Function at 0x140003510
Capabilities:
Check for unmoving mouse cursor
Create a process with modified i/o handles and window
Create process on windows
Enumerate processes
Get common file path
Get session information
Get system information on windows
Log keystrokes via polling
Query environment variable
Terminate process
Terminate process by name

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x808
movaps xmmword [rsp + 0x7f0], xmm6
mov qword [rsp + 0x20], 1
lea rdx, [0x1400251a0]
lea r9, [0x1400258db]
lea rsi, [rsp + 0x70]
mov r8d, 0xa
mov rcx, rsi
call fcn.14000ab16
and qword [rsi + 0x68], 0
mov qword [rsi + 0x70], 0xa
mov word [rsi + 0x78], 1
lea rax, [rsp + 0x280]
mov ecx, 0x10
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov rcx, rax
call fcn.14000e16e
test rax, rax
je case.0x140003cf2.0
mov rsi, rax
mov rdi, rdx
mov al, byte [0x14002e1b0]
mov ecx, 0x40
mov edx, 8
call fcn.14000c5d0
test rax, rax
je 0x140006ef7
mov r13, rax
mov qword [rax], rsi
mov qword [rax + 8], rdi
lea rbx, [rsp + 0x3d0]
lea rsi, [rsp + 0x280]
mov ecx, 0x10
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov r12d, 4
mov r15d, 1
lea rsi, [rsp + 0x100]
mov eax, 4
mov qword [rsp + 0x258], rax
mov rcx, rbx
call fcn.14000e16e
test rax, rax
je 0x1400036cc
mov rdi, rax
mov r14, rdx
mov rbp, qword [rsp + 0x258]
cmp r15, rbp
jne 0x1400036ab
mov rcx, r15
inc rcx
je case.0x140003cf2.0
lea rax, [r15 + r15]
cmp rax, rcx
cmova rcx, rax
cmp rcx, 5
cmovb rcx, r12
xor edx, edx
mov rax, rcx
shr rax, 0x3b
sete dl
mov r8, rcx
shl r8, 4
shl rdx, 3
mov rbp, rcx
test r15, r15
je 0x14000367a
mov rax, r15
shl rax, 4
mov qword [rsp + 0x100], r13
mov qword [rsp + 0x110], rax
mov eax, 8
jmp 0x14000367c
xor eax, eax
mov qword [rsp + 0x108], rax
lea rcx, [rsp + 0x170]
mov r9, rsi
call fcn.1400074e9
cmp qword [rsp + 0x170], 0
jne 0x140006ec4
mov r13, qword [rsp + 0x178]
mov qword [rsp + 0x258], rbp
mov rax, r15
shl rax, 4
mov qword [r13 + rax], rdi
mov qword [r13 + rax + 8], r14
inc r15
jmp 0x1400035f6
test r15, r15
je case.0x140003cf2.0
mov rsi, qword [r13 + 8]
test rsi, rsi
je case.0x140003cf2.0
mov rdi, qword [r13]
movzx eax, byte [rdi]
cmp eax, 0x2d
je 0x140003701
cmp eax, 0x2b
jne 0x14000370b
dec rsi
je case.0x140003cf2.0
inc rdi
jmp 0x14000370b
cmp rsi, 1
je case.0x140003cf2.0
xor ebx, ebx
cmp rsi, 5
jae 0x14000373d
xor r14d, r14d
cmp rsi, rbx
je 0x14000377f
movzx ecx, byte [rdi + rbx]
mov edx, 0xa
call fcn.14000aa70
test eax, eax
je case.0x140003cf2.0
imul r14d, r14d, 0xa
add r14d, edx
inc rbx
jmp 0x140003716
mov bp, 0xa
xor r14d, r14d
cmp rsi, rbx
je 0x14000377f
movzx ecx, byte [rdi + rbx]
mov edx, 0xa
call fcn.14000aa70
test eax, eax
je case.0x140003cf2.0
mov ecx, edx
mov eax, r14d
mul bp
jo case.0x140003cf2.0
mov r14d, eax
add r14w, cx
jb case.0x140003cf2.0
inc rbx
jmp 0x140003744
mov edi, 3
xor ebx, ebx
lea rsi, [rsp + 0x3d0]
sub edi, 1
jb 0x1400037b4
mov rcx, rsi
mov edx, r14d
call fcn.140001cc9
cmp byte [rsp + 0x420], 2
jne 0x1400037bf
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x14000378e
mov r15d, 1
jmp 0x140003952
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x2b0], rax
movups xmm0, xmmword [rsp + 0x3d0]
movups xmm1, xmmword [rsp + 0x3e0]
movups xmm2, xmmword [rsp + 0x3f0]
movaps xmmword [rsp + 0x2a0], xmm2
movaps xmmword [rsp + 0x290], xmm1
movaps xmmword [rsp + 0x280], xmm0
mov r15, qword [rsp + 0x408]
mov rbx, qword [rsp + 0x410]
mov rsi, qword [rsp + 0x418]
mov edi, dword [rsp + 0x428]
mov rcx, qword [0x140024018]
mov rdx, qword [0x140024020]
call fcn.14000772c
mov rax, qword [rsp + 0x2b0]
mov qword [0x140024028], rax
movaps xmm0, xmmword [rsp + 0x2a0]
movups xmmword [0x140024018], xmm0
mov rcx, qword [0x14002e030]
mov rdx, qword [0x14002e038]
call fcn.14000c9be
movups xmm0, xmmword [rsp + 0x3d0]
movups xmm1, xmmword [rsp + 0x3e0]
movups xmmword [0x14002e040], xmm1
movups xmmword [0x14002e030], xmm0
mov ecx, 1
xor edx, edx
call fcn.14000772c
test edi, edi
je 0x140003952
mov dword [rsp + 0x354], edi
lea rcx, [rsp + 0x3d0]
and dword [rcx + 0x20], 0
and word [rcx + 0x24], 0
and dword [rcx], 0
xorps xmm6, xmm6
movups xmmword [rcx + 8], xmm6
mov qword [rcx + 0x18], 7
mov byte [rcx + 0x20], 1
mov rdx, r15
mov qword [rsp + 0x1d8], rsi
mov r8, rsi
call fcn.14001a6b3
test rax, rax
jne case.0x140003cf2.0
mov rsi, rdx
lea rdx, [rsp + 0x3d0]
movaps xmmword [rdx + 0x20], xmm6
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
and dword [rdx + 0x30], 0
mov rcx, rsi
call sub.kernel32.dll_GetFileInformationByHandle
test eax, eax
mov qword [rsp + 0x3c0], rbx
je 0x140003988
test byte [rsp + 0x3d1], 4
je 0x140003939
lea r8, [rsp + 0x280]
and qword [r8], 0
mov rcx, rsi
mov edx, 9
mov r9d, 8
call sub.kernel32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x140003988
mov ebx, dword [rsp + 0x3f0]
mov eax, dword [rsp + 0x3f4]
shl rbx, 0x20
or rbx, rax
xor edi, edi
jmp 0x14000399f
mov rcx, r15
mov rdx, rbx
call fcn.14000772c
mov rcx, r13
mov rdx, qword [rsp + 0x258]
movaps xmm6, xmmword [rsp + 0x7f0]
add rsp, 0x808
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140001991
call fcn.1400017a8
mov rdx, rax
mov ecx, 1
call fcn.140015314
mov dil, 1
xor ebx, ebx
mov rcx, rbx
call fcn.14000773c
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x1d0], rdx
mov qword [rsp + 0x78], rdx
and qword [rsp + 0x80], 0
test dil, dil
mov dword [rsp + 0x350], r14d
mov qword [rsp + 0x3c8], r13
mov qword [rsp + 0x250], r15
jne 0x1400039e8
add rbx, 0x400
jae 0x1400039f2
mov dword [rsp + 0x68], 0
jmp 0x140003a13
mov rax, rbx
and rax, 0x1fff
je 0x140003a0d
mov ecx, 0x2000
sub rcx, rax
add rbx, rcx
setae al
jmp 0x140003a0f
mov al, 1
mov dword [rsp + 0x68], eax
xor r15d, r15d
lea r13, [rsp + 0x3d0]
xorps xmm6, xmm6
mov r14, qword [rsp + 0x1d0]
xor r12d, r12d
cmp r15, r14
jne 0x140003a4d
mov edx, 0x20
lea rcx, [rsp + 0x70]
call fcn.1400073f8
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x70]
lea rax, [rdi + r15]
mov rcx, r14
sub rcx, r15
cmp rcx, rbx
mov rdx, rbx
cmovb rdx, rcx
cmp byte [rsp + 0x68], 0
cmove rdx, rcx
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x288], rdx
and qword [rsp + 0x290], 0
mov qword [rsp + 0x298], r12
lea rcx, [rsp + 0x280]
call fcn.14001a6a1
mov r9, qword [rsp + 0x288]
sub r9, qword [rsp + 0x290]
mov rcx, r13
mov rdx, rsi
mov r8, rax
call fcn.14001a5a3
cmp qword [rsp + 0x3d0], 0
je 0x140003af7
mov rbp, qword [rsp + 0x3d8]
mov rcx, rbp
call fcn.1400153fe
cmp al, 0xb
je 0x140003b28
mov rcx, rbp
call fcn.1400153fe
cmp al, 0x23
jne 0x140006eaf
mov rcx, rbp
call fcn.140014dd8
jmp 0x140003a2c
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x298]
add rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x290], rax
cmp rcx, rax
cmovbe rcx, rax
mov qword [rsp + 0x298], rcx
jmp 0x140003b38
mov rcx, rbp
call fcn.140014dd8
mov rax, qword [rsp + 0x290]
test rax, rax
je 0x140006ea2
mov rcx, qword [rsp + 0x298]
mov r12, rcx
sub r12, rax
jb case.0x140003cf2.0
mov rdx, qword [rsp + 0x288]
cmp rcx, rdx
ja case.0x140003cf2.0
cmp rax, rdx
ja case.0x140003cf2.0
add r15, rax
mov qword [rsp + 0x80], r15
cmp r15, r14
jne 0x140003a2c
cmp r14, qword [rsp + 0x1d0]
jne 0x140003a2c
movaps xmmword [rsp + 0x3e0], xmm6
movaps xmmword [rsp + 0x3d0], xmm6
lea r15, [rsp + 0x100]
mov r9d, 0x20
mov rcx, r15
mov rdx, rsi
mov r8, r13
call fcn.14001a5a3
cmp qword [rsp + 0x100], 0
je 0x140003bfb
mov rbp, qword [rsp + 0x108]
mov rcx, rbp
call fcn.1400153fe
cmp al, 0xb
je 0x140003c3c
mov rcx, rbp
call fcn.1400153fe
cmp al, 0x23
jne 0x140006eaf
mov ecx, 1
mov rdx, rbp
call fcn.140015314
jmp 0x140003ba9
mov rax, qword [rsp + 0x108]
test rax, rax
je 0x140003c44
cmp rax, 0x21
jae case.0x140003cf2.0
lea r8, [rsp + rax]
add r8, 0x3d0
lea rcx, [rsp + 0x70]
mov rdx, r13
call fcn.1400073b5
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x80]
jmp 0x140003a2c
mov rcx, rbp
call fcn.140014dd8
mov rcx, rsi
call fcn.1400211e0
mov rcx, qword [section..data]
mov rdx, qword [0x140024008]
call fcn.14000772c
mov qword [section..data], rdi
mov qword [0x140024008], r14
mov rax, qword [rsp + 0x1d0]
mov qword [0x140024010], rax
mov rax, qword [0x14002e068]
test rax, rax
mov rbx, qword [rsp + 0x1d8]
jne 0x140003ce4
mov ecx, 1
xor eax, eax
lock cmpxchg qword [0x14002e068], rcx
jne 0x140003ce4
xorps xmm0, xmm0
lea rsi, [rsp + 0x3d0]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call sub.kernel32.dll_GetSystemInfo
mov r14d, dword [rsi + 0x20]
mov qword [0x14002e058], 1
mov qword [0x14002e060], r14
mov eax, 2
xchg qword [0x14002e068], rax
jmp 0x140003d0d
lea rcx, [0x140006f04]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
pause
mov rax, qword [0x14002e068]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov r14, qword [0x14002e060]
mov qword [rsp + 0x170], 8
xorps xmm6, xmm6
movups xmmword [rsp + 0x178], xmm6
mov ecx, 2
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
test rax, rax
jle 0x140003ec2
mov rsi, rax
lea rdi, [rsp + 0x3fc]
mov r8d, 0x104
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rdi - 0x2c], 0x130
and dword [rdi - 0x24], 0
movups xmmword [rdi - 0x1c], xmm6
movups xmmword [rdi - 0x10], xmm6
lea rdx, [rsp + 0x3d0]
mov rcx, rsi
call sub.kernel32.dll_Process32First
test eax, eax
je 0x140003ecc
mov qword [rsp + 0x68], r14
lea rbx, [rsp + 0x3d0]
mov ebp, dword [rsp + 0x3d8]
mov r12d, dword [rsp + 0x3f0]
mov rcx, rdi
call fcn.14000e5d0
mov r8, rdx
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.1400078a8
mov ecx, 0x410
xor edx, edx
mov r8d, ebp
call sub.kernel32.dll_OpenProcess
test rax, rax
je 0x140003e59
mov r15, rax
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14000e8ac
cmp qword [rsp + 0x70], 0
je 0x140003e51
mov r14, rdi
lea rdi, [rsp + 0x280]
mov rcx, rdi
lea rdx, [rsp + 0x100]
call fcn.14000c9a6
mov dword [rsp + 0x2c0], ebp
mov dword [rsp + 0x2c4], r12d
mov qword [rsp + 0x298], r15
lea rax, [rsp + 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rsp + 0x2a0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
and dword [rsp + 0x2c8], 0
lea rcx, [rsp + 0x170]
mov rdx, rdi
mov rdi, r14
call fcn.14000e944
jmp 0x140003e59
mov rcx, r15
call fcn.1400211e0
mov rcx, rsi
mov rdx, rbx
call sub.kernel32.dll_Process32Next
mov ebp, eax
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
call fcn.14000c9be
test ebp, ebp
jne 0x140003d8d
mov rcx, rsi
call fcn.1400211e0
movups xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x260], xmm0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x278], rax
mov rbx, qword [rsp + 0x1d8]
jmp 0x140003f0b
movups xmmword [rsp + 0x268], xmm6
jmp 0x140003edf
mov rcx, rsi
call fcn.1400211e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x268], xmm0
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x260], 8
mov ecx, 8
xor edx, edx
call fcn.14000e85f
mov ecx, 8
xor edx, edx
call fcn.14000e898
mov rcx, qword [rsp + 0x250]
mov rdx, rbx
xor r8d, r8d
call fcn.140001ee0
lea r12, [rsp + 0x77]
xorps xmm6, xmm6
lea r15, [rsp + 0x3fc]
lea rbx, [rsp + 0x280]
xor eax, eax
mov qword [rsp + 0x1d0], rax
xor eax, eax
mov qword [rsp + 0x68], rax
test byte [rsp + 0x1d0], 1
jne 0x140003f8f
mov rcx, qword [rsp + 0x260]
imul rax, qword [rsp + 0x270], 0x50
mov r8d, dword [rsp + 0x354]
test rax, rax
je 0x140003f85
lea rdx, [rcx + 0x50]
add rax, 0xffffffffffffffb0
cmp dword [rcx + 0x40], r8d
mov rcx, rdx
jne 0x140003f6a
jmp 0x140005020
mov al, 1
mov qword [rsp + 0x1d0], rax
and qword [rsp + 0x170], 0
and dword [rsp + 0x210], 0
lea rax, [rsp + 0x210]
mov qword [rsp + 0x20], rax
xor ecx, ecx
xor edx, edx
mov r8d, 1
lea r9, [rsp + 0x170]
call sub.wtsapi32.dll_WTSEnumerateSessionsW
test eax, eax
je 0x1400041b5
mov r12, qword [rsp + 0x170]
mov ebp, dword [rsp + 0x210]
mov r15d, 1
cmp r15, rbp
jae 0x14000419b
imul rax, r15, 0x18
mov esi, dword [r12 + rax]
and qword [rsp + 0x100], 0
and dword [rsp + 0x1e0], 0
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, esi
mov r8d, 6
lea r9, [rsp + 0x100]
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x140004121
mov rdi, qword [rsp + 0x100]
test rdi, rdi
je 0x14000412e
lea r14, [rdi - 2]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [r14 + 2], 0
lea r14, [r14 + 2]
jne 0x14000404b
lea rax, [rsp + 0x288]
movups xmmword [rax], xmm6
mov qword [rsp + 0x280], 1
mov rax, rdx
shr rax, 1
and edx, 1
add rdx, rax
mov rcx, rbx
call fcn.1400073f8
mov qword [rsp + 0x3d0], rdi
mov qword [rsp + 0x3d8], r14
and word [rsp + 0x3e0], 0
lea rdi, [rsp + 0x70]
mov r14d, 0xfffd
mov rcx, r13
call fcn.140007627
movzx ecx, ax
cmp rcx, 2
je 0x1400040f6
shr rax, 0x20
test rcx, rcx
cmovne eax, r14d
cmp eax, 0x7f
ja 0x1400040d6
mov rcx, rbx
mov edx, eax
call fcn.14000c8bf
jmp 0x1400040a9
and dword [rsp + 0x70], 0
mov ecx, eax
mov rdx, rdi
call fcn.1400148ff
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.1400073b5
jmp 0x1400040a9
mov rdi, qword [rsp + 0x280]
mov r14, qword [rsp + 0x288]
mov ecx, 1
xor edx, edx
call fcn.14000772c
mov rcx, qword [rsp + 0x100]
call sub.wtsapi32.dll_WTSFreeMemory
jmp 0x140004136
call fcn.1400017a8
mov rcx, rax
call fcn.140001813
mov edi, 1
xor r14d, r14d
lea rax, [rsp + 0x1e0]
and qword [rsp + 0x70], 0
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, esi
mov r8d, 8
lea r9, [rsp + 0x70]
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x14000417b
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140004188
mov esi, dword [rcx]
call sub.wtsapi32.dll_WTSFreeMemory
test esi, esi
jne 0x140004188
jmp 0x14000420f
call fcn.1400017a8
mov rcx, rax
call fcn.140001813
inc r15
mov rcx, rdi
mov rdx, r14
call fcn.14000772c
jmp 0x140003fe1
mov rcx, qword [rsp + 0x170]
call sub.wtsapi32.dll_WTSFreeMemory
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x3fc]
xor ecx, ecx
xor esi, esi
cmp ecx, 0x100
je 0x1400041d7
lea edi, [rcx + 1]
call sub.user32.dll_GetAsyncKeyState
movzx eax, ax
shr rax, 0xf
add rsi, rax
mov ecx, edi
jmp 0x1400041b9
test rsi, rsi
je 0x140004282
mov rcx, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x1d8]
mov r8b, 1
call fcn.140001ee0
call fcn.14001cf27
mov qword [0x14002e050], rax
mov dword [0x140024030], edx
jmp 0x140005020
and qword [rsp + 0x280], 0
mov rcx, rbx
call sub.user32.dll_GetCursorPos
mov ecx, 0x7d0
call sub.kernel32.dll_Sleep
and qword [rsp + 0x3d0], 0
mov rcx, r13
call sub.user32.dll_GetCursorPos
mov r15d, dword [rsp + 0x280]
mov r12d, dword [rsp + 0x3d0]
mov esi, dword [rsp + 0x3d4]
mov ebp, dword [rsp + 0x284]
mov rcx, rdi
mov rdx, r14
call fcn.14000772c
cmp r12d, r15d
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x3fc]
jne 0x1400041e0
cmp esi, ebp
jne 0x1400041e0
cmp dword [0x140024030], 0x3b9aca00
je 0x1400043e3
call fcn.14001cf27
mov rdi, rax
mov esi, edx
mov r12, qword [0x14002e050]
mov r14d, dword [0x140024030]
call fcn.14001cf87
test rax, rax
je case.0x140003cf2.0
mov rcx, rax
mov eax, 0x3b9aca00
xor edx, edx
div rcx
lea ebp, [rax - 0x3b9aca00]
cmp rcx, 1
sete r15b
cmovne ebp, eax
mov rcx, r12
mov edx, r14d
mov r8, rdi
mov r9d, esi
call fcn.14001cfc3
cmp al, 1
jne 0x140004360
