Function at 0x140002c20
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Get file attributes
Query environment variable
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x35c0]
mov eax, 0x36c0
call fcn.140010f50
sub rsp, rax
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rbp + 0x35b0], rax
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.140001c40
call fcn.140001d00
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
lea rdx, [rbp + 0x10]
mov rcx, rax
mov qword [rsp + 0x70], rdi
mov r12, rax
mov r15d, edi
call fcn.140001030
mov ebx, edi
mov r13d, edi
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rax
mov rsi, rax
nop
cmp dword [0x140025d00], 0
mov r14d, edi
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x68], edi
jne 0x140002de1
mov ebx, 1
cmp dword [rbp + 0x10], ebx
jle 0x140002ce5
lea rdi, [rsi + 8]
nop
mov rcx, qword [rdi]
call fcn.1400021c0
inc ebx
lea rdi, [rdi + 8]
cmp ebx, dword [rbp + 0x10]
jl 0x140002cd0
xor edi, edi
mov rsi, qword [0x140025d30]
test rsi, rsi
je 0x140002dd8
mov rbx, qword [0x140025d28]
test rbx, rbx
je 0x140002dd8
movzx edi, byte [0x1400199e4]
lea rcx, [rbp + 0x111]
xor edx, edx
mov byte [rbp + 0x110], dil
lea r8d, [rdx + 0x7f]
call fcn.140007e40
xor edx, edx
mov byte [rbp + 0x90], dil
lea rcx, [rbp + 0x91]
lea r8d, [rdx + 0x7f]
call fcn.140007e40
xor edi, edi
lea rax, [rbp + 0x110]
mov qword [rsp + 0x38], rdi
or r9d, 0xffffffff
mov qword [rsp + 0x30], rdi
mov r8, rsi
mov dword [rsp + 0x28], 0x80
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140002fff
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], rdi
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x80
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140002fff
lea r9, [rbp + 0x18]
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x110]
call fcn.140001540
test al, al
je 0x140002fff
mov ebx, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, 1
mov dword [rbp + 0x14], eax
cmp dword [rbp + 0x10], eax
jle 0x140002e43
lea rdi, [rsi + 8]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140002e29
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x64]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x54]
call fcn.1400022d0
test eax, eax
je 0x140002e37
mov eax, dword [rbp + 0x14]
inc eax
add rdi, 8
mov dword [rbp + 0x14], eax
cmp eax, dword [rbp + 0x10]
jl 0x140002df2
mov r14d, dword [rsp + 0x54]
xor edi, edi
mov r15, qword [rsp + 0x70]
test r14b, 0x20
je 0x140002e59
cmp dword [rsp + 0x60], 0
jne 0x140002e59
and r14d, 0xffffffdf
mov dword [rsp + 0x54], r14d
test r14b, 8
je 0x140002e87
test ebx, ebx
jne 0x140002e87
mov ebx, 1
mov rcx, rsi
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rbp + 0x10]
mov rcx, r12
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x140002c96
test r14b, 2
je 0x140002ecc
mov r9d, dword [0x140025d20]
lea r8, str.Hstart___Command_Line
or r9d, 0x40
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
test r15, r15
je 0x140002ecc
mov r9d, dword [0x140025d20]
lea r8, str.Hstart___Starting_Directory
or r9d, 0x40
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
test dword [0x140025d04], 0x20000000
je 0x1400036be
bt r14d, 0xf
jae 0x140002f05
call fcn.1400020a0
test eax, eax
jne 0x140003035
bt r14d, 0xa
jb 0x140003035
bts r14d, 9
mov dword [rsp + 0x54], r14d
bt r14d, 0x10
jae 0x140002f2e
call fcn.1400020a0
test eax, eax
jne 0x14000307d
bt r14d, 0xa
jb 0x14000307d
bts r14d, 9
mov dword [rsp + 0x54], r14d
bt r14d, 0xe
jae 0x14000314f
test r13d, r13d
jne 0x14000314f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
lea r8, str.HstartFileMappingObject
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x140003124
xor r9d, r9d
mov qword [rsp + 0x20], 0x1000
xor r8d, r8d
lea edx, [r13 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x1400030f0
xor edx, edx
lea r8, str.HstartFileMappingEvent
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rdi, rax
