Function at 0x1400607b0
Capabilities:
Bypass mark of the web
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov rsi, rcx
mov rcx, qword [rbp + 0x500]
mov qword [rsp + 0x58], rcx
mov r12, qword [rsi + 8]
movzx r13d, r8w
mov ecx, r13d
xor ebx, ebx
cmp r13d, 0x9c41
ja 0x140060873
je 0x140060844
sub ecx, 1
je case.0x1400608b5.40003
cmp ecx, 0x12b
jne case.default.0x140062b48
mov qword [rsp + 0x20], rbx
lea r9, [0x1400200e0]
mov r8, r12
lea rdx, str.ABOUTBOX
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x140062e09
mov rax, qword [rsi + 0x260]
mov qword [rsp + 0x20], rax
lea r9, [0x14003f520]
mov r8, r12
lea rdx, str.COLUMNCHOOSER
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x140062e09
mov edi, 0xd101
cmp r13d, edi
ja 0x140062b25
je case.0x140062b48.53506
sub ecx, 0x9c43
cmp ecx, 0xa4
ja case.default.0x140062b48
movsxd rax, ecx
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x62f28]
mov ecx, dword [rdx + rax*4 + 0x62e58]
add rcx, rdx
jmp rcx
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x9c53
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x140062b48
cmp byte [0x14013ca64], bl
sete al
mov byte [0x14013ca64], al
movzx r8d, al
lea rcx, [rsi + 0x80]
xor r9d, r9d
mov edx, r13d
call fcn.140069a80
movzx edx, byte [0x14013ca64]
mov rcx, r12
call fcn.140074cb0
jmp case.default.0x140062b48
cmp byte [0x14013ca67], bl
sete al
mov byte [0x14013ca67], al
mov edx, 0x9cc0
movzx r8d, al
lea rcx, [rsi + 0x80]
xor r9d, r9d
call fcn.140069a80
lea rcx, [0x1401424a0]
call fcn.1400326d0
jmp case.default.0x140062b48
cmp byte [0x14013ca68], bl
sete al
mov byte [0x14013ca68], al
mov edx, 0x9ce6
jmp 0x140060920
cmp byte [0x14013ca69], bl
sete al
mov byte [0x14013ca69], al
mov edx, 0x9ce7
jmp 0x140060920
mov dl, 1
mov rcx, qword [rsi + 0x260]
call fcn.14005c340
jmp case.default.0x140062b48
lea rcx, [0x1401424a0]
call fcn.1400312d0
test al, al
je 0x1400609b6
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.Bookmarks_are_not_enabled_because_the_file_is_read_only.
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x140062b48
mov rcx, qword [rsi + 0x260]
call fcn.140021150
jmp case.default.0x140062b48
mov edx, dword [rsi + 0x42d8]
mov ecx, 0x9cdd
mov eax, edx
or eax, 1
and edx, 0xfffffffe
cmp r13w, cx
cmovne edx, eax
mov dword [rsi + 0x42d8], edx
mov byte [rsp + 0x48], bl
and edx, 1
lea edx, [rdx*2 - 1]
lea r8, [rsp + 0x48]
mov rcx, qword [rsi + 0x260]
call fcn.140021570
test al, al
jne 0x140060a6e
cmp byte [rsp + 0x48], bl
jne 0x140060a6e
lea rcx, str.No_more_bookmarks
call fcn.1400b0640
mov rdx, rax
lea rcx, str.No_more_bookmarks
call fcn.1400b0780
mov qword [rsp + 0x50], rax
mov rcx, r12
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rcx, [rsp + 0x50]
call fcn.1400b0200
mov r9d, gethostbyaddr
lea r8, [0x1400f7478]
mov rdx, rax
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140060a6e
call fcn.1400b0810
nop
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, r12
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.default.0x140062b48
cmp byte [0x14013ca65], bl
sete al
mov byte [0x14013ca65], al
movzx r8d, al
lea rcx, [rsi + 0x80]
xor r9d, r9d
mov edx, 0x9c53
call fcn.140069a80
jmp 0x140062e09
mov qword [rsp + 0x20], rbx
lea r9, [0x1400a25e0]
mov r8, r12
lea rdx, [0x140100ef0]
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x140062b48
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1042
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
test eax, eax
js case.default.0x140062b48
lea r15, [0x1401424a0]
mov qword [rbp], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
movsxd r8, edi
lea rdx, [rbp + 0x10]
mov rcx, r15
call fcn.140021860
nop
mov qword [rsp + 0x50], rbx
lea r8, [rsp + 0x50]
mov edx, 0xffffffff
lea rcx, [rbp + 0x10]
call fcn.140029410
mov rax, qword [rbp + 0x20]
movzx ecx, word [rax + 8]
sub ecx, 2
je 0x140060b8f
cmp ecx, 1
je 0x140060b6c
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.Jump_not_implemented_for_this_event_class
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140060bb1
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
test rcx, rcx
je 0x140060b80
call fcn.1400b04e0
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.14005a8d0
jmp 0x140060bb1
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
test rcx, rcx
je 0x140060ba3
call fcn.1400b04e0
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.14005aaf0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140060bc1
call fcn.1400b0810
nop
lea rcx, [rbp + 0x10]
call fcn.140028220
nop
jmp 0x140062df9
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1042
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
test eax, eax
js case.default.0x140062b48
lea r15, [0x1401424a0]
mov qword [rbp], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
movsxd r8, edi
lea rdx, [rbp + 0x10]
mov rcx, r15
call fcn.140021860
nop
cmp qword [rbp + 0x20], 0
je 0x140060c4a
mov r9d, 0x104
lea r8, [rbp + 0x280]
mov edx, 0x9c75
