Function at 0x14003f120
Capabilities:
Check for time delay via gettickcount
Check os version
Encode data using xor
Enumerate processes
Get disk size
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7d8]
sub rsp, 0x8b0
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140184e90]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov r13, rcx
xor r14d, r14d
mov word [rbp + 0x590], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x592]
call fcn.1400b60d0
mov qword [r13 + 0x1d0], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x50], r14d
or rbx, 0xffffffffffffffff
lea r15d, [r14 + 1]
cmp byte [r13 + 0x119], r14b
je 0x14003f1c9
mov ebx, dword [r13 + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jb 0x14003f1c5
test ebx, ebx
jne 0x14003fe3a
or rbx, 0xffffffffffffffff
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, rbx
je 0x1400401b7
mov r12d, 0x238
mov r8d, r12d
xor edx, edx
lea rcx, [rbp + 0x50]
call fcn.1400b60d0
mov dword [rbp + 0x50], r12d
mov dword [rsp + 0x40], r14d
mov ecx, dword [0x14018cd80]
imul ecx, ecx
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
mov eax, 3
cmp ecx, eax
jne 0x14003f23c
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004017b
mov eax, 0x63
mov word [rbp + 0x550], ax
mov dword [rbp + 0x554], 0x6f0072
mov eax, 0x6d
mov word [rbp + 0x558], ax
mov eax, 0x2e
mov word [rbp + 0x55c], ax
mov word [rbp + 0x564], r14w
mov qword [rbp + 0x2a0], r14
mov qword [rbp + 0x2a8], r14
mov qword [rbp + 0x2a8], 7
mov qword [rbp + 0x2a0], r14
mov word [rbp + 0x290], r14w
cmp word [rbp + 0x7c], r14w
jne 0x14003f2bb
mov r8, r14
jmp 0x14003f2cc
lea rax, [rbp + 0x7c]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x14003f2c2
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 0x290]
call fcn.140043394
nop
mov eax, 0x65
mov dword [rbp + 0x560], 0x650078
mov word [rbp + 0x55e], ax
mov word [rbp + 0x55a], ax
mov eax, 0x68
mov word [rbp + 0x552], ax
lea rax, [rbp + 0x550]
mov rdx, rbx
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x14003f310
lea rcx, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 8
cmovae rcx, qword [rbp + 0x290]
mov r8, rdx
mov r10, qword [rbp + 0x2a0]
cmp r10, rdx
cmovb r8, r10
test r8, r8
je 0x14003f370
lea r9, [rbp + 0x550]
movzx eax, word [r9]
cmp word [rcx], ax
jne 0x14003f366
add rcx, 2
add r9, 2
sub r8, r15
jne 0x14003f34e
jmp 0x14003f370
sbb eax, eax
and eax, 0xfffffffe
add eax, r15d
jmp 0x14003f373
mov eax, r14d
movsxd rcx, eax
mov eax, r14d
cmp r10, rdx
setne al
cmp r10, rdx
cmovb eax, ebx
test rcx, rcx
cmovne eax, ecx
test eax, eax
je 0x14003f3d9
cmp qword [rbp + 0x2a8], 8
jb 0x14003f3a5
mov rcx, qword [rbp + 0x290]
call fcn.1400b0c74
mov qword [rbp + 0x2a8], 7
mov qword [rbp + 0x2a0], r14
mov word [rbp + 0x290], r14w
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003f677
jmp 0x14003f251
cmp dword [r13 + 0x2d0], r15d
jne 0x14003f3ed
mov dword [r13 + 0x2d0], 2
mov r12d, dword [rbp + 0x70]
mov dword [rsp + 0x40], r12d
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
test rax, rax
je 0x14003f5f2
test r12d, r12d
je 0x14003f5f2
mov r8d, 0x104
lea rdx, [rbp + 0x590]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14003feb7
cmp word [rbp + 0x590], r14w
jne 0x14003f44c
mov r8, r14
jmp 0x14003f460
lea rax, [rbp + 0x590]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x14003f456
lea rdx, [rbp + 0x590]
lea rcx, [rbp + 0x290]
call fcn.140043394
mov r8, qword [rbp + 0x2a0]
add r8, 0xfffffffffffffff6
mov r9, rbx
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x290]
call fcn.140042d84
mov rcx, rax
lea rax, [rbp + 0x550]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x14003f4a1
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14003f4b9
mov rcx, qword [rcx]
mov rdx, r8
cmp r10, r8
cmovb rdx, r10
test rdx, rdx
je 0x14003f4f1
lea r9, [rbp + 0x550]
movzx eax, word [r9]
cmp word [rcx], ax
jne 0x14003f4e7
add rcx, 2
add r9, 2
sub rdx, r15
jne 0x14003f4cf
jmp 0x14003f4f1
sbb eax, eax
and eax, 0xfffffffe
add eax, r15d
jmp 0x14003f4f4
mov eax, r14d
movsxd rcx, eax
mov eax, r14d
cmp r10, r8
setne al
cmp r10, r8
cmovb eax, ebx
test rcx, rcx
cmovne eax, ecx
test eax, eax
setne bl
cmp qword [rbp + 0x3a8], 8
jb 0x14003f527
mov rcx, qword [rbp + 0x390]
call fcn.1400b0c74
mov qword [rbp + 0x3a8], 7
mov qword [rbp + 0x3a0], r14
mov word [rbp + 0x390], r14w
test bl, bl
je 0x14003f5da
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x58]
mov dword [rsp + 0x40], r8d
mov eax, dword [0x14018cd80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x17
jne 0x14003f59f
mov ecx, 4
call fcn.1400b1450
mov ecx, dword [0x14018cd80]
mov dword [rax], ecx
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
test rax, rax
je 0x14003fe7e
mov r8d, 0x104
lea rdx, [rbp + 0x590]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14003fe42
cmp qword [rbp + 0x2a8], 8
jb 0x14003f659
mov rcx, qword [rbp + 0x290]
call fcn.1400b0c74
jmp 0x14003f659
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, dword [rbp + 0x58]
mov dword [rsp + 0x40], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
test rax, rax
je 0x140040104
mov r8d, 0x104
lea rdx, [rbp + 0x590]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1400400c8
cmp qword [rbp + 0x2a8], 8
jb 0x14003f655
mov rcx, qword [rbp + 0x290]
call fcn.1400b0c74
mov edi, dword [rsp + 0x44]
or rbx, 0xffffffffffffffff
mov word [rbp + 0x290], r14w
mov qword [rbp + 0x2a0], r14
mov qword [rbp + 0x2a8], 7
mov rax, qword [r13 + 0x1d0]
add rax, r15
test rax, 0xfffffffffffffffe
jne 0x14003f696
mov ecx, dword [r13 + 0x1dc]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r13 + 0x1d0]
sub rax, r15
cmp rax, 0xfffffffffffffffd
ja 0x14003f1a1
lea rcx, [0x1401849a8]
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r12d, r14d
lea rcx, [0x1401849a8]
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
mov eax, 6
cmp ecx, eax
jb 0x14003f7a1
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edi, 0x104
sub eax, edi
or eax, ecx
jge 0x14003f72d
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140001f54
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0xc], edi
jl 0x14003fef3
mov dword [rbx - 0x10], edi
mov word [rbx + 0x208], r14w
mov r9d, edi
mov r8, rbx
xor edx, edx
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x68]
call fcn.140002948
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140038540
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001d7c
nop
mov rdx, qword [rsp + 0x70]
or rsi, 0xffffffffffffffff
jmp 0x14003f926
lea rax, [rbp - 0x58]
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 0x590]
lea rcx, [rbp - 0x58]
call fcn.140001cb0
nop
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140038540
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003f7f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [0x14018cd80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 5
jne 0x14003f84d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
lea eax, [r8 + 1]
mov dword [0x14018cd80], eax
call fcn.14003ad98
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x1400400bd
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14003f885
add rcx, 2
test dx, dx
jne 0x14003f86e
mov eax, r14d
jmp 0x14003f88a
sbb eax, eax
or eax, r15d
test eax, eax
jne 0x14003f94d
mov r8, qword [rsp + 0x30]
mov ecx, r15d
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
mov ebx, 0x104
sub eax, ebx
or eax, ecx
jge 0x14003f8be
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140001f54
mov r8, qword [rsp + 0x30]
cmp dword [r8 - 0xc], ebx
jl 0x14003fefe
mov dword [r8 - 0x10], ebx
mov word [r8 + 0x208], r14w
mov r9d, ebx
xor edx, edx
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.140002948
nop
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140038540
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003f940
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x38]
mov edi, eax
cmp dword [rbx - 0x10], r14d
je 0x14003f993
call fcn.14003ad98
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x14003ff09
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14003f986
add rcx, 2
test dx, dx
jne 0x14003f96f
mov eax, r14d
jmp 0x14003f98b
sbb eax, eax
or eax, r15d
test eax, eax
jne 0x14003ff14
mov r8d, r14d
cmp edi, 0x714
jne 0x14003f9e4
lea rcx, [rsp + 0x78]
call fcn.140038bd4
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140001d7c
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003f9d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rbx, qword [rsp + 0x38]
cmp dword [rbx - 0x10], r14d
je 0x14003fa2a
call fcn.14003ad98
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140040001
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14003fa1d
add rcx, 2
test dx, dx
jne 0x14003fa06
mov eax, r14d
jmp 0x14003fa22
sbb eax, eax
or eax, r15d
test eax, eax
jne 0x14003ff14
mov qword [r13 + 0x1d0], r14
mov edx, r8d
lea rcx, [rbp + 0x310]
call fcn.14003a388
mov rsi, rax
mov edx, edi
lea rcx, [rbp + 0x3f0]
call fcn.14003a388
mov rdi, rax
mov edx, r12d
lea rcx, [rbp + 0x3b0]
call fcn.14003a388
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x370]
call fcn.14003a388
nop
lea r12, str.___:
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x330]
call fcn.140025860
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call fcn.14004389c
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140025860
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x3d0]
call fcn.14004389c
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.140025860
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14004389c
nop
cmp qword [rbp + 0x368], 0x10
jb 0x14003fb0a
mov rcx, qword [rbp + 0x350]
call fcn.1400b0c74
mov esi, 0xf
mov qword [rbp + 0x368], rsi
mov qword [rbp + 0x360], r14
mov byte [rbp + 0x350], r14b
cmp qword [rbp + 0x3e8], 0x10
jb 0x14003fb3a
mov rcx, qword [rbp + 0x3d0]
call fcn.1400b0c74
mov qword [rbp + 0x3e8], rsi
mov qword [rbp + 0x3e0], r14
mov byte [rbp + 0x3d0], r14b
cmp qword [rbp + 0x2e8], 0x10
jb 0x14003fb65
mov rcx, qword [rbp + 0x2d0]
call fcn.1400b0c74
mov qword [rbp + 0x2e8], rsi
mov qword [rbp + 0x2e0], r14
mov byte [rbp + 0x2d0], r14b
cmp qword [rbp + 0x308], 0x10
jb 0x14003fb90
mov rcx, qword [rbp + 0x2f0]
call fcn.1400b0c74
mov qword [rbp + 0x308], rsi
mov qword [rbp + 0x300], r14
mov byte [rbp + 0x2f0], r14b
cmp qword [rbp + 0x348], 0x10
jb 0x14003fbbb
mov rcx, qword [rbp + 0x330]
call fcn.1400b0c74
mov qword [rbp + 0x348], rsi
mov qword [rbp + 0x340], r14
mov byte [rbp + 0x330], r14b
cmp qword [rbp + 0x388], 0x10
jb 0x14003fbe6
mov rcx, qword [rbp + 0x370]
call fcn.1400b0c74
mov qword [rbp + 0x388], rsi
mov qword [rbp + 0x380], r14
mov byte [rbp + 0x370], r14b
cmp qword [rbp + 0x3c8], 0x10
jb 0x14003fc11
mov rcx, qword [rbp + 0x3b0]
call fcn.1400b0c74
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3c0], r14
mov byte [rbp + 0x3b0], r14b
cmp qword [rbp + 0x408], 0x10
jb 0x14003fc3c
mov rcx, qword [rbp + 0x3f0]
call fcn.1400b0c74
mov qword [rbp + 0x408], rsi
mov qword [rbp + 0x400], r14
mov byte [rbp + 0x3f0], r14b
cmp qword [rbp + 0x328], 0x10
jb 0x14003fc67
mov rcx, qword [rbp + 0x310]
call fcn.1400b0c74
mov qword [rbp + 0x328], rsi
mov qword [rbp + 0x320], r14
mov byte [rbp + 0x310], r14b
mov ebx, dword [rsp + 0x50]
mov eax, ebx
add ebx, r15d
mov dword [rsp + 0x50], ebx
cmp eax, 5
jge 0x14004000c
lea rdx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
cmovae rdx, qword [rbp + 0x2b0]
lea rcx, [rsp + 0x68]
call fcn.1400029e4
nop
cmp byte [0x14018d87e], r14b
jne 0x14003fd14
mov dword [rbp + 0x568], 0x6005a
mov r12d, 4
mov dword [rbp + 0x56c], 0x30004
mov word [rbp + 0x570], r14w
mov rcx, r14
lea rsi, [0x140187da0]
lea rdx, [0x1401889a0]
movzx eax, byte [rcx + rsi]
xor ax, word [rbp + rcx*2 + 0x568]
mov word [rdx + rcx*2], ax
add rcx, r15
cmp rcx, r12
jl 0x14003fcf0
mov esi, 0xf
mov byte [0x14018d87e], r15b
lea rdx, [0x1401889a0]
lea rcx, [rsp + 0x58]
call fcn.140001cb0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000cfa0
nop
lea rcx, [r13 + 0x1b8]
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
call fcn.14000d9c4
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003fd6f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003fd8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003fdae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [r13 + 0x1dc]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp + 0x2c8], 0x10
jb 0x14003fdd9
mov rcx, qword [rbp + 0x2b0]
call fcn.1400b0c74
mov qword [rbp + 0x2c8], rsi
mov qword [rbp + 0x2c0], r14
mov byte [rbp + 0x2b0], r14b
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003fe0e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
mov edi, dword [rsp + 0x44]
jg 0x14003f1a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003f1a1
mov eax, r15d
jmp 0x1400401f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x410]
call fcn.14003a388
mov r9, rax
call fcn.14003c1f4
mov rdx, rax
mov r8, r9
lea rcx, [rbp - 0x20]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp - 0x20]
call fcn.1400b8b68
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x470]
call fcn.14003a388
mov r8, rax
call fcn.14003c9d0
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp + 0x38]
call fcn.1400b8b68
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x510]
call fcn.14003a388
mov rbx, rax
call fcn.14003c7e4
mov rdx, rax
mov r8, rbx
lea rcx, [rbp]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp]
call fcn.1400b8b68
nop
mov ecx, 0x80070057
call fcn.140001874
int3
mov ecx, 0x80070057
call fcn.140001874
int3
mov ecx, 0x80004005
call fcn.140001874
int3
lea rdx, str.0.0.0.0
mov rcx, rbx
call fcn.1400c4c70
test eax, eax
jne 0x14003ffa4
mov qword [r13 + 0x1d0], r14
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.14001674c
nop
mov dl, 0x5c
lea rcx, [rsp + 0x48]
call fcn.140042bb4
mov dl, 0x20
lea rcx, [rsp + 0x48]
call fcn.140042bb4
mov dl, 0x2f
lea rcx, [rsp + 0x48]
call fcn.140042bb4
mov rax, qword [rsp + 0x48]
sub r15d, dword [rax - 8]
or r15d, dword [rax - 0xc]
jge 0x14003ff7d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400170e8
call fcn.14003c0e4
mov rdx, rax
mov r8, qword [rsp + 0x48]
lea rcx, [rbp + 0x18]
call fcn.14003ca78
lea rdx, [0x14014f7e8]
lea rcx, [rbp + 0x18]
call fcn.1400b8b68
nop
lea rcx, [r13 + 0x188]
lea rdx, [rsp + 0x38]
call fcn.140001d7c
mov eax, dword [rsp + 0x40]
mov dword [r13 + 0x1c8], eax
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003ffdb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003fffa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400401f3
mov ecx, 0x80004005
call fcn.140001874
nop
lea r8, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
cmovae r8, qword [rbp + 0x2b0]
mov qword [rsp + 0x58], r8
lea rdx, [0x1401889d0]
cmp byte [0x14018d871], r14b
jne 0x1400400a3
mov dword [rbp + 0x578], 0x17
mov dword [rbp + 0x57c], 0x6001e
mov dword [rbp + 0x580], 0x4000d
mov dword [rbp + 0x584], 0x450001
mov dword [rbp + 0x588], 0x1f0006
mov dword [rbp + 0x58c], 0x14
lea r8, [0x140187da0]
movzx eax, byte [r14 + r8]
xor ax, word [rbp + r14*2 + 0x578]
mov word [rdx + r14*2], ax
add r14, r15
cmp r14, 0xb
jl 0x14004007b
mov byte [0x14018d871], r15b
mov r8, qword [rsp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.14003ca78
lea rdx, [0x14014f7e8]
lea rcx, [rbp - 0x40]
call fcn.1400b8b68
nop
mov ecx, 0x80004005
call fcn.140001874
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4d0]
call fcn.14003a388
mov r9, rax
call fcn.14003b7d8
mov rdx, rax
mov r8, r9
lea rcx, [rbp - 0x30]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp - 0x30]
call fcn.1400b8b68
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x450]
call fcn.14003a388
mov rbx, rax
mov edx, edi
lea rcx, [rbp + 0x430]
call fcn.14003a388
nop
lea r8, [0x140120c18]
mov rdx, rax
lea rcx, [rbp + 0x4b0]
call fcn.140025860
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x4f0]
call fcn.14004389c
mov rbx, rax
call fcn.14003be18
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x10]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp - 0x10]
call fcn.1400b8b68
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x530]
call fcn.14003a388
mov r9, rax
call fcn.14003bd2c
mov rdx, rax
mov r8, r9
lea rcx, [rbp - 0x50]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp - 0x50]
call fcn.1400b8b68
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x490]
call fcn.14003a388
mov r9, rax
call fcn.14003bf08
mov rdx, rax
mov r8, r9
lea rcx, [rbp + 0x28]
call fcn.14003cb30
lea rdx, [0x14014f7e8]
lea rcx, [rbp + 0x28]
call fcn.1400b8b68
nop
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.1400b0c90
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret