Function at 0x14007b1b0
Capabilities:
Authenticate hmac
Create process on windows
Delete file
Self delete

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x738]
sub rsp, 0x810
vmovaps xmmword [rax - 0x38], xmm6
vmovaps xmmword [rax - 0x48], xmm7
vmovaps xmmword [rax - 0x58], xmm8
vmovaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x1400a6040]
xor rax, rsp
mov qword [rbp + 0x6c0], rax
xor r13d, r13d
mov dword [rsp + 0x40], r13d
lea rdx, [0x140107050]
lea rcx, [rbp + 0x178]
call fcn.14001aeb0
nop
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140112048], eax
jle 0x14007b260
lea rcx, [0x140112048]
call fcn.1400836a0
cmp dword [0x140112048], 0xffffffff
jne 0x14007b260
lea rcx, [0x14008bec0]
call fcn.1400835a4
lea rcx, [0x140112048]
call fcn.140083634
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r13
mov rcx, qword [0x140111e40]
mov rdx, qword [0x140111e48]
cmp rcx, rdx
je 0x14007b299
call fcn.14001ba40
mov rax, qword [0x140111e40]
mov qword [0x140111e48], rax
lea rax, [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova rax, qword [rbp + 0x178]
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x158], rax
call fcn.140082a0c
vmovups xmm0, xmmword [rbp + 0x150]
vmovdqa xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rbp + 0x130]
call fcn.14001ebc0
mov esi, 0x6000
mov dword [rsp + 0x40], esi
vpxor xmm6, xmm6, xmm6
vmovdqu xmmword [rbp + 0x120], xmm6
xor r8d, r8d
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x1f0]
call fcn.14007ad70
nop
cmp byte [rbp + 0x468], 0
je 0x14007b386
mov ecx, 0x58
call fcn.140083340
mov rdi, rax
mov qword [rbp - 0x68], rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_std::filesystem::_Dir_enum_impl_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call fcn.14007b070
nop
mov esi, 0x7000
mov dword [rsp + 0x40], esi
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], rdi
vmovdqu xmm6, xmmword [rbp + 0x120]
jmp 0x14007b38c
vpextrq rdi, xmm6, 1
mov ebx, dword [rbp + 0x46c]
mov rcx, qword [rbp + 0x210]
call fcn.140082d04
mov rdx, qword [rbp + 0x208]
cmp rdx, 7
jbe 0x14007b3e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b3e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007b3e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400835c4
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x208], 7
mov word [rbp + 0x1f0], r13w
test ebx, ebx
jne 0x14007cb06
mov rdx, qword [rbp + 0x148]
cmp rdx, 7
jbe 0x14007b452
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b44d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007b44d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400835c4
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], 7
mov word [rbp + 0x130], r13w
test rdi, rdi
je 0x14007b488
lock inc dword [rdi + 8]
mov rdi, qword [rbp + 0x128]
vmovdqu xmm6, xmmword [rbp + 0x120]
mov esi, dword [rsp + 0x40]
vmovdqu xmmword [rbp + 0x100], xmm6
vmovdqu xmmword [rbp + 0x150], xmm6
test rdi, rdi
je 0x14007b4ac
lock inc dword [rdi + 8]
mov rdi, qword [rbp + 0x128]
mov esi, dword [rsp + 0x40]
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1d8], xmm1
mov r12, 0xffffffffffffffff
test rdi, rdi
je 0x14007b4fe
mov eax, r12d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14007b4fa
mov rbx, qword [rbp + 0x128]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14007b4fa
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 8]
mov esi, dword [rsp + 0x40]
mov r14, qword [rbp + 0x150]
mov r15, qword [rbp + 0x158]
nop dword [rax]
lea rbx, str..config
test r14, r14
je 0x14007ba1b
lea rdx, [rbp + 0x30]
mov rcx, r14
call fcn.14007ac00
mov rax, qword [rbp + 0x30]
mov edx, dword [rbp + 0x38]
test edx, edx
je 0x14007b546
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x14007cb1c
cmp eax, 2
jne 0x14007b6c4
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
call fcn.140082a0c
vmovups xmm0, xmmword [rbp + 0xb0]
vmovdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 8]
call fcn.14001ebc0
or esi, 0x60
or esi, 1
mov dword [rsp + 0x40], esi
lea rcx, [r14 + 0x20]
cmp qword [r14 + 0x38], 7
jbe 0x14007b5a1
mov rcx, qword [r14 + 0x20]
mov rax, qword [r14 + 0x30]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.14007a440
cmp rax, rdx
je 0x14007b5fc
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14007b5c5
cmp cx, 0x2f
jne 0x14007b5ce
add rax, 2
cmp rax, rdx
jne 0x14007b5b6
cmp rax, rdx
je 0x14007b5fc
nop dword [rax]
nop word [rax + rax]
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14007b5fc
cmp cx, 0x2f
je 0x14007b5fc
mov rbx, r8
cmp rax, r8
jne 0x14007b5e0
mov r8d, 0x3a
mov rcx, rbx
call fcn.140083240
cmp rbx, rax
je 0x14007b647
lea rcx, [rax - 2]
cmp rbx, rcx
je 0x14007b647
cmp word [rcx], 0x2e
jne 0x14007b62f
lea rdx, [rcx - 2]
cmp rbx, rdx
jne 0x14007b64a
cmp word [rdx], 0x2e
jne 0x14007b64a
jmp 0x14007b647
sub rcx, 2
cmp rbx, rcx
je 0x14007b647
cmp word [rcx], 0x2e
je 0x14007b64a
sub rcx, 2
cmp rbx, rcx
jne 0x14007b638
mov rcx, rax
mov qword [rbp + 0xc0], rcx
sub rax, rcx
sar rax, 1
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x40]
call fcn.14007d130
or esi, 0x82
mov dword [rsp + 0x40], esi
lea rax, [rbp + 8]
mov rbx, qword [rbp + 0x20]
cmp rbx, 7
cmova rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x88], rax
vmovups xmm0, xmmword [rbp + 0x80]
vmovdqa xmmword [rbp + 0xe0], xmm0
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x40]
call fcn.14007a7a0
test eax, eax
jne 0x14007b6c8
mov dil, 1
jmp 0x14007b6cb
mov rbx, qword [rbp + 0x20]
xor dil, dil
test sil, 2
je 0x14007b72d
and esi, 0xfffffffd
mov dword [rsp + 0x40], esi
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x14007b71c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b713
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007b9f9
call fcn.1400835c4
mov rbx, qword [rbp + 0x20]
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
test sil, 1
je 0x14007b776
and esi, 0xfffffffe
mov dword [rsp + 0x40], esi
cmp rbx, 7
jbe 0x14007b776
lea rdx, [rbx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b771
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba00
call fcn.1400835c4
test dil, dil
je 0x14007b940
lea rcx, [r14 + 0x20]
cmp qword [r14 + 0x38], 7
jbe 0x14007b78e
mov rcx, qword [r14 + 0x20]
mov rax, qword [r14 + 0x30]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.14007a440
cmp rax, r11
je 0x14007b7de
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14007b7b5
cmp cx, 0x2f
jne 0x14007b7be
add rax, 2
cmp rax, r11
jne 0x14007b7a6
cmp rax, r11
je 0x14007b7de
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14007b7de
cmp cx, 0x2f
je 0x14007b7de
mov r10, rdx
cmp rax, rdx
jne 0x14007b7c3
mov qword [rbp + 0x90], r10
sub r11, r10
sar r11, 1
mov qword [rbp + 0x98], r11
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x60]
call fcn.14007d130
bts esi, 0xb
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rax, qword [rbp + 0x60]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0xa8], rax
call fcn.140082a0c
vmovups xmm0, xmmword [rbp + 0xa0]
vmovdqa xmmword [rbp + 0xf0], xmm0
lea r8, [rbp + 0xf0]
mov edx, eax
lea rcx, [rbp - 0x18]
call fcn.14007d740
or esi, 0x700
mov dword [rsp + 0x40], esi
mov rdx, qword [0x140111e48]
cmp rdx, qword [0x140111e50]
je 0x14007b89b
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r13
mov qword [rdx + 0x18], r13
vmovups ymm0, ymmword [rbp - 0x18]
vmovups ymmword [rdx], ymm0
mov qword [rbp - 8], r13
mov eax, 0xf
mov qword [rbp], rax
mov byte [rbp - 0x18], 0
add qword [0x140111e48], 0x20
jmp 0x14007b8a8
lea r8, [rbp - 0x18]
call fcn.14007d420
mov rax, qword [rbp]
cmp rax, 0xf
jbe 0x14007b8e3
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b8db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba07
vzeroupper
call fcn.1400835c4
mov qword [rbp - 8], r13
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x14007b940
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b92e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba11
vzeroupper
call fcn.1400835c4
nop word [rax + rax]
lea rdx, [rbp + 0x470]
mov rcx, qword [r14 + 0x40]
vzeroupper
call fcn.140082ce4
cmp eax, 0x12
je 0x14007b99a
test eax, eax
jne 0x14007cb2d
cmp word [rbp + 0x49c], 0x2e
jne 0x14007b986
movzx eax, word [rbp + 0x49e]
test ax, ax
je 0x14007b940
cmp ax, 0x2e
jne 0x14007b986
cmp word [rbp + 0x4a0], 0
je 0x14007b940
lea rdx, [rbp + 0x470]
mov rcx, r14
call fcn.14007af00
jmp 0x14007b510
mov r14, r13
mov qword [rbp + 0x150], r13
mov rbx, r15
mov rdi, r15
mov rcx, r15
mov rax, r15
mov r15, r13
mov qword [rbp + 0x158], r13
test rax, rax
je 0x14007b510
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14007b9f0
mov rax, qword [rcx]
call qword [rax]
mov eax, r12d
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x14007b9f0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop dword [rax + rax]
mov esi, dword [rsp + 0x40]
jmp 0x14007b4fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test r15, r15
je 0x14007ba58
mov eax, r12d
lock xadd dword [r15 + 8], eax
cmp eax, 1
jne 0x14007ba58
mov rbx, qword [rbp + 0x158]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14007ba58
mov rcx, qword [rbp + 0x158]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x14007ba9a
mov eax, r12d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14007ba9a
mov rbx, qword [rbp + 0x128]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r12d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14007ba9a
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [0x140111e48]
mov rbx, qword [0x140111e40]
cmp rbx, rdi
je 0x14007bb05
mov rdx, qword [rbp + 0x168]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14007bac1
mov rax, qword [rbx]
mov qword [rbp - 0x68], rax
cmp rdx, qword [rbp + 0x170]
je 0x14007bae5
mov qword [rdx], rax
mov rdx, qword [rbp + 0x168]
add rdx, 8
mov qword [rbp + 0x168], rdx
jmp 0x14007bafc
lea r8, [rbp - 0x68]
lea rcx, [rbp + 0x160]
call fcn.14007d280
mov rdx, qword [rbp + 0x168]
add rbx, 0x20
cmp rbx, rdi
jne 0x14007bab4
mov rcx, qword [0x140110278]
mov rax, qword [rcx + 0x3ef8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef8]
cmp byte [rax + 0xbb], 0
jne 0x14007bb63
lea rdx, str.Configurations
mov r8, rdx
cmp rdx, 0xffffffffffffffff
jae 0x14007bb5e
nop word [rax + rax]
movzx ecx, byte [r8]
test cl, cl
je 0x14007bb5e
lea rax, [r8 + 1]
cmp cl, 0x23
jne 0x14007bb55
cmp byte [rax], cl
je 0x14007bb5e
mov r8, rax
cmp rax, 0xffffffffffffffff
jb 0x14007bb40
call fcn.140060450
vmovss xmm8, dword [0x140097928]
vmovss dword [rbp - 0x60], xmm8
vmovss xmm9, dword [0x1400978f4]
vmovss dword [rbp - 0x5c], xmm9
lea rdx, [rbp - 0x60]
lea rcx, str.Load_Selected
call fcn.14005deb0
test al, al
je 0x14007bc7d
movsxd rcx, dword [0x140106fe0]
test ecx, ecx
js 0x14007bc7d
mov rax, qword [0x140111e48]
mov r8, qword [0x140111e40]
sub rax, r8
sar rax, 5
mov rdx, rcx
cmp rcx, rax
jae 0x14007bc7d
shl rdx, 5
add rdx, r8
lea rcx, [rbp + 0x130]
call fcn.14001aeb0
nop
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rdx, qword [rbp + 0x130]
mov r8, qword [rbp + 0x140]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140025a60
lea rdx, [0x14001ba00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x130]
call fcn.14007f510
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x14007bc64
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bc5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007bc5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400835c4
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
mov rax, qword [0x140110278]
mov rcx, qword [rax + 0x3ef8]
cmp byte [rcx + 0xbb], 0
jne 0x14007bcdb
vmovss xmm0, dword [rax + 0x381c]
vaddss xmm0, xmm0, dword [rcx + 0x108]
vmovss dword [rcx + 0x100], xmm0
mov eax, dword [rcx + 0x10c]
mov dword [rcx + 0x104], eax
vmovsd xmm0, qword [rcx + 0x130]
vmovsd qword [rcx + 0x128], xmm0
mov eax, dword [rcx + 0x13c]
mov dword [rcx + 0x138], eax
mov byte [rcx + 0x140], 1
vmovss dword [rbp - 0x58], xmm8
vmovss dword [rbp - 0x54], xmm9
lea rdx, [rbp - 0x58]
lea rcx, str.Save_Selected
call fcn.14005deb0
test al, al
je 0x14007bda7
movsxd rcx, dword [0x140106fe0]
test ecx, ecx
js 0x14007bda7
mov rax, qword [0x140111e48]
mov r8, qword [0x140111e40]
sub rax, r8
sar rax, 5
mov rdx, rcx
cmp rcx, rax
jae 0x14007bda7
shl rdx, 5
add rdx, r8
lea rcx, [rbp + 0x198]
call fcn.14001aeb0
nop
lea rcx, [rbp + 0x198]
call fcn.14007d890
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0xf
jbe 0x14007bd8e
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bd89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007bd89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400835c4
mov qword [rbp + 0x1a8], r13
mov qword [rbp + 0x1b0], 0xf
mov byte [rbp + 0x198], 0
mov rax, qword [0x140110278]
mov rcx, qword [rax + 0x3ef8]
cmp byte [rcx + 0xbb], 0
jne 0x14007be05
vmovss xmm0, dword [rax + 0x381c]
vaddss xmm0, xmm0, dword [rcx + 0x108]
vmovss dword [rcx + 0x100], xmm0
mov eax, dword [rcx + 0x10c]
mov dword [rcx + 0x104], eax
vmovsd xmm0, qword [rcx + 0x130]
vmovsd qword [rcx + 0x128], xmm0
mov eax, dword [rcx + 0x13c]
mov dword [rcx + 0x138], eax
mov byte [rcx + 0x140], 1
vmovss dword [rbp - 0x50], xmm8
vmovss dword [rbp - 0x4c], xmm9
lea rdx, [rbp - 0x50]
lea rcx, str.Delete_Selected
call fcn.14005deb0
test al, al
je 0x14007bec4
movsxd rax, dword [0x140106fe0]
test eax, eax
js 0x14007bec4
mov rcx, qword [0x140111e48]
sub rcx, qword [0x140111e40]
sar rcx, 5
cmp rax, rcx
jae 0x14007bec4
mov rsi, qword [0x140110278]
mov rbx, qword [rsi + 0x3ef8]
movsxd r8, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.reallyDelete
call fcn.140028170
mov edi, eax
mov rcx, qword [rbx]
cmp dword [rcx + 0x3f40], eax
jne 0x14007be9c
lea r8, str.reallyDelete
mov edx, 0xb
mov ecx, eax
call fcn.1400418a0
test byte [rsi + 0x5ce4], 4
je 0x14007bebb
mov r8d, edi
lea rdx, str.reallyDelete
lea rcx, str._popup__OpenPopup___s_____0x_08X__n
call fcn.1400414a0
xor edx, edx
mov ecx, edi
call fcn.14003a260
mov rbx, qword [0x140110278]
mov eax, dword [rbx + 0x48b0]
vmovss xmm6, dword [0x140097918]
vxorps xmm7, xmm7, xmm7
cmp dword [rbx + 0x48a0], eax
jg 0x14007bef1
mov dword [rbx + 0x47d0], r13d
jmp 0x14007c372
mov rbx, qword [rbx + 0x3ef8]
movsxd r8, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, str.reallyDelete
call fcn.140028170
mov edi, eax
mov rcx, qword [rbx]
cmp dword [rcx + 0x3f40], eax
jne 0x14007bf39
lea r8, str.reallyDelete
mov edx, 0xb
mov ecx, eax
call fcn.1400418a0
mov ecx, edi
call fcn.14003a8a0
test al, al
je 0x14007c372
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, str.Sure_ah_
call fcn.14005cd40
vmovss dword [rbp - 0x48], xmm6
vmovss dword [rbp - 0x44], xmm7
lea rdx, [rbp - 0x48]
lea rcx, [0x140095a98]
call fcn.14005deb0
test al, al
je 0x14007bf7d
call fcn.14003a7c0
mov rax, qword [0x140110278]
mov rcx, qword [rax + 0x3ef8]
cmp byte [rcx + 0xbb], 0
jne 0x14007bfdb
vmovss xmm0, dword [rax + 0x381c]
vaddss xmm0, xmm0, dword [rcx + 0x108]
vmovss dword [rcx + 0x100], xmm0
mov eax, dword [rcx + 0x10c]
mov dword [rcx + 0x104], eax
vmovsd xmm0, qword [rcx + 0x130]
vmovsd qword [rcx + 0x128], xmm0
mov eax, dword [rcx + 0x13c]
mov dword [rcx + 0x138], eax
mov byte [rcx + 0x140], 1
vmovss dword [rbp - 0x40], xmm6
vmovss dword [rbp - 0x3c], xmm7
lea rdx, [rbp - 0x40]
lea rcx, [0x14009690c]
call fcn.14005deb0
test al, al
je 0x14007c31b
movsxd rdx, dword [0x140106fe0]
shl rdx, 5
add rdx, qword [0x140111e40]
lea rcx, [rbp + 0x1b8]
call fcn.14001aeb0
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x188]
sub rax, rcx
cmp rax, 1
jb 0x14007cb00
lea r9, [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova r9, qword [rbp + 0x178]
mov qword [rsp + 0x30], 1
lea rax, [0x140096908]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x198]
call fcn.140003ba0
nop
lea rdx, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], 0xf
cmova rdx, qword [rbp + 0x1b8]
mov r8, qword [rbp + 0x1c8]
lea rcx, [rbp + 0x198]
call fcn.14001b320
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], r13
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x130], ymm0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0xf
jbe 0x14007c121
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c119
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c119
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1400835c4
mov qword [rbp + 0x1a8], r13
mov qword [rbp + 0x1b0], 0xf
mov byte [rbp + 0x198], 0
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rcx, qword [rbp + 0x130]
vzeroupper
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x14007c267
movsxd rbx, dword [0x140106fe0]
shl rbx, 5
add rbx, qword [0x140111e40]
mov r14, qword [0x140111e48]
lea rax, [rbx + 0x20]
cmp rax, r14
je 0x14007c20d
add rbx, 0x18
nop dword [rax]
lea rsi, [rbx + 8]
lea rdi, [rbx - 0x18]
cmp rdi, rsi
je 0x14007c1f9
mov rdx, qword [rbx]
cmp rdx, 0xf
jbe 0x14007c1d9
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14007c1d1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007c2af
mov rcx, r8
vzeroupper
call fcn.1400835c4
add rbx, 0x20
mov qword [rbx - 0x28], r13
vmovups ymm0, ymmword [rsi]
vmovups ymmword [rdi], ymm0
mov qword [rbx - 8], r13
mov qword [rbx], 0xf
mov byte [rsi], 0
jmp 0x14007c1fd
add rbx, 0x20
lea rax, [rbx + 8]
cmp rax, r14
jne 0x14007c190
mov r14, qword [0x140111e48]
mov rdx, qword [r14 - 8]
cmp rdx, 0xf
jbe 0x14007c247
mov rcx, qword [r14 - 0x20]
inc rdx
cmp rdx, 0x1000
jb 0x14007c23f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007c2af
mov rcx, r8
vzeroupper
call fcn.1400835c4
mov qword [r14 - 0x10], r13
mov qword [r14 - 8], 0xf
mov byte [r14 - 0x20], 0
sub qword [0x140111e48], 0x20
mov dword [0x140106fe0], r12d
vzeroupper
call fcn.14003a7c0
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x14007c2be
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c2b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c2b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400835c4
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0xf
jbe 0x14007c31b
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c316
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c316
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400835c4
mov rbx, qword [0x140110278]
mov rcx, qword [rbx + 0x3ef8]
cmp qword [rbx + 0x48d8], rcx
jne 0x14007c356
cmp byte [rbx + 0x4951], 0
je 0x14007c356
cmp dword [rbx + 0x4910], 0
jne 0x14007c356
mov eax, dword [rbx + 0x4954]
and eax, 0xfffffff2
or eax, 2
mov dword [rbx + 0x4954], eax
test dword [rcx + 0x14], 0x1000000
je 0x14007c366
mov byte [rbx + 0x3e5e], 1
call fcn.140035910
mov byte [rbx + 0x3e5e], 0
mov rax, qword [0x140110278]
mov rcx, qword [rax + 0x3ef8]
vmovss dword [rbp - 0x78], xmm8
vmovss dword [rbp - 0x74], xmm9
cmp byte [rcx + 0xbb], 0
jne 0x14007c3da
vmovss xmm0, dword [rax + 0x381c]
vaddss xmm0, xmm0, dword [rcx + 0x108]
vmovss dword [rcx + 0x100], xmm0
mov eax, dword [rcx + 0x10c]
mov dword [rcx + 0x104], eax
vmovsd xmm0, qword [rcx + 0x130]
vmovsd qword [rcx + 0x128], xmm0
mov eax, dword [rcx + 0x13c]
mov dword [rcx + 0x138], eax
mov byte [rcx + 0x140], 1
mov eax, dword [0x140096988]
mov dword [rsp + 0x50], eax
vmovsd xmm0, qword [str.fPERL]
movzx eax, byte [0x14009698c]
vmovsd qword [rsp + 0x48], xmm0
mov byte [rsp + 0x48], 0x52
xor byte [rsp + 0x49], 0x35
xor byte [rsp + 0x4a], 0x36
xor byte [rsp + 0x4b], 0x37
xor byte [rsp + 0x4c], 0x38
xor byte [rsp + 0x4d], 0x39
xor byte [rsp + 0x4e], 0x3a
xor byte [rsp + 0x4f], 0x3b
xor byte [rsp + 0x50], 0x3c
xor byte [rsp + 0x51], 0x3d
xor byte [rsp + 0x52], 0x3e
xor byte [rsp + 0x53], 0x3f
xor al, 0x40
mov byte [rsp + 0x54], al
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x48]
call fcn.14005deb0
test al, al
je 0x14007c4ec
vmovsd xmm0, qword [0x140096960]
vmovsd qword [rbp + 0x120], xmm0
mov eax, dword [0x140096968]
mov dword [rbp + 0x128], eax
movzx ecx, word [0x14009696c]
mov word [rbp + 0x12c], cx
mov byte [rbp + 0x120], 0x23
xor byte [rbp + 0x121], 0x35
xor byte [rbp + 0x122], 0x36
xor byte [rbp + 0x123], 0x37
xor byte [rbp + 0x124], 0x38
xor byte [rbp + 0x125], 0x39
xor byte [rbp + 0x126], 0x3a
xor byte [rbp + 0x127], 0x3b
xor al, 0x3c
mov byte [rbp + 0x128], al
xor byte [rbp + 0x129], 0x3d
xor byte [rbp + 0x12a], 0x3e
xor byte [rbp + 0x12b], 0x3f
xor cl, 0x40
mov byte [rbp + 0x12c], cl
xor byte [rbp + 0x12d], 0x41
lea rcx, [rbp + 0x120]
call fcn.14003a1c0
vmovsd xmm0, qword [0x140096960]
vmovsd qword [rsp + 0x60], xmm0
mov eax, dword [0x140096968]
mov dword [rsp + 0x68], eax
movzx eax, word [0x14009696c]
mov word [rsp + 0x6c], ax
cmp byte [0x14009696d], 0
je 0x14007c55f
mov byte [rsp + 0x60], 0x23
xor byte [rsp + 0x61], 0x35
xor byte [rsp + 0x62], 0x36
xor byte [rsp + 0x63], 0x37
xor byte [rsp + 0x64], 0x38
xor byte [rsp + 0x65], 0x39
xor byte [rsp + 0x66], 0x3a
xor byte [rsp + 0x67], 0x3b
xor byte [rsp + 0x68], 0x3c
xor byte [rsp + 0x69], 0x3d
xor byte [rsp + 0x6a], 0x3e
xor byte [rsp + 0x6b], 0x3f
xor byte [rsp + 0x6c], 0x40
xor byte [rsp + 0x6d], 0x41
mov rbx, qword [0x140110278]
mov eax, dword [rbx + 0x48b0]
cmp dword [rbx + 0x48a0], eax
jg 0x14007c580
mov dword [rbx + 0x47d0], r13d
jmp 0x14007c767
mov rbx, qword [rbx + 0x3ef8]
movsxd r8, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
mov r8d, dword [rax + r8*4 - 4]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140028170
mov edi, eax
mov rcx, qword [rbx]
cmp dword [rcx + 0x3f40], eax
jne 0x14007c5c4
lea r8, [rsp + 0x60]
mov edx, 0xb
mov ecx, eax
call fcn.1400418a0
mov ecx, edi
call fcn.14003a8a0
test al, al
je 0x14007c767
vmovsd xmm0, qword [str.g_DR]
vmovsd qword [rsp + 0x78], xmm0
movzx eax, byte [0x140096978]
mov byte [rsp + 0x78], 0x53
xor byte [rsp + 0x79], 0x35
xor byte [rsp + 0x7a], 0x36
xor byte [rsp + 0x7b], 0x37
xor byte [rsp + 0x7c], 0x38
xor byte [rsp + 0x7d], 0x39
xor byte [rsp + 0x7e], 0x3a
xor byte [rsp + 0x7f], 0x3b
xor al, 0x3c
mov byte [rbp - 0x80], al
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rsp + 0x78]
call fcn.14005cd40
vmovss dword [rbp - 0x38], xmm6
vmovss dword [rbp - 0x34], xmm7
movzx eax, word [0x140096990]
mov word [rsp + 0x70], ax
movzx eax, byte [0x140096992]
mov byte [rsp + 0x70], 0x4e
xor byte [rsp + 0x71], 0x35
xor al, 0x36
mov byte [rsp + 0x72], al
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x70]
call fcn.14005deb0
test al, al
je 0x14007c669
call fcn.14003a7c0
mov rax, qword [0x140110278]
mov rcx, qword [rax + 0x3ef8]
vmovss dword [rbp - 0x70], xmm6
vmovss dword [rbp - 0x6c], xmm7
cmp byte [rcx + 0xbb], 0
jne 0x14007c6d1
vmovss xmm0, dword [rax + 0x381c]
vaddss xmm0, xmm0, dword [rcx + 0x108]
vmovss dword [rcx + 0x100], xmm0
mov eax, dword [rcx + 0x10c]
mov dword [rcx + 0x104], eax
vmovsd xmm0, qword [rcx + 0x130]
vmovsd qword [rcx + 0x128], xmm0
mov eax, dword [rcx + 0x13c]
mov dword [rcx + 0x138], eax
mov byte [rcx + 0x140], 1
movzx eax, word [0x14009697c]
mov word [rsp + 0x44], ax
movzx eax, byte [0x14009697e]
mov byte [rsp + 0x44], 0x59
xor byte [rsp + 0x45], 0x35
xor al, 0x36
mov byte [rsp + 0x46], al
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x44]
call fcn.14005deb0
test al, al
je 0x14007c710
call fcn.14007cb40
call fcn.14003a7c0
mov rbx, qword [0x140110278]
mov rcx, qword [rbx + 0x3ef8]
cmp qword [rbx + 0x48d8], rcx
jne 0x14007c74b
cmp byte [rbx + 0x4951], 0
je 0x14007c74b
cmp dword [rbx + 0x4910], 0
jne 0x14007c74b
mov eax, dword [rbx + 0x4954]
and eax, 0xfffffff2
or eax, 2
mov dword [rbx + 0x4954], eax
test dword [rcx + 0x14], 0x1000000
je 0x14007c75b
mov byte [rbx + 0x3e5e], 1
call fcn.140035910
mov byte [rbx + 0x3e5e], 0
mov rax, qword [rbp + 0x168]
mov r9, qword [rbp + 0x160]
sub rax, r9
sar rax, 3
mov dword [rsp + 0x20], eax
call fcn.14006e040
mov rcx, qword [0x140110278]
mov rax, qword [rcx + 0x3ef8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef8]
cmp byte [rax + 0xbb], 0
jne 0x14007c7e3
lea rdx, str.Create__Save_New_Config
mov r8, rdx
cmp rdx, 0xffffffffffffffff
jae 0x14007c7de
nop word [rax + rax]
movzx ecx, byte [r8]
test cl, cl
je 0x14007c7de
lea rax, [r8 + 1]
cmp cl, 0x23
jne 0x14007c7d5
cmp byte [rax], cl
je 0x14007c7de
mov r8, rax
cmp rax, 0xffffffffffffffff
jb 0x14007c7c0
call fcn.140060450
vmovss dword [rbp - 0x30], xmm7
vmovss dword [rbp - 0x2c], xmm7
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, pe_nt_image_headers64
lea rbx, [0x140106ee0]
mov r8, rbx
xor edx, edx
lea rcx, [0x1400948bc]
call fcn.140065aa0
vmovss dword [rbp - 0x28], xmm8
vmovss dword [rbp - 0x24], xmm9
lea rdx, [rbp - 0x28]
lea rcx, str.Create_Config
call fcn.14005deb0
test al, al
je 0x14007c982
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], r13
nop
inc r12
cmp byte [rbx + r12], 0
jne 0x14007c860
mov r8, r12
mov rdx, rbx
lea rcx, [rbp + 0x130]
call fcn.140003d10
nop
mov r8d, 7
lea rdx, str..config
lea rcx, [rbp + 0x130]
call fcn.14001b320
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1d0], r13
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x1b8], ymm0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x14007c915
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c90d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c90d
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1400835c4
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
lea rcx, [rbp + 0x1b8]
vzeroupper
call fcn.14007d890
nop
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0xf
jbe 0x14007c982
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c97d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007c97d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400835c4
vmovss dword [rbp - 0x20], xmm8
vmovss dword [rbp - 0x1c], xmm9
lea rdx, [rbp - 0x20]
lea rcx, str.Open_Folder
call fcn.14005deb0
test al, al
je 0x14007c9d6
lea r8, [rbp + 0x178]
cmp qword [rbp + 0x190], 0xf
cmova r8, qword [rbp + 0x178]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, [0x140096668]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8, qword [0x140110278]
mov rdx, qword [r8 + 0x3ef8]
cmp byte [rdx + 0xbb], 0
jne 0x14007ca12
mov r8, qword [r8 + 0x4bc0]
test r8, r8
je 0x14007ca12
movsx rax, word [r8 + 0x70]
imul rcx, rax, 0x2c
add rcx, qword [r8 + 8]
test byte [rcx + 4], 8
jne 0x14007ca12
dec dword [rdx + 0xf0]
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x14007ca74
mov rax, qword [rbp + 0x170]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ca5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007ca5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400835c4
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r13
mov rdx, qword [rbp + 0x190]
cmp rdx, 0xf
jbe 0x14007cab8
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cab3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007cab3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400835c4
mov rcx, qword [rbp + 0x6c0]
xor rcx, rsp
call fcn.140083320
lea r11, [rsp + 0x810]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
vmovaps xmm8, xmmword [r11 - 0x30]
vmovaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003aa0
nop
lea r8, [rbp + 0x130]
mov edx, ebx
lea rcx, str.directory_iterator::directory_iterator
call fcn.14001f4a0
nop
lea r8, [r14 + 0x20]
lea rcx, str.directory_entry::status
call fcn.14001f4a0
int3
mov edx, eax
call fcn.14007aba0
int3