Function at 0x1800060f0
Capabilities:
Check for time delay via gettickcount
Check if file exists
Enumerate processes
Get common file path
Get startup folder
Get thread local storage value
Query environment variable
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2300]
mov eax, 0x2400
call fcn.1800ed9d0
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2440], rbx
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rbp + 0x22f0], rax
mov r12, r9
mov r15, r8
xor r13d, r13d
lea rdi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
cmp qword [0x1801c12b8], r13
je 0x180006275
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rax, qword [0x1801c12b8]
cmp byte [rax + 0x78], r13b
je 0x180006275
cmp dword [rax + 0x80], 4
jb 0x180006275
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x210], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x210], xmm1
mov word [rbp + 0x200], r13w
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x1800061b3
mov r9, qword [r12]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x1800061c0
mov r8, qword [r15]
lea rdx, str.JumpToProtectMainPage_link___s__path___s
lea rcx, [rbp + 0x200]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x24a
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x200]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x180006217
lea rdx, [rbp + 0x200]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x18000625d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008db8
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], r13w
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov byte [rsp + 0x31], 0
lea r9, [rsp + 0x31]
lea r8, [rbp + 0x40]
call fcn.180018cc0
mov esi, eax
cmp qword [0x1801c12b8], 0
je 0x1800063cb
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rcx, qword [0x1801c12b8]
cmp byte [rcx + 0x78], 0
je 0x1800063cb
cmp dword [rcx + 0x80], 4
jb 0x1800063cb
movzx ebx, byte [rcx + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x230], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x220], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
mov r8d, esi
lea rdx, str.GetProtectMainPage_dwErr__0x_X_protectMainPage___s
lea rcx, [rbp + 0x220]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x251
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x220]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x18000636d
lea rdx, [rbp + 0x220]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x1800063b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dbe
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], r13w
mov byte [rsp + 0x30], 0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.180011240
mov r14, 0xffffffffffffffff
test al, al
je 0x18000640d
cmp qword [rbp + 0x30], 0
jne 0x1800064d6
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x12f0]
call fcn.18010be50
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x12f0]
call fcn.180033250
test al, al
je 0x1800064d6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x250], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x250], xmm1
mov word [rbp + 0x240], r13w
lea rax, [rbp + 0x12f0]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180006470
lea rdx, [rbp + 0x12f0]
lea rcx, [rbp + 0x240]
call fcn.180004930
nop
lea rcx, [rbp + 0x20]
call fcn.1800048a0
movups xmm0, xmmword [rbp + 0x240]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x250]
movups xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movzx edi, byte [rsp + 0x30]
mov rax, qword [0x1801c12b8]
test rax, rax
je 0x180006614
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rax, qword [0x1801c12b8]
cmp byte [rax + 0x78], 0
je 0x180006614
cmp dword [rax + 0x80], 4
jb 0x180006614
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x270], xmm1
mov word [rbp + 0x260], r13w
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
movzx r9d, dil
lea rdx, str.GetProtectMainPage_Other_Browser_protectMainPage___s__isLocked___d
lea rcx, [rbp + 0x260]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x25f
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x260]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x1800065af
lea rdx, [rbp + 0x260]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x278]
cmp rdx, 8
jb 0x1800065f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800065f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dc4
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x270], xmm0
mov word [rbp + 0x260], r13w
mov rax, qword [0x1801c12b8]
cmp qword [rbp + 0x50], 0
jne 0x1800067f0
test dil, dil
jne 0x1800067f0
test rax, rax
je 0x180006747
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rax, qword [0x1801c12b8]
cmp byte [rax + 0x78], dil
je 0x180006747
cmp dword [rax + 0x80], 4
jb 0x180006747
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x290], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x290], xmm1
mov word [rbp + 0x280], r13w
mov r8d, 0x1a
lea rdx, str.GetProtectMainPage
lea rcx, [rbp + 0x280]
call fcn.180004930
mov dword [rsp + 0x28], 0x264
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x280]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x1800066e9
lea rdx, [rbp + 0x280]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 8
jb 0x18000672f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000672a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dca
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x280], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006787
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006782
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dd0
call fcn.1800ecd20
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x1800067d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dd6
call fcn.1800ecd20
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov eax, esi
jmp 0x180008d7c
lea rcx, [rbp + 0xa0]
call fcn.1800a0ea0
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rcx, qword [rbp + 0xa0]
lea rdx, str.explorer.exe
call fcn.18010e9d0
test eax, eax
je 0x180006a5e
call fcn.1800095c0
test al, al
jne 0x180006a5e
cmp qword [0x1801c12b8], 0
je 0x180006959
lea rcx, [0x1801c12b8]
call fcn.1800cdd20
mov rax, qword [0x1801c12b8]
cmp byte [rax + 0x78], 0
je 0x180006959
cmp dword [rax + 0x80], 4
jb 0x180006959
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2b0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x2b0], xmm1
mov word [rbp + 0x2a0], r13w
mov r8d, 0x17
lea rdx, str.other_desk_close_swtich
lea rcx, [rbp + 0x2a0]
call fcn.180004930
mov dword [rsp + 0x28], 0x26e
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x2a0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
test bl, bl
je 0x1800068fb
lea rdx, [rbp + 0x2a0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 8
jb 0x180006941
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000693c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ddc
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x2b0], xmm0
mov word [rbp + 0x2a0], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x18000699f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000699a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008de2
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x1800069f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800069f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008de8
call fcn.1800ecd20
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006a48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dee
call fcn.1800ecd20
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
jmp 0x180008d77
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x360], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x360]
call fcn.180004930
nop
lea rcx, [rbp + 0x360]
call fcn.18009fec0
test al, al
sete bl
mov rdx, qword [rbp + 0x378]
cmp rdx, 8
jb 0x180006af2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006aed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008df4
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x360], r13w
test bl, bl
je 0x180006e57
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x140]
call fcn.180004930
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006be8
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x6a4]
call fcn.18010be50
mov dword [rbp + 0x6a0], 0x238
lea rdx, [rbp + 0x6a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180006bdf
nop
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x6cc]
call fcn.18010e9d0
mov rcx, rbx
test eax, eax
je 0x180006e4a
lea rdx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180006ba0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x180006c30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006c2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dfa
call fcn.1800ecd20
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
test bl, bl
je 0x180006e57
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180006d53
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x190], xmm1
mov word [rbp + 0x180], r13w
mov r8d, 0xd
lea rdx, str.not_found_rtp
lea rcx, [rbp + 0x180]
call fcn.180004930
mov dword [rsp + 0x28], 0x291
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x180]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180006cf5
lea rdx, [rbp + 0x180]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x180006d3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006d36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e00
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180006d99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006d94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e06
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006df1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006dec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e0c
call fcn.1800ecd20
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006a48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dac
jmp 0x180006a43
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x180006bea
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x130], xmm1
mov word [rbp + 0x120], r13w
movdqu xmmword [rbp + 0x170], xmm0
movdqu xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x160], r13w
mov r8d, 0xa
lea rdx, str.2345PCSafe
lea rcx, [rbp + 0x160]
call fcn.180004930
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x120]
call fcn.180004930
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x180006f1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e12
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r13w
lea rcx, [rbp + 0x120]
call fcn.18003f750
test al, al
je 0x1800072cc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x390], xmm1
mov word [rbp + 0x380], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x380]
call fcn.180004930
nop
lea rcx, [rbp + 0x380]
call fcn.18009fec0
test al, al
sete bl
mov rdx, qword [rbp + 0x398]
cmp rdx, 8
jb 0x180006fdd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006fd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e18
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x380], r13w
test bl, bl
je 0x1800072cc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x310], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x310], xmm1
mov word [rbp + 0x300], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x300]
call fcn.180004930
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x18000704f
xor bl, bl
jmp 0x180007061
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.180008e40
movzx ebx, al
mov rdx, qword [rbp + 0x318]
cmp rdx, 8
jb 0x1800070a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800070a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e1e
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x310], xmm0
mov word [rbp + 0x300], r13w
test bl, bl
jne 0x1800072cc
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x1800071c8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x1b0], xmm1
mov word [rbp + 0x1a0], r13w
mov r8d, 0xe
lea rdx, str.not_found_tray
lea rcx, [rbp + 0x1a0]
call fcn.180004930
mov dword [rsp + 0x28], 0x29e
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x1a0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x18000716a
lea rdx, [rbp + 0x1a0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x1800071b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800071ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e24
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], r13w
lea rcx, [rbp + 0x120]
call fcn.1800048a0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x18000721b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e2a
call fcn.1800ecd20
movdqa xmm0, xmmword [0x18016e090]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180007273
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000726e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e30
call fcn.1800ecd20
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006a48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008db2
jmp 0x180006a43
mov r8, qword [rbp + 0x30]
test r8, r8
je 0x1800074a2
mov rdi, r8
cmp r8, 1
jb 0x18000735a
mov rbx, r13
test r8, r8
je 0x180007328
nop word [rax + rax]
cmp r8, rbx
jbe 0x180008da6
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
movzx edx, word [rax + rbx*2]
lea rcx, str.__r_t_n
call fcn.18010b3b8
mov r8, qword [rbp + 0x30]
test rax, rax
je 0x180007328
inc rbx
cmp rbx, rdi
jb 0x1800072f0
test rbx, rbx
je 0x18000735a
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
sub r8, rbx
mov qword [rbp + 0x30], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.18010b9f0
lea rdx, str.__r_t_n
lea rcx, [rbp + 0x20]
call fcn.18009d1f0
lea rcx, [rbp + 0x20]
call fcn.18009d380
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 5
lea rdx, str.http:
call fcn.1801124b0
test eax, eax
je 0x1800074a2
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 6
lea rdx, str.https:
call fcn.1801124b0
test eax, eax
je 0x1800074a2
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xb
lea rdx, str.about:blank
call fcn.1801124b0
test eax, eax
je 0x1800074a2
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xa
lea rdx, str.about:tabs
call fcn.1801124b0
test eax, eax
je 0x1800074a2
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x1d0], xmm1
mov word [rbp + 0x1c0], r13w
mov r8d, 7
lea rdx, str.http:__
lea rcx, [rbp + 0x1c0]
call fcn.180004930
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.18000ce30
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x20]
call fcn.180004930
nop
lea rcx, [rbp + 0x1c0]
call fcn.1800048a0
mov eax, dword [0x1801c09c8]
test eax, eax
je 0x180007594
mov ebx, dword [0x1801c09c8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
andps xmm1, xmmword [0x18016e0f0]
movsd xmm0, qword [0x18016e060]
comisd xmm0, xmm1
jb 0x180007594
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x18000758f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x4b0], xmm1
mov word [rbp + 0x4a0], r13w
mov r8d, 0x1c
lea rdx, str.JumpToProtectMainPage
lea rcx, [rbp + 0x4a0]
call fcn.180004930
mov dword [rsp + 0x28], CDefFolderMenu_Create2
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4a0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180007582
lea rdx, [rbp + 0x4a0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x4a0]
call fcn.1800048a0
nop
jmp 0x180008d4a
call fcn.18000c340
test al, al
jne 0x1800075a9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [0x1801c09c8], eax
mov eax, 1
xchg dword [0x1801be96c], eax
test eax, eax
jne 0x1800075bd
call fcn.180026840
lea rdx, [rbp + 0x40]
call fcn.180026f30
test al, al
je 0x180007614
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x600]
call fcn.180016650
nop
mov r8, qword [rbp + 0x610]
test r8, r8
je 0x180007608
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 8
cmovae rdx, qword [rbp + 0x600]
lea rcx, [rbp + 0x40]
call fcn.18000ce30
nop
lea rcx, [rbp + 0x600]
call fcn.1800048a0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x18000763a
mov rdx, qword [r15]
lea r8, [rbp + 0x60]
call fcn.1800175e0
mov ecx, dword [0x1801be95c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x18000771f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x4d0], xmm1
mov word [rbp + 0x4c0], r13w
cmp qword [r12 + 0x18], 8
jb 0x18000769c
mov r12, qword [r12]
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r9, qword [rbp + 0x60]
mov qword [rsp + 0x20], r12
mov r8, rdi
lea rdx, str.pAction___p_targetFileName___s_currentPath___s
lea rcx, [rbp + 0x4c0]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x2d0
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4c0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180007711
lea rdx, [rbp + 0x4c0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x4c0]
call fcn.1800048a0
jmp 0x180007726
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
xor edx, edx
mov ecx, dword [0x1801be95c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp qword [rbp + 0x50], 0
jne 0x18000781b
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, [0x1801612b8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x18000781b
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x18000780c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x4f0], xmm1
mov word [rbp + 0x4e0], r13w
mov r8d, 0x26
lea rdx, str.GetProtectMainPage_fail_and_path_is_ie
lea rcx, [rbp + 0x4e0]
call fcn.180004930
mov dword [rsp + 0x28], 0x2d6
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4e0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x1800077ff
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x4e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
jmp 0x180008d4a
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x180007828
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000784e
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007b5c
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.18000cae0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1800055c0
nop
cmp qword [rbp + 0xf0], 0
jne 0x180007997
cmp qword [rbp + 0x70], 0
jbe 0x180007b50
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.18000cae0
nop
mov rdx, rax
lea rcx, [rbp + 0x660]
call fcn.1800055c0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.18000ca50
nop
lea rcx, [rbp + 0x660]
call fcn.1800048a0
cmp qword [rbp + 0xf0], 0
jbe 0x180007b50
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180007a50
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x510], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x510], xmm1
mov word [rbp + 0x500], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.targetFileName_guid_file_path___ws
lea rcx, [rbp + 0x500]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x2e7
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x500]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x18000798b
lea rdx, [rbp + 0x500]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x500]
jmp 0x180007a4b
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180007a50
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x530], xmm1
mov word [rbp + 0x520], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.linkName_guid_file_path___ws
lea rcx, [rbp + 0x520]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x2ed
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x520]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180007a44
lea rdx, [rbp + 0x520]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x520]
call fcn.1800048a0
cmp qword [rbp + 0xf0], 0
jbe 0x180007b50
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, [0x1801612b8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180007ad9
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str._shdocvw.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180007ad9
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str.ieframe.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007b50
lea rdx, [rbp + 0x680]
call fcn.18001aad0
nop
lea r8, [rbp + 0x40]
mov rdx, rax
call fcn.180018fc0
movzx ebx, al
lea rcx, [rbp + 0x680]
call fcn.1800048a0
test bl, bl
je 0x180007b50
lea rcx, [rbp + 0xe0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x120]
call fcn.1800048a0
nop
lea rcx, [rbp + 0xa0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x20]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x40]
call fcn.1800048a0
xor eax, eax
jmp 0x180008d7c
lea rcx, [rbp + 0xe0]
call fcn.1800048a0
cmp rdi, 1
jne 0x180007c12
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007bf2
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x590], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x590], xmm1
mov word [rbp + 0x580], r13w
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rbp + 0x580]
call fcn.180004930
nop
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x60]
call fcn.180018fc0
movzx ebx, al
lea rcx, [rbp + 0x580]
call fcn.1800048a0
test bl, bl
je 0x180007c12
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
jmp 0x180007b1c
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180018fc0
test al, al
je 0x180007c12
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
jmp 0x180007b1c
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.18000cae0
nop
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007d33
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1af0]
call fcn.18010be50
mov r9d, 1
lea r8d, [r9 + 0xf]
lea rdx, [rbp + 0x1af0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180007d33
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
lea rdx, [rbp + 0x1af0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007d33
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
je 0x180007d33
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xaf0]
call fcn.18010be50
mov r9d, 1
lea r8d, [r9 + 0x18]
lea rdx, [rbp + 0xaf0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rdx, rbx
lea rcx, [rbp + 0xaf0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, [rbp + 0xaf0]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180007d15
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0x100]
call fcn.180004930
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0x80], r13w
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rbp + 0x80]
call fcn.180004930
nop
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r13w
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x5b0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x5b0], xmm1
mov word [rbp + 0x5a0], r13w
mov r8, r14
inc r8
cmp word [rdx + r8*2], 0
jne 0x180007dd2
lea rcx, [rbp + 0x5a0]
call fcn.180004930
nop
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5a0]
call fcn.18001c540
mov ebx, eax
lea rcx, [rbp + 0x5a0]
call fcn.1800048a0
test ebx, ebx
jne 0x180008c76
cmp qword [rbp + 0xd0], 0
jne 0x180007f56
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, [0x1801612b8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007f56
lea edx, [rbx + 4]
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180007f0c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x550], xmm1
mov word [rbp + 0x540], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180161420]
lea rcx, [rbp + 0x540]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x32f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x540]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180007f00
lea rdx, [rbp + 0x540]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x540]
call fcn.1800048a0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x80]
call fcn.180018fc0
test al, al
je 0x180007f56
lea rcx, [rbp + 0xc0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x80]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x100]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
jmp 0x180007b1c
cmp byte [rsp + 0x30], 0
je 0x180008736
lea rcx, [rsp + 0x48]
call fcn.18000e110
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.180004930
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqa xmmword [rbp + 0x2f0], xmm1
mov word [rbp + 0x2e0], r13w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x40]
call fcn.18000cae0
nop
lea r8, [rbp + 0x2c0]
mov rdx, rax
call fcn.180010e30
test al, al
je 0x1800086c1
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x1800080c1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x570], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x570], xmm1
mov word [rbp + 0x560], r13w
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180161440]
lea rcx, [rbp + 0x560]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x33e
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x560]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x1800080b5
lea rdx, [rbp + 0x560]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x560]
call fcn.1800048a0
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x80]
call fcn.180011730
test al, al
je 0x1800086c1
lea rdx, [rbp + 0x40]
call fcn.180026f30
test al, al
je 0x18000813a
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5c0]
call fcn.180016210
nop
mov r8, qword [rbp + 0x5d0]
test r8, r8
je 0x18000812e
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 8
cmovae rdx, qword [rbp + 0x5c0]
lea rcx, [rbp + 0x40]
call fcn.18000ce30
nop
lea rcx, [rbp + 0x5c0]
call fcn.1800048a0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1e0]
call fcn.18000cae0
nop
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180008215
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x3b0], xmm1
mov word [rbp + 0x3a0], r13w
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r8, qword [rbp + 0xc0]
mov eax, dword [rbp + 0x2c4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x2c0]
lea rdx, [0x180161490]
lea rcx, [rbp + 0x3a0]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x34d
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3a0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180008209
lea rdx, [rbp + 0x3a0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x3a0]
call fcn.1800048a0
cmp dword [rbp + 0x2c4], 1
jne 0x180008342
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2c8]
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x320]
call fcn.1800102f0
nop
mov r8, qword [rbp + 0x330]
test r8, r8
je 0x180008336
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rdx, qword [rbp + 0x320]
lea rcx, [rbp + 0x1e0]
call fcn.180004930
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180008336
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x3d0], xmm1
mov word [rbp + 0x3c0], r13w
lea r8, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae r8, qword [rbp + 0x320]
lea rdx, [0x180161510]
lea rcx, [rbp + 0x3c0]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x356
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3c0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180008329
lea rdx, [rbp + 0x3c0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x3c0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x320]
call fcn.1800048a0
cmp dword [rbp + 0x2c0], 1
jne 0x180008474
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x60]
call fcn.18000cae0
nop
mov r8, rax
lea rdx, [rbp + 0x340]
call fcn.18000fcb0
nop
mov r8, qword [rbp + 0x350]
test r8, r8
je 0x180008468
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rdx, qword [rbp + 0x340]
lea rcx, [rbp + 0x1e0]
call fcn.180004930
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180008468
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x3f0], xmm1
mov word [rbp + 0x3e0], r13w
lea r8, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae r8, qword [rbp + 0x340]
lea rdx, [0x180161550]
lea rcx, [rbp + 0x3e0]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x361
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3e0]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x18000845b
lea rdx, [rbp + 0x3e0]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x3e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x340]
call fcn.1800048a0
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x5e0]
call fcn.180011bd0
nop
lea r8, [rbp + 0x1e0]
cmp qword [rbp + 0x5f0], 0
je 0x1800085aa
lea rdx, [rbp + 0x5e0]
call fcn.180018fc0
test al, al
je 0x1800086a7
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x20]
call fcn.18000cae0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000ec60
nop
lea rcx, [rbp + 0x5e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x2e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cc10
nop
mov rcx, qword [0x1801c0a58]
test rcx, rcx
je 0x180008526
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c0a58]
sub dword [0x1801be968], 1
jne 0x180008543
call fcn.180020430
mov rcx, rax
call fcn.1800207c0
mov rcx, qword [0x1801c0a58]
test rcx, rcx
je 0x18000854f
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012d90
nop
mov edx, 0x60
mov rcx, qword [rsp + 0x48]
call fcn.180004b60
nop
lea rcx, [rbp + 0xc0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x80]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x100]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
jmp 0x180007b1c
lea rdx, [rbp + 0x80]
call fcn.180018fc0
test al, al
je 0x1800086a7
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp]
call fcn.18000cae0
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000ec60
nop
lea rcx, [rbp + 0x5e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x2e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cc10
nop
mov rcx, qword [0x1801c0a58]
test rcx, rcx
je 0x180008633
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c0a58]
sub dword [0x1801be968], 1
jne 0x180008650
call fcn.180020430
mov rcx, rax
call fcn.1800207c0
mov rcx, qword [0x1801c0a58]
test rcx, rcx
je 0x18000865c
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012740
nop
lea rcx, [rbp + 0xc0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x80]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x100]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
jmp 0x180007b1c
lea rcx, [rbp + 0x5e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x2e0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cc10
nop
mov rcx, qword [0x1801c0a58]
test rcx, rcx
je 0x1800086f4
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c0a58]
sub dword [0x1801be968], 1
jne 0x180008711
call fcn.180020430
mov rcx, rax
call fcn.1800207c0
mov rcx, qword [0x1801c0a58]
test rcx, rcx
je 0x18000871d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012740
jmp 0x1800087de
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x1800087de
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x410], xmm1
mov word [rbp + 0x400], r13w
mov r8d, 0x1b
lea rdx, str.Other_Browser_Home
lea rcx, [rbp + 0x400]
call fcn.180004930
mov dword [rsp + 0x28], 0x37c
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x400]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x1800087d2
lea rdx, [rbp + 0x400]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x400]
call fcn.1800048a0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x650], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x650], xmm1
mov word [rbp + 0x640], r13w
movdqu xmmword [rbp + 0x630], xmm0
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r13w
lea rcx, [rsp + 0x40]
call fcn.18001b660
nop
lea rcx, [rsp + 0x40]
call fcn.18001b880
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.18001bab0
test al, al
je 0x180008b7f
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x640]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.18001ba00
test al, al
je 0x180008b7f
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x18000892c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x430], xmm1
mov word [rbp + 0x420], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x1801615d0]
lea rcx, [rbp + 0x420]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x387
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x420]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180008920
lea rdx, [rbp + 0x420]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x420]
call fcn.1800048a0
cmp qword [rbp + 0x70], 0
jne 0x1800089de
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180008978
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
jmp 0x1800089d5
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x8e0]
call fcn.18010be50
mov r8d, 0x104
lea rdx, [rbp + 0x8e0]
lea rcx, str._ProgramFiles_Internet_Exploreriexplore.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800089de
lea rax, [rbp + 0x8e0]
nop
inc r14
cmp word [rax + r14*2], 0
jne 0x1800089c0
mov r8, r14
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0x60]
call fcn.180004930
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180008a51
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x40]
call fcn.180004930
mov r8d, 1
lea rdx, [0x18016164c]
lea rcx, [rbp + 0x40]
call fcn.18000ce30
mov r8d, 0xb
lea rdx, [0x180161650]
lea rcx, [rbp + 0x40]
call fcn.18000ce30
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180008b0f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x450], xmm1
mov word [rbp + 0x440], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r8, qword [rbp + 0x60]
lea rdx, [0x180161668]
lea rcx, [rbp + 0x440]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x3a1
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x440]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180008b03
lea rdx, [rbp + 0x440]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x440]
call fcn.1800048a0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180018fc0
test al, al
je 0x180008c44
lea rcx, [rsp + 0x40]
call fcn.18001b6c0
nop
lea rcx, [rbp + 0x620]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x640]
call fcn.1800048a0
nop
lea rcx, [rbp + 0xc0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x80]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x100]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
jmp 0x180007b1c
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov edi, eax
test eax, eax
je 0x180008c44
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x470], xmm1
mov word [rbp + 0x460], r13w
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
mov r8d, eax
lea rdx, str.RCBlackShortCut_Analyze_Fail___x_lnk___s
lea rcx, [rbp + 0x460]
call fcn.1800ceea0
mov dword [rsp + 0x28], 0x3a9
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x460]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp edi, 1
jbe 0x180008c38
lea rdx, [rbp + 0x460]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x460]
call fcn.1800048a0
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180008c52
mov byte [rax + 8], 0
lea rcx, [rsp + 0x40]
call fcn.18001b6c0
nop
lea rcx, [rbp + 0x620]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x640]
jmp 0x180008d13
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce980
mov ebx, eax
test eax, eax
je 0x180008d19
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x18016e090]
movdqu xmmword [rbp + 0x490], xmm1
mov word [rbp + 0x480], r13w
lea rdx, str.GetShortCutTargetCmdEx_Fail
lea rcx, [rbp + 0x480]
call fcn.180004910
mov dword [rsp + 0x28], 0x3af
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x480]
mov edx, 4
lea rcx, [0x1801c12b8]
call fcn.1800ce9d0
cmp ebx, 1
jbe 0x180008d0c
lea rdx, [rbp + 0x480]
lea rcx, [0x1801c12b8]
call fcn.1800ced60
nop
lea rcx, [rbp + 0x480]
call fcn.1800048a0
nop
lea rcx, [rbp + 0xc0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x80]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x100]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x60]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x120]
call fcn.1800048a0
nop
lea rcx, [rbp + 0xa0]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x20]
call fcn.1800048a0
nop
lea rcx, [rbp + 0x40]
call fcn.1800048a0
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x22f0]
xor rcx, rsp
call fcn.1800eccc0
mov rbx, qword [rsp + 0x2440]
add rsp, 0x2400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180012f80
nop
call fcn.18010e7e4
int3
call fcn.18010e7e4
int3
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3
call fcn.18010e7e4
int3
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3
call fcn.18010e7e4
int3
call fcn.18010e7e4
int3
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3