Function at 0x1800061e0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Enumerate processes
Get common file path
Get startup folder
Get thread local storage value
Query environment variable
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2300]
mov eax, 0x2400
call fcn.1800f0250
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2440], rbx
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rbp + 0x22f0], rax
mov r12, r9
mov r15, r8
xor r13d, r13d
lea rdi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
cmp qword [0x1801c5338], r13
je 0x180006365
lea rcx, [0x1801c5338]
call fcn.1800d05a0
mov rax, qword [0x1801c5338]
cmp byte [rax + 0x78], r13b
je 0x180006365
cmp dword [rax + 0x80], 4
jb 0x180006365
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x210], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x210], xmm1
mov word [rbp + 0x200], r13w
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x1800062a3
mov r9, qword [r12]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x1800062b0
mov r8, qword [r15]
lea rdx, str.JumpToProtectMainPage_link___s__path___s
lea rcx, [rbp + 0x200]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x24c
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x200]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
test bl, bl
je 0x180006307
lea rdx, [rbp + 0x200]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x18000634d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006348
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ea8
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], r13w
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov byte [rsp + 0x31], 0
lea r9, [rsp + 0x31]
lea r8, [rbp + 0x40]
call fcn.180019060
mov esi, eax
cmp qword [0x1801c5338], 0
je 0x1800064bb
lea rcx, [0x1801c5338]
call fcn.1800d05a0
mov rcx, qword [0x1801c5338]
cmp byte [rcx + 0x78], 0
je 0x1800064bb
cmp dword [rcx + 0x80], 4
jb 0x1800064bb
movzx ebx, byte [rcx + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x230], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x220], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
mov r8d, esi
lea rdx, str.GetProtectMainPage_dwErr__0x_X_protectMainPage___s
lea rcx, [rbp + 0x220]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x253
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x220]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
test bl, bl
je 0x18000645d
lea rdx, [rbp + 0x220]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x1800064a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000649e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008eae
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], r13w
mov byte [rsp + 0x30], 0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.1800115e0
mov r14, 0xffffffffffffffff
test al, al
je 0x1800064fd
cmp qword [rbp + 0x30], 0
jne 0x1800065c6
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x12f0]
call fcn.18010e6d0
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x12f0]
call fcn.180033780
test al, al
je 0x1800065c6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x250], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x250], xmm1
mov word [rbp + 0x240], r13w
lea rax, [rbp + 0x12f0]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180006560
lea rdx, [rbp + 0x12f0]
lea rcx, [rbp + 0x240]
call fcn.180004a10
nop
lea rcx, [rbp + 0x20]
call fcn.180004980
movups xmm0, xmmword [rbp + 0x240]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x250]
movups xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movzx edi, byte [rsp + 0x30]
mov rax, qword [0x1801c5338]
test rax, rax
je 0x180006704
lea rcx, [0x1801c5338]
call fcn.1800d05a0
mov rax, qword [0x1801c5338]
cmp byte [rax + 0x78], 0
je 0x180006704
cmp dword [rax + 0x80], 4
jb 0x180006704
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x270], xmm1
mov word [rbp + 0x260], r13w
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
movzx r9d, dil
lea rdx, str.GetProtectMainPage_Other_Browser_protectMainPage___s__isLocked___d
lea rcx, [rbp + 0x260]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x261
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x260]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
test bl, bl
je 0x18000669f
lea rdx, [rbp + 0x260]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
mov rdx, qword [rbp + 0x278]
cmp rdx, 8
jb 0x1800066e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800066e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008eb4
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x270], xmm0
mov word [rbp + 0x260], r13w
mov rax, qword [0x1801c5338]
cmp qword [rbp + 0x50], 0
jne 0x1800068e0
test dil, dil
jne 0x1800068e0
test rax, rax
je 0x180006837
lea rcx, [0x1801c5338]
call fcn.1800d05a0
mov rax, qword [0x1801c5338]
cmp byte [rax + 0x78], dil
je 0x180006837
cmp dword [rax + 0x80], 4
jb 0x180006837
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x290], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x290], xmm1
mov word [rbp + 0x280], r13w
mov r8d, 0x1a
lea rdx, str.GetProtectMainPage
lea rcx, [rbp + 0x280]
call fcn.180004a10
mov dword [rsp + 0x28], 0x266
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x280]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
test bl, bl
je 0x1800067d9
lea rdx, [rbp + 0x280]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 8
jb 0x18000681f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000681a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008eba
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x280], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006877
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006872
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ec0
call fcn.1800ef5a0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x1800068c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800068c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ec6
call fcn.1800ef5a0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov eax, esi
jmp 0x180008e6c
lea rcx, [rbp + 0xa0]
call fcn.1800a3720
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rcx, qword [rbp + 0xa0]
lea rdx, str.explorer.exe
call fcn.180111250
test eax, eax
je 0x180006b4e
call fcn.1800096b0
test al, al
jne 0x180006b4e
cmp qword [0x1801c5338], 0
je 0x180006a49
lea rcx, [0x1801c5338]
call fcn.1800d05a0
mov rax, qword [0x1801c5338]
cmp byte [rax + 0x78], 0
je 0x180006a49
cmp dword [rax + 0x80], 4
jb 0x180006a49
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2b0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x2b0], xmm1
mov word [rbp + 0x2a0], r13w
mov r8d, 0x17
lea rdx, str.other_desk_close_swtich
lea rcx, [rbp + 0x2a0]
call fcn.180004a10
mov dword [rsp + 0x28], 0x270
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x2a0]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
test bl, bl
je 0x1800069eb
lea rdx, [rbp + 0x2a0]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 8
jb 0x180006a31
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ecc
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x2b0], xmm0
mov word [rbp + 0x2a0], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180006a8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ed2
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006ae7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ae2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ed8
call fcn.1800ef5a0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006b38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ede
call fcn.1800ef5a0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
jmp 0x180008e67
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x360], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x360]
call fcn.180004a10
nop
lea rcx, [rbp + 0x360]
call fcn.1800a2740
test al, al
sete bl
mov rdx, qword [rbp + 0x378]
cmp rdx, 8
jb 0x180006be2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006bdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ee4
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x360], r13w
test bl, bl
je 0x180006f47
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x140]
call fcn.180004a10
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006cd8
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x6a4]
call fcn.18010e6d0
mov dword [rbp + 0x6a0], 0x238
lea rdx, [rbp + 0x6a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180006ccf
nop
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x6cc]
call fcn.180111250
mov rcx, rbx
test eax, eax
je 0x180006f3a
lea rdx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180006c90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x180006d20
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006d1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008eea
call fcn.1800ef5a0
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
test bl, bl
je 0x180006f47
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180006e43
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x190], xmm1
mov word [rbp + 0x180], r13w
mov r8d, 0xd
lea rdx, str.not_found_rtp
lea rcx, [rbp + 0x180]
call fcn.180004a10
mov dword [rsp + 0x28], 0x293
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x180]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180006de5
lea rdx, [rbp + 0x180]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x180006e2b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006e26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ef0
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180006e89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006e84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ef6
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006ee1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006edc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008efc
call fcn.1800ef5a0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006b38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e9c
jmp 0x180006b33
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x180006cda
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x130], xmm1
mov word [rbp + 0x120], r13w
movdqu xmmword [rbp + 0x170], xmm0
movdqu xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x160], r13w
mov r8d, 0xa
lea rdx, str.2345PCSafe
lea rcx, [rbp + 0x160]
call fcn.180004a10
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x120]
call fcn.180004a10
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x18000700d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007008
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f02
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r13w
lea rcx, [rbp + 0x120]
call fcn.18003fc80
test al, al
je 0x1800073bc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x390], xmm1
mov word [rbp + 0x380], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x380]
call fcn.180004a10
nop
lea rcx, [rbp + 0x380]
call fcn.1800a2740
test al, al
sete bl
mov rdx, qword [rbp + 0x398]
cmp rdx, 8
jb 0x1800070cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800070c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f08
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x380], r13w
test bl, bl
je 0x1800073bc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x310], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x310], xmm1
mov word [rbp + 0x300], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x300]
call fcn.180004a10
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x18000713f
xor bl, bl
jmp 0x180007151
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.180008f30
movzx ebx, al
mov rdx, qword [rbp + 0x318]
cmp rdx, 8
jb 0x180007197
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007192
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f0e
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x310], xmm0
mov word [rbp + 0x300], r13w
test bl, bl
jne 0x1800073bc
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x1800072b8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x1b0], xmm1
mov word [rbp + 0x1a0], r13w
mov r8d, 0xe
lea rdx, str.not_found_tray
lea rcx, [rbp + 0x1a0]
call fcn.180004a10
mov dword [rsp + 0x28], 0x2a0
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x1a0]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x18000725a
lea rdx, [rbp + 0x1a0]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x1800072a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000729b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f14
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], r13w
lea rcx, [rbp + 0x120]
call fcn.180004980
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x18000730b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007306
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f1a
call fcn.1800ef5a0
movdqa xmm0, xmmword [0x180171380]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180007363
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000735e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f20
call fcn.1800ef5a0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006b38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ea2
jmp 0x180006b33
mov r8, qword [rbp + 0x30]
test r8, r8
je 0x180007592
mov rdi, r8
cmp r8, 1
jb 0x18000744a
mov rbx, r13
test r8, r8
je 0x180007418
nop word [rax + rax]
cmp r8, rbx
jbe 0x180008e96
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
movzx edx, word [rax + rbx*2]
lea rcx, str.__r_t_n
call fcn.18010dc38
mov r8, qword [rbp + 0x30]
test rax, rax
je 0x180007418
inc rbx
cmp rbx, rdi
jb 0x1800073e0
test rbx, rbx
je 0x18000744a
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
sub r8, rbx
mov qword [rbp + 0x30], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.18010e270
lea rdx, str.__r_t_n
lea rcx, [rbp + 0x20]
call fcn.18009fa70
lea rcx, [rbp + 0x20]
call fcn.18009fc00
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 5
lea rdx, str.http:
call fcn.180114d30
test eax, eax
je 0x180007592
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 6
lea rdx, str.https:
call fcn.180114d30
test eax, eax
je 0x180007592
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xb
lea rdx, str.about:blank
call fcn.180114d30
test eax, eax
je 0x180007592
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xa
lea rdx, str.about:tabs
call fcn.180114d30
test eax, eax
je 0x180007592
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x1d0], xmm1
mov word [rbp + 0x1c0], r13w
mov r8d, 7
lea rdx, str.http:__
lea rcx, [rbp + 0x1c0]
call fcn.180004a10
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.18000d050
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x20]
call fcn.180004a10
nop
lea rcx, [rbp + 0x1c0]
call fcn.180004980
mov eax, dword [0x1801c4a48]
test eax, eax
je 0x180007684
mov ebx, dword [0x1801c4a48]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
andps xmm1, xmmword [0x1801713e0]
movsd xmm0, qword [0x180171350]
comisd xmm0, xmm1
jb 0x180007684
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x18000767f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x4b0], xmm1
mov word [rbp + 0x4a0], r13w
mov r8d, 0x1c
lea rdx, str.JumpToProtectMainPage
lea rcx, [rbp + 0x4a0]
call fcn.180004a10
mov dword [rsp + 0x28], CDefFolderMenu_Create2
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4a0]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180007672
lea rdx, [rbp + 0x4a0]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x4a0]
call fcn.180004980
nop
jmp 0x180008e3a
call fcn.18000c560
test al, al
jne 0x180007699
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [0x1801c4a48], eax
mov eax, 1
xchg dword [0x1801c29ec], eax
test eax, eax
jne 0x1800076ad
call fcn.180026da0
lea rdx, [rbp + 0x40]
call fcn.180027490
test al, al
je 0x180007704
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x600]
call fcn.1800169f0
nop
mov r8, qword [rbp + 0x610]
test r8, r8
je 0x1800076f8
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 8
cmovae rdx, qword [rbp + 0x600]
lea rcx, [rbp + 0x40]
call fcn.18000d050
nop
lea rcx, [rbp + 0x600]
call fcn.180004980
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x18000772a
mov rdx, qword [r15]
lea r8, [rbp + 0x60]
call fcn.180017980
mov ecx, dword [0x1801c29dc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x18000780f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x4d0], xmm1
mov word [rbp + 0x4c0], r13w
cmp qword [r12 + 0x18], 8
jb 0x18000778c
mov r12, qword [r12]
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r9, qword [rbp + 0x60]
mov qword [rsp + 0x20], r12
mov r8, rdi
lea rdx, str.pAction___p_targetFileName___s_currentPath___s
lea rcx, [rbp + 0x4c0]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x2d2
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4c0]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180007801
lea rdx, [rbp + 0x4c0]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x4c0]
call fcn.180004980
jmp 0x180007816
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
xor edx, edx
mov ecx, dword [0x1801c29dc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp qword [rbp + 0x50], 0
jne 0x18000790b
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, [0x180164298]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x18000790b
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x1800078fc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x4f0], xmm1
mov word [rbp + 0x4e0], r13w
mov r8d, 0x26
lea rdx, str.GetProtectMainPage_fail_and_path_is_ie
lea rcx, [rbp + 0x4e0]
call fcn.180004a10
mov dword [rsp + 0x28], 0x2d8
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4e0]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x1800078ef
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x4e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
jmp 0x180008e3a
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x180007918
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000793e
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007c4c
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.18000cd00
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1800056b0
nop
cmp qword [rbp + 0xf0], 0
jne 0x180007a87
cmp qword [rbp + 0x70], 0
jbe 0x180007c40
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.18000cd00
nop
mov rdx, rax
lea rcx, [rbp + 0x660]
call fcn.1800056b0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.18000cc70
nop
lea rcx, [rbp + 0x660]
call fcn.180004980
cmp qword [rbp + 0xf0], 0
jbe 0x180007c40
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180007b40
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x510], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x510], xmm1
mov word [rbp + 0x500], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.targetFileName_guid_file_path___ws
lea rcx, [rbp + 0x500]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x2e9
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x500]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180007a7b
lea rdx, [rbp + 0x500]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x500]
jmp 0x180007b3b
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180007b40
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x530], xmm1
mov word [rbp + 0x520], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.linkName_guid_file_path___ws
lea rcx, [rbp + 0x520]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x2ef
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x520]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180007b34
lea rdx, [rbp + 0x520]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x520]
call fcn.180004980
cmp qword [rbp + 0xf0], 0
jbe 0x180007c40
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, [0x180164298]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180007bc9
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str._shdocvw.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180007bc9
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str.ieframe.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007c40
lea rdx, [rbp + 0x680]
call fcn.18001ae70
nop
lea r8, [rbp + 0x40]
mov rdx, rax
call fcn.180019360
movzx ebx, al
lea rcx, [rbp + 0x680]
call fcn.180004980
test bl, bl
je 0x180007c40
lea rcx, [rbp + 0xe0]
call fcn.180004980
nop
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
lea rcx, [rbp + 0x120]
call fcn.180004980
nop
lea rcx, [rbp + 0xa0]
call fcn.180004980
nop
lea rcx, [rbp + 0x20]
call fcn.180004980
nop
lea rcx, [rbp + 0x40]
call fcn.180004980
xor eax, eax
jmp 0x180008e6c
lea rcx, [rbp + 0xe0]
call fcn.180004980
cmp rdi, 1
jne 0x180007d02
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007ce2
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x590], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x590], xmm1
mov word [rbp + 0x580], r13w
xor r8d, r8d
lea rdx, [0x180163940]
lea rcx, [rbp + 0x580]
call fcn.180004a10
nop
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x60]
call fcn.180019360
movzx ebx, al
lea rcx, [rbp + 0x580]
call fcn.180004980
test bl, bl
je 0x180007d02
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
jmp 0x180007c0c
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180019360
test al, al
je 0x180007d02
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
jmp 0x180007c0c
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.18000cd00
nop
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007e23
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1af0]
call fcn.18010e6d0
mov r9d, 1
lea r8d, [r9 + 0xf]
lea rdx, [rbp + 0x1af0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180007e23
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
lea rdx, [rbp + 0x1af0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007e23
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
je 0x180007e23
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xaf0]
call fcn.18010e6d0
mov r9d, 1
lea r8d, [r9 + 0x18]
lea rdx, [rbp + 0xaf0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rdx, rbx
lea rcx, [rbp + 0xaf0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, [rbp + 0xaf0]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180007e05
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0x100]
call fcn.180004a10
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0x80], r13w
xor r8d, r8d
lea rdx, [0x180163940]
lea rcx, [rbp + 0x80]
call fcn.180004a10
nop
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r13w
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x5b0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x5b0], xmm1
mov word [rbp + 0x5a0], r13w
mov r8, r14
inc r8
cmp word [rdx + r8*2], 0
jne 0x180007ec2
lea rcx, [rbp + 0x5a0]
call fcn.180004a10
nop
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5a0]
call fcn.18001c8e0
mov ebx, eax
lea rcx, [rbp + 0x5a0]
call fcn.180004980
test ebx, ebx
jne 0x180008d66
cmp qword [rbp + 0xd0], 0
jne 0x180008046
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, [0x180164298]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180008046
lea edx, [rbx + 4]
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180007ffc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x550], xmm1
mov word [rbp + 0x540], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180164400]
lea rcx, [rbp + 0x540]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x331
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x540]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180007ff0
lea rdx, [rbp + 0x540]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x540]
call fcn.180004980
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x80]
call fcn.180019360
test al, al
je 0x180008046
lea rcx, [rbp + 0xc0]
call fcn.180004980
nop
lea rcx, [rbp + 0x80]
call fcn.180004980
nop
lea rcx, [rbp + 0x100]
call fcn.180004980
nop
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
jmp 0x180007c0c
cmp byte [rsp + 0x30], 0
je 0x180008826
lea rcx, [rsp + 0x48]
call fcn.18000e330
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.180004a10
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqa xmmword [rbp + 0x2f0], xmm1
mov word [rbp + 0x2e0], r13w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x40]
call fcn.18000cd00
nop
lea r8, [rbp + 0x2c0]
mov rdx, rax
call fcn.1800111b0
test al, al
je 0x1800087b1
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x1800081b1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x570], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x570], xmm1
mov word [rbp + 0x560], r13w
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180164420]
lea rcx, [rbp + 0x560]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x340
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x560]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x1800081a5
lea rdx, [rbp + 0x560]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x560]
call fcn.180004980
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x80]
call fcn.180011ad0
test al, al
je 0x1800087b1
lea rdx, [rbp + 0x40]
call fcn.180027490
test al, al
je 0x18000822a
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5c0]
call fcn.1800165b0
nop
mov r8, qword [rbp + 0x5d0]
test r8, r8
je 0x18000821e
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 8
cmovae rdx, qword [rbp + 0x5c0]
lea rcx, [rbp + 0x40]
call fcn.18000d050
nop
lea rcx, [rbp + 0x5c0]
call fcn.180004980
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1e0]
call fcn.18000cd00
nop
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180008305
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x3b0], xmm1
mov word [rbp + 0x3a0], r13w
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r8, qword [rbp + 0xc0]
mov eax, dword [rbp + 0x2c4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x2c0]
lea rdx, [0x180164470]
lea rcx, [rbp + 0x3a0]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x34f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3a0]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x1800082f9
lea rdx, [rbp + 0x3a0]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x3a0]
call fcn.180004980
cmp dword [rbp + 0x2c4], 1
jne 0x180008432
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2c8]
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x320]
call fcn.180010670
nop
mov r8, qword [rbp + 0x330]
test r8, r8
je 0x180008426
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rdx, qword [rbp + 0x320]
lea rcx, [rbp + 0x1e0]
call fcn.180004a10
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180008426
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x3d0], xmm1
mov word [rbp + 0x3c0], r13w
lea r8, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae r8, qword [rbp + 0x320]
lea rdx, [0x1801644f0]
lea rcx, [rbp + 0x3c0]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x358
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3c0]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180008419
lea rdx, [rbp + 0x3c0]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x3c0]
call fcn.180004980
nop
lea rcx, [rbp + 0x320]
call fcn.180004980
cmp dword [rbp + 0x2c0], 1
jne 0x180008564
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x60]
call fcn.18000cd00
nop
mov r8, rax
lea rdx, [rbp + 0x340]
call fcn.180010030
nop
mov r8, qword [rbp + 0x350]
test r8, r8
je 0x180008558
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rdx, qword [rbp + 0x340]
lea rcx, [rbp + 0x1e0]
call fcn.180004a10
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180008558
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x3f0], xmm1
mov word [rbp + 0x3e0], r13w
lea r8, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae r8, qword [rbp + 0x340]
lea rdx, [0x180164530]
lea rcx, [rbp + 0x3e0]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x363
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3e0]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x18000854b
lea rdx, [rbp + 0x3e0]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x3e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x340]
call fcn.180004980
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x5e0]
call fcn.180011f70
nop
lea r8, [rbp + 0x1e0]
cmp qword [rbp + 0x5f0], 0
je 0x18000869a
lea rdx, [rbp + 0x5e0]
call fcn.180019360
test al, al
je 0x180008797
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x20]
call fcn.18000cd00
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000efe0
nop
lea rcx, [rbp + 0x5e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000ce30
nop
mov rcx, qword [0x1801c4ad8]
test rcx, rcx
je 0x180008616
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c4ad8]
sub dword [0x1801c29e8], 1
jne 0x180008633
call fcn.1800207f0
mov rcx, rax
call fcn.180020b80
mov rcx, qword [0x1801c4ad8]
test rcx, rcx
je 0x18000863f
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180013130
nop
mov edx, 0x60
mov rcx, qword [rsp + 0x48]
call fcn.180004c40
nop
lea rcx, [rbp + 0xc0]
call fcn.180004980
nop
lea rcx, [rbp + 0x80]
call fcn.180004980
nop
lea rcx, [rbp + 0x100]
call fcn.180004980
nop
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
jmp 0x180007c0c
lea rdx, [rbp + 0x80]
call fcn.180019360
test al, al
je 0x180008797
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp]
call fcn.18000cd00
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000efe0
nop
lea rcx, [rbp + 0x5e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000ce30
nop
mov rcx, qword [0x1801c4ad8]
test rcx, rcx
je 0x180008723
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c4ad8]
sub dword [0x1801c29e8], 1
jne 0x180008740
call fcn.1800207f0
mov rcx, rax
call fcn.180020b80
mov rcx, qword [0x1801c4ad8]
test rcx, rcx
je 0x18000874c
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012ae0
nop
lea rcx, [rbp + 0xc0]
call fcn.180004980
nop
lea rcx, [rbp + 0x80]
call fcn.180004980
nop
lea rcx, [rbp + 0x100]
call fcn.180004980
nop
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
jmp 0x180007c0c
lea rcx, [rbp + 0x5e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004980
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000ce30
nop
mov rcx, qword [0x1801c4ad8]
test rcx, rcx
je 0x1800087e4
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c4ad8]
sub dword [0x1801c29e8], 1
jne 0x180008801
call fcn.1800207f0
mov rcx, rax
call fcn.180020b80
mov rcx, qword [0x1801c4ad8]
test rcx, rcx
je 0x18000880d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012ae0
jmp 0x1800088ce
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x1800088ce
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x410], xmm1
mov word [rbp + 0x400], r13w
mov r8d, 0x1b
lea rdx, str.Other_Browser_Home
lea rcx, [rbp + 0x400]
call fcn.180004a10
mov dword [rsp + 0x28], 0x37e
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x400]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x1800088c2
lea rdx, [rbp + 0x400]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x400]
call fcn.180004980
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x650], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x650], xmm1
mov word [rbp + 0x640], r13w
movdqu xmmword [rbp + 0x630], xmm0
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r13w
lea rcx, [rsp + 0x40]
call fcn.18001ba00
nop
lea rcx, [rsp + 0x40]
call fcn.18001bc20
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.18001be50
test al, al
je 0x180008c6f
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x640]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.18001bda0
test al, al
je 0x180008c6f
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180008a1c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x430], xmm1
mov word [rbp + 0x420], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x1801645b0]
lea rcx, [rbp + 0x420]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x389
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x420]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180008a10
lea rdx, [rbp + 0x420]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x420]
call fcn.180004980
cmp qword [rbp + 0x70], 0
jne 0x180008ace
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180008a68
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
jmp 0x180008ac5
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x8e0]
call fcn.18010e6d0
mov r8d, 0x104
lea rdx, [rbp + 0x8e0]
lea rcx, str._ProgramFiles_Internet_Exploreriexplore.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180008ace
lea rax, [rbp + 0x8e0]
nop
inc r14
cmp word [rax + r14*2], 0
jne 0x180008ab0
mov r8, r14
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0x60]
call fcn.180004a10
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180008b41
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x40]
call fcn.180004a10
mov r8d, 1
lea rdx, [0x18016462c]
lea rcx, [rbp + 0x40]
call fcn.18000d050
mov r8d, 0xb
lea rdx, [0x180164630]
lea rcx, [rbp + 0x40]
call fcn.18000d050
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180008bff
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x450], xmm1
mov word [rbp + 0x440], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r8, qword [rbp + 0x60]
lea rdx, [0x180164648]
lea rcx, [rbp + 0x440]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x3a3
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x440]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180008bf3
lea rdx, [rbp + 0x440]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x440]
call fcn.180004980
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180019360
test al, al
je 0x180008d34
lea rcx, [rsp + 0x40]
call fcn.18001ba60
nop
lea rcx, [rbp + 0x620]
call fcn.180004980
nop
lea rcx, [rbp + 0x640]
call fcn.180004980
nop
lea rcx, [rbp + 0xc0]
call fcn.180004980
nop
lea rcx, [rbp + 0x80]
call fcn.180004980
nop
lea rcx, [rbp + 0x100]
call fcn.180004980
nop
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
jmp 0x180007c0c
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov edi, eax
test eax, eax
je 0x180008d34
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x470], xmm1
mov word [rbp + 0x460], r13w
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
mov r8d, eax
lea rdx, str.RCBlackShortCut_Analyze_Fail___x_lnk___s
lea rcx, [rbp + 0x460]
call fcn.1800d1720
mov dword [rsp + 0x28], 0x3ab
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x460]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp edi, 1
jbe 0x180008d28
lea rdx, [rbp + 0x460]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x460]
call fcn.180004980
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180008d42
mov byte [rax + 8], 0
lea rcx, [rsp + 0x40]
call fcn.18001ba60
nop
lea rcx, [rbp + 0x620]
call fcn.180004980
nop
lea rcx, [rbp + 0x640]
jmp 0x180008e03
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1200
mov ebx, eax
test eax, eax
je 0x180008e09
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x180171380]
movdqu xmmword [rbp + 0x490], xmm1
mov word [rbp + 0x480], r13w
lea rdx, str.GetShortCutTargetCmdEx_Fail
lea rcx, [rbp + 0x480]
call fcn.1800049f0
mov dword [rsp + 0x28], 0x3b1
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x480]
mov edx, 4
lea rcx, [0x1801c5338]
call fcn.1800d1250
cmp ebx, 1
jbe 0x180008dfc
lea rdx, [rbp + 0x480]
lea rcx, [0x1801c5338]
call fcn.1800d15e0
nop
lea rcx, [rbp + 0x480]
call fcn.180004980
nop
lea rcx, [rbp + 0xc0]
call fcn.180004980
nop
lea rcx, [rbp + 0x80]
call fcn.180004980
nop
lea rcx, [rbp + 0x100]
call fcn.180004980
nop
lea rcx, [rbp + 0x60]
call fcn.180004980
nop
lea rcx, [rbp + 0x120]
call fcn.180004980
nop
lea rcx, [rbp + 0xa0]
call fcn.180004980
nop
lea rcx, [rbp + 0x20]
call fcn.180004980
nop
lea rcx, [rbp + 0x40]
call fcn.180004980
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x22f0]
xor rcx, rsp
call fcn.1800ef540
mov rbx, qword [rsp + 0x2440]
add rsp, 0x2400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180013320
nop
call fcn.180111064
int3
call fcn.180111064
int3
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
int3
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
int3
call fcn.180111064
int3
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
int3
call fcn.180111064
int3
call fcn.180111064
int3
call fcn.180111064
nop
call fcn.180111064
nop
call fcn.180111064
int3