Function at 0x140199f40
Capabilities:
Accept command line arguments
Check os version
Create directory
Create thread
Get system information on windows
Initialize iwebbrowser2

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1dd8]
mov eax, 0x1ed8
call fcn.140247340
sub rsp, rax
mov qword [rbp + 0x190], 0xfffffffffffffffe
mov r12, rcx
xor esi, esi
mov dword [rbp + 0x1e28], esi
mov r9d, 1
mov r8d, r9d
lea rdx, str.SAS_Init
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
lea ecx, [rsi + 0x10]
call fcn.14018ef40
mov rdi, rax
mov qword [rbp + 0x1e28], rax
test rax, rax
je 0x140199fe7
lea rbx, [rax + 8]
mov qword [rbx], rsi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rdi], 1
mov qword [rsp + 0x20], rbx
lea r9, [0x1402d7280]
xor edx, edx
lea r8d, [rsi + 4]
lea rcx, [0x1402d72b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rdi], eax
jmp 0x140199fea
mov rdi, rsi
mov r13d, 0x20
mov rbx, qword [0x1403534d0]
mov qword [0x1403534d0], rdi
test rbx, rbx
je 0x14019a020
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea edx, [r13 - 0x10]
mov rcx, rbx
call fcn.140247060
cmp dword [0x14037adb8], 0
je 0x14019a073
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x10]
call fcn.140249b10
mov r8d, 0x1061
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x10]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp - 0x10]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x14019caae
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14018ef40
mov rdi, rax
mov qword [rbp + 0x1e28], rax
test rax, rax
je 0x14019a0b6
lea rbx, [rax + 8]
mov qword [rbp + 0x1e30], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
mov dword [rdi], 0xffffff
jmp 0x14019a0b9
mov rdi, rsi
mov qword [0x14037d070], rdi
mov dword [rdi], 0xff
mov r8b, 0x1e
mov edx, 0x3fffff
mov rcx, qword [0x14037d070]
call fcn.140190440
mov r8b, 0x46
mov edx, 0x3fffff
mov rcx, qword [0x14037d070]
call fcn.140190440
mov r8b, 0x64
mov edx, 0xff
mov rcx, qword [0x14037d070]
call fcn.140190440
xor edx, edx
mov r8d, 0x9c
lea rcx, [rbp + 0xf0]
call fcn.140249b10
mov dword [rbp + 0xf0], 0x9c
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, 0xffffffffffffffff
test rax, rax
je 0x14019a23c
mov dword [rbp + 0x1a0], 0x11c
lea rcx, [rbp + 0x1a0]
call rax
mov eax, dword [rbp + 0x1b0]
mov dword [rbp + 0x100], eax
mov eax, dword [rbp + 0x1ac]
mov dword [rbp + 0xfc], eax
mov eax, dword [rbp + 0x1a4]
mov dword [rbp + 0xf4], eax
mov eax, dword [rbp + 0x1a8]
mov dword [rbp + 0xf8], eax
movzx eax, byte [rbp + 0x2ba]
mov byte [rbp + 0x18a], al
movzx eax, byte [rbp + 0x2bb]
mov byte [rbp + 0x18b], al
movzx eax, word [rbp + 0x2b4]
mov word [rbp + 0x184], ax
movzx eax, word [rbp + 0x2b6]
mov word [rbp + 0x186], ax
movzx eax, word [rbp + 0x2b8]
mov word [rbp + 0x188], ax
lea rcx, [rbp + 0x1b4]
mov rax, r15
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14019a1f0
lea r9d, [rax + 1]
lea rcx, [rbp + 0x1e28]
mov qword [rsp + 0x38], rcx
lea rcx, [0x1402860c8]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x104]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x1b4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movzx eax, word [rbp + 0x186]
movzx ecx, word [rbp + 0x184]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbp + 0xf8]
mov r8d, dword [rbp + 0xf4]
lea rdx, str.Operating_System____d._d_SP___d._d__
lea rcx, [rbp + 0xdd0]
call fcn.140006bc0
mov edi, 1
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0xdd0]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, dword [rbp + 0xf8]
mov r8d, dword [rbp + 0xf4]
lea rdx, str._d._d
lea rcx, [0x14037b080]
call fcn.140006bc0
movzx r9d, word [rbp + 0x186]
movzx r8d, word [rbp + 0x184]
lea rdx, str._d._d
lea rcx, [0x14037b280]
call fcn.140006bc0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x1091
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ebx, ax
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x5b0]
call fcn.140249b10
mov r8d, 0x400
lea rdx, [rbp + 0x5b0]
mov ecx, ebx
call sub.KERNEL32.dll_VerLanguageNameA
lea r9, [rbp + 0x5b0]
mov r8d, ebx
lea rdx, str.Language____x______s__
lea rcx, [rbp + 0xdd0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0xdd0]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x10]
call fcn.140249b10
mov r8d, 0x100
lea rdx, [rbp - 0x10]
lea rcx, [0x14034ea2c]
call fcn.1400e31f0
test eax, eax
je 0x14019a3e6
mov rcx, rsi
lea rdx, [0x14037af80]
nop dword [rax]
movzx eax, byte [rbp + rcx - 0x10]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14019a3c0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x10]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
lea rcx, [0x1402c5710]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x40]
test rax, rax
je 0x14019a42a
call rax
jmp 0x14019a430
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x10ac
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
movzx ecx, word [rbp - 0x40]
mov r9d, edi
mov r8d, edi
test ecx, ecx
je 0x14019a525
sub ecx, 9
je 0x14019a4f6
cmp ecx, edi
lea rcx, vtable.CSASApplicationLogManager.0
je 0x14019a4bf
lea rdx, str.Unknown_Unsupported_Architecture
call fcn.140004a50
movabs rax, 0x6e776f6e6b6e55
mov qword [0x14037b380], rax
jmp 0x14019a542
lea rdx, str.x86_on_Win64_Architecture
call fcn.140004a50
movsd xmm0, qword [str.x86_on_Win64]
movsd qword [0x14037b380], xmm0
mov eax, dword [0x1402c5780]
mov dword [0x14037b388], eax
movzx eax, byte [0x1402c5784]
mov byte [0x14037b38c], al
jmp 0x14019a542
lea rdx, str.AMD64_Architecture
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov eax, dword [str.AMD64]
mov dword [0x14037b380], eax
movzx eax, word [reloc.WSOCK32.dll_gethostbyname]
mov word [0x14037b384], ax
jmp 0x14019a542
lea rdx, str.x86_Architecture
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [0x14037b380], 0x363878
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x10c6
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, vtable.CSABString.0
cmp dword [rbp + 0x100], 2
jne 0x14019a9a4
cmp qword [0x14037adc8], 0
je 0x14019a8ff
test byte [0x14034e698], 4
je 0x14019a648
mov rbx, qword [0x14034e4d8]
mov qword [rbx + 0x88], r12
mov dword [rbx + 0x90], 0x80c
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9c402024
mov rcx, rbx
call fcn.14019fb60
lea r8, str.SASProcessMonitorEvent
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov qword [rbx + 0xa8], rax
test rax, rax
je 0x14019a641
mov dword [rbx + 0xa0], edi
lea rax, [rbp + 0x1e28]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, rbx
lea r8, [0x140196d10]
mov edx, 0x100000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rbx, vtable.CSABString.0
cmp dword [0x140350898], 0
je 0x14019a8ff
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], 4
lea ecx, [rax + 5]
call fcn.140247068
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14019a69f
mov r8d, dword [rbp - 0x80]
inc r8d
lea rdx, [0x140287fe4]
mov rcx, rax
call fcn.1402496a0
mov dword [rbp - 0x7c], edi
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x68], 4
mov ecx, 5
call fcn.140247068
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14019a6da
mov r8d, dword [rbp - 0x68]
inc r8d
lea rdx, [0x140287fe4]
mov rcx, rax
call fcn.1402496a0
mov dword [rbp - 0x64], edi
cmp dword [0x14035089c], 0
je 0x14019a8b8
lea rsi, [0x140350584]
mov rax, r15
inc rax
cmp byte [rsi + rax], 0
jne 0x14019a6f4
test rax, rax
je 0x14019a8b8
mov qword [rbp - 0x60], rbx
mov rbx, r15
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14019a710
mov dword [rbp - 0x50], ebx
lea eax, [rbx + 1]
mov r14d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14019a743
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call fcn.1402496a0
mov dword [rbp - 0x4c], 1
mov rsi, qword [rsp + 0x78]
mov ecx, dword [rbp - 0x80]
inc ecx
add ecx, ebx
call fcn.140247068
mov rbx, rax
test rsi, rsi
je 0x14019a78e
mov rdx, rsi
mov r8, rax
sub r8, rsi
nop dword [rax]
movzx eax, byte [rdx]
mov byte [rdx + r8], al
lea rdx, [rdx + 1]
test al, al
jne 0x14019a770
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x78], rbx
jmp 0x14019a793
mov qword [rsp + 0x78], rax
test rbx, rbx
je 0x14019a7bd
mov ecx, dword [rbp - 0x80]
add rcx, rbx
mov r8, r14
mov rdx, rdi
call fcn.1402496a0
mov rcx, qword [rsp + 0x78]
mov rax, r15
inc rax
cmp byte [rcx + rax], 0
jne 0x14019a7b1
mov dword [rbp - 0x80], eax
test rdi, rdi
je 0x14019a7ca
mov rcx, rdi
call fcn.140247060
lea rax, vtable.CSABString.0
mov qword [rbp - 0x60], rax
lea rsi, [0x140350688]
mov rbx, r15
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14019a7e0
mov dword [rbp - 0x50], ebx
lea eax, [rbx + 1]
mov r14d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14019a813
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call fcn.1402496a0
mov dword [rbp - 0x4c], 1
mov rsi, qword [rbp - 0x70]
mov ecx, dword [rbp - 0x68]
inc ecx
add ecx, ebx
call fcn.140247068
mov rbx, rax
test rsi, rsi
je 0x14019a85d
mov rdx, rsi
mov r8, rax
sub r8, rsi
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx + r8], al
lea rdx, [rdx + 1]
test al, al
jne 0x14019a840
mov rcx, rsi
call fcn.140247060
mov qword [rbp - 0x70], rbx
jmp 0x14019a861
mov qword [rbp - 0x70], rax
test rbx, rbx
je 0x14019a88c
mov ecx, dword [rbp - 0x68]
add rcx, rbx
mov r8, r14
mov rdx, rdi
call fcn.1402496a0
mov rcx, qword [rbp - 0x70]
mov rax, r15
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14019a880
mov dword [rbp - 0x68], eax
test rdi, rdi
je 0x14019a899
mov rcx, rdi
call fcn.140247060
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
mov edi, 1
lea rbx, vtable.CSABString.0
lea r8, [rsp + 0x50]
mov edx, edi
mov rcx, qword [0x14034e4d8]
call fcn.1401a06f0
nop
mov qword [rbp - 0x78], rbx
add dword [rbp - 0x64], 0xffffffff
jne 0x14019a8e5
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14019a8e5
call fcn.140247060
nop
mov qword [rsp + 0x70], rbx
add dword [rbp - 0x7c], 0xffffffff
jne 0x14019a8ff
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14019a8ff
call fcn.140247060
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x10ea
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp dword [rbp + 0xf4], 6
jb 0x14019a9a4
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14019a9a4
lea rdx, str.ChangeWindowMessageFilter
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14019a9a4
mov edx, edi
mov ecx, 0x4a
call rbx
mov edx, edi
mov ecx, dword [0x140353510]
call rbx
mov edx, edi
mov ecx, dword [0x140353514]
call rbx
mov edx, edi
mov ecx, dword [0x14034e67c]
call rbx
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x110c
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x110f
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp dword [0x140350790], 0
je 0x14019ac01
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x1114
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9, qword [0x1403517c0]
mov rbx, qword [0x1403516b8]
mov eax, dword [rbx + 0x40]
mov dword [r9 + 0x3c], eax
mov rax, qword [rbx + 0x20]
mov rsi, qword [rax]
mov r14, qword [rsi + 8]
mov r8, r14
mov rdx, rsi
lea rcx, [rbx + 0x20]
call fcn.14018bde0
mov rdx, rax
mov rax, qword [rbx + 0x28]
movabs rcx, 0x333333333333332
sub rcx, rax
cmp rcx, 1
jb 0x14019cacf
inc rax
mov qword [rbx + 0x28], rax
mov qword [rsi + 8], rdx
mov qword [r14], rdx
cmp dword [rbx + 0x30], 0
je 0x14019aafb
mov rcx, rbx
call fcn.140196c30
mov ecx, dword [rbx + 0x40]
lea eax, [rcx + 1]
mov dword [rbx + 0x40], eax
mov dword [0x14033d1a0], ecx
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x1119
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov edi, 1
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
call fcn.140238fc0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x111e
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [0x1403516b8]
call fcn.140196c30
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x1123
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor esi, esi
mov r14d, esi
mov ecx, 0x2da0
call fcn.14018ef40
mov qword [rbp + 0x1e28], rax
test rax, rax
je 0x14019ac2d
mov rdx, qword [0x14037adb0]
mov rcx, rax
call fcn.1400771d0
jmp 0x14019ac30
mov rax, rsi
mov qword [0x1403517c8], rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x112c
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ecx, 0x4a0
call fcn.14018ef40
mov qword [rbp + 0x1e28], rax
test rax, rax
je 0x14019aca9
mov rdx, qword [0x14037adb0]
mov rcx, rax
call fcn.140078a00
jmp 0x14019acac
mov rax, rsi
mov qword [0x1403517d0], rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x1130
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [0x140351044]
cmp qword [0x1403534f0], 0
je 0x14019b7da
mov r9d, edi
mov r8d, edi
lea rdx, str.First_Time_Run
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov qword [0x1403508d4], rsi
mov dword [0x140350f24], esi
lea rcx, [0x140350820]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [0x140350810]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov r14d, esi
mov rax, qword [0x1403534f0]
cmp dword [rax], esi
setne r14b
mov dword [rbp + 0x1e30], r14d
cmp dword [rax + 4], 0
je 0x14019af0d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x114a
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rbx, qword [0x14037ae08]
lea rcx, [rbp - 0x78]
call fcn.140253e44
cmp rax, 0xffffffffffffffff
je 0x14019aeb5
lea rcx, [rbp - 0x78]
call fcn.140253980
test rax, rax
je 0x14019aeb5
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp - 0x20], eax
lea rcx, [rbp - 0x40]
call fcn.140253da4
mov rdi, rax
mov rcx, qword [rbx + 0xf8]
mov r10, qword [rcx]
lea r8, [rbx + 0x78]
mov qword [rsp + 0x48], rsi
lea rax, [rbp + 0x1e38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x20006
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov rdx, 0xffffffff80000000
call qword [r10 + 0x118]
test eax, eax
jne 0x14019aeb0
mov dword [rbp + 0x1e28], edi
mov rcx, qword [rbx + 0xf8]
mov rax, qword [rcx]
mov dword [rsp + 0x30], 4
lea rdx, [rbp + 0x1e28]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea r8, [0x14029b668]
mov rdx, qword [rbp + 0x1e38]
call qword [rax + 0x1b0]
mov rcx, qword [rbx + 0xf8]
mov rax, qword [rcx]
mov rdx, qword [rbp + 0x1e38]
call qword [rax + pe_nt_image_headers64]
mov edi, 1
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x114f
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov dword [0x14034e690], edi
lea rbx, [0x140351044]
lea rcx, [0x1403508a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov r8d, 0x104
lea rdx, [0x14034ea2c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x115b
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9d, edi
mov r8d, 0x400
lea rdx, [0x14034ea2c]
lea rcx, [0x140296e88]
call fcn.1400ea960
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x1160
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rcx, [0x14034e908]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [0x14034e918]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x1045
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r8d, dword [0x14034e690]
test r8d, r8d
jne 0x14019b06d
mov eax, dword [str.FREE]
mov dword [0x14035146c], eax
movzx eax, byte [0x1402c4adc]
mov byte [0x140351470], al
jmp 0x14019b077
mov dword [0x14035146c], 0x4f5250
cmp byte [0x140351044], 0
je 0x14019b0c0
lea rcx, [0x14035146c]
lea rdx, [rcx - 1]
nop dword [rax + rax]
lea rdx, [rdx + 1]
cmp byte [rdx], 0
jne 0x14019b090
movzx eax, word [0x1402997b4]
mov word [rdx], ax
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x14019b0a6
xor edx, edx
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14019b0b1
test r8d, r8d
jne 0x14019b7b9
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
mov r8d, 0x116c
lea rdx, [0x140286ae4]
lea rcx, [rbp + 0x1a0]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x1a0]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, vtable.CSABString.0
mov qword [rsp + 0x70], rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x7c], edi
test rax, rax
je 0x14019b14d
mov rcx, rax
call fcn.140247060
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], 0x2c
mov ecx, 0x2d
call fcn.140247068
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14019b19d
movups xmm0, xmmword [str.metrics.php_eventVIEWxappendyescampaign]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402b4c38]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1402b4c48]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x1402b4c50]
mov dword [rax + 0x28], ecx
movzx ecx, byte [0x1402b4c54]
mov byte [rax + 0x2c], cl
mov qword [rbp + 0x1e38], rsi
mov dword [rbp + 0x1e28], esi
lea rax, vtable.CSABInternet.0
mov qword [rbp - 0x10], rax
lea rax, vtable.CSABByteString.0
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x18], rsi
mov rcx, rdi
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x14019b1fb
mov r8, qword [rbp + 0x28]
inc r8
mov rcx, rax
call fcn.1402496a0
mov rdx, rdi
mov rcx, qword [rbp + 0x18]
call fcn.140247060
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rdi
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.14000af20
nop
mov dword [rbp + 0x30], esi
mov qword [rbp + 8], rsi
mov ecx, 8
call fcn.140247068
mov qword [rbp - 8], rax
lea r8, str.SAS_APP
mov edx, 8
mov rcx, rax
call fcn.140253604
mov dword [rbp], edi
lea rax, vtable.CSABInternet_TryAll.0
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x38], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rsi
mov dword [rbp + 0x58], esi
movdqa xmm0, xmmword [0x14029c3d0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov r8d, 0x48
lea rdx, str.https:__secure.superantispyware.com_content_popup_free_post_install.html
lea rcx, [rbp - 0x40]
call fcn.1400b29c0
nop
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
mov r12d, esi
mov r8d, 8
lea rdx, str.https:__
mov rcx, rbx
call fcn.140250bd8
test eax, eax
jne 0x14019b2b3
mov r12d, edi
jmp 0x14019b2d0
mov r8d, 7
lea rdx, [0x1402b4988]
mov rcx, rbx
call fcn.140250bd8
test eax, eax
jne 0x14019b959
lea rdx, [0x1402b4990]
mov rcx, rbx
call fcn.140248db4
mov r14, rax
test rax, rax
je 0x14019b959
add r14, 3
mov edx, PathResolve
mov rcx, r14
call fcn.14024a10c
mov r15, rax
test rax, rax
je 0x14019b94b
mov ecx, r15d
sub ecx, r14d
mov ebx, ecx
inc ecx
mov edi, ecx
call fcn.140247068
mov rsi, rax
mov r9d, ebx
mov r8, r14
mov edx, edi
mov rcx, rax
call fcn.1402532e8
mov dword [rsp + 0x40], r12d
xor eax, eax
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x1e28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1e38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100000
mov r9, r15
mov r8d, r12d
mov rdx, rsi
lea rcx, [rbp - 0x10]
mov rax, qword [rbp - 0x10]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, eax
mov edi, 1
mov edx, edi
mov rcx, rsi
call fcn.140247060
test ebx, ebx
je 0x14019b94b
mov r8d, dword [rbp + 0x1e28]
xor esi, esi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], SafeArrayUnaccessData
mov byte [rsp + 0x50], sil
mov rdx, qword [rbp + 0x1e38]
lea rcx, [rsp + 0x50]
call fcn.1400b29c0
nop
mov ecx, dword [rbp + 0x1e28]
inc ecx
mov eax, 2
mul rcx
mov rbx, rax
mov r15, 0xffffffffffffffff
cmovo rbx, r15
mov rcx, rbx
call fcn.140247068
mov rdi, rax
test rax, rax
je 0x14019b3f0
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140249b10
jmp 0x14019b3f3
mov rdi, rsi
mov qword [rbp - 0x78], rdi
mov r13d, 0x60
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r8, qword [rsp + 0x50]
mov eax, dword [rbp + 0x1e28]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8d, dword [rbp + 0x1e28]
inc r8d
movdqa xmm0, xmmword [0x14029c3c0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], si
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.1400b2b10
mov rcx, qword [rbp + 0x1e38]
test rcx, rcx
je 0x14019b546
call fcn.140247060
mov qword [rbp + 0x1e38], rsi
mov dword [rbp + 0x1e28], esi
lea r10, [rbp - 0x60]
mov rbx, qword [rbp - 0x60]
mov rsi, qword [rbp - 0x48]
cmp rsi, 8
cmovae r10, rbx
mov rax, qword [rbp - 0x50]
cmp rax, 7
jb 0x14019b544
lea r11, [rax - 6]
lea r11, [r10 + r11*2]
mov rcx, r10
lea r14, str.target:
nop
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x14019b544
cmp word [rcx], 0x74
je 0x14019b4cf
add rcx, 2
sub rax, 1
jmp 0x14019b4b9
test rcx, rcx
je 0x14019b544
mov r8d, 7
mov rdx, r14
mov r9, rcx
sub r9, r14
movzx eax, word [rdx]
cmp word [rdx + r9], ax
jne 0x14019b53b
add rdx, 2
sub r8, 1
jne 0x14019b4e3
sub rcx, r10
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14019b544
lea rax, [rbp - 0x60]
cmp rsi, 8
cmovae rax, rbx
mov qword [rsp + 0x20], rax
lea r9, [0x140196410]
mov r8, qword [rbp + 0x1e20]
mov edx, 0x42
mov rcx, qword [0x14034e658]
call qword [sym.imp.USER32.dll_DialogBoxParamA]
mov rbx, rax
xor esi, esi
jmp 0x14019b56d
add rcx, 2
jmp 0x14019b4b0
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9, [0x140196030]
mov r8, qword [rbp + 0x1e20]
mov edx, 0x42
mov rcx, qword [0x14034e658]
call qword [sym.imp.USER32.dll_DialogBoxParamA]
mov ebx, eax
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14019b5ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019b5a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14019cadc
call fcn.140247060
movdqa xmm0, xmmword [0x14029c3c0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], si
test rdi, rdi
je 0x14019b5cc
mov rcx, rdi
call fcn.140247060
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14019b609
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019b604
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14019cae2
call fcn.140247060
cmp ebx, 1
jne 0x14019b954
mov edx, 0x118f
mov r9d, ebx
mov r8d, ebx
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov dword [0x14034e690], ebx
mov dword [0x14034e8fc], ebx
mov dword [0x1403507ac], ebx
mov dword [0x14034e6a0], ebx
xor edx, edx
lea ecx, [rbx + 7]
mov r9d, ebx
mov r8d, ebx
call fcn.1402239f0
xor edx, edx
lea ecx, [rbx + 1]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov r8d, ebx
call fcn.1402238c0
lea rax, vtable.CSABString.0
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x50], SafeArrayGetDim
lea ecx, [rbx + 0xe]
call fcn.140247068
mov rdi, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14019b6c5
movsd xmm0, qword [str.sasrpi_tri_acc]
movsd qword [rax], xmm0
mov ecx, dword [0x1402c5858]
mov dword [rax + 8], ecx
movzx ecx, word [0x1402c585c]
mov word [rax + 0xc], cx
movzx ecx, byte [0x1402c585e]
mov byte [rax + 0xe], cl
mov dword [rbp - 0x4c], 1
mov rsi, qword [rsp + 0x78]
mov ecx, 0x3b
call fcn.140247068
mov rbx, rax
test rsi, rsi
je 0x14019b70d
mov rcx, rsi
mov rdx, rax
sub rdx, rsi
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14019b6f0
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x78], rbx
jmp 0x14019b712
mov qword [rsp + 0x78], rax
test rbx, rbx
je 0x14019b74c
movsd xmm0, qword [rdi]
movsd qword [rbx + 0x2c], xmm0
mov ecx, dword [rdi + 8]
mov dword [rbx + 0x34], ecx
movzx ecx, word [rdi + 0xc]
mov word [rbx + 0x38], cx
movzx eax, byte [rdi + 0xe]
mov byte [rbx + 0x3a], al
mov rax, r15
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x14019b740
mov dword [rbp - 0x80], eax
test rdi, rdi
je 0x14019b759
mov rcx, rdi
call fcn.140247060
mov edi, 1
mov r9d, edi
mov r8d, edi
mov edx, 0x11af
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
nop
lea rcx, [rbp - 0x40]
call fcn.14007c450
nop
lea rcx, [rbp - 0x10]
call fcn.1400e3a90
nop
cmp dword [rbp - 0x7c], 1
jne 0x14019b79d
test rbx, rbx
je 0x14019b79d
mov rcx, rbx
call fcn.140247060
xor esi, esi
mov r12, qword [rbp + 0x1e20]
mov r14d, dword [rbp + 0x1e30]
mov r8d, dword [0x14034e690]
test r8d, r8d
je 0x14019b7da
mov r9d, edi
mov r8d, edi
mov edx, 0x11b5
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.140227160
call fcn.1401bfb60
mov r9d, edi
mov r8d, edi
mov edx, 0x11c0
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor r9d, r9d
xor r8d, r8d
mov edx, 0x812
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageA]
mov r9d, edi
mov r8d, edi
mov edx, 0x11c2
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea r12, vtable.CSABString.0
cmp dword [0x14034e684], 0
je 0x14019b98b
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
mov rcx, rdi
call fcn.140247068
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14019b867
mov r8d, dword [rsp + 0x60]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x64], edi
or r13d, 1
mov dword [rbp + 0x1e28], r13d
lea rdx, [rsp + 0x50]
lea rcx, str.task
call fcn.1400df720
test eax, eax
jne 0x14019b98b
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], rsi
mov dword [rbp - 0x68], esi
mov rcx, rdi
call fcn.140247068
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14019b8c1
mov r8d, dword [rbp - 0x68]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rbp - 0x64], edi
or r13d, 2
mov dword [rbp + 0x1e28], r13d
lea rdx, [rbp - 0x78]
lea rcx, str.UPDATERESULTS
call fcn.1400df720
test eax, eax
jne 0x14019b98b
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rsi
mov dword [rbp - 0x80], esi
mov rcx, rdi
call fcn.140247068
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14019b91c
mov r8d, dword [rbp - 0x80]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rbp - 0x7c], edi
or r13d, 4
mov dword [rbp + 0x1e28], r13d
lea rdx, [rsp + 0x70]
lea rcx, str.silent
call fcn.1400df720
test eax, eax
jne 0x14019b98b
cmp dword [0x14034e678], eax
jne 0x14019b98b
mov bl, 1
jmp 0x14019b98d
mov r15, 0xffffffffffffffff
jmp 0x14019b959
mov edi, 1
mov r9d, edi
mov r8d, edi
mov edx, 0x11a5
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rdx, str.sasrpi_tri_dec
lea rcx, [rsp + 0x70]
call fcn.1400fba30
mov rbx, qword [rsp + 0x78]
jmp 0x14019b75e
xor bl, bl
test r13b, 4
je 0x14019b9b2
and r13d, 0xfffffffb
mov qword [rsp + 0x70], r12
add dword [rbp - 0x7c], 0xffffffff
jne 0x14019b9b2
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14019b9b2
call fcn.140247060
nop
test r13b, 2
je 0x14019b9d5
and r13d, 0xfffffffd
mov qword [rbp - 0x78], r12
add dword [rbp - 0x64], 0xffffffff
jne 0x14019b9d5
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14019b9d5
call fcn.140247060
nop
test r13b, 1
je 0x14019b9fa
and r13d, 0xfffffffe
mov qword [rsp + 0x50], r12
add dword [rsp + 0x64], 0xffffffff
jne 0x14019b9fa
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019b9fa
call fcn.140247060
test bl, bl
je 0x14019ba36
mov r9d, edi
mov r8d, edi
mov edx, 0x11cd
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov ecx, 0xa
call fcn.1400ea400
mov r9d, edi
mov r8d, edi
mov edx, 0x11d2
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov rbx, qword [0x14037ae08]
test rbx, rbx
je 0x14019bacf
mov edi, dword [0x14034e8d4]
test edi, edi
jne 0x14019ba5f
cmp byte [0x14034e8d8], dil
je 0x14019bbec
jmp 0x14019ba6b
movzx esi, byte [0x14034e8d8]
test sil, sil
je 0x14019ba96
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034e8d8]
mov rcx, rbx
call fcn.1400e8490
movzx esi, byte [0x14034e8d8]
mov edi, dword [0x14034e8d4]
mov rbx, qword [0x14037ae08]
jmp 0x14019baa0
mov edx, edi
mov rcx, rbx
call fcn.140193360
test eax, eax
je 0x14019bbe3
mov dword [0x14034e690], 1
test sil, sil
je 0x14019bbd7
lea rdx, [0x14034e8d8]
mov rcx, rbx
call fcn.1401a08b0
mov edi, 1
mov r9d, edi
mov r8d, edi
mov edx, 0x11d8
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.140227470
mov r9d, edi
mov r8d, edi
mov edx, 0x11dd
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
lea r8, str.SoftwareSUPERAntiSpyware.comSUPERAntiSpyware
mov rdx, 0xffffffff80000001
call fcn.14002aa50
mov r9d, edi
mov r8d, edi
mov edx, 0x11e2
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov qword [rsp + 0x50], r12
xor esi, esi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
mov rcx, rdi
call fcn.140247068
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14019bb73
mov r8d, dword [rsp + 0x60]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x64], edi
lea rdx, [rsp + 0x50]
lea rcx, str.forcedefinitionupdate
call fcn.1400df720
mov ebx, eax
mov qword [rsp + 0x50], r12
add dword [rsp + 0x64], 0xffffffff
jne 0x14019bba5
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019bba5
call fcn.140247060
test ebx, ebx
cmovne r14d, edi
mov rcx, qword [0x1403517c8]
cmp dword [0x1403508e0], 0
je 0x14019be55
lea rdx, [0x14034e928]
call fcn.1400787f0
lea rdx, [0x14034e928]
jmp 0x14019be68
mov dword [rbx + 0x2c], edi
mov byte [rbx + 0x30], 0
jmp 0x14019baca
xor edx, edx
xor ecx, ecx
call fcn.1400fcba0
cmp dword [0x14034e690], 0
je 0x14019baca
call fcn.1401eb980
test eax, eax
je 0x14019baca
call fcn.140192940
cmp dword [0x140350f20], eax
ja 0x14019baca
mov rcx, qword [0x140351888]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14019bc3f
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rcx, qword [0x140351888]
call qword [sym.imp.USER32.dll_PostMessageA]
mov r8, qword [0x14037ae08]
mov rdx, qword [0x14034e658]
mov rcx, qword [0x14034e650]
call fcn.1400e8a80
mov rbx, rax
mov qword [rsp + 0x70], r12
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x78], rax
xor edx, edx
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov edi, 1
mov dword [rbp - 0x7c], edi
test rax, rax
je 0x14019bc95
mov rcx, rax
call fcn.140247060
xor eax, eax
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x80], 0x2c
mov ecx, 0x2d
call fcn.140247068
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14019bce5
movups xmm0, xmmword [str.metrics.php_eventVIEWxappendyescampaign]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402b4c38]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1402b4c48]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x1402b4c50]
mov dword [rax + 0x28], ecx
movzx ecx, byte [0x1402b4c54]
mov byte [rax + 0x2c], cl
cmp ebx, 0x402
jne 0x14019bd2c
lea rdx, str.sasrpi_exp_pur
lea rcx, [rsp + 0x70]
call fcn.1400fba30
lea rax, str.iealmr
mov qword [0x1403517e8], rax
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x209
mov rcx, qword [0x14034e650]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x14019bdc5
cmp ebx, 0x404
jne 0x14019bd50
lea rdx, str.sasrpi_exp_dec
lea rcx, [rsp + 0x70]
call fcn.1400fba30
xor edx, edx
xor ecx, ecx
call fcn.1400fcba0
jmp 0x14019bdc5
cmp ebx, 0x401
jne 0x14019bd94
lea rdx, str.sasrpi_exp_acc
lea rcx, [rsp + 0x70]
call fcn.1400fba30
lea rax, str.iealmp
mov qword [0x1403517e8], rax
mov r9, r15
mov edx, 0x111
mov r8d, 0x208
mov rcx, qword [0x14034e650]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x14019bdc5
cmp ebx, 0x406
jne 0x14019bda5
lea rdx, str.sasrpi_exp_set
jmp 0x14019bdbb
cmp ebx, 0x400
lea rdx, str.sasrpi_exp_clo
je 0x14019bdbb
lea rdx, str.sasrpi_exp_unk
lea rcx, [rsp + 0x70]
call fcn.1400fba30
mov r8d, edi
lea rdx, [0x1402b4cb8]
lea rcx, [rbp - 0x10]
call fcn.1400e3850
lea rax, vtable.CSABInternet_TryAll.0
mov qword [rbp - 0x10], rax
xor eax, eax
mov qword [rbp + 0x38], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x58], eax
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov rbx, qword [rsp + 0x78]
mov r9, rbx
mov r8d, edi
lea rdx, str.www.superantispyware.com
lea rcx, [rbp - 0x10]
call fcn.1400e6ad0
nop
lea rcx, [rbp - 0x10]
call fcn.1400e3a90
nop
cmp dword [rbp - 0x7c], 1
jne 0x14019bacf
test rbx, rbx
je 0x14019bacf
mov rcx, rbx
call fcn.140247060
jmp 0x14019bacf
lea rdx, [0x14034eb30]
call fcn.1400787f0
lea rdx, [0x14034eb30]
mov rcx, qword [0x1403517d0]
call fcn.14003af00
mov ecx, dword [0x1403508e0]
cmp qword [0x1403534f0], 0
jne 0x14019be88
test ecx, ecx
je 0x14019be8d
call fcn.1401b2eb0
call fcn.140192ca0
mov r9d, edi
mov r8d, edi
mov edx, 0x1200
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.1401b2170
cmp eax, 0x800
je 0x14019bf1e
mov r9d, edi
mov r8d, edi
mov edx, 0x1205
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.1401b33c0
test eax, eax
je 0x14019bf13
mov r9d, edi
mov r8d, edi
mov edx, 0x120a
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.1401b2170
cmp eax, 0x800
cmovne r14d, edi
mov r9d, edi
mov r8d, edi
mov edx, 0x1210
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
jmp 0x14019bf1e
cmp dword [0x14034e900], 0
cmovne r14d, edi
cmp qword [0x1403517f8], 0
je 0x14019bf43
call fcn.140192ef0
test eax, eax
je 0x14019bf43
mov rcx, qword [0x1403517f8]
call fcn.140005370
test eax, eax
cmovne r14d, edi
cmp dword [0x140350478], 0x2c6f
cmovb r14d, edi
mov dword [rbp + 0x1e30], r14d
mov r9d, edi
mov r8d, edi
mov edx, 0x1226
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov edi, dword [0x140350478]
mov rbx, qword [0x14037ae08]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14019bf8e
call fcn.140247060
mov qword [rbx + 0x48], rsi
lea rsi, [0x14034f000]
inc r15
cmp byte [rsi + r15], 0
jne 0x14019bf95
mov dword [rbx + 0x50], r15d
lea ecx, [r15 + 1]
call fcn.140247068
mov qword [rbx + 0x48], rax
test rax, rax
je 0x14019bfc7
mov r8d, dword [rbx + 0x50]
inc r8d
mov rdx, rsi
mov rcx, rax
call fcn.1402496a0
mov dword [rbx + 0x58], edi
mov esi, 1
cmp dword [0x14034e690], 0
je 0x14019bff1
mov rcx, qword [0x14037add0]
test rcx, rcx
je 0x14019bff1
mov r8d, esi
mov edx, 0x400
call fcn.14018fcb0
xor edx, edx
xor ecx, ecx
call fcn.14019caf0
mov r9d, esi
mov r8d, esi
mov edx, 0x123b
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov ecx, esi
call fcn.1401971d0
call fcn.1401d67a0
call fcn.1401d7050
mov r9d, esi
mov r8d, esi
mov edx, 0x1246
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.1401eb980
mov r12d, eax
mov r9d, esi
mov r8d, esi
mov edx, 0x124a
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
test r12d, r12d
je 0x14019c2f3
mov r9d, esi
mov r8d, esi
mov edx, 0x124d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
cmp dword [0x14034e8d4], 0
jne 0x14019c08a
cmp byte [0x14034e8d8], 0
je 0x14019c090
mov dword [0x1403508d0], esi
xor r15d, r15d
mov r9d, esi
mov r8d, esi
mov edx, 0x125b
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
cmp dword [0x1403508d0], 0
je 0x14019c0ca
mov r9d, esi
mov r8d, esi
mov edx, 0x1261
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rcx, [0x140337de0]
call fcn.1400deab0
mov r9d, esi
mov r8d, esi
mov edx, 0x1266
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.1401fd1d0
mov r9d, esi
mov r8d, esi
mov edx, 0x126b
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801
mov rdi, qword [rbp + 0x1e20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov r9d, esi
mov r8d, esi
mov edx, 0x1270
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor r9d, r9d
xor r8d, r8d
mov edx, 0x811
mov rcx, qword [0x14034e650]
call qword [sym.imp.USER32.dll_PostMessageA]
mov r9d, esi
mov r8d, esi
mov edx, 0x1275
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
mov rcx, rsi
call fcn.140247068
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14019c1a9
mov r8d, dword [rsp + 0x60]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x64], esi
lea rdx, [rsp + 0x50]
lea rcx, str.task
call fcn.1400df720
test eax, eax
sete bl
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
add dword [rsp + 0x64], 0xffffffff
jne 0x14019c1e5
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019c1e5
call fcn.140247060
test bl, bl
je 0x14019c4e6
mov r9d, esi
mov r8d, esi
mov edx, 0x127a
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r9d, esi
mov r8d, esi
lea rcx, vtable.CSASApplicationLogManager.0
cmp qword [0x1403534f0], 0
je 0x14019c309
mov edx, 0x127f
call fcn.14007ee60
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
mov rcx, rsi
call fcn.140247068
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14019c268
mov r8d, dword [rsp + 0x60]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x64], esi
lea rdx, [rsp + 0x50]
lea rcx, str.silent
call fcn.1400df720
test eax, eax
sete bl
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
add dword [rsp + 0x64], 0xffffffff
jne 0x14019c2a4
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019c2a4
call fcn.140247060
test bl, bl
je 0x14019c2bf
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x20c
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x14034e690], 0
jne 0x14019c418
lea rdx, [0x1402c4c80]
lea rcx, [0x140351044]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x14019c418
mov dword [0x140350864], esi
jmp 0x14019c404
xor r15d, r15d
mov dword [0x1403508d4], r15d
mov dword [0x140350f24], r15d
jmp 0x14019c093
mov edx, 0x128e
call fcn.14007ee60
cmp dword [0x14034e690], 0
jne 0x14019c339
lea rdx, [0x1402c4c80]
lea rcx, [0x140351044]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x14019c339
call fcn.1401bfb20
cmp dword [0x140350790], 0
jne 0x14019c3a9
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
mov rcx, rsi
call fcn.140247068
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14019c381
mov r8d, dword [rsp + 0x60]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x64], esi
or r13d, 8
mov dword [rbp + 0x1e28], r13d
lea rdx, [rsp + 0x50]
lea rcx, str.silent
call fcn.1400df720
test eax, eax
jne 0x14019c3a9
mov bl, 1
jmp 0x14019c3ab
xor bl, bl
test r13b, 8
je 0x14019c3d7
and r13d, 0xfffffff7
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
add dword [rsp + 0x64], 0xffffffff
jne 0x14019c3d7
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019c3d7
call fcn.140247060
test bl, bl
je 0x14019c3f2
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x20c
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x14034e678], 0
jne 0x14019c418
cmp dword [0x140350864], 3
je 0x14019c418
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80b
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x14034e900], 0
je 0x14019c48d
test r14d, r14d
jne 0x14019c48d
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r15d
mov rcx, rsi
call fcn.140247068
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14019c465
mov r8d, dword [rsp + 0x60]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x64], esi
or r13d, 0x10
mov dword [rbp + 0x1e28], r13d
lea rdx, [rsp + 0x50]
lea rcx, str.UPDATERESULTS
call fcn.1400df720
test eax, eax
jne 0x14019c48d
mov bl, 1
jmp 0x14019c48f
xor bl, bl
test r13b, 0x10
je 0x14019c4b7
lea rax, vtable.CSABString.0
mov qword [rsp + 0x50], rax
add dword [rsp + 0x64], 0xffffffff
jne 0x14019c4b7
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019c4b7
call fcn.140247060
test bl, bl
je 0x14019c4e6
mov r9d, esi
mov r8d, esi
mov edx, 0x12a4
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80e
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov rcx, qword [0x14037ae08]
cmp byte [0x14034e8d8], 0
je 0x14019c50a
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034e8d8]
call fcn.1400e8490
jmp 0x14019c515
mov edx, dword [0x14034e8d4]
call fcn.140193360
cmp dword [0x1403508d8], 0
jne 0x14019c559
test eax, eax
je 0x14019c559
mov r9d, esi
mov r8d, esi
mov edx, 0x12b5
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor edx, edx
mov ecx, esi
call fcn.1400fcba0
mov r9d, esi
mov r8d, esi
mov edx, 0x12ba
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x5b0]
call fcn.140249b10
lea rdx, [0x14034ec34]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.SASDETECT.STG
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rax, vtable.CSASDetectionLogManager.0
mov qword [rbp + 0xdd0], rax
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0xdd8]
call fcn.140249b10
nop
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0xdd8]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.1401a1a20
mov qword [rbp - 0x78], rax
mov r9d, esi
mov r8d, esi
mov edx, 0x12d5
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xdd0]
call fcn.140197590
mov r9d, esi
mov r8d, esi
mov edx, 0x12d7
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r15, qword [rbp - 0x78]
mov rbx, qword [r15]
xor r13d, r13d
cmp rbx, r15
je 0x14019c7be
lea rax, vtable.CHistoryItem.0
nop
mov qword [rbp - 0x10], rax
lea rcx, [rbp]
call fcn.14000ce10
nop
lea rcx, [rbp + 0x18]
call fcn.14000ce10
nop
lea rcx, [rbp + 0x30]
call fcn.14000ce10
nop
lea rcx, [rbp + 0x48]
call fcn.14000ce10
mov dword [rbp + 0x74], r13d
mov dword [rbp - 8], 0x405
mov r8d, 0xffffffff
mov rdx, qword [rbx + 0x38]
lea rcx, [rbp + 0x18]
call fcn.140005600
mov r8d, 0xffffffff
mov rdx, qword [rbx + 0xa0]
lea rcx, [rbp]
call fcn.140005600
mov r8d, 0xffffffff
mov rdx, qword [rbx + 0x20]
lea rcx, [rbp + 0x30]
call fcn.140005600
mov eax, dword [rbx + 0x90]
mov dword [rbp + 0x60], eax
xor eax, eax
mov qword [rbp + 0x64], rax
mov qword [rbp + 0x6c], rax
mov rdi, qword [0x1403517d8]
mov rsi, qword [rdi + 8]
mov r14, qword [rsi + 8]
lea r9, [rbp - 0x10]
mov r8, r14
mov rdx, rsi
lea rcx, [rdi + 8]
call fcn.140008a90
mov rdx, qword [rdi + 0x10]
movabs rcx, 0x1af286bca1af285
sub rcx, rdx
cmp rcx, 1
jb 0x14019cac2
lea rcx, [rdx + 1]
mov qword [rdi + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r14], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx + 0xa0]
lea r8, [0x140296e1c]
mov edx, 0x410
lea rcx, [rbp + 0x1a0]
call fcn.14000b150
xor edx, edx
lea rcx, [rbp + 0x1a0]
call fcn.1401de4a0
nop
cmp dword [rbp + 0x5c], 1
jne 0x14019c75c
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x14019c75c
call fcn.140247060
cmp dword [rbp + 0x44], 1
jne 0x14019c770
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14019c770
call fcn.140247060
cmp dword [rbp + 0x2c], 1
jne 0x14019c784
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14019c784
call fcn.140247060
cmp dword [rbp + 0x14], 1
jne 0x14019c798
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14019c798
call fcn.140247060
mov rbx, qword [rbx]
cmp rbx, r15
lea rax, vtable.CHistoryItem.0
jne 0x14019c640
mov r14d, dword [rbp + 0x1e30]
mov rdi, qword [rbp + 0x1e20]
mov esi, 1
cmp qword [rbp - 0x70], 0
je 0x14019c7dd
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rbp + 0x5b0]
call qword [rax + 0x88]
nop
lea rcx, [rbp - 0x78]
call fcn.1401a1d50
mov edx, 0xb0
mov rcx, qword [rbp - 0x78]
call fcn.140247060
nop
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x9c0]
call fcn.140249b10
lea rdx, [0x14034ec34]
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.Quarantine
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
xor edx, edx
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.quarantine.db
lea rcx, [rbp + 0x9c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
lea rdx, [rbp + 0x9c0]
call fcn.1400370a0
call fcn.1400e0c90
lea r15, vtable.CSABString.0
cmp dword [0x14034e6a0], 0
je 0x14019c909
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], r13d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x58], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x64], esi
lea rdx, [rsp + 0x50]
lea rcx, str.RealTimeDelay
call fcn.1400e0790
test eax, eax
je 0x14019c8d5
mov rcx, qword [rsp + 0x58]
call fcn.1402520ac
mov edx, eax
jmp 0x14019c8da
mov edx, 0x3e8
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140037bf0
nop
mov qword [rsp + 0x50], r15
add dword [rsp + 0x64], 0xffffffff
jne 0x14019c909
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019c909
call fcn.140247060
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140037e40
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
mov edx, dword [0x14034e6c4]
call fcn.1400372b0
mov r9d, esi
mov r8d, esi
mov edx, 0x1323
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rdx, rax
mov rcx, rdi
call fcn.1400df970
mov r9d, esi
mov r8d, esi
mov edx, 0x1325
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.1400fb560
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140077e60
mov rcx, qword [0x1403517e0]
call fcn.140194510
mov dword [0x14037adb8], esi
test r14d, r14d
je 0x14019ca4d
cmp dword [0x1403508d0], 0
jne 0x14019ca4d
test r12d, r12d
jne 0x14019ca4d
mov ecx, 0xa0000000
call fcn.1401b3670
test eax, eax
je 0x14019ca4d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], r13d
mov rcx, rsi
call fcn.140247068
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14019ca00
mov r8d, dword [rsp + 0x60]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x64], esi
lea rdx, [rsp + 0x50]
lea rcx, str.silent
call fcn.1400df720
test eax, eax
sete bl
mov qword [rsp + 0x50], r15
add dword [rsp + 0x64], 0xffffffff
jne 0x14019ca35
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14019ca35
call fcn.140247060
mov eax, r13d
test bl, bl
sete al
mov dword [0x1403507bc], eax
mov ecx, 0x800000
call fcn.1401fc7b0
mov r9d, esi
mov r8d, esi
lea rcx, vtable.CSASApplicationLogManager.0
cmp qword [0x1403534f0], 0
je 0x14019ca9f
mov edx, 0x1345
call fcn.14007ee60
lea rax, [rbp + 0x1e28]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x1400f7200]
mov edx, 0x100000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14037af78], rax
jmp 0x14019caa9
mov edx, 0x1359
call fcn.14007ee60
call fcn.1401de490
add rsp, 0x1ed8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
nop
lea rcx, str.list_T__too_long
call fcn.1402453d0
nop
call fcn.1402500e8
nop
call fcn.1402500e8
int3