test rax, rax
je 0x140002fbd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x10]
mov rcx, rsi
call fcn.140001030
mov rcx, rsi
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x1400030c5
mov ebx, dword [rsp + 0x50]
mov r13d, 1
xor edi, edi
jmp 0x140002ca0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.The_provided_license_key_is_invalid_or_corrupted.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x140003fda
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
call fcn.140004d30
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
jns 0x1400036ab
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.Failed_to_register_the_Hstart_UAC_task.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x140003fda
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
call fcn.140004a60
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
test edi, edi
jns 0x1400036ab
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.Failed_to_unregister_the_Hstart_UAC_task.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x140003fda
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.Failed_to_parse_the_command_line_arguments__UACTASK_.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x140003fda
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.MapViewOfFile_failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x140003fda
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.OpenFileMapping_failed.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x140003fda
bt r14d, 0xd
jae 0x1400032b1
call fcn.1400020a0
test eax, eax
jne 0x1400032b1
xor r9d, r9d
lea rax, str.HstartFileMappingObject
mov qword [rsp + 0x28], rax
xor edx, edx
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x1000
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
jne 0x1400031bf
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.Failed_to_create_file_mapping_object.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rsi + 1]
jmp 0x140003fda
xor r9d, r9d
mov qword [rsp + 0x20], 0x1000
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
jne 0x140003218
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.Failed_to_map_view_of_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0x80004005
jmp 0x140003fda
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, r12
mov rcx, r14
inc eax
movsxd r8, eax
add r8, r8
call fcn.1400079f0
lea r9, str.HstartFileMappingEvent
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.ole32.dll_CoInitialize]
mov rcx, rbx
call fcn.1400045f0
mov edi, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jns 0x1400036ab
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start
or r9d, 0x10
lea rdx, str.Failed_to_run_Hstart_with__NOUAC_switch._Maybe_the_Hstart_UAC_task_in_Task_Scheduler_is_misconfigured_or_inactive._Run_Hstart_with__REGTASK_switch_to_fix_it.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x140003fda
mov eax, r14d
and eax, 0x600
cmp eax, 0x200
jne 0x1400036b2
call fcn.1400020a0
test eax, eax
jne 0x1400036b2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8d, 0x104
lea rdx, [rbp + 0x3a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400036ab
movzx eax, word [0x140018538]
lea rcx, [rbp + 0x5b2]
xor edx, edx
mov word [rbp + 0x5b0], ax
mov r8d, 0xffe
call fcn.140007e40
lea rdx, [rbp + 0x10]
mov rcx, r12
call fcn.140001030
mov esi, 1
mov r14, rax
cmp dword [rbp + 0x10], esi
jle 0x140003655
lea rbx, [rax + 8]
mov r15d, 0xfffd
mov rcx, qword [rbx]
movzx eax, word [rcx]
sub ax, 0x2d
test r15w, ax
je 0x14000350c
mov ecx, 0x800
lea rax, [rbp + 0x5b0]
cmp word [rax], 0
je 0x140003370
add rax, 2
sub rcx, 1
jne 0x140003360
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x140003387
mov eax, 0x800
sub rax, rcx
jmp 0x14000338a
mov rax, rdi
test edx, edx
js 0x1400033e5
mov edx, 0x800
lea rcx, [rbp + 0x5b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x1400033d7
add rax, 0x7ffff7ff
lea r8, [0x14001add0]
add rax, rdx
sub r8, rcx
test rax, rax
je 0x1400033d5
movzx edi, word [r8 + rcx]
test di, di
je 0x1400033d5
mov word [rcx], di
dec rax
add rcx, 2
sub rdx, 1
jne 0x1400033b6
xor edi, edi
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
mov r8, qword [rbx]
lea rax, [rbp + 0x5b0]
mov ecx, 0x800
cmp word [rax], 0
je 0x140003404
add rax, 2
sub rcx, 1
jne 0x1400033f4
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x14000341b
mov eax, 0x800
sub rax, rcx
jmp 0x14000341e
mov rax, rdi
test edx, edx
js 0x140003472
mov edx, 0x800
lea rcx, [rbp + 0x5b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140003464
add rax, 0x7ffff7ff
add rax, rdx
sub r8, rcx
test rax, rax
je 0x140003462
movzx edi, word [r8 + rcx]
test di, di
je 0x140003462
mov word [rcx], di
dec rax
add rcx, 2
sub rdx, 1
jne 0x140003443
xor edi, edi
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
mov ecx, 0x800
lea rax, [rbp + 0x5b0]
nop
cmp word [rax], 0
je 0x140003490
add rax, 2
sub rcx, 1
jne 0x140003480
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x1400034a7
mov eax, 0x800
sub rax, rcx
jmp 0x1400034aa
mov rax, rdi
test edx, edx
js 0x140003646
mov edx, 0x800
lea rcx, [rbp + 0x5b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140003638
add rax, 0x7ffff7ff
lea r8, [0x14001add4]
add rax, rdx
sub r8, rcx
nop
test rax, rax
je 0x140003636
movzx edi, word [r8 + rcx]
test di, di
je 0x140003636
mov word [rcx], di
dec rax
add rcx, 2
sub rdx, 1
jne 0x1400034e0
jmp 0x140003636
add rcx, 2
lea rdx, [0x14001a7b8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea r8, str._UAC2
test eax, eax
je 0x14000352b
mov r8, qword [rbx]
mov ecx, 0x800
lea rax, [rbp + 0x5b0]
cmp word [rax], 0
je 0x140003547
add rax, 2
sub rcx, 1
jne 0x140003537
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x14000355e
mov eax, 0x800
sub rax, rcx
jmp 0x140003561
mov rax, rdi
test edx, edx
js 0x1400035b5
mov edx, 0x800
lea rcx, [rbp + 0x5b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x1400035a7
add rax, 0x7ffff7ff
add rax, rdx
sub r8, rcx
test rax, rax
je 0x1400035a5
movzx edi, word [r8 + rcx]
test di, di
je 0x1400035a5
mov word [rcx], di
dec rax
add rcx, 2
sub rdx, 1
jne 0x140003586
xor edi, edi
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
mov ecx, 0x800
lea rax, [rbp + 0x5b0]
cmp word [rax], 0
je 0x1400035d1
add rax, 2
sub rcx, 1
jne 0x1400035c1
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x1400035e8
mov eax, 0x800
sub rax, rcx
jmp 0x1400035eb
mov rax, rdi
test edx, edx
js 0x140003646
mov edx, 0x800
lea rcx, [rbp + 0x5b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140003638
add rax, 0x7ffff7ff
lea r8, [0x14001adcc]
add rax, rdx
sub r8, rcx
test rax, rax
je 0x140003636
movzx edi, word [r8 + rcx]
test di, di
je 0x140003636
mov word [rcx], di
dec rax
add rcx, 2
sub rdx, 1
jne 0x140003617
xor edi, edi
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
inc esi
add rbx, 8
cmp esi, dword [rbp + 0x10]
jl 0x140003340
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
lea rcx, [rbp - 0x60]
lea r8d, [rdx + 0x70]
call fcn.140007e40
lea rax, str.runas
mov qword [rbp - 0x60], 0x70
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x60]
lea rax, [rbp + 0x3a0]
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x48], rax
lea rax, [rbp + 0x5b0]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x30], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
jmp 0x140003fda
test dword [0x140025d04], 0x20000000
jne 0x1400036c8
btr r14d, 0xc
mov dword [rsp + 0x54], r14d
bt r14d, 0xc
jae 0x1400036d7
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp dword [rbp + 0x10], 1
mov ebx, edi
mov dword [rsp + 0x50], ebx
mov r12d, edi
jne 0x140003819
mov r8d, 0x800
mov word [rbp + 0x25b0], di
lea rdx, [rbp + 0x25b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x25b0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x140003736
lea rdx, [rbp + rcx*2 + 0x25ae]
cmp word [rdx], 0x5c
je 0x140003736
dec eax
dec rcx
sub rdx, 2
test rcx, rcx
jg 0x140003722
cdqe
add rax, rax
cmp rax, 0x1000
jae 0x14000400a
mov word [rbp + rax + 0x25b0], di
mov ecx, 0x800
lea rax, [rbp + 0x25b0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x140003770
add rax, 2
sub rcx, 1
jne 0x140003760
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x140003787
mov eax, 0x800
sub rax, rcx
jmp 0x14000378a
mov rax, rdi
test edx, edx
js 0x1400037e5
mov edx, 0x800
lea rcx, [rbp + 0x25b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x1400037d7
add rax, 0x7ffff7ff
lea r8, str.HstartUI.exe
add rax, rdx
sub r8, rcx
test rax, rax
je 0x1400037d5
movzx edi, word [rcx + r8]
test di, di
je 0x1400037d5
mov word [rcx], di
dec rax
add rcx, 2
sub rdx, 1
jne 0x1400037b6
xor edi, edi
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x25b0]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x140003819
or r14d, 1
mov dword [rsp + 0x54], r14d
test r14b, 1
je 0x140003840
mov r9d, dword [0x140025d20]
lea r8, str.Hidden_Start_v5.1__64_bit_
or r9d, 0x40
lea rdx, str.Run_from_command_line:_r_nhstart64.exe___PARAMETERS_____PRIORITY____COMMAND_LINES__r_n_r_nPARAMETERS:_r_n_NOCONSOLE___run_console_apps_without_any_windows_r_n_ELEVATE_or__RUNAS___run_apps_in_elevated_mode_r_n_NOELEVATE___force_to_run_apps_in_non_elevated_mode_r_n_UAC___run_Hstart_executable_in_elevated_mode_r_n_NOUAC___run_apps_elevated_without_UAC_prompts_r_n_SHELL___run_apps__open_docs_and_URLs_in_Windows_Shell_r_n_MIN___run_apps_with_the_main_window_minimized_r_n_MAX___run_apps_with_the_main_window_maximized_r_n_DPATH___set_the_starting_directory_for_executed_applications_r_n_DELAYN___delay_N_seconds_before_command_execution_r_n_WAIT___wait_for_commands_to_terminate__run_synchronously__r_n_WAITINPUT___wait_for_the_user_input_to_set_the_priority_class_r_n_MSGTEXT___show_the_message_after_command_execution_r_n_MSGTITLETEXT___set_title_of_the_message_r_n_ERRTEXT___show_error_message_if_an_error_detected_r_n_ERRTITLETEXT___set_title_of_the_error_message_r_n_ENVVARNAMEVARVALUE___set_evironment_variable_r_n_SILENT___silent_mode__no_error_messages_will_be_displayed_r_n_TEST___test_mode__see_what_parameters_are_passed_to_Hstart_r_n_r_nPRIORITY_classes:_r_n__HIGH__ABOVENORMAL__NORMAL__BELOWNORMAL__IDLE__r_n_r_nUse_quotes_to_build_complex_COMMAND_LINES:_r_nhstart64.exe__NOCONSOLE___C:Long_Path_test.bat___param__r_n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
movsxd r15, dword [rbp + 0x14]
cmp r15d, dword [rbp + 0x10]
jge 0x140003dd6
mov r13, r15
mov rcx, qword [rsi + r13*8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x68]
mov ebx, 6
lea r8, [rsp + 0x64]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x54]
call fcn.1400022d0
mov r14d, dword [rsp + 0x54]
test eax, eax
jne 0x140003f92
mov rcx, qword [rsi + r13*8]
lea rdx, [rbp + 0x25b0]
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x1400038b8
lea rsi, [rbp + 0x25b0]
jmp 0x1400038bc
mov rsi, qword [rsi + r13*8]
mov rcx, qword [rsp + 0x70]
mov word [rbp + 0x190], di
test rcx, rcx
je 0x1400038e0
mov r8d, 0x104
lea rdx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, r14d
and edi, 2
je 0x14000390e
mov r9d, dword [0x140025d20]
lea r8, str.Hstart___Execute_
or r9d, 0x24
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x140003dbb
cmp dword [0x140025d00], 1
jne 0x140003b89
test edi, edi
jne 0x140003b89
movaps xmm0, xmmword [str.Hstart_is_going_to_run_the_following_command:_r_n_]
lea rcx, [rbp + 0x614]
movaps xmm1, xmmword [0x14001ae60]
xor edx, edx
mov eax, dword [0x14001aeb0]
mov r8d, 0x1f9c
movaps xmmword [rbp + 0x5b0], xmm0
movaps xmm0, xmmword [0x14001ae70]
movaps xmmword [rbp + 0x5c0], xmm1
movaps xmm1, xmmword [0x14001ae80]
movaps xmmword [rbp + 0x5d0], xmm0
movaps xmm0, xmmword [0x14001ae90]
