Function at 0x140203170
Capabilities:
Get common file path
Get hostname

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1fd0]
mov eax, 0x20d0
call fcn.140247340
sub rsp, rax
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x2128], rbx
cmp dword [0x14037caf4], 0
je 0x1402031af
call fcn.14020a700
lea rax, vtable.CSASLogManager.0
mov qword [rbp - 0x80], rax
mov rax, qword [0x14037adb0]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x78], 0xffffffffffffffff
xor r15d, r15d
mov qword [rbp - 0x68], r15
test rax, rax
jne 0x140203223
lea ecx, [rax + 0x18]
call fcn.14018ef40
mov rbx, rax
mov qword [rbp + 0x2010], rax
test rax, rax
je 0x140203204
lea rax, vtable.CSABSDKFunctions.0
mov qword [rbx], rax
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
jmp 0x140203207
mov rbx, r15
mov qword [rbp - 0x70], rbx
xor r8d, r8d
mov edx, 0x1000
mov rcx, rbx
call fcn.140011040
mov qword [rbp - 0x68], rax
mov qword [rbx + 0x10], rax
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x7b0]
call fcn.140249b10
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x1bc0]
call fcn.140249b10
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov ecx, 0x3e9
call fcn.1401933c0
test eax, eax
je 0x1402032cb
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0xbc0]
call fcn.140249b10
xor r9d, r9d
lea r8d, [r9 + 0x24]
lea rdx, [rbp + 0xbc0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
movzx eax, byte [rbp + 0xbc0]
mov ecx, eax
mov edx, 0x43
test al, al
cmove ecx, edx
mov byte [rbp + 0xbc0], cl
lea rdx, str.C:_stk_downloads
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx eax, byte [rbp + 0xbc0]
mov byte [rbp + 0x7b0], al
jmp 0x1402032f3
lea rdx, [0x14034ec34]
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.Logs
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x7c]
movzx ecx, word [rsp + 0x7a]
movzx edx, word [rsp + 0x78]
movzx r10d, word [rsp + 0x70]
movzx r9d, word [rsp + 0x76]
movzx r8d, word [rsp + 0x72]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str.SUPERAntiSpyware_Scan_Log____02d__02d__04d____02d__02d__02d
lea rcx, [rbp + 0x1bc0]
call fcn.140006bc0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x50]
call fcn.140249b10
lea rax, [rsp + 0x58]
mov qword [rbp + 0x2010], rax
lea rsi, vtable.CSABString.0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r15
lea rcx, [rbp + 0x1bc0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140203380
mov dword [rsp + 0x68], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1402033b6
mov r8d, dword [rsp + 0x68]
inc r8d
lea rdx, [rbp + 0x1bc0]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x6c], 1
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r15
lea rcx, [rbp + 0x7b0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1402033d6
mov dword [rsp + 0x50], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14020340c
mov r8d, dword [rsp + 0x50]
inc r8d
lea rdx, [rbp + 0x7b0]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x54], 1
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.1402028f0
test eax, eax
je 0x1402051f3
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x68], 0x19
mov ecx, 0x1a
call fcn.140247068
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140203475
movups xmm0, xmmword [str.SUPERAntiSpyware_Scan_Log]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1402d0528]
movsd qword [rax + 0x10], xmm1
movzx ecx, word [0x1402d0530]
mov word [rax + 0x18], cx
mov dword [rsp + 0x6c], 1
mov dword [rbp + 0x2010], r15d
mov r13, qword [rbp - 0x70]
mov r12, qword [rbp - 0x78]
test rbx, rbx
je 0x1402034f5
cmp r12, 0xffffffffffffffff
je 0x1402034f5
mov rax, qword [r13]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rbx + r9], 0
jne 0x1402034a2
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r8, rbx
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
nop
test rbx, rbx
je 0x140203502
mov rcx, rbx
call fcn.140247060
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x68], 0x20
mov ecx, 0x21
call fcn.140247068
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140203545
movups xmm0, xmmword [str.https:__www.superantispyware.com]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402b7120]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x1402b7130]
mov byte [rax + 0x20], cl
mov dword [rsp + 0x6c], 1
mov dword [rbp + 0x2010], r15d
test rbx, rbx
je 0x1402035c3
cmp r12, 0xffffffffffffffff
je 0x1402035c3
mov rax, qword [r13]
mov r9, 0xffffffffffffffff
nop word [rax + rax]
inc r9
cmp byte [rbx + r9], 0
jne 0x140203570
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r8, rbx
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
nop
test rbx, rbx
je 0x1402035d0
mov rcx, rbx
call fcn.140247060
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203608
