Function at 0x1400ffcf0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7c0
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x800], rbx
mov rax, qword [0x14028c238]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
mov qword [rbp - 0x20], r8
mov r13, rdx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 8], rdx
xor r15d, r15d
mov r14d, r15d
mov dword [rsp + 0x48], r15d
lea r12, vtable.WaJson.0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x48], r15d
mov byte [rbp - 0x48], r15b
mov dword [rbp - 0x50], 5
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x68], r15d
mov byte [rsp + 0x68], r15b
mov dword [rsp + 0x60], 5
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r15
mov dword [rbp - 0x30], r15d
mov byte [rbp - 0x30], r15b
mov dword [rbp - 0x38], 5
mov rbx, qword [fcn.1400c54b0]
mov rcx, rbx
call qword [fcn.140005fb0]
lea rcx, [rsp + 0x58]
call rbx
mov dword [rsp + 0x60], 3
lea ecx, [r15 + 0x18]
call fcn.14016e754
mov qword [rsp + 0x50], rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x308], 7
mov qword [rbp + 0x300], r15
mov word [rbp + 0x2f0], r15w
mov qword [rbp + 0x450], 7
mov qword [rbp + 0x448], r15
mov word [rbp + 0x438], r15w
mov qword [rbp + 0x1a8], 7
mov qword [rbp + 0x1a0], r15
mov word [rbp + 0x190], r15w
mov qword [rbp + 0x2e8], 7
mov qword [rbp + 0x2e0], r15
mov word [rbp + 0x2d0], r15w
mov qword [rbp + 0x2a8], 7
mov qword [rbp + 0x2a0], r15
mov word [rbp + 0x290], r15w
lea rcx, [rbp + 0x2f0]
call fcn.1400fda40
test eax, eax
js 0x14010194b
lea r8, str.Logs_
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x210]
call fcn.1400e1f60
mov rbx, rax
lea rax, [rbp + 0x2d0]
cmp rax, rbx
je 0x1400ffee0
mov r8, qword [rbp + 0x2e8]
cmp r8, 8
jb 0x1400ffeb6
inc r8
mov rdx, qword [rbp + 0x2d0]
lea rcx, [rbp + 0x2d0]
call fcn.1400c3a10
mov qword [rbp + 0x2e8], 7
mov qword [rbp + 0x2e0], r15
mov word [rbp + 0x2d0], r15w
mov rdx, rbx
lea rcx, [rbp + 0x2d0]
call fcn.1400c3980
nop
mov r8, qword [rbp + 0x228]
cmp r8, 8
jb 0x1400fff03
inc r8
mov rdx, qword [rbp + 0x210]
lea rcx, [rbp + 0x210]
call fcn.1400c3a10
lea r8, str.LogseScan_
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x210]
call fcn.1400e1f60
mov rbx, rax
lea rax, [rbp + 0x290]
cmp rax, rbx
je 0x1400fff79
mov r8, qword [rbp + 0x2a8]
cmp r8, 8
jb 0x1400fff4f
inc r8
mov rdx, qword [rbp + 0x290]
lea rcx, [rbp + 0x290]
call fcn.1400c3a10
mov qword [rbp + 0x2a8], 7
mov qword [rbp + 0x2a0], r15
mov word [rbp + 0x290], r15w
mov rdx, rbx
lea rcx, [rbp + 0x290]
call fcn.1400c3980
nop
mov r8, qword [rbp + 0x228]
cmp r8, 8
jb 0x1400fff9c
inc r8
mov rdx, qword [rbp + 0x210]
lea rcx, [rbp + 0x210]
call fcn.1400c3a10
lea r8, [0x140236090]
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x1b0]
call fcn.1400e1f60
cmp qword [rax + 0x18], 8
jb 0x1400fffc0
mov rax, qword [rax]
lea rdx, [rbp + 0x460]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov r8, qword [rbp + 0x1c8]
cmp r8, 8
jb 0x1400ffff6
inc r8
mov rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x1b0]
call fcn.1400c3a10
mov qword [rbp + 0x1c8], 7
mov qword [rbp + 0x1c0], r15
mov word [rbp + 0x1b0], r15w
cmp rsi, 0xffffffffffffffff
je 0x1401001b1
nop word [rax + rax]
cmp word [rbp + 0x48c], 0
jne 0x14010002f
mov r8, r15
jmp 0x14010004b
lea rax, [rbp + 0x48c]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140100040
lea rdx, [rbp + 0x48c]
lea rcx, [rbp + 0x190]
call fcn.1400c3720
lea rcx, [rbp + 0x190]
mov rbx, qword [rbp + 0x190]
mov rdi, qword [rbp + 0x1a8]
cmp rdi, 8
cmovae rcx, rbx
mov r9d, 0xa
lea r8, str.virlog.dat
mov rdx, qword [rbp + 0x1a0]
call fcn.1400ca4f0
test eax, eax
je 0x1401000e6
lea rcx, [rbp + 0x190]
cmp rdi, 8
cmovae rcx, rbx
mov r9d, SafeArrayDestroy
lea r8, str.spamlog.dat
call fcn.1400ca4f0
test eax, eax
je 0x1401000e6
lea rcx, [rbp + 0x190]
cmp rdi, 8
cmovae rcx, rbx
mov r9d, SafeArrayDestroy
lea r8, str.warnlog.dat
call fcn.1400ca4f0
test eax, eax
jne 0x140100190
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x210]
call fcn.1400cb2f0
mov rbx, rax
lea rax, [rbp + 0x190]
cmp rax, rbx
je 0x14010015c
mov r8, qword [rbp + 0x1a8]
cmp r8, 8
jb 0x140100132
inc r8
mov rdx, qword [rbp + 0x190]
lea rcx, [rbp + 0x190]
call fcn.1400c3a10
mov qword [rbp + 0x1a8], 7
mov qword [rbp + 0x1a0], r15
mov word [rbp + 0x190], r15w
mov rdx, rbx
lea rcx, [rbp + 0x190]
call fcn.1400c3980
nop
mov r8, qword [rbp + 0x228]
cmp r8, 8
jb 0x14010017f
inc r8
mov rdx, qword [rbp + 0x210]
lea rcx, [rbp + 0x210]
call fcn.1400c3a10
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x190]
call fcn.1400fec10
lea rdx, [rbp + 0x460]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140100020
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8, [0x140236090]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x1b0]
call fcn.1400e1f60
cmp qword [rax + 0x18], 8
jb 0x1401001d5
mov rax, qword [rax]
lea rdx, [rbp + 0x460]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov r8, qword [rbp + 0x1c8]
cmp r8, 8
jb 0x14010020b
inc r8
mov rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x1b0]
call fcn.1400c3a10
mov qword [rbp + 0x1c8], 7
mov qword [rbp + 0x1c0], r15
mov word [rbp + 0x1b0], r15w
cmp rsi, 0xffffffffffffffff
je 0x140100415
nop
cmp word [rbp + 0x48c], 0
jne 0x14010023f
mov r8, r15
jmp 0x14010025b
lea rax, [rbp + 0x48c]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140100250
lea rdx, [rbp + 0x48c]
lea rcx, [rbp + 0x190]
call fcn.1400c3720
lea rcx, [rbp + 0x190]
mov rbx, qword [rbp + 0x190]
mov rdi, qword [rbp + 0x1a8]
cmp rdi, 8
cmovae rcx, rbx
mov r9d, 1
lea r8, [0x14023267c]
mov rdx, qword [rbp + 0x1a0]
call fcn.1400ca4f0
test eax, eax
je 0x1401003f4
lea rcx, [rbp + 0x190]
cmp rdi, 8
cmovae rcx, rbx
mov r9d, 2
lea r8, [0x1402360a4]
call fcn.1400ca4f0
test eax, eax
je 0x1401003f4
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x210]
call fcn.1400cb2f0
mov rbx, rax
lea rax, [rbp + 0x190]
cmp rax, rbx
je 0x14010034b
mov r8, qword [rbp + 0x1a8]
cmp r8, 8
jb 0x140100321
inc r8
mov rdx, qword [rbp + 0x190]
lea rcx, [rbp + 0x190]
call fcn.1400c3a10
mov qword [rbp + 0x1a8], 7
mov qword [rbp + 0x1a0], r15
mov word [rbp + 0x190], r15w
mov rdx, rbx
lea rcx, [rbp + 0x190]
call fcn.1400c3980
nop
mov r8, qword [rbp + 0x228]
cmp r8, 8
jb 0x14010036e
inc r8
mov rdx, qword [rbp + 0x210]
lea rcx, [rbp + 0x210]
call fcn.1400c3a10
lea rcx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rcx, qword [rbp + 0x190]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x78], r15
mov qword [rsp + 0x48], r15
cmp rax, 0xffffffffffffffff
je 0x1401003e3
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x190]
call fcn.1400fec10
lea rdx, [rbp + 0x460]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140100230
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rbp + 0x350], 7
xor esi, esi
mov qword [rbp + 0x348], rsi
mov word [rbp + 0x338], si
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x338]
lea rcx, [rsp + 0x58]
call fcn.1400fed90
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x60], esi
mov byte [rbp - 0x60], sil
mov dword [rbp - 0x68], 3
lea ecx, [rsi + 0x18]
call fcn.14016e754
mov qword [rsp + 0x50], rax
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rbp - 0x60], rax
lea r8, [0x1402360b0]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x358]
call fcn.1400e1f60
cmp qword [rax + 0x18], 8
jb 0x14010049c
mov rax, qword [rax]
lea rdx, [rbp + 0x460]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov r8, qword [rbp + 0x370]
cmp r8, 8
jb 0x1401004d2
inc r8
mov rdx, qword [rbp + 0x358]
lea rcx, [rbp + 0x358]
call fcn.1400c3a10
mov qword [rbp + 0x370], 7
mov qword [rbp + 0x368], rsi
mov word [rbp + 0x358], si
movzx r15d, byte [rsp + 0x40]
cmp r12, 0xffffffffffffffff
je 0x1401017d9
nop dword [rax + rax]
cmp word [rbp + 0x48c], 0
jne 0x14010050f
mov r8, rsi
jmp 0x14010052b
lea rax, [rbp + 0x48c]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140100520
lea rdx, [rbp + 0x48c]
lea rcx, [rbp + 0x190]
call fcn.1400c3720
lea rcx, [rbp + 0x190]
mov rbx, qword [rbp + 0x190]
mov rdi, qword [rbp + 0x1a8]
cmp rdi, 8
cmovae rcx, rbx
mov r9d, 1
lea r8, [0x14023267c]
mov rdx, qword [rbp + 0x1a0]
call fcn.1400ca4f0
test eax, eax
je 0x14010173f
lea rcx, [rbp + 0x190]
cmp rdi, 8
cmovae rcx, rbx
mov r9d, 2
lea r8, [0x1402360a4]
call fcn.1400ca4f0
test eax, eax
je 0x14010173f
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x210]
call fcn.1400cb2f0
mov rbx, rax
lea rax, [rbp + 0x190]
cmp rax, rbx
je 0x14010061a
mov r8, qword [rbp + 0x1a8]
cmp r8, 8
jb 0x1401005f1
inc r8
mov rdx, qword [rbp + 0x190]
lea rcx, [rbp + 0x190]
call fcn.1400c3a10
mov qword [rbp + 0x1a8], 7
mov qword [rbp + 0x1a0], rsi
mov word [rbp + 0x190], si
mov rdx, rbx
lea rcx, [rbp + 0x190]
call fcn.1400c3980
nop
mov r8, qword [rbp + 0x228]
cmp r8, 8
jb 0x14010063d
inc r8
mov rdx, qword [rbp + 0x210]
lea rcx, [rbp + 0x210]
call fcn.1400c3a10
lea rax, [0x140236180]
mov qword [rbp + 0x70], rax
lea rax, [0x140233af0]
mov qword [rbp + 0x80], rax
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x128], rax
or r14d, 4
mov dword [rsp + 0x48], r14d
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x70]
call fcn.140102410
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x88]
call fcn.1400fae40
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x88], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x88]
call fcn.1400faab0
nop
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rdx, qword [rbp + 0x190]
lea rcx, [rbp + 0x88]
call fcn.1400fac70
test rax, rax
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
jne 0x14010071c
lea r9, [rbp + 0x70]
add rcx, r9
mov eax, dword [rcx + 0x10]
or eax, 2
mov edx, eax
or edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, eax
jmp 0x140100730
lea rax, [rbp + 0x70]
add rcx, rax
mov edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, esi
xor r8d, r8d
call fcn.1400d10f0
cmp qword [rbp + 0x108], 0
je 0x140101736
lea rcx, [rbp - 0x70]
call fcn.1400c54b0
mov qword [rbp + 0x228], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x220], rsi
mov byte [rbp + 0x210], 0
xor r8d, r8d
lea rdx, [0x140224165]
lea rcx, [rbp + 0x210]
call fcn.1400d2ee0
nop
mov qword [rbp + 0x3b0], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x3a8], rsi
mov byte [rbp + 0x398], 0
xor r8d, r8d
lea rdx, [0x140224165]
lea rcx, [rbp + 0x398]
call fcn.1400d2ee0
nop
mov qword [rbp + 0x390], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x388], rsi
mov byte [rbp + 0x378], 0
xor r8d, r8d
lea rdx, [0x140224165]
lea rcx, [rbp + 0x378]
call fcn.1400d2ee0
nop
mov qword [rbp + 0x268], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x260], rsi
mov byte [rbp + 0x250], 0
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x70]
add rcx, rax
mov dl, 0xa
call fcn.1400faef0
movzx r8d, al
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x70]
call fcn.1400fbdb0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x1401016f8
nop dword [rax]
nop dword [rax + rax]
mov r9d, 5
xor r8d, r8d
lea rdx, str.name
lea rcx, [rbp + 0x250]
call fcn.140102320
xor r8d, r8d
lea rcx, [rbp + 0x250]
cmp rax, 0xffffffffffffffff
je 0x1401011e6
lea r9d, [r8 + 6]
lea rdx, str.name_
call fcn.140102320
mov rbx, rax
lea ecx, [rax + 6]
movsxd rdi, ecx
mov r9d, 1
mov r8, rdi
lea rdx, [0x1402360d8]
lea rcx, [rbp + 0x250]
call fcn.140102320
sub eax, ebx
sub eax, 6
movsxd r9, eax
mov r8, rdi
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x250]
call fcn.140101dd0
nop
mov qword [rbp + 0x248], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x240], rsi
mov byte [rbp + 0x230], 0
xor r8d, r8d
lea rdx, [0x140224165]
lea rcx, [rbp + 0x230]
call fcn.1400d2ee0
nop
lea rbx, [rbp + 0x2b0]
mov rdx, qword [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
cmovae rbx, rdx
lea rdi, [rbp + 0x2b0]
cmovae rdi, rdx
add rdi, qword [rbp + 0x2c0]
cmp rbx, rdi
je 0x140100aee
mov r9, qword [rbp + 0x240]
movzx edx, byte [rbx]
cmp dl, 0xbb
je 0x140100952
cmp dl, 0x7c
je 0x140100952
lea rcx, [rbp + 0x230]
call fcn.1400fc3a0
mov r9, qword [rbp + 0x240]
jmp 0x14010095e
mov eax, esi
test r9, r9
setne al
test eax, eax
jne 0x14010096b
inc rbx
cmp rbx, rdi
jne 0x140100930
jmp 0x140100aee
lea rax, [rbp + 0x230]
cmp qword [rbp + 0x248], 0x10
cmovae rax, qword [rbp + 0x230]
xor r8d, r8d
cmp byte [r9 + rax - 1], 0x20
jne 0x1401009aa
dec r9
lea rdx, [rbp + 0x418]
lea rcx, [rbp + 0x230]
call fcn.140101dd0
nop
or r14d, 1
jmp 0x1401009e5
mov qword [rbp + 0x1e8], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x1e0], rsi
mov byte [rbp + 0x1d0], 0
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x1d0]
call fcn.1400d3010
lea rax, [rbp + 0x1d0]
or r14d, 2
mov dword [rsp + 0x48], r14d
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140101e80
test r14b, 2
je 0x140100a75
and r14d, 0xfffffffd
mov dword [rsp + 0x48], r14d
mov rax, qword [rbp + 0x1e8]
cmp rax, 0x10
jb 0x140100a5c
inc rax
mov rcx, qword [rbp + 0x1d0]
cmp rax, 0x1000
jb 0x140100a57
test cl, 0x1f
jne 0x14010176a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140101764
sub rcx, rax
cmp rcx, 8
jb 0x14010175e
cmp rcx, 0x27
ja 0x140101758
mov rcx, rax
call fcn.140005f10
mov qword [rbp + 0x1e8], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x1e0], rsi
mov byte [rbp + 0x1d0], 0
test r14b, 1
je 0x140100ad8
and r14d, 0xfffffffe
mov dword [rsp + 0x48], r14d
mov rax, qword [rbp + 0x430]
cmp rax, 0x10
jb 0x140100ad8
inc rax
mov rcx, qword [rbp + 0x418]
cmp rax, 0x1000
jb 0x140100ad3
test cl, 0x1f
jne 0x140101782
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14010177c
sub rcx, rax
cmp rcx, 8
jb 0x140101776
cmp rcx, 0x27
ja 0x140101770
mov rcx, rax
call fcn.140005f10
xor r8d, r8d
lea rdx, [0x140224165]
lea rcx, [rbp + 0x230]
call fcn.1400d2ee0
mov r9d, 8
xor r8d, r8d
lea rdx, str.result_
lea rcx, [rbp + 0x250]
call fcn.140102320
mov rbx, rax
lea ecx, [rax + 8]
movsxd rdi, ecx
mov r9d, 1
mov r8, rdi
lea rdx, [0x1402360d8]
lea rcx, [rbp + 0x250]
call fcn.140102320
sub eax, ebx
sub eax, 8
movsxd r9, eax
mov r8, rdi
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x250]
call fcn.140101dd0
nop
cmp qword [rbp + 0x280], 0
ja 0x140100c93
mov rax, qword [rbp + 0x288]
cmp rax, 0x10
jb 0x140100bb0
inc rax
mov rcx, qword [rbp + 0x270]
cmp rax, 0x1000
jb 0x140100bab
test cl, 0x1f
jne 0x14010179a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140101794
sub rcx, rax
cmp rcx, 8
jb 0x14010178e
cmp rcx, 0x27
ja 0x140101788
mov rcx, rax
call fcn.140005f10
mov qword [rbp + 0x288], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x280], rsi
mov byte [rbp + 0x270], 0
mov rax, qword [rbp + 0x248]
cmp rax, 0x10
jb 0x140100c1d
inc rax
mov rcx, qword [rbp + 0x230]
cmp rax, 0x1000
jb 0x140100c18
test cl, 0x1f
jne 0x1401017b2
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1401017ac
sub rcx, rax
cmp rcx, 8
jb 0x1401017a6
cmp rcx, 0x27
ja 0x1401017a0
mov rcx, rax
call fcn.140005f10
mov qword [rbp + 0x248], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x240], rsi
mov byte [rbp + 0x230], 0
mov rax, qword [rbp + 0x2c8]
cmp rax, 0x10
jb 0x1401016bc
inc rax
mov rcx, qword [rbp + 0x2b0]
cmp rax, 0x1000
jb 0x140100c89
test cl, 0x1f
jne 0x1401017ca
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1401017c4
sub rcx, rax
cmp rcx, 8
jb 0x1401017be
cmp rcx, 0x27
ja 0x1401017b8
mov rcx, rax
call fcn.140005f10
jmp 0x1401016bc
mov qword [rbp + 0x1c8], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp + 0x1c0], rsi
mov byte [rbp + 0x1b0], 0
xor r8d, r8d
lea rdx, [0x140224165]
lea rcx, [rbp + 0x1b0]
call fcn.1400d2ee0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x270]
call fcn.1400d1b20
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x270]
call fcn.1400d1af0
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rbp - 0x78]
cmp rbx, rdi
je 0x140100d67
movzx edx, byte [rbx]
lea rcx, [rbp + 0x1b0]
cmp dl, 0x20
je 0x140100d08
call fcn.1400fc3a0
jmp 0x140100d4a
call fcn.1401028b0
test al, al
je 0x140100d4a
xor edx, edx
lea rcx, [rbp + 0x1b0]
call fcn.1400d1ad0
cmp byte [rax], 0x41
jl 0x140100d37
xor edx, edx
lea rcx, [rbp + 0x1b0]
call fcn.1400d1ad0
cmp byte [rax], 0x5a
jle 0x140100d54
lea rdx, [0x140224165]
lea rcx, [rbp + 0x1b0]
call fcn.140101e30
inc rbx
mov qword [rsp + 0x50], rbx
jmp 0x140100ced
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x270]
call fcn.140101e50
xor r8d, r8d
lea rdx, str.action_
lea rcx, [rbp + 0x250]
call fcn.140101e10
mov rbx, rax
lea ecx, [rax + 8]
movsxd rdi, ecx
mov r8, rdi
lea rdx, [0x1402360d8]
lea rcx, [rbp + 0x250]
call fcn.140101e10
sub eax, ebx
sub eax, 8
movsxd r9, eax
mov r8, rdi
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x250]
call fcn.140101dd0
nop
xor r8d, r8d
lea rdx, str.quarant
lea rcx, [rbp + 0x1f0]
call fcn.140101e10
cmp rax, 0xffffffffffffffff
je 0x140100de0
lea rdx, str.quarantined
jmp 0x140100e0c
xor r8d, r8d
lea rdx, [0x14023610c]
lea rcx, [rbp + 0x1f0]
call fcn.140101e10
lea rdx, str.unknown
cmp rax, 0xffffffffffffffff
lea rax, str.deleted
cmovne rdx, rax
lea rcx, [rbp + 0x1f0]
call fcn.140101e30
lea rdx, str.unknown
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
jne 0x140100e5d
lea rdx, [0x140226660]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
jne 0x140100e5d
lea rdx, [0x1402289e0]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x140100e60
xor r15b, r15b
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x270]
call fcn.140102940
test al, al
je 0x140100ea9
lea rdx, [rbp + 0x398]
lea rcx, [rbp + 0x2b0]
call fcn.140102940
test al, al
je 0x140100ea9
lea rdx, [rbp + 0x378]
lea rcx, [rbp + 0x1f0]
call fcn.140102940
test al, al
jne 0x1401011a1
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x210]
call fcn.140101e50
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x398]
call fcn.140101e50
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x378]
call fcn.140101e50
xor r8d, r8d
lea rdx, str.info_
lea rcx, [rbp + 0x250]
call fcn.140101e10
mov rbx, rax
lea ecx, [rax + 6]
movsxd rdi, ecx
mov r8, rdi
lea rdx, [0x1402360d8]
lea rcx, [rbp + 0x250]
call fcn.140101e10
sub eax, ebx
sub eax, 6
movsxd r9, eax
mov r8, rdi
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x250]
call fcn.140101dd0
nop
mov r8d, 0x20
mov rdx, qword [rbp + 0x2c0]
lea rcx, [rbp + 0x3f8]
call fcn.140101da0
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x3f8]
call fcn.1400ca580
mov rdi, rax
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x2b0]
call fcn.1400d1af0
mov rbx, rax
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x2b0]
call fcn.1400d1b20
mov r9, qword [rdi]
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp - 0x18]
call fcn.1401029c0
mov r8d, 0x20
mov rdx, qword [rbp + 0x280]
lea rcx, [rbp + 0x3d8]
call fcn.140101da0
nop
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x3d8]
call fcn.1400ca580
mov rdi, rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x270]
call fcn.1400d1af0
mov rbx, rax
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x270]
call fcn.1400d1b20
mov r9, qword [rdi]
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp + 0x30]
call fcn.1401029c0
mov r8d, 0x20
mov rdx, qword [rbp + 0x200]
lea rcx, [rbp + 0x3b8]
call fcn.140101da0
nop
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x3b8]
call fcn.1400ca580
mov rdi, rax
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1f0]
call fcn.1400d1af0
mov rbx, rax
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x1f0]
call fcn.1400d1b20
mov r9, qword [rdi]
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp - 0x10]
call fcn.1401029c0
mov edx, 2
lea rcx, [rsp + 0x70]
call fcn.1400c4570
nop
lea rcx, [rbp + 0x3d8]
call fcn.1400c3480
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.1400c4330
nop
lea r8, [rbp + 0x1d0]
lea rdx, str.threat_name
lea rcx, [rsp + 0x70]
call fcn.1400c5920
nop
lea rbx, vtable.WaJson.0
mov qword [rbp + 0x1d0], rbx
lea rcx, [rbp + 0x1d0]
call fcn.1400c54b0
nop
lea rcx, [rbp + 0x3b8]
call fcn.1400c3480
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.1400c4330
nop
lea r8, [rbp + 0x1d0]
lea rdx, str.remediation
lea rcx, [rsp + 0x70]
call fcn.1400c5920
nop
mov qword [rbp + 0x1d0], rbx
lea rcx, [rbp + 0x1d0]
call fcn.1400c54b0
nop
lea rcx, [rbp + 0x3f8]
call fcn.1400c3480
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.1400c4330
nop
lea r8, [rbp + 0x1d0]
lea rdx, str.path
lea rcx, [rsp + 0x70]
call fcn.1400c5920
nop
mov qword [rbp + 0x1d0], rbx
lea rcx, [rbp + 0x1d0]
call fcn.1400c54b0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.1400c5620
nop
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x70]
call fcn.1400c54b0
nop
lea rcx, [rbp + 0x3b8]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x3d8]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x3f8]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x310]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x1f0]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x1b0]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x270]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x230]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x2b0]
call fcn.1400d1b40
jmp 0x1401016bc
lea rdx, str.Scan_completed_at:
call fcn.140101e10
cmp rax, 0xffffffffffffffff
je 0x1401016bc
xor r8d, r8d
lea rdx, str.Scan_completed_at:
lea rcx, [rbp + 0x250]
call fcn.140101e10
mov r9, qword [rbp + 0x260]
add r9, 0xffffffffffffffe9
mov r8d, SafeArrayCopy
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x250]
call fcn.140101dd0
nop
mov r9d, 2
lea r8d, [r9 + 2]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x1b0]
call fcn.140101dd0
nop
lea rcx, [rbp + 0x230]
call fcn.1400fd9a0
mov dword [rbp + 0x31c], eax
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x1b0]
call fcn.140101dd0
nop
lea rdx, [0x140236110]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x1401012a5
mov ecx, 1
jmp 0x140101405
lea rdx, [0x140236114]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x1401012c6
mov ecx, 2
jmp 0x140101405
lea rdx, [0x14023613c]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x1401012e7
mov ecx, 3
jmp 0x140101405
lea rdx, [0x140236140]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x140101308
mov ecx, 4
jmp 0x140101405
lea rdx, [0x140236134]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x140101329
mov ecx, 5
jmp 0x140101405
lea rdx, [0x140236138]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x14010134a
mov ecx, 6
jmp 0x140101405
lea rdx, [0x14023614c]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x14010136b
mov ecx, 7
jmp 0x140101405
lea rdx, [0x140236150]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x140101389
mov ecx, 8
jmp 0x140101405
lea rdx, [0x140236144]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x1401013a7
mov ecx, 9
jmp 0x140101405
lea rdx, [0x140236148]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x1401013c5
mov ecx, 0xa
jmp 0x140101405
lea rdx, [0x140236154]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
test al, al
je 0x1401013e3
mov ecx, SafeArrayDestroy
jmp 0x140101405
lea rdx, [0x140236158]
lea rcx, [rbp + 0x1f0]
call fcn.1401028c0
mov ecx, 1
test al, al
mov eax, SafeArrayDestroy
cmovne ecx, eax
lea eax, [rcx - 1]
mov dword [rbp + 0x320], eax
mov r9d, 4
lea r8d, [r9 + 0xc]
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0x1b0]
call fcn.140101dd0
nop
lea rcx, [rbp + 0x3b8]
call fcn.1400fd9a0
sub eax, 0x76c
mov dword [rbp + 0x324], eax
mov r9d, 2
lea r8d, [r9 + 5]
lea rdx, [rbp + 0x3d8]
lea rcx, [rbp + 0x1b0]
call fcn.140101dd0
nop
lea rcx, [rbp + 0x3d8]
call fcn.1400fd9a0
mov dword [rbp + 0x318], eax
mov r9d, 2
lea r8d, [r9 + 8]
lea rdx, [rbp + 0x3f8]
lea rcx, [rbp + 0x1b0]
call fcn.140101dd0
nop
lea rcx, [rbp + 0x3f8]
call fcn.1400fd9a0
mov dword [rbp + 0x314], eax
mov r9d, 2
lea r8d, [r9 + 0xb]
lea rdx, [rbp + 0x418]
lea rcx, [rbp + 0x1b0]
call fcn.140101dd0
nop
lea rcx, [rbp + 0x418]
call fcn.1400fd9a0
mov dword [rbp + 0x310], eax
lea rcx, [rbp + 0x310]
call fcn.1401bc0d8
mov edx, eax
lea rcx, [rbp + 0x270]
call fcn.1400fda20
nop
mov r8d, 0x20
mov rdx, qword [rbp + 0x280]
lea rcx, [rbp + 0x2b0]
call fcn.140101da0
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x2b0]
call fcn.1400ca580
mov rdi, rax
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x270]
call fcn.1400d1af0
mov rbx, rax
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x270]
call fcn.1400d1b20
mov r9, qword [rdi]
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp - 0x10]
call fcn.1401029c0
lea rcx, [rbp - 0x70]
call fcn.1400c55e0
test rax, rax
je 0x140101646
xor edi, edi
lea r13, vtable.WaJson.0
nop dword [rax + rax]
mov rax, qword [rbp - 0x70]
mov rbx, qword [rax + 0x70]
mov rcx, rbx
call qword [fcn.140005fb0]
mov rdx, rdi
lea rcx, [rbp - 0x70]
call rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400c4200
nop
lea rcx, [rbp + 0x2b0]
call fcn.1400c3480
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.1400c4330
nop
lea r8, [rbp + 0x1d0]
lea rdx, str.scan_time
lea rcx, [rsp + 0x70]
call fcn.1400c5920
nop
mov qword [rbp + 0x1d0], r13
lea rcx, [rbp + 0x1d0]
call fcn.1400c54b0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.1400c5620
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x2b0]
call fcn.140102a00
test al, al
je 0x14010161b
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x338]
call fcn.1400ca150
nop
mov qword [rsp + 0x70], r13
lea rcx, [rsp + 0x70]
call fcn.1400c54b0
nop
inc esi
movsxd rdi, esi
lea rcx, [rbp - 0x70]
call fcn.1400c55e0
cmp rdi, rax
jb 0x140101570
mov r13, qword [rbp - 0x28]
lea rcx, [rbp + 0x2b0]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x270]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x418]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x3f8]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x3d8]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x3b8]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x1f0]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x230]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x1b0]
call fcn.1400d1b40
xor esi, esi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x70]
add rcx, rax
mov dl, 0xa
call fcn.1400faef0
movzx r8d, al
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x70]
call fcn.1400fbdb0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
je 0x140100840
lea rcx, [rbp + 0x70]
call fcn.140101f40
nop
lea rcx, [rbp + 0x250]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x378]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x398]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x210]
call fcn.1400d1b40
nop
lea rcx, [rbp + 0x70]
call fcn.140101ab0
lea rdx, [rbp + 0x460]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1401017d0
jmp 0x140100500
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
nop
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
nop
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
nop
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
int3
call fcn.1401b4bec
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx edx, r15b
lea rcx, [rbp + 0x1d0]
call fcn.1400c4480
nop
lea r8, [rbp + 0x1d0]
lea rdx, str.no_threats
lea rcx, [rbp - 0x58]
call fcn.1400c5920
nop
lea rbx, vtable.WaJson.0
mov qword [rbp + 0x1d0], rbx
lea rcx, [rbp + 0x1d0]
call fcn.1400c54b0
nop
lea rcx, [rbp + 0x338]
call fcn.1400c3480
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400c4330
nop
lea r8, [rsp + 0x70]
lea rdx, str.last_threat_time
lea rcx, [rbp - 0x58]
call fcn.1400c5920
nop
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x70]
call fcn.1400c54b0
nop
lea r8, [rsp + 0x58]
lea rdx, str.threats
lea rcx, [rbp - 0x58]
call fcn.1400c57d0
lea r8, [rbp - 0x58]
lea rdx, str.result
lea rcx, [rbp - 0x40]
call fcn.1400c57d0
lea rdx, [rbp + 0x310]
lea rcx, [rbp - 0x40]
call fcn.1400c8b50
mov rdx, rax
mov rcx, qword [rbp - 0x20]
call fcn.1400ca180
lea rcx, [rbp + 0x310]
call fcn.1400c3490
nop
mov qword [rbp - 0x70], rbx
lea rcx, [rbp - 0x70]
call fcn.1400c54b0
nop
lea rcx, [rbp + 0x338]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x290]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x2d0]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x190]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x438]
call fcn.1400c3490
nop
lea rcx, [rbp + 0x2f0]
call fcn.1400c3490
nop
mov qword [rbp - 0x40], rbx
lea rcx, [rbp - 0x40]
call fcn.1400c54b0
nop
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x58]
call fcn.1400c54b0
nop
mov qword [rbp - 0x58], rbx
lea rcx, [rbp - 0x58]
call fcn.1400c54b0
nop
mov qword [r13], rbx
mov rcx, r13
call fcn.1400c54b0
nop
xor eax, eax
jmp 0x140101a7b
mov r8, qword [rbp + 0x2a8]
cmp r8, 8
jb 0x14010196e
inc r8
mov rdx, qword [rbp + 0x290]
lea rcx, [rbp + 0x290]
call fcn.1400c3a10
mov qword [rbp + 0x2a8], 7
mov qword [rbp + 0x2a0], r15
mov word [rbp + 0x290], r15w
mov r8, qword [rbp + 0x2e8]
cmp r8, 8
jb 0x1401019ab
inc r8
mov rdx, qword [rbp + 0x2d0]
lea rcx, [rbp + 0x2d0]
call fcn.1400c3a10
mov qword [rbp + 0x2e8], 7
mov qword [rbp + 0x2e0], r15
mov word [rbp + 0x2d0], r15w
mov r8, qword [rbp + 0x1a8]
cmp r8, 8
jb 0x1401019e8
inc r8
mov rdx, qword [rbp + 0x190]
lea rcx, [rbp + 0x190]
call fcn.1400c3a10
mov qword [rbp + 0x1a8], 7
mov qword [rbp + 0x1a0], r15
mov word [rbp + 0x190], r15w
mov r8, qword [rbp + 0x308]
cmp r8, 8
jb 0x140101a25
inc r8
mov rdx, qword [rbp + 0x2f0]
lea rcx, [rbp + 0x2f0]
call fcn.1400c3a10
mov qword [rbp + 0x308], 7
mov qword [rbp + 0x300], r15
mov word [rbp + 0x2f0], r15w
mov qword [rbp - 0x40], r12
lea rcx, [rbp - 0x40]
call fcn.1400c54b0
nop
mov qword [rsp + 0x58], r12
lea rcx, [rsp + 0x58]
call fcn.1400c54b0
nop
mov qword [rbp - 0x58], r12
lea rcx, [rbp - 0x58]
call fcn.1400c54b0
nop
mov qword [r13], r12
mov rcx, r13
call fcn.1400c54b0
nop
or eax, 0xffffffff
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.14016e480
mov rbx, qword [rsp + 0x800]
add rsp, 0x7c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret