Function at 0x140004570
Capabilities:
Check if file exists
Delete registry key
Get file attributes
Manipulate boot configuration
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x140010008]
xor rax, rsp
mov qword [rbp + 0x310], rax
xor r14d, r14d
lea rdx, str.C:WindowsCursors_aero_working_m.ani
mov dword [rbp + 0x38], r14d
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
lea r8d, [r14 + 0x25]
movdqu xmmword [rsp + 0x40], xmm1
call fcn.1400084c0
cmp qword [rsp + 0x48], 0x10
lea rcx, [rsp + 0x30]
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000463d
test al, 0x10
jne 0x14000463d
xorps xmm0, xmm0
lea r8d, [r14 + 0x23]
xorps xmm1, xmm1
lea rdx, str.C:ProgramDataCommonCreativOS.pro
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
movdqu xmmword [rbp - 0x78], xmm1
call fcn.1400084c0
cmp qword [rbp - 0x70], 0x10
lea rcx, [rsp + 0x78]
cmovae rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140004633
test al, 0x10
jne 0x140004633
xor dil, dil
lea ebx, [r14 + 3]
jmp 0x14000464c
mov ebx, 3
lea eax, [rbx - 1]
jmp 0x140004645
mov ebx, 1
mov eax, r14d
mov dil, 1
test eax, eax
je 0x140004699
mov rdx, qword [rbp - 0x70]
and ebx, 0xfffffffd
cmp rdx, 0x10
jb 0x140004687
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004682
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046d0
call fcn.1400098fc
movdqa xmm0, xmmword [0x14000bf40]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], r14b
mov rdx, qword [rsp + 0x48]
and ebx, 0xfffffffe
cmp rdx, 0x10
jb 0x1400046dc
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046d7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400046d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
test dil, dil
jne 0x140006058
xorps xmm0, xmm0
lea rdx, str.User
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 4
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.1400084c0
xorps xmm0, xmm0
lea rdx, str.SOFTWARECreativOS
xorps xmm1, xmm1
lea rcx, [rsp + 0x30]
mov r8d, 0x12
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.1400084c0
lea rax, [rbp + 0x40]
or ebx, 0xc
cmp qword [rsp + 0x48], 0x10
lea rdx, [rsp + 0x30]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
cmovae rdx, qword [rsp + 0x30]
mov rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140004a1f
cmp qword [rsp + 0x68], 0x10
lea rax, [rbp + 0x38]
mov rcx, qword [rbp + 0x40]
lea rdx, [rsp + 0x50]
cmovae rdx, qword [rsp + 0x50]
lea r9, [rbp + 0x3c]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rbp + 0x3c], r14d
mov dword [rbp + 0x38], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x40]
test eax, eax
jne 0x140004a19
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rdx, [0x14000b94c]
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 3
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.1400084c0
xorps xmm0, xmm0
lea rdx, str.SOFTWARECreativOS
xorps xmm1, xmm1
lea rcx, [rbp - 0x48]
mov r8d, 0x12
movups xmmword [rbp - 0x48], xmm0
movdqu xmmword [rbp - 0x38], xmm1
call fcn.1400084c0
lea rax, [rbp + 0x40]
or ebx, 0x30
cmp qword [rbp - 0x30], 0x10
lea rdx, [rbp - 0x48]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
cmovae rdx, qword [rbp - 0x48]
mov rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140004a1f
cmp qword [rbp - 0x50], 0x10
lea rax, [rbp + 0x3c]
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp - 0x68]
cmovae rdx, qword [rbp - 0x68]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rbp + 0x38], r14d
mov dword [rbp + 0x3c], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x40]
test eax, eax
jne 0x140004a19
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rdx, str.auth
xorps xmm1, xmm1
lea rcx, [rbp + 0x18]
mov r8d, 4
movups xmmword [rbp + 0x18], xmm0
movdqu xmmword [rbp + 0x28], xmm1
call fcn.1400084c0
xorps xmm0, xmm0
lea rdx, str.SOFTWARECreativOS
xorps xmm1, xmm1
lea rcx, [rbp - 8]
mov r8d, 0x12
movups xmmword [rbp - 8], xmm0
movdqu xmmword [rbp + 8], xmm1
call fcn.1400084c0
lea rax, [rbp + 0x40]
or ebx, 0xc0
cmp qword [rbp + 0x10], 0x10
lea rdx, [rbp - 8]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
cmovae rdx, qword [rbp - 8]
mov rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140004a1f
cmp qword [rbp + 0x30], 0x10
lea rax, [rbp + 0x3c]
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp + 0x18]
cmovae rdx, qword [rbp + 0x18]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rbp + 0x38], r14d
mov dword [rbp + 0x3c], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x40]
test eax, eax
jne 0x140004a19
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rdx, [0x14000b958]
xorps xmm1, xmm1
lea rcx, [rbp - 0x28]
mov r8d, 2
movups xmmword [rbp - 0x28], xmm0
movdqu xmmword [rbp - 0x18], xmm1
call fcn.1400084c0
xorps xmm0, xmm0
lea rdx, str.SOFTWARECreativOS
xorps xmm1, xmm1
lea rcx, [rsp + 0x78]
mov r8d, 0x12
movups xmmword [rsp + 0x78], xmm0
movdqu xmmword [rbp - 0x78], xmm1
call fcn.1400084c0
lea rax, [rbp + 0x40]
or ebx, 0x300
cmp qword [rbp - 0x70], 0x10
lea rdx, [rsp + 0x78]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
cmovae rdx, qword [rsp + 0x78]
mov rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140004a1f
cmp qword [rbp - 0x10], 0x10
lea rax, [rbp + 0x3c]
mov rcx, qword [rbp + 0x40]
lea rdx, [rbp - 0x28]
cmovae rdx, qword [rbp - 0x28]
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rbp + 0x38], r14d
mov dword [rbp + 0x3c], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rbp + 0x40]
test eax, eax
jne 0x140004a19
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004a22
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dil, 1
bt ebx, 9
jae 0x140004a7a
mov rdx, qword [rbp - 0x70]
btr ebx, 9
cmp rdx, 0x10
jb 0x140004a68
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a63
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ca3
call fcn.1400098fc
movdqa xmm0, xmmword [0x14000bf40]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], r14b
bt ebx, 8
jae 0x140004ad0
mov rdx, qword [rbp - 0x10]
btr ebx, 8
cmp rdx, 0x10
jb 0x140004abf
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004aba
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ca3
call fcn.1400098fc
movdqa xmm0, xmmword [0x14000bf40]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], r14b
test bl, bl
jns 0x140004b24
mov rdx, qword [rbp + 0x10]
btr ebx, 7
cmp rdx, 0x10
jb 0x140004b13
mov rcx, qword [rbp - 8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b0e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ca3
call fcn.1400098fc
movdqa xmm0, xmmword [0x14000bf40]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], r14b
test bl, 0x40
je 0x140004b78
mov rdx, qword [rbp + 0x30]
and ebx, 0xffffffbf
cmp rdx, 0x10
jb 0x140004b67
mov rcx, qword [rbp + 0x18]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b62
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ca3
call fcn.1400098fc
movdqa xmm0, xmmword [0x14000bf40]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], r14b
test bl, 0x20
je 0x140004bcc
mov rdx, qword [rbp - 0x30]
and ebx, 0xffffffdf
cmp rdx, 0x10
jb 0x140004bbb
mov rcx, qword [rbp - 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bb6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ca3
call fcn.1400098fc
movdqa xmm0, xmmword [0x14000bf40]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], r14b
test bl, 0x10
je 0x140004c20
mov rdx, qword [rbp - 0x50]
and ebx, 0xffffffef
cmp rdx, 0x10
jb 0x140004c0f
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c0a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ca3
call fcn.1400098fc
movdqa xmm0, xmmword [0x14000bf40]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], r14b
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140004c59
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c54
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ca3
call fcn.1400098fc
mov rdx, qword [rsp + 0x68]
and ebx, 0xfffffff3
movdqa xmm0, xmmword [0x14000bf40]
mov byte [rsp + 0x30], r14b
movdqu xmmword [rsp + 0x40], xmm0
cmp rdx, 0x10
jb 0x140004caf
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004caa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004caa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
test dil, dil
jne 0x140006058
xorps xmm0, xmm0
lea rdx, str._localappdata_cacheqtshadercache94075cabd8844ee8f3c41238627fa5a5d48b71c76e
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 0x4d
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
cmp qword [rsp + 0x68], 8
lea rcx, [rsp + 0x50]
mov r8d, 0x104
lea rdx, [rbp + 0x100]
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xorps xmm0, xmm0
mov qword [rbp + 0x90], r14
mov rdi, 0xffffffffffffffff
mov qword [rbp + 0x98], r14
movups xmmword [rbp + 0x80], xmm0
lea rax, [rbp + 0x100]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x140004d30
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x80]
call fcn.140008230
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140004d92
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d8d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
xorps xmm0, xmm0
lea rdx, str._localappdata_cacheqtshadercache_b9ecc05f05f41810baa12267694075cabd8844ee8
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 0x4c
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
cmp qword [rsp + 0x68], 8
lea rcx, [rsp + 0x50]
mov r8d, 0x104
lea rdx, [rbp + 0x100]
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xorps xmm0, xmm0
mov qword [rbp + 0x70], r14
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x78], r14
lea rax, [rbp + 0x100]
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x140004df4
mov r8, rdi
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x60]
call fcn.140008230
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140004e56
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e51
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
xorps xmm0, xmm0
mov qword [rbp + 0xb0], r14
mov r8d, 0x21
mov qword [rbp + 0xb8], r14
lea rdx, str.C:ProgramDataESETESET_Security
lea rcx, [rbp + 0xa0]
movups xmmword [rbp + 0xa0], xmm0
call fcn.140008230
lea r8, str.License
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xe0]
call fcn.140007ba0
cmp qword [rbp + 0x98], 8
lea rdx, [rbp + 0x80]
mov r8, qword [rbp + 0x90]
lea rcx, [rsp + 0x30]
cmovae rdx, qword [rbp + 0x80]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140008230
lea rcx, [rsp + 0x30]
bts ebx, 0xa
call fcn.1400030a0
test al, al
je 0x140004f30
cmp qword [rbp + 0x78], 8
lea rdx, [rbp + 0x60]
mov r8, qword [rbp + 0x70]
lea rcx, [rsp + 0x50]
cmovae rdx, qword [rbp + 0x60]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
lea rcx, [rsp + 0x50]
bts ebx, 0xb
call fcn.1400030a0
test al, al
je 0x140004f30
xor dil, dil
jmp 0x140004f33
mov dil, 1
bt ebx, 0xb
jae 0x140004f8b
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140004f77
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f72
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004fc4
call fcn.1400098fc
movdqa xmm0, xmmword [0x14000bf30]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140004fd0
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fcb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fcb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
test dil, dil
jne 0x140006058
cmp qword [rbp + 0xb8], 8
lea rdx, [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
lea rcx, [rsp + 0x50]
cmovae rdx, qword [rbp + 0xa0]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
lea rcx, [rsp + 0x50]
call fcn.1400030a0
mov rdx, qword [rsp + 0x68]
test al, al
sete bl
cmp rdx, 8
jb 0x140005066
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005061
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005061
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
test bl, bl
jne 0x140006058
lea rax, [rbp + 0x40]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARENodejsPartnerST
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006052
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWARENodejsPartnerST
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x140006052
cmp qword [rbp + 0xf8], 8
lea rdx, [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rsp + 0x50]
cmovae rdx, qword [rbp + 0xe0]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
lea rcx, [rsp + 0x50]
call fcn.1400030a0
mov rdx, qword [rsp + 0x68]
test al, al
sete bl
cmp rdx, 8
jb 0x14000514f
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000514a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000514a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
test bl, bl
je 0x140005178
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x50]
call fcn.140007200
lea rcx, [rsp + 0x50]
call fcn.1400034e0
lea rcx, [rsp + 0x50]
call fcn.140001d50
xorps xmm0, xmm0
mov qword [rbp + 0xd0], r14
mov r8d, 0x34
mov qword [rbp + 0xd8], r14
lea rdx, str.C:ProgramDataESETESET_SecurityLicenselicense.lf
lea rcx, [rbp + 0xc0]
movups xmmword [rbp + 0xc0], xmm0
call fcn.140008230
cmp qword [rbp + 0xd8], 8
lea rdx, [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rsp + 0x30]
cmovae rdx, qword [rbp + 0xc0]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140008230
cmp qword [rsp + 0x48], 8
lea rcx, [rsp + 0x30]
cmovae rcx, qword [rsp + 0x30]
call fcn.1400095fc
shr rax, 0x20
test eax, eax
jne 0x14000605e
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140005249
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005244
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005244
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
lea r8, str.license.lf
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x50]
call fcn.140007ba0
xorps xmm0, xmm0
lea rdx, [rbp + 0x80]
movups xmmword [rbp + 0x40], xmm0
lea rcx, [rsp + 0x78]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
xorps xmm1, xmm1
mov word [rax], r14w
cmp qword [rbp + 0x98], 8
mov r8, qword [rbp + 0x90]
cmovae rdx, qword [rbp + 0x80]
movups xmmword [rsp + 0x78], xmm0
movdqu xmmword [rbp - 0x78], xmm1
call fcn.140008230
cmp qword [rbp + 0x58], 8
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x78]
cmovae rdx, qword [rbp + 0x40]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
call fcn.140009820
test eax, eax
jne 0x140006072
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x140005333
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000532e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053cd
call fcn.1400098fc
mov rdx, qword [rbp + 0x58]
movdqa xmm0, xmmword [0x14000bf30]
mov word [rsp + 0x78], r14w
movdqu xmmword [rbp - 0x78], xmm0
cmp rdx, 8
jb 0x140005382
mov rcx, qword [rbp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000537d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053cd
call fcn.1400098fc
mov rdx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x14000bf30]
mov word [rbp + 0x40], r14w
movdqu xmmword [rbp + 0x50], xmm0
cmp rdx, 8
jb 0x1400053d9
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053d4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400053d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
mov qword [rsp + 0x450], rsi
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x458], r15
movaps xmmword [rsp + 0x420], xmm6
call fcn.140003f80
call fcn.1400043a0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000541d
imul rax, rax, 0x64
jmp 0x14000543b
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffc46535ff
lea rdi, [rax + 0x3b9aca00]
cmp rax, rcx
jl 0x14000545b
movabs rdi, 0x7fffffffffffffff
movsd xmm6, qword [0x14000bf28]
movabs rsi, 0x311cdad160000
movabs r15, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140005495
imul rbx, rax, 0x64
jmp 0x1400054b6
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x14000552a
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea r8, [rcx + rsi]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r9b
test r9b, r9b
jne 0x1400054e8
lea r8, [rax + rcx]
add rax, rcx
lea rdx, [rcx + rsi]
test r9b, r9b
lea rcx, [rbp + 0x40]
cmove rdx, rax
mov rax, r15
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rbp + 0x40], rdx
sub r8d, eax
mov dword [rbp + 0x48], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140005477
cmp qword [rbp + 0x98], 8
lea rdx, [rbp + 0x80]
mov r8, qword [rbp + 0x90]
lea rcx, [rsp + 0x30]
cmovae rdx, qword [rbp + 0x80]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140008230
cmp qword [rsp + 0x48], 8
lea rcx, [rsp + 0x30]
cmovae rcx, qword [rsp + 0x30]
call fcn.1400095fc
movaps xmm6, xmmword [rsp + 0x420]
mov r15, qword [rsp + 0x458]
shr rax, 0x20
test eax, eax
jne 0x140006083
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400055da
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055d5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400055d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
cmp qword [rbp + 0x78], 8
lea rdx, [rbp + 0x60]
mov r8, qword [rbp + 0x70]
lea rcx, [rsp + 0x30]
cmovae rdx, qword [rbp + 0x60]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140008230
cmp qword [rsp + 0x48], 8
lea rcx, [rsp + 0x30]
cmovae rcx, qword [rsp + 0x30]
call fcn.1400095fc
shr rax, 0x20
test eax, eax
jne 0x140006097
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000566e
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005669
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005669
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
xorps xmm0, xmm0
lea rdx, str.bcdedit.exe
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 0xb
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x68]
call fcn.140003800
mov rbx, rax
mov rdx, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0x20
jb 0x1400056ec
lea rsi, [rcx + 0x20]
mov rdi, rbx
mov qword [rbx + 0x10], rsi
cmp rdx, 8
jb 0x1400056cf
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x40
lea rdx, str.__DELETEVALUE_CURRENT_SAFEBOOT
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], r14w
jmp 0x14000570c
lea r9, str.__DELETEVALUE_CURRENT_SAFEBOOT
mov qword [rsp + 0x20], 0x20
mov edx, 0x20
mov rcx, rbx
call fcn.140008060
mov rbx, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
lea rcx, [rbp - 0x48]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
call fcn.140003b70
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14000578c
mov rcx, qword [rbp - 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005787
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005869
call fcn.1400098fc
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400057ce
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057c9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005869
call fcn.1400098fc
mov rdx, qword [rbp - 0x50]
movdqa xmm0, xmmword [0x14000bf30]
mov word [rsp + 0x30], r14w
movdqu xmmword [rsp + 0x40], xmm0
cmp rdx, 8
jb 0x14000581e
mov rcx, qword [rbp - 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005819
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005869
call fcn.1400098fc
mov rdx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x14000bf30]
mov word [rbp - 0x68], r14w
movdqu xmmword [rbp - 0x58], xmm0
cmp rdx, 8
jb 0x140005875
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005870
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005870
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
xorps xmm0, xmm0
lea rdx, str.bcdedit.exe
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 0xb
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x68]
call fcn.140003800
mov rbx, rax
mov rdx, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0x27
jb 0x1400058f3
lea rsi, [rcx + 0x27]
mov rdi, rbx
mov qword [rbx + 0x10], rsi
cmp rdx, 8
jb 0x1400058d6
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x4e
lea rdx, str.__DELETEVALUE_CURRENT_SAFEBOOTMINIMAL
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], r14w
jmp 0x140005913
lea r9, str.__DELETEVALUE_CURRENT_SAFEBOOTMINIMAL
mov qword [rsp + 0x20], 0x27
mov edx, 0x27
mov rcx, rbx
call fcn.140008060
mov rbx, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
lea rcx, [rbp - 0x48]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
call fcn.140003b70
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140005993
mov rcx, qword [rbp - 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000598e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a70
call fcn.1400098fc
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400059d5
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059d0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a70
call fcn.1400098fc
mov rdx, qword [rbp - 0x50]
movdqa xmm0, xmmword [0x14000bf30]
mov word [rsp + 0x30], r14w
movdqu xmmword [rsp + 0x40], xmm0
cmp rdx, 8
jb 0x140005a25
mov rcx, qword [rbp - 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a20
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a70
call fcn.1400098fc
mov rdx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x14000bf30]
mov word [rbp - 0x68], r14w
movdqu xmmword [rbp - 0x58], xmm0
cmp rdx, 8
jb 0x140005a7c
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a77
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
xorps xmm0, xmm0
lea rdx, str.bcdedit.exe
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 0xb
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x68]
call fcn.140003800
mov rbx, rax
mov rdx, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0x27
jb 0x140005afa
lea rsi, [rcx + 0x27]
mov rdi, rbx
mov qword [rbx + 0x10], rsi
cmp rdx, 8
jb 0x140005add
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x4e
lea rdx, str.__DELETEVALUE_CURRENT_SAFEBOOTNETWORK
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], r14w
jmp 0x140005b1a
lea r9, str.__DELETEVALUE_CURRENT_SAFEBOOTNETWORK
mov qword [rsp + 0x20], 0x27
mov edx, 0x27
mov rcx, rbx
call fcn.140008060
mov rbx, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
lea rcx, [rbp - 0x48]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
call fcn.140003b70
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140005b9a
mov rcx, qword [rbp - 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b95
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c77
call fcn.1400098fc
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140005bdc
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bd7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c77
call fcn.1400098fc
mov rdx, qword [rbp - 0x50]
movdqa xmm0, xmmword [0x14000bf30]
mov word [rsp + 0x30], r14w
movdqu xmmword [rsp + 0x40], xmm0
cmp rdx, 8
jb 0x140005c2c
mov rcx, qword [rbp - 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c27
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c77
call fcn.1400098fc
mov rdx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x14000bf30]
mov word [rbp - 0x68], r14w
movdqu xmmword [rbp - 0x58], xmm0
cmp rdx, 8
jb 0x140005c83
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c7e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
xorps xmm0, xmm0
lea rdx, str.bcdedit.exe
xorps xmm1, xmm1
lea rcx, [rsp + 0x30]
mov r8d, 0xb
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140008230
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x68]
call fcn.140003800
mov rbx, rax
mov rdx, qword [rax + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0x2e
jb 0x140005d01
lea rsi, [rcx + 0x2e]
mov rdi, rbx
mov qword [rbx + 0x10], rsi
cmp rdx, 8
jb 0x140005ce4
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
mov r8d, 0x5c
lea rdx, str.__DELETEVALUE_CURRENT_SAFEBOOTALTERNATESHELL
call sub.VCRUNTIME140.dll_memmove
mov word [rdi + rsi*2], r14w
jmp 0x140005d21
lea r9, str.__DELETEVALUE_CURRENT_SAFEBOOTALTERNATESHELL
mov qword [rsp + 0x20], 0x2e
mov edx, 0x2e
mov rcx, rbx
call fcn.140008060
mov rbx, rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
call fcn.140003da0
lea rcx, [rsp + 0x50]
call fcn.140001d50
lea rcx, [rbp - 0x68]
call fcn.140001d50
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140005db5
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005db0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005db0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
xorps xmm0, xmm0
lea rdx, str.shutdown__r__f__t_0
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 0x13
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.140008230
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140003b70
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140005e2a
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e25
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e63
call fcn.1400098fc
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140005e6f
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e6a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x140005eb5
mov rcx, qword [rbp + 0xc0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005eb0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006019
call fcn.1400098fc
mov rdx, qword [rbp + 0xf8]
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r14w
cmp rdx, 8
jb 0x140005f15
mov rcx, qword [rbp + 0xe0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f10
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006019
call fcn.1400098fc
mov rdx, qword [rbp + 0xb8]
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r14w
cmp rdx, 8
jb 0x140005f75
mov rcx, qword [rbp + 0xa0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f70
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006019
call fcn.1400098fc
mov rdx, qword [rbp + 0x78]
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], r14w
cmp rdx, 8
jb 0x140005fcb
mov rcx, qword [rbp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fc6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006019
call fcn.1400098fc
mov rdx, qword [rbp + 0x98]
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r14w
cmp rdx, 8
jb 0x140006025
mov rcx, qword [rbp + 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006020
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006020
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400098fc
mov rsi, qword [rsp + 0x450]
xor eax, eax
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1400098a0
mov rbx, qword [rsp + 0x460]
add rsp, 0x430
pop r14
pop rdi
pop rbp
ret
call fcn.140003e00
int3
call fcn.140003e00
int3
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, str.remove
call fcn.1400027e0
int3
lea r9, [rbp + 0x40]
mov edx, eax
lea r8, [rsp + 0x78]
call fcn.140002850
int3
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, str.remove
call fcn.1400027e0
int3
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, str.remove
call fcn.1400027e0
int3