Function at 0x56d5ce
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6d8
movaps xmmword [rsp + 0x6c0], xmm6
mov byte [rsp + 0x238], r9b
mov qword [rsp + 0x60], r8
mov rsi, rdx
mov qword [rsp + 0x90], rcx
cmp byte [rdx + 0x68], 0
mov qword [rsp + 0x68], rdx
je 0x56d623
and qword [rsp + 0x138], 0
and qword [rsp + 0x148], 0
jmp 0x56d79f
cmp qword [rsi + 0x60], 0
je 0x56e011
and qword [rsp + 0x138], 0
and qword [rsp + 0x148], 0
call sub.kernel32.dll_GetEnvironmentStringsW
test rax, rax
je 0x56fcc5
lea rbx, [rsp + 0x2e0]
lea r14, [rsp + 0x150]
lea r15, [rsp + 0x2c0]
lea r13, [rsp + 0x138]
mov qword [rsp + 0x78], rax
mov rdi, rax
mov rbp, rdi
cmp word [rdi], 0
je 0x56d790
mov rdx, 0xfffffffffffffffe
xor ecx, ecx
mov rsi, rcx
mov rax, rdx
inc rcx
add rdx, 2
cmp word [rbp + rsi*2], 0
jne 0x56d68c
test rsi, rsi
je 0x56fcca
lea rdi, [rcx*2]
add rdi, rbp
xor r12d, r12d
test rax, rax
je 0x56d676
cmp word [rbp + r12*2 + 2], 0x3d
je 0x56d6cf
inc r12
add rax, 0xfffffffffffffffe
jmp 0x56d6b8
cmp r12, rsi
jae 0x56fcca
lea r8, [r12 + 1]
mov rcx, r14
mov rdx, rbp
call fcn.0056a64c
add r12, 2
sub rsi, r12
jb 0x56fcca
lea rdx, [r12*2]
add rdx, rbp
mov rcx, rbx
mov r8, rsi
call fcn.0056a64c
movups xmm0, xmmword [rsp + 0x150]
movups xmm1, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x2c0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [rsp + 0x2e0]
movaps xmm1, xmmword [rsp + 0x2f0]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm1
cmp byte [rsp + 0xd8], 2
je 0x56d790
mov rcx, r15
lea rdx, [rsp + 0xc0]
call fcn.0056c92f
mov rcx, r14
mov rdx, r13
mov r8, r15
lea r9, [rsp + 0xe0]
call fcn.00572a9b
mov rcx, r14
call fcn.0055d67f
jmp 0x56d676
mov rcx, qword [rsp + 0x78]
call sub.kernel32.dll_FreeEnvironmentStringsW
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x56d7e9
mov rdx, qword [rsi + 0x58]
and qword [rsp + 0x1b8], 0
mov qword [rsp + 0x1c0], rcx
mov qword [rsp + 0x1c8], rdx
and qword [rsp + 0x1d8], 0
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x1e0], rcx
mov qword [rsp + 0x1e8], rdx
mov ecx, 1
jmp 0x56d7ed
xor ecx, ecx
xor eax, eax
lea rdx, [rsp + 0x1b0]
mov qword [rdx], rcx
mov qword [rdx + 0x20], rcx
lea r13, [rsp + 0x2d8]
lea rbp, [rsp + 0x2c0]
lea rbx, [rsp + 0xc0]
lea r15, [rsp + 0x150]
xorps xmm6, xmm6
test rax, rax
je 0x56dd3b
dec rax
mov qword [rsp + 0x1f0], rax
lea rcx, [rsp + 0x1b0]
call fcn.00570e7a
test rax, rax
je 0x56fcca
mov rdi, rax
mov rcx, rbp
mov rdx, rax
call fcn.00570ec0
mov rsi, qword [rsp + 0x2c0]
test rsi, rsi
je 0x56fcca
mov rax, qword [rsp + 0x2c8]
mov r12, qword [rsp + 0x2d0]
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], r12
mov rcx, rbp
mov rdx, rbx
call fcn.00570f0d
imul rax, r12, 0x38
lea r14, [rsi + rax]
add r14, 0x168
shl r12, 5
mov rax, qword [rsp + 0x2d0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x2c0]
movups xmmword [rdi], xmm0
cmp byte [rsi + r12 + 0x18], 2
jne 0x56d963
mov rdx, qword [rsp + 0x138]
test rdx, rdx
je 0x56dc8e
mov r8, qword [rsp + 0x140]
mov r9, qword [r14]
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x270]
call fcn.00572303
cmp qword [rsp + 0x270], 0
jne 0x56dc8e
mov rcx, qword [rsp + 0x278]
mov rax, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x288]
mov byte [rsp + 0x5b], 0
test rax, rax
je 0x56db75
lea rcx, [rcx + rdx*8]
add rcx, 0x3d8
dec rax
mov rcx, qword [rcx]
movzx edx, word [rcx + 0x3d2]
sub rax, 1
jb 0x56d9aa
lea rcx, [rcx + rdx*8]
add rcx, 0x3d8
jmp 0x56d946
add rsi, r12
lea rdx, [r14 + 0x18]
mov rcx, r13
call fcn.0056fcce
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
mov rcx, rbp
call fcn.0056acbc
mov rcx, rbx
mov rdx, rsi
call fcn.0056fcce
mov rcx, r15
lea rdx, [rsp + 0x138]
mov r8, rbp
mov r9, rbx
call fcn.00572a9b
mov rcx, r15
jmp 0x56dc99
dec rdx
mov qword [rsp + 0x2a8], rcx
and qword [rsp + 0x2b0], 0
mov qword [rsp + 0x2b8], rdx
mov rcx, rbp
lea rdx, [rsp + 0x2a8]
lea r8, [rsp + 0x5b]
call fcn.005723cd
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x230], rax
movups xmm0, xmmword [rsp + 0x2c0]
movups xmm1, xmmword [rsp + 0x2d0]
movups xmm2, xmmword [rsp + 0x2e0]
movaps xmmword [rsp + 0x220], xmm2
movaps xmmword [rsp + 0x210], xmm1
movaps xmmword [rsp + 0x200], xmm0
movups xmm0, xmmword [r13 + 0x20]
movups xmm1, xmmword [r13 + 0x30]
movaps xmmword [rsp + 0x240], xmm0
movaps xmmword [rsp + 0x250], xmm1
movups xmm0, xmmword [r13 + 0x40]
movaps xmmword [rsp + 0x290], xmm0
mov rax, qword [r13 + 0x50]
mov qword [rsp + 0x2a0], rax
mov rcx, rbp
lea rdx, [rsp + 0x290]
call fcn.00570ec0
mov rcx, qword [rsp + 0x2c0]
mov rax, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2d0]
imul r8, rdx, 0x38
mov r9, rdx
shl r9, 5
mov r10, qword [rcx + r8 + 0x198]
mov qword [rsp + 0x180], r10
movups xmm0, xmmword [rcx + r8 + 0x168]
movups xmm1, xmmword [rcx + r8 + 0x178]
movups xmm2, xmmword [rcx + r8 + 0x188]
movaps xmmword [rsp + 0x170], xmm2
movaps xmmword [rsp + 0x160], xmm1
