Function at 0x1401cccf0
Capabilities:
Authenticate hmac
Get installed programs
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x430
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm14
movaps xmmword [rax - 0xd8], xmm15
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x288], rax
mov rsi, rdx
mov r12, rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x18], rdx
mov rcx, rdx
call fcn.1401c9830
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
je 0x1401ccda2
movss xmm2, dword [0x140379638]
mov edx, 1
mov rcx, rsi
call fcn.1400e5540
mov rdx, rsi
mov rcx, r12
call fcn.1401d0a70
xorps xmm10, xmm10
test al, al
je 0x1401ccdce
movaps xmm2, xmm10
mov edx, 9
mov rcx, rsi
call fcn.1400e5540
or qword [rsi + 0x40], 0x10000000
mov r8d, 0xf
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d9930
nop
xor r8d, r8d
lea rdx, str.Critical
mov rcx, rax
call fcn.140202b80
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401cce05
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
test bl, bl
je 0x1401cce3c
mov edx, 9
mov rcx, rsi
call fcn.1400d93d0
movss xmm13, dword [0x140379478]
test al, al
je 0x1401cce29
movaps xmm2, xmm10
jmp 0x1401cce2d
movaps xmm2, xmm13
mov edx, 0x4d
mov rcx, rsi
call fcn.1400e5540
jmp 0x1401cce45
movss xmm13, dword [0x140379478]
mov rcx, rsi
call fcn.1400d2290
lea rdi, [0x14034d1a0]
test al, al
je 0x1401cd190
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
jne 0x1401cd190
mov rcx, rsi
call fcn.1400d9d60
mov r15, rax
movss xmm7, dword [0x140379524]
test rax, rax
je 0x1401cd198
mov rcx, qword [rax]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x1401cd198
lea r13, str.Win64
movsd xmm6, qword [0x140379400]
nop word [rax + rax]
mov qword [rsp + 0x50], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401ccec7
mov qword [rsp + 0x48], rdi
jmp 0x1401cceec
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.140203bb0
nop
xor r8d, r8d
lea rdx, [0x14034be44]
lea rcx, [rsp + 0x48]
call fcn.140205020
test al, al
je 0x1401cd110
xor r8d, r8d
lea rdx, str.CurrentVersionRun_
lea rcx, [rsp + 0x48]
call fcn.140203280
test eax, eax
jle 0x1401cd110
movaps xmm1, xmm6
lea rcx, [rbp + 0x260]
call fcn.1400ec260
mov r9, rax
mov r8, rsi
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.1401cc5f0
test al, al
jne 0x1401cd178
mov rcx, rsi
call fcn.1401c9e20
test al, al
je 0x1401cd110
mov rcx, rsi
call fcn.1401c9e90
test rax, rax
je 0x1401cd110
mov rcx, qword [rax]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1401cd110
mov edi, dword [rsp + 0x54]
mov r11, qword [rax + 0x20]
cmp edi, dword [r11 + 0xc]
jne 0x1401ccfd1
mov rdx, qword [rsp + 0x48]
mov r10, qword [r11]
sub r10, rdx
nop word [rax + rax]
movzx r9d, word [rdx]
movzx r8d, word [rdx + r10]
sub r9d, r8d
jne 0x1401ccfc7
add rdx, 2
test r8d, r8d
jne 0x1401ccfb0
test r9d, r9d
sete dl
test dl, dl
jne 0x1401cd02c
cmp byte [rax + 0x19], 0
jne 0x1401cd01e
mov rdx, qword [rax + 0x10]
cmp byte [rdx + 0x19], 0
jne 0x1401ccffe
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
jne 0x1401cd01e
nop dword [rax]
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1401ccff0
jmp 0x1401cd01e
mov rdx, qword [rax + 8]
cmp byte [rdx + 0x19], 0
jne 0x1401cd01b
cmp rax, qword [rdx + 0x10]
jne 0x1401cd01b
mov rax, rdx
mov rdx, qword [rdx + 8]
cmp byte [rdx + 0x19], 0
je 0x1401cd008
mov rax, rdx
cmp rax, rcx
je 0x1401cd109
jmp 0x1401ccf90
xor r14b, r14b
xor dil, dil
mov eax, dword [r11 + 0x14]
cmp eax, 5
jae 0x1401cd057
mov ecx, dword [r11 + 0x10]
cmp ecx, 0x14
jae 0x1401cd057
cmp eax, 2
jae 0x1401cd052
cmp ecx, 0xa
jb 0x1401cd109
mov dil, 1
jmp 0x1401cd05a
mov r14b, 1
movaps xmm2, xmm7
mov edx, 0x49
mov rcx, rsi
call fcn.1400e5540
test r14b, r14b
je 0x1401cd0ed
mov eax, dword [rsi + 0x40]
shr rax, 0xb
and al, 1
lea rdx, str.Win32
cmovne rdx, r13
lea rcx, [rbp - 0x78]
call fcn.140200840
nop
mov edx, dword [rbp - 0x6c]
inc edx
lea rcx, [rbp - 0x78]
call fcn.1402028a0
movsxd rcx, dword [rbp - 0x6c]
mov rax, qword [rbp - 0x78]
mov edx, 0x2f
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x6c]
inc edx
lea rcx, [rbp - 0x78]
call fcn.140203bb0
lea rdx, str.Backdoor.Behavior
lea rcx, [rbp - 0x78]
call fcn.140200ef0
lea r8, [rbp - 0x78]
mov edx, 2
mov rcx, rsi
call fcn.1400dab80
nop
cmp dword [rbp - 0x70], 0
jle 0x1401cd109
mov rcx, qword [rbp - 0x78]
call fcn.1402bd0e0
jmp 0x1401cd109
test dil, dil
lea rdi, [0x14034d1a0]
je 0x1401cd110
movabs rax, 0x2000000000
or qword [rsi + 0x40], rax
jmp 0x1401cd110
lea rdi, [0x14034d1a0]
cmp dword [rsp + 0x50], 0
jle 0x1401cd121
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
cmp byte [rbx + 0x19], 0
jne 0x1401cd16e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cd14e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cd16e
nop dword [rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cd140
jmp 0x1401cd16e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cd16b
cmp rbx, qword [rax + 0x10]
jne 0x1401cd16b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cd158
mov rbx, rax
cmp rbx, qword [r15]
je 0x1401cd198
jmp 0x1401cceb0
cmp dword [rsp + 0x50], 0
jle 0x1401cd189
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
xor al, al
jmp 0x1401d0448
movss xmm7, dword [0x140379524]
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cd1fc
lea rdx, [rsi + 8]
lea rcx, [rbp - 0x68]
call fcn.1400e4760
nop
lea rdx, [rsi + 8]
mov rcx, r12
call fcn.1401cc020
test al, al
je 0x1401cd1ed
mov edx, dword [rsi + 0x14]
add edx, 0xfffffff8
js 0x1401cd1ed
lea rcx, [rsi + 8]
call fcn.140200d70
mov ecx, 0x202e
cmp ax, cx
jne 0x1401cd1ed
movaps xmm2, xmm7
mov edx, 0x15
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cd1fc
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
mov rcx, rsi
call fcn.1400d9860
movss xmm12, dword [0x140379488]
test al, al
je 0x1401cd22d
mov eax, dword [rsi + 0x40]
shr rax, 0x1e
test al, 1
je 0x1401cd22d
movaps xmm2, xmm12
mov edx, 0x46
mov rcx, rsi
call fcn.1400e5540
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x34
movss xmm6, dword [0x140379418]
test al, 1
je 0x1401cd2a6
mov rax, rcx
shr rax, 0x24
test al, 1
jne 0x1401cd2a6
mov rax, rcx
shr rax, 0x1c
test al, 1
jne 0x1401cd2a6
shr rcx, 0x1a
test cl, 1
jne 0x1401cd2a6
mov rcx, qword [r12 + 8]
call fcn.1400f20b0
test al, al
je 0x1401cd276
movaps xmm2, xmm7
jmp 0x1401cd299
mov rcx, rsi
call fcn.1400d2290
test al, al
je 0x1401cd296
mov rcx, rsi
call fcn.1400d98d0
cmp qword [rax + 8], 1
ja 0x1401cd296
movaps xmm2, xmm7
jmp 0x1401cd299
movaps xmm2, xmm6
mov edx, 0x47
mov rcx, rsi
call fcn.1400e5540
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x35
test al, 1
je 0x1401cd308
mov rax, rcx
shr rax, 0x24
test al, 1
jne 0x1401cd308
mov rax, rcx
shr rax, 0x1c
test al, 1
jne 0x1401cd308
shr rcx, 0x1a
test cl, 1
jne 0x1401cd308
mov rcx, qword [r12 + 8]
call fcn.1400f20b0
test al, al
je 0x1401cd2e7
movaps xmm2, xmm7
jmp 0x1401cd2fb
mov rcx, rsi
call fcn.1400d2290
test al, al
je 0x1401cd2f8
movaps xmm2, xmm7
jmp 0x1401cd2fb
movaps xmm2, xmm6
mov edx, 0x48
mov rcx, rsi
call fcn.1400e5540
mov eax, dword [rsi + 0x40]
shr rax, 0xd
movabs r15, 0x100000000
movss xmm6, dword [0x140379520]
test al, 1
je 0x1401cd356
movaps xmm2, xmm10
mov edx, 0x2a
mov rcx, rsi
call fcn.1400e5540
mov rax, qword [rsi + 0x40]
shr rax, 0x23
test al, 1
je 0x1401cd356
movaps xmm2, xmm6
mov edx, 0x3e
mov rcx, rsi
call fcn.1400e5540
or qword [rsi + 0x40], r15
mov rax, qword [rsi + 0x40]
shr rax, 0x20
test al, 1
jne 0x1401cd490
lea r14, [rsi + 8]
lea rdx, [rbp + 0x10]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1401cd396
cmp word [rbp + 0x3c], 0
jne 0x1401cd388
or qword [rsi + 0x40], r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1401cd490
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1401cd3e3
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x20000
lea r8d, [rax + 2]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1401cd3f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401cd490
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1401cd490
mov rdx, qword [r12 + 8]
mov rcx, r14
call fcn.1401f9a50
mov rdi, rax
lea rax, vtable.Core::SharedPtr_class_HitmanPro35::FileSystemBase_.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdi
xor ebx, ebx
mov qword [rbp - 0x48], rbx
test rdi, rdi
je 0x1401cd444
lea ecx, [rbx + 4]
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x1401cd438
mov dword [rax], 0
mov qword [rbp - 0x48], rax
jmp 0x1401cd43e
xor ebx, ebx
mov qword [rbp - 0x48], rbx
mov dword [rbx], 1
test rdi, rdi
je 0x1401cd462
mov rax, qword [rdi]
lea r8, [rsp + 0x68]
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x20]
test al, al
je 0x1401cd462
or qword [rsi + 0x40], r15
test rbx, rbx
je 0x1401cd490
mov eax, dword [rbx]
test eax, eax
jle 0x1401cd471
dec eax
mov dword [rbx], eax
cmp dword [rbx], 0
jne 0x1401cd490
test rdi, rdi
je 0x1401cd488
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, rbx
call fcn.14021ae20
mov rax, qword [rsi + 0x40]
shr rax, 0x20
test al, 1
je 0x1401cd4bc
mov rdx, qword [rsi + 8]
lea rcx, str.Cloaked__s__r_n
call fcn.1402bf424
movaps xmm2, xmm6
mov edx, 3
mov rcx, rsi
call fcn.1400e5540
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x21
test al, 1
je 0x1401cd4d5
movaps xmm2, xmm6
mov edx, 3
jmp 0x1401cd4eb
shr rcx, 0x18
test cl, 1
je 0x1401cd4f3
movss xmm2, dword [0x140379620]
mov edx, 4
mov rcx, rsi
call fcn.1400e5540
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cd54e
bt rcx, 8
jb 0x1401cd520
lea rcx, [rsi + 8]
xor r8d, r8d
lea rdx, str..dll
call fcn.140202750
test al, al
jne 0x1401cd54e
mov eax, dword [rsi + 0x40]
shr rax, 0x18
test al, 1
je 0x1401cd54e
mov rcx, rsi
call fcn.1400d9300
comiss xmm12, xmm0
jbe 0x1401cd54e
movss xmm2, dword [0x1403795f0]
mov edx, 5
mov rcx, rsi
call fcn.1400e5540
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cd599
mov edx, 0x400
mov rcx, rsi
call fcn.1401c6280
test al, al
je 0x1401cd599
lea rcx, [rsi + 8]
mov r8d, 1
lea rdx, str..NET
call fcn.140202610
test al, al
je 0x1401cd599
movss xmm2, dword [0x140379614]
mov edx, 0x28
mov rcx, rsi
call fcn.1400e5540
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cd5c2
shr rcx, 0x2f
test cl, 1
je 0x1401cd5c2
movaps xmm2, xmm10
mov edx, 0x3c
mov rcx, rsi
call fcn.1400e5540
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cd620
bt rcx, 8
jb 0x1401cd620
lea rcx, [rsi + 8]
xor r8d, r8d
lea rdx, str..dll
call fcn.140202750
test al, al
je 0x1401cd620
mov rcx, rsi
call fcn.1401c97a0
cmp eax, 1
jne 0x1401cd620
lea edx, [rax + 3]
mov rcx, rsi
call fcn.1401c6280
test al, al
je 0x1401cd620
movss xmm2, dword [0x14037961c]
mov edx, 0x29
mov rcx, rsi
call fcn.1400e5540
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
movss xmm8, dword [0x1403794b0]
movss xmm6, dword [0x1403794c0]
test al, 1
je 0x1401cd7f0
xor r14b, r14b
shr rcx, 0x1b
test cl, 1
jne 0x1401cd6ea
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x58]
call fcn.1400d5970
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400e4760
nop
xor r8d, r8d
lea rdx, [0x140352308]
lea rcx, [rsp + 0x78]
call fcn.140202b80
test al, al
je 0x1401cd6c8
xor edi, edi
lea rbx, str.setup
nop dword [rax]
nop dword [rax + rax]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [rsp + 0x58]
call fcn.140202610
test al, al
jne 0x1401cd6c5
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, 3
jb 0x1401cd6a0
jmp 0x1401cd6c8
mov r14b, 1
cmp dword [rbp - 0x80], 0
jle 0x1401cd6d9
mov rcx, qword [rsp + 0x78]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cd6ea
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
mov r9, qword [rsi + 0x40]
mov rax, r9
shr rax, 0x1b
test al, 1
jne 0x1401cd702
test r14b, r14b
je 0x1401cd7f0
mov r8, qword [rsi + 0x50]
test r8, r8
je 0x1401cd7f0
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cd738
nop
cmp dword [rcx + 0x20], 1
jge 0x1401cd72c
mov rcx, qword [rcx + 0x10]
jmp 0x1401cd732
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cd720
cmp rdx, rax
je 0x1401cd748
cmp dword [rdx + 0x20], 1
mov qword [rsp + 0x68], rdx
jle 0x1401cd74d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cd765
cmp qword [rax + 0x28], 0
jne 0x1401cd7f0
test r8, r8
je 0x1401cd7f0
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cd798
nop
cmp dword [rcx + 0x20], 0xe
jge 0x1401cd78c
mov rcx, qword [rcx + 0x10]
jmp 0x1401cd792
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cd780
cmp rdx, rax
je 0x1401cd7a8
cmp dword [rdx + 0x20], 0xe
mov qword [rsp + 0x68], rdx
jle 0x1401cd7ad
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cd7f0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401cd7f0
movss xmm0, dword [rcx]
comiss xmm0, xmm8
jbe 0x1401cd7f0
movaps xmm2, xmm6
test r14b, r14b
jne 0x1401cd7df
shr r9, 0x1a
test r9b, 1
je 0x1401cd7e3
movaps xmm2, xmm10
mov edx, 0x3f
mov rcx, rsi
call fcn.1400e5540
mov eax, dword [rsi + 0x40]
shr rax, 9
movss xmm11, dword [0x1403793c0]
movss xmm7, dword [0x1403794fc]
mov rcx, rsi
test al, 1
je 0x1401cd898
mov r8d, 9
lea rdx, [rsp + 0x58]
call fcn.1400d9930
nop
xor r8d, r8d
lea rdx, str.Boot
lea rcx, [rsp + 0x58]
call fcn.140202b80
test al, al
jne 0x1401cd86c
xor r8d, r8d
lea rdx, str.System
lea rcx, [rsp + 0x58]
call fcn.140202b80
test al, al
jne 0x1401cd86c
xor r8d, r8d
lea rdx, str.AutoLoad
lea rcx, [rsp + 0x58]
call fcn.140202b80
test al, al
je 0x1401cd87e
movaps xmm2, xmm11
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cd93b
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
jmp 0x1401cd93b
call fcn.1400d2290
test al, al
je 0x1401cd90c
movaps xmm6, xmm11
movsxd rax, dword [r12 + 0x1f4]
cmp dword [rsi + 0x14], eax
jl 0x1401cd8f2
mov r8, rax
mov rdx, qword [r12 + 0x1e8]
mov rcx, qword [rsi + 8]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401cd8f2
movaps xmm6, xmm12
mov eax, dword [rsi + 0x40]
shr rax, 0xa
test al, 1
je 0x1401cd8e1
movaps xmm6, xmm7
lea rcx, [rsi + 8]
call fcn.1401c9610
test al, al
jne 0x1401cd8f2
addss xmm6, xmm7
movaps xmm2, xmm6
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e5540
movss xmm6, dword [0x1403794c0]
jmp 0x1401cd93b
lea rdx, [rsi + 8]
mov rcx, qword [r12 + 8]
call fcn.1400fc050
test al, al
je 0x1401cd93b
lea rdx, [rsi + 8]
mov rcx, rsi
call fcn.1400edab0
movaps xmm2, xmm11
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e5540
lea r13, [rsi + 8]
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d4470
nop
mov rdi, qword [r12 + 0x100]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401cd984
nop
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x20]
call fcn.1402bcf6c
test eax, eax
jns 0x1401cd978
mov rbx, qword [rbx + 0x10]
jmp 0x1401cd97e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401cd960
cmp rdi, qword [r12 + 0x100]
je 0x1401cd9a7
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.1402bcf6c
test eax, eax
js 0x1401cd9a7
mov qword [rsp + 0x68], rdi
jmp 0x1401cd9b4
mov rax, qword [r12 + 0x100]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r12 + 0x100]
jne 0x1401cd9f2
movsxd rax, dword [r12 + 0x224]
cmp dword [rsp + 0x64], eax
jl 0x1401cda04
mov r8, rax
mov rdx, qword [r12 + 0x218]
mov rcx, qword [rsp + 0x58]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401cda04
movaps xmm2, xmm11
mov edx, 7
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cda15
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
mov rax, qword [r12 + 0x110]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401cdabb
movsxd rax, dword [rbx + 0x2c]
cmp dword [r13 + 0xc], eax
jl 0x1401cda4c
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
jne 0x1401cdaab
cmp byte [rbx + 0x19], 0
jne 0x1401cda9e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cda7e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cda9e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cda70
jmp 0x1401cda9e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cda9b
cmp rbx, qword [rax + 0x10]
jne 0x1401cda9b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cda88
mov rbx, rax
cmp rbx, qword [r12 + 0x110]
jmp 0x1401cda23
movaps xmm2, xmm6
mov edx, 8
mov rcx, rsi
call fcn.1400e5540
mov rax, qword [rsi + 0x40]
shr rax, 0x2c
test al, 1
je 0x1401cdaed
mov edx, 7
mov rcx, rsi
call fcn.1400d93d0
test al, al
jne 0x1401cdaed
movss xmm2, dword [0x14037947c]
mov edx, 0x3b
mov rcx, rsi
call fcn.1400e5540
movsxd rax, dword [r12 + 0x194]
cmp dword [r13 + 0xc], eax
jl 0x1401cdbe5
mov r8, rax
mov rdx, qword [r12 + 0x188]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401cdbe5
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d5970
nop
mov rax, qword [r12 + 0x120]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401cdbd4
movsxd rax, dword [rbx + 0x2c]
cmp dword [rsp + 0x64], eax
jl 0x1401cdb66
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.1402beee8
test eax, eax
sete al
test al, al
jne 0x1401cdbc3
cmp byte [rbx + 0x19], 0
jne 0x1401cdbb6
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cdb90
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cdbb6
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cdb82
jmp 0x1401cdbb6
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cdbb3
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401cdbb3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cdba0
mov rbx, rax
cmp rbx, qword [r12 + 0x120]
jmp 0x1401cdb3c
movaps xmm2, xmm7
mov edx, 6
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cdbe5
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
mov r8, qword [rsi + 0x50]
movss xmm6, dword [0x1403794cc]
test r8, r8
je 0x1401cdd95
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cdc28
nop word [rax + rax]
cmp dword [rcx + 0x20], 2
jge 0x1401cdc1c
mov rcx, qword [rcx + 0x10]
jmp 0x1401cdc22
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cdc10
cmp rdx, rax
je 0x1401cdc38
cmp dword [rdx + 0x20], 2
mov qword [rsp + 0x68], rdx
jle 0x1401cdc3d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cdd95
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401cdd95
cmp qword [rcx + 8], 0
seta al
test al, al
je 0x1401cdd95
movabs rax, 0x8000000000000000
test qword [rsi + 0x40], rax
je 0x1401cdd95
mov rdx, r13
mov rcx, r12
call fcn.1401cc020
test al, al
je 0x1401cdd95
mov r8, qword [rsi + 0x50]
test r8, r8
jne 0x1401cdc9f
xor ebx, ebx
jmp 0x1401cdcf2
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cdcc8
nop
cmp dword [rcx + 0x20], 2
jge 0x1401cdcbc
mov rcx, qword [rcx + 0x10]
jmp 0x1401cdcc2
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cdcb0
cmp rdx, rax
je 0x1401cdcd8
cmp dword [rdx + 0x20], 2
mov qword [rsp + 0x68], rdx
jle 0x1401cdcdd
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
jne 0x1401cdcee
xor ebx, ebx
jmp 0x1401cdcf2
mov rbx, qword [rax + 0x28]
mov rbx, qword [rbx]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d98d0
cmp rbx, qword [rax]
je 0x1401cdd95
nop dword [rax]
mov rdx, qword [rbx + 0x20]
shr rdx, 0x20
mov rcx, qword [r12 + 8]
call fcn.1400fea30
test rax, rax
je 0x1401cdd85
cmp byte [rbx + 0x19], 0
jne 0x1401cdd76
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cdd51
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cdd76
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cdd43
jmp 0x1401cdd76
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cdd73
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401cdd73
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cdd60
mov rbx, rax
mov rcx, rsi
call fcn.1400d98d0
cmp rbx, qword [rax]
jne 0x1401cdd10
jmp 0x1401cdd95
movaps xmm2, xmm6
mov edx, 0xa
mov rcx, rsi
call fcn.1400e5540
mov r8, qword [rsi + 0x50]
movss xmm15, dword [0x1403795f8]
movss xmm9, dword [0x140379458]
test r8, r8
je 0x1401cde77
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cdddc
cmp dword [rcx + 0x20], 3
jge 0x1401cddd0
mov rcx, qword [rcx + 0x10]
jmp 0x1401cddd6
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cddc4
cmp rdx, rax
je 0x1401cddec
cmp dword [rdx + 0x20], 3
mov qword [rsp + 0x68], rdx
jle 0x1401cddf1
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cde13
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401cde13
cmp qword [rcx + 8], 0
seta al
test al, al
jne 0x1401cde87
test r8, r8
je 0x1401cde77
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cde40
cmp dword [rcx + 0x20], 4
jge 0x1401cde34
mov rcx, qword [rcx + 0x10]
jmp 0x1401cde3a
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cde28
cmp rdx, rax
je 0x1401cde50
cmp dword [rdx + 0x20], 4
mov qword [rsp + 0x68], rdx
jle 0x1401cde55
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cde77
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401cde77
cmp qword [rcx + 8], 0
seta al
test al, al
jne 0x1401cde87
mov rcx, rsi
call fcn.1400d9860
test al, al
je 0x1401ce00f
movaps xmm2, xmm11
mov edx, 0xb
mov rcx, rsi
call fcn.1400e5540
movsxd rax, dword [r12 + 0x1a4]
cmp dword [r13 + 0xc], eax
jl 0x1401cdec3
mov r8, rax
mov rdx, qword [r12 + 0x198]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
jne 0x1401cdeee
movsxd rax, dword [r12 + 0x1b4]
cmp dword [r13 + 0xc], eax
jl 0x1401cdeff
mov r8, rax
mov rdx, qword [r12 + 0x1a8]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401cdeff
movaps xmm2, xmm11
mov edx, 0xc
mov rcx, rsi
call fcn.1400e5540
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 9
test al, 1
jne 0x1401cdf96
bt rcx, 8
jb 0x1401cdf2f
xor r8d, r8d
lea rdx, str..dll
mov rcx, r13
call fcn.140202750
test al, al
jne 0x1401cdf96
mov rcx, rsi
call fcn.1401c9ef0
mov rcx, rsi
cmp eax, 0xfa0
jb 0x1401cdf4c
movaps xmm2, xmm15
mov edx, 0xd
jmp 0x1401cdf91
mov rdx, qword [r12 + 8]
call fcn.1400daee0
test eax, eax
jg 0x1401cdf96
mov rdx, qword [r12 + 8]
mov rcx, rsi
call fcn.1400db1c0
test eax, eax
jle 0x1401cdf7a
movss xmm2, dword [0x1403795f4]
mov edx, 0xe
jmp 0x1401cdf8e
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
jne 0x1401cdf96
movaps xmm2, xmm9
mov edx, 0xf
mov rcx, rsi
call fcn.1400e5540
mov rcx, rsi
call fcn.1401c9920
test al, al
je 0x1401cdfe0
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cdfcf
mov edx, 4
mov rcx, rsi
call fcn.1400d9a80
test al, al
je 0x1401cdfcf
mov edx, 2
mov rcx, rsi
call fcn.1400d9a80
test al, al
jne 0x1401cdfe0
movaps xmm2, xmm9
mov edx, 0x10
mov rcx, rsi
call fcn.1400e5540
mov rcx, rsi
call fcn.1401c9a90
test al, al
je 0x1401ce00f
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
je 0x1401cdffe
movaps xmm2, xmm10
jmp 0x1401ce002
movaps xmm2, xmm9
mov edx, 0x11
mov rcx, rsi
call fcn.1400e5540
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401ce108
mov rdx, r13
lea rcx, [rsp + 0x78]
call fcn.1400d5970
nop
mov rdi, qword [r12 + 0x130]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401ce064
nop
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbx + 0x20]
call fcn.1402bcf6c
test eax, eax
jns 0x1401ce058
mov rbx, qword [rbx + 0x10]
jmp 0x1401ce05e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401ce040
cmp rdi, qword [r12 + 0x130]
je 0x1401ce087
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402bcf6c
test eax, eax
js 0x1401ce087
mov qword [rsp + 0x68], rdi
jmp 0x1401ce094
mov rax, qword [r12 + 0x130]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x68]
mov rbx, qword [rbx]
cmp rbx, qword [r12 + 0x130]
je 0x1401ce0f8
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d4470
nop
mov eax, dword [rsp + 0x64]
cmp dword [rbx + 0x3c], eax
jne 0x1401ce0d4
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x30]
call fcn.1402bcf6c
test eax, eax
sete al
test al, al
jne 0x1401ce0e6
movaps xmm2, xmm12
mov edx, 0x12
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ce0f8
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x80], 0
jle 0x1401ce108
mov rcx, qword [rsp + 0x78]
call fcn.1402bd0e0
mov eax, dword [rsi + 0x40]
shr rax, 0x15
lea r15, vtable.Core::Array_class_Core::String_.0
movss xmm14, dword [0x1403794c8]
movss xmm10, dword [0x140379368]
test al, 1
je 0x1401ce7eb
mov rdx, r13
lea rcx, [rbp - 0x10]
call fcn.1400e4760
nop
mov rdi, qword [r12 + 0xf0]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401ce173
nop
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbx + 0x20]
call fcn.1402bcf6c
test eax, eax
jns 0x1401ce167
mov rbx, qword [rbx + 0x10]
jmp 0x1401ce16d
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401ce150
cmp rdi, qword [r12 + 0xf0]
je 0x1401ce195
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rbp - 0x10]
call fcn.1402bcf6c
test eax, eax
js 0x1401ce195
mov qword [rsp + 0x68], rdi
jmp 0x1401ce1a2
mov rax, qword [r12 + 0xf0]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r12 + 0xf0]
je 0x1401ce1c9
movss xmm2, dword [0x14037947c]
mov edx, 0x15
mov rcx, rsi
call fcn.1400e5540
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d5970
nop
mov qword [rbp - 0x58], r15
xor ebx, ebx
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x48], rbx
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x14034bd50]
lea rcx, [rsp + 0x58]
call fcn.1402043f0
cmp dword [rbp - 0x50], 2
jg 0x1401ce306
mov rdx, r13
mov rcx, r12
call fcn.1401cc020
test al, al
jne 0x1401ce306
mov qword [rbp + 0x260], r15
mov dword [rbp + 0x268], ebx
mov qword [rbp + 0x270], rbx
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
nop
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x14034c088]
lea rcx, [rsp + 0x58]
call fcn.1402043f0
test eax, eax
jle 0x1401ce2b6
mov edi, dword [rbp + 0x268]
test edi, edi
jle 0x1401ce2b6
mov r14, qword [rbp + 0x270]
nop dword [rax]
nop word [rax + rax]
movsxd rcx, ebx
shl rcx, 4
add rcx, r14
mov r8d, 1
lea rdx, str.plug
call fcn.140202b80
test al, al
jne 0x1401ce2ef
inc ebx
cmp ebx, edi
jl 0x1401ce290
mov eax, dword [rsi + 0x40]
shr rax, 9
test al, 1
je 0x1401ce2cb
movss xmm2, dword [0x140379524]
jmp 0x1401ce2e1
mov rcx, rsi
call fcn.1400d2290
test al, al
je 0x1401ce2dd
movaps xmm2, xmm14
jmp 0x1401ce2e1
movaps xmm2, xmm9
mov edx, 0x14
mov rcx, rsi
call fcn.1400e5540
nop
mov qword [rbp + 0x260], r15
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
xor ebx, ebx
mov eax, dword [rsi + 0x40]
shr rax, 0xa
test al, 1
je 0x1401ce322
movaps xmm2, xmm13
mov edx, 0x13
mov rcx, rsi
call fcn.1400e5540
mov r8d, 2
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400d9930
nop
cmp dword [rbp - 0x7c], 0
jle 0x1401ce374
lea rdx, [rsp + 0x78]
mov rcx, qword [r12 + 8]
call fcn.1400fd310
test al, al
je 0x1401ce356
mov edx, 0x16
jmp 0x1401ce369
lea rcx, [rsp + 0x78]
call fcn.1401d0bc0
test al, al
je 0x1401ce374
mov edx, 0x1c
movaps xmm2, xmm6
mov rcx, rsi
call fcn.1400e5540
xor r12b, r12b
movdqa xmm0, xmmword [0x140379650]
movdqu xmmword [rbp + 0x260], xmm0
lea rdi, [rbp + 0x260]
nop
mov r8d, dword [rdi]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d9930
nop
xor r8d, r8d
lea rdx, str.TODO:
mov rcx, rax
call fcn.140202610
movzx r14d, al
cmp dword [rbp - 0x60], 0
jle 0x1401ce3c5
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
test r14b, r14b
jne 0x1401ce3db
inc ebx
add rdi, 4
movsxd rax, ebx
cmp rax, 4
jb 0x1401ce390
jmp 0x1401ce3de
mov r12b, 1
mov r8d, 3
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.1400d9930
nop
cmp dword [rbp - 0x6c], 0
jle 0x1401ce43c
mov r8d, 1
lea rdx, str.TODO:
lea rcx, [rbp - 0x78]
call fcn.140205020
test al, al
jne 0x1401ce42b
mov r8d, 1
lea rdx, str.aaaaa
lea rcx, [rbp - 0x78]
call fcn.140205020
test al, al
je 0x1401ce43c
movaps xmm2, xmm11
mov edx, 0x17
mov rcx, rsi
call fcn.1400e5540
xor r15b, r15b
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1400d9930
nop
cmp dword [rsp + 0x54], 0
je 0x1401ce604
mov r8d, 1
lea rdx, str.0.0.0.0
lea rcx, [rsp + 0x48]
call fcn.140202b80
lea r14, vtable.Core::Array_class_Core::String_.0
test al, al
jne 0x1401ce60b
mov qword [rbp + 0x260], r14
mov dword [rbp + 0x268], 0
mov qword [rbp + 0x270], 0
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
nop
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x14034bd50]
lea rcx, [rsp + 0x48]
call fcn.1402043f0
cmp eax, 2
jge 0x1401ce5ae
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x14035803c]
lea rcx, [rsp + 0x48]
call fcn.1402043f0
cmp eax, 2
jl 0x1401ce5ab
mov rdi, qword [0x14041eee8]
test rdi, rdi
jne 0x1401ce511
xor ebx, ebx
jmp 0x1401ce54a
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401ce515
test ebx, ebx
jle 0x1401ce54a
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x48]
call fcn.1402c06dc
jmp 0x1401ce551
cmp dword [rsp + 0x54], 0
jle 0x1401ce55d
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140203bb0
mov eax, dword [rbp + 0x268]
test eax, eax
jle 0x1401ce5ae
xor ebx, ebx
mov rdi, qword [rbp + 0x270]
mov r14d, eax
test rbx, rbx
jle 0x1401ce589
lea rdx, [0x14034bd50]
lea rcx, [rsp + 0x48]
call fcn.140200ef0
mov rdx, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.140200ef0
inc rbx
add rdi, 0x10
dec r14
jne 0x1401ce573
lea r14, vtable.Core::Array_class_Core::String_.0
jmp 0x1401ce5ae
mov r15b, 1
mov qword [rbp + 0x260], r14
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
test r15b, r15b
jne 0x1401ce60b
cmp dword [rbp - 0x6c], 0
jle 0x1401ce627
xor edi, edi
lea rbx, str.virus
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [rbp - 0x78]
call fcn.140202610
test al, al
jne 0x1401ce627
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, 5
jb 0x1401ce5e0
jmp 0x1401ce627
lea r14, vtable.Core::Array_class_Core::String_.0
movss xmm13, dword [0x140379418]
movaps xmm2, xmm13
mov edx, 0x18
mov rcx, rsi
call fcn.1400e5540
jmp 0x1401ce630
movss xmm13, dword [0x140379418]
cmp dword [rbp - 0x7c], 3
jl 0x1401ce67d
lea rcx, [rsp + 0x78]
call fcn.1401cc0e0
test al, al
jne 0x1401ce67d
mov r8d, 1
lea rdx, str.TODO:
lea rcx, [rsp + 0x78]
call fcn.140205020
test al, al
jne 0x1401ce67d
test r12b, r12b
jne 0x1401ce6be
mov r8d, 1
lea rdx, str.Microsoft_Corporation
lea rcx, [rsp + 0x78]
call fcn.140202b80
jmp 0x1401ce6be
mov r8d, 5
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d9930
cmp dword [rax + 0xc], 5
jle 0x1401ce69b
movaps xmm6, xmm10
jmp 0x1401ce69f
movaps xmm6, xmm13
cmp dword [rbp - 0x60], 0
jle 0x1401ce6ae
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
movaps xmm2, xmm6
mov edx, 0x1a
mov rcx, rsi
call fcn.1400e5540
mov rcx, rsi
call fcn.1401c9710
mov ebx, eax
test eax, eax
je 0x1401ce71d
cmp eax, 1
jne 0x1401ce6df
mov edx, eax
mov rcx, rsi
call fcn.1401c9690
test al, al
jne 0x1401ce71d
movd xmm6, ebx
cvtdq2ps xmm6, xmm6
mov edx, 8
mov rcx, rsi
call fcn.1401c9690
test al, al
jne 0x1401ce708
mov edx, 0x100
mov rcx, rsi
call fcn.1401c9690
test al, al
je 0x1401ce70d
mulss xmm6, xmm11
movaps xmm2, xmm6
mov edx, 0x1d
mov rcx, rsi
call fcn.1400e5540
mov edx, 0x200
mov rcx, rsi
call fcn.1401c9690
test al, al
je 0x1401ce73e
movaps xmm2, xmm7
mov edx, 0x43
mov rcx, rsi
call fcn.1400e5540
mov edx, 0x400
mov rcx, rsi
call fcn.1401c9690
test al, al
je 0x1401ce760
movaps xmm2, xmm13
mov edx, 0x44
mov rcx, rsi
call fcn.1400e5540
mov edx, 0x800
mov rcx, rsi
call fcn.1401c9690
test al, al
je 0x1401ce783
movaps xmm2, xmm13
mov edx, 0x45
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x50], 0
jle 0x1401ce795
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x70], 0
jle 0x1401ce7a5
mov rcx, qword [rbp - 0x78]
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x80], 0
jle 0x1401ce7b6
mov rcx, qword [rsp + 0x78]
call fcn.1402bd0e0
nop
mov qword [rbp - 0x58], r14
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ce7d8
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
nop
cmp dword [rbp - 8], 0
jle 0x1401ce7e7
mov rcx, qword [rbp - 0x10]
call fcn.1402bd0e0
mov r12, qword [rbp - 0x30]
call fcn.1401167f0
lea r14, [rsi + 0x20]
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
movsd xmm13, qword [0x140379558]
divsd xmm0, xmm13
cvtpd2ps xmm0, xmm0
xorps xmm6, xmm6
comiss xmm6, xmm0
jbe 0x1401ce832
movaps xmm2, xmm9
jmp 0x1401ce8cf
call fcn.1401167f0
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
comiss xmm12, xmm1
jbe 0x1401ce867
movaps xmm2, xmm11
jmp 0x1401ce8cf
call fcn.1401167f0
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
comiss xmm7, xmm1
ja 0x1401ce8cb
call fcn.1401167f0
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x140379524]
comiss xmm0, xmm1
jbe 0x1401ce8dc
movaps xmm2, xmm10
mov edx, 0x1e
mov rcx, rsi
call fcn.1400e5540
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cea13
mov rcx, rsi
call fcn.1400d9300
movss xmm7, dword [0x140379478]
comiss xmm7, xmm0
ja 0x1401cea1b
mov rcx, rsi
call fcn.1400d9300
mov rcx, rsi
comiss xmm12, xmm0
jbe 0x1401ce942
call fcn.1401c9710
movss xmm8, dword [0x140379418]
cmp eax, 2
jl 0x1401cea24
movaps xmm2, xmm8
mov edx, 0x20
mov rcx, rsi
call fcn.1400e5540
jmp 0x1401cea24
call fcn.1400d9300
comiss xmm8, xmm0
jbe 0x1401ce9a3
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401ce97c
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401ce97c
movaps xmm6, xmm10
cmp dword [rsi + 0x38], 0x400000
jb 0x1401ce98c
addss xmm6, xmm11
jmp 0x1401ce991
addss xmm6, xmm9
movaps xmm2, xmm6
mov edx, 0x20
mov rcx, rsi
call fcn.1400e5540
jmp 0x1401cea1b
mov rcx, rsi
call fcn.1400d9300
comiss xmm0, xmm8
jb 0x1401cea1b
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401ce9e0
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401ce9e0
movaps xmm6, xmm11
movss xmm8, dword [0x140379418]
cmp dword [rsi + 0x38], 0x400000
jb 0x1401ce9f9
addss xmm6, xmm8
jmp 0x1401cea01
addss xmm6, dword [0x1403794c0]
movaps xmm2, xmm6
mov edx, 0x20
mov rcx, rsi
call fcn.1400e5540
jmp 0x1401cea24
movss xmm7, dword [0x140379478]
movss xmm8, dword [0x140379418]
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cebf6
mov edx, 6
mov rcx, rsi
call fcn.1400d9a80
test al, al
je 0x1401ceacb
mov r8d, 6
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1400d9930
nop
cmp dword [rsp + 0x64], 0
je 0x1401ceaba
mov rbx, qword [rsp + 0x58]
mov r8d, 0xa
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.1402c04e8
mov rdx, qword [rsp + 0x68]
sub rdx, rbx
sar rdx, 1
movsxd rcx, dword [rsp + 0x64]
cmp rdx, rcx
jne 0x1401ceaba
lea ecx, [rax + 0x7fffffff]
cmp ecx, 0xfffffffd
ja 0x1401ceaba
dec eax
cmp eax, 0x2fe
ja 0x1401ceaba
movss xmm2, dword [0x140379524]
mov edx, 0x25
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ceacb
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x10
test al, 1
je 0x1401ceb93
shr rcx, 0x26
test cl, 1
je 0x1401ceafc
movss xmm2, dword [0x140379568]
mov edx, 0x21
mov rcx, rsi
call fcn.1400e5540
movss xmm2, dword [0x140379520]
mov edx, 0x24
mov rcx, rsi
call fcn.1400e5540
xor r15d, r15d
mov qword [rbp - 0x80], r15
lea edx, [r15 + 0x16]
lea rcx, [rsp + 0x78]
call fcn.1402028a0
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
lea r9d, [r15 + 0x16]
lea r8, str.Labels_EwsAuthenticode
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
lea edx, [r15 + 0x16]
lea rcx, [rsp + 0x78]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.1400f6d90
nop
cmp dword [rbp - 0x80], r15d
jle 0x1401ceb72
mov rcx, qword [rsp + 0x78]
call fcn.1402bd0e0
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.14016b280
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cebf9
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
jmp 0x1401cebf9
mov rax, rcx
shr rax, 0x1a
test al, 1
je 0x1401cebf6
mov rax, rcx
shr rax, 0x26
test al, 1
je 0x1401cebbb
movss xmm2, dword [0x140379568]
mov edx, 0x21
mov rcx, rsi
jmp 0x1401cebf1
shr rcx, 0x11
test cl, 1
mov rcx, rsi
je 0x1401cebe4
call fcn.1400d2290
test al, al
je 0x1401cebd6
movaps xmm2, xmm12
jmp 0x1401cebda
movaps xmm2, xmm8
mov edx, 0x26
mov rcx, rsi
jmp 0x1401cebf1
movss xmm2, dword [0x14037960c]
mov edx, 0x22
call fcn.1400e5540
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cec57
shr rcx, 0x1a
test cl, 1
je 0x1401cec57
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e4760
nop
xor r8d, r8d
lea rdx, str..cpl
mov rcx, rax
call fcn.140202b80
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401cec42
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
test bl, bl
je 0x1401cec57
movaps xmm2, xmm8
mov edx, 0x23
mov rcx, rsi
call fcn.1400e5540
mov rcx, rsi
call fcn.1400d2290
mov edi, 0x5c
test al, al
je 0x1401cf1c4
mov rcx, rsi
call fcn.1400d9d60
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d9d60
cmp rbx, qword [rax]
je 0x1401cf0b1
movss xmm15, dword [0x140379524]
mov r14d, edi
nop word [rax + rax]
mov qword [rsp + 0x50], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401cecbe
lea rax, [0x14034d1a0]
mov qword [rsp + 0x48], rax
jmp 0x1401cece3
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.140203bb0
nop
mov r8d, 1
lea rdx, [0x14034be44]
lea rcx, [rsp + 0x48]
call fcn.140205020
test al, al
je 0x1401ceff3
mov edx, r14d
mov rcx, qword [rsp + 0x48]
call fcn.1402c0274
mov rdi, rax
test rax, rax
je 0x1401cefbf
sub rdi, qword [rsp + 0x48]
sar rdi, 1
test edi, edi
jle 0x1401cefbf
mov r8d, 1
lea rdx, [0x14034c0a0]
lea rcx, [rsp + 0x48]
call fcn.140205020
test al, al
je 0x1401ced67
lea r8d, [rdi + 1]
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.140202eb0
mov edi, eax
test edi, edi
jle 0x1401cefbf
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.140204810
nop
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x78]
call fcn.140205020
test al, al
jne 0x1401cef5b
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun
lea rcx, [rsp + 0x78]
call fcn.140205020
test al, al
jne 0x1401cef5b
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
lea rcx, [rsp + 0x78]
call fcn.140205020
lea rcx, [rsp + 0x78]
test al, al
je 0x1401ceec1
mov r8d, 0x36
lea rdx, [rsp + 0x58]
call fcn.140204810
nop
xor r8d, r8d
lea rdx, str.Notify_
lea rcx, [rsp + 0x58]
call fcn.140205020
test al, al
je 0x1401cee20
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cee16
movaps xmm2, xmm11
jmp 0x1401cee19
movaps xmm2, xmm7
mov edx, 0x2d
jmp 0x1401cee9e
xor r8d, r8d
lea rdx, str.Shell
lea rcx, [rsp + 0x58]
call fcn.140202b80
test al, al
jne 0x1401cee68
xor r8d, r8d
lea rdx, str.UserInit
lea rcx, [rsp + 0x58]
call fcn.140202b80
test al, al
jne 0x1401cee68
xor r8d, r8d
lea rdx, str.System
lea rcx, [rsp + 0x58]
call fcn.140202b80
test al, al
je 0x1401ceea7
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x30
test al, 1
je 0x1401cee86
shr rcx, 0x15
test cl, 1
je 0x1401cee95
movaps xmm2, xmm15
jmp 0x1401cee99
shr rcx, 0x1a
test cl, 1
je 0x1401cee95
movaps xmm2, xmm8
jmp 0x1401cee99
movaps xmm2, xmm12
mov edx, 0x2e
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cefaf
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
jmp 0x1401cefaf
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindowsAppInit_DLLs
call fcn.140202b80
test al, al
je 0x1401ceef3
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401ceee5
movaps xmm2, xmm8
jmp 0x1401ceee9
movaps xmm2, xmm12
mov edx, 0x2f
jmp 0x1401cefa6
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
lea rcx, [rsp + 0x78]
call fcn.140202b80
test al, al
je 0x1401cef27
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cef1c
movaps xmm2, xmm8
jmp 0x1401cef20
movaps xmm2, xmm12
mov edx, 0x30
jmp 0x1401cefa6
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
lea rcx, [rsp + 0x78]
call fcn.140205020
test al, al
je 0x1401cefaf
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cef50
movaps xmm2, xmm11
jmp 0x1401cef54
movaps xmm2, xmm12
mov edx, 0x31
jmp 0x1401cefa6
movaps xmm6, xmm8
movsxd rax, dword [r12 + 0x1e4]
cmp dword [r13 + 0xc], eax
jl 0x1401cef9e
mov r8, rax
mov rdx, qword [r12 + 0x1d8]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401cef9e
mov edx, 4
mov rcx, rsi
call fcn.1401c6280
test al, al
jne 0x1401cef9e
movaps xmm6, xmm7
movaps xmm2, xmm6
mov edx, 0x2c
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rbp - 0x80], 0
jle 0x1401cefbf
mov rcx, qword [rsp + 0x78]
call fcn.1402bd0e0
xor r8d, r8d
lea rdx, str.HKLMSYSTEMCurrentControlSetControlSecurityProvidersSecurityProviders
lea rcx, [rsp + 0x48]
call fcn.140205020
test al, al
je 0x1401cf029
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cefe8
movaps xmm2, xmm8
jmp 0x1401cefec
movaps xmm2, xmm12
mov edx, 0x32
jmp 0x1401cf020
lea rdx, [rsp + 0x48]
mov rcx, qword [r12 + 8]
call fcn.1400fc050
test al, al
je 0x1401cf029
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cf017
movaps xmm2, xmm10
jmp 0x1401cf01b
movaps xmm2, xmm9
mov edx, 0x33
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x50], 0
jle 0x1401cf03a
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
cmp byte [rbx + 0x19], 0
jne 0x1401cf08e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cf06e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cf08e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cf060
jmp 0x1401cf08e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cf08b
cmp rbx, qword [rax + 0x10]
jne 0x1401cf08b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cf078
mov rbx, rax
mov rcx, rsi
call fcn.1400d9d60
cmp rbx, qword [rax]
jne 0x1401ceca0
movss xmm15, dword [0x1403795f8]
lea r14, [rsi + 0x20]
mov edi, 0x5c
mov rcx, rsi
call fcn.1400d9d60
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d9d60
cmp rbx, qword [rax]
je 0x1401cf1c4
lea rdi, [0x14034d1a0]
nop word [rax + rax]
mov qword [rbp - 0x70], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401cf0f5
mov qword [rbp - 0x78], rdi
jmp 0x1401cf117
lea rcx, [rbp - 0x78]
call fcn.1402028a0
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.1402c06dc
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.140203bb0
nop
mov r8d, 1
lea rdx, [0x14034be44]
lea rcx, [rbp - 0x78]
call fcn.140205020
test al, al
je 0x1401cf155
mov r8d, 1
lea rdx, str._shellopencommand_
lea rcx, [rbp - 0x78]
call fcn.140202750
nop
cmp dword [rbp - 0x70], 0
jle 0x1401cf164
mov rcx, qword [rbp - 0x78]
call fcn.1402bd0e0
cmp byte [rbx + 0x19], 0
jne 0x1401cf1ae
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cf18e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cf1ae
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cf180
jmp 0x1401cf1ae
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cf1ab
cmp rbx, qword [rax + 0x10]
jne 0x1401cf1ab
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cf198
mov rbx, rax
mov rcx, rsi
call fcn.1400d9d60
cmp rbx, qword [rax]
jne 0x1401cf0e0
mov edi, 0x5c
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 9
test al, 1
je 0x1401cf1f1
shr rcx, 0x1a
test cl, 1
jne 0x1401cf1e0
movaps xmm10, xmm8
movaps xmm2, xmm10
mov edx, 0x34
mov rcx, rsi
call fcn.1400e5540
xor r15b, r15b
mov byte [rsp + 0x40], r15b
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x26
movss xmm7, dword [0x140379610]
test al, 1
jne 0x1401cf58b
mov rax, rcx
shr rax, 0x20
test al, 1
jne 0x1401cf58b
mov rax, rcx
shr rax, 0x22
test al, 1
jne 0x1401cf58b
shr rcx, 0xa
test cl, 1
jne 0x1401cf58b
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e4760
nop
mov r8d, 1
lea rdx, str..cpl
mov rcx, rax
call fcn.140202b80
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401cf273
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
test bl, bl
jne 0x1401cf58b
mov rdx, r13
lea rcx, [rsp + 0x68]
call fcn.1400d4470
nop
xorps xmm8, xmm8
movaps xmm6, xmm8
mov rdx, r13
mov rcx, qword [r12 + 8]
call fcn.1400f77c0
test al, al
je 0x1401cf2af
movss xmm6, dword [0x140379618]
jmp 0x1401cf3ee
mov qword [rsp + 0x50], 0
mov edx, dword [rsp + 0x74]
test edx, edx
jne 0x1401cf2ce
lea rax, [0x14034d1a0]
mov qword [rsp + 0x48], rax
jmp 0x1401cf2f9
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd r9, dword [rsp + 0x74]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call fcn.1402c06dc
mov edx, dword [rsp + 0x74]
lea rcx, [rsp + 0x48]
call fcn.140203bb0
nop
cmp dword [rsp + 0x54], 3
jle 0x1401cf3d1
lea rdx, [rsp + 0x48]
mov rcx, qword [r12 + 8]
call fcn.1400f7880
test al, al
jne 0x1401cf3b0
cmp dword [rsp + 0x54], 0
je 0x1401cf3d1
mov edx, edi
mov rcx, qword [rsp + 0x48]
call fcn.1402c00ac
test rax, rax
je 0x1401cf3d1
sub rax, qword [rsp + 0x48]
sar rax, 1
test eax, eax
js 0x1401cf3d1
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.1400d4470
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsp + 0x50]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x48]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x48]
call fcn.140203bb0
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cf304
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
jmp 0x1401cf304
xor r8d, r8d
lea rdx, str.ExpertHelper
lea rcx, [rsp + 0x68]
call fcn.140202610
test al, al
je 0x1401cf3ce
movaps xmm6, xmm15
jmp 0x1401cf3d1
movaps xmm6, xmm7
cmp dword [rsp + 0x50], 0
jle 0x1401cf3e2
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
ucomiss xmm6, xmm8
jp 0x1401cf3ee
je 0x1401cf571
cmp dword [rsp + 0x74], 3
jle 0x1401cf571
mov edx, edi
mov r8d, 3
lea rcx, [rsp + 0x68]
call fcn.140202eb0
cmp eax, 0xffffffff
je 0x1401cf571
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1c4], eax
jne 0x1401cf441
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1b8]
call fcn.1402bcf6c
test eax, eax
sete al
test al, al
jne 0x1401cf571
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1d4], eax
jne 0x1401cf46e
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1c8]
call fcn.1402bcf6c
test eax, eax
sete al
test al, al
jne 0x1401cf571
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1e4], eax
jne 0x1401cf49b
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1d8]
call fcn.1402bcf6c
test eax, eax
sete al
test al, al
jne 0x1401cf571
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1f4], eax
jne 0x1401cf4c8
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1e8]
call fcn.1402bcf6c
test eax, eax
sete al
test al, al
jne 0x1401cf571
mov rax, qword [r12 + 0x140]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401cf558
nop dword [rax]
movsxd rax, dword [rbx + 0x2c]
cmp dword [rsp + 0x74], eax
jl 0x1401cf504
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x68]
call fcn.1402beee8
test eax, eax
sete al
test al, al
jne 0x1401cf571
cmp byte [rbx + 0x19], 0
jne 0x1401cf54e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cf52e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cf54e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cf520
jmp 0x1401cf54e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cf54b
cmp rbx, qword [rax + 0x10]
jne 0x1401cf54b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cf538
mov rbx, rax
cmp rbx, qword [r12 + 0x140]
jne 0x1401cf4e0
mov r15b, 1
mov byte [rsp + 0x40], r15b
movaps xmm2, xmm6
mov edx, 0x35
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x70], 0
jle 0x1401cf582
mov rcx, qword [rsp + 0x68]
call fcn.1402bd0e0
test r15b, r15b
jne 0x1401cfbcf
movsxd rax, dword [r12 + 0x1d4]
cmp dword [r13 + 0xc], eax
jl 0x1401cf5ba
mov r8, rax
mov rdx, qword [r12 + 0x1c8]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
jne 0x1401cfbcf
movsxd rax, dword [r12 + 0x1c4]
cmp dword [r13 + 0xc], eax
jl 0x1401cfbcf
mov r8, rax
mov rdx, qword [r12 + 0x1b8]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401cfbcf
mov eax, dword [rsi + 0x14]
cmp eax, dword [r12 + 0x1c4]
jle 0x1401cfbcf
xor edx, edx
mov r14d, edx
mov dword [rbp - 0x40], edx
cmp dword [r12 + 0x158], edx
jl 0x1401cfbcb
mov r15d, edx
mov qword [rbp], rdx
mov r13, 0xfffffffffffffff0
mov qword [rbp - 0x38], r13
lea rcx, [0x14034c0a8]
movss xmm8, dword [0x140379614]
nop word [rax + rax]
lea rdi, [0x14034c0a0]
test r14d, r14d
cmove rdi, rcx
test rdi, rdi
jne 0x1401cf65c
mov ebx, edx
mov qword [rsp + 0x50], rdi
jmp 0x1401cf677
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401cf660
mov qword [rsp + 0x50], 0
test ebx, ebx
jne 0x1401cf685
lea rax, [0x14034d1a0]
mov qword [rsp + 0x48], rax
jmp 0x1401cf6aa
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x48]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140203bb0
nop
test r15, r15
jle 0x1401cf747
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd rcx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.140203bb0
mov rdi, qword [r12 + 0x160]
mov ebx, dword [rsp + 0x54]
add ebx, dword [r13 + rdi + 0xc]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd r9, dword [r13 + rdi + 0xc]
mov ecx, dword [rsp + 0x50]
movsxd rax, dword [rsp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [r13 + rdi]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140203bb0
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1402028a0
movsxd rcx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.140203bb0
lea rdx, [0x140355100]
lea rcx, [rsp + 0x48]
call fcn.140200ef0
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400ed8e0
mov r12, rax
test rax, rax
je 0x1401cfb7c
mov rax, qword [rbp - 0x30]
mov r8d, dword [rax + 0x1c4]
inc r8d
lea rdx, [rbp - 0x68]
lea rcx, [rsi + 8]
call fcn.140204810
nop
lea rdi, vtable.Core::Array_class_Core::String_.0
mov qword [rbp - 0x58], rdi
xor ebx, ebx
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x48], rbx
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x14034c088]
lea rcx, [rbp - 0x68]
call fcn.1402043f0
test eax, eax
jle 0x1401cfb4d
lea rax, [0x14034d1a0]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rbx
mov eax, ebx
cmp dword [rbp - 0x50], 2
setg al
inc eax
mov r14d, ebx
movsxd r15, eax
test eax, eax
jle 0x1401cfb35
mov r13, qword [rbp - 0x48]
lea rdi, [r13 + 0xc]
cmp dword [rdi], 3
jle 0x1401cf857
movsxd rdx, r14d
shl rdx, 4
add rdx, r13
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax + 8]
call fcn.1400f7360
test al, al
jne 0x1401cf868
inc r14d
inc rbx
add rdi, 0x10
cmp rbx, r15
jge 0x1401cf8a2
jmp 0x1401cf837
shl rbx, 4
add rbx, r13
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.140203bb0
cmp dword [rbp - 0x7c], 0
jle 0x1401cfb2a
movaps xmm6, xmm7
mov byte [rsp + 0x40], 1
mov eax, dword [rsi + 0x40]
bt rax, 8
jb 0x1401cf8d9
xor r8d, r8d
lea rdx, str..dll
lea rcx, [rsi + 8]
call fcn.140202750
test al, al
je 0x1401cf8d9
movaps xmm6, xmm8
xor r15d, r15d
mov qword [rbp - 0x10], r15
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401cfb2a
lea ecx, [rax + 0x10]
call fcn.1402bcb4c
mov rdi, rax
lea r14, vtable.Core::Win32::RegistryKey.0
test rax, rax
je 0x1401cf92e
mov rax, qword [rbp - 0x10]
mov qword [rdi], r14
mov qword [rdi + 8], rax
jmp 0x1401cf931
mov rdi, r15
test rdi, rdi
je 0x1401cfb2a
lea rbx, [0x14034d1a0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r15
lea r8, [rbp - 0x78]
lea rdx, str.Publisher
mov rcx, rdi
call fcn.1400d9fd0
xor r8d, r8d
lea rdx, str.virus
lea rcx, [rbp - 0x78]
call fcn.140202610
test al, al
jne 0x1401cfb08
xor r8d, r8d
lea rdx, str.anti
lea rcx, [rbp - 0x78]
call fcn.140202610
test al, al
jne 0x1401cfb08
movaps xmm2, xmm6
mov edx, 0x35
mov rcx, rsi
call fcn.1400e5540
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r15
lea r8, [rsp + 0x58]
lea rdx, str.DisplayName
mov rcx, rdi
call fcn.1400d9fd0
test al, al
je 0x1401cfaf5
mov eax, dword [rbp - 0x6c]
test eax, eax
jne 0x1401cfa0a
lea edx, [rax + 9]
lea rcx, [rbp - 0x78]
call fcn.1402028a0
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 9
lea r8, [0x1403697a8]
mov rcx, qword [rbp - 0x78]
call fcn.1402c06dc
mov edx, 9
lea rcx, [rbp - 0x78]
call fcn.140203bb0
mov eax, dword [rbp - 0x6c]
cmp eax, 3
jle 0x1401cfaf5
cmp dword [rsp + 0x64], 3
jle 0x1401cfaf5
mov r9, qword [rsp + 0x58]
mov r8, qword [rbp - 0x78]
lea rdx, str.SOFTWARE_ws_ws
lea rcx, [rbp + 0x260]
call fcn.140202d40
mov rbx, rax
mov ecx, dword [0x140431ad8]
test cl, 1
jne 0x1401cfa6f
or ecx, 1
mov dword [0x140431ad8], ecx
mov qword [0x140431ae0], r14
mov qword [0x140431ae8], 0xffffffff80000001
lea rcx, [0x1403050e0]
call fcn.1402be804
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [0x140431ae8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401cfab9
lea ecx, [rax + 0x10]
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x1401cfab9
mov rax, qword [rsp + 0x68]
mov qword [rbx], r14
mov qword [rbx + 8], rax
jmp 0x1401cfabc
mov rbx, r15
cmp dword [rbp + 0x268], 0
jle 0x1401cfad1
mov rcx, qword [rbp + 0x260]
call fcn.1402bd0e0
test rbx, rbx
je 0x1401cfaf5
movaps xmm2, xmm15
mov edx, 0x36
mov rcx, rsi
call fcn.1400e5540
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cfb0d
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
jmp 0x1401cfb0d
mov byte [rsp + 0x40], 0
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp - 0x70], 0
jle 0x1401cfb2a
mov rcx, qword [rbp - 0x78]
call fcn.1402bd0e0
mov r13, qword [rbp - 0x38]
lea rdi, vtable.Core::Array_class_Core::String_.0
cmp dword [rbp - 0x80], 0
jle 0x1401cfb45
mov rcx, qword [rsp + 0x78]
call fcn.1402bd0e0
mov r15, qword [rbp]
mov r14d, dword [rbp - 0x40]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp - 0x58], rdi
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cfb7c
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x50], 0
jle 0x1401cfb8d
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
inc r14d
mov dword [rbp - 0x40], r14d
inc r15
mov qword [rbp], r15
add r13, 0x10
mov qword [rbp - 0x38], r13
mov r12, qword [rbp - 0x30]
cmp r14d, dword [r12 + 0x158]
lea rcx, [0x14034c0a8]
mov edx, 0
jle 0x1401cf640
movzx r15d, byte [rsp + 0x40]
lea r13, [rsi + 8]
lea r14, [rsi + 0x20]
xor dil, dil
mov edx, 7
mov rcx, rsi
call fcn.1400d9a80
test al, al
jne 0x1401cfca5
mov rcx, rsi
call fcn.1400d9300
movss xmm6, dword [0x14037947c]
comiss xmm6, xmm0
ja 0x1401cfcad
cmp dword [rsi + 0x38], 0x500000
jae 0x1401cfcad
call fcn.1401167f0
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm0, xmm0
comiss xmm0, dword [0x140379520]
ja 0x1401cfcad
lea rax, [0x14034d1a0]
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.1400d8ed0
nop
lea r9, [rsp + 0x58]
mov r8, rax
mov rdx, r13
mov rcx, qword [r12 + 0x228]
call fcn.1401fcd00
nop
test al, al
je 0x1401cfc92
mov dil, 1
lea r8, [rsp + 0x58]
mov edx, 7
mov rcx, rsi
call fcn.14000b8f0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cfcad
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
jmp 0x1401cfcad
movss xmm6, dword [0x14037947c]
mov edx, 7
mov rcx, rsi
call fcn.1400d9a80
test al, al
je 0x1401cfd2a
mov r8d, 7
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d9930
nop
mov byte [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x68]
mov rcx, r12
call fcn.1401d0780
movzx ebx, byte [rsp + 0x40]
test al, al
je 0x1401cfd09
test bl, bl
je 0x1401cfd0d
movss xmm2, dword [0x1403794c0]
mov edx, 0x38
mov rcx, rsi
call fcn.1400e5540
test bl, bl
jne 0x1401cfd1b
test dil, dil
je 0x1401cfd1b
mov rcx, rsi
call fcn.1401c9c40
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cfd2a
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
test r15b, r15b
je 0x1401cfea9
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400d4470
nop
lea r14, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.1.0
mov qword [rbp + 0x260], r14
lea r15, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.0
mov qword [rbp + 0x268], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
xor edi, edi
mov dword [rbp + 0x280], edi
lea r8, [rbp + 0x260]
lea rdx, [rbp - 0x68]
mov rcx, qword [r12 + 8]
call fcn.1400f7a90
test al, al
je 0x1401cfe7f
lea ecx, [rdi + 0x18]
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x1401cfdb7
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
mov qword [rbx], rax
lea rax, [rbp + 0x260]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rdi
jmp 0x1401cfdba
mov rbx, rdi
lea rax, vtable.Core::SharedPtr_class_Core::Collections::Generic::IEnumerator_class_Core::String__.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
test rbx, rbx
je 0x1401cfdfc
mov ecx, 4
call fcn.1402bcb4c
mov rdi, rax
test rax, rax
je 0x1401cfdf0
mov dword [rax], 0
mov qword [rbp - 0x48], rax
jmp 0x1401cfdf6
xor edi, edi
mov qword [rbp - 0x48], rdi
mov dword [rdi], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
je 0x1401cfe5a
nop dword [rax + rax]
mov byte [rsp + 0x40], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r8, rax
lea r9, [rsp + 0x40]
mov rcx, r12
call fcn.1401d0780
test al, al
je 0x1401cfe4e
cmp byte [rsp + 0x40], 0
je 0x1401cfe4e
movss xmm2, dword [0x1403794c0]
mov edx, 0x39
mov rcx, rsi
call fcn.1400e5540
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
jne 0x1401cfe10
test rdi, rdi
je 0x1401cfe7f
mov eax, dword [rdi]
test eax, eax
jle 0x1401cfe69
dec eax
mov dword [rdi], eax
cmp dword [rdi], 0
jne 0x1401cfe7f
mov rcx, rbx
call fcn.14021ae20
mov rcx, rdi
call fcn.14021ae20
nop
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x268], r15
lea rcx, [rbp + 0x268]
call fcn.14011bb40
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cfea9
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.1400d9c10
nop
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.14000a400
nop
mov rdx, rax
lea rcx, [r12 + 0xd0]
call fcn.14000a580
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x260]
lea rcx, [r12 + 0xd0]
call fcn.1401d12d0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401cff05
mov rcx, qword [rbp - 0x58]
call fcn.1402bd0e0
mov edx, 7
mov rcx, rsi
call fcn.1400d9a80
test al, al
je 0x1401d00eb
mov rdx, qword [r13]
lea rcx, str.INTERNET_FILE:__ws_r_n
call fcn.1402bd818
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.14000a400
nop
mov rdx, rax
lea rcx, [r12 + 0xc0]
call fcn.14000a580
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x260]
lea rcx, [r12 + 0xc0]
call fcn.1401d12d0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401cff79
mov rcx, qword [rbp - 0x58]
call fcn.1402bd0e0
mov rbx, qword [r12 + 0xd0]
mov r8, qword [rbx + 8]
cmp byte [r8 + 0x19], 0
jne 0x1401cffd0
nop dword [rax]
mov rax, qword [r8 + 0x20]
mov r9, qword [rbp - 0x28]
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x1401cffb4
add rax, 2
test ecx, ecx
jne 0x1401cffa0
test edx, edx
jns 0x1401cffbe
mov r8, qword [r8 + 0x10]
jmp 0x1401cffc4
mov rbx, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], 0
je 0x1401cff90
nop dword [rax + rax]
mov r10, qword [r12 + 0xd0]
mov r8, qword [r10 + 8]
cmp byte [r8 + 0x19], 0
jne 0x1401d002b
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp - 0x28]
mov r9, qword [r8 + 0x20]
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x1401d0014
add rax, 2
test ecx, ecx
jne 0x1401d0000
test edx, edx
jns 0x1401d0020
mov r10, r8
mov r8, qword [r8]
jmp 0x1401d0024
mov r8, qword [r8 + 0x10]
cmp byte [r8 + 0x19], 0
je 0x1401cfff0
cmp rbx, r10
je 0x1401d0219
mov rdi, qword [rbx + 0x30]
cmp rdi, rsi
je 0x1401d008d
mov edx, 7
mov rcx, rdi
call fcn.1400d9a80
test al, al
jne 0x1401d008d
mov rdx, qword [rdi + 8]
lea rcx, str.RE_QUEUEING:__s_r_n
call fcn.1402bf424
mov rax, qword [rbx + 0x30]
mov edx, dword [rax + 0x38]
lea rcx, str._tSize_u_r_n
call fcn.1402bf424
mov rdx, qword [rbp - 0x28]
lea rcx, str._tHash_s_r_n
call fcn.1402bf424
mov rdx, qword [rbx + 0x30]
mov rcx, r12
call fcn.1401ca880
cmp byte [rbx + 0x19], 0
jne 0x1401cffd0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401d00c2
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cffd0
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401d00b1
jmp 0x1401cffd0
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401d00e3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401d00e3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401d00d0
mov rbx, rax
jmp 0x1401cffd0
cmp qword [r12 + 0xc8], 0
jbe 0x1401d0219
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x18]
lea rcx, [r12 + 0xc0]
call fcn.1400c8c90
mov rax, qword [rax]
cmp rax, qword [r12 + 0xc0]
je 0x1401d0219
mov rbx, qword [rax + 0x30]
mov r8, qword [rbx + 8]
mov rdx, qword [r13]
lea rcx, str.FILE_CAME_FROM_INTERNET_r_n_ws_r_n_ws_r_n
call fcn.1402bd818
mov edx, 0xb
mov rcx, rsi
call fcn.1400d93d0
mov rdx, r13
mov rcx, r12
test al, al
je 0x1401d0163
call fcn.1401cc020
movss xmm13, dword [0x140379418]
test al, al
jne 0x1401d017b
jmp 0x1401d017f
call fcn.1401cc020
movss xmm13, dword [0x140379418]
test al, al
je 0x1401d017b
movaps xmm14, xmm13
jmp 0x1401d017f
movaps xmm14, xmm6
movaps xmm2, xmm14
mov edx, 0x3a
mov rcx, rsi
call fcn.1400e5540
mov r8d, 7
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400d9930
nop
cmp dword [rsp + 0x64], 0
jle 0x1401d0206
mov edx, 7
mov rcx, rsi
call fcn.1400d9a80
test al, al
jne 0x1401d01ce
lea r8, [rsp + 0x58]
mov edx, 7
mov rcx, rsi
call fcn.14000b8f0
mov byte [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x58]
mov rcx, r12
call fcn.1401d0780
test al, al
je 0x1401d0206
cmp byte [rsp + 0x40], 0
je 0x1401d0206
movss xmm2, dword [0x1403794c0]
mov edx, 0x38
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rsp + 0x60], 0
jle 0x1401d0222
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
jmp 0x1401d0222
movss xmm13, dword [0x140379418]
mov edx, 7
mov rcx, rsi
call fcn.1400d93d0
test al, al
je 0x1401d0293
mov edx, 9
mov rcx, rsi
call fcn.1400d93d0
test al, al
je 0x1401d0293
mov eax, dword [rsi + 0x40]
shr rax, 9
test al, 1
jne 0x1401d0293
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e4760
nop
xor r8d, r8d
lea rdx, str..sys
lea rcx, [rbp - 0x68]
call fcn.140202b80
test al, al
je 0x1401d0284
movaps xmm2, xmm6
mov edx, 0x37
mov rcx, rsi
call fcn.1400e5540
nop
cmp dword [rbp - 0x60], 0
jle 0x1401d0293
mov rcx, qword [rbp - 0x68]
call fcn.1402bd0e0
mov eax, dword [rsi + 0x40]
shr rax, 0x1c
test al, 1
je 0x1401d02c0
mov edx, 0x800
mov rcx, rsi
call fcn.1401c6280
test al, al
je 0x1401d02c0
movaps xmm2, xmm13
mov edx, 0x41
mov rcx, rsi
call fcn.1400e5540
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401d0426
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401d0426
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402beee8
test eax, eax
sete al
test al, al
je 0x1401d0426
xor r8d, r8d
lea rdx, str.services.exe
mov rcx, r13
call fcn.140202750
test al, al
je 0x1401d0426
xor eax, eax
mov qword [rbp - 0x80], rax
lea edx, [rax + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1402028a0
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0xc
lea r8, str.services.exe
mov rcx, qword [rsp + 0x78]
call fcn.1402c06dc
mov edx, 0xc
lea rcx, [rsp + 0x78]
call fcn.140203bb0
nop
lea r8, [rsp + 0x78]
lea rdx, [r12 + 0x178]
lea rcx, [rsp + 0x58]
call fcn.1400d4050
nop
cmp dword [rbp - 0x80], 0
jle 0x1401d0386
mov rcx, qword [rsp + 0x78]
call fcn.1402bd0e0
mov eax, dword [r13 + 0xc]
cmp dword [rsp + 0x64], eax
jne 0x1401d0415
mov rdx, qword [r13]
mov rcx, qword [rsp + 0x58]
call fcn.1402bcf6c
test eax, eax
sete al
test al, al
je 0x1401d0415
mov eax, dword [rsi + 0x40]
shr rax, 0xe
movss xmm6, dword [0x140379524]
test al, 1
jne 0x1401d03e6
cmp byte [r12 + 0x30], 0
je 0x1401d03e6
movaps xmm2, xmm6
mov edx, 0x40
mov rcx, rsi
call fcn.1400e5540
movabs rbx, 0x2000000000
or qword [rsi + 0x40], rbx
jmp 0x1401d03f0
movabs rbx, 0x2000000000
mov edx, 0x800
mov rcx, rsi
call fcn.1401c6280
test al, al
je 0x1401d0415
movaps xmm2, xmm6
mov edx, 0x42
mov rcx, rsi
call fcn.1400e5540
or qword [rsi + 0x40], rbx
cmp dword [rsp + 0x60], 0
jle 0x1401d0426
mov rcx, qword [rsp + 0x58]
call fcn.1402bd0e0
cmp byte [r12 + 0x31], 0
je 0x1401d0437
mov rcx, rsi
call fcn.1401d04b0
nop
cmp dword [rbp - 0x20], 0
jle 0x1401d0446
mov rcx, qword [rbp - 0x28]
call fcn.1402bd0e0
mov al, 1
mov rcx, qword [rbp + 0x288]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret