Function at 0x140051d30
Capabilities:
Create thread
Inject thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x440
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rsp + 0x420], rax
xor ebx, ebx
mov dword [rsp + 0x130], ebx
lea rdx, [0x1400cbbc0]
cmp qword [0x1400cbbd8], 7
cmova rdx, qword [0x1400cbbc0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8, qword [0x1400cbbd0]
lea rcx, [rsp + 0x40]
call fcn.14004c290
nop
mov r8d, 3
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x200]
call fcn.14004c1b0
movsd xmm0, qword [rax]
movsd qword [rsp + 0x60], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x140], ecx
lea r13, [0x1400c9cf8]
mov qword [rsp + 0x148], r13
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140051e44
cmp eax, 1
sete dil
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140051e56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051e51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400535f7
jmp 0x140051e51
mov dil, 1
test ecx, ecx
jne 0x1400535fd
jmp 0x140051e05
call fcn.140060054
test dil, dil
je 0x140051f31
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov r8d, 0x15
lea rdx, str.ImAuto.dll_not_found_
lea rcx, [rsp + 0x70]
call fcn.14004dbd0
nop
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x80]
call fcn.140053750
mov dword [0x1400c9ca8], 0xe60000ff
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x140051efa
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051ef5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400535f1
call fcn.140060054
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14005f9a0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov eax, dword [0x1400cbb0c]
test eax, eax
jne 0x140051f7c
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x16
lea rdx, str.QtWebEngineProcess.exe
lea rcx, [rsp + 0x40]
call fcn.14004c290
nop
lea rcx, [rsp + 0x40]
call fcn.14005f050
mov esi, eax
mov dword [rsp + 0x200], eax
jmp 0x140052004
cmp eax, 1
jne 0x140051fbf
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x1e
lea rdx, str.CefSharp.BrowserSubprocess.exe
lea rcx, [rsp + 0x40]
call fcn.14004c290
nop
lea rcx, [rsp + 0x40]
call fcn.14005f050
mov esi, eax
mov dword [rsp + 0x200], eax
jmp 0x140052004
cmp eax, 2
jne 0x140053562
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x14
lea rdx, str.DarkOrbit_Client.exe
lea rcx, [rsp + 0x40]
call fcn.14004c290
nop
lea rcx, [rsp + 0x40]
call fcn.14005f050
mov esi, eax
mov dword [rsp + 0x200], eax
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140052046
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052041
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400535f1
call fcn.140060054
test esi, esi
je 0x140053562
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140052096
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c0], xmm0
mov r8, rbx
mov qword [rsp + 0x1d0], rbx
mov eax, 7
mov qword [rsp + 0x1d8], rax
mov word [rsp + 0x1c0], bx
jmp 0x140052130
mov dword [rsp + 0x130], 0x104
lea r9, [rsp + 0x130]
lea r8, [rsp + 0x210]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov rcx, rdi
test eax, eax
jne 0x1400520cb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140052066
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rbx
mov qword [rsp + 0x1d8], rbx
lea rax, [rsp + 0x210]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140052100
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x1c0]
call fcn.14004c290
mov rax, qword [rsp + 0x1d8]
mov r8, qword [rsp + 0x1d0]
xorps xmm0, xmm0
test r8, r8
jne 0x1400521fc
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov r8d, 0x19
lea rdx, str.Target_process_not_found.
lea rcx, [rsp + 0x70]
call fcn.14004dbd0
nop
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x80]
call fcn.140053750
mov dword [0x1400c9ca8], 0xe60000ff
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x1400521d5
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400521cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005371a
call fcn.140060054
nop
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 7
jbe 0x140051efa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c0]
jmp 0x140051ed0
lea rdx, [rsp + 0x1c0]
cmp rax, 7
cmova rdx, qword [rsp + 0x1c0]
movups xmmword [rsp + 0x1e0], xmm0
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], rbx
lea rcx, [rsp + 0x1e0]
call fcn.14004c290
nop
lea rdi, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 7
cmova rdi, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0x1f0]
lea rdx, [rdi + rax*2]
mov rcx, rdi
call fcn.14004fc40
cmp rax, rdx
je 0x1400522dc
nop word [rax + rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14005227f
cmp cx, 0x2f
jne 0x140052288
add rax, 2
cmp rax, rdx
jne 0x140052270
cmp rax, rdx
je 0x1400522dc
nop dword [rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400522ae
cmp cx, 0x2f
je 0x1400522ae
mov rdx, r8
cmp rax, r8
jne 0x140052290
jmp 0x1400522dc
cmp rax, rdx
je 0x1400522dc
nop dword [rax]
nop word [rax + rax]
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x1400522d4
cmp cx, 0x2f
jne 0x1400522dc
mov rdx, r8
cmp rax, r8
jne 0x1400522c0
sub rdx, rdi
sar rdx, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8, rdx
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14004c290
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1a0]
call fcn.14004d5b0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14005235a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052355
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005370e
call fcn.140060054
lea rax, str.libcurl.dll
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xe
lea rax, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 7
cmova rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x148], rax
movups xmm0, xmmword [rsp + 0x140]
movups xmmword [rsp + 0x98], xmm0
movabs rdi, 0xc000000000000000
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x140], 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x148], rax
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x180]
call fcn.140056400
nop
lea rax, str.zlib1.dll
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0xc
lea rax, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 7
cmova rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x148], rax
movups xmm0, xmmword [rsp + 0x140]
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x140], 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x148], rax
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x160]
call fcn.140056400
nop
lea r12, [0x1400cbba0]
mov rdx, r12
cmp qword [0x1400cbbb8], 7
cmova rdx, qword [0x1400cbba0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8, qword [0x1400cbbb0]
lea rcx, [rsp + 0x40]
call fcn.14004c290
nop
mov edi, 0x1fff1
mov dword [rsp + 0x130], edi
mov r8d, 3
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x140]
call fcn.14004c1b0
movsd xmm0, qword [rax]
movsd qword [rsp + 0x60], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x140], ecx
mov qword [rsp + 0x148], r13
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140052626
cmp eax, 1
je 0x14005262e
lea r15, [0x1400cbb80]
mov rdx, r15
cmp qword [0x1400cbb98], 7
cmova rdx, qword [0x1400cbb80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov r8, qword [0x1400cbb90]
lea rcx, [rsp + 0x90]
call fcn.14004c290
nop
mov edi, 0x7fff3
mov dword [rsp + 0x130], edi
mov r8d, 3
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x140]
call fcn.14004c1b0
movsd xmm0, qword [rax]
movsd qword [rsp + 0x60], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x140], ecx
mov qword [rsp + 0x148], r13
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14005261c
cmp eax, 1
je 0x140052635
xor r14b, r14b
jmp 0x140052638
test ecx, ecx
jne 0x140053610
jmp 0x140052635
test ecx, ecx
jne 0x140053626
lea r15, [0x1400cbb80]
mov r14b, 1
test dil, 2
je 0x1400526ab
and edi, 0xfffffffd
mov dword [rsp + 0x130], edi
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x140052690
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005268b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053639
call fcn.140060054
movdqa xmm6, xmmword [0x1400bc8d0]
movdqu xmmword [rsp + 0xa0], xmm6
mov word [rsp + 0x90], bx
jmp 0x1400526b3
movdqa xmm6, xmmword [0x1400bc8d0]
test dil, 1
je 0x140052705
and edi, 0xfffffffe
mov dword [rsp + 0x130], edi
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140052705
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052700
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005363f
call fcn.140060054
test r14b, r14b
je 0x140052934
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov r8d, 0x14
lea rdx, str.DLL_Files_not_found.
lea rcx, [rsp + 0x70]
call fcn.14004dbd0
nop
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x80]
call fcn.140053750
mov dword [0x1400c9ca8], 0xe60000ff
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x1400527aa
mov rcx, qword [rsp + 0x70]
inc rdx
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400527a4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053702
call fcn.140060054
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 7
jbe 0x1400527f2
mov rcx, qword [rsp + 0x160]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400527ed
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053708
call fcn.140060054
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], bx
mov rdx, qword [rsp + 0x198]
cmp rdx, 7
jbe 0x140052856
mov rcx, qword [rsp + 0x180]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052851
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005370e
call fcn.140060054
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], bx
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 7
jbe 0x1400528ba
mov rcx, qword [rsp + 0x1a0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400528b5
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053714
call fcn.140060054
mov word [rsp + 0x1a0], bx
mov qword [rsp + 0x1b8], 7
mov qword [rsp + 0x1b0], rbx
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 7
jbe 0x14005291e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140052919
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005371a
call fcn.140060054
movdqu xmmword [rsp + 0x1f0], xmm6
mov word [rsp + 0x1e0], bx
jmp 0x1400521d5
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 7
cmova rdx, qword [rsp + 0x180]
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], rbx
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0xb0]
call fcn.14004c290
or edi, 0x180000
mov dword [rsp + 0x130], edi
mov r8d, 3
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x140]
call fcn.14004c1b0
movsd xmm0, qword [rax]
movsd qword [rsp + 0x60], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x140], ecx
mov qword [rsp + 0x148], r13
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140052a27
cmp eax, 1
setne r14b
mov rdx, qword [rsp + 0xc8]
cmp rdx, 7
jbe 0x140052a39
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052a34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053645
jmp 0x140052a34
xor r14b, r14b
test ecx, ecx
jne 0x14005364b
jmp 0x1400529e2
call fcn.140060054
movdqu xmmword [rsp + 0xc0], xmm6
mov word [rsp + 0xb0], bx
test r14b, r14b
je 0x140052b25
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 7
cmova rdx, qword [rsp + 0x180]
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0x90]
call fcn.14004c290
nop
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 7
cmova rcx, qword [rsp + 0x90]
call fcn.1400619b8
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140053661
mov rdx, qword [rsp + 0xa8]
cmp rdx, 7
jbe 0x140052b14
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052b0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005367a
call fcn.140060054
movdqu xmmword [rsp + 0xa0], xmm6
mov word [rsp + 0x90], bx
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 7
cmova rdx, qword [rsp + 0x160]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov r8, qword [rsp + 0x170]
lea rcx, [rsp + 0x70]
call fcn.14004c290
or edi, 0x600000
mov dword [rsp + 0x130], edi
mov r8d, 3
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x140]
call fcn.14004c1b0
movsd xmm0, qword [rax]
movsd qword [rsp + 0x60], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x140], ecx
mov qword [rsp + 0x148], r13
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140052c0c
cmp eax, 1
setne r14b
mov rdx, qword [rsp + 0x88]
cmp rdx, 7
jbe 0x140052c1e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052c19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053680
jmp 0x140052c19
xor r14b, r14b
test ecx, ecx
jne 0x140053686
jmp 0x140052bca
call fcn.140060054
movdqu xmmword [rsp + 0x80], xmm6
mov word [rsp + 0x70], bx
test r14b, r14b
je 0x140052d07
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 7
cmova rdx, qword [rsp + 0x160]
xorps xmm0, xmm0
movups xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], rbx
mov r8, qword [rsp + 0x170]
lea rcx, [rsp + 0x140]
call fcn.14004c290
nop
lea rcx, [rsp + 0x140]
cmp qword [rsp + 0x158], 7
cmova rcx, qword [rsp + 0x140]
call fcn.1400619b8
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140053699
mov rdx, qword [rsp + 0x158]
cmp rdx, 7
jbe 0x140052cf6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052cf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400536b2
call fcn.140060054
movdqu xmmword [rsp + 0x150], xmm6
mov word [rsp + 0x140], bx
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 7
cmova rdx, qword [rsp + 0x180]
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], rbx
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0xf0]
call fcn.14004c290
or edi, 0x1800000
mov dword [rsp + 0x130], edi
cmp qword [0x1400cbbb8], 7
cmova r12, qword [0x1400cbba0]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rbx
mov r8, qword [0x1400cbbb0]
mov rdx, r12
lea rcx, [rsp + 0xd0]
call fcn.14004c290
or edi, 0x6000000
mov dword [rsp + 0x130], edi
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xd0]
call fcn.140051590
nop
mov rdx, qword [rsp + 0xe8]
cmp rdx, 7
jbe 0x140052e0b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052e06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400536b8
call fcn.140060054
movdqu xmmword [rsp + 0xe0], xmm6
mov word [rsp + 0xd0], bx
mov rdx, qword [rsp + 0x108]
cmp rdx, 7
jbe 0x140052e64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052e5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400536be
call fcn.140060054
movdqu xmmword [rsp + 0x100], xmm6
mov word [rsp + 0xf0], bx
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 7
cmova rdx, qword [rsp + 0x160]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8, qword [rsp + 0x170]
lea rcx, [rsp + 0x40]
call fcn.14004c290
or edi, 0x18000000
mov dword [rsp + 0x130], edi
cmp qword [0x1400cbb98], 7
cmova r15, qword [0x1400cbb80]
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], rbx
mov r8, qword [0x1400cbb90]
mov rdx, r15
lea rcx, [rsp + 0x110]
call fcn.14004c290
or edi, 0x60000000
mov dword [rsp + 0x130], edi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x110]
call fcn.140051590
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 7
jbe 0x140052f6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052f65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400536c4
call fcn.140060054
movdqu xmmword [rsp + 0x120], xmm6
mov word [rsp + 0x110], bx
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140052fbd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052fb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400536ca
call fcn.140060054
movdqu xmmword [rsp + 0x50], xmm6
mov word [rsp + 0x40], bx
jmp 0x140052fe9
lea r15, [0x1400cbbc0]
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 7
cmova rdx, qword [rsp + 0x180]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.14004c290
or edi, 0x80000000
or edi, 4
mov dword [rsp + 0x130], edi
mov r8d, 3
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x140]
call fcn.14004c1b0
movsd xmm0, qword [rax]
movsd qword [rsp + 0x60], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x140], ecx
mov qword [rsp + 0x148], r13
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140053148
cmp eax, 1
je 0x140053150
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 7
cmova rdx, qword [rsp + 0x160]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov r8, qword [rsp + 0x170]
lea rcx, [rsp + 0x70]
call fcn.14004c290
nop
or edi, 8
mov dword [rsp + 0x130], edi
mov r8d, 3
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x140]
call fcn.14004c1b0
movsd xmm0, qword [rax]
movsd qword [rsp + 0x60], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x140], ecx
mov qword [rsp + 0x148], r13
movaps xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x140], xmm0
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14005313e
cmp eax, 1
je 0x140053150
xor r14b, r14b
jmp 0x140053153
test ecx, ecx
jne 0x1400536d0
jmp 0x140053150
test ecx, ecx
jne 0x1400536e3
mov r14b, 1
test dil, 8
je 0x1400531af
and edi, 0xfffffff7
mov rdx, qword [rsp + 0x88]
cmp rdx, 7
jbe 0x1400531a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005319c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400536f6
call fcn.140060054
movdqu xmmword [rsp + 0x80], xmm6
mov word [rsp + 0x70], bx
test dil, 4
je 0x1400531f7
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400531f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400531f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400536fc
call fcn.140060054
test r14b, r14b
je 0x140053264
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0x16
lea rdx, str.Copy_operation_failed.
lea rcx, [rsp + 0x40]
call fcn.14004dbd0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.140053750
mov dword [0x1400c9ca8], 0xe60000ff
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400527aa
mov rcx, qword [rsp + 0x40]
jmp 0x14005277c
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140053359
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140053350
mov qword [rsp + 0x200], rbx
mov rcx, qword [0x1400cbbd0]
lea r9, [rcx*2 + 2]
cmp qword [0x1400cbbd8], 7
cmova r15, qword [0x1400cbbc0]
lea rax, [rsp + 0x200]
mov qword [rsp + 0x20], rax
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140053350
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140053359
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x25
lea rdx, str.ImAuto_has_been_started_successfully.
call fcn.140053750
mov dword [0x1400c9ca8], 0xe62fffad
jmp 0x1400527aa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0x17
lea rdx, str.ImAuto_failed_to_start.
lea rcx, [rsp + 0x40]
call fcn.14004dbd0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.140053750
mov dword [0x1400c9ca8], 0xe60000ff
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400533e6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400533e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053702
call fcn.140060054
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 7
jbe 0x14005342e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053429
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053708
call fcn.140060054
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], bx
mov rdx, qword [rsp + 0x198]
cmp rdx, 7
jbe 0x140053492
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005348d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005370e
call fcn.140060054
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], bx
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 7
jbe 0x1400534f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400534f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140053714
call fcn.140060054
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1b8], 7
mov word [rsp + 0x1a0], bx
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 7
jbe 0x14005291e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052919
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005371a
jmp 0x140052919
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0x12
lea rdx, str.Process_not_found.
lea rcx, [rsp + 0x40]
call fcn.14004dbd0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
call fcn.140053750
mov dword [0x1400c9ca8], 0xe60000ff
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140051efa
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051ef5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051ef5
call fcn.1400716ac
int3
call fcn.1400716ac
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x140]
call fcn.14004c150
nop
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x140]
call fcn.14004c150
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x140]
call fcn.14004c150
int3
call fcn.1400716ac
nop
call fcn.1400716ac
nop
call fcn.1400716ac
nop
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x140]
call fcn.14004c150
nop
shr rdx, 0x20
lea r8, [rsp + 0x90]
lea rcx, str.remove
call fcn.14004c0e0
nop
call fcn.1400716ac
int3
call fcn.1400716ac
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x140]
call fcn.14004c150
nop
shr rdx, 0x20
lea r8, [rsp + 0x140]
lea rcx, str.remove
call fcn.14004c0e0
nop
call fcn.1400716ac
nop
call fcn.1400716ac
nop
call fcn.1400716ac
nop
call fcn.1400716ac
nop
call fcn.1400716ac
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x140]
call fcn.14004c150
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x140]
call fcn.14004c150
int3
call fcn.1400716ac
nop
call fcn.1400716ac
int3
call fcn.1400716ac
nop
call fcn.1400716ac
nop
call fcn.1400716ac
nop
call fcn.1400716ac
nop
call fcn.1400716ac
int3