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [rsp + 0x78]
movzx r10d, ax
cmp ax, 0xc
jbe 0x14020361b
sub r10d, 0xc
lea rcx, [0x1402d0534]
lea rdx, [0x1402d0538]
cmp ax, 0xc
cmovae rdx, rcx
movzx eax, word [rsp + 0x7a]
movzx ecx, word [rsp + 0x70]
movzx r9d, word [rsp + 0x76]
movzx r8d, word [rsp + 0x72]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], ecx
lea rdx, str.Generated__02d__02d__04d_at__02d:_02d__s
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x1402036d8
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rcx + r9], 0
jne 0x140203685
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203710
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
lea r8, [0x14037d0a0]
lea rdx, str.Application_Version_:__s
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203796
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rcx + r9], 0
jne 0x140203743
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov r8d, dword [0x140350478]
lea rdx, str.Database_Version_:__d
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203823
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x1402037d0
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x14020385b
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov eax, dword [0x140350860]
test eax, eax
jne 0x140203883
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x14020392b
lea r9d, [rax + 0x1c]
lea r8, str.Scan_type_______:_Quick_Scan
jmp 0x1402038e2
cmp eax, 1
jne 0x1402038a6
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x14020392b
lea r9d, [rax + 0x1e]
lea r8, str.Scan_type_______:_Complete_Scan
jmp 0x1402038e2
cmp eax, 2
jne 0x1402038c5
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x14020392b
lea r9d, [rax + 0x1b]
lea r8, str.Scan_type_______:_Custom_Scan
jmp 0x1402038e2
cmp eax, 4
jne 0x14020392b
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x14020392b
lea r9d, [rax + 0x21]
lea r8, str.Scan_type_______:_Critical_Point_Scan
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov rax, qword [r13]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov rax, qword [r13]
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
lea r8, [0x14037cb10]
lea rdx, str.Total_Scan_Time_:__s
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x1402039b3
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
nop
inc r9
cmp byte [rcx + r9], 0
jne 0x140203960
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x1402039eb
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
lea rax, vtable.CSABStringId.0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x116
mov qword [rsp + 0x58], rsi
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xbc0]
call fcn.140249b10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov r9d, 0x400
lea r8, [rbp + 0xbc0]
mov edx, 0x116
call qword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x140203a89
lea rcx, [rbp + 0xbc0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140203a50
mov dword [rsp + 0x68], eax
inc eax
mov edi, eax
mov ecx, eax
call fcn.140247068
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140203aa9
mov r8d, edi
lea rdx, [rbp + 0xbc0]
mov rcx, rax
call fcn.1402496a0
jmp 0x140203aa9
mov dword [rsp + 0x68], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rbx, rax
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov dword [rsp + 0x6c], 1
mov dword [rbp + 0x2010], r15d
test rbx, rbx
je 0x140203b23
cmp r12, 0xffffffffffffffff
je 0x140203b23
mov rax, qword [r13]
mov r9, 0xffffffffffffffff
nop
inc r9
cmp byte [rbx + r9], 0
jne 0x140203ad0
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r8, rbx
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
nop
test rbx, rbx
je 0x140203b31
mov rcx, rbx
call fcn.140247060
nop
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x3b0]
call fcn.140249b10
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xbc0]
call fcn.140249b10
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x2010]
call fcn.1400e4b70
mov r8d, 0x400
lea rdx, [rbp + 0xbc0]
lea rcx, [rbp + 0x2010]
call fcn.140202750
lea rcx, [rbp + 0x3b0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140203ba1
test rax, rax
je 0x140203c26
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203c26
mov rax, qword [r13]
lea rcx, [rbp + 0x3b0]
mov r9, 0xffffffffffffffff
nop
inc r9
cmp byte [rcx + r9], 0
jne 0x140203bd0
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3b0]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
lea rcx, [rbp + 0xbc0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140203c34
test rax, rax
je 0x140203cb7
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203cb7
mov rax, qword [r13]
lea rcx, [rbp + 0xbc0]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rcx + r9], 0
jne 0x140203c61
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0xbc0]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203cef
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [0x14037caf8]
mov r8d, dword [rax + 0x12a4]
lea rdx, str.Memory_items_scanned______:__d
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203d83
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x140203d30
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [0x14037caf8]
mov r8d, dword [rax + 0x12b0]
lea rdx, str.Memory_items_detected___:__d
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203e13
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x140203dc0
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [0x14037caf8]
mov r8d, dword [rax + 0x12a0]
lea rdx, str.Registry_items_scanned____:__d
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203ea3
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x140203e50
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [0x14037caf8]
mov r8d, dword [rax + 0x12ac]
lea rdx, str.Registry_items_detected_:__d
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203f33
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x140203ee0
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [0x14037caf8]
mov r8d, dword [rax + 0x129c]
lea rdx, str.File_items_scanned________:__d
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140203fc3
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x140203f70
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [0x14037caf8]
mov r8d, dword [rax + 0x12a8]
lea rdx, str.File_items_detected_____:__d
lea rcx, [rbp - 0x50]
call fcn.140006bc0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140204053
mov rax, qword [r13]
lea rcx, [rbp - 0x50]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x140204000
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [0x14037d258]
mov rdi, qword [rax]
cmp rdi, rax
je 0x1402042bf
nop word [rax + rax]
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x1402040a8
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140204106
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rdi + 0x20]
mov r8, qword [rdi + 0x18]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [rdi + 0x38]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1402042af
nop word [rax + rax]
mov dword [rbp + 0x2018], 0x804
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x54], 1
lea rdx, [rbx + 0x10]
lea r9, [rbp + 0x2018]
lea r8, [rsp + 0x40]
mov ecx, dword [rbx + 0x810]
call fcn.1401fd640
mov qword [rsp + 0x58], rsi
mov esi, 1
mov dword [rsp + 0x68], esi
lea ecx, [rsi + 1]
call fcn.140247068
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1402041a1
movzx ecx, word [reloc.OLEAUT32.dll_VariantCopy]
mov word [rax], cx
mov dword [rsp + 0x6c], esi
mov ecx, dword [rsp + 0x50]
add ecx, 2
call fcn.140247068
mov r14, rax
test r15, r15
je 0x1402041df
mov rcx, r15
mov rdx, rax
sub rdx, r15
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1402041c2
mov rcx, r15
call fcn.140247060
mov qword [rsp + 0x60], r14
jmp 0x1402041e4
mov qword [rsp + 0x60], rax
test r14, r14
je 0x140204214
mov r8d, dword [rsp + 0x50]
inc r8d
lea rcx, [r14 + 1]
mov rdx, qword [rsp + 0x48]
call fcn.1402496a0
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [r14 + rsi], 0
jne 0x140204206
mov dword [rsp + 0x68], esi
xor r15d, r15d
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140204272
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8, r14
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
lea r9d, [r15 + 2]
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
nop
test r14, r14
je 0x140204280
mov rcx, r14
call fcn.140247060
nop
lea rsi, vtable.CSABString.0
mov qword [rsp + 0x40], rsi
add dword [rsp + 0x54], 0xffffffff
jne 0x1402042a2
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1402042a2
call fcn.140247060
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0x38]
jne 0x140204120
mov rdi, qword [rdi]
cmp rdi, qword [0x14037d258]
jne 0x140204070
mov qword [rsp + 0x40], rsi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov r15d, 1
mov dword [rsp + 0x54], r15d
mov rax, qword [0x14037eee8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140204524
xor edi, edi
nop
cmp rbx, qword [rax]
jne 0x1402043f0
test rsi, rsi
je 0x14020431b
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], 0x5a
mov ecx, 0x5b
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204392
movups xmm0, xmmword [str._r_n_r_n_Unwanted_Programs_Detected__r_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d0720]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1402d0730]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x1402d0740]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [0x1402d0750]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x1402d0760]
movsd qword [rax + 0x50], xmm1
movzx eax, word [0x1402d0768]
mov word [rsi + 0x58], ax
movzx eax, byte [0x1402d076a]
mov byte [rsi + 0x5a], al
mov dword [rbp + 0x2010], edi
cmp r12, 0xffffffffffffffff
je 0x1402043f0
mov rax, qword [r13]
mov qword [rsp + 0x28], rdi
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 0x5a
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], rdi
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
test rsi, rsi
je 0x140204402
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], 1
mov ecx, 2
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14020442b
movzx ecx, word [reloc.OLEAUT32.dll_VariantCopy]
mov word [rax], cx
mov r14, qword [rbx + 0x10]
mov ecx, dword [r14 + 0x10]
add ecx, 2
call fcn.140247068
mov rsi, rax
test rdi, rdi
je 0x14020446d
mov rcx, rdi
mov rdx, rax
sub rdx, rdi
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140204450
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x48], rsi
jmp 0x140204472
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x14020449f
mov r8d, dword [r14 + 0x10]
inc r8d
lea rcx, [rsi + 1]
mov rdx, qword [r14 + 8]
call fcn.1402496a0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x140204492
mov dword [rsp + 0x50], eax
xor edi, edi
mov dword [rbp + 0x2010], edi
test rsi, rsi
je 0x140204511
cmp r12, 0xffffffffffffffff
je 0x140204511
mov rax, qword [r13]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rsi + r9], dil
jne 0x1402044c0
mov qword [rsp + 0x28], rdi
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], rdi
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rbx, qword [rbx]
mov rax, qword [0x14037eee8]
cmp rbx, rax
jne 0x140204300
test dword [0x14037caf0], 0x80000000
je 0x140204f6a
cmp dword [0x1403507b8], 0
je 0x140204f6a
cmp qword [0x14037d260], 0
jne 0x140204559
cmp qword [0x14037eef0], 0
je 0x140204f6a
test rsi, rsi
je 0x140204570
mov rcx, rsi
call fcn.140247060
xor r15d, r15d
mov qword [rsp + 0x48], r15
jmp 0x140204573
xor r15d, r15d
mov dword [rsp + 0x50], 0x8a
mov ecx, 0x8b
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204618
movups xmm0, xmmword [str._r_n_r_n_Scheduled_Scan___Automatic_Removal_Results__r_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d0780]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1402d0790]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x1402d07a0]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [0x1402d07b0]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [0x1402d07c0]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [0x1402d07d0]
movups xmmword [rax + 0x60], xmm0
movups xmm1, xmmword [0x1402d07e0]
movups xmmword [rax + 0x70], xmm1
movsd xmm0, qword [0x1402d07f0]
movsd qword [rax + 0x80], xmm0
movzx eax, word [0x1402d07f8]
mov word [rsi + 0x88], ax
movzx eax, byte [0x1402d07fa]
mov byte [rsi + 0x8a], al
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140204677
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 0x8a
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov ecx, r15d
mov dword [rbp + 0x2010], ecx
mov rax, qword [0x14037d258]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140204a85
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x38]
mov rdi, qword [rax]
cmp rdi, rax
je 0x140204a75
cmp dword [rdi + 0x76c], 4
je 0x140204a68
test ecx, ecx
jne 0x14020478b
test rsi, rsi
je 0x1402046d7
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 0x28
mov ecx, 0x29
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204722
movups xmm0, xmmword [str._r_nItems_scheduled_for_automatic_removal:]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d0810]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1402d0820]
movsd qword [rax + 0x20], xmm0
movzx eax, byte [0x1402d0828]
mov byte [rsi + 0x28], al
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140204781
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 0x28
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov dword [rbp + 0x2010], 1
mov rax, qword [0x14037d258]
cmp rbx, qword [rax]
jne 0x1402048c2
test rsi, rsi
je 0x1402047ad
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 1
mov ecx, 2
call fcn.140247068
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14020480d
movzx ecx, word [reloc.OLEAUT32.dll_VariantCopy]
mov word [rax], cx
mov ecx, dword [rbx + 0x20]
add ecx, 2
call fcn.140247068
mov rsi, rax
mov rcx, r14
mov rdx, rax
sub rdx, r14
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1402047f0
mov rcx, r14
call fcn.140247060
mov qword [rsp + 0x48], rsi
jmp 0x140204820
mov ecx, dword [rbx + 0x20]
add ecx, 2
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x14020484d
mov r8d, dword [rbx + 0x20]
inc r8d
lea rcx, [rsi + 1]
mov rdx, qword [rbx + 0x18]
call fcn.1402496a0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x140204840
mov dword [rsp + 0x50], eax
mov dword [rbp + 0x2018], r15d
test rsi, rsi
je 0x1402048c2
cmp r12, 0xffffffffffffffff
je 0x1402048c2
mov rax, qword [r13]
mov r9, 0xffffffffffffffff
nop word [rax + rax]
inc r9
cmp byte [rsi + r9], 0
jne 0x140204870
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2018]
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2018]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov dword [rbp + 0x2020], 0x804
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x6c], 1
lea rdx, [rdi + 0x10]
lea r9, [rbp + 0x2020]
lea r8, [rsp + 0x58]
mov ecx, dword [rdi + 0x810]
call fcn.1401fd640
test rsi, rsi
je 0x14020492f
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], r15
mov r14d, 2
mov dword [rsp + 0x50], r14d
lea ecx, [r14 + 1]
call fcn.140247068
mov r15, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14020499d
movzx ecx, word [0x1402d082c]
mov word [rax], cx
movzx ecx, byte [0x1402d082e]
mov byte [rax + 2], cl
mov ecx, dword [rsp + 0x68]
add ecx, 3
call fcn.140247068
mov rsi, rax
mov rcx, r15
mov rdx, rax
sub rdx, r15
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140204980
mov rcx, r15
call fcn.140247060
mov qword [rsp + 0x48], rsi
jmp 0x1402049b1
mov ecx, dword [rsp + 0x68]
add ecx, 3
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x1402049e2
mov r8d, dword [rsp + 0x68]
inc r8d
lea rcx, [rsi + 2]
mov rdx, qword [rsp + 0x60]
call fcn.1402496a0
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rsi + r14], 0
jne 0x1402049d3
mov dword [rsp + 0x50], r14d
xor r15d, r15d
mov dword [rbp + 0x2018], r15d
cmp r12, 0xffffffffffffffff
je 0x140204a40
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2018]
mov qword [rsp + 0x20], rcx
mov r9d, r14d
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2018]
mov qword [rsp + 0x20], rcx
lea r9d, [r15 + 2]
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
nop
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
add dword [rsp + 0x6c], 0xffffffff
jne 0x140204a62
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140204a62
call fcn.140247060
mov ecx, dword [rbp + 0x2010]
mov rdi, qword [rdi]
cmp rdi, qword [rbx + 0x38]
jne 0x1402046b0
mov rbx, qword [rbx]
cmp rbx, qword [0x14037d258]
jne 0x1402046a0
mov r14d, r15d
mov rax, qword [0x14037d258]
mov rdi, qword [rax]
cmp rdi, rax
je 0x140204db1
nop dword [rax + rax]
mov rax, qword [rdi + 0x38]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140204da1
cmp dword [rbx + 0x76c], 4
jne 0x140204d94
test r14d, r14d
jne 0x140204b94
test rsi, rsi
je 0x140204ad8
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 0x47
mov ecx, 0x48
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204b2f
movups xmm0, xmmword [str._r_nItems_not_removed_automatically__adware__potentially_unwanted__etc._:]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d0840]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1402d0850]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x1402d0860]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1402d0870]
movsd qword [rax + 0x40], xmm0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140204b8e
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 0x47
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov r14d, 1
mov rax, qword [0x14037d258]
cmp rdi, qword [rax]
jne 0x140204c62
test rsi, rsi
je 0x140204bb6
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 1
mov ecx, 2
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204bdc
movzx ecx, word [reloc.OLEAUT32.dll_VariantCopy]
mov word [rax], cx
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140081fe0
mov dword [rbp + 0x2010], r15d
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140204c62
cmp r12, 0xffffffffffffffff
je 0x140204c62
mov rax, qword [r13]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rsi + r9], 0
jne 0x140204c10
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov dword [rbp + 0x2018], 0x804
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x6c], 1
lea rdx, [rbx + 0x10]
lea r9, [rbp + 0x2018]
lea r8, [rsp + 0x58]
mov ecx, dword [rbx + 0x810]
call fcn.1401fd640
test rsi, rsi
je 0x140204ccf
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 2
mov ecx, 3
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204cff
movzx ecx, word [0x1402d082c]
mov word [rax], cx
movzx ecx, byte [0x1402d082e]
mov byte [rax + 2], cl
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140081fe0
mov dword [rbp + 0x2010], r15d
mov rsi, qword [rsp + 0x48]
cmp r12, 0xffffffffffffffff
je 0x140204d72
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x50]
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
nop
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
add dword [rsp + 0x6c], 0xffffffff
jne 0x140204d94
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140204d94
call fcn.140247060
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0x38]
jne 0x140204ab0
mov rdi, qword [rdi]
cmp rdi, qword [0x14037d258]
jne 0x140204aa0
mov rax, qword [0x14037eee8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140204f65
test r14d, r14d
jne 0x140204e9b
test rsi, rsi
je 0x140204ddf
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 0x47
mov ecx, 0x48
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204e36
movups xmm0, xmmword [str._r_nItems_not_removed_automatically__adware__potentially_unwanted__etc._:]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d0840]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1402d0850]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x1402d0860]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1402d0870]
movsd qword [rax + 0x40], xmm0
mov dword [rbp + 0x2010], r15d
cmp r12, 0xffffffffffffffff
je 0x140204e95
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 0x47
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov r14d, 1
test rsi, rsi
je 0x140204ead
mov rcx, rsi
call fcn.140247060
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 1
mov ecx, 2
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204ed3
movzx ecx, word [reloc.OLEAUT32.dll_VariantCopy]
mov word [rax], cx
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140081fe0
mov dword [rbp + 0x2010], r15d
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140204f55
cmp r12, 0xffffffffffffffff
je 0x140204f55
mov rax, qword [r13]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rsi + r9], 0
jne 0x140204f03
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], r15
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rbx, qword [rbx]
cmp rbx, qword [0x14037eee8]
jne 0x140204dc4
mov r15d, dword [rsp + 0x54]
test rsi, rsi
je 0x140204f80
mov rcx, rsi
call fcn.140247060
xor ebx, ebx
mov qword [rsp + 0x48], rbx
jmp 0x140204f82
xor ebx, ebx
mov dword [rsp + 0x50], 0x2a
mov ecx, 0x2b
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140204fd8
movups xmm0, xmmword [str._r_n_r_n_End_of_Log__r_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402d0888]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1402d0898]
movsd qword [rax + 0x20], xmm0
movzx ecx, word [0x1402d08a0]
mov word [rax + 0x28], cx
movzx ecx, byte [0x1402d08a2]
mov byte [rax + 0x2a], cl
mov dword [rbp + 0x2010], ebx
cmp r12, 0xffffffffffffffff
je 0x14020504b
mov rax, qword [r13]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2a
mov r8, rdi
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x2010]
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, [0x140286114]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x30]
mov rax, qword [r13]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x38]
mov qword [rbp - 0x78], 0xffffffffffffffff
test dword [0x14037caf0], 0x80000000
je 0x1402051a8
mov rax, qword [0x14037d260]
cmp dword [0x140351034], 0
je 0x140205070
test rax, rax
je 0x140205086
cmp dword [0x140351030], 0
je 0x1402051af
test rax, rax
je 0x1402051af
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
mov r9d, 1
mov r8d, 0x80000000
lea rdx, [0x14037e730]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1402051a8
mov rcx, qword [0x14037adb0]
mov r9, qword [rcx]
lea r8, [rbp + 0x2020]
mov rdx, rax
call qword [r9 + 0x68]
lea ebx, [rax + 1]
mov ecx, ebx
call fcn.140247068
mov rsi, rax
xor eax, eax
mov dword [rbp + 0x2010], eax
mov rcx, qword [0x14037adb0]
mov r10, qword [rcx]
lea r9d, [rbx - 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2010]
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, r14
call qword [r10 + 0x28]
mov rcx, qword [0x14037adb0]
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 0x38]
mov eax, dword [rbp + 0x2010]
test eax, eax
je 0x1402051a0
mov byte [rax + rsi], 0
mov dword [rbp + 0x2018], 0x104
lea rdx, [rbp + 0x2018]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rax, qword [0x14037d260]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3b0]
lea r8, str._From:__s__Scheduled_Scan_Results___u_detections_
mov edx, 0x410
lea rcx, [rbp + 0xbc0]
call fcn.14000b150
xor r9d, r9d
mov r8, rsi
lea rdx, [rbp + 0xbc0]
lea rcx, [0x140350f28]
call fcn.1401f2430
mov rcx, rsi
call fcn.140247060
mov rax, qword [0x14037d260]
cmp dword [0x140350794], 0
je 0x1402051c5
test rax, rax
jne 0x1402051dd
cmp dword [0x140350798], eax
jne 0x1402051dd
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [0x14037e730]
call qword [rax + 0x88]
nop
lea eax, [r15 - 1]
test eax, eax
jne 0x1402051f3
test rdi, rdi
je 0x1402051f3
mov rcx, rdi
call fcn.140247060
nop
lea rcx, [rbp - 0x80]
call fcn.140202010
mov rbx, qword [rsp + 0x2128]
add rsp, 0x20d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret