Function at 0x1400f4d80
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x228
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x210], r8
mov qword [rsp + 0x218], r9
add rdx, 0x40
lea rcx, [rsp + 0x1e8]
call fcn.1400f70d0
cmp qword [rsp + 0x1e8], 0
mov qword [rsp + 0x190], rsi
je 0x1400f4ef9
mov ecx, 4
mov edx, 1
call fcn.14000dd80
test rax, rax
je 0x1400f6c8e
mov rdi, rax
mov dword [rax], 0x48544150
add rax, 4
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
mov word [rsp + 0x80], 0
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x70]
call fcn.1400f4000
mov r12, qword [rsp + 0x1f8]
test r12, r12
je 0x1400f4f25
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0x60], rbp
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x68], rax
mov r14, qword [rsp + 0x148]
mov ebp, dword [rsp + 0x150]
mov rsi, qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
lea rcx, [r12 + 0x168]
movzx eax, word [r12 + 0x3d2]
mov qword [rsp + 0x1b8], rax
imul rbx, rax, 0x38
lea rdi, [r12 - 0x10]
mov r15, 0xffffffffffffffff
nop word cs:[rax + rax]
test rbx, rbx
je 0x1400f4ed0
lea r13, [rcx + 0x38]
mov r8, qword [rcx + 0x28]
mov r9d, dword [rcx + 0x30]
mov dword [rsp + 0x20], 1
mov rcx, r14
mov edx, ebp
call rsi
add rbx, 0xffffffffffffffc8
add rdi, 0x20
inc r15
mov rcx, r13
cmp eax, 3
je 0x1400f4e90
cmp eax, 1
jne 0x1400f4efe
jmp 0x1400f4ed8
mov r15, qword [rsp + 0x1b8]
mov rax, qword [rsp + 0x68]
sub rax, 1
jb 0x1400f5eff
mov qword [rsp + 0x68], rax
mov r12, qword [r12 + r15*8 + 0x3d8]
jmp 0x1400f4e5d
xor r15d, r15d
jmp 0x1400f4f5e
cmp eax, 2
jne 0x1400f6c85
mov r15, qword [rdi - 8]
mov r12, qword [rdi]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x1b0]
jmp 0x1400f4f28
xor r15d, r15d
mov edx, 4
mov r8d, 1
mov rcx, rdi
call fcn.14000dd90
mov rdx, qword [rsp + 0x140]
test rdx, rdx
je 0x1400f4f5e
mov rcx, qword [rsp + 0x148]
add rdx, rdx
mov r8d, 2
call fcn.14000dd90
mov r14, qword [rsi + 0x28]
mov rbx, qword [rsi + 0x30]
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x1a0], rbx
test rbx, rbx
je 0x1400f5083
cmp rbx, 4
jae 0x1400f5058
lea rdx, [0x1400f7d60]
movzx ecx, byte [rbx + r14 - 1]
call rdx
test al, al
jne 0x1400f5083
cmp rbx, 3
jbe 0x1400f5488
movzx eax, byte [rbx + r14 - 4]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x2e
jne 0x1400f54ad
movzx eax, byte [r14 + rbx - 3]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
mov al, 1
cmp cl, 0x65
jne 0x1400f5015
movzx ecx, byte [r14 + rbx - 2]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x78
jne 0x1400f5015
movzx eax, byte [r14 + rbx - 1]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x65
setne al
xor ecx, ecx
nop word [rax + rax]
cmp rbx, rcx
je 0x1400f5615
movzx edx, byte [r14 + rcx]
cmp edx, 0x2f
je 0x1400f503b
inc rcx
cmp edx, 0x5c
jne 0x1400f5020
test al, al
jne 0x1400f54cb
lea rcx, [rsp + 0xf0]
mov rdx, r14
mov r8, rbx
call fcn.1400f2fc0
jmp 0x1400f509e
mov eax, dword [str._mainfatal_runtime_error:__n]
cmp eax, dword [r14]
lea rax, [0x1400f7d70]
lea rdx, [0x1400f7d60]
cmove rdx, rax
movzx ecx, byte [rbx + r14 - 1]
call rdx
test al, al
je 0x1400f4fa0
lea rax, [0x1401c42e0]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 0
mov r14, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xf8]
test rax, rax
je 0x1400f521b
mov r15, qword [rsp + 0x100]
cmp r15, 5
mov qword [rsp + 0x68], rax
jb case.0x1400f57c1.68
cmp word [rax + r15*2 - 0xa], 0x2e
jne case.0x1400f57c1.68
cmp word [rax + r15*2 - 2], 0
je 0x1400f579c
mov rbx, rbp
mov rdi, qword [rsi + 0x28]
mov r15, qword [rsi + 0x98]
mov rax, rsi
mov rsi, qword [rsi + 0xa0]
movzx ebp, byte [rax + 0xad]
mov r13, qword [rax + 0x30]
add r13, rdi
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x80], 0
lea r12, [rsp + 0x70]
mov rcx, r12
xor edx, edx
call fcn.1400fc150
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov word [rax + rcx*2], 0x22
inc qword [rsp + 0x80]
mov qword [rsp + 0x120], r13
mov qword [rsp + 0x128], rdi
mov word [rsp + 0x130], 0
lea rdx, [rsp + 0x120]
mov rcx, r12
call fcn.1400f3460
mov rdx, qword [rsp + 0x80]
cmp rdx, qword [rsp + 0x70]
jne 0x1400f5199
lea rcx, [rsp + 0x70]
call fcn.1400fc150
mov rdx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov word [rax + rdx*2], 0x22
inc qword [rsp + 0x80]
shl rsi, 3
lea rsi, [rsi + rsi*4]
lea r13, [rsp + 0x70]
jmp 0x1400f51f5
lea rdi, [r15 + 0x28]
mov rax, qword [rsp + 0x78]
mov word [rax + rdx*2], 0x20
inc qword [rsp + 0x80]
mov rcx, r13
mov rdx, r15
mov r8d, ebp
call fcn.1400f2840
add rsi, 0xffffffffffffffd8
mov r15, rdi
test rax, rax
jne 0x1400f5390
test rsi, rsi
je 0x1400f523b
mov rdx, qword [rsp + 0x80]
cmp rdx, qword [rsp + 0x70]
jne 0x1400f51c0
mov rcx, r13
call fcn.1400fc150
mov rdx, qword [rsp + 0x80]
jmp 0x1400f51c0
mov qword [rbp], r14
mov qword [rbp + 0x10], 2
cmp qword [rsp + 0x1e8], 0
jne 0x1400f53ec
jmp 0x1400f5459
mov r12, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400f53b0
mov rdx, qword [rsp + 0x80]
mov cl, 1
mov dword [rsp + 0x1b0], ecx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x1c0], rcx
mov qword [rsp + 0x1b8], r14
mov rbp, rbx
mov rsi, qword [rsp + 0x190]
mov qword [rsp + 0x1c8], r12
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rdx
cmp rdx, r12
mov qword [rsp + 0x60], rbp
jne 0x1400f52be
lea rcx, [rsp + 0x1c8]
call fcn.1400fc150
mov rax, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1d8]
mov word [rax + rdx*2], 0
inc qword [rsp + 0x1d8]
cmp byte [rsi + 0xac], 0
mov eax, 0x400
mov ebp, 0x608
cmove ebp, eax
or ebp, dword [rsi + 0xa8]
cmp qword [rsp + 0x1e8], 0
je 0x1400f5705
mov rdi, qword [rsp + 0x1f0]
mov r15, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x200]
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 2
mov qword [rsp + 0xd0], 0
test rsi, rsi
jne 0x1400f5363
lea rcx, [rsp + 0xc0]
xor edx, edx
call fcn.1400fc150
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
mov word [rax + rcx*2], 0
inc qword [rsp + 0xd0]
test r15, r15
je 0x1400f5930
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], r15
xor eax, eax
jmp 0x1400f5937
mov r12, rax
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400f53b0
mov rcx, qword [rsp + 0x78]
add rdx, rdx
mov r8d, 2
call fcn.14000dd90
mov rbp, rbx
mov qword [rbx], r12
mov qword [rbx + 0x10], 2
xor esi, esi
mov rcx, qword [rsp + 0x68]
test r14, r14
je 0x1400f53db
add r14, r14
mov r8d, 2
mov rdx, r14
call fcn.14000dd90
cmp qword [rsp + 0x1e8], 0
sete al
or sil, al
jne 0x1400f5459
mov rcx, qword [rsp + 0x1f8]
test rcx, rcx
je 0x1400f542d
mov rdx, qword [rsp + 0x1f0]
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x148], rdx
mov qword [rsp + 0x150], rcx
xor ecx, ecx
jmp 0x1400f5434
mov ecx, 2
xor eax, eax
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x120]
call fcn.1400f8cd0
cmp dword [rsp + 0x210], 3
jb 0x1400f5471
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbp
add rsp, 0x228
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
nop word [rax + rax]
cmp rbx, rax
je 0x1400f5615
movzx ecx, byte [r14 + rax]
cmp ecx, 0x2f
je 0x1400f54cb
inc rax
cmp ecx, 0x5c
jne 0x1400f5490
jmp 0x1400f54cb
xor eax, eax
nop
cmp rbx, rax
je 0x1400f5615
movzx ecx, byte [r14 + rax]
cmp ecx, 0x2f
je 0x1400f54cb
inc rax
cmp ecx, 0x5c
jne 0x1400f54b0
xor r15d, r15d
test rbx, rbx
setns al
js 0x1400f6c9f
mov r15b, al
mov rcx, rbx
mov rdx, r15
call fcn.14000dd80
test rax, rax
je 0x1400f6ca6
mov r12, rax
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.14012ca80
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], rbx
mov byte [rsp + 0x88], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x130], rax
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x138], al
mov eax, dword [rsp + 0x89]
mov dword [rsp + 0x139], eax
movzx eax, word [rsp + 0x8d]
mov word [rsp + 0x13d], ax
movzx eax, byte [rsp + 0x8f]
mov byte [rsp + 0x13f], al
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x128], rax
lea rdx, str..exeprogram_not_found
lea rcx, [rsp + 0x120]
mov r8d, 4
call fcn.1400f0ec0
movaps xmm0, xmmword [rsp + 0x120]
movaps xmm1, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.1400f6d40
cmp qword [rsp + 0x128], 0
je 0x1400f574b
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0xf0], xmm0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
jne 0x1400f5787
jmp 0x1400f509e
lea rax, [r14 + rbx]
xor r9d, r9d
mov rcx, r14
jmp 0x1400f563c
xor r9d, r9d
test dx, dx
je 0x1400f56f9
mov dx, 1
test r9w, r9w
jne 0x1400f5630
cmp rcx, rax
je 0x1400f5ecc
movzx r8d, byte [rcx]
test r8b, r8b
js 0x1400f565d
inc rcx
jmp 0x1400f56c1
mov r9d, r8d
and r9d, 0x1f
movzx r11d, byte [rcx + 1]
and r11d, 0x3f
cmp r8b, 0xdf
jbe 0x1400f56b3
movzx r10d, byte [rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r8b, 0xf0
jb 0x1400f56cc
movzx r8d, byte [rcx + 3]
add rcx, 4
and r9d, 7
shl r9d, 0x12
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
or r8d, r9d
cmp r8d, 0xffff
jbe 0x1400f56c1
jmp 0x1400f56e3
add rcx, 2
shl r9d, 6
or r9d, r11d
mov r8d, r9d
xor r9d, r9d
mov edx, r8d
jmp 0x1400f5633
add rcx, 3
shl r9d, 0xc
or r10d, r9d
mov r8d, r10d
cmp r8d, 0xffff
jbe 0x1400f56c1
and r8d, 0x3ff
or r8d, 0xdc00
mov r9d, r8d
jmp 0x1400f5633
lea rax, str.nul_byte_found_in_provided_data
jmp 0x1400f508a
mov r15d, 2
xor ebx, ebx
xor r12d, r12d
cmp byte [rsi + 0x18], 2
jne 0x1400f5d5a
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0x1a8], rbx
mov rbx, rsi
mov eax, 2
mov qword [rsp + 0x1e0], rax
xor eax, eax
mov qword [rsp + 0x188], rax
xor eax, eax
jmp 0x1400f5f99
lea rdx, str.nul_byte_found_in_provided_data
lea rcx, [rsp + 0x70]
xor r8d, r8d
call fcn.1400ef310
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0xf0]
call fcn.1400f2fc0
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400f509e
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call fcn.14000dd90
jmp 0x1400f509e
movzx eax, word [rax + r15*2 - 8]
lea ecx, [rax - 0x42]
cmp ecx, 0x21
ja case.0x1400f57c1.68
lea rdx, [0x1400f6cb4]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
mov rdx, qword [rsp + 0x68]
jmp rcx
movzx ecx, word [rdx + r15*2 - 6]
or ecx, 0x20
cmp ecx, 0x61
jne 0x1400f57df
movzx ecx, word [rdx + r15*2 - 4]
or ecx, 0x20
cmp ecx, 0x74
je 0x1400f580f
cmp ax, 0x43
jne case.0x1400f57c1.68
movzx eax, word [rdx + r15*2 - 6]
or eax, 0x20
cmp eax, 0x6d
jne case.0x1400f57c1.68
movzx eax, word [rdx + r15*2 - 4]
add eax, 0xffffffbc
test eax, 0xffdf
jne case.0x1400f57c1.68
lea rcx, [rsp + 0x120]
call fcn.1400fa780
mov rdx, qword [rsp + 0x120]
mov rax, qword [rsp + 0x128]
test rax, rax
je 0x1400f657c
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rcx
lea rcx, [rsp + 0x140]
lea rdx, [0x1401c432e]
mov r8d, 8
call fcn.1401021c0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 1
mov word [rsp + 0x138], 0
mov qword [rsp + 0x120], 1
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x120]
call fcn.1400f35f0
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x1c0], rax
test rax, rax
je 0x1400f657c
mov qword [rsp + 0x1b8], rdx
mov r9, qword [rsi + 0x98]
mov rax, qword [rsi + 0xa0]
movzx ecx, byte [rsi + 0xad]
mov byte [rsp + 0x28], cl
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x120]
mov rdx, qword [rsp + 0x68]
mov r8, r15
call fcn.1400f2cb0
mov r12, qword [rsp + 0x120]
mov rax, qword [rsp + 0x128]
test rax, rax
je 0x1400f69a2
mov dword [rsp + 0x1b0], 0
mov rdx, qword [rsp + 0x130]
jmp 0x1400f527f
mov eax, 2
xor esi, esi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xb0], rsi
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x70]
call fcn.1400f8320
movzx eax, byte [rsp + 0x138]
cmp al, 2
je 0x1400f5cf6
mov r12, qword [rsp + 0x140]
mov rbx, qword [rsp + 0x148]
mov r15, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x158]
mov qword [rsp + 0xe8], rcx
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x188], rcx
mov rcx, qword [rsp + 0x168]
mov qword [rsp + 0x1a8], rcx
movzx ecx, byte [rsp + 0x170]
mov byte [rsp + 0x11c], cl
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
add r8, rcx
xor esi, esi
mov r9, rcx
jmp 0x1400f59fc
xor esi, esi
test r10w, r10w
je 0x1400f5e6e
mov r10w, 1
test si, si
jne 0x1400f59f0
cmp r9, r8
je 0x1400f5ab1
movzx esi, byte [r9]
test sil, sil
js 0x1400f5a20
inc r9
mov r11d, esi
jmp 0x1400f5a7d
mov r11d, esi
and r11d, 0x1f
movzx r13d, byte [r9 + 1]
and r13d, 0x3f
cmp sil, 0xdf
jbe 0x1400f5a72
movzx edi, byte [r9 + 2]
shl r13d, 6
and edi, 0x3f
or edi, r13d
cmp sil, 0xf0
jb 0x1400f5a87
movzx esi, byte [r9 + 3]
add r9, 4
and r11d, 7
shl r11d, 0x12
shl edi, 6
and esi, 0x3f
or esi, edi
or r11d, esi
cmp r11d, 0xffff
jbe 0x1400f5a7d
jmp 0x1400f5a9b
add r9, 2
shl r11d, 6
or r11d, r13d
xor esi, esi
mov r10d, r11d
jmp 0x1400f59f2
add r9, 3
shl r11d, 0xc
or r11d, edi
cmp r11d, 0xffff
jbe 0x1400f5a7d
and r11d, 0x3ff
or r11d, 0xdc00
mov esi, r11d
jmp 0x1400f59f2
cmp al, 2
je 0x1400f6c26
test rdx, rdx
je 0x1400f5ac9
mov r8d, 1
call fcn.14000dd90
lea r8, [r15 + r15]
mov rax, qword [rsp + 0xc0]
mov r13, qword [rsp + 0xd0]
sub rax, r13
cmp rax, r15
mov rsi, qword [rsp + 0x1a8]
jb 0x1400f5cd0
mov rcx, r13
add rcx, r13
add rcx, qword [rsp + 0xc8]
mov rdx, rbx
call fcn.14012ca80
add r15, r13
mov qword [rsp + 0xd0], r15
test r12, r12
je 0x1400f5b33
add r12, r12
mov r8d, 2
mov rcx, rbx
mov rdx, r12
call fcn.14000dd90
mov r15, qword [rsp + 0xd0]
cmp r15, qword [rsp + 0xc0]
jne 0x1400f5b55
lea rcx, [rsp + 0xc0]
mov rdx, r15
call fcn.1400fc150
mov r15, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x188]
mov rax, qword [rsp + 0xc8]
mov word [rax + r15*2], 0x3d
inc qword [rsp + 0xd0]
add rsi, rbx
xor r8d, r8d
mov rax, rbx
jmp 0x1400f5b8c
xor r8d, r8d
test cx, cx
je 0x1400f6506
mov cx, 1
test r8w, r8w
jne 0x1400f5b80
cmp rax, rsi
je 0x1400f5c36
movzx r8d, byte [rax]
test r8b, r8b
js 0x1400f5bb0
inc rax
mov edx, r8d
jmp 0x1400f5c18
mov edx, r8d
and edx, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp r8b, 0xdf
jbe 0x1400f5bfa
movzx r9d, byte [rax + 2]
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
cmp r8b, 0xf0
jb 0x1400f5c06
movzx r8d, byte [rax + 3]
add rax, 4
and edx, 7
shl edx, 0x12
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
or edx, r8d
jmp 0x1400f5c10
add rax, 2
shl edx, 6
or edx, r10d
jmp 0x1400f5c18
add rax, 3
shl edx, 0xc
or edx, r9d
cmp edx, 0xffff
ja 0x1400f5c22
xor r8d, r8d
mov ecx, edx
jmp 0x1400f5b83
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x1400f5b83
cmp byte [rsp + 0x11c], 2
je 0x1400f6c44
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rbx
mov word [rsp + 0x100], 0
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0xf0]
call fcn.1400f3460
mov rdx, qword [rsp + 0xe8]
test rdx, rdx
je 0x1400f5c8e
mov r8d, 1
mov rcx, rbx
call fcn.14000dd90
mov rdx, qword [rsp + 0xd0]
cmp rdx, qword [rsp + 0xc0]
jne 0x1400f5cb5
lea rcx, [rsp + 0xc0]
call fcn.1400fc150
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0xc8]
mov word [rax + rdx*2], 0
inc qword [rsp + 0xd0]
jmp 0x1400f594c
lea rcx, [rsp + 0xc0]
mov rdx, r13
mov rdi, r8
mov r8, r15
call fcn.140130160
mov r8, rdi
mov r13, qword [rsp + 0xd0]
jmp 0x1400f5af1
lea rcx, [rsp + 0x70]
call fcn.1400f8cd0
mov rdx, qword [rsp + 0xd0]
cmp rdx, qword [rsp + 0xc0]
jne 0x1400f5d27
lea rcx, [rsp + 0xc0]
call fcn.1400fc150
mov rdx, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0x190]
mov rax, qword [rsp + 0xc8]
mov word [rax + rdx*2], 0
mov rbx, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xc8]
mov r12, r15
cmp byte [rsi + 0x18], 2
je 0x1400f571a
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
add rcx, rax
xor r10d, r10d
mov rdx, rax
jmp 0x1400f5d7d
xor r10d, r10d
test r8w, r8w
je 0x1400f5e51
mov r8w, 1
test r10w, r10w
jne 0x1400f5d70
cmp rdx, rcx
je 0x1400f5f14
movzx r9d, byte [rdx]
test r9b, r9b
js 0x1400f5da2
inc rdx
jmp 0x1400f5e30
mov rdi, rsi
mov r10d, r9d
and r10d, 0x1f
movzx esi, byte [rdx + 1]
and esi, 0x3f
cmp r9b, 0xdf
jbe 0x1400f5dfb
movzx r11d, byte [rdx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r9b, 0xf0
jb 0x1400f5e0e
movzx r9d, byte [rdx + 3]
add rdx, 4
and r10d, 7
shl r10d, 0x12
shl r11d, 6
and r9d, 0x3f
or r9d, r11d
or r9d, r10d
mov rsi, rdi
cmp r9d, 0xffff
jbe 0x1400f5e30
jmp 0x1400f5e3b
add rdx, 2
shl r10d, 6
or r10d, esi
mov r9d, r10d
mov rsi, rdi
jmp 0x1400f5e30
add rdx, 3
shl r10d, 0xc
or r11d, r10d
mov r9d, r11d
mov rsi, rdi
cmp r9d, 0xffff
ja 0x1400f5e3b
nop dword [rax + rax]
xor r10d, r10d
mov r8d, r9d
jmp 0x1400f5d73
and r9d, 0x3ff
or r9d, 0xdc00
mov r10d, r9d
jmp 0x1400f5d73
lea rax, str.nul_byte_found_in_provided_data
mov rbp, qword [rsp + 0x60]
mov qword [rbp], rax
mov qword [rbp + 0x10], 2
jmp 0x1400f6173
lea rdi, str.nul_byte_found_in_provided_data
test rdx, rdx
je 0x1400f5e85
mov r8d, 1
call fcn.14000dd90
mov rbp, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xe8]
test rdx, rdx
je 0x1400f5eaa
mov r8d, 1
mov rcx, qword [rsp + 0x188]
call fcn.14000dd90
test r12, r12
je 0x1400f652d
add r12, r12
mov r8d, 2
mov rcx, rbx
mov rdx, r12
call fcn.14000dd90
jmp 0x1400f652d
cmp rbx, 0xf
ja 0x1400f6297
dec rbx
xor ecx, ecx
nop dword [rax + rax]
cmp byte [r14 + rcx], 0x2e
sete al
je 0x1400f62ab
lea rdx, [rcx + 1]
cmp rbx, rcx
mov rcx, rdx
jne 0x1400f5ee0
jmp 0x1400f62ab
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x190]
xor r15d, r15d
jmp 0x1400f4f1b
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rax
mov word [rsp + 0x130], 0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x120]
call fcn.1400f4000
mov rdx, qword [rsp + 0x80]
cmp rdx, qword [rsp + 0x70]
mov qword [rsp + 0xe8], r15
mov rbx, rsi
jne 0x1400f5f74
lea rcx, [rsp + 0x70]
call fcn.1400fc150
mov rdx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov word [rax + rdx*2], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x208], rax
movzx esi, byte [rsp + 0x290]
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
lea r15, [0x1401d9c50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rax, qword [0x1401d9ce8]
shl rax, 1
test rax, rax
mov qword [rsp + 0x220], r12
jne 0x1400f68b6
xor eax, eax
movzx r13d, byte [0x1401d9c58]
xor ecx, ecx
test r13b, r13b
setne cl
mov qword [rsp + 0xf8], r15
mov dword [rsp + 0x11c], eax
mov byte [rsp + 0x100], al
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x90], 0
test sil, sil
lea rsi, [rsp + 0x210]
lea rax, [rsp + 0x198]
cmovne rax, rsi
mov qword [rsp + 0x198], 1
lea rcx, [rbx + 0x60]
cmp dword [rbx + 0x60], 5
cmove rcx, rax
mov rdi, qword [rbx + 0x70]
lea r12, [rbx + 0x80]
cmp dword [rbx + 0x80], 5
cmove r12, rsi
lea r8, [rsp + 0x70]
mov edx, 0xfffffff6
call fcn.1400f6e10
mov r15, rdx
cmp rax, 1
jne 0x1400f61ed
mov rbp, qword [rsp + 0x60]
mov qword [rbp], r15
mov qword [rbp + 0x10], 2
mov rbx, qword [rsp + 0x1a8]
cmp dword [rsp + 0x198], 3
mov r15, qword [rsp + 0xe8]
jb 0x1400f60d7
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x70], 0
je 0x1400f60ea
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x80], 0
je 0x1400f6103
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x90], 0
je 0x1400f611c
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x7fffffffffffffff
test r13b, r13b
cmp byte [rsp + 0x11c], 0
jne 0x1400f6143
mov rcx, qword [0x1401d9ce8]
test rcx, rax
jne 0x1400f6ae0
lea rcx, [0x1401d9c50]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdx, qword [rsp + 0x188]
test rdx, rdx
je 0x1400f6173
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1e0]
call fcn.14000dd90
test rbx, rbx
je 0x1400f618c
add rbx, rbx
mov r8d, 2
mov rcx, r15
mov rdx, rbx
call fcn.14000dd90
mov rdx, qword [rsp + 0x1c8]
test rdx, rdx
je 0x1400f61af
mov rcx, qword [rsp + 0x1d0]
add rdx, rdx
mov r8d, 2
call fcn.14000dd90
mov rdx, qword [rsp + 0x1b8]
test rdx, rdx
je 0x1400f61d2
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1c0]
call fcn.14000dd90
mov sil, 1
cmp byte [rsp + 0x1b0], 0
mov rcx, qword [rsp + 0x68]
je 0x1400f53c5
jmp 0x1400f5459
lea r8, [rsp + 0x80]
add rbx, 0x70
cmp edi, 5
cmove rbx, rsi
mov rcx, rbx
mov edx, 0xfffffff5
call fcn.1400f6e10
mov rdi, rdx
test rax, rax
je 0x1400f6230
mov rbp, qword [rsp + 0x60]
mov qword [rbp], rdi
mov qword [rbp + 0x10], 2
mov rbx, qword [rsp + 0x1a8]
jmp 0x1400f6273
lea r8, [rsp + 0x90]
mov rcx, r12
mov edx, 0xfffffff4
call fcn.1400f6e10
mov r12, rdx
test rax, rax
mov rbx, qword [rsp + 0x1a8]
je 0x1400f66bb
mov rbp, qword [rsp + 0x60]
mov qword [rbp], r12
mov qword [rbp + 0x10], 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x198], 3
mov r15, qword [rsp + 0xe8]
jae 0x1400f60c9
jmp 0x1400f60d7
mov cl, 0x2e
mov rdx, r14
mov r8, rbx
call fcn.140109280
cmp rax, 1
sete al
mov byte [rsp + 0x5f], al
lea rax, [rsp + 0x198]
mov qword [rsp + 0x1c8], rax
lea rax, [rsp + 0x5f]
mov qword [rsp + 0x1d0], rax
test r15, r15
je 0x1400f6324
mov rax, r15
mov r15, rbp
add r12, rax
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
mov byte [rsp + 0x108], 1
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0xf0]
call fcn.1400f79f0
movzx eax, byte [rsp + 0x138]
cmp al, 2
jne 0x1400f6594
mov rbp, r15
lea rcx, [rsp + 0x70]
call fcn.1400fa210
cmp byte [rsp + 0x88], 2
jne 0x1400f638a
mov rsi, qword [rsp + 0x70]
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x1400f647a
lea rbx, [rsi - 1]
mov rcx, qword [rsi - 1]
mov rax, qword [rsi + 7]
call qword [rax]
mov rax, qword [rsi + 7]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400f6372
mov r8, qword [rax + 0x10]
mov rcx, qword [rbx]
call fcn.14000dd90
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
call fcn.14000dd90
jmp 0x1400f647a
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov rcx, rbx
mov rdx, r14
call fcn.1400ef6c0
cmp r14, rdx
cmovb rdx, r14
test rax, rax
cmove rdx, r14
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0x130], rdx
mov qword [rsp + 0x138], rdi
mov rdx, qword [rsp + 0x198]
mov r8, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x120]
call fcn.1400ee860
cmp byte [rsp + 0x5f], 0
jne 0x1400f641b
lea rdx, str.exeNULcmd.exe
lea rcx, [rsp + 0x120]
mov r8d, 3
call fcn.1400ef310
mov rdx, qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
lea rcx, [rsp + 0xf0]
call fcn.1400f6d40
mov rdx, qword [rsp + 0x120]
test rdx, rdx
je 0x1400f6458
mov rcx, qword [rsp + 0x128]
mov r8d, 1
call fcn.14000dd90
mov r12, qword [rsp + 0xf8]
test r12, r12
je 0x1400f647a
mov rsi, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0x100]
jmp 0x1400f6924
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x1c8]
call fcn.1400fb490
mov rax, qword [rsp + 0x120]
mov r12, qword [rsp + 0x130]
test rax, rax
jne 0x1400f64ad
test r12, r12
jne 0x1400f6914
test rax, rax
je 0x1400f68c2
mov rsi, qword [rsp + 0x128]
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x1400f68e5
lea rbx, [rsi - 1]
mov rcx, qword [rsi - 1]
mov rax, qword [rsi + 7]
call qword [rax]
mov rax, qword [rsi + 7]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400f64f3
mov r8, qword [rax + 0x10]
mov rcx, qword [rbx]
call fcn.14000dd90
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
jmp 0x1400f68e0
lea rdi, str.nul_byte_found_in_provided_data
mov rdx, qword [rsp + 0xe8]
test rdx, rdx
je 0x1400f6528
mov r8d, 1
mov rcx, rbx
call fcn.14000dd90
mov rbp, qword [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.1400f8cd0
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x1400f655a
mov rcx, qword [rsp + 0xc8]
add rdx, rdx
mov r8d, 2
call fcn.14000dd90
mov qword [rbp], rdi
mov qword [rbp + 0x10], 2
mov rdx, qword [rsp + 0x1c8]
test rdx, rdx
jne 0x1400f6199
jmp 0x1400f61af
mov rcx, qword [rsp + 0x68]
mov qword [rbp], rdx
mov qword [rbp + 0x10], 2
xor esi, esi
jmp 0x1400f53c5
lea rbp, [rsp + 0x89]
lea r13, [rsp + 0x139]
lea rbx, [rsp + 0x120]
lea r14, [rsp + 0xf0]
lea rsi, [rsp + 0x70]
lea rdi, str.exeNULcmd.exe
jmp 0x1400f65fb
mov r12, qword [rsp + 0x128]
test r12, r12
jne 0x1400f6c0e
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, r14
call fcn.1400f79f0
movzx eax, byte [rsp + 0x138]
cmp al, 2
je 0x1400f6321
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
test r8, r8
jne 0x1400f662a
test rdx, rdx
je 0x1400f65e0
mov r8d, 1
call fcn.14000dd90
jmp 0x1400f65e0
mov r9d, dword [r13]
mov r10d, dword [r13 + 3]
mov dword [rbp + 3], r10d
mov dword [rbp], r9d
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], r8
mov byte [rsp + 0x88], al
mov rdx, qword [rsp + 0x198]
mov r8, qword [rsp + 0x1a0]
mov rcx, rsi
call fcn.1400ee860
cmp byte [rsp + 0x5f], 0
jne 0x1400f6683
mov r8d, 3
mov rcx, rsi
mov rdx, rdi
call fcn.1400ef310
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov rcx, rbx
call fcn.1400f6d40
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400f65c2
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call fcn.14000dd90
jmp 0x1400f65c2
xorps xmm0, xmm0
movups xmmword [rsp + 0x154], xmm0
movups xmmword [rsp + 0x148], xmm0
movups xmmword [rsp + 0x138], xmm0
movups xmmword [rsp + 0x128], xmm0
movups xmmword [rsp + 0x168], xmm0
movups xmmword [rsp + 0x178], xmm0
mov dword [rsp + 0x120], 0x68
test r12, r12
jne 0x1400f6708
test rdi, rdi
jne 0x1400f6708
test r15, r15
je 0x1400f672b
mov dword [rsp + 0x15c], pe_nt_image_headers64
mov qword [rsp + 0x170], r15
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x180], r12
mov rdx, qword [rsp + 0x1d0]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x1c0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400f69da
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
mov rbp, qword [rsp + 0x60]
movups xmmword [rbp + 0x30], xmm2
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [rbp], xmm0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call rsi
mov rcx, rdi
call rsi
mov rcx, r15
call rsi
cmp dword [rsp + 0x198], 3
jb 0x1400f67ef
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xf0]
call fcn.1400f4b90
mov rdx, qword [rsp + 0x188]
test rdx, rdx
mov rsi, qword [rsp + 0xe8]
je 0x1400f6827
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1e0]
call fcn.14000dd90
test rbx, rbx
je 0x1400f6840
add rbx, rbx
mov r8d, 2
mov rcx, rsi
mov rdx, rbx
call fcn.14000dd90
mov rdx, qword [rsp + 0x1c8]
test rdx, rdx
je 0x1400f6863
mov rcx, qword [rsp + 0x1d0]
add rdx, rdx
mov r8d, 2
call fcn.14000dd90
mov rdx, qword [rsp + 0x1b8]
test rdx, rdx
je 0x1400f6886
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1c0]
call fcn.14000dd90
test r14, r14
sete al
mov ecx, dword [rsp + 0x1b0]
or cl, al
jne 0x1400f5459
add r14, r14
mov r8d, 2
mov rcx, qword [rsp + 0x68]
mov rdx, r14
call fcn.14000dd90
jmp 0x1400f5459
call fcn.140130b50
xor al, 1
jmp 0x1400f5fee
test r12, r12
je 0x1400f68e5
mov rdx, qword [rsp + 0x128]
test rdx, rdx
je 0x1400f68e5
add rdx, rdx
mov r8d, 2
mov rcx, r12
call fcn.14000dd90
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x1c8]
call fcn.1400fa3b0
mov rax, qword [rsp + 0x120]
mov r12, qword [rsp + 0x130]
test rax, rax
jne 0x1400f6949
test r12, r12
je 0x1400f6949
mov rsi, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x138]
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0x100], rdi
mov rsi, qword [rsp + 0x190]
jmp 0x1400f509e
test rax, rax
je 0x1400f6a07
mov rsi, qword [rsp + 0x128]
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x1400f6a2a
lea rbx, [rsi - 1]
mov rcx, qword [rsi - 1]
mov rax, qword [rsi + 7]
call qword [rax]
mov rax, qword [rsi + 7]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400f698f
mov r8, qword [rax + 0x10]
mov rcx, qword [rbx]
call fcn.14000dd90
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
jmp 0x1400f6a25
mov qword [rbp], r12
mov qword [rbp + 0x10], 2
mov rdx, qword [rsp + 0x1b8]
test rdx, rdx
je 0x1400f53be
add rdx, rdx
mov r8d, 2
mov rcx, qword [rsp + 0x1c0]
call fcn.14000dd90
jmp 0x1400f53be
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rbp, qword [rsp + 0x60]
mov qword [rbp], rax
mov qword [rbp + 0x10], 2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400f626a
test r12, r12
je 0x1400f6a2a
mov rdx, qword [rsp + 0x128]
test rdx, rdx
je 0x1400f6a2a
add rdx, rdx
mov r8d, 2
mov rcx, r12
call fcn.14000dd90
lea rdx, str.PATHprogram_path_has_no_file_name
lea rcx, [rsp + 0xc0]
mov r8d, 4
call fcn.1400f7c20
cmp byte [rsp + 0xd8], 2
mov rsi, qword [rsp + 0x190]
je 0x1400f6ad4
mov qword [rsp + 0x60], rbp
mov rbx, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rax, qword [rsp + 0xd0]
add rax, r14
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], r14
mov word [rsp + 0x100], 0
mov byte [rsp + 0x108], 1
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0xf0]
call fcn.1400f79f0
movzx eax, byte [rsp + 0x138]
cmp al, 2
jne 0x1400f6af9
test rbx, rbx
mov rbp, qword [rsp + 0x60]
je 0x1400f6ad4
mov r8d, 1
mov rcx, r14
mov rdx, rbx
call fcn.14000dd90
lea rax, [0x1401c4310]
jmp 0x1400f508a
call fcn.140130b50
test al, al
jne 0x1400f6143
mov byte [0x1401d9c58], 1
jmp 0x1400f6143
lea rdi, [rsp + 0x89]
lea rbp, [rsp + 0x139]
lea r15, [rsp + 0x120]
lea r13, [rsp + 0xf0]
jmp 0x1400f6b47
mov r12, qword [rsp + 0x128]
test r12, r12
jne 0x1400f6c51
mov rcx, r15
mov rdx, r13
call fcn.1400f79f0
movzx eax, byte [rsp + 0x138]
cmp al, 2
je 0x1400f6ab9
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
test r8, r8
jne 0x1400f6b76
test rdx, rdx
je 0x1400f6b2c
mov r8d, 1
call fcn.14000dd90
jmp 0x1400f6b2c
mov r9d, dword [rbp]
mov r10d, dword [rbp + 3]
mov dword [rdi + 3], r10d
mov dword [rdi], r9d
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], r8
mov byte [rsp + 0x88], al
mov rdx, qword [rsp + 0x198]
mov r8, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x70]
call fcn.1400ee860
cmp byte [rsp + 0x5f], 0
jne 0x1400f6bd6
mov r8d, 3
lea rcx, [rsp + 0x70]
lea rdx, str.exeNULcmd.exe
call fcn.1400ef310
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov rcx, r15
call fcn.1400f6d40
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400f6b1b
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call fcn.14000dd90
jmp 0x1400f6b1b
mov rsi, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x130]
mov rbp, r15
jmp 0x1400f6924
mov rdi, rdx
mov rbp, qword [rsp + 0x60]
mov rdx, qword [rsp + 0xe8]
test rdx, rdx
jne 0x1400f5e97
jmp 0x1400f5eaa
mov rdi, qword [rsp + 0xe8]
jmp 0x1400f6528
mov rsi, qword [rsp + 0x120]
mov rdi, qword [rsp + 0x130]
test rbx, rbx
mov rbp, qword [rsp + 0x60]
je 0x1400f6924
mov r8d, 1
mov rcx, r14
mov rdx, rbx
call fcn.14000dd90
jmp 0x1400f6924
call sub.KERNEL32.dll_GetLastError
ud2
mov ecx, 4
mov edx, 1
call fcn.140130c60
ud2
call fcn.1400f4aa0
ud2
mov rcx, rbx
mov rdx, r15
call fcn.140130c60
ud2