Function at 0x1400a8bf0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6f48]
mov eax, 0x7048
call fcn.140247340
sub rsp, rax
mov qword [rbp + 0x1e8], 0xfffffffffffffffe
mov r14, rcx
cmp dword [rcx + 0x14e4], 0x200
je 0x1400aa88d
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x1f00]
call fcn.140249b10
mov edx, 0x410
lea rcx, [rbp + 0x1f00]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rbp + 0x1f00]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a8c70
test eax, eax
je 0x1400a8ca6
mov eax, eax
cmp byte [rbp + rax + 0x1eff], 0x5c
je 0x1400a8ca6
lea rcx, [rbp + 0x1f00]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400a8c93
movzx eax, word [0x140287e84]
mov word [rcx], ax
lea rcx, [rbp + 0x1f00]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400a8cb0
movsd xmm0, qword [str.config_system]
movsd qword [rcx], xmm0
mov eax, dword [0x14029b070]
mov dword [rcx + 8], eax
movzx eax, word [0x14029b074]
mov word [rcx + 0xc], ax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
lea r15, vtable.CSABDataBuffer.0
mov qword [rbp + 0x60], r15
xor r13d, r13d
mov qword [rbp + 0x68], r13
mov dword [rbp + 0x70], r13d
mov qword [rbp + 0x74], 1
mov qword [rbp + 0x6f98], r13
lea r9, [rbp + 0x6f98]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x1f00]
mov rcx, r14
call fcn.1400911e0
cmp qword [rbp + 0x6f98], r13
jne 0x1400a8d47
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, str.SSD___1
call qword [rax + 0x48]
jmp 0x1400aa86f
mov edi, dword [rbp + 0x70]
mov rbx, qword [rbp + 0x68]
lea rax, vtable.CSABRegistryHive.0
mov qword [rbp + 0xa0], rax
lea rsi, vtable.CSABString.0
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], r13
mov dword [rbp + 0xb8], r13d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0xb0], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0xbc], 1
mov qword [rbp + 0xc0], rbx
mov dword [rbp + 0xc8], edi
mov qword [rbp + 0xe0], r13
lea rcx, [rbp + 0xa0]
call fcn.14008ad50
test eax, eax
je 0x1400a8dd9
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, str.SSD___2
call qword [rax + 0x48]
jmp 0x1400aa83f
lea r15, str.controlset001_services
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x1c0], r15
lea rax, str.controlset002_services
mov qword [rbp + 0x1c8], rax
lea rax, str.controlset003_services
mov qword [rbp + 0x1d0], rax
lea rax, str.controlset004_services
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x1e0], r13
mov dword [rbp - 0x44], r13d
mov r12, qword [rsp + 0x60]
mov qword [rbp - 0x18], rsi
test r15, r15
je 0x1400a8e6a
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], 0
jne 0x1400a8e35
mov dword [rbp - 8], ebx
lea eax, [rbx + 1]
mov edi, eax
mov ecx, eax
call fcn.140247068
mov rsi, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400a8e8b
mov r8d, edi
mov rdx, r15
mov rcx, rax
call fcn.1402496a0
jmp 0x1400a8e8b
mov dword [rbp - 8], r13d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rsi, rax
mov qword [rbp - 0x10], rax
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov ebx, r13d
mov dword [rbp - 4], 1
mov qword [rbp + 0x40], r13
test ebx, ebx
jne 0x1400a8eaa
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0x40], rax
jmp 0x1400a8f8f
lea r15, vtable.CSABRegistryPath.0
mov qword [rbp - 0x78], r15
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x70]
call fcn.140008ba0
nop
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140025b70
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x78]
call fcn.14008ba30
nop
mov rax, qword [rbp + 0xd8]
mov rdi, qword [rbp - 0x58]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400a8f5c
test rax, rax
je 0x1400a8f21
mov ecx, 0x6b6e
cmp word [rax], cx
jne 0x1400a8f26
lea r8, [rbx + 0x10]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400840e0
test rax, rax
je 0x1400a8f26
mov rbx, qword [rbx]
jmp 0x1400a8ef5
mov qword [rbp - 0x78], r15
lea rcx, [rbp - 0x58]
call fcn.140025de0
mov edx, 0x28
mov rcx, qword [rbp - 0x58]
call fcn.140247060
cmp dword [rbp - 0x5c], 1
jne 0x1400a8f55
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400a8f55
call fcn.140247060
mov ebx, 0x1006
jmp 0x1400a8f92
mov qword [rbp + 0x40], rax
mov qword [rbp - 0x78], r15
lea rcx, [rbp - 0x58]
call fcn.140025de0
mov edx, 0x28
mov rcx, qword [rbp - 0x58]
call fcn.140247060
cmp dword [rbp - 0x5c], 1
jne 0x1400a8f8f
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400a8f8f
call fcn.140247060
mov ebx, r13d
test rsi, rsi
je 0x1400a8f9f
mov rcx, rsi
call fcn.140247060
test ebx, ebx
jne 0x1400aa7e1
lea rbx, vtable.CSABString.0
mov qword [rbp - 0x18], rbx
mov dword [rbp - 8], r13d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov r13, rax
mov qword [rbp - 0x10], rax
xor eax, eax
mov qword [r13], rax
mov qword [r13 + 8], rax
mov dword [rbp - 4], 1
mov qword [rbp + 0x120], rbx
mov dword [rbp + 0x130], eax
lea ecx, [rax + 0x10]
call fcn.140247068
mov r15, rax
mov qword [rbp + 0x128], rax
xor eax, eax
mov qword [r15], rax
mov qword [r15 + 8], rax
mov dword [rbp + 0x134], 1
xor r8d, r8d
mov qword [rbp], r8
mov qword [rbp + 0x180], r8
mov edx, r8d
mov qword [rsp + 0x68], rdx
mov r11d, r8d
mov qword [rbp + 0x50], r8
mov qword [rbp + 0x1a0], r8
mov qword [rbp + 0x1a8], r8
mov qword [rbp + 0x1b8], r8
cmp dword [r14 + 0x127c], r8d
jne 0x1400aa7c2
mov rdi, qword [rbp + 0xc0]
mov esi, r8d
mov dword [rsp + 0x48], r8d
movzx eax, r8w
mov word [rbp + 0x6f98], ax
mov r9d, dword [rbp + 0x1a4]
mov dword [rsp + 0x4c], r9d
mov r10d, r8d
mov dword [rsp + 0x50], r8d
mov ebx, r8d
mov dword [rbp - 0x48], ebx
nop dword [rax]
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax + 0x14]
test ecx, ecx
je 0x1400a9289
test ebx, ebx
mov ebx, 0x696c
jne 0x1400a913f
mov dword [rbp - 0x48], 1
xor esi, esi
mov dword [rsp + 0x48], esi
mov eax, dword [rax + 0x1c]
add eax, 0x1004
cdqe
lea r8, [rax + rdi]
mov qword [rbp], r8
xor r11d, r11d
mov qword [rbp + 0x50], r11
xor r9d, r9d
mov dword [rsp + 0x4c], r9d
movzx eax, word [r8]
mov edx, 0x6972
cmp ax, dx
jne 0x1400a9120
mov r11, r8
mov qword [rbp + 0x50], r8
movsx r10d, word [r8 + 2]
mov dword [rsp + 0x50], r10d
movsxd rax, dword [r8 + 4]
lea rdx, [rdi + 0x1004]
add rdx, rax
mov qword [rsp + 0x68], rdx
movzx ecx, word [rax + rdi + 0x1006]
mov word [rbp + 0x6f98], cx
cmp word [rdx], bx
je 0x1400a9146
mov r8, rdx
mov qword [rbp], rdx
xor edx, edx
mov qword [rsp + 0x68], rdx
jmp 0x1400a9146
xor edx, edx
cmp ax, bx
cmove rdx, r8
mov qword [rsp + 0x68], rdx
xor r10d, r10d
mov dword [rsp + 0x50], r10d
mov word [rbp + 0x6f98], cx
jmp 0x1400a9146
movzx ecx, word [rbp + 0x6f98]
movsx eax, cx
cmp esi, eax
jl 0x1400a91a6
inc r9d
mov dword [rsp + 0x4c], r9d
test r10d, r10d
je 0x1400a9289
cmp r9d, r10d
jge 0x1400a9289
movsxd rax, r9d
movsxd rcx, dword [r11 + rax*4 + 4]
lea rdx, [rdi + 0x1004]
add rdx, rcx
mov qword [rsp + 0x68], rdx
movzx ecx, word [rcx + rdi + 0x1006]
mov word [rbp + 0x6f98], cx
cmp word [rdx], bx
je 0x1400a91a0
mov r8, rdx
mov qword [rbp], rdx
xor edx, edx
mov qword [rsp + 0x68], rdx
xor esi, esi
mov dword [rsp + 0x48], esi
movsx eax, cx
cmp esi, eax
jge 0x1400a9289
movsxd rax, esi
test rdx, rdx
je 0x1400a91bf
mov ecx, dword [rdx + rax*4 + 4]
jmp 0x1400a91c4
mov ecx, dword [r8 + rax*8 + 4]
add ecx, 0x1004
movsxd rax, ecx
add rdi, rax
mov eax, 0x6b6e
cmp word [rdi], ax
je 0x1400a91e4
mov eax, 0x1008
jmp 0x1400a928e
movzx ebx, word [rdi + 0x48]
test bx, bx
jg 0x1400a91f7
mov eax, 0x1008
jmp 0x1400a928e
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x5f40]
call fcn.140249b10
movsx r8, bx
lea rdx, [rdi + 0x4c]
lea rcx, [rbp + 0x5f40]
call fcn.1402496a0
test r13, r13
je 0x1400a9234
mov rcx, r13
call fcn.140247060
mov qword [rbp - 0x10], 0
lea rcx, [rbp + 0x5f40]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a9242
mov dword [rbp - 8], eax
inc eax
mov ebx, eax
mov ecx, eax
call fcn.140247068
mov r13, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400a9277
mov r8d, ebx
lea rdx, [rbp + 0x5f40]
mov rcx, rax
call fcn.1402496a0
inc esi
mov dword [rsp + 0x48], esi
xor eax, eax
mov r12, rdi
mov qword [rsp + 0x60], rdi
jmp 0x1400a928e
mov eax, 0x1007
test eax, eax
jne 0x1400aa7bb
mov edx, 0xffffffff
mov rcx, qword [r14 + 0x1290]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rbx, vtable.CSABString.0
mov qword [rbp + 8], rbx
mov r14d, 7
mov dword [rbp + 0x18], r14d
lea ecx, [r14 + 1]
call fcn.140247068
mov r15, rax
mov qword [rbp + 0x10], rax
test rax, rax
je 0x1400a92de
movsd xmm0, qword [str.system_]
movsd qword [rax], xmm0
mov dword [rbp + 0x1c], 1
mov qword [rsp + 0x70], rbx
mov rax, qword [rbp + 0x58]
test rax, rax
je 0x1400a9338
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400a9300
mov dword [rbp - 0x80], ebx
lea eax, [rbx + 1]
mov edi, eax
mov ecx, eax
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400a9334
mov r8d, edi
mov rdx, qword [rbp + 0x58]
mov rcx, rax
call fcn.1402496a0
mov eax, ebx
jmp 0x1400a9356
xor ebx, ebx
mov dword [rbp - 0x80], ebx
lea ecx, [rbx + 0x10]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov dword [rbp - 0x7c], 1
lea ecx, [rax + 8]
call fcn.140247068
mov rdi, rax
test r15, r15
je 0x1400a939c
mov rcx, r15
mov rdx, rax
sub rdx, r15
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400a9380
mov rcx, r15
call fcn.140247060
mov qword [rbp + 0x10], rdi
jmp 0x1400a93a0
mov qword [rbp + 0x10], rax
test rdi, rdi
je 0x1400a93ce
lea r8d, [rbx + 1]
lea rcx, [rdi + 7]
mov rdx, rsi
call fcn.1402496a0
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rdi + r14], 0
jne 0x1400a93c0
mov dword [rbp + 0x18], r14d
test rsi, rsi
je 0x1400a93db
mov rcx, rsi
call fcn.140247060
lea r15, vtable.CSABString.0
mov qword [rbp + 0x88], r15
mov dword [rbp + 0x98], 1
mov ecx, 2
call fcn.140247068
mov rbx, rax
mov qword [rbp + 0x90], rax
test rax, rax
je 0x1400a9416
movzx ecx, word [0x140287e84]
mov word [rax], cx
mov dword [rbp + 0x9c], 1
lea ecx, [r14 + 2]
call fcn.140247068
mov rsi, rax
test rdi, rdi
je 0x1400a945c
mov rcx, rdi
mov rdx, rax
sub rdx, rdi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400a9440
mov rcx, rdi
call fcn.140247060
mov qword [rbp + 0x10], rsi
jmp 0x1400a9460
mov qword [rbp + 0x10], rax
test rsi, rsi
je 0x1400a9485
mov edx, r14d
movzx ecx, word [rbx]
mov word [rdx + rsi], cx
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400a9476
mov r14d, ecx
mov dword [rbp + 0x18], ecx
test rbx, rbx
je 0x1400a9492
mov rcx, rbx
call fcn.140247060
mov qword [rsp + 0x70], r15
test r13, r13
je 0x1400a94dc
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rbx + r13], 0
jne 0x1400a94a3
mov dword [rbp - 0x80], ebx
lea eax, [rbx + 1]
mov r15d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400a94d8
mov r8d, r15d
mov rdx, r13
mov rcx, rax
call fcn.1402496a0
mov eax, ebx
jmp 0x1400a94fa
xor ebx, ebx
mov dword [rbp - 0x80], ebx
lea ecx, [rbx + 0x10]
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x78], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rbp - 0x7c], 1
lea ecx, [rax + 1]
add ecx, r14d
call fcn.140247068
mov r15, rax
test rsi, rsi
je 0x1400a953d
mov qword [rbp - 0x40], rax
mov rcx, rsi
mov rdx, rax
sub rdx, rsi
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400a9521
mov rcx, rsi
call fcn.140247060
mov qword [rbp + 0x10], r15
jmp 0x1400a9545
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x10], rax
test r15, r15
je 0x1400a9570
lea r8d, [rbx + 1]
mov ecx, r14d
add rcx, r15
mov rdx, rdi
call fcn.1402496a0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r15 + rax], 0
jne 0x1400a9563
mov dword [rbp + 0x18], eax
test rdi, rdi
je 0x1400a957d
mov rcx, rdi
call fcn.140247060
lea r15, vtable.CSABString.0
mov qword [rbp + 0xf0], r15
mov dword [rbp + 0x100], 0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov r13, rax
mov qword [rbp + 0xf8], rax
xor eax, eax
mov qword [r13], rax
mov qword [r13 + 8], rax
mov dword [rbp + 0x104], 1
xor edx, edx
mov qword [rsp + 0x58], rdx
mov qword [rbp + 0x138], rdx
mov qword [rbp + 0x148], rdx
mov esi, edx
mov r8d, edx
mov dword [rbp + 0x6fa0], edx
mov r14, qword [rbp + 0x6f90]
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [r12 + 0x24]
mov rdi, qword [rbp + 0xc0]
test ecx, ecx
je 0x1400aa75f
test r8d, r8d
jne 0x1400a962a
mov dword [rbp + 0x6fa0], 1
xor esi, esi
mov eax, dword [r12 + 0x28]
add eax, 0x1004
movsxd rdx, eax
add rdx, rdi
mov qword [rsp + 0x58], rdx
cmp esi, ecx
jge 0x1400aa75f
movsxd rax, esi
movsxd rcx, dword [rdx + rax*4]
lea eax, [rcx + 0x1004]
cmp eax, dword [rbp + 0xc8]
jae 0x1400aa75f
mov rbx, rcx
mov eax, 0x1000
mov r8d, eax
xor edx, edx
lea rcx, [rbp + 0x3f40]
call fcn.140249b10
movzx eax, word [rbx + rdi + 0x1006]
mov ecx, 0x1000
cmp ax, cx
jge 0x1400aa75f
movsx r8, ax
lea rdx, [rdi + 0x1018]
add rdx, rbx
lea rcx, [rbp + 0x3f40]
call fcn.1402496a0
lea rcx, [rbp + 0x3f40]
call fcn.140250f2c
test r13, r13
je 0x1400a96b8
mov rcx, r13
call fcn.140247060
xor edi, edi
mov qword [rbp + 0xf8], rdi
jmp 0x1400a96ba
xor edi, edi
lea rcx, [rbp + 0x3f40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a96d0
mov dword [rbp + 0x100], eax
inc eax
mov ebx, eax
mov ecx, eax
call fcn.140247068
mov r13, rax
mov qword [rbp + 0xf8], rax
test rax, rax
je 0x1400a970b
mov r8d, ebx
lea rdx, [rbp + 0x3f40]
mov rcx, rax
call fcn.1402496a0
inc esi
mov dword [rbp + 0x6fa8], esi
mov edx, 0xffffffff
mov rcx, qword [r14 + 0x1290]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, str.ImagePath
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rbp + 0x6fa0]
jne 0x1400a95f0
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x2f40]
call fcn.140249b10
lea rax, vtable.CSABDataBuffer.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdi
mov dword [rbp - 0x28], edi
mov qword [rbp - 0x24], 1
mov qword [rbp + 0x20], r15
mov dword [rbp + 0x30], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rbx, rax
mov qword [rbp + 0x28], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov dword [rbp + 0x34], 1
xor r15d, r15d
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x168], r15
mov esi, r15d
mov r12d, r15d
nop word [rax + rax]
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x24]
test ecx, ecx
je 0x1400a99d0
mov rdx, qword [rbp + 0xc0]
test r12d, r12d
jne 0x1400a97f2
mov r12d, 1
mov esi, edi
mov eax, dword [rax + 0x28]
add eax, 0x1004
movsxd r15, eax
add r15, rdx
cmp esi, ecx
jge 0x1400a99d0
movsxd rax, esi
movsxd rcx, dword [r15 + rax*4]
lea eax, [rcx + 0x1004]
cmp eax, dword [rbp + 0xc8]
jae 0x1400a99d0
lea r14, [rdx + 0x1004]
add r14, rcx
mov eax, 0x1000
mov r8d, eax
xor edx, edx
lea rcx, [rbp + 0x4f40]
call fcn.140249b10
movzx eax, word [r14 + 2]
mov ecx, 0x1000
cmp ax, cx
jge 0x1400a99d0
movsx r8, ax
lea rdx, [r14 + 0x14]
lea rcx, [rbp + 0x4f40]
call fcn.1402496a0
lea rcx, [rbp + 0x4f40]
call fcn.140250f2c
test rbx, rbx
je 0x1400a9877
mov rcx, rbx
call fcn.140247060
mov qword [rbp + 0x28], rdi
lea rcx, [rbp + 0x4f40]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a9885
mov dword [rbp + 0x30], eax
inc eax
mov edi, eax
mov ecx, eax
call fcn.140247068
mov rbx, rax
mov qword [rbp + 0x28], rax
test rax, rax
je 0x1400a98ba
mov r8d, edi
lea rdx, [rbp + 0x4f40]
mov rcx, rax
call fcn.1402496a0
inc esi
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov edi, 0
jne 0x1400a97c0
mov edi, dword [r14 + 4]
btr edi, 0x1f
cmp dword [r14 + 4], 0x80000000
jne 0x1400a98ee
mov edi, 4
jmp 0x1400a98f6
test edi, edi
je 0x1400a9998
lea esi, [rdi + 2]
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x1400a9913
cmp dword [rbp - 0x20], 0
jne 0x1400a9913
lea rcx, [rbp - 0x38]
mov rax, qword [rbp - 0x38]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov dword [rbp - 0x28], 0
mov edx, esi
lea rcx, [rbp - 0x38]
mov rax, qword [rbp - 0x38]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r10, rax
mov qword [rbp - 0x30], rax
mov r9d, dword [rbp - 0x28]
test rax, rax
cmovne r9d, esi
mov dword [rbp - 0x28], r9d
je 0x1400a9959
test r9d, r9d
je 0x1400a9959
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x38]
mov rax, qword [rbp - 0x38]
call qword [rax + 0x20]
mov r10, qword [rbp - 0x30]
mov eax, dword [r14 + 4]
cmp eax, 0x80000000
jne 0x1400a996d
mov eax, dword [r14 + 0xc]
mov dword [r10], eax
jmp 0x1400a9998
mov r8d, edi
test eax, eax
jns 0x1400a997a
lea rdx, [r14 + 8]
jmp 0x1400a998f
movsxd rcx, dword [r14 + 8]
mov rdx, qword [rbp + 0xc0]
add rdx, 0x1004
add rdx, rcx
mov rcx, r10
call fcn.1402496a0
nop
test rbx, rbx
je 0x1400a99a5
mov rcx, rbx
call fcn.140247060
xor edi, edi
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x1af0]
call fcn.140249b10
mov rcx, qword [rbp - 0x30]
test rcx, rcx
jne 0x1400a99df
mov rbx, rdi
mov qword [rbp + 0x80], rbx
jmp 0x1400a99f8
test rbx, rbx
je 0x1400a99a7
mov rcx, rbx
call fcn.140247060
jmp 0x1400a99a7
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x80], rax
test rax, rax
je 0x1400aa8a1
lea rsi, vtable.CSABString.0
mov qword [rbp + 0x108], rsi
mov qword [rbp + 0x110], rdi
mov dword [rbp + 0x118], edi
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x108]
call fcn.140005530
mov dword [rbp + 0x11c], 1
mov r12, qword [rbp + 0x110]
mov rdx, r12
lea rcx, [rbp + 0x2f40]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14029b0fc]
lea rcx, [rbp + 0x2f40]
call fcn.140248db4
test rax, rax
jne 0x1400a9a77
lea rdx, [0x14029b100]
lea rcx, [rbp + 0x2f40]
call fcn.140248db4
test rax, rax
je 0x1400a9a84
lea rcx, [rbp + 0x2f40]
call qword [sym.imp.SHLWAPI.dll_PathRemoveArgsA]
lea rcx, [rbp + 0x2f40]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesA]
lea rcx, [rbp + 0x88]
call fcn.14000ce10
nop
lea rdx, [rbp + 0x2f40]
lea rcx, [rbp + 0x88]
call fcn.140029260
nop
mov qword [rsp + 0x70], rsi
mov dword [rbp - 0x80], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x7c], 1
lea rdx, [rbp + 0x88]
lea rcx, [rsp + 0x70]
call fcn.140004780
mov r15, qword [rsp + 0x78]
mov rdx, r15
lea rcx, [rbp + 0x1af0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x1af0]
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesA]
lea rcx, [rbp + 0x1f0]
call fcn.1400270b0
nop
mov r14d, edi
mov qword [rbp + 0x48], rdi
mov rdi, qword [rbp + 0x6f90]
add rdi, 0x28
mov rax, qword [rdi]
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x20019
xor r9d, r9d
mov rsi, qword [rbp - 0x40]
mov r8, rsi
mov rdx, 0xffffffff80000002
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x1400a9bcb
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x2b30]
call fcn.140249b10
mov dword [rsp + 0x40], 0x410
mov rax, qword [rdi]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x2b30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.ImagePath
mov rdx, qword [rbp + 0x48]
mov rcx, rdi
call qword [rax + 0x60]
test eax, eax
jne 0x1400a9bb6
cmp dword [rsp + 0x40], eax
jne 0x1400a9bbc
mov r14d, 1
mov rax, qword [rdi]
mov rdx, qword [rbp + 0x48]
mov rcx, rdi
call qword [rax + 0x28]
jmp 0x1400a9bd1
mov r14d, 1
mov rcx, qword [rbp + 0x228]
test rcx, rcx
je 0x1400a9bed
call fcn.140247060
xor edi, edi
mov qword [rbp + 0x228], rdi
jmp 0x1400a9bef
xor edi, edi
lea rcx, [rbp + 0x1af0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a9c00
mov dword [rbp + 0x230], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x228], rax
test rax, rax
je 0x1400a9c3c
mov r8d, dword [rbp + 0x230]
inc r8d
lea rdx, [rbp + 0x1af0]
mov rcx, rax
call fcn.1402496a0
mov rcx, qword [rbp + 0x2d8]
test rcx, rcx
je 0x1400a9c54
call fcn.140247060
mov qword [rbp + 0x2d8], rdi
mov dword [rbp + 0x2e0], SafeArrayUnaccessData
mov ecx, reloc.WSOCK32.dll_send
call fcn.140247068
mov qword [rbp + 0x2d8], rax
test rax, rax
je 0x1400a9c8d
mov r8d, dword [rbp + 0x2e0]
inc r8d
lea rdx, str.HKEY_LOCAL_MACHINE
mov rcx, rax
call fcn.1402496a0
mov r8d, 0xffffffff
mov rdx, rsi
lea rcx, [rbp + 0x2a0]
call fcn.140005600
mov dword [rbp + 0x270], 1
lea rax, vtable.CSABDataBuffer.0
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rdi
mov dword [rbp - 0x68], edi
mov qword [rbp - 0x64], 1
mov qword [rsp + 0x40], rdi
lea rax, [0x140286ae1]
mov qword [rbp + 0x20], rax
lea rcx, [0x14028d61c]
mov qword [rbp + 0x28], rcx
lea rcx, [0x14028d62c]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdi
mov esi, edi
mov rdi, rax
nop word [rax + rax]
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x2310]
call fcn.140249b10
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1400a9d20
mov ecx, dword [rbp + 0x230]
add rax, rcx
cmp rax, 0x410
jae 0x1400a9da3
test esi, esi
je 0x1400a9d56
lea rdx, [0x14028b4b8]
mov rcx, qword [rbp + 0x228]
call fcn.140248db4
test rax, rax
jne 0x1400a9db3
mov rdx, qword [rbp + 0x228]
lea rcx, [rbp + 0x2310]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rdi
lea rcx, [rbp + 0x2310]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x78]
lea rdx, [rbp + 0x2310]
mov rdi, qword [rbp + 0x6f90]
mov rcx, rdi
call fcn.1400911e0
cmp dword [rbp - 0x68], 0
jne 0x1400a9e79
inc esi
mov rdi, qword [rbp + rsi*8 + 0x20]
test rdi, rdi
jne 0x1400a9d00
mov rdi, qword [rbp + 0x6f90]
cmp dword [rbp - 0x68], 0
je 0x1400aa670
mov rdx, qword [rbp - 0x70]
mov qword [rbp + 0x278], rdx
mov eax, dword [rsp + 0x40]
mov dword [rbp + 0x26c], eax
mov dword [rbp + 0x270], 1
lea r8, [rbp + 0x1f0]
mov rcx, rdi
call fcn.1400882b0
mov dword [rbp + 0x270], 0
mov rcx, qword [rdi + 0x12d8]
test rcx, rcx
je 0x1400a9e20
mov rax, qword [rcx]
mov r9d, 2
lea r8, [rbp + 0x1f0]
mov edx, 0x402
call qword [rax + 0x28]
xor esi, esi
inc dword [rdi + 0x12a0]
mov rcx, qword [rbp + 0x338]
test r14d, r14d
je 0x1400a9ee8
test rcx, rcx
je 0x1400a9e49
call fcn.140247060
mov qword [rbp + 0x338], rsi
mov dword [rbp + 0x340], SafeArrayUnaccessData
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x338], rax
test rax, rax
je 0x1400a9f32
lea rdx, str._HIDDENSERVICE_
jmp 0x1400a9f20
mov rcx, qword [rbp + 0x228]
test rcx, rcx
je 0x1400a9e95
call fcn.140247060
mov qword [rbp + 0x228], 0
lea rcx, [rbp + 0x2310]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400a9ea3
mov dword [rbp + 0x230], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x228], rax
test rax, rax
je 0x1400a9dba
mov r8d, dword [rbp + 0x230]
inc r8d
lea rdx, [rbp + 0x2310]
mov rcx, rax
call fcn.1402496a0
jmp 0x1400a9dba
test rcx, rcx
je 0x1400a9ef9
call fcn.140247060
mov qword [rbp + 0x338], rsi
mov dword [rbp + 0x340], 9
mov ecx, 0xa
call fcn.140247068
mov qword [rbp + 0x338], rax
test rax, rax
je 0x1400a9f32
lea rdx, str._SERVICE_
mov r8d, dword [rbp + 0x340]
inc r8d
mov rcx, rax
call fcn.1402496a0
mov qword [rsp + 0x40], rsi
xor edi, edi
mov rcx, qword [rbp + 0x6f90]
lea r9, [rcx + 0x13e0]
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 1
mov eax, dword [rcx + 0x12c4]
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1f0]
mov rcx, qword [rcx + 0x12c8]
call fcn.140017e00
test eax, eax
je 0x1400a9fdd
mov edi, 1
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x1400a9fdd
lea rcx, [rbp + 0x1270]
call fcn.1400279f0
nop
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x1280]
call fcn.1400284d0
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x18c8]
call fcn.14000db90
xor eax, eax
mov dword [rbp + 0x1300], eax
mov qword [rbp + 0x1308], rax
lea rcx, [rbp + 0x1270]
call fcn.1400283f0
test edi, edi
je 0x1400aa15f
lea rax, vtable.CSASDescriptor.0
mov qword [rbp + 0x9f0], rax
lea rax, vtable.CSASDescriptor.1.0
mov qword [rbp + 0x9f8], rax
lea rcx, [rbp + 0xa00]
call fcn.1400270b0
nop
lea rcx, [rbp + 0x1048]
call fcn.14000cb90
nop
lea rcx, [rbp + 0x1208]
call fcn.14000ce10
nop
lea rcx, [rbp + 0x1220]
call fcn.14000ce10
nop
lea rcx, [rbp + 0x1238]
call fcn.14000ce10
xor edi, edi
mov dword [rbp + 0x11f8], edi
mov qword [rbp + 0x1200], rdi
mov qword [rbp + 0x1258], rdi
mov dword [rbp + 0x1250], edi
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0xa00]
call fcn.1400284d0
mov dword [rbp + 0xa80], edi
mov qword [rbp + 0xa88], rdi
mov rdx, rsi
lea rcx, [rbp + 0x1048]
call fcn.14000db90
lea r8, [rbp + 0x9f0]
mov edx, 0x402
mov r14, qword [rbp + 0x6f90]
mov rcx, r14
call fcn.14007e430
lea r8, [rbp + 0x9f0]
mov edx, 0x400
mov rcx, r14
call fcn.14007e430
nop
lea rsi, vtable.CSASDescriptor.0
mov qword [rbp + 0x9f0], rsi
lea rax, vtable.CSASDescriptor.1.0
mov qword [rbp + 0x9f8], rax
lea rdi, vtable.CSABString.0
mov qword [rbp + 0x1238], rdi
add dword [rbp + 0x124c], 0xffffffff
jne 0x1400aa100
mov rcx, qword [rbp + 0x1240]
test rcx, rcx
je 0x1400aa100
call fcn.140247060
mov qword [rbp + 0x1220], rdi
add dword [rbp + 0x1234], 0xffffffff
jne 0x1400aa121
mov rcx, qword [rbp + 0x1228]
test rcx, rcx
je 0x1400aa121
call fcn.140247060
mov qword [rbp + 0x1208], rdi
add dword [rbp + 0x121c], 0xffffffff
jne 0x1400aa142
mov rcx, qword [rbp + 0x1210]
test rcx, rcx
je 0x1400aa142
call fcn.140247060
lea rcx, [rbp + 0x1048]
call fcn.14000d760
lea rcx, [rbp + 0xa00]
call fcn.140027e10
jmp 0x1400aa677
test r14d, r14d
mov r14, qword [rbp + 0x6f90]
je 0x1400aa622
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, str._r_nHidden_Service
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rbp - 0x40]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1af0]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rbp + 0x290]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, [0x140286ae1]
call qword [rax + 0x48]
movsxd r8, dword [rbp + 0x26c]
mov rcx, r8
shl rcx, 2
cmp rcx, 0x7fffffff
jg 0x1400aa8ac
movabs rax, 0x5555555555555556
imul rcx
mov rdi, rdx
shr rdi, 0x3f
add rdi, rdx
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub r8d, eax
add edi, r8d
mov eax, 0x6bca1af3
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x4c
mov ecx, edi
sub ecx, eax
je 0x1400aa250
and ecx, 0x80000003
jge 0x1400aa243
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x1400aa250
mov eax, 4
sub eax, ecx
add edi, eax
mov dword [rsp + 0x40], edi
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x2720]
call fcn.140249b10
mov r9d, edi
lea r8, [rbp + 0x1af0]
lea rdx, str.Base64Data::_s::_d::
lea rcx, [rbp + 0x2720]
call fcn.140006bc0
mov esi, edi
lea rcx, [rbp + 0x2720]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x1400aa295
lea rcx, [rax + 1]
add rcx, rsi
call fcn.140247068
mov rdi, rax
lea rax, [rbp + 0x2720]
mov rcx, 0xffffffffffffffff
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rax + rcx], 0
jne 0x1400aa2c0
lea r8, [rcx + 1]
add r8, rsi
xor edx, edx
mov rcx, rdi
call fcn.140249b10
lea rdx, [rbp + 0x2720]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, [rbp + 0x2720]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400aa300
add r8, rdi
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x40]
mov edx, dword [rbp + 0x26c]
mov rcx, qword [rbp + 0x278]
call fcn.14000a430
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x48]
mov rcx, rdi
call fcn.140247060
cmp dword [r14 + 0x14e0], 0
je 0x1400aa622
lea rsi, vtable.CSASDescriptor.0
mov qword [rbp + 0x1270], rsi
lea rax, vtable.CSASDescriptor.1.0
mov qword [rbp + 0x1278], rax
lea rcx, [rbp + 0x1280]
call fcn.1400270b0
nop
lea rcx, [rbp + 0x18c8]
call fcn.14000cb90
nop
lea rcx, [rbp + 0x1a88]
call fcn.14000ce10
nop
lea rcx, [rbp + 0x1aa0]
call fcn.14000ce10
nop
lea rcx, [rbp + 0x1ab8]
call fcn.14000ce10
xor edi, edi
mov dword [rbp + 0x1a78], edi
mov qword [rbp + 0x1a80], rdi
mov qword [rbp + 0x1ad8], rdi
mov dword [rbp + 0x1ad0], edi
lea rcx, [rbp + 0x840]
call fcn.14000cb90
nop
lea rcx, [rbp + 0x9f0]
call fcn.1400270b0
nop
mov r8d, 0xffffffff
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0xaa0]
call fcn.140005600
mov rcx, qword [rbp + 0xad8]
test rcx, rcx
je 0x1400aa412
call fcn.140247060
mov qword [rbp + 0xad8], rdi
mov dword [rbp + 0xae0], SafeArrayUnaccessData
mov ecx, reloc.WSOCK32.dll_send
call fcn.140247068
mov qword [rbp + 0xad8], rax
test rax, rax
je 0x1400aa44b
mov r8d, dword [rbp + 0xae0]
inc r8d
lea rdx, str.HKEY_LOCAL_MACHINE
mov rcx, rax
call fcn.1402496a0
mov rcx, qword [rbp + 0xa28]
test rcx, rcx
je 0x1400aa463
call fcn.140247060
mov qword [rbp + 0xa28], rdi
lea rcx, [rbp + 0x1af0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400aa471
mov dword [rbp + 0xa30], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0xa28], rax
test rax, rax
je 0x1400aa4ad
mov r8d, dword [rbp + 0xa30]
inc r8d
lea rdx, [rbp + 0x1af0]
mov rcx, rax
call fcn.1402496a0
lea rdx, [rbp + 0x9f0]
lea rcx, [rbp + 0x1280]
call fcn.1400284d0
mov dword [rbp + 0x8b0], reloc.WSOCK32.dll_shutdown
lea rax, str.____HIDDEN_SERVICE____
mov qword [rbp + 0x8a8], rax
mov rcx, qword [rbp + 0x850]
test rcx, rcx
je 0x1400aa4f0
call fcn.140247060
mov qword [rbp + 0x850], rdi
mov dword [rbp + 0x858], 2
mov ecx, 3
call fcn.140247068
mov qword [rbp + 0x850], rax
test rax, rax
je 0x1400aa529
mov r8d, dword [rbp + 0x858]
inc r8d
lea rdx, [0x14028da08]
mov rcx, rax
call fcn.1402496a0
mov dword [rbp + 0x944], 3
lea rdx, [rbp + 0x840]
lea rcx, [rbp + 0x18c8]
call fcn.14000db90
lea r8, [rbp + 0x1270]
mov edx, 0x402
mov rcx, r14
call fcn.14007e430
lea r8, [rbp + 0x1270]
mov edx, 0x400
mov rcx, r14
call fcn.14007e430
nop
lea rcx, [rbp + 0x9f0]
call fcn.140027e10
nop
lea rcx, [rbp + 0x840]
call fcn.14000d760
nop
mov qword [rbp + 0x1270], rsi
lea rax, vtable.CSASDescriptor.1.0
mov qword [rbp + 0x1278], rax
lea rdi, vtable.CSABString.0
mov qword [rbp + 0x1ab8], rdi
add dword [rbp + 0x1acc], 0xffffffff
jne 0x1400aa5c6
mov rcx, qword [rbp + 0x1ac0]
test rcx, rcx
je 0x1400aa5c6
call fcn.140247060
mov qword [rbp + 0x1aa0], rdi
add dword [rbp + 0x1ab4], 0xffffffff
jne 0x1400aa5e7
mov rcx, qword [rbp + 0x1aa8]
test rcx, rcx
je 0x1400aa5e7
call fcn.140247060
mov qword [rbp + 0x1a88], rdi
add dword [rbp + 0x1a9c], 0xffffffff
jne 0x1400aa608
mov rcx, qword [rbp + 0x1a90]
test rcx, rcx
je 0x1400aa608
call fcn.140247060
lea rcx, [rbp + 0x18c8]
call fcn.14000d760
lea rcx, [rbp + 0x1280]
call fcn.140027e10
jmp 0x1400aa629
lea rdi, vtable.CSABString.0
mov rcx, qword [rbp + 0x228]
call fcn.140250f2c
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x20]
call fcn.140008ba0
nop
lea rcx, [r14 + 0x13a0]
mov rdx, rax
call fcn.1400b2e80
nop
mov qword [rbp + 0x20], rdi
add dword [rbp + 0x34], 0xffffffff
jne 0x1400aa677
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400aa677
call fcn.140247060
jmp 0x1400aa677
mov r14, qword [rbp + 0x6f90]
lea rdi, vtable.CSABDataBuffer.0
mov qword [rbp - 0x78], rdi
add dword [rbp - 0x64], 0xffffffff
jne 0x1400aa69d
cmp dword [rbp - 0x60], 0
jne 0x1400aa69d
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400aa69d
call fcn.140247060
nop
lea rcx, [rbp + 0x1f0]
call fcn.140027e10
nop
cmp dword [rbp - 0x7c], 1
jne 0x1400aa6be
test r15, r15
je 0x1400aa6be
mov rcx, r15
call fcn.140247060
nop
cmp dword [rbp + 0x9c], 1
jne 0x1400aa6d9
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x1400aa6d9
call fcn.140247060
nop
test r12, r12
je 0x1400aa6e7
mov rcx, r12
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov qword [rbp - 0x38], rdi
add dword [rbp - 0x24], 0xffffffff
mov esi, dword [rbp + 0x6fa8]
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rbp + 0x6fa0]
mov r12, qword [rsp + 0x60]
lea r15, vtable.CSABString.0
jne 0x1400a95f0
cmp dword [rbp - 0x20], 0
lea r15, vtable.CSABString.0
jne 0x1400a95f0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
lea r15, vtable.CSABString.0
je 0x1400a95f0
call fcn.140247060
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rbp + 0x6fa0]
lea r15, vtable.CSABString.0
jmp 0x1400a95f0
test r13, r13
je 0x1400aa773
mov rcx, r13
call fcn.140247060
mov rdi, qword [rbp + 0xc0]
mov r15, qword [rbp - 0x40]
test r15, r15
je 0x1400aa78b
mov rcx, r15
call fcn.140247060
mov rdi, qword [rbp + 0xc0]
cmp dword [r14 + 0x127c], 0
mov r13, qword [rbp - 0x10]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rbp]
mov esi, dword [rsp + 0x48]
mov r9d, dword [rsp + 0x4c]
mov r10d, dword [rsp + 0x50]
mov r11, qword [rbp + 0x50]
mov ebx, dword [rbp - 0x48]
je 0x1400a9080
mov r15, qword [rbp + 0x128]
test r15, r15
je 0x1400aa7d0
mov rcx, r15
call fcn.140247060
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400aa7de
call fcn.140247060
xor r13d, r13d
mov ecx, dword [rbp - 0x44]
inc ecx
mov dword [rbp - 0x44], ecx
mov r15, qword [rbp + rcx*8 + 0x1c0]
mov qword [rbp + 0x58], r15
test r15, r15
je 0x1400aa806
lea rsi, vtable.CSABString.0
jmp 0x1400a8e25
lea rbx, [r14 + 0x1410]
mov edi, 0x1a
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400aa827
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx], r13
add rbx, 8
sub rdi, 1
jne 0x1400aa812
lea rsi, vtable.CSABString.0
lea r15, vtable.CSABDataBuffer.0
lea rax, vtable.CSABRegistryHive.0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rsi
add dword [rbp + 0xbc], 0xffffffff
jne 0x1400aa86f
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x1400aa86f
call fcn.140247060
nop
mov qword [rbp + 0x60], r15
add dword [rbp + 0x74], 0xffffffff
jne 0x1400aa88d
cmp dword [rbp + 0x78], 0
jne 0x1400aa88d
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x1400aa88d
call fcn.140247060
add rsp, 0x7048
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140004cd0
nop
mov ecx, 0x80004005
call fcn.140004cd0
int3