mov r9, r12
sub r9, rdi
mov r10d, 0x3b9aca00
jb case.0x140003cf2.0
cmp r14d, esi
jae 0x140004317
test r9, r9
je case.0x140003cf2.0
dec r9
lea ecx, [r14 + 0x3b9aca00]
jmp 0x14000431a
mov ecx, r14d
sub ecx, esi
mov eax, ecx
xor edx, edx
div r10d
mov r11d, eax
add r11, r9
jb case.0x140003cf2.0
xor r8d, r8d
mov r8b, r15b
mov eax, ecx
xor edx, edx
div r10d
mov rcx, r11
mov r9d, ebp
call fcn.14001cfc3
inc al
cmp al, 2
jae 0x140004360
xor ecx, ecx
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x3fc]
xor edx, edx
jmp 0x1400043bb
mov edx, 0x3b9aca00
sub rdi, r12
mov r8d, 0x3b9aca00
jae 0x14000437f
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x3fc]
jmp 0x1400043bb
cmp esi, r14d
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x3fc]
jae 0x14000439f
test rdi, rdi
je 0x1400043bb
dec rdi
add esi, 0x3b9aca00
sub esi, r14d
mov eax, esi
xor edx, edx
div r8d
mov ecx, eax
add rcx, rdi
jb case.0x140003cf2.0
mov eax, esi
xor edx, edx
div r8d
cmp edx, 0x3b9aca00
mov r8, qword [rsp + 0x68]
je 0x140005025
cmp rcx, 0x709
jb 0x140005025
mov dword [0x140024030], 0x3b9aca00
mov r15, qword [rsp + 0x250]
mov rcx, r15
mov rsi, qword [rsp + 0x1d8]
mov rdx, rsi
xor r8d, r8d
call fcn.140001ee0
lea rax, [rsp + 0x3f0]
and word [rax + 4], 0
mov rdi, qword [section..data]
and dword [rax], 0
mov r14, qword [0x140024010]
and dword [rsp + 0x3d0], 0
movups xmmword [rax - 0x18], xmm6
mov qword [rsp + 0x3e8], 7
mov byte [rsp + 0x3f1], 1
mov word [rsp + 0x3f3], 0x101
mov rcx, r13
mov rdx, r15
mov r8, rsi
call fcn.14001a6b3
mov rsi, rdx
test rax, rax
jne 0x1400044d5
jmp 0x14000446d
sub r14, rax
jb case.0x140003cf2.0
add rdi, rax
test r14, r14
je 0x1400044c2
mov rcx, r13
mov rdx, rsi
mov r8, rdi
mov r9, r14
call fcn.14001687c
cmp qword [rsp + 0x3d0], 0
je 0x1400044ac
mov r12, qword [rsp + 0x3d8]
mov rcx, r12
call fcn.1400153fe
cmp al, 0x23
jne 0x1400044c5
mov rcx, r12
call fcn.140014dd8
jmp 0x14000446d
mov rax, qword [rsp + 0x3d8]
test rax, rax
jne 0x140004461
lea r12, str.failed_to_write_whole_buffer
jmp 0x1400044c5
xor r12d, r12d
mov rcx, rsi
call fcn.1400211e0
mov rsi, r12
test r12, r12
je 0x1400044dd
mov rcx, rsi
call fcn.140001813
mov r14, qword [rsp + 0x1d8]
mov rcx, r14
call fcn.14000773c
mov rsi, rax
mov rdi, rdx
mov rcx, rax
mov rdx, r15
mov r8, r14
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0x288]
movups xmmword [rax + 0x90], xmm6
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2b8], rdi
mov qword [rsp + 0x2c0], r14
mov byte [rsp + 0x2c8], 0
mov qword [rsp + 0x310], 8
and qword [rsp + 0x2d0], 0
and qword [rsp + 0x2e0], 0
and word [rsp + 0x2e8], 0
mov byte [rsp + 0x308], 2
and dword [rsp + 0x328], 0
and word [rsp + 0x32c], 0
mov eax, 5
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x2a0], rax
mov r12, qword [0x140024018]
mov rsi, qword [0x140024028]
mov rcx, rsi
call fcn.14000773c
mov rdi, rax
mov r14, rdx
mov rcx, rax
mov rdx, r12
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x320]
cmp rdx, qword [rsp + 0x318]
jne 0x1400045de
lea rcx, [rsp + 0x310]
call fcn.140018f30
mov rdx, qword [rsp + 0x320]
mov rax, qword [rsp + 0x310]
imul rcx, rdx, 0x28
and qword [rax + rcx], 0
mov qword [rax + rcx + 8], rdi
mov qword [rax + rcx + 0x10], r14
mov qword [rax + rcx + 0x18], rsi
mov byte [rax + rcx + 0x20], 0
mov r8d, dword [rsp + 0x3d0]
mov r9d, dword [rsp + 0x3d3]
mov dword [rax + rcx + 0x21], r8d
mov dword [rax + rcx + 0x24], r9d
inc rdx
mov qword [rsp + 0x320], rdx
mov rcx, r15
mov rdx, qword [rsp + 0x1d8]
call fcn.14001b2fd
test rax, rax
je 0x14000468c
mov rdi, rax
mov rsi, rdx
mov rcx, rdx
call fcn.14000773c
mov r14, rax
mov r12, rdx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x2f0]
call fcn.140015a7b
mov qword [rsp + 0x2f0], r14
mov qword [rsp + 0x2f8], r12
mov qword [rsp + 0x300], rsi
mov byte [rsp + 0x308], 0
mov al, byte [rsp + 0x2e8]
test al, al
sete cl
mov r15, qword [rsp + 0x2e0]
test r15, r15
sete dl
and dl, cl
mov byte [rsp + 0x168], dl
je 0x1400046be
xor r15d, r15d
lea r12, [rsp + 0x77]
jmp 0x140004ec1
and qword [rsp + 0x338], 0
and qword [rsp + 0x348], 0
test al, al
lea r12, [rsp + 0x77]
lea rbp, [rsp + 0x70]
jne 0x1400048c4
call sub.kernel32.dll_GetEnvironmentStringsW
mov r12, rax
mov qword [rsp + 0x248], rax
test rax, rax
je 0x140006ef0
mov rdx, r12
cmp word [rdx], 0
je 0x1400048b2
mov rdi, 0xfffffffffffffffd
mov rcx, 0xfffffffffffffffe
mov r12, rdx
mov rax, rcx
inc rdi
cmp word [r12], 0
lea r12, [r12 + 2]
lea rcx, [rcx + 2]
jne 0x140004719
cmp rdi, 0xfffffffffffffffe
je case.0x140003cf2.0
lea r14, [rdx + 4]
xor ebp, ebp
test rax, rax
je 0x14000475a
cmp word [r14 - 2], 0x3d
je 0x140004764
inc rbp
add rax, 0xfffffffffffffffe
add r14, 2
jmp 0x140004740
mov rdx, r12
lea rbp, [rsp + 0x70]
jmp 0x1400046fe
lea rsi, [rdi + 2]
cmp rbp, rsi
jae case.0x140003cf2.0
lea r8, [rbp + 1]
lea rcx, [rsp + 0x100]
call fcn.1400159ed
lea rax, [rbp + 2]
cmp rsi, rax
jb case.0x140003cf2.0
sub rdi, rbp
lea rcx, [rsp + 0x3f0]
mov rdx, r14
mov r8, rdi
call fcn.1400159ed
movups xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x3e0], xmm1
movaps xmmword [rsp + 0x3d0], xmm0
movaps xmmword [rsp + 0x170], xmm0
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x180], rax
mov al, byte [rsp + 0x3e8]
lea rcx, [rsp + 0x3f0]
movups xmm0, xmmword [rcx - 7]
movups xmm1, xmmword [rcx + 9]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x8f], rcx
cmp al, 2
lea rbp, [rsp + 0x70]
je 0x1400048b2
mov rcx, qword [rsp + 0x180]
mov qword [rsp + 0x7e0], rcx
movaps xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x7d0], xmm0
mov byte [rsp + 0x7e8], al
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x73]
lea rdx, [rsp + 0x7e9]
mov dword [rdx + 3], ecx
mov dword [rdx], eax
lea rax, [rsp + 0x77]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x360], xmm0
movaps xmmword [rsp + 0x370], xmm1
mov rcx, r13
lea rdx, [rsp + 0x7d0]
call fcn.14001bbf0
lea rsi, [rsp + 0x100]
mov rcx, rsi
lea rdx, [rsp + 0x338]
mov r8, r13
lea r9, [rsp + 0x360]
call fcn.140017ff0
mov rcx, rsi
call fcn.140015a7b
jmp 0x1400046fb
mov rcx, qword [rsp + 0x248]
call sub.kernel32.dll_FreeEnvironmentStringsW
lea r12, [rsp + 0x77]
and qword [rsp + 0x178], 0
mov rax, qword [rsp + 0x2d0]
and qword [rsp + 0x198], 0
mov rcx, qword [rsp + 0x2d8]
xor edx, edx
test rax, rax
setne dl
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x190], rdx
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], rcx
cmove r15, rax
test r15, r15
je 0x140004df6
dec r15
mov qword [rsp + 0x1b0], r15
lea rcx, [rsp + 0x170]
call fcn.140014996
test rax, rax
je case.0x140003cf2.0
mov rdi, rax
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x3e0], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x3d0], xmm0
mov rcx, rbp
mov rdx, r13
call fcn.1400149dc
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je case.0x140003cf2.0
mov rax, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r14
mov rcx, r13
mov rdx, rbp
call fcn.140014a29
imul rax, r14, 0x38
lea r15, [rsi + rax]
add r15, 0x168
shl r14, 5
mov rax, qword [rsp + 0x3e0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x3d0]
movups xmmword [rdi], xmm0
cmp byte [rsi + r14 + 0x18], 2
jne 0x140004be7
mov r12, qword [rsp + 0x338]
test r12, r12
je 0x140004d3d
mov r14, qword [rsp + 0x340]
mov r9, qword [r15]
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x210]
mov rdx, r12
mov r8, r14
call fcn.14001786c
cmp qword [rsp + 0x210], 0
jne 0x140004d3d
mov rax, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x228]
mov byte [rsp + 0x5f], 0
test rdx, rdx
je 0x140004c3b
dec rdx
lea rdi, [rsp + 0x100]
mov rax, qword [rax + rcx*8 + 0x3d8]
movzx ecx, word [rax + 0x3d2]
sub rdx, 1
jae 0x140004a57
dec rcx
mov qword [rsp + 0x100], rax
and qword [rsp + 0x108], 0
mov qword [rsp + 0x110], rcx
mov rcx, r13
mov rdx, rdi
lea r8, [rsp + 0x5f]
call fcn.140017936
mov ecx, 0xb
mov rsi, r13
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x3f0]
mov rax, qword [rsi + 0x48]
mov qword [rsp + 0x1f0], rax
movups xmm0, xmmword [rsi + 0x38]
movaps xmmword [rsp + 0x1e0], xmm0
mov rcx, r13
lea rdx, [rsp + 0x1e0]
call fcn.1400149dc
mov rcx, qword [rsp + 0x3d0]
mov rax, qword [rsp + 0x3d8]
mov rdx, qword [rsp + 0x3e0]
imul r8, rdx, 0x38
mov r9, rdx
shl r9, 5
mov r10, qword [rcx + r8 + 0x198]
mov qword [rsp + 0x400], r10
movups xmm0, xmmword [rcx + r8 + 0x168]
movups xmm1, xmmword [rcx + r8 + 0x178]
movups xmm2, xmmword [rcx + r8 + 0x188]
movaps xmmword [rsp + 0x3f0], xmm2
movaps xmmword [rsp + 0x3e0], xmm1
movaps xmmword [rsp + 0x3d0], xmm0
mov r10, qword [rsp + 0x130]
mov qword [rcx + r8 + 0x198], r10
movups xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movups xmm2, xmmword [rsp + 0x120]
movups xmmword [rcx + r8 + 0x188], xmm2
movups xmmword [rcx + r8 + 0x178], xmm1
movups xmmword [rcx + r8 + 0x168], xmm0
movups xmm0, xmmword [rcx + r9]
movups xmm1, xmmword [rcx + r9 + 0x10]
movups xmmword [rsi + 0x28], xmm1
movups xmmword [rsi + 0x18], xmm0
lea r8, [rsp + 0x138]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rcx + r9 + 0x10], xmm1
movups xmmword [rcx + r9], xmm0
inc rdx
test rax, rax
je 0x140004c68
lea rcx, [rcx + rdx*8]
add rcx, 0x3d8
mov rdx, qword [rcx]
lea rcx, [rdx + 0x3d8]
dec rax
jne 0x140004bc2
mov qword [rsp + 0xc8], rdx
lea rax, [rsp + 0x77]
movups xmmword [rax + 0x59], xmm6
jmp 0x140004c81
add rsi, r14
lea rdx, [r15 + 0x18]
lea rcx, [rsp + 0x3e8]
call fcn.14001bc35
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
mov rcx, r13
call fcn.140018ee8
mov rcx, rbp
mov rdx, rsi
call fcn.14001bc35
lea rsi, [rsp + 0x100]
mov rcx, rsi
lea rdx, [rsp + 0x338]
mov r8, r13
mov r9, rbp
call fcn.140017ff0
mov rcx, rsi
jmp 0x140004d52
mov qword [rsp + 0x3d0], rax
and qword [rsp + 0x3d8], 0
mov qword [rsp + 0x3e0], rcx
lea rcx, [rsp + 0x70]
mov rdx, r13
lea r8, [rsp + 0x5f]
call fcn.140017936
jmp 0x140004c91
mov qword [rsp + 0xc8], rcx
and qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], rdx
mov ecx, 0xb
lea rdi, [rsp + 0x70]
mov rsi, r13
rep movsq qword [rdi], qword [rsi]
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x120], xmm2
movaps xmmword [rsp + 0x110], xmm1
movaps xmmword [rsp + 0x100], xmm0
mov sil, byte [rsp + 0xa0]
lea rax, [rsp + 0x77]
movups xmm0, xmmword [rax + 0x2a]
movups xmm1, xmmword [rax + 0x3a]
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmmword [rsp + 0x1f0], xmm1
dec qword [rsp + 0x348]
mov rax, qword [rax + 0x49]
mov qword [rsp + 0x1ff], rax
cmp byte [rsp + 0x5f], 0
je 0x140004d37
test r14, r14
je case.0x140003cf2.0
mov rax, qword [r12 + 0x3d8]
mov qword [rsp + 0x338], rax
dec r14
mov qword [rsp + 0x340], r14
and qword [rax + 0x160], 0
mov edx, 8
mov rcx, r12
call fcn.14000c660
cmp sil, 2
jne 0x140004d64
mov byte [rsp + 0x88], 2
lea r12, [rsp + 0x77]
lea rbp, [rsp + 0x70]
mov rcx, rbp
call fcn.140015a7b
mov r15, qword [rsp + 0x1b0]
jmp 0x140004922
movaps xmm0, xmmword [rsp + 0x100]
movaps xmm1, xmmword [rsp + 0x110]
movaps xmm2, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x3f0], xmm2
movaps xmmword [rsp + 0x3e0], xmm1
movaps xmmword [rsp + 0x3d0], xmm0
mov byte [rsp + 0x400], sil
mov rax, qword [rsp + 0x1ff]
lea rcx, [rsp + 0x3f0]
mov qword [rcx + 0x30], rax
movaps xmm0, xmmword [rsp + 0x1e0]
movaps xmm1, xmmword [rsp + 0x1f0]
movups xmmword [rcx + 0x21], xmm1
movups xmmword [rcx + 0x11], xmm0
movups xmm0, xmmword [rcx + 0x18]
mov rax, qword [rcx + 0x28]
mov rcx, qword [rcx + 0x30]
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov rcx, r13
call fcn.140016d5a
jmp 0x140004d45
mov rdi, qword [rsp + 0x338]
mov rsi, qword [rsp + 0x340]
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x330], rax
mov ecx, 4
call fcn.14000773c
mov dword [rax], 0x48544150
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], 4
mov byte [rsp + 0x88], 0
mov rcx, r13
mov rdx, rbp
call fcn.14001bbf0
test rdi, rdi
mov qword [rsp + 0x358], rsi
mov qword [rsp + 0x248], rdi
je 0x140004eb6
mov r9, qword [rsp + 0x3d0]
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, rdi
mov r8, rsi
call fcn.14001786c
cmp qword [rsp + 0x70], 0
jne 0x140004eb6
mov rax, qword [rsp + 0x78]
mov r15d, 0
test rax, rax
je 0x140004eb9
mov rcx, qword [rsp + 0x88]
shl rcx, 5
mov r15, qword [rax + rcx]
mov rdi, qword [rax + rcx + 0x10]
jmp 0x140004eb9
xor r15d, r15d
mov rcx, r13
call fcn.140016d5a
mov r14, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c0]
mov qword [rsp + 0x210], r14
mov qword [rsp + 0x218], rsi
lea rdx, str.program_path_has_no_file_name
test rsi, rsi
je 0x140004f2b
mov r9d, 4
mov rcx, r14
mov rdx, rsi
lea r8, str.__UNC._
call fcn.1400137ad
test al, al
lea rdx, [0x14001bc91]
lea rax, [0x14001bc8a]
cmovne rdx, rax
mov cl, byte [rsi + r14 - 1]
call rdx
lea rdx, str.program_path_has_no_file_name
test al, al
je 0x140004f9f
lea r15, [rsp + 0x3fc]
mov rsi, rdx
mov edi, 2
cmp byte [rsp + 0x168], 0
jne 0x140004fd4
mov rcx, qword [rsp + 0x248]
test rcx, rcx
je 0x140004fb0
and qword [rsp + 0x3d8], 0
mov qword [rsp + 0x3e0], rcx
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x3e8], rax
and qword [rsp + 0x3f8], 0
mov qword [rsp + 0x400], rcx
mov qword [rsp + 0x408], rax
mov eax, 1
mov rcx, qword [rsp + 0x330]
jmp 0x140004fb4
cmp rsi, 4
jae 0x1400052e9
xor eax, eax
jmp 0x140005349
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x410], rcx
mov rcx, r13
call fcn.14001908f
xor ecx, ecx
call fcn.14001c8d4
cmp rdi, 2
jne 0x140006d88
mov al, byte [0x14002e1b0]
mov ecx, 8
mov edx, 8
call fcn.14000c5d0
test rax, rax
je 0x140006ed5
mov rdi, rax
mov qword [rax], rsi
mov rcx, rbx
call fcn.140001858
mov rcx, rdi
lea rdx, fcn.14000c94a
call fcn.1400017be
mov r8, qword [rsp + 0x68]
inc r8
cmp qword [0x14002e030], 0
mov qword [rsp + 0x68], r8
je 0x140005046
mov rax, r8
xor edx, edx
mov ecx, 0x3c
div rcx
jmp 0x140005069
mov rax, r8
xor edx, edx
mov ecx, 3
div rcx
mov rcx, rdx
mov rax, r8
xor edx, edx
mov r8d, 0x3c
div r8
test rcx, rcx
je 0x140005072
test rdx, rdx
jne 0x140005172
mov rcx, r13
mov edx, dword [rsp + 0x350]
call fcn.140001cc9
cmp byte [rsp + 0x420], 2
je 0x140005172
mov r15, qword [rsp + 0x3d0]
mov rsi, qword [rsp + 0x3d8]
lea r12, [rsp + 0x3f0]
movups xmm0, xmmword [r12 - 0x10]
movups xmm1, xmmword [r12]
movaps xmmword [rsp + 0x280], xmm0
movaps xmmword [rsp + 0x290], xmm1
mov rax, qword [r12 + 0x10]
mov qword [rsp + 0x2a0], rax
mov r14, qword [rsp + 0x408]
mov rdi, qword [rsp + 0x410]
mov rcx, qword [0x140024018]
mov rdx, qword [0x140024020]
call fcn.14000772c
lea rcx, [rsp + 0x288]
mov rax, qword [rcx + 0x18]
mov qword [0x140024028], rax
movups xmm0, xmmword [rcx + 8]
movups xmmword [0x140024018], xmm0
test r15, r15
je 0x140005150
mov rcx, qword [0x14002e030]
mov rdx, qword [0x14002e038]
call fcn.14000c9be
mov qword [0x14002e030], r15
mov qword [0x14002e038], rsi
movups xmm0, xmmword [r12 - 0x10]
movups xmmword [0x14002e040], xmm0
mov rcx, r14
mov rdx, rdi
call fcn.14000772c
jmp 0x140005165
mov rcx, r14
mov rdx, rdi
call fcn.14000772c
xor ecx, ecx
mov rdx, rsi
call fcn.14000c9be
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x3fc]
mov ecx, 0x3e8
call sub.kernel32.dll_Sleep
mov rcx, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x270]
and qword [rsp + 0x270], 0
call fcn.14000e864
mov ecx, 2
xor edx, edx
call sub.kernel32.dll_CreateToolhelp32Snapshot
test rax, rax
jle 0x140003f47
mov rsi, rax
mov r8d, 0x104
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rsp + 0x3d0], 0x130
and dword [rsp + 0x3d8], 0
lea rax, [rsp + 0x3f0]
movups xmmword [rax - 0x10], xmm6
movups xmmword [rax - 4], xmm6
mov rcx, rsi
mov rdx, r13
call sub.kernel32.dll_Process32First
test eax, eax
je 0x1400052dc
mov edi, dword [rsp + 0x3d8]
mov ebp, dword [rsp + 0x3f0]
mov rcx, r15
call fcn.14000e5d0
mov r8, rdx
lea rcx, [rsp + 0x100]
mov rdx, rax
call fcn.1400078a8
mov ecx, 0x410
xor edx, edx
mov r8d, edi
call sub.kernel32.dll_OpenProcess
test rax, rax
je 0x1400052b2
mov r14, rax
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14000e8ac
cmp qword [rsp + 0x70], 0
je 0x1400052aa
mov rcx, rbx
lea rdx, [rsp + 0x100]
call fcn.14000c9a6
mov dword [rsp + 0x2c0], edi
mov dword [rsp + 0x2c4], ebp
mov qword [rsp + 0x298], r14
movups xmm0, xmmword [r12 + 1]
movups xmm1, xmmword [r12 + 0x11]
lea rax, [rsp + 0x288]
movups xmmword [rax + 0x28], xmm1
movups xmmword [rax + 0x18], xmm0
and dword [rsp + 0x2c8], 0
lea rcx, [rsp + 0x260]
mov rdx, rbx
call fcn.14000e944
jmp 0x1400052b2
mov rcx, r14
call fcn.1400211e0
mov rcx, rsi
mov rdx, r13
call sub.kernel32.dll_Process32Next
mov edi, eax
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
call fcn.14000c9be
test edi, edi
jne 0x1400051f9
mov rcx, rsi
call fcn.1400211e0
jmp 0x140003f47
lea rcx, [rsi + r14]
add rcx, 0xfffffffffffffffc
xor edx, edx
lea r11, str..exeprogram_not_found
cmp rdx, 4
sete al
je 0x140005339
mov r8b, byte [rcx + rdx]
mov r9b, byte [rdx + r11]
inc rdx
lea r10d, [r8 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
or r10b, r8b
lea r8d, [r9 - 0x41]
cmp r8b, 0x1a
setb r8b
shl r8b, 5
or r8b, r9b
cmp r10b, r8b
je 0x1400052fa
mov r14, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x218]
lea rcx, [r14 + rsi]
xor edx, edx
cmp rsi, rdx
je 0x140005395
movzx r8d, byte [r14 + rdx]
cmp r8d, 0x2f
je 0x140005368
inc rdx
cmp r8d, 0x5c
jne 0x14000534f
test al, al
je 0x1400054dc
lea rcx, [rsp + 0x1e0]
mov rdx, r14
mov r8, rsi
call fcn.14001bdb6
lea r15, [rsp + 0x3fc]
lea r14, [rsp + 0x70]
jmp 0x140005645
mov qword [rsp + 0x3d0], r14
mov qword [rsp + 0x3d8], rcx
and word [rsp + 0x3e0], 0
mov rcx, r13
call fcn.140014c7a
cmp ax, 1
jne 0x1400053c1
test dx, dx
jne 0x1400053ae
lea rdx, str.nul_byte_found_in_provided_data
cmp ax, 1
je 0x140004f2b
mov rcx, r14
mov rdx, rsi
mov r8b, 0x2e
call fcn.14001bca0
mov byte [rsp + 0x360], al
test r15, r15
je 0x140005673
add rdi, r15
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], rdi
and word [rsp + 0x110], 0
mov byte [rsp + 0x118], 1
lea rsi, [rsp + 0x3f0]
lea r14, [rsp + 0x70]
lea rdi, [rsp + 0x100]
mov rcx, r13
mov rdx, rdi
call fcn.14001a39a
mov al, byte [rsp + 0x3e8]
cmp al, 2
je 0x14000566b
cmp qword [rsp + 0x3e0], 0
je 0x1400054c2
mov rcx, qword [rsp + 0x3e0]
mov qword [rsp + 0x80], rcx
movups xmm0, xmmword [rsp + 0x3d0]
movaps xmmword [rsp + 0x70], xmm0
mov ecx, dword [rsi - 7]
mov edx, dword [rsi - 4]
mov dword [r12 + 0x15], edx
mov dword [r12 + 0x12], ecx
mov byte [rsp + 0x88], al
mov rcx, r13
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x360]
mov r9, r14
call fcn.14001bcc0
mov rax, qword [rsp + 0x3d0]
mov rdx, qword [rsp + 0x3d8]
test rax, rax
jne 0x140005848
xor ecx, ecx
call fcn.14001bd21
jmp 0x140005429
mov rcx, qword [rsp + 0x3d0]
mov rdx, qword [rsp + 0x3d8]
call fcn.14000772c
jmp 0x140005429
mov rcx, rsi
call fcn.14000773c
mov rdi, rax
mov r12, rdx
mov rcx, rax
mov rdx, r14
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x88], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x3e0], rax
mov al, byte [rsp + 0x88]
mov byte [rsp + 0x3e8], al
mov eax, dword [rsp + 0x89]
mov dword [rsp + 0x3e9], eax
movzx eax, word [rsp + 0x8d]
mov word [rsp + 0x3ed], ax
mov al, byte [rsp + 0x8f]
mov byte [rsp + 0x3ef], al
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x3d0], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x3d8], rax
mov r8d, 4
mov rcx, r13
lea rdx, str..exeprogram_not_found
call fcn.14001a48e
movaps xmm0, xmmword [rsp + 0x3d0]
movaps xmm1, xmmword [rsp + 0x3e0]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x80]
mov rcx, r13
mov rdx, rsi
call fcn.14001bd4a
cmp qword [rsp + 0x3d0], 0
lea r15, [rsp + 0x3fc]
je 0x1400055ff
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x1f0], rax
movups xmm0, xmmword [rsp + 0x3d0]
movaps xmmword [rsp + 0x1e0], xmm0
lea r12, [rsp + 0x77]
lea r14, [rsp + 0x70]
jmp 0x140005638
lea r14, [rsp + 0x70]
mov rcx, r14
lea rdx, [0x1400285c8]
xor r8d, r8d
call fcn.14001b9e3
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x1e0]
mov rdx, rsi
call fcn.14001bdb6
lea r12, [rsp + 0x77]
mov rdx, qword [rsp + 0x78]
mov rcx, rsi
call fcn.14000772c
mov rax, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x1e8]
test rax, rax
je 0x140004f33
mov rdi, qword [rsp + 0x1f0]
jmp 0x140005b7e
mov rcx, r13
call fcn.140015a7b
mov qword [rsp + 0x100], 2
lea rax, [rsp + 0x138]
movups xmmword [rax - 0x30], xmm6
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x60], rax
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x1400056b6
mov r14, r13
mov esi, 0x200
mov r12, r8
jmp 0x1400056fe
sub r8, r15
lea rcx, [rsp + 0x100]
mov rdx, r8
call fcn.140014acb
mov r14, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x108]
mov eax, 0xffffffff
cmp rdi, rax
mov r15d, 0xffffffff
cmovb r15, rdi
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x60], r14
mov rsi, r15
mov r12, r15
xor ecx, ecx
call sub.kernel32.dll_SetLastError
xor ecx, ecx
mov rdx, r14
mov r8d, r12d
call sub.kernel32.dll_GetModuleFileNameW
mov ebp, eax
test eax, eax
jne 0x140005721
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140005774
mov r8d, ebp
cmp r12, r8
jne 0x14000574e
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne case.0x140003cf2.0
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
jmp 0x1400056a0
jb 0x1400056a0
cmp rsi, r8
jb case.0x140003cf2.0
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.1400159ed
mov sil, byte [rsp + 0x88]
jmp 0x140005789
call fcn.1400017a8
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x88], 2
mov sil, 2
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x100]
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
call fcn.1400159bd
cmp sil, 2
jne 0x1400057b8
lea rcx, [rsp + 0x70]
call fcn.1400159d4
jmp 0x14000585c
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, rsi
mov rdx, rdi
call fcn.14001b2fd
cmp rdi, rdx
cmovb rdx, rdi
test rax, rax
cmove rdx, rdi
mov qword [rsp + 0x3d0], rsi
mov qword [rsp + 0x3d8], r14
mov qword [rsp + 0x3e0], rdx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x3e8], rax
mov rcx, r15
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x360]
mov r9, r13
call fcn.14001bcc0
mov rax, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
test rax, rax
je 0x140005855
mov rdi, qword [rsp + 0x110]
jmp 0x140005b59
mov rdi, qword [rsp + 0x3e0]
jmp 0x140005b5e
xor ecx, ecx
call fcn.14001bd21
mov qword [rsp + 0x170], 2
lea rax, [rsp + 0x178]
movups xmmword [rax], xmm6
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x60], rax
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x14000589e
mov r14, r13
mov esi, 0x200
mov r12, r8
jmp 0x1400058e6
sub r8, r15
lea rcx, [rsp + 0x170]
mov rdx, r8
call fcn.140014acb
mov r14, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov eax, 0xffffffff
cmp rdi, rax
mov r15d, 0xffffffff
cmovb r15, rdi
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x60], r14
mov rsi, r15
mov r12, r15
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r14
mov edx, r12d
call sub.kernel32.dll_GetSystemDirectoryW
mov ebp, eax
test eax, eax
jne 0x14000590b
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1400059bc
mov r8d, ebp
cmp r12, r8
jne 0x140005938
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne case.0x140003cf2.0
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
jmp 0x140005888
jb 0x140005888
cmp rsi, r8
lea r15, [rsp + 0x100]
jb case.0x140003cf2.0
lea rsi, [rsp + 0x70]
mov rcx, rsi
mov rdx, r14
call fcn.1400159ed
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x360]
mov r9, rsi
call fcn.14001bcc0
and qword [rsp + 0x100], 0
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
call fcn.1400159bd
mov rax, qword [rsp + 0x108]
test rax, rax
je 0x1400059ea
mov rdx, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x118]
lea r12, [rsp + 0x77]
jmp 0x140005b59
call fcn.1400017a8
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x100], 1
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
call fcn.1400159bd
lea r15, [rsp + 0x100]
mov rcx, r15
call fcn.14001bd2b
mov qword [rsp + 0x170], 2
lea rax, [rsp + 0x178]
movups xmmword [rax], xmm6
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x60], rax
xor edi, edi
xor r15d, r15d
cmp r8, 0x201
jae 0x140005a34
mov r14, r13
mov esi, 0x200
mov r12, r8
jmp 0x140005a7c
sub r8, r15
lea rcx, [rsp + 0x170]
mov rdx, r8
call fcn.140014acb
mov r14, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov eax, 0xffffffff
cmp rdi, rax
mov r15d, 0xffffffff
cmovb r15, rdi
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x60], r14
mov rsi, r15
mov r12, r15
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r14
mov edx, r12d
call sub.kernel32.dll_GetWindowsDirectoryW
mov ebp, eax
test eax, eax
jne 0x140005aa1
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140006050
mov r8d, ebp
cmp r12, r8
jne 0x140005ace
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne case.0x140003cf2.0
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
jmp 0x140005a1e
jb 0x140005a1e
cmp rsi, r8
jb case.0x140003cf2.0
lea rsi, [rsp + 0x70]
mov rcx, rsi
mov rdx, r14
call fcn.1400159ed
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x360]
mov r9, rsi
call fcn.14001bcc0
and qword [rsp + 0x100], 0
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
call fcn.1400159bd
mov rax, qword [rsp + 0x108]
test rax, rax
lea rdi, [rsp + 0x3f0]
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x100]
je 0x14000608b
mov rdx, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x118]
lea r14, [rsp + 0x70]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rdx
mov qword [rsp + 0x1f0], rdi
mov qword [rsp + 0x3b8], rdx
mov qword [rsp + 0x1c8], rax
lea rax, [rax + rdi*2]
add rax, 0xfffffffffffffff6
cmp rdi, 5
mov ecx, 0
cmovb rax, rcx
mov qword [rsp + 0x160], rdx
jb 0x140005bb6
cmp word [rax], 0x2e
jne 0x140005bb6
cmp word [rax + 8], 0
je 0x140005fae
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0x310]
mov bpl, byte [rsp + 0x32d]
mov r15, qword [rsp + 0x2c0]
add r15, rax
mov rsi, r14
imul r14, qword [rsp + 0x320], 0x28
mov qword [rsp + 0x70], 2
movups xmmword [r12 + 1], xmm6
mov rcx, rsi
mov dx, 0x22
call fcn.140019d75
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0x3d8], r15
and word [rsp + 0x3e0], 0
mov rcx, rsi
mov rdx, r13
call fcn.140019d50
mov rcx, rsi
mov dx, 0x22
call fcn.140019d75
test r14, r14
je 0x140005c8d
lea r15, [rdi + 0x28]
lea rsi, [rsp + 0x70]
mov rcx, rsi
mov dx, 0x20
call fcn.140019d75
mov rcx, rsi
mov rdx, rdi
mov r8d, ebp
call fcn.14001c22f
add r14, 0xffffffffffffffd8
mov rdi, r15
test rax, rax
je 0x140005c3a
mov rsi, rax
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
call fcn.1400159bd
lea r15, [rsp + 0x3fc]
jmp 0x140006cff
mov rax, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
test rax, rax
lea r15, [rsp + 0x3fc]
je 0x140006cfc
mov rcx, qword [rsp + 0x80]
mov dl, 1
mov dword [rsp + 0xf8], edx
mov dword [rsp + 0x23c], 0
mov rbp, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x160]
mov qword [rsp + 0x1c0], rdx
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r14
mov qword [rsp + 0x220], rcx
lea rcx, [rsp + 0x210]
xor edx, edx
call fcn.140019d75
cmp byte [rsp + 0x32c], 0
mov ecx, 0x608
mov eax, 0x400
cmove ecx, eax
or ecx, dword [rsp + 0x328]
mov dword [rsp + 0x230], ecx
mov eax, 2
mov qword [rsp + 0x1b8], rax
mov eax, 0
mov esi, 0
mov ecx, 2
cmp byte [rsp + 0x168], 0
lea r14, [rsp + 0x70]
jne 0x14000600d
mov qword [rsp + 0x158], rbp
mov qword [rsp + 0x1e0], 2
lea rax, [rsp + 0x1e8]
movups xmmword [rax], xmm6
mov rcx, qword [rsp + 0x330]
test rcx, rcx
jne 0x140005d98
lea rcx, [rsp + 0x1e0]
xor edx, edx
call fcn.140019d75
mov rcx, qword [rsp + 0x330]
xor eax, eax
mov r8, qword [rsp + 0x248]
test r8, r8
setne al
cmove rcx, r8
mov qword [rsp + 0x3d0], rax
and qword [rsp + 0x3d8], 0
mov qword [rsp + 0x3e0], r8
mov rdx, qword [rsp + 0x358]
mov qword [rsp + 0x3e8], rdx
mov qword [rsp + 0x3f0], rax
and qword [rsp + 0x3f8], 0
mov qword [rsp + 0x400], r8
mov qword [rsp + 0x408], rdx
mov qword [rsp + 0x410], rcx
mov rcx, r14
mov rdx, r13
call fcn.1400157a7
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140005fdb
mov rdx, qword [rsp + 0x80]
imul r8, rdx, 0x38
mov al, byte [rcx + r8 + 0x198]
cmp al, 2
je 0x140005fdb
add r8, rcx
add r8, 0x168
mov r15, qword [r8]
mov r9, qword [r8 + 8]
mov qword [rsp + 0x168], r9
mov rbp, qword [r8 + 0x10]
shl rdx, 5
lea r9, [rcx + rdx]
mov rdi, qword [rcx + rdx]
mov rcx, qword [rcx + rdx + 8]
mov qword [rsp + 0x60], rcx
mov rcx, qword [r8 + 0x28]
mov qword [rsp + 0x80], rcx
movups xmm0, xmmword [r8 + 0x18]
movaps xmmword [rsp + 0x70], xmm0
mov ecx, dword [r8 + 0x31]
mov edx, dword [r8 + 0x34]
mov dword [r12 + 0x15], edx
mov dword [r12 + 0x12], ecx
movups xmm0, xmmword [r9 + 0x10]
movaps xmmword [rsp + 0x360], xmm0
mov byte [rsp + 0x88], al
lea rcx, [rsp + 0x100]
mov rdx, r14
call fcn.14001c392
cmp byte [rsp + 0x118], 2
mov rsi, qword [rsp + 0x100]
je 0x1400062d5
mov rdx, qword [rsp + 0x108]
mov rcx, rsi
call fcn.14000772c
lea rsi, [rsp + 0x1e0]
mov rcx, rsi
mov rdx, r15
mov r8, rbp
call fcn.14001597b
mov rcx, r15
mov r15, rsi
mov rdx, qword [rsp + 0x168]
call fcn.1400159bd
mov rcx, rsi
mov dx, 0x3d
call fcn.140019d75
mov qword [rsp + 0x70], rdi
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x360]
movups xmmword [r12 + 9], xmm0
lea rcx, [rsp + 0x100]
mov rdx, r14
call fcn.14001c392
cmp byte [rsp + 0x118], 2
mov rsi, qword [rsp + 0x100]
je 0x1400062f2
mov rdi, qword [rsp + 0x108]
mov rax, qword [rsp + 0x110]
add rax, rsi
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], rax
and word [rsp + 0x180], 0
mov rcx, r15
lea rdx, [rsp + 0x170]
call fcn.140019d50
mov rcx, rsi
mov rdx, rdi
call fcn.14000772c
mov rcx, r15
xor edx, edx
call fcn.140019d75
lea r15, [rsp + 0x3fc]
jmp 0x140005dfe
movzx ecx, word [rax + 2]
cmp ecx, 0x42
je 0x140006334
cmp ecx, 0x43
je 0x14000635c
cmp ecx, 0x62
je 0x140006334
cmp ecx, 0x63
je 0x14000635c
jmp 0x140005bb6
mov rcx, r13
call fcn.14001908f
lea rcx, [rsp + 0x1e0]
xor edx, edx
call fcn.140019d75
mov rsi, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0x1e8]
mov rcx, rsi
mov rbp, qword [rsp + 0x158]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x168], rax
cmp byte [rsp + 0x308], 2
mov eax, 0
mov edi, 0
je 0x1400061f9
lea rcx, [rsp + 0x2f0]
call fcn.14001c411
test rax, rax
je 0x1400061af
mov rsi, rdx
jmp 0x1400068d2
call fcn.1400017a8
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x100], 1
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
call fcn.1400159bd
lea rdi, [rsp + 0x3f0]
lea r12, [rsp + 0x77]
lea r15, [rsp + 0x100]
mov rcx, r15
call fcn.14001bd2b
mov r8d, 4
lea rcx, [rsp + 0x170]
lea rdx, [0x140028c99]
call fcn.14001a1b5
cmp byte [rsp + 0x188], 2
je 0x1400064d8
mov r14, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x178]
mov rax, qword [rsp + 0x180]
add rax, r14
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], rax
and word [rsp + 0x110], 0
mov byte [rsp + 0x118], 1
mov rcx, r13
mov rdx, r15
call fcn.14001a39a
mov al, byte [rsp + 0x3e8]
cmp al, 2
je 0x1400064c5
cmp qword [rsp + 0x3e0], 0
je 0x140006195
mov rcx, qword [rsp + 0x3e0]
mov qword [rsp + 0x80], rcx
movups xmm0, xmmword [rsp + 0x3d0]
movaps xmmword [rsp + 0x70], xmm0
mov ecx, dword [rdi - 7]
mov edx, dword [rdi - 4]
mov dword [r12 + 0x15], edx
mov dword [r12 + 0x12], ecx
mov byte [rsp + 0x88], al
mov rcx, r13
lea rdx, [rsp + 0x210]
lea r8, [rsp + 0x360]
lea r9, [rsp + 0x70]
call fcn.14001bcc0
mov rbp, qword [rsp + 0x3d0]
mov rax, qword [rsp + 0x3d8]
test rbp, rbp
jne 0x1400064f3
xor ecx, ecx
mov rdx, rax
call fcn.14001bd21
jmp 0x1400060f7
mov rcx, qword [rsp + 0x3d0]
mov rdx, qword [rsp + 0x3d8]
call fcn.14000772c
jmp 0x1400060f7
mov rax, qword [rdx]
mov rcx, qword [rdx + 0x10]
add rcx, rax
mov qword [rsp + 0x3d0], rax
mov qword [rsp + 0x3d8], rcx
and word [rsp + 0x3e0], 0
mov rcx, r14
mov rdx, r13
call fcn.14001c469
mov rcx, r14
xor edx, edx
call fcn.140019d75
mov rdi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x158], rax
movaps xmmword [rsp + 0x170], xmm6
and qword [rsp + 0x180], 0
lea r15, [0x14002e178]
mov rcx, r15
call sub.kernel32.dll_AcquireSRWLockExclusive
mov al, byte [0x14002e180]
xor ecx, ecx
test al, al
setne cl
mov qword [rsp + 0x108], r15
and qword [rsp + 0x70], 0
mov byte [rsp + 0x110], 0
and qword [rsp + 0x80], 0
mov qword [rsp + 0x100], rcx
and qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x288]
cmp rax, 5
mov r9, r14
mov r14, qword [rsp + 0x290]
mov r15, qword [rsp + 0x2a0]
mov ecx, 0
cmovne rcx, rax
mov r8d, 0xfffffff6
call fcn.14001c527
test rax, rax
je 0x1400062b6
mov rsi, rdx
lea r15, [rsp + 0x3fc]
mov rdi, qword [rsp + 0x1b8]
jmp 0x140006872
cmp r14d, 5
mov qword [rsp + 0x240], rdx
je 0x14000647c
mov rcx, qword [rsp + 0x290]
jmp 0x14000647e
mov rcx, rdi
mov rdx, qword [rsp + 0x60]
call fcn.14000772c
mov rcx, r15
mov rdx, qword [rsp + 0x168]
call fcn.1400159bd
lea r15, [rsp + 0x3fc]
mov rcx, r13
call fcn.14001908f
mov rcx, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x1e8]
call fcn.1400159bd
mov rbp, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x1c0]
mov r14d, dword [rsp + 0xf8]
jmp 0x1400068f4
movzx r8d, word [rax + 4]
or r8d, 0x20
cmp r8d, 0x61
jne 0x140006352
movzx r8d, word [rax + 6]
or r8d, 0x20
cmp r8d, 0x74
je 0x14000637d
cmp cx, 0x43
jne 0x140005bb6
movzx ecx, word [rax + 4]
or ecx, 0x20
cmp ecx, 0x6d
jne 0x140005bb6
movzx eax, word [rax + 6]
add eax, 0xffffffbc
test ax, 0xffdf
jne 0x140005bb6
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x70], 2
movups xmmword [r12 + 1], xmm6
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x60], rax
xor r14d, r14d
xor r15d, r15d
cmp r8, 0x201
jae 0x1400063c0
mov r12, r13
mov esi, 0x200
mov rbp, r8
jmp 0x1400063ff
sub r8, r15
lea rcx, [rsp + 0x70]
mov rdx, r8
call fcn.140014acb
mov r12, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov eax, 0xffffffff
cmp r14, rax
mov r15d, 0xffffffff
cmovb r15, r14
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x60], r12
mov rsi, r15
mov rbp, r15
xor ecx, ecx
call sub.kernel32.dll_SetLastError
mov rcx, r12
mov edx, ebp
call sub.kernel32.dll_GetSystemDirectoryW
mov edi, eax
test eax, eax
jne 0x140006423
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x140006519
mov r8d, edi
cmp rbp, r8
jne 0x140006450
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne case.0x140003cf2.0
add rbp, rbp
mov eax, 0xffffffff
cmp rbp, rax
cmovae rbp, rax
mov r8, rbp
jmp 0x1400063aa
jb 0x1400063aa
cmp rsi, r8
jb case.0x140003cf2.0
lea rcx, [rsp + 0x100]
mov rdx, r12
call fcn.140018ee8
mov r15, qword [rsp + 0x100]
jmp 0x140006529
xor ecx, ecx
mov rdx, qword [rsp + 0x298]
mov r8d, 0xfffffff5
lea r9, [rsp + 0x80]
call fcn.14001c527
mov r14, rdx
test rax, rax
je 0x1400064ae
lea r15, [rsp + 0x3fc]
jmp 0x14000685a
cmp r15d, 5
je 0x140006819
mov rcx, qword [rsp + 0x2a0]
jmp 0x14000681b
mov rcx, r13
call fcn.140015a7b
mov rcx, r14
mov rdx, rsi
call fcn.14000772c
xor ecx, ecx
mov rdx, qword [rsp + 0x3b8]
call fcn.14001bd21
lea rdx, [0x140029290]
jmp 0x140004f2b
mov rdi, qword [rsp + 0x3e0]
mov rcx, r14
mov rdx, rsi
mov rsi, rax
call fcn.14000772c
mov rdx, rsi
lea r14, [rsp + 0x70]
mov rax, rbp
jmp 0x140005b5e
call fcn.1400017a8
mov qword [rsp + 0x108], rax
xor r15d, r15d
mov rcx, qword [rsp + 0x60]
mov rdx, r14
call fcn.1400159bd
mov rsi, qword [rsp + 0x108]
test r15, r15
lea r12, [rsp + 0x77]
je 0x140005c80
mov rdi, qword [rsp + 0x110]
mov qword [rsp + 0x170], r15
mov eax, 1
mov qword [rsp + 0x3d0], rax
and qword [rsp + 0x3d8], 0
mov qword [rsp + 0x3e0], rax
and word [rsp + 0x3e8], 0
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x180], rdi
lea r14, [0x1400292e6]
mov qword [rsp + 0x3f0], r14
lea rax, [0x1400292ee]
mov qword [rsp + 0x3f8], rax
and word [rsp + 0x400], 0
test r14, r14
je 0x1400065de
lea rcx, [rsp + 0x3f0]
call fcn.140014d6f
test ax, ax
je 0x1400065d5
mov esi, edx
jmp 0x140006617
and qword [rsp + 0x3f0], 0
cmp qword [rsp + 0x3d0], 0
je 0x1400066c3
mov rax, qword [rsp + 0x3d8]
cmp qword [rsp + 0x3e0], rax
je 0x1400066c3
lea rcx, [rax + 1]
mov qword [rsp + 0x3d8], rcx
movzx esi, word [rsp + rax*2 + 0x3e8]
mov r14, qword [rsp + 0x3f0]
cmp rdi, qword [rsp + 0x178]
jne 0x1400066ae
mov rax, qword [rsp + 0x3d0]
test r14, r14
je 0x140006672
mov rdx, qword [rsp + 0x3f8]
sub rdx, r14
add rdx, 3
shr rdx, 2
test rax, rax
je 0x14000668b
mov rax, qword [rsp + 0x3e0]
sub rax, qword [rsp + 0x3d8]
add rdx, rax
mov rax, 0xffffffffffffffff
cmovb rdx, rax
jmp 0x140006692
test rax, rax
je 0x140006689
mov rdx, qword [rsp + 0x3e0]
sub rdx, qword [rsp + 0x3d8]
jmp 0x14000668b
xor edx, edx
mov rax, 0xffffffffffffffff
inc rdx
cmove rdx, rax
lea rcx, [rsp + 0x170]
call fcn.140014acb
mov r15, qword [rsp + 0x170]
mov word [r15 + rdi*2], si
inc rdi
mov qword [rsp + 0x180], rdi
jmp 0x1400065ba
mov rax, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x178]
test rax, rax
je 0x140005c80
mov qword [rsp + 0x158], rax
mov rdi, qword [rsp + 0x310]
mov rax, qword [rsp + 0x320]
mov qword [rsp + 0x1b8], rax
mov al, byte [rsp + 0x32d]
mov byte [rsp + 0x1c0], al
test al, al
setne byte [rsp + 0x60]
lea rax, str.cmd.exe__d__c__
mov qword [rsp + 0x100], rax
lea rax, [0x140028fb7]
mov qword [rsp + 0x108], rax
and word [rsp + 0x110], 0
lea rcx, [rsp + 0x100]
call fcn.140014d6f
test ax, ax
je 0x140006b2b
mov ebp, edx
mov r15, rdi
mov rcx, qword [rsp + 0x108]
sub rcx, qword [rsp + 0x100]
add rcx, 3
shr rcx, 2
cmp rcx, 4
mov eax, 3
cmovb rcx, rax
inc rcx
call fcn.140014a73
mov rdi, rax
mov word [rax], bp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], 1
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x3e0], rax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0x3d0], xmm0
mov r14d, 1
mov rcx, r13
call fcn.140014d6f
cmp ax, 1
jne 0x140006b09
mov ebp, edx
cmp r14, qword [rsp + 0x78]
jne 0x140006807
mov rdx, qword [rsp + 0x3d8]
sub rdx, qword [rsp + 0x3d0]
add rdx, 3
shr rdx, 2
inc rdx
lea rcx, [rsp + 0x70]
call fcn.140014acb
mov rdi, qword [rsp + 0x70]
mov word [rdi + r14*2], bp
inc r14
mov qword [rsp + 0x80], r14
jmp 0x1400067c2
xor ecx, ecx
lea r15, [rsp + 0x3fc]
mov rdx, qword [rsp + 0x2a8]
mov r8d, 0xfffffff4
lea r9, [rsp + 0x90]
call fcn.14001c527
mov r12, rdx
test rax, rax
je 0x14000693c
mov rcx, r14
call fcn.1400211e0
mov r14, r12
lea r12, [rsp + 0x77]
mov rdi, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x240]
call fcn.1400211e0
mov rsi, r14
mov ecx, 1
call fcn.14001c8d4
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
call fcn.14001c8ec
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
call fcn.14001c8ec
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
call fcn.14001c8ec
lea rcx, [rsp + 0x100]
call fcn.14001c8e3
mov rcx, rdi
mov rdx, qword [rsp + 0x158]
call fcn.1400159bd
mov rdi, qword [rsp + 0x1c0]
mov r14d, dword [rsp + 0xf8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x168]
call fcn.1400159bd
mov rcx, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x218]
call fcn.1400159bd
mov rcx, rbp
mov rdx, rdi
call fcn.1400159bd
mov edi, 2
test r14b, r14b
jne 0x140004fd4
mov rcx, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x160]
call fcn.1400159bd
jmp 0x140004fd4
lea rax, [rsp + 0x3f0]
movups xmmword [rax + 0x14], xmm6
movups xmmword [rax + 8], xmm6
movups xmmword [rax - 8], xmm6
movups xmmword [rax - 0x18], xmm6
movups xmmword [rax + 0x38], xmm6
movups xmmword [rax + 0x28], xmm6
mov dword [rsp + 0x3d0], 0x68
test r12, r12
mov rax, qword [rsp + 0x240]
jne 0x14000697e
test r14, r14
jne 0x14000697e
test rax, rax
je 0x1400069a1
mov dword [rsp + 0x40c], 0x100
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], r14
mov qword [rsp + 0x430], r12
mov rdx, qword [rsp + 0x210]
lea rax, [rsp + 0x170]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rsi
mov eax, dword [rsp + 0x230]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
mov rcx, rbp
mov qword [rsp + 0x230], rdx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x140006d19
mov rsi, qword [rsp + 0x170]
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x398], rax
mov rdi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x390], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x3b0], rax
mov rcx, r12
call fcn.1400211e0
mov rcx, r14
call fcn.1400211e0
mov rcx, qword [rsp + 0x240]
call fcn.1400211e0
mov ecx, 1
call fcn.14001c8d4
lea rcx, [rsp + 0x100]
call fcn.14001c8e3
mov rcx, qword [rsp + 0x1b8]
mov rdx, qword [rsp + 0x158]
call fcn.1400159bd
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x168]
call fcn.1400159bd
mov rdx, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x230]
call fcn.1400159bd
mov rcx, rbp
mov rdx, qword [rsp + 0x1c0]
call fcn.1400159bd
cmp byte [rsp + 0x23c], 0
je 0x140006aff
mov rcx, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x160]
call fcn.1400159bd
lea r12, [rsp + 0x77]
jmp 0x140004fd4
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x170], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x180], rax
mov rdi, r15
jmp 0x140006b42
mov qword [rsp + 0x170], 2
lea rax, [rsp + 0x178]
movups xmmword [rax], xmm6
lea rcx, [rsp + 0x170]
mov dx, 0x22
call fcn.140019d75
mov rax, qword [rsp + 0xf8]
add rax, rax
xor ecx, ecx
mov rbp, qword [rsp + 0x158]
cmp rax, rcx
je 0x140006b8c
mov rdx, qword [rsp + 0x1c8]
cmp word [rdx + rcx], 0x22
lea rcx, [rcx + 2]
jne 0x140006b68
lea r14, str.Windows_file_names_may_not_contain_____or_end_with___
jmp 0x140006cd4
mov rax, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0xf8]
cmp word [rax + r15*2 - 2], 0x5c
lea r14, str.Windows_file_names_may_not_contain_____or_end_with___
je 0x140006cd4
mov qword [rsp + 0x230], rdi
lea rdi, [r15 - 1]
mov r14, qword [rsp + 0x1c8]
lea rcx, [r14 + r15*2]
add rcx, 0xfffffffffffffffe
mov edx, 1
mov r9d, 1
lea r8, [0x140028fb8]
call fcn.140016f4f
test al, al
mov edx, 0
cmovne rdx, r14
test rdx, rdx
cmove rdx, r14
cmove rdi, r15
lea r8, [rdx + rdi*2]
lea rdi, [rsp + 0x170]
mov rcx, rdi
call fcn.140015970
mov rcx, rdi
mov r15, qword [rsp + 0x230]
mov dx, 0x22
call fcn.140019d75
imul rax, qword [rsp + 0x1b8], 0x28
add rax, r15
mov qword [rsp + 0xf8], rax
cmp r15, qword [rsp + 0xf8]
je 0x140006d31
lea rcx, [rsp + 0x170]
mov dx, 0x20
call fcn.140019d75
mov dil, byte [rsp + 0x60]
cmp byte [rsp + 0x1c0], 0
jne 0x140006ca1
cmp qword [r15], 0
mov dil, byte [rsp + 0x60]
jne 0x140006ca1
mov rax, r15
mov r14, qword [r15 + 8]
mov rbp, qword [r15 + 0x18]
xor r12d, r12d
cmp rbp, r12
setne dil
je 0x140006ca1
mov r8b, byte [r14 + r12]
mov edx, 0x16
lea rcx, str._t_____________
call fcn.14001bca0
inc r12
test al, al
je 0x140006c7c
lea r12, [r15 + 0x28]
lea rcx, [rsp + 0x170]
mov rdx, r15
mov r8d, edi
call fcn.14001c22f
mov r15, r12
test rax, rax
lea r12, [rsp + 0x77]
mov rbp, qword [rsp + 0x158]
je 0x140006c35
mov r14, rax
mov rcx, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x178]
call fcn.1400159bd
lea r15, [rsp + 0x3fc]
mov rcx, rbp
mov rdx, rsi
call fcn.1400159bd
mov rsi, r14
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x1c8]
call fcn.1400159bd
jmp 0x140004f36
call fcn.1400017a8
mov rsi, rax
mov rcx, r12
call fcn.1400211e0
mov r12, rsi
jmp 0x14000684a
lea rcx, [rsp + 0x170]
mov dx, 0x22
call fcn.140019d75
mov rax, qword [rsp + 0x170]
mov r14, qword [rsp + 0x178]
test rax, rax
je 0x140006ce9
mov rcx, qword [rsp + 0x180]
mov dl, 1
mov dword [rsp + 0x23c], edx
mov dword [rsp + 0xf8], 0
mov qword [rsp + 0x1c0], rsi
lea r15, [rsp + 0x3fc]
jmp 0x140005cdc
mov rcx, rsi
call fcn.1400211e0
mov rcx, qword [rsp + 0x398]
call fcn.1400211e0
test rdi, rdi
je 0x140006daf
mov rcx, qword [rsp + 0x388]
call fcn.1400211e0
cmp qword [rsp + 0x3a0], 0
mov rdi, qword [rsp + 0x3c8]
mov rbx, qword [rsp + 0x3c0]
mov r14, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x3b0]
je 0x140006de7
mov rcx, qword [rsp + 0x390]
call fcn.1400211e0
cmp qword [rsp + 0x3a8], 0
je 0x140006dfa
mov rcx, rsi
call fcn.1400211e0
lea rcx, [rsp + 0x280]
call fcn.140001858
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, 0x411
xor edx, edx
mov r8d, eax
call sub.kernel32.dll_OpenProcess
test rax, rax
je 0x140006e35
mov rsi, rax
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_TerminateProcess
mov rcx, rsi
call fcn.1400211e0
lea rdx, fcn.14000c94a
xor ecx, ecx
call fcn.1400017be
mov rsi, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x270]
mov rcx, rsi
call fcn.14000e85f
mov rdx, qword [rsp + 0x268]
mov rcx, rsi
call fcn.14000e898
mov rcx, r14
mov rdx, rbx
call fcn.14000772c
mov rcx, rdi
mov rdx, qword [rsp + 0x258]
call fcn.140001991
movaps xmm6, xmmword [rsp + 0x7f0]
add rsp, 0x808
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x1d0], r15
jmp 0x140003c44
mov rcx, rdi
mov rdx, r14
call fcn.14000772c
mov rcx, rsi
call fcn.1400211e0
jmp case.0x140003cf2.0
mov rcx, qword [rsp + 0x178]
test rcx, rcx
jne 0x140006ee1
ud2
mov ecx, 8
mov edx, 8
jmp 0x140006ee9
mov rdx, qword [rsp + 0x180]
call fcn.1400074ca
ud2
call fcn.1400017a8
jmp case.0x140003cf2.0
mov ecx, 8
mov edx, 0x40
jmp 0x140006ee9