Function at 0x140076d50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x418]
sub rsp, 0x518
movaps xmmword [rsp + 0x500], xmm6
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov r13, r9
mov qword [rsp + 0x50], r9
mov rsi, r8
mov r15d, edx
mov rbx, rcx
mov rax, qword [rbp + 0x480]
mov qword [rbp + 0x150], rax
xor edi, edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x40], 0x203e2d20
mov byte [rsp + 0x44], dil
movdqa xmm0, xmmword [0x1400d1d80]
movdqu xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0xa0], 0x6b636568
mov word [rbp + 0xa4], 0x73
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x80], dil
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x38]
call fcn.14005eaa0
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140060d60
lea r8, [rsp + 0x49]
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.140061a00
mov dword [rsp + 0x40], 0x202d3c20
mov byte [rsp + 0x44], dil
movdqa xmm0, xmmword [0x1400d1d80]
movdqu xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0xa0], 0x6b636568
mov word [rbp + 0xa4], 0x73
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x80], dil
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.14005eaa0
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140060d60
lea r8, [rsp + 0x49]
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140061a00
mov r14, qword [0x1400fbc38]
mov qword [rbp - 0x38], rdi
lea rax, [rbp + 0x180]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], rdi
mov rax, qword [r14]
cmp dword [rax], edi
je 0x140076f0a
mov qword [rbp + 0x70], rdi
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x70]
mov qword [rbp - 0x38], rax
lea r8, [0x1400e01eb]
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, r14
call fcn.14007cc00
nop
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp word [rbx + r8*2], 0
jne 0x140076f14
mov rdx, rbx
mov rcx, rsi
call fcn.1400043e0
mov rax, qword [rbp + 0x150]
mov qword [rax], r12
mov qword [rbp + 0x160], rdi
movdqa xmm0, xmmword [0x1400e3130]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], di
lea r8, [rbp + 0x160]
mov edx, r15d
mov rcx, rbx
call fcn.140073650
test eax, eax
je 0x140077af1
mov r15, qword [rbp + 0x170]
lea r13, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae r13, qword [rbp + 0x160]
cmp r15, 8
jae 0x140076fb5
movups xmm6, xmmword [r13]
movups xmmword [rbp + 0xf0], xmm6
mov qword [rbp + 0x108], 7
mov ebx, 7
mov r14, qword [rbp + 0xf0]
jmp 0x140077008
mov rbx, r15
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0xf0]
call fcn.1400045d0
mov r14, rax
mov qword [rbp + 0xf0], rax
lea r8, [r15*2 + 2]
mov rdx, r13
mov rcx, rax
call fcn.14009bb80
mov qword [rbp + 0x108], rbx
movups xmm6, xmmword [rbp + 0xf0]
mov qword [rbp + 0x100], r15
mov r13d, 4
lea rax, [rbp + 0xf0]
cmp rsi, rax
je 0x140077039
mov rcx, rsi
call fcn.140003e50
movups xmmword [rsi], xmm6
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rsi + 0x10], xmm0
jmp 0x140077074
cmp rbx, 8
jb 0x140077074
lea rdx, [rbx*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14007706c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140077c9f
mov rcx, r14
call fcn.14005c5c0
cmp byte [0x1400fbd13], 0
je 0x1400770df
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14007708a
mov rdx, qword [rsi]
mov r8, r12
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140077090
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x108], 7
lea rcx, [rbp + 0xf0]
call fcn.1400043e0
mov r13d, 0x34
lea rcx, [rbp + 0xf0]
call fcn.1400814a0
test al, al
je 0x1400770df
lea eax, [r13 - 0x2a]
jmp 0x140077c54
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400770ec
mov rdx, qword [rsi]
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x108], 7
mov r8, qword [rsi + 0x10]
lea rcx, [rbp + 0xf0]
call fcn.1400043e0
or r13d, 0xc0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xf0]
call fcn.140081fd0
movzx ebx, al
mov byte [rsp + 0x49], al
lea rcx, [rbp + 0xf0]
call fcn.140003e50
mov r15d, dword [rsp + 0x40]
mov dword [rsp + 0x40], r15d
cmp byte [0x1400fbd1a], 0
jne 0x14007716e
test bl, bl
je 0x14007716e
test r15d, r15d
je 0x140077c56
cmp byte [0x1400fbd1b], 0
jne 0x14007717b
jmp 0x140077c56
cmp byte [0x1400fbd1b], 0
je 0x140077428
mov byte [rsp + 0x48], 0
lea r14, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae r14, qword [rbp + 0x160]
mov rax, qword [rbp + 0x170]
lea rbx, [r14 + rax*2]
mov rdx, rbx
mov rcx, r14
call fcn.1400099e0
cmp rax, rbx
je 0x14007720d
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400771c1
cmp cx, 0x2f
jne 0x1400771d0
add rax, 2
jmp 0x1400771ad
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x1400771ed
cmp cx, 0x2f
je 0x1400771ed
mov rbx, rdx
cmp rax, rdx
je 0x14007720d
jmp 0x1400771d0
cmp rax, rbx
je 0x14007720d
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x140077205
cmp cx, 0x2f
jne 0x14007720d
mov rbx, rdx
cmp rax, rdx
jne 0x1400771f2
sub rbx, r14
sar rbx, 1
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], di
mov r8, rbx
mov rdx, r14
lea rcx, [rbp + 0x90]
call fcn.1400043e0
or r13d, 0x700
nop dword [rax]
test r15d, r15d
jne 0x140077260
cmp byte [rsp + 0x49], r15b
jne 0x140077404
lea rcx, [rbp + 0x90]
mov r14, qword [rbp + 0x90]
mov r15, qword [rbp + 0xa8]
cmp r15, 8
cmovae rcx, r14
mov rax, qword [rbp + 0xa0]
lea rbx, [rcx + rax*2]
mov rdx, rbx
call fcn.1400099e0
cmp rax, rbx
je 0x1400772ad
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400772a4
cmp cx, 0x2f
jne 0x1400772ad
add rax, 2
cmp rax, rbx
jne 0x140077295
sub rbx, rax
cmp rbx, 2
jb 0x140077404
cmp byte [rsp + 0x48], 0
jne 0x14007741c
lea rcx, [rbp + 0x90]
cmp r15, 8
cmovae rcx, r14
call fcn.140088250
test al, al
setne byte [rsp + 0x48]
lea r14, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae r14, qword [rbp + 0x90]
mov rax, qword [rbp + 0xa0]
lea rbx, [r14 + rax*2]
mov rdx, rbx
mov rcx, r14
call fcn.1400099e0
cmp rax, rbx
je 0x14007736d
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140077321
cmp cx, 0x2f
jne 0x140077330
add rax, 2
jmp 0x14007730d
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14007734d
cmp cx, 0x2f
je 0x14007734d
mov rbx, rdx
cmp rax, rdx
je 0x14007736d
jmp 0x140077330
cmp rax, rbx
je 0x14007736d
lea rdx, [rbx - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x140077365
cmp cx, 0x2f
jne 0x14007736d
mov rbx, rdx
cmp rax, rdx
jne 0x140077352
sub rbx, r14
sar rbx, 1
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x108], 7
mov r8, rbx
mov rdx, r14
lea rcx, [rbp + 0xf0]
call fcn.1400043e0
or r13d, 0x3800
lea rcx, [rbp + 0x90]
call fcn.140003e50
movups xmm0, xmmword [rbp + 0xf0]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rbp + 0x100]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], di
lea rcx, [rbp + 0xf0]
call fcn.140003e50
mov r15d, dword [rsp + 0x40]
dec r15d
mov dword [rsp + 0x40], r15d
jmp 0x140077250
cmp byte [rsp + 0x48], 0
jne 0x14007741c
lea rcx, [rbp + 0x90]
call fcn.140003e50
jmp 0x140077c56
lea rcx, [rbp + 0x90]
call fcn.140003e50
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140077435
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 1
mov eax, 3
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax - 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov rax, qword [rbp + 0x150]
mov qword [rax], r15
cmp r15, 0xffffffffffffffff
jne 0x140077598
lea rcx, [rbp - 0x10]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x48], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007758e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp qword [rsi + 0x18], 8
jb 0x1400774ab
mov rsi, qword [rsi]
mov dword [rsp + 0x50], 0x290028
mov dword [rsp + 0x54], 0x2d0020
mov dword [rsp + 0x58], 0x20
mov dword [rbp - 0x68], 0x650050
mov dword [rbp - 0x64], 0x660072
mov dword [rbp - 0x60], 0x72006f
mov dword [rbp - 0x5c], 0x53006d
mov dword [rbp - 0x58], 0x630065
mov dword [rbp - 0x54], 0x720075
mov dword [rbp - 0x50], 0x740069
mov dword [rbp - 0x4c], 0x430079
mov dword [rbp - 0x48], 0x650068
mov dword [rbp - 0x44], 0x6b0063
mov dword [rbp - 0x40], 0x73
mov dword [rsp + 0x70], 0x44005b
mov dword [rsp + 0x74], 0x4c004c
mov dword [rsp + 0x78], 0x520050
mov dword [rsp + 0x7c], 0x54004f
mov dword [rbp - 0x80], 0x430045
mov dword [rbp - 0x7c], 0x5d0054
mov dword [rbp - 0x78], 0x3a0020
mov dword [rbp - 0x74], 0x20003a
mov word [rbp - 0x70], di
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x20]
call fcn.14005ebc0
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140061040
mov dword [rsp + 0x20], ebx
mov r9, rsi
lea r8, str.CreateFileW_failed:_path_s__err_d
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
mov edi, 2
jmp 0x140077c56
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1e0]
call fcn.14009c250
lea rbx, [rbp + 0x1e0]
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rbp + 0x1e0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
mov dword [rsp + 0x40], eax
mov r14d, 2
test eax, eax
je 0x14007792a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140077648
mov edx, dword [rsp + 0x40]
mov eax, r14d
mul rdx
cmovo rax, r12
mov rcx, rax
call fcn.1400ab818
mov rbx, rax
test rax, rax
je 0x14007792a
xor r9d, r9d
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
test eax, eax
jne 0x140077648
xor r15b, r15b
jmp 0x14007769d
mov rdx, rbx
movzx eax, word [rbx]
test ax, ax
je 0x140077680
movabs rcx, 0x400000020003
nop dword [rax]
sub ax, 0x2e
cmp ax, 0x2e
ja 0x140077680
bt rcx, rax
jae 0x140077680
add rdx, r14
movzx eax, word [rdx]
test ax, ax
jne 0x140077660
nop dword [rax + rax]
inc r12
cmp word [rdx + r12*2], 0
jne 0x140077680
mov r8, r12
lea rcx, [rbp + 0xf0]
call fcn.1400043e0
mov r15b, 1
lea rax, [rbp + 0x1e0]
cmp rbx, rax
je 0x1400776b1
mov rcx, rbx
call fcn.1400aa588
test r15b, r15b
je 0x14007792a
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 8
cmovae rdx, qword [rbp + 0xf0]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400776de
mov rcx, qword [rsi]
call fcn.1400b4800
test eax, eax
jne 0x14007792a
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x140077731
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007772c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140077cab
call fcn.14005c5c0
cmp byte [0x1400fbd12], 0
je 0x14007788f
mov ecx, dword [0x1400fb894]
mov rax, qword gs:[0x58]
mov ebx, 0x14
add rbx, qword [rax + rcx*8]
cmp dword [rbx], 0
jle 0x140077873
lea rcx, [rbp - 0x10]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x48], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140077865
mov ebx, dword [rbx]
mov dword [rsp + 0x50], 0x290028
mov dword [rsp + 0x54], 0x2d0020
mov dword [rsp + 0x58], 0x20
mov dword [rbp - 0x68], 0x650050
mov dword [rbp - 0x64], 0x660072
mov dword [rbp - 0x60], 0x72006f
mov dword [rbp - 0x5c], 0x53006d
mov dword [rbp - 0x58], 0x630065
mov dword [rbp - 0x54], 0x720075
mov dword [rbp - 0x50], 0x740069
mov dword [rbp - 0x4c], 0x430079
mov dword [rbp - 0x48], 0x650068
mov dword [rbp - 0x44], 0x6b0063
mov dword [rbp - 0x40], 0x73
mov dword [rsp + 0x70], 0x44005b
mov dword [rsp + 0x74], 0x4c004c
mov dword [rsp + 0x78], 0x520050
mov dword [rsp + 0x7c], 0x54004f
mov dword [rbp - 0x80], 0x430045
mov dword [rbp - 0x7c], 0x5d0054
mov dword [rbp - 0x78], 0x3a0020
mov dword [rbp - 0x74], 0x20003a
mov word [rbp - 0x70], di
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x20]
call fcn.14005ebc0
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140061040
mov r9d, ebx
lea r8, str.in_winverify_trust_value__d
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
mov r14d, 0xc
mov edi, r14d
jmp 0x140077c56
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140077880
mov rcx, qword [rsi]
xor edx, edx
call fcn.140079710
test eax, eax
jne 0x140077c56
lea rcx, [rbp + 0xf0]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140077920
cmp qword [rsi + 0x18], 8
jb 0x1400778ad
mov rsi, qword [rsi]
mov dword [rsp + 0x50], 0x290028
mov dword [rsp + 0x54], 0x2d0020
mov dword [rsp + 0x58], 0x20
lea rdx, str.PerformSecurityChecks
lea rcx, [rbp - 0x68]
call fcn.140067af0
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rsp + 0x70]
call fcn.140067a60
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14005ebc0
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140061040
mov r9, rsi
lea r8, str._s_is_a_VULNERABLE_PATH
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
mov edi, 5
jmp 0x140077c56
lea rcx, [rbp + 0x20]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0xb0], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140077a60
mov rax, qword [rsp + 0x50]
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140077967
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x150], xmm0
mov qword [rsp + 0x50], 0xd
lea rax, [rbp + 0x150]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x70], xmm0
lea rax, str.GETPATH_FAILED_failed:__s
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x19
lea r8, [rbp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140095680
bts r13d, 0xe
or r13d, 2
mov dword [rsp + 0x40], r13d
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rbx, qword [rsp + 0x70]
mov dword [rbp + 0x70], 0x2d202928
mov word [rbp + 0x74], 0x20
movdqa xmm0, xmmword [0x1400d1d80]
movdqu xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0xa0], 0x6b636568
mov word [rbp + 0xa4], 0x73
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x60], 0
lea r8, [rbp + 0x90]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14005eaa0
lea r8, [rbp + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140060ed0
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
test r13b, 2
je 0x140077aa3
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140077aa3
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077a9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140077ca5
call fcn.14005c5c0
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x140077ae9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077ae4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140077cab
call fcn.14005c5c0
mov edi, r14d
jmp 0x140077c56
mov rcx, r13
call fcn.1400874e0
lea rcx, [rbp + 0x20]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140077c11
mov rcx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x140077b1c
mov rcx, qword [r13]
mov rax, qword [r13 + 0x10]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x150], xmm0
mov qword [rsp + 0x50], 0xd
lea rax, [rbp + 0x150]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x70], xmm0
lea rax, str.GETPATH_FAILED_failed:__s
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x19
lea r8, [rbp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140095680
nop
mov edi, 9
mov dword [rsp + 0x40], edi
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rbx, qword [rsp + 0x70]
mov dword [rbp + 0x70], 0x2d202928
mov word [rbp + 0x74], 0x20
movdqa xmm0, xmmword [0x1400d1d80]
movdqu xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0xa0], 0x6b636568
mov word [rbp + 0xa4], 0x73
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x60], 0
lea r8, [rbp + 0x90]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14005eaa0
lea r8, [rbp + 0x70]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140060ed0
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
test dil, 1
je 0x140077c4f
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140077c4f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077c4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140077c99
call fcn.14005c5c0
mov eax, 3
mov edi, eax
lea rcx, [rbp + 0x160]
call fcn.140003e50
nop
lea rcx, [rbp - 0x38]
call fcn.14006d200
mov eax, edi
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.14005c5a0
movaps xmm6, xmmword [rsp + 0x500]
add rsp, 0x518
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
int3