Function at 0x140001000
Capabilities:
Access peb ldr_data
Get common file path
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x9a0
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14001c008]
xor rax, rsp
mov qword [rbp + 0x920], rax
mov rax, qword gs:[0x60]
movabs r13, 0xf19af32351281819
mov r15, qword [rax + 0x18]
add r15, 0x20
xor r12d, r12d
mov r14d, r12d
mov rsi, qword [r15]
nop dword [rax]
movzx r9d, word [rsi + 0x38]
xor edx, edx
mov r8, qword [rsi + 0x40]
xor ecx, ecx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
movzx r9d, word [rsi + 0x38]
xor edx, edx
mov r8, qword [rsi + 0x40]
xor ecx, ecx
mov qword [rsp + 0x38], r12
mov rbx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharUpperA]
movabs rax, 0xc3a9bf661f7a5d52
lea rdx, [rbp + 0x10]
mov qword [rbp], rax
movabs rax, 0x3d906bf6832a17a8
mov rcx, qword [rbp]
mov qword [rbp + 0x10], rcx
mov rcx, rbx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x2f0], rax
movabs rax, 0x3d906bf6cf665386
mov qword [rbp], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x2f8], rax
xorps xmm0, xmmword [rbp + 0x2f0]
movdqa xmmword [rbp + 0x10], xmm0
call fcn.1400037bc
test rax, rax
jne 0x140001169
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsi]
cmp rsi, r15
je 0x140001181
jmp 0x140001060
mov r14, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
movsxd rax, dword [r14 + 0x3c]
xor ebx, ebx
xor r15d, r15d
xor r11d, r11d
movabs r9, 0x39d7a4d53aa97553
movabs r8, 0xbfeb35184a5b8208
mov edi, dword [rax + r14 + 0x88]
add rdi, r14
mov esi, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x20]
add rsi, r14
mov r12d, dword [rdi + 0x24]
add r13, r14
add r12, r14
cmp dword [rdi + 0x18], ebx
jbe 0x140001398
movabs rcx, 0x9def974c1c5c7d5e
movabs r10, 0x6af50792a1071be3
nop dword [rax]
mov eax, dword [r13 + r11*4]
mov qword [rbp], rcx
add rax, r14
mov rcx, qword [rbp]
mov qword [rbp + 0x80], rcx
mov qword [rbp], r10
lea r10, [r11 + r11]
mov rcx, qword [rbp]
mov qword [rbp + 0x88], rcx
mov qword [rbp], r9
mov rcx, qword [rbp]
mov qword [rbp + 0x90], rcx
mov qword [rbp], r8
mov rcx, qword [rbp]
mov qword [rbp + 0x98], rcx
movabs rcx, 0xf19af32351281819
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov qword [rbp + 0x300], rcx
movabs rcx, 0x3d906bf6cf665386
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov qword [rbp + 0x308], rcx
mov qword [rbp], r9
lea r9, [rbp + 0x80]
mov rcx, qword [rbp]
sub r9, rax
mov qword [rbp + 0x310], rcx
mov qword [rbp], r8
mov rcx, qword [rbp]
mov qword [rbp + 0x318], rcx
mov rcx, rax
vmovdqu ymm0, ymmword [rbp + 0x300]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x1400012b5
inc rcx
test edx, edx
jne 0x1400012a0
test r8d, r8d
jne 0x1400012c5
movzx ecx, word [r10 + r12]
mov ebx, dword [rsi + rcx*4]
add rbx, r14
movabs rcx, 0xb0f99c51015c7d5e
lea r8, [rbp + 0x20]
mov qword [rbp], rcx
sub r8, rax
mov rcx, qword [rbp]
mov qword [rbp + 0x20], rcx
movabs rcx, 0x3d901885aa1437e2
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov qword [rbp + 0x28], rcx
movabs rcx, 0xf19af32351281819
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov qword [rbp + 0x2e0], rcx
movabs rcx, 0x3d906bf6cf665386
mov qword [rbp], rcx
mov rcx, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x2e8], rcx
xorps xmm0, xmmword [rbp + 0x2e0]
movdqa xmmword [rbp + 0x20], xmm0
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001353
inc rax
test ecx, ecx
jne 0x140001340
test edx, edx
jne 0x140001363
movzx eax, word [r10 + r12]
mov r15d, dword [rsi + rax*4]
add r15, r14
inc r11d
movabs rcx, 0x9def974c1c5c7d5e
movabs r8, 0xbfeb35184a5b8208
movabs r9, 0x39d7a4d53aa97553
movabs r10, 0x6af50792a1071be3
cmp r11d, dword [rdi + 0x18]
jb 0x1400011e0
movabs rax, 0xf1f4f351514d1872
lea rcx, [rbp + 0x120]
mov qword [rbp], rax
movabs rsi, 0x39bba4b93acd757d
mov rax, qword [rbp]
movabs r13, 0xf19af32351281819
mov qword [rbp + 0x120], rax
movabs r12, 0x3d906bf6cf665386
movabs rax, 0x3da26bc5cf0a53e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqu ymmword [rbp + 0x120], ymm1
vzeroupper
call rbx
mov rdi, rax
lea rdx, [rbp + 0x30]
movabs rax, 0x83f89a6f35497755
mov qword [rbp], rax
movabs rax, 0x3d906bf6981f21e7
mov rcx, qword [rbp]
mov qword [rbp + 0x30], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x38], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0x2d0], rcx
mov rcx, rdi
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0x2d8], rax
xorps xmm0, xmmword [rbp + 0x2d0]
movdqa xmmword [rbp + 0x30], xmm0
call r15
mov r14, rax
movabs rbx, 0xbfeb35184a5b8208
movabs rax, 0xf1fbf355514c1878
mov qword [rbp], rax
movabs rax, 0x3da26bc5cf0f53f6
mov rcx, qword [rbp]
mov qword [rbp + 0x100], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x108], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x110], rcx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movabs rax, 0x39d7a4d53aa97553
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
lea rcx, [rbp + 0x100]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
vmovdqu ymm0, ymmword [rbp + 0x340]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqu ymmword [rbp + 0x100], ymm1
vzeroupper
call r14
mov rsi, rax
movabs rax, 0xf1f7f34f515a186c
mov qword [rbp], rax
movabs rax, 0x3df46bd8cf0853e9
mov rcx, qword [rbp]
mov qword [rbp + 0xe0], rcx
mov qword [rbp], rax
movabs rax, 0x39d7a4d53ac5753f
mov rcx, qword [rbp]
mov qword [rbp + 0xe8], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xf0], rcx
lea rcx, [rbp + 0xe0]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
movabs rax, 0x39d7a4d53aa97553
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqu ymmword [rbp + 0xe0], ymm1
vzeroupper
call r14
mov rbx, rax
lea rdx, [rbp + 0x40]
movabs rax, 0xa1ea9e46055c7d5e
mov qword [rbp], rax
movabs rax, 0x3d906bf6980e27e7
mov rcx, qword [rbp]
mov qword [rbp + 0x40], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x48], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0x2c0], rcx
mov rcx, rdi
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x2c8], rax
xorps xmm0, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp + 0x40], xmm0
call r15
movabs rax, 0x9df4844c15644a4c
movabs rcx, 0xbfeb35184a5b8208
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x51f92d999b0232e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x39d7a4d53aa92236
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
lea rdx, [rbp + 0xc0]
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x39d7a4d53aa97553
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
mov qword [rbp], rcx
mov rcx, rbx
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
vmovdqu ymm0, ymmword [rbp + 0x380]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0xc0], ymm1
vzeroupper
call r15
mov rdi, rax
lea rdx, [rbp + 0x50]
movabs rax, 0x94e99c4f124f7d4b
mov qword [rbp], rax
movabs rax, 0x3d906bf6cf1f36cd
mov rcx, qword [rbp]
mov qword [rbp + 0x50], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x58], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0x2b0], rcx
mov rcx, rsi
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x50]
mov qword [rbp + 0x2b8], rax
xorps xmm0, xmmword [rbp + 0x2b0]
movdqa xmmword [rbp + 0x50], xmm0
call r15
mov rbx, rax
lea rdx, [rbp + 0x60]
movabs rax, 0x85fb9651124f7d4b
mov qword [rbp], rax
movabs rax, 0x3dc713b3b60318e3
mov rcx, qword [rbp]
mov qword [rbp + 0x60], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x68], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp + 0x2a0], rcx
mov rcx, rsi
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x60]
mov qword [rbp + 0x2a8], rax
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x60], xmm0
call r15
mov r12, rax
movabs rax, 0x94d18746024f7d4b
mov qword [rbp], rax
movabs rax, 0x3dc70e83a30705ff
mov rcx, qword [rbp]
mov qword [rbp + 0x70], rcx
mov qword [rbp], rax
movabs rax, 0x3d906bf6cf665386
mov rcx, qword [rbp]
mov qword [rbp + 0x78], rcx
mov qword [rbp], r13
mov rcx, qword [rbp]
mov qword [rbp], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x70]
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x290], rcx
xorps xmm0, xmmword [rbp + 0x290]
lea rdx, [rbp + 0x70]
movdqa xmmword [rbp + 0x70], xmm0
mov rcx, rsi
call r15
mov rsi, rax
movabs rax, 0xf1eaf357515c1871
mov qword [rbp], rax
movabs rax, 0x3dbf6bd9cf5c53f5
mov rcx, qword [rbp]
mov qword [rbp + 0x1a0], rcx
mov qword [rbp], rax
movabs rax, 0x39b3a4fb3ac57537
mov rcx, qword [rbp]
mov qword [rbp + 0x1a8], rcx
mov qword [rbp], rax
movabs rax, 0xbf8935684a34827a
mov rcx, qword [rbp]
mov qword [rbp + 0x1b0], rcx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x42967021825d9822
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x4a18c66d76c53685
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x7c9df83e016efe24
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x1865d2402b7c3c45
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x60446eee66b9926e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xc7f30f0b44bc7d7e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x81c205fbde06e9a2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x55857b6ba9ce5e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0xc67f53b490042a65
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xfb69207bf77342f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0x2b348a48bfae574e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0xe00fe969aae03fb0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0xa3a5d07ec64679c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0xf1707d88d5549fda
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x1878343ae7bc918f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0xf0a8f02d7a8384f4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x9ee4a88e8bc63060
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0x279d9f9880b20a0a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0x20a86ba4a0787962
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rax, 0xf53a2c8c80338358
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
movabs rax, 0x28b8d42926b7b3f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rax, 0x6bee026e77952aef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs rax, 0x4b2d9f9b43c7fd9c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0xf88dba30b623d90c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x420], rax
movabs rax, 0x3d906bf6cf665386
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x428], rax
movabs rax, 0x39d7a4d53aa97553
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
movabs rax, 0xbfeb35184a5b8208
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
movabs rax, 0x42f5700f8225984d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
movabs rax, 0x4a6bc64276a836ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
movabs rax, 0x7cfbf8110102fe47
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
movabs rax, 0x1857d2342b533c2c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
movabs rax, 0x60236e9b66c89201
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x460], rax
movabs rax, 0xc7c50f6e44c57d4e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x468], rax
movabs rax, 0x81a6058dde60e9db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x470], rax
movabs rax, 0x52b57d0baa5e5d0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x478], rax
movabs rax, 0xc6505387903d2a15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
movabs rax, 0xfb1a201af70142b2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0x2b198a29bfc5572f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
movabs rax, 0xe062e90caa813ff4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
movabs rax, 0xa3e1d053c62879a9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
movabs rax, 0xf1147da6d5189f96
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
movabs rax, 0x180a3405e7d091e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4b0], rax
movabs rax, 0xf0d1f0487ae88498
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4b8], rax
movabs rax, 0x9e8aa8bf8bb1305d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
movabs rax, 0x27ae9ff280c80a7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
movabs rax, 0x20c06bc1a0087957
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4d0], rax
movabs rax, 0xf54d2ce48001833c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4d8], rax
movabs rax, 0x2889d44b2686b391
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
movabs rax, 0x6bd7021e77f42ade
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
movabs rax, 0x4b499fbd43b4fdeb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
movabs rax, 0xf88dba00b61ed960
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x420]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vmovdqa ymmword [rbp + 0x1a0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqu ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x480]