movaps xmmword [rbp + 0x5e0], xmm1
movaps xmm1, xmmword [0x14001aea0]
movaps xmmword [rbp + 0x5f0], xmm0
movaps xmmword [rbp + 0x600], xmm1
mov dword [rbp + 0x610], eax
call fcn.140007e40
mov ecx, 0x1000
lea rax, [rbp + 0x5b0]
cmp word [rax], 0
je 0x1400039b3
add rax, 2
sub rcx, 1
jne 0x1400039a3
test rcx, rcx
mov edx, 0x80070057
mov edi, 0
cmovne edx, edi
je 0x1400039cf
mov eax, 0x1000
sub rax, rcx
jmp 0x1400039d2
mov rax, rdi
test edx, edx
js 0x140003a2f
mov edx, 0x1000
lea rcx, [rbp + 0x5b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140003a21
lea rdi, [rax + 0x7fffefff]
mov r8, rsi
add rdi, rdx
sub r8, rcx
nop dword [rax + rax]
test rdi, rdi
je 0x140003a1f
movzx eax, word [rcx + r8]
test ax, ax
je 0x140003a1f
mov word [rcx], ax
dec rdi
add rcx, 2
sub rdx, 1
jne 0x140003a00
xor edi, edi
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
mov ecx, 0x1000
lea rax, [rbp + 0x5b0]
nop dword [rax + rax]
cmp word [rax], 0
je 0x140003a50
add rax, 2
sub rcx, 1
jne 0x140003a40
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x140003a67
mov eax, 0x1000
sub rax, rcx
jmp 0x140003a6a
mov rax, rdi
test edx, edx
js 0x140003ac6
mov edx, 0x1000
lea rcx, [rbp + 0x5b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140003ab8
lea rdi, [rax + 0x7fffefff]
add rdi, rdx
lea r8, str._r_n_r_nThis_message_is_always_displayed_before_running_a_command_in_the_unregistred_version_of_Hstart._Purchase_a_license_at_www.ntwind.com_to_unlock_all_features.
sub r8, rcx
test rdi, rdi
je 0x140003ab6
movzx eax, word [rcx + r8]
test ax, ax
je 0x140003ab6
mov word [rcx], ax
dec rdi
add rcx, 2
sub rdx, 1
jne 0x140003a97
xor edi, edi
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
mov ecx, 0x1000
lea rax, [rbp + 0x5b0]
cmp word [rax], 0
je 0x140003ae2
add rax, 2
sub rcx, 1
jne 0x140003ad2
test rcx, rcx
mov edx, 0x80070057
cmovne edx, edi
je 0x140003af9
mov eax, 0x1000
sub rax, rcx
jmp 0x140003afc
mov rax, rdi
test edx, edx
js 0x140003b5f
mov edx, 0x1000
lea rcx, [rbp + 0x5b0]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140003b51
lea rdi, [rax + 0x7fffefff]
add rdi, rdx
lea r8, str._r_n_r_nThank_you_for_evaluating_Hstart_
sub r8, rcx
nop dword [rax]
test rdi, rdi
je 0x140003b4f
movzx eax, word [rcx + r8]
test ax, ax
je 0x140003b4f
mov word [rcx], ax
dec rdi
add rcx, 2
sub rdx, 1
jne 0x140003b30
xor edi, edi
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
mov r9d, dword [0x140025d20]
lea r8, str.HSTART___UNREGISTERED_VERSION
or r9d, 0x41
lea rdx, [rbp + 0x5b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
je 0x140003dbd
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x140003b9d
imul ecx, eax, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
test r14d, 0x1140
je 0x140003e29
cmp word [rsi], 0x22
jne 0x140003bd5
movzx eax, word [rsi + 2]
add rsi, 2
mov rdi, rsi
test ax, ax
je 0x140003c19
cmp ax, 0x22
je 0x140003c19
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140003bc0
jmp 0x140003c19
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140003bf5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdi, [rsi + rcx*2]
jmp 0x140003c19
movzx eax, word [rsi]
mov rdi, rsi
test ax, ax
je 0x140003c19
cmp ax, 0x20
je 0x140003c19
cmp ax, 9
je 0x140003c19
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140003c00
cmp word [rdi], 0
je 0x140003c49
xor eax, eax
mov word [rdi], ax
add rdi, 2
movzx eax, word [rdi]
test ax, ax
je 0x140003c49
cmp ax, 0x20
je 0x140003c3c
cmp ax, 9
jne 0x140003c49
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140003c30
test dword [rsp + 0x64], 0x8000000
je 0x140003c65
mov rcx, rsi
call fcn.140001b20
test eax, eax
jne 0x140003c65
xor ecx, ecx
mov ebx, ecx
jmp 0x140003c80
bt r14d, 0x14
jb 0x140003c7e
bt r14d, 0x15
mov ebx, 1
mov eax, 3
cmovb ebx, eax
xor ecx, ecx
bt r14d, 0xc
jae 0x140003cd7
bt r14d, 8
mov dword [rsp + 0x20], ebx
lea rax, str.runas
mov rdx, rdi
lea r9, str.open
cmovb r9, rax
lea r8, [rbp + 0x190]
cmp word [rbp + 0x190], 0
cmove r8, rcx
mov rcx, rsi
call fcn.140004330
mov ebx, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test eax, eax
js 0x140003cd0
inc r12d
xor edi, edi
jmp 0x140003dc6
xor edx, edx
lea rcx, [rbp - 0x60]
lea r8d, [rdx + 0x70]
call fcn.140007e40
bt r14d, 8
mov qword [rbp - 0x48], rsi
lea rcx, str.runas
mov dword [rbp - 0x60], 0x70
lea rax, str.open
mov dword [rbp - 0x5c], 0x40
cmovb rax, rcx
mov qword [rbp - 0x40], rdi
cmp word [rbp + 0x190], 0
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x50], rax
mov esi, 0
lea rax, [rbp + 0x190]
mov dword [rbp - 0x30], ebx
cmove rax, rsi
mov qword [rbp - 0x38], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
mov edi, esi
cmovne rdi, qword [rbp + 8]
je 0x140003dbb
inc r12d
test rdi, rdi
je 0x140003dbb
test r14b, 0x10
je 0x140003d86
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x14]
mov dword [rbp + 0x14], esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140003db2
mov eax, dword [rbp + 0x14]
test eax, eax
je 0x140003db2
mov dword [rsp + 0x50], eax
jmp 0x140003db2
test r14b, 0x20
je 0x140003db2
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov edx, dword [rsp + 0x60]
cmp eax, edx
je 0x140003db2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov ebx, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
inc r15d
inc r13
cmp r15d, dword [rbp + 0x10]
jl 0x140003851
bt r14d, 0xc
jae 0x140003de3
call qword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
jne 0x140003f9b
mov rdx, qword [0x140025d18]
test rdx, rdx
je 0x140003fcf
test r12d, r12d
jle 0x140003fcf
mov rax, qword [0x140025d38]
lea r8, str.Hidden_Start
mov r9d, dword [0x140025d20]
or r9d, 0x40
test rax, rax
cmovne r8, rax
jmp 0x140003fc7
mov edx, dword [rsp + 0x64]
lea rdi, [rbp - 0x80]
mov ebx, dword [rsp + 0x60]
xor eax, eax
and edx, 0xffff3e1f
mov ecx, 0x18
rep stosb byte [rdi], al
or edx, ebx
lea rdi, [rbp + 0x20]
mov dword [rsp + 0x64], edx
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rbp + 0x20], 0x68
test r14d, 0x300000
je 0x140003e83
bt r14d, 0x14
mov dword [rbp + 0x5c], 1
mov eax, 3
mov ecx, 6
cmovb ax, cx
mov word [rbp + 0x60], ax
cmp word [rbp + 0x190], 0
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x48], rcx
lea rax, [rbp + 0x190]
mov edi, 0
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x40], rcx
cmove rax, rdi
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], edx
xor ecx, ecx
mov rdx, rsi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140003f69
mov rcx, qword [rbp - 0x78]
inc r12d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, 0x10
je 0x140003f29
mov rcx, qword [rbp - 0x80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x18], edi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140003f56
mov eax, dword [rbp + 0x18]
test eax, eax
je 0x140003f56
mov rcx, qword [rbp - 0x80]
mov ebx, eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003dc1
test r14b, 0x20
je 0x140003f56
mov rcx, qword [rbp - 0x80]
or edx, 0xffffffff
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, ebx
je 0x140003f56
mov rcx, qword [rbp - 0x80]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rbp - 0x80]
mov ebx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003dc1
mov rsi, qword [rsp + 0x58]
test r14b, 4
jne 0x140003f92
mov r9d, dword [0x140025d20]
lea r8, str.Failed_to_create_process___Hstart
mov rdx, qword [rsi + r13*8]
or r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, dword [rsp + 0x50]
jmp 0x140003dc6
mov rdx, qword [0x140025d10]
test rdx, rdx
je 0x140003fcf
mov rcx, qword [0x140025d08]
lea r8, str.Hidden_Start
mov r9d, dword [0x140025d20]
or r9d, 0x10
test rcx, rcx
cmovne r8, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp + 0x35b0]
xor rcx, rsp
call fcn.1400056e0
lea r11, [rsp + 0x36c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140005ab4
int3