Function at 0x180066be0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x18018c280]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r12, r9
mov rbx, rdx
mov qword [rsp + 0x120], rdx
mov rdi, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x328]
xor r13d, r13d
cmp qword [rdi + 0x28], r13
jne 0x180066c61
cmp dword [rdi + 0x60], 5
jne 0x180066c61
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
mov r8d, Ordinal_26
lea rdx, str.____ftable_url_is_empty.
mov rcx, rbx
call fcn.1800053f0
jmp 0x1800672ec
mov rax, qword [rdi + 8]
cmp qword [rdi], rax
jne 0x180066c98
cmp dword [rdi + 0x60], 6
jne 0x180066c98
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
mov r8d, Ordinal_34
lea rdx, str.____ftable_binary_data_is_empty
mov rcx, rbx
call fcn.1800053f0
jmp 0x1800672ec
lea rdx, [rdi + 0x38]
lea rcx, [rsp + 0x88]
call fcn.180005740
mov r14, rax
lea rcx, [rsp + 0x68]
call fcn.1800054f0
mov rdx, rax
lea rax, [0x180171618]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 8
lea rcx, [0x1801937e0]
cmp qword [0x1801937f8], 7
cmova rcx, qword [0x1801937e0]
mov qword [rsp + 0xf0], rcx
mov rax, qword [0x1801937f0]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x158], xmm0
movabs r15, 0xc000000000000000
mov qword [rsp + 0x140], r15
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x180066d2b
mov rcx, qword [rdx]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x168], xmm0
movabs rax, 0xc000000000000010
mov qword [rsp + 0x148], rax
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x180066d6e
mov rcx, qword [r14]
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0x178], xmm0
movabs rax, 0xc000000000000020
mov qword [rsp + 0x150], rax
mov qword [rsp + 0xf0], 3
lea rax, [rsp + 0x140]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xf0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.18000d210
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x180066e3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180066e37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067bc9
call fcn.1800918d0
movdqa xmm0, xmmword [0x180171c00]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r13w
mov rdx, qword [rsp + 0xa0]
cmp rdx, 7
jbe 0x180066ea0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180066e93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067bcf
call fcn.1800918d0
movdqa xmm0, xmmword [0x180171c00]
movdqu xmmword [rsp + 0x98], xmm0
mov word [rsp + 0x88], r13w
mov eax, dword [rdi + 0x60]
cmp eax, 5
jne 0x18006726a
lea rdx, [rdi + 0x18]
lea r8, [rsp + 0x100]
lea rcx, [rsp + 0x140]
call fcn.18002a3e0
nop
cmp byte [rsp + 0x160], 0
jne 0x18006721e
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rdx, qword [rsp + 0x100]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], r13
mov r8, qword [rsp + 0x110]
lea rcx, [rsp + 0xd0]
call fcn.18000acf0
nop
mov r8d, 3
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xf0]
call fcn.180021d60
movsd xmm0, qword [rax]
movsd qword [rsp + 0x50], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0xf0], ecx
lea rax, [0x18018d290]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xf0], xmm0
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x180066fd4
cmp eax, 1
setne dil
mov rdx, qword [rsp + 0xe8]
cmp rdx, 7
jbe 0x180066fe6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180066fe1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067bd5
jmp 0x180066fe1
xor dil, dil
test ecx, ecx
jne 0x180067bdb
jmp 0x180066f8f
call fcn.1800918d0
test dil, dil
je 0x1800670b1
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rdx, qword [rsp + 0x100]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xe8], r13
mov r8, qword [rsp + 0x110]
lea rcx, [rsp + 0xd0]
call fcn.18000acf0
nop
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 7
cmova rcx, qword [rsp + 0xd0]
call fcn.18009059c
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x180067bf8
mov rdx, qword [rsp + 0xe8]
cmp rdx, 7
jbe 0x1800670b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800670ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c11
call fcn.1800918d0
nop
jmp 0x1800670c5
lea rax, str.____handle_downloads:_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], Ordinal_26
lea rax, [rsp + 0x140]
cmp qword [rsp + 0x158], 0xf
cmova rax, qword [rsp + 0x140]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xf0], 1
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xf0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180019800
nop
mov rdx, qword [rsp + 0x158]
cmp rdx, 0xf
jbe 0x1800671b5
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800671b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c1d
call fcn.1800918d0
movdqa xmm0, xmmword [0x180171c10]
movdqu xmmword [rsp + 0x150], xmm0
mov byte [rsp + 0x140], 0
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c17
jmp 0x1800672e7
mov rdx, qword [rsp + 0x158]
cmp rdx, 0xf
jbe 0x18006758a
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180067260
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c1d
call fcn.1800918d0
jmp 0x18006758a
cmp eax, 6
jne 0x18006758a
mov rax, qword [rdi + 8]
cmp qword [rdi], rax
jne 0x18006731c
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, Ordinal_26
lea rdx, str.____Binary_data_is_empty.
mov rcx, rbx
call fcn.1800053f0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c23
call fcn.1800918d0
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1800918b0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x1b0]
call fcn.1800c7af0
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x1b0]
call fcn.180026430
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1b0], r14
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ac], edx
cmp qword [rsp + 0x238], 0
jne 0x180067497
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, Ordinal_34
lea rdx, str.____Fstream_file_can_not_open.
mov rcx, rbx
call fcn.1800053f0
nop
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1b0], r14
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ac], edx
lea rcx, [rsp + 0x1b8]
call fcn.180025ad0
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x1ac], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x258]
call fcn.18008f420
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c23
jmp 0x1800672e7
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rdx
lea rcx, [rsp + 0x1b0]
call fcn.180025c70
lea rcx, [rsp + 0x1b8]
call fcn.180026330
test rax, rax
jne 0x180067502
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
mov eax, 6
mov edx, 2
cmp qword [rsp + rcx + 0x1f8], 0
cmovne eax, edx
or eax, dword [rsp + rcx + 0x1c0]
and eax, 0x17
mov dword [rsp + rcx + 0x1c0], eax
mov edx, dword [rsp + rcx + 0x1c4]
and edx, eax
jne 0x180067c29
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1b0], r14
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ac], edx
lea rcx, [rsp + 0x1b8]
call fcn.180025ad0
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x1ac], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x258], rax
lea rcx, [rsp + 0x258]
call fcn.18008f420
nop
mov eax, dword [rdi + 0x58]
cmp eax, 2
jne 0x180067606
mov r8d, Ordinal_26
lea rdx, str.___Download_completed.
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x10], r13
mov rcx, rbx
call fcn.1800053f0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067bc3
jmp 0x1800672e7
test eax, eax
jne 0x180067abc
mov eax, dword [rdi + 0x5c]
xorps xmm0, xmm0
cmp eax, 3
jne 0x18006788d
movups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], reloc.LIBPQ.dll_Ordinal_15
mov byte [rsp + 0x120], 0
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x100]
call fcn.180022760
test al, al
jne 0x1800677ba
lea rax, str.____Process_as_user_can_not_created:_
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], Ordinal_47
lea rax, [rsp + 0x120]
cmp qword [rsp + 0x138], 0xf
cmova rax, qword [rsp + 0x120]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0xf8], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xf0], 1
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xf8], rax
movaps xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0xf0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180019800
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x18006774e
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180067749
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c86
call fcn.1800918d0
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], reloc.LIBPQ.dll_Ordinal_15
mov byte [rsp + 0x120], 0
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c8c
jmp 0x1800672e7
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, Ordinal_45
lea rdx, str.___Process_created_as_user_successfully.
mov rcx, rbx
call fcn.1800053f0
nop
mov rdx, qword [rsp + 0x138]
cmp rdx, 0xf
jbe 0x180067821
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006781c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c86
call fcn.1800918d0
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x138], reloc.LIBPQ.dll_Ordinal_15
mov byte [rsp + 0x120], 0
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c8c
jmp 0x1800672e7
cmp eax, 4
jne 0x180067aaa
xor eax, eax
movups xmmword [rsp + 0x144], xmm0
movups xmmword [rsp + 0x154], xmm0
movups xmmword [rsp + 0x164], xmm0
movups xmmword [rsp + 0x174], xmm0
movups xmmword [rsp + 0x184], xmm0
movups xmmword [rsp + 0x194], xmm0
mov dword [rsp + 0x1a4], eax
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x140], Ordinal_106
lea rcx, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova rcx, qword [rsp + 0x100]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180067a1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Process_can_not_created_Error_code:_
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], Ordinal_47
mov dword [rsp + 0xf8], eax
movabs rax, 0x2000000000000000
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x120], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.180019800
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c92
jmp 0x1800672e7
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, Ordinal_45
lea rdx, str.___Process_created_default_successfully.
mov rcx, rbx
call fcn.1800053f0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180067c92
jmp 0x1800672e7
mov r8d, reloc.LIBPQ.dll_Ordinal_22
lea rdx, str.____Wrong_execute_code
jmp 0x1800675a2
cmp eax, 1
jne 0x180067b54
mov byte [r12], al
lea rax, [rsp + 0x100]
cmp rsi, rax
je 0x180067b42
mov rdi, qword [rsp + 0x110]
lea r9, [rsp + 0x100]
cmp qword [rsp + 0x118], 7
cmova r9, qword [rsp + 0x100]
mov rax, qword [rsi + 0x18]
cmp rdi, rax
ja 0x180067b37
mov r14, rsi
cmp rax, 7
jbe 0x180067b0d
mov r14, qword [rsi]
mov qword [rsi + 0x10], rdi
lea r8, [rdi + rdi]
mov rdx, r9
mov rcx, r14
call fcn.1800c7450
mov word [r14 + rdi*2], r13w
mov r8d, Ordinal_34
lea rdx, str.___Update_process_is_starting.
jmp 0x18006759f
mov rdx, rdi
mov rcx, rsi
call fcn.180026ce0
mov r8d, Ordinal_34
lea rdx, str.___Update_process_is_starting.
jmp 0x18006759f
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov r8d, reloc.LIBPQ.dll_Ordinal_22
lea rdx, str.____Wrong_command_code
mov rcx, rbx
call fcn.1800053f0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 7
jbe 0x1800672ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800672e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800672e7
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xf0]
lea rcx, [0x1801050d0]
call fcn.1800212d0
nop
shr rdx, 0x20
lea r8, [rsp + 0xd0]
lea rcx, str.remove
call fcn.18002bf00
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
nop
test dl, 4
je 0x180067c37
lea rbx, [0x180101b48]
jmp 0x180067c4c
test dl, 2
lea rbx, [0x180101b60]
lea rax, [0x180101b78]
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0xf0]
call fcn.180002ed0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xa8]
call fcn.1800038a0
lea rdx, [0x18018a2b0]
lea rcx, [rsp + 0xa8]
call fcn.180093f98
nop
call fcn.1800a6d18
nop
call fcn.1800a6d18
int3
call fcn.1800a6d18
int3