vmovdqu ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x200], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0x220], ymm1
mov qword [rbp + 0x4f8], rax
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x4c0]
vmovdqu ymm0, ymmword [rbp + 0x260]
vmovdqa ymmword [rbp + 0x240], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x4e0]
vmovdqa ymmword [rbp + 0x260], ymm1
lea rdx, [rbp + 0x710]
mov ecx, 0x104
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14000233c
lea r8, [rbp + 0x710]
mov edx, 0x104
lea rcx, [rbp + 0x500]
call fcn.140006470
lea r8, str.arasaka.dll
mov edx, 0x104
lea rcx, [rbp + 0x500]
call fcn.1400064d8
xor r15d, r15d
lea r8, [rbp + 0x500]
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x1a0]
xor ecx, ecx
call rdi
test eax, eax
js 0x14000233c
movabs rax, 0xf1eef3455147184a
movabs rcx, 0x52b57d0baa5e5d0
mov qword [rbp], rax
movabs rdi, 0x3d906bf6cf665386
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x3df56b84cf0753f1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x39bba4ba3af9750f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0xbf8e35714a388261
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0x429c70428279983e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x4a18c62d76da3689
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x7ca7f8650164fe28
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0x1833d25a2b3a3c7b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0x607f6ee866bf926e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xc7b10f1d44bc7d1d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x81a6058dde0de9be
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0x39d7a4d53aa97553
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
movabs rax, 0xbfeb35184a5b8208
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
movabs rax, 0x42f5700f8225984d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
movabs rax, 0x4a6bc64276a836ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
movabs rax, 0x7cfbf8110102fe47
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
movabs rax, 0x1857d2342b533c2c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
movabs rax, 0x60236e9b66c89201
mov qword [rbp], rax
mov rax, qword [rbp]
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x400], rax
xor r9d, r9d
mov qword [rsp + 0x40], r15
movabs rax, 0xc7c50f6e44c57d4e
mov qword [rbp], rax
xor r8d, r8d
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
movabs rax, 0x81a6058dde60e9db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x410], rax
mov qword [rbp], rcx
mov rcx, 0xffffffff80000001
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x3c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqu ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x140], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x3e0]
vmovdqu ymm0, ymmword [rbp + 0x180]
mov qword [rbp + 0x418], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x38], rax
vmovdqa ymmword [rbp + 0x160], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x400]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
vmovdqa ymmword [rbp + 0x180], ymm1
mov dword [rsp + 0x20], r15d
vzeroupper
call r12
test eax, eax
jne 0x14000233c
mov dword [rbp + 0x288], 1
lea r9d, [r15 + 4]
movabs rcx, 0xbfeb35184a5b8208
mov dword [rsp + 0x28], 4
movabs rax, 0xf1fbf3505141185d
lea r8, [rbp + 0xa0]
mov qword [rbp], rax
xor edx, edx
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x3dd36b93cf0a53e4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x39d7a4d53aed751e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x39d7a4d53aa97553
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov rcx, qword [rbp + 0x280]
mov qword [rbp + 0x3b8], rax
lea rax, [rbp + 0x288]
vmovdqu ymm0, ymmword [rbp + 0x3a0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqu ymmword [rbp + 0xa0], ymm1
mov qword [rsp + 0x20], rax
vzeroupper
call rsi
mov rcx, qword [rbp + 0x280]
test eax, eax
je 0x140002371
call rbx
mov eax, 1
mov rcx, qword [rbp + 0x920]
xor rcx, rsp
call fcn.1400023a0
lea r11, [rsp + 0x9a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call rbx
lea rcx, [rbp + 0x500]
call r14
xor eax, eax
jmp 0x140002341