Function at 0x14002c0f0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov r15, rdx
mov rbx, rcx
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x80], rcx
xor r12d, r12d
lea r9, [rdx + 0x10]
mov qword [rsp + 0x38], r9
lea rsi, [rdx + 0x18]
mov qword [rsp + 0x30], rsi
mov edx, 0x28
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
cmp byte [rdx + rcx], r12b
je 0x14002c2c2
mov rax, qword [r9]
mov r8, r15
cmp qword [rsi], 8
jb 0x14002c16d
mov r8, qword [r15]
test rax, rax
je 0x14002c1ab
mov rcx, r8
mov rdx, r12
cmp word [r8], 0x5c
je 0x14002c193
nop
cmp rax, 1
je 0x14002c196
dec rax
add rcx, 2
cmp word [rcx], 0x5c
jne 0x14002c180
mov rdx, rcx
test rdx, rdx
je 0x14002c1ab
sub rdx, r8
sar rdx, 1
cmp rdx, 0xffffffffffffffff
jne 0x14002c2cc
call fcn.140008570
mov rdi, rax
mov r13, qword [rax + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, 1
jb 0x14002d010
cmp qword [rdi + 0x18], 8
jb 0x14002c1db
mov rdi, qword [rdi]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
lea r12, [r13 + 1]
mov ebx, 7
lea rsi, [rbp - 0x48]
cmp r12, rbx
jbe 0x14002c23b
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x14002c20d
mov rbx, rcx
jmp 0x14002c219
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
mov r14, 0xffffffffffffffff
cmovb rdx, r14
lea rcx, [rbp - 0x48]
call fcn.1400037f0
mov rsi, rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
lea rbx, [r13*2]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14009d3c0
mov eax, 0x5c
mov word [rbx + rsi], ax
xor ecx, ecx
mov word [rsi + r12*2], cx
mov r8, r15
lea rdx, [rbp - 0x48]
mov rbx, qword [rbp - 0x70]
mov rcx, rbx
call fcn.140012fb0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14002c337
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c332
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002cff9
jmp 0x14002c332
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rsi
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r12
mov edi, 7
mov qword [rbp + 0x20], rdi
mov word [rbp + 8], r12w
cmp qword [r9], 0
jne 0x14002c364
mov rdx, r15
mov rcx, rbx
call fcn.1400132f0
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x14002c337
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c332
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002cfff
call fcn.14009bfe4
mov rax, rbx
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0x5e0]
add rsp, 0x590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r15
cmp qword [rsi], 8
jb 0x14002c370
mov rcx, qword [r15]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp]
call qword [sym.imp.SHELL32.dll_SHEvaluateSystemCommandTemplate]
movabs r13, 0x7ffffffffffffffe
test eax, eax
js 0x14002c3c3
mov rdx, qword [rbp]
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002c3a0
lea rcx, [rbp + 8]
call fcn.140003510
mov rcx, qword [rbp]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14002cc03
mov rbx, r15
cmp qword [rsi], 8
jb 0x14002c3cf
mov rbx, qword [r15]
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14002d016
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x30], rax
mov rdx, rbx
lea rcx, [rbp + 0x30]
call fcn.1400062d0
mov r14, 0xffffffffffffffff
test al, al
jne 0x14002c42c
test rbx, rbx
jne 0x14002c40f
mov eax, r12d
jmp 0x14002c41c
mov rax, r14
inc rax
cmp word [rbx + rax*2], 0
jne 0x14002c412
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x30]
call fcn.1400068f0
nop
mov rax, r15
cmp qword [rsi], 8
jb 0x14002c438
mov rax, qword [r15]
movzx eax, word [rax]
mov word [rbp + 0x28], ax
mov rbx, qword [rbp + 0x30]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14002d005
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14002c46f
mov edx, edi
lea rcx, [rbp + 0x30]
call fcn.140006870
mov rbx, qword [rbp + 0x30]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.1400b14d0
lea r12, [rbx - 0x18]
mov qword [rbp - 0x78], r12
cmp edi, dword [r12 + 0xc]
jg 0x14002d005
mov dword [r12 + 8], edi
xor ecx, ecx
mov word [rbx + rdi*2], cx
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14002d021
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp + 0x40], rdi
lea rsi, str..EXE
lea rax, [0x14011a658]
mov rdx, qword [rsi]
test rdx, rdx
je 0x14002c502
cmp dword [r12 + 8], 0
jl 0x14002c502
mov rcx, rbx
call fcn.14009ecac
mov r12, rax
test rax, rax
je 0x14002c4f7
sub r12, rbx
sar r12, 1
test r12d, r12d
jns 0x14002c5bc
lea rax, [0x14011a658]
lea r12, [rbx - 0x18]
add rsi, 8
cmp rsi, rax
jne 0x14002c4c8
mov r12d, r14d
movzx eax, word [rbp + 0x28]
cmp ax, 0x22
jne 0x14002c9e7
mov edx, 0x5c
xor r8d, r8d
mov rcx, r15
call fcn.140012bd0
cmp rax, 0xffffffffffffffff
je 0x14002c9e3
lea edx, [r8 + 0x22]
lea r8d, [rdx - 0x20]
mov rcx, r15
call fcn.140012bd0
mov r8, rax
cmp rax, 0xffffffffffffffff
je 0x14002c9e3
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x38]
lea rbx, [r8 + 1]
cmp qword [rax], rbx
cmovb rbx, qword [rax]
mov rax, qword [rsp + 0x30]
cmp qword [rax], 8
jb 0x14002c579
mov r15, qword [r15]
cmp rbx, r13
ja 0x14002d044
cmp rbx, 8
jae 0x14002c714
mov qword [rsp + 0x50], rbx
mov esi, 7
mov qword [rsp + 0x58], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.14009d3c0
xor r15d, r15d
mov word [rsp + rbx + 0x40], r15w
jmp 0x14002c783
mov rdx, qword [rsi]
test rdx, rdx
jne 0x14002c5ca
xor esi, esi
mov eax, esi
jmp 0x14002c5dc
mov rax, r14
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002c5d0
xor esi, esi
mov r8d, eax
lea rcx, [rbp + 0x40]
call fcn.1400068f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov rcx, qword [rsp + 0x38]
mov eax, esi
cmp word [rbp + 0x28], 0x22
sete al
add eax, 4
add eax, r12d
cdqe
cmp qword [rcx], rax
cmovb rax, qword [rcx]
mov qword [rbp - 0x80], rax
mov rdx, r15
mov qword [rbp + 0x38], rdx
mov rcx, qword [rsp + 0x30]
cmp qword [rcx], 8
jb 0x14002c62b
mov rdx, qword [r15]
mov qword [rbp + 0x38], rdx
cmp rax, r13
ja 0x14002d044
cmp rax, 8
jae 0x14002c660
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 7
lea rdi, [rax + rax]
mov r8, rdi
lea rcx, [rsp + 0x60]
call fcn.14009d3c0
mov word [rsp + rdi + 0x60], si
jmp 0x14002c6bb
mov rdi, rax
or rdi, 7
cmp rdi, r13
jbe 0x14002c671
mov rdi, r13
jmp 0x14002c67e
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x60]
call fcn.1400037f0
mov rsi, rax
mov qword [rsp + 0x60], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
lea rdi, [rax + rax]
mov r8, rdi
mov rdx, qword [rbp + 0x38]
mov rcx, rsi
call fcn.14009d3c0
xor ecx, ecx
mov word [rsi + rdi], cx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 8]
call fcn.140005f80
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14002c70b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d02c
call fcn.14009bfe4
mov rdi, qword [rbp + 0x40]
jmp 0x14002c50e
mov r13, rbx
or r13, 7
movabs rcx, 0x7ffffffffffffffe
cmp r13, rcx
jbe 0x14002c72f
mov r13, rcx
jmp 0x14002c73c
cmp r13, 0xa
mov eax, 0xa
cmovb r13, rax
lea rdx, [r13 + 1]
lea rcx, [rsp + 0x40]
call fcn.1400037f0
mov rsi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r13
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.14009d3c0
xor r15d, r15d
mov word [rbx + rsi], r15w
lea esi, [r15 + 7]
movabs r13, 0x7ffffffffffffffe
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 8]
call fcn.140005f80
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002c7d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c7ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d02c
call fcn.14009bfe4
test r12d, r12d
jns 0x14002c943
mov rax, qword [rbp + 0x18]
lea rbx, [rax - 1]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
cmp rax, rbx
cmovb rbx, rax
lea r15, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae r15, qword [rbp + 8]
cmp rbx, r13
ja 0x14002d032
mov qword [rbp - 0x50], rsi
cmp rbx, 8
jae 0x14002c83c
mov qword [rbp - 0x58], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.14009d3c0
xor r15d, r15d
mov word [rbp + rbx - 0x68], r15w
jmp 0x14002c891
mov rax, rbx
or rax, 7
cmp rax, r13
ja 0x14002c858
mov r13, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r13, rax
lea rdx, [r13 + 1]
lea rcx, [rbp - 0x68]
call fcn.1400037f0
mov rsi, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], r13
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.14009d3c0
xor r15d, r15d
mov word [rbx + rsi], r15w
lea esi, [r15 + 7]
lea r8, str..exe_
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x20]
call fcn.140006cf0
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140005f80
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14002c8f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c8ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d038
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp - 0x10], xmm0
mov word [rbp - 0x20], r15w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x14002c943
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c93e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d03e
call fcn.14009bfe4
mov rbx, qword [rbp - 0x70]
movups xmm0, xmmword [rbp + 8]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x18]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], rsi
mov word [rbp + 8], r15w
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002c97e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rsi, qword [rbp - 0x78]
lock xadd dword [rsi + 0x10], r14d
sub r14d, 1
jg 0x14002c99b
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x14002c337
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c332
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002cfff
jmp 0x14002c332
movzx eax, word [rbp + 0x28]
test r12d, r12d
jns 0x14002ca96
cmp ax, 0x22
je 0x14002ca96
lea rsi, [rbx - 0x18]
cmp dword [rsi + 8], 0
jl 0x14002ca9a
lea rdx, str.PROGRAM_FILES
mov rcx, rbx
call fcn.14009ecac
test rax, rax
je 0x14002ca9a
sub rax, rbx
sar rax, 1
test eax, eax
js 0x14002ca9a
add eax, 0xa
movsxd r8, eax
mov edx, 0x20
mov rcx, r15
call fcn.140012bd0
cmp rax, 0xffffffffffffffff
jne 0x14002ca6d
lea rax, [rbp + 8]
mov r12, qword [rsp + 0x30]
cmp rax, r15
je 0x14002ca9f
mov rdx, r15
cmp qword [r12], 8
jb 0x14002ca5a
mov rdx, qword [r15]
mov rax, qword [rsp + 0x38]
mov r8, qword [rax]
lea rcx, [rbp + 8]
call fcn.140003510
jmp 0x14002ca9f
mov r9, rax
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, r15
call fcn.14000a520
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140005f80
lea rcx, [rbp - 0x20]
call fcn.140003960
jmp 0x14002ca9a
mov rsi, qword [rbp - 0x78]
mov r12, qword [rsp + 0x30]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
jne 0x14002cb1a
mov rcx, r15
cmp qword [r12], 8
jb 0x14002cab5
mov rcx, qword [r15]
lea rdx, [rbp + 0x28]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
test rax, rax
je 0x14002caef
mov rdx, qword [rax]
mov r8, r14
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002cad0
lea rcx, [rbp + 8]
call fcn.140003510
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14002cb16
lea rax, [rbp + 8]
cmp rax, r15
je 0x14002cb16
cmp qword [r12], 8
jb 0x14002cb02
mov r15, qword [r15]
mov rax, qword [rsp + 0x38]
mov r8, qword [rax]
mov rdx, r15
lea rcx, [rbp + 8]
call fcn.140003510
mov rdx, qword [rbp + 0x18]
lea r8, [rbp + 8]
mov r10, qword [rbp + 8]
mov r9, qword [rbp + 0x20]
cmp r9, 8
cmovae r8, r10
test rdx, rdx
je 0x14002cb6b
lea rcx, [rdx - 1]
mov rax, r14
cmp rcx, r14
cmovb rax, rcx
lea rcx, [r8 + rax*2]
cmp word [rcx], 0x2e
je 0x14002cb5f
nop dword [rax + rax]
cmp rcx, r8
je 0x14002cb6b
sub rcx, 2
cmp word [rcx], 0x2e
jne 0x14002cb50
sub rcx, r8
sar rcx, 1
cmp rcx, 0xffffffffffffffff
jne 0x14002cbc7
mov rax, r9
sub rax, rdx
cmp rax, 4
jb 0x14002cba4
lea rax, [rdx + 4]
mov qword [rbp + 0x18], rax
lea rax, [rbp + 8]
cmp r9, 8
cmovae rax, r10
movabs rcx, 0x6500780065002e
mov qword [rax + rdx*2], rcx
xor r12d, r12d
mov word [rax + rdx*2 + 8], r12w
jmp 0x14002cbca
mov qword [rsp + 0x20], 4
lea r9, [0x1400f0090]
movzx r8d, byte [rbp + 0x28]
mov edx, 4
lea rcx, [rbp + 8]
call fcn.140007950
xor r12d, r12d
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002cbe5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x14002cbfe
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + VariantCopy]
mov edi, 7
lea r8, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae r8, qword [rbp + 8]
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x14002cc52
mov rcx, r8
mov rdx, r12
cmp word [r8], 0x3a
je 0x14002cc3a
cmp rax, 1
je 0x14002cc3d
dec rax
add rcx, 2
cmp word [rcx], 0x3a
jne 0x14002cc27
mov rdx, rcx
test rdx, rdx
je 0x14002cc52
sub rdx, r8
sar rdx, 1
cmp rdx, 0xffffffffffffffff
jne 0x14002cfdb
call fcn.14002dc10
test al, al
je 0x14002cc66
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rcx, qword [rbp + 8]
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14002cf22
call fcn.14002dc10
test al, al
je 0x14002ce75
call fcn.140008570
mov rsi, rax
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x80], rcx
mov rax, r13
sub rax, rcx
cmp rax, 1
jb 0x14002d04a
cmp qword [rsi + 0x18], 8
jb 0x14002ccc3
mov rsi, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r12, [rcx + 1]
mov rbx, rdi
lea r15, [rsp + 0x40]
cmp r12, 7
jbe 0x14002cd25
mov rbx, r12
or rbx, 7
cmp rbx, r13
jbe 0x14002ccf7
mov rbx, r13
jmp 0x14002cd04
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
cmovb rdx, r14
lea rcx, [rsp + 0x40]
call fcn.1400037f0
mov r15, rax
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
lea rbx, [rcx + rcx]
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call fcn.14009d3c0
mov eax, 0x5c
mov word [r15 + rbx], ax
xor ecx, ecx
mov word [r15 + r12*2], cx
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rdx, qword [rbp + 8]
mov r8, qword [rbp + 0x18]
lea rcx, [rsp + 0x40]
call fcn.140006fe0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rdi
mov word [rax], r12w
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
xor edx, edx
lea r8d, [r12 + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14002ce02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cdfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d050
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14002ce58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ce53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d056
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r12w
test rbx, rbx
jne 0x14002cf22
lea r8, [rbp + 8]
mov r9, qword [rbp + 8]
mov r10, qword [rbp + 0x20]
cmp r10, 8
cmovae r8, r9
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x14002cecb
mov rcx, r8
mov rdx, r12
cmp word [r8], 0x5c
je 0x14002ceb3
nop
cmp rax, 1
je 0x14002ceb6
dec rax
add rcx, 2
cmp word [rcx], 0x5c
jne 0x14002cea0
mov rdx, rcx
test rdx, rdx
je 0x14002cecb
sub rdx, r8
sar rdx, 1
cmp rdx, 0xffffffffffffffff
jne 0x14002cfc8
lea rdx, [rbp + 8]
cmp r10, 8
cmovae rdx, r9
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x14002cfc8
lea rax, [rbp + 0x70]
inc r14
cmp word [rax + r14*2], 0
jne 0x14002cf02
mov r8, r14
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 8]
call fcn.140003510
jmp 0x14002cfc8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r9d, 0x208
lea r8, [rbp + 0x70]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetMappedFileNameW]
test eax, eax
je 0x14002cfbe
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x48]
call fcn.14002d0a0
nop
lea rdx, [rbp + 0x48]
lea rax, [rbp + 8]
cmp qword [rbp + 0x58], 0
cmovbe rdx, rax
lea rax, [rbp + 8]
cmp rax, rdx
je 0x14002cf82
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14002cf78
mov rdx, qword [rdx]
lea rcx, [rbp + 8]
call fcn.140003510
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 8
jb 0x14002cfbe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cfb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002cff3
call fcn.14009bfe4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
call fcn.14002dc10
test al, al
je 0x14002cfdb
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov rax, qword [rbp - 0x70]
movups xmm0, xmmword [rbp + 8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbp + 0x18]
movups xmmword [rax + 0x10], xmm1
jmp 0x14002c33a
call fcn.1400a3080
nop
call fcn.1400a3080
int3
call fcn.1400a3080
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
call fcn.140003690
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
call fcn.1400a3080
int3
call fcn.140003690
nop
call fcn.1400a3080
nop
call fcn.1400a3080
int3
call fcn.140003690
nop
call fcn.140003690
nop
call fcn.1400a3080
nop
call fcn.1400a3080
int3