Function at 0x14001e880
Capabilities:
Create process on windows
Encode data using base64
Encrypt data using speck
Get common file path
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x678
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x5e0], xmm6
mov qword [rbp + 0x5d8], 0xfffffffffffffffe
mov qword [rbp + 0x440], r8
mov qword [rbp + 0x4e8], rcx
movzx eax, byte [rdx + 0xa0]
mov qword [rbp + 0x560], rdx
mov rbx, qword [rdx + 0x98]
test al, al
jne 0x14001e8ed
test rbx, rbx
jne 0x14001e8ed
mov qword [rbp + 0x400], 0
xor r12d, r12d
jmp 0x14001f4d7
mov qword [rbp + 0x4d0], 0
mov qword [rbp + 0x4e0], 0
test al, al
jne 0x14001eb21
mov qword [rbp + 0x590], rbx
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x140021f8e
lea rbx, [rbp - 0x10]
lea rsi, [rbp + 0x450]
lea r14, [rbp + 0x568]
mov qword [rbp + 0x5a8], rax
mov rdi, rax
nop dword [rax]
cmp word [rdi], 0
je 0x14001eb0d
mov r12, rdi
mov rcx, 0xfffffffffffffffe
xor edx, edx
nop word cs:[rax + rax]
mov r15, rdx
mov rax, rcx
inc rdx
add rcx, 2
cmp word [r12 + r15*2], 0
jne 0x14001e960
lea rdi, [r12 + rdx*2]
cmp r15, 1
je 0x14001e940
test r15, r15
je 0x140021ec5
xor r13d, r13d
nop dword [rax + rax]
cmp word [r12 + r13*2 + 2], 0x3d
je 0x14001e9b0
inc r13
add rax, 0xfffffffffffffffe
jne 0x14001e990
jmp 0x14001e940
lea r8, [r13 + 1]
cmp r13, r15
jae 0x140021edd
mov rcx, rsi
mov rdx, r12
call fcn.140017b10
add r13, 2
mov r8, r15
sub r8, r13
jb 0x140021ef7
lea rdx, [r12 + r13*2]
lea rcx, [rbp - 0x30]
call fcn.140017b10
mov r9, qword [rbp + 0x450]
mov r8, qword [rbp + 0x458]
movdqu xmm6, xmmword [rbp + 0x460]
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
movups xmm0, xmmword [rbx - 0x10]
movaps xmmword [rbp + 0x4b0], xmm0
movabs rax, 0x8000000000000000
cmp r9, rax
je 0x14001eb0d
mov qword [rbp + 0x5c0], r9
mov qword [rbp + 0x5b0], rdx
mov qword [rbp + 0x598], rcx
movq rax, xmm6
add rax, r8
mov qword [rbp + 0x450], r8
mov qword [rbp + 0x458], rax
mov word [rbp + 0x460], 0
mov r15, r14
mov rcx, r14
mov rdx, rsi
mov qword [rbp + 0x5c8], r8
call fcn.1400234d0
mov rax, qword [rbp + 0x5c0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x5c8]
mov qword [rbp - 0x28], rax
movdqu xmmword [rbp - 0x20], xmm6
mov rax, qword [rbp + 0x578]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rbp + 0x568]
movups xmmword [rbx], xmm0
mov rax, qword [rbp + 0x5b0]
mov qword [rbp + 0x450], rax
mov rax, qword [rbp + 0x598]
mov qword [rbp + 0x458], rax
movaps xmm0, xmmword [rbp + 0x4b0]
lea rax, [rbp + 0x460]
movups xmmword [rax], xmm0
mov byte [rbp + 0x58f], 0
mov rcx, r15
lea rdx, [rbp + 0x4d0]
lea r8, [rbp - 0x30]
mov r9, rsi
call fcn.140023700
mov rax, qword [rbp + 0x568]
shl rax, 1
test rax, rax
je 0x14001e940
mov rcx, qword [rbp + 0x570]
mov edx, 1
call fcn.1400050b0
jmp 0x14001e940
mov rcx, qword [rbp + 0x5a8]
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rbp + 0x590]
mov rcx, qword [rbp + 0x560]
mov rax, qword [rcx + 0x88]
mov rcx, qword [rcx + 0x90]
mov qword [rbp + 0x5b0], rcx
xor edi, edi
test rax, rax
setne dil
cmove rbx, rax
xor esi, esi
jmp 0x14001eb52
xor eax, eax
test rbx, rbx
je 0x14001f321
test rdi, rdi
je 0x14001ebb0
test rsi, rsi
jne 0x14001ebb0
mov edi, 1
mov r8, qword [rbp + 0x5b0]
test r8, r8
je 0x14001ebc1
mov rdx, r8
and rdx, 7
je 0x14001ebc6
mov rcx, r8
and rcx, 0xfffffffffffffff8
mov rsi, rax
nop dword [rax]
mov rsi, qword [rsi + 0x3d8]
dec rdx
jne 0x14001eb90
cmp r8, 8
jae 0x14001ebe0
jmp 0x14001ec1e
test rdi, rdi
mov rdx, qword [rbp + 0x5b0]
jne 0x14001ec22
jmp 0x140021e52
mov rsi, rax
jmp 0x14001ec1e
mov rsi, rax
mov rcx, r8
cmp r8, 8
jb 0x14001ec1e
nop word cs:[rax + rax]
mov rax, qword [rsi + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rsi, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14001ebe0
xor edx, edx
xor eax, eax
movzx ecx, word [rsi + 0x3d2]
mov r15, rsi
mov r12, rdx
cmp rdx, rcx
jb 0x14001ec68
nop word cs:[rax + rax]
mov rcx, qword [r15 + 0x160]
test rcx, rcx
je 0x140021a55
inc rax
movzx r12d, word [r15 + 0x3d0]
mov r15, rcx
cmp r12w, word [rcx + 0x3d2]
jae 0x14001ec40
test rax, rax
je 0x14001ed00
mov rsi, qword [r15 + r12*8 + 0x3e0]
mov rcx, rax
dec rcx
je 0x14001ecee
mov rdx, rcx
and rdx, 7
je 0x14001eca5
mov rcx, rdx
nop dword [rax]
mov rsi, qword [rsi + 0x3d8]
dec rcx
jne 0x14001ec90
not rdx
add rdx, rax
mov rcx, rdx
add rax, 0xfffffffffffffffe
cmp rax, 7
jb 0x14001ecee
nop
mov rax, qword [rsi + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rsi, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14001ecb0
xor r13d, r13d
jmp 0x14001ed08
lea r13, [r12 + 1]
mov rsi, r15
dec rbx
imul rax, r12, 0x38
lea r14, [r15 + rax]
add r14, 0x168
shl r12, 5
movabs rax, 0x8000000000000000
cmp qword [r15 + r12], rax
mov qword [rbp + 0x5b0], r13
jne 0x14001ed90
mov r13, qword [rbp + 0x4d0]
mov eax, 0
test r13, r13
je 0x14001eb52
mov r15, rdi
mov r9, qword [r14 + 0x28]
mov rax, qword [r14 + 0x30]
mov rdi, qword [rbp + 0x4d8]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x568]
mov rdx, r13
mov r8, rdi
call fcn.140024da0
cmp qword [rbp + 0x568], 0
je 0x14001ef46
xor eax, eax
mov rdi, r15
jmp 0x14001eb52
mov qword [rbp + 0x590], rdi
mov rdi, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
test r8, r8
mov qword [rbp + 0x5c0], r8
je 0x14001edd3
js 0x140021ebb
movzx eax, byte [0x14003e290]
xor ecx, ecx
mov rdx, r8
call fcn.140029ed0
mov r8, qword [rbp + 0x5c0]
test rax, rax
jne 0x14001edd8
jmp 0x140021ea9
mov eax, 1
mov qword [rbp + 0x5c8], rax
mov rcx, rax
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [r14 + 0x18]
mov byte [rbp + 0x598], al
mov rdi, qword [r14 + 0x28]
mov r14, qword [r14 + 0x30]
test r14, r14
je 0x14001ee2e
mov rax, r14
shr rax, 0x3e
jne 0x140021e75
lea r13, [r14 + r14]
movzx eax, byte [0x14003e290]
xor ecx, ecx
mov rdx, r13
call fcn.140029ed0
test rax, rax
jne 0x14001ee36
jmp 0x140021e63
mov eax, 2
xor r13d, r13d
mov qword [rbp + 0x5a8], rax
add r15, r12
mov rcx, rax
mov rdx, rdi
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0x5c0]
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp + 0x5c8]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
movzx eax, byte [rbp + 0x598]
mov byte [rbp - 0x18], al
mov qword [rbp - 0x10], r14
mov rax, qword [rbp + 0x5a8]
mov qword [rbp - 8], rax
mov qword [rbp], r14
mov r13, qword [r15 + 8]
mov rdi, qword [r15 + 0x10]
test rdi, rdi
mov qword [rbp + 0x558], r14
je 0x14001eebd
js 0x140021e98
movzx eax, byte [0x14003e290]
xor ecx, ecx
mov rdx, rdi
call fcn.140029ed0
mov r12, rax
test rax, rax
jne 0x14001eec3
jmp 0x140021e7f
mov r12d, 1
mov rcx, r12
mov rdx, r13
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [r15 + 0x18]
mov qword [rbp + 0x450], rdi
mov qword [rbp + 0x458], r12
mov qword [rbp + 0x460], rdi
mov byte [rbp + 0x468], al
mov byte [rbp + 0x5a7], 0
lea rcx, [rbp + 0x568]
lea rdx, [rbp + 0x4d0]
lea r8, [rbp - 0x30]
lea r9, [rbp + 0x450]
call fcn.140023700
mov rax, qword [rbp + 0x568]
shl rax, 1
test rax, rax
mov rdi, qword [rbp + 0x590]
je 0x14001eb50
mov rcx, qword [rbp + 0x570]
mov edx, 1
call fcn.1400050b0
jmp 0x14001eb50
mov rax, qword [rbp + 0x570]
mov rdx, qword [rbp + 0x578]
mov rcx, qword [rbp + 0x580]
mov byte [rbp + 0x3f0], 0
test rdx, rdx
je 0x14001f0d3
mov rax, qword [rax + rcx*8 + 0x3d8]
mov rcx, rdx
dec rcx
je 0x14001f03e
mov r8, rcx
and r8, 7
je 0x14001efae
mov rcx, r8
nop dword [rax + rax]
movzx r9d, word [rax + 0x3d2]
mov rax, qword [rax + r9*8 + 0x3d8]
dec rcx
jne 0x14001ef90
not r8
add r8, rdx
mov rcx, r8
add rdx, 0xfffffffffffffffe
cmp rdx, 7
jb 0x14001f03e
nop dword [rax]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14001efc0
movzx ecx, word [rax + 0x3d2]
dec rcx
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x4b8], 0
mov qword [rbp + 0x4c0], rcx
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x4b0]
lea r8, [rbp + 0x3f0]
call fcn.140024f40
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x4a0], rax
movups xmm0, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0x490], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movups xmm2, xmmword [rbp - 0x10]
movups xmm3, xmmword [rbp]
movaps xmmword [rbp + 0x480], xmm3
movaps xmmword [rbp + 0x470], xmm2
movaps xmmword [rbp + 0x460], xmm1
movaps xmmword [rbp + 0x450], xmm0
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x38]
movzx ecx, word [rdx + 0x3d2]
cmp rax, rcx
jae 0x14001f108
mov rcx, rdx
jmp 0x14001f139
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x458], 0
mov qword [rbp + 0x460], rcx
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x450]
lea r8, [rbp + 0x3f0]
call fcn.140024f40
jmp 0x14001f229
mov r8, qword [rbp + 0x30]
nop dword [rax]
mov rcx, qword [rdx + 0x160]
test rcx, rcx
je 0x14001f134
inc r8
movzx eax, word [rdx + 0x3d0]
mov rdx, rcx
cmp ax, word [rcx + 0x3d2]
jae 0x14001f110
jmp 0x14001f139
mov rax, r8
xor ecx, ecx
imul rdx, rax, 0x38
shl rax, 5
mov r8, qword [rcx + rdx + 0x198]
mov qword [rbp + 0x520], r8
movups xmm0, xmmword [rcx + rdx + 0x168]
movups xmm1, xmmword [rcx + rdx + 0x178]
movups xmm2, xmmword [rcx + rdx + 0x188]
movaps xmmword [rbp + 0x510], xmm2
movaps xmmword [rbp + 0x500], xmm1
movaps xmmword [rbp + 0x4f0], xmm0
mov r8, qword [rbp + 0x480]
mov qword [rcx + rdx + 0x198], r8
movaps xmm0, xmmword [rbp + 0x450]
movaps xmm1, xmmword [rbp + 0x460]
movaps xmm2, xmmword [rbp + 0x470]
movups xmmword [rcx + rdx + 0x188], xmm2
movups xmmword [rcx + rdx + 0x178], xmm1
movups xmmword [rcx + rdx + 0x168], xmm0
movups xmm0, xmmword [rcx + rax]
movups xmm1, xmmword [rcx + rax + 0x10]
lea rdx, [rbp + 0x528]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rdx, [rbp + 0x488]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + rax], xmm0
movups xmmword [rcx + rax + 0x10], xmm1
mov rax, qword [rbp + 0x540]
mov qword [rbp + 0x20], rax
movaps xmm0, xmmword [rbp + 0x530]
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [rbp + 0x4f0]
movaps xmm1, xmmword [rbp + 0x500]
movaps xmm2, xmmword [rbp + 0x510]
movaps xmm3, xmmword [rbp + 0x520]
movaps xmmword [rbp], xmm3
movaps xmmword [rbp - 0x10], xmm2
movaps xmmword [rbp - 0x20], xmm1
movaps xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x5c0], rax
mov rax, qword [rbp - 8]
mov qword [rbp + 0x5c8], rax
dec qword [rbp + 0x4e0]
mov r12, qword [rbp + 8]
mov r14, qword [rbp + 0x10]
cmp byte [rbp + 0x3f0], 0
je 0x14001f2b4
mov qword [rbp + 0x598], rdx
mov qword [rbp + 0x5a8], r8
test rdi, rdi
je 0x140021f0e
mov rax, qword [r13 + 0x3d8]
mov qword [rbp + 0x4d0], rax
dec rdi
mov qword [rbp + 0x4d8], rdi
mov qword [rax + 0x160], 0
mov edx, 8
mov rcx, r13
call fcn.1400050b0
mov r8, qword [rbp + 0x5a8]
mov rdx, qword [rbp + 0x598]
mov eax, 0
movabs rcx, 0x8000000000000000
cmp rdx, rcx
mov rdi, r15
je 0x14001eb52
test rdx, rdx
je 0x14001f2e1
mov edx, 1
mov rcx, r8
call fcn.1400050b0
cmp qword [rbp + 0x5c0], 0
je 0x14001f2fc
mov edx, 2
mov rcx, qword [rbp + 0x5c8]
call fcn.1400050b0
shl r12, 1
mov eax, 0
test r12, r12
je 0x14001eb52
mov edx, 1
mov rcx, r14
call fcn.1400050b0
xor eax, eax
jmp 0x14001eb52
mov rax, qword [rbp + 0x4e0]
mov qword [rbp + 0x418], rax
movups xmm0, xmmword [rbp + 0x4d0]
movups xmmword [rbp + 0x408], xmm0
mov qword [rbp + 0x400], 1
movzx eax, byte [0x14003e290]
mov edx, 4
xor ecx, ecx
call fcn.140029ed0
test rax, rax
je 0x140021f39
mov dword [rax], 0x48544150
mov rcx, rax
add rcx, 4
mov qword [rbp + 0x4f0], rax
mov qword [rbp + 0x4f8], rcx
mov word [rbp + 0x500], 0
lea rcx, [rbp + 0x450]
lea rdx, [rbp + 0x4f0]
mov qword [rbp + 0x5c0], rax
call fcn.1400234d0
mov qword [rbp - 0x30], 4
mov rcx, qword [rbp + 0x5c0]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], 4
mov byte [rbp - 0x18], 0
movups xmm0, xmmword [rbp + 0x450]
movups xmmword [rbp - 0x10], xmm0
mov r14, qword [rbp + 0x460]
mov qword [rbp], r14
mov rsi, qword [rbp - 8]
mov rbx, qword [rbp + 0x408]
test rbx, rbx
je 0x14001f4aa
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x5b0], rax
mov r13, qword [sym.imp.kernel32.dll_CompareStringOrdinal]
lea rcx, [rbx + 0x168]
movzx eax, word [rbx + 0x3d2]
mov qword [rbp + 0x5c8], rax
imul rdi, rax, 0x38
mov r15, 0xffffffffffffffff
test rdi, rdi
je 0x14001f460
lea r12, [rcx + 0x38]
mov r8, qword [rcx + 0x28]
mov r9d, dword [rcx + 0x30]
mov dword [rsp + 0x20], 1
mov rcx, rsi
mov edx, r14d
call r13
inc r15
add rdi, 0xffffffffffffffc8
mov rcx, r12
cmp eax, 3
je 0x14001f420
cmp eax, 1
jne 0x14001f48c
jmp 0x14001f467
mov r15, qword [rbp + 0x5c8]
mov rax, qword [rbp + 0x5b0]
sub rax, 1
jb 0x14001f986
mov qword [rbp + 0x5b0], rax
mov rbx, qword [rbx + r15*8 + 0x3d8]
jmp 0x14001f400
cmp eax, 2
jne 0x140021dcc
test rbx, rbx
je 0x14001f4af
shl r15, 5
mov r12, qword [rbx + r15 + 8]
mov rdi, qword [rbx + r15 + 0x10]
jmp 0x14001f4b2
xor r12d, r12d
jmp 0x14001f4b9
xor r12d, r12d
mov rcx, qword [rbp + 0x5c0]
mov edx, 1
call fcn.1400050b0
cmp qword [rbp - 0x10], 0
je 0x14001f4d7
mov edx, 2
mov rcx, rsi
call fcn.1400050b0
mov rax, qword [rbp + 0x560]
mov r8, qword [rax + 0x10]
lea rbx, str.program_path_has_no_file_name
test r8, r8
je 0x14001f820
mov rdx, qword [rax + 8]
cmp r8, 4
jae 0x14001f505
lea rax, [0x140025440]
jmp 0x14001f52d
mov eax, dword [rdx]
bswap eax
xor ecx, ecx
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
adc ecx, 0xffffffff
lea rcx, [0x140025430]
lea rax, [0x140025440]
cmove rax, rcx
mov qword [rbp + 0x5b0], rdx
mov qword [rbp + 0x5c0], r8
movzx esi, byte [r8 + rdx - 1]
mov byte [rbp + 0x5d7], 1
mov ecx, esi
call rax
test al, al
jne 0x14001f820
mov r14, qword [rbp + 0x5c0]
cmp r14, 3
jbe 0x14001f5c8
mov rbx, qword [rbp + 0x5b0]
movzx eax, byte [r14 + rbx - 4]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x2e
jne 0x14001f5d3
movzx eax, byte [rbx + r14 - 3]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x65
jne 0x14001f5d3
movzx eax, byte [rbx + r14 - 2]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x78
jne 0x14001f5d3
lea eax, [rsi - 0x41]
cmp al, 0x1a
setb al
shl al, 5
or al, sil
cmp al, 0x65
sete al
jmp 0x14001f5d5
xor eax, eax
mov rbx, qword [rbp + 0x5b0]
jmp 0x14001f5d5
xor eax, eax
lea rsi, [rbx + r14]
xor ecx, ecx
nop dword [rax + rax]
cmp r14, rcx
je 0x14001f649
movzx edx, byte [rbx + rcx]
cmp edx, 0x2f
je 0x14001f5f6
inc rcx
cmp edx, 0x5c
jne 0x14001f5e0
test al, al
mov qword [rbp + 0x598], rsi
je 0x14001f723
mov byte [rbp + 0x5d7], 1
lea rcx, [rbp - 0x30]
mov rdx, rbx
mov r8, r14
call fcn.140015bc0
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
movabs rdx, 0x8000000000000000
cmp rcx, rdx
jne 0x14001f8ca
mov qword [rbp + 0x4d8], rax
mov qword [rbp + 0x4d0], rdx
jmp 0x140020091
xor r8d, r8d
lea r11, str.nul_byte_found_in_provided_data
mov rax, rbx
jmp 0x14001f66c
xor r8d, r8d
test cx, cx
je 0x14001f81d
mov cx, 1
test r8w, r8w
jne 0x14001f660
cmp rax, rsi
je 0x14001f917
movzx r9d, byte [rax]
movzx edx, r9b
test dl, dl
js 0x14001f690
inc rax
jmp 0x14001f6f2
mov r8d, edx
and r8d, 0x1f
movzx r10d, byte [rax + 1]
and r10d, 0x3f
cmp dl, 0xdf
jbe 0x14001f6e4
movzx edx, byte [rax + 2]
shl r10d, 6
and edx, 0x3f
or edx, r10d
cmp r9b, 0xf0
jb 0x14001f6fc
movzx r9d, byte [rax + 3]
add rax, 4
and r8d, 7
shl r8d, 0x12
shl edx, 6
and r9d, 0x3f
or r9d, edx
or r9d, r8d
mov edx, r9d
cmp edx, 0xffff
jbe 0x14001f6f2
jmp 0x14001f70f
add rax, 2
shl r8d, 6
or r8d, r10d
mov edx, r8d
xor r8d, r8d
mov ecx, edx
jmp 0x14001f663
add rax, 3
shl r8d, 0xc
or edx, r8d
cmp edx, 0xffff
jbe 0x14001f6f2
and edx, 0x3ff
or edx, 0xdc00
mov r8d, edx
jmp 0x14001f663
test r14, r14
js 0x14002201f
movzx eax, byte [0x14003e290]
xor ecx, ecx
mov rdx, r14
call fcn.140029ed0
test rax, rax
je 0x140022030
mov rdi, rax
mov rcx, rax
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x18], 0
lea rdx, str..exeprogram_not_found
lea rcx, [rbp - 0x30]
mov r8d, 4
mov qword [rbp + 0x5c8], rdi
call fcn.14001b650
mov r14, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov qword [rbp + 0x3e8], rbx
mov qword [rbp + 0x3e0], r14
mov byte [rbp + 0x58e], 1
lea rcx, [rbp + 0x4f0]
mov rdx, rbx
mov r8, rsi
call fcn.140025520
movabs rdi, 0x8000000000000000
cmp qword [rbp + 0x4f0], rdi
jne 0x14001f8f6
mov qword [rbp + 0x5c8], r14
mov qword [rbp + 0x5c0], rbx
mov rcx, rbx
mov rdx, rsi
call fcn.14001e070
test rax, rax
je 0x14001f97a
cmp rdx, 2
jne 0x14001f940
movzx ecx, word [rax]
cmp ecx, 0x2e2e
jne 0x14001f940
mov ecx, 2
xor r8d, r8d
mov r10, qword [rbp + 0x5c0]
jmp 0x140020005
mov rbx, r11
mov rdx, qword [rbp - 0x20]
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rdx
mov byte [rbp + 0x5d7], 1
lea rcx, [rbp + 0x4d0]
lea rdx, [rbp - 0x30]
call fcn.140025450
jmp 0x140020091
mov rax, qword [rbp + 0x500]
mov qword [rbp + 0x4e0], rax
movups xmm0, xmmword [rbp + 0x4f0]
movaps xmmword [rbp + 0x4d0], xmm0
jmp 0x14002007f
cmp r14, 0xf
mov qword [rbp + 0x598], rsi
ja 0x14001f98e
xor eax, eax
mov qword [rbp + 0x5a8], rax
xor eax, eax
nop
cmp byte [rbx + rax], 0x2e
je 0x14001f9a7
inc rax
cmp r14, rax
jne 0x14001f930
jmp 0x14001f9b3
mov rcx, rdx
mov r10, qword [rbp + 0x5c0]
nop word [rax + rax]
test rcx, rcx
je 0x14001f99d
mov r9, rcx
dec rcx
cmp byte [rax + r9 - 1], 0x2e
jne 0x14001f950
test rcx, rcx
je 0x14001ffff
sub rdx, r9
mov r8, rax
add r8, r9
jmp 0x140020005
mov r10, qword [rbp + 0x5c0]
jmp 0x140020025
xor r12d, r12d
jmp 0x14001f4b2
mov cl, 0x2e
mov rdx, rbx
mov r8, r14
call fcn.140008a30
jmp 0x14001f9ac
mov r8, rax
xor eax, eax
jmp 0x140020005
mov eax, 1
mov qword [rbp + 0x5a8], rax
test r12, r12
je 0x14001fa07
add rdi, r12
mov qword [rbp + 0x4f0], r12
mov qword [rbp + 0x4f8], rdi
mov word [rbp + 0x500], 0
mov byte [rbp + 0x508], 1
mov byte [rbp + 0x5d7], 1
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x4f0]
call fcn.14001b360
mov rax, qword [rbp - 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
jne 0x14001fe63
mov qword [rbp + 0x568], 0
mov qword [rbp + 0x570], 2
mov qword [rbp + 0x578], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x5c8], rax
xor esi, esi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jb 0x14001fa5f
jmp 0x14001fa70
jae 0x14001fb2d
cmp r8, 0x201
jae 0x14001fa70
mov r14d, 0x200
lea r13, [rbp - 0x30]
mov r15, r8
jmp 0x14001fac8
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14001fa9f
lea rcx, [rbp + 0x568]
mov rdx, r12
call fcn.14002ee00
mov rsi, qword [rbp + 0x568]
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x5c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov r12d, 0xffffffff
cmovb r12, rsi
mov qword [rbp + 0x578], r12
mov rbx, rsi
mov r14, r12
mov r13, qword [rbp + 0x5c8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
xor ecx, ecx
mov rdx, r13
mov r8d, r15d
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov edi, eax
test eax, eax
jne 0x14001faee
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14001fb63
mov r8d, edi
cmp r15, r8
jne 0x14001fa50
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140021f54
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jae 0x14001fa70
jmp 0x14001fa5f
cmp r14, r8
jb 0x140022063
lea rcx, [rbp + 0x4f0]
mov rdx, r13
call fcn.140017b10
movups xmm0, xmmword [rbp + 0x4f0]
movups xmm1, xmmword [rbp + 0x500]
movaps xmmword [rbp + 0x460], xmm1
movaps xmmword [rbp + 0x450], xmm0
jmp 0x14001fb89
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x458], rax
movabs rax, 0x8000000000000000
mov qword [rbp + 0x450], rax
test rsi, rsi
je 0x14001fb9f
mov edx, 2
mov rcx, qword [rbp + 0x5c8]
call fcn.1400050b0
mov rax, qword [rbp + 0x450]
movabs r14, 0x8000000000000000
cmp rax, r14
jne 0x14001fbcd
lea rcx, [rbp + 0x458]
mov byte [rbp + 0x5d7], 1
call fcn.140013cb0
jmp 0x14001fc9a
mov qword [rbp + 0x590], rax
mov rcx, qword [rbp + 0x458]
mov rsi, qword [rbp + 0x460]
mov rdi, qword [rbp + 0x468]
mov byte [rbp + 0x58d], 0
mov qword [rbp + 0x5c8], rcx
mov rdx, rsi
call fcn.14001d120
mov rbx, qword [rbp + 0x5b0]
mov r8, qword [rbp + 0x5c0]
cmp rsi, rdx
cmovb rdx, rsi
test rax, rax
cmove rdx, rsi
mov rax, qword [rbp + 0x590]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x5c8]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], rdi
lea rcx, [rbp - 0x30]
mov rdx, rbx
call fcn.14001c250
cmp qword [rbp + 0x5a8], 1
je 0x14001fc5f
lea rdx, str.exe.NULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
lea rcx, [rbp - 0x30]
call fcn.14001e1a0
mov rsi, qword [rbp - 0x28]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp + 0x4f0]
mov rdx, rsi
call fcn.140025520
cmp qword [rbp - 0x30], 0
je 0x14001fc8a
mov edx, 1
mov rcx, rsi
call fcn.1400050b0
mov rax, qword [rbp + 0x4f0]
cmp rax, r14
jne 0x14001ffe5
mov qword [rbp + 0x568], 0
mov qword [rbp + 0x570], 2
mov qword [rbp + 0x578], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x5c8], rax
xor ebx, ebx
xor esi, esi
xor r15d, r15d
cmp r8, 0x201
jb 0x14001fcef
jmp 0x14001fd00
lea rsi, [rbp - 0x30]
lea rdi, [rbp + 0x4f0]
lea r15, [rbp + 0x450]
lea r12, str.exe.NULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
jmp 0x14001fe9d
mov byte [rbp + 0x5d7], 1
mov rcx, rsi
mov rdx, rdi
call fcn.14001b360
mov rax, qword [rbp - 0x30]
cmp rax, rbx
je 0x14001fa07
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14001ff3b
mov r8, qword [rbp - 0x18]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
mov rcx, rsi
mov rdx, qword [rbp + 0x5b0]
mov r8, qword [rbp + 0x5c0]
call fcn.14001c250
cmp qword [rbp + 0x5a8], 1
je 0x14001feed
mov rcx, rsi
mov rdx, r12
call fcn.14001e1a0
mov r14, qword [rbp - 0x28]
mov r8, qword [rbp - 0x20]
mov rcx, r15
mov rdx, r14
call fcn.140025520
cmp qword [rbp - 0x30], 0
je 0x14001ff14
mov edx, 1
mov rcx, r14
call fcn.1400050b0
mov rax, qword [rbp + 0x450]
cmp rax, rbx
jne 0x140020bdd
mov byte [rbp + 0x5d7], 1
mov rcx, rsi
mov rdx, rdi
call fcn.14001b360
jmp 0x14001fe90
test rax, rax
je 0x14001fe7e
mov edx, 1
call fcn.1400050b0
jmp 0x14001fe7e
mov qword [rbp + 0x5c0], rax
mov rsi, qword [rbp + 0x4f8]
add al, 0
add byte [rax - 0x75], cl
mov ebp, 0x500
add byte [rax], al
xor r8d, r8d
mov rcx, rdx
mov qword [rbp + 0x5c0], rax
mov rsi, qword [rbp + 0x458]
mov rdi, qword [rbp + 0x460]
jmp 0x1400200c0
lea rcx, str._rustc_7cf61ebde7b22796c69757901dd346d0fe70bd97library_alloc_srccollections_btree_navigate.rs
call fcn.14002e530
jmp 0x1400220e1
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x568], rax
lea rax, [rbp + 0x568]
mov qword [rbp + 0x450], rax
lea rax, [0x14001aa40]
mov qword [rbp + 0x458], rax
lea rax, str.comparing_environment_keys_failed:
mov qword [rbp + 0x4f0], rax
mov qword [rbp + 0x4f8], 1
mov qword [rbp + 0x510], 0
lea rax, [rbp + 0x450]
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x508], 1
lea rdx, str.library_std_src_syspalwindowsprocess.rs
lea rcx, [rbp + 0x4f0]
call fcn.14002dff0
jmp 0x1400220e1
lea rcx, str._rustc_7cf61ebde7b22796c69757901dd346d0fe70bd97library_alloc_srccollections_btree_navigate.rs
call fcn.14002e530
jmp 0x1400220e1
mov ecx, 2
mov rdx, r13
call fcn.14002df20
jmp 0x1400220e1
call fcn.140005100
jmp 0x1400220e1
mov byte [rbp + 0x5a7], 1
mov ecx, 1
mov rdx, rdi
call fcn.14002df20
jmp 0x1400220e1
mov byte [rbp + 0x5a7], 1
call fcn.140005100
jmp 0x1400220e1
mov ecx, 1
mov rdx, r8
call fcn.14002df20
jmp 0x1400220e1
call fcn.140005100
jmp 0x1400220e1
lea r8, str.library_std_src_syspalwindowsos.rs
mov ecx, 1
xor edx, edx
call fcn.14002e030
jmp 0x1400220e1
lea rax, str.library_std_src_syspalwindowsos.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14002e130
jmp 0x1400220e1
lea r8, str.library_std_src_syspalwindowsos.rs
mov rcx, r13
mov rdx, r15
call fcn.14002e030
jmp 0x1400220e1
mov qword [rbp + 0x5b0], r12
mov qword [rbp + 0x590], r14
lea rcx, str.assertion_failed:_self.height___0
lea r8, [0x140033768]
mov edx, 0x21
call fcn.14002e1b0
jmp 0x1400220e1
mov byte [rbp + 0x5d7], 1
mov ecx, 1
mov edx, 4
call fcn.14002df20
jmp 0x1400220e1
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.14002e1b0
jmp 0x1400220e1
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x568], rax
lea rax, [rbp + 0x568]
mov qword [rbp + 0x450], rax
lea rax, [0x14001aa40]
mov qword [rbp + 0x458], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x450]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x30]
call fcn.14002dff0
jmp 0x1400220e1
mov byte [rbp + 0x5d7], 1
call fcn.140005100
jmp 0x1400220e1
mov byte [rbp + 0x5d7], 1
mov ecx, 1
mov rdx, r14
call fcn.14002df20
jmp 0x1400220e1
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14002e130
jmp 0x1400220e1