Function at 0x140091190
Capabilities:
Delete registry value
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1820]
mov eax, 0x1920
call fcn.1401c66b0
sub rsp, rax
movaps xmmword [rsp + 0x1910], xmm6
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp + 0x1800], rax
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x64], r13d
lea r15, [0x14024fa68]
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x140091219
test byte [rcx + 0x1c], 4
je 0x140091219
cmp byte [rcx + 0x19], 4
jb 0x140091219
lea edx, [r13 + 0x11]
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
call fcn.1401bf390
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x14009124b
test byte [rcx + 0x1c], 4
je 0x14009124b
cmp byte [rcx + 0x19], 5
jb 0x14009124b
mov edx, reloc.WS2_32.dll_select
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
mov r8b, 1
mov rcx, rsi
call fcn.1400a2500
cmp qword [0x140250690], 0xffffffffffffffff
jne 0x140091295
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, [0x1401fa098]
call qword [case.0x1401ba071.53]
mov qword [0x140250690], rax
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x1400912c2
test byte [rcx + 0x1c], 4
je 0x1400912c2
cmp byte [rcx + 0x19], 5
jb 0x1400912c2
mov edx, reloc.WS2_32.dll_send
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
mov ecx, 3
call fcn.14006cd10
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x1400912f9
test byte [rcx + 0x1c], 4
je 0x1400912f9
cmp byte [rcx + 0x19], 5
jb 0x1400912f9
mov edx, reloc.WS2_32.dll_sendto
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
xor ecx, ecx
call fcn.14006cd10
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x14009132d
test byte [rcx + 0x1c], 4
je 0x14009132d
cmp byte [rcx + 0x19], 5
jb 0x14009132d
mov edx, reloc.WS2_32.dll_setsockopt
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
mov eax, dword [0x14024fcbc]
cmp eax, 0xffffffff
jne 0x14009134c
mov r9d, 0x3fab
call fcn.1401acbb0
movzx eax, al
mov dword [0x14024fcbc], eax
cmp eax, 1
je 0x140091356
call fcn.1400963a0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r8d, 0x104
lea rdx, [rbp + 0x13e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400913d7
mov dword [rbp + 0x10], r13d
mov dword [rsp + 0x70], r13d
lea rax, [rbp + 0x13e0]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [rax + rdx*2], r13w
jne 0x1400913a0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x13e0]
call fcn.1401bf380
xor edx, edx
mov r8d, 0x198
lea rcx, [rbp + 0x10d0]
call sub.VCRUNTIME140.dll_memset
mov edi, 0x202
mov ecx, edi
lea rdx, [rbp + 0x10d0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
test eax, eax
je 0x140091458
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x1400914b1
test byte [rcx + 0x1c], 4
je 0x1400914b1
cmp byte [rcx + 0x19], 5
jb 0x1400914b1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
mov rax, qword [0x14024fa68]
mov edx, reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x20], r8d
mov r9d, ebx
lea r8, [0x1401fc458]
mov rcx, qword [rax + 0x10]
call fcn.14008eb90
jmp 0x1400914b1
cmp word [rbp + 0x10d0], di
je 0x1400914b1
mov rax, qword [0x14024fa68]
cmp rax, r15
je 0x1400914ab
test byte [rax + 0x1c], 4
je 0x1400914ab
cmp byte [rax + 0x19], 5
jb 0x1400914ab
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
mov rax, qword [0x14024fa68]
movzx r9d, word [rbp + 0x10d2]
mov edx, reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], r8d
lea r8, [0x1401fc458]
mov rcx, qword [rax + 0x10]
call fcn.14008eb90
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rbp + 0x530], r13d
mov word [rbp + 0x534], 0x100
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14009163c
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x530]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140091633
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x428
lea r8, [rbp + 0x9b0]
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
test eax, eax
je 0x140091629
lea r9, [rbp + 0x18]
lea r8, [rbp - 0x38]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x9b0]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
je 0x140091629
mov r8, qword [rbp - 0x38]
test r8, r8
je 0x140091629
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x9c], xmm0
mov qword [rbp + 0xb0], 5
mov dword [rbp + 0x90], 0x40001
mov qword [rbp + 0x94], 3
mov dword [rbp + 0xac], r13d
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0xb8], rax
lea r9, [rbp - 0x20]
lea rdx, [rbp + 0x90]
mov ecx, 1
call qword [case.0x1401ba071.49]
test eax, eax
jne 0x140091629
lea edx, [rax + 1]
lea rcx, [rbp + 0x560]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x14009161f
mov r9d, dword [rbp + 0x18]
mov r8, qword [rbp - 0x20]
mov edx, dword [rsp + 0x68]
lea rcx, [rbp + 0x560]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x14009161f
lea r8, [rbp + 0x560]
mov edx, 4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rbx
call qword [case.0x1401b9e8b.6]
lea rax, [0x14008e9b0]
mov qword [rsi + 0xc10], rax
mov qword [rsi + 0xc18], rsi
lea rdx, [rbp + 0x538]
call fcn.1400b0610
lea rbx, [rax + 8]
lea rdi, [rsi + 0xf98]
mov eax, dword [rax]
mov dword [rsi + 0xf90], eax
mov r12d, 7
cmp rdi, rbx
je 0x14009169d
mov rcx, rdi
call fcn.1400036b0
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r12
mov word [rbx], r13w
lea rcx, [rbp + 0x540]
call fcn.1400036b0
call fcn.14010e880
lea rcx, [0x1402501d0]
call fcn.14010eda0
test eax, eax
je 0x1400916ee
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x1400916ee
test byte [rcx + 0x1c], 4
je 0x1400916ee
cmp byte [rcx + 0x19], 2
jb 0x1400916ee
mov edx, 0xa
mov r9d, eax
lea r8, [0x140202130]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb50
call fcn.140196e70
mov ebx, 0x22
mov ecx, 0x25
test al, al
cmovne ebx, ecx
mov ecx, 0xe0
call fcn.1401c51ec
mov qword [rbp + 0x28], rax
lea r8, [0x14010ab10]
mov edx, ebx
mov rcx, rax
call fcn.1400885b0
nop
mov qword [rbp - 0x18], rax
mov dword [rsp + 0x60], 2
mov qword [rbp - 0x18], r13
mov rcx, qword [0x1402574b0]
mov qword [0x1402574b0], rax
test rcx, rcx
je 0x140091756
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14003c8e9.0]
mov eax, 2
and eax, 0xfffffffd
mov dword [rsp + 0x60], eax
mov rdi, qword [0x1402574b0]
lea rbx, [rdi + 0xb0]
mov qword [rbp + 0xe0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea r14, [rdi + 0xa8]
cmp qword [r14], 0
je 0x1400917ad
cmp byte [rdi + 0xd8], 0
jne 0x1400917a5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, r12d
jmp 0x1400917ce
mov rcx, r14
call fcn.14006f910
xor edx, edx
mov rcx, rdi
call fcn.14008ae50
mov edi, eax
cmp qword [r14], 0
cmovne edi, r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x140091800
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x140091805
test byte [rcx + 0x1c], 4
je 0x140091805
cmp byte [rcx + 0x19], 2
jb 0x140091805
mov edx, reloc.WS2_32.dll_listen
mov r9d, edi
lea r8, [0x140202140]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb50
jmp 0x140091805
call fcn.14010f330
xor r9d, r9d
lea r8, str.plugins.01000600.settings.EKRN_CFG.AdvancedLoggingEnabled
lea rdx, [rbp + 0x3d0]
mov rcx, rsi
call fcn.140081c00
nop
xor edx, edx
mov rcx, rax
call fcn.140031290
movzx edi, al
lea rcx, [rbp + 0x3f0]
call fcn.14000b5d0
nop
mov rbx, qword [rbp + 0x3d8]
test rbx, rbx
je 0x140091882
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140091882
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14003c8e9.0]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140091882
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
test dil, dil
je 0x140091893
lea rcx, [rsi + 0x1108]
call fcn.1400109f0
mov rcx, rsi
call fcn.1400e7cb0
lea rcx, [rsi + 0x28]
call fcn.140124940
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x1400918d2
test byte [rcx + 0x1c], 4
je 0x1400918d2
cmp byte [rcx + 0x19], 5
jb 0x1400918d2
mov edx, reloc.WS2_32.dll_shutdown
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
nop
lea r14, [rsi + 0x20]
mov r15, r14
mov qword [rbp + 0x128], r14
mov byte [rbp + 0x130], 1
mov rcx, r14
call qword [case.0x1401b9e8b.1]
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov rdi, qword [rsi + 0x18]
test rdi, rdi
je 0x140091911
lock inc dword [rdi + 8]
mov rdi, qword [rsi + 0x18]
mov r15, qword [rbp + 0x128]
mov rbx, qword [rsi + 0x10]
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], rdi
mov eax, dword [rsp + 0x60]
or eax, 4
mov dword [rsp + 0x60], eax
mov rcx, r15
call qword [case.0x1401b9e8b.2]
mov ecx, dword [rbx + 0x24c]
call fcn.140036040
and dword [rsp + 0x60], 0xfffffffb
test rdi, rdi
je 0x140091986
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140091986
mov rcx, qword [rbp + 0x78]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14003c8e9.0]
mov eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140091986
mov rcx, qword [rbp + 0x78]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
nop
mov qword [rbp + 0x138], r14
mov byte [rbp + 0x140], 1
mov rcx, r14
call qword [case.0x1401b9e8b.1]
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
mov rdi, qword [rsi + 0x18]
test rdi, rdi
je 0x1400919c1
lock inc dword [rdi + 8]
mov rdi, qword [rsi + 0x18]
mov r14, qword [rbp + 0x138]
mov rbx, qword [rsi + 0x10]
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rdi
mov eax, dword [rsp + 0x60]
or eax, 8
mov dword [rsp + 0x60], eax
mov rcx, r14
call qword [case.0x1401b9e8b.2]
movzx ebx, byte [rbx + 4]
mov r14d, r13d
test bl, bl
setne r14b
and dword [rsp + 0x60], 0xfffffff7
test rdi, rdi
je 0x140091a43
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140091a43
mov rcx, qword [rbp + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14003c8e9.0]
mov eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140091a43
mov rcx, qword [rbp + 0x88]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
neg bl
sbb ecx, ecx
and ecx, 3
call fcn.14006cd10
mov rcx, qword [0x14024fa68]
lea rdi, [0x14024fa68]
cmp rcx, rdi
je 0x140091a86
test byte [rcx + 0x1c], 4
je 0x140091a86
cmp byte [rcx + 0x19], 5
jb 0x140091a86
mov edx, reloc.WS2_32.dll_socket
mov r9d, r14d
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb50
mov byte [rsp + 0x20], 0
mov r9d, 0x2001f
lea r8, [rbp - 0x78]
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov rcx, 0xffffffff80000002
call fcn.1401a5450
test al, al
je 0x140091c5e
mov rbx, qword [rbp - 0x78]
mov dword [rsp + 0x74], 0x102
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x48]
xor r8d, r8d
lea rdx, str.UniqueId
mov rcx, rbx
call qword [0x14024f060]
test eax, eax
je 0x140091af0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140091b5d
mov eax, dword [rbp - 0x48]
dec eax
cmp eax, 1
jbe 0x140091b07
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140091b5d
cmp dword [rsp + 0x74], 0x102
jbe 0x140091b1e
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140091b5d
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xfc0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x48]
xor r8d, r8d
lea rdx, str.UniqueId
mov rcx, rbx
call qword [0x14024f060]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x140091c54
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, 1
lock xadd dword [str.TESE], ecx
inc ecx
movsxd r10, ecx
shl rax, 0x20
or r10, rax
mov r8d, 0x81
mov r9d, r13d
lea rdx, [rbp + 0xf30]
mov ecx, 0x3c
lea r11, str.0123456789ABCDEFD
nop word [rax + rax]
mov rax, r10
sar rax, cl
and eax, 0xf
movzx eax, byte [rax + r11]
mov byte [rdx], al
dec r8
cmp r8, 1
je 0x140091bc4
inc r9d
inc rdx
sub ecx, 4
jns 0x140091ba0
movsxd rax, r9d
mov byte [rbp + rax + 0xf30], 0
mov dword [rsp + 0x28], 0x81
lea rax, [rbp + 0xfc0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0xf30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbp + 0x10c0], r13w
lea rcx, [rbp + 0xfc0]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140091c10
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.UniqueId
mov rcx, qword [rbp - 0x78]
call qword [case.0x1401ba071.80]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp - 0x78]
call qword [0x14024f048]
mov byte [rsp + 0x20], 0
mov r9d, 0x20006
lea r8, [rbp - 0x78]
lea rdx, str.SOFTWAREWow6432NodeMicrosoftSoftGrid4.5ClientAppFSServiceInclusions
mov rcx, 0xffffffff80000002
call fcn.1401a5450
test al, al
je 0x140091cc4
mov dword [rsp + 0x28], 0xa
lea rax, str.ekrn
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1401fbe50]
mov rcx, qword [rbp - 0x78]
call qword [case.0x1401ba071.80]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp - 0x78]
call qword [0x14024f048]
lea rbx, [rsi + 0x488]
mov qword [rbp + 0x2e8], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x470]
mov rax, qword [rcx + 0x10]
sub rax, qword [rcx]
sar rax, 4
cmp rax, 0x19
jae 0x140091cfa
call fcn.1400c4d50
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x58
call fcn.1401c51ec
mov qword [rbp - 0x40], rax
mov rcx, rax
call fcn.140081ee0
nop
mov rdx, qword [rsi + 0xf88]
mov qword [rsi + 0xf88], rax
test rdx, rdx
je 0x140091d32
call fcn.1400c4c80
mov rcx, rsi
call fcn.1400ac9e0
movups xmm0, xmmword [str.runtime.RUNTIME_CONFIG]
movups xmmword [rbp + 0xe10], xmm0
mov eax, dword [0x140200440]
mov dword [rbp + 0xe20], eax
movzx eax, word [0x140200444]
mov word [rbp + 0xe24], ax
movzx eax, byte [0x140200446]
mov byte [rbp + 0xe26], al
mov edx, 1
lea rcx, [rbp + 0x590]
call fcn.14000d670
nop
lea rdx, [rbp + 0x590]
mov rcx, rsi
call fcn.1400ec530
test al, al
je 0x140091dbd
lea rcx, [rbp + 0x590]
call fcn.14000d390
cmp qword [rax + 0x18], 0x10
jb 0x140091daa
mov rax, qword [rax]
mov r8, rax
lea rdx, [rbp + 0xe10]
mov rcx, rsi
call fcn.140081d80
nop
lea rcx, [rbp + 0x6c0]
call fcn.140002800
nop
lea rcx, [rbp + 0x6a0]
call fcn.140002800
nop
lea rax, [rbp + 0x640]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x640]
call fcn.14000b780
lea rcx, [rbp + 0x640]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x590]
call fcn.140002800
nop
mov ecx, 0xe0
call fcn.1401c51ec
mov qword [rbp - 0x40], rax
lea r8, [0x14010ab10]
mov edx, reloc.WS2_32.dll_socket
mov rcx, rax
call fcn.1400885b0
nop
mov qword [rbp + 0xe8], rax
or dword [rsp + 0x60], 0x10
mov qword [rbp + 0xe8], r13
mov rcx, qword [0x1402574b8]
mov qword [0x1402574b8], rax
test rcx, rcx
je 0x140091e63
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14003c8e9.0]
and dword [rsp + 0x60], 0xffffffef
call fcn.14010f600
lea rcx, [0x140250290]
call fcn.14010eda0
lea rcx, [0x140250230]
call fcn.14010eda0
lea rbx, [0x1402503a0]
mov qword [rbp + 0x2e0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea r14, vtable.ModuleManager_class_NodOsApi::Mutex__class_NodOsApi::ReadPreferringRWLock_.0
cmp qword [0x140250398], 0
je 0x140091ec3
cmp byte [0x1402503c8], 0
je 0x140091ece
lea rcx, [0x140250398]
call fcn.14006f910
xor edx, edx
mov rcx, r14
call fcn.14008ae50
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.14010e310
lea rcx, [0x14024ff40]
call fcn.14010eda0
mov dword [rbp - 0x40], 0xc8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
mov edx, 1
lea ecx, [rdx + 0x2d]
lea r9, [rbp + 0x68]
lea r8, [rbp + 0x60]
call fcn.14010dba0
nop
mov rax, qword [rbp + 0x68]
test rax, rax
je 0x140091f26
lea rdx, [rbp - 0x40]
mov ecx, 0x708
call qword [case.0x14003c8e9.0]
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140091f34
call fcn.14010e200
cmp dword [rbp - 0x40], 0
jne 0x140091f3f
mov eax, r13d
jmp 0x140091fae
cmp qword [0x1402574a0], 0
jne 0x140091fb4
mov ecx, 0x60
call fcn.1401c51ec
mov rbx, rax
mov qword [rbp - 0x80], rax
lea rax, vtable.CArrayNoThrow_struct__SSL_CONN_CREDENTIAL__struct__SSL_CONN_CREDENTIAL_const____ptr64_.0
mov qword [rbx], rax
mov qword [rbx + 8], r13
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x10], r13
lea rax, vtable.CSortedArray_struct__SSL_CONN_CREDENTIAL__struct__SSL_CONN_CREDENTIAL_const____ptr64_.0
mov qword [rbx], rax
lea rax, [0x1401a80f0]
mov qword [rbx + 0x28], rax
lea rax, vtable.CSslCredentialRecycler.0
mov qword [rbx], rax
mov dword [rbx + 0x30], r13d
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [0x1402574a0], rbx
mov eax, 2
xchg dword [0x14024fa60], eax
lea rax, [0x140009470]
mov qword [rbp + 0x278], rax
lea rax, [0x14000a350]
mov qword [rbp + 0x280], rax
lea rax, [0x140191b10]
mov qword [rbp + 0x288], rax
movsxd rax, dword [reloc.WS2_32.dll_closesocket]
mov ecx, 0x7d0
mov rax, qword [rbp + rax*8 + 0x278]
call qword [case.0x14003c8e9.0]
mov rcx, rsi
call fcn.1400a3990
mov rcx, rsi
call fcn.1400e8b00
mov ebx, dword [rsi + 0x149c]
lea rdx, [rbp + 0x298]
lea rcx, [0x1402501d0]
call fcn.14010eb40
mov r12d, dword [rsp + 0x60]
bts r12d, 0x1c
mov dword [rsp + 0x60], r12d
mov rax, qword [rax]
test rax, rax
je 0x14009204f
mov rax, qword [rax + 8]
test rax, rax
je 0x14009204f
movzx edx, bx
mov ecx, 0x4650
call qword [case.0x14003c8e9.0]
btr r12d, 0x1c
mov dword [rsp + 0x60], r12d
lea rcx, [rbp + 0x298]
call fcn.140080110
mov rax, qword [0x14024fa68]
cmp rax, rdi
je 0x1400920a5
test byte [rax + 0x1c], 4
je 0x1400920a5
cmp byte [rax + 0x19], 5
jb 0x1400920a5
mov r9d, dword [rsi + 0x149c]
mov rax, qword [0x14024fa68]
mov edx, 0x18
lea r8, [0x1401fc458]
mov rcx, qword [rax + 0x10]
call fcn.14008eb50
mov r12d, dword [rsp + 0x60]
mov dword [rbp + 0x218], 1
lea rax, [0x140200330]
mov qword [rbp + 0x21c], rax
lea rax, [0x1400eb540]
mov qword [rbp + 0x22c], rax
mov qword [rbp + 0x224], rsi
lea rcx, [rbp + 0xc0]
call fcn.14010f540
nop
mov rax, qword [rax]
test rax, rax
je 0x140092112
mov rax, qword [rax + 0x98]
test rax, rax
je 0x140092112
mov rax, qword [rax + 8]
test rax, rax
je 0x140092112
xor r8d, r8d
lea rdx, [rbp + 0x218]
mov ecx, 0x5402
call qword [case.0x14003c8e9.0]
nop
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x140092127
add rcx, 0x48
call fcn.14007f890
mov dword [rbp + 0x238], 1
lea rax, str.scheduler
mov qword [rbp + 0x23c], rax
lea rax, [0x1400eb580]
mov qword [rbp + 0x24c], rax
mov qword [rbp + 0x244], rsi
lea rcx, [rbp + 0xc8]
call fcn.14010f540
nop
mov rax, qword [rax]
test rax, rax
je 0x140092194
mov rax, qword [rax + 0x98]
test rax, rax
je 0x140092194
mov rax, qword [rax + 8]
test rax, rax
je 0x140092194
xor r8d, r8d
lea rdx, [rbp + 0x238]
mov ecx, 0x5402
call qword [case.0x14003c8e9.0]
nop
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x1400921a9
add rcx, 0x48
call fcn.14007f890
mov r9, rsi
lea r8, [0x1400eb560]
lea rdx, [0x1401fd0b8]
call fcn.1400ebce0
lea rbx, [rsi + 0x1310]
mov rcx, rbx
call fcn.140100420
mov dword [rbp + 0x258], 1
lea rax, str.State.Features
mov qword [rbp + 0x25c], rax
lea rax, [0x1400ffdc0]
mov qword [rbp + 0x26c], rax
mov qword [rbp + 0x264], rbx
lea rcx, [rbp + 0xd0]
call fcn.14010f540
nop
mov rax, qword [rax]
test rax, rax
je 0x14009223b
mov rax, qword [rax + 0x98]
test rax, rax
je 0x14009223b
mov rax, qword [rax + 8]
test rax, rax
je 0x14009223b
xor r8d, r8d
lea rdx, [rbp + 0x258]
mov ecx, 0x5402
call qword [case.0x14003c8e9.0]
nop
mov rcx, qword [rbp + 0xd0]
test rcx, rcx
je 0x140092250
add rcx, 0x48
call fcn.14007f890
call fcn.140196fb0
shr eax, 3
test al, 1
je 0x14009227b
mov ecx, 0x28
call fcn.1401c51ec
mov rbx, rax
mov qword [rbp - 0x80], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [rsi + 8], rbx
call fcn.1400e7740
mov rcx, rsi
call fcn.1400a3550
mov rax, qword [rsi + 0x338]
mov rdx, qword [rsi + 0x340]
cmp rax, rdx
je 0x1400922b5
nop dword [rax + rax]
mov rcx, qword [rax]
cmp dword [rcx + 8], 0x1000600
je 0x1400922b8
add rax, 8
cmp rax, rdx
jne 0x1400922a0
mov rcx, r13
call fcn.140116940
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
lea rax, [0x1401eb910]
mov qword [rbp - 0x50], rax
mov word [rbp - 0x70], r13w
lea r8, [rbp - 0x70]
mov edx, 0xf0000b0
mov rcx, rsi
call fcn.1400ace00
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
mov rax, qword [rsi + 0x338]
mov rcx, qword [rsi + 0x340]
cmp rax, rcx
je 0x140092325
nop dword [rax + rax]
mov rdx, qword [rax]
cmp dword [rdx + 8], 0x1000600
je 0x140092328
add rax, 8
cmp rax, rcx
jne 0x140092310
mov rdx, r13
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r8
lea r9, str.virlog.dat
mov r8d, 1
mov rcx, rsi
call fcn.140106a80
lea r8, [rbp - 0x70]
mov edx, 0xf0000af
mov rcx, rsi
call fcn.1400ace00
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
mov rax, qword [rsi + 0x338]
mov rcx, qword [rsi + 0x340]
cmp rax, rcx
je 0x140092395
nop dword [rax]
mov rdx, qword [rax]
cmp dword [rdx + 8], 0x1000600
je 0x140092398
add rax, 8
cmp rax, rcx
jne 0x140092380
mov rdx, r13
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], r8
lea r9, str.warnlog.dat
mov r8d, 2
mov rcx, rsi
call fcn.140106a80
lea r8, [rbp - 0x70]
mov edx, 0xf0000b1
mov rcx, rsi
call fcn.1400ace00
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
mov rax, qword [rsi + 0x338]
mov rcx, qword [rsi + 0x340]
cmp rax, rcx
je 0x140092405
nop dword [rax]
mov rdx, qword [rax]
cmp dword [rdx + 8], 0x1000600
je 0x140092408
add rax, 8
cmp rax, rcx
jne 0x1400923f0
mov rdx, r13
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r8
lea r9, str.eScan_
mov r8d, 3
mov rcx, rsi
call fcn.140106a80
mov rax, qword [rsi + 0x338]
mov rcx, qword [rsi + 0x340]
cmp rax, rcx
je 0x140092455
nop dword [rax]
mov rdx, qword [rax]
cmp dword [rdx + 8], 0x1000600
je 0x140092458
add rax, 8
cmp rax, rcx
jne 0x140092440
mov rdx, r13
mov dword [rsp + 0x28], reloc.WS2_32.dll_getservbyport
lea r14, [0x1401ef380]
mov qword [rsp + 0x20], r14
lea r9, str.lasthit.dat
mov r8d, 0x18
mov rcx, rsi
call fcn.140106a80
call fcn.140196fb0
shr eax, 1
test al, 1
jne 0x1400925da
lea r8, [rbp - 0x70]
mov edx, 0xf0000e7
mov rcx, rsi
call fcn.1400ace00
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
mov rax, qword [rsi + 0x338]
mov rcx, qword [rsi + 0x340]
cmp rax, rcx
je 0x1400924d7
mov rdx, qword [rax]
cmp dword [rdx + 8], 0x1000600
je 0x1400924da
add rax, 8
cmp rax, rcx
jne 0x1400924c2
mov rdx, r13
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], r8
lea r9, str.blocked.dat
mov r8d, reloc.WS2_32.dll_select
mov rcx, rsi
call fcn.140106a80
lea r8, [rbp - 0x70]
mov edx, 0xf0000f0
mov rcx, rsi
call fcn.1400ace00
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
mov rax, qword [rsi + 0x338]
mov rcx, qword [rsi + 0x340]
cmp rax, rcx
je 0x140092545
nop
mov rdx, qword [rax]
cmp dword [rdx + 8], 0x1000600
je 0x140092548
add rax, 8
cmp rax, rcx
jne 0x140092530
mov rdx, r13
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], r8
lea r9, str.sent.dat
mov r8d, reloc.WS2_32.dll_send
mov rcx, rsi
call fcn.140106a80
lea r8, [rbp - 0x70]
mov edx, 0xf0000f8
mov rcx, rsi
call fcn.1400ace00
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
mov rax, qword [rsi + 0x338]
mov rcx, qword [rsi + 0x340]
cmp rax, rcx
je 0x1400925b5
nop dword [rax]
mov rdx, qword [rax]
cmp dword [rdx + 8], 0x1000600
je 0x1400925b8
add rax, 8
cmp rax, rcx
jne 0x1400925a0
mov rdx, r13
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], r8
lea r9, str.audit.dat
mov r8d, reloc.WS2_32.dll_shutdown
mov rcx, rsi
call fcn.140106a80
lea rcx, [rbp + 0x2a8]
call fcn.14010aa40
nop
or r12d, 1
mov dword [rsp + 0x60], r12d
cmp qword [rax], 0
jne 0x14009260a
lea rcx, [rsi + 0x168]
call fcn.1400764f0
test al, al
je 0x14009260a
mov bl, 1
jmp 0x14009260c
xor bl, bl
test r12b, 1
je 0x140092627
and r12d, 0xfffffffe
mov dword [rsp + 0x60], r12d
lea rcx, [rbp + 0x2a8]
call fcn.140080110
test bl, bl
je 0x1400926e6
xor r9d, r9d
lea r8, [rbp + 0xd8]
mov edx, 0x81a
lea rcx, [rsi + 0x168]
call fcn.140079120
mov rbx, r14
test eax, eax
cmovne rbx, qword [rbp + 0xd8]
xor r9d, r9d
lea r8, [rbp + 0x28]
mov edx, 0x819
lea rcx, [rsi + 0x168]
call fcn.140079120
mov rcx, r14
test eax, eax
cmovne rcx, qword [rbp + 0x28]
mov dword [rsp + 0x48], 0x12000077
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 0x1200003a
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x400
mov r9d, 2
lea r8, str.EkrnAvModulesNotLoaded
mov edx, 0x1000600
mov rcx, rsi
call fcn.1400a3bb0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xf000034
mov r8d, 0x1338001f
lea rdx, str.EkrnModulesLoadError
lea rcx, [rsi + 0x168]
call fcn.1400795b0
lea r13, [rsi + 0x938]
mov dword [r13 + 0xc], 0
lea rcx, [r13 + 0x10]
call fcn.140193d40
mov word [r13 + 8], 0
lea rcx, [r13 + 0x238]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [r13 + 0xc], 0
lea rdx, [rbp + 0x15f0]
mov rcx, r13
call fcn.140193bb0
test al, al
je 0x140092820
mov edx, 1
lea rcx, [rbp + 0x15f0]
call fcn.1401b2a60
mov rdi, rax
test rax, rax
je 0x140092820
mov rcx, rax
call fcn.1401b0850
cmp eax, 1
je 0x140092818
mov r14, qword [rdi + 0x138]
test r14, r14
je 0x14009280e
mov qword [rbp - 0x28], 0
mov qword [rbp + 0x2d0], 0
lea rax, [rbp - 0x28]
nop word [rax + rax]
lea rcx, [rax]
mov qword [rbp + 0x20], 0
mov rbx, qword [rbp - 0x28]
cmp rbx, 0xffffffffffffffff
je 0x14009280e
test rbx, rbx
jne 0x1400927c5
mov rbx, qword [r14 + 0x80]
test rbx, rbx
je 0x1400927c0
mov rax, qword [rbx + 0x88]
mov qword [rcx], rax
mov rax, qword [rcx]
jmp 0x1400927d0
mov rax, qword [rbx + 0x88]
mov qword [rbp - 0x28], rax
test rax, rax
jne 0x1400927dc
mov qword [rcx], 0xffffffffffffffff
test rbx, rbx
je 0x14009280e
lea rdx, [rbx + 4]
lea rcx, str.SERVERS
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
lea rax, [rbp - 0x28]
jne 0x140092790
cmp dword [rbx], 5
lea rax, [rbp - 0x28]
jne 0x140092790
mov rdx, rbx
mov rcx, rdi
call fcn.1401b1850
mov rcx, rdi
call fcn.1401b2c70
jmp 0x140092820
mov rcx, rdi
call fcn.1401b2dd0
lea rcx, [r13 + 0x238]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rax, [0x14008e910]
mov qword [rsi + 0xb60], rax
mov qword [rsi + 0xb68], rsi
mov byte [rsp + 0x20], 1
mov r9d, 0x2001b
lea r8, [rbp]
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov rcx, 0xffffffff80000002
call fcn.1401a5450
lea rdi, [0x1401a55e0]
test al, al
je 0x140092c47
mov r8, qword [rbp]
lea rcx, [rbp + 0x30]
call fcn.140035a80
nop
lea r8, [rbp + 8]
lea rdx, str.OldProductCode
mov rcx, qword [rbp]
call fcn.1401a5610
test al, al
je 0x140092c1e
lea rdx, str.OldProductCode
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
cmp byte [rbp + 0x30], 0
jne 0x1400928e0
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
cmp rax, rdi
jne 0x1400928da
call qword [0x14024f048]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400928e0
call qword [case.0x14003c8e9.0]
mov eax, dword [rbp + 8]
dec eax
cmp eax, 0x6c
ja 0x140092c47
call fcn.1401968b0
cmp eax, 0x6e
jb 0x140092c47
call fcn.140196fb0
shr eax, 1
test al, 1
je 0x140092c47
xor r9d, r9d
lea r8, str.Settings.LiveGrid
lea rdx, [rbp + 0x370]
mov rcx, rsi
call fcn.140081c00
nop
lea rcx, [rbp + 0x370]
call fcn.140030e90
test al, al
je 0x140092c10
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1c0], xmm0
mov dword [rbp + 0x1d0], 0xffffffff
mov dword [rbp + 0x1d4], 0x10000
mov qword [rbp + 0x1d8], 0
lea rax, [rbp + 0x1e0]
mov qword [rbp - 0x80], rax
movdqu xmmword [rbp + 0x1e0], xmm0
movdqu xmmword [rbp + 0x1f0], xmm0
lea rax, str.SubmitStatisticsChosen
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 0
mov dword [rbp + 0x210], reloc.WS2_32.dll_shutdown
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x428]
lea rcx, [rbp + 0x370]
call fcn.140031520
or r12d, 0x80000000
mov dword [rsp + 0x60], r12d
xor edx, edx
mov rcx, rax
call fcn.140031060
mov ebx, eax
btr r12d, 0x1f
mov dword [rsp + 0x60], r12d
lea rcx, [rbp + 0x428]
call fcn.14000b680
nop
lea rcx, [rbp + 0x1e0]
call fcn.14000b5d0
nop
mov rcx, qword [rbp + 0x1c8]
test rcx, rcx
je 0x140092a08
call fcn.14000a250
test ebx, ebx
je 0x140092c10
mov r14b, 1
movzx r15d, r14b
lea rax, str.SubmitStatistics
mov qword [rbp + 0xde0], rax
lea rax, str.SubmitInfectedFiles
mov qword [rbp + 0xde8], rax
lea rax, str.SubmitSuspiciousExecutables
mov qword [rbp + 0xdf0], rax
lea rax, str.SubmitSuspiciousArchives
mov qword [rbp + 0xdf8], rax
lea rax, str.SubmitSuspiciousScripts
mov qword [rbp + 0xe00], rax
lea rax, str.SubmitSuspiciousOther
mov qword [rbp + 0xe08], rax
lea rdi, [rbp + 0xde0]
lea rax, [rbp + 0x188]
mov qword [rbp - 0x80], rax
mov r12d, dword [rsp + 0x64]
mov rcx, qword [rdi]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x168], xmm0
mov dword [rbp + 0x178], 0xffffffff
mov dword [rbp + 0x17c], 0x10000
movdqu xmmword [rbp + 0x180], xmm0
xor eax, eax
mov qword [rbp + 0x190], rax
movdqu xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], rcx
mov qword [rbp + 0x1b0], rax
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140092ad2
mov dword [rbp + 0x1b8], eax
lea r8, [rbp + 0x168]
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x370]
call fcn.140031520
or r12d, 1
mov dword [rsp + 0x64], r12d
xor edx, edx
mov rcx, rax
call fcn.140031060
mov ebx, eax
and r12d, 0xfffffffe
mov dword [rsp + 0x64], r12d
lea rcx, [rbp + 0x480]
call fcn.14000b680
nop
lea rcx, [rbp + 0x188]
call fcn.14000b5d0
nop
mov rcx, qword [rbp + 0x170]
test rcx, rcx
je 0x140092b44
call fcn.14000a250
test r14b, r14b
je 0x140092b54
cmp ebx, 1
jne 0x140092b54
movzx r14d, bl
jmp 0x140092b57
xor r14b, r14b
test r15b, r15b
je 0x140092b66
cmp ebx, 1
je 0x140092b66
mov r15b, 1
jmp 0x140092b69
xor r15b, r15b
add rdi, 8
lea rax, [rbp + 0xe10]
cmp rdi, rax
jne 0x140092a82
test r14b, r14b
je 0x140092bc3
mov dword [rbp - 0x10], 1
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x6f0]
call fcn.1400c5700
nop
cmp qword [rax + 0x18], 0x10
jb 0x140092ba4
mov rax, qword [rax]
mov r8, rax
lea rdx, str.Settings.LiveGrid.SubmitSuspiciousEmails
mov rcx, rsi
call fcn.140081d80
nop
lea rcx, [rbp + 0x6f0]
call fcn.140085f30
test r15b, r15b
je 0x140092c09
mov dword [rbp - 0xc], 0
lea rdx, [rbp - 0xc]
lea rcx, [rbp + 0x850]
call fcn.1400c5700
nop
cmp qword [rax + 0x18], 0x10
jb 0x140092bea
mov rax, qword [rax]
mov r8, rax
lea rdx, str.Settings.LiveGrid.SubmitSuspiciousEmails
mov rcx, rsi
call fcn.140081d80
nop
lea rcx, [rbp + 0x850]
call fcn.140085f30
lea rdi, [0x1401a55e0]
lea rcx, [rbp + 0x370]
call fcn.14000b680
jmp 0x140092c47
cmp byte [rbp + 0x30], 0
jne 0x140092c47
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
cmp rax, rdi
jne 0x140092c41
call qword [0x14024f048]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140092c47
call qword [case.0x14003c8e9.0]
xor r12d, r12d
mov ebx, r12d
mov dword [rbp - 0x80], ebx
mov byte [rsp + 0x20], 1
mov r9d, 0x2001b
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov rcx, 0xffffffff80000002
call fcn.1401a5450
test al, al
je 0x140092cc0
lea r8, [rbp - 0x80]
lea rdx, str.InstallationStatus
mov rcx, qword [rsp + 0x78]
call fcn.1401a5610
test al, al
je 0x140092caa
lea rdx, str.InstallationStatus
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x78]
call qword [0x14024f048]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [rbp - 0x80]
test ebx, ebx
setne al
xchg byte [rsi + 0x120], al
mov byte [rsp + 0x20], 1
mov r9d, 0x2001b
lea r8, [rsp + 0x78]
lea rdx, str.SoftwareESETESET_SecurityCurrentVersionInfo
mov rcx, 0xffffffff80000002
call fcn.1401a5450
test al, al
je 0x140092dc7
mov r8, qword [rsp + 0x78]
lea rcx, [rbp + 0x100]
call fcn.140035a80
nop
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp + 0x148]
call fcn.1400c57c0
nop
mov dword [rsp + 0x70], r12d
lea r8, [rsp + 0x70]
lea rdx, str.RebootWhenNeeded
mov rcx, qword [rsp + 0x78]
call fcn.1401a5610
test al, al
je 0x140092d6f
cmp dword [rsp + 0x70], 0
je 0x140092d6f
lea rbx, [rsi + 0x12c0]
mov qword [rbp + 0xe0], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov byte [rbx + 0x2c], 1
mov rcx, rbx
call fcn.1401240f0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp byte [rbp + 0x148], 0
jne 0x140092d95
lea rdx, str.RebootWhenNeeded
mov rcx, qword [rbp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
cmp byte [rbp + 0x100], 0
jne 0x140092dc7
mov rax, qword [rbp + 0x108]
mov rcx, qword [rbp + 0x110]
cmp rax, rdi
jne 0x140092dc1
call qword [0x14024f048]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140092dc7
call qword [case.0x14003c8e9.0]
movzx eax, byte [rsi + 0x120]
test al, al
jne 0x140092dfb
mov eax, dword [0x14024fcb8]
cmp eax, 0xffffffff
jne 0x140092df1
mov r9d, 0x47ba
call fcn.1401acbb0
movzx eax, al
mov dword [0x14024fcb8], eax
cmp eax, 1
jne 0x140092dfb
call fcn.140090530
mov rcx, qword [0x14024fa68]
lea r15, [0x14024fa68]
cmp rcx, r15
je 0x140092e36
test byte [rcx + 0x1c], 4
je 0x140092e36
cmp byte [rcx + 0x19], 5
jb 0x140092e36
mov edx, 0x19
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
mov rcx, qword [0x14024fa68]
mov r14, qword [rsi + 0x340]
mov rbx, qword [rsi + 0x338]
cmp rbx, r14
je 0x140092ea5
nop dword [rax]
mov rdi, qword [rbx]
cmp dword [rdi + 8], 0x1000600
je 0x140092e9c
mov rcx, rdi
call fcn.140116940
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x140092e9c
test byte [rcx + 0x1c], 4
je 0x140092e9c
cmp byte [rcx + 0x19], 5
jb 0x140092e9c
mov edx, 0x1a
mov r9d, dword [rdi + 8]
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb50
mov rcx, qword [0x14024fa68]
add rbx, 8
cmp rbx, r14
jne 0x140092e50
cmp rcx, r15
je 0x140092ecb
test byte [rcx + 0x1c], 4
je 0x140092ecb
cmp byte [rcx + 0x19], 5
jb 0x140092ecb
mov edx, 0x1b
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
mov rbx, qword [rsi + 0x338]
mov rdi, qword [rsi + 0x340]
cmp rbx, rdi
je 0x140092f2a
nop
mov rcx, qword [rbx]
mov eax, dword [rcx + 0x28]
cmp eax, 2
je 0x140092ef8
mov eax, dword [rcx + 0x28]
cmp eax, 4
je 0x140092f21
mov eax, dword [rcx + 0x28]
jmp 0x140092f21
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, 0x10046
xor r8d, r8d
xor edx, edx
call fcn.140116e90
add rbx, 8
cmp rbx, rdi
jne 0x140092ee0
lea rax, vtable.ModuleManager_class_NodOsApi::Mutex__class_NodOsApi::ReadPreferringRWLock_.0
mov qword [rbp + 0x530], rax
lea rcx, [0x140250338]
call fcn.140088520
mov edi, dword [rsp + 0x64]
or edi, 0x10
mov dword [rsp + 0x64], edi
and edi, 0xffffffef
mov dword [rsp + 0x64], edi
or edi, 8
mov dword [rsp + 0x64], edi
mov rax, qword [0x140250388]
test rax, rax
je 0x140092f7d
mov rax, qword [rax + 8]
test rax, rax
je 0x140092f7d
mov ecx, 0x597c
call qword [case.0x14003c8e9.0]
and edi, 0xfffffff7
mov dword [rsp + 0x64], edi
lea rcx, [0x140250338]
call fcn.14007f890
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x140092fbd
test byte [rcx + 0x1c], 4
je 0x140092fbd
cmp byte [rcx + 0x19], 5
jb 0x140092fbd
mov edx, 0x1c
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
mov edx, 1
mov rcx, rsi
call fcn.1400fc000
mov qword [rbp + 0x548], r12
mov qword [rbp + 0x550], r12
mov qword [rbp + 0x548], r12
mov qword [rbp + 0x550], 7
mov word [rbp + 0x538], r12w
xor r8d, r8d
lea rdx, [0x1401ef380]
lea rcx, [rbp + 0x538]
call fcn.140003530
nop
lea rdx, [rbp + 0x538]
mov rcx, rsi
call fcn.1400b0e80
nop
mov r8, qword [rbp + 0x550]
cmp r8, 8
jb 0x140093035
inc r8
mov rdx, qword [rbp + 0x538]
call fcn.140003670
mov qword [rbp + 0x548], r12
mov qword [rbp + 0x550], 7
mov word [rbp + 0x538], r12w
mov rcx, qword [rsi + 0x460]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14003c8e9.0]
test eax, eax
je 0x140093097
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x140093097
test byte [rcx + 0x1c], 4
je 0x140093097
cmp byte [rcx + 0x19], 2
jb 0x140093097
mov edx, 0x1d
mov r9d, eax
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb50
mov rcx, qword [rsi + 0x468]
test rcx, rcx
je 0x1400930e4
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14003c8e9.0]
test eax, eax
je 0x1400930e4
mov rcx, qword [0x14024fa68]
cmp rcx, r15
je 0x1400930e4
test byte [rcx + 0x1c], 4
je 0x1400930e4
cmp byte [rcx + 0x19], 2
jb 0x1400930e4
mov edx, 0x1e
mov r9d, eax
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb50
lea r15, [rsi + 0x60]
mov qword [rbp + 0x158], r15
mov byte [rbp + 0x160], 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp byte [rsi + 0x58], 0
je 0x140093114
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400931bf
mov rax, qword [rsi + 0xb0]
cmp qword [rsi + 0x50], rax
ja 0x14009312b
lea rcx, [rsi + 0x40]
call fcn.14007f530
nop
mov ecx, 0x18
call fcn.1401c51ec
mov qword [rbp + 0x20], rax
lea rcx, vtable.ThreadPool::Runnable.0
mov qword [rax], rcx
lea rcx, vtable.ThreadPool::RunnableImpl_class_std::_Binder_struct_std::_Unforced__bool_____thiscall_CHttpServer::__void___class_CHttpServer____ptr64__.0
mov qword [rax], rcx
lea rcx, [fcn.140192a60]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r13
mov qword [rbp - 0x18], rax
or edi, 0x20
mov dword [rsp + 0x64], edi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x30]
lea rcx, [rsi + 0x90]
call fcn.140081120
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14009319a
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14003c8e9.0]
and edi, 0xffffffdf
mov dword [rsp + 0x64], edi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp + 0x160], 0
lea rcx, [rsi + 0x88]
call qword [case.0x1401b9e8b.4]
nop
mov rcx, qword [rsi + 0x6c0]
test rcx, rcx
je 0x1400931d1
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, [rbp + 0x2b8]
lea rcx, [rsi + 0x10]
call fcn.1400f2bf0
nop
mov rax, qword [rax]
movzx ebx, byte [rax + 4]
lea rcx, [rbp + 0x2b8]
call fcn.140009bd0
test bl, bl
je 0x1400932cd
mov dword [rsp + 0x68], 0x8a000000
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.1400f9940
mov rcx, qword [0x14024fa68]
lea rax, [0x14024fa68]
cmp rcx, rax
je 0x14009324d
test byte [rcx + 0x1c], 4
je 0x14009324d
cmp byte [rcx + 0x19], 5
jb 0x14009324d
mov edx, 0x1f
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
xor r13d, r13d
lea rdx, [rbp + 0xf0]
lea rcx, [rsi + 0x10]
call fcn.1400f2bf0
nop
mov rax, qword [rax]
movzx ebx, byte [rax + 5]
lea rcx, [rbp + 0xf0]
call fcn.140009bd0
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x68]
mov rcx, rsi
test bl, bl
je 0x1400933ab
mov dword [rsp + 0x68], 0x8b000000
call fcn.1400f9940
mov rcx, qword [0x14024fa68]
lea rax, [0x14024fa68]
cmp rcx, rax
je 0x1400933ec
test byte [rcx + 0x1c], 4
je 0x1400933ec
cmp byte [rcx + 0x19], 5
jb 0x1400933ec
mov edx, 0x21
jmp 0x1400933dc
xorps xmm0, xmm0
movups xmmword [rbp + 0xe30], xmm0
movups xmmword [rbp + 0xe40], xmm0
movups xmmword [rbp + 0xe50], xmm0
movups xmmword [rbp + 0xe60], xmm0
movups xmmword [rbp + 0xe70], xmm0
movups xmmword [rbp + 0xe80], xmm0
movups xmmword [rbp + 0xe90], xmm0
movups xmmword [rbp + 0xea0], xmm0
mov edx, 0x40
lea rcx, [rbp + 0xe30]
call fcn.1401965a0
xor r13d, r13d
mov ecx, r13d
lea rdx, [rbp + 0xe30]
lea r8, str.erso
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14009334a
cmp rcx, 5
jne 0x140093330
jmp 0x140093250
mov dword [rsp + 0x68], 0xca000000
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.1400f9940
mov rcx, qword [0x14024fa68]
lea rax, [0x14024fa68]
cmp rcx, rax
je 0x140093250
test byte [rcx + 0x1c], 4
je 0x140093250
cmp byte [rcx + 0x19], 5
jb 0x140093250
mov edx, 0x20
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
jmp 0x140093250
mov dword [rsp + 0x68], 0xcb000000
call fcn.1400f9940
mov rcx, qword [0x14024fa68]
lea rax, [0x14024fa68]
cmp rcx, rax
je 0x1400933ec
test byte [rcx + 0x1c], 4
je 0x1400933ec
cmp byte [rcx + 0x19], 5
jb 0x1400933ec
mov edx, 0x22
lea r8, [0x1401fc458]
mov rcx, qword [rcx + 0x10]
call fcn.14008eb30
cmp qword [rsi + 0x6d8], 0
jne 0x140093410
lea rdx, [rsi + 0x6c8]
lea rcx, [0x140067660]
call fcn.1401928f0
mov qword [rsi + 0x6d8], rax
mov rcx, rsi
call fcn.1400f8fc0
mov rcx, rsi
call fcn.1400a9e00
mov qword [rbp + 0x530], r13
lea rcx, [rbp + 0x530]
call fcn.140043fe0
mov eax, dword [rbp + 0x534]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x530]
mov dword [rsp + 0x20], eax
lea r9, str.HIPS:_P_u_R_u
mov edx, 0x80
mov r8, 0xffffffffffffffff
lea rcx, [rbp + 0x12e0]
call fcn.1400138a0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x30], 5
lea rax, [rbp + 0x12e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1000600
mov rcx, rsi
call fcn.140121000
lea r12, [rsi + 0xe10]
mov qword [rbp + 0x118], r15
mov byte [rbp + 0x120], 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp byte [rsi + 0x58], 0
je 0x1400934d9
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140093584
mov rax, qword [rsi + 0xb0]
cmp qword [rsi + 0x50], rax
ja 0x1400934f0
lea rcx, [rsi + 0x40]
call fcn.14007f530
nop
mov ecx, 0x18
call fcn.1401c51ec
mov qword [rbp + 0x20], rax
lea rcx, vtable.ThreadPool::Runnable.0
mov qword [rax], rcx
lea rcx, vtable.ThreadPool::RunnableImpl_class_std::_Binder_struct_std::_Unforced__unsigned_long_int_____thiscall_CDnsCache::__void___class_CDnsCache____ptr64__.0
mov qword [rax], rcx
lea rcx, [fcn.14014ad70]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r12
mov qword [rbp - 0x38], rax
or edi, 0x40
mov dword [rsp + 0x64], edi
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x20]
lea rcx, [rsi + 0x90]
call fcn.140081120
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14009355f
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14003c8e9.0]
and edi, 0xffffffbf
mov dword [rsp + 0x64], edi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp + 0x120], 0
lea rcx, [rsi + 0x88]
call qword [case.0x1401b9e8b.4]
nop
mov qword [rbp + 0x50], r15
mov byte [rbp + 0x58], 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp byte [rsi + 0x58], 0
je 0x1400935aa
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140093654
mov rax, qword [rsi + 0xb0]
cmp qword [rsi + 0x50], rax
ja 0x1400935c1
lea rcx, [rsi + 0x40]
call fcn.14007f530
nop
mov ecx, 0x18
call fcn.1401c51ec
mov qword [rbp + 0x20], rax
lea rcx, vtable.ThreadPool::Runnable.0
mov qword [rax], rcx
lea rcx, vtable.ThreadPool::RunnableImpl_class_std::_Binder_struct_std::_Unforced__void_____thiscall_CDnsCache::__void___class_CDnsCache____ptr64__.0
mov qword [rax], rcx
lea rcx, [0x14014aff0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r12
mov qword [rbp + 0x18], rax
bts edi, 7
mov dword [rsp + 0x64], edi
mov qword [rbp + 0x18], r13
mov qword [rbp - 8], rax
lea rdx, [rbp - 8]
lea rcx, [rsi + 0x90]
call fcn.140081120
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140093631
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14003c8e9.0]
btr edi, 7
mov dword [rsp + 0x64], edi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp + 0x58], 0
lea rcx, [rsi + 0x88]
call qword [case.0x1401b9e8b.4]
nop
movzx eax, byte [rsi + 0x120]
test al, al
je 0x140093674
mov rcx, rsi
call fcn.14011bc60
call fcn.14008ee60
mov rcx, rsi
call fcn.1400c26e0
mov rax, qword [rsi + 0x338]
mov rdx, qword [rsi + 0x340]
cmp rax, rdx
je 0x140093873
nop dword [rax + rax]
mov rcx, qword [rax]
cmp dword [rcx + 8], 0x1000400
je 0x1400936aa
add rax, 8
cmp rax, rdx
jne 0x140093690
jmp 0x140093873
mov eax, dword [rcx + 0x28]
cmp eax, 2
je 0x1400936c6
mov eax, dword [rcx + 0x28]
cmp eax, 4
je 0x140093873
mov eax, dword [rcx + 0x28]
jmp 0x140093873
lea rax, [rbp + 0x2d8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0x28
lea rax, [rbp + 0x560]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, 0x1f01b
xor r8d, r8d
xor edx, edx
call fcn.140116e90
test eax, eax
jne 0x140093873
mov rax, qword [rbp + 0x570]
shr rax, 0x20
test eax, eax
je 0x140093873
call fcn.14008ee60
lea rbx, [rsi + 0x1470]
mov qword [rbp + 0x48], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0xf0], xmm0
mov rdi, qword [rbp + 0x578]
mov rdx, rdi
lea rcx, [rbp + 0xf0]
call fcn.14008f500
mov byte [rsi + 0x1498], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movabs rax, 0xa0009001d0000
cmp qword [rbp + 0x580], rax
jae 0x140093813
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10d0]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rbp + 0x10d0]
call fcn.140195db0
test al, al
je 0x140093813
lea r8, str.Diagnostics_
mov edx, 0x104
lea rcx, [rbp + 0x10d0]
call fcn.1401aed20
mov qword [rbp + 0x530], r13
xor r9d, r9d
lea r8, [rbp + 0x530]
lea edx, [r9 + 1]
lea rcx, str.D:_A_OICI_GA___SY__A_OICI_GA___BA__A_OICI_GW___BU_
call fcn.1401bf6e0
test eax, eax
je 0x140093813
mov r8, qword [rbp + 0x530]
mov edx, 0x80000004
lea rcx, [rbp + 0x10d0]
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
mov rcx, qword [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xorps xmm0, xmm0
movups xmmword [rbp + 0xeb0], xmm0
movups xmmword [rbp + 0xec0], xmm0
movups xmmword [rbp + 0xed0], xmm0
movups xmmword [rbp + 0xee0], xmm0
movups xmmword [rbp + 0xef0], xmm0
movups xmmword [rbp + 0xf00], xmm0
movups xmmword [rbp + 0xf10], xmm0
movups xmmword [rbp + 0xf20], xmm0
mov edx, 0x40
lea rcx, [rbp + 0xeb0]
call fcn.1401965a0
mov r8, rdi
lea rdx, [rbp + 0xeb0]
call fcn.1400f8550
call fcn.14006a380
xorps xmm6, xmm6
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x78
sub r8d, ecx
movsxd rax, r8d
add rax, 0x78
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x140210cb0]
lea rax, [rbp + 0x330]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x368], r13
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_f42026762377f26356d9bf84fb7d5226___void___.0
mov qword [rbp + 0x330], rax
mov qword [rbp + 0x338], rsi
lea rax, [rbp + 0x330]
mov qword [rbp + 0x368], rax
mov dword [rsp + 0x20], 2
movq r9, xmm6
movq r8, xmm0
lea rdx, [rbp + 0x330]
lea rcx, [rsi + 0xd8]
call fcn.14008d500
lea rcx, [rsi + 0x350]
call fcn.140136bd0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x14024f1f8]
mov qword [rsi + 0x10f8], rax
test rax, rax
je 0x1400939ff
lea rax, [0x14007ba90]
mov qword [rsi + 0x1068], rax
mov qword [rsi + 0x10b0], rsi
lea rax, [0x14007bab0]
mov qword [rsi + 0x1070], rax
mov qword [rsi + 0x10b8], rsi
lea rax, [0x14007bad0]
mov qword [rsi + 0x1078], rax
mov qword [rsi + 0x10c0], rsi
lea rax, [0x14007baf0]
mov qword [rsi + 0x1080], rax
mov qword [rsi + 0x10c8], rsi
lea rax, [0x14007bb10]
mov qword [rsi + 0x1088], rax
mov qword [rsi + 0x10d0], rsi
lea rax, [0x14007bb30]
mov qword [rsi + 0x1090], rax
mov qword [rsi + 0x10d8], rsi
lea rax, [0x14007bb50]
mov qword [rsi + 0x1098], rax
mov qword [rsi + 0x10e0], rsi
lea rax, [0x14007bb70]
mov qword [rsi + 0x10a8], rax
mov qword [rsi + 0x10f0], rsi
mov qword [rbp - 0x18], rsi
lea rax, [0x14007bb90]
mov qword [rbp - 0x38], rax
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x38]
lea rcx, [rsi + 0x40]
call fcn.1400c57f0
mov rcx, rsi
call fcn.1400b4780
mov dword [rbp + 0x90], 1
lea rax, [0x1401ef308]
mov qword [rbp + 0x94], rax
lea rax, [0x1400ebed0]
mov qword [rbp + 0xa4], rax
mov qword [rbp + 0x9c], rsi
lea rcx, [rbp + 0x10]
call fcn.14010f540
nop
mov rax, qword [rax]
test rax, rax
je 0x140093a71
mov rax, qword [rax + 0x98]
test rax, rax
je 0x140093a71
mov rax, qword [rax + 8]
test rax, rax
je 0x140093a71
xor r8d, r8d
lea rdx, [rbp + 0x90]
mov ecx, 0x5402
call qword [case.0x14003c8e9.0]
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140093a83
add rcx, 0x48
call fcn.14007f890
mov rcx, rsi
call fcn.1400ad9c0
mov dword [rsi + 0x164], 1
mov rcx, rsi
call fcn.1400b23f0
lea rbx, [rsi + 0x1448]
mov qword [rbp + 0x2c8], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
call fcn.140196fb0
shr eax, 1
test al, 1
je 0x140093b87
mov rcx, rsi
call fcn.1400b7620
lea rcx, [rsi + 0x168]
lea r9, [0x1400b7450]
mov r8, rsi
lea rdx, str.Settings.LiveGrid.SubmitStatisticsChosen
call fcn.140076130
xor r9d, r9d
lea r8, str.Settings.LiveGrid.SubmitStatisticsChosen
lea rdx, [rbp + 0x4d8]
mov rcx, rsi
call fcn.140081c00
nop
xor edx, edx
mov rcx, rax
call fcn.140031060
mov edi, eax
lea rcx, [rbp + 0x4d8]
call fcn.14000b680
test edi, edi
jne 0x140093b87
mov rcx, rsi
call fcn.1400b4a00
movsd xmm0, qword [0x140210ce0]
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x328], r13
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_7e1c0135a47b6e5bdd6ede99ba9f1670___void__class_TimerPool::ThisTimer_.0
mov qword [rbp + 0x2f0], rax
mov qword [rbp + 0x2f8], rsi
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x328], rax
mov dword [rsp + 0x20], r13d
movq r9, xmm0
movq r8, xmm0
lea rdx, [rbp + 0x2f0]
lea rcx, [rsi + 0xd8]
call fcn.14008d650
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call fcn.1400c0e00
mov rax, qword [rsi + 0x13e0]
mov rcx, qword [rsi + 0x13d8]
mov rdx, rcx
cmp rcx, rax
je 0x140093bc1
nop
cmp dword [rdx], 0x2030000
je 0x140093bc1
add rdx, 4
cmp rdx, rax
jne 0x140093bb0
cmp rdx, rax
je 0x140093bed
cmp rcx, rax
je 0x140093bed
nop dword [rax + rax]
cmp dword [rcx], 0x2010000
je 0x140093be1
add rcx, 4
cmp rcx, rax
jne 0x140093bd0
cmp rcx, rax
je 0x140093bed
mov byte [rsi + 0xf80], 1
lea rbx, [rsi + 0x1470]
mov qword [rbp + 0x290], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp byte [rsi + 0x1498], 0
jne 0x140093c19
call fcn.14008fc50
mov byte [rsi + 0x1498], al
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp qword [rbp - 0x58], 8
jb 0x140093c4f
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx + 0x10]
lea rcx, [fcn.140007ea0]
cmp rax, rcx
mov rcx, qword [rbp - 0x70]
jne 0x140093c49
call fcn.140007ea0
jmp 0x140093c4f
call qword [case.0x14003c8e9.0]
mov eax, 1
mov rcx, qword [rbp + 0x1800]
xor rcx, rsp
call fcn.1401c5190
lea r11, [rsp + 0x1920]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret