Function at 0x180005280
Capabilities:
Check for time delay via gettickcount
Check if file exists
Enumerate processes
Get common file path
Get startup folder
Get thread local storage value
Query environment variable
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2300]
mov eax, 0x2400
call fcn.1800dfab0
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2440], rbx
mov rax, qword [0x1801a3080]
xor rax, rsp
mov qword [rbp + 0x22f0], rax
mov r12, r9
mov r15, r8
xor r13d, r13d
lea rdi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
cmp qword [0x1801ab190], r13
je 0x180005405
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rax, qword [0x1801ab190]
cmp byte [rax + 0x78], r13b
je 0x180005405
cmp dword [rax + 0x80], 4
jb 0x180005405
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x210], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x210], xmm1
mov word [rbp + 0x200], r13w
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x180005343
mov r9, qword [r12]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x180005350
mov r8, qword [r15]
lea rdx, str.JumpToProtectMainPage_link___s__path___s
lea rcx, [rbp + 0x200]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x24a
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x200]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
test bl, bl
je 0x1800053a7
lea rdx, [rbp + 0x200]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x1800053ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800053e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f48
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], r13w
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov byte [rsp + 0x31], 0
lea r9, [rsp + 0x31]
lea r8, [rbp + 0x40]
call fcn.180018800
mov esi, eax
cmp qword [0x1801ab190], 0
je 0x18000555b
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rcx, qword [0x1801ab190]
cmp byte [rcx + 0x78], 0
je 0x18000555b
cmp dword [rcx + 0x80], 4
jb 0x18000555b
movzx ebx, byte [rcx + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x230], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x220], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
mov r8d, esi
lea rdx, str.GetProtectMainPage_dwErr__0x_X_protectMainPage___s
lea rcx, [rbp + 0x220]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x251
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x220]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
test bl, bl
je 0x1800054fd
lea rdx, [rbp + 0x220]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x180005543
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000553e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f4e
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], r13w
mov byte [rsp + 0x30], 0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.180010870
mov r14, 0xffffffffffffffff
test al, al
je 0x18000559d
cmp qword [rbp + 0x30], 0
jne 0x180005666
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x12f0]
call fcn.1800fe490
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x12f0]
call fcn.180032900
test al, al
je 0x180005666
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x250], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x250], xmm1
mov word [rbp + 0x240], r13w
lea rax, [rbp + 0x12f0]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180005600
lea rdx, [rbp + 0x12f0]
lea rcx, [rbp + 0x240]
call fcn.18000c0a0
nop
lea rcx, [rbp + 0x20]
call fcn.18000c030
movups xmm0, xmmword [rbp + 0x240]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x250]
movups xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movzx edi, byte [rsp + 0x30]
mov rax, qword [0x1801ab190]
test rax, rax
je 0x1800057a4
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rax, qword [0x1801ab190]
cmp byte [rax + 0x78], 0
je 0x1800057a4
cmp dword [rax + 0x80], 4
jb 0x1800057a4
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x270], xmm1
mov word [rbp + 0x260], r13w
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
movzx r9d, dil
lea rdx, str.GetProtectMainPage_Other_Browser_protectMainPage___s__isLocked___d
lea rcx, [rbp + 0x260]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x25f
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x260]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
test bl, bl
je 0x18000573f
lea rdx, [rbp + 0x260]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x278]
cmp rdx, 8
jb 0x180005785
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005780
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f54
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x270], xmm0
mov word [rbp + 0x260], r13w
mov rax, qword [0x1801ab190]
cmp qword [rbp + 0x50], 0
jne 0x180005980
test dil, dil
jne 0x180005980
test rax, rax
je 0x1800058d7
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rax, qword [0x1801ab190]
cmp byte [rax + 0x78], dil
je 0x1800058d7
cmp dword [rax + 0x80], 4
jb 0x1800058d7
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x290], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x290], xmm1
mov word [rbp + 0x280], r13w
mov r8d, 0x1a
lea rdx, str.GetProtectMainPage
lea rcx, [rbp + 0x280]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x264
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x280]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
test bl, bl
je 0x180005879
lea rdx, [rbp + 0x280]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 8
jb 0x1800058bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800058ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f5a
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x280], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180005917
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005912
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f60
call fcn.1800dedc4
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180005968
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005963
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f66
call fcn.1800dedc4
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov eax, esi
jmp 0x180007f0c
lea rcx, [rbp + 0xa0]
call fcn.1800942b0
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rcx, qword [rbp + 0xa0]
lea rdx, str.explorer.exe
call fcn.180100d08
test eax, eax
je 0x180005bee
call fcn.180008750
test al, al
jne 0x180005bee
cmp qword [0x1801ab190], 0
je 0x180005ae9
lea rcx, [0x1801ab190]
call fcn.1800c19a0
mov rax, qword [0x1801ab190]
cmp byte [rax + 0x78], 0
je 0x180005ae9
cmp dword [rax + 0x80], 4
jb 0x180005ae9
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2b0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x2b0], xmm1
mov word [rbp + 0x2a0], r13w
mov r8d, 0x17
lea rdx, str.other_desk_close_swtich
lea rcx, [rbp + 0x2a0]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x26e
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x2a0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
test bl, bl
je 0x180005a8b
lea rdx, [rbp + 0x2a0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 8
jb 0x180005ad1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005acc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f6c
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x2b0], xmm0
mov word [rbp + 0x2a0], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180005b2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f72
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180005b87
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f78
call fcn.1800dedc4
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180005bd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005bd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f7e
call fcn.1800dedc4
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
jmp 0x180007f07
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x360], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x360]
call fcn.18000c0a0
nop
lea rcx, [rbp + 0x360]
call fcn.1800932d0
test al, al
sete bl
mov rdx, qword [rbp + 0x378]
cmp rdx, 8
jb 0x180005c82
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f84
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x360], r13w
test bl, bl
je 0x180005fe7
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x140]
call fcn.18000c0a0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180005d78
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x6a4]
call fcn.1800fe490
mov dword [rbp + 0x6a0], 0x238
lea rdx, [rbp + 0x6a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180005d6f
nop
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x6cc]
call fcn.180100d08
mov rcx, rbx
test eax, eax
je 0x180005fda
lea rdx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005d30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x180005dc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005dbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f8a
call fcn.1800dedc4
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
test bl, bl
je 0x180005fe7
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180005ee3
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x190], xmm1
mov word [rbp + 0x180], r13w
mov r8d, 0xd
lea rdx, str.not_found_rtp
lea rcx, [rbp + 0x180]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x291
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x180]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180005e85
lea rdx, [rbp + 0x180]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x180005ecb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ec6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f90
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180005f29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f96
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180005f81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f9c
call fcn.1800dedc4
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180005bd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005bd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f3c
jmp 0x180005bd3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x180005d7a
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x130], xmm1
mov word [rbp + 0x120], r13w
movdqu xmmword [rbp + 0x170], xmm0
movdqu xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x160], r13w
mov r8d, 0xa
lea rdx, str.2345PCSafe
lea rcx, [rbp + 0x160]
call fcn.18000c0a0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x120]
call fcn.18000c0a0
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x1800060ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fa2
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r13w
lea rcx, [rbp + 0x120]
call fcn.180037e00
test al, al
je 0x18000645c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x390], xmm1
mov word [rbp + 0x380], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x380]
call fcn.18000c0a0
nop
lea rcx, [rbp + 0x380]
call fcn.1800932d0
test al, al
sete bl
mov rdx, qword [rbp + 0x398]
cmp rdx, 8
jb 0x18000616d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006168
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fa8
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x380], r13w
test bl, bl
je 0x18000645c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x310], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x310], xmm1
mov word [rbp + 0x300], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x300]
call fcn.18000c0a0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x1800061df
xor bl, bl
jmp 0x1800061f1
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.180007fd0
movzx ebx, al
mov rdx, qword [rbp + 0x318]
cmp rdx, 8
jb 0x180006237
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006232
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fae
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x310], xmm0
mov word [rbp + 0x300], r13w
test bl, bl
jne 0x18000645c
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180006358
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x1b0], xmm1
mov word [rbp + 0x1a0], r13w
mov r8d, 0xe
lea rdx, str.not_found_tray
lea rcx, [rbp + 0x1a0]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x29e
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x1a0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x1800062fa
lea rdx, [rbp + 0x1a0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x180006340
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000633b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fb4
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], r13w
lea rcx, [rbp + 0x120]
call fcn.18000c030
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x1800063ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fba
call fcn.1800dedc4
movdqa xmm0, xmmword [0x18015f560]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006403
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fc0
call fcn.1800dedc4
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180005bd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005bd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f42
jmp 0x180005bd3
mov r8, qword [rbp + 0x30]
test r8, r8
je 0x180006632
mov rdi, r8
cmp r8, 1
jb 0x1800064ea
mov rbx, r13
test r8, r8
je 0x1800064b8
nop word [rax + rax]
cmp r8, rbx
jbe 0x180007f36
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
movzx edx, word [rax + rbx*2]
lea rcx, str.__r_t_n
call fcn.1800fd940
mov r8, qword [rbp + 0x30]
test rax, rax
je 0x1800064b8
inc rbx
cmp rbx, rdi
jb 0x180006480
test rbx, rbx
je 0x1800064ea
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
sub r8, rbx
mov qword [rbp + 0x30], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.1800fe030
lea rdx, str.__r_t_n
lea rcx, [rbp + 0x20]
call fcn.180090600
lea rcx, [rbp + 0x20]
call fcn.180090790
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 5
lea rdx, str.http:
call fcn.180104b70
test eax, eax
je 0x180006632
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 6
lea rdx, str.https:
call fcn.180104b70
test eax, eax
je 0x180006632
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xb
lea rdx, str.about:blank
call fcn.180104b70
test eax, eax
je 0x180006632
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xa
lea rdx, str.about:tabs
call fcn.180104b70
test eax, eax
je 0x180006632
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x1d0], xmm1
mov word [rbp + 0x1c0], r13w
mov r8d, 7
lea rdx, str.http:__
lea rcx, [rbp + 0x1c0]
call fcn.18000c0a0
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.18000c360
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x20]
call fcn.18000c0a0
nop
lea rcx, [rbp + 0x1c0]
call fcn.18000c030
mov eax, dword [0x1801aa8b8]
test eax, eax
je 0x180006724
mov ebx, dword [0x1801aa8b8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
andps xmm1, xmmword [0x18015f5c0]
movsd xmm0, qword [0x18015f538]
comisd xmm0, xmm1
jb 0x180006724
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x18000671f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x4b0], xmm1
mov word [rbp + 0x4a0], r13w
mov r8d, 0x1c
lea rdx, str.JumpToProtectMainPage
lea rcx, [rbp + 0x4a0]
call fcn.18000c0a0
mov dword [rsp + 0x28], CDefFolderMenu_Create2
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4a0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180006712
lea rdx, [rbp + 0x4a0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x4a0]
call fcn.18000c030
nop
jmp 0x180007eda
call fcn.18000b4d0
test al, al
jne 0x180006739
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [0x1801aa8b8], eax
mov eax, 1
xchg dword [0x1801a885c], eax
test eax, eax
jne 0x18000674d
call fcn.1800262a0
lea rdx, [rbp + 0x40]
call fcn.180026990
test al, al
je 0x1800067a4
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x600]
call fcn.180016470
nop
mov r8, qword [rbp + 0x610]
test r8, r8
je 0x180006798
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 8
cmovae rdx, qword [rbp + 0x600]
lea rcx, [rbp + 0x40]
call fcn.18000c360
nop
lea rcx, [rbp + 0x600]
call fcn.18000c030
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800067ca
mov rdx, qword [r15]
lea r8, [rbp + 0x60]
call fcn.180017120
mov ecx, dword [0x1801a884c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x1800068af
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x4d0], xmm1
mov word [rbp + 0x4c0], r13w
cmp qword [r12 + 0x18], 8
jb 0x18000682c
mov r12, qword [r12]
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r9, qword [rbp + 0x60]
mov qword [rsp + 0x20], r12
mov r8, rdi
lea rdx, str.pAction___p_targetFileName___s_currentPath___s
lea rcx, [rbp + 0x4c0]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x2d0
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4c0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x1800068a1
lea rdx, [rbp + 0x4c0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x4c0]
call fcn.18000c030
jmp 0x1800068b6
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
xor edx, edx
mov ecx, dword [0x1801a884c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp qword [rbp + 0x50], 0
jne 0x1800069ab
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, [0x180152b98]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800069ab
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x18000699c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x4f0], xmm1
mov word [rbp + 0x4e0], r13w
mov r8d, 0x26
lea rdx, str.GetProtectMainPage_fail_and_path_is_ie
lea rcx, [rbp + 0x4e0]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x2d6
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4e0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x18000698f
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x4e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
jmp 0x180007eda
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800069b8
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800069de
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180006cec
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.18000bd10
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.180004750
nop
cmp qword [rbp + 0xf0], 0
jne 0x180006b27
cmp qword [rbp + 0x70], 0
jbe 0x180006ce0
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.18000bd10
nop
mov rdx, rax
lea rcx, [rbp + 0x660]
call fcn.180004750
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.18000bc20
nop
lea rcx, [rbp + 0x660]
call fcn.18000c030
cmp qword [rbp + 0xf0], 0
jbe 0x180006ce0
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180006be0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x510], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x510], xmm1
mov word [rbp + 0x500], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.targetFileName_guid_file_path___ws
lea rcx, [rbp + 0x500]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x2e7
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x500]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180006b1b
lea rdx, [rbp + 0x500]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x500]
jmp 0x180006bdb
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180006be0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x530], xmm1
mov word [rbp + 0x520], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.linkName_guid_file_path___ws
lea rcx, [rbp + 0x520]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x2ed
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x520]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180006bd4
lea rdx, [rbp + 0x520]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x520]
call fcn.18000c030
cmp qword [rbp + 0xf0], 0
jbe 0x180006ce0
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, [0x180152b98]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180006c69
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str._shdocvw.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180006c69
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str.ieframe.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180006ce0
lea rdx, [rbp + 0x680]
call fcn.18001a610
nop
lea r8, [rbp + 0x40]
mov rdx, rax
call fcn.180018b00
movzx ebx, al
lea rcx, [rbp + 0x680]
call fcn.18000c030
test bl, bl
je 0x180006ce0
lea rcx, [rbp + 0xe0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
lea rcx, [rbp + 0x120]
call fcn.18000c030
nop
lea rcx, [rbp + 0xa0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x20]
call fcn.18000c030
nop
lea rcx, [rbp + 0x40]
call fcn.18000c030
xor eax, eax
jmp 0x180007f0c
lea rcx, [rbp + 0xe0]
call fcn.18000c030
cmp rdi, 1
jne 0x180006da2
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180006d82
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x590], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x590], xmm1
mov word [rbp + 0x580], r13w
xor r8d, r8d
lea rdx, [0x180152244]
lea rcx, [rbp + 0x580]
call fcn.18000c0a0
nop
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x60]
call fcn.180018b00
movzx ebx, al
lea rcx, [rbp + 0x580]
call fcn.18000c030
test bl, bl
je 0x180006da2
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
jmp 0x180006cac
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180018b00
test al, al
je 0x180006da2
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
jmp 0x180006cac
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.18000bd10
nop
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180006ec3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1af0]
call fcn.1800fe490
mov r9d, 1
lea r8d, [r9 + 0xf]
lea rdx, [rbp + 0x1af0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180006ec3
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
lea rdx, [rbp + 0x1af0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180006ec3
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
je 0x180006ec3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xaf0]
call fcn.1800fe490
mov r9d, 1
lea r8d, [r9 + 0x18]
lea rdx, [rbp + 0xaf0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rdx, rbx
lea rcx, [rbp + 0xaf0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, [rbp + 0xaf0]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180006ea5
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0x100]
call fcn.18000c0a0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0x80], r13w
xor r8d, r8d
lea rdx, [0x180152244]
lea rcx, [rbp + 0x80]
call fcn.18000c0a0
nop
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r13w
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x5b0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x5b0], xmm1
mov word [rbp + 0x5a0], r13w
mov r8, r14
inc r8
cmp word [rdx + r8*2], 0
jne 0x180006f62
lea rcx, [rbp + 0x5a0]
call fcn.18000c0a0
nop
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5a0]
call fcn.18001c080
mov ebx, eax
lea rcx, [rbp + 0x5a0]
call fcn.18000c030
test ebx, ebx
jne 0x180007e06
cmp qword [rbp + 0xd0], 0
jne 0x1800070e6
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, [0x180152b98]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800070e6
lea edx, [rbx + 4]
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x18000709c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x550], xmm1
mov word [rbp + 0x540], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180152d00]
lea rcx, [rbp + 0x540]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x32f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x540]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180007090
lea rdx, [rbp + 0x540]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x540]
call fcn.18000c030
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x80]
call fcn.180018b00
test al, al
je 0x1800070e6
lea rcx, [rbp + 0xc0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x80]
call fcn.18000c030
nop
lea rcx, [rbp + 0x100]
call fcn.18000c030
nop
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
jmp 0x180006cac
cmp byte [rsp + 0x30], 0
je 0x1800078c6
lea rcx, [rsp + 0x48]
call fcn.18000d740
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.18000c0a0
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqa xmmword [rbp + 0x2f0], xmm1
mov word [rbp + 0x2e0], r13w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x40]
call fcn.18000bd10
nop
lea r8, [rbp + 0x2c0]
mov rdx, rax
call fcn.180010460
test al, al
je 0x180007851
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180007251
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x570], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x570], xmm1
mov word [rbp + 0x560], r13w
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180152d20]
lea rcx, [rbp + 0x560]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x33e
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x560]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180007245
lea rdx, [rbp + 0x560]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x560]
call fcn.18000c030
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x80]
call fcn.180010d60
test al, al
je 0x180007851
lea rdx, [rbp + 0x40]
call fcn.180026990
test al, al
je 0x1800072ca
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5c0]
call fcn.180016030
nop
mov r8, qword [rbp + 0x5d0]
test r8, r8
je 0x1800072be
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 8
cmovae rdx, qword [rbp + 0x5c0]
lea rcx, [rbp + 0x40]
call fcn.18000c360
nop
lea rcx, [rbp + 0x5c0]
call fcn.18000c030
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1e0]
call fcn.18000bd10
nop
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x1800073a5
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x3b0], xmm1
mov word [rbp + 0x3a0], r13w
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r8, qword [rbp + 0xc0]
mov eax, dword [rbp + 0x2c4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x2c0]
lea rdx, [0x180152d70]
lea rcx, [rbp + 0x3a0]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x34d
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3a0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180007399
lea rdx, [rbp + 0x3a0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x3a0]
call fcn.18000c030
cmp dword [rbp + 0x2c4], 1
jne 0x1800074d2
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2c8]
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x320]
call fcn.18000f920
nop
mov r8, qword [rbp + 0x330]
test r8, r8
je 0x1800074c6
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rdx, qword [rbp + 0x320]
lea rcx, [rbp + 0x1e0]
call fcn.18000c0a0
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x1800074c6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x3d0], xmm1
mov word [rbp + 0x3c0], r13w
lea r8, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae r8, qword [rbp + 0x320]
lea rdx, [0x180152df0]
lea rcx, [rbp + 0x3c0]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x356
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3c0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x1800074b9
lea rdx, [rbp + 0x3c0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x3c0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x320]
call fcn.18000c030
cmp dword [rbp + 0x2c0], 1
jne 0x180007604
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x60]
call fcn.18000bd10
nop
mov r8, rax
lea rdx, [rbp + 0x340]
call fcn.18000f2e0
nop
mov r8, qword [rbp + 0x350]
test r8, r8
je 0x1800075f8
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rdx, qword [rbp + 0x340]
lea rcx, [rbp + 0x1e0]
call fcn.18000c0a0
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x1800075f8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x3f0], xmm1
mov word [rbp + 0x3e0], r13w
lea r8, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae r8, qword [rbp + 0x340]
lea rdx, [0x180152e30]
lea rcx, [rbp + 0x3e0]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x361
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3e0]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x1800075eb
lea rdx, [rbp + 0x3e0]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x3e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x340]
call fcn.18000c030
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x5e0]
call fcn.180011200
nop
lea r8, [rbp + 0x1e0]
cmp qword [rbp + 0x5f0], 0
je 0x18000773a
lea rdx, [rbp + 0x5e0]
call fcn.180018b00
test al, al
je 0x180007837
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x20]
call fcn.18000bd10
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000e290
nop
lea rcx, [rbp + 0x5e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x2e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000be40
nop
mov rcx, qword [0x1801aa948]
test rcx, rcx
je 0x1800076b6
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801aa948]
sub dword [0x1801a8858], 1
jne 0x1800076d3
call fcn.18001fe90
mov rcx, rax
call fcn.180020220
mov rcx, qword [0x1801aa948]
test rcx, rcx
je 0x1800076df
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.1800123c0
nop
mov edx, 0x60
mov rcx, qword [rsp + 0x48]
call fcn.18000ca80
nop
lea rcx, [rbp + 0xc0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x80]
call fcn.18000c030
nop
lea rcx, [rbp + 0x100]
call fcn.18000c030
nop
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
jmp 0x180006cac
lea rdx, [rbp + 0x80]
call fcn.180018b00
test al, al
je 0x180007837
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp]
call fcn.18000bd10
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000e290
nop
lea rcx, [rbp + 0x5e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x2e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000be40
nop
mov rcx, qword [0x1801aa948]
test rcx, rcx
je 0x1800077c3
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801aa948]
sub dword [0x1801a8858], 1
jne 0x1800077e0
call fcn.18001fe90
mov rcx, rax
call fcn.180020220
mov rcx, qword [0x1801aa948]
test rcx, rcx
je 0x1800077ec
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180011d70
nop
lea rcx, [rbp + 0xc0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x80]
call fcn.18000c030
nop
lea rcx, [rbp + 0x100]
call fcn.18000c030
nop
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
jmp 0x180006cac
lea rcx, [rbp + 0x5e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x2e0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000be40
nop
mov rcx, qword [0x1801aa948]
test rcx, rcx
je 0x180007884
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801aa948]
sub dword [0x1801a8858], 1
jne 0x1800078a1
call fcn.18001fe90
mov rcx, rax
call fcn.180020220
mov rcx, qword [0x1801aa948]
test rcx, rcx
je 0x1800078ad
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180011d70
jmp 0x18000796e
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x18000796e
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x410], xmm1
mov word [rbp + 0x400], r13w
mov r8d, 0x1b
lea rdx, str.Other_Browser_Home
lea rcx, [rbp + 0x400]
call fcn.18000c0a0
mov dword [rsp + 0x28], 0x37c
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x400]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180007962
lea rdx, [rbp + 0x400]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x400]
call fcn.18000c030
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x650], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x650], xmm1
mov word [rbp + 0x640], r13w
movdqu xmmword [rbp + 0x630], xmm0
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r13w
lea rcx, [rsp + 0x40]
call fcn.18001b1a0
nop
lea rcx, [rsp + 0x40]
call fcn.18001b3c0
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.18001b5f0
test al, al
je 0x180007d0f
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x640]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.18001b540
test al, al
je 0x180007d0f
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180007abc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x430], xmm1
mov word [rbp + 0x420], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180152eb0]
lea rcx, [rbp + 0x420]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x387
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x420]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180007ab0
lea rdx, [rbp + 0x420]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x420]
call fcn.18000c030
cmp qword [rbp + 0x70], 0
jne 0x180007b6e
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180007b08
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
jmp 0x180007b65
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x8e0]
call fcn.1800fe490
mov r8d, 0x104
lea rdx, [rbp + 0x8e0]
lea rcx, str._ProgramFiles_Internet_Exploreriexplore.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180007b6e
lea rax, [rbp + 0x8e0]
nop
inc r14
cmp word [rax + r14*2], 0
jne 0x180007b50
mov r8, r14
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0x60]
call fcn.18000c0a0
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007be1
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x40]
call fcn.18000c0a0
mov r8d, 1
lea rdx, [0x180152f2c]
lea rcx, [rbp + 0x40]
call fcn.18000c360
mov r8d, 0xb
lea rdx, [0x180152f30]
lea rcx, [rbp + 0x40]
call fcn.18000c360
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180007c9f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x450], xmm1
mov word [rbp + 0x440], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r8, qword [rbp + 0x60]
lea rdx, [0x180152f48]
lea rcx, [rbp + 0x440]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x3a1
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x440]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180007c93
lea rdx, [rbp + 0x440]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x440]
call fcn.18000c030
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180018b00
test al, al
je 0x180007dd4
lea rcx, [rsp + 0x40]
call fcn.18001b200
nop
lea rcx, [rbp + 0x620]
call fcn.18000c030
nop
lea rcx, [rbp + 0x640]
call fcn.18000c030
nop
lea rcx, [rbp + 0xc0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x80]
call fcn.18000c030
nop
lea rcx, [rbp + 0x100]
call fcn.18000c030
nop
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
jmp 0x180006cac
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov edi, eax
test eax, eax
je 0x180007dd4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x470], xmm1
mov word [rbp + 0x460], r13w
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
mov r8d, eax
lea rdx, str.RCBlackShortCut_Analyze_Fail___x_lnk___s
lea rcx, [rbp + 0x460]
call fcn.1800c2b20
mov dword [rsp + 0x28], 0x3a9
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x460]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp edi, 1
jbe 0x180007dc8
lea rdx, [rbp + 0x460]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x460]
call fcn.18000c030
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180007de2
mov byte [rax + 8], 0
lea rcx, [rsp + 0x40]
call fcn.18001b200
nop
lea rcx, [rbp + 0x620]
call fcn.18000c030
nop
lea rcx, [rbp + 0x640]
jmp 0x180007ea3
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2600
mov ebx, eax
test eax, eax
je 0x180007ea9
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x18015f560]
movdqu xmmword [rbp + 0x490], xmm1
mov word [rbp + 0x480], r13w
lea rdx, str.GetShortCutTargetCmdEx_Fail
lea rcx, [rbp + 0x480]
call fcn.18000bbb0
mov dword [rsp + 0x28], 0x3af
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x480]
mov edx, 4
lea rcx, [0x1801ab190]
call fcn.1800c2650
cmp ebx, 1
jbe 0x180007e9c
lea rdx, [rbp + 0x480]
lea rcx, [0x1801ab190]
call fcn.1800c29e0
nop
lea rcx, [rbp + 0x480]
call fcn.18000c030
nop
lea rcx, [rbp + 0xc0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x80]
call fcn.18000c030
nop
lea rcx, [rbp + 0x100]
call fcn.18000c030
nop
lea rcx, [rbp + 0x60]
call fcn.18000c030
nop
lea rcx, [rbp + 0x120]
call fcn.18000c030
nop
lea rcx, [rbp + 0xa0]
call fcn.18000c030
nop
lea rcx, [rbp + 0x20]
call fcn.18000c030
nop
lea rcx, [rbp + 0x40]
call fcn.18000c030
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x22f0]
xor rcx, rsp
call fcn.1800deda0
mov rbx, qword [rsp + 0x2440]
add rsp, 0x2400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800125b0
nop
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
int3
call fcn.180103f88
nop
call fcn.180103f88
nop
call fcn.180103f88
int3