Function at 0x140047a54
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Enumerate processes
Get disk size
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7b8]
sub rsp, 0x890
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14019be90]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov r15, rcx
xor ebx, ebx
mov word [rbp + 0x570], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x572]
call fcn.1400c0510
mov qword [r15 + 0x1d8], rbx
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
lea r14d, [rbx + 1]
lea r12d, [rbx + 0xf]
cmp ecx, r12d
jne 0x140047b11
mov r9d, ebx
test r8d, r8d
je 0x140047b0a
mov ecx, r8d
and ecx, r14d
add r9d, ecx
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
jne 0x140047af4
mov dword [0x1401a3d80], r9d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [rsp + 0x40], eax
mov r13d, ebx
mov r8d, dword [0x1401a3d80]
imul r8d, r8d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
mov eax, 7
cmp r8d, eax
jne 0x140047b64
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
or rsi, 0xffffffffffffffff
cmp byte [r15 + 0x121], bl
je 0x140047b8e
mov ebx, dword [r15 + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jb 0x140047b8c
test ebx, ebx
jne 0x1400489b4
xor ebx, ebx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, rsi
je 0x140048cba
mov esi, 0x238
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.1400c0510
mov edx, dword [0x1401a3d80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0xf
jne 0x140047c00
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [rbp + 0x40], esi
mov esi, ebx
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140048c7e
mov r8d, dword [0x1401a3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xf
jne 0x140047c65
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r8d, dword [0x1401a3d80]
mov eax, 0x63
mov word [rbp + 0x540], ax
mov dword [rbp + 0x544], 0x6f0072
mov eax, 0x6d
mov word [rbp + 0x548], ax
mov eax, 0x2e
mov word [rbp + 0x54c], ax
mov word [rbp + 0x554], bx
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xe
jne 0x140047cec
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401a3d80]
test rax, rax
mov eax, 7
cmove ecx, eax
mov dword [0x1401a3d80], ecx
jmp 0x140047cf1
mov eax, 7
mov qword [rbp + 0x290], rbx
mov qword [rbp + 0x298], rbx
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x290], rbx
mov word [rbp + 0x280], bx
cmp word [rbp + 0x6c], bx
jne 0x140047d1f
mov r8, rbx
jmp 0x140047d31
lea rcx, [rbp + 0x6c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], bx
jne 0x140047d27
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 0x280]
call fcn.14004c178
nop
mov eax, 0x65
mov word [rbp + 0x552], ax
mov word [rbp + 0x54e], ax
mov word [rbp + 0x54a], ax
mov r8d, dword [0x1401a3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 5
jne 0x140047d98
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov r8d, dword [0x1401a3d80]
mov eax, 0x68
mov word [rbp + 0x542], ax
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xf
jne 0x140047ddf
test r8d, r8d
cmove r8d, r14d
mov dword [0x1401a3d80], r8d
mov eax, 0x78
mov word [rbp + 0x550], ax
lea rcx, [rbp + 0x540]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rcx + rdx*2], bx
jne 0x140047df6
lea rcx, [rbp + 0x280]
cmp qword [rbp + 0x298], 8
cmovae rcx, qword [rbp + 0x280]
mov r9, rdx
mov r11, qword [rbp + 0x290]
cmp r11, rdx
cmovb r9, r11
test r9, r9
je 0x140047e55
lea r10, [rbp + 0x540]
movzx eax, word [r10]
cmp word [rcx], ax
jne 0x140047e4b
add rcx, 2
add r10, 2
sub r9, r14
jne 0x140047e33
jmp 0x140047e55
sbb eax, eax
and eax, 0xfffffffe
add eax, r14d
jmp 0x140047e57
mov eax, ebx
movsxd rcx, eax
mov eax, ebx
cmp r11, rdx
setne al
cmp r11, rdx
mov rdx, 0xffffffffffffffff
cmovb eax, edx
test rcx, rcx
cmovne eax, ecx
test eax, eax
je 0x140047ef5
mov ecx, r8d
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xe
jne 0x140047eab
test r8d, r8d
cmove r8d, r14d
mov dword [0x1401a3d80], r8d
cmp qword [rbp + 0x298], 8
jb 0x140047ec1
mov rcx, qword [rbp + 0x280]
call fcn.1400bb0b4
mov eax, 7
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x290], rbx
mov word [rbp + 0x280], bx
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400481d6
jmp 0x140047c1a
cmp dword [r15 + 0x2d8], r14d
jne 0x140047f09
mov dword [r15 + 0x2d8], 2
mov esi, dword [rbp + 0x60]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r10, rax
mov qword [r15 + 0x1d8], rax
mov r9d, dword [0x1401a3d80]
mov r8d, r9d
imul r8d, r9d
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 3
jne 0x140047f77
mov r8d, ebx
test r9d, r9d
je 0x140047f70
mov ecx, r9d
and ecx, r14d
add r8d, ecx
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
jne 0x140047f5a
mov dword [0x1401a3d80], r8d
test r10, r10
je 0x140048159
test esi, esi
je 0x140048159
mov r8d, 0x104
lea rdx, [rbp + 0x570]
mov rcx, r10
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x140048a31
cmp word [rbp + 0x570], bx
jne 0x140047fb4
mov r8, rbx
jmp 0x140047fc9
lea rcx, [rbp + 0x570]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], bx
jne 0x140047fbf
lea rdx, [rbp + 0x570]
lea rcx, [rbp + 0x280]
call fcn.14004c178
mov r8, qword [rbp + 0x290]
add r8, 0xfffffffffffffff6
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x280]
call fcn.14004baf8
mov rcx, rax
lea rax, [rbp + 0x540]
or r11, 0xffffffffffffffff
mov r8, r11
inc r8
cmp word [rax + r8*2], bx
jne 0x14004800f
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x140048027
mov rcx, qword [rcx]
mov rdx, r8
cmp r10, r8
cmovb rdx, r10
test rdx, rdx
je 0x14004805f
lea r9, [rbp + 0x540]
movzx eax, word [r9]
cmp word [rcx], ax
jne 0x140048055
add rcx, 2
add r9, 2
sub rdx, r14
jne 0x14004803d
jmp 0x14004805f
sbb eax, eax
and eax, 0xfffffffe
add eax, r14d
jmp 0x140048061
mov eax, ebx
movsxd rcx, eax
mov eax, ebx
cmp r10, r8
setne al
cmp r10, r8
cmovb eax, r11d
test rcx, rcx
cmovne eax, ecx
test eax, eax
setne bl
cmp qword [rbp + 0x318], 8
jb 0x140048094
mov rcx, qword [rbp + 0x300]
call fcn.1400bb0b4
mov eax, 7
mov qword [rbp + 0x318], rax
xor ecx, ecx
mov qword [rbp + 0x310], rcx
mov word [rbp + 0x300], cx
test bl, bl
je 0x14004813f
mov rcx, qword [r15 + 0x1d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1401a3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0x12
jne 0x1400480fa
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401a3d80], eax
mov esi, dword [rbp + 0x48]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r15 + 0x1d8], rax
xor ebx, ebx
test rax, rax
je 0x1400489f8
mov r8d, 0x104
lea rdx, [rbp + 0x570]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1400489bc
jmp 0x140048141
xor ebx, ebx
cmp qword [rbp + 0x298], 8
jb 0x1400481bc
mov rcx, qword [rbp + 0x280]
call fcn.1400bb0b4
jmp 0x1400481bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, dword [rbp + 0x48]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r15 + 0x1d8], rax
test rax, rax
je 0x140048c0a
mov r8d, 0x104
lea rdx, [rbp + 0x570]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x140048bce
cmp qword [rbp + 0x298], 8
jb 0x1400481b8
mov rcx, qword [rbp + 0x280]
call fcn.1400bb0b4
mov edi, dword [rsp + 0x40]
mov eax, 7
mov word [rbp + 0x280], bx
mov qword [rbp + 0x290], rbx
mov qword [rbp + 0x298], rax
mov rax, qword [r15 + 0x1d8]
add rax, r14
test rax, 0xfffffffffffffffe
jne 0x1400481f5
mov ecx, dword [r15 + 0x1e4]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r15 + 0x1d8]
sub rax, r14
cmp rax, 0xfffffffffffffffd
ja 0x140047b64
lea rcx, [0x14019b9a8]
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
xor edi, edi
mov r12d, edi
lea rcx, [0x14019b9a8]
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.14003a338
test al, al
jne 0x1400482f7
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov r12d, 0x104
sub eax, r12d
or eax, ecx
jge 0x140048288
mov edx, r12d
lea rcx, [rsp + 0x30]
call fcn.14000239c
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0xc], r12d
jl 0x140048a6d
mov dword [rbx - 0x10], r12d
mov word [rbx + 0x208], di
mov r9d, r12d
mov r8, rbx
xor edx, edx
mov rcx, qword [r15 + 0x1d8]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x78]
call fcn.140002cf8
nop
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14003e7e8
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400021c4
nop
mov rdx, qword [rbp - 0x60]
jmp 0x14004843b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x570]
lea rcx, [rsp + 0x60]
call fcn.1400020f8
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14003e7e8
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400021c4
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x140048352
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.140042640
xor r11d, r11d
mov ecx, r11d
test rax, rax
setne cl
test ecx, ecx
je 0x140048bc3
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x140048395
add rcx, 2
test dx, dx
jne 0x14004837e
mov eax, r11d
jmp 0x14004839a
sbb eax, eax
or eax, r14d
test eax, eax
jne 0x140048469
mov r8, qword [rsp + 0x30]
mov ecx, r14d
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
mov ebx, 0x104
sub eax, ebx
or eax, ecx
jge 0x1400483d1
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14000239c
mov r8, qword [rsp + 0x30]
xor r11d, r11d
cmp dword [r8 - 0xc], ebx
jl 0x140048a78
mov dword [r8 - 0x10], ebx
mov word [r8 + 0x208], r11w
mov r9d, ebx
xor edx, edx
mov rcx, qword [r15 + 0x1d8]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x68]
call fcn.140002cf8
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14003e7e8
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400021c4
nop
mov rdx, qword [rsp + 0x68]
or rcx, 0xffffffffffffffff
add rdx, 0xffffffffffffffe8
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x140048459
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r11d, r11d
mov rbx, qword [rsp + 0x38]
mov edi, eax
cmp dword [rbx - 0x10], r11d
je 0x1400484af
call fcn.140042640
mov ecx, r11d
test rax, rax
setne cl
test ecx, ecx
je 0x140048a83
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x1400484a2
add rcx, 2
test dx, dx
jne 0x14004848b
mov eax, r11d
jmp 0x1400484a7
sbb eax, eax
or eax, r14d
test eax, eax
jne 0x140048a8e
mov r10d, r11d
cmp edi, 0x714
jne 0x140048507
lea rcx, [rsp + 0x70]
call fcn.14003f0f8
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400021c4
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x1400484f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10d, eax
mov rbx, qword [rsp + 0x38]
xor r11d, r11d
cmp dword [rbx - 0x10], r11d
je 0x14004854d
call fcn.140042640
mov ecx, r11d
test rax, rax
setne cl
test ecx, ecx
je 0x140048b7d
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x140048540
add rcx, 2
test dx, dx
jne 0x140048529
mov eax, r11d
jmp 0x140048545
sbb eax, eax
or eax, r14d
test eax, eax
jne 0x140048a8e
mov qword [r15 + 0x1d8], r11
mov edx, r10d
lea rcx, [rbp + 0x3e0]
call fcn.140040e34
mov rsi, rax
mov edx, edi
lea rcx, [rbp + 0x3a0]
call fcn.140040e34
mov rdi, rax
mov edx, r12d
lea rcx, [rbp + 0x360]
call fcn.140040e34
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x320]
call fcn.140040e34
nop
lea r12, [0x140135b50]
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x2e0]
call fcn.14002a598
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.14004c680
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x3c0]
call fcn.14002a598
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x340]
call fcn.14004c680
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x380]
call fcn.14002a598
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.14004c680
nop
mov edi, 0x10
cmp qword [rbp + 0x398], rdi
jb 0x140048631
mov rcx, qword [rbp + 0x380]
call fcn.1400bb0b4
mov r12d, 0xf
mov qword [rbp + 0x398], r12
xor ebx, ebx
mov qword [rbp + 0x390], rbx
mov byte [rbp + 0x380], bl
cmp qword [rbp + 0x358], rdi
jb 0x140048662
mov rcx, qword [rbp + 0x340]
call fcn.1400bb0b4
mov qword [rbp + 0x358], r12
mov qword [rbp + 0x350], rbx
mov byte [rbp + 0x340], bl
cmp qword [rbp + 0x3d8], rdi
jb 0x14004868b
mov rcx, qword [rbp + 0x3c0]
call fcn.1400bb0b4
mov qword [rbp + 0x3d8], r12
mov qword [rbp + 0x3d0], rbx
mov byte [rbp + 0x3c0], bl
cmp qword [rbp + 0x2d8], rdi
jb 0x1400486b4
mov rcx, qword [rbp + 0x2c0]
call fcn.1400bb0b4
mov qword [rbp + 0x2d8], r12
mov qword [rbp + 0x2d0], rbx
mov byte [rbp + 0x2c0], bl
cmp qword [rbp + 0x2f8], rdi
jb 0x1400486dd
mov rcx, qword [rbp + 0x2e0]
call fcn.1400bb0b4
mov qword [rbp + 0x2f8], r12
mov qword [rbp + 0x2f0], rbx
mov byte [rbp + 0x2e0], bl
cmp qword [rbp + 0x338], rdi
jb 0x140048706
mov rcx, qword [rbp + 0x320]
call fcn.1400bb0b4
mov qword [rbp + 0x338], r12
mov qword [rbp + 0x330], rbx
mov byte [rbp + 0x320], bl
cmp qword [rbp + 0x378], rdi
jb 0x14004872f
mov rcx, qword [rbp + 0x360]
call fcn.1400bb0b4
mov qword [rbp + 0x378], r12
mov qword [rbp + 0x370], rbx
mov byte [rbp + 0x360], bl
cmp qword [rbp + 0x3b8], rdi
jb 0x140048758
mov rcx, qword [rbp + 0x3a0]
call fcn.1400bb0b4
mov qword [rbp + 0x3b8], r12
mov qword [rbp + 0x3b0], rbx
mov byte [rbp + 0x3a0], bl
cmp qword [rbp + 0x3f8], rdi
jb 0x140048781
mov rcx, qword [rbp + 0x3e0]
call fcn.1400bb0b4
mov qword [rbp + 0x3f8], r12
mov qword [rbp + 0x3f0], rbx
mov byte [rbp + 0x3e0], bl
mov eax, r13d
add r13d, r14d
cmp eax, 5
jge 0x140048b88
mov ecx, dword [0x1401a3d80]
imul ecx, ecx
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
mov esi, 6
cmp ecx, esi
jne 0x1400487ee
lea ecx, [rsi - 2]
call fcn.1400bb888
mov rbx, rax
call fcn.1400bba88
mov dword [rbx], eax
mov dword [0x1401a3d80], eax
mov rcx, rbx
call fcn.1400bb0b4
xor ebx, ebx
lea rdx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], rdi
cmovae rdx, qword [rbp + 0x2a0]
lea rcx, [rsp + 0x50]
call fcn.140002d94
nop
cmp byte [0x1401a58b8], bl
jne 0x140048892
mov dword [rbp + 0x558], 0xa0058
mov dword [rbp + 0x55c], 0x1c0006
mov word [rbp + 0x560], bx
mov rcx, rbx
lea rdx, [0x14019f988]
lea rax, [0x14019ed90]
movzx eax, byte [rcx + rax]
xor ax, word [rbp + rcx*2 + 0x558]
mov word [rdx + rcx*2], ax
add rcx, r14
cmp rcx, 4
jl 0x14004883c
mov byte [0x1401a58b8], r14b
mov eax, dword [0x1401a3d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x11
jne 0x140048892
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
lea rdx, [0x14019f988]
lea rcx, [rbp - 0x70]
call fcn.1400020f8
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14000dac8
nop
lea rcx, [r15 + 0x1c0]
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
call fcn.14000e4ec
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x1400488ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004890b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004892a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [r15 + 0x1e4]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp + 0x2b8], rdi
jb 0x140048954
mov rcx, qword [rbp + 0x2a0]
call fcn.1400bb0b4
mov qword [rbp + 0x2b8], r12
mov qword [rbp + 0x2b0], rbx
mov byte [rbp + 0x2a0], bl
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140048988
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
mov edi, dword [rsp + 0x40]
jg 0x140047b68
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140047b68
mov eax, r14d
jmp 0x140048cf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x400]
call fcn.140040e34
mov r9, rax
call fcn.140044bf4
mov rdx, rax
mov r8, r9
lea rcx, [rbp - 0x28]
call fcn.14004549c
lea rdx, [0x1401664c8]
lea rcx, [rbp - 0x28]
call fcn.1400c2fa8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x460]
call fcn.140040e34
mov r8, rax
call fcn.14004533c
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.14004549c
lea rdx, [0x1401664c8]
lea rcx, [rbp + 0x30]
call fcn.1400c2fa8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x500]
call fcn.140040e34
mov rbx, rax
call fcn.140045198
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 8]
call fcn.14004549c
lea rdx, [0x1401664c8]
lea rcx, [rbp - 8]
call fcn.1400c2fa8
nop
mov ecx, 0x80070057
call fcn.14000187c
int3
mov ecx, 0x80070057
call fcn.14000187c
int3
mov ecx, 0x80004005
call fcn.14000187c
int3
lea rdx, str.0.0.0.0
mov rcx, rbx
call fcn.1400cf0b4
xor edi, edi
test eax, eax
jne 0x140048b20
mov qword [r15 + 0x1d8], rdi
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.1400187b8
nop
mov dl, 0x5c
lea rcx, [rsp + 0x48]
call fcn.14004b928
mov dl, 0x20
lea rcx, [rsp + 0x48]
call fcn.14004b928
mov dl, 0x2f
lea rcx, [rsp + 0x48]
call fcn.14004b928
mov rax, qword [rsp + 0x48]
sub r14d, dword [rax - 8]
or r14d, dword [rax - 0xc]
jge 0x140048af9
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140019474
call fcn.140044a48
mov rdx, rax
mov r8, qword [rsp + 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400453e4
lea rdx, [0x1401664c8]
lea rcx, [rbp + 0x18]
call fcn.1400c2fa8
nop
lea rcx, [r15 + 0x190]
lea rdx, [rsp + 0x38]
call fcn.1400021c4
mov dword [r15 + 0x1d0], esi
lea rdx, [rbx - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140048b57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140048b76
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140048cf6
mov ecx, 0x80004005
call fcn.14000187c
nop
lea rbx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], rdi
cmovae rbx, qword [rbp + 0x2a0]
call fcn.14004457c
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x48]
call fcn.1400453e4
lea rdx, [0x1401664c8]
lea rcx, [rbp - 0x48]
call fcn.1400c2fa8
nop
mov ecx, 0x80004005
call fcn.14000187c
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4a0]
call fcn.140040e34
mov rbx, rax
call fcn.140043920
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.14004549c
lea rdx, [0x1401664c8]
lea rcx, [rbp - 0x38]
call fcn.1400c2fa8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4e0]
call fcn.140040e34
mov rbx, rax
mov edx, edi
lea rcx, [rbp + 0x420]
call fcn.140040e34
nop
lea r8, [0x140133d10]
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.14002a598
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x480]
call fcn.14004c680
mov r8, rax
call fcn.1400446b8
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14004549c
lea rdx, [0x1401664c8]
lea rcx, [rbp - 0x18]
call fcn.1400c2fa8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4c0]
call fcn.140040e34
mov r11, rax
call fcn.14004442c
mov rdx, rax
mov r8, r11
lea rcx, [rbp + 8]
call fcn.14004549c
lea rdx, [0x1401664c8]
lea rcx, [rbp + 8]
call fcn.1400c2fa8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x520]
call fcn.140040e34
mov r10, rax
call fcn.14004475c
mov rdx, rax
mov r8, r10
lea rcx, [rbp - 0x58]
call fcn.14004549c
lea rdx, [0x1401664c8]
lea rcx, [rbp - 0x58]
call fcn.1400c2fa8
nop
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1400bb0d0
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret