Function at 0x140006a60
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2170
call fcn.1400c0680
sub rsp, rax
lea rdi, [rsp + 0x40]
mov ecx, 0x84c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2180]
lea rcx, [rsp + 0x50]
call fcn.140004cd0
nop
lea rdx, str.a365
lea rcx, [rsp + 0x370]
call fcn.140004c00
mov qword [rsp + 0x1c50], rax
mov rax, qword [rsp + 0x1c50]
mov qword [rsp + 0x1c58], rax
mov rdx, qword [rsp + 0x1c58]
lea rcx, [rsp + 0x338]
call fcn.140044df0
mov qword [rsp + 0x1c60], rax
mov rax, qword [rsp + 0x1c60]
mov qword [rsp + 0x1c68], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1c68]
mov rcx, rax
call fcn.14000aec0
nop
lea rcx, [rsp + 0x338]
call fcn.140004d30
nop
lea rcx, [rsp + 0x370]
call fcn.140004d90
lea rcx, [rsp + 0x3c8]
call fcn.1400069e0
mov qword [rsp + 0x1c70], rax
mov rax, qword [rsp + 0x1c70]
mov qword [rsp + 0x1c78], rax
mov rdx, qword [rsp + 0x1c78]
lea rcx, [rsp + 0x50]
call fcn.140008ed0
nop
lea rcx, [rsp + 0x3c8]
call fcn.140004db0
mov r8d, 4
lea rdx, [rsp + 0x428]
lea rcx, [rsp + 0x50]
call fcn.140055ae0
mov qword [rsp + 0x1c80], rax
mov rax, qword [rsp + 0x1c80]
mov qword [rsp + 0x1c88], rax
lea rdx, [0x1401a66c8]
mov rcx, qword [rsp + 0x1c88]
call fcn.140008f00
mov dword [rsp + 0x420], eax
lea rcx, [rsp + 0x428]
call fcn.140004db0
cmp dword [rsp + 0x420], 0
je 0x140008299
lea rdx, str.2022_10_1_20:01:12
lea rcx, [rsp + 0x480]
call fcn.140004c00
mov qword [rsp + 0x1c90], rax
mov rax, qword [rsp + 0x1c90]
mov qword [rsp + 0x1c98], rax
mov rcx, qword [rsp + 0x1c98]
call fcn.140052c70
mov edx, 1
mov rcx, rax
call fcn.1400610e0
movsd qword [rsp + 0xb8], xmm0
lea rcx, [rsp + 0x480]
call fcn.140004d90
call fcn.140062b40
movsd xmm1, qword [rsp + 0xb8]
comisd xmm1, xmm0
jbe 0x140006cfd
lea rdx, [0x1401a66d4]
lea rcx, [rsp + 0x510]
call fcn.140004c00
mov qword [rsp + 0x1ca0], rax
mov rax, qword [rsp + 0x1ca0]
mov qword [rsp + 0x1ca8], rax
mov rdx, qword [rsp + 0x1ca8]
lea rcx, [rsp + 0x4d8]
call fcn.140044df0
mov qword [rsp + 0x1cb0], rax
mov rax, qword [rsp + 0x1cb0]
mov qword [rsp + 0x1cb8], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1cb8]
mov rcx, rax
call fcn.14000aec0
nop
lea rcx, [rsp + 0x4d8]
call fcn.140004d30
nop
lea rcx, [rsp + 0x510]
call fcn.140004d90
mov dword [rsp + 0x568], 1
lea rcx, [rsp + 0x50]
call fcn.140004db0
mov eax, dword [rsp + 0x568]
jmp 0x1400087fe
lea rcx, [rsp + 0x570]
call fcn.1400117c0
mov qword [rsp + 0x1cc0], rax
mov rax, qword [rsp + 0x1cc0]
mov qword [rsp + 0x1cc8], rax
mov r8d, 4
lea rdx, [rsp + 0x5c8]
mov rcx, qword [rsp + 0x1cc8]
call fcn.140055ae0
mov qword [rsp + 0x1cd0], rax
mov rax, qword [rsp + 0x1cd0]
mov qword [rsp + 0x1cd8], rax
mov r8d, 1
lea rdx, [rsp + 0x620]
mov rcx, qword [rsp + 0x1cd8]
call fcn.140055950
mov qword [rsp + 0x1ce0], rax
mov rax, qword [rsp + 0x1ce0]
mov qword [rsp + 0x1ce8], rax
lea rdx, [0x1401a66c4]
mov rcx, qword [rsp + 0x1ce8]
call fcn.140008f70
mov dword [rsp + 0x56c], eax
lea rcx, [rsp + 0x620]
call fcn.140004db0
nop
lea rcx, [rsp + 0x5c8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x570]
call fcn.140004db0
cmp dword [rsp + 0x56c], 0
je 0x140006de6
xor edx, edx
lea rcx, [0x140259aa0]
call fcn.140011a20
jmp 0x140006e07
mov dword [rsp + 0x678], 1
lea rcx, [rsp + 0x50]
call fcn.140004db0
mov eax, dword [rsp + 0x678]
jmp 0x1400087fe
lea rcx, [rsp + 0xd0]
call fcn.140004cd0
nop
lea rcx, [rsp + 0x150]
call fcn.140004cd0
nop
lea rcx, [rsp + 0x50]
call fcn.140052cf0
mov qword [rsp + 0x1cf0], rax
lea rdx, [0x1401a66dc]
lea rcx, [rsp + 0x680]
call fcn.140004c00
mov qword [rsp + 0x1cf8], rax
mov rax, qword [rsp + 0x1cf8]
mov qword [rsp + 0x1d00], rax
mov rcx, qword [rsp + 0x1d00]
call fcn.140052c70
mov qword [rsp + 0x20], 1
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140056580
mov rcx, qword [rsp + 0x1cf0]
sub ecx, eax
mov eax, ecx
dec eax
cdqe
mov r8, rax
lea rdx, [rsp + 0x6d8]
lea rcx, [rsp + 0x50]
call fcn.140055ae0
mov qword [rsp + 0x1d08], rax
mov rax, qword [rsp + 0x1d08]
mov qword [rsp + 0x1d10], rax
mov rdx, qword [rsp + 0x1d10]
lea rcx, [rsp + 0x150]
call fcn.140008ed0
nop
lea rcx, [rsp + 0x6d8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x680]
call fcn.140004d90
lea rcx, [rsp + 0x150]
call fcn.140052cf0
sub eax, 7
cdqe
mov r8, rax
lea rdx, [rsp + 0x730]
lea rcx, [rsp + 0x150]
call fcn.140055950
mov qword [rsp + 0x1d18], rax
mov rax, qword [rsp + 0x1d18]
mov qword [rsp + 0x1d20], rax
mov rdx, qword [rsp + 0x1d20]
lea rcx, [rsp + 0x150]
call fcn.140008ed0
nop
lea rcx, [rsp + 0x730]
call fcn.140004db0
call fcn.1400166f0
mov dword [rsp + 0x1d28], eax
lea rcx, [rsp + 0x788]
call fcn.140044d80
mov qword [rsp + 0x1d30], rax
mov rax, qword [rsp + 0x1d30]
mov qword [rsp + 0x1d38], rax
lea rcx, [rsp + 0x150]
call fcn.140052c70
mov rdx, qword [rsp + 0x1d38]
mov rcx, rax
call fcn.140009b30
mov ecx, dword [rsp + 0x1d28]
mov r8d, ecx
mov rdx, rax
lea rcx, [rsp + 0x7c0]
call fcn.1400068b0
mov qword [rsp + 0x1d40], rax
mov rax, qword [rsp + 0x1d40]
mov qword [rsp + 0x1d48], rax
mov rdx, qword [rsp + 0x1d48]
lea rcx, [rsp + 0x7f8]
call fcn.1400133e0
mov qword [rsp + 0x1d50], rax
mov rax, qword [rsp + 0x1d50]
mov qword [rsp + 0x1d58], rax
mov rdx, qword [rsp + 0x1d58]
lea rcx, [rsp + 0x150]
call fcn.140008ed0
nop
lea rcx, [rsp + 0x7f8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x7c0]
call fcn.140004d30
nop
lea rcx, [rsp + 0x788]
call fcn.140004d30
lea rcx, [rsp + 0x150]
call fcn.140052cf0
mov qword [rsp + 0x1d60], rax
lea rdx, [0x1401a66e0]
lea rcx, [rsp + 0x850]
call fcn.140004c00
mov qword [rsp + 0x1d68], rax
mov rax, qword [rsp + 0x1d68]
mov qword [rsp + 0x1d70], rax
mov rcx, qword [rsp + 0x1d70]
call fcn.140052c70
mov qword [rsp + 0x20], 1
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140056580
mov rcx, qword [rsp + 0x1d60]
sub ecx, eax
mov eax, ecx
dec eax
cdqe
mov r8, rax
lea rdx, [rsp + 0x8a8]
lea rcx, [rsp + 0x150]
call fcn.140055ae0
mov qword [rsp + 0x1d78], rax
mov rax, qword [rsp + 0x1d78]
mov qword [rsp + 0x1d80], rax
mov rdx, qword [rsp + 0x1d80]
lea rcx, [rsp + 0xd0]
call fcn.140008ed0
nop
lea rcx, [rsp + 0x8a8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x850]
call fcn.140004d90
lea rcx, [rsp + 0x150]
call fcn.140052cf0
mov qword [rsp + 0x1d88], rax
lea rcx, [rsp + 0xd0]
call fcn.140052cf0
mov rcx, qword [rsp + 0x1d88]
sub ecx, eax
mov eax, ecx
cdqe
mov r8, rax
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x150]
call fcn.140055950
mov qword [rsp + 0x1d90], rax
mov rax, qword [rsp + 0x1d90]
mov qword [rsp + 0x1d98], rax
mov rdx, qword [rsp + 0x1d98]
lea rcx, [rsp + 0x150]
call fcn.140008ed0
nop
lea rcx, [rsp + 0x900]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x958]
call fcn.140058d50
mov qword [rsp + 0x1da0], rax
mov rax, qword [rsp + 0x1da0]
mov qword [rsp + 0x1da8], rax
lea r8, [0x1401a66e8]
mov rdx, qword [rsp + 0x1da8]
lea rcx, [rsp + 0x9b0]
call fcn.140058fc0
mov qword [rsp + 0x1db0], rax
mov rax, qword [rsp + 0x1db0]
mov qword [rsp + 0x1db8], rax
mov rcx, qword [rsp + 0x1db8]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x9b0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x958]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xa08]
call fcn.1400066c0
mov qword [rsp + 0x1dc0], rax
mov rax, qword [rsp + 0x1dc0]
mov qword [rsp + 0x1dc8], rax
mov rdx, qword [rsp + 0x1dc8]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0xa08]
call fcn.140004d30
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1401a66f8]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xa40]
call fcn.140058fc0
mov qword [rsp + 0x1dd0], rax
mov rax, qword [rsp + 0x1dd0]
mov qword [rsp + 0x1dd8], rax
mov rcx, qword [rsp + 0x1dd8]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xa40]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xa98]
call fcn.140006770
mov qword [rsp + 0x1de0], rax
mov rax, qword [rsp + 0x1de0]
mov qword [rsp + 0x1de8], rax
mov rdx, qword [rsp + 0x1de8]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0xa98]
call fcn.140004d30
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1401a6718]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xad0]
call fcn.140058fc0
mov qword [rsp + 0x1df0], rax
mov rax, qword [rsp + 0x1df0]
mov qword [rsp + 0x1df8], rax
mov rcx, qword [rsp + 0x1df8]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xad0]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xb28]
call fcn.140006810
mov qword [rsp + 0x1e00], rax
mov rax, qword [rsp + 0x1e00]
mov qword [rsp + 0x1e08], rax
mov rdx, qword [rsp + 0x1e08]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0xb28]
call fcn.140004d30
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1401a6760]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xb60]
call fcn.140058fc0
mov qword [rsp + 0x1e10], rax
mov rax, qword [rsp + 0x1e10]
mov qword [rsp + 0x1e18], rax
mov rcx, qword [rsp + 0x1e18]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xb60]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0xbb8]
call fcn.140006610
mov qword [rsp + 0x1e20], rax
mov rax, qword [rsp + 0x1e20]
mov qword [rsp + 0x1e28], rax
mov rdx, qword [rsp + 0x1e28]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0xbb8]
call fcn.140004d30
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0xbf0]
call fcn.140058d50
mov qword [rsp + 0x1e30], rax
mov rax, qword [rsp + 0x1e30]
mov qword [rsp + 0x1e38], rax
lea r8, [0x1401a67b8]
mov rdx, qword [rsp + 0x1e38]
lea rcx, [rsp + 0xc48]
call fcn.140058fc0
mov qword [rsp + 0x1e40], rax
mov rax, qword [rsp + 0x1e40]
mov qword [rsp + 0x1e48], rax
mov rcx, qword [rsp + 0x1e48]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xc48]
call fcn.140004db0
nop
lea rcx, [rsp + 0xbf0]
call fcn.140004db0
mov rdx, qword [rsp + 0x2180]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1401a66e4]
lea rcx, [rsp + 0xcd8]
call fcn.140004c00
mov qword [rsp + 0x1e50], rax
mov rax, qword [rsp + 0x1e50]
mov qword [rsp + 0x1e58], rax
mov rdx, qword [rsp + 0x1e58]
lea rcx, [rsp + 0xca0]
call fcn.140044df0
mov qword [rsp + 0x1e60], rax
mov rax, qword [rsp + 0x1e60]
mov qword [rsp + 0x1e68], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1e68]
mov rcx, rax
call fcn.14000aec0
nop
lea rcx, [rsp + 0xca0]
call fcn.140004d30
nop
lea rcx, [rsp + 0xcd8]
call fcn.140004d90
mov ecx, 0x5669
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401a66f4]
lea rcx, [rsp + 0xd30]
call fcn.140004c00
mov qword [rsp + 0x1e70], rax
mov rax, qword [rsp + 0x1e70]
mov qword [rsp + 0x1e78], rax
lea r8, [rsp + 0x150]
mov rdx, qword [rsp + 0x1e78]
lea rcx, [rsp + 0xd88]
call fcn.140058d50
mov qword [rsp + 0x1e80], rax
mov rax, qword [rsp + 0x1e80]
mov qword [rsp + 0x1e88], rax
lea r8, [rsp + 0xd0]
mov rdx, qword [rsp + 0x1e88]
lea rcx, [rsp + 0xde0]
call fcn.140058d50
mov qword [rsp + 0x1e90], rax
mov rax, qword [rsp + 0x1e90]
mov qword [rsp + 0x1e98], rax
lea r8, [0x1401a6738]
mov rdx, qword [rsp + 0x1e98]
lea rcx, [rsp + 0xe38]
call fcn.140058fc0
mov qword [rsp + 0x1ea0], rax
mov rax, qword [rsp + 0x1ea0]
mov qword [rsp + 0x1ea8], rax
mov rcx, qword [rsp + 0x1ea8]
call fcn.140052c70
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1401a67c8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0xe38]
call fcn.140004db0
nop
lea rcx, [rsp + 0xde0]
call fcn.140004db0
nop
lea rcx, [rsp + 0xd88]
call fcn.140004db0
nop
lea rcx, [rsp + 0xd30]
call fcn.140004d90
cmp dword [rsp + 0x2188], 0x5f1
jle 0x14000825c
mov edx, 0x3a98
mov ecx, 0x2710
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x1d0]
call fcn.140004cd0
nop
lea rcx, [rsp + 0x250]
call fcn.140004cd0
nop
mov edx, 8
lea rcx, [rsp + 0xe90]
call fcn.1400113a0
mov qword [rsp + 0x1eb0], rax
mov rax, qword [rsp + 0x1eb0]
mov qword [rsp + 0x1eb8], rax
lea r8, str.deepscan_
mov rdx, qword [rsp + 0x1eb8]
lea rcx, [rsp + 0xee8]
call fcn.140058fc0
mov qword [rsp + 0x1ec0], rax
mov rax, qword [rsp + 0x1ec0]
mov qword [rsp + 0x1ec8], rax
mov rdx, qword [rsp + 0x1ec8]
lea rcx, [rsp + 0x1d0]
call fcn.140008ed0
nop
lea rcx, [rsp + 0xee8]
call fcn.140004db0
nop
lea rcx, [rsp + 0xe90]
call fcn.140004db0
mov edx, 5
lea rcx, [rsp + 0xf40]
call fcn.140013160
mov qword [rsp + 0x1ed0], rax
mov rax, qword [rsp + 0x1ed0]
mov qword [rsp + 0x1ed8], rax
mov rdx, qword [rsp + 0x1ed8]
lea rcx, [rsp + 0x250]
call fcn.140008ed0
nop
lea rcx, [rsp + 0xf40]
call fcn.140004db0
lea rcx, [rsp + 0x1d0]
call fcn.140052c70
mov rcx, rax
call fcn.1400382a0
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0xf98]
call fcn.140058d50
mov qword [rsp + 0x1ee0], rax
mov rax, qword [rsp + 0x1ee0]
mov qword [rsp + 0x1ee8], rax
lea r8, [0x1401a67d8]
mov rdx, qword [rsp + 0x1ee8]
lea rcx, [rsp + 0xff0]
call fcn.140058fc0
mov qword [rsp + 0x1ef0], rax
mov rax, qword [rsp + 0x1ef0]
mov qword [rsp + 0x1ef8], rax
mov rcx, qword [rsp + 0x1ef8]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0xff0]
call fcn.140004db0
nop
lea rcx, [rsp + 0xf98]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x1048]
call fcn.1400066c0
mov qword [rsp + 0x1f00], rax
mov rax, qword [rsp + 0x1f00]
mov qword [rsp + 0x1f08], rax
mov rdx, qword [rsp + 0x1f08]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0x1048]
call fcn.140004d30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [0x1401a67e8]
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x1080]
call fcn.140058fc0
mov qword [rsp + 0x1f10], rax
mov rax, qword [rsp + 0x1f10]
mov qword [rsp + 0x1f18], rax
mov rcx, qword [rsp + 0x1f18]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x1080]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x10d8]
call fcn.140006770
mov qword [rsp + 0x1f20], rax
mov rax, qword [rsp + 0x1f20]
mov qword [rsp + 0x1f28], rax
mov rdx, qword [rsp + 0x1f28]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0x10d8]
call fcn.140004d30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.msvcr100.dll
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x1110]
call fcn.140058fc0
mov qword [rsp + 0x1f30], rax
mov rax, qword [rsp + 0x1f30]
mov qword [rsp + 0x1f38], rax
mov rcx, qword [rsp + 0x1f38]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x1110]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x1168]
call fcn.140006810
mov qword [rsp + 0x1f40], rax
mov rax, qword [rsp + 0x1f40]
mov qword [rsp + 0x1f48], rax
mov rdx, qword [rsp + 0x1f48]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0x1168]
call fcn.140004d30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, str.Microsoft.WindowsAppRuntime.Bootstrap.dll
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x11a0]
call fcn.140058fc0
mov qword [rsp + 0x1f50], rax
mov rax, qword [rsp + 0x1f50]
mov qword [rsp + 0x1f58], rax
mov rcx, qword [rsp + 0x1f58]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x11a0]
call fcn.140004db0
mov edx, 0x7d0
mov ecx, 0x3e8
call fcn.1400372b0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x11f8]
call fcn.140006610
mov qword [rsp + 0x1f60], rax
mov rax, qword [rsp + 0x1f60]
mov qword [rsp + 0x1f68], rax
mov rdx, qword [rsp + 0x1f68]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0x11f8]
call fcn.140004d30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x1230]
call fcn.140058d50
mov qword [rsp + 0x1f70], rax
mov rax, qword [rsp + 0x1f70]
mov qword [rsp + 0x1f78], rax
lea r8, str..txt
mov rdx, qword [rsp + 0x1f78]
lea rcx, [rsp + 0x1288]
call fcn.140058fc0
mov qword [rsp + 0x1f80], rax
mov rax, qword [rsp + 0x1f80]
mov qword [rsp + 0x1f88], rax
mov rcx, qword [rsp + 0x1f88]
call fcn.140004de0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x1288]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1230]
call fcn.140004db0
mov dword [rsp + 0x12e0], 0
mov dword [rsp + 0x12e4], 0
lea rdx, str.95BBFFFFE16ACD15355D7F0C57E87F12B725A20B6365AD096A71998F71E272D4FD2F6C403FB63B5A32F489185E4915614CBEA3841BCE6C98874980B2CD0104990C7320E0
lea rcx, [rsp + 0x12e8]
call fcn.140004c00
mov qword [rsp + 0x1f90], rax
mov rax, qword [rsp + 0x1f90]
mov qword [rsp + 0x1f98], rax
lea r9, [rsp + 0x12e0]
lea r8, [rsp + 0x12e4]
mov rdx, qword [rsp + 0x1f98]
lea rcx, [rsp + 0x1340]
call fcn.140006510
mov qword [rsp + 0x1fa0], rax
mov rax, qword [rsp + 0x1fa0]
mov qword [rsp + 0x1fa8], rax
mov rdx, qword [rsp + 0x1fa8]
mov rcx, qword [rsp + 0x1b8]
call fcn.140016620
nop
lea rcx, [rsp + 0x1340]
call fcn.140004d30
nop
lea rcx, [rsp + 0x12e8]
call fcn.140004d90
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1401a6828]
lea rcx, [rsp + 0x13b0]
call fcn.140004c00
mov qword [rsp + 0x1fb0], rax
mov rax, qword [rsp + 0x1fb0]
mov qword [rsp + 0x1fb8], rax
mov rdx, qword [rsp + 0x1fb8]
lea rcx, [rsp + 0x1378]
call fcn.140044df0
mov qword [rsp + 0x1fc0], rax
mov rax, qword [rsp + 0x1fc0]
mov qword [rsp + 0x1fc8], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x1fc8]
mov rcx, rax
call fcn.14000aec0
nop
lea rcx, [rsp + 0x1378]
call fcn.140004d30
nop
lea rcx, [rsp + 0x13b0]
call fcn.140004d90
lea rdx, [0x1401a6714]
lea rcx, [rsp + 0x1408]
call fcn.140004c00
mov qword [rsp + 0x1fd0], rax
mov rax, qword [rsp + 0x1fd0]
mov qword [rsp + 0x1fd8], rax
lea r8, [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1fd8]
lea rcx, [rsp + 0x1460]
call fcn.140058d50
mov qword [rsp + 0x1fe0], rax
mov rax, qword [rsp + 0x1fe0]
mov qword [rsp + 0x1fe8], rax
lea r8, [rsp + 0x250]
mov rdx, qword [rsp + 0x1fe8]
lea rcx, [rsp + 0x14b8]
call fcn.140058d50
mov qword [rsp + 0x1ff0], rax
mov rax, qword [rsp + 0x1ff0]
mov qword [rsp + 0x1ff8], rax
lea r8, str..exe_
mov rdx, qword [rsp + 0x1ff8]
lea rcx, [rsp + 0x1510]
call fcn.140058fc0
mov qword [rsp + 0x2000], rax
mov rax, qword [rsp + 0x2000]
mov qword [rsp + 0x2008], rax
mov rcx, qword [rsp + 0x2008]
call fcn.140052c70
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x1401a69f8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x1510]
call fcn.140004db0
nop
lea rcx, [rsp + 0x14b8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1460]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1408]
call fcn.140004d90
lea rdx, [0x1401a6744]
lea rcx, [rsp + 0x15a0]
call fcn.140004c00
mov qword [rsp + 0x2010], rax
mov rax, qword [rsp + 0x2010]
mov qword [rsp + 0x2018], rax
mov rdx, qword [rsp + 0x2018]
lea rcx, [rsp + 0x1568]
call fcn.140044df0
mov qword [rsp + 0x2020], rax
mov rax, qword [rsp + 0x2020]
mov qword [rsp + 0x2028], rax
lea rcx, [0x140259880]
call fcn.140005480
mov rdx, qword [rsp + 0x2028]
mov rcx, rax
call fcn.14000aec0
nop
lea rcx, [rsp + 0x1568]
call fcn.140004d30
nop
lea rcx, [rsp + 0x15a0]
call fcn.140004d90
nop
lea rcx, [rsp + 0x250]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1d0]
call fcn.140004db0
mov dword [rsp + 0x15f8], 1
lea rcx, [rsp + 0x150]
call fcn.140004db0
nop
lea rcx, [rsp + 0xd0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x50]
call fcn.140004db0
mov eax, dword [rsp + 0x15f8]
jmp 0x1400087fe
lea rcx, [rsp + 0x2d0]
call fcn.140004cd0
nop
xor ecx, ecx
call fcn.140036fe0
mov edx, 0xa
mov ecx, 5
call fcn.1400372b0
mov edx, eax
lea rcx, [rsp + 0x1600]
call fcn.140013160
mov qword [rsp + 0x2030], rax
mov rax, qword [rsp + 0x2030]
mov qword [rsp + 0x2038], rax
mov edx, 0xa
mov ecx, 5
call fcn.1400372b0
mov edx, eax
lea rcx, [rsp + 0x1658]
call fcn.140013160
mov qword [rsp + 0x2040], rax
mov rax, qword [rsp + 0x2040]
mov qword [rsp + 0x2048], rax
mov edx, 8
lea rcx, [rsp + 0x16b0]
call fcn.1400113a0
mov qword [rsp + 0x2050], rax
mov rax, qword [rsp + 0x2050]
mov qword [rsp + 0x2058], rax
lea r8, str.aokhn_
mov rdx, qword [rsp + 0x2058]
lea rcx, [rsp + 0x1708]
call fcn.140058fc0
mov qword [rsp + 0x2060], rax
mov rax, qword [rsp + 0x2060]
mov qword [rsp + 0x2068], rax
mov r8, qword [rsp + 0x2048]
mov rdx, qword [rsp + 0x2068]
lea rcx, [rsp + 0x1760]
call fcn.140058d50
mov qword [rsp + 0x2070], rax
mov rax, qword [rsp + 0x2070]
mov qword [rsp + 0x2078], rax
lea r8, [0x1401a67c4]
mov rdx, qword [rsp + 0x2078]
lea rcx, [rsp + 0x17b8]
call fcn.140058fc0
mov qword [rsp + 0x2080], rax
mov rax, qword [rsp + 0x2080]
mov qword [rsp + 0x2088], rax
mov r8, qword [rsp + 0x2038]
mov rdx, qword [rsp + 0x2088]
lea rcx, [rsp + 0x1810]
call fcn.140058d50
mov qword [rsp + 0x2090], rax
mov rax, qword [rsp + 0x2090]
mov qword [rsp + 0x2098], rax
lea r8, [0x1401a67b4]
mov rdx, qword [rsp + 0x2098]
lea rcx, [rsp + 0x1868]
call fcn.140058fc0
mov qword [rsp + 0x20a0], rax
mov rax, qword [rsp + 0x20a0]
mov qword [rsp + 0x20a8], rax
mov rdx, qword [rsp + 0x20a8]
lea rcx, [rsp + 0x2d0]
call fcn.140008ed0
nop
lea rcx, [rsp + 0x1868]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1810]
call fcn.140004db0
nop
lea rcx, [rsp + 0x17b8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1760]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1708]
call fcn.140004db0
nop
lea rcx, [rsp + 0x16b0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1658]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1600]
call fcn.140004db0
lea rcx, [rsp + 0x2d0]
call fcn.140052c70
mov rcx, rax
call fcn.1400382a0
lea rcx, [rsp + 0x19e0]
call fcn.140004cd0
mov qword [rsp + 0x20b0], rax
mov rax, qword [rsp + 0x20b0]
mov qword [rsp + 0x20b8], rax
call fcn.1400166f0
mov dword [rsp + 0x20c0], eax
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov ecx, 5
call fcn.1400372b0
mov edx, eax
lea rcx, [rsp + 0x18f8]
call fcn.140013160
mov qword [rsp + 0x20c8], rax
mov rax, qword [rsp + 0x20c8]
mov qword [rsp + 0x20d0], rax
mov r8, qword [rsp + 0x20d0]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x1950]
call fcn.140058d50
mov qword [rsp + 0x20d8], rax
mov rax, qword [rsp + 0x20d8]
mov qword [rsp + 0x20e0], rax
mov rdx, qword [rsp + 0x20e0]
lea rcx, [rsp + 0x18c0]
call fcn.140044df0
mov qword [rsp + 0x20e8], rax
mov rax, qword [rsp + 0x20e8]
mov qword [rsp + 0x20f0], rax
mov eax, dword [rsp + 0x20c0]
mov r8d, eax
mov rdx, qword [rsp + 0x20f0]
lea rcx, [rsp + 0x19a8]
call fcn.1400068b0
mov qword [rsp + 0x20f8], rax
mov rax, qword [rsp + 0x20f8]
mov qword [rsp + 0x2100], rax
mov rdx, qword [rsp + 0x20b8]
mov rcx, qword [rsp + 0x2100]
call fcn.140047d40
mov qword [rsp + 0x2108], rax
lea rcx, [rsp + 0x1a38]
call fcn.1400117c0
mov qword [rsp + 0x2110], rax
mov rax, qword [rsp + 0x2110]
mov qword [rsp + 0x2118], rax
lea rcx, [rsp + 0x1a90]
call fcn.140011720
mov qword [rsp + 0x2120], rax
mov rax, qword [rsp + 0x2120]
mov qword [rsp + 0x2128], rax
mov r8, qword [rsp + 0x2118]
mov rdx, qword [rsp + 0x2128]
lea rcx, [rsp + 0x1ae8]
call fcn.140058d50
mov qword [rsp + 0x2130], rax
mov rax, qword [rsp + 0x2130]
mov qword [rsp + 0x2138], rax
lea r8, [0x1401a67d4]
mov rdx, qword [rsp + 0x2138]
lea rcx, [rsp + 0x1b40]
call fcn.140058fc0
mov qword [rsp + 0x2140], rax
mov rax, qword [rsp + 0x2140]
mov qword [rsp + 0x2148], rax
mov rax, qword [rsp + 0x2108]
mov r8, rax
mov rdx, qword [rsp + 0x2148]
lea rcx, [rsp + 0x1b98]
call fcn.140058d50
mov qword [rsp + 0x2150], rax
mov rax, qword [rsp + 0x2150]
mov qword [rsp + 0x2158], rax
lea r8, str.__aa_
mov rdx, qword [rsp + 0x2158]
lea rcx, [rsp + 0x1bf0]
call fcn.140058fc0
mov qword [rsp + 0x2160], rax
mov rax, qword [rsp + 0x2160]
mov qword [rsp + 0x2168], rax
mov rcx, qword [rsp + 0x2168]
call fcn.140052c70
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14003a4a0
nop
lea rcx, [rsp + 0x1bf0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1b98]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1b40]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1ae8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1a90]
call fcn.140004db0
nop
lea rcx, [rsp + 0x1a38]
call fcn.140004db0
nop
lea rcx, [rsp + 0x19a8]
call fcn.140004d30
nop
lea rcx, [rsp + 0x18c0]
call fcn.140004d30
nop
lea rcx, [rsp + 0x1950]
call fcn.140004db0
nop
lea rcx, [rsp + 0x18f8]
call fcn.140004db0
nop
lea rcx, [rsp + 0x19e0]
call fcn.140004db0
mov dword [rsp + 0x1c48], 1
lea rcx, [rsp + 0x2d0]
call fcn.140004db0
nop
lea rcx, [rsp + 0x50]
call fcn.140004db0
mov eax, dword [rsp + 0x1c48]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.1400c02e0
mov rax, rdi
add rsp, 0x2170
pop rdi
ret