcx, rsi
call fcn.140005cc0
movzx ebx, al
mov rdx, qword [rsp + 0x118]
cmp rdx, 8
jb 0x1400050ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004f2b
call fcn.140010864
jmp 0x1400050ea
mov qword [rsp + 0x1f0], r15
mov qword [rsp + 0x1f8], r14
movabs r8, 0xa30c32200ae4a645
mov qword [rsp + 0x200], r8
movabs rcx, 0xfe1b07fd93e380be
mov qword [rsp + 0x208], rcx
movabs rcx, 0x7b405e22e4e6e657
mov qword [rsp + 0x210], rcx
mov qword [rsp + 0x218], r13
movabs rcx, 0x4bfb4a581cb58b16
mov qword [rsp + 0x1c0], rcx
movabs rcx, 0x8170bfaa69890b85
mov qword [rsp + 0x1c8], rcx
movabs rcx, 0x8325120e24ca866d
mov qword [rsp + 0x1d0], rcx
movabs rcx, 0xd63b268ffc91f2db
mov qword [rsp + 0x1d8], rcx
movabs rcx, 0x7b69061ad4c39e67
mov qword [rsp + 0x1e0], rcx
mov qword [rsp + 0x1e8], r13
vmovdqu xmm0, xmmword [rsp + 0x1c0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1f0]
vmovdqu xmmword [rsp + 0x1c0], xmm1
vmovdqu xmm2, xmmword [rsp + 0x200]
vpxor xmm0, xmm2, xmmword [rsp + 0x1d0]
vmovdqu xmmword [rsp + 0x1d0], xmm0
vmovdqu xmm1, xmmword [rsp + 0x210]
vpxor xmm2, xmm1, xmmword [rsp + 0x1e0]
vmovdqu xmmword [rsp + 0x1e0], xmm2
mov r8d, eax
lea rdx, str.NtSystem::Create
lea rcx, [rsp + 0x1c0]
call fcn.140010140
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
movabs rsi, 0x41c4517a7fe89d61
mov qword [rsp + 0x90], rsi
movabs r12, 0xf315c9c31bb40aaf
mov qword [rsp + 0x98], r12
vmovdqu xmm0, xmmword [rsp + 0x90]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x90], xmm1
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r14
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rdi
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x1c0]
vmovdqu xmmword [rsp + 0x180], xmm1
lea rcx, [rsp + 0x180]
call fcn.140002490
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.140002540
mov rcx, qword [rsp + 0x70]
call rax
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 8
jb 0x140004f4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010864
jmp 0x140004f4d
movabs rsi, 0x41c4517a7fe89d61
movabs r12, 0xf315c9c31bb40aaf
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], r14
movabs rax, 0x50d2527378e89d61
mov qword [rsp + 0x180], rax
movabs rax, 0xf315c99462a82481
mov qword [rsp + 0x188], rax
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x1b0]
vmovdqu xmmword [rsp + 0x180], xmm1
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x1a8], rdi
vmovdqu xmm0, xmmword [rsp + 0x1a0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1b0]
vmovdqu xmmword [rsp + 0x1a0], xmm1
lea rcx, [rsp + 0x1a0]
call fcn.140002490
lea rdx, [rsp + 0x180]
mov rcx, rax
call fcn.140002540
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], r14
movabs rcx, 0x24b73e7a3ceef87d
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], r14
vmovdqu xmm0, xmmword [rsp + 0x190]
vpxor xmm1, xmm0, xmmword [rsp + 0x1b0]
vmovdqu xmmword [rsp + 0x190], xmm1
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x80]
call rax
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], r12
vmovdqu xmm0, xmmword [rsp + 0x180]
vpxor xmm1, xmm0, xmmword [rsp + 0x1b0]
vmovdqu xmmword [rsp + 0x180], xmm1
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x1a8], rdi
vmovdqu xmm0, xmmword [rsp + 0x1a0]
vpxor xmm1, xmm0, xmmword [rsp + 0x1b0]
vmovdqu xmmword [rsp + 0x1a0], xmm1
lea rcx, [rsp + 0x1a0]
call fcn.140002490
lea rdx, [rsp + 0x180]
mov rcx, rax
call fcn.140002540
mov rcx, qword [rsp + 0x80]
call rax
xor bl, bl
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x140005135
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005130
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005130
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010864
movzx eax, bl
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140010840
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret