Function at 0x1400026b0
Capabilities:
Create process on windows
Delete file
Get common file path
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2f20]
mov eax, 0x3020
call fcn.14003aa60
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x3050], rbx
mov qword [rsp + 0x3058], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f10], rax
mov r14, r8
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
call fcn.140004aa0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 1
mov rcx, qword [rax + 8]
mov rbx, rax
cmp byte [rcx + 0x19], r12b
jne 0x14000274a
cmp dword [rcx + 0x1c], 1
jge 0x140002733
mov rcx, qword [rcx + 0x10]
jmp 0x140002739
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], r12b
je 0x140002727
cmp rbx, rax
je 0x14000274a
cmp dword [rbx + 0x1c], 1
jle 0x140002783
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f30
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f70
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x82
mov dword [rsp + 0x30], 2
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x1400027c7
cmp dword [rax + 0x1c], 2
jge 0x1400027b0
mov rax, qword [rax + 0x10]
jmp 0x1400027b6
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x1400027a4
cmp rbx, rcx
je 0x1400027c7
cmp dword [rbx + 0x1c], 2
jle 0x140002800
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f30
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f70
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x83
mov dword [rsp + 0x30], 3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x140002844
cmp dword [rax + 0x1c], 3
jge 0x14000282d
mov rax, qword [rax + 0x10]
jmp 0x140002833
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x140002821
cmp rbx, rcx
je 0x140002844
cmp dword [rbx + 0x1c], 3
jle 0x14000287d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f30
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f70
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x85
mov dword [rsp + 0x30], 4
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x1400028c3
nop
cmp dword [rax + 0x1c], 4
jge 0x1400028ac
mov rax, qword [rax + 0x10]
jmp 0x1400028b2
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x1400028a0
cmp rbx, rcx
je 0x1400028c3
cmp dword [rbx + 0x1c], 4
jle 0x1400028fc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f30
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f70
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x86
mov dword [rsp + 0x30], 5
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x140002943
nop dword [rax]
cmp dword [rax + 0x1c], 5
jge 0x14000292c
mov rax, qword [rax + 0x10]
jmp 0x140002932
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x140002920
cmp rbx, rcx
je 0x140002943
cmp dword [rbx + 0x1c], 5
jle 0x14000297c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f30
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f70
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x87
mov dword [rsp + 0x30], 6
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x1400029c3
nop dword [rax]
cmp dword [rax + 0x1c], 6
jge 0x1400029ac
mov rax, qword [rax + 0x10]
jmp 0x1400029b2
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x1400029a0
cmp rbx, rcx
je 0x1400029c3
cmp dword [rbx + 0x1c], 6
jle 0x1400029fc
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f30
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f70
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x84
mov dword [rsp + 0x30], 7
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x140002a43
nop dword [rax]
cmp dword [rax + 0x1c], 7
jge 0x140002a2c
mov rax, qword [rax + 0x10]
jmp 0x140002a32
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x140002a20
cmp rbx, rcx
je 0x140002a43
cmp dword [rbx + 0x1c], 7
jle 0x140002a7c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f30
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004f70
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x85
lea rcx, [rbp - 0x10]
call fcn.140032010
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140032640
lea rcx, [rbp - 0x10]
test al, al
je 0x140002e43
mov r8, r14
lea rdx, str.CommandLine:__s
call fcn.1400333e0
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r12
mov word [rbp - 0x70], r12w
lea rcx, [rbp - 0x70]
call fcn.140036b30
test al, al
je 0x140002aef
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
lea rdx, str.OS:__s
lea rcx, [rbp - 0x10]
call fcn.1400333e0
lea rcx, [rbp - 0x10]
call fcn.140032620
lea rcx, [rbp + 0x248]
call fcn.140035130
movzx esi, ax
lea r8, [rsp + 0x48]
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.140039850
mov edx, 0x7f
lea rcx, [rsp + 0x58]
call fcn.140039a40
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
xor r8d, r8d
xor edx, edx
call fcn.140004a50
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
mov r8d, 6
lea rdx, str.LOCALE
lea rcx, [rsp + 0x70]
call fcn.140003a80
nop
mov r8, qword [rbp - 0x38]
cmp r8, 8
jb 0x140002baa
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140003ec0
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x50]
call fcn.140003d10
nop
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x140002be6
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140003ec0
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
or rbx, 0xffffffffffffffff
cmp word [rbp + 0x248], 0
jne 0x140002c0b
mov r8, r12
jmp 0x140002c20
lea rax, [rbp + 0x248]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140002c15
lea rdx, [rbp + 0x248]
lea rcx, [rsp + 0x70]
call fcn.140003a80
nop
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x140002c4c
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.140003ec0
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.140003d10
nop
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x140002c88
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140003ec0
lea r9, [rbp - 0x50]
mov r8, qword [rdi + 8]
mov rdx, rdi
call fcn.140004ed0
mov r8, rax
movabs rcx, 0x333333333333332
mov rdx, qword [rsp + 0x40]
sub rcx, rdx
cmp rcx, 1
jae 0x140002cc0
lea rcx, str.list_T__too_long
call fcn.14003b6fc
int3
inc rdx
mov qword [rsp + 0x40], rdx
mov qword [rdi + 8], r8
mov rax, qword [rax + 8]
mov qword [rax], r8
lea r8, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140005ad0
test eax, eax
je 0x140002e76
cmp eax, 4
jne 0x140002dbd
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
lea r8, [rsp + 0x70]
movzx edx, si
lea ecx, [rax + 0x67]
call fcn.140037210
mov r9d, 3
xor r8d, r8d
lea rdx, [0x140079e10]
lea rcx, [rsp + 0x70]
call fcn.140003710
cmp rax, 0xffffffffffffffff
je 0x140002d79
cmp word [rbp + 0xc70], 0
jne 0x140002d43
mov rbx, r12
jmp 0x140002d5a
lea rcx, [rbp + 0xc70]
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x140002d50
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xc70]
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003830
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x70]
cmovae rdx, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x1030
call fcn.140039bb0
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x140002dbd
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140003ec0
call fcn.140039a60
lea rcx, [rbp - 0x10]
call fcn.140033990
lea rcx, [rbp - 0x50]
call fcn.140003520
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x140002e0c
nop dword [rax + rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140003520
mov rcx, rdi
call fcn.14003a6cc
mov rdi, rbx
cmp rbx, rsi
jne 0x140002df0
mov rcx, rsi
call fcn.14003a6cc
mov r8, qword [rbp - 0x58]
cmp r8, 8
jb 0x140002e2e
inc r8
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x70]
call fcn.140003ec0
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r12
mov word [rbp - 0x70], r12w
lea rcx, [rbp - 0x10]
call fcn.140032100
mov r8, qword [rsp + 0x48]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140003da0
mov rcx, qword [rsp + 0x48]
call fcn.14003a6cc
mov eax, 1
jmp 0x1400034c3
lea rcx, [rbp + 0x248]
call fcn.140035130
mov word [rsp + 0x58], ax
xor sil, sil
mov r15d, r12d
mov ecx, 0x3ff
and ax, cx
mov edi, 0x81
mov ecx, 0x89
cmp ax, 1
cmove di, cx
cmp byte [rbp + 0x1f9], sil
je 0x140002f40
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.1400022f0
test al, al
jne 0x140002f21
call fcn.140005710
call fcn.140039a60
lea rcx, [rbp - 0x10]
call fcn.140033990
lea rcx, [rbp - 0x50]
call fcn.140003520
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x140002e0c
nop dword [rax + rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140003520
mov rcx, rdi
call fcn.14003a6cc
mov rdi, rbx
cmp rbx, rsi
jne 0x140002f00
jmp 0x140002e0c
mov edx, 0x80
mov r8d, 0x3e8
movzx ecx, di
call fcn.140039ed0
lea rcx, str.uninstall
jmp 0x140002fcc
cmp byte [rbp + 0x1fb], r15b
je 0x140002ff3
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.1400022f0
test al, al
jne 0x140002fb2
call fcn.140005710
call fcn.140039a60
lea rcx, [rbp - 0x10]
call fcn.140033990
lea rcx, [rbp - 0x50]
call fcn.140003520
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x140002e0c
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140003520
mov rcx, rdi
call fcn.14003a6cc
mov rdi, rbx
cmp rbx, rsi
jne 0x140002f91
jmp 0x140002e0c
mov edx, 0x80
mov r8d, 0x3e8
movzx ecx, di
call fcn.140039ed0
lea rcx, str.pdlcuninstall
call fcn.1400064b0
mov r15d, eax
mov r8d, eax
lea rdx, str.Uninstall_finished_with_exit_code:__d
lea rcx, [rbp - 0x10]
call fcn.1400333e0
call fcn.14003a370
test r15d, r15d
sete sil
call fcn.140005710
call fcn.140039a60
movzx r14d, byte [rbp + 0x1ff]
lea rcx, [rbp - 0x10]
call fcn.140033990
test sil, sil
je 0x140003463
mov edi, 0x104
mov edx, edi
lea rcx, [rbp + 0x14b0]
call fcn.140037390
lea r9, [rbp + 0x14b0]
lea r8, str._sCleanup.dat
mov edx, edi
lea rcx, [rbp + 0x16c0]
call fcn.140002210
lea rcx, [rbp + 0x16c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r14b, r14b
jne 0x140003081
lea r9, [rbp + 0x14b0]
lea r8, str._sMaintenanceLog.txt
mov edx, edi
lea rcx, [rbp + 0x16c0]
call fcn.140002210
lea rcx, [rbp + 0x16c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r9, [rbp + 0x14b0]
lea r8, str._sCleanup.exe
mov rdx, rdi
lea rcx, [rbp + 0x16c0]
call fcn.140002210
mov rdx, rdi
lea rcx, [rbp + 0x18d0]
lea r8, [rbp + 0x14b0]
lea rax, [rbp + 0x18d0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400030e3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400030e3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400030c0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
lea rax, [rbp + 0x14b0]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140003100
test rbx, rbx
je 0x14000314b
lea rbx, [rbx*2 - 2]
cmp rbx, 0x208
jae 0x140003145
mov word [rbp + rbx + 0x18d0], r12w
mov edx, 0x5c
lea rcx, [rbp + 0x18d0]
call fcn.14003d1e4
test rax, rax
je 0x14000314b
mov word [rax], r12w
jmp 0x14000314b
call fcn.14003a4fc
int3
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1cf0]
call fcn.14003da30
lea rsi, [rbp + 0x1cf0]
mov edx, edi
lea rcx, [rbp + 0x1cf0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
cmove rsi, r12
mov edx, 0x800
lea rcx, [rbp + 0x1f00]
lea r8, str._c_timeout_2__nul__del__
lea rax, [rbp + 0x1f00]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffff7fe]
test rax, rax
je 0x1400031c3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x1400031c3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400031a0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov ecx, 0x800
lea rax, [rbp + 0x1f00]
nop
cmp word [rax], 0
je 0x1400031f0
add rax, 2
sub rcx, 1
jne 0x1400031e0
mov ebx, 0x80070057
mov edx, ebx
test rcx, rcx
cmovne edx, r12d
je 0x14000320a
mov eax, 0x800
sub rax, rcx
jmp 0x14000320d
mov rax, r12
test edx, edx
js 0x140003270
mov edx, 0x800
sub rdx, rax
lea rcx, [rbp + 0x1f00]
lea rcx, [rcx + rax*2]
je 0x140003261
add rax, 0x7ffff7ff
add rax, rdx
lea r9, [rbp + 0x16c0]
sub r9, rcx
nop dword [rax]
test rax, rax
je 0x140003261
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140003261
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x140003240
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
lea r8, str._____NUL__rmdir__Q__
mov edx, 0x800
lea rcx, [rbp + 0x1f00]
call fcn.140002130
mov ecx, 0x800
lea rax, [rbp + 0x1f00]
cmp word [rax], 0
je 0x1400032a4
add rax, 2
sub rcx, 1
jne 0x140003294
mov edx, ebx
test rcx, rcx
cmovne edx, r12d
je 0x1400032b9
mov eax, 0x800
sub rax, rcx
jmp 0x1400032bc
mov rax, r12
test edx, edx
js 0x140003318
mov edx, 0x800
sub rdx, rax
lea rcx, [rbp + 0x1f00]
lea rcx, [rcx + rax*2]
je 0x140003309
add rax, 0x7ffff7ff
add rax, rdx
lea r9, [rbp + 0x14b0]
sub r9, rcx
test rax, rax
je 0x140003309
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140003309
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x1400032e8
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
lea r8, str._____NUL__timeout_1____NUL__rmdir__Q__
mov edx, 0x800
lea rcx, [rbp + 0x1f00]
call fcn.140002130
mov ecx, 0x800
lea rax, [rbp + 0x1f00]
nop dword [rax]
cmp word [rax], 0
je 0x140003350
add rax, 2
sub rcx, 1
jne 0x140003340
test rcx, rcx
cmovne ebx, r12d
je 0x140003363
mov eax, 0x800
sub rax, rcx
jmp 0x140003366
mov rax, r12
test ebx, ebx
js 0x1400033c1
mov r9d, 0x800
sub r9, rax
lea rcx, [rbp + 0x1f00]
lea rcx, [rcx + rax*2]
je 0x1400033b2
add rax, 0x7ffff7ff
add rax, r9
lea r8, [rbp + 0x18d0]
sub r8, rcx
test rax, rax
je 0x1400033b2
movzx edx, word [r8 + rcx]
test dx, dx
je 0x1400033b2
mov word [rcx], dx
add rcx, 2
dec rax
sub r9, 1
jne 0x140003393
lea rax, [rcx - 2]
test r9, r9
cmovne rax, rcx
mov word [rax], r12w
lea r8, str._____NUL
mov edx, 0x800
lea rcx, [rbp + 0x1f00]
call fcn.140002130
mov r8d, 0x208
lea rdx, [rbp + 0x1ae0]
lea rcx, str.COMSPEC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140003441
lea rcx, [rbp + 0x1ae0]
lea rdx, str.cmd.exe
lea rax, [rbp + 0x1ae0]
sub rdx, rax
nop
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x140003432
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140003432
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140003410
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], r12w
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x1f00]
lea r8, [rbp + 0x1ae0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x50]
call fcn.140003520
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x14000349c
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140003520
mov rcx, rdi
call fcn.14003a6cc
mov rdi, rbx
cmp rbx, rsi
jne 0x140003480
mov rcx, rsi
call fcn.14003a6cc
lea rcx, [rbp - 0x70]
call fcn.1400035c0
lea rcx, [rbp - 0x10]
call fcn.140032100
lea rcx, [rsp + 0x48]
call fcn.1400034f0
mov eax, r15d
mov rcx, qword [rbp + 0x2f10]
xor rcx, rsp
call fcn.14003a3d0
lea r11, [rsp + 0x3020]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret