Function at 0x453470
Capabilities:
Create process on windows
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, rdx
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0x1f8], r8
mov qword [rsp + 0x200], r9
add rdx, 0x40
lea rcx, [rsp + 0x230]
call fcn.004447f0
mov r13, qword [rsp + 0x230]
test r13, r13
je 0x453627
mov ebx, 4
mov r15d, 1
mov ecx, 4
mov edx, 1
call fcn.004018c0
test rax, rax
je 0x454180
mov dword [rax], 0x48544150
mov qword [rsp + 0x90], 4
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 4
mov byte [rsp + 0xa8], 0
mov rcx, rax
add rcx, 4
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xf0]
call fcn.0044a980
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0x100], xmm1
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x110], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x120], rax
mov r12, qword [rsp + 0x240]
test r12, r12
je 0x453f89
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0xe8], rsi
mov rbp, qword [rsp + 0x238]
lea rbx, [rsp + 0xf0]
lea r14, [r12 + 0x168]
movzx r15d, word [r12 + 0x3d2]
imul rdi, r15, 0x38
lea r13, [r12 - 0x10]
mov rsi, 0xffffffffffffffff
nop word cs:[rax + rax]
test rdi, rdi
je 0x453610
mov rcx, rbx
mov rdx, r14
call fcn.00452910
add r14, 0x38
add rdi, 0xffffffffffffffc8
add r13, 0x20
inc rsi
cmp al, 1
je 0x4535e0
movzx eax, al
test eax, eax
jne 0x453613
jmp 0x45362c
mov rsi, r15
sub rbp, 1
jb 0x45477d
mov r12, qword [r12 + rsi*8 + 0x3d8]
jmp 0x4535b2
xor r15d, r15d
jmp 0x453687
mov r15, qword [r13 - 8]
mov r12, qword [r13]
mov rsi, qword [rsp + 0xe8]
mov r13, qword [rsp + 0x1a0]
mov rdx, qword [rsp + 0xf0]
test rdx, rdx
je 0x453664
mov rcx, qword [rsp + 0xf8]
mov r8d, 1
call fcn.004018d0
mov rdx, qword [rsp + 0x110]
test rdx, rdx
je 0x453687
mov rcx, qword [rsp + 0x118]
add rdx, rdx
mov r8d, 2
call fcn.004018d0
mov r14, qword [rsi + 0x28]
mov rbx, qword [rsi + 0x30]
mov qword [rsp + 0x160], r14
mov qword [rsp + 0x168], rbx
test rbx, rbx
je 0x4536de
cmp rbx, 4
jae 0x4536b3
lea rdx, [0x00436d30]
jmp 0x4536ce
mov eax, dword [0x004c65a7]
cmp eax, dword [r14]
lea rax, [0x00436d40]
lea rdx, [0x00436d30]
cmove rdx, rax
movzx ecx, byte [rbx + r14 - 1]
call rdx
test al, al
je 0x4538ec
lea rax, [0x004c8d30]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x4538cb
mov r15, qword [rsp + 0x80]
mov qword [rsp + 0x208], rbx
mov qword [rsp + 0x210], r14
mov qword [rsp + 0x218], r15
cmp r15, 5
jb case.0x454410.68
cmp word [r14 + r15*2 - 0xa], 0x2e
jne case.0x454410.68
cmp word [r14 + r15*2 - 2], 0
je 0x4543f0
mov rdi, qword [rsi + 0x28]
mov r15, qword [rsi + 0x30]
mov r14, qword [rsi + 0x98]
mov rax, rsi
mov rsi, qword [rsi + 0xa0]
mov r13, rax
movzx ebp, byte [rax + 0xad]
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 2
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x90]
xor edx, edx
call fcn.00468720
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
mov word [rax + rcx*2], 0x22
inc qword [rsp + 0xa0]
add r15, rdi
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xf8], rdi
mov word [rsp + 0x100], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf0]
call fcn.00449690
mov rdx, qword [rsp + 0xa0]
cmp rdx, qword [rsp + 0x90]
jne 0x45380f
lea rcx, [rsp + 0x90]
call fcn.00468720
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov word [rax + rdx*2], 0x22
inc qword [rsp + 0xa0]
shl rsi, 3
lea rsi, [rsi + rsi*4]
lea r12, [rsp + 0x90]
nop word cs:[rax + rax]
test rsi, rsi
je 0x45396c
mov rdx, qword [rsp + 0xa0]
cmp rdx, qword [rsp + 0x90]
jne 0x45386b
mov rcx, r12
call fcn.00468720
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov word [rax + rdx*2], 0x20
inc qword [rsp + 0xa0]
mov rcx, r12
mov rdx, r14
mov r8d, ebp
call fcn.004460d0
mov r15, rax
add r14, 0x28
add rsi, 0xffffffffffffffd8
test rax, rax
je 0x453840
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x453efc
mov rcx, qword [rsp + 0x98]
add rdx, rdx
mov r8d, 2
call fcn.004018d0
jmp 0x453efc
mov rax, qword [rsp + 0xe0]
mov qword [rax], rbx
mov qword [rax + 0x10], 2
test r13, r13
jne 0x453f48
jmp 0x453fce
cmp rbx, 3
jbe 0x454001
movzx eax, byte [rbx + r14 - 4]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x2e
jne 0x454088
movzx eax, byte [r14 + rbx - 3]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x65
jne 0x454103
movzx eax, byte [r14 + rbx - 2]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x78
jne 0x454103
movzx eax, byte [r14 + rbx - 1]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x65
sete al
jmp 0x454105
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x453efc
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [rsp + 0x208]
movaps xmmword [rsp + 0x1c0], xmm0
mov al, 1
mov dword [rsp + 0xe8], eax
mov dword [rsp + 0x1a0], 0
mov rsi, r13
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x260], rax
movaps xmm0, xmmword [rsp + 0x1c0]
movaps xmmword [rsp + 0x250], xmm0
mov qword [rsp + 0x1a8], r15
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rdx
cmp rdx, r15
jne 0x453a1e
lea rcx, [rsp + 0x1a8]
call fcn.00468720
mov rcx, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b8]
mov word [rcx + rdx*2], 0
inc qword [rsp + 0x1b8]
cmp byte [rsi + 0xac], 0
mov eax, 0x400
mov ebx, 0x608
cmove ebx, eax
or ebx, dword [rsi + 0xa8]
cmp qword [rsp + 0x230], 0
je 0x4540c4
mov r14, rsi
lea rax, [rsp + 0x238]
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0x170], rsi
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x160], xmm0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x68], 0
test rsi, rsi
jne 0x453ab8
lea rcx, [rsp + 0x58]
xor edx, edx
call fcn.00468720
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov word [rax + rcx*2], 0
inc qword [rsp + 0x68]
mov rax, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x168]
xor edx, edx
test rcx, rcx
cmove rsi, rcx
sete dl
add rdx, rdx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xd0], rsi
lea r15, [rsp + 0x128]
lea rcx, [rsp + 0xf0]
lea r8, [rsp + 0x90]
mov rsi, r14
mov rdx, r8
call fcn.0042f2d0
cmp byte [rsp + 0x108], 2
je 0x454ed5
mov r13, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x118]
mov r12, qword [rsp + 0x120]
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movaps xmmword [rsp + 0x190], xmm1
movaps xmmword [rsp + 0x180], xmm0
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
add rax, rcx
xor r11d, r11d
mov r8, rcx
jmp 0x453bad
xor r11d, r11d
test r9w, r9w
je 0x454034
mov r9w, 1
test r11w, r11w
jne 0x453ba0
cmp r8, rax
je 0x453c69
movzx r11d, byte [r8]
test r11b, r11b
js 0x453bd2
inc r8
mov r10d, r11d
jmp 0x453c31
mov r10d, r11d
and r10d, 0x1f
movzx edi, byte [r8 + 1]
and edi, 0x3f
cmp r11b, 0xdf
jbe 0x453c26
movzx esi, byte [r8 + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp r11b, 0xf0
jb 0x453c3c
movzx r11d, byte [r8 + 3]
add r8, 4
and r10d, 7
shl r10d, 0x12
shl esi, 6
and r11d, 0x3f
or r11d, esi
or r10d, r11d
cmp r10d, 0xffff
mov rsi, r14
jbe 0x453c31
jmp 0x453c53
add r8, 2
shl r10d, 6
or r10d, edi
xor r11d, r11d
mov r9d, r10d
jmp 0x453ba3
add r8, 3
shl r10d, 0xc
or r10d, esi
cmp r10d, 0xffff
mov rsi, r14
jbe 0x453c31
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x453ba3
mov rdi, r15
test rdx, rdx
je 0x453c7c
mov r8d, 1
call fcn.004018d0
lea rax, [r12*2]
add rax, rbp
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x58]
mov r15, qword [rsp + 0x68]
sub rax, r15
cmp rax, r12
jae 0x453cc8
lea rcx, [rsp + 0x58]
mov rdx, r15
mov r8, r12
call fcn.00468c70
mov r15, qword [rsp + 0x68]
lea r8, [r12 + r12]
lea rcx, [r15 + r15]
add rcx, qword [rsp + 0x60]
mov rdx, rbp
call sub.msvcrt.dll_memcpy
add r15, r12
mov qword [rsp + 0x68], r15
test r13, r13
je 0x453d03
add r13, r13
mov r8d, 2
mov rcx, rbp
mov rdx, r13
call fcn.004018d0
mov r15, qword [rsp + 0x68]
cmp r15, qword [rsp + 0x58]
jne 0x453d1c
lea rcx, [rsp + 0x58]
mov rdx, r15
call fcn.00468720
mov r15, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov word [rax + r15*2], 0x3d
inc qword [rsp + 0x68]
mov r12, qword [rsp + 0x180]
mov r13, qword [rsp + 0x188]
mov rdx, qword [rsp + 0x190]
movzx eax, byte [rsp + 0x198]
lea rcx, [rdx + r13]
xor r11d, r11d
mov r8, r13
mov r15, rdi
jmp 0x453d6d
xor r11d, r11d
test r9w, r9w
je 0x45471e
mov r9w, 1
test r11w, r11w
jne 0x453d60
cmp r8, rcx
je 0x453e29
movzx r11d, byte [r8]
test r11b, r11b
js 0x453d92
inc r8
mov r10d, r11d
jmp 0x453df1
mov r10d, r11d
and r10d, 0x1f
movzx edi, byte [r8 + 1]
and edi, 0x3f
cmp r11b, 0xdf
jbe 0x453de6
movzx esi, byte [r8 + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp r11b, 0xf0
jb 0x453dfc
movzx r11d, byte [r8 + 3]
add r8, 4
and r10d, 7
shl r10d, 0x12
shl esi, 6
and r11d, 0x3f
or r11d, esi
or r10d, r11d
cmp r10d, 0xffff
mov rsi, r14
jbe 0x453df1
jmp 0x453e13
add r8, 2
shl r10d, 6
or r10d, edi
xor r11d, r11d
mov r9d, r10d
jmp 0x453d63
add r8, 3
shl r10d, 0xc
or r10d, esi
cmp r10d, 0xffff
mov rsi, r14
jbe 0x453df1
and r10d, 0x3ff
or r10d, 0xdc00
mov r11d, r10d
jmp 0x453d63
cmp al, 2
je 0x45536c
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], rdx
lea r8, [rsp + 0x199]
mov edx, dword [r8]
mov r8d, dword [r8 + 3]
lea r9, [rsp + 0x89]
mov dword [r9 + 3], r8d
mov dword [r9], edx
mov qword [rsp + 0x70], r12
mov byte [rsp + 0x88], al
mov qword [rsp + 0x1c0], rcx
mov qword [rsp + 0x1c8], r13
mov word [rsp + 0x1d0], 0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x1c0]
call fcn.00449690
test r12, r12
je 0x453eaa
mov r8d, 1
mov rcx, r13
mov rdx, r12
call fcn.004018d0
mov rdx, qword [rsp + 0x68]
cmp rdx, qword [rsp + 0x58]
jne 0x453ed7
lea rcx, [rsp + 0x58]
call fcn.00468720
lea rcx, [rsp + 0xf0]
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0x68]
jmp 0x453ee7
lea rcx, [rsp + 0xf0]
lea r8, [rsp + 0x90]
mov rax, qword [rsp + 0x60]
mov word [rax + rdx*2], 0
inc qword [rsp + 0x68]
jmp 0x453b2a
mov rax, qword [rsp + 0xe0]
mov qword [rax], r15
mov qword [rax + 0x10], 2
xor esi, esi
test rbx, rbx
je 0x453f2f
mov rcx, qword [rsp + 0x210]
add rbx, rbx
mov r8d, 2
mov rdx, rbx
call fcn.004018d0
cmp qword [rsp + 0x230], 0
sete al
or sil, al
cmp sil, 1
je 0x453fce
mov rcx, qword [rsp + 0x240]
test rcx, rcx
je 0x453fa2
mov rdx, qword [rsp + 0x238]
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0xf8], rdx
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x118], rdx
mov qword [rsp + 0x120], rcx
xor ecx, ecx
jmp 0x453fa9
xor r15d, r15d
mov rdx, qword [rsp + 0xf0]
test rdx, rdx
jne 0x453651
jmp 0x453664
mov ecx, 2
xor eax, eax
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0xf0]
call fcn.004322e0
cmp dword [rsp + 0x1f8], 3
jb 0x453fe5
mov rcx, qword [rsp + 0x200]
call fcn.004be984
mov rax, qword [rsp + 0xe0]
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
nop word cs:[rax + rax]
cmp rbx, rax
je 0x454190
movzx ecx, byte [r14 + rax]
cmp ecx, 0x2f
je 0x454150
inc rax
cmp ecx, 0x5c
jne 0x454010
jmp 0x454150
test rdx, rdx
je 0x454044
mov r8d, 1
call fcn.004018d0
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x454064
mov rcx, qword [rsp + 0x188]
mov r8d, 1
call fcn.004018d0
lea rsi, str.nul_byte_found_in_provided_data
test r13, r13
je 0x45473b
add r13, r13
mov r8d, 2
mov rcx, rbp
mov rdx, r13
jmp 0x454736
mov r14, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x168]
xor eax, eax
nop word [rax + rax]
cmp rbx, rax
je 0x454190
movzx ecx, byte [r14 + rax]
cmp ecx, 0x2f
je 0x454150
inc rax
cmp ecx, 0x5c
jne 0x4540a0
jmp 0x454150
mov r14d, 2
xor r12d, r12d
xor eax, eax
xor r15d, r15d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rax
cmp byte [rsi + 0x18], 2
jne 0x4545d6
mov ecx, 2
xor edi, edi
xor eax, eax
xor edx, edx
mov qword [rsp + 0x220], rdx
jmp 0x454859
xor eax, eax
mov r14, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x168]
xor ecx, ecx
nop word [rax + rax]
cmp rbx, rcx
je 0x454190
movzx edx, byte [r14 + rcx]
cmp edx, 0x2f
je 0x454137
inc rcx
cmp edx, 0x5c
jne 0x454120
test al, al
je 0x454150
lea rcx, [rsp + 0x70]
mov rdx, r14
mov r8, rbx
call fcn.004468b0
jmp 0x4536f3
test rbx, rbx
je 0x454275
js 0x455374
mov r15, rbx
not r15
shr r15, 0x3f
mov rcx, rbx
mov rdx, r15
call fcn.004018c0
mov r12, rax
test rax, rax
jne 0x45427b
mov rcx, rbx
mov rdx, r15
call fcn.0048d440
jmp 0x455379
lea rax, [r14 + rbx]
xor r9d, r9d
mov rcx, r14
jmp 0x4541ac
xor r9d, r9d
test dx, dx
je 0x454269
mov dx, 1
test r9w, r9w
jne 0x4541a0
cmp rcx, rax
je 0x4546c4
movzx r8d, byte [rcx]
test r8b, r8b
js 0x4541cd
inc rcx
jmp 0x454231
mov r9d, r8d
and r9d, 0x1f
movzx r11d, byte [rcx + 1]
and r11d, 0x3f
cmp r8b, 0xdf
jbe 0x454223
movzx r10d, byte [rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r8b, 0xf0
jb 0x45423c
movzx r8d, byte [rcx + 3]
add rcx, 4
and r9d, 7
shl r9d, 0x12
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
or r8d, r9d
cmp r8d, 0xffff
jbe 0x454231
jmp 0x454253
add rcx, 2
shl r9d, 6
or r9d, r11d
mov r8d, r9d
xor r9d, r9d
mov edx, r8d
jmp 0x4541a3
add rcx, 3
shl r9d, 0xc
or r10d, r9d
mov r8d, r10d
cmp r8d, 0xffff
jbe 0x454231
and r8d, 0x3ff
or r8d, 0xdc00
mov r9d, r8d
jmp 0x4541a3
lea rax, str.nul_byte_found_in_provided_data
jmp 0x4536e5
mov r12d, 1
mov rcx, r12
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], rbx
mov byte [rsp + 0xa8], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x100], rax
movzx eax, byte [rsp + 0xa8]
mov byte [rsp + 0x108], al
mov eax, dword [rsp + 0xa9]
mov dword [rsp + 0x109], eax
movzx eax, word [rsp + 0xad]
mov word [rsp + 0x10d], ax
movzx eax, byte [rsp + 0xaf]
mov byte [rsp + 0x10f], al
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xf8], rax
lea rdx, str..exeprogram_not_found
lea rcx, [rsp + 0xf0]
mov r8d, 4
call fcn.00459ef0
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmm1, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xa0], xmm1
movaps xmmword [rsp + 0x90], xmm0
mov rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa0]
lea rcx, [rsp + 0xf0]
call fcn.004558a0
cmp qword [rsp + 0xf8], 0
je 0x454396
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x70], xmm0
jmp 0x4543c7
lea rdx, [0x004c8a40]
lea rcx, [rsp + 0x90]
xor r8d, r8d
call fcn.0040d0b0
mov rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.004468b0
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x4536f3
mov rcx, qword [rsp + 0x98]
mov r8d, 1
call fcn.004018d0
jmp 0x4536f3
movzx eax, word [r14 + r15*2 - 8]
lea ecx, [rax - 0x42]
cmp ecx, 0x21
ja case.0x454410.68
lea rdx, [0x004555c0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
movzx ecx, word [r14 + r15*2 - 6]
or ecx, 0x20
cmp ecx, 0x61
jne 0x45442e
movzx ecx, word [r14 + r15*2 - 4]
or ecx, 0x20
cmp ecx, 0x74
je 0x45445e
cmp ax, 0x43
jne case.0x454410.68
movzx eax, word [r14 + r15*2 - 6]
or eax, 0x20
cmp eax, 0x6d
jne case.0x454410.68
movzx eax, word [r14 + r15*2 - 4]
add eax, 0xffffffbc
test eax, 0xffdf
jne case.0x454410.68
lea rcx, [rsp + 0xf0]
call fcn.0043d9d0
mov r12, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xf8]
test rax, rax
je 0x4547bf
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
lea rdx, str.cmd.exeEnvKeyos_string
lea rcx, [rsp + 0x90]
mov r8d, 8
call fcn.004a7c20
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x120], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0xf0], 1
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 1
mov word [rsp + 0x108], 0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xf0]
call fcn.00449820
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
test r13, r13
je 0x4547bf
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x180], r12
mov qword [rsp + 0x188], r13
mov qword [rsp + 0x190], rax
mov r9, qword [rsi + 0x98]
mov rax, qword [rsi + 0xa0]
movzx ecx, byte [rsi + 0xad]
mov byte [rsp + 0x28], cl
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xf0]
mov rdx, r14
mov r8, r15
call fcn.00446580
mov r15, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x455297
mov rdx, qword [rsp + 0x100]
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x1c0], xmm0
mov al, 1
mov dword [rsp + 0x1a0], eax
mov dword [rsp + 0xe8], 0
jmp 0x4539c4
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
add rcx, rax
xor r10d, r10d
mov rdx, rax
jmp 0x4545fd
xor r10d, r10d
test r8w, r8w
je 0x4546ff
mov r8w, 1
test r10w, r10w
jne 0x4545f0
cmp rdx, rcx
je 0x4547cf
movzx r9d, byte [rdx]
test r9b, r9b
js 0x45461f
inc rdx
jmp 0x454689
mov rdi, rsi
mov r10d, r9d
and r10d, 0x1f
movzx esi, byte [rdx + 1]
and esi, 0x3f
cmp r9b, 0xdf
jbe 0x454678
movzx r11d, byte [rdx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r9b, 0xf0
jb 0x454694
movzx r9d, byte [rdx + 3]
add rdx, 4
and r10d, 7
shl r10d, 0x12
shl r11d, 6
and r9d, 0x3f
or r9d, r11d
or r9d, r10d
mov rsi, rdi
cmp r9d, 0xffff
jbe 0x454689
jmp 0x4546ae
add rdx, 2
shl r10d, 6
or r10d, esi
mov r9d, r10d
mov rsi, rdi
xor r10d, r10d
mov r8d, r9d
jmp 0x4545f3
add rdx, 3
shl r10d, 0xc
or r11d, r10d
mov r9d, r11d
mov rsi, rdi
cmp r9d, 0xffff
jbe 0x454689
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x4545f3
cmp rbx, 0x10
jae 0x4547a6
test rbx, rbx
je 0x454bb5
dec rbx
xor ecx, ecx
nop dword [rax]
cmp byte [r14 + rcx], 0x2e
sete al
je 0x454bb7
lea rdx, [rcx + 1]
cmp rbx, rcx
mov rcx, rdx
jne 0x4546e0
jmp 0x454bb7
lea rax, str.nul_byte_found_in_provided_data
mov rcx, qword [rsp + 0xe0]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
jmp 0x454ad8
lea rsi, str.nul_byte_found_in_provided_data
test r12, r12
je 0x45473b
mov r8d, 1
mov rcx, r13
mov rdx, r12
call fcn.004018d0
lea rcx, [rsp + 0x90]
call fcn.004322e0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x454765
mov rcx, qword [rsp + 0x60]
add rdx, rdx
mov r8d, 2
call fcn.004018d0
mov rax, qword [rsp + 0xe0]
mov qword [rax], rsi
mov qword [rax + 0x10], 2
jmp 0x454af1
mov rsi, qword [rsp + 0xe8]
mov r13, qword [rsp + 0x1a0]
xor r15d, r15d
mov rdx, qword [rsp + 0xf0]
test rdx, rdx
jne 0x453651
jmp 0x453664
mov cl, 0x2e
mov rdx, r14
mov r8, rbx
call fcn.004b53f0
cmp rax, 1
sete al
jmp 0x454bb7
mov rax, qword [rsp + 0xe0]
mov qword [rax], r12
jmp 0x453f07
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0xf0]
call fcn.0044a980
mov rdx, qword [rsp + 0xa0]
cmp rdx, qword [rsp + 0x90]
jne 0x454825
lea rcx, [rsp + 0x90]
call fcn.00468720
mov rdx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x98]
mov word [rax + rdx*2], 0
mov rax, qword [rsp + 0xa0]
inc rax
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov rdx, rcx
mov qword [rsp + 0x220], rcx
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x228], rcx
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x180], xmm0
mov qword [rsp + 0x190], 0
lea r13, [0x004fb228]
mov rcx, r13
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [0x004e75a8]
mov rax, qword [rax]
shl rax, 1
test rax, rax
mov qword [rsp + 0x1f0], r14
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x270], r15
je 0x4548d7
call fcn.0040fa40
mov ebp, eax
xor bpl, 1
jmp 0x4548d9
xor ebp, ebp
movzx eax, byte [rsp + 0x2e0]
movzx r15d, byte [0x004fb230]
xor ecx, ecx
test r15b, r15b
setne cl
mov qword [rsp + 0x78], r13
mov byte [rsp + 0x80], bpl
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x90], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xb0], 0
test al, al
lea rax, [rsp + 0x1f8]
lea rdx, [rsp + 0x160]
cmovne rdx, rax
mov qword [rsp + 0x160], 1
lea rcx, [rsi + 0x60]
cmp dword [rsi + 0x60], 5
cmove rcx, rdx
cmp dword [rsi + 0x70], 5
lea r14, [rsi + 0x70]
cmove r14, rax
lea r13, [rsi + 0x80]
cmp dword [rsi + 0x80], 5
cmove r13, rax
lea r8, [rsp + 0x90]
mov edx, 0xfffffff6
call fcn.00455990
mov rdi, rdx
test rax, rax
je 0x454a41
mov rax, qword [rsp + 0xe0]
mov qword [rax], rdi
mov qword [rax + 0x10], 2
cmp dword [rsp + 0x160], 3
jb 0x4549bb
mov rcx, qword [rsp + 0x168]
call fcn.004be984
cmp qword [rsp + 0x90], 0
je 0x4549d3
mov rcx, qword [rsp + 0x98]
call fcn.004be984
cmp qword [rsp + 0xa0], 0
je 0x4549eb
mov rcx, qword [rsp + 0xa8]
call fcn.004be984
cmp qword [rsp + 0xb0], 0
je 0x454a03
mov rcx, qword [rsp + 0xb8]
call fcn.004be984
movabs rax, 0x7fffffffffffffff
test r15b, r15b
je 0x454a7a
test bpl, bpl
mov r14, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x1e8]
jne 0x454aae
mov rcx, qword [0x004e75a8]
mov rcx, qword [rcx]
test rcx, rax
je 0x454aae
call fcn.0040fa40
jmp 0x454aa3
lea r8, [rsp + 0xa0]
mov rcx, r14
mov edx, 0xfffffff5
call fcn.00455990
mov r14, rdx
test rax, rax
je 0x454b5e
mov rax, qword [rsp + 0xe0]
mov qword [rax], r14
mov qword [rax + 0x10], 2
jmp 0x454b9a
test bpl, bpl
mov r14, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x1e8]
jne 0x454aae
mov rcx, qword [0x004e75a8]
mov rcx, qword [rcx]
test rcx, rax
je 0x454aae
call fcn.0040fa40
test al, al
jne 0x454aae
mov byte [0x004fb230], 1
lea rcx, [0x004fb228]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
test rsi, rsi
je 0x454ad8
add rsi, rsi
mov r8d, 2
mov rcx, qword [rsp + 0x228]
mov rdx, rsi
call fcn.004018d0
test r12, r12
je 0x454af1
add r12, r12
mov r8d, 2
mov rcx, r14
mov rdx, r12
call fcn.004018d0
mov rdx, qword [rsp + 0x1a8]
test rdx, rdx
je 0x454b14
mov rcx, qword [rsp + 0x1b0]
add rdx, rdx
mov r8d, 2
call fcn.004018d0
mov rdx, qword [rsp + 0x250]
test rdx, rdx
je 0x454b37
mov rcx, qword [rsp + 0x258]
add rdx, rdx
mov r8d, 2
call fcn.004018d0
cmp byte [rsp + 0xe8], 0
jne 0x453fce
mov sil, 1
mov rbx, qword [rsp + 0x208]
test rbx, rbx
jne 0x453f16
jmp 0x453f2f
lea r8, [rsp + 0xb0]
mov rcx, r13
mov edx, 0xfffffff4
call fcn.00455990
mov rsi, rdx
test rax, rax
je 0x455092
mov rax, qword [rsp + 0xe0]
mov qword [rax], rsi
mov qword [rax + 0x10], 2
mov rcx, r14
call fcn.004be984
mov rcx, rdi
call fcn.004be984
cmp dword [rsp + 0x160], 3
jae 0x4549ae
jmp 0x4549bb
xor eax, eax
mov byte [rsp + 0x1a8], al
lea rax, [rsp + 0x160]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x60], rax
test r15, r15
je 0x454cf1
mov rdi, rsi
add r12, r15
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r15
mov word [rsp + 0x80], 0
mov byte [rsp + 0x88], 1
lea r12, [rsp + 0xa9]
lea rsi, [rsp + 0x109]
lea rbx, [rsp + 0xf0]
lea r14, [rsp + 0x70]
lea r15, [rsp + 0x1a8]
nop dword [rax + rax]
mov rcx, rbx
mov rdx, r14
call fcn.00436480
movzx eax, byte [rsp + 0x108]
cmp al, 2
je 0x454cee
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
test r8, r8
je 0x454cd5
mov r9d, dword [rsi]
mov r10d, dword [rsi + 3]
mov dword [r12 + 3], r10d
mov dword [r12], r9d
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], r8
mov byte [rsp + 0xa8], al
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r9, r15
call fcn.00455820
mov rbp, qword [rsp + 0xf8]
test rbp, rbp
je 0x454c30
jmp 0x454e2e
test rdx, rdx
je 0x454c30
mov r8d, 1
call fcn.004018d0
jmp 0x454c30
mov rsi, rdi
lea rcx, [rsp + 0x70]
call fcn.0043e1e0
cmp byte [rsp + 0x88], 2
jne 0x454d14
lea rcx, [rsp + 0x70]
call fcn.0044ee90
jmp 0x454e43
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
mov rdx, rbx
call fcn.0040d550
test rax, rax
je 0x454d5b
cmp rbx, rdx
jb 0x454d5b
mov qword [rsp + 0xa0], rdx
movaps xmm0, xmmword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x108], rax
movaps xmmword [rsp + 0xf0], xmm0
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
lea rcx, [rsp + 0xf0]
call fcn.0040c540
cmp byte [rsp + 0x1a8], 0
jne 0x454dcc
lea rdx, str.exeNULexit_code:
lea rcx, [rsp + 0xf0]
mov r8d, 3
call fcn.0040d0b0
mov rdx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
lea rcx, [rsp + 0x180]
call fcn.004558a0
mov rdi, rsi
mov rdx, qword [rsp + 0xf0]
test rdx, rdx
je 0x454e0c
mov rcx, qword [rsp + 0xf8]
mov r8d, 1
call fcn.004018d0
mov rbp, qword [rsp + 0x188]
test rbp, rbp
je 0x454e40
mov rsi, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x190]
jmp 0x454ebb
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0x100]
jmp 0x454ebb
mov rsi, rdi
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x58]
call fcn.0043c570
cmp qword [rsp + 0xf0], 0
jne 0x454e6d
mov rbp, qword [rsp + 0x100]
test rbp, rbp
jne 0x454ea8
lea rcx, [rsp + 0xf0]
call fcn.0044ea60
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x58]
call fcn.0043d520
cmp qword [rsp + 0xf0], 0
jne 0x454f22
mov rbp, qword [rsp + 0x100]
test rbp, rbp
je 0x454f22
mov rdi, rsi
mov rsi, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x108]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rbx
mov rsi, rdi
jmp 0x4536f3
lea rcx, [rsp + 0x90]
call fcn.004322e0
mov rdx, qword [rsp + 0x68]
cmp rdx, qword [rsp + 0x58]
jne 0x454efd
lea rcx, [rsp + 0x58]
call fcn.00468720
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov word [rax + rdx*2], 0
mov rax, qword [rsp + 0x68]
inc rax
mov r12, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov r15, r14
jmp 0x4540d2
lea rcx, [rsp + 0xf0]
call fcn.0044ea60
lea rdx, str.PATH_program_path_has_no_file_name
lea rcx, [rsp + 0x1c0]
mov r8d, 4
call fcn.004367e0
cmp byte [rsp + 0x1d8], 2
je 0x4552fa
mov rdi, rsi
movups xmm0, xmmword [rsp + 0x1c0]
movups xmm1, xmmword [rsp + 0x1d0]
movaps xmmword [rsp + 0x180], xmm0
movaps xmmword [rsp + 0x190], xmm1
mov rcx, qword [rsp + 0x188]
mov rax, qword [rsp + 0x190]
add rax, rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0x78], rcx
mov word [rsp + 0x80], 0
mov byte [rsp + 0x88], 1
lea rsi, [rsp + 0xa9]
lea rbx, [rsp + 0x109]
lea r14, [rsp + 0xf0]
lea r15, [rsp + 0x70]
lea r12, [rsp + 0x1a8]
mov rcx, r14
mov rdx, r15
call fcn.00436480
movzx eax, byte [rsp + 0x108]
cmp al, 2
je 0x4552d7
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
test r8, r8
je 0x455079
mov r9d, dword [rbx]
mov r10d, dword [rbx + 3]
mov dword [rsi + 3], r10d
mov dword [rsi], r9d
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], r8
mov byte [rsp + 0xa8], al
mov rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x168]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov r9, r12
call fcn.00455820
mov rbp, qword [rsp + 0xf8]
test rbp, rbp
je 0x454fd6
jmp 0x455333
test rdx, rdx
je 0x454fd6
mov r8d, 1
call fcn.004018d0
jmp 0x454fd6
xorps xmm0, xmm0
movups xmmword [rsp + 0x124], xmm0
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x108], xmm0
movups xmmword [rsp + 0xf8], xmm0
movups xmmword [rsp + 0x138], xmm0
movups xmmword [rsp + 0x148], xmm0
mov dword [rsp + 0xf0], 0x68
test rsi, rsi
jne 0x4550df
test r14, r14
jne 0x4550df
test rdi, rdi
je 0x455102
mov dword [rsp + 0x12c], 0x100
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], rsi
mov r13, qword [rsp + 0x258]
mov rdx, qword [rsp + 0x1b0]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
mov rcx, r13
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessW
test eax, eax
je 0x455306
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movups xmm2, xmmword [rsp + 0xb0]
mov rax, qword [rsp + 0xe0]
movups xmmword [rax + 0x30], xmm2
movups xmmword [rax + 0x20], xmm1
movups xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x180]
movups xmmword [rax], xmm0
mov rcx, rsi
call fcn.004be984
mov rcx, r14
call fcn.004be984
mov rcx, rdi
call fcn.004be984
cmp dword [rsp + 0x160], 3
jb 0x4551ce
mov rcx, qword [rsp + 0x168]
call fcn.004be984
lea rcx, [rsp + 0x70]
call fcn.0044ec20
mov rsi, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x1e8]
test rdx, rdx
je 0x455203
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x228]
call fcn.004018d0
test r12, r12
je 0x45521c
add r12, r12
mov r8d, 2
mov rcx, rsi
mov rdx, r12
call fcn.004018d0
mov rdx, qword [rsp + 0x1a8]
test rdx, rdx
je 0x45523f
mov rcx, qword [rsp + 0x1b0]
add rdx, rdx
mov r8d, 2
call fcn.004018d0
mov rdx, qword [rsp + 0x250]
test rdx, rdx
je 0x45525d
add rdx, rdx
mov r8d, 2
mov rcx, r13
call fcn.004018d0
cmp byte [rsp + 0x1a0], 0
je 0x453fce
mov rdx, qword [rsp + 0x208]
test rdx, rdx
je 0x453fce
mov rcx, qword [rsp + 0x210]
add rdx, rdx
mov r8d, 2
call fcn.004018d0
jmp 0x453fce
mov rax, qword [rsp + 0xe0]
mov qword [rax], r15
mov qword [rax + 0x10], 2
test r12, r12
je 0x453f0f
add r12, r12
mov r8d, 2
mov rcx, r13
mov rdx, r12
call fcn.004018d0
xor esi, esi
test rbx, rbx
jne 0x453f16
jmp 0x453f2f
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x4552f7
mov r8d, 1
mov rcx, qword [rsp + 0xe8]
call fcn.004018d0
mov rsi, rdi
lea rax, [0x004c8d60]
jmp 0x4536e5
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0xe0]
mov qword [rcx], rax
mov qword [rcx + 0x10], 2
mov rcx, rsi
call fcn.004be984
jmp 0x454b92
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x454ebb
mov r8d, 1
mov rcx, qword [rsp + 0xe8]
call fcn.004018d0
jmp 0x454ebb
mov rsi, r12
jmp 0x45473b
call fcn.0048bbc0
ud2