Function at 0x5557d0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x218
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x110], 0
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x158], 0
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x1a0], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x208], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x1f8], 0
mov qword [rbp + 0x1f0], 0
nop
lea rcx, [0x00557430]
call fcn.0041bda0
nop
call fcn.00538bc0
call fcn.005551d0
call fcn.005552c0
test al, al
je 0x556cb8
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x555a8c
mov rax, qword [0x00584b68]
cmp byte [rax + 0x300], 0
je 0x555a8c
call fcn.00542690
test al, al
je 0x556cb8
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x555abf
lea rcx, [0x00556e3c]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
lea rcx, [0x00556e70]
mov dl, 1
call fcn.00542890
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, eax
mov edx, 0x80
call sub.kernel32.dll_SetPriorityClass
call fcn.00555150
mov ecx, 0xa
call fcn.004099b0
mov ecx, eax
imul ecx, ecx, 0x3e8
add ecx, 0x3e8
call sub.kernel32.dll_Sleep
call fcn.00435cf0
mov rax, qword [0x00584b48]
movsd qword [rax + 0x2f0], xmm0
mov ecx, 1
call sub.kernel32.dll_SetErrorMode
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x555b35
lea rcx, [0x00556e90]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
call fcn.00538be0
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x555bf8
lea rcx, [rbp + 0x200]
mov rax, qword [0x00584b48]
movzx rdx, byte [rax + 8]
call fcn.00431320
lea rcx, [rbp + 0x1f8]
mov rax, qword [0x00584b48]
movzx rdx, byte [rax + 9]
call fcn.00431320
lea rcx, [rbp + 0x1f0]
mov rax, qword [0x00584b48]
mov edx, dword [rax + 0xc]
call fcn.00431360
lea rcx, [rbp + 0x208]
mov edx, 6
lea r8, [0x00556ebc]
mov r9, qword [rbp + 0x200]
lea rax, [0x00556edc]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rsp + 0x28], rax
lea rax, [0x00556edc]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x1f0]
mov qword [rsp + 0x38], rax
call fcn.00412c30
mov rcx, qword [rbp + 0x208]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x555c1d
lea rcx, [0x00556eec]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
call fcn.00541ea0
test al, al
jne 0x555c54
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x556cb8
lea rcx, [0x00556f14]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
jmp 0x556cb8
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x555c72
lea rcx, [0x00556f7c]
mov dl, 1
call fcn.00542890
call fcn.004098a0
cmp eax, 1
jne 0x555fb0
lea rcx, [rbp + 0x1e8]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1e8]
lea rdx, [0x00556fa4]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1e0]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1e0]
lea rdx, [0x00556fb8]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1d8]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1d8]
lea rdx, [0x00556fd4]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1d0]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1d0]
lea rdx, [0x00556fec]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1c8]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1c8]
lea rdx, [0x00557008]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1c0]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1c0]
lea rdx, [0x00557024]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1b8]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1b8]
lea rdx, [0x0055703c]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1b0]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1b0]
lea rdx, [0x00557058]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1a8]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1a8]
lea rdx, [0x00557078]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x1a0]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x1a0]
lea rdx, [0x0055709c]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x198]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x198]
lea rdx, [0x005570bc]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x190]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x190]
lea rdx, [0x005570dc]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x188]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x188]
lea rdx, [0x005570f0]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x180]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x180]
lea rdx, [0x00557108]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x178]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x178]
lea rdx, [0x00557124]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x170]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x170]
lea rdx, [0x0055713c]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x168]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x168]
lea rdx, [0x00557158]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x160]
mov edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x160]
lea rdx, [0x00557180]
call fcn.00412d10
test eax, eax
je 0x555fb0
lea rcx, [rbp + 0x158]
mov edx, 1
call fcn.00409920
mov rcx, qword [0x005849a8]
mov rdx, qword [rbp + 0x158]
call fcn.00412840
mov dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0x150]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x150]
lea rdx, [0x00556fb8]
call fcn.00412d10
test eax, eax
jne 0x55605d
lea rcx, [rbp + 0x148]
mov edx, dword [0x00592d70]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0x140]
mov rdx, qword [rbp + 0x148]
xor r8, r8
call fcn.00411fc0
mov rcx, qword [rbp + 0x140]
call fcn.00449450
test al, al
je 0x556051
lea rcx, [rbp + 0x138]
mov edx, dword [0x00592d70]
add edx, 1
call fcn.00409920
mov rcx, qword [rbp + 0x138]
call fcn.00431610
mov rcx, qword [0x00584b48]
mov dword [rcx + 0x90], eax
add dword [0x00592d70], 2
jmp 0x556576
lea rcx, [rbp + 0x130]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x130]
lea rdx, [0x00557008]
call fcn.00412d10
test eax, eax
jne 0x556092
add dword [0x00592d70], 2
jmp 0x556576
lea rcx, [rbp + 0x128]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x128]
lea rdx, [0x00556fec]
call fcn.00412d10
test eax, eax
jne 0x5560c7
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0x120]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x120]
lea rdx, [0x00557158]
call fcn.00412d10
test eax, eax
jne 0x55610a
mov rax, qword [0x00584b48]
mov byte [rax + 0x135], 0
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0x118]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x118]
lea rdx, [0x0055713c]
call fcn.00412d10
test eax, eax
jne 0x55614d
mov rax, qword [0x00584b48]
mov byte [rax + 0x12d], 1
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0x110]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x110]
lea rdx, [0x00556fa4]
call fcn.00412d10
test eax, eax
jne 0x556190
mov rax, qword [0x00584b48]
mov byte [rax + 0x12e], 1
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0x108]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x108]
lea rdx, [0x00556fd4]
call fcn.00412d10
test eax, eax
jne 0x5561e1
mov rax, qword [0x00584b48]
mov byte [rax + 0x131], 1
mov rax, qword [0x00584b48]
mov byte [rax + 0x132], 0
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0x100]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x100]
lea rdx, [0x00557024]
call fcn.00412d10
test eax, eax
jne 0x556232
mov rax, qword [0x00584b48]
mov byte [rax + 0x131], 0
mov rax, qword [0x00584b48]
mov byte [rax + 0x132], 1
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0xf8]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0xf8]
lea rdx, [0x0055703c]
call fcn.00412d10
test eax, eax
jne 0x556275
mov rax, qword [0x00584b48]
mov byte [rax + 0x133], 1
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0xf0]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0xf0]
lea rdx, [0x00557058]
call fcn.00412d10
test eax, eax
jne 0x5562b8
mov rax, qword [0x00584b48]
mov byte [rax + 0x130], 0
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0xe8]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0xe8]
lea rdx, [0x00557078]
call fcn.00412d10
test eax, eax
jne 0x5562fb
mov rax, qword [0x00584b48]
mov byte [rax + 0x14d], 1
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0xe0]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0xe0]
lea rdx, [0x0055709c]
call fcn.00412d10
test eax, eax
jne 0x556385
mov rax, qword [0x00584b48]
cmp byte [rax + 0x14d], 0
je 0x556379
lea rcx, [rbp + 0xd8]
mov edx, dword [0x00592d70]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
xor r8, r8
call fcn.00411fc0
mov rcx, qword [rbp + 0xd0]
mov rax, qword [0x00584b48]
lea rdx, [rax + 0x80]
call fcn.00449a50
add dword [0x00592d70], 2
jmp 0x556576
lea rcx, [rbp + 0xc8]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0xc8]
lea rdx, [0x005570bc]
call fcn.00412d10
test eax, eax
jne 0x55640c
mov rax, qword [0x00584b48]
cmp byte [rax + 0x14d], 0
je 0x556400
lea rcx, [rbp + 0xc0]
mov edx, dword [0x00592d70]
add edx, 1
call fcn.00409920
lea rcx, [rbp + 0xb8]
mov rdx, qword [rbp + 0xc0]
xor r8, r8
call fcn.00411fc0
mov rcx, qword [rbp + 0xb8]
mov rax, qword [0x00584b48]
lea rdx, [rax + 0x28]
call fcn.00449a50
add dword [0x00592d70], 2
jmp 0x556576
lea rcx, [rbp + 0xb0]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0xb0]
lea rdx, [0x005570dc]
call fcn.00412d10
test eax, eax
je 0x55645e
lea rcx, [rbp + 0xa8]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0xa8]
lea rdx, [0x005570f0]
call fcn.00412d10
test eax, eax
jne 0x556492
lea rcx, [rbp + 0xa0]
mov edx, dword [0x00592d70]
add edx, 1
call fcn.00409920
mov rcx, qword [0x005849a8]
mov rdx, qword [rbp + 0xa0]
call fcn.00412840
add dword [0x00592d70], 2
jmp 0x556576
lea rcx, [rbp + 0x98]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x98]
lea rdx, [0x00557108]
call fcn.00412d10
test eax, eax
jne 0x5564d5
mov rax, qword [0x00584b48]
mov byte [rax + 0x12b], 1
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0x90]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x90]
lea rdx, [0x00557124]
call fcn.00412d10
test eax, eax
jne 0x556515
mov rax, qword [0x00584b48]
mov byte [rax + 0x12c], 1
add dword [0x00592d70], 1
jmp 0x556576
lea rcx, [rbp + 0x88]
mov edx, dword [0x00592d70]
call fcn.00409920
mov rcx, qword [rbp + 0x88]
lea rdx, [0x00557180]
call fcn.00412d10
test eax, eax
jne 0x55656f
lea rcx, [rbp + 0x80]
mov edx, dword [0x00592d70]
add edx, 1
call fcn.00409920
mov rcx, qword [0x00584ee8]
mov rdx, qword [rbp + 0x80]
call fcn.00412840
add dword [0x00592d70], 2
jmp 0x556576
add dword [0x00592d70], 1
call fcn.004098a0
cmp dword [0x00592d70], eax
jle 0x555fbf
mov rax, qword [0x00584b48]
mov eax, dword [rax + 0x90]
test eax, eax
je 0x5565fb
mov rcx, qword [0x00584b48]
cmp byte [rcx + 0x134], 0
je 0x5565e3
lea rcx, [rbp + 0x70]
mov edx, eax
call fcn.00431320
lea rcx, [rbp + 0x78]
mov edx, 3
lea r8, [0x005571a8]
mov r9, qword [rbp + 0x70]
lea rax, [0x005571c4]
mov qword [rsp + 0x20], rax
call fcn.00412c30
mov rcx, qword [rbp + 0x78]
mov dl, 1
call fcn.00542890
mov rax, qword [0x00584b48]
mov ecx, dword [rax + 0x90]
imul ecx, ecx, 0x3e8
call sub.kernel32.dll_Sleep
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x556620
lea rcx, [0x00557200]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov rax, qword [0x00584b48]
mov rax, qword [rax + 0x80]
test rax, rax
je 0x556637
mov rax, qword [rax - 8]
test rax, rax
jne 0x55664f
mov rax, qword [0x00584b48]
lea rcx, [rax + 0x80]
call fcn.00537c80
mov rax, qword [0x00584ee8]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412610
test eax, eax
je 0x556670
mov cl, 1
call fcn.0054b330
jmp 0x556cb8
mov rax, qword [0x005849a8]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412610
test eax, eax
jne 0x5566bb
lea rcx, [rbp + 0x68]
mov rax, qword [0x00584b48]
lea rdx, [rax + 0x80]
call fcn.004499e0
mov rax, qword [0x00584b48]
lea rcx, [rax + 0x120]
mov rdx, qword [rbp + 0x68]
call fcn.00449860
test al, al
jne 0x556cb8
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x5566d9
lea rcx, [0x00557230]
mov dl, 1
call fcn.00542890
call fcn.005544f0
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x55670c
xor ecx, ecx
mov dl, 1
call fcn.00542890
lea rcx, [0x00557268]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov rax, qword [0x00584b48]
cmp byte [rax + 0x133], 0
jne 0x556721
call fcn.00549cc0
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x556746
lea rcx, [0x005572c4]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov rax, qword [0x00584b48]
cmp byte [rax + 0x133], 0
jne 0x55675b
call fcn.00544690
mov rax, qword [0x00584b48]
cmp byte [rax + 0x133], 0
je 0x556799
mov rax, qword [0x00584b48]
mov rax, qword [rax + 0x58]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
mov rax, qword [0x00584b48]
mov rax, qword [rax + 0x40]
mov rcx, rax
mov rbx, qword [rax]
call qword [rbx + 0x90]
mov rax, qword [0x005849a8]
mov rcx, qword [rax]
xor edx, edx
call fcn.00412610
test eax, eax
je 0x5569f0
mov rax, qword [0x005849a8]
mov rcx, qword [rax]
call fcn.00448b20
test al, al
je 0x55682b
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x556817
xor ecx, ecx
mov dl, 1
call fcn.00542890
lea rcx, [rbp + 0x60]
lea rdx, [0x005572f0]
mov rax, qword [0x005849a8]
mov r8, qword [rax]
call fcn.00412200
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x60]
call fcn.00412810
mov rcx, qword [rbp + 0x58]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov rax, qword [0x005849a8]
mov rcx, qword [rax]
call fcn.00554a70
jmp 0x5569a7
mov rax, qword [0x00584b48]
cmp byte [rax + 0x133], 0
jne 0x55689c
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
jne 0x55689c
jmp 0x556857
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00555100]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00584a60]
mov qword [rsp + 0x28], rax
call fcn.004108c0
test rax, rax
je 0x55684d
mov ecx, 0x3e8
call fcn.004099b0
mov ecx, eax
add ecx, 0x1f4
call sub.kernel32.dll_Sleep
jmp 0x5568aa
mov rax, qword [0x00584b48]
mov byte [rax + 0x14a], 1
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x5568fc
xor ecx, ecx
mov dl, 1
call fcn.00542890
lea rcx, [rbp + 0x50]
lea rdx, [0x00557320]
mov rax, qword [0x005849a8]
mov r8, qword [rax]
call fcn.00412200
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
call fcn.00412810
mov rcx, qword [rbp + 0x48]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
mov rax, qword [0x005849a8]
mov rcx, qword [rax]
call fcn.00554d90
jmp 0x556917
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
mov rax, qword [0x00584b48]
cmp byte [rax + 0x14a], 0
je 0x55690d
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x556955
xor ecx, ecx
mov dl, 1
call fcn.00542890
lea rcx, [0x0055735c]
mov dl, 1
call fcn.00542890
xor ecx, ecx
call fcn.00542ad0
call fcn.00542a90
mov rax, qword [0x00584b48]
cmp byte [rax + 0x134], 0
je 0x5569a7
mov rax, qword [0x00584b68]
cmp byte [rax + 0x300], 0
je 0x5569a7
lea rcx, [0x00557394]
xor edx, edx
call fcn.00542890
lea rcx, [0x005573c0]
xor edx, edx
call fcn.00542890
mov rcx, qword [0x00584d08]
call fcn.0040c370
call fcn.00409570
mov rax, qword [0x00584b48]
cmp byte [rax + 0x12d], 0
je 0x556cb8
xor ecx, ecx
lea rdx, [0x005573f6]
lea r8, [0x00557400]
lea r9, [0x00557412]
lea rax, [0x0055742c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
jmp 0x556cb8
mov rax, qword [0x00584b48]
cmp byte [rax + 0x133], 0
jne 0x556cb8
mov rax, qword [0x00584b48]
cmp byte [rax + 0x130], 0
je 0x556a1b
xor ecx, ecx
call fcn.0054b330
mov rax, qword [0x00584b48]
cmp byte [rax + 0x12b], 0
je 0x556a45
mov rax, qword [0x00584b48]
mov byte [rax + 0x14a], 1
jmp 0x556a71
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00552ce0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00584a60]
mov qword [rsp + 0x28], rax
call fcn.004108c0
test rax, rax
je 0x556a3b
mov ecx, 0x3e8
call fcn.004099b0
mov ecx, eax
add ecx, 0x1f4
call sub.kernel32.dll_Sleep
mov rax, qword [0x00584b48]
cmp byte [rax + 0x12b], 0
je 0x556ab2
mov rax, qword [0x00584b48]
mov byte [rax + 0x148], 1
jmp 0x556ade
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00552910]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00584a60]
mov qword [rsp + 0x28], rax
call fcn.004108c0
test rax, rax
je 0x556aa8
mov rax, qword [0x00584b48]
cmp byte [rax + 0x12c], 0
je 0x556b08
mov rax, qword [0x00584b48]
mov byte [rax + 0x14c], 1
jmp 0x556b40
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x005549e0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00584a60]
mov qword [rsp + 0x28], rax
call fcn.004108c0
test rax, rax
je 0x556afe
jmp 0x556b40
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
mov rax, qword [0x00584b48]
cmp byte [rax + 0x14c], 0
je 0x556b36
mov rax, qword [0x00584b48]
cmp byte [rax + 0x12c], 0
je 0x556b7a
mov rax, qword [0x00584b48]
mov byte [rax + 0x14b], 1
jmp 0x556ba6
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x00554980]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00584a60]
mov qword [rsp + 0x28], rax
call fcn.004108c0
test rax, rax
je 0x556b70
mov ecx, 0x3e8
call fcn.004099b0
mov ecx, eax
add ecx, 0x1f4
call sub.kernel32.dll_Sleep
mov rax, qword [0x00584b48]
cmp byte [rax + 0x12c], 0
je 0x556be7
mov rax, qword [0x00584b48]
mov byte [rax + 0x149], 1
jmp 0x556c1f
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
xor ecx, ecx
xor edx, edx
lea r8, [0x005546a0]
xor r9, r9
mov dword [rsp + 0x20], 0
mov rax, qword [0x00584a60]
mov qword [rsp + 0x28], rax
call fcn.004108c0
test rax, rax
je 0x556bdd
jmp 0x556c1f
mov ecx, 0x2710
call sub.kernel32.dll_Sleep
mov rax, qword [0x00584b48]
cmp byte [rax + 0x148], 0
je 0x556c15
mov rax, qword [0x00584b48]
cmp byte [rax + 0x149], 0
je 0x556c15
mov rax, qword [0x00584b48]
cmp byte [rax + 0x14a], 0
je 0x556c15
mov rax, qword [0x00584b48]
cmp byte [rax + 0x14b], 0
je 0x556c15
call fcn.00543340
mov rax, qword [0x00584b48]
mov rcx, qword [rax + 0x120]
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00584b48]
cmp byte [rax + 0x12d], 0
je 0x556cb7
xor ecx, ecx
lea rdx, [0x005573f6]
lea r8, [0x00557400]
lea r9, [0x00557412]
lea rax, [0x0055742c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x48]
call fcn.00410ac0
lea rcx, [rbp + 0x50]
call fcn.00410b60
lea rcx, [rbp + 0x58]
call fcn.00410ac0
lea rcx, [rbp + 0x60]
call fcn.00410b60
lea rcx, [rbp + 0x68]
call fcn.00410b10
lea rcx, [rbp + 0x70]
mov edx, 9
call fcn.00410ba0
lea rcx, [rbp + 0xb8]
call fcn.00410b10
lea rcx, [rbp + 0xc0]
mov edx, 2
call fcn.00410ba0
lea rcx, [rbp + 0xd0]
call fcn.00410b10
lea rcx, [rbp + 0xd8]
mov edx, 0xd
call fcn.00410ba0
lea rcx, [rbp + 0x140]
call fcn.00410b10
lea rcx, [rbp + 0x148]
mov edx, 0x19
call fcn.00410ba0
call fcn.00410620
jmp 0x556d59
lea rsp, [rbp + 0x218]
pop rbx
pop rbp
ret