Function at 0x140134c70
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov r15, rcx
xor esi, esi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 8]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.140129e10
nop
mov rdx, rax
lea rcx, [r15 + 8]
call fcn.140017b80
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140134d11
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov eax, dword [r15]
add eax, 0xfffffffe
cmp eax, 0x2a
ja case.0x140134d3b.23
cdqe
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x135eb4]
mov ecx, dword [rdx + rax*4 + 0x135e5c]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x140], r14d
mov qword [rbp + 0x148], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
mov byte [rbp + 0x170], 0
mov qword [rbp + 0x178], rsi
movdqa xmmword [rbp + 0x180], xmm0
mov dword [rbp + 0x190], esi
lea rcx, [rbp + 0x140]
call fcn.14018b9f0
xor eax, eax
jmp 0x140134ebf
mov rcx, 0xffffffff80000000
call fcn.1401241f0
mov dword [rbp + 0xe0], r14d
mov qword [rbp + 0xe8], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov qword [rbp + 0x118], rsi
movdqa xmmword [rbp + 0x120], xmm0
mov dword [rbp + 0x130], esi
movzx eax, byte [r15 + 0x13b]
mov byte [rbp + 0x110], al
call fcn.140166630
cmp dword [rax + 0xb8], 0
je 0x140134e75
mov ecx, 1
call fcn.1401226c0
lea rcx, [rbp + 0xe0]
call fcn.14018b9f0
call fcn.140166630
mov rcx, rax
xor edx, edx
call fcn.14016d760
lea rcx, [rsp + 0x48]
call fcn.140022dc0
nop
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, qword [rax]
lea rdx, str.Open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg case.0x140134d3b.20
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
xor eax, eax
jmp 0x140134ebf
call fcn.140127bc0
test eax, eax
jne 0x140134eb4
lea ecx, [rax + 1]
call fcn.1401226c0
call fcn.14012bfe0
mov dword [rax + 0xc0], 1
lea rcx, [rbp + 0xe0]
call fcn.14018b9f0
call fcn.140166630
mov rcx, rax
xor edx, edx
call fcn.14016d760
xor eax, eax
jmp 0x140134ebf
mov rcx, r15
call fcn.1400d9e70
mov eax, r14d
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14012bfe0
mov dword [rax + 0xc4], 1
xor ecx, ecx
call fcn.140122ba0
xor ecx, ecx
call fcn.14018dd20
mov ecx, 1
call fcn.14018dd20
xor eax, eax
jmp 0x140134ebf
call fcn.14012bfe0
mov dword [rax + 0xc4], 1
mov rcx, 0xffffffff80000000
call fcn.1401241f0
mov rcx, 0xffffffff80000002
call fcn.1401241f0
mov ecx, 1
call fcn.140122ba0
mov edx, 1
mov r8d, edx
call fcn.14018f230
xor edx, edx
lea r8d, [rdx + 1]
call fcn.14018f230
xor eax, eax
jmp 0x140134ebf
call fcn.14012bfe0
mov dword [rax + 0xc4], 1
call fcn.14018e6b0
xor eax, eax
jmp 0x140134ebf
call fcn.14012bfe0
mov dword [rax + 0xc4], 1
call fcn.14018eed0
xor eax, eax
jmp 0x140134ebf
lea rcx, str.__rCheckLicValid
call fcn.140021650
call fcn.14012bfe0
cmp dword [rax + 4], 0
je case.0x140134d3b.20
call fcn.1400e34e0
mov r9, qword [rax + 0x20]
mov rdx, rsi
lea r8, [0x1402a1fd8]
nop word [rax + rax]
movzx ecx, word [r9 + rdx*2]
inc rdx
cmp cx, word [r8 + rdx*2 - 2]
jne case.0x140134d3b.20
cmp rdx, 4
jne 0x140134fd0
lea rcx, [rax + 0x10]
mov r8d, edx
lea rdx, [rbp - 0x58]
call fcn.140029210
nop
mov rcx, qword [rax]
lea rdx, str.2099
nop word [rax + rax]
movzx ebx, word [rcx + rsi*2]
inc rsi
movzx eax, word [rdx + rsi*2 - 2]
sub ebx, eax
jne 0x140135026
cmp rsi, 5
jne 0x140135010
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013504b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
test ebx, ebx
jne case.0x140134d3b.20
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140135e3a
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rbx, str.SOFTWAREBandizipl
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140018bb0
test al, al
jne 0x1401350bc
nop dword [rax + rax]
inc r14
cmp word [rbx + r14*2], 0
jne 0x1401350a0
mov r8d, r14d
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140018f50
nop
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call fcn.140064510
xor eax, eax
jmp 0x140134ebf
call fcn.14012bfe0
mov dword [rax + 0xc4], 1
mov qword [rbp + 0xd0], rsi
mov rcx, qword [r15 + 0x60]
sub rcx, 0x18
call fcn.140019180
lea rbx, [rax + 0x18]
mov qword [rbp + 0xd0], rbx
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x320]
call fcn.14022eb00
lea rcx, [rbp + 0x320]
call fcn.14005e8f0
nop
lea rcx, [rbp - 0x20]
call fcn.14005d690
nop
lea rdx, str.BandizipAgent
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140135140
lea rcx, [rbp - 0x20]
call fcn.140018f50
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x3b0]
call fcn.140017b80
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x3b8], eax
mov eax, dword [rbp - 0x14]
mov dword [rbp + 0x3bc], eax
mov eax, dword [rbp - 0x10]
mov dword [rbp + 0x3c0], eax
mov eax, dword [rbp - 0xc]
mov dword [rbp + 0x3c4], eax
mov eax, dword [rbp - 8]
mov dword [rbp + 0x3c8], eax
mov eax, dword [rbp - 4]
mov dword [rbp + 0x3cc], eax
mov eax, dword [rbp]
mov dword [rbp + 0x3d0], eax
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x3d8]
call fcn.140017b80
movaps xmm0, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0x3e0], xmm0
mov eax, dword [rbp + 0x20]
mov dword [rbp + 0x3f0], eax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0x3f4], eax
mov rdx, rbx
lea rcx, [rbp + 0x320]
call fcn.14005eb10
lea rcx, [rbp + 0x320]
call fcn.14005f030
nop
lea rcx, [rbp - 0x20]
call fcn.14005d8a0
nop
lea rcx, [rbp + 0x320]
call fcn.14005ea20
nop
lea rax, [rbp + 0x400]
mov qword [rsp + 0x40], rax
mov rdx, qword [rbp + 0x400]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140135238
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
lea rcx, [rbp + 0x3b0]
call fcn.14005d8a0
nop
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg case.0x140134d3b.20
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
xor eax, eax
jmp 0x140134ebf
mov qword [rbp + 0x58], rsi
mov rcx, qword [r15 + 0x60]
sub rcx, 0x18
call fcn.140019180
lea rbx, [rax + 0x18]
mov qword [rbp + 0x58], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x98], rsi
lea r8, str._event
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x98]
call fcn.1400179b0
nop
mov r9, qword [rbp + 0x98]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rbp + 0x38], rax
mov rdx, rbx
lea rcx, [rbp + 0x68]
call fcn.140064350
test eax, eax
jne 0x14013554c
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x78], rax
mov qword [rbp + 0xb0], rsi
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x50]
call fcn.140036a30
nop
mov r9, qword [rax]
mov r8, rbx
lea rdx, str._s__err:_s
lea rcx, [rbp + 0xb0]
call fcn.140028500
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140135377
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov qword [rbp + 0xa8], rsi
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x48]
call fcn.140036a30
nop
mov r9, qword [rax]
mov r8, qword [rbp + 0x58]
lea rdx, str.error_at_mmf.OpenExisting______s__err:_s
lea rcx, [rbp + 0xa8]
call fcn.140028500
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401353cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp + 0xa8]
add rcx, 0xffffffffffffffe8
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x80]
call fcn.1401aede0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea r9, str.TEXT
mov r8, qword [rbp + 0xb0]
lea rdx, str.TEXT_ERR_AT_CANT_OPEN_MMF
lea rcx, [rbp - 0x40]
call fcn.140044df0
mov rbx, rax
call fcn.14012bfe0
lea rcx, [0x1402670d8]
lea r8, [0x1402670e0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call fcn.140061b80
nop
mov rdx, qword [rbp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140135476
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14013549f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401354c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1401354db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x38], rsi
mov rbx, qword [rbp + 0x70]
test rbx, rbx
je 0x14013551e
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x1401354f7
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x78], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x70], rsi
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x140135517
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x80], rsi
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140135542
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov eax, 0x66
jmp 0x140134ebf
mov qword [rbp + 0x90], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140135e45
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp + 0x90], rax
mov rbx, qword [rbp + 0x78]
mov rdx, rbx
lea rcx, [rbp + 0x90]
call fcn.140018bb0
test al, al
jne 0x1401355bb
test rbx, rbx
jne 0x14013559d
mov r8d, esi
jmp 0x1401355ab
mov r8, r14
inc r8
cmp word [rbx + r8*2], 0
jne 0x1401355a0
mov rdx, rbx
lea rcx, [rbp + 0x90]
call fcn.140018f50
nop
mov rdx, r15
mov rbx, qword [rbp + 0x90]
mov rcx, rbx
call fcn.1400de340
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401355f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140135622
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140135635
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x38], rsi
mov rbx, qword [rbp + 0x70]
test rbx, rbx
je 0x140135678
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x140135651
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbp + 0x78], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x70], rsi
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x140135671
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x80], rsi
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg case.0x140134d3b.23
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
jmp case.0x140134d3b.23
mov qword [rbp + 0xb8], rsi
mov rcx, qword [r15 + 0x60]
sub rcx, 0x18
call fcn.140019180
lea rbx, [rax + 0x18]
mov qword [rbp + 0xb8], rbx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x40], rsi
mov byte [rbp + 0x50], al
mov word [rbp + 0x52], si
mov dword [rbp + 0x54], esi
mov qword [rbp + 0x40], rsi
mov dword [rbp + 0x40], esi
mov qword [rbp + 0x48], rsi
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.14004b6d0
test al, al
jne 0x1401357fc
mov qword [rbp + 0xc0], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140135e50
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp + 0xc0], rax
mov r8, rbx
lea rdx, str.Error._Cannot_open__ls
lea rcx, [rbp + 0xc0]
call fcn.14001c4c0
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov rbx, qword [rbp + 0xc0]
lea rcx, [rbx - 0x18]
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x78], rax
call fcn.14012bfe0
lea rcx, [0x1402670d8]
lea r8, [0x1402670e0]
cmp dword [rax + 0x88], 0
cmovne r8, rcx
xor r9d, r9d
lea rdx, [rbp - 0x78]
xor ecx, ecx
call fcn.140061b80
nop
mov eax, r14d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1401357b6
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1401357c8
call fcn.140207144
mov qword [rbp + 0x48], rsi
mov dword [rbp + 0x54], esi
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1401357f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov eax, 0x68
jmp 0x140134ebf
mov qword [rbp + 0xa0], rsi
lea rbx, [0x140267540]
mov rax, qword [rbp + 0x48]
test rax, rax
cmovne rbx, rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140135e50
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp + 0xa0], rax
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.140018bb0
test al, al
jne 0x14013587b
test rbx, rbx
jne 0x14013585b
mov r8d, esi
jmp 0x14013586b
mov r8, r14
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x140135860
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.140018f50
nop
mov rdx, r15
mov rbx, qword [rbp + 0xa0]
mov rcx, rbx
call fcn.1400de340
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401358b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1401358c2
call fcn.140207144
mov qword [rbp + 0x48], rsi
mov dword [rbp + 0x54], esi
mov rdx, qword [rbp + 0xb8]
jmp 0x14013567c
mov qword [rbp + 0xc8], rsi
mov rcx, qword [r15 + 0x60]
sub rcx, 0x18
call fcn.140019180
lea rbx, [rax + 0x18]
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0x60], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140135e2f
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp + 0x60], rax
mov r8, rbx
lea rdx, str._iconpackadmin___s_
lea rcx, [rbp + 0x60]
call fcn.14001c4c0
call fcn.140022880
cmp eax, 7
jl 0x140135964
call fcn.14002ef00
test eax, eax
jne 0x140135964
lea rcx, [rbp - 0x38]
call fcn.140022dc0
nop
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x60]
mov r8, qword [rax]
xor ecx, ecx
call fcn.14002efc0
nop
mov rdx, qword [rbp - 0x38]
jmp 0x140135996
lea rcx, [rbp - 0x30]
call fcn.140022dc0
nop
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x60]
mov r8, qword [rax]
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401359b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1401359de
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0xc8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg case.0x140134d3b.20
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
xor eax, eax
jmp 0x140134ebf
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rcx, qword [r15 + 0x60]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call fcn.140128560
xor eax, eax
jmp 0x140134ebf
call fcn.14012bfe0
mov dword [rax + 0xc4], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x30], rax
mov rcx, qword [r15 + 0x70]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x68], rax
mov rcx, qword [r15 + 0x68]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x70], rax
mov rcx, qword [r15 + 0x60]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x30], rsi
mov rcx, qword [rsp + 0x58]
cmp dword [rcx - 0x10], 0
je 0x140135ada
lea r8, [rbp + 0x30]
lea rdx, [0x1402a17a8]
call fcn.14002c760
mov rsi, qword [rbp + 0x30]
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140135b00
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x70]
mov rcx, rsi
call fcn.1401336b0
xor eax, eax
jmp 0x140134ebf
call fcn.14012bfe0
mov dword [rax + 0xc4], 1
call fcn.140130420
jmp 0x140134ebf
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_help_parameter_
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x140134ebf
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1a0]
call fcn.14022eb00
mov qword [rbp + 0x1a8], rsi
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x1c8], rsi
mov qword [rbp + 0x1d0], rsi
mov dword [rbp + 0x1d8], esi
lea rbx, vtable.CPassManDlg.0
mov qword [rbp + 0x1a0], rbx
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x38], rax
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], rsi
mov qword [rbp + 0x200], rsi
mov dword [rbp + 0x208], esi
mov dword [rbp + 0x210], esi
lea rcx, [rbp + 0x218]
call fcn.1400f3d80
nop
mov dword [rbp + 0x1e8], esi
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140136370
nop
mov qword [rbp + 0x1a0], rbx
lea rcx, [rbp + 0x218]
call fcn.1400f3ea0
nop
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x40], rax
mov rbx, qword [rbp + 0x1f0]
test rbx, rbx
je 0x140135c57
mov rdi, qword [rbp + 0x1f8]
test rdi, rdi
je 0x140135c4e
mov rcx, rbx
call fcn.14003eb00
add rbx, 0x10
sub rdi, 1
jne 0x140135c35
mov rbx, qword [rbp + 0x1f0]
mov rcx, rbx
call fcn.140207144
nop
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x60], rax
mov rcx, qword [rbp + 0x1c8]
test rcx, rcx
je case.0x140134d3b.20
call fcn.1401f7250
xor eax, eax
jmp 0x140134ebf
call fcn.14012bfe0
mov dword [rax + 0xc4], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov rcx, qword [r15 + 0x68]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rcx, qword [r15 + 0x60]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.140133a30
jmp 0x140134ebf
xor edx, edx
mov r8d, 0x180
lea rcx, [rbp + 0x1a0]
call fcn.14022eb00
lea rcx, [rbp + 0x1a0]
call fcn.140187840
nop
lea rdx, [r15 + 0x60]
lea rcx, [rbp + 0x1e8]
call fcn.140017b80
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
mov rax, qword [rbp + 0x1c8]
test rax, rax
jne 0x140135d47
call fcn.1401f7180
mov qword [rbp + 0x1c8], rax
test rax, rax
jne 0x140135d47
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140135dd9
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1401f72b0
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x1b0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x1b8], eax
lea rdi, [0x140315cd8]
mov qword [rsp + 0x48], rdi
mov byte [rsp + 0x50], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x50], 1
mov rax, qword [0x140315d00]
mov qword [rbp + 0x1c0], rax
lea rax, [rbp + 0x1b0]
mov qword [0x140315d00], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x20], rsi
lea r9, [0x140017d70]
mov r8, rbx
mov edx, 0xe4
mov rcx, qword [0x14030a4d0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop
lea rcx, [rbp + 0x1a0]
call fcn.140187b10
xor eax, eax
jmp 0x140134ebf
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], rax
mov rcx, qword [r15 + 0x60]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
call fcn.140178600
xor eax, eax
jmp 0x140134ebf
call fcn.140166630
mov rcx, rax
call fcn.1401672f0
jmp 0x140134ea1
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3