Function at 0x14000134c
Capabilities:
Create process on windows
Query environment variable
Resume thread
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x11128]
mov eax, 0x11200
call fcn.14001b230
sub rsp, rax
mov rax, qword [0x14002b010]
xor rax, rsp
mov qword [rbp + 0x110f0], rax
xor r15d, r15d
mov dword [rsp + 0x60], ecx
mov bl, r15b
mov qword [rbp + 0x10], rdx
lea rcx, [0x140027e60]
mov dword [rsp + 0x78], ebx
mov r12, rdx
mov qword [rbp - 0x80], r15
mov dil, r15b
mov qword [rbp - 0x18], r15
mov r14b, r15b
mov byte [rsp + 0x68], r15b
mov byte [rsp + 0x69], r15b
mov byte [rsp + 0x6b], r15b
mov byte [rsp + 0x6a], r15b
mov byte [rsp + 0x6c], r15b
mov byte [rsp + 0x6d], r15b
mov byte [rsp + 0x6e], r15b
mov byte [rsp + 0x6f], r15b
mov byte [rsp + 0x70], r15b
mov qword [rbp - 0x10], r15
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor r9d, r9d
lea edx, [r15 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rcx, [0x140027d50]
call fcn.14001a864
mov dword [rbp + 0x90], eax
test eax, eax
jne 0x140002112
xor r8d, r8d
lea rcx, str.TRACKER_ATTACHED
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [r15 + 1]
cmp eax, r8d
jbe 0x140001455
xor r8d, r8d
lea rcx, str.TRACKER_ENABLED
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r8d, [r15 + 1]
movzx ebx, bl
cmp eax, r8d
cmova ebx, r8d
mov dword [rsp + 0x78], ebx
mov ecx, dword [rsp + 0x60]
lea rbx, [r12 + 8]
mov r9d, 0x40
mov esi, r8d
lea r13d, [r9 - 0x3e]
cmp esi, ecx
jge 0x14000160e
mov rdx, qword [rbx]
lea rax, [rdx + 2]
cmp word [rdx], r9w
jne 0x140001489
mov qword [rbp - 0x80], rax
jmp 0x1400015fe
cmp word [rdx], 0x2d
je 0x1400016cb
movzx ecx, word [rax]
cmp ecx, 0x55
ja 0x14000153a
je 0x1400015d9
cmp ecx, 0x48
ja 0x1400014f9
je 0x140001564
sub ecx, 0x3f
je 0x140001564
sub ecx, r13d
je 0x140001592
sub ecx, 1
je 0x140001576
sub ecx, 1
je 0x14000157f
sub ecx, 1
je 0x140001576
sub ecx, 1
je 0x14000156c
cmp ecx, 1
jne 0x1400015c0
mov byte [rsp + 0x6d], r8b
jmp 0x1400015fa
sub ecx, 0x49
je 0x140001576
sub ecx, r13d
je 0x1400015f5
sub ecx, r13d
je 0x1400015ee
sub ecx, r13d
je 0x1400015e7
sub ecx, 1
je 0x1400015e0
sub ecx, r13d
je 0x140001576
cmp ecx, r13d
jne 0x1400015c0
mov byte [rsp + 0x68], r8b
jmp 0x1400015fa
cmp ecx, 0x69
ja 0x140001599
je 0x140001576
sub ecx, 0x61
je 0x140001592
sub ecx, 1
je 0x140001576
sub ecx, 1
je 0x14000157f
sub ecx, 1
je 0x140001576
sub ecx, 1
je 0x14000156c
sub ecx, 1
je 0x1400014ef
cmp ecx, r13d
jne 0x1400015c0
mov dil, r8b
jmp 0x1400015fa
mov byte [rsp + 0x69], r8b
jmp 0x1400015fa
add esi, r8d
add rbx, 8
jmp 0x1400015fa
add esi, r8d
mov r14b, r8b
add rbx, 8
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
jmp 0x1400015fa
mov byte [rsp + 0x6a], r8b
jmp 0x1400015fa
sub ecx, 0x6b
je 0x1400015f5
sub ecx, r13d
je 0x1400015ee
sub ecx, r13d
je 0x1400015e7
sub ecx, 1
je 0x1400015e0
sub ecx, r13d
je 0x140001576
sub ecx, r13d
je 0x140001530
cmp ecx, 1
je 0x1400015d9
mov ecx, 0x2710
mov dil, r8b
call fcn.1400011f8
mov r8d, 1
lea r9d, [r8 + 0x3f]
jmp 0x1400015fa
mov byte [rsp + 0x6c], r8b
jmp 0x1400015fa
mov byte [rsp + 0x6b], r8b
jmp 0x1400015fa
mov byte [rsp + 0x6f], r8b
jmp 0x1400015fa
mov byte [rsp + 0x6e], r8b
jmp 0x1400015fa
mov byte [rsp + 0x70], r8b
mov ecx, dword [rsp + 0x60]
add esi, r8d
add rbx, 8
test r14b, r14b
je 0x14000146b
mov r15d, esi
cmp esi, ecx
jg 0x140001fd2
test r14b, r14b
je 0x140001fd2
test dil, dil
jne 0x140001fd2
mov rax, qword [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rbp - 0x58], r12
xor r12d, r12d
movdqa xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], ecx
mov dword [rbp - 0x50], r12d
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x38], r12
test rax, rax
je 0x14000166b
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14001adcc
test eax, eax
jle 0x14000166b
lea rcx, [rbp - 0x70]
call fcn.14001ace8
lea rdx, [0x140027d68]
lea rcx, [rbp - 0x70]
call fcn.140002988
lea rdx, [0x140027d70]
mov r14, rax
lea rcx, [rbp - 0x70]
call fcn.140002988
lea rdx, [0x140027d78]
mov rbx, rax
lea rcx, [rbp - 0x70]
call fcn.140002988
lea rdx, [0x140027d80]
mov qword [rbp], rax
lea rcx, [rbp - 0x70]
call fcn.140002988
mov rdi, rax
test r14, r14
jne 0x1400016e4
test rbx, rbx
jne 0x1400016e9
lea r14, [0x140027d48]
jmp 0x140001711
mov ecx, 0x2710
mov dil, r8b
call fcn.1400011f8
mov ecx, dword [rsp + 0x60]
mov r15d, esi
jmp 0x140001619
test rbx, rbx
je 0x140001711
mov rcx, rbx
call fcn.14001a0a4
mov rbx, rax
mov qword [rbp - 0x10], rax
mov r14, qword [rax]
cmp dword [r14 - 8], 1
jle 0x140001711
mov edx, dword [r14 - 0x10]
mov rcx, rax
call fcn.140002bf0
mov r14, qword [rbx]
xor ebx, ebx
test rdi, rdi
je 0x140001789
mov r8, rdi
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov r12, rax
test rax, rax
jne 0x140001789
mov rdx, rdi
mov ecx, 0x2716
call fcn.140001270
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000174f
call fcn.14000c534
mov qword [rbp - 0x70], rbx
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140001761
call fcn.14000c534
mov qword [rbp - 0x68], rbx
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x14000177f
mov rcx, rbx
call fcn.140002a40
mov edx, 0x40
mov rcx, rbx
call fcn.140004fb4
mov eax, 0xa
jmp 0x140002112
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x208
call fcn.140005db0
xor edx, edx
mov qword [rbp + 0x18], rbx
lea rcx, [rbp + 0x24]
mov qword [rbp - 8], rbx
lea r8d, [rdx + 0x64]
call fcn.140005db0
mov r8, qword [rbp - 0x18]
lea rcx, [rbp + 0x4c0]
xor eax, eax
mov dword [rbp + 0x20], 0x68
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
lea rax, [rbp + 0x4c0]
mov word [rbp + 0x10f0], bx
sub r8, rax
mov edx, 0x104
movups xmmword [rbp - 0x30], xmm0
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000180b
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000180b
mov word [rcx], ax
add rcx, r13
sub rdx, 1
jne 0x1400017e9
movsxd rdi, dword [rsp + 0x60]
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
dec esi
mov word [rax], bx
movsxd rbx, esi
cmp rbx, rdi
jge 0x140001937
mov rsi, qword [rbp + 0x10]
mov rcx, qword [rsi + rbx*8]
mov edx, 0x20
call fcn.140005a10
test rax, rax
jne 0x14000185d
mov rcx, qword [rsi + rbx*8]
lea edx, [rax + 9]
call fcn.140005a10
test rax, rax
jne 0x14000185d
mov r8, qword [rsi + rbx*8]
jmp 0x1400018f8
lea r8, [0x140027d88]
mov edx, 0x7fff
lea rcx, [rbp + 0x10f0]
call fcn.140002860
mov r8, qword [rsi + rbx*8]
lea rcx, [rbp + 0x10f0]
mov edx, 0x7fff
call fcn.140002860
mov ecx, 0x7fff
lea rax, [rbp + 0x10f0]
mov r8d, ecx
xor r9d, r9d
cmp word [rax], r9w
je 0x1400018ab
add rax, r13
sub r8, 1
jne 0x14000189c
sub rcx, r8
mov rax, r8
neg rax
sbb rdx, rdx
and rdx, rcx
test r8, r8
je 0x1400018f1
cmp word [rbp + rdx*2 + 0x10ee], 0x5c
jne 0x1400018f1
lea rdx, [rdx*2 - 2]
cmp rdx, 0xfffe
jae 0x14000214d
mov word [rbp + rdx + 0x10f0], r9w
lea r8, [0x140027d90]
jmp 0x1400018f8
lea r8, [0x140027d88]
mov edx, 0x7fff
lea rcx, [rbp + 0x10f0]
call fcn.140002860
cmp r15d, dword [rsp + 0x60]
jge 0x140001928
lea r8, [0x140027d98]
mov edx, 0x7fff
lea rcx, [rbp + 0x10f0]
call fcn.140002860
inc r15d
inc rbx
cmp rbx, rdi
jl 0x140001830
xor r15d, r15d
lea rdi, [0x140027d9c]
cmp byte [rsp + 0x68], r15b
je 0x140001958
mov rdx, rdi
lea rcx, str.TRACKER_TRACKCOMMANDLINES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [rsp + 0x69], r15b
je 0x14000196f
mov rdx, rdi
lea rcx, str.TRACKER_TRACKEXTENDED
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [rsp + 0x6a], r15b
je 0x140001986
mov rdx, rdi
lea rcx, str.TRACKER_TRACKEXTENDEDATTRIBUTESONLY
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [rsp + 0x6b], r15b
je 0x14000199d
mov rdx, rdi
lea rcx, str.TRACKER_TRACKEXECUTIONTIMES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [rsp + 0x6c], r15b
je 0x1400019b4
mov rdx, rdi
lea rcx, str.TRACKER_RECORD_DUPLICATES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [rsp + 0x6d], r15b
je 0x1400019cb
mov rdx, rdi
lea rcx, str.TRACKER_TRACK_REPLACEFILE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [rsp + 0x6e], r15b
je 0x1400019e2
mov rdx, rdi
lea rcx, str.TRACKER_RECORD_MISSING
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [rsp + 0x6f], r15b
je 0x1400019f9
mov rdx, rdi
lea rcx, str.TRACKER_RECORD_OPERATIONS
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [rsp + 0x70], r15b
je 0x140001a10
mov rdx, rdi
lea rcx, str.TRACKER_FULL_TOOLCHAIN
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r14
lea rcx, str.TRACKER_INTERMEDIATE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x140001a53
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140001a46
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov edx, 8
mov rcx, rbx
call fcn.140004fb4
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x140001a75
mov rdx, rax
lea rcx, str.TRACKER_RESPONSEFILE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140027e60]
jmp 0x140001a95
mov rbx, qword [rbp]
test rbx, rbx
je 0x140001aa2
lea rdx, [0x140027e60]
lea rcx, str.TRACKER_RESPONSEFILE
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rbx
lea rcx, str.TRACKER_ROOTFILES
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
lea rcx, str.TRACKER_OUTOFPROC
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
lea rcx, str.TRACKER_ENABLED
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140027e60]
lea rcx, str.TRACKER_TOOLCHAIN
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [0x140027e60]
lea rcx, str.TRACKER_TOOL
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rbp + 0x18]
mov esi, 0x104
mov qword [rsp + 0x28], rax
lea r8, [0x140027da0]
lea rax, [rbp + 0xa0]
mov r9d, esi
lea rdx, [rbp + 0x4c0]
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x140001b86
lea rdx, [rbp + 0x4c0]
mov ecx, 0x2715
call fcn.140001270
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140001b4c
call fcn.14000c534
mov qword [rbp - 0x70], r15
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140001b5e
call fcn.14000c534
mov qword [rbp - 0x68], r15
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x140001b7c
mov rcx, rbx
call fcn.140002a40
mov edx, 0x40
mov rcx, rbx
call fcn.140004fb4
mov eax, 5
jmp 0x140002112
lea rdx, [0x140027dac]
lea rcx, [rbp - 0x70]
call fcn.140002988
xor ecx, ecx
mov rbx, rax
mov edi, 3
test rax, rax
je 0x140001bd9
lea rax, [rbp - 8]
mov r9d, esi
mov qword [rsp + 0x28], rax
lea r8, str..dll
lea rax, [rbp + 0x2b0]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov r14d, dword [rbp + 0x90]
jmp 0x140001ca1
mov r8d, esi
lea rdx, [rbp + 0x8d0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r14d, eax
test eax, eax
je 0x140001f79
mov ecx, pe_nt_image_headers64
lea rax, [rbp + 0xcf0]
mov qword [rsp + 0x40], rcx
lea r9, [rbp + 0x6d0]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x90]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0xef0]
mov qword [rsp + 0x28], rax
mov r8, rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x8d0]
call fcn.14000cec0
lea rax, [rbp + 0x6d0]
mov rdx, rsi
lea r9, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0xae0]
call fcn.1400027c4
test eax, eax
js 0x140001f79
lea rax, [rbp - 8]
mov r9d, esi
mov qword [rsp + 0x28], rax
lea r8, str..dll
lea rax, [rbp + 0x2b0]
lea rdx, str.FileTracker32.dll
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0xae0]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x140001f79
call fcn.140002708
mov rcx, rax
test rax, rax
je 0x140002142
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
lea rax, [rbp + 0x2b0]
mov qword [rbp - 0x80], rbx
cmp rax, 0x10000
jae 0x140001d00
lea rax, [rbp + 0x2b0]
xor edx, edx
movzx esi, ax
mov ecx, esi
call fcn.140002aa0
test rax, rax
je 0x140001d14
mov r8d, esi
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.140002270
jmp 0x140001d10
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp - 0x80]
call fcn.140002154
mov rbx, qword [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [rbp + 0x10f0]
movzx eax, word [rbp + 0xa0]
cmp byte [rsp + 0x78], r15b
je 0x140001d7c
neg ax
mov esi, 1
lea rax, [rbp + 0xa0]
sbb rcx, rcx
xor r9d, r9d
and rcx, rax
xor r8d, r8d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x604
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x140001dad
neg ax
mov qword [rsp + 0x50], rbx
lea rax, [rbp + 0xa0]
sbb rcx, rcx
and rcx, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
call fcn.1400044d4
mov esi, 1
test eax, eax
jne 0x140001dc7
lea rdx, [rbp + 0x10f0]
mov ecx, 0x2712
call fcn.140001270
jmp 0x140001f15
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rbp - 0x30]
lea rdx, [rbp]
mov qword [rbp + 8], r12
neg r12
mov qword [rbp], rax
sbb ecx, ecx
or r12d, 0xffffffff
neg ecx
mov r9d, r12d
add ecx, esi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x140001e39
mov rcx, qword [rbp - 0x30]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140001e30
lea rdx, [rbp + 0x10f0]
mov ecx, 0x2713
call fcn.140001270
mov dword [rsp + 0x60], edi
jmp 0x140001f00
mov edi, dword [rsp + 0x60]
jmp 0x140001f00
cmp eax, esi
jne 0x140001f05
mov edx, dword [rbp - 0x20]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x140001ec0
mov ecx, 0x2718
call fcn.1400012e8
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140001e74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140001e86
call fcn.14000c534
mov qword [rbp - 0x70], r15
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140001e98
call fcn.14000c534
mov qword [rbp - 0x68], r15
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x140001eb6
mov rcx, rbx
call fcn.140002a40
mov edx, 0x40
mov rcx, rbx
call fcn.140004fb4
mov eax, 0xb
jmp 0x140002112
mov rcx, qword [rbp - 0x30]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x30]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140001efc
lea rdx, [rbp + 0x10f0]
mov ecx, 0x2713
call fcn.140001270
mov dword [rsp + 0x78], edi
jmp 0x140001f00
mov edi, dword [rsp + 0x78]
mov r13d, edi
jmp 0x140001f15
mov ecx, 0x2717
call fcn.1400012e8
mov r13d, 0xc
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140001f2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140001f41
call fcn.14000c534
mov qword [rbp - 0x70], r15
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140001f53
call fcn.14000c534
mov qword [rbp - 0x68], r15
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x140001f71
mov rcx, rbx
call fcn.140002a40
mov edx, 0x40
mov rcx, rbx
call fcn.140004fb4
mov eax, r13d
jmp 0x140002112
mov rdx, rbx
mov ecx, 0x2714
call fcn.140001270
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140001f98
call fcn.14000c534
mov qword [rbp - 0x70], r15
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140001faa
call fcn.14000c534
mov qword [rbp - 0x68], r15
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x140001fc8
mov rcx, rbx
call fcn.140002a40
mov edx, 0x40
mov rcx, rbx
call fcn.140004fb4
mov eax, 4
jmp 0x140002112
xor r8d, r8d
mov r9d, 0x766f
mov ecx, 0x2fa8
lea edx, [r8 + 4]
call fcn.140001234
mov ecx, 0x2fa9
call fcn.140001234
mov ecx, 0x2faa
call fcn.140001234
mov ebx, 0x2fab
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x61]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x62]
call fcn.140001234
lea ecx, [rbx + 0x63]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x64]
call fcn.140001234
lea ecx, [rbx + 0x65]
call fcn.140001234
lea ecx, [rbx + 0x66]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x67]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x68]
call fcn.140001234
lea ecx, [rbx + 0x69]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x6a]
call fcn.140001234
lea ecx, [rbx + 0x6b]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x6c]
call fcn.140001234
lea ecx, [rbx + 0x6d]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x6e]
call fcn.140001234
lea ecx, [rbx + 0x6f]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x70]
call fcn.140001234
lea ecx, [rbx + 0x71]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x72]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x73]
call fcn.140001234
lea ecx, [rbx + 0x74]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x75]
call fcn.140001234
mov ecx, ebx
call fcn.140001234
lea ecx, [rbx + 0x76]
call fcn.140001234
mov eax, 1
mov rcx, qword [rbp + 0x110f0]
xor rcx, rsp
call fcn.140004f90
lea r11, [rsp + 0x11200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002d84
int3
call fcn.1400050c4
int3