Function at 0x14001b790
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a30]
mov eax, 0x4b30
call fcn.140247340
sub rsp, rax
mov qword [rbp], 0xfffffffffffffffe
mov qword [rsp + 0x4b78], rbx
mov r12, r9
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x4620]
call fcn.140249b10
xor r14d, r14d
mov dword [rbp - 0x60], r14d
mov edi, r14d
mov dword [rbp + 0x4a70], r14d
mov r13d, r14d
mov rcx, rsi
call fcn.14003de20
mov qword [rbp + 8], rax
add rax, 8
mov qword [rbp - 0x48], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rsi + 0xd48], r14
jne 0x14001b841
xor edx, edx
mov rcx, rsi
call fcn.14003de30
test eax, eax
je 0x14001c983
cmp qword [rsi + 0xd48], r14
je 0x14001c983
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.14000b0b0
mov r15, rax
mov qword [rbp - 0x70], rax
mov rcx, qword [rsi + 0xd48]
mov rax, qword [rcx + 8]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14001c94c
cmp qword [rsi + 0xc70], 0
je 0x14001c94c
mov dword [r12], 0xffffffff
mov rax, qword [rbx + 0x88]
mov ecx, 1
test rax, rax
je 0x14001b8b5
cmp dword [rbx + 0x7c], 2
jb 0x14001b8b5
cmp byte [rax], 0x4d
jne 0x14001b8b5
cmp byte [rax + 1], 0x5a
cmove edi, ecx
mov dword [rbp + 0x4a70], edi
cmp dword [rbx + 0x90], 0
je 0x14001bacb
mov rcx, qword [rbx + 0xa0]
cmp byte [rcx], 0x58
je 0x14001bacb
call fcn.140250f2c
lea r8, [rbp - 0x58]
mov rdx, qword [rbx + 0xa0]
mov rcx, rsi
call fcn.14003ece0
xor r8d, r8d
lea rdx, [rbp - 0x58]
mov rcx, qword [rsi + 0xc70]
call fcn.140017cd0
test eax, eax
je 0x14001b9d9
mov eax, dword [rsi + 0x23f0]
test al, 4
je 0x14001b987
mov rax, qword [rbx + 0xa0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsi + 0x2420]
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 8]
mov qword [rbp - 0x78], rcx
lea r9, [rsp + 0x70]
mov r8, rcx
mov rdx, rax
lea rcx, [rsi + 0x2420]
call fcn.140009370
mov rdx, rax
mov rax, qword [rsi + 0x2428]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jb 0x14001c9c5
inc rax
mov qword [rsi + 0x2428], rax
mov rax, qword [rsp + 0x78]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x78]
mov qword [rax], rdx
mov eax, dword [rsi + 0x23f0]
test al, 1
jne 0x14001b9d9
mov rdi, qword [rsi + 0x2408]
test rdi, rdi
je 0x14001c94c
mov rax, qword [rdi]
lea rdx, str.Ecluded_by_MD5
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdi, qword [rsi + 0x2408]
test rdi, rdi
je 0x14001c94c
mov rdi, qword [rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, rax
mov rcx, qword [rsi + 0x2408]
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x14001c94c
mov qword [rbp - 0x78], r14
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x58]
mov rcx, qword [rsi + 0xc78]
call fcn.140017cd0
test eax, eax
je 0x14001bacb
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x14001bacb
cmp byte [rax + 0x2d], 0x2a
cmovne r13, rax
mov r12, qword [r15 + 8]
lea r9, [rbp - 0x78]
mov r8, r12
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.140009370
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaa9
mov rax, qword [rbp - 0x68]
sub rcx, rax
cmp rcx, 1
jb 0x14001c9d2
inc rax
mov qword [rbp - 0x68], rax
mov qword [r15 + 8], rdx
mov qword [r12], rdx
test byte [rsi + 0x23f0], 4
je 0x14001bac7
mov rax, qword [rbx + 0xa0]
mov qword [rsp + 0x70], rax
mov r12, qword [rsi + 0x2410]
mov rax, qword [r12 + 8]
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x70]
mov r8, rax
mov rdx, r12
lea rcx, [rsi + 0x2410]
call fcn.140009370
mov rdx, rax
mov rax, qword [rsi + 0x2418]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jb 0x14001c9df
inc rax
mov qword [rsi + 0x2418], rax
mov qword [r12 + 8], rdx
mov rax, qword [rsp + 0x78]
mov qword [rax], rdx
mov r15, qword [rbp - 0x70]
mov r12, 0xffffffffffffffff
cmp dword [rbp + 0x4aa0], 0
je 0x14001bc88
cmp dword [rsi + 0x23f0], 0
jne 0x14001bc88
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x10]
call fcn.140249b10
mov edx, 0x410
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp + 0x10]
mov rax, r12
inc rax
cmp byte [rcx + rax], 0
jne 0x14001bb13
cmp dword [rbx + 0x40], eax
jbe 0x14001bc88
mov r8d, eax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x14001bc88
test edi, edi
je 0x14001bc88
cmp dword [rbx + 0xa8], eax
je 0x14001bc70
cmp dword [rbx + 0x90], eax
je 0x14001bc70
mov rcx, qword [rbx + 0xa0]
cmp byte [rcx], 0x58
je 0x14001bc70
call fcn.140250f2c
mov rcx, qword [rbx + 0xa0]
lea rax, vtable.CSABStaticString.0
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x14001bba2
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14001bb90
mov dword [rbp - 0x30], eax
mov qword [rbp - 0x38], rcx
jmp 0x14001bbaa
mov dword [rbp - 0x30], r14d
mov qword [rbp - 0x38], r14
lea rcx, [rsi + 0x1aa0]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x40]
call fcn.140017bd0
test eax, eax
jne 0x14001bc69
lea rdx, [rbx + 0x30]
lea rcx, [rsi + 0x1ac8]
call fcn.140025630
test eax, eax
je 0x14001bc6e
mov ecx, 0x21
call fcn.140247068
mov rdi, rax
mov rdx, qword [rbx + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, vtable.CSABStaticString.0
mov qword [rbp - 0x28], rax
test rdi, rdi
je 0x14001bc26
inc r12
cmp byte [rdi + r12], 0
jne 0x14001bc12
mov dword [rbp - 0x18], r12d
mov qword [rbp - 0x20], rdi
jmp 0x14001bc31
mov dword [rbp - 0x18], r14d
mov rdi, r14
mov qword [rbp - 0x20], r14
mov rcx, rdi
call fcn.140250f2c
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x58], rdi
lea rcx, [rsi + 0x1ab0]
movzx eax, byte [rbp + 0x4a70]
mov byte [rsp + 0x20], al
lea r9, [rbp - 0x58]
xor r8d, r8d
lea rdx, [rbp - 0x10]
call fcn.14000b590
inc dword [rsi + 0x1ac0]
jmp 0x14001c94c
jmp 0x14001bc88
lea rdx, [rbx + 0x30]
lea rcx, [rsi + 0x1ac8]
call fcn.140025630
test eax, eax
jne 0x14001c94c
call fcn.140192ec0
test eax, eax
je 0x14001be83
mov rax, qword [0x1403517f8]
add rax, 8
mov qword [rbp - 0x10], rax
add rax, 8
mov qword [rsp + 0x70], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
lea rdx, str._MEMORY_
mov rcx, rax
call fcn.140248db4
test rax, rax
jne 0x14001be31
lea r8, [rbp - 0x78]
lea edx, [rax + 1]
mov rcx, qword [0x1403517f8]
call fcn.140005020
test eax, eax
je 0x14001be16
mov rdx, qword [rbx + 0x38]
lea rcx, [rsp + 0x78]
call fcn.14000bd30
nop
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x10]
call fcn.140249b10
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbx + 0x7c]
mov r8, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x38]
mov rcx, qword [0x1403517f8]
call fcn.140005dc0
test eax, eax
je 0x14001be09
mov rdi, qword [rsi + 0x2408]
test rdi, rdi
je 0x14001bd96
mov rax, qword [rdi]
lea rdx, str.AV_Detected_File
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdi, qword [rsi + 0x2408]
test rdi, rdi
je 0x14001bd96
mov rdi, qword [rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, rax
mov rcx, qword [rsi + 0x2408]
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rsi + 0x2408]
test rcx, rcx
je 0x14001bd96
mov rax, qword [rcx]
lea rdx, [rbp + 0x10]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ecx, 0x1a8
call fcn.14018ef40
mov qword [rbp + 0x4a70], rax
test rax, rax
je 0x14001bdb7
mov rcx, rax
call fcn.14000cb90
mov r14, rax
lea r8, [rbp + 0x10]
mov rdx, r14
mov rcx, rsi
call fcn.14003cb30
mov rax, qword [rbp + 0x4a88]
mov dword [rax], 0xffffffff
mov rax, qword [rbp + 0x4a80]
test rax, rax
je 0x14001bde7
test r14, r14
je 0x14001bde7
mov qword [rax], r14
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14d, 1
jmp 0x14001c94c
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14001be78
mov rcx, qword [rsi + 0x2408]
test rcx, rcx
je 0x14001be78
mov rax, qword [rcx]
lea rdx, str.AV_Failed_Init
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x14001be78
mov rdi, qword [rsi + 0x2408]
test rdi, rdi
je 0x14001be72
mov rax, qword [rdi]
lea rdx, str.AV_Not_Scanning_Memory
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdi, qword [rsi + 0x2408]
test rdi, rdi
je 0x14001be72
mov rdi, qword [rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, rax
mov rcx, qword [rsi + 0x2408]
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov edi, dword [rbp + 0x4a70]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x14001bea9
cmp dword [rbx + 0x90], 0
je 0x14001bea9
mov rdx, qword [rbx + 0xa0]
cmp byte [rdx], 0x58
je 0x14001bea9
mov rcx, qword [rsi + 0x2408]
mov rax, qword [rcx]
call qword [rax + 0x70]
mov rcx, qword [rsi + 0xca0]
test rcx, rcx
je 0x14001beba
call fcn.14003f190
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x10]
call fcn.140249b10
lea r8, [rbp + 0x10]
mov rdx, qword [rbx + 0x38]
mov rcx, rsi
call fcn.140014a40
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rdx, rax
lea rcx, [rbp + 0x4620]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, [rbp + 0x4620]
nop dword [rax]
inc r12
cmp byte [rax + r12], 0
jne 0x14001bf00
mov edi, 1
cmp dword [rbp + 0x4a90], 0
jne 0x14001bf2a
cmp dword [rbx + 0x70], 0
je 0x14001bf2a
mov dword [rbp - 0x60], edi
mov rcx, qword [rbx + 0x68]
call fcn.140250f2c
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x420]
call fcn.140249b10
mov dword [rbp + 0x628], r14d
lea rax, [rbx + 0x30]
mov qword [rbp + 0x630], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x638]
call fcn.140249b10
mov dword [rbp + 0x838], r14d
lea rax, [rbx + 0x190]
mov qword [rbp + 0x840], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x848]
call fcn.140249b10
mov dword [rbp + 0xa48], r14d
lea rax, [rbx + 0x1a8]
mov qword [rbp + 0xa50], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xa58]
call fcn.140249b10
mov dword [rbp + 0xc58], r14d
lea rax, [rbx + 0x1c0]
mov qword [rbp + 0xc60], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xc68]
call fcn.140249b10
mov dword [rbp + 0xe68], r14d
lea rax, [rbx + 0x1d8]
mov qword [rbp + 0xe70], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0xe78]
call fcn.140249b10
mov dword [rbp + 0x1078], r14d
lea rax, [rbx + 0x1f0]
mov qword [rbp + 0x1080], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1088]
call fcn.140249b10
mov dword [rbp + 0x1288], r14d
lea rax, [rbx + 0x208]
mov qword [rbp + 0x1290], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1298]
call fcn.140249b10
mov dword [rbp + 0x1498], r14d
lea rax, [rbx + 0x220]
mov qword [rbp + 0x14a0], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x14a8]
call fcn.140249b10
mov dword [rbp + 0x16a8], r14d
lea rax, [rbx + 0x238]
mov qword [rbp + 0x16b0], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x16b8]
call fcn.140249b10
mov dword [rbp + 0x18b8], r14d
lea rax, [rbx + 0x250]
mov qword [rbp + 0x18c0], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x18c8]
call fcn.140249b10
mov dword [rbp + 0x1ac8], r14d
lea rax, [rbx + 0x268]
mov qword [rbp + 0x1ad0], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1ad8]
call fcn.140249b10
mov dword [rbp + 0x1cd8], r14d
lea rax, [rbx + 0x280]
mov qword [rbp + 0x1ce0], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1ce8]
call fcn.140249b10
mov dword [rbp + 0x1ee8], r14d
lea rax, [rbx + 0x298]
mov qword [rbp + 0x1ef0], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1ef8]
call fcn.140249b10
mov dword [rbp + 0x20f8], r14d
lea rax, [rbx + 0x2b0]
mov qword [rbp + 0x2100], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x2108]
call fcn.140249b10
mov dword [rbp + 0x2308], r14d
lea rax, [rbx + 0x98]
mov qword [rbp + 0x2310], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x2318]
call fcn.140249b10
mov dword [rbp + 0x2518], r14d
lea rax, [rbx + 0x2c8]
mov qword [rbp + 0x2520], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x2528]
call fcn.140249b10
mov dword [rbp + 0x2728], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2730]
call fcn.140249b10
mov dword [rbp + 0x2938], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2940]
call fcn.140249b10
mov dword [rbp + 0x2b48], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2b50]
call fcn.140249b10
mov dword [rbp + 0x2d58], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2d60]
call fcn.140249b10
mov dword [rbp + 0x2f68], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2f70]
call fcn.140249b10
mov dword [rbp + 0x3178], r14d
lea rax, [rbx + 0x140]
mov qword [rbp + 0x3180], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x3188]
call fcn.140249b10
mov dword [rbp + 0x3388], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3390]
call fcn.140249b10
mov dword [rbp + 0x3598], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x35a0]
call fcn.140249b10
mov dword [rbp + 0x37a8], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x37b0]
call fcn.140249b10
mov dword [rbp + 0x39b8], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x39c0]
call fcn.140249b10
mov dword [rbp + 0x3bc8], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3bd0]
call fcn.140249b10
mov dword [rbp + 0x3dd8], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x3de0]
call fcn.140249b10
mov dword [rbp + 0x3fe8], r14d
lea rax, [rbx + 0x178]
mov qword [rbp + 0x3ff0], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x3ff8]
call fcn.140249b10
mov dword [rbp + 0x41f8], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x4200]
call fcn.140249b10
mov dword [rbp + 0x4408], r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x4410]
call fcn.140249b10
mov dword [rbp + 0x4618], r14d
mov r8, qword [rbx + 0x88]
mov qword [rsp + 0x78], r8
mov r9d, 0x800
test r8, r8
je 0x14001c5a9
mov edx, dword [rbx + 0x7c]
mov dword [rbp - 0x78], edx
cmp edx, 2
jb 0x14001c5a9
mov word [rbx + 0x634], r14w
mov rax, qword [rbp + 0xa50]
movzx ecx, r14w
cmp dword [rax + 0x10], 0
jne 0x14001c3cf
mov word [rbx + 0x634], di
mov ecx, edi
mov rax, qword [rbp + 0x1080]
cmp dword [rax + 0x10], 0
jne 0x14001c3e7
or cx, 2
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0xc60]
cmp dword [rax + 0x10], 0
jne 0x14001c3ff
or cx, 4
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0x840]
cmp dword [rax + 0x10], 0
jne 0x14001c417
or cx, 8
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0xe70]
cmp dword [rax + 0x10], 0
jne 0x14001c42f
or cx, 0x20
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0x1290]
cmp dword [rax + 0x10], 0
jne 0x14001c447
or cx, 0x40
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0x14a0]
cmp dword [rax + 0x10], 0
jne 0x14001c463
mov eax, 0x80
or cx, ax
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0x16b0]
cmp dword [rax + 0x10], 0
jne 0x14001c47f
mov eax, 0x100
or cx, ax
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0x1ad0]
cmp dword [rax + 0x10], 0
jne 0x14001c49b
mov eax, 0x200
or cx, ax
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0x1ce0]
cmp dword [rax + 0x10], 0
jne 0x14001c4b7
mov eax, 0x400
or cx, ax
mov word [rbx + 0x634], cx
mov rax, qword [rbp + 0x18c0]
cmp dword [rax + 0x10], 0
jne 0x14001c4cf
or cx, r9w
mov word [rbx + 0x634], cx
cmp edx, 0x11e
jbe 0x14001c52e
lea rax, [rdx - 0x1e]
add rax, r8
mov qword [rsp + 0x70], rax
lea rdi, [r8 + 0x100]
cmp rdi, rax
ja 0x14001c52e
cmp dword [rdi], 0x530056
jne 0x14001c51e
cmp dword [rdi + 0x1a], 0x4f0046
jne 0x14001c51e
mov r8d, 0x1e
lea rdx, str.VS_VERSION_INFO
mov rcx, rdi
call fcn.140249ce0
test eax, eax
je 0x14001c523
mov rax, qword [rsp + 0x70]
inc rdi
jmp 0x14001c4ea
mov r8d, 1
mov eax, r8d
jmp 0x14001c537
mov eax, r14d
mov r8d, 1
mov dword [rbx + 0x638], eax
mov qword [rbx + 0x63c], r14
mov eax, dword [rbp - 0x78]
cmp eax, 0x104
jbe 0x14001c5a9
mov rcx, qword [rsp + 0x78]
lea rdx, [rax - 4]
add rdx, rcx
lea rax, [rcx + 0x100]
mov rcx, rax
cmp rax, rdx
ja 0x14001c5a9
nop dword [rax]
cmp dword [rcx], 0x6264702e
je 0x14001c582
inc rcx
cmp rcx, rdx
jbe 0x14001c570
jmp 0x14001c589
mov dword [rbx + 0x63c], r8d
cmp rax, rdx
ja 0x14001c5a9
nop
cmp dword [rax], 0x4244502e
je 0x14001c5a2
inc rax
cmp rax, rdx
jbe 0x14001c590
jmp 0x14001c5a9
mov dword [rbx + 0x63c], r8d
mov qword [rsp + 0x70], r14
mov rcx, qword [rsi + 0xc80]
add rcx, 8
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x4620]
call fcn.140012e40
mov rax, qword [rsi + 0xc68]
mov rcx, qword [rbp - 0x80]
sub rax, rcx
je 0x14001c7dc
lea rdi, [rax + rcx]
mov qword [rsp + 0x78], rdi
mov eax, dword [rdi + 8]
test eax, 0x210
jne 0x14001c7d2
mov r9d, dword [rbp + 0x4a70]
test r9d, r9d
jne 0x14001c609
test al, 2
jne 0x14001c7d2
mov r10d, dword [rbp - 0x60]
test r10d, r10d
jne 0x14001c61a
test al, 0x20
jne 0x14001c7d2
bt eax, 0xc
jae 0x14001c62d
cmp dword [rbx + 0x638], 0
jne 0x14001c7d2
bt eax, 0xb
jae 0x14001c640
cmp dword [rbx + 0x638], 0
je 0x14001c7d2
bt eax, 0xd
jae 0x14001c653
cmp dword [rbx + 0x63c], 0
jne 0x14001c7d2
bt eax, 0xe
jae 0x14001c666
cmp dword [rbx + 0x640], 0
jne 0x14001c7d2
bt eax, 0xf
jae 0x14001c679
cmp dword [rbx + 0x63c], 0
je 0x14001c7d2
bt eax, 0x10
jae 0x14001c68c
cmp dword [rbx + 0x640], 0
je 0x14001c7d2
mov ecx, dword [rbx + 0x7c]
mov r8d, dword [rdi + 0xf]
mov edx, dword [rdi + 0x13]
test ecx, ecx
je 0x14001c70b
cmp r8d, 0xffffffff
jne 0x14001c6af
cmp edx, r8d
je 0x14001c70b
cmp ecx, edx
jb 0x14001c7ce
jmp 0x14001c70b
cmp edx, 0xffffffff
je 0x14001c702
cmp r8d, edx
jne 0x14001c6cc
cmp ecx, r8d
je 0x14001c70b
mov rcx, qword [rbp - 0x80]
mov eax, dword [rdi]
test rax, rax
jmp 0x14001c5d8
test al, 8
je 0x14001c6eb
cmp ecx, edx
jbe 0x14001c7ce
cmp ecx, r8d
jb 0x14001c70b
mov rcx, qword [rbp - 0x80]
mov eax, dword [rdi]
test rax, rax
jmp 0x14001c5d8
cmp ecx, edx
ja 0x14001c70b
cmp ecx, r8d
jb 0x14001c70b
mov rcx, qword [rbp - 0x80]
mov eax, dword [rdi]
test rax, rax
jmp 0x14001c5d8
cmp ecx, r8d
ja 0x14001c7ce
mov eax, dword [rbp + 0x4aa8]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x420]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x4a98]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r12d
lea rax, [rbp + 0x4620]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov r9, rdi
mov r8d, dword [rbp + 0x4a90]
mov rdx, rbx
mov rcx, rsi
call fcn.14001c9f0
test eax, eax
je 0x14001c7ce
test r13, r13
jne 0x14001c781
cmp byte [rdi + 0x2d], 0x2a
cmovne r13, rdi
mov rdi, qword [r15 + 8]
lea r9, [rsp + 0x78]
mov r8, rdi
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.140009370
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaa9
mov rax, qword [rbp - 0x68]
sub rcx, rax
cmp rcx, 1
jb 0x14001c9ab
inc rax
mov qword [rbp - 0x68], rax
mov qword [r15 + 8], rdx
mov qword [rdi], rdx
mov r15, qword [rbp - 0x70]
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov eax, dword [rdi]
test rax, rax
jmp 0x14001c5d8
mov r12, qword [rbp - 0x68]
test r12, r12
je 0x14001c948
cmp qword [rbp + 0x4a80], 0
je 0x14001c945
mov rdi, r14
test r13, r13
je 0x14001c840
mov ecx, 0x1a8
call fcn.14018ef40
mov qword [rbp + 0x4a70], rax
test rax, rax
je 0x14001c822
mov rcx, rax
call fcn.14000cb90
mov rdi, rax
jmp 0x14001c825
mov rdi, r14
mov r8, r13
mov rdx, rdi
mov rcx, rsi
call fcn.14003cc40
mov eax, dword [r13 + 4]
mov rcx, qword [rbp + 0x4a88]
mov dword [rcx], eax
mov rbx, qword [r15]
cmp rbx, r15
je 0x14001c936
nop dword [rax]
mov r13, qword [rbx + 0x10]
mov ecx, 0x1a8
call fcn.14018ef40
test rdi, rdi
jne 0x14001c89c
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14001c879
mov rcx, rax
call fcn.14000cb90
mov rdi, rax
jmp 0x14001c87c
mov rdi, r14
mov r8, r13
mov rdx, rdi
mov rcx, rsi
call fcn.14003cc40
mov eax, dword [r13 + 4]
mov rcx, qword [rbp + 0x4a88]
mov dword [rcx], eax
jmp 0x14001c926
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14001c8b0
mov rcx, rax
call fcn.14000cb90
jmp 0x14001c8b3
mov rax, r14
mov qword [rbp + 0x4a70], rax
mov r8, r13
mov rdx, rax
mov rcx, rsi
call fcn.14003cc40
mov r13, qword [rdi + 0x198]
mov rax, qword [r13 + 8]
mov qword [rsp + 0x70], rax
lea r9, [rbp + 0x4a70]
mov r8, rax
mov rdx, r13
lea rcx, [rdi + 0x198]
call fcn.140009370
mov rdx, qword [rdi + 0x1a0]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rdx
cmp rcx, 1
jb 0x14001c9b8
lea rcx, [rdx + 1]
mov qword [rdi + 0x1a0], rcx
mov qword [r13 + 8], rax
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x14001c850
mov r12, qword [rbp - 0x68]
test rdi, rdi
je 0x14001c945
mov rax, qword [rbp + 0x4a80]
mov qword [rax], rdi
test r12, r12
setne r14b
mov rcx, qword [r15]
mov qword [r15], r15
mov qword [r15 + 8], r15
cmp rcx, r15
je 0x14001c975
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140247060
mov rcx, rbx
cmp rbx, r15
jne 0x14001c960
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, r15
call fcn.140247060
nop
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, r14d
mov rbx, qword [rsp + 0x4b78]
add rsp, 0x4b30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3