Function at 0x180006270
Capabilities:
Check for time delay via gettickcount
Check if file exists
Enumerate processes
Get common file path
Get startup folder
Get thread local storage value
Query environment variable
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2300]
mov eax, 0x2400
call fcn.1800f0120
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2440], rbx
mov rax, qword [0x1801bc080]
xor rax, rsp
mov qword [rbp + 0x22f0], rax
mov r12, r9
mov r15, r8
xor r13d, r13d
lea rdi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
cmp qword [0x1801c5328], r13
je 0x1800063f5
lea rcx, [0x1801c5328]
call fcn.1800d0470
mov rax, qword [0x1801c5328]
cmp byte [rax + 0x78], r13b
je 0x1800063f5
cmp dword [rax + 0x80], 4
jb 0x1800063f5
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x210], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x210], xmm1
mov word [rbp + 0x200], r13w
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x180006333
mov r9, qword [r12]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x180006340
mov r8, qword [r15]
lea rdx, str.JumpToProtectMainPage_link___s__path___s
lea rcx, [rbp + 0x200]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x24f
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x200]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
test bl, bl
je 0x180006397
lea rdx, [rbp + 0x200]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x1800063dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f38
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], r13w
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov byte [rsp + 0x31], 0
lea r9, [rsp + 0x31]
lea r8, [rbp + 0x40]
call fcn.180018f30
mov esi, eax
cmp qword [0x1801c5328], 0
je 0x18000654b
lea rcx, [0x1801c5328]
call fcn.1800d0470
mov rcx, qword [0x1801c5328]
cmp byte [rcx + 0x78], 0
je 0x18000654b
cmp dword [rcx + 0x80], 4
jb 0x18000654b
movzx ebx, byte [rcx + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x230], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x220], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
mov r8d, esi
lea rdx, str.GetProtectMainPage_dwErr__0x_X_protectMainPage___s
lea rcx, [rbp + 0x220]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x256
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x220]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
test bl, bl
je 0x1800064ed
lea rdx, [rbp + 0x220]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x180006533
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000652e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f3e
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], r13w
mov byte [rsp + 0x30], 0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.180011390
mov r14, 0xffffffffffffffff
test al, al
je 0x18000658d
cmp qword [rbp + 0x30], 0
jne 0x180006656
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x12f0]
call fcn.18010e5a0
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x12f0]
call fcn.180033650
test al, al
je 0x180006656
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x250], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x250], xmm1
mov word [rbp + 0x240], r13w
lea rax, [rbp + 0x12f0]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800065f0
lea rdx, [rbp + 0x12f0]
lea rcx, [rbp + 0x240]
call fcn.180004aa0
nop
lea rcx, [rbp + 0x20]
call fcn.180004a10
movups xmm0, xmmword [rbp + 0x240]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x250]
movups xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movzx edi, byte [rsp + 0x30]
mov rax, qword [0x1801c5328]
test rax, rax
je 0x180006794
lea rcx, [0x1801c5328]
call fcn.1800d0470
mov rax, qword [0x1801c5328]
cmp byte [rax + 0x78], 0
je 0x180006794
cmp dword [rax + 0x80], 4
jb 0x180006794
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x270], xmm1
mov word [rbp + 0x260], r13w
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
movzx r9d, dil
lea rdx, str.GetProtectMainPage_Other_Browser_protectMainPage___s__isLocked___d
lea rcx, [rbp + 0x260]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x264
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x260]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
test bl, bl
je 0x18000672f
lea rdx, [rbp + 0x260]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x278]
cmp rdx, 8
jb 0x180006775
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006770
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f44
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x270], xmm0
mov word [rbp + 0x260], r13w
mov rax, qword [0x1801c5328]
cmp qword [rbp + 0x50], 0
jne 0x180006970
test dil, dil
jne 0x180006970
test rax, rax
je 0x1800068c7
lea rcx, [0x1801c5328]
call fcn.1800d0470
mov rax, qword [0x1801c5328]
cmp byte [rax + 0x78], dil
je 0x1800068c7
cmp dword [rax + 0x80], 4
jb 0x1800068c7
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x290], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x290], xmm1
mov word [rbp + 0x280], r13w
mov r8d, 0x1a
lea rdx, str.GetProtectMainPage
lea rcx, [rbp + 0x280]
call fcn.180004aa0
mov dword [rsp + 0x28], 0x269
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x280]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
test bl, bl
je 0x180006869
lea rdx, [rbp + 0x280]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 8
jb 0x1800068af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800068aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f4a
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x280], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006907
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006902
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f50
call fcn.1800ef470
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006958
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006953
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f56
call fcn.1800ef470
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov eax, esi
jmp 0x180008efc
lea rcx, [rbp + 0xa0]
call fcn.1800a35f0
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rcx, qword [rbp + 0xa0]
lea rdx, str.explorer.exe
call fcn.180111120
test eax, eax
je 0x180006bde
call fcn.180009740
test al, al
jne 0x180006bde
cmp qword [0x1801c5328], 0
je 0x180006ad9
lea rcx, [0x1801c5328]
call fcn.1800d0470
mov rax, qword [0x1801c5328]
cmp byte [rax + 0x78], 0
je 0x180006ad9
cmp dword [rax + 0x80], 4
jb 0x180006ad9
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2b0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x2b0], xmm1
mov word [rbp + 0x2a0], r13w
mov r8d, 0x17
lea rdx, str.other_desk_close_swtich
lea rcx, [rbp + 0x2a0]
call fcn.180004aa0
mov dword [rsp + 0x28], 0x273
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x2a0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
test bl, bl
je 0x180006a7b
lea rdx, [rbp + 0x2a0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 8
jb 0x180006ac1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006abc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f5c
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x2b0], xmm0
mov word [rbp + 0x2a0], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180006b1f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f62
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006b77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f68
call fcn.1800ef470
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006bc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006bc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f6e
call fcn.1800ef470
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
jmp 0x180008ef7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x360], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x360]
call fcn.180004aa0
nop
lea rcx, [rbp + 0x360]
call fcn.1800a2610
test al, al
sete bl
mov rdx, qword [rbp + 0x378]
cmp rdx, 8
jb 0x180006c72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006c6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f74
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x360], r13w
test bl, bl
je 0x180006fd7
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x140]
call fcn.180004aa0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006d68
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x6a4]
call fcn.18010e5a0
mov dword [rbp + 0x6a0], 0x238
lea rdx, [rbp + 0x6a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180006d5f
nop
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x6cc]
call fcn.180111120
mov rcx, rbx
test eax, eax
je 0x180006fca
lea rdx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180006d20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x180006db0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006dab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f7a
call fcn.1800ef470
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
test bl, bl
je 0x180006fd7
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180006ed3
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x190], xmm1
mov word [rbp + 0x180], r13w
mov r8d, 0xd
lea rdx, str.not_found_rtp
lea rcx, [rbp + 0x180]
call fcn.180004aa0
mov dword [rsp + 0x28], 0x296
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x180]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180006e75
lea rdx, [rbp + 0x180]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x180006ebb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006eb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f80
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180006f19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f86
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006f71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f8c
call fcn.1800ef470
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006bc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006bc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f2c
jmp 0x180006bc3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x180006d6a
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x130], xmm1
mov word [rbp + 0x120], r13w
movdqu xmmword [rbp + 0x170], xmm0
movdqu xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x160], r13w
mov r8d, 0xa
lea rdx, str.2345PCSafe
lea rcx, [rbp + 0x160]
call fcn.180004aa0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x120]
call fcn.180004aa0
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x18000709d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007098
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f92
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r13w
lea rcx, [rbp + 0x120]
call fcn.18003fb50
test al, al
je 0x18000744c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x390], xmm1
mov word [rbp + 0x380], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x380]
call fcn.180004aa0
nop
lea rcx, [rbp + 0x380]
call fcn.1800a2610
test al, al
sete bl
mov rdx, qword [rbp + 0x398]
cmp rdx, 8
jb 0x18000715d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007158
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f98
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x380], r13w
test bl, bl
je 0x18000744c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x310], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x310], xmm1
mov word [rbp + 0x300], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x300]
call fcn.180004aa0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x1800071cf
xor bl, bl
jmp 0x1800071e1
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.180008fc0
movzx ebx, al
mov rdx, qword [rbp + 0x318]
cmp rdx, 8
jb 0x180007227
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007222
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f9e
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x310], xmm0
mov word [rbp + 0x300], r13w
test bl, bl
jne 0x18000744c
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180007348
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x1b0], xmm1
mov word [rbp + 0x1a0], r13w
mov r8d, 0xe
lea rdx, str.not_found_tray
lea rcx, [rbp + 0x1a0]
call fcn.180004aa0
mov dword [rsp + 0x28], 0x2a3
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x1a0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x1800072ea
lea rdx, [rbp + 0x1a0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x180007330
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000732b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008fa4
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], r13w
lea rcx, [rbp + 0x120]
call fcn.180004a10
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x18000739b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007396
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008faa
call fcn.1800ef470
movdqa xmm0, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x1800073f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800073ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008fb0
call fcn.1800ef470
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006bc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006bc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f32
jmp 0x180006bc3
mov r8, qword [rbp + 0x30]
test r8, r8
je 0x180007622
mov rdi, r8
cmp r8, 1
jb 0x1800074da
mov rbx, r13
test r8, r8
je 0x1800074a8
nop word [rax + rax]
cmp r8, rbx
jbe 0x180008f26
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
movzx edx, word [rax + rbx*2]
lea rcx, str.__r_t_n
call fcn.18010db08
mov r8, qword [rbp + 0x30]
test rax, rax
je 0x1800074a8
inc rbx
cmp rbx, rdi
jb 0x180007470
test rbx, rbx
je 0x1800074da
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
sub r8, rbx
mov qword [rbp + 0x30], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.18010e140
lea rdx, str.__r_t_n
lea rcx, [rbp + 0x20]
call fcn.18009f940
lea rcx, [rbp + 0x20]
call fcn.18009fad0
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 5
lea rdx, str.http:
call fcn.180114c00
test eax, eax
je 0x180007622
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 6
lea rdx, str.https:
call fcn.180114c00
test eax, eax
je 0x180007622
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xb
lea rdx, str.about:blank
call fcn.180114c00
test eax, eax
je 0x180007622
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xa
lea rdx, str.about:tabs
call fcn.180114c00
test eax, eax
je 0x180007622
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x1d0], xmm1
mov word [rbp + 0x1c0], r13w
mov r8d, 7
lea rdx, str.http:__
lea rcx, [rbp + 0x1c0]
call fcn.180004aa0
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.18000ce00
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x20]
call fcn.180004aa0
nop
lea rcx, [rbp + 0x1c0]
call fcn.180004a10
mov eax, dword [0x1801c49f8]
test eax, eax
je 0x180007714
mov ebx, dword [0x1801c49f8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
andps xmm1, xmmword [0x180171310]
movsd xmm0, qword [0x180171288]
comisd xmm0, xmm1
jb 0x180007714
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x18000770f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x4b0], xmm1
mov word [rbp + 0x4a0], r13w
mov r8d, 0x1c
lea rdx, str.JumpToProtectMainPage
lea rcx, [rbp + 0x4a0]
call fcn.180004aa0
mov dword [rsp + 0x28], reloc.SHELL32.dll_CDefFolderMenu_Create2
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4a0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180007702
lea rdx, [rbp + 0x4a0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x4a0]
call fcn.180004a10
nop
jmp 0x180008eca
call fcn.18000c310
test al, al
jne 0x180007729
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [0x1801c49f8], eax
mov eax, 1
xchg dword [0x1801c299c], eax
test eax, eax
jne 0x18000773d
call fcn.180026c70
lea rdx, [rbp + 0x40]
call fcn.180027360
test al, al
je 0x180007794
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x600]
call fcn.1800168c0
nop
mov r8, qword [rbp + 0x610]
test r8, r8
je 0x180007788
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 8
cmovae rdx, qword [rbp + 0x600]
lea rcx, [rbp + 0x40]
call fcn.18000ce00
nop
lea rcx, [rbp + 0x600]
call fcn.180004a10
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800077ba
mov rdx, qword [r15]
lea r8, [rbp + 0x60]
call fcn.180017850
mov ecx, dword [0x1801c298c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x18000789f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x4d0], xmm1
mov word [rbp + 0x4c0], r13w
cmp qword [r12 + 0x18], 8
jb 0x18000781c
mov r12, qword [r12]
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r9, qword [rbp + 0x60]
mov qword [rsp + 0x20], r12
mov r8, rdi
lea rdx, str.pAction___p_targetFileName___s_currentPath___s
lea rcx, [rbp + 0x4c0]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x2d5
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4c0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180007891
lea rdx, [rbp + 0x4c0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x4c0]
call fcn.180004a10
jmp 0x1800078a6
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
xor edx, edx
mov ecx, dword [0x1801c298c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp qword [rbp + 0x50], 0
jne 0x18000799b
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, [0x1801642a8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x18000799b
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x18000798c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x4f0], xmm1
mov word [rbp + 0x4e0], r13w
mov r8d, 0x26
lea rdx, str.GetProtectMainPage_fail_and_path_is_ie
lea rcx, [rbp + 0x4e0]
call fcn.180004aa0
mov dword [rsp + 0x28], 0x2db
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4e0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x18000797f
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x4e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
jmp 0x180008eca
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800079a8
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800079ce
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007cdc
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.18000cab0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.180005740
nop
cmp qword [rbp + 0xf0], 0
jne 0x180007b17
cmp qword [rbp + 0x70], 0
jbe 0x180007cd0
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.18000cab0
nop
mov rdx, rax
lea rcx, [rbp + 0x660]
call fcn.180005740
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.18000ca20
nop
lea rcx, [rbp + 0x660]
call fcn.180004a10
cmp qword [rbp + 0xf0], 0
jbe 0x180007cd0
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180007bd0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x510], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x510], xmm1
mov word [rbp + 0x500], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.targetFileName_guid_file_path___ws
lea rcx, [rbp + 0x500]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x2ec
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x500]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180007b0b
lea rdx, [rbp + 0x500]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x500]
jmp 0x180007bcb
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180007bd0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x530], xmm1
mov word [rbp + 0x520], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.linkName_guid_file_path___ws
lea rcx, [rbp + 0x520]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x2f2
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x520]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180007bc4
lea rdx, [rbp + 0x520]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x520]
call fcn.180004a10
cmp qword [rbp + 0xf0], 0
jbe 0x180007cd0
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, [0x1801642a8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180007c59
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str._shdocvw.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180007c59
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str.ieframe.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007cd0
lea rdx, [rbp + 0x680]
call fcn.18001ad40
nop
lea r8, [rbp + 0x40]
mov rdx, rax
call fcn.180019230
movzx ebx, al
lea rcx, [rbp + 0x680]
call fcn.180004a10
test bl, bl
je 0x180007cd0
lea rcx, [rbp + 0xe0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
lea rcx, [rbp + 0x120]
call fcn.180004a10
nop
lea rcx, [rbp + 0xa0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x20]
call fcn.180004a10
nop
lea rcx, [rbp + 0x40]
call fcn.180004a10
xor eax, eax
jmp 0x180008efc
lea rcx, [rbp + 0xe0]
call fcn.180004a10
cmp rdi, 1
jne 0x180007d92
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007d72
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x590], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x590], xmm1
mov word [rbp + 0x580], r13w
xor r8d, r8d
lea rdx, [0x180163950]
lea rcx, [rbp + 0x580]
call fcn.180004aa0
nop
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x60]
call fcn.180019230
movzx ebx, al
lea rcx, [rbp + 0x580]
call fcn.180004a10
test bl, bl
je 0x180007d92
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
jmp 0x180007c9c
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180019230
test al, al
je 0x180007d92
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
jmp 0x180007c9c
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.18000cab0
nop
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007eb3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1af0]
call fcn.18010e5a0
mov r9d, 1
lea r8d, [r9 + 0xf]
lea rdx, [rbp + 0x1af0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180007eb3
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
lea rdx, [rbp + 0x1af0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007eb3
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
je 0x180007eb3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xaf0]
call fcn.18010e5a0
mov r9d, 1
lea r8d, [r9 + 0x18]
lea rdx, [rbp + 0xaf0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rdx, rbx
lea rcx, [rbp + 0xaf0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, [rbp + 0xaf0]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180007e95
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0x100]
call fcn.180004aa0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0x80], r13w
xor r8d, r8d
lea rdx, [0x180163950]
lea rcx, [rbp + 0x80]
call fcn.180004aa0
nop
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r13w
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x5b0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x5b0], xmm1
mov word [rbp + 0x5a0], r13w
mov r8, r14
inc r8
cmp word [rdx + r8*2], 0
jne 0x180007f52
lea rcx, [rbp + 0x5a0]
call fcn.180004aa0
nop
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5a0]
call fcn.18001c7b0
mov ebx, eax
lea rcx, [rbp + 0x5a0]
call fcn.180004a10
test ebx, ebx
jne 0x180008df6
cmp qword [rbp + 0xd0], 0
jne 0x1800080d6
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, [0x1801642a8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800080d6
lea edx, [rbx + 4]
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x18000808c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x550], xmm1
mov word [rbp + 0x540], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180164410]
lea rcx, [rbp + 0x540]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x334
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x540]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180008080
lea rdx, [rbp + 0x540]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x540]
call fcn.180004a10
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x80]
call fcn.180019230
test al, al
je 0x1800080d6
lea rcx, [rbp + 0xc0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x80]
call fcn.180004a10
nop
lea rcx, [rbp + 0x100]
call fcn.180004a10
nop
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
jmp 0x180007c9c
cmp byte [rsp + 0x30], 0
je 0x1800088b6
lea rcx, [rsp + 0x48]
call fcn.18000e0e0
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.180004aa0
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqa xmmword [rbp + 0x2f0], xmm1
mov word [rbp + 0x2e0], r13w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x40]
call fcn.18000cab0
nop
lea r8, [rbp + 0x2c0]
mov rdx, rax
call fcn.180010f60
test al, al
je 0x180008841
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180008241
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x570], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x570], xmm1
mov word [rbp + 0x560], r13w
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180164430]
lea rcx, [rbp + 0x560]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x343
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x560]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180008235
lea rdx, [rbp + 0x560]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x560]
call fcn.180004a10
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x80]
call fcn.180011880
test al, al
je 0x180008841
lea rdx, [rbp + 0x40]
call fcn.180027360
test al, al
je 0x1800082ba
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5c0]
call fcn.180016480
nop
mov r8, qword [rbp + 0x5d0]
test r8, r8
je 0x1800082ae
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 8
cmovae rdx, qword [rbp + 0x5c0]
lea rcx, [rbp + 0x40]
call fcn.18000ce00
nop
lea rcx, [rbp + 0x5c0]
call fcn.180004a10
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1e0]
call fcn.18000cab0
nop
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180008395
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x3b0], xmm1
mov word [rbp + 0x3a0], r13w
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r8, qword [rbp + 0xc0]
mov eax, dword [rbp + 0x2c4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x2c0]
lea rdx, [0x180164480]
lea rcx, [rbp + 0x3a0]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x352
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3a0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180008389
lea rdx, [rbp + 0x3a0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x3a0]
call fcn.180004a10
cmp dword [rbp + 0x2c4], 1
jne 0x1800084c2
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2c8]
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x320]
call fcn.180010420
nop
mov r8, qword [rbp + 0x330]
test r8, r8
je 0x1800084b6
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rdx, qword [rbp + 0x320]
lea rcx, [rbp + 0x1e0]
call fcn.180004aa0
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x1800084b6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x3d0], xmm1
mov word [rbp + 0x3c0], r13w
lea r8, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae r8, qword [rbp + 0x320]
lea rdx, [0x180164500]
lea rcx, [rbp + 0x3c0]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x35b
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3c0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x1800084a9
lea rdx, [rbp + 0x3c0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x3c0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x320]
call fcn.180004a10
cmp dword [rbp + 0x2c0], 1
jne 0x1800085f4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x60]
call fcn.18000cab0
nop
mov r8, rax
lea rdx, [rbp + 0x340]
call fcn.18000fde0
nop
mov r8, qword [rbp + 0x350]
test r8, r8
je 0x1800085e8
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rdx, qword [rbp + 0x340]
lea rcx, [rbp + 0x1e0]
call fcn.180004aa0
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x1800085e8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x3f0], xmm1
mov word [rbp + 0x3e0], r13w
lea r8, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae r8, qword [rbp + 0x340]
lea rdx, [0x180164540]
lea rcx, [rbp + 0x3e0]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x366
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3e0]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x1800085db
lea rdx, [rbp + 0x3e0]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x3e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x340]
call fcn.180004a10
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x5e0]
call fcn.180011d20
nop
lea r8, [rbp + 0x1e0]
cmp qword [rbp + 0x5f0], 0
je 0x18000872a
lea rdx, [rbp + 0x5e0]
call fcn.180019230
test al, al
je 0x180008827
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x20]
call fcn.18000cab0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000ed90
nop
lea rcx, [rbp + 0x5e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cbe0
nop
mov rcx, qword [0x1801c4a88]
test rcx, rcx
je 0x1800086a6
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c4a88]
sub dword [0x1801c2998], 1
jne 0x1800086c3
call fcn.1800206c0
mov rcx, rax
call fcn.180020a50
mov rcx, qword [0x1801c4a88]
test rcx, rcx
je 0x1800086cf
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012ee0
nop
mov edx, 0x60
mov rcx, qword [rsp + 0x48]
call fcn.180004cd0
nop
lea rcx, [rbp + 0xc0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x80]
call fcn.180004a10
nop
lea rcx, [rbp + 0x100]
call fcn.180004a10
nop
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
jmp 0x180007c9c
lea rdx, [rbp + 0x80]
call fcn.180019230
test al, al
je 0x180008827
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp]
call fcn.18000cab0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000ed90
nop
lea rcx, [rbp + 0x5e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cbe0
nop
mov rcx, qword [0x1801c4a88]
test rcx, rcx
je 0x1800087b3
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c4a88]
sub dword [0x1801c2998], 1
jne 0x1800087d0
call fcn.1800206c0
mov rcx, rax
call fcn.180020a50
mov rcx, qword [0x1801c4a88]
test rcx, rcx
je 0x1800087dc
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012890
nop
lea rcx, [rbp + 0xc0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x80]
call fcn.180004a10
nop
lea rcx, [rbp + 0x100]
call fcn.180004a10
nop
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
jmp 0x180007c9c
lea rcx, [rbp + 0x5e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cbe0
nop
mov rcx, qword [0x1801c4a88]
test rcx, rcx
je 0x180008874
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c4a88]
sub dword [0x1801c2998], 1
jne 0x180008891
call fcn.1800206c0
mov rcx, rax
call fcn.180020a50
mov rcx, qword [0x1801c4a88]
test rcx, rcx
je 0x18000889d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012890
jmp 0x18000895e
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x18000895e
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x410], xmm1
mov word [rbp + 0x400], r13w
mov r8d, 0x1b
lea rdx, str.Other_Browser_Home
lea rcx, [rbp + 0x400]
call fcn.180004aa0
mov dword [rsp + 0x28], 0x381
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x400]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180008952
lea rdx, [rbp + 0x400]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x400]
call fcn.180004a10
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x650], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x650], xmm1
mov word [rbp + 0x640], r13w
movdqu xmmword [rbp + 0x630], xmm0
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r13w
lea rcx, [rsp + 0x40]
call fcn.18001b8d0
nop
lea rcx, [rsp + 0x40]
call fcn.18001baf0
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.18001bd20
test al, al
je 0x180008cff
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x640]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.18001bc70
test al, al
je 0x180008cff
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180008aac
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x430], xmm1
mov word [rbp + 0x420], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x1801645c0]
lea rcx, [rbp + 0x420]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x38c
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x420]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180008aa0
lea rdx, [rbp + 0x420]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x420]
call fcn.180004a10
cmp qword [rbp + 0x70], 0
jne 0x180008b5e
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180008af8
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
jmp 0x180008b55
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x8e0]
call fcn.18010e5a0
mov r8d, 0x104
lea rdx, [rbp + 0x8e0]
lea rcx, str._ProgramFiles_Internet_Exploreriexplore.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180008b5e
lea rax, [rbp + 0x8e0]
nop
inc r14
cmp word [rax + r14*2], 0
jne 0x180008b40
mov r8, r14
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0x60]
call fcn.180004aa0
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180008bd1
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x40]
call fcn.180004aa0
mov r8d, 1
lea rdx, [0x18016463c]
lea rcx, [rbp + 0x40]
call fcn.18000ce00
mov r8d, 0xb
lea rdx, [0x180164640]
lea rcx, [rbp + 0x40]
call fcn.18000ce00
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180008c8f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x450], xmm1
mov word [rbp + 0x440], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r8, qword [rbp + 0x60]
lea rdx, [0x180164658]
lea rcx, [rbp + 0x440]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x3a6
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x440]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180008c83
lea rdx, [rbp + 0x440]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x440]
call fcn.180004a10
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180019230
test al, al
je 0x180008dc4
lea rcx, [rsp + 0x40]
call fcn.18001b930
nop
lea rcx, [rbp + 0x620]
call fcn.180004a10
nop
lea rcx, [rbp + 0x640]
call fcn.180004a10
nop
lea rcx, [rbp + 0xc0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x80]
call fcn.180004a10
nop
lea rcx, [rbp + 0x100]
call fcn.180004a10
nop
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
jmp 0x180007c9c
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov edi, eax
test eax, eax
je 0x180008dc4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x470], xmm1
mov word [rbp + 0x460], r13w
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
mov r8d, eax
lea rdx, str.RCBlackShortCut_Analyze_Fail___x_lnk___s
lea rcx, [rbp + 0x460]
call fcn.1800d15f0
mov dword [rsp + 0x28], 0x3ae
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x460]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp edi, 1
jbe 0x180008db8
lea rdx, [rbp + 0x460]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x460]
call fcn.180004a10
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180008dd2
mov byte [rax + 8], 0
lea rcx, [rsp + 0x40]
call fcn.18001b930
nop
lea rcx, [rbp + 0x620]
call fcn.180004a10
nop
lea rcx, [rbp + 0x640]
jmp 0x180008e93
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d10d0
mov ebx, eax
test eax, eax
je 0x180008e99
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x1801712b0]
movdqu xmmword [rbp + 0x490], xmm1
mov word [rbp + 0x480], r13w
lea rdx, str.GetShortCutTargetCmdEx_Fail
lea rcx, [rbp + 0x480]
call fcn.180004a80
mov dword [rsp + 0x28], 0x3b4
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x480]
mov edx, 4
lea rcx, [0x1801c5328]
call fcn.1800d1120
cmp ebx, 1
jbe 0x180008e8c
lea rdx, [rbp + 0x480]
lea rcx, [0x1801c5328]
call fcn.1800d14b0
nop
lea rcx, [rbp + 0x480]
call fcn.180004a10
nop
lea rcx, [rbp + 0xc0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x80]
call fcn.180004a10
nop
lea rcx, [rbp + 0x100]
call fcn.180004a10
nop
lea rcx, [rbp + 0x60]
call fcn.180004a10
nop
lea rcx, [rbp + 0x120]
call fcn.180004a10
nop
lea rcx, [rbp + 0xa0]
call fcn.180004a10
nop
lea rcx, [rbp + 0x20]
call fcn.180004a10
nop
lea rcx, [rbp + 0x40]
call fcn.180004a10
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x22f0]
xor rcx, rsp
call fcn.1800ef410
mov rbx, qword [rsp + 0x2440]
add rsp, 0x2400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800130d0
nop
call fcn.180110f34
int3
call fcn.180110f34
int3
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
int3
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
int3
call fcn.180110f34
int3
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
int3
call fcn.180110f34
int3
call fcn.180110f34
int3
call fcn.180110f34
nop
call fcn.180110f34
nop
call fcn.180110f34
int3