Function at 0x14000d060
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Connect pipe
Create directory
Create pipe
Create process on windows
Encode data using base64
Get common file path
Persist via run registry key
Query environment variable
Read file on windows
Resolve function by parsing pe exports
Resume thread
Self delete
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xdd8
xor ebx, ebx
mov rdi, r9
mov rsi, rcx
mov dword [rsp + 0x78], 0x20
mov dword [rsp + 0x1b0], 0x61
mov dword [rsp + 0x98], 0x63
lea ebp, [rbx + 0x2f]
mov dword [rsp + 0x268], ebx
mov dword [rax - 0xbb0], ebx
mov byte [rsp + 0x9c], bl
mov qword [rax - 0xa28], rbx
mov qword [rax - 0x9c0], rbx
mov dword [rsp + 0xb8], 0xd
cmp r9, rbx
je 0x14000d419
lea rcx, [rax + 0x20]
call fcn.140053eb0
mov r11, qword [rsp + 0xe18]
cmp r11, rbx
je 0x14000d419
cmp bp, word [r11]
jne 0x14000d419
movzx ecx, word [r11 + 2]
lea edx, [rbx + 0x20]
lea ebp, [rbx + 0x69]
or cx, dx
lea r8d, [rbx + 0x73]
lea r9d, [rbx + 0x72]
lea r10d, [rbx + 0x76]
cmp bp, cx
jne 0x14000d246
movzx eax, word [r11 + 4]
or ax, dx
lea edx, [rbx + 0x6e]
cmp dx, ax
jne 0x14000d246
movzx eax, word [r11 + 6]
lea edx, [rbx + 0x20]
or ax, dx
cmp r8w, ax
jne 0x14000d246
movzx eax, word [r11 + 8]
or ax, dx
lea edx, [rbx + 0x74]
cmp dx, ax
jne 0x14000d246
movzx eax, word [r11 + 0xa]
lea edx, [rbx + 0x20]
or ax, dx
cmp word [rsp + 0x1b0], ax
jne 0x14000d246
movzx eax, word [r11 + 0xc]
or ax, dx
lea edx, [rbx + 0x6c]
cmp dx, ax
jne 0x14000d246
movzx eax, word [r11 + 0xe]
or ax, word [rsp + 0x78]
cmp dx, ax
jne 0x14000d246
movzx eax, word [r11 + 0x10]
lea edx, [rbx + 0x20]
or ax, dx
cmp r8w, ax
jne 0x14000d246
movzx eax, word [r11 + 0x12]
or ax, dx
lea edx, [rbx + 0x65]
cmp dx, ax
jne 0x14000d24b
movzx eax, word [r11 + 0x14]
or ax, word [rsp + 0x78]
cmp r9w, ax
jne 0x14000d24b
movzx eax, word [r11 + 0x16]
or ax, word [rsp + 0x78]
cmp r10w, ax
jne 0x14000d24b
movzx eax, word [r11 + 0x18]
or ax, word [rsp + 0x78]
cmp bp, ax
jne 0x14000d24b
movzx eax, word [r11 + 0x1a]
or ax, word [rsp + 0x78]
cmp word [rsp + 0x98], ax
jne 0x14000d24b
movzx eax, word [r11 + 0x1c]
or ax, word [rsp + 0x78]
cmp dx, ax
jne 0x14000d24b
lea eax, [rbx + 9]
cmp ax, word [r11 + 0x1e]
ja 0x14000d234
lea eax, [rbx + 0xd]
cmp word [r11 + 0x1e], ax
jbe 0x14000d3e1
mov eax, 0x20
cmp ax, word [r11 + 0x1e]
je 0x14000d3e1
jmp 0x14000d24b
mov edx, 0x65
cmp r8w, cx
jne 0x14000d2e2
movzx eax, word [r11 + 4]
or ax, word [rsp + 0x78]
cmp dx, ax
jne 0x14000d2e2
movzx eax, word [r11 + 6]
or ax, word [rsp + 0x78]
cmp r9w, ax
jne 0x14000d2e2
movzx eax, word [r11 + 8]
or ax, word [rsp + 0x78]
cmp r10w, ax
jne 0x14000d2e2
movzx eax, word [r11 + 0xa]
or ax, word [rsp + 0x78]
cmp bp, ax
jne 0x14000d2e2
movzx eax, word [r11 + 0xc]
or ax, word [rsp + 0x78]
cmp word [rsp + 0x98], ax
jne 0x14000d2e2
movzx eax, word [r11 + 0xe]
or ax, word [rsp + 0x78]
cmp dx, ax
jne 0x14000d2e2
mov eax, 9
cmp ax, word [r11 + 0x10]
ja 0x14000d2d2
mov eax, 0xd
cmp word [r11 + 0x10], ax
jbe 0x14000d3e1
mov eax, 0x20
cmp ax, word [r11 + 0x10]
je 0x14000d3e1
cmp r9w, cx
jne 0x14000d419
movzx eax, word [r11 + 4]
mov ecx, 0x20
or ax, cx
cmp dx, ax
jne 0x14000d419
movzx eax, word [r11 + 6]
or ax, cx
mov ecx, 0x6d
cmp cx, ax
jne 0x14000d419
movzx eax, word [r11 + 8]
mov ecx, 0x6f
or ax, 0x20
cmp cx, ax
jne 0x14000d419
movzx eax, word [r11 + 0xa]
mov ecx, 0x20
or ax, cx
cmp r10w, ax
jne 0x14000d419
movzx eax, word [r11 + 0xc]
or ax, cx
cmp dx, ax
jne 0x14000d419
movzx eax, word [r11 + 0xe]
or ax, cx
cmp r8w, ax
jne 0x14000d419
movzx eax, word [r11 + 0x10]
or ax, cx
cmp dx, ax
jne 0x14000d419
movzx eax, word [r11 + 0x12]
or ax, cx
cmp r9w, ax
jne 0x14000d419
movzx eax, word [r11 + 0x14]
or ax, cx
cmp r10w, ax
jne 0x14000d419
movzx eax, word [r11 + 0x16]
or ax, cx
cmp bp, ax
jne 0x14000d419
movzx eax, word [r11 + 0x18]
lea r8d, [rcx + 0x43]
or ax, cx
cmp r8w, ax
jne 0x14000d419
movzx eax, word [r11 + 0x1a]
or ax, cx
cmp dx, ax
jne 0x14000d419
lea eax, [rcx - 0x17]
cmp ax, word [r11 + 0x1c]
ja 0x14000d3da
lea eax, [rcx - 0x13]
cmp word [r11 + 0x1c], ax
jbe 0x14000d3e1
cmp cx, word [r11 + 0x1c]
jne 0x14000d419
lea rdx, str.PECMD_EXEC
lea rcx, [0x140119a00]
call fcn.140066a00
mov rdx, qword [rsp + 0xe18]
lea rcx, [0x140119a00]
call fcn.14005bdb0
mov eax, 2
mov word [rsi + 0xc8], ax
jmp 0x140014d16
mov eax, dword [rsp + 0xe20]
mov esi, 1
mov dword [rsp + 0x1f0], ebx
mov ecx, eax
mov byte [rsp + 0x88], bl
mov byte [rsp + 0x80], bl
and ecx, esi
mov dword [rsp + 0x84], ecx
mov ecx, eax
shr eax, 2
shr ecx, 1
and al, sil
and ecx, esi
mov dword [rsp + 0xe20], eax
mov dword [rsp + 0xbc], ecx
lea rcx, [rsp + 0x190]
call fcn.14005bc74
mov rdx, qword [rsp + 0xe08]
cmp rdx, rbx
je 0x14000d4a3
lea rcx, [rsp + 0x190]
call fcn.140066a00
mov r11, qword [rsp + 0x190]
lea rcx, [rsp + 0xe08]
mov qword [rsp + 0xe08], r11
call fcn.140053eb0
lea rcx, [rsp + 0x180]
call fcn.14005bc74
mov rdx, qword [rsp + 0xe18]
cmp rdx, rbx
je 0x14000d4da
lea rcx, [rsp + 0x180]
call fcn.140066a00
mov rdx, qword [rsp + 0x180]
mov qword [rsp + 0xe18], rdx
cmp qword [rsp + 0xe28], rbx
lea rax, [rsp + 0x540]
mov ecx, 0x5e
cmovne rax, qword [rsp + 0xe28]
mov dword [rsp + 0x480], ecx
mov qword [rsp + 0x468], rax
mov rax, qword [rsp + 0xe08]
mov qword [rsp + 0x368], rax
cmp rax, rbx
jne 0x14000d565
mov qword [rsp + 0xe08], rdx
cmp rdx, rbx
je 0x14000d565
lea r8d, [rcx - 0x59]
lea rcx, str._shel
call fcn.1400553c8
cmp al, bl
je 0x14000d565
lea rax, [rsp + 0x480]
mov dl, sil
mov dword [rsp + 0x84], esi
mov qword [rsp + 0xe18], rax
mov dword [rsp + 0xbc], esi
mov dword [rsp + 0xe20], edx
lea rcx, [rsp + 0x160]
mov byte [rsp + 0x71], bl
mov qword [rsp + 0x3a0], rbx
mov byte [rsp + 0x72], bl
mov byte [rsp + 0x121], bl
mov byte [rsp + 0x178], bl
mov byte [rsp + 0x118], bl
mov byte [rsp + 0xa0], bl
mov byte [rsp + 0xc3], bl
mov byte [rsp + 0x74], bl
mov byte [rsp + 0x90], bl
mov byte [rsp + 0x81], bl
mov byte [rsp + 0x120], bl
call fcn.14005bc74
mov al, byte [0x1401198e0]
neg al
lea rcx, [rsp + 0x188]
mov dword [rsp + 0x320], ebx
sbb eax, eax
mov dword [rsp + 0x324], ebx
mov byte [rsp + 0x123], bl
and eax, 0x10000
mov byte [rsp + 0x140], bl
mov byte [rsp + 0xc1], bl
mov byte [rsp + 0xc4], bl
mov byte [rsp + 0xc5], sil
mov byte [rsp + 0x122], bl
mov dword [rsp + 0x100], eax
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xb4], ebx
mov dword [rsp + 0x11c], ebx
call fcn.14005bc74
lea rcx, [rsp + 0x108]
mov dword [rsp + 0x150], ebx
mov byte [rsp + 0x70], bl
call fcn.14005bc74
lea rcx, [rsp + 0x130]
call fcn.14005bc74
lea rcx, [rsp + 0x110]
call fcn.14005bc74
or dword [rsp + 0x1c0], 0xffffffff
lea rcx, [rsp + 0x1a8]
mov sil, bl
mov r11b, bl
mov byte [rsp + 0xc2], bl
mov dword [rsp + 0xa4], esi
mov qword [rsp + 0x430], rbx
call fcn.14005bc74
xor edx, edx
lea rcx, [rsp + 0x5f0]
mov qword [rsp + 0x228], rbx
lea r8d, [rdx + 0x60]
mov qword [rsp + 0x280], rbx
mov dword [rsp + 0x5e0], 0x68
mov qword [rsp + 0x5e8], rbx
call fcn.1400df2a0
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x650]
call fcn.1400df2a0
xor eax, eax
lea rcx, [rsp + 0x3b8]
mov qword [rsp + 0x338], rbx
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x348], rax
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x358], rax
mov qword [rsp + 0x360], rax
call fcn.140005ea4
mov ebp, 2
mov eax, ebx
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0xe18]
mov dword [rsp + 0xd0], ebx
lea edx, [rbp + 0x21]
lea ecx, [rbp + 1]
lea r9d, [rbp + 0x22]
cmp rax, rbx
jne 0x14000d762
lea r8d, [rbp - 1]
mov cl, r8b
mov dword [rsp + 0xa4], ecx
mov rcx, qword [rsp + 0xe08]
jmp 0x14000d81d
cmp dx, word [rax]
jne 0x14000d78c
mov rcx, qword [rsp + 0xe08]
cmp rax, rcx
jne 0x14000d77f
add rcx, rbp
mov qword [rsp + 0xe08], rcx
add rax, rbp
mov qword [rsp + 0xe18], rax
jmp 0x14000d7a8
test byte [0x1401198e3], cl
movzx esi, sil
cmovne esi, ecx
mov rcx, qword [rsp + 0xe08]
mov dword [rsp + 0xa4], esi
cmp rax, rbx
je 0x14000d817
mov edx, 0x5e
cmp dx, word [rax]
jne 0x14000d7e4
cmp rax, rcx
jne 0x14000d7c7
add rcx, rbp
mov qword [rsp + 0xe08], rcx
mov r8d, 1
add rax, rbp
mov dl, r8b
mov qword [rsp + 0xe18], rax
mov dword [rsp + 0xe20], edx
jmp 0x14000d7ea
mov r8d, 1
cmp rax, rbx
je 0x14000d81d
cmp r9w, word [rax]
jne 0x14000d81d
cmp rax, rcx
jne 0x14000d805
add rcx, rbp
mov qword [rsp + 0xe08], rcx
add rax, rbp
mov byte [rsp + 0x74], r8b
mov qword [rsp + 0xe18], rax
jmp 0x14000d81d
mov r8d, 1
mov esi, ebx
mov dword [rsp + 0x104], ebx
mov edx, 0x7c
cmp rax, rbx
je 0x14000d85b
cmp dx, word [rax]
jne 0x14000d85b
cmp rax, rcx
jne 0x14000d845
add rcx, rbp
mov qword [rsp + 0xe08], rcx
add rax, rbp
mov esi, r8d
mov dword [rsp + 0x104], r8d
mov qword [rsp + 0xe18], rax
mov eax, 0x30
lea r10d, [rax - 6]
lea r9d, [rax - 3]
cmp rdi, rbx
je 0x14000d9e0
cmp r10w, word [rdi]
jne 0x14000d9e0
add rcx, rbp
mov byte [rsp + 0x71], 0x10
mov qword [rsp + 0xe08], rcx
cmp dx, word [rcx]
jne 0x14000d8a6
add rcx, rbp
mov esi, r8d
mov dword [rsp + 0x104], r8d
mov qword [rsp + 0xe08], rcx
cmp ax, word [rcx]
ja 0x14000d8f0
cmp word [rcx], 0x39
ja 0x14000d8f0
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0xe08]
mov byte [rsp + 0x71], 0x11
call fcn.140006ecc
cmp qword [rsp + 0x3a0], rbx
mov rcx, qword [rsp + 0xe08]
mov edi, 1
lea r8d, [rdi + 0x1f]
jg 0x14000d928
mov qword [rsp + 0x3a0], rdi
jmp 0x14000d928
movzx eax, word [rcx]
mov r8d, 0x20
lea edx, [r8 + 0x4e]
or ax, r8w
cmp dx, ax
jne 0x14000d90d
mov byte [rsp + 0x71], 0x12
jmp 0x14000d918
cmp r9w, word [rcx]
jne 0x14000d923
mov byte [rsp + 0x71], 0x14
add rcx, rbp
mov qword [rsp + 0xe08], rcx
mov edi, 1
mov eax, 0x23
cmp ax, word [rcx]
jne 0x14000d945
add rcx, rbp
mov byte [rsp + 0x9c], dil
mov qword [rsp + 0xe08], rcx
mov eax, 9
cmp ax, word [rcx]
ja 0x14000d95d
mov eax, 0xd
cmp word [rcx], ax
jbe 0x14000d9e0
cmp r8w, word [rcx]
je 0x14000d9e0
lea rcx, [rsp + 0x3b8]
call fcn.140005fd0
lea rcx, [rsp + 0x1a8]
call fcn.140053e80
lea rcx, [rsp + 0x110]
call fcn.140053e80
lea rcx, [rsp + 0x130]
call fcn.140053e80
lea rcx, [rsp + 0x108]
call fcn.140053e80
lea rcx, [rsp + 0x188]
call fcn.140053e80
lea rcx, [rsp + 0x160]
call fcn.140053e80
lea rcx, [rsp + 0x180]
call fcn.140053e80
lea rcx, [rsp + 0x190]
call fcn.140053e80
mov rbx, rdi
jmp 0x140014d16
lea rcx, [rsp + 0xe08]
call fcn.140053eb0
mov dword [rsp + 0x1d0], 0x22
mov edx, 0x3d
cmp byte [rsp + 0x71], bl
je 0x14000db9d
mov rcx, qword [rsp + 0xe08]
mov eax, 1
mov dword [rsp + 0x84], eax
movzx eax, word [rcx]
mov rdi, rcx
cmp ax, bx
je 0x140014c9c
cmp ax, dx
je 0x14000da3a
add rdi, rbp
mov ax, word [rdi]
cmp ax, bx
jne 0x14000da2a
cmp rdi, rcx
je 0x140014c9c
cmp dx, word [rdi]
jne 0x140014c9c
sub rdi, rbp
mov eax, 0x2b
mov qword [rsp + 0x310], rdi
cmp ax, word [rdi]
jne 0x14000da75
mov al, byte [rdi]
sub rdi, rbp
mov byte [rsp + 0x123], al
mov qword [rsp + 0x310], rdi
mov r8, rdi
mov r10d, 9
cmp rdi, rcx
jbe 0x14000dab3
lea esi, [r10 + 0x17]
lea edi, [rsi - 0x13]
cmp r10w, word [r8]
ja 0x14000da96
cmp word [r8], di
jbe 0x14000da9c
cmp si, word [r8]
jne 0x14000daa4
sub r8, rbp
cmp r8, rcx
ja 0x14000da8a
mov rdi, qword [rsp + 0x310]
mov esi, dword [rsp + 0x104]
mov r11d, 0xd
cmp r10w, word [r8]
ja 0x14000dac9
cmp word [r8], r11w
jbe 0x140014c9c
mov r9d, 0x20
cmp r9w, word [r8]
je 0x140014c9c
mov rdx, r8
add r8, rbp
cmp rdx, rcx
jbe 0x14000db02
lea rax, [rdx - 2]
cmp r10w, word [rax]
ja 0x14000daf4
cmp word [rax], r11w
jbe 0x14000db02
cmp r9w, word [rax]
je 0x14000db02
mov rdx, rax
cmp rax, rcx
ja 0x14000dae4
sub r8, rdx
lea rcx, [rsp + 0x108]
sar r8, 1
call fcn.14005bedc
mov r9, qword [rsp + 0xe00]
lea rdx, [rsp + 0x108]
mov rcx, r9
xor r8d, r8d
call fcn.14000394c
mov rax, qword [rsp + 0xe00]
cmp byte [rax + 0xda], bl
jne 0x14000db46
test byte [rax + 0xd], 0xf
je 0x14000db59
lea rdx, [rsp + 0x108]
xor r8d, r8d
mov rcx, rax
call fcn.14000394c
movzx eax, word [rdi]
cmp ax, bx
je 0x14000db76
mov ecx, 0x3d
cmp ax, cx
je 0x14000db84
add rdi, rbp
mov ax, word [rdi]
cmp ax, bx
jne 0x14000db66
mov eax, 0x3d
cmp word [rdi], ax
jne 0x140014c9c
lea rax, [rdi + 2]
lea rcx, [rsp + 0x430]
mov qword [rsp + 0x430], rax
call fcn.140053eb0
lea rcx, [rsp + 0xe08]
call fcn.140053eb0
mov rdi, qword [rsp + 0xe08]
mov qword [rsp + 0xd8], rdi
cmp qword [rsp + 0x228], rbx
je 0x14000dbce
cmp byte [rsp + 0x71], bl
jne 0x14000dd5c
mov edx, 0x2d
cmp dx, word [rdi]
jne 0x14000dbee
lea rcx, [rdi + 2]
mov rax, rdi
cmp dx, word [rcx]
cmove rax, rcx
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0xd8]
lea rcx, [0x1400fc900]
mov r8d, 1
call fcn.14005e44c
cmp al, bl
jne 0x14000dd5c
mov rax, qword [rsp + 0xd8]
mov ecx, 0x2d
cmp cx, word [rax]
je 0x14000dc30
mov ecx, 0x2f
cmp cx, word [rax]
jne 0x14000dd5c
add rax, rbp
lea rdx, [rsp + 0xd8]
lea rcx, str.catch
mov r8d, 5
mov qword [rsp + 0xd8], rax
call fcn.14005e4e8
cmp al, bl
je 0x14000dcce
mov cl, byte [rsp + 0x71]
mov al, cl
or cl, 0x10
mov byte [rsp + 0x71], cl
cmp al, bl
je 0x14000deba
mov rax, qword [rsp + 0xd8]
movzx ecx, word [rax]
cmp cx, bx
je 0x14000dcb4
mov edx, 0x20
lea esi, [rdx - 0x13]
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x14000dc95
cmp cx, si
jbe 0x14000dcad
cmp dx, cx
je 0x14000dcad
add rax, rbp
mov qword [rsp + 0xd8], rax
mov cx, word [rax]
cmp cx, bx
jne 0x14000dc8a
mov esi, dword [rsp + 0x104]
lea rcx, [rsp + 0xd8]
call fcn.140053eb0
mov rdi, qword [rsp + 0xd8]
jmp 0x14000dbce
mov rdx, qword [rsp + 0xd8]
lea rcx, str.cmd:
mov r8d, 4
call fcn.1400553c8
cmp al, bl
je 0x14000ddb4
mov rcx, qword [rsp + 0xe00]
add qword [rsp + 0xd8], 8
lea r9, [rsp + 0x1c0]
lea r8, [rsp + 0x1a8]
lea rdx, [rsp + 0xd8]
call fcn.140008fe0
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0xd8]
cmp rdi, rax
jae 0x14000dd52
mov esi, 0x20
mov word [rdi], si
mov rax, qword [rsp + 0xd8]
add rdi, rbp
cmp rdi, rax
jb 0x14000dd38
mov esi, dword [rsp + 0x104]
cmp byte [rsp + 0x71], bl
je 0x14000dc76
lea rcx, [rsp + 0xe08]
call fcn.140053eb0
mov rdx, qword [rsp + 0x228]
cmp rdx, rbx
je 0x14000dd8a
movzx eax, word [rdx]
neg ax
sbb rcx, rcx
and rcx, rdx
mov qword [rsp + 0x228], rcx
cmp esi, ebx
jne 0x14000dec4
cmp qword [rsp + 0xe30], rbx
jne 0x14000dec4
mov dil, bl
mov byte [rsp + 0xc0], bl
mov esi, 1
jmp 0x14000ded4
mov rdx, qword [rsp + 0xd8]
lea rcx, [0x1400fc8ec]
mov r8d, 3
call fcn.1400553c8
cmp al, bl
je 0x14000ddf7
mov rax, qword [rsp + 0xd8]
mov ecx, 0x2a
add rax, 6
jmp 0x14000dde8
add rax, rbp
mov qword [rsp + 0xd8], rax
cmp cx, word [rax]
je 0x14000dde5
jmp 0x14000de74
mov rdx, qword [rsp + 0xd8]
lea rcx, str.exe:
mov r8d, 4
call fcn.1400553c8
cmp al, bl
je 0x14000de3a
mov rax, qword [rsp + 0xd8]
mov ecx, 0x2a
add rax, 8
jmp 0x14000de2b
add rax, rbp
mov qword [rsp + 0xd8], rax
cmp cx, word [rax]
je 0x14000de28
jmp 0x14000de74
mov rdx, qword [rsp + 0xd8]
lea rcx, str.logs:
mov r8d, 5
call fcn.1400553c8
cmp al, bl
je 0x14000dc6e
mov rax, qword [rsp + 0xd8]
mov ecx, 0xa
add rax, rcx
mov qword [rsp + 0xd8], rax
mov edx, 0x22
cmp word [rax], dx
jne 0x14000dc76
add rax, rbp
mov qword [rsp + 0xd8], rax
movzx ecx, word [rax]
cmp cx, bx
je 0x14000dcb4
add rax, rbp
mov qword [rsp + 0xd8], rax
cmp dx, cx
je 0x14000dc76
mov cx, word [rax]
cmp cx, bx
jne 0x14000de99
jmp 0x14000dc76
mov edx, 0x3d
jmp 0x14000da07
mov esi, 1
mov dil, sil
mov byte [rsp + 0xc0], sil
lea rcx, [rsp + 0x1b8]
mov qword [rsp + 0x4b8], rbx
mov qword [rsp + 0x2f0], rbx
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0x218], rbx
mov qword [rsp + 0x208], rbx
call fcn.14005bc74
lea rcx, [rsp + 0x1f8]
call fcn.14005bc74
mov bp, bx
mov qword [rsp + 0x148], rbx
mov dword [rsp + 0x7c], ebp
mov qword [rsp + 0x1d8], rbx
mov byte [rsp + 0x75], bl
cmp dil, bl
jne 0x14000df85
cmp qword [rsp + 0x368], rbx
jne 0x14000df85
mov rdx, qword [rsp + 0xe08]
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x1d8]
xor r9d, r9d
mov byte [rsp + 0x20], sil
call fcn.14007059c
mov r11, qword [rsp + 0x1d8]
mov qword [rsp + 0xe08], r11
mov dword [rsp + 0x24c], pe_nt_image_headers64
mov eax, 1
mov edi, 2
mov rsi, qword [rsp + 0xe08]
mov edx, 0x2d
cmp dx, word [rsi]
jne 0x14000dfc5
lea rcx, [rsi + 2]
mov rax, rsi
cmp dx, word [rcx]
cmove rax, rcx
mov qword [rsp + 0xe08], rax
lea eax, [rdx - 0x2c]
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc900]
mov r8d, eax
call fcn.14005e44c
mov r8, qword [rsp + 0xe08]
cmp al, bl
jne 0x14000f54e
mov ecx, 0x2d
cmp cx, word [r8]
je 0x14000e004
lea eax, [rcx + 2]
cmp ax, word [r8]
jne 0x14000f54e
add r8, rdi
lea rdx, [rsp + 0xe08]
lea rcx, str.catch
mov qword [rsp + 0xe08], r8
mov r8d, 5
call fcn.14005e44c
cmp al, bl
je 0x14000e037
mov byte [rsp + 0x71], 0x10
jmp 0x14000f449
mov rdx, qword [rsp + 0xe08]
lea rcx, str.clone:
mov r8d, 6
call fcn.1400553c8
cmp al, bl
je 0x14000e0d1
mov rax, qword [rsp + 0xe08]
add rax, 0xc
mov qword [rsp + 0xe08], rax
mov rdx, rax
movzx ecx, word [rax]
cmp cx, bx
je 0x14000e0bb
mov r8d, 0x20
lea r9d, [r8 - 0x17]
cmp r9w, cx
ja 0x14000e090
mov r10d, 0xd
cmp cx, r10w
jbe 0x14000e0ab
cmp r8w, cx
je 0x14000e0ab
add rax, rdi
mov qword [rsp + 0xe08], rax
mov cx, word [rax]
cmp cx, bx
je 0x14000e0bb
jmp 0x14000e07e
cmp word [rax], bx
je 0x14000e0bb
mov word [rax], bx
add qword [rsp + 0xe08], rdi
cmp word [rdx], bx
je 0x14000f539
mov qword [rsp + 0x280], rdx
jmp 0x14000f539
lea rdx, [rsp + 0xe08]
lea rcx, str.shel
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x14000e117
or byte [rsp + 0xe20], dil
and byte [rsp + 0xa4], 0xfe
mov eax, 1
mov dword [rsp + 0xbc], eax
mov dword [rsp + 0x84], eax
jmp 0x14000df9a
mov rdx, qword [rsp + 0xe08]
lea rcx, str.shel:
mov r8d, 5
call fcn.1400553c8
cmp al, bl
je 0x14000e1d3
or byte [rsp + 0xe20], dil
and byte [rsp + 0xa4], 0xfe
mov eax, 1
mov dword [rsp + 0xbc], eax
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0xe08]
add rax, 0xa
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x4c8]
mov r8d, 5
mov qword [rsp + 0x490], rbx
mov qword [rsp + 0xe08], rax
mov qword [rsp + 0x4c8], rax
call fcn.140023518
mov r8, qword [rsp + 0x490]
cmp r8, rbx
mov qword [rsp + 0xe08], rax
mov eax, 1
jle 0x14000df9a
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x438]
call fcn.14005bedc
jmp 0x14000f449
mov rdx, qword [rsp + 0xe08]
lea rcx, str.runrmenu:
mov r8d, 9
call fcn.1400553c8
cmp al, bl
je 0x14000e252
mov r8, qword [rsp + 0xe08]
add r8, 0x12
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, bx
je 0x14000e245
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000e228
cmp ax, bp
jbe 0x14000e241
cmp cx, ax
je 0x14000e241
add r8, rdi
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, bx
jne 0x14000e21d
mov ebp, dword [rsp + 0x7c]
lea rcx, [rsp + 0x160]
jmp 0x14000e404
mov rdx, qword [rsp + 0xe08]
lea rcx, str.poprmenu
mov r8d, 8
call fcn.1400553c8
cmp al, bl
je 0x14000e37d
mov rax, qword [rsp + 0xe08]
add rax, 0x10
mov qword [rsp + 0xe08], rax
mov qword [rsp + 0x330], rax
movzx ecx, word [rax]
cmp cx, bx
je 0x14000e2dd
mov edx, 0x20
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x14000e2b3
mov r9d, 0xd
cmp cx, r9w
jbe 0x14000e2cd
cmp dx, cx
je 0x14000e2cd
add rax, rdi
mov qword [rsp + 0xe08], rax
mov cx, word [rax]
cmp cx, bx
je 0x14000e2dd
jmp 0x14000e2a1
cmp word [rax], bx
je 0x14000e2dd
add rax, rdi
mov qword [rsp + 0xe08], rax
lea rcx, [rsp + 0xe08]
call fcn.140053eb0
lea rcx, [rsp + 0x320]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsp + 0x330]
mov byte [rsp + 0x90], 1
mov esi, 0x30
cmp word [rax], bx
je 0x14000e328
cmp word [rax], si
jb 0x14000e31d
cmp word [rax], 0x39
jbe 0x14000e328
add rax, rdi
mov qword [rsp + 0x330], rax
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x330]
call fcn.14006a974
mov r11, qword [rsp + 0x330]
cmp word [r11], bx
je 0x14000e363
cmp word [r11], si
jb 0x14000e358
cmp word [r11], 0x39
jbe 0x14000e363
add r11, rdi
mov qword [rsp + 0x330], r11
lea rdx, [rsp + 0x324]
lea rcx, [rsp + 0x330]
call fcn.14006a974
jmp 0x14000f449
mov rdx, qword [rsp + 0xe08]
lea rcx, str.pid:
mov r8d, 4
call fcn.1400553c8
cmp al, bl
je 0x14000e414
mov r8, qword [rsp + 0xe08]
add r8, 8
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, bx
je 0x14000f539
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000e3d6
cmp ax, bp
jbe 0x14000e3ef
cmp cx, ax
je 0x14000e3ef
add r8, rdi
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, bx
jne 0x14000e3cb
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f539
lea rcx, [rsp + 0x208]
sub r8, rdx
sar r8, 1
call fcn.14005bedc
jmp 0x14000f539
mov rdx, qword [rsp + 0xe08]
lea rcx, str.hpid:
mov r8d, 5
call fcn.1400553c8
cmp al, bl
je 0x14000e4a4
mov r8, qword [rsp + 0xe08]
mov eax, 0xa
add r8, rax
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, bx
je 0x14000f539
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000e471
cmp ax, bp
jbe 0x14000e48a
cmp cx, ax
je 0x14000e48a
add r8, rdi
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, bx
jne 0x14000e466
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f539
lea rcx, [rsp + 0x218]
jmp 0x14000e404
mov rdx, qword [rsp + 0xe08]
lea rcx, str.ppid:
mov r8d, 5
call fcn.1400553c8
cmp al, bl
je 0x14000e51a
mov eax, 0xa
lea rdx, [rsp + 0x4d8]
lea rcx, [rsp + 0xe08]
add qword [rsp + 0xe08], rax
mov qword [rsp + 0x4d8], rbx
call fcn.14005fe50
mov rax, qword [rsp + 0x4d8]
cmp rax, rbx
mov qword [rsp + 0x230], rax
jge 0x14000f449
mov rcx, rax
call fcn.140009148
mov qword [rsp + 0x230], rax
jmp 0x14000f449
mov rdx, qword [rsp + 0xe08]
lea rcx, str.exe:
mov r8d, 4
call fcn.1400553c8
cmp al, bl
je 0x14000e6d8
mov rax, qword [rsp + 0xe08]
mov r8d, 0x23
mov edi, ebx
add rax, 8
mov edx, ebx
lea r10d, [r8 - 0x22]
mov qword [rsp + 0xe08], rax
movzx ecx, word [rax]
mov r9, rax
cmp r8w, cx
jne 0x14000e572
mov ebp, r10d
mov dword [rsp + 0x7c], r10d
mov esi, 0x22
cmp si, cx
jne 0x14000e636
add rax, 2
mov qword [rsp + 0xe08], rax
mov r8, rax
mov qword [rsp + 0x328], rax
movzx ecx, word [rax]
cmp cx, bx
je 0x14000e5fa
lea edi, [rsi - 2]
lea r8d, [rsi - 0x20]
lea r11d, [rsi - 0x19]
cmp si, cx
jne 0x14000e5d9
add edx, r10d
test r10b, dl
je 0x14000e5d9
movzx ecx, word [rax + 2]
cmp cx, bx
je 0x14000e5ec
cmp r11w, cx
ja 0x14000e5d0
cmp cx, word [rsp + 0xb8]
jbe 0x14000e5ec
cmp di, cx
je 0x14000e5ec
or bp, r8w
add rax, r8
mov qword [rsp + 0xe08], rax
mov cx, word [rax]
cmp cx, bx
jne 0x14000e5aa
mov r8, qword [rsp + 0x328]
mov dword [rsp + 0x7c], ebp
mov edi, ebx
cmp si, word [rax]
jne 0x14000e671
or edi, 0xffffffff
mov r9, r8
lea ecx, [rdi + 3]
add rax, rcx
mov byte [rsp + 0x75], cl
mov qword [rsp + 0xe08], rax
cmp si, word [rax - 4]
je 0x14000e630
cmp si, word [r8]
jne 0x14000e671
cmp si, word [r8 + 2]
je 0x14000e630
cmp si, word [r8]
jne 0x14000e671
mov byte [rsp + 0x75], bl
jmp 0x14000e671
cmp cx, bx
je 0x14000e671
mov edx, 0x20
lea ebp, [rdx - 0x13]
lea r8d, [rdx - 0x17]
cmp r8w, cx
ja 0x14000e652
cmp cx, bp
jbe 0x14000e66b
cmp dx, cx
je 0x14000e66b
add rax, 2
mov qword [rsp + 0xe08], rax
mov cx, word [rax]
cmp cx, bx
jne 0x14000e647
mov ebp, dword [rsp + 0x7c]
mov edi, ebx
sub rax, r9
sar rax, 1
add edi, eax
cmp edi, ebx
jle 0x14000e6ce
lea rdx, [r9 - 0xa]
lea rcx, [rsp + 0x170]
call fcn.140066a00
mov r11, qword [rsp + 0x170]
movsxd rax, edi
lea rcx, [r11 + 0xa]
mov qword [rsp + 0xe8], rcx
mov word [rcx + rax*2], bx
mov eax, 0x2a
cmp ax, word [rcx]
jne 0x14000e6ce
cmp word [rcx + 2], bx
jne 0x14000e6ce
lea rcx, [rsp + 0x170]
call fcn.140005e4c
mov qword [rsp + 0xe8], rax
mov edi, 2
jmp 0x14000f539
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400fc8ec]
mov r8d, 3
call fcn.1400553c8
cmp al, bl
je 0x14000e883
mov rax, qword [rsp + 0xe08]
mov ecx, 0x2a
mov edi, ebx
add rax, 6
lea esi, [rcx - 0x29]
mov qword [rsp + 0xe08], rax
cmp word [rax], cx
jne 0x14000e725
add edi, esi
add rax, 2
jmp 0x14000e710
cmp edi, 2
mov qword [rsp + 0x4e0], rax
mov rdx, rbx
mov qword [rsp + 0x478], rbx
jge 0x14000e82a
cmp word [rax], bx
je 0x14000e7c3
mov ecx, 9
cmp cx, word [rax]
ja 0x14000e75a
mov ecx, 0xd
cmp word [rax], cx
jbe 0x14000e7c3
mov ecx, 0x20
cmp cx, word [rax]
je 0x14000e7c3
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x4e0]
mov r8d, esi
call fcn.140023518
mov rdx, qword [rsp + 0x478]
cmp rdx, rbx
mov qword [rsp + 0xe08], rax
jle 0x14000e7c3
mov r8, rdx
mov rdx, qword [rsp + 0x4e0]
lea rcx, [rsp + 0x148]
call fcn.14005bedc
mov rcx, qword [rsp + 0x148]
mov rdx, qword [rsp + 0x478]
mov qword [rsp + 0x128], rcx
jmp 0x14000e7cb
mov rcx, qword [rsp + 0x148]
cmp edi, esi
jne 0x14000e80e
cmp rdx, rbx
jle 0x14000e816
lea rdx, [rsp + 0x148]
mov r8, rsi
mov qword [rsp + 0x548], rcx
mov qword [rsp + 0x148], rbx
call fcn.1400c8c48
lea rcx, [rsp + 0x548]
mov qword [rsp + 0x128], rax
call fcn.140053e80
jmp 0x14000e6ce
cmp edi, ebx
jle 0x14000e6ce
lea rsi, [0x1400fc888]
mov qword [rsp + 0x128], rsi
jmp 0x14000e6ce
lea rcx, [rsp + 0x148]
mov edx, 0x105
call fcn.14005bd74
mov rdx, qword [rsp + 0x148]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x148]
xor edx, edx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp rax, rbx
je 0x14000e86e
mov word [rax], bx
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x128], rax
jmp 0x14000e6ce
mov rdx, qword [rsp + 0xe08]
lea rcx, str.logs:
mov r8d, 5
call fcn.1400553c8
cmp al, bl
je 0x14000e941
mov rdi, qword [rsp + 0xe08]
mov esi, ebx
mov eax, 0x3f
add rdi, 0xa
mov qword [rsp + 0xe08], rdi
mov qword [rsp + 0x388], rdi
cmp ax, word [rdi]
sete sil
cmp esi, ebx
je 0x14000e8df
add rdi, 2
mov qword [rsp + 0x388], rdi
lea rdx, [rsp + 0x3a8]
lea rcx, [rsp + 0x388]
mov r8d, 1
mov qword [rsp + 0x3a8], rbx
call fcn.140023518
mov r8, qword [rsp + 0x3a8]
cmp r8, rbx
mov qword [rsp + 0xe08], rax
jle 0x14000e6ce
cmp esi, ebx
je 0x14000e92c
cmp qword [0x140119a58], rbx
je 0x14000e6ce
lea rcx, [rsp + 0x188]
mov rdx, rdi
call fcn.14005bedc
jmp 0x14000e6ce
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc884]
mov r8d, edi
call fcn.14005e44c
cmp al, bl
je 0x14000e96d
mov eax, 1
mov byte [rsp + 0x120], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.nowin
mov r8d, 5
call fcn.14005e44c
cmp al, bl
je 0x14000e99c
mov eax, 1
mov byte [rsp + 0x81], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.hide
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x14000e9c4
mov edx, 0x10000000
jmp 0x14000eb52
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc86c]
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x14000e9fa
mov eax, 1
add dword [rsp + 0x1f0], eax
mov dword [rsp + 0x84], eax
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.waiti
mov r8d, 5
call fcn.14005e44c
cmp al, bl
je 0x14000ea29
mov eax, 1
mov byte [rsp + 0x80], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc860]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x14000ea55
mov eax, 1
or byte [rsp + 0x72], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.err
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x14000ea7d
or byte [rsp + 0x72], 3
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.limit
mov r8d, 5
call fcn.14005e44c
cmp al, bl
je 0x14000eaac
mov eax, 1
mov byte [rsp + 0xa0], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc84c]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x14000eadb
mov eax, 1
mov byte [rsp + 0xc3], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.hook
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x14000eb0a
mov eax, 1
mov dword [rsp + 0xbc], eax
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc840]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x14000eb2f
mov edx, 6
jmp 0x14000eb52
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc83c]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x14000eb5e
mov edx, 3
mov dword [rsp + 0xb4], edx
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.show
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x14000eb8d
mov eax, 1
mov dword [rsp + 0xb4], eax
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.runs
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x14000ebbc
mov eax, 1
mov byte [rsp + 0x118], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc828]
mov r8d, edi
call fcn.14005e44c
cmp al, bl
jne 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.no64
mov r8d, 4
call fcn.14005e44c
cmp al, bl
jne 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc81c]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x14000ec2c
mov eax, 1
mov byte [rsp + 0x121], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc818]
mov r8d, edi
call fcn.14005e44c
cmp al, bl
je 0x14000ec58
mov eax, 1
mov byte [rsp + 0x178], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.incmd
mov r8d, 5
call fcn.14005e44c
cmp al, bl
je 0x14000ec87
mov eax, 1
mov byte [rsp + 0xc4], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.svr_
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x14000ecb1
mov dword [rsp + 0x100], ebx
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.svrsys
mov r8d, 6
call fcn.14005e44c
cmp al, bl
je 0x14000ecd9
mov eax, 0x20000
jmp 0x14000ed60
lea rdx, [rsp + 0xe08]
lea rcx, str.svrsys_
mov r8d, 7
call fcn.14005e44c
cmp al, bl
je 0x14000ed08
mov al, byte [0x1401198e0]
neg al
sbb eax, eax
and eax, 0x20000
jmp 0x14000ed60
lea rdx, [rsp + 0xe08]
lea rcx, str.svrusr
mov r8d, 6
call fcn.14005e44c
cmp al, bl
je 0x14000ed37
mov eax, 1
or dword [rsp + 0x100], eax
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.svrusr_
mov r8d, 7
call fcn.14005e44c
cmp al, bl
je 0x14000ed6c
cmp byte [0x1401198e0], bl
mov eax, ebx
setne al
mov dword [rsp + 0x100], eax
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.hidecmd
mov r8d, 7
call fcn.14005e44c
cmp al, bl
je 0x14000ed9b
mov eax, 1
mov byte [rsp + 0xc5], al
jmp 0x14000df9a
lea rdx, [rsp + 0xe08]
lea rcx, str.hidecmd_
mov r8d, 8
call fcn.14005e44c
cmp al, bl
je 0x14000edc5
mov byte [rsp + 0xc5], bl
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc7cc]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
je 0x14000edf4
mov eax, 1
mov dword [rsp + 0xb0], eax
jmp 0x14000df9a
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400fc7c8]
mov r8d, 3
call fcn.1400553c8
cmp al, bl
je 0x14000ee25
mov rsi, qword [rsp + 0xe08]
mov ecx, 0x108
add rsi, 6
jmp 0x14000ee57
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400fc7c4]
mov r8d, edi
call fcn.1400553c8
cmp al, bl
je 0x14000eeff
mov rsi, qword [rsp + 0xe08]
mov eax, 4
add rsi, rax
lea ecx, [rax + 4]
mov qword [rsp + 0xe08], rsi
movzx eax, word [rsi]
mov dword [rsp + 0xb0], ecx
cmp ax, bx
je 0x14000f539
mov r8d, 9
cmp r8w, ax
ja 0x14000ee8c
mov edx, 0xd
cmp ax, dx
jbe 0x14000f500
mov edx, 0x20
cmp dx, ax
je 0x14000f505
or ax, dx
mov edx, 0x61
cmp dx, ax
jne 0x14000eeae
lea eax, [rdx - 0x21]
or ecx, eax
jmp 0x14000eedc
mov edx, 0x65
cmp dx, ax
jne 0x14000eebe
bts ecx, 7
jmp 0x14000eedc
mov edx, 0x63
cmp dx, ax
jne 0x14000eece
bts ecx, 8
jmp 0x14000eedc
mov edx, 0x64
cmp dx, ax
jne 0x14000eee3
bts ecx, 9
mov dword [rsp + 0xb0], ecx
add rsi, rdi
mov qword [rsp + 0xe08], rsi
mov ax, word [rsi]
cmp ax, bx
je 0x14000f539
jmp 0x14000ee78
mov rdx, qword [rsp + 0xe08]
lea rcx, [0x1400fc7c0]
mov r8d, 3
call fcn.1400553c8
cmp al, bl
je 0x14000efae
mov r8, qword [rsp + 0xe08]
mov eax, 0x3a
mov byte [rsp + 0x74], 1
add r8, 6
mov qword [rsp + 0xe08], r8
cmp ax, word [r8]
jne 0x14000f539
add r8, rdi
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, bx
je 0x14000f539
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000ef7b
cmp ax, bp
jbe 0x14000ef94
cmp cx, ax
je 0x14000ef94
add r8, rdi
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, bx
jne 0x14000ef70
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f539
lea rcx, [rsp + 0x1b8]
jmp 0x14000e404
mov rdx, qword [rsp + 0xe08]
lea rcx, str.code:
mov r8d, 5
call fcn.1400553c8
cmp al, bl
je 0x14000f09a
mov rax, qword [rsp + 0xe08]
lea rdx, [rsp + 0x2a0]
lea rcx, str.UTF8
add rax, 0xa
or r8d, 0xffffffff
mov qword [rsp + 0xe08], rax
mov qword [rsp + 0x2a0], rax
call fcn.14005e44c
cmp al, bl
je 0x14000f029
mov dword [rsp + 0x150], 0xfde9
mov eax, 1
mov byte [rsp + 0x70], al
mov rsi, qword [rsp + 0xe08]
jmp 0x14000f4fa
lea rdx, [rsp + 0x2a0]
lea rcx, str.ANSI
or r8d, 0xffffffff
call fcn.14005e44c
cmp al, bl
je 0x14000f04e
mov dword [rsp + 0x150], ebx
jmp 0x14000f013
lea rdx, [rsp + 0x2a0]
lea rcx, [0x1400fc7a4]
or r8d, 0xffffffff
call fcn.14005e44c
cmp al, bl
je 0x14000f07c
mov byte [rsp + 0x70], dil
mov dword [rsp + 0x150], 0x4b0
jmp 0x14000f01c
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x2a0]
call fcn.14005ffb0
cmp eax, ebx
jle 0x14000f01c
jmp 0x14000f013
lea rdx, [rsp + 0xe08]
lea rcx, str.timeout:
mov r8d, 7
call fcn.14005e528
cmp al, bl
je 0x14000f187
mov rax, qword [rsp + 0xe08]
mov ecx, 0x23
mov dil, bl
mov qword [rsp + 0x318], rax
cmp cx, word [rax]
jne 0x14000f0de
mov dil, 1
jmp 0x14000f0eb
mov ecx, 0x2a
cmp cx, word [rax]
jne 0x14000f0f7
mov dil, 2
add rax, 2
mov qword [rsp + 0x318], rax
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x318]
mov qword [rsp + 0x260], rbx
call fcn.14005feb0
cmp eax, ebx
jle 0x14000f17d
cmp dword [rsp + 0x260], ebx
jle 0x14000f17d
mov eax, dword [rsp + 0x260]
or dword [rsp + 0x84], 0x10
mov ecx, 0x3a
mov dword [rsp + 0x268], eax
mov rax, qword [rsp + 0x318]
mov byte [rsp + 0x9c], dil
lea edi, [rcx - 0x38]
cmp cx, word [rax]
jne 0x14000f01c
add rax, rdi
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x318]
mov qword [rsp + 0x318], rax
call fcn.14005ffb0
jmp 0x14000f01c
mov edi, 2
jmp 0x14000f01c
mov rdx, qword [rsp + 0xe08]
lea rcx, str.user:
mov r8d, 5
call fcn.1400553c8
cmp al, bl
je 0x14000f217
mov r8, qword [rsp + 0xe08]
mov eax, 0xa
add r8, rax
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, bx
je 0x14000f539
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000f1e4
cmp ax, bp
jbe 0x14000f1fd
cmp cx, ax
je 0x14000f1fd
add r8, rdi
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, bx
jne 0x14000f1d9
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f539
lea rcx, [rsp + 0x130]
jmp 0x14000e404
mov rdx, qword [rsp + 0xe08]
lea rcx, str.passwd:
mov r8d, 7
call fcn.1400553c8
cmp al, bl
je 0x14000f23e
mov byte [rsp + 0xc2], bl
jmp 0x14000f268
mov rdx, qword [rsp + 0xe08]
lea rcx, str.passwd
mov r8d, 7
call fcn.1400553c8
cmp al, bl
je 0x14000f2d6
mov eax, 1
mov byte [rsp + 0xc2], al
mov r8, qword [rsp + 0xe08]
add r8, 0xe
mov qword [rsp + 0xe08], r8
mov rdx, r8
movzx eax, word [r8]
cmp ax, bx
je 0x14000f539
mov ecx, 0x20
lea ebp, [rcx - 0x13]
lea r9d, [rcx - 0x17]
cmp r9w, ax
ja 0x14000f2a3
cmp ax, bp
jbe 0x14000f2bc
cmp cx, ax
je 0x14000f2bc
add r8, rdi
mov qword [rsp + 0xe08], r8
mov ax, word [r8]
cmp ax, bx
jne 0x14000f298
mov ebp, dword [rsp + 0x7c]
cmp rdx, r8
je 0x14000f539
lea rcx, [rsp + 0x110]
jmp 0x14000e404
lea rdx, [rsp + 0xe08]
lea rcx, str.REALTIME
mov r8d, 8
call fcn.14005e44c
cmp al, bl
je 0x14000f304
mov dword [rsp + 0x11c], pe_nt_image_headers64
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.HIGH
mov r8d, 4
call fcn.14005e44c
cmp al, bl
je 0x14000f332
mov dword [rsp + 0x11c], 0x80
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.ABOVENORMAL
mov r8d, 0xb
call fcn.14005e44c
cmp al, bl
je 0x14000f360
mov dword [rsp + 0x11c], 0x8000
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.NORMAL
mov r8d, 6
call fcn.14005e44c
cmp al, bl
je 0x14000f38e
mov dword [rsp + 0x11c], 0x20
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, str.BELOWNORMAL
mov r8d, 0xb
call fcn.14005e44c
cmp al, bl
je 0x14000f3bc
mov dword [rsp + 0x11c], 0x4000
jmp 0x14000f449
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc73c]
mov r8d, 3
call fcn.14005e44c
cmp al, bl
jne 0x14000f43e
mov rdi, qword [rsp + 0xe08]
lea rcx, [0x1400fc730]
mov r8d, 4
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
jne 0x14000f453
movzx eax, word [rdi + 8]
mov ecx, 9
cmp cx, ax
ja 0x14000f414
mov ecx, 0xd
cmp ax, cx
jbe 0x14000f423
mov ecx, 0x20
cmp cx, ax
je 0x14000f423
cmp ax, bx
jne 0x14000f453
add qword [rsp + 0xe08], 8
lea rcx, [rsp + 0xe08]
call fcn.140053eb0
mov edi, 2
mov dword [rsp + 0x11c], 0x40
mov eax, 1
jmp 0x14000df9a
mov edi, 3
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc72c]
mov r8d, edi
call fcn.14005e44c
cmp al, bl
je 0x14000f482
lea eax, [rdi - 2]
mov byte [rsp + 0x140], al
jmp 0x14000df95
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc728]
mov r8d, edi
call fcn.14005e44c
cmp al, bl
je 0x14000f4b9
mov eax, 1
mov byte [rsp + 0x70], bl
mov dword [rsp + 0x150], ebx
mov byte [rsp + 0xc1], al
jmp 0x14000df95
lea rdx, [rsp + 0xe08]
lea rcx, [0x1400fc724]
mov r8d, edi
call fcn.14005e44c
cmp al, bl
je 0x14000f4e5
mov eax, 1
mov byte [rsp + 0x122], al
jmp 0x14000df95
mov eax, 0x2d
cmp ax, word [rsi]
mov qword [rsp + 0xe08], rsi
jne 0x14000f54b
lea edi, [rax - 0x2b]
mov r8d, 9
mov edx, 0x20
movzx eax, word [rsi]
cmp ax, bx
je 0x14000f539
mov ebp, 0xd
cmp r8w, ax
ja 0x14000f51d
cmp ax, bp
jbe 0x14000f535
cmp dx, ax
je 0x14000f535
add rsi, rdi
mov qword [rsp + 0xe08], rsi
mov ax, word [rsi]
cmp ax, bx
jne 0x14000f512
mov ebp, dword [rsp + 0x7c]
lea rcx, [rsp + 0xe08]
call fcn.140053eb0
jmp 0x14000f449
mov r8, rsi
mov eax, dword [rsp + 0xb0]
cmp eax, ebx
je 0x14000f5a3
cmp byte [rsp + 0x81], bl
je 0x14000f570
mov ecx, 4
or eax, ecx
mov dword [rsp + 0xb0], eax
cmp eax, ebx
je 0x14000f5a3
cmp byte [rsp + 0x80], bl
je 0x14000f58b
mov ecx, 0x20
or eax, ecx
mov dword [rsp + 0xb0], eax
cmp eax, ebx
je 0x14000f5a3
cmp byte [rsp + 0xc4], bl
je 0x14000f5a3
bts eax, 0xa
mov dword [rsp + 0xb0], eax
mov rax, qword [rsp + 0x230]
cmp eax, ebx
je 0x14000f5ee
lea r8, [rsp + 0x5e0]
lea rcx, [rsp + 0x3b8]
mov edx, eax
mov dword [r8], 0x70
call fcn.140005eb8
mov r11, qword [rsp + 0x3c0]
mov r8, qword [rsp + 0xe08]
neg r11
sbb eax, eax
and eax, 0x80000
mov dword [rsp + 0xd0], eax
cmp dword [rsp + 0x150], 0x4b0
movzx eax, byte [rsp + 0x70]
mov rdx, qword [rsp + 0x430]
mov edi, 2
cmove eax, edi
mov dword [rsp + 0x440], eax
cmp rdx, rbx
je 0x14000f667
mov r8, rdx
mov qword [rsp + 0xe08], rdx
cmp byte [rsp + 0xc0], bl
jne 0x14000f667
cmp qword [rsp + 0x368], rbx
jne 0x14000f667
mov rcx, qword [rsp + 0xe00]
lea eax, [rdi - 1]
lea r8, [rsp + 0x1d8]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14007059c
mov r8, qword [rsp + 0x1d8]
mov qword [rsp + 0xe08], r8
mov rsi, qword [rsp + 0xe8]
mov qword [rsp + 0x3f8], rbx
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], rbx
cmp rsi, rbx
je 0x14000f696
cmp word [rsi], bx
je 0x14000f696
cmp bp, bx
je 0x14000f6a2
mov bpl, bl
mov dword [rsp + 0x140], ebp
jmp 0x14000f6a9
mov ebp, dword [rsp + 0x140]
lea rax, [0x1400fbd88]
mov r11w, bx
mov r10w, bx
mov r9w, bx
mov qword [rsp + 0x388], rax
mov dword [rsp + 0xf0], r11d
mov dword [rsp + 0xb8], r10d
mov dword [rsp + 0x98], r9d
cmp rsi, rbx
je 0x14000f808
mov eax, 0x2a
lea edx, [rax - 0x29]
cmp word [rsi], ax
jne 0x14000f70e
add rsi, rdi
add r11w, dx
cmp word [rsi], ax
je 0x14000f6f2
mov qword [rsp + 0xe8], rsi
mov dword [rsp + 0xf0], r11d
mov eax, 0x3f
cmp word [rsi], ax
jne 0x14000f75e
add rsi, rdi
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0x388], rsi
movzx eax, word [rsi]
cmp ax, bx
je 0x14000f75e
mov ecx, 0x3a
add rsi, rdi
mov qword [rsp + 0xe8], rsi
cmp cx, ax
je 0x14000f752
mov ax, word [rsi]
cmp ax, bx
jne 0x14000f738
jmp 0x14000f75e
mov word [rsi - 2], bx
mov r8, qword [rsp + 0xe08]
movzx ecx, word [rsi]
mov eax, 0x63
or cx, 0x20
cmp cx, ax
jne 0x14000fa7c
movzx eax, word [rsi + 2]
or ax, word [rsp + 0x78]
cmp ax, word [rsp + 0x1b0]
jne 0x14000fa7c
movzx eax, word [rsi + 4]
or ax, word [rsp + 0x78]
cmp ax, 0x62
jne 0x14000fa7c
mov eax, 0x3a
cmp word [rsi + 6], ax
jne 0x14000fa7c
add rsi, 8
mov r10d, edx
mov dword [rsp + 0xb8], edx
mov qword [rsp + 0xe8], rsi
mov ecx, 0x20
cmp rsi, rbx
je 0x14000f808
movzx eax, word [rsi]
or ax, cx
cmp ax, 0x75
jne 0x14000f808
movzx eax, word [rsi + 2]
or ax, cx
mov ecx, 0x64
cmp ax, cx
jne 0x14000f808
lea eax, [rcx - 0x2a]
cmp word [rsi + 4], ax
jne 0x14000f808
add rsi, 6
mov r9d, edx
mov dword [rsp + 0x98], edx
mov qword [rsp + 0xe8], rsi
cmp bpl, bl
je 0x14000f86e
cmp rsi, rbx
je 0x14000f86e
cmp r10w, bx
jne 0x14000f86e
cmp r9w, bx
jne 0x14000f86e
cmp byte [rsp + 0x75], bl
movzx eax, word [rsi]
mov edx, ebx
setne dl
mov rcx, rsi
cmp ax, bx
je 0x14000f86e
mov r11d, 1
cmp word [rsp + 0x1d0], ax
jne 0x14000f854
add edx, r11d
cmp edx, edi
jl 0x14000f854
cmp word [rcx + 2], bx
movzx ebp, bpl
cmovne ebp, ebx
add rcx, rdi
mov ax, word [rcx]
cmp ax, bx
jne 0x14000f838
mov r11d, dword [rsp + 0xf0]
mov dword [rsp + 0x140], ebp
cmp r11w, bx
jne 0x14000f880
cmp r10w, bx
jne 0x14000f880
cmp r9w, bx
je 0x14000f884
mov byte [rsp + 0x75], bl
cmp bpl, bl
je 0x14000f8d4
cmp r9w, bx
mov ecx, ebx
mov eax, ebx
sete cl
cmp r10w, bx
sete al
test eax, ecx
je 0x14000f8d4
mov edx, 0x2a
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, rbx
je 0x14000f8b5
mov word [rax], bx
lea rdx, [rsp + 0x3f8]
mov rcx, rsi
call fcn.14001c124
mov r8, qword [rsp + 0xe08]
mov dword [rsp + 0xf0], ebx
mov rax, qword [rsp + 0x468]
mov r11d, 1
mov ecx, ebx
mov dword [rax], r11d
xor eax, eax
cmp qword [rsp + 0x280], rbx
setne cl
mov qword [rsp + 0x4a0], rax
mov qword [rsp + 0x510], rax
mov qword [rsp + 0x518], rax
mov qword [rsp + 0x520], rax
mov al, byte [rsp + 0x178]
mov qword [rsp + 0x168], rbx
mov dword [rsp + 0x7c], ebx
mov dword [rsp + 0x104], ebx
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x310], rbx
mov rsi, rbx
mov qword [rsp + 0x158], rbx
mov rdi, rbx
mov qword [rsp + 0x1e0], rbx
mov rbp, rbx
mov qword [rsp + 0x238], rbx
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x498], rbx
mov qword [rsp + 0x508], rbx
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x4e8], 0x18
mov qword [rsp + 0x4f0], rbx
mov dword [rsp + 0x4f8], r11d
mov qword [rsp + 0x1e8], rbx
cmp al, bl
je 0x14000f9e5
mov rax, qword [0x1401172d8]
lea rcx, [rsp + 0x5e0]
mov dword [rsp + 0x78], r11d
bts dword [rcx + 0x3c], 8
mov qword [rcx + 0x58], rax
mov rax, qword [0x1401172e0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1401172d0]
mov qword [rcx + 0x50], rax
mov eax, 0x26
cmp byte [rsp + 0xc0], bl
je 0x140010343
lea ecx, [rax + 0x56]
mov qword [rsp + 0x2a0], rbx
lea eax, [rcx - 0x7a]
cmp cx, word [r8]
jne 0x14000fa45
lea ebp, [rcx - 0x5c]
lea esi, [rcx - 0x73]
lea edi, [rcx - 0x6f]
add r8, rax
mov qword [rsp + 0xe08], r8
cmp cx, word [r8]
je 0x14000fa14
cmp si, word [r8]
ja 0x14000fa31
cmp word [r8], di
jbe 0x14000fa14
cmp bp, word [r8]
je 0x14000fa14
mov rsi, qword [rsp + 0x158]
mov rdi, rbx
mov rbp, rbx
mov qword [rsp + 0x230], r8
mov qword [rsp + 0xa8], rbx
mov r10, rbx
cmp word [r8], bx
je 0x14000fbd0
cmp cx, word [r8]
jne 0x14000fad8
cmp cx, word [r8 + 2]
je 0x14000facf
mov r10, r8
mov qword [rsp + 0xa8], r8
jmp 0x14000fad8
mov eax, 0x65
cmp cx, ax
jne 0x14000f7c2
movzx eax, word [rsi + 2]
mov ecx, 0x20
or ax, cx
cmp ax, 0x78
jne 0x14000f7c7
lea eax, [rcx + 0x1a]
cmp word [rsi + 4], ax
jne 0x14000f7c7
mov eax, pe_nt_image_headers64
add rsi, 6
mov r10w, ax
mov qword [rsp + 0xe8], rsi
mov dword [rsp + 0xb8], r10d
jmp 0x14000f7c7
add r8, rax
cmp cx, word [r8]
je 0x14000facf
add r8, rax
cmp word [r8], bx
jne 0x14000fa62
cmp r10, rbx
je 0x14000fbd0
mov word [r10], bx
add qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa8]
call fcn.140053eb0
mov rax, qword [rsp + 0xa8]
movzx ecx, word [rax]
mov qword [rsp + 0x260], rax
cmp cx, bx
je 0x14000fba0
mov edx, 0x7c
cmp dx, cx
jne 0x14000fb76
lea rcx, [rax + 2]
mov qword [rsp + 0x328], rcx
cmp dx, word [rcx]
jne 0x14000fb76
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0x328]
mov rcx, qword [rsp + 0x260]
movsxd r8, eax
add r8, r8
call fcn.14001b6a0
mov rax, qword [rsp + 0x260]
mov edx, 0x7c
jmp 0x14000fb71
add rax, 2
cmp dx, word [rax]
je 0x14000fb6d
add rax, 2
mov qword [rsp + 0x260], rax
mov cx, word [rax]
cmp cx, bx
jne 0x14000fb24
mov r10, qword [rsp + 0xa8]
mov qword [rsp + 0x278], r10
cmp word [r10], bx
jne 0x14000fbb5
mov r8, qword [rsp + 0xe08]
mov eax, 2
lea ecx, [rax + 0x7a]
jmp 0x14000fa4d
mov rdx, qword [rsp + 0x230]
mov r11d, 1
mov al, r11b
cmp word [rdx], bx
je 0x14000fbda
mov cl, r11b
jmp 0x14000fbf2
mov rdx, qword [rsp + 0x230]
mov al, bl
cmp al, bl
mov cl, bl
cmove r10, rdx
mov qword [rsp + 0x278], r10
mov qword [rsp + 0xa8], r10
cmp cl, bl
je 0x14000fd65
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x558]
lea rdx, [rsp + 0xf8]
mov qword [rsp + 0x3a8], rax
mov eax, 1
lea rcx, [rsp + 0xc8]
xor r9d, r9d
mov dword [rsp + 0x558], 0x18
mov qword [rsp + 0x560], rbx
mov dword [rsp + 0x568], eax
call qword [sym.imp.KERNEL32.dll_CreatePipe]
cmp eax, ebx
jne 0x14000fc63
mov rcx, qword [rsp + 0xe00]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call fcn.14001d7e0
mov rax, qword [rsp + 0x3a8]
mov rdx, qword [rsp + 0xc8]
mov dword [rsp + 0x30], 3
lea r9, [rsp + 0xc8]
mov r8, rax
mov rcx, rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rax, qword [rsp + 0xf8]
mov word [rsp + 0x178], bx
cmp rax, rbx
je 0x14000fcf5
mov rdx, qword [rsp + 0x230]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xe00]
lea r9, [rsp + 0x178]
mov qword [rsp + 0x28], rbx
mov r8, rax
mov rcx, rax
mov dword [rsp + 0x20], ebx
call fcn.14000d060
mov rcx, qword [rsp + 0xf8]
cmp rcx, rbx
je 0x14000fcf5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0xc8]
mov eax, 1
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x3a8]
lea r9, [rsp + 0xc8]
mov r8, rax
mov rcx, rax
mov qword [rsp + 0xf8], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r11, qword [rsp + 0xc8]
mov r10, qword [rsp + 0x278]
cmp r11, rbx
je 0x14000fd65
mov eax, 1
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x5e0]
bts dword [rax + 0x3c], 8
mov qword [rax + 0x50], r11
mov r8, r10
mov qword [rsp + 0xa8], r10
mov r9d, 0x3e
lea edx, [r9 - 2]
movzx eax, word [r8]
cmp ax, bx
je 0x1400102b6
mov ecx, 2
cmp ax, dx
je 0x14000fdab
cmp ax, r9w
je 0x14000fdab
add r8, rcx
mov qword [rsp + 0xa8], r8
mov ax, word [r8]
cmp ax, bx
jne 0x14000fd8c
cmp word [r8], bx
je 0x1400102b6
cmp dx, word [r8]
jne 0x14000ff7b
mov word [r8], bx
add qword [rsp + 0xa8], rcx
lea rcx, [rsp + 0xa8]
call fcn.140053eb0
mov r8, qword [rsp + 0xa8]
cmp word [r8], bx
je 0x14000ff71
mov rdx, r8
mov qword [rsp + 0x3b0], rdx
movzx eax, word [r8]
cmp ax, bx
je 0x14000fe2f
mov ecx, 0x3e
lea r9d, [rcx - 2]
cmp ax, r9w
je 0x14000fe27
cmp ax, cx
je 0x14000fe27
add r8, 2
mov qword [rsp + 0xa8], r8
mov ax, word [r8]
cmp ax, bx
jne 0x14000fe07
mov rdi, qword [rsp + 0x1e0]
sub r8, rdx
lea rcx, [rsp + 0x448]
sar r8, 1
call fcn.14006690c
lea rcx, [rsp + 0x2c8]
call fcn.14005bc74
mov rdx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0xe00]
mov eax, 1
lea r8, [rsp + 0x2c8]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14007059c
mov rcx, qword [rsp + 0x2c8]
mov qword [rsp + 0x3b0], rcx
call fcn.140017068
lea rcx, [rsp + 0x3b0]
call fcn.140053eb0
cmp rsi, rbx
je 0x14000fea8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x3b0]
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x4e8]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x158]
mov r9d, 7
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x20], rax
call fcn.1400037b4
mov rsi, qword [rsp + 0x158]
cmp rsi, rbx
jne 0x14000ff4f
mov rdx, qword [rsp + 0x3b0]
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x4e8]
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0x158]
mov r9d, 7
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rax
call fcn.1400037b4
mov rsi, qword [rsp + 0x158]
mov qword [rsp + 0x158], rsi
lea rcx, [rsp + 0x2c8]
call fcn.140053e80
lea rcx, [rsp + 0x448]
call fcn.140053e80
mov r8, qword [rsp + 0xa8]
mov r9d, 0x3e
lea edx, [r9 - 2]
cmp r9w, word [r8]
jne 0x14000fd7a
mov word [r8], bx
mov rax, qword [rsp + 0xa8]
mov r8d, 1
lea ecx, [r8 + 0x31]
mov dword [rsp + 0x1b0], ebx
mov byte [rsp + 0x70], r8b
lea edx, [rcx - 0x30]
cmp cx, word [rax - 2]
jne 0x14000ffc0
mov word [rax - 2], bx
mov rax, qword [rsp + 0xa8]
mov byte [rsp + 0x70], dl
add rax, rdx
mov qword [rsp + 0xa8], rax
cmp r9w, word [rax]
jne 0x14000ffe4
add rax, rdx
mov dword [rsp + 0x1b0], r8d
mov qword [rsp + 0xa8], rax
mov ecx, 0x26
cmp cx, word [rax]
jne 0x14000fffe
add rax, rdx
mov byte [rsp + 0x70], 3
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa8]
call fcn.140053eb0
mov r8, qword [rsp + 0xa8]
mov edx, 0x3c
lea r9d, [rdx + 2]
cmp word [r8], bx
je 0x14000fd7a
mov rdx, r8
mov qword [rsp + 0x308], rdx
movzx eax, word [r8]
cmp ax, bx
je 0x140010069
mov ecx, r9d
lea r9d, [rcx - 2]
cmp ax, r9w
je 0x140010061
cmp ax, cx
je 0x140010061
add r8, 2
mov qword [rsp + 0xa8], r8
mov ax, word [r8]
cmp ax, bx
jne 0x140010041
mov rbp, qword [rsp + 0x238]
sub r8, rdx
lea rcx, [rsp + 0x2b0]
sar r8, 1
call fcn.14006690c
lea rcx, [rsp + 0x3f0]
call fcn.14005bc74
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0xe00]
mov eax, 1
lea r8, [rsp + 0x3f0]
xor r9d, r9d
mov byte [rsp + 0x20], al
call fcn.14007059c
mov rcx, qword [rsp + 0x3f0]
mov qword [rsp + 0x308], rcx
call fcn.140017068
lea rcx, [rsp + 0x308]
call fcn.140053eb0
mov al, byte [rsp + 0x70]
mov r9d, 1
test r9b, al
je 0x140010100
cmp rdi, rbx
je 0x1400100f5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [rsp + 0x70]
mov rdi, rbx
mov qword [rsp + 0x1e0], rbx
test al, 2
je 0x140010125
cmp rbp, rbx
je 0x140010112
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, rbx
mov qword [rsp + 0x238], rbx
mov qword [rsp + 0x2a0], rbx
mov rdx, qword [rsp + 0x308]
mov qword [rsp + 0x38], rbx
mov eax, 4
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x4e8]
lea rcx, [rsp + 0x458]
mov r9d, 7
mov r8d, 0x40000000
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x458], rbx
call fcn.1400037b4
mov qword [rsp + 0x220], rax
cmp rax, rbx
jne 0x14001022f
mov rdx, qword [rsp + 0x308]
mov qword [rsp + 0x38], rbx
mov eax, 4
mov dword [rsp + 0x30], 0x2000000
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x4e8]
lea rcx, [rsp + 0x300]
mov r9d, 7
mov r8d, 0x40000000
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x300], rbx
call fcn.1400037b4
mov qword [rsp + 0x220], rax
cmp rax, rbx
jne 0x14001022f
mov rdx, qword [rsp + 0x308]
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x4e8]
mov dword [rsp + 0x30], 0x2000000
lea rcx, [rsp + 0xe0]
mov r9d, 7
mov r8d, 0x40000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0x20], rax
call fcn.1400037b4
mov qword [rsp + 0x220], rax
cmp rax, rbx
je 0x14001028f
cmp dword [rsp + 0x1b0], ebx
je 0x14001024c
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov al, byte [rsp + 0x70]
mov ecx, 1
cmp al, cl
jne 0x140010263
mov rax, qword [rsp + 0x220]
jmp 0x140010277
cmp al, 3
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x2a0], rax
jne 0x140010284
mov rdi, rax
mov qword [rsp + 0x1e0], rax
jmp 0x14001028f
mov rbp, rax
mov qword [rsp + 0x238], rax
lea rcx, [rsp + 0x3f0]
call fcn.140053e80
lea rcx, [rsp + 0x2b0]
call fcn.140053e80
mov r8, qword [rsp + 0xa8]
jmp 0x14000fd70
mov r11d, 1
lea rcx, [rsp + 0x5e0]
cmp rsi, rbx
je 0x1400102d7
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x78], r11d
mov qword [rcx + 0x50], rsi
cmp rdi, rbx
je 0x1400102ea
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x78], r11d
mov qword [rcx + 0x58], rdi
mov rax, qword [rsp + 0x2a0]
cmp rax, rbx
je 0x140010305
bts dword [rcx + 0x3c], 8
mov dword [rsp + 0x78], r11d
mov qword [rcx + 0x60], rax
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x1e8]
xor r9d, r9d
mov byte [rsp + 0x20], r11b
call fcn.14007059c
mov r8, qword [rsp + 0x1e8]
mov eax, 0x26
mov qword [rsp + 0xe08], r8
lea r11d, [rax - 0x25]
mov edi, dword [rsp + 0xb4]
mov sil, bl
mov ebp, 0x24
cmp word [r8], 0x21
je 0x1400103a8
mov ecx, 0x2a
cmp word [r8], cx
je 0x1400103a8
mov ecx, 0x40
cmp word [r8], cx
jne 0x1400103c0
lea rdx, str.WinSta0WinLogon
lea rcx, [rsp + 0x3d0]
call fcn.140066a00
mov r11, qword [rsp + 0x3d0]
mov r8, qword [rsp + 0xe08]
lea rax, [rsp + 0x5e0]
mov qword [rax + 0x10], r11
mov r11d, 1
add sil, r11b
mov edi, 0x10000000
add r8, 2
mov eax, 0x26
mov qword [rsp + 0xe08], r8
jmp 0x140010352
mov ecx, 0x3d
cmp word [r8], cx
jne 0x1400103dd
or dword [rsp + 0x84], r11d
add dword [rsp + 0x1f0], r11d
jmp 0x1400103ad
cmp word [r8], bp
jne 0x1400103ea
mov byte [rsp + 0x74], r11b
jmp 0x1400103ad
cmp word [r8], ax
jne 0x1400103f7
mov edi, 3
jmp 0x1400103ad
mov eax, 0x5e
cmp word [r8], ax
je 0x140010409
cmp word [r8], 0x5f
jne 0x140010410
mov edi, 6
jmp 0x1400103ad
mov rbp, qword [rsp + 0x238]
mov dword [rsp + 0xb4], edi
mov dword [rsp + 0xb4], edi
mov dword [rsp + 0xb4], edi
mov dword [rsp + 0xb4], edi
mov byte [rsp + 0x73], sil
mov rsi, qword [rsp + 0x158]
mov dword [rsp + 0xb4], edi
cmp edi, 0x10000000
mov rdi, qword [rsp + 0x1e0]
je 0x140010493
mov ecx, dword [rsp + 0xa4]
cmp cl, bl
je 0x140010493
lea rdx, str.WinSta0Default
lea rcx, [rsp + 0x3d0]
call fcn.140066a00
mov r11, qword [rsp + 0x3d0]
mov r8, qword [rsp + 0xe08]
lea rax, [rsp + 0x5e0]
mov qword [rax + 0x10], r11
lea r11, [rsp + 0x5e0]
mov edx, 1
cmp qword [r11 + 0x10], rbx
je 0x1400104ce
test byte [rsp + 0x73], dl
je 0x1400104ce
call fcn.14000ceb0
mov r8, qword [rsp + 0xe08]
mov edx, 1
cmp eax, edx
lea r11, [rsp + 0x5e0]
jge 0x1400104ce
mov qword [r11 + 0x10], rbx
mov rax, qword [rsp + 0xe30]
cmp rax, rbx
je 0x1400104f8
bts dword [r11 + 0x3c], 8
mov ecx, ebx
mov dword [rsp + 0x84], ebx
mov byte [rsp + 0x71], bl
mov dword [rsp + 0x78], edx
mov qword [r11 + 0x58], rax
jmp 0x1400104ff
mov ecx, dword [rsp + 0x84]
mov eax, dword [rsp + 0xb0]
cmp eax, ebx
je 0x140010518
cmp ecx, ebx
je 0x140010518
or eax, 0x10
mov dword [rsp + 0xb0], eax
cmp byte [rsp + 0x74], bl
je 0x140010547
mov rax, qword [rsp + 0x1b8]
cmp word [rax], bx
jne 0x140010547
lea rdx, str.open
lea rcx, [rsp + 0x1b8]
call fcn.140066968
mov r8, qword [rsp + 0xe08]
mov cl, byte [rsp + 0x118]
cmp cl, bl
je 0x140010751
mov edx, 0x5c
mov rcx, r8
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rcx, qword [rsp + 0xe08]
mov r11, rax
add rax, 2
mov rbx, rcx
test r11, r11
cmovne rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
neg dword [rsp + 0x84]
movsxd rcx, eax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 1
lea eax, [rcx + rcx]
sbb rcx, rcx
mov r8, rbx
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xe08]
neg rcx
add rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call fcn.1400551f0
cdqe
mov qword [rsp + 0xe0], rax
lea rcx, [rsp + 0x1e8]
call fcn.140053e80
xor ebx, ebx
mov rcx, qword [rsp + 0xf8]
cmp rcx, rbx
je 0x1400105f5
cmp rcx, 0xffffffffffffffff
je 0x1400105f5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0xf8], rbx
cmp rcx, rbx
je 0x140010616
cmp rcx, 0xffffffffffffffff
je 0x140010616
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc8], rbx
cmp rbp, rbx
je 0x140010632
cmp rbp, 0xffffffffffffffff
je 0x140010632
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rbx
je 0x140010646
cmp rdi, 0xffffffffffffffff
je 0x140010646
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rbx
je 0x14001065a
cmp rsi, 0xffffffffffffffff
je 0x14001065a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x168]
call fcn.140053e80
lea rcx, [rsp + 0x3f8]
call fcn.140053e80
lea rcx, [rsp + 0x1d8]
call fcn.140053e80
lea rcx, [rsp + 0x148]
call fcn.140053e80
lea rcx, [rsp + 0x1f8]
call fcn.140053e80
lea rcx, [rsp + 0x1b8]
call fcn.140053e80
lea rcx, [rsp + 0x208]
call fcn.140053e80
lea rcx, [rsp + 0x218]
call fcn.140053e80
lea rcx, [rsp + 0x170]
call fcn.140053e80
lea rcx, [rsp + 0x3b8]
call fcn.140005fd0
lea rcx, [rsp + 0x1a8]
call fcn.140053e80
lea rcx, [rsp + 0x110]
call fcn.140053e80
lea rcx, [rsp + 0x130]
call fcn.140053e80
lea rcx, [rsp + 0x108]
call fcn.140053e80
lea rcx, [rsp + 0x188]
call fcn.140053e80
lea rcx, [rsp + 0x160]
call fcn.140053e80
lea rcx, [rsp + 0x180]
call fcn.140053e80
lea rcx, [rsp + 0x190]
call fcn.140053e80
mov rbx, qword [rsp + 0xe0]
jmp 0x140014d16
lea rcx, [rsp + 0xe08]
call fcn.140053eb0
xor ecx, ecx
mov qword [rsp + 0x2b8], rbx
mov qword [rsp + 0x200], rcx
cmp qword [rsp + 0x280], rcx
je 0x14001089b
lea rcx, [rsp + 0x398]
mov byte [rsp + 0x74], bl
call fcn.14005bc74
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0xe00]
or r9d, 0xffffffff
xor r8d, r8d
call fcn.14001c574
mov rdx, rax
cmp rax, rbx
je 0x140010972
mov rax, qword [rax]
cmp word [rax], bx
je 0x140010972
lea rcx, [rsp + 0x398]
call fcn.1400669b4
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x200]
call fcn.140066a00
mov r11, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x398]
lea r9, [rsp + 0x2b8]
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x200]
mov qword [rsp + 0x20], r11
call fcn.140008c9c
lea rcx, [rsp + 0x398]
movsxd r11, eax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0xe08], rax
cmp r11d, ebx
je 0x14001088c
mov qword [rsp + 0xe0], r11
call fcn.140053e80
lea rcx, [rsp + 0x200]
call fcn.140053e80
mov rcx, qword [rsp + 0x2b8]
cmp rcx, rbx
je 0x14001087a
cmp rcx, 0xffffffffffffffff
je 0x14001087a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140053e80
jmp 0x1400105dc
call fcn.140053e80
mov rbx, qword [rsp + 0x2b8]
xor ecx, ecx
mov rax, qword [rsp + 0x160]
cmp word [rax], cx
je 0x140010b0d
mov rcx, qword [rsp + 0xe08]
call fcn.140019c78
lea rdx, str.__k:0
lea rcx, [rsp + 0x378]
or r8, 0xffffffffffffffff
mov qword [rsp + 0xe08], rax
call fcn.140066928
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x378]
call fcn.14005bdb0
lea rdx, [0x1400fc664]
lea rcx, [rsp + 0x378]
call fcn.14005bdb0
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x378]
call fcn.14005bdb0
mov rdx, qword [rsp + 0x378]
mov rcx, qword [rsp + 0xe00]
xor r8d, r8d
call fcn.14008d110
lea rcx, [rsp + 0x378]
mov qword [rsp + 0xe0], rax
call fcn.140053e80
lea rcx, [rsp + 0x200]
call fcn.140053e80
test rbx, rbx
je 0x1400105cd
cmp rbx, 0xffffffffffffffff
je 0x1400105cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400105cd
lea rcx, [rsp + 0x398]
call fcn.140053e80
lea rcx, [rsp + 0x200]
call fcn.140053e80
lea rcx, [rsp + 0x1e8]
call fcn.140053e80
mov rcx, qword [rsp + 0xf8]
cmp rcx, rbx
je 0x1400109b2
cmp rcx, 0xffffffffffffffff
je 0x1400109b2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0xf8], rbx
cmp rcx, rbx
je 0x1400109d3
cmp rcx, 0xffffffffffffffff
je 0x1400109d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc8], rbx
cmp rbp, rbx
je 0x1400109ef
cmp rbp, 0xffffffffffffffff
je 0x1400109ef
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rbx
je 0x140010a03
cmp rdi, 0xffffffffffffffff
je 0x140010a03
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rbx
je 0x140010a17
cmp rsi, 0xffffffffffffffff
je 0x140010a17
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x168]
call fcn.140053e80
lea rcx, [rsp + 0x3f8]
call fcn.140053e80
lea rcx, [rsp + 0x1d8]
call fcn.140053e80
lea rcx, [rsp + 0x148]
call fcn.140053e80
lea rcx, [rsp + 0x1f8]
call fcn.140053e80
lea rcx, [rsp + 0x1b8]
call fcn.140053e80
lea rcx, [rsp + 0x208]
call fcn.140053e80
lea rcx, [rsp + 0x218]
call fcn.140053e80
lea rcx, [rsp + 0x170]
call fcn.140053e80
lea rcx, [rsp + 0x3b8]
call fcn.140005fd0
lea rcx, [rsp + 0x1a8]
call fcn.140053e80
lea rcx, [rsp + 0x110]
call fcn.140053e80
lea rcx, [rsp + 0x130]
call fcn.140053e80
lea rcx, [rsp + 0x108]
call fcn.140053e80
lea rcx, [rsp + 0x188]
call fcn.140053e80
lea rcx, [rsp + 0x160]
call fcn.140053e80
lea rcx, [rsp + 0x180]
call fcn.140053e80
lea rcx, [rsp + 0x190]
call fcn.140053e80
mov rbx, 0xffffffff80070057
jmp 0x140014d16
mov al, byte [rsp + 0x90]
cmp al, cl
je 0x140011073
lea rcx, [rsp + 0xe8]
call fcn.14005bc74
mov rcx, qword [rsp + 0xe08]
and dword [rsp + 0x140], 0
call fcn.140019c78
lea rcx, [rsp + 0x128]
mov qword [rsp + 0xe08], rax
call fcn.14005bc74
mov rcx, qword [rsp + 0xe08]
and qword [rsp + 0x270], 0
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x128]
call fcn.1400c8c48
mov r11, qword [rsp + 0x270]
xor eax, eax
cmp r11, rax
jne 0x140010bd7
lea rcx, [rsp + 0x128]
call fcn.140053e80
lea rcx, [rsp + 0xe8]
call fcn.140053e80
lea rcx, [rsp + 0x200]
call fcn.140053e80
test rbx, rbx
je 0x140010bc3
cmp rbx, 0xffffffffffffffff
je 0x140010bc3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140053e80
xor ebx, ebx
jmp 0x140010999
mov word [r11 - 2], ax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x410]
mov qword [rsp + 0x260], rax
call fcn.1400668e8
mov rax, qword [rsp + 0x410]
mov rdx, qword [rsp + 0x270]
lea rcx, [rsp + 0x3e8]
mov qword [rsp + 0xe0], rax
call fcn.1400668e8
mov r11, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0xe0]
lea r9, [rsp + 0xe8]
lea r8, [rsp + 0x140]
mov qword [rsp + 0x20], r11
call fcn.1400085ac
xor eax, eax
cmp dword [rsp + 0x140], eax
jle 0x140010d02
mov rcx, qword [rsp + 0xe00]
cmp qword [rcx + 0x40], rax
jne 0x140010c7c
xor edx, edx
call fcn.140019204
xor eax, eax
mov r9, qword [rsp + 0xe00]
mov rcx, rax
mov qword [rsp + 0x2c8], rax
mov rdx, qword [r9 + 0x40]
cmp rdx, rax
je 0x140010ca4
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x2c8], rcx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [rsp + 0x2c8]
mov r9d, dword [rsp + 0x324]
mov r8d, dword [rsp + 0x320]
xor eax, eax
mov edx, 0x128
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x260]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rcx, qword [rsp + 0x2c8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x24c], eax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.USER32.dll_DestroyMenu]
mov r11d, dword [rsp + 0x24c]
xor eax, eax
add r11d, 0xffffff00
cmp r11d, eax
jl 0x140010ea2
cmp r11d, dword [rsp + 0x140]
jge 0x140010ea2
cmp r11d, eax
mov rcx, qword [rsp + 0xe8]
jle 0x140010d9f
mov r8d, r11d
lea esi, [rax + 2]
lea r9d, [rax + 1]
lea r11d, [rax + 0xa]
mov r10d, 0xd
movzx edx, word [rcx]
cmp dx, ax
je 0x140010d72
cmp dx, r10w
je 0x140010d72
cmp dx, r11w
je 0x140010d72
add rcx, rsi
jmp 0x140010d59
cmp word [rcx], r11w
je 0x140010d7e
cmp word [rcx], r10w
jne 0x140010d81
add rcx, rsi
cmp word [rcx], r11w
je 0x140010d8d
cmp word [rcx], r10w
jne 0x140010d90
add rcx, rsi
sub r8, r9
jne 0x140010d53
mov rsi, qword [rsp + 0x158]
jmp 0x140010da5
mov r11d, 0xa
movzx edx, word [rcx]
mov r8, rcx
mov qword [rsp + 0xe0], rcx
cmp dx, ax
je 0x140010dde
mov r9d, 0xd
cmp dx, r9w
je 0x140010dd6
cmp dx, r11w
je 0x140010dd6
add rcx, 2
mov dx, word [rcx]
cmp dx, ax
jne 0x140010dbe
mov rdi, qword [rsp + 0x1e0]
mov word [rcx], ax
cmp word [r8], ax
je 0x140010ea2
lea rdx, str.__k:0
lea rcx, [rsp + 0x198]
or r8, 0xffffffffffffffff
call fcn.140066928
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x198]
call fcn.14005bdb0
lea rdx, [0x1400fc664]
lea rcx, [rsp + 0x198]
call fcn.14005bdb0
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x198]
call fcn.14005bdb0
mov rdx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0xe00]
xor r8d, r8d
call fcn.14008d110
lea rcx, [rsp + 0x198]
mov qword [rsp + 0xe0], rax
call fcn.140053e80
lea rcx, [rsp + 0x3e8]
call fcn.140053e80
lea rcx, [rsp + 0x410]
call fcn.140053e80
lea rcx, [rsp + 0x128]
call fcn.140053e80
lea rcx, [rsp + 0xe8]
jmp 0x14001093f
lea rcx, [rsp + 0x3e8]
call fcn.140053e80
lea rcx, [rsp + 0x410]
call fcn.140053e80
lea rcx, [rsp + 0x128]
call fcn.140053e80
lea rcx, [rsp + 0xe8]
call fcn.140053e80
lea rcx, [rsp + 0x200]
call fcn.140053e80
test rbx, rbx
je 0x140010ef7
cmp rbx, 0xffffffffffffffff
je 0x140010ef7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140053e80
mov rcx, qword [rsp + 0xf8]
xor ebx, ebx
cmp rcx, rbx
je 0x140010f1f
cmp rcx, 0xffffffffffffffff
je 0x140010f1f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0xf8], rbx
cmp rcx, rbx
je 0x140010f40
cmp rcx, 0xffffffffffffffff
je 0x140010f40
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc8], rbx
cmp rbp, rbx
je 0x140010f5c
cmp rbp, 0xffffffffffffffff
je 0x140010f5c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rbx
je 0x140010f70
cmp rdi, 0xffffffffffffffff
je 0x140010f70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rbx
je 0x140010f84
cmp rsi, 0xffffffffffffffff
je 0x140010f84
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x168]
call fcn.140053e80
lea rcx, [rsp + 0x3f8]
call fcn.140053e80
lea rcx, [rsp + 0x1d8]
call fcn.140053e80
lea rcx, [rsp + 0x148]
call fcn.140053e80
lea rcx, [rsp + 0x1f8]
call fcn.140053e80
lea rcx, [rsp + 0x1b8]
call fcn.140053e80
lea rcx, [rsp + 0x208]
call fcn.140053e80
lea rcx, [rsp + 0x218]
call fcn.140053e80
lea rcx, [rsp + 0x170]
call fcn.140053e80
lea rcx, [rsp + 0x3b8]
call fcn.140005fd0
lea rcx, [rsp + 0x1a8]
call fcn.140053e80
lea rcx, [rsp + 0x110]
call fcn.140053e80
lea rcx, [rsp + 0x130]
call fcn.140053e80
lea rcx, [rsp + 0x108]
call fcn.140053e80
lea rcx, [rsp + 0x188]
call fcn.140053e80
lea rcx, [rsp + 0x160]
call fcn.140053e80
lea rcx, [rsp + 0x180]
call fcn.140053e80
lea rcx, [rsp + 0x190]
call fcn.140053e80
jmp 0x140014d16
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x2f8]
call fcn.1400668e8
xor ebx, ebx
cmp byte [rsp + 0xc4], bl
je 0x140011131
lea rdx, str.PECMDpecmd_cmd
lea rcx, [rsp + 0x2f8]
call fcn.140066a00
lea r8d, [rbx + 1]
lea rcx, [rsp + 0xe08]
xor edx, edx
call fcn.140023518
lea rcx, [rsp + 0x2f8]
mov rdx, rax
mov qword [rsp + 0xe08], rax
call fcn.14005bdb0
lea rcx, [rsp + 0x170]
call fcn.140005e4c
mov qword [rsp + 0xe8], rax
mov r10d, 4
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0xe08], rax
mov eax, dword [rsp + 0xb4]
cmp eax, 0x10000000
je 0x14001111e
mov cl, byte [rsp + 0x122]
cmp cl, bl
je 0x1400115f4
lea r9, [rsp + 0x5e0]
bts dword [r9 + 0x3c], 7
jmp 0x1400115fc
mov al, byte [rsp + 0xc5]
cmp al, bl
je 0x1400110eb
mov edx, dword [rsp + 0xb4]
cmp edx, 0x10000000
je 0x1400110eb
mov rax, qword [rsp + 0x2f8]
lea rcx, [rsp + 0xe08]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x250], rbx
mov qword [rsp + 0xe08], rax
call fcn.140023518
lea rdx, [rsp + 0x250]
lea rcx, [0x1400fc660]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0xe08]
mov r8d, 3
mov qword [rsp + 0x250], rax
call fcn.14005e44c
cmp al, bl
jne 0x1400112bf
lea rdx, [rsp + 0x250]
lea rcx, str.cmd.exe
mov r8d, 7
call fcn.14005e44c
cmp al, bl
jne 0x1400112bf
mov rcx, qword [0x1401199c8]
cmp rcx, rbx
jne 0x140011240
xor r9d, r9d
lea rdx, [rsp + 0xbc0]
xor ecx, ecx
lea r8d, [r9 + 0x24]
mov word [rsp + 0xbc0], bx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rsp + 0xbc0]
lea rcx, [0x1401199c8]
call fcn.140066a00
lea rdx, str.System32cmd.exe
lea rcx, [0x1401199c8]
call fcn.14005bdb0
mov rcx, qword [0x1401199c8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x1401199c8]
mov word [0x140119964], ax
jmp 0x140011247
mov ax, word [0x140119964]
mov rdx, qword [rsp + 0x250]
movsx r8d, ax
mov dword [rsp + 0xa4], ebx
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
jne 0x140011394
mov rax, qword [rsp + 0x250]
movsx rcx, word [0x140119964]
lea rdx, [rax + rcx*2]
mov eax, 0x22
cmp ax, word [rdx]
je 0x1400112a8
mov eax, 9
cmp ax, word [rdx]
ja 0x14001129a
mov eax, 0xd
cmp word [rdx], ax
jbe 0x1400112a8
mov eax, 0x20
cmp ax, word [rdx]
jne 0x140011394
lea rcx, [rsp + 0x250]
mov qword [rsp + 0x250], rdx
call fcn.140006e80
jmp 0x1400112cd
mov eax, dword [rsp + 0xe20]
mov dword [rsp + 0xa4], eax
lea rdx, [rsp + 0x250]
lea rcx, [0x1400fc62c]
mov r8d, 2
call fcn.14005e44c
cmp al, bl
je 0x140011394
mov rax, qword [rsp + 0x250]
mov ecx, 0x22
cmp cx, word [rax]
jne 0x140011358
add rax, 2
lea rcx, [rsp + 0x3d8]
mov qword [rsp + 0x3d8], rax
call fcn.140053eb0
mov rax, qword [rsp + 0x3d8]
mov ecx, 0x22
cmp cx, word [rax]
je 0x140011350
lea r8d, [rcx - 0x1e]
lea rdx, [rsp + 0x3d8]
lea rcx, str.call
call fcn.14005e44c
cmp al, bl
je 0x14001138a
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x250], rax
lea rcx, [rsp + 0xe08]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xe08], rax
call fcn.140023518
mov dword [rsp + 0xa4], 1
mov r11, rax
mov qword [rsp + 0x1a0], rax
jmp 0x14001139c
mov rax, qword [rsp + 0x250]
jmp 0x140011358
mov r11, qword [rsp + 0x1a0]
mov rax, r11
mov r10d, 4
sub rax, qword [rsp + 0xe08]
sar rax, 1
cmp eax, r10d
jle 0x1400110f1
lea rdx, str..cmd
lea rcx, [r11 - 8]
mov r8d, r10d
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
je 0x1400113f8
mov rcx, qword [rsp + 0x1a0]
lea rdx, str..bat
mov r8d, 4
add rcx, 0xfffffffffffffff8
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, ebx
jne 0x1400110eb
mov rcx, qword [rsp + 0x1a0]
xor edx, edx
mov r8d, 0x191
movzx eax, word [rcx]
mov word [rcx], bx
lea rcx, [rsp + 0x950]
mov word [rsp + 0x90], ax
call fcn.1400df2a0
mov rdx, qword [rsp + 0xe08]
mov qword [rsp + 0x38], rbx
lea r11, [rsp + 0x950]
mov dword [rsp + 0x30], 0x80
lea rcx, [rsp + 0x240]
mov r9d, 7
mov r8d, 0xc0000000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x2b0], r11
mov byte [rsp + 0x178], bl
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x20], rbx
call fcn.1400037b4
mov qword [rsp + 0x20], rbx
mov rbx, qword [rsp + 0x240]
lea r9, [rsp + 0x298]
lea rdx, [rsp + 0x950]
mov r8d, 0x190
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, [rsp + 0x950]
lea rcx, str.::hidecmd::
mov r8d, 0xb
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
xor ecx, ecx
cmp eax, ecx
jne 0x14001152c
mov edx, 0x10000000
lea r9d, [rcx + 1]
lea r8d, [rcx + 0xd]
mov dword [rsp + 0xb4], edx
mov dl, byte [rsp + 0x950]
lea r10d, [rcx + 0xa]
cmp dl, cl
je 0x140011510
lea rax, [rsp + 0x950]
cmp dl, r8b
je 0x140011508
cmp dl, r10b
je 0x140011508
add rax, r9
mov dl, byte [rax]
cmp dl, cl
jne 0x1400114f5
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x2b0]
movsx edx, byte [rax]
cmp dx, r10w
je 0x140011527
cmp dx, r8w
jne 0x140011534
add rax, r9
jmp 0x140011518
lea rax, [rsp + 0x950]
cmp dword [rsp + 0xa4], ecx
jne 0x140011593
mov ecx, 0x3a
cmp byte [rax], cl
jne 0x14001154f
cmp byte [rax + 1], cl
jne 0x14001154f
add rax, 2
mov edx, 0x40
cmp byte [rax], dl
jne 0x140011562
lea ecx, [rdx - 0x3f]
add rax, rcx
cmp byte [rax], dl
je 0x14001155b
lea rcx, [0x1400fc5f0]
mov r8d, 7
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
mov edx, dword [rsp + 0x178]
xor ecx, ecx
cmp eax, ecx
lea eax, [rcx + 1]
movzx edx, dl
cmove edx, eax
mov dword [rsp + 0x178], edx
cmp rbx, rcx
je 0x1400115a7
cmp rbx, 0xffffffffffffffff
je 0x1400115a7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x1a0]
mov ax, word [rsp + 0x90]
xor ebx, ebx
mov word [r11], ax
cmp byte [rsp + 0x178], bl
je 0x1400110eb
mov rdx, qword [rsp + 0xe08]
mov rcx, qword [rsp + 0xe00]
call fcn.14003000c
lea rcx, [rsp + 0x2f8]
mov qword [rsp + 0xe0], rax
jmp 0x14001084f
lea r9, [rsp + 0x5e0]
mov r8d, 1
cmp eax, ebx
je 0x14001160f
or dword [r9 + 0x3c], r8d
mov word [r9 + 0x40], ax
mov cl, byte [rsp + 0x73]
mov edx, 3
mov al, cl
and al, dl
cmp al, dl
je 0x140011629
cmp byte [rsp + 0x81], bl
je 0x14001162f
bts dword [r9 + 0x3c], 0x1b
cmp qword [r9 + 0x10], rbx
je 0x14001163c
cmp cl, bl
mov ecx, r8d
jg 0x14001163e
mov ecx, ebx
mov eax, ebx
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0x1b0], ebx
cmp ecx, ebx
je 0x140011664
mov eax, r10d
mov dword [rsp + 0x1b0], r8d
mov dword [rsp + 0x90], eax
mov dl, byte [rsp + 0x120]
cmp dl, bl
je 0x140011679
or eax, 0x10
mov dword [rsp + 0x90], eax
xor eax, eax
mov byte [rsp + 0x70], bl
cmp cl, al
je 0x1400116b5
movzx ecx, word [0x14011af8c]
test r10b, cl
jne 0x1400116b5
or cx, r10w
mov bl, r8b
lea edx, [rax + 2]
mov word [0x14011af8c], cx
lea rcx, str.SeDebugPrivilege
xor r8d, r8d
mov byte [rsp + 0x70], bl
call fcn.14001a130
xor eax, eax
lea rcx, [0x140119fa0]
mov qword [rsp + 0x240], rcx
cmp byte [0x140119c40], al
jne 0x140011701
mov rcx, qword [rsp + 0xe10]
cmp rcx, rax
je 0x1400116de
cmp byte [rcx + 0xc], al
jne 0x140011701
mov dl, byte [rsp + 0x121]
mov byte [rsp + 0x81], al
cmp dl, al
je 0x140011709
cmp rcx, rax
je 0x140011709
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x240], rax
mov byte [rsp + 0x81], 1
lea rcx, [rsp + 0x3e0]
xor edx, edx
call fcn.1400668e8
xor edx, edx
mov qword [rsp + 0xa8], rdx
cmp byte [rsp + 0x81], dl
je 0x140011bcb
lea rcx, [0x14011af08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x740]
xor edx, edx
call fcn.14001c3bc
mov rax, qword [rsp + 0xe10]
test rax, rax
je 0x140011770
mov r8, qword [rsp + 0x240]
lea rcx, [rsp + 0x740]
mov rdx, rax
call fcn.140056ba8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0x4a8]
mov edx, 0x106
mov qword [rsp + 0x240], rax
call fcn.14005bce8
mov rcx, qword [rsp + 0x240]
mov r11, qword [rsp + 0x4a8]
xor eax, eax
cmp word [rcx], ax
je 0x1400118d3
mov rsi, r11
lea r10d, [rax + 2]
mov r9, rcx
mov qword [rsp + 0x448], rcx
add rcx, r10
movzx edx, word [rcx]
mov qword [rsp + 0x198], rcx
cmp dx, ax
je 0x1400117ef
mov r8d, 0x3d
cmp dx, r8w
je 0x1400117e7
add rcx, r10
mov dx, word [rcx]
cmp dx, ax
jne 0x1400117d6
mov qword [rsp + 0x198], rcx
mov rdx, rcx
sub rdx, r9
sar rdx, 1
mov qword [rsp + 0x300], rdx
cmp word [rcx], ax
je 0x1400118bb
lea r8, [rcx + 2]
mov qword [rsp + 0x458], r8
cmp word [r8], ax
je 0x1400118b6
cmp edx, 0x104
jg 0x1400118b6
movsxd rax, edx
mov rcx, rsi
mov rdx, r9
add rax, rax
mov r8, rax
mov qword [rsp + 0xe0], rax
call fcn.14001b6e8
mov rax, qword [rsp + 0xe0]
xor ebx, ebx
lea rcx, [rsp + 0x740]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rsi
mov word [rax + rsi], bx
mov qword [rsp + 0x20], rbx
call fcn.140016e70
cmp rax, rbx
jne 0x1400118a1
mov r9d, dword [rsp + 0x300]
mov r8, qword [rsp + 0x458]
mov rdx, qword [rsp + 0x448]
or qword [rsp + 0x20], 0xffffffffffffffff
lea rcx, [rsp + 0x740]
call fcn.14001c490
mov rcx, qword [rsp + 0x198]
mov r10d, 2
xor eax, eax
jmp 0x1400118b6
add rcx, r10
cmp word [rcx], ax
jne 0x1400118b3
add rcx, r10
cmp word [rcx], ax
jne 0x1400117b2
mov rsi, qword [rsp + 0x158]
mov bl, byte [rsp + 0x70]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
movsxd rdx, dword [rsp + 0x748]
xor eax, eax
cmp rdx, rax
mov dword [rsp + 0xa4], eax
mov rcx, rax
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x198], rdx
jle 0x140011a61
mov rsi, rdx
lea rax, [rcx + 1]
mov rbp, rcx
cmp rax, rsi
mov qword [rsp + 0x240], rax
mov rbx, rax
jge 0x1400119a6
mov rax, rcx
shl rax, 3
mov qword [rsp + 0xe0], rax
mov rdi, rax
mov rcx, qword [rsp + 0x740]
mov rax, qword [rdi + rcx]
mov rdx, qword [rax]
mov rax, qword [rcx + rbx*8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jns 0x140011964
mov rdi, rbx
mov rbp, rbx
shl rdi, 3
inc rbx
cmp rbx, rsi
jl 0x14001193a
cmp rbp, qword [rsp + 0x2b0]
je 0x14001199e
mov rcx, qword [rsp + 0x740]
mov r8, qword [rsp + 0xe0]
mov rax, qword [rcx + rbp*8]
mov rdx, qword [r8 + rcx]
mov qword [r8 + rcx], rax
mov rax, qword [rsp + 0x740]
mov qword [rax + rbp*8], rdx
mov rax, qword [rsp + 0x240]
cmp rax, rsi
mov rcx, rax
mov qword [rsp + 0x2b0], rax
jl 0x140011911
mov rdx, qword [rsp + 0x198]
mov rdi, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x238]
mov bl, byte [rsp + 0x70]
xor eax, eax
cmp rdx, rax
jle 0x140011a61
mov edi, dword [rsp + 0xa4]
mov rsi, rax
mov rbp, rdx
lea ebx, [rax + 1]
mov rax, qword [rsp + 0x740]
mov rcx, qword [rax + rsi*8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rdi + rax + 1]
mov dword [rsp + 0x1d0], eax
mov rax, qword [rsp + 0x740]
mov rcx, qword [rax + rsi*8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [rsp + 0x1d0]
add rsi, rbx
cmp rsi, rbp
lea edi, [rcx + rax + 3]
jl 0x1400119f5
mov rsi, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x238]
mov bl, byte [rsp + 0x70]
mov dword [rsp + 0xa4], edi
mov rdi, qword [rsp + 0x1e0]
mov eax, dword [rsp + 0xa4]
lea rcx, [rsp + 0x3e0]
add eax, 4
movsxd rdx, eax
call fcn.14005bd74
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0xa8], rax
mov rcx, rax
xor eax, eax
cmp qword [rsp + 0x198], rax
jle 0x140011b8c
mov rbp, qword [rsp + 0x198]
xor ebx, ebx
mov rsi, rcx
mov rdi, rax
mov rax, qword [rsp + 0x740]
mov rcx, qword [rax + rdi*8]
mov rax, qword [rcx]
mov rcx, rax
mov qword [rsp + 0xe0], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0xe0]
mov rcx, rsi
cdqe
add rax, rax
mov r8, rax
mov qword [rsp + 0x300], rax
call fcn.14001b6e8
add rsi, qword [rsp + 0x300]
mov eax, 0x3d
mov word [rsi], ax
mov rax, qword [rsp + 0x740]
add rsi, 2
mov rcx, qword [rax + rdi*8]
mov rax, qword [rcx + 8]
mov rcx, rax
mov qword [rsp + 0xe0], rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rsp + 0xe0]
mov rcx, rsi
cdqe
add rax, rax
mov r8, rax
mov qword [rsp + 0x300], rax
call fcn.14001b6e8
add rsi, qword [rsp + 0x300]
inc rdi
mov word [rsi], bx
add rsi, 2
cmp rdi, rbp
jl 0x140011aae
mov rdi, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x238]
mov bl, byte [rsp + 0x70]
mov qword [rsp + 0x270], rsi
mov rsi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x270]
xor eax, eax
mov word [rcx], ax
mov word [rcx + 2], ax
lea rcx, [rsp + 0x4a8]
call fcn.140053e80
lea rcx, [rsp + 0x740]
xor edx, edx
call fcn.1400486e4
lea rcx, [rsp + 0x7b0]
call fcn.140053e80
lea rcx, [0x14011af08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
mov rax, qword [rsp + 0x108]
mov ecx, 0x40
lea r8d, [rcx - 0x3f]
cmp cx, word [rax]
jne 0x140011be6
mov al, r8b
jmp 0x140011bf9
cmp qword [rsp + 0x228], rdx
movzx eax, dl
mov ecx, 2
cmovne eax, ecx
mov cl, byte [rsp + 0x71]
cmp cl, dl
je 0x140011d96
or dword [rsp + 0x84], r8d
or cl, 8
neg al
sbb eax, eax
mov byte [rsp + 0x71], cl
and eax, 0xfff01000
add eax, 0x100000
mov dword [rsp + 0x1d0], eax
call fcn.1400569a0
lea rdx, str..pipepecmd_exec__u
lea rcx, [rsp + 0x6c0]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfA]
and qword [rsp + 0x38], 0
mov eax, 1
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x1d0]
lea rcx, [rsp + 0x6c0]
mov dword [rsp + 0x28], eax
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 6
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsp + 0x290], rax
test rax, rax
je 0x140011cfa
cmp rax, 0xffffffffffffffff
je 0x140011cfa
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x2e8]
or r8, 0xffffffffffffffff
call fcn.140066928
xor ecx, ecx
mov r9d, 7
mov rdx, qword [rax]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x4e8]
mov dword [rsp + 0x28], 3
mov r8d, 0xc0000000
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x288]
call fcn.1400037b4
lea rcx, [rsp + 0x2e8]
call fcn.140053e80
jmp 0x140011d05
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x288]
lea rdx, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x78], 2
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov cl, byte [rsp + 0x72]
mov r8d, 1
lea r9, [rsp + 0x5e0]
xor edx, edx
mov dword [rsp + 0x104], r8d
bts dword [r9 + 0x3c], 8
mov qword [rsp + 0x520], rax
mov qword [rsp + 0x498], rax
mov dword [rsp + 0x78], r8d
test cl, 2
jne 0x140011d77
cmp cl, dl
jne 0x140011d85
mov rax, qword [rsp + 0x288]
mov qword [r9 + 0x58], rax
jmp 0x140011d8d
mov rax, qword [rsp + 0x288]
test r8b, cl
je 0x140011d96
mov qword [r9 + 0x60], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x1a0], rdx
mov qword [rsp + 0x1c8], rdx
neg rax
mov eax, dword [rsp + 0x11c]
mov qword [rsp + 0x220], rdx
sbb ecx, ecx
and ecx, 0x400
or ecx, eax
mov eax, dword [rsp + 0x90]
or eax, ecx
mov dword [rsp + 0x90], eax
cmp byte [rsp + 0xc3], dl
je 0x140011def
or eax, 0x1000004
mov dword [rsp + 0x90], eax
mov r10, qword [rsp + 0xe8]
cmp byte [rsp + 0x74], dl
je 0x140011e06
cmp r10, rdx
je 0x140013537
mov al, byte [rsp + 0xa0]
mov r8d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0x98]
cmp al, dl
je 0x140011f85
cmp r8w, dx
jne 0x140011f85
cmp cx, dx
jne 0x140011f85
mov r9, qword [rsp + 0xe08]
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x1a0]
mov r8, r10
call fcn.140005d2c
mov rcx, rax
mov rbx, rax
call fcn.140005e7c
xor esi, esi
cmp eax, esi
je 0x140011e72
mov ebp, 3
jmp 0x1400122eb
mov eax, dword [rsp + 0x100]
cmp eax, esi
je 0x140011f04
mov edx, dword [rsp + 0xd0]
mov qword [rsp + 0x68], rsi
movzx eax, ax
or edx, dword [rsp + 0x90]
or eax, 2
lea rcx, [0x1400fbe50]
mov qword [rsp + 0x60], rcx
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x338]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x5e0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov rdx, qword [rsp + 0xe08]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0xe8]
call fcn.140006f6c
jmp 0x140011f7a
xor ecx, ecx
call fcn.140005c10
mov edx, dword [rsp + 0xd0]
mov r8, qword [rsp + 0xe08]
or edx, dword [rsp + 0x90]
lea rcx, [rsp + 0x338]
xor r9d, r9d
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x5e0]
mov qword [rsp + 0x4b8], rax
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rcx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x30], edx
mov rdx, qword [rsp + 0xe8]
mov dword [rsp + 0x28], ecx
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebp, eax
mov dword [rsp + 0x7c], eax
jmp 0x1400136ad
mov rax, qword [rsp + 0x130]
cmp word [rax], dx
je 0x14001227c
cmp r8w, dx
jne 0x14001227c
cmp cx, dx
jne 0x14001227c
mov r11b, byte [rsp + 0xc2]
xor esi, esi
mov ebp, esi
mov dword [rsp + 0x7c], esi
cmp r11b, sil
je 0x1400120bd
mov rdx, qword [rsp + 0x110]
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x258]
mov r9, rdi
mov r8, rdi
mov qword [rsp + 0x258], rsi
call fcn.14005bbb0
lea rcx, [rsp + 0x390]
call fcn.14005b998
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x110]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400df2a0
mov rcx, qword [rsp + 0x258]
lea rdx, [rsp + 0x390]
call fcn.140062264
mov rdx, qword [rsp + 0x390]
lea rcx, [rsp + 0x110]
cmp rax, rsi
mov r9, rdi
mov r8, rdi
mov ebx, esi
setne bl
call fcn.14005be30
mov rcx, qword [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x258]
xor edx, edx
movsxd r8, eax
call fcn.1400df2a0
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rsp + 0x390]
xor edx, edx
movsxd r8, eax
call fcn.1400df2a0
lea rcx, [rsp + 0x390]
call fcn.140053e80
lea rcx, [rsp + 0x258]
call fcn.140053e80
cmp ebx, esi
je 0x140012231
mov rbx, qword [rsp + 0x130]
jmp 0x1400120c0
mov rbx, rax
mov edx, 0x40
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, rsi
jne 0x1400120ef
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, rsi
jne 0x1400120ef
lea rbp, [0x1400fbe50]
jmp 0x1400120fe
mov word [rax], si
mov rbp, qword [rsp + 0x130]
lea rbx, [rax + 2]
mov r9, qword [rsp + 0xe08]
mov r8, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x1a0]
call fcn.140005d2c
mov rcx, rax
mov rdi, rax
call fcn.140005e7c
cmp eax, esi
jne 0x140011e68
mov eax, dword [rsp + 0x100]
cmp eax, esi
je 0x1400121ba
mov edx, dword [rsp + 0xd0]
movzx ecx, ax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], ecx
mov rcx, qword [rsp + 0xe8]
or edx, 1
lea rax, [rsp + 0x338]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov rdx, qword [rsp + 0xe08]
mov dword [rsp + 0x20], esi
call fcn.140006f6c
jmp 0x14001222b
mov r9d, dword [rsp + 0xd0]
mov r8, qword [rsp + 0x110]
lea rax, [rsp + 0x338]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x5e0]
or r9d, 1
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x90]
mov rdx, rbp
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xe08]
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov dword [rsp + 0x7c], eax
mov ebp, eax
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x110]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400df2a0
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x130]
xor edx, edx
movsxd r8, eax
add r8, r8
call fcn.1400df2a0
jmp 0x1400136ad
cmp byte [rsp + 0x140], dl
je 0x14001237c
cmp r10, rdx
je 0x14001229d
mov eax, 0x26
cmp ax, word [r10]
je 0x14001237c
cmp word [rsp + 0xf0], dx
jne 0x14001237c
cmp r8w, dx
jne 0x14001237c
cmp cx, dx
jne 0x14001237c
mov rcx, qword [rsp + 0x128]
call fcn.140005e7c
xor esi, esi
cmp eax, esi
jne 0x140011e68
mov dword [rsp + 0x7c], esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsp + 0x468]
mov dword [rax], ebp
mov rcx, qword [rsp + 0x2b8]
cmp rcx, rsi
je 0x140012304
cmp rcx, 0xffffffffffffffff
je 0x140012304
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rsp + 0xf8]
mov rbx, rsi
mov qword [rsp + 0x2b8], rbx
cmp qword [rdi], rsi
je 0x140012325
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x208]
mov qword [rdi], rsi
mov rdi, qword [rsp + 0xe00]
cmp r8, rsi
je 0x140012350
lea rax, [rsp + 0x338]
mov rcx, rdi
mov edx, dword [rax + 0x10]
call fcn.14005ecb0
mov r8, qword [rsp + 0x218]
cmp r8, rsi
je 0x1400136f9
mov edx, 0x26
mov rax, r8
cmp dx, word [r8]
jne 0x1400136c8
lea rcx, [r8 + 2]
jmp 0x1400136c3
lea rcx, [rsp + 0x2d0]
mov qword [rsp + 0x298], rdx
mov dword [rsp + 0x7c], edx
mov qword [rsp + 0x2c0], rdx
mov qword [rsp + 0x2a8], rdx
mov qword [rsp + 0x210], r10
mov qword [rsp + 0x370], r10
call fcn.14005b998
xor eax, eax
lea rcx, [rsp + 0x488]
mov qword [rsp + 0x2d8], rax
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x270], rcx
lea rcx, [rsp + 0x138]
mov qword [rsp + 0x258], rax
mov qword [rsp + 0x488], rax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x380], rcx
cmp word [rsp + 0x98], ax
je 0x140012516
mov rbx, qword [rsp + 0x210]
lea r9d, [rax + 0x22]
lea ebp, [rax + 2]
cmp r9w, word [rbx]
jne 0x14001242d
add rbx, rbp
mov qword [rsp + 0x210], rbx
lea rcx, [rsp + 0x210]
mov edx, 0x3a
call fcn.1400ccf8c
mov rcx, qword [rsp + 0x210]
xor esi, esi
cmp rcx, rbx
je 0x140012461
cmp word [rcx - 2], r9w
jne 0x140012461
mov word [rcx - 2], si
mov rcx, qword [rsp + 0x210]
cmp dx, word [rcx]
jne 0x14001247c
mov word [rcx], si
mov rcx, qword [rsp + 0x210]
add rcx, rbp
mov qword [rsp + 0x210], rcx
mov rdi, rcx
cmp r9w, word [rcx]
jne 0x1400124aa
lea rdi, [rcx + 2]
add rcx, rbp
mov qword [rsp + 0x210], rcx
cmp r9w, word [rcx]
jne 0x1400124a5
mov word [rcx], si
mov rcx, qword [rsp + 0x210]
cmp word [rcx], si
jne 0x140012489
cmp word [rsp + 0xb8], si
je 0x1400124d8
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov qword [rsp + 0x298], rax
cmp rax, rsi
je 0x1400124d8
mov word [rax], si
add rax, rbp
mov qword [rsp + 0x298], rax
lea rdx, [rsp + 0x2d0]
mov r9d, 0x10000
mov r8, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.14004e40c
mov r11, qword [rsp + 0x2e0]
mov rbp, qword [rsp + 0x2d0]
add rbp, r11
mov qword [rsp + 0x258], rbp
jmp 0x140012d58
mov rdx, qword [rsp + 0x210]
cmp rdx, rax
je 0x140012760
mov ecx, 0x26
cmp word [rdx], cx
jne 0x14001273c
mov rcx, qword [rsp + 0xe00]
or r9d, 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.140016e70
mov qword [rsp + 0x2e8], rax
test rax, rax
jne 0x1400126dc
lea rcx, [rsp + 0x138]
call fcn.140053e80
lea rcx, [rsp + 0x2d0]
call fcn.140053e80
lea rcx, [rsp + 0x2a8]
call fcn.140053e80
lea rcx, [rsp + 0x220]
call fcn.140053e80
lea rcx, [rsp + 0x1c8]
call fcn.140053e80
lea rcx, [rsp + 0x1a0]
call fcn.140053e80
lea rcx, [rsp + 0x3e0]
call fcn.140053e80
test bl, bl
je 0x1400125dd
xor r8d, r8d
mov eax, 0xfffb
lea rcx, str.SeDebugPrivilege
and word [0x14011af8c], ax
lea edx, [r8 + 4]
call fcn.14001a130
lea rcx, [rsp + 0x2f8]
call fcn.140053e80
lea rcx, [rsp + 0x200]
call fcn.140053e80
mov rcx, qword [rsp + 0x2b8]
xor ebx, ebx
cmp rcx, rbx
je 0x140012612
cmp rcx, 0xffffffffffffffff
je 0x140012612
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140053e80
mov rcx, qword [rsp + 0xf8]
cmp rcx, rbx
je 0x140012638
cmp rcx, 0xffffffffffffffff
je 0x140012638
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0xf8], rbx
cmp rcx, rbx
je 0x140012659
cmp rcx, 0xffffffffffffffff
je 0x140012659
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xc8], rbx
cmp rbp, rbx
je 0x140012675
cmp rbp, 0xffffffffffffffff
je 0x140012675
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, rbx
je 0x140012689
cmp rdi, 0xffffffffffffffff
je 0x140012689
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rsi, rbx
je 0x14001269d
cmp rsi, 0xffffffffffffffff
je 0x14001269d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x288]
cmp rax, rbx
je 0x1400126b9
cmp rax, 0xffffffffffffffff
je 0x1400126b9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x290]
cmp rax, rbx
je 0x140010a17
cmp rax, 0xffffffffffffffff
je 0x140010a17
mov rcx, rax
jmp 0x140010a11
mov rdx, qword [rax + 0x18]
movabs rax, 0x3fffffffffffffff
lea rcx, [rsp + 0x2d0]
and rdx, rax
mov qword [rsp + 0x2d8], rdx
add rdx, 0x10
call fcn.14005ba78
mov r8, qword [rsp + 0x2d8]
mov rdx, qword [rsp + 0x2e8]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x2d0]
inc r8
mov rbp, rax
mov qword [rsp + 0x258], rax
call fcn.14001b6e8
xor esi, esi
jmp 0x140012d58
neg byte [rsp + 0x75]
mov edi, 2
lea rcx, [rsp + 0x370]
sbb edx, edx
and edx, edi
call fcn.14006eaa4
mov qword [rsp + 0x2c0], rax
jmp 0x14001276d
mov rax, qword [rsp + 0x2c0]
mov edi, 2
xor esi, esi
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x4b0], rsi
cmp rax, rsi
jne 0x140012c23
mov r9, qword [rsp + 0xe08]
mov qword [rsp + 0x210], r9
cmp r9, rsi
je 0x1400127bd
lea eax, [rsi + 0x2a]
cmp word [r9], ax
jne 0x1400127bd
lea eax, [rsi + 1]
add word [rsp + 0xf0], ax
lea rax, [r9 + 2]
mov qword [rsp + 0x210], rax
cmp byte [rsp + 0x140], sil
je 0x1400127cf
mov word [rsp + 0xf0], si
cmp word [rsp + 0xb8], si
je 0x1400128a7
mov rcx, qword [rsp + 0x370]
mov ebx, 0x3a
xor edx, edx
mov r8d, ebx
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbp, rax
mov qword [rsp + 0x298], rax
cmp rax, rsi
je 0x14001288e
add rbp, rdi
mov word [rax], si
mov qword [rsp + 0x298], rbp
je 0x14001288e
mov r9, qword [rsp + 0x370]
mov eax, 0x22
mov dword [rsp + 0x98], edi
mov qword [rsp + 0x270], rsi
mov rbx, rsi
cmp ax, word [r9]
jne 0x140012879
add r9, 2
lea rcx, [rsp + 0x380]
mov edx, eax
mov qword [rsp + 0x370], r9
mov qword [rsp + 0x380], r9
call fcn.1400ccf8c
mov rcx, qword [rsp + 0x380]
cmp word [rcx], si
je 0x140012879
mov word [rcx], si
mov r9, qword [rsp + 0x370]
lea rcx, [rsp + 0x138]
mov rdx, r9
call fcn.140066968
jmp 0x140012dae
mov rax, qword [rsp + 0x2c0]
cmp rax, rsi
jne 0x140012c28
mov r9, qword [rsp + 0xe08]
mov rbx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0x128]
lea rcx, [rsp + 0x1a0]
mov r8, rbx
call fcn.140005d2c
mov rcx, rax
mov rbp, rax
mov qword [rsp + 0x128], rax
call fcn.140005e7c
cmp eax, esi
jne 0x1400134d3
cmp byte [rsp + 0x71], sil
jne 0x1400129d0
mov rcx, qword [rsp + 0xe08]
xor edx, edx
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
cmp rax, rsi
je 0x14001290e
add rbx, rdi
jmp 0x140012916
mov rbx, qword [rsp + 0xe08]
lea rcx, str.winpeshl
mov r8d, 8
mov rdx, rbx
call fcn.1400553c8
mov edi, 0x2e
cmp al, sil
je 0x140012965
movzx eax, word [rbx + 0x10]
cmp si, ax
je 0x14001295d
cmp di, ax
je 0x14001295d
lea ecx, [rdi - 0x25]
cmp cx, ax
ja 0x140012953
lea ecx, [rdi - 0x21]
cmp ax, cx
jbe 0x14001295d
mov ecx, 0x20
cmp cx, ax
jne 0x140012965
mov byte [rsp + 0x88], 1
lea rcx, str.wpeinit
mov r8d, 8
mov rdx, rbx
call fcn.1400553c8
cmp al, sil
je 0x1400129be
movzx eax, word [rbx + 0xe]
cmp si, ax
je 0x1400129ab
cmp di, ax
je 0x1400129ab
mov ecx, 9
cmp cx, ax
ja 0x1400129a1
mov ecx, 0xd
cmp ax, cx
jbe 0x1400129ab
mov ecx, 0x20
cmp cx, ax
jne 0x1400129be
mov rbx, qword [rsp + 0xe8]
mov r9d, 1
mov dil, r9b
jmp 0x1400129d9
mov rbx, qword [rsp + 0xe8]
mov dil, byte [rsp + 0x88]
jmp 0x1400129d3
mov dil, sil
mov r9d, 1
mov edx, dword [rsp + 0xe20]
test r9b, dl
jne 0x1400129ee
cmp dword [rsp + 0xbc], esi
je 0x140012a33
mov rcx, qword [rsp + 0xe08]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.Shell.x
lea rdx, str.SOFTWAREPELOGON
movsxd rcx, eax
mov r9d, 1
lea eax, [rcx + rcx]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xe08]
mov qword [rsp + 0x20], rax
call fcn.1400551f0
mov eax, dword [rsp + 0xb0]
xor r9d, r9d
xor r8d, r8d
cmp eax, esi
je 0x140012aa3
mov ecx, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0xe08]
mov dword [rsp + 0x50], eax
or ecx, dword [rsp + 0x90]
lea rax, [rsp + 0x338]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.140003b94
jmp 0x140012b79
mov eax, dword [rsp + 0x100]
cmp eax, esi
je 0x140012b23
mov edx, dword [rsp + 0xd0]
mov qword [rsp + 0x68], rsi
movzx eax, ax
or edx, dword [rsp + 0x90]
lea rcx, [0x1400fbe50]
mov qword [rsp + 0x60], rcx
mov ecx, dword [rsp + 0x78]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x338]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov rdx, qword [rsp + 0xe08]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.140006f6c
jmp 0x140012b79
mov ecx, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0xe08]
lea rax, [rsp + 0x338]
or ecx, dword [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rsp + 0x20], ecx
mov rcx, rbx
call fcn.1400de7c4
mov ebp, eax
mov dword [rsp + 0x7c], eax
neg eax
sbb cl, cl
and cl, dil
mov byte [rsp + 0x88], cl
cmp cl, sil
je 0x140012bca
call fcn.1400238ac
mov ecx, dword [rsp + 0x84]
cmp eax, esi
je 0x140012bac
or ecx, 1
mov dword [rsp + 0x84], ecx
cmp ecx, esi
jne 0x140012bca
lea rcx, str.waitpeinit.pecmd
call fcn.1400de830
mov ecx, esi
cmp eax, esi
setne cl
mov dword [rsp + 0x84], ecx
cmp ebp, esi
jne 0x140013686
cmp byte [rsp + 0x74], sil
jne 0x140013686
cmp rbx, rsi
jne 0x140013686
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x140013686
lea rcx, [rsp + 0x138]
call fcn.140053e80
lea rcx, [rsp + 0x2d0]
call fcn.140053e80
lea rcx, [rsp + 0x2a8]
call fcn.140053e80
jmp 0x140013539
mov ebx, 0x3a
mov rbp, rax
cmp word [rsp + 0xb8], si
je 0x140012c66
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov qword [rsp + 0x298], rax
cmp rax, rsi
je 0x140012c5e
mov word [rax], si
add rax, rdi
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x2c0]
add rax, rdi
lea r8, str.EXEDATA
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x2c0], rax
call fcn.14006e9b8
movzx ecx, word [rbp]
mov r8d, 0x20
mov rdx, rax
mov qword [rsp + 0x2e8], rax
mov rax, qword [0x140119df0]
mov word [rbp], si
mov word [rsp + 0xa0], cx
mov rcx, qword [rsp + 0x370]
lea edi, [r8 + 0xe]
mov dword [rsp + 0x24c], r8d
mov rbx, rsi
cmp di, word [rcx]
jne 0x140012cd7
cmp word [rcx + 2], si
je 0x140012cf9
cmp word [rcx], si
je 0x140012cf9
xor edx, edx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdx, qword [rsp + 0x2e8]
mov r8d, 0x20
mov rbx, rax
mov cx, word [rsp + 0xa0]
mov word [rbp], cx
cmp rax, rsi
je 0x140012d47
lea rcx, [rsp + 0x24c]
mov dword [rsp + 0x24c], r8d
mov r8, rdx
mov rdx, qword [rsp + 0x4b0]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x2d0]
mov rcx, rax
call fcn.14001c8ac
mov rbp, rax
mov qword [rsp + 0x258], rax
jmp 0x140012d4a
mov rbp, rsi
cmp rbx, rsi
je 0x140012d58
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp qword [rsp + 0x2d8], rsi
je 0x140013682
cmp rbp, rsi
je 0x140013682
mov eax, 1
mov edi, eax
mov dword [rsp + 0x98], eax
cmp word [rsp + 0xf0], si
ja 0x140012d9e
cmp word [rsp + 0xb8], si
je 0x14001346d
jmp 0x140012d9e
mov edi, dword [rsp + 0x98]
mov rbp, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x380]
mov r8, qword [rsp + 0x270]
lea rax, [0x1400fbd88]
cmp rbx, rsi
cmovne rax, qword [rsp + 0x388]
lea r9, str.exedat
lea rcx, [rsp + 0x168]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.14000744c
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x1c8]
call fcn.1400669b4
mov rbx, qword [rsp + 0x488]
lea rax, [rsp + 0x488]
cmp rbx, rsi
lea rcx, [rsp + 0x138]
mov qword [rsp + 0x270], rax
setne al
mov dword [rsp + 0x1d0], esi
mov qword [rsp + 0x380], rcx
cmp al, sil
je 0x140012e6d
mov r8d, dword [rsp + 0x2d8]
mov rdx, qword [rsp + 0x258]
lea r9, [rsp + 0x1d0]
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.140058bf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140012e7a
mov ebx, 1
cmp edi, ebx
jle 0x140013682
mov rdx, qword [rsp + 0x168]
mov dil, sil
cmp rbp, rsi
je 0x1400130a5
mov rax, qword [rsp + 0x138]
lea rcx, [rsp + 0x138]
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x450], rax
call fcn.140066a00
lea rdx, str..ex
lea rcx, [rsp + 0x138]
call fcn.14005bdb0
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x1c8]
call fcn.1400669b4
mov eax, 0x5c
mov rbx, rbp
cmp ax, word [rbp]
je 0x140012ef1
lea rbx, [rbp - 2]
mov word [rbx], ax
mov rcx, qword [rsp + 0x1c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [rsp + 0xb8]
mov ecx, 1
cmp cx, ax
jne 0x140012f8b
lea rdx, [0x1400fc518]
lea rcx, [rsp + 0x280]
call fcn.1400668e8
mov rdx, qword [rsp + 0x450]
lea rcx, [rsp + 0x280]
call fcn.14005bdb0
lea rdx, [0x1400fc510]
lea rcx, [rsp + 0x280]
call fcn.14005bdb0
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0x280]
call fcn.14005bdb0
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0xe00]
call fcn.140041b1c
lea rcx, [rsp + 0x280]
call fcn.140053e80
jmp 0x140013071
mov ecx, pe_nt_image_headers64
cmp cx, ax
jne 0x140013071
xor edx, edx
lea rcx, [rsp + 0x840]
mov dword [rsp + 0x830], 0x68
lea r8d, [rdx + 0x58]
mov qword [rsp + 0x838], rsi
call fcn.1400df2a0
mov rcx, qword [rsp + 0x450]
xor eax, eax
mov qword [rsp + 0x530], rax
mov qword [rsp + 0x538], rax
lea rax, [rsp + 0x528]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x830]
lea rdx, [0x1400fc508]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1c8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xd0]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov dword [rsp + 0x86c], 0x80
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x528], rsi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x528]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x528]
cmp rcx, rsi
je 0x14001305e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x530]
cmp rcx, rsi
je 0x140013071
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x138]
mov rdx, rbx
call fcn.14005bdb0
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x1a0]
call fcn.1400669b4
lea rcx, [rsp + 0x450]
call fcn.140053e80
jmp 0x1400130b2
lea rcx, [rsp + 0x1c8]
call fcn.140066a00
mov r9, qword [rsp + 0xe08]
mov edx, 0x22
mov rax, r9
cmp dx, word [r9]
jne 0x1400130cc
lea rax, [r9 + 2]
mov ecx, 0x3f
cmp cx, word [rax]
jne 0x1400131c8
lea rdi, [rax + 2]
cmp cx, word [rdi]
jne 0x1400130f4
mov rbx, qword [rsp + 0x138]
lea rdi, [rax + 4]
jmp 0x14001317b
mov eax, 0x5c
cmp ax, word [rdi]
jne 0x1400131c5
cmp dx, word [r9]
je 0x140013173
mov rax, qword [rsp + 0x1c8]
mov ebx, 0x104
lea rcx, [rsp + 0x1c8]
mov rdx, rbx
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x500], rax
call fcn.14005bd74
mov rax, qword [rsp + 0x1c8]
mov r8d, ebx
mov word [rax], si
mov rdx, qword [rsp + 0x1c8]
mov rcx, qword [rsp + 0x500]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea rcx, [rsp + 0x500]
call fcn.140053e80
mov r9, qword [rsp + 0xe08]
mov edx, 0x22
mov rbx, qword [rsp + 0x1c8]
cmp dx, word [r9]
jne 0x140013195
lea rdx, [0x1400fb7b4]
lea rcx, [rsp + 0x220]
call fcn.140066a00
lea rcx, [rsp + 0x220]
mov rdx, rbx
call fcn.14005bdb0
lea rcx, [rsp + 0x220]
mov rdx, rdi
call fcn.14005bdb0
mov r9, qword [rsp + 0x220]
mov qword [rsp + 0xe08], r9
mov dil, sil
cmp rbp, rsi
je 0x14001322f
mov ecx, dword [rsp + 0xf0]
cmp cx, si
ja 0x1400132ff
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rsp + 0x2d0]
mov rbp, rsi
mov qword [rsp + 0x298], rsi
call fcn.14001c124
cmp qword [rsp + 0x2d8], rsi
je 0x140013227
mov rax, qword [rsp + 0x2d0]
mov ebx, 1
or edx, 0xffffffff
mov qword [rsp + 0x258], rax
mov dil, bl
jmp 0x14001344c
mov r9, qword [rsp + 0xe08]
mov r8, qword [rsp + 0x138]
mov rbx, r8
cmp rbp, rsi
je 0x14001324c
movzx eax, word [rbp]
neg ax
sbb rcx, rcx
and rbx, rcx
mov rax, qword [rsp + 0x128]
lea rcx, [rsp + 0x1a0]
cmp rax, rsi
cmove rax, qword [rsp + 0x1c8]
mov rdx, rax
call fcn.140005d2c
mov rcx, rax
mov rbp, rax
mov qword [rsp + 0x128], rax
call fcn.140005e7c
cmp eax, esi
jne 0x1400134d3
mov ecx, dword [rsp + 0xb0]
xor r9d, r9d
xor r8d, r8d
cmp ecx, esi
je 0x140013344
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x50], ecx
lea rdx, [rsp + 0x338]
or eax, dword [rsp + 0x90]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0xe08]
lea rcx, [rsp + 0x5e0]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140003b94
jmp 0x14001341a
cmp byte [rsp + 0x74], sil
je 0x14001322f
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x298], rsi
cmp rax, rsi
cmove rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x128], rax
mov eax, 2
mov dil, al
cmp cx, ax
jb 0x140012bf7
jmp 0x14001343c
mov eax, dword [rsp + 0x100]
cmp eax, esi
je 0x1400133c4
mov ecx, dword [rsp + 0xd0]
mov qword [rsp + 0x68], rsi
movzx eax, ax
or ecx, dword [rsp + 0x90]
lea rdx, [0x1400fbe50]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x338]
lea rax, [rsp + 0x5e0]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0xe08]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140006f6c
jmp 0x14001341a
mov eax, dword [rsp + 0xd0]
lea rdx, [rsp + 0x338]
lea rcx, [rsp + 0x5e0]
or eax, dword [rsp + 0x90]
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0xe08]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x78]
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.1400de7c4
cmp byte [rsp + 0xf0], 2
mov ebp, eax
mov dword [rsp + 0x7c], eax
jl 0x140013686
cmp word [rsp + 0xb8], si
jne 0x140013686
lea rax, [rsp + 0x338]
mov ebx, 1
mov edx, dword [rax + 0x10]
mov rcx, qword [rsp + 0x168]
call fcn.1400046dc
mov rax, qword [rsp + 0x168]
mov word [rax], si
cmp dil, bl
jne 0x140013504
mov rbx, qword [rsp + 0xe08]
mov edx, 0x22
mov rax, rbx
cmp dx, word [rbx]
jne 0x140013486
lea rax, [rbx + 2]
mov ecx, 0x3f
movzx edi, si
cmp cx, word [rax]
jne 0x1400134b1
mov ecx, 0x5c
cmp cx, word [rax + 2]
jne 0x1400134b1
lea rbx, [rax + 4]
cmp dx, word [rbx]
jne 0x1400134b1
sub rbx, 2
mov di, word [rbx]
mov word [rbx], dx
mov rcx, qword [rsp + 0x128]
call fcn.140005e7c
cmp eax, esi
jne 0x1400134d3
cmp di, si
je 0x140012d97
mov word [rbx], di
jmp 0x140012d97
lea rcx, [rsp + 0x138]
mov ebp, 3
call fcn.140053e80
lea rcx, [rsp + 0x2d0]
call fcn.140053e80
lea rcx, [rsp + 0x2a8]
call fcn.140053e80
jmp 0x1400122eb
cmp dil, 2
jne 0x140013682
lea rcx, [rsp + 0x138]
call fcn.140053e80
lea rcx, [rsp + 0x2d0]
call fcn.140053e80
lea rcx, [rsp + 0x2a8]
call fcn.140053e80
jmp 0x14001353e
xor esi, esi
mov ebx, 1
xor edx, edx
lea rcx, [rsp + 0x578]
mov dword [rsp + 0x570], 0x70
lea r8d, [rdx + 0x68]
call fcn.1400df2a0
mov edx, dword [rsp + 0xb4]
mov rcx, qword [rsp + 0x128]
cmp edx, esi
mov eax, 5
mov dword [rsp + 0x574], 0x4540
cmovne ax, dx
movzx eax, ax
mov dword [rsp + 0x5a0], eax
cmp rcx, rsi
je 0x1400135a7
mov rax, qword [rsp + 0x598]
cmp word [rcx], si
cmovne rax, rcx
mov qword [rsp + 0x598], rax
mov rax, qword [rsp + 0x1b8]
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x4c0]
mov qword [rsp + 0x580], rax
mov rax, qword [rsp + 0xe08]
mov r8d, ebx
mov qword [rsp + 0x4c0], rax
mov qword [rsp + 0x588], rax
mov qword [rsp + 0x4d0], rsi
call fcn.140023518
mov rdx, qword [rsp + 0x4c0]
mov rbx, rax
cmp word [rax], si
jne 0x140013609
cmp rdx, qword [rsp + 0xe08]
je 0x14001362e
mov r8, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x1f8]
call fcn.14005bedc
mov r11, qword [rsp + 0x1f8]
mov qword [rsp + 0x588], r11
mov rax, qword [rsp + 0x590]
cmp word [rbx], si
lea rcx, [rsp + 0x570]
cmovne rax, rbx
mov qword [rsp + 0x590], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rbx, [rsp + 0x338]
mov ebp, eax
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x5d8]
mov rcx, rax
mov qword [rbx], rax
mov qword [rsp + 0x5d8], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx + 0x10], eax
jmp 0x1400136ad
mov ebp, dword [rsp + 0x7c]
lea rcx, [rsp + 0x138]
call fcn.140053e80
lea rcx, [rsp + 0x2d0]
call fcn.140053e80
lea rcx, [rsp + 0x2a8]
call fcn.140053e80
cmp ebp, esi
je 0x1400122d9
mov ebp, esi
jmp 0x1400122e1
mov rax, rcx
add rcx, 2
cmp dx, word [rcx]
je 0x1400136bc
cmp dx, word [rax]
jne 0x1400136d1
add rax, 2
mov ecx, 0x3a
jmp 0x1400136dc
add rax, 2
cmp cx, word [rax]
je 0x1400136d8
cmp word [rax], si
je 0x1400136f9
lea rax, [rsp + 0x338]
mov rcx, rdi
mov rdx, qword [rax]
call fcn.14003c190
lea rax, [rsp + 0x338]
cmp byte [rsp + 0xc3], sil
je 0x140013743
cmp qword [rax], rsi
je 0x140013743
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rdi, rax
mov qword [rsp + 0x2f0], rax
lea rax, [rsp + 0x338]
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
lea rax, [rsp + 0x338]
jmp 0x14001374b
mov rdi, qword [rsp + 0x2f0]
mov edx, dword [rax + 0x10]
mov rcx, qword [rsp + 0xe00]
lea r8, str.__LastPID
call fcn.14005ecb0
mov rcx, qword [rsp + 0xe00]
lea rax, [rsp + 0x338]
mov edx, dword [rax + 0x14]
lea r8, str.__LastTID
call fcn.14005ecb0
cmp dword [rsp + 0x1b0], esi
je 0x1400137a6
lea rax, [rsp + 0x338]
lea rcx, str.SeDebugPrivilege
mov edx, 4
mov r8, qword [rax]
call fcn.14001a210
mov eax, 4
test byte [rsp + 0x90], al
je 0x1400137cb
lea rax, [rsp + 0x338]
mov rcx, qword [rax + 8]
cmp rcx, rsi
je 0x1400137cb
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [rsp + 0x220]
call fcn.140053e80
lea rcx, [rsp + 0x1c8]
call fcn.140053e80
lea rcx, [rsp + 0x1a0]
call fcn.140053e80
lea rcx, [rsp + 0x3e0]
call fcn.140053e80
cmp byte [rsp + 0x70], sil
je 0x140013825
xor r8d, r8d
mov eax, 0xfffb
lea rcx, str.SeDebugPrivilege
and word [0x14011af8c], ax
lea edx, [r8 + 4]
call fcn.14001a130
lea rax, [rsp + 0x288]
cmp qword [rax], rsi
je 0x140013843
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x288]
mov qword [rax], rsi
lea rax, [rsp + 0xc8]
cmp qword [rax], rsi
je 0x140013864
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0xc8]
mov qword [rax], rsi
lea rax, [rsp + 0x158]
cmp qword [rax], rsi
je 0x140013885
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x158]
mov qword [rax], rsi
lea rax, [rsp + 0x1e0]
cmp qword [rax], rsi
je 0x1400138a6
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x1e0]
mov qword [rax], rsi
lea rax, [rsp + 0x238]
cmp qword [rax], rsi
je 0x1400138c7
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x238]
mov qword [rax], rsi
mov eax, dword [rsp + 0xe20]
cmp al, sil
jne 0x1400138e0
cmp byte [rsp + 0x80], sil
je 0x140013953
lea r8, [rsp + 0x338]
cmp qword [r8], rsi
je 0x14001390a
mov rcx, qword [r8]
mov edx, 0x1388
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [rsp + 0xe20]
lea r8, [rsp + 0x338]
cmp al, sil
je 0x140013953
mov edx, 1
test dl, al
je 0x14001392e
mov rax, qword [r8]
neg rax
sbb ecx, ecx
and ecx, 2
or ecx, edx
mov edx, dword [r8 + 0x10]
call fcn.14003a748
mov rdx, qword [rsp + 0x438]
cmp rdx, rsi
je 0x140013953
mov rcx, qword [rsp + 0xe00]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call fcn.140045d3c
cmp dword [rsp + 0x7c], esi
je 0x140014724
lea r8, [rsp + 0x338]
mov rdx, qword [r8]
mov rax, rdx
neg rax
sbb ecx, ecx
and ecx, dword [rsp + 0x84]
mov dword [rsp + 0x84], ecx
movsxd rcx, dword [rsp + 0x104]
mov qword [rsp + rcx*8 + 0x498], rdx
inc ecx
mov dword [rsp + 0x104], ecx
mov rcx, qword [r8 + 8]
cmp rcx, rsi
je 0x1400139ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x338]
mov qword [r8 + 8], rsi
mov eax, 0x3e8
cmp dword [rsp + 0xbc], esi
je 0x1400139e6
mov rcx, qword [rsp + 0xe00]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
call fcn.14001d7e0
lea rax, [rsp + 0x338]
mov rcx, qword [rax]
call fcn.14004dadc
mov edx, dword [rsp + 0x84]
cmp edx, esi
je 0x14001474c
mov al, byte [0x14011721f]
mov ebx, 0x100000
lea rcx, [rsp + 0x90]
lea edx, [rbx + 4]
mov ebp, esi
mov dword [rsp + 0xbc], esi
mov byte [rsp + 0x72], al
call fcn.14005b9fc
mov rax, qword [rsp + 0x108]
lea rcx, [rax + 2]
mov edx, 0x40
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x550], rcx
mov byte [rsp + 0xe20], sil
cmp dx, word [rax]
jne 0x140013a60
mov byte [rsp + 0xe20], 1
mov rax, rcx
mov qword [rsp + 0x460], rcx
jmp 0x140013a72
cmp qword [rsp + 0x228], rsi
je 0x140013a72
mov byte [rsp + 0xe20], 2
cmp byte [rsp + 0x123], sil
je 0x140013b0b
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x470]
xor r9d, r9d
mov rdx, rax
mov qword [rsp + 0x470], rsi
call fcn.140064818
mov rdx, qword [rsp + 0x470]
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x90]
mov r9, rax
mov r8, rax
call fcn.14005bbb0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
mov dword [rsp + 0xbc], eax
lea ebx, [rax + 0x3ff]
and ebx, 0xfffffc00
add ebx, 0x100000
lea ecx, [rbx + 8]
movsxd rdx, ecx
lea rcx, [rsp + 0x90]
call fcn.14005ba78
lea rcx, [rsp + 0x470]
call fcn.140053e80
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
or rax, 0xffffffffffffffff
mov r8, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [rsp + 0x71], 8
mov dword [rsp + 0xa4], eax
mov dword [rsp + 0x11c], esi
je 0x14001409f
mov rcx, qword [rsp + 0x108]
mov eax, 0x40
cmp ax, word [rcx]
je 0x140013b7e
cmp byte [rsp + 0xc1], sil
je 0x140013b7e
mov eax, 0x26
cmp word [rcx], ax
je 0x140013b77
mov rax, qword [rsp + 0xe00]
test byte [rax + 0xd], 0xf
je 0x140013b7e
mov byte [rsp + 0x73], 1
jmp 0x140013b83
mov byte [rsp + 0x73], sil
xor ecx, ecx
mov dword [rsp + 0xd0], esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x290]
lea rdx, [rsp + 0x508]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [rsp + 0xb4], ebp
cmp byte [rsp + 0xe20], sil
je 0x140013bc2
mov edi, ebx
sub edi, ebp
jmp 0x140013bc7
mov edi, 0x100000
lea rax, [rsp + 0x508]
movsxd rdx, ebp
lea r9, [rsp + 0xd0]
add rdx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x290]
mov rcx, qword [rax]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0xa4]
mov edx, 0x3e8
mov dword [rsp + 0x1b0], eax
mov eax, dword [rsp + 0x1c0]
lea rcx, [rsp + 0x368]
cmp eax, esi
mov dword [rsp + 0xbc], esi
mov byte [rsp + 0x80], sil
cmovle eax, edx
mov dword [rsp + 0x1c0], eax
call fcn.14005bc74
mov al, byte [0x14011721f]
cmp al, sil
mov byte [rsp + 0x72], al
jg 0x140013c5a
cmp dword [rsp + 0x1f0], 2
jl 0x140013e2a
cmp dword [rsp + 0x268], esi
jle 0x140013ca1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov dword [rsp + 0x11c], eax
mov eax, dword [rsp + 0x268]
sub edx, dword [rsp + 0xa4]
cmp edx, eax
jae 0x140013e2a
mov ecx, eax
sub ecx, edx
mov edx, dword [rsp + 0x1c0]
cmp edx, ecx
cmova edx, ecx
mov dword [rsp + 0x1c0], edx
jmp 0x140013ca8
mov edx, dword [rsp + 0x1c0]
mov rcx, qword [rsp + 0xe00]
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], edx
mov edx, dword [rsp + 0x104]
lea r8, [rsp + 0x498]
xor r9d, r9d
call fcn.140019a10
mov edx, eax
mov dword [rsp + 0x100], eax
cmp eax, esi
jne 0x140013db0
lea rax, [rsp + 0x290]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x508]
mov rcx, qword [rax]
xor r9d, r9d
mov dword [rsp + 0x98], esi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov r11d, dword [rsp + 0x98]
cmp r11d, esi
jle 0x140013d3d
mov rax, qword [rsp + 0x90]
cmp r11d, edi
cmovg r11d, edi
add ebp, r11d
mov dword [rsp + 0x98], r11d
movsxd rcx, ebp
mov byte [rcx + rax], sil
lea eax, [rbp + 0x100000]
cmp eax, ebx
jl 0x140013d60
add ebx, 0x100000
lea rcx, [rsp + 0x90]
lea eax, [rbx + 4]
movsxd rdx, eax
call fcn.14005ba78
cmp byte [rsp + 0xe20], sil
je 0x140013d70
mov edi, ebx
sub edi, ebp
jmp 0x140013d75
mov edi, 0x100000
lea rax, [rsp + 0x508]
movsxd rdx, ebp
lea r9, [rsp + 0x98]
add rdx, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x290]
mov rcx, qword [rax]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x100]
mov cl, byte [rsp + 0xe20]
cmp cl, sil
je 0x140013df8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x11c], eax
sub eax, dword [rsp + 0x1b0]
cmp eax, dword [rsp + 0x1c0]
jge 0x140013f31
cmp ebp, dword [rsp + 0xbc]
je 0x14001407e
cmp eax, 0x14
jl 0x14001407e
jmp 0x140013f31
mov eax, dword [rsp + 0x104]
mov r9d, 1
cmp eax, r9d
jle 0x140013e43
dec eax
cmp eax, edx
jne 0x140013e43
mov byte [rsp + 0x80], r9b
cmp cl, sil
je 0x140013e2a
cmp ebp, dword [rsp + 0xbc]
jne 0x140013f31
lea rcx, [rsp + 0x368]
mov dword [rsp + 0xbc], ebp
call fcn.140053e80
jmp 0x1400142a7
test byte [rsp + 0x71], r9b
je 0x140013e8d
movsxd rax, dword [rsp + 0xb4]
cmp ebp, eax
jle 0x140013e8d
mov rdx, qword [rsp + 0x3a0]
movsxd r8, ebp
mov rcx, rax
cmp rax, r8
jge 0x140013e8d
mov rax, qword [rsp + 0x90]
mov r10d, 0xa
cmp byte [rcx + rax], r10b
jne 0x140013e85
sub rdx, r9
cmp rdx, rsi
jle 0x140013e2a
add rcx, r9
cmp rcx, r8
jl 0x140013e77
mov eax, 5
sub eax, r9d
mov dword [rsp + 0xb0], eax
js 0x140013c3d
mov al, byte [0x14011721f]
cmp al, sil
jle 0x140013c3d
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x710]
xor r8d, r8d
xor r9d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, esi
je 0x140013c3d
cmp dword [rsp + 0x718], 0x12
je 0x140013f09
lea rcx, [rsp + 0x710]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x710]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [rsp + 0xb0]
mov r9d, 1
jmp 0x140013e92
mov byte [rsp + 0x72], sil
mov byte [rsp + 0x80], 1
cmp byte [rsp + 0xe20], sil
je 0x140013c3d
cmp ebp, dword [rsp + 0xbc]
je 0x140013c3d
mov ecx, dword [rsp + 0x11c]
mov rax, qword [rsp + 0x90]
mov dword [rsp + 0xbc], ebp
mov dword [rsp + 0x1b0], ecx
mov cl, byte [rsp + 0x73]
mov r8, rax
cmp cl, sil
jne 0x140013fad
cmp dword [rsp + 0x150], 0x4b0
je 0x140013f8c
movsxd r9, dword [rsp + 0x150]
lea rcx, [rsp + 0x368]
movsxd r8, ebp
mov rdx, rax
call fcn.14005be30
mov r8, qword [rsp + 0x368]
jmp 0x140013fa1
movsxd rcx, ebp
mov word [rcx + rax + 2], si
mov rax, qword [rsp + 0x90]
mov word [rcx + rax + 2], si
mov cl, byte [rsp + 0x73]
mov rax, qword [rsp + 0x90]
mov r9d, 1
cmp byte [rsp + 0xe20], r9b
jne 0x140013feb
mov rax, qword [rsp + 0x460]
mov rcx, qword [rsp + 0xe00]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
lea r9, [0x1400fb538]
mov rdx, rax
mov r8, rax
call fcn.140057434
jmp 0x140014034
cmp cl, sil
je 0x14001401f
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x90]
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xe00]
mov r9d, ebp
mov r8, rax
call fcn.14006b08c
jmp 0x140014034
mov rdx, qword [rsp + 0x460]
mov rcx, qword [rsp + 0xe00]
call fcn.14005b2f4
mov rax, qword [rsp + 0x228]
cmp rax, rsi
je 0x14001407e
lea rcx, [rsp + 0x328]
mov rdx, rax
call fcn.1400668e8
mov rdx, qword [rsp + 0x328]
mov rcx, qword [rsp + 0xe00]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call fcn.140045d3c
lea rcx, [rsp + 0x328]
call fcn.140053e80
cmp byte [rsp + 0x80], sil
jne 0x140013e2a
mov cl, byte [rsp + 0xe20]
mov edx, dword [rsp + 0x100]
jmp 0x140013df8
cmp dword [rsp + 0x84], 0xffffff9c
je 0x1400142af
movsxd rcx, dword [rsp + 0x1f0]
movsxd rdx, dword [rsp + 0x268]
lea edi, [rbx + 4]
mov qword [rsp + 0x228], rcx
mov qword [rsp + 0x1b0], rdx
mov al, byte [0x14011721f]
cmp al, sil
mov byte [rsp + 0x72], al
jg 0x1400140e9
cmp rcx, 2
jl 0x1400142a0
cmp rdx, rsi
mov eax, 0x3e8
mov dword [rsp + 0xe20], eax
jle 0x140014127
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rsp + 0x268]
sub eax, dword [rsp + 0xa4]
cmp eax, ecx
jae 0x1400142a0
sub ecx, eax
mov eax, dword [rsp + 0xe20]
mov rdx, rax
cmp ecx, edx
cmovb eax, ecx
mov edx, dword [rsp + 0x104]
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x498]
xor r9d, r9d
mov dword [rsp + 0x28], 0x4ff
mov dword [rsp + 0x20], eax
call fcn.140019a10
mov edx, dword [rsp + 0x104]
lea ecx, [rdx - 1]
cmp ecx, eax
je 0x1400142a0
mov r8d, 1
cmp edx, r8d
jle 0x1400141fd
cmp eax, esi
jne 0x1400141fd
lea eax, [rbp + 0x100000]
cmp eax, ebx
jl 0x1400141a4
mov eax, 0x100000
lea rcx, [rsp + 0x90]
add edi, eax
add ebx, eax
movsxd rdx, edi
call fcn.14005ba78
mov r8d, 1
lea rax, [rsp + 0x290]
movsxd rdx, ebp
lea r9, [rsp + 0xb8]
mov rcx, qword [rax]
add rdx, qword [rsp + 0x90]
mov dword [rsp + 0xb8], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, 1
cmp eax, esi
je 0x1400141fd
cmp dword [rsp + 0xb8], esi
jbe 0x1400141fd
add ebp, dword [rsp + 0xb8]
mov rax, qword [rsp + 0x90]
movsxd rcx, ebp
mov byte [rcx + rax], sil
mov al, byte [0x14011721f]
mov rcx, qword [rsp + 0x228]
mov rdx, qword [rsp + 0x1b0]
cmp al, sil
jle 0x1400140d0
mov dword [rsp + 0x20], r8d
lea rcx, [rsp + 0x6e0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
mov rcx, qword [rsp + 0x228]
mov rdx, qword [rsp + 0x1b0]
cmp eax, esi
je 0x1400140d0
cmp dword [rsp + 0x6e8], 0x12
je 0x1400140d0
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x14011721f]
mov r8d, 1
cmp r11b, sil
jg 0x14001421c
mov rcx, qword [rsp + 0x228]
mov rdx, qword [rsp + 0x1b0]
jmp 0x1400140d0
mov dword [rsp + 0xbc], ebp
mov rdi, qword [rsp + 0x2f0]
cmp dword [rsp + 0x84], 0xffffff9c
mov rax, qword [rsp + 0x90]
movsxd rcx, ebp
mov byte [rcx + rax + 2], sil
mov rax, qword [rsp + 0x90]
mov byte [rcx + rax + 1], sil
mov rax, qword [rsp + 0x90]
mov byte [rcx + rax], sil
mov dword [rsp + 0xf0], esi
je 0x140014379
cmp byte [rsp + 0x72], sil
jle 0x140014379
mov al, byte [rsp + 0x9c]
mov ecx, 1
cmp al, cl
je 0x140014379
cmp al, 2
jne 0x14001434c
mov r8d, dword [rsp + 0x248]
lea rax, [rsp + 0x338]
lea rdx, str._force__exitcode_d__tree__d
mov r9d, dword [rax + 0x10]
lea rcx, [rsp + 0x8e0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0xe00]
lea rdx, [rsp + 0x8e0]
call fcn.140038f64
jmp 0x140014379
cmp rdi, rsi
je 0x140014361
mov edx, dword [rsp + 0x248]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
mov edx, dword [rsp + 0x248]
lea rax, [rsp + 0x338]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rax, [rsp + 0x338]
lea rdx, [rsp + 0xf0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0xf0]
mov rcx, qword [rsp + 0x468]
mov dword [rcx], eax
mov dword [rsp + 0xe20], eax
cmp byte [rsp + 0x71], sil
je 0x1400146a5
mov rax, qword [rsp + 0x108]
mov ecx, 0x40
mov rbx, rsi
cmp cx, word [rax]
je 0x1400143f3
cmp byte [rsp + 0xc1], sil
je 0x1400143f3
mov ecx, 0x26
cmp word [rax], cx
je 0x1400143ec
mov rax, qword [rsp + 0xe00]
test byte [rax + 0xd], 0xf
je 0x1400143f3
mov eax, 1
jmp 0x1400143f6
mov al, sil
lea rcx, [rsp + 0x418]
mov byte [rsp + 0xe20], al
call fcn.14005b998
mov al, byte [rsp + 0xe20]
mov qword [rsp + 0x420], rsi
mov qword [rsp + 0x428], rsi
cmp al, sil
jne 0x14001460e
mov eax, dword [rsp + 0x440]
cmp al, 2
jne 0x140014451
mov rax, qword [rsp + 0x90]
movsxd rcx, ebp
mov word [rcx + rax], si
mov rbx, qword [rsp + 0x90]
jmp 0x1400144e0
mov ecx, 1
cmp al, cl
lea rcx, [rsp + 0x418]
jne 0x14001447c
movsxd r9, dword [rsp + 0x150]
mov rdx, qword [rsp + 0x90]
movsxd r8, ebp
call fcn.14005be30
jmp 0x1400144e5
lea eax, [rbp + 0x18]
movsxd rdx, eax
call fcn.14005bd74
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x418]
movsxd rax, ebp
mov qword [rsp + 0x428], rax
mov qword [rsp + 0x420], rax
lea eax, [rbp + 1]
movsxd r8, eax
call fcn.14001b6e8
mov r11, qword [rsp + 0x418]
xor edx, edx
movsxd rcx, ebp
lea r8d, [rdx + 0x10]
add rcx, r11
call fcn.1400df2a0
lea rcx, [rsp + 0x418]
mov edx, 0x2004
call fcn.1400cb778
cmp rbx, rsi
jne 0x1400144ed
mov rbx, qword [rsp + 0x418]
mov al, byte [rsp + 0x71]
mov ecx, 4
test cl, al
je 0x14001453d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2 - 2]
cmp rax, rbx
jb 0x140014607
mov ecx, 0xd
cmp cx, word [rax]
je 0x14001452c
mov edx, 0xa
cmp dx, word [rax]
jne 0x140014607
mov word [rax], si
sub rax, 2
cmp rax, rbx
jae 0x140014519
jmp 0x140014607
mov r8d, 1
test r8b, al
je 0x1400145b3
movzx eax, word [rbx]
mov rcx, qword [rsp + 0x3a0]
cmp ax, si
je 0x1400145a7
lea edi, [r8 + 1]
lea ebp, [rdi + 0xb]
cmp bp, ax
jne 0x14001457b
mov r9d, 0xa
cmp r9w, word [rbx + 2]
jne 0x14001457b
cmp rcx, r8
jle 0x140014585
add rbx, rdi
jmp 0x140014585
mov edx, 0xa
cmp dx, ax
jne 0x14001458d
sub rcx, r8
cmp rcx, rsi
jle 0x140014598
add rbx, rdi
mov ax, word [rbx]
cmp ax, si
jne 0x14001455f
mov rdi, qword [rsp + 0x2f0]
mov ebp, dword [rsp + 0xbc]
mov word [rbx], si
mov al, byte [rsp + 0xe20]
jmp 0x140014614
test al, 2
je 0x1400145aa
movzx eax, word [rbx]
cmp ax, si
je 0x1400145aa
mov ecx, 0xd
lea edi, [rcx - 3]
cmp ax, cx
je 0x1400145d7
cmp ax, di
je 0x1400145d7
add rbx, 2
jmp 0x1400145f7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [rbx + 2]
mov rcx, rbx
movsxd r8, eax
add r8, r8
call fcn.14001b6a0
mov ecx, 0xd
mov ax, word [rbx]
cmp ax, si
jne 0x1400145c7
mov rdi, qword [rsp + 0x2f0]
mov al, byte [rsp + 0xe20]
mov r8d, 1
mov rdx, qword [rsp + 0x108]
mov ecx, 0x40
cmp cx, word [rdx]
mov rcx, qword [rsp + 0xe00]
jne 0x140014659
mov rax, qword [rsp + 0x418]
mov rdx, qword [rsp + 0x550]
lea r9, [0x1400fb538]
mov qword [rsp + 0x28], rax
mov r8, rdx
mov qword [rsp + 0x20], rax
call fcn.140057434
jmp 0x14001468f
cmp al, sil
je 0x140014682
mov byte [rsp + 0x28], r8b
mov r8, qword [rsp + 0x90]
lea rax, [rsp + 0x90]
mov r9d, ebp
mov qword [rsp + 0x20], rax
call fcn.14006b08c
jmp 0x14001468f
mov r8, qword [rsp + 0x418]
call fcn.14005b2f4
lea rcx, [rsp + 0x418]
call fcn.140053e80
mov ebp, dword [rsp + 0xf0]
jmp 0x1400146ac
mov ebp, dword [rsp + 0xe20]
lea rdx, [0x1400fc490]
lea rcx, [rsp + 0x8a0]
mov r8d, ebp
mov word [rsp + 0x8a0], si
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0x8a0]
lea rdx, [0x1400fc470]
call fcn.14005b2f4
cmp rdi, rsi
je 0x14001470d
mov al, byte [rsp + 0x9c]
mov ecx, 1
cmp al, cl
je 0x14001470d
mov edx, dword [rsp + 0x248]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
lea rcx, [rsp + 0x90]
call fcn.140053e80
mov rbx, qword [rsp + 0x2b8]
jmp 0x140014745
mov rdx, qword [rsp + 0x108]
cmp word [rdx], si
je 0x140014745
mov rcx, qword [rsp + 0xe00]
lea r8, [0x1400fb538]
call fcn.14005b2f4
mov edx, dword [rsp + 0x84]
mov rcx, qword [rsp + 0xe38]
cmp rcx, rsi
je 0x140014767
lea rax, [rsp + 0x338]
mov rax, qword [rax]
mov qword [rcx], rax
lea rax, [rsp + 0x338]
mov qword [rax], rsi
cmp byte [rsp + 0x88], sil
je 0x140014946
cmp dword [rax + 0x10], esi
je 0x140014946
cmp byte [0x140119a41], sil
jne 0x140014946
mov eax, 1
mov byte [0x140119a41], al
cmp edx, esi
jne 0x14001491a
lea rcx, [rsp + 0x230]
mov edx, 0x1000
call fcn.14005bce8
mov rax, qword [rsp + 0x230]
mov dword [rsp + 0x7c], esi
mov word [rax], si
lea rax, [rsp + 0x7c]
lea r9, [rsp + 0x230]
lea r8, str.SystemStartOptions
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140060e4c
mov r11, qword [rsp + 0x230]
lea rcx, [rsp + 0x278]
mov qword [rsp + 0x278], r11
call fcn.140053eb0
jmp 0x140014860
lea rcx, str.PECMDHB
mov r8d, 8
mov rdx, r11
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, esi
je 0x140014870
mov rdx, qword [rsp + 0x278]
lea rcx, str.WIMHB
mov r8d, 6
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
cmp eax, esi
je 0x140014870
lea rcx, [rsp + 0x278]
call fcn.140006e80
mov r11, qword [rsp + 0x278]
cmp word [r11], si
jne 0x14001481a
jmp 0x14001487c
mov eax, 1
mov dword [rsp + 0x84], eax
lea rcx, [rsp + 0x230]
call fcn.140053e80
cmp dword [rsp + 0x84], esi
jne 0x14001491a
lea rax, [rsp + 0x338]
lea rdx, str.__nfb__incmd_pecmd_TEAM_WAIT__InitSys__ncd__lu
lea rcx, [rsp + 0xaf0]
mov r8d, dword [rax + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0xe00]
lea r8, [rsp + 0xaf0]
lea rdx, str.DELAY_bwinpeshl____s__r_n
call fcn.140017284
lea rax, [0x140119920]
lea r9, [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xe00]
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0xaf0]
mov r8, rax
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov word [rsp + 0xa0], si
mov dword [rsp + 0x20], esi
call fcn.14000d060
jmp 0x14001493e
call fcn.1400238ac
cmp eax, esi
je 0x140014937
mov rcx, qword [rsp + 0xe00]
lea rdx, str.exec
call fcn.140023970
xor ecx, ecx
call fcn.14002b128
lea rax, [rsp + 0x338]
mov rcx, qword [rsp + 0x168]
cmp rcx, rsi
je 0x140014960
cmp word [rcx], si
je 0x140014960
mov edx, dword [rax + 0x10]
call fcn.1400046dc
lea rax, [rsp + 0x158]
cmp qword [rax], rsi
je 0x14001497e
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x158]
mov qword [rax], rsi
lea rax, [rsp + 0x1e0]
cmp qword [rax], rsi
je 0x14001499f
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x1e0]
mov qword [rax], rsi
lea rax, [rsp + 0x238]
cmp qword [rax], rsi
je 0x1400149bf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x238]
mov qword [rax], rsi
lea rax, [rsp + 0x288]
cmp qword [rax], rsi
je 0x1400149e0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x288]
mov qword [rax], rsi
lea rax, [rsp + 0x290]
cmp qword [rax], rsi
je 0x140014a01
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x290]
mov qword [rax], rsi
lea rax, [rsp + 0x310]
cmp qword [rax], rsi
je 0x140014a22
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x310]
mov rcx, qword [rsp + 0x520]
mov qword [rax], rsi
cmp rcx, rsi
je 0x140014a38
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x338]
mov rcx, qword [rax + 8]
cmp rcx, rsi
je 0x140014a57
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x338]
mov rcx, qword [rsp + 0xe00]
xor edx, edx
mov qword [rax + 8], rsi
call fcn.14008fc94
lea rcx, [rsp + 0x2f8]
call fcn.140053e80
lea rcx, [rsp + 0x200]
call fcn.140053e80
cmp rbx, rsi
je 0x140014a98
cmp rbx, 0xffffffffffffffff
je 0x140014a98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x1e8]
call fcn.140053e80
mov rcx, qword [rsp + 0xf8]
cmp rcx, rsi
je 0x140014abe
cmp rcx, 0xffffffffffffffff
je 0x140014abe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0xf8], rsi
cmp rcx, rsi
je 0x140014adf
cmp rcx, 0xffffffffffffffff
je 0x140014adf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x238]
mov qword [rsp + 0xc8], rsi
cmp rcx, rsi
je 0x140014b00
cmp rcx, 0xffffffffffffffff
je 0x140014b00
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1e0]
cmp rcx, rsi
je 0x140014b19
cmp rcx, 0xffffffffffffffff
je 0x140014b19
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x158]
cmp rcx, rsi
je 0x140014b32
cmp rcx, 0xffffffffffffffff
je 0x140014b32
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x310]
cmp rcx, rsi
je 0x140014b4b
cmp rcx, 0xffffffffffffffff
je 0x140014b4b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x288]
cmp rcx, rsi
je 0x140014b64
cmp rcx, 0xffffffffffffffff
je 0x140014b64
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x290]
cmp rcx, rsi
je 0x140014b7d
cmp rcx, 0xffffffffffffffff
je 0x140014b7d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x168]
call fcn.140053e80
lea rcx, [rsp + 0x3f8]
call fcn.140053e80
lea rcx, [rsp + 0x1d8]
call fcn.140053e80
lea rcx, [rsp + 0x148]
call fcn.140053e80
lea rcx, [rsp + 0x1f8]
call fcn.140053e80
lea rcx, [rsp + 0x1b8]
call fcn.140053e80
lea rcx, [rsp + 0x208]
call fcn.140053e80
lea rcx, [rsp + 0x218]
call fcn.140053e80
lea rcx, [rsp + 0x170]
call fcn.140053e80
cmp rdi, rsi
je 0x140014c06
cmp rdi, 0xffffffffffffffff
je 0x140014c06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x4b8]
cmp rax, rsi
je 0x140014c22
cmp rax, 0xffffffffffffffff
je 0x140014c22
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x3b8]
call fcn.140005fd0
lea rcx, [rsp + 0x1a8]
call fcn.140053e80
lea rcx, [rsp + 0x110]
call fcn.140053e80
lea rcx, [rsp + 0x130]
call fcn.140053e80
lea rcx, [rsp + 0x108]
call fcn.140053e80
lea rcx, [rsp + 0x188]
call fcn.140053e80
lea rcx, [rsp + 0x160]
call fcn.140053e80
lea rcx, [rsp + 0x180]
call fcn.140053e80
lea rcx, [rsp + 0x190]
call fcn.140053e80
mov rbx, rbp
jmp 0x140014d16
lea rcx, [rsp + 0x3b8]
call fcn.140005fd0
lea rcx, [rsp + 0x1a8]
call fcn.140053e80
lea rcx, [rsp + 0x110]
call fcn.140053e80
lea rcx, [rsp + 0x130]
call fcn.140053e80
lea rcx, [rsp + 0x108]
call fcn.140053e80
lea rcx, [rsp + 0x188]
call fcn.140053e80
lea rcx, [rsp + 0x160]
call fcn.140053e80
lea rcx, [rsp + 0x180]
call fcn.140053e80
lea rcx, [rsp + 0x190]
call fcn.140053e80
mov ebx, 1
lea rcx, [rsp + 0x438]
call fcn.140053e80
lea rcx, [rsp + 0x3d0]
call fcn.140053e80
mov rax, rbx
add rsp, 0xdd8
pop rdi
pop rsi
pop rbp
pop rbx
ret