Function at 0x140002750
Capabilities:
Create process on windows
Delete file
Get common file path
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2f20]
mov eax, 0x3020
call fcn.14003d9e0
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x3050], rbx
mov qword [rsp + 0x3058], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f10], rax
mov r14, r8
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
call fcn.140004b50
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 1
mov rcx, qword [rax + 8]
mov rbx, rax
cmp byte [rcx + 0x19], r12b
jne 0x1400027ea
cmp dword [rcx + 0x1c], 1
jge 0x1400027d3
mov rcx, qword [rcx + 0x10]
jmp 0x1400027d9
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], r12b
je 0x1400027c7
cmp rbx, rax
je 0x1400027ea
cmp dword [rbx + 0x1c], 1
jle 0x140002823
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004fe0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140005020
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x82
mov dword [rsp + 0x30], 2
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x140002867
cmp dword [rax + 0x1c], 2
jge 0x140002850
mov rax, qword [rax + 0x10]
jmp 0x140002856
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x140002844
cmp rbx, rcx
je 0x140002867
cmp dword [rbx + 0x1c], 2
jle 0x1400028a0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004fe0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140005020
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x83
mov dword [rsp + 0x30], 3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x1400028e4
cmp dword [rax + 0x1c], 3
jge 0x1400028cd
mov rax, qword [rax + 0x10]
jmp 0x1400028d3
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x1400028c1
cmp rbx, rcx
je 0x1400028e4
cmp dword [rbx + 0x1c], 3
jle 0x14000291d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004fe0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140005020
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x85
mov dword [rsp + 0x30], 4
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x140002963
nop
cmp dword [rax + 0x1c], 4
jge 0x14000294c
mov rax, qword [rax + 0x10]
jmp 0x140002952
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x140002940
cmp rbx, rcx
je 0x140002963
cmp dword [rbx + 0x1c], 4
jle 0x14000299c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004fe0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140005020
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x86
mov dword [rsp + 0x30], 5
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x1400029e3
nop dword [rax]
cmp dword [rax + 0x1c], 5
jge 0x1400029cc
mov rax, qword [rax + 0x10]
jmp 0x1400029d2
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x1400029c0
cmp rbx, rcx
je 0x1400029e3
cmp dword [rbx + 0x1c], 5
jle 0x140002a1c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004fe0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140005020
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x87
mov dword [rsp + 0x30], 6
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x140002a63
nop dword [rax]
cmp dword [rax + 0x1c], 6
jge 0x140002a4c
mov rax, qword [rax + 0x10]
jmp 0x140002a52
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x140002a40
cmp rbx, rcx
je 0x140002a63
cmp dword [rbx + 0x1c], 6
jle 0x140002a9c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004fe0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140005020
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x84
mov dword [rsp + 0x30], 7
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], r12b
jne 0x140002ae3
nop dword [rax]
cmp dword [rax + 0x1c], 7
jge 0x140002acc
mov rax, qword [rax + 0x10]
jmp 0x140002ad2
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x140002ac0