lea rcx, [rbp + 0x10]
call fcn.140029c30
lea rdx, [rbp + 0x280]
mov rcx, r12
call fcn.140074240
nop
lea rcx, [rbp + 0x10]
call fcn.140028220
nop
jmp 0x140062df9
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1042
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js case.default.0x140062b48
lea rcx, [rsi + 0x70]
mov r9d, r13d
mov r8d, eax
mov rdx, r12
call fcn.140048280
jmp case.default.0x140062b48
lea r14, [0x140100e24]
mov edi, 5
nop dword [rax]
mov eax, dword [r14 - 4]
cmp eax, r13d
jne 0x140060ccf
mov r8d, eax
xor r9d, r9d
mov edx, 0x40a
mov rcx, qword [rsi + 0x268]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
setne dl
mov ecx, dword [r14]
call fcn.1400965d0
add r14, 8
sub rdi, 1
jne 0x140060ca0
jmp case.default.0x140062b48
cmp byte [0x14013ca66], bl
sete al
mov byte [0x14013ca66], al
movzx r8d, al
lea rcx, [rsi + 0x80]
xor r9d, r9d
mov edx, 0x9c7f
call fcn.140069a80
cmp byte [0x14013ca66], bl
sete dl
lea rcx, [0x1401425a0]
call fcn.14002dbf0
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.140031cf0
jmp case.default.0x140062b48
mov rcx, qword [0x1401430f0]
test rcx, rcx
je 0x140060d56
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401430f0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x140062e09
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov rsi, rax
mov qword [rbp], rax
test rax, rax
je 0x140060da5
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CFilterDlg.0
mov qword [rsi], rax
mov dword [rsi + 0x68], UnRegisterTypeLib
jmp 0x140060da8
mov rsi, rbx
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call fcn.14005e740
mov rcx, qword [rsi + 8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140062e09
lea rcx, [0x1401425a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdi, qword [0x1401425d0]
sub rdi, qword [0x1401425c8]
lea rcx, [0x1401425a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, 0x20
jae 0x140060e1b
mov r9d, 0x40
lea r8, [0x1400f7478]
lea rdx, str.No_filter_rules_are_currently_defined
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp case.default.0x140062b48
mov qword [rsp + 0x20], rbx
lea r9, [0x1400a8150]
mov r8, r12
lea rdx, str.SAVE_FILTER
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rdx, qword [rsi + 0x4290]
lea rcx, [0x140143588]
call fcn.14005f430
jmp case.default.0x140062b48
mov qword [rsp + 0x20], rbx
lea r9, [0x14007dc00]
mov r8, r12
lea rdx, str.ORGANIZE_FILTERS
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rdx, qword [rsi + 0x4290]
lea rcx, [0x140143588]
call fcn.14005f430
jmp case.default.0x140062b48
mov rcx, qword [0x1401430f8]
test rcx, rcx
je 0x140060eba
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401430f8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.default.0x140062b48
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov rsi, rax
mov qword [rbp], rax
test rax, rax
je 0x140060f05
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CHighlightDlg.0
mov qword [rsi], rax
mov byte [rsi + 0x68], bl
jmp 0x140060f08
mov rsi, rbx
mov rax, qword [rsi + 0x28]
test rax, rax
jne 0x140060f3c
call fcn.1400b6d28
mov qword [rsi + 0x28], rax
test rax, rax
jne 0x140060f3c
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 5
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x140062b48
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [rsi + 0x10]
test rdi, rdi
je 0x140062e35
test rsi, rsi
je 0x140062e35
mov qword [rdi], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rbx
lea r9, [0x140048560]
mov r8, r12
mov edx, 0xbc
mov rcx, qword [0x140144400]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov edx, 5
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x140062b48
mov r8d, dword [0x14013ca78]
mov edx, dword [0x14013ca7c]
lea rcx, [rbp + 0x10]
call fcn.1400580f0
nop
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdi, rax
mov rax, qword [rbp + 0x38]
test rax, rax
jne 0x140061011
call fcn.1400b6d28
mov qword [rbp + 0x38], rax
test rax, rax
jne 0x140061011
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400610b1
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rax, [rbp + 0x10]
mov qword [rbp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x28], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [0x14013c370], rax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rbx
lea r9, [0x140048560]
mov r8, rdi
mov edx, 0xbd
mov rcx, qword [0x140144400]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, 1
jne 0x1400610b1
lea rcx, [rbp + 0x10]
call fcn.140058390
mov dword [0x14013ca7c], eax
lea rcx, [rbp + 0x10]
call fcn.1400583a0
mov dword [0x14013ca78], eax
lea rcx, [0x1401424a0]
call fcn.1400326d0
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je case.default.0x140062b48
call fcn.1400b6df8
jmp case.default.0x140062b48
mov dword [rsp + 0x60], WSAGetLastError
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x10], xmm1
movups xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
movups xmmword [rbp + 0x40], xmm1
movups xmmword [rbp + 0x50], xmm1
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], eax
lea r8, [rbp + 0x10]
lea edx, [rax + 0x5c]
mov rcx, qword [0x14013c8d0]
call qword [sym.imp.GDI32.dll_GetObjectW]
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x10]
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x7c], 0x10041
lea rcx, [rsp + 0x60]
call qword [sym.imp.COMDLG32.dll_ChooseFontW]
test eax, eax
je case.default.0x140062b48
mov rcx, qword [0x14013c8d0]
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rcx, [rbp + 0x10]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [0x14013c8d0], rax
xor r9d, r9d
mov r8, rax
lea edx, [r9 + 0x30]
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0x320
mov ecx, 0x2bc
cmp dword [rbp + 0x20], ecx
cmovl eax, ecx
mov dword [rbp + 0x20], eax
mov rcx, qword [0x14013c8d8]
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rcx, [rbp + 0x10]
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [0x14013c8d8], rax
lea rdx, [rbp]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0xc]
mov r8d, dword [rbp + 4]
sub eax, r8d
mov r9d, dword [rbp + 8]
mov edx, dword [rbp]
sub r9d, edx
dec r9d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [rbp + 0xc]
mov r8d, dword [rbp + 4]
sub eax, r8d
mov r9d, dword [rbp + 8]
mov edx, dword [rbp]
sub r9d, edx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MoveWindow]
lea rdx, [rbp]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rbp + 0xc]
mov r9d, dword [rbp + 4]
sub ecx, r9d
mov eax, dword [rbp + 8]
mov r8d, dword [rbp]
sub eax, r8d
dec eax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [rbp + 0xc]
mov r9d, dword [rbp + 4]
sub ecx, r9d
mov eax, dword [rbp + 8]
mov r8d, dword [rbp]
sub eax, r8d
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp case.default.0x140062b48
mov qword [rsp + 0x20], rbx
lea r9, [0x140059490]
mov r8, r12
lea rdx, str.HISTORY_DEPTH
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x140062e09
lea rcx, [0x1401424a0]
call fcn.140030320
test eax, eax
je 0x1400612e0
mov qword [rsp + 0x20], rbx
lea r9, [0x1400b4ba0]
mov r8, r12
lea rdx, str.SYSTEM_DETAILS
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x140062e09
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.There_are_no_events_in_the_trace
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140062e09
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov rsi, rax
mov qword [rbp], rax
test rax, rax
je 0x14006134f
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.COccurrencesDlg.0
mov qword [rsi], rax
mov qword [rsi + 0x68], rbx
jmp 0x140061352
mov rsi, rbx
mov rax, qword [rsi + 0x28]
test rax, rax
jne 0x140061386
call fcn.1400b6d28
mov qword [rsi + 0x28], rax
test rax, rax
jne 0x140061386
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 5
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140062e09
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [rsi + 0x10]
test rdi, rdi
je 0x140062e35
test rsi, rsi
je 0x140062e35
mov qword [rdi], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rbx
lea r9, [0x140048560]
mov r8, r12
mov edx, 0xbf
mov rcx, qword [0x140144400]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov edx, 5
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140062e09
mov rcx, qword [0x1401430e8]
test rcx, rcx
je 0x14006143f
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401430e8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x14006153a
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
test rax, rax
je 0x14006148f
lea rcx, [rsi + 0x70]
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CProcessTreeDlg.0
mov qword [r15], rax
mov qword [r15 + 0x68], rcx
jmp 0x140061492
mov r15, rbx
mov r14, qword [rsi + 8]
lea rdi, [r15 + 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140041950
test eax, eax
jne 0x1400614b9
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x140061524
test rdi, rdi
je 0x140062e45
test r15, r15
je 0x140062e45
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rbx
lea r9, [0x140048560]
mov r8, r14
mov edx, 0xae
mov rcx, qword [0x140144400]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov qword [0x1401430e8], rax
mov edx, 5
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
lea r15, [0x1401424a0]
mov qword [rbp], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1042
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, eax
lea rdx, [rbp + 0x10]
mov rcx, r15
call fcn.140021860
nop
cmp qword [rbp + 0x20], 0
je 0x1400615a1
lea rcx, [rbp + 0x10]
call fcn.14002a8c0
mov r9d, dword [rax + 4]
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [0x1401430e8]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
lea rcx, [rbp + 0x10]
call fcn.140028220
nop
jmp 0x140062df9
mov ecx, 0x68
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
test rax, rax
je 0x1400615f8
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CProcessActivitySummaryDlg.0
mov qword [r15], rax
jmp 0x1400615fb
mov r15, rbx
mov rsi, qword [rsi + 8]
mov rax, qword [r15 + 0x28]
test rax, rax
jne 0x140061623
call fcn.1400b6d28
mov qword [r15 + 0x28], rax
test rax, rax
jne 0x140061623
mov ecx, recv
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006169f
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [r15 + 0x10]
test rdi, rdi
je 0x140062e35
test r15, r15
je 0x140062e35
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 0x99
mov r8, rsi
lea r9, [0x140048560]
mov qword [rsp + 0x20], rbx
mov rcx, qword [0x140144400]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov edx, 5
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x140062e09
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
test rax, rax
je 0x140061709
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CFileSummaryDlg.0
mov qword [r15], rax
mov qword [r15 + 0x68], rbx
jmp 0x14006170c
mov r15, rbx
mov rsi, qword [rsi + 8]
mov rax, qword [r15 + 0x28]
test rax, rax
jne 0x14006172b
call fcn.1400b6d28
mov qword [r15 + 0x28], rax
test rax, rax
je 0x140061616
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [r15 + 0x10]
test rdi, rdi
je 0x140062e35
test r15, r15
je 0x140062e35
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 0xba
jmp 0x140061683
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
test rax, rax
je 0x1400617dc
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CRegistrySummaryDlg.0
mov qword [r15], rax
mov qword [r15 + 0x68], rbx
jmp 0x1400617df
mov r15, rbx
mov rsi, qword [rsi + 8]
mov rax, qword [r15 + 0x28]
test rax, rax
jne 0x1400617fe
call fcn.1400b6d28
mov qword [r15 + 0x28], rax
test rax, rax
je 0x140061616
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [r15 + 0x10]
test rdi, rdi
je 0x140062e35
test r15, r15
je 0x140062e35
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, reloc.OLEAUT32.dll_DllRegisterServer
jmp 0x140061683
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
test rax, rax
je 0x1400618af
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CNetworkSummaryDlg.0
mov qword [r15], rax
mov qword [r15 + 0x68], rbx
jmp 0x1400618b2
mov r15, rbx
mov rsi, qword [rsi + 8]
mov rax, qword [r15 + 0x28]
test rax, rax
jne 0x1400618d1
call fcn.1400b6d28
mov qword [r15 + 0x28], rax
test rax, rax
je 0x140061616
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [r15 + 0x10]
test rdi, rdi
je 0x140062e35
test r15, r15
je 0x140062e35
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 0x98
jmp 0x140061683
mov ecx, 0xf0
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
xor ebx, ebx
test rax, rax
je 0x140061a5c
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov r14, 0xffffffffffffffff
mov qword [rax + 0x58], r14
lea rax, vtable.CStackSummaryDlg.0
mov qword [r15], rax
lea rdi, [r15 + 0x68]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], rdi
mov qword [rdi], rbx
lea rdx, str._All_
mov rcx, rdi
call fcn.1400b01a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi + 0xc], xmm0
mov qword [rdi + 0x1c], rax
mov qword [rdi + 0x28], rbx
lea rcx, str._All_
call fcn.1400b0640
mov rdx, rax
lea rcx, str._All_
call fcn.1400b0780
mov qword [rdi + 0x38], rax
mov qword [r15 + 0xa8], rdi
lea rdi, [r15 + 0xb0]
mov qword [rsp + 0x58], rdi
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
lea ecx, [rbx + 0x58]
call fcn.1400b5680
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi], rax
mov qword [r15 + 0xc0], r14
mov dword [r15 + 0xc8], 0xffffffff
mov qword [r15 + 0xd0], rbx
mov dword [r15 + 0xd8], ebx
lea rdi, [r15 + 0xe0]
mov qword [rsp + 0x58], rdi
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
lea ecx, [rbx + 0x60]
call fcn.1400b5680
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi], rax
jmp 0x140061a5f
mov r15, rbx
mov rsi, qword [rsi + 8]
mov rax, qword [r15 + 0x28]
test rax, rax
jne 0x140061a99
call fcn.1400b6d28
mov qword [r15 + 0x28], rax
test rax, rax
jne 0x140061a99
mov ecx, recv
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [r15 + 8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140062e09
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [r15 + 0x10]
test rdi, rdi
je 0x140062e35
test r15, r15
je 0x140062e35
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 0x9f
mov r8, rsi
lea r9, [0x140048560]
mov qword [rsp + 0x20], rbx
mov rcx, qword [0x140144400]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rcx, qword [r15 + 8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x140062e09
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
test rax, rax
je 0x140061b75
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CCrossReferenceSummaryDlg.0
mov qword [r15], rax
mov qword [r15 + 0x68], rbx
jmp 0x140061b78
mov r15, rbx
mov rsi, qword [rsi + 8]
mov rax, qword [r15 + 0x28]
test rax, rax
jne 0x140061b97
call fcn.1400b6d28
mov qword [r15 + 0x28], rax
test rax, rax
je 0x140061a7a
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [r15 + 0x10]
test rdi, rdi
je 0x140062e35
test r15, r15
je 0x140062e35
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 0xa0
jmp 0x140061af9
mov qword [rsp + 0x20], rbx
lea r9, [0x1400b39b0]
mov r8, r12
lea rdx, str.SYMBOLCONFIG
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x140062e09
and dword [rsi + 0x42d8], 0xffffffbf
lea rcx, [rsi + 0x42c0]
call qword [sym.imp.COMDLG32.dll_FindTextW]
mov qword [0x140142ec8], rax
jmp 0x140062e09
mov rdi, qword [rsi + 0x260]
mov ebx, dword [rsi + 0x42d8]
mov ecx, 0x9cd3
mov eax, ebx
or eax, 1
and ebx, 0xfffffffe
cmp r13w, cx
cmovne ebx, eax
mov dword [rsi + 0x42d8], ebx
and bl, 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1042
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd rdx, eax
movzx r8d, bl
lea r15, [0x1401424a0]
mov rcx, r15
call fcn.140031820
mov r13, rax
mov rcx, r15
call fcn.140030320
mov ecx, eax
cmp r13, rcx
jb 0x140061d0d
lea rcx, str.No_more_highlights
call fcn.1400b0640
mov rdx, rax
lea rcx, str.No_more_highlights
call fcn.1400b0780
mov qword [rsp + 0x40], rax
mov rcx, r12
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rcx, [rsp + 0x40]
call fcn.1400b0200
mov r9d, gethostbyaddr
lea r8, [0x1400f7478]
mov rdx, rax
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140061d08
call fcn.1400b0810
nop
jmp 0x140062e09
mov dword [rbp + 0x20], 3
xor ebx, ebx
mov dword [rbp + 0x1c], ebx
lea r9, [rbp + 0x10]
mov edx, 0x102b
lea r8, [rbx - 1]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp + 0x20], 3
mov dword [rbp + 0x1c], 3
lea r9, [rbp + 0x10]
mov r8, r13
mov edx, 0x102b
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r8, r13d
xor r9d, r9d
mov edx, 0x1013
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, r13
xor r8d, r8d
mov edx, 0x1043
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call qword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x140062e09
mov ecx, dword [rsi + 0x42d8]
mov edx, 0x9c7e
mov eax, ecx
or eax, 1
and ecx, 0xfffffffe
cmp r13w, dx
cmovne ecx, eax
mov dword [rsi + 0x42d8], ecx
lea r9, [rsi + 0x42c0]
xor r8d, r8d
mov edx, 0x8004
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140062e09
lea r8, [0x140142ed0]
mov edx, 0x104
lea rcx, [rbp + 0x280]
call fcn.1400ce79c
mov edx, 0x5c
lea rcx, [rbp + 0x280]
call fcn.1400ba6f8
lea rdx, [rbp + 0x488]
sub rdx, rax
sar rdx, 1
lea r8, str.procmon.chm
mov rcx, rax
call fcn.1400ce79c
lea r9, [rbp + 0x280]
lea r8, str._s:Zone.Identifier
mov edx, 0x104
lea rcx, [rbp + 0x70]
call fcn.1400051d0
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x280]
mov rcx, r12
call fcn.1400b5460
test rax, rax
jne 0x140062e09
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.Unable_to_open_help_file
call fcn.1400b0640
mov rdx, rax
lea rcx, str.Unable_to_open_help_file
call fcn.1400b0780
mov qword [rsp + 0x40], rax
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1400746d0
jmp 0x140062e09
mov qword [rsp + 0x20], rbx
lea r9, [0x1400200e0]
mov r8, r12
lea rdx, [0x140101198]
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x140062e09
mov dword [rbp + 0x10], 0x50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x14], 1
lea r9, [rbp + 0x10]
xor r8d, r8d
mov edx, 0x9cb0
mov rcx, qword [rsi + 0x140]
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov r8d, dword [rbp + 0x1c]
shr r8d, 3
movzx eax, r8b
not al
and al, 1
mov byte [0x14013ca74], al
not r8d
and r8d, 1
lea rcx, [rsi + 0x80]
xor r9d, r9d
mov edx, 0x9cb0
call fcn.140069a80
jmp case.default.0x140062b48
mov edx, 0x100c
mov r9d, 1
lea r8, [r9 - 2]
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1028
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [rax + rax*4]
add ecx, ecx
mov eax, 0x9c8e
cmp r13w, ax
jne 0x140061f77
sub edi, ecx
mov eax, ebx
cmovns eax, edi
mov edi, eax
jmp 0x140061f98
add edi, ecx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp edi, eax
jl 0x140061f98
lea edi, [rax - 1]
mov dword [rbp + 0x20], 3
mov dword [rbp + 0x1c], 3
movsxd rdi, edi
lea r9, [rbp + 0x10]
mov r8, rdi
mov edx, 0x102b
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8, rdi
mov edx, 0x1013
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x140062b48
lea r15, [0x1401424a0]
mov qword [rbp], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
xor edx, edx
lea rcx, [0x1401425e8]
call fcn.140068f30
cmp byte [0x14013ca66], 0
sete dl
lea rcx, [0x1401425a0]
call fcn.140068f30
xor edx, edx
mov rcx, r15
call fcn.140031cf0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, qword [0x1401430f0]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
jmp 0x140062df9
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
test rax, rax
je 0x14006208c
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CBackingFileDlg.0
mov qword [r15], rax
mov qword [r15 + 0x68], rbx
jmp 0x14006208f
mov r15, rbx
mov rsi, qword [rsi + 8]
mov rax, qword [r15 + 0x28]
test rax, rax
jne 0x1400620c7
call fcn.1400b6d28
mov qword [r15 + 0x28], rax
test rax, rax
jne 0x1400620c7
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 5
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x140062b48
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400b6e58
lea rdi, [r15 + 0x10]
test rdi, rdi
je 0x140062e35
test r15, r15
je 0x140062e35
mov qword [rdi], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rdi + 8], eax
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x14013c370]
mov qword [rdi + 0x10], rax
mov qword [0x14013c370], rdi
lea rcx, [0x14013c348]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rsp + 0x20], rbx
lea r9, [0x140048560]
mov r8, rsi
mov edx, DllRegisterServer
mov rcx, qword [0x140144400]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov edx, 5
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x140062b48
mov r14d, 0x9cc7
cmp r13w, r14w
sete dil
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [str.ProcmonConfiguration.pmc]
movaps xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [0x1401011b8]
movaps xmmword [rbp + 0x290], xmm1
movups xmm0, xmmword [0x1401011c8]
movaps xmmword [rbp + 0x2a0], xmm0
movzx eax, word [0x1401011d8]
mov word [rbp + 0x2b0], ax
xor edx, edx
mov r8d, 0x1d6
lea rcx, [rbp + 0x2b2]
call fcn.1400b88a0
mov dword [rsp + 0x60], 0x98
mov qword [rsp + 0x68], r12
lea rax, [rbp + 0x280]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], 0x104
lea rax, str.Procmon_Configuration__.PMC_
mov qword [rsp + 0x78], rax
mov eax, reloc.WS2_32.dll_inet_ntoa
mov ecx, 8
cmp r13w, r14w
cmove eax, ecx
mov dword [rbp - 0x40], eax
mov rax, qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
cmove rax, qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
lea rcx, [rsp + 0x60]
call rax
test eax, eax
je case.default.0x140062b48
mov ecx, 6
lea rax, [rbp + 0xa8]
nop dword [rax]
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov dword [rax + 0x10], ebx
lea rax, [rax + 0x28]
sub rcx, 1
jne 0x140062250
lea rcx, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0x70], rbx
mov word [rbp + 0x78], bx
mov dword [rbp + 0x7c], ebx
movdqa xmm0, xmmword [0x1400f9d20]
movdqa xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rbx
mov dword [rbp + 0x1b8], ebx
lea rax, [rbp + 0x70]
mov qword [rbp + 0x98], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0x138], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0x160], rax
mov edx, 0x2e
lea rcx, [rbp + 0x280]
call fcn.1400ba484
test rax, rax
jne 0x140062318
lea r8, str..pmc
mov edx, 0x104
lea rcx, [rbp + 0x280]
call fcn.1400cf5e4
xor r9d, r9d
movzx r8d, dil
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x70]
call fcn.14006b090
test al, al
jne 0x1400623cd
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.The_selected_file_cannot_be_opened
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rbp + 0x70]
call fcn.14006b8a0
mov rdi, qword [rbp + 0x1b0]
test rdi, rdi
je 0x1400623ba
mov r14, 0xffffffffffffffff
lock xadd dword [rdi + 0x10], r14d
cmp r14d, 1
jne 0x1400623b3
test rdi, rdi
je 0x1400623b3
mov rcx, qword [rdi]
test rcx, rcx
je 0x140062394
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400623a6
call fcn.1400b56bc
mov qword [rdi + 8], rbx
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.1400b56bc
mov qword [rbp + 0x1b0], rbx
lea rcx, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
jmp case.default.0x140062b48
lea rdx, [rbp + 0x70]
lea rcx, [rbp]
call fcn.1400a8c50
nop
lea rcx, [rbp]
cmp r13w, r14w
jne 0x14006251c
call fcn.1400a95f0
lea rdi, [rsi + 0x80]
mov r8d, ebx
cmp byte [0x14013ca64], bl
setne r8b
xor r9d, r9d
mov edx, 0x9cb4
mov rcx, rdi
call fcn.140069a80
mov r8d, ebx
cmp byte [0x14013ca65], bl
setne r8b
xor r9d, r9d
mov edx, 0x9c53
mov rcx, rdi
call fcn.140069a80
mov r8d, ebx
cmp byte [0x14013ca66], bl
setne r8b
xor r9d, r9d
mov edx, 0x9c7f
mov rcx, rdi
call fcn.140069a80
mov rcx, rsi
call fcn.140069f00
mov r8d, ebx
cmp byte [0x14013ca74], 1
sete r8b
xor r9d, r9d
mov edx, 0x9cb0
mov rcx, rdi
call fcn.140069a80
mov r8d, ebx
cmp byte [0x14013ca67], bl
setne r8b
xor r9d, r9d
mov edx, 0x9cc0
mov rcx, rdi
call fcn.140069a80
mov r8d, ebx
cmp byte [0x14013ca68], bl
setne r8b
xor r9d, r9d
mov edx, 0x9ce6
mov rcx, rdi
call fcn.140069a80
xor r9d, r9d
mov r8, qword [0x14013c8d0]
lea edx, [r9 + 0x30]
mov rcx, qword [rsi + 0x260]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [0x14013c960]
lea r8, [0x14013c8e0]
lea rdx, [0x14013c964]
mov rcx, qword [rsi + 0x260]
call fcn.14003f810
mov rcx, qword [rsi + 0x210]
call fcn.14009eaf0
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.140031cf0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, qword [0x1401430f0]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140062529
mov rdx, qword [rsi + 0x260]
call fcn.1400a98e0
nop
lea rcx, [rbp]
call fcn.1400061c0
nop
lea rcx, [rbp + 0x70]
call fcn.14006b8a0
mov rdi, qword [rbp + 0x1b0]
test rdi, rdi
je 0x140062597
mov r14, 0xffffffffffffffff
lock xadd dword [rdi + 0x10], r14d
cmp r14d, 1
jne 0x140062590
test rdi, rdi
je 0x140062590
mov rcx, qword [rdi]
test rcx, rcx
je 0x140062571
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140062583
call fcn.1400b56bc
mov qword [rdi + 8], rbx
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.1400b56bc
mov qword [rbp + 0x1b0], rbx
lea rcx, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
jmp case.default.0x140062b48
call fcn.1400780c0
mov ebx, eax
call fcn.140077830
movzx edi, al
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov r14, rax
test ebx, ebx
je 0x140062630
test dil, dil
je 0x140062630
mov ecx, 1
call fcn.1400780d0
xor edx, edx
lea r15, [0x1401424a0]
mov rcx, r15
call fcn.14002fa80
lea rax, [0x140143310]
mov qword [rsp + 0x20], rax
lea r9, [0x140143100]
xor r8d, r8d
lea rdx, [0x14013cc98]
mov rcx, r15
call fcn.1400303b0
test al, al
je 0x140062645
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, r12
call fcn.1400779f0
jmp 0x140062645
xor ecx, ecx
call fcn.1400780d0
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.14002fa80
xor r9d, r9d
lea edx, [r9 + 1]
mov r8d, 0xfa
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetTimer]
lea rcx, [0x14013cc98]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x14013cc98]
call fcn.1400b0780
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.14009d400
call fcn.140077830
xor ebx, ebx
test al, al
setne bl
lea rcx, [rsi + 0x80]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x9c52
call fcn.140069a80
mov rcx, qword [rsi + 0x210]
call fcn.14009eaf0
mov rcx, r14
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x140062e09
mov rax, qword [rsi + 0x90]
mov rdx, qword [rsi + 0x98]
test rdx, rdx
je 0x140062734
movzx ecx, word [rax]
mov r8d, 0xffff
cmp cx, r8w
je 0x140062734
mov r10d, 0x9c54
nop
cmp r10w, cx
je 0x140062709
add rax, 4
add rdx, 0x10
movzx ecx, word [rax]
cmp cx, r8w
jne 0x1400626f0
jmp 0x140062734
movzx ecx, word [rdx]
bt cx, 8
jae 0x140062724
or cx, word [rax + 2]
mov r8d, 0xfeff
and cx, r8w
mov word [rdx], cx
movzx edx, word [rax + 2]
test cx, dx
je 0x140062734
or word [rsi + 0xa0], dx
call fcn.140077830
test al, al
jne 0x140062762
call fcn.1400780c0
test eax, eax
jne 0x140062762
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x9c87
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140062e09
call fcn.140077830
movzx edi, al
mov r14, rbx
test al, al
je 0x1400627af
call fcn.140072b10
test al, al
jne 0x1400627af
mov qword [rsp + 0x20], rbx
lea r9, [fcn.140012ab0]
mov r8, r12
lea rdx, str.DISCONNECTING
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov r14, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_UpdateWindow]
call qword [sym.imp.GDI32.dll_GdiFlush]
test dil, dil
sete cl
xor edx, edx
call fcn.140078280
mov edi, eax
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyWindow]
test edi, edi
je 0x1400627f2
call fcn.140077830
test al, al
jne 0x1400627f2
mov r9d, gethostbyaddr
lea r8, [0x1400f7478]
lea rdx, str.Unable_to_enable_capturing_of_events.
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.140077830
test al, al
setne bl
xor r9d, r9d
mov r8d, ebx
mov edx, 0x9c52
lea rcx, [rsi + 0x80]
call fcn.140069a80
mov rcx, qword [rsi + 0x210]
call fcn.14009eaf0
call fcn.140077830
test al, al
je 0x140062e09
xor r9d, r9d
lea edx, [r9 + 1]
mov r8d, 0xfa
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x140062e09
cmp byte [0x140142ec1], bl
sete dl
mov byte [0x140142ec1], dl
mov r9d, 0xffffffff
xor r8d, r8d
mov rcx, r12
call fcn.140026ec0
mov byte [0x140142ec1], al
test al, al
setne bl
lea rcx, [rsi + 0x80]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x9c8c
call fcn.140069a80
jmp 0x140062e09
mov qword [rsp + 0x20], rbx
lea r9, [0x1400a77c0]
mov r8, r12
lea rdx, str.SAVE
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.default.0x140062b48
mov rcx, r12
call fcn.140099730
test al, al
je case.default.0x140062b48
lea rcx, [rsi + 0x80]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9c54
call fcn.1400699c0
jmp case.default.0x140062b48
xor ecx, ecx
call fcn.1400780d0
xor edx, edx
lea rcx, [0x1401424a0]
call fcn.14002fa80
call fcn.140077830
mov r8d, ebx
test al, al
setne r8b
lea rcx, [rsi + 0x80]
xor r9d, r9d
mov edx, 0x9c52
call fcn.140069a80
lea rcx, [0x1400f6914]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x1400f6914]
call fcn.1400b0780
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.14009d400
jmp case.default.0x140062b48
mov dil, 1
mov r14, rbx
test r9, r9
je 0x140062962
cmp byte [r9], bl
sete dil
mov r14, qword [r9 + 8]
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x9c8a
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x140143310]
mov qword [rsp + 0x20], rax
lea r9, [0x140143100]
movzx r8d, dil
lea rdx, [0x14013cc98]
lea rcx, [0x1401424a0]
call fcn.1400303b0
movzx edi, al
test al, al
je 0x1400629d1
mov r8, r14
xor edx, edx
mov rcx, r12
call fcn.1400779f0
movzx edi, al
xor r9d, r9d
lea edx, [r9 + 1]
mov r8d, 0xfa
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetTimer]
call fcn.140077830
test al, al
setne bl
lea rcx, [rsi + 0x80]
xor r9d, r9d
mov r8d, ebx
mov edx, 0x9c52
call fcn.140069a80
lea rcx, [0x14013cc98]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x14013cc98]
call fcn.1400b0780
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.14009d400
movzx eax, dil
jmp 0x140062e0b
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14006c290
nop
lea rcx, [rsp + 0x50]
call fcn.1400b0850
test eax, eax
jne 0x140062a4e
mov rcx, qword [rsp + 0x50]
jmp 0x140062d82
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x9c8a
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, str._remote_system_root_
mov qword [rsp + 0x20], rax
lea r9, str._remote_computer_name_
xor r8d, r8d
lea rdx, [0x14013cc98]
lea rcx, [0x1401424a0]
call fcn.1400303b0
test al, al
je 0x140062ab3
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
test rcx, rcx
je 0x140062aa6
call fcn.1400b04e0
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.140077c00
call fcn.140077830
mov r8d, ebx
test al, al
setne r8b
xor r9d, r9d
mov edx, 0x9c52
lea rcx, [rsi + 0x80]
call fcn.140069a80
lea rcx, [0x14013cc98]
call fcn.1400b0640
mov rdx, rax
lea rcx, [0x14013cc98]
call fcn.1400b0780
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.14009d400
nop
mov rcx, qword [rsp + 0x50]
jmp 0x140062d82
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140062e09
sub ecx, 0xd102
cmp ecx, 5
ja case.default.0x140062b48
movsxd rax, ecx
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x62fd0]
add rax, rdx
jmp rax
lea r15, [0x1401424a0]
mov qword [rbp], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp r13w, di
sete al
lea r9, [rsi + 0x270]
mov edx, dword [rsi + 0x4270]
mov byte [rsp + 0x20], al
xor r8d, r8d
lea rcx, [0x1401425a0]
call fcn.14002c210
movzx edx, al
mov rcx, r15
call fcn.140031cf0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, qword [0x1401430f0]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
jmp 0x140062df9
mov rcx, qword [0x1401430f0]
test rcx, rcx
je 0x140062bd5
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401430f0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x140062c45
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.1400b5680
mov r15, rax
mov qword [rbp], rax
test rax, rax
je 0x140062c25
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], rbx
mov byte [rax + 0x60], bl
mov qword [rax + 0x50], rbx
mov qword [rax + 0x58], 0xffffffffffffffff
lea rax, vtable.CFilterDlg.0
mov qword [r15], rax
mov dword [r15 + 0x68], UnRegisterTypeLib
jmp 0x140062c28
mov r15, rbx
xor r8d, r8d
mov rdx, r12
mov rcx, r15
call fcn.14005e740
mov edx, 5
mov rcx, qword [r15 + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
lea r15, [0x1401424a0]
mov qword [rbp], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov ecx, 0x20
call fcn.1400b5680
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140062cc4
lea r14, [rsi + 0x270]
mov ecx, dword [rsi + 0x4270]
mov dword [rax], ecx
mov dword [rax + 4], ebx
lea rsi, [rax + 8]
mov qword [rsp + 0x50], rsi
call fcn.14003f040
movzx edi, al
mov rcx, r14
call fcn.1400b0640
mov rdx, rax
mov rcx, r14
call fcn.1400b0780
mov qword [rsi], rax
movzx edx, dil
mov rcx, r14
call fcn.1400748d0
mov qword [rsi + 8], rax
mov word [r12 + 0x18], 0x101
jmp 0x140062cc7
mov r12, rbx
mov edx, 0x418
mov rcx, qword [0x1401430f0]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r9, r12
xor r8d, r8d
mov edx, 0x800d
call qword [sym.imp.USER32.dll_SendMessageW]
nop
jmp 0x140062df9
lea r15, [0x1401424a0]
mov qword [rbp], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea r9, [rsi + 0x270]
mov edx, dword [rsi + 0x4270]
mov byte [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [0x1401425e8]
call fcn.14002c210
mov rcx, r15
call fcn.1400326d0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, qword [0x1401430f8]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
jmp 0x140062df9
lea rcx, [rsi + 0x270]
call fcn.1400b0640
mov rdx, rax
lea rcx, [rsi + 0x270]
call fcn.1400b0780
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.14006f350
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140062d8d
call fcn.1400b0810
nop
jmp case.default.0x140062b48
lea r15, [0x1401424a0]
mov qword [rbp], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea r9, [rsi + 0x2270]
mov eax, 0xd104
mov r8d, ebx
cmp r13w, ax
setne r8b
add r8d, 2
mov byte [rsp + 0x20], 0
mov edx, 0x9c74
lea rcx, [0x1401425a0]
call fcn.14002c210
movzx edx, al
mov rcx, r15
call fcn.140031cf0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800b
mov rcx, qword [0x1401430f0]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rsp + 0x58]
mov dword [rax], ebx
xor eax, eax
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.1400b5660
mov rbx, qword [rsp + 0x5e8]
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, 1
mov ecx, 0xc0000005
call fcn.1400494a0
int3
mov edx, 1
mov ecx, 0xc0000005
call fcn.1400494a0
int3