movaps xmmword [rsp + 0x150], xmm0
mov r10, qword [rsp + 0x230]
mov qword [rcx + r8 + 0x198], r10
movaps xmm0, xmmword [rsp + 0x200]
movaps xmm1, xmmword [rsp + 0x210]
movaps xmm2, xmmword [rsp + 0x220]
movups xmmword [rcx + r8 + 0x188], xmm2
movups xmmword [rcx + r8 + 0x178], xmm1
movups xmmword [rcx + r8 + 0x168], xmm0
movups xmm0, xmmword [rcx + r9]
movups xmm1, xmmword [rcx + r9 + 0x10]
lea r8, [rsp + 0x188]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
movaps xmm0, xmmword [rsp + 0x240]
movaps xmm1, xmmword [rsp + 0x250]
movups xmmword [rcx + r9], xmm0
movups xmmword [rcx + r9 + 0x10], xmm1
inc rdx
test rax, rax
je 0x56dba0
lea rcx, [rcx + rdx*8]
add rcx, 0x3d8
mov rdx, qword [rcx]
lea rcx, [rdx + 0x3d8]
dec rax
jne 0x56db51
mov qword [rsp + 0x118], rdx
lea rax, [rsp + 0x120]
movups xmmword [rax], xmm6
jmp 0x56dbb9
mov qword [rsp + 0x2c0], rcx
and qword [rsp + 0x2c8], 0
mov qword [rsp + 0x2d0], rdx
mov rcx, rbx
mov rdx, rbp
lea r8, [rsp + 0x5b]
call fcn.005723cd
jmp 0x56dbc7
mov qword [rsp + 0x118], rcx
and qword [rsp + 0x120], 0
mov qword [rsp + 0x128], rdx
mov ecx, 0xb
mov rdi, rbx
mov rsi, r15
rep movsq qword [rdi], qword [rsi]
movups xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0xd0]
movups xmm2, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x170], xmm2
movaps xmmword [rsp + 0x160], xmm1
movaps xmmword [rsp + 0x150], xmm0
mov sil, byte [rsp + 0xf0]
lea rax, [rsp + 0x120]
movups xmm0, xmmword [rax - 0x2f]
movups xmm1, xmmword [rax - 0x1f]
movaps xmmword [rsp + 0x200], xmm0
movaps xmmword [rsp + 0x210], xmm1
dec qword [rsp + 0x148]
mov rax, qword [rax - 0x10]
mov qword [rsp + 0x21f], rax
cmp byte [rsp + 0x5b], 0
je 0x56dc88
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x56fcca
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x56fcca
mov rdx, qword [rcx + 0x3d8]
mov qword [rsp + 0x138], rdx
dec rax
mov qword [rsp + 0x140], rax
and qword [rdx + 0x160], 0
mov edx, 8
call fcn.00414d20
cmp sil, 2
jne 0x56dcab
mov byte [rsp + 0xd8], 2
mov rcx, rbx
call fcn.0055d67f
mov rax, qword [rsp + 0x1f0]
jmp 0x56d81f
movaps xmm0, xmmword [rsp + 0x150]
movaps xmm1, xmmword [rsp + 0x160]
movaps xmm2, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x2e0], xmm2
movaps xmmword [rsp + 0x2d0], xmm1
movaps xmmword [rsp + 0x2c0], xmm0
mov byte [rsp + 0x2f0], sil
mov rax, qword [rsp + 0x21f]
mov qword [r13 + 0x38], rax
movaps xmm0, xmmword [rsp + 0x200]
movaps xmm1, xmmword [rsp + 0x210]
movups xmmword [r13 + 0x29], xmm1
movups xmmword [r13 + 0x19], xmm0
movups xmm0, xmmword [r13 + 0x20]
mov rax, qword [r13 + 0x30]
mov rcx, qword [r13 + 0x38]
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rcx
mov rcx, rbp
call fcn.0056a9d2
jmp 0x56dc96
mov rsi, qword [rsp + 0x138]
mov r14, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
xor r12d, r12d
mov ecx, 4
xor edx, edx
call fcn.00433a18
mov dword [rax], 0x48544150
lea r8, [rsp + 0xc0]
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov qword [r8 + 0x10], 4
mov byte [r8 + 0x18], 0
lea rcx, [rsp + 0x2c0]
mov rdx, r8
call fcn.0056c92f
test rsi, rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0xa8], r14
je 0x56dde1
mov r9, qword [rsp + 0x2c0]
mov rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov rdx, rsi
mov r8, r14
call fcn.00572303
cmp qword [rdi], 0
mov rsi, qword [rsp + 0x68]
je 0x56dde8
xor r12d, r12d
jmp 0x56de05
mov rsi, qword [rsp + 0x68]
jmp 0x56de05
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd8]
shl rcx, 5
mov r12, qword [rax + rcx]
mov r13, qword [rax + rcx + 0x10]
lea rcx, [rsp + 0x2c0]
call fcn.0056a9d2
xor edi, edi
mov r15, qword [rsi + 0x30]
mov r14, qword [rsi + 0x40]
mov qword [rsp + 0x240], r15
mov qword [rsp + 0x248], r14
lea rsi, str.program_path_has_no_file_name
test r14, r14
je 0x56de6f
lea r8, str.__UNC._
mov r9d, 4
mov rcx, r15
mov rdx, r14
call fcn.00563284
lea rcx, [0x00574c11]
lea rdx, [0x00574c02]
test al, al
cmovne rdx, rcx
mov cl, byte [r14 + r15 - 1]
call rdx
test al, al
je 0x56ded7
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x78]
mov rax, qword [rsp + 0x90]
mov qword [rax], rsi
mov qword [rax + 0x10], 2
test dil, dil
jne 0x56df04
test r13, r13
je 0x56dee8
and qword [rsp + 0x2c8], 0
mov qword [rsp + 0x2d0], r13
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x2d8], rax
and qword [rsp + 0x2e8], 0
mov qword [rsp + 0x2f0], r13
mov qword [rsp + 0x2f8], rax
mov eax, 1
jmp 0x56deec
cmp r14, 4
mov dword [rsp + 0x54], edi
jae 0x56df2c
xor eax, eax
jmp 0x56dfbf
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x2c0]
mov qword [rcx], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x40], rbx
call fcn.00573537
mov ecx, dword [r15]
mov rdx, qword [r15 + 8]
call fcn.0056d5c0
movaps xmm6, xmmword [rsp + 0x6c0]
add rsp, 0x6d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rbp, rbx
lea rdx, [r14 + r15]
add rdx, 0xfffffffffffffffc
mov qword [rsp + 0x20], 4
lea r9, str..exeprogram_not_found
lea rdi, [rsp + 0x2c0]
mov r8d, 4
mov rcx, rdi
call fcn.0057189f
mov rcx, qword [rdi + 0x28]
mov r9, qword [rdi + 0x20]
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r9, rcx
setae al
jae 0x56dfa8
mov r10b, byte [rdx + r9]
mov r11b, byte [r8 + r9]
inc r9
lea esi, [r10 - 0x41]
cmp sil, 0x1a
setb bl
shl bl, 5
or bl, r10b
lea r10d, [r11 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
or r10b, r11b
cmp bl, r10b
je 0x56df6c
mov r15, qword [rsp + 0x240]
mov r14, qword [rsp + 0x248]
mov rbx, rbp
mov edi, dword [rsp + 0x54]
lea rcx, [r15 + r14]
xor edx, edx
mov qword [rsp + 0x98], rbx
cmp r14, rdx
je 0x56e01c
movzx r8d, byte [r15 + rdx]
cmp r8d, 0x5c
je 0x56dfe6
inc rdx
cmp r8d, 0x2f
jne 0x56dfcd
test al, al
je 0x56e061
lea rcx, [rsp + 0x200]
mov rdx, r15
mov r8, r14
call fcn.0056fd91
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
jmp 0x56e698
mov dil, 1
xor r12d, r12d
jmp 0x56de14
lea rsi, [rsp + 0x2c0]
mov qword [rsi], r15
mov qword [rsi + 8], rcx
and word [rsi + 0x10], 0
mov rcx, rsi
call fcn.00569f98
cmp ax, 1
jne 0x56e043
test dx, dx
jne 0x56e030
cmp ax, 1
jne 0x56e17b
lea rsi, [0x00773460]
mov rbx, qword [rsp + 0x98]
jmp 0x56de6f
mov rcx, r14
xor edx, edx
call fcn.00433a18
mov rdi, rax
mov rbx, rdx
mov rcx, rax
mov rdx, r15
mov r8, r14
call sub.ntdll.dll_memcpy
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], r14
mov byte [rsp + 0xd8], 0
mov rax, qword [rsp + 0xd0]
mov cl, byte [rsp + 0xd8]
mov edx, dword [rsp + 0xd9]
movzx r8d, word [rsp + 0xdd]
mov r9b, byte [rsp + 0xdf]
lea rdi, [rsp + 0x2c0]
mov qword [rdi + 0x10], rax
mov byte [rdi + 0x18], cl
mov dword [rdi + 0x19], edx
mov word [rdi + 0x1d], r8w
mov byte [rdi + 0x1f], r9b
mov rax, qword [rsp + 0xc0]
mov qword [rdi], rax
mov rax, qword [rsp + 0xc8]
mov qword [rdi + 8], rax
lea rdx, str..exeprogram_not_found
mov r8d, 4
mov rcx, rdi
call fcn.00573601
movaps xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmmword [rsp + 0xd0], xmm1
movaps xmmword [rsp + 0xc0], xmm0
mov rdi, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xd0]
lea rbx, [rsp + 0x2c0]
mov rcx, rbx
mov rdx, rdi
call fcn.0056fd25
cmp qword [rbx], 0
mov r13, qword [rsp + 0x78]
je 0x56e290
mov rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x210], rax
movups xmm0, xmmword [rsp + 0x2c0]
movaps xmmword [rsp + 0x200], xmm0
jmp 0x56e2c1
mov rcx, r15
mov rdx, r14
mov r8b, 0x2e
call fcn.005701da
mov byte [rsp + 0x270], al
test r12, r12
je 0x56e2ed
add r13, r12
lea r14, [rsp + 0x150]
mov qword [r14], r12
mov qword [r14 + 8], r13
and word [r14 + 0x10], 0
mov byte [r14 + 0x18], 1
lea r13, [rsp + 0xd9]
lea rbp, [rsp + 0x2d9]
lea r15, [rsp + 0x2c0]
lea rbx, [rsp + 0x240]
lea rdi, [rsp + 0xc0]
mov rcx, r15
mov rdx, r14
call fcn.0056d14a
mov al, byte [rsp + 0x2d8]
cmp al, 2
je 0x56e2e0
cmp qword [rsp + 0x2d0], 0
je 0x56e276
mov rcx, qword [rsp + 0x2d0]
mov qword [rsp + 0xd0], rcx
movups xmm0, xmmword [rsp + 0x2c0]
movaps xmmword [rsp + 0xc0], xmm0
mov ecx, dword [rbp]
mov edx, dword [rbp + 3]
mov dword [r13 + 3], edx
mov dword [r13], ecx
mov byte [rsp + 0xd8], al
mov rcx, r15
mov rdx, rbx
lea r8, [rsp + 0x270]
mov r9, rdi
call fcn.00570219
mov rsi, qword [rsp + 0x2c0]
mov r12, qword [rsp + 0x2c8]
test rsi, rsi
jne 0x56e39e
xor ecx, ecx
mov rdx, r12
call fcn.0040256e
jmp 0x56e1de
mov rcx, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2c8]
call fcn.00433bdd
jmp 0x56e1de
lea rdx, [0x00799ab8]
lea rbx, [rsp + 0xc0]
mov rcx, rbx
xor r8d, r8d
call fcn.0057460b
mov rdi, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x200]
mov rdx, rdi
call fcn.0056fd91
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
call fcn.00433bdd
jmp 0x56e694
lea rcx, [rsp + 0x2c0]
call fcn.0055d67f
lea rdi, [rsp + 0xc0]
mov rcx, rdi
call fcn.0056cdbf
cmp byte [rdi + 0x18], 2
jne 0x56e315
lea rcx, [rsp + 0xc0]
call fcn.0056a61b
jmp 0x56e3b5
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xd0]
mov rcx, rdi
mov rdx, r14
call fcn.00574556
cmp r14, rdx
cmovb rdx, r14
test rax, rax
cmove rdx, r14
lea r9, [rsp + 0x2c0]
mov qword [r9], rdi
mov qword [r9 + 8], rsi
mov qword [r9 + 0x10], rdx
mov rax, qword [rsp + 0xd8]
mov qword [r9 + 0x18], rax
lea rdi, [rsp + 0x150]
lea rdx, [rsp + 0x240]
lea r8, [rsp + 0x270]
mov rcx, rdi
call fcn.00570219
mov rsi, qword [rdi]
mov r12, qword [rdi + 8]
test rsi, rsi
je 0x56e3ab
mov rdi, qword [rsp + 0x160]
jmp 0x56e66d
mov rdi, qword [rsp + 0x2d0]
jmp 0x56e66d
xor ecx, ecx
mov rdx, r12
call fcn.0040256e
lea rax, [rsp + 0x1b0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov r15d, 2
xor r14d, r14d
mov ebx, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x56e3fd
lea r13, [rsp + 0x2c0]
mov esi, 0x200
mov rdi, r8
jmp 0x56e43e
sub r8, r12
lea rcx, [rsp + 0x1b0]
mov rdx, r8
call fcn.0056a634
mov r15, qword [rsp + 0x1b0]
mov r14, qword [rsp + 0x1b8]
cmp r14, rbx
mov r12d, 0xffffffff
cmovb r12, r14
mov qword [rsp + 0x1c0], r12
mov r13, r15
mov rsi, r12
mov rdi, r12
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r13
mov edx, edi
call sub.kernel32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x56e462
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x56e4f7
mov r8d, ebp
cmp rdi, r8
jne 0x56e494
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x56fcca
add rdi, rdi
mov eax, 0xffffffff
cmp rdi, rax
mov ebx, 0xffffffff
cmovae rdi, rax
mov r8, rdi
jmp 0x56e3e2
jb 0x56e3e2
cmp rsi, r8
jb 0x56fcca
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov rdx, r13
call fcn.0056a64c
lea rbx, [rsp + 0x158]
lea rdx, [rsp + 0x240]
lea r8, [rsp + 0x270]
mov rcx, rbx
mov r9, rdi
call fcn.00570219
and qword [rbx - 8], 0
mov rcx, r15
mov rdx, r14
call fcn.0057667d
mov rsi, qword [rbx]
test rsi, rsi
jne 0x56e65d
jmp 0x56e51b
call fcn.00569a3f
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], 1
mov rcx, r15
mov rdx, r14
call fcn.0057667d
lea rcx, [rsp + 0x150]
call fcn.0057027a
lea rax, [rsp + 0x1b0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov r14d, 2
xor ebx, ebx
mov r13d, 0xffffffff
xor esi, esi
cmp r8, 0x201
jae 0x56e570
lea r12, [rsp + 0x2c0]
mov r15d, 0x200
mov rdi, r8
jmp 0x56e5b0
sub r8, rsi
lea rcx, [rsp + 0x1b0]
mov rdx, r8
call fcn.0056a634
mov r14, qword [rsp + 0x1b0]
mov rbx, qword [rsp + 0x1b8]
cmp rbx, r13
mov esi, 0xffffffff
cmovb rsi, rbx
mov qword [rsp + 0x1c0], rsi
mov r12, r14
mov r15, rsi
mov rdi, rsi
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r12
mov edx, edi
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x56e5d4
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x56ebc0
mov r8d, ebp
cmp rdi, r8
jne 0x56e5fc
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x56fcca
add rdi, rdi
cmp rdi, r13
cmovae rdi, r13
mov r8, rdi
jmp 0x56e554
jb 0x56e554
cmp r15, r8
jb 0x56fcca
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov rdx, r12
call fcn.0056a64c
lea r15, [rsp + 0x158]
lea rdx, [rsp + 0x240]
lea r8, [rsp + 0x270]
mov rcx, r15
mov r9, rdi
call fcn.00570219
and qword [r15 - 8], 0
mov rcx, r14
mov rdx, rbx
call fcn.0057667d
mov rsi, qword [r15]
test rsi, rsi
je 0x56ebe4
mov r12, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x168]
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], r12
mov qword [rsp + 0x210], rdi
mov r13, qword [rsp + 0x78]
mov edi, dword [rsp + 0x54]
mov rbp, qword [rsp + 0x200]
test rbp, rbp
je 0x56e794
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0xb8], rax
mov rdx, qword [rsp + 0x210]
cmp rdx, 4
jbe 0x56e6db
cmp word [rbp + rdx*2 - 0xa], 0x2e
jne 0x56e6db
cmp word [rbp + rdx*2 - 2], 0
je 0x56e910
mov r14, qword [rbx + 0x30]
mov r15, qword [rbx + 0x90]
mov rax, rbx
mov bl, byte [rbx + 0xc5]
mov r12, qword [rax + 0x40]
add r12, r14
imul rsi, qword [rax + 0xa0], 0x28
lea rdi, [rsp + 0xc0]
mov qword [rdi], 2
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
mov rcx, rdi
mov dx, 0x22
call fcn.0056ac3c
lea rdx, [rsp + 0x2c0]
mov qword [rdx], r14
mov qword [rdx + 8], r12
and word [rdx + 0x10], 0
mov rcx, rdi
call fcn.0056ad59
mov rcx, rdi
mov dx, 0x22
call fcn.0056ac3c
test rsi, rsi
je 0x56e7a9
lea r12, [r15 + 0x28]
mov rcx, rdi
mov dx, 0x20
call fcn.0056ac3c
mov rcx, rdi
mov rdx, r15
mov r8d, ebx
call fcn.00570299
add rsi, 0xffffffffffffffd8
mov r15, r12
test rax, rax
je 0x56e748
mov r14, rax
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
call fcn.0057667d
jmp 0x56e8d7
mov rsi, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x98]
jmp 0x56de79
mov rax, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
test rax, rax
je 0x56e8d7
mov rdx, qword [rsp + 0xd0]
mov cl, 1
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0xa4], 0
mov qword [rsp + 0x80], rbp
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov esi, dword [rsp + 0x54]
lea rcx, [rsp + 0x290]
mov qword [rcx], rax
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rdx
xor edi, edi
xor edx, edx
call fcn.0056ac3c
cmp byte [rbx + 0xc4], 0
mov eax, 0x400
mov ecx, 0x608
cmove ecx, eax
or ecx, dword [rbx + 0xc0]
mov dword [rsp + 0x54], ecx
mov r14d, 2
mov eax, 2
mov r12d, 0
test sil, sil
mov qword [rsp + 0x70], rbp
jne 0x56eb66
mov qword [rsp + 0x200], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x208], xmm0
mov rsi, qword [rsp + 0x98]
test rsi, rsi
jne 0x56e88d
lea rcx, [rsp + 0x200]
xor edx, edx
call fcn.0056ac3c
test r13, r13
mov rax, qword [rsp + 0xa8]
je 0x56e93e
and qword [rsp + 0x2c8], 0
mov qword [rsp + 0x2d0], r13
mov qword [rsp + 0x2d8], rax
and qword [rsp + 0x2e8], 0
mov qword [rsp + 0x2f0], r13
mov qword [rsp + 0x2f8], rax
mov eax, 1
jmp 0x56e942
mov r15, qword [rsp + 0x60]
mov edi, dword [rsp + 0x54]
mov rax, qword [rsp + 0x90]
mov qword [rax], r14
mov qword [rax + 0x10], 2
mov rbx, qword [rsp + 0x98]
mov rcx, rbp
mov rdx, qword [rsp + 0xb8]
call fcn.0057667d
jmp 0x56de8c
movzx eax, word [rbp + rdx*2 - 8]
cmp eax, 0x42
je 0x56eef9
cmp eax, 0x43
je 0x56ef1d
cmp eax, 0x62
je 0x56eef9
cmp eax, 0x63
je 0x56ef1d
jmp 0x56e6db
xor eax, eax
xor esi, esi
lea rcx, [rsp + 0x2c0]
mov qword [rcx], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x40], rsi
lea rbp, [rsp + 0xd9]
lea r13, [rsp + 0xc0]
lea r14, [rsp + 0x150]
lea r12, [rsp + 0x200]
mov rcx, r13
lea rdx, [rsp + 0x2c0]
call fcn.00570f89
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x56eb28
mov rdx, qword [rsp + 0xd0]
imul r8, rdx, 0x38
mov al, byte [rcx + r8 + 0x198]
cmp al, 2
je 0x56eb28
mov r15, r12
add r8, rcx
add r8, 0x168
mov r12, qword [r8]
mov r9, qword [r8 + 8]
mov qword [rsp + 0x78], r9
mov rdi, qword [r8 + 0x10]
shl rdx, 5
lea r9, [rcx + rdx]
mov rsi, qword [rcx + rdx]
mov rcx, qword [rcx + rdx + 8]
mov qword [rsp + 0xa8], rcx
mov rcx, qword [r8 + 0x28]
mov qword [rsp + 0xd0], rcx
movups xmm0, xmmword [r8 + 0x18]
movaps xmmword [rsp + 0xc0], xmm0
mov ecx, dword [r8 + 0x31]
mov edx, dword [r8 + 0x34]
mov dword [rbp + 3], edx
mov dword [rbp], ecx
movups xmm0, xmmword [r9 + 0x10]
movaps xmmword [rsp + 0x240], xmm0
mov byte [rsp + 0xd8], al
mov rcx, r14
mov rdx, r13
call fcn.005703fd
cmp byte [rsp + 0x168], 2
mov rbx, rbp
mov rbp, qword [rsp + 0x150]
je 0x56ee84
mov rdx, qword [rsp + 0x158]
mov rcx, rbp
call fcn.00433bdd
mov rcx, r15
mov rdx, r12
mov r8, rdi
call fcn.0056a4f4
mov rcx, r12
mov r12, r15
mov rdx, qword [rsp + 0x78]
call fcn.0057667d
mov rcx, r15
mov dx, 0x3d
call fcn.0056ac3c
mov qword [rsp + 0xc0], rsi
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0x240]
mov rdi, rbx
movups xmmword [rbx - 9], xmm0
mov r15, r14
mov rcx, r14
mov rdx, r13
call fcn.005703fd
cmp byte [rsp + 0x168], 2
mov rbp, qword [rsp + 0x150]
je 0x56eea1
mov rsi, qword [rsp + 0x158]
mov rax, qword [rsp + 0x160]
add rax, rbp
mov qword [rsp + 0x1b0], rbp
mov qword [rsp + 0x1b8], rax
and word [rsp + 0x1c0], 0
mov rcx, r12
lea rdx, [rsp + 0x1b0]
call fcn.0056ad59
mov rcx, rbp
mov rdx, rsi
call fcn.00433bdd
mov rcx, r12
xor edx, edx
call fcn.0056ac3c
mov rbp, rdi
mov r14, r15
jmp 0x56e975
lea rcx, [rsp + 0x2c0]
call fcn.00573537
lea rsi, [rsp + 0x200]
mov rcx, rsi
xor edx, edx
call fcn.0056ac3c
mov rax, qword [rsi]
mov rdi, qword [rsi + 8]
mov r12, rax
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov r14d, 2
mov qword [rsp + 0x78], rax
xor eax, eax
cmp byte [rbx + 0x88], 2
mov ecx, 0
mov r13, rdi
je 0x56ed73
lea rcx, [rbx + 0x70]
call fcn.0057047c
test rax, rax
je 0x56ed31
mov rax, qword [rsp + 0x90]
mov qword [rax], rdx
mov qword [rax + 0x10], 2
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0x5c]
jmp 0x56fc7b
call fcn.00569a3f
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], 1
mov rcx, r14
mov rdx, rbx
call fcn.0057667d
lea rcx, [rsp + 0x150]
call fcn.0057027a
lea rdx, str.PATH:
lea rdi, [rsp + 0x1b0]
mov r8d, 4
mov rcx, rdi
call fcn.0056d1ed
cmp byte [rdi + 0x18], 2
je 0x56f06b
mov rcx, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1c0]
add rax, rcx
lea r15, [rsp + 0x150]
mov qword [rsp + 0xb8], rcx
mov qword [r15], rcx
mov qword [r15 + 8], rax
and word [r15 + 0x10], 0
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x70], rax
mov byte [r15 + 0x18], 1
lea rbx, [rsp + 0xd9]
lea rbp, [rsp + 0x2d9]
lea r13, [rsp + 0x2c0]
lea rdi, [rsp + 0x270]
lea r14, [rsp + 0xc0]
mov rcx, r13
mov rdx, r15
call fcn.0056d14a
mov al, byte [rsp + 0x2d8]
cmp al, 2
je 0x56f04c
cmp qword [rsp + 0x2d0], 0
je 0x56ed17
mov rcx, qword [rsp + 0x2d0]
mov qword [rsp + 0xd0], rcx
movups xmm0, xmmword [rsp + 0x2c0]
movaps xmmword [rsp + 0xc0], xmm0
mov ecx, dword [rbp]
mov edx, dword [rbp + 3]
mov dword [rbx + 3], edx
mov dword [rbx], ecx
mov byte [rsp + 0xd8], al
mov rcx, r13
lea rdx, [rsp + 0x240]
mov r8, rdi
mov r9, r14
call fcn.00570219
mov rsi, qword [rsp + 0x2c0]
mov r12, qword [rsp + 0x2c8]
test rsi, rsi
jne 0x56f0dc
xor ecx, ecx
mov rdx, r12
call fcn.0040256e
jmp 0x56ec82
mov rcx, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2c8]
call fcn.00433bdd
jmp 0x56ec82
mov rax, qword [rdx]
mov rcx, qword [rdx + 0x10]
add rcx, rax
lea rdx, [rsp + 0x2c0]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
and word [rdx + 0x10], 0
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.0056c974
mov rcx, rsi
xor edx, edx
call fcn.0056ac3c
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
mov r14, rcx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x270], xmm0
and qword [rsp + 0x280], 0
lea rdx, [0x007e00e8]
lea rcx, [rsp + 0x240]
call fcn.0056c700
lea r8, [rsp + 0x1b0]
and qword [r8], 0
and qword [r8 + 0x10], 0
and qword [r8 + 0x20], 0
lea rcx, [rsp + 0x2a8]
mov dword [rcx], 2
cmp byte [rsp + 0x238], 0
cmovne rcx, r15
cmp dword [rbx], 6
mov edi, dword [rbx + 0x10]
cmovne rcx, rbx
lea rsi, [rbx + 0x20]
cmp dword [rbx + 0x20], 6
cmove rsi, r15
mov edx, 0xfffffff6
call fcn.005704d4
mov rbp, rdx
test rax, rax
je 0x56ee2f
mov rax, qword [rsp + 0x90]
mov qword [rax], rbp
mov qword [rax + 0x10], 2
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0x5c]
jmp 0x56fc3a
lea r8, [rsp + 0x1c0]
lea rcx, [rbx + 0x10]
cmp edi, 6
cmove rcx, r15
mov edx, 0xfffffff5
call fcn.005704d4
mov rdi, rdx
test rax, rax
je 0x56f08a
mov rax, qword [rsp + 0x90]
mov qword [rax], rdi
mov qword [rax + 0x10], 2
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0x5c]
jmp 0x56fc32
mov rcx, rsi
mov rdx, qword [rsp + 0xa8]
call fcn.00433bdd
mov rcx, r12
mov rdx, qword [rsp + 0x78]
call fcn.0057667d
mov r15, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0x5c]
lea rcx, [rsp + 0x2c0]
call fcn.00573537
mov rcx, qword [rsp + 0x200]
mov rdx, qword [rsp + 0x208]
call fcn.0057667d
mov rax, qword [rsp + 0x90]
mov qword [rax], rbp
mov qword [rax + 0x10], 2
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
jmp 0x56fc88
movzx ecx, word [rbp + rdx*2 - 6]
or ecx, 0x20
cmp ecx, 0x61
jne 0x56ef13
movzx ecx, word [rbp + rdx*2 - 4]
or ecx, 0x20
cmp ecx, 0x74
je 0x56ef40
cmp ax, 0x43
jne 0x56e6db
movzx eax, word [rbp + rdx*2 - 6]
or eax, 0x20
cmp eax, 0x6d
jne 0x56e6db
movzx eax, word [rbp + rdx*2 - 4]
add eax, 0xffffffbc
test ax, 0xffdf
jne 0x56e6db
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0x70], rbp
lea rax, [rsp + 0xc0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov r8d, 0x200
mov ebx, 2
xor r14d, r14d
mov r15d, 0xffffffff
xor esi, esi
cmp r8, 0x201
jae 0x56ef95
lea rbp, [rsp + 0x2c0]
mov r13d, 0x200
mov rdi, r8
jmp 0x56efd5
sub r8, rsi
lea rcx, [rsp + 0xc0]
mov rdx, r8
call fcn.0056a634
mov rbx, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
cmp r14, r15
mov esi, 0xffffffff
cmovb rsi, r14
mov qword [rsp + 0xd0], rsi
mov rbp, rbx
mov r13, rsi
mov rdi, rsi
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, rbp
mov edx, edi
call sub.kernel32.dll_GetSystemDirectoryW
mov r12d, eax
test eax, eax
jne 0x56effa
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x56f0fb
mov r8d, r12d
cmp rdi, r8
jne 0x56f022
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x56fcca
add rdi, rdi
cmp rdi, r15
cmovae rdi, r15
mov r8, rdi
jmp 0x56ef79
jb 0x56ef79
cmp r13, r8
jb 0x56fcca
lea rdi, [rsp + 0x150]
mov rcx, rdi
mov rdx, rbp
call fcn.0056ac72
mov rsi, qword [rdi]
jmp 0x56f10a
lea rcx, [rsp + 0x2c0]
call fcn.0055d67f
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0x70]
call fcn.00433bdd
xor ecx, ecx
call fcn.0040256e
lea rsi, [0x00773490]
mov rbx, qword [rsp + 0x98]
mov edi, dword [rsp + 0x54]
jmp 0x56de6f
lea r8, [rsp + 0x1d0]
mov rcx, rsi
mov edx, 0xfffffff4
call fcn.005704d4
test rax, rax
mov qword [rsp + 0x238], rdi
je 0x56f449
mov rax, qword [rsp + 0x90]
mov qword [rax], rdx
mov qword [rax + 0x10], 2
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0x5c]
jmp 0x56fc25
mov rdi, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0x70]
call fcn.00433bdd
jmp 0x56e66d
call fcn.00569a3f
mov qword [rsp + 0x158], rax
xor esi, esi
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x78]
mov rcx, rbx
mov rdx, r14
call fcn.0057667d
test rsi, rsi
mov rbp, qword [rsp + 0x70]
je 0x56f43c
mov rax, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x160]
lea rbx, [rsp + 0x1b0]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rdi
mov eax, 1
lea r14, [rsp + 0x2e0]
mov qword [r14 - 0x20], rax
and qword [r14 - 0x18], 0
mov qword [r14 - 0x10], rax
and word [r14 - 8], 0
lea rax, [0x007734ea]
mov qword [r14], rax
lea rcx, [0x007734f2]
mov qword [r14 + 8], rcx
and word [r14 + 0x10], 0
mov r15d, 3
test rax, rax
je 0x56f1b5
mov rcx, r14
call fcn.0056a33a
test ax, ax
je 0x56f1a7
mov ebp, edx
jmp 0x56f1f6
and qword [rsp + 0x2e0], 0
mov rbp, qword [rsp + 0x70]
cmp qword [rsp + 0x2c0], 0
je 0x56f2c1
mov rax, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x2d0]
cmp rcx, rax
je 0x56f1e5
lea rdx, [rax + 1]
mov qword [rsp + 0x2c8], rdx
cmp rcx, rax
je 0x56f2c1
movzx ebp, word [rsp + 0x2d8]
cmp rdi, qword [rsp + 0x1b8]
jne 0x56f2a0
mov rcx, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2e0]
test rdx, rdx
je 0x56f268
mov rax, qword [rsp + 0x2e8]
sub rax, rdx
movzx r8d, word [rsp + 0x2f0]
add rax, 2
xor edx, edx
div r15
cmp r8w, 1
sbb rax, 0xffffffffffffffff
test rcx, rcx
je 0x56f281
mov rdx, qword [rsp + 0x2d0]
sub rdx, qword [rsp + 0x2c8]
mov rcx, 0xffffffffffffffff
add rax, rdx
jb 0x56f263
mov rcx, rax
mov rax, rcx
jmp 0x56f281
test rcx, rcx
je 0x56f27f
mov rax, qword [rsp + 0x2d0]
sub rax, qword [rsp + 0x2c8]
jmp 0x56f281
xor eax, eax
mov rdx, 0xffffffffffffffff
inc rax
je 0x56f290
mov rdx, rax
mov rcx, rbx
call fcn.0056a634
mov rsi, qword [rsp + 0x1b0]
mov word [rsi + rdi*2], bp
inc rdi
mov qword [rsp + 0x1c0], rdi
mov rax, qword [rsp + 0x2e0]
mov rbp, qword [rsp + 0x70]
jmp 0x56f191
mov rax, qword [rsp + 0x1b0]
mov rsi, qword [rsp + 0x1b8]
test rax, rax
je 0x56f55d
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x68]
mov rbx, qword [rax + 0x90]
mov r12, qword [rax + 0xa0]
mov al, byte [rax + 0xc5]
mov byte [rsp + 0xa4], al
test al, al
setne byte [rsp + 0x5c]
lea rax, str.cmd.exe__d__c__Windows_file_names_may_not_contain_____or_end_with___
lea rcx, [rsp + 0x150]
mov qword [rcx], rax
lea rax, [0x00773307]
mov qword [rcx + 8], rax
and word [rcx + 0x10], 0
call fcn.0056a33a
test ax, ax
je 0x56f576
mov ebp, edx
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0x158]
sub rax, qword [rsp + 0x150]
movzx ecx, word [rsp + 0x160]
add rax, 2
mov esi, 3
xor edx, edx
div rsi
cmp cx, 1
sbb rax, 0xffffffffffffffff
cmp rax, 4
cmovb rax, rsi
lea rcx, [rax + 1]
xor edx, edx
call fcn.00576947
mov rdi, rax
mov word [rax], bp
lea r14, [rsp + 0xc0]
mov qword [r14], rax
mov qword [r14 + 8], rdx
mov qword [r14 + 0x10], 1
mov rax, qword [rsp + 0x160]
lea r15, [rsp + 0x2c0]
mov qword [r15 + 0x10], rax
movups xmm0, xmmword [rsp + 0x150]
movaps xmmword [r15], xmm0
mov r12d, 1
mov rcx, r15
call fcn.0056a33a
cmp ax, 1
jne 0x56f52b
mov ebp, edx
cmp r12, qword [rsp + 0xc8]
jne 0x56f42a
mov rax, qword [rsp + 0x2c8]
sub rax, qword [rsp + 0x2c0]
movzx ecx, word [rsp + 0x2d0]
add rax, 2
xor edx, edx
div rsi
cmp cx, 1
sbb rax, 0xffffffffffffffff
lea rdx, [rax + 1]
mov rcx, r14
call fcn.0056a634
mov rdi, qword [rsp + 0xc0]
mov word [rdi + r12*2], bp
inc r12
mov qword [rsp + 0xd0], r12
jmp 0x56f3cf
mov rsi, qword [rsp + 0x158]
jmp 0x56f562
xorps xmm0, xmm0
movups xmmword [rsp + 0xf4], xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0x108], xmm0
movups xmmword [rsp + 0x118], xmm0
test rdx, rdx
jne 0x56f48b
test rdi, rdi
jne 0x56f48b
test rbp, rbp
je 0x56f4ae
mov dword [rsp + 0xfc], 0x100
mov qword [rsp + 0x110], rbp
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rdx
mov rbx, qword [rbx + 0xb8]
test rbx, rbx
je 0x56f725
and qword [rsp + 0x138], 0
mov dword [rsp + 0xc0], 0x70
mov rax, rbx
shr rax, 0x20
jne 0x56f747
mov qword [rsp + 0x130], rdx
lea rsi, [rsp + 0x138]
xor ecx, ecx
mov edx, ebx
xor r8d, r8d
mov r9, rsi
call sub.kernel32.dll_InitializeProcThreadAttributeList
mov rsi, qword [rsi]
test rsi, rsi
je 0x56f7b4
js 0x56fcca
mov ecx, 1
mov rdx, rsi
call fcn.00417402
test rax, rax
jne 0x56f7b9
jmp 0x56fcca
movups xmm0, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x1b0], xmm0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1c0], rax
mov rsi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x130]
jmp 0x56f58d
mov r15, qword [rsp + 0x60]
mov edi, dword [rsp + 0x54]
mov rax, qword [rsp + 0x90]
mov qword [rax], rsi
jmp 0x56e8eb
mov qword [rsp + 0x1b0], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b8], xmm0
lea rcx, [rsp + 0x1b0]
mov dx, 0x22
call fcn.0056ac3c
mov rdx, qword [rsp + 0xb0]
lea rax, [rdx + rdx]
xor ecx, ecx
lea r14, [0x00773340]
mov r15, qword [rsp + 0x60]
mov edi, dword [rsp + 0x54]
mov rbp, qword [rsp + 0x70]
cmp rax, rcx
je 0x56f5d7
cmp word [rbp + rcx], 0x22
lea rcx, [rcx + 2]
jne 0x56f5c1
jmp 0x56f6e8
cmp word [rbp + rdx*2 - 2], 0x5c
je 0x56f6e8
mov qword [rsp + 0x88], rsi
lea rsi, [rdx - 1]
lea rcx, [rdx*2 - 2]
add rcx, rbp
mov rdi, rdx
lea r8, [0x00798ce0]
mov edx, 1
mov r9d, 1
call fcn.0056cee3
xor edx, edx
test al, al
cmovne rdx, rbp
test rdx, rdx
cmove rdx, rbp
cmove rsi, rdi
lea r8, [rdx + rsi*2]
lea r15, [rsp + 0x1b0]
mov rcx, r15
call fcn.0056a4e9
mov rcx, r15
mov dx, 0x22
call fcn.0056ac3c
imul rsi, r12, 0x28
add rsi, rbx
lea rbp, str._t____________N
cmp rbx, rsi
je 0x56f75f
mov rcx, r15
mov dx, 0x20
call fcn.0056ac3c
mov dil, byte [rsp + 0x5c]
cmp byte [rsp + 0xa4], 0
jne 0x56f6b0
cmp qword [rbx], 0
mov dil, byte [rsp + 0x5c]
jne 0x56f6b0
mov r14, qword [rbx + 8]
mov r12, qword [rbx + 0x18]
xor r13d, r13d
cmp r12, r13
setne dil
je 0x56f6b0
mov r8b, byte [r14 + r13]
mov edx, 0x16
mov rcx, rbp
call fcn.005701da
inc r13
test al, al
je 0x56f68f
lea r12, [rbx + 0x28]
mov rcx, r15
mov rdx, rbx
mov r8d, edi
call fcn.00570299
mov rbx, r12
test rax, rax
mov r13, qword [rsp + 0x78]
je 0x56f655
mov r14, rax
mov r15, qword [rsp + 0x60]
mov edi, dword [rsp + 0x54]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b8]
call fcn.0057667d
mov rax, qword [rsp + 0x90]
mov qword [rax], r14
mov qword [rax + 0x10], 2
mov rcx, qword [rsp + 0x80]
mov rdx, rsi
call fcn.0057667d
jmp 0x56e8f3
mov rdi, r13
mov qword [rsp + 0x130], rdx
lea rax, [rsp + 0xc0]
mov dword [rax], 0x68
mov edx, dword [rsp + 0x54]
jmp 0x56fa17
lea rsi, [0x00773528]
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0x5c]
jmp 0x56fc02
lea rdi, [rsp + 0x1b0]
mov rcx, rdi
mov dx, 0x22
call fcn.0056ac3c
mov rax, qword [rdi]
mov r14, qword [rdi + 8]
test rax, rax
je 0x56fbab
mov rdx, qword [rsp + 0x1c0]
mov cl, 1
mov dword [rsp + 0xa4], ecx
mov dword [rsp + 0x5c], 0
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov esi, dword [rsp + 0x54]
mov rbp, qword [rsp + 0x70]
jmp 0x56e801
mov eax, 1
cmp rsi, 1
mov rdi, rsi
adc rdi, 0
test rsi, rsi
cmove rdi, rsi
lea r9, [rsp + 0x138]
mov qword [rsp + 0xb0], rax
mov rcx, rax
mov edx, ebx
xor r8d, r8d
call sub.kernel32.dll_InitializeProcThreadAttributeList
test eax, eax
je 0x56f84c
mov qword [rsp + 0x268], rdi
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0xa8]
test rcx, rcx
je 0x56f859
mov rdx, qword [rax + 0xb0]
and qword [rsp + 0x158], 0
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x168], rdx
and qword [rsp + 0x178], 0
mov rax, qword [rax + 0xb8]
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rdx
mov edi, 1
jmp 0x56f85d
call fcn.00569a3f
mov rsi, rax
jmp 0x56fbde
xor edi, edi
xor eax, eax
lea rsi, [rsp + 0x158]
mov qword [rsi - 8], rdi
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x38], rax
xorps xmm6, xmm6
mov qword [rsp + 0x68], rbx
mov rax, rbx
mov rbx, r14
test rax, rax
je 0x56f9d9
dec rax
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x190]
test rax, rax
je 0x56f9d9
dec rax
mov qword [rsp + 0x190], rax
mov r15, qword [rsp + 0x158]
test rdi, rdi
je 0x56f8f4
test r15, r15
jne 0x56f8f4
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
mov rcx, rsi
call fcn.00570e60
mov qword [rsp + 0x150], 1
mov edi, 1
mov r15, qword [rsp + 0x158]
jmp 0x56f8fd
test rdi, rdi
je 0x56fcca
mov r8, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
movzx eax, word [r15 + 0x16a]
cmp r14, rax
jb 0x56f936
mov rax, qword [r15]
test rax, rax
je 0x56fcca
inc r8
movzx r14d, word [r15 + 0x168]
mov r15, rax
jmp 0x56f90d
test r8, r8
je 0x56f955
mov rdx, qword [r15 + r14*8 + 0x178]
dec r8
lea rcx, [rsp + 0x200]
call fcn.00570e60
jmp 0x56f972
lea rax, [r14 + 1]
mov qword [rsp + 0x200], r15
and qword [rsp + 0x208], 0
mov qword [rsp + 0x210], rax
imul rax, r14, 0x18
mov rcx, qword [rsp + 0x210]
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0x200]
mov qword [rsi], rcx
mov rcx, qword [rsp + 0x208]
mov qword [rsi + 8], rcx
mov r8, qword [r15 + r14*8 + 8]
mov r9, qword [r15 + rax + 0x60]
mov rax, qword [r15 + rax + 0x70]
movups xmmword [rsp + 0x28], xmm6
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0xb0]
xor edx, edx
call sub.kernel32.dll_UpdateProcThreadAttribute
test eax, eax
je 0x56fbc6
mov rax, qword [rsp + 0x198]
mov r14, rbx
jmp 0x56f87f
mov edx, dword [rsp + 0x54]
or edx, 0x80000
lea rax, [rsp + 0x2c0]
lea rsi, [rsp + 0xc0]
mov ecx, 0xd
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x68], rcx
mov r15, qword [rsp + 0x60]
mov rdi, r13
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x290]
lea rcx, [rsp + 0x270]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x80]
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x56fb59
movaps xmm0, xmmword [rsp + 0x270]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
movups xmm3, xmmword [rsp + 0x1d0]
mov rax, qword [rsp + 0x90]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax], xmm0
test rbx, rbx
je 0x56fabe
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x268]
call fcn.0057075b
mov rcx, qword [rsp + 0x130]
call fcn.0059c8b0
mov rcx, qword [rsp + 0x238]
call fcn.0059c8b0
mov rcx, rbp
call fcn.0059c8b0
mov rdx, qword [rsp + 0x2b0]
mov ecx, 2
call fcn.0056d5c0
mov rcx, qword [rsp + 0x248]
call sub.kernel32.dll_ReleaseSRWLockExclusive
mov rcx, r14
mov rdx, qword [rsp + 0xa8]
call fcn.0057667d
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call fcn.0057667d
mov rdx, qword [rsp + 0x298]
mov rcx, rsi
call fcn.0057667d
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
call fcn.0057667d
cmp byte [rsp + 0xa4], 0
mov rcx, qword [rsp + 0x70]
je 0x56df04
jmp 0x56fcb3
call fcn.00569a3f
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
test rbx, rbx
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x130]
je 0x56fc15
mov rcx, qword [rsp + 0xb0]
mov rsi, rdx
mov rdx, qword [rsp + 0x268]
call fcn.0057075b
mov rdx, rsi
jmp 0x56fc15
mov r15, qword [rsp + 0x60]
mov edi, dword [rsp + 0x54]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
jmp 0x56f6fd
call fcn.00569a3f
mov rsi, rax
mov r15, qword [rsp + 0x60]
mov r14, rbx
mov rdi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0xb0]
mov rdx, rdi
call fcn.0057075b
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x130]
mov rax, qword [rsp + 0x90]
mov qword [rax], rsi
mov qword [rax + 0x10], 2
mov rcx, rdx
call fcn.0059c8b0
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x238]
call fcn.0059c8b0
mov rcx, rbp
call fcn.0059c8b0
mov rdx, qword [rsp + 0x2b0]
mov ecx, 2
call fcn.0056d5c0
lea rcx, [rsp + 0x1b0]
call fcn.0057078c
mov rcx, qword [rsp + 0x248]
call sub.kernel32.dll_ReleaseSRWLockExclusive
mov rcx, r14
mov rdx, qword [rsp + 0xa8]
call fcn.0057667d
mov rbp, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov rdx, r13
call fcn.0057667d
mov rcx, qword [rsp + 0x290]
mov rdx, qword [rsp + 0x298]
call fcn.0057667d
mov rcx, rdi
mov rdx, rsi
call fcn.0057667d
test bl, bl
jne 0x56df04
mov rcx, rbp
mov rdx, qword [rsp + 0xb8]
call fcn.0057667d
jmp 0x56df04
call fcn.00569a3f
ud2