cmp rbx, rcx
je 0x140002ae3
cmp dword [rbx + 0x1c], 7
jle 0x140002b1c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140004fe0
lea r9, [rax + 0x1c]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140005020
mov rbx, qword [rsp + 0x38]
mov dword [rbx + 0x20], 0x85
lea rcx, [rbp - 0x10]
call fcn.140035b00
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140036130
lea rcx, [rbp - 0x10]
test al, al
je 0x140002ee3
mov r8, r14
lea rdx, str.CommandLine:__s
call fcn.140036ed0
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r12
mov word [rbp - 0x70], r12w
lea rcx, [rbp - 0x70]
call fcn.14003a070
test al, al
je 0x140002b8f
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
lea rdx, str.OS:__s
lea rcx, [rbp - 0x10]
call fcn.140036ed0
lea rcx, [rbp - 0x10]
call fcn.140036110
lea rcx, [rbp + 0x248]
call fcn.140038c20
movzx esi, ax
lea r8, [rsp + 0x48]
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.14003c7d0
mov edx, 0x7f
lea rcx, [rsp + 0x58]
call fcn.14003c9c0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
xor r8d, r8d
xor edx, edx
call fcn.140004b00
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
mov r8d, 6
lea rdx, str.LOCALE
lea rcx, [rsp + 0x70]
call fcn.140003b30
nop
mov r8, qword [rbp - 0x38]
cmp r8, 8
jb 0x140002c4a
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140003f70
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r12
mov word [rbp - 0x50], r12w
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x50]
call fcn.140003dc0
nop
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x140002c86
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140003f70
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
or rbx, 0xffffffffffffffff
cmp word [rbp + 0x248], 0
jne 0x140002cab
mov r8, r12
jmp 0x140002cc0
lea rax, [rbp + 0x248]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x140002cb5
lea rdx, [rbp + 0x248]
lea rcx, [rsp + 0x70]
call fcn.140003b30
nop
mov r8, qword [rbp - 0x18]
cmp r8, 8
jb 0x140002cec
inc r8
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x30]
call fcn.140003f70
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r12
mov word [rbp - 0x30], r12w
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.140003dc0
nop
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x140002d28
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140003f70
lea r9, [rbp - 0x50]
mov r8, qword [rdi + 8]
mov rdx, rdi
call fcn.140004f80
mov r8, rax
movabs rcx, 0x333333333333332
mov rdx, qword [rsp + 0x40]
sub rcx, rdx
cmp rcx, 1
jae 0x140002d60
lea rcx, str.list_T__too_long
call fcn.14003e8d8
int3
inc rdx
mov qword [rsp + 0x40], rdx
mov qword [rdi + 8], r8
mov rax, qword [rax + 8]
mov qword [rax], r8
lea r8, [rsp + 0x38]
lea rcx, [rbp - 0x10]
call fcn.140006900
test eax, eax
je 0x140002f16
cmp eax, 4
jne 0x140002e5d
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
lea r8, [rsp + 0x70]
movzx edx, si
lea ecx, [rax + 0x67]
call fcn.14003a750
mov r9d, 3
xor r8d, r8d
lea rdx, [0x1400860e0]
lea rcx, [rsp + 0x70]
call fcn.1400037c0
cmp rax, 0xffffffffffffffff
je 0x140002e19
cmp word [rbp + 0xc70], 0
jne 0x140002de3
mov rbx, r12
jmp 0x140002dfa
lea rcx, [rbp + 0xc70]
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x140002df0
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xc70]
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400038e0
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x70]
cmovae rdx, qword [rsp + 0x70]
xor ecx, ecx
mov r9d, 0x1030
call fcn.14003cb30
mov r8, qword [rbp - 0x78]
cmp r8, 8
jb 0x140002e5d
inc r8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140003f70
call fcn.14003c9e0
lea rcx, [rbp - 0x10]
call fcn.140037480
lea rcx, [rbp - 0x50]
call fcn.1400035d0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x140002eac
nop dword [rax + rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.1400035d0
mov rcx, rdi
call fcn.14003d64c
mov rdi, rbx
cmp rbx, rsi
jne 0x140002e90
mov rcx, rsi
call fcn.14003d64c
mov r8, qword [rbp - 0x58]
cmp r8, 8
jb 0x140002ece
inc r8
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x70]
call fcn.140003f70
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], r12
mov word [rbp - 0x70], r12w
lea rcx, [rbp - 0x10]
call fcn.140035bf0
mov r8, qword [rsp + 0x48]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140003e50
mov rcx, qword [rsp + 0x48]
call fcn.14003d64c
mov eax, 1
jmp 0x14000356c
lea rcx, [rbp + 0x248]
call fcn.140038c20
mov word [rsp + 0x58], ax
xor sil, sil
mov r15d, r12d
mov ecx, 0x3ff
and ax, cx
mov edi, 0x81
mov ecx, 0x89
cmp ax, 1
cmove di, cx
cmp byte [rbp + 0x1f9], sil
je 0x140002fe0
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140002390
test al, al
jne 0x140002fc1
call fcn.1400057c0
call fcn.14003c9e0
lea rcx, [rbp - 0x10]
call fcn.140037480
lea rcx, [rbp - 0x50]
call fcn.1400035d0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x140002eac
nop dword [rax + rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.1400035d0
mov rcx, rdi
call fcn.14003d64c
mov rdi, rbx
cmp rbx, rsi
jne 0x140002fa0
jmp 0x140002eac
mov edx, 0x80
mov r8d, 0x3e8
movzx ecx, di
call fcn.14003ce50
lea rcx, str.uninstall
jmp 0x14000306c
cmp byte [rbp + 0x1fb], r15b
je 0x140003093
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140002390
test al, al
jne 0x140003052
call fcn.1400057c0
call fcn.14003c9e0
lea rcx, [rbp - 0x10]
call fcn.140037480
lea rcx, [rbp - 0x50]
call fcn.1400035d0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x140002eac
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.1400035d0
mov rcx, rdi
call fcn.14003d64c
mov rdi, rbx
cmp rbx, rsi
jne 0x140003031
jmp 0x140002eac
mov edx, 0x80
mov r8d, 0x3e8
movzx ecx, di
call fcn.14003ce50
lea rcx, str.pdlcuninstall
call fcn.1400073a0
mov r15d, eax
mov r8d, eax
lea rdx, str.Uninstall_finished_with_exit_code:__d
lea rcx, [rbp - 0x10]
call fcn.140036ed0
call fcn.14003d2f0
test r15d, r15d
sete sil
call fcn.1400057c0
call fcn.14003c9e0
movzx r14d, byte [rbp + 0x1ff]
lea rcx, [rbp - 0x10]
call fcn.140037480
test sil, sil
je 0x140003503
mov edi, 0x104
mov edx, edi
lea rcx, [rbp + 0x14b0]
call fcn.14003a8d0
lea r9, [rbp + 0x14b0]
lea r8, str._sCleanup.dat
mov edx, edi
lea rcx, [rbp + 0x16c0]
call fcn.1400022b0
lea rcx, [rbp + 0x16c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r14b, r14b
jne 0x140003121
lea r9, [rbp + 0x14b0]
lea r8, str._sMaintenanceLog.txt
mov edx, edi
lea rcx, [rbp + 0x16c0]
call fcn.1400022b0
lea rcx, [rbp + 0x16c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r9, [rbp + 0x14b0]
lea r8, str._sCleanup.exe
mov rdx, rdi
lea rcx, [rbp + 0x16c0]
call fcn.1400022b0
mov rdx, rdi
lea rcx, [rbp + 0x18d0]
lea r8, [rbp + 0x14b0]
lea rax, [rbp + 0x18d0]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140003183
movzx eax, word [rcx + r8]
test ax, ax
je 0x140003183
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140003160
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
lea rax, [rbp + 0x14b0]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400031a0
test rbx, rbx
je 0x1400031eb
lea rbx, [rbx*2 - 2]
cmp rbx, 0x208
jae 0x1400031e5
mov word [rbp + rbx + 0x18d0], r12w
mov edx, 0x5c
lea rcx, [rbp + 0x18d0]
call fcn.14004181c
test rax, rax
je 0x1400031eb
mov word [rax], r12w
jmp 0x1400031eb
call fcn.14003d47c
int3
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1cf0]
call fcn.140042070
lea rsi, [rbp + 0x1cf0]
mov edx, edi
lea rcx, [rbp + 0x1cf0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
cmove rsi, r12
mov edx, 0x800
lea rcx, [rbp + 0x1f00]
lea r8, str._c_timeout_2__nul__del__
lea rax, [rbp + 0x1f00]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffff7fe]
test rax, rax
je 0x140003263
movzx eax, word [rcx + r8]
test ax, ax
je 0x140003263
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140003240
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov ecx, 0x800
lea rax, [rbp + 0x1f00]
nop
cmp word [rax], 0
je 0x140003290
add rax, 2
sub rcx, 1
jne 0x140003280
mov ebx, 0x80070057
mov edx, ebx
test rcx, rcx
cmovne edx, r12d
je 0x1400032aa
mov eax, 0x800
sub rax, rcx
jmp 0x1400032ad
mov rax, r12
test edx, edx
js 0x140003310
mov edx, 0x800
sub rdx, rax
lea rcx, [rbp + 0x1f00]
lea rcx, [rcx + rax*2]
je 0x140003301
add rax, 0x7ffff7ff
add rax, rdx
lea r9, [rbp + 0x16c0]
sub r9, rcx
nop dword [rax]
test rax, rax
je 0x140003301
movzx r8d, word [rcx + r9]
test r8w, r8w
je 0x140003301
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x1400032e0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
lea r8, str._____NUL__rmdir__Q__
mov edx, 0x800
lea rcx, [rbp + 0x1f00]
call fcn.1400021d0
mov ecx, 0x800
lea rax, [rbp + 0x1f00]
cmp word [rax], 0
je 0x140003344
add rax, 2
sub rcx, 1
jne 0x140003334
mov edx, ebx
test rcx, rcx
cmovne edx, r12d
je 0x140003359
mov eax, 0x800
sub rax, rcx
jmp 0x14000335c
mov rax, r12
test edx, edx
js 0x1400033b8
mov edx, 0x800
sub rdx, rax
lea rcx, [rbp + 0x1f00]
lea rcx, [rcx + rax*2]
je 0x1400033a9
add rax, 0x7ffff7ff
add rax, rdx
lea r9, [rbp + 0x14b0]
sub r9, rcx
test rax, rax
je 0x1400033a9
movzx r8d, word [rcx + r9]
test r8w, r8w
je 0x1400033a9
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x140003388
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
lea r8, str._____NUL__timeout_1____NUL__rmdir__Q__
mov edx, 0x800
lea rcx, [rbp + 0x1f00]
call fcn.1400021d0
mov ecx, 0x800
lea rax, [rbp + 0x1f00]
nop dword [rax]
cmp word [rax], 0
je 0x1400033f0
add rax, 2
sub rcx, 1
jne 0x1400033e0
test rcx, rcx
cmovne ebx, r12d
je 0x140003403
mov eax, 0x800
sub rax, rcx
jmp 0x140003406
mov rax, r12
test ebx, ebx
js 0x140003461
mov r9d, 0x800
sub r9, rax
lea rcx, [rbp + 0x1f00]
lea rcx, [rcx + rax*2]
je 0x140003452
add rax, 0x7ffff7ff
add rax, r9
lea r8, [rbp + 0x18d0]
sub r8, rcx
test rax, rax
je 0x140003452
movzx edx, word [rcx + r8]
test dx, dx
je 0x140003452
mov word [rcx], dx
add rcx, 2
dec rax
sub r9, 1
jne 0x140003433
lea rax, [rcx - 2]
test r9, r9
cmovne rax, rcx
mov word [rax], r12w
lea r8, str._____NUL
mov edx, 0x800
lea rcx, [rbp + 0x1f00]
call fcn.1400021d0
mov r8d, 0x208
lea rdx, [rbp + 0x1ae0]
lea rcx, str.COMSPEC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1400034e1
lea rcx, [rbp + 0x1ae0]
lea rdx, str.cmd.exe
lea rax, [rbp + 0x1ae0]
sub rdx, rax
nop
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x1400034d2
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400034d2
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x1400034b0
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], r12w
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x1f00]
lea r8, [rbp + 0x1ae0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp - 0x50]
call fcn.1400035d0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x14000353c
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.1400035d0
mov rcx, rdi
call fcn.14003d64c
mov rdi, rbx
cmp rbx, rsi
jne 0x140003520
mov edx, 1
lea r8d, [rdx + 0x4f]
mov rcx, rsi
call fcn.1400020e0
lea rcx, [rbp - 0x70]
call fcn.140003670
lea rcx, [rbp - 0x10]
call fcn.140035bf0
lea rcx, [rsp + 0x48]
call fcn.1400035a0
mov eax, r15d
mov rcx, qword [rbp + 0x2f10]
xor rcx, rsp
call fcn.14003d350
lea r11, [rsp + 0x3020]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret