Function at 0x1400d0010
Capabilities:
Get hostname
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x3b8], rax
mov dword [rbp - 0x80], r8d
mov r13, rdx
mov r14, rcx
cmp qword [0x140686be0], 0
jne 0x1400d005b
xor al, al
jmp 0x1400d1918
lea rax, vtable.AutoLock.0
mov qword [rsp + 0x68], rax
lea rax, [0x140686bf0]
mov qword [rsp + 0x70], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
xor bl, bl
xor edx, edx
xor ecx, ecx
call fcn.1401d3b80
mov rdi, rax
xor r15d, r15d
lea esi, [r15 + 1]
test rax, rax
je 0x1400d0153
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str._sophos_
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d00fd
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400d00cf
mov rdx, qword [r14]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
test eax, eax
cmove ebx, esi
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400d0153
lea rax, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rax
je 0x1400d014b
test byte [rcx + 0x1c], sil
je 0x1400d014b
cmp byte [rcx + 0x19], 4
jb 0x1400d014b
cmp qword [r14 + 0x18], 8
jb 0x1400d0133
mov r14, qword [r14]
mov edx, 0x22
mov r9, r14
lea r8, [0x1405f7158]
mov rcx, qword [rcx + 0x10]
call fcn.1400786c0
xor sil, sil
jmp 0x1400d1907
mov rdx, r14
lea rcx, [rbp + 0x58]
call fcn.1401d9930
nop
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x1400d016d
mov rax, qword [r14]
lea r9, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae r9, qword [rbp + 0x58]
mov r8, r13
cmp qword [r13 + 0x18], 8
jb 0x1400d0189
mov r8, qword [r13]
mov qword [rsp + 0x20], rax
lea rdx, str._NewApplication___ls___ls___ls_
mov ecx, esi
call fcn.140109e80
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rbp - 0x2c]
movzx ecx, word [rbp - 0x2e]
movzx edx, word [rbp - 0x30]
movzx r10d, word [rbp - 0x32]
movzx r9d, word [rbp - 0x36]
movzx r8d, word [rbp - 0x38]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, [0x1405f7dc0]
lea rcx, [rbp + 0x390]
call fcn.1400f6d20
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
lea rax, [rbp + 0x390]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400d0210
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x38]
call fcn.140073120
nop
mov r8, rsi
lea rdx, [0x1405f6950]
lea rcx, [rbp + 0x38]
call fcn.1400729d0
xor edx, edx
mov r8d, 0x308
lea rcx, [rbp + 0x80]
call fcn.14035c350
lea rcx, [rbp + 0x80]
call fcn.1401ce640
nop
mov rax, qword [rbp + 0x188]
lea rcx, [rbp + 0x188]
mov rax, qword [rax + 0x10]
call qword [case.0x1401cd220.0]
mov rdi, rax
lea rax, [rbp + 0x80]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], r15
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov dword [rdi + 0x30], r15d
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x58], r15
lea rax, vtable.tinyxml2::XMLElement.0
mov qword [rdi], rax
mov dword [rdi + 0x68], r15d
mov qword [rdi + 0x70], r15
lea rax, [rbp + 0x188]
mov qword [rdi + 0x60], rax
mov rdx, rdi
lea rcx, [rbp + 0x128]
call fcn.1401d0af0
test dword [rdi + 0x18], 0x200
je 0x1400d02eb
mov rcx, qword [rdi + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 6
call fcn.140359a1c
mov qword [rdi + 0x20], rax
mov ecx, dword [str.event]
mov dword [rax], ecx
movzx ecx, word [0x1405f6d70]
mov word [rax + 4], cx
mov rax, qword [rdi + 0x20]
add rax, 5
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
mov rsi, r15
mov rbx, qword [rdi + 0x70]
test rbx, rbx
je 0x1400d037a
lea r12, str.type
nop
lea rcx, [rbx + 8]
call fcn.1401cc190
cmp rax, r12
je 0x1400d03e5
mov r8d, 0x7fffffff
mov rdx, r12
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400d0375
mov rsi, rbx
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x1400d037a
jmp 0x1400d0340
test rbx, rbx
jne 0x1400d03e5
mov rcx, rdi
call fcn.1401ce2a0
mov rbx, rax
test rsi, rsi
je 0x1400d0390
mov qword [rsi + 0x40], rax
jmp 0x1400d0394
mov qword [rdi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400d03a6
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], r15d
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov ecx, 5
call fcn.140359a1c
mov qword [rbx + 0x10], rax
mov ecx, dword [str.type]
mov dword [rax], ecx
movzx ecx, byte [0x1405f56bc]
mov byte [rax + 4], cl
mov rax, qword [rbx + 0x10]
add rax, 4
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
test dword [rbx + 0x20], 0x200
je 0x1400d03f7
mov rcx, qword [rbx + 0x28]
call fcn.140359090
mov dword [rbx + 0x20], r15d
mov qword [rbx + 0x28], r15
mov qword [rbx + 0x30], r15
mov ecx, 0x13
call fcn.140359a1c
mov qword [rbx + 0x28], rax
movups xmm0, xmmword [str.sophos.hmpa.newapp]
movups xmmword [rax], xmm0
movzx ecx, word [0x1405f6d68]
mov word [rax + 0x10], cx
movzx ecx, byte [0x1405f6d6a]
mov byte [rax + 0x12], cl
mov rax, qword [rbx + 0x28]
add rax, 0x12
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x20], 0x200
mov rax, qword [rbp + 0x188]
lea rcx, [rbp + 0x188]
mov rax, qword [rax + 0x10]
call qword [case.0x1401cd220.0]
mov rsi, rax
lea rax, [rbp + 0x80]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r15
mov dword [rsi + 0x18], r15d
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x28], r15
mov dword [rsi + 0x30], r15d
mov qword [rsi + 0x38], r15
mov qword [rsi + 0x40], r15
mov qword [rsi + 0x48], r15
mov qword [rsi + 0x50], r15
mov qword [rsi + 0x58], r15
lea rax, vtable.tinyxml2::XMLElement.0
mov qword [rsi], rax
mov dword [rsi + 0x68], r15d
mov qword [rsi + 0x70], r15
lea rax, [rbp + 0x188]
mov qword [rsi + 0x60], rax
mov rdx, rsi
lea rcx, [rbp + 0x128]
call fcn.1401d0af0
test dword [rsi + 0x18], 0x200
je 0x1400d04cf
mov rcx, qword [rsi + 0x20]
call fcn.140359090
mov dword [rsi + 0x18], r15d
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x28], r15
mov ecx, 0xe
call fcn.140359a1c
mov qword [rsi + 0x20], rax
movsd xmm0, qword [str.SoftwareRadar]
movsd qword [rax], xmm0
mov ecx, dword [0x1405f6d80]
mov dword [rax + 8], ecx
movzx ecx, word [0x1405f6d84]
mov word [rax + 0xc], cx
mov rax, qword [rsi + 0x20]
add rax, 0xd
mov qword [rsi + 0x28], rax
mov dword [rsi + 0x18], 0x200
lea r12, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae r12, qword [rbp + 0x38]
mov rbx, qword [rsi + 0x70]
test rbx, rbx
je 0x1400d056f
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, [0x1405f6d74]
cmp rax, rcx
je 0x1400d05e7
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400d056a
mov r15, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400d052e
test rbx, rbx
jne 0x1400d05e7
mov rcx, rsi
call fcn.1401ce2a0
mov rbx, rax
test r15, r15
je 0x1400d0585
mov qword [r15 + 0x40], rax
jmp 0x1400d0589
mov qword [rsi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400d059b
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov ecx, 3
call fcn.140359a1c
mov qword [rbx + 0x10], rax
movzx ecx, word [0x1405f6d74]
mov word [rax], cx
movzx ecx, byte [0x1405f6d76]
mov byte [rax + 2], cl
mov rax, qword [rbx + 0x10]
add rax, 2
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
lea rcx, [rbx + 0x20]
mov rdx, r12
call fcn.1401cc010
lea rcx, [rbp + 0x390]
call fcn.14006b440
nop
cmp byte [rax + 0x20], 0
je 0x1400d062a
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
jmp 0x1400d065a
mov qword [rbp - 0x58], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
xor r8d, r8d
lea rdx, [0x1405e4ea8]
lea rcx, [rbp - 0x58]
call fcn.140073120
nop
lea r12, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae r12, qword [rbp - 0x58]
xor r15d, r15d
mov rbx, qword [rsi + 0x70]
test rbx, rbx
je 0x1400d06b0
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, [0x1405f6d8c]
cmp rax, rcx
je 0x1400d071c
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400d06ab
mov r15, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400d066f
test rbx, rbx
jne 0x1400d071c
mov rcx, rsi
call fcn.1401ce2a0
mov rbx, rax
test r15, r15
je 0x1400d06c6
mov qword [r15 + 0x40], rax
jmp 0x1400d06ca
mov qword [rsi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400d06dc
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov ecx, 4
call fcn.140359a1c
mov qword [rbx + 0x10], rax
mov ecx, dword [0x1405f6d8c]
mov dword [rax], ecx
mov rax, qword [rbx + 0x10]
add rax, 3
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
lea rcx, [rbx + 0x20]
mov rdx, r12
call fcn.1401cc010
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400d0765
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d075f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1948
call fcn.140359090
nop
cmp byte [rbp + 0x3b0], 0
je 0x1400d077a
lea rcx, [rbp + 0x390]
call fcn.140073500
call fcn.1401ecb40
mov r12, rax
xor r15d, r15d
mov rbx, qword [rsi + 0x70]
test rbx, rbx
je 0x1400d07ca
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, [0x1405f6d88]
cmp rax, rcx
je 0x1400d0836
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400d07c5
mov r15, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400d0789
test rbx, rbx
jne 0x1400d0836
mov rcx, rsi
call fcn.1401ce2a0
mov rbx, rax
test r15, r15
je 0x1400d07e0
mov qword [r15 + 0x40], rax
jmp 0x1400d07e4
mov qword [rsi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400d07f6
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov ecx, 4
call fcn.140359a1c
mov qword [rbx + 0x10], rax
mov ecx, dword [0x1405f6d88]
mov dword [rax], ecx
mov rax, qword [rbx + 0x10]
add rax, 3
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
lea rcx, [rbx + 0x20]
mov rdx, r12
call fcn.1401cc010
mov dword [rsp + 0x78], 0x10
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1400d087a
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x18]
call fcn.140097490
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x28]
jmp 0x1400d0894
mov qword [rbp + 0x18], 0
xor eax, eax
mov qword [rbp + 0x28], rax
mov ecx, 0xf
mov qword [rbp + 0x30], rcx
mov byte [rbp + 0x18], al
test rax, rax
je 0x1400d0978
lea r12, [rbp + 0x18]
cmp rcx, 0x10
cmovae r12, qword [rbp + 0x18]
xor r15d, r15d
mov rbx, qword [rsi + 0x70]
test rbx, rbx
je 0x1400d08f2
lea rcx, [rbx + 8]
call fcn.1401cc190
lea rcx, str.computer
cmp rax, rcx
je 0x1400d096c
mov r8d, 0x7fffffff
mov rdx, rcx
mov rcx, rax
call fcn.140377720
test eax, eax
je 0x1400d08ed
mov r15, rbx
mov rbx, qword [rbx + 0x40]
jmp 0x1400d08b1
test rbx, rbx
jne 0x1400d096c
mov rcx, rsi
call fcn.1401ce2a0
mov rbx, rax
test r15, r15
je 0x1400d0908
mov qword [r15 + 0x40], rax
jmp 0x1400d090c
mov qword [rsi + 0x70], rbx
test dword [rax + 8], 0x200
je 0x1400d091e
mov rcx, qword [rax + 0x10]
call fcn.140359090
mov dword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov ecx, 9
call fcn.140359a1c
mov qword [rbx + 0x10], rax
movsd xmm0, qword [str.computer]
movsd qword [rax], xmm0
movzx ecx, byte [0x1405f6da8]
mov byte [rax + 8], cl
mov rax, qword [rbx + 0x10]
add rax, 8
mov qword [rbx + 0x18], rax
mov dword [rbx + 8], 0x200
lea rcx, [rbx + 0x20]
mov rdx, r12
call fcn.1401cc010
mov r8, qword [rsi + 8]
mov rdx, qword [rdi + 8]
cmp r8, rdx
jne 0x1400d0a81
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1400d09e7
mov rax, qword [rcx + 0x38]
cmp rsi, rax
jne 0x1400d09a3
mov rax, qword [rax + 0x50]
mov qword [rcx + 0x38], rax
mov rax, qword [rcx + 0x40]
cmp rsi, rax
jne 0x1400d09b4
mov rax, qword [rax + 0x48]
mov qword [rcx + 0x40], rax
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x1400d09c5
mov rax, qword [rsi + 0x50]
mov qword [rcx + 0x50], rax
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x1400d09d6
mov rax, qword [rsi + 0x48]
mov qword [rcx + 0x48], rax
xor r15d, r15d
mov qword [rsi + 0x50], r15
mov qword [rsi + 0x48], r15
mov qword [rsi + 0x10], r15
jmp 0x1400d0a40
xor r15d, r15d
mov ecx, r15d
mov eax, r15d
movsxd r9, dword [r8 + 0x104]
test r9, r9
jle 0x1400d0a2f
mov rdx, qword [r8 + 0xa8]
cmp rsi, qword [rdx + rax*8]
je 0x1400d0a15
inc ecx
inc rax
cmp rax, r9
jl 0x1400d0a03
jmp 0x1400d0a2f
movsxd rax, dword [r8 + 0x104]
movsxd rcx, ecx
mov rax, qword [rdx + rax*8 - 8]
mov qword [rdx + rcx*8], rax
dec dword [r8 + 0x104]
mov rcx, qword [rsi + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1401cd220.0]
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x1400d0a67
mov qword [rax + 0x48], rsi
mov rax, qword [rdi + 0x38]
mov qword [rsi + 0x50], rax
mov qword [rdi + 0x38], rsi
mov qword [rsi + 0x48], r15
mov qword [rsi + 0x10], rdi
mov rdx, qword [rdi + 8]
jmp 0x1400d0a84
mov qword [rdi + 0x40], rsi
mov qword [rdi + 0x38], rsi
mov qword [rsi + 0x50], r15
mov qword [rsi + 0x48], r15
mov qword [rsi + 0x10], rdi
mov rdx, qword [rdi + 8]
jmp 0x1400d0a84
xor r15d, r15d
cmp rdx, qword [rbp + 0x88]
jne 0x1400d0b86
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400d0aec
mov rax, qword [rcx + 0x38]
cmp rdi, rax
jne 0x1400d0aab
mov rax, qword [rax + 0x50]
mov qword [rcx + 0x38], rax
mov rax, qword [rcx + 0x40]
cmp rdi, rax
jne 0x1400d0abc
mov rax, qword [rax + 0x48]
mov qword [rcx + 0x40], rax
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x1400d0acd
mov rax, qword [rdi + 0x50]
mov qword [rcx + 0x50], rax
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x1400d0ade
mov rax, qword [rdi + 0x48]
mov qword [rcx + 0x48], rax
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x10], r15
jmp 0x1400d0b41
mov ecx, r15d
mov rax, r15
movsxd r9, dword [rdx + 0x104]
test r9, r9
jle 0x1400d0b30
mov r8, qword [rdx + 0xa8]
cmp rdi, qword [r8 + rax*8]
je 0x1400d0b17
inc ecx
inc rax
cmp rax, r9
jl 0x1400d0b05
jmp 0x1400d0b30
movsxd rax, dword [rdx + 0x104]
movsxd rcx, ecx
mov rax, qword [r8 + rax*8 - 8]
mov qword [r8 + rcx*8], rax
dec dword [rdx + 0x104]
mov rcx, qword [rdi + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1401cd220.0]
mov rax, qword [rbp + 0xb8]
test rax, rax
je 0x1400d0b65
mov qword [rax + 0x48], rdi
mov rax, qword [rbp + 0xb8]
mov qword [rdi + 0x50], rax
mov qword [rbp + 0xb8], rdi
jmp 0x1400d0b77
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xb8], rdi
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x48], r15
lea rax, [rbp + 0x80]
mov qword [rdi + 0x10], rax
mov rax, qword [rbp + 0x188]
lea rcx, [rbp + 0x188]
mov rax, qword [rax + 0x10]
call qword [case.0x1401cd220.0]
mov rbx, rax
lea rax, [rbp + 0x80]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r15
mov dword [rbx + 0x18], r15d
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x28], r15
mov dword [rbx + 0x30], r15d
mov qword [rbx + 0x38], r15
mov qword [rbx + 0x40], r15
mov qword [rbx + 0x48], r15
mov qword [rbx + 0x50], r15
mov qword [rbx + 0x58], r15
lea r12, vtable.tinyxml2::XMLElement.0
mov qword [rbx], r12
mov dword [rbx + 0x68], r15d
mov qword [rbx + 0x70], r15
lea rax, [rbp + 0x188]
mov qword [rbx + 0x60], rax
mov rdx, rbx
lea rcx, [rbp + 0x128]
call fcn.1401d0af0
test dword [rbx + 0x18], 0x200
je 0x1400d0c12
mov rcx, qword [rbx + 0x20]
call fcn.140359090
mov dword [rbx + 0x18], r15d
mov qword [rbx + 0x20], r15
mov qword [rbx + 0x28], r15
mov ecx, 0xf
call fcn.140359a1c
mov qword [rbx + 0x20], rax
movsd xmm0, qword [0x1405f6d90]
movsd qword [rax], xmm0
mov ecx, dword [0x1405f6d98]
mov dword [rax + 8], ecx
movzx ecx, word [0x1405f6d9c]
mov word [rax + 0xc], cx
movzx ecx, byte [0x1405f6d9e]
mov byte [rax + 0xe], cl
mov rax, qword [rbx + 0x20]
add rax, 0xe
mov qword [rbx + 0x28], rax
mov dword [rbx + 0x18], 0x200
mov r9, qword [rbx + 8]
cmp r9, qword [rsi + 8]
jne 0x1400d0d5c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400d0cd2
mov rax, qword [rcx + 0x38]
cmp rbx, rax
jne 0x1400d0c91
mov rax, qword [rax + 0x50]
mov qword [rcx + 0x38], rax
mov rax, qword [rcx + 0x40]
cmp rbx, rax
jne 0x1400d0ca2
mov rax, qword [rax + 0x48]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1400d0cb3
mov rax, qword [rbx + 0x50]
mov qword [rcx + 0x50], rax
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x1400d0cc4
mov rax, qword [rbx + 0x48]
mov qword [rcx + 0x48], rax
mov qword [rbx + 0x50], r15
mov qword [rbx + 0x48], r15
mov qword [rbx + 0x10], r15
jmp 0x1400d0d2d
mov ecx, r15d
mov rax, r15
movsxd r8, dword [r9 + 0x104]
test r8, r8
jle 0x1400d0d1c
mov rdx, qword [r9 + 0xa8]
nop dword [rax + rax]
cmp rbx, qword [rdx + rax*8]
je 0x1400d0d02
inc ecx
inc rax
cmp rax, r8
jl 0x1400d0cf0
jmp 0x1400d0d1c
movsxd rax, dword [r9 + 0x104]
movsxd rcx, ecx
mov rax, qword [rdx + rax*8 - 8]
mov qword [rdx + rcx*8], rax
dec dword [r9 + 0x104]
mov rcx, qword [rbx + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1401cd220.0]
mov rax, qword [rsi + 0x38]
test rax, rax
je 0x1400d0d48
mov qword [rax + 0x48], rbx
mov rax, qword [rsi + 0x38]
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x38], rbx
jmp 0x1400d0d54
mov qword [rsi + 0x40], rbx
mov qword [rsi + 0x38], rbx
mov qword [rbx + 0x50], r15
mov qword [rbx + 0x48], r15
mov qword [rbx + 0x10], rsi
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov rdx, r13
cmp qword [r13 + 0x18], 8
jb 0x1400d0d7e
mov rdx, qword [r13]
lea rcx, [rbp + 0x390]
call fcn.140097490
mov rdi, rax
lea rax, [rbp - 0x78]
cmp rax, rdi
je 0x1400d0dbd
lea rcx, [rbp - 0x78]
call fcn.140073500
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x3a8]
cmp rdx, 0x10
jb 0x1400d0dfe
inc rdx
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0df9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d194e
call fcn.140359090
mov rax, qword [rbp + 0x188]
lea rcx, [rbp + 0x188]
mov rax, qword [rax + 0x10]
call qword [case.0x1401cd220.0]
mov rdi, rax
lea rax, [rbp + 0x80]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], r15
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov dword [rdi + 0x30], r15d
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x58], r15
mov qword [rdi], r12
mov dword [rdi + 0x68], r15d
mov qword [rdi + 0x70], r15
lea rax, [rbp + 0x188]
mov qword [rdi + 0x60], rax
mov rdx, rdi
lea rcx, [rbp + 0x128]
call fcn.1401d0af0
test dword [rdi + 0x18], 0x200
je 0x1400d0e83
mov rcx, qword [rdi + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 9
call fcn.140359a1c
mov qword [rdi + 0x20], rax
movsd xmm0, qword [str.Template]
movsd qword [rax], xmm0
movzx ecx, byte [0x1405f63b0]
mov byte [rax + 8], cl
mov rax, qword [rdi + 0x20]
add rax, 8
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov rcx, rdi
call fcn.1401cdec0
mov rax, qword [rbx + 8]
cmp qword [rdi + 8], rax
jne 0x1400d0f1d
mov rdx, rdi
call fcn.1401cd170
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1400d0f09
mov qword [rax + 0x50], rdi
mov rax, qword [rbx + 0x40]
mov qword [rdi + 0x48], rax
mov qword [rbx + 0x40], rdi
jmp 0x1400d0f15
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x38], rdi
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x10], rbx
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rdx, qword [rbp + 0x58]
lea rcx, [rbp + 0x390]
call fcn.140097490
mov rdi, rax
lea rax, [rbp - 0x78]
cmp rax, rdi
je 0x1400d0f6a
lea rcx, [rbp - 0x78]
call fcn.140073500
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x3a8]
cmp rdx, 0x10
jb 0x1400d0fab
inc rdx
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d0fa6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1954
call fcn.140359090
mov rax, qword [rbp + 0x188]
lea rcx, [rbp + 0x188]
mov rax, qword [rax + 0x10]
call qword [case.0x1401cd220.0]
mov rdi, rax
lea rax, [rbp + 0x80]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], r15
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov dword [rdi + 0x30], r15d
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x58], r15
mov qword [rdi], r12
mov dword [rdi + 0x68], r15d
mov qword [rdi + 0x70], r15
lea rax, [rbp + 0x188]
mov qword [rdi + 0x60], rax
mov rdx, rdi
lea rcx, [rbp + 0x128]
call fcn.1401d0af0
test dword [rdi + 0x18], 0x200
je 0x1400d1030
mov rcx, qword [rdi + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 5
call fcn.140359a1c
mov qword [rdi + 0x20], rax
mov ecx, dword [str.Path]
mov dword [rax], ecx
movzx ecx, byte [0x1405f6dc0]
mov byte [rax + 4], cl
mov rax, qword [rdi + 0x20]
add rax, 4
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov rcx, rdi
call fcn.1401cdec0
mov r9, qword [rdi + 8]
cmp r9, qword [rbx + 8]
jne 0x1400d1173
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1400d10ee
mov rax, qword [rcx + 0x38]
cmp rdi, rax
jne 0x1400d10ad
mov rax, qword [rax + 0x50]
mov qword [rcx + 0x38], rax
mov rax, qword [rcx + 0x40]
cmp rdi, rax
jne 0x1400d10be
mov rax, qword [rax + 0x48]
mov qword [rcx + 0x40], rax
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x1400d10cf
mov rax, qword [rdi + 0x50]
mov qword [rcx + 0x50], rax
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x1400d10e0
mov rax, qword [rdi + 0x48]
mov qword [rcx + 0x48], rax
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x10], r15
jmp 0x1400d1144
mov ecx, r15d
mov rax, r15
movsxd r8, dword [r9 + 0x104]
test r8, r8
jle 0x1400d1133
mov rdx, qword [r9 + 0xa8]
cmp rdi, qword [rdx + rax*8]
je 0x1400d1119
inc ecx
inc rax
cmp rax, r8
jl 0x1400d1107
jmp 0x1400d1133
movsxd rax, dword [r9 + 0x104]
movsxd rcx, ecx
mov rax, qword [rdx + rax*8 - 8]
mov qword [rdx + rcx*8], rax
dec dword [r9 + 0x104]
mov rcx, qword [rdi + 0x60]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1401cd220.0]
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1400d115f
mov qword [rax + 0x50], rdi
mov rax, qword [rbx + 0x40]
mov qword [rdi + 0x48], rax
mov qword [rbx + 0x40], rdi
jmp 0x1400d116b
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x38], rdi
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x10], rbx
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400d1180
mov rdx, qword [r14]
lea rcx, [rbp + 0x390]
call fcn.140097490
mov rdi, rax
lea rax, [rbp - 0x78]
cmp rax, rdi
je 0x1400d11bf
lea rcx, [rbp - 0x78]
call fcn.140073500
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x3a8]
cmp rdx, 0x10
jb 0x1400d1200
inc rdx
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d11fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d1942
call fcn.140359090
mov rax, qword [rbp + 0x188]
lea rcx, [rbp + 0x188]
mov rax, qword [rax + 0x10]
call qword [case.0x1401cd220.0]
mov rdi, rax
lea rax, [rbp + 0x80]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], r15
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov dword [rdi + 0x30], r15d
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov qword [rdi + 0x58], r15
mov qword [rdi], r12
mov dword [rdi + 0x68], r15d
mov qword [rdi + 0x70], r15
lea rax, [rbp + 0x188]
mov qword [rdi + 0x60], rax
mov rdx, rdi
lea rcx, [rbp + 0x128]
call fcn.1401d0af0
test dword [rdi + 0x18], 0x200
je 0x1400d1285
mov rcx, qword [rdi + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 9
call fcn.140359a1c
mov qword [rdi + 0x20], rax
movsd xmm0, qword [str.RealPath]
movsd qword [rax], xmm0
movzx ecx, byte [0x1405f6db8]
mov byte [rax + 8], cl
mov rax, qword [rdi + 0x20]
add rax, 8
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov rcx, rdi
call fcn.1401cdec0
mov rdx, rdi
mov rcx, rbx
call fcn.1401ccb30
mov edx, dword [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140093d60
nop
mov qword [rbp - 8], r15
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r15w
xor r8d, r8d
lea rdx, [0x1405e4f00]
lea rcx, [rbp - 8]
call fcn.1400739a0
nop
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r15w
xor r8d, r8d
lea rdx, [0x1405e4f00]
lea rcx, [rbp - 0x28]
call fcn.1400739a0
nop
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400d1356
mov rcx, qword [r14]
lea r8, [rbp - 0x28]
lea rdx, [rbp - 8]
call fcn.1401d50f0
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
lea rcx, [rsp + 0x48]
call fcn.140097490
mov rdi, rax
lea rax, [rbp - 0x78]
cmp rax, rdi
je 0x1400d13ae
lea rcx, [rbp - 0x78]
call fcn.140073500
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov r8, qword [rsp + 0x60]
cmp r8, 0x10
jb 0x1400d13cb
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400734c0
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x80]
call fcn.1401d0a60
mov rdi, rax
test dword [rax + 0x18], 0x200
je 0x1400d13f3
mov rcx, qword [rax + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 5
call fcn.140359a1c
mov qword [rdi + 0x20], rax
mov ecx, dword [str.Name]
mov dword [rax], ecx
movzx ecx, byte [0x1405f6dd8]
mov byte [rax + 4], cl
mov rax, qword [rdi + 0x20]
add rax, 4
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov rcx, rdi
call fcn.1401cdec0
mov rdx, rdi
mov rcx, rbx
call fcn.1401ccb30
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rsp + 0x48]
call fcn.140097490
mov rdi, rax
lea rax, [rbp - 0x78]
cmp rax, rdi
je 0x1400d149e
lea rcx, [rbp - 0x78]
call fcn.140073500
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov r8, qword [rsp + 0x60]
cmp r8, 0x10
jb 0x1400d14bb
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400734c0
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x80]
call fcn.1401d0a60
mov rdi, rax
test dword [rax + 0x18], 0x200
je 0x1400d14e3
mov rcx, qword [rax + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 8
call fcn.140359a1c
mov qword [rdi + 0x20], rax
mov rcx, qword [str.Version]
mov qword [rax], rcx
mov rax, qword [rdi + 0x20]
add rax, 7
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov rcx, rdi
call fcn.1401cdec0
mov rdx, rdi
mov rcx, rbx
call fcn.1401ccb30
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r15w
xor r8d, r8d
lea rdx, [0x1405e4f00]
lea rcx, [rbp - 0x58]
call fcn.1400739a0
nop
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400d1571
mov rcx, qword [r14]
lea rdx, [rbp - 0x58]
call fcn.1401d5690
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x48]
call fcn.140097490
mov rdi, rax
lea rax, [rbp - 0x78]
cmp rax, rdi
je 0x1400d15c5
lea rcx, [rbp - 0x78]
call fcn.140073500
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov r8, qword [rsp + 0x60]
cmp r8, 0x10
jb 0x1400d15e2
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400734c0
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x80]
call fcn.1401d0a60
mov rdi, rax
test dword [rax + 0x18], 0x200
je 0x1400d160a
mov rcx, qword [rax + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 0xa
call fcn.140359a1c
mov qword [rdi + 0x20], rax
movsd xmm0, qword [str.Publisher]
movsd qword [rax], xmm0
movzx ecx, word [0x1405f6dd0]
mov word [rax + 8], cx
mov rax, qword [rdi + 0x20]
add rax, 9
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov rcx, rdi
call fcn.1401cdec0
mov rdx, rdi
mov rcx, rbx
call fcn.1401ccb30
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400d168d
mov rcx, qword [r14]
lea rdx, [rbp + 0x390]
call fcn.140091910
test al, al
je 0x1400d1790
mov edx, 0x20
lea rcx, [rbp + 0x390]
call fcn.1401d4250
mov rdi, rax
test rax, rax
je 0x1400d1790
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140097490
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.1400a5360
mov r8, qword [rsp + 0x60]
cmp r8, 0x10
jb 0x1400d16f4
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1400734c0
mov rcx, rdi
call fcn.1403683a0
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x80]
call fcn.1401d0a60
mov rdi, rax
test dword [rax + 0x18], 0x200
je 0x1400d1724
mov rcx, qword [rax + 0x20]
call fcn.140359090
mov dword [rdi + 0x18], r15d
mov qword [rdi + 0x20], r15
mov qword [rdi + 0x28], r15
mov ecx, 7
call fcn.140359a1c
mov qword [rdi + 0x20], rax
mov ecx, dword [str.SHA256]
mov dword [rax], ecx
movzx ecx, word [0x1405f6de0]
mov word [rax + 4], cx
movzx ecx, byte [0x1405f6de2]
mov byte [rax + 6], cl
mov rax, qword [rdi + 0x20]
add rax, 6
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], 0x200
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov rcx, rdi
call fcn.1401cdec0
mov rdx, rdi
mov rcx, rbx
call fcn.1401ccb30
nop
lea rcx, [rbp - 0x58]
call fcn.140073b90
nop
lea rcx, [rbp - 0x28]
call fcn.140073b90
nop
lea rcx, [rbp - 8]
call fcn.140073b90
nop
lea rcx, [rsp + 0x40]
call fcn.140093ed0
nop
lea rdx, [rbp + 0x80]
mov r15d, 1
mov ecx, r15d
call fcn.1400d1960
movzx esi, al
test al, al
je 0x1400d1890
xor bl, bl
xor edx, edx
movzx ecx, r15b
call fcn.1401d3b80
mov rdi, rax
test rax, rax
je 0x1400d1860
lea r8, [rbp - 0x80]
lea rdx, str._sophos_
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400d1853
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x1400d1814
mov rcx, qword [r13]
mov eax, dword [r13 + 0x10]
add eax, eax
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x1400d1827
mov rdx, qword [r14]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, r15d
xor r8d, r8d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, bl
test eax, eax
cmove ebx, r15d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x1400d18d2
lea rax, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rax
je 0x1400d18d2
test byte [rcx + 0x1c], r15b
je 0x1400d18d2
cmp byte [rcx + 0x19], 4
jb 0x1400d18d2
cmp qword [r14 + 0x18], 8
jb 0x1400d1889
mov r14, qword [r14]
mov edx, 0x23
jmp 0x1400d18be
lea rax, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rax
je 0x1400d18d2
test byte [rcx + 0x1c], r15b
je 0x1400d18d2
cmp byte [rcx + 0x19], 4
jb 0x1400d18d2
cmp qword [r14 + 0x18], 8
jb 0x1400d18b9
mov r14, qword [r14]
mov edx, 0x24
mov r9, r14
lea r8, [0x1405f7158]
mov rcx, qword [rcx + 0x10]
call fcn.1400786c0
nop
lea rcx, [rbp - 0x78]
call fcn.140073500
nop
lea rcx, [rbp + 0x18]
call fcn.140073500
nop
lea rcx, [rbp + 0x80]
call fcn.1401ce800
nop
lea rcx, [rbp + 0x38]
call fcn.140073500
nop
lea rcx, [rbp + 0x58]
call fcn.140073b90
nop
lea rcx, [0x140686bf0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, sil
mov rcx, qword [rbp + 0x3b8]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x518]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
int3