Function at 0x1401c94d0
Capabilities:
Authenticate hmac
Get installed programs
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x430
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm14
movaps xmmword [rax - 0xd8], xmm15
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x288], rax
mov rsi, rdx
mov r12, rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x18], rdx
mov rcx, rdx
call fcn.1401c6010
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
je 0x1401c9582
movss xmm2, dword [0x140372258]
mov edx, 1
mov rcx, rsi
call fcn.1400e4050
mov rdx, rsi
mov rcx, r12
call fcn.1401cd250
xorps xmm10, xmm10
test al, al
je 0x1401c95ae
movaps xmm2, xmm10
mov edx, 9
mov rcx, rsi
call fcn.1400e4050
or qword [rsi + 0x40], 0x10000000
mov r8d, 0xf
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d8440
nop
xor r8d, r8d
lea rdx, str.Critical
mov rcx, rax
call fcn.1401fce20
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401c95e5
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
test bl, bl
je 0x1401c961c
mov edx, 9
mov rcx, rsi
call fcn.1400d7ee0
movss xmm13, dword [0x140372098]
test al, al
je 0x1401c9609
movaps xmm2, xmm10
jmp 0x1401c960d
movaps xmm2, xmm13
mov edx, 0x4d
mov rcx, rsi
call fcn.1400e4050
jmp 0x1401c9625
movss xmm13, dword [0x140372098]
mov rcx, rsi
call fcn.1400d1020
lea rdi, [0x140346ce0]
test al, al
je 0x1401c9970
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
jne 0x1401c9970
mov rcx, rsi
call fcn.1400d8870
mov r15, rax
movss xmm7, dword [0x140372144]
test rax, rax
je 0x1401c9978
mov rcx, qword [rax]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x1401c9978
lea r13, str.Win64
movsd xmm6, qword [0x140372020]
nop word [rax + rax]
mov qword [rsp + 0x50], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401c96a7
mov qword [rsp + 0x48], rdi
jmp 0x1401c96cc
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.1402ba94c
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.1401fde50
nop
xor r8d, r8d
lea rdx, [0x140345d54]
lea rcx, [rsp + 0x48]
call fcn.1401ff2c0
test al, al
je 0x1401c98f0
xor r8d, r8d
lea rdx, str.CurrentVersionRun_
lea rcx, [rsp + 0x48]
call fcn.1401fd520
test eax, eax
jle 0x1401c98f0
movaps xmm1, xmm6
lea rcx, [rbp + 0x260]
call fcn.1400e9a50
mov r9, rax
mov r8, rsi
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.1401c8dd0
test al, al
jne 0x1401c9958
mov rcx, rsi
call fcn.1401c6600
test al, al
je 0x1401c98f0
mov rcx, rsi
call fcn.1401c6670
test rax, rax
je 0x1401c98f0
mov rcx, qword [rax]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1401c98f0
mov edi, dword [rsp + 0x54]
mov r11, qword [rax + 0x20]
cmp edi, dword [r11 + 0xc]
jne 0x1401c97b1
mov rdx, qword [rsp + 0x48]
mov r10, qword [r11]
sub r10, rdx
nop word [rax + rax]
movzx r9d, word [rdx]
movzx r8d, word [rdx + r10]
sub r9d, r8d
jne 0x1401c97a7
add rdx, 2
test r8d, r8d
jne 0x1401c9790
test r9d, r9d
sete dl
test dl, dl
jne 0x1401c980c
cmp byte [rax + 0x19], 0
jne 0x1401c97fe
mov rdx, qword [rax + 0x10]
cmp byte [rdx + 0x19], 0
jne 0x1401c97de
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
jne 0x1401c97fe
nop dword [rax]
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1401c97d0
jmp 0x1401c97fe
mov rdx, qword [rax + 8]
cmp byte [rdx + 0x19], 0
jne 0x1401c97fb
cmp rax, qword [rdx + 0x10]
jne 0x1401c97fb
mov rax, rdx
mov rdx, qword [rdx + 8]
cmp byte [rdx + 0x19], 0
je 0x1401c97e8
mov rax, rdx
cmp rax, rcx
je 0x1401c98e9
jmp 0x1401c9770
xor r14b, r14b
xor dil, dil
mov eax, dword [r11 + 0x14]
cmp eax, 5
jae 0x1401c9837
mov ecx, dword [r11 + 0x10]
cmp ecx, 0x14
jae 0x1401c9837
cmp eax, 2
jae 0x1401c9832
cmp ecx, 0xa
jb 0x1401c98e9
mov dil, 1
jmp 0x1401c983a
mov r14b, 1
movaps xmm2, xmm7
mov edx, 0x49
mov rcx, rsi
call fcn.1400e4050
test r14b, r14b
je 0x1401c98cd
mov eax, dword [rsi + 0x40]
shr rax, 0xb
and al, 1
lea rdx, str.Win32
cmovne rdx, r13
lea rcx, [rbp - 0x78]
call fcn.1401faae0
nop
mov edx, dword [rbp - 0x6c]
inc edx
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 0x6c]
mov rax, qword [rbp - 0x78]
mov edx, 0x2f
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x6c]
inc edx
lea rcx, [rbp - 0x78]
call fcn.1401fde50
lea rdx, str.Backdoor.Behavior
lea rcx, [rbp - 0x78]
call fcn.1401fb190
lea r8, [rbp - 0x78]
mov edx, 2
mov rcx, rsi
call fcn.1400d9690
nop
cmp dword [rbp - 0x70], 0
jle 0x1401c98e9
mov rcx, qword [rbp - 0x78]
call fcn.1402b7350
jmp 0x1401c98e9
test dil, dil
lea rdi, [0x140346ce0]
je 0x1401c98f0
movabs rax, 0x2000000000
or qword [rsi + 0x40], rax
jmp 0x1401c98f0
lea rdi, [0x140346ce0]
cmp dword [rsp + 0x50], 0
jle 0x1401c9901
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
cmp byte [rbx + 0x19], 0
jne 0x1401c994e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401c992e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401c994e
nop dword [rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401c9920
jmp 0x1401c994e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401c994b
cmp rbx, qword [rax + 0x10]
jne 0x1401c994b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401c9938
mov rbx, rax
cmp rbx, qword [r15]
je 0x1401c9978
jmp 0x1401c9690
cmp dword [rsp + 0x50], 0
jle 0x1401c9969
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
xor al, al
jmp 0x1401ccc28
movss xmm7, dword [0x140372144]
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401c99dc
lea rdx, [rsi + 8]
lea rcx, [rbp - 0x68]
call fcn.1400e3270
nop
lea rdx, [rsi + 8]
mov rcx, r12
call fcn.1401c8800
test al, al
je 0x1401c99cd
mov edx, dword [rsi + 0x14]
add edx, 0xfffffff8
js 0x1401c99cd
lea rcx, [rsi + 8]
call fcn.1401fb010
mov ecx, 0x202e
cmp ax, cx
jne 0x1401c99cd
movaps xmm2, xmm7
mov edx, 0x15
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rbp - 0x60], 0
jle 0x1401c99dc
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
mov rcx, rsi
call fcn.1400d8370
movss xmm12, dword [0x1403720a8]
test al, al
je 0x1401c9a0d
mov eax, dword [rsi + 0x40]
shr rax, 0x1e
test al, 1
je 0x1401c9a0d
movaps xmm2, xmm12
mov edx, 0x46
mov rcx, rsi
call fcn.1400e4050
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x34
movss xmm6, dword [0x140372038]
test al, 1
je 0x1401c9a86
mov rax, rcx
shr rax, 0x24
test al, 1
jne 0x1401c9a86
mov rax, rcx
shr rax, 0x1c
test al, 1
jne 0x1401c9a86
shr rcx, 0x1a
test cl, 1
jne 0x1401c9a86
mov rcx, qword [r12 + 8]
call fcn.1400ef830
test al, al
je 0x1401c9a56
movaps xmm2, xmm7
jmp 0x1401c9a79
mov rcx, rsi
call fcn.1400d1020
test al, al
je 0x1401c9a76
mov rcx, rsi
call fcn.1400d83e0
cmp qword [rax + 8], 1
ja 0x1401c9a76
movaps xmm2, xmm7
jmp 0x1401c9a79
movaps xmm2, xmm6
mov edx, 0x47
mov rcx, rsi
call fcn.1400e4050
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x35
test al, 1
je 0x1401c9ae8
mov rax, rcx
shr rax, 0x24
test al, 1
jne 0x1401c9ae8
mov rax, rcx
shr rax, 0x1c
test al, 1
jne 0x1401c9ae8
shr rcx, 0x1a
test cl, 1
jne 0x1401c9ae8
mov rcx, qword [r12 + 8]
call fcn.1400ef830
test al, al
je 0x1401c9ac7
movaps xmm2, xmm7
jmp 0x1401c9adb
mov rcx, rsi
call fcn.1400d1020
test al, al
je 0x1401c9ad8
movaps xmm2, xmm7
jmp 0x1401c9adb
movaps xmm2, xmm6
mov edx, 0x48
mov rcx, rsi
call fcn.1400e4050
mov eax, dword [rsi + 0x40]
shr rax, 0xd
movabs r15, 0x100000000
movss xmm6, dword [0x140372140]
test al, 1
je 0x1401c9b36
movaps xmm2, xmm10
mov edx, 0x2a
mov rcx, rsi
call fcn.1400e4050
mov rax, qword [rsi + 0x40]
shr rax, 0x23
test al, 1
je 0x1401c9b36
movaps xmm2, xmm6
mov edx, 0x3e
mov rcx, rsi
call fcn.1400e4050
or qword [rsi + 0x40], r15
mov rax, qword [rsi + 0x40]
shr rax, 0x20
test al, 1
jne 0x1401c9c70
lea r14, [rsi + 8]
lea rdx, [rbp + 0x10]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1401c9b76
cmp word [rbp + 0x3c], 0
jne 0x1401c9b68
or qword [rsi + 0x40], r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1401c9c70
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1401c9bc3
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x20000
lea r8d, [rax + 2]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1401c9bd2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401c9c70
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1401c9c70
mov rdx, qword [r12 + 8]
mov rcx, r14
call fcn.1401f3d00
mov rdi, rax
lea rax, vtable.Core::SharedPtr_class_HitmanPro35::FileSystemBase_.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdi
xor ebx, ebx
mov qword [rbp - 0x48], rbx
test rdi, rdi
je 0x1401c9c24
lea ecx, [rbx + 4]
call fcn.1402b6dbc
mov rbx, rax
test rax, rax
je 0x1401c9c18
mov dword [rax], 0
mov qword [rbp - 0x48], rax
jmp 0x1401c9c1e
xor ebx, ebx
mov qword [rbp - 0x48], rbx
mov dword [rbx], 1
test rdi, rdi
je 0x1401c9c42
mov rax, qword [rdi]
lea r8, [rsp + 0x68]
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x20]
test al, al
je 0x1401c9c42
or qword [rsi + 0x40], r15
test rbx, rbx
je 0x1401c9c70
mov eax, dword [rbx]
test eax, eax
jle 0x1401c9c51
dec eax
mov dword [rbx], eax
cmp dword [rbx], 0
jne 0x1401c9c70
test rdi, rdi
je 0x1401c9c68
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, rbx
call fcn.1402150f0
mov rax, qword [rsi + 0x40]
shr rax, 0x20
test al, 1
je 0x1401c9c9c
mov rdx, qword [rsi + 8]
lea rcx, str.Cloaked__s__r_n
call fcn.1402b9694
movaps xmm2, xmm6
mov edx, 3
mov rcx, rsi
call fcn.1400e4050
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x21
test al, 1
je 0x1401c9cb5
movaps xmm2, xmm6
mov edx, 3
jmp 0x1401c9ccb
shr rcx, 0x18
test cl, 1
je 0x1401c9cd3
movss xmm2, dword [0x140372240]
mov edx, 4
mov rcx, rsi
call fcn.1400e4050
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401c9d2e
bt rcx, 8
jb 0x1401c9d00
lea rcx, [rsi + 8]
xor r8d, r8d
lea rdx, str..dll
call fcn.1401fc9f0
test al, al
jne 0x1401c9d2e
mov eax, dword [rsi + 0x40]
shr rax, 0x18
test al, 1
je 0x1401c9d2e
mov rcx, rsi
call fcn.1400d7e10
comiss xmm12, xmm0
jbe 0x1401c9d2e
movss xmm2, dword [0x140372210]
mov edx, 5
mov rcx, rsi
call fcn.1400e4050
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401c9d79
mov edx, 0x400
mov rcx, rsi
call fcn.1401c2a60
test al, al
je 0x1401c9d79
lea rcx, [rsi + 8]
mov r8d, 1
lea rdx, str..NET
call fcn.1401fc8b0
test al, al
je 0x1401c9d79
movss xmm2, dword [0x140372234]
mov edx, 0x28
mov rcx, rsi
call fcn.1400e4050
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401c9da2
shr rcx, 0x2f
test cl, 1
je 0x1401c9da2
movaps xmm2, xmm10
mov edx, 0x3c
mov rcx, rsi
call fcn.1400e4050
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401c9e00
bt rcx, 8
jb 0x1401c9e00
lea rcx, [rsi + 8]
xor r8d, r8d
lea rdx, str..dll
call fcn.1401fc9f0
test al, al
je 0x1401c9e00
mov rcx, rsi
call fcn.1401c5f80
cmp eax, 1
jne 0x1401c9e00
lea edx, [rax + 3]
mov rcx, rsi
call fcn.1401c2a60
test al, al
je 0x1401c9e00
movss xmm2, dword [0x14037223c]
mov edx, 0x29
mov rcx, rsi
call fcn.1400e4050
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
movss xmm8, dword [0x1403720d0]
movss xmm6, dword [0x1403720e0]
test al, 1
je 0x1401c9fd0
xor r14b, r14b
shr rcx, 0x1b
test cl, 1
jne 0x1401c9eca
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x58]
call fcn.1400d44c0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400e3270
nop
xor r8d, r8d
lea rdx, [0x14034be40]
lea rcx, [rsp + 0x78]
call fcn.1401fce20
test al, al
je 0x1401c9ea8
xor edi, edi
lea rbx, str.8_6_
nop dword [rax]
nop dword [rax + rax]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [rsp + 0x58]
call fcn.1401fc8b0
test al, al
jne 0x1401c9ea5
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, 3
jb 0x1401c9e80
jmp 0x1401c9ea8
mov r14b, 1
cmp dword [rbp - 0x80], 0
jle 0x1401c9eb9
mov rcx, qword [rsp + 0x78]
call fcn.1402b7350
nop
cmp dword [rsp + 0x60], 0
jle 0x1401c9eca
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
mov r9, qword [rsi + 0x40]
mov rax, r9
shr rax, 0x1b
test al, 1
jne 0x1401c9ee2
test r14b, r14b
je 0x1401c9fd0
mov r8, qword [rsi + 0x50]
test r8, r8
je 0x1401c9fd0
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401c9f18
nop
cmp dword [rcx + 0x20], 1
jge 0x1401c9f0c
mov rcx, qword [rcx + 0x10]
jmp 0x1401c9f12
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401c9f00
cmp rdx, rax
je 0x1401c9f28
cmp dword [rdx + 0x20], 1
mov qword [rsp + 0x68], rdx
jle 0x1401c9f2d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401c9f45
cmp qword [rax + 0x28], 0
jne 0x1401c9fd0
test r8, r8
je 0x1401c9fd0
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401c9f78
nop
cmp dword [rcx + 0x20], 0xe
jge 0x1401c9f6c
mov rcx, qword [rcx + 0x10]
jmp 0x1401c9f72
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401c9f60
cmp rdx, rax
je 0x1401c9f88
cmp dword [rdx + 0x20], 0xe
mov qword [rsp + 0x68], rdx
jle 0x1401c9f8d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401c9fd0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401c9fd0
movss xmm0, dword [rcx]
comiss xmm0, xmm8
jbe 0x1401c9fd0
movaps xmm2, xmm6
test r14b, r14b
jne 0x1401c9fbf
shr r9, 0x1a
test r9b, 1
je 0x1401c9fc3
movaps xmm2, xmm10
mov edx, 0x3f
mov rcx, rsi
call fcn.1400e4050
mov eax, dword [rsi + 0x40]
shr rax, 9
movss xmm11, dword [0x140371fe0]
movss xmm7, dword [0x14037211c]
mov rcx, rsi
test al, 1
je 0x1401ca078
mov r8d, 9
lea rdx, [rsp + 0x58]
call fcn.1400d8440
nop
xor r8d, r8d
lea rdx, str.Boot
lea rcx, [rsp + 0x58]
call fcn.1401fce20
test al, al
jne 0x1401ca04c
xor r8d, r8d
lea rdx, str.System
lea rcx, [rsp + 0x58]
call fcn.1401fce20
test al, al
jne 0x1401ca04c
xor r8d, r8d
lea rdx, str.AutoLoad
lea rcx, [rsp + 0x58]
call fcn.1401fce20
test al, al
je 0x1401ca05e
movaps xmm2, xmm11
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ca11b
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
jmp 0x1401ca11b
call fcn.1400d1020
test al, al
je 0x1401ca0ec
movaps xmm6, xmm11
movsxd rax, dword [r12 + 0x1f4]
cmp dword [rsi + 0x14], eax
jl 0x1401ca0d2
mov r8, rax
mov rdx, qword [r12 + 0x1e8]
mov rcx, qword [rsi + 8]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401ca0d2
movaps xmm6, xmm12
mov eax, dword [rsi + 0x40]
shr rax, 0xa
test al, 1
je 0x1401ca0c1
movaps xmm6, xmm7
lea rcx, [rsi + 8]
call fcn.1401c5df0
test al, al
jne 0x1401ca0d2
addss xmm6, xmm7
movaps xmm2, xmm6
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e4050
movss xmm6, dword [0x1403720e0]
jmp 0x1401ca11b
lea rdx, [rsi + 8]
mov rcx, qword [r12 + 8]
call fcn.1400f9ac0
test al, al
je 0x1401ca11b
lea rdx, [rsi + 8]
mov rcx, rsi
call fcn.1400eb2a0
movaps xmm2, xmm11
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e4050
lea r13, [rsi + 8]
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d2fc0
nop
mov rdi, qword [r12 + 0x100]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401ca164
nop
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x20]
call fcn.1402b71dc
test eax, eax
jns 0x1401ca158
mov rbx, qword [rbx + 0x10]
jmp 0x1401ca15e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401ca140
cmp rdi, qword [r12 + 0x100]
je 0x1401ca187
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.1402b71dc
test eax, eax
js 0x1401ca187
mov qword [rsp + 0x68], rdi
jmp 0x1401ca194
mov rax, qword [r12 + 0x100]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r12 + 0x100]
jne 0x1401ca1d2
movsxd rax, dword [r12 + 0x224]
cmp dword [rsp + 0x64], eax
jl 0x1401ca1e4
mov r8, rax
mov rdx, qword [r12 + 0x218]
mov rcx, qword [rsp + 0x58]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401ca1e4
movaps xmm2, xmm11
mov edx, 7
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ca1f5
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
mov rax, qword [r12 + 0x110]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401ca29b
movsxd rax, dword [rbx + 0x2c]
cmp dword [r13 + 0xc], eax
jl 0x1401ca22c
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
jne 0x1401ca28b
cmp byte [rbx + 0x19], 0
jne 0x1401ca27e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ca25e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ca27e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ca250
jmp 0x1401ca27e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ca27b
cmp rbx, qword [rax + 0x10]
jne 0x1401ca27b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ca268
mov rbx, rax
cmp rbx, qword [r12 + 0x110]
jmp 0x1401ca203
movaps xmm2, xmm6
mov edx, 8
mov rcx, rsi
call fcn.1400e4050
mov rax, qword [rsi + 0x40]
shr rax, 0x2c
test al, 1
je 0x1401ca2cd
mov edx, 7
mov rcx, rsi
call fcn.1400d7ee0
test al, al
jne 0x1401ca2cd
movss xmm2, dword [0x14037209c]
mov edx, 0x3b
mov rcx, rsi
call fcn.1400e4050
movsxd rax, dword [r12 + 0x194]
cmp dword [r13 + 0xc], eax
jl 0x1401ca3c5
mov r8, rax
mov rdx, qword [r12 + 0x188]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401ca3c5
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d44c0
nop
mov rax, qword [r12 + 0x120]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401ca3b4
movsxd rax, dword [rbx + 0x2c]
cmp dword [rsp + 0x64], eax
jl 0x1401ca346
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.1402b9158
test eax, eax
sete al
test al, al
jne 0x1401ca3a3
cmp byte [rbx + 0x19], 0
jne 0x1401ca396
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ca370
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ca396
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ca362
jmp 0x1401ca396
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ca393
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401ca393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ca380
mov rbx, rax
cmp rbx, qword [r12 + 0x120]
jmp 0x1401ca31c
movaps xmm2, xmm7
mov edx, 6
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ca3c5
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
mov r8, qword [rsi + 0x50]
movss xmm6, dword [0x1403720ec]
test r8, r8
je 0x1401ca575
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ca408
nop word [rax + rax]
cmp dword [rcx + 0x20], 2
jge 0x1401ca3fc
mov rcx, qword [rcx + 0x10]
jmp 0x1401ca402
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ca3f0
cmp rdx, rax
je 0x1401ca418
cmp dword [rdx + 0x20], 2
mov qword [rsp + 0x68], rdx
jle 0x1401ca41d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401ca575
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401ca575
cmp qword [rcx + 8], 0
seta al
test al, al
je 0x1401ca575
movabs rax, 0x8000000000000000
test qword [rsi + 0x40], rax
je 0x1401ca575
mov rdx, r13
mov rcx, r12
call fcn.1401c8800
test al, al
je 0x1401ca575
mov r8, qword [rsi + 0x50]
test r8, r8
jne 0x1401ca47f
xor ebx, ebx
jmp 0x1401ca4d2
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ca4a8
nop
cmp dword [rcx + 0x20], 2
jge 0x1401ca49c
mov rcx, qword [rcx + 0x10]
jmp 0x1401ca4a2
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ca490
cmp rdx, rax
je 0x1401ca4b8
cmp dword [rdx + 0x20], 2
mov qword [rsp + 0x68], rdx
jle 0x1401ca4bd
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
jne 0x1401ca4ce
xor ebx, ebx
jmp 0x1401ca4d2
mov rbx, qword [rax + 0x28]
mov rbx, qword [rbx]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d83e0
cmp rbx, qword [rax]
je 0x1401ca575
nop dword [rax]
mov rdx, qword [rbx + 0x20]
shr rdx, 0x20
mov rcx, qword [r12 + 8]
call fcn.1400fc4a0
test rax, rax
je 0x1401ca565
cmp byte [rbx + 0x19], 0
jne 0x1401ca556
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ca531
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ca556
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ca523
jmp 0x1401ca556
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ca553
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401ca553
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ca540
mov rbx, rax
mov rcx, rsi
call fcn.1400d83e0
cmp rbx, qword [rax]
jne 0x1401ca4f0
jmp 0x1401ca575
movaps xmm2, xmm6
mov edx, 0xa
mov rcx, rsi
call fcn.1400e4050
mov r8, qword [rsi + 0x50]
movss xmm15, dword [0x140372218]
movss xmm9, dword [0x140372078]
test r8, r8
je 0x1401ca657
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ca5bc
cmp dword [rcx + 0x20], 3
jge 0x1401ca5b0
mov rcx, qword [rcx + 0x10]
jmp 0x1401ca5b6
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ca5a4
cmp rdx, rax
je 0x1401ca5cc
cmp dword [rdx + 0x20], 3
mov qword [rsp + 0x68], rdx
jle 0x1401ca5d1
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401ca5f3
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401ca5f3
cmp qword [rcx + 8], 0
seta al
test al, al
jne 0x1401ca667
test r8, r8
je 0x1401ca657
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ca620
cmp dword [rcx + 0x20], 4
jge 0x1401ca614
mov rcx, qword [rcx + 0x10]
jmp 0x1401ca61a
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ca608
cmp rdx, rax
je 0x1401ca630
cmp dword [rdx + 0x20], 4
mov qword [rsp + 0x68], rdx
jle 0x1401ca635
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401ca657
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401ca657
cmp qword [rcx + 8], 0
seta al
test al, al
jne 0x1401ca667
mov rcx, rsi
call fcn.1400d8370
test al, al
je 0x1401ca7ef
movaps xmm2, xmm11
mov edx, 0xb
mov rcx, rsi
call fcn.1400e4050
movsxd rax, dword [r12 + 0x1a4]
cmp dword [r13 + 0xc], eax
jl 0x1401ca6a3
mov r8, rax
mov rdx, qword [r12 + 0x198]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
jne 0x1401ca6ce
movsxd rax, dword [r12 + 0x1b4]
cmp dword [r13 + 0xc], eax
jl 0x1401ca6df
mov r8, rax
mov rdx, qword [r12 + 0x1a8]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401ca6df
movaps xmm2, xmm11
mov edx, 0xc
mov rcx, rsi
call fcn.1400e4050
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 9
test al, 1
jne 0x1401ca776
bt rcx, 8
jb 0x1401ca70f
xor r8d, r8d
lea rdx, str..dll
mov rcx, r13
call fcn.1401fc9f0
test al, al
jne 0x1401ca776
mov rcx, rsi
call fcn.1401c66d0
mov rcx, rsi
cmp eax, 0xfa0
jb 0x1401ca72c
movaps xmm2, xmm15
mov edx, 0xd
jmp 0x1401ca771
mov rdx, qword [r12 + 8]
call fcn.1400d99f0
test eax, eax
jg 0x1401ca776
mov rdx, qword [r12 + 8]
mov rcx, rsi
call fcn.1400d9cd0
test eax, eax
jle 0x1401ca75a
movss xmm2, dword [0x140372214]
mov edx, 0xe
jmp 0x1401ca76e
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
jne 0x1401ca776
movaps xmm2, xmm9
mov edx, 0xf
mov rcx, rsi
call fcn.1400e4050
mov rcx, rsi
call fcn.1401c6100
test al, al
je 0x1401ca7c0
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401ca7af
mov edx, 4
mov rcx, rsi
call fcn.1400d8590
test al, al
je 0x1401ca7af
mov edx, 2
mov rcx, rsi
call fcn.1400d8590
test al, al
jne 0x1401ca7c0
movaps xmm2, xmm9
mov edx, 0x10
mov rcx, rsi
call fcn.1400e4050
mov rcx, rsi
call fcn.1401c6270
test al, al
je 0x1401ca7ef
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
je 0x1401ca7de
movaps xmm2, xmm10
jmp 0x1401ca7e2
movaps xmm2, xmm9
mov edx, 0x11
mov rcx, rsi
call fcn.1400e4050
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401ca8e8
mov rdx, r13
lea rcx, [rsp + 0x78]
call fcn.1400d44c0
nop
mov rdi, qword [r12 + 0x130]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401ca844
nop
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbx + 0x20]
call fcn.1402b71dc
test eax, eax
jns 0x1401ca838
mov rbx, qword [rbx + 0x10]
jmp 0x1401ca83e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401ca820
cmp rdi, qword [r12 + 0x130]
je 0x1401ca867
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402b71dc
test eax, eax
js 0x1401ca867
mov qword [rsp + 0x68], rdi
jmp 0x1401ca874
mov rax, qword [r12 + 0x130]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x68]
mov rbx, qword [rbx]
cmp rbx, qword [r12 + 0x130]
je 0x1401ca8d8
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d2fc0
nop
mov eax, dword [rsp + 0x64]
cmp dword [rbx + 0x3c], eax
jne 0x1401ca8b4
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x30]
call fcn.1402b71dc
test eax, eax
sete al
test al, al
jne 0x1401ca8c6
movaps xmm2, xmm12
mov edx, 0x12
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ca8d8
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
nop
cmp dword [rbp - 0x80], 0
jle 0x1401ca8e8
mov rcx, qword [rsp + 0x78]
call fcn.1402b7350
mov eax, dword [rsi + 0x40]
shr rax, 0x15
lea r15, vtable.Core::Array_class_Core::String_.0
movss xmm14, dword [0x1403720e8]
movss xmm10, dword [0x140371f88]
test al, 1
je 0x1401cafcb
mov rdx, r13
lea rcx, [rbp - 0x10]
call fcn.1400e3270
nop
mov rdi, qword [r12 + 0xf0]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401ca953
nop
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbx + 0x20]
call fcn.1402b71dc
test eax, eax
jns 0x1401ca947
mov rbx, qword [rbx + 0x10]
jmp 0x1401ca94d
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401ca930
cmp rdi, qword [r12 + 0xf0]
je 0x1401ca975
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rbp - 0x10]
call fcn.1402b71dc
test eax, eax
js 0x1401ca975
mov qword [rsp + 0x68], rdi
jmp 0x1401ca982
mov rax, qword [r12 + 0xf0]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r12 + 0xf0]
je 0x1401ca9a9
movss xmm2, dword [0x14037209c]
mov edx, 0x15
mov rcx, rsi
call fcn.1400e4050
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d44c0
nop
mov qword [rbp - 0x58], r15
xor ebx, ebx
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x48], rbx
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140345c60]
lea rcx, [rsp + 0x58]
call fcn.1401fe690
cmp dword [rbp - 0x50], 2
jg 0x1401caae6
mov rdx, r13
mov rcx, r12
call fcn.1401c8800
test al, al
jne 0x1401caae6
mov qword [rbp + 0x260], r15
mov dword [rbp + 0x268], ebx
mov qword [rbp + 0x270], rbx
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
nop
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140345f98]
lea rcx, [rsp + 0x58]
call fcn.1401fe690
test eax, eax
jle 0x1401caa96
mov edi, dword [rbp + 0x268]
test edi, edi
jle 0x1401caa96
mov r14, qword [rbp + 0x270]
nop dword [rax]
nop word [rax + rax]
movsxd rcx, ebx
shl rcx, 4
add rcx, r14
mov r8d, 1
lea rdx, str.plug
call fcn.1401fce20
test al, al
jne 0x1401caacf
inc ebx
cmp ebx, edi
jl 0x1401caa70
mov eax, dword [rsi + 0x40]
shr rax, 9
test al, 1
je 0x1401caaab
movss xmm2, dword [0x140372144]
jmp 0x1401caac1
mov rcx, rsi
call fcn.1400d1020
test al, al
je 0x1401caabd
movaps xmm2, xmm14
jmp 0x1401caac1
movaps xmm2, xmm9
mov edx, 0x14
mov rcx, rsi
call fcn.1400e4050
nop
mov qword [rbp + 0x260], r15
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
xor ebx, ebx
mov eax, dword [rsi + 0x40]
shr rax, 0xa
test al, 1
je 0x1401cab02
movaps xmm2, xmm13
mov edx, 0x13
mov rcx, rsi
call fcn.1400e4050
mov r8d, 2
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400d8440
nop
cmp dword [rbp - 0x7c], 0
jle 0x1401cab54
lea rdx, [rsp + 0x78]
mov rcx, qword [r12 + 8]
call fcn.1400fad80
test al, al
je 0x1401cab36
mov edx, 0x16
jmp 0x1401cab49
lea rcx, [rsp + 0x78]
call fcn.1401cd3a0
test al, al
je 0x1401cab54
mov edx, 0x1c
movaps xmm2, xmm6
mov rcx, rsi
call fcn.1400e4050
xor r12b, r12b
movdqa xmm0, xmmword [0x140372270]
movdqu xmmword [rbp + 0x260], xmm0
lea rdi, [rbp + 0x260]
nop
mov r8d, dword [rdi]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d8440
nop
xor r8d, r8d
lea rdx, str.TODO:
mov rcx, rax
call fcn.1401fc8b0
movzx r14d, al
cmp dword [rbp - 0x60], 0
jle 0x1401caba5
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
test r14b, r14b
jne 0x1401cabbb
inc ebx
add rdi, 4
movsxd rax, ebx
cmp rax, 4
jb 0x1401cab70
jmp 0x1401cabbe
mov r12b, 1
mov r8d, 3
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.1400d8440
nop
cmp dword [rbp - 0x6c], 0
jle 0x1401cac1c
mov r8d, 1
lea rdx, str.TODO:
lea rcx, [rbp - 0x78]
call fcn.1401ff2c0
test al, al
jne 0x1401cac0b
mov r8d, 1
lea rdx, str.aaaaa
lea rcx, [rbp - 0x78]
call fcn.1401ff2c0
test al, al
je 0x1401cac1c
movaps xmm2, xmm11
mov edx, 0x17
mov rcx, rsi
call fcn.1400e4050
xor r15b, r15b
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1400d8440
nop
cmp dword [rsp + 0x54], 0
je 0x1401cade4
mov r8d, 1
lea rdx, str.0.0.0.0
lea rcx, [rsp + 0x48]
call fcn.1401fce20
lea r14, vtable.Core::Array_class_Core::String_.0
test al, al
jne 0x1401cadeb
mov qword [rbp + 0x260], r14
mov dword [rbp + 0x268], 0
mov qword [rbp + 0x270], 0
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
nop
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140345c60]
lea rcx, [rsp + 0x48]
call fcn.1401fe690
cmp eax, 2
jge 0x1401cad8e
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x1403519e4]
lea rcx, [rsp + 0x48]
call fcn.1401fe690
cmp eax, 2
jl 0x1401cad8b
mov rdi, qword [0x140416ee8]
test rdi, rdi
jne 0x1401cacf1
xor ebx, ebx
jmp 0x1401cad2a
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401cacf5
test ebx, ebx
jle 0x1401cad2a
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x48]
call fcn.1402ba94c
jmp 0x1401cad31
cmp dword [rsp + 0x54], 0
jle 0x1401cad3d
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401fde50
mov eax, dword [rbp + 0x268]
test eax, eax
jle 0x1401cad8e
xor ebx, ebx
mov rdi, qword [rbp + 0x270]
mov r14d, eax
test rbx, rbx
jle 0x1401cad69
lea rdx, [0x140345c60]
lea rcx, [rsp + 0x48]
call fcn.1401fb190
mov rdx, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.1401fb190
inc rbx
add rdi, 0x10
dec r14
jne 0x1401cad53
lea r14, vtable.Core::Array_class_Core::String_.0
jmp 0x1401cad8e
mov r15b, 1
mov qword [rbp + 0x260], r14
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
test r15b, r15b
jne 0x1401cadeb
cmp dword [rbp - 0x6c], 0
jle 0x1401cae07
xor edi, edi
lea rbx, str.virus
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [rbp - 0x78]
call fcn.1401fc8b0
test al, al
jne 0x1401cae07
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, 5
jb 0x1401cadc0
jmp 0x1401cae07
lea r14, vtable.Core::Array_class_Core::String_.0
movss xmm13, dword [0x140372038]
movaps xmm2, xmm13
mov edx, 0x18
mov rcx, rsi
call fcn.1400e4050
jmp 0x1401cae10
movss xmm13, dword [0x140372038]
cmp dword [rbp - 0x7c], 3
jl 0x1401cae5d
lea rcx, [rsp + 0x78]
call fcn.1401c88c0
test al, al
jne 0x1401cae5d
mov r8d, 1
lea rdx, str.TODO:
lea rcx, [rsp + 0x78]
call fcn.1401ff2c0
test al, al
jne 0x1401cae5d
test r12b, r12b
jne 0x1401cae9e
mov r8d, 1
lea rdx, str.Microsoft_Corporation
lea rcx, [rsp + 0x78]
call fcn.1401fce20
jmp 0x1401cae9e
mov r8d, 5
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d8440
cmp dword [rax + 0xc], 5
jle 0x1401cae7b
movaps xmm6, xmm10
jmp 0x1401cae7f
movaps xmm6, xmm13
cmp dword [rbp - 0x60], 0
jle 0x1401cae8e
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
movaps xmm2, xmm6
mov edx, 0x1a
mov rcx, rsi
call fcn.1400e4050
mov rcx, rsi
call fcn.1401c5ef0
mov ebx, eax
test eax, eax
je 0x1401caefd
cmp eax, 1
jne 0x1401caebf
mov edx, eax
mov rcx, rsi
call fcn.1401c5e70
test al, al
jne 0x1401caefd
movd xmm6, ebx
cvtdq2ps xmm6, xmm6
mov edx, 8
mov rcx, rsi
call fcn.1401c5e70
test al, al
jne 0x1401caee8
mov edx, 0x100
mov rcx, rsi
call fcn.1401c5e70
test al, al
je 0x1401caeed
mulss xmm6, xmm11
movaps xmm2, xmm6
mov edx, 0x1d
mov rcx, rsi
call fcn.1400e4050
mov edx, 0x200
mov rcx, rsi
call fcn.1401c5e70
test al, al
je 0x1401caf1e
movaps xmm2, xmm7
mov edx, 0x43
mov rcx, rsi
call fcn.1400e4050
mov edx, 0x400
mov rcx, rsi
call fcn.1401c5e70
test al, al
je 0x1401caf40
movaps xmm2, xmm13
mov edx, 0x44
mov rcx, rsi
call fcn.1400e4050
mov edx, 0x800
mov rcx, rsi
call fcn.1401c5e70
test al, al
je 0x1401caf63
movaps xmm2, xmm13
mov edx, 0x45
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x50], 0
jle 0x1401caf75
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
nop
cmp dword [rbp - 0x70], 0
jle 0x1401caf85
mov rcx, qword [rbp - 0x78]
call fcn.1402b7350
nop
cmp dword [rbp - 0x80], 0
jle 0x1401caf96
mov rcx, qword [rsp + 0x78]
call fcn.1402b7350
nop
mov qword [rbp - 0x58], r14
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cafb8
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
nop
cmp dword [rbp - 8], 0
jle 0x1401cafc7
mov rcx, qword [rbp - 0x10]
call fcn.1402b7350
mov r12, qword [rbp - 0x30]
call fcn.140113b80
lea r14, [rsi + 0x20]
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
movsd xmm13, qword [0x140372178]
divsd xmm0, xmm13
cvtpd2ps xmm0, xmm0
xorps xmm6, xmm6
comiss xmm6, xmm0
jbe 0x1401cb012
movaps xmm2, xmm9
jmp 0x1401cb0af
call fcn.140113b80
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
comiss xmm12, xmm1
jbe 0x1401cb047
movaps xmm2, xmm11
jmp 0x1401cb0af
call fcn.140113b80
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
comiss xmm7, xmm1
ja 0x1401cb0ab
call fcn.140113b80
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x140372144]
comiss xmm0, xmm1
jbe 0x1401cb0bc
movaps xmm2, xmm10
mov edx, 0x1e
mov rcx, rsi
call fcn.1400e4050
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cb1f3
mov rcx, rsi
call fcn.1400d7e10
movss xmm7, dword [0x140372098]
comiss xmm7, xmm0
ja 0x1401cb1fb
mov rcx, rsi
call fcn.1400d7e10
mov rcx, rsi
comiss xmm12, xmm0
jbe 0x1401cb122
call fcn.1401c5ef0
movss xmm8, dword [0x140372038]
cmp eax, 2
jl 0x1401cb204
movaps xmm2, xmm8
mov edx, 0x20
mov rcx, rsi
call fcn.1400e4050
jmp 0x1401cb204
call fcn.1400d7e10
comiss xmm8, xmm0
jbe 0x1401cb183
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401cb15c
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401cb15c
movaps xmm6, xmm10
cmp dword [rsi + 0x38], 0x400000
jb 0x1401cb16c
addss xmm6, xmm11
jmp 0x1401cb171
addss xmm6, xmm9
movaps xmm2, xmm6
mov edx, 0x20
mov rcx, rsi
call fcn.1400e4050
jmp 0x1401cb1fb
mov rcx, rsi
call fcn.1400d7e10
comiss xmm0, xmm8
jb 0x1401cb1fb
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401cb1c0
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401cb1c0
movaps xmm6, xmm11
movss xmm8, dword [0x140372038]
cmp dword [rsi + 0x38], 0x400000
jb 0x1401cb1d9
addss xmm6, xmm8
jmp 0x1401cb1e1
addss xmm6, dword [0x1403720e0]
movaps xmm2, xmm6
mov edx, 0x20
mov rcx, rsi
call fcn.1400e4050
jmp 0x1401cb204
movss xmm7, dword [0x140372098]
movss xmm8, dword [0x140372038]
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cb3d6
mov edx, 6
mov rcx, rsi
call fcn.1400d8590
test al, al
je 0x1401cb2ab
mov r8d, 6
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1400d8440
nop
cmp dword [rsp + 0x64], 0
je 0x1401cb29a
mov rbx, qword [rsp + 0x58]
mov r8d, 0xa
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.1402ba758
mov rdx, qword [rsp + 0x68]
sub rdx, rbx
sar rdx, 1
movsxd rcx, dword [rsp + 0x64]
cmp rdx, rcx
jne 0x1401cb29a
lea ecx, [rax + 0x7fffffff]
cmp ecx, 0xfffffffd
ja 0x1401cb29a
dec eax
cmp eax, 0x2fe
ja 0x1401cb29a
movss xmm2, dword [0x140372144]
mov edx, 0x25
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cb2ab
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x10
test al, 1
je 0x1401cb373
shr rcx, 0x26
test cl, 1
je 0x1401cb2dc
movss xmm2, dword [0x140372188]
mov edx, 0x21
mov rcx, rsi
call fcn.1400e4050
movss xmm2, dword [0x140372140]
mov edx, 0x24
mov rcx, rsi
call fcn.1400e4050
xor r15d, r15d
mov qword [rbp - 0x80], r15
lea edx, [r15 + 0x16]
lea rcx, [rsp + 0x78]
call fcn.1401fcb40
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
lea r9d, [r15 + 0x16]
lea r8, str.Labels_EwsAuthenticode
mov rcx, qword [rsp + 0x78]
call fcn.1402ba94c
lea edx, [r15 + 0x16]
lea rcx, [rsp + 0x78]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.1400f4800
nop
cmp dword [rbp - 0x80], r15d
jle 0x1401cb352
mov rcx, qword [rsp + 0x78]
call fcn.1402b7350
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.1401683e0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cb3d9
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
jmp 0x1401cb3d9
mov rax, rcx
shr rax, 0x1a
test al, 1
je 0x1401cb3d6
mov rax, rcx
shr rax, 0x26
test al, 1
je 0x1401cb39b
movss xmm2, dword [0x140372188]
mov edx, 0x21
mov rcx, rsi
jmp 0x1401cb3d1
shr rcx, 0x11
test cl, 1
mov rcx, rsi
je 0x1401cb3c4
call fcn.1400d1020
test al, al
je 0x1401cb3b6
movaps xmm2, xmm12
jmp 0x1401cb3ba
movaps xmm2, xmm8
mov edx, 0x26
mov rcx, rsi
jmp 0x1401cb3d1
movss xmm2, dword [0x14037222c]
mov edx, 0x22
call fcn.1400e4050
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cb437
shr rcx, 0x1a
test cl, 1
je 0x1401cb437
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e3270
nop
xor r8d, r8d
lea rdx, str..cpl
mov rcx, rax
call fcn.1401fce20
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401cb422
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
test bl, bl
je 0x1401cb437
movaps xmm2, xmm8
mov edx, 0x23
mov rcx, rsi
call fcn.1400e4050
mov rcx, rsi
call fcn.1400d1020
mov edi, 0x5c
test al, al
je 0x1401cb9a4
mov rcx, rsi
call fcn.1400d8870
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d8870
cmp rbx, qword [rax]
je 0x1401cb891
movss xmm15, dword [0x140372144]
mov r14d, edi
nop word [rax + rax]
mov qword [rsp + 0x50], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401cb49e
lea rax, [0x140346ce0]
mov qword [rsp + 0x48], rax
jmp 0x1401cb4c3
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.1402ba94c
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.1401fde50
nop
mov r8d, 1
lea rdx, [0x140345d54]
lea rcx, [rsp + 0x48]
call fcn.1401ff2c0
test al, al
je 0x1401cb7d3
mov edx, r14d
mov rcx, qword [rsp + 0x48]
call fcn.1402ba4e4
mov rdi, rax
test rax, rax
je 0x1401cb79f
sub rdi, qword [rsp + 0x48]
sar rdi, 1
test edi, edi
jle 0x1401cb79f
mov r8d, 1
lea rdx, [0x140345fb0]
lea rcx, [rsp + 0x48]
call fcn.1401ff2c0
test al, al
je 0x1401cb547
lea r8d, [rdi + 1]
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.1401fd150
mov edi, eax
test edi, edi
jle 0x1401cb79f
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.1401feab0
nop
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x78]
call fcn.1401ff2c0
test al, al
jne 0x1401cb73b
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun
lea rcx, [rsp + 0x78]
call fcn.1401ff2c0
test al, al
jne 0x1401cb73b
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
lea rcx, [rsp + 0x78]
call fcn.1401ff2c0
lea rcx, [rsp + 0x78]
test al, al
je 0x1401cb6a1
mov r8d, 0x36
lea rdx, [rsp + 0x58]
call fcn.1401feab0
nop
xor r8d, r8d
lea rdx, str.Notify_
lea rcx, [rsp + 0x58]
call fcn.1401ff2c0
test al, al
je 0x1401cb600
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cb5f6
movaps xmm2, xmm11
jmp 0x1401cb5f9
movaps xmm2, xmm7
mov edx, 0x2d
jmp 0x1401cb67e
xor r8d, r8d
lea rdx, str.Shell
lea rcx, [rsp + 0x58]
call fcn.1401fce20
test al, al
jne 0x1401cb648
xor r8d, r8d
lea rdx, str.UserInit
lea rcx, [rsp + 0x58]
call fcn.1401fce20
test al, al
jne 0x1401cb648
xor r8d, r8d
lea rdx, str.System
lea rcx, [rsp + 0x58]
call fcn.1401fce20
test al, al
je 0x1401cb687
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x30
test al, 1
je 0x1401cb666
shr rcx, 0x15
test cl, 1
je 0x1401cb675
movaps xmm2, xmm15
jmp 0x1401cb679
shr rcx, 0x1a
test cl, 1
je 0x1401cb675
movaps xmm2, xmm8
jmp 0x1401cb679
movaps xmm2, xmm12
mov edx, 0x2e
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cb78f
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
jmp 0x1401cb78f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindowsAppInit_DLLs
call fcn.1401fce20
test al, al
je 0x1401cb6d3
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cb6c5
movaps xmm2, xmm8
jmp 0x1401cb6c9
movaps xmm2, xmm12
mov edx, 0x2f
jmp 0x1401cb786
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
lea rcx, [rsp + 0x78]
call fcn.1401fce20
test al, al
je 0x1401cb707
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cb6fc
movaps xmm2, xmm8
jmp 0x1401cb700
movaps xmm2, xmm12
mov edx, 0x30
jmp 0x1401cb786
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
lea rcx, [rsp + 0x78]
call fcn.1401ff2c0
test al, al
je 0x1401cb78f
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cb730
movaps xmm2, xmm11
jmp 0x1401cb734
movaps xmm2, xmm12
mov edx, 0x31
jmp 0x1401cb786
movaps xmm6, xmm8
movsxd rax, dword [r12 + 0x1e4]
cmp dword [r13 + 0xc], eax
jl 0x1401cb77e
mov r8, rax
mov rdx, qword [r12 + 0x1d8]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401cb77e
mov edx, 4
mov rcx, rsi
call fcn.1401c2a60
test al, al
jne 0x1401cb77e
movaps xmm6, xmm7
movaps xmm2, xmm6
mov edx, 0x2c
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rbp - 0x80], 0
jle 0x1401cb79f
mov rcx, qword [rsp + 0x78]
call fcn.1402b7350
xor r8d, r8d
lea rdx, str.HKLMSYSTEMCurrentControlSetControlSecurityProvidersSecurityProviders
lea rcx, [rsp + 0x48]
call fcn.1401ff2c0
test al, al
je 0x1401cb809
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cb7c8
movaps xmm2, xmm8
jmp 0x1401cb7cc
movaps xmm2, xmm12
mov edx, 0x32
jmp 0x1401cb800
lea rdx, [rsp + 0x48]
mov rcx, qword [r12 + 8]
call fcn.1400f9ac0
test al, al
je 0x1401cb809
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cb7f7
movaps xmm2, xmm10
jmp 0x1401cb7fb
movaps xmm2, xmm9
mov edx, 0x33
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x50], 0
jle 0x1401cb81a
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
cmp byte [rbx + 0x19], 0
jne 0x1401cb86e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cb84e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cb86e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cb840
jmp 0x1401cb86e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cb86b
cmp rbx, qword [rax + 0x10]
jne 0x1401cb86b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cb858
mov rbx, rax
mov rcx, rsi
call fcn.1400d8870
cmp rbx, qword [rax]
jne 0x1401cb480
movss xmm15, dword [0x140372218]
lea r14, [rsi + 0x20]
mov edi, 0x5c
mov rcx, rsi
call fcn.1400d8870
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d8870
cmp rbx, qword [rax]
je 0x1401cb9a4
lea rdi, [0x140346ce0]
nop word [rax + rax]
mov qword [rbp - 0x70], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401cb8d5
mov qword [rbp - 0x78], rdi
jmp 0x1401cb8f7
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401fde50
nop
mov r8d, 1
lea rdx, [0x140345d54]
lea rcx, [rbp - 0x78]
call fcn.1401ff2c0
test al, al
je 0x1401cb935
mov r8d, 1
lea rdx, str._shellopencommand_
lea rcx, [rbp - 0x78]
call fcn.1401fc9f0
nop
cmp dword [rbp - 0x70], 0
jle 0x1401cb944
mov rcx, qword [rbp - 0x78]
call fcn.1402b7350
cmp byte [rbx + 0x19], 0
jne 0x1401cb98e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cb96e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cb98e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cb960
jmp 0x1401cb98e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cb98b
cmp rbx, qword [rax + 0x10]
jne 0x1401cb98b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cb978
mov rbx, rax
mov rcx, rsi
call fcn.1400d8870
cmp rbx, qword [rax]
jne 0x1401cb8c0
mov edi, 0x5c
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 9
test al, 1
je 0x1401cb9d1
shr rcx, 0x1a
test cl, 1
jne 0x1401cb9c0
movaps xmm10, xmm8
movaps xmm2, xmm10
mov edx, 0x34
mov rcx, rsi
call fcn.1400e4050
xor r15b, r15b
mov byte [rsp + 0x40], r15b
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x26
movss xmm7, dword [0x140372230]
test al, 1
jne 0x1401cbd6b
mov rax, rcx
shr rax, 0x20
test al, 1
jne 0x1401cbd6b
mov rax, rcx
shr rax, 0x22
test al, 1
jne 0x1401cbd6b
shr rcx, 0xa
test cl, 1
jne 0x1401cbd6b
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e3270
nop
mov r8d, 1
lea rdx, str..cpl
mov rcx, rax
call fcn.1401fce20
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401cba53
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
test bl, bl
jne 0x1401cbd6b
mov rdx, r13
lea rcx, [rsp + 0x68]
call fcn.1400d2fc0
nop
xorps xmm8, xmm8
movaps xmm6, xmm8
mov rdx, r13
mov rcx, qword [r12 + 8]
call fcn.1400f5230
test al, al
je 0x1401cba8f
movss xmm6, dword [0x140372238]
jmp 0x1401cbbce
mov qword [rsp + 0x50], 0
mov edx, dword [rsp + 0x74]
test edx, edx
jne 0x1401cbaae
lea rax, [0x140346ce0]
mov qword [rsp + 0x48], rax
jmp 0x1401cbad9
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd r9, dword [rsp + 0x74]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call fcn.1402ba94c
mov edx, dword [rsp + 0x74]
lea rcx, [rsp + 0x48]
call fcn.1401fde50
nop
cmp dword [rsp + 0x54], 3
jle 0x1401cbbb1
lea rdx, [rsp + 0x48]
mov rcx, qword [r12 + 8]
call fcn.1400f52f0
test al, al
jne 0x1401cbb90
cmp dword [rsp + 0x54], 0
je 0x1401cbbb1
mov edx, edi
mov rcx, qword [rsp + 0x48]
call fcn.1402ba31c
test rax, rax
je 0x1401cbbb1
sub rax, qword [rsp + 0x48]
sar rax, 1
test eax, eax
js 0x1401cbbb1
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.1400d2fc0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsp + 0x50]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x48]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x48]
call fcn.1401fde50
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cbae4
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
jmp 0x1401cbae4
xor r8d, r8d
lea rdx, str.ExpertHelper
lea rcx, [rsp + 0x68]
call fcn.1401fc8b0
test al, al
je 0x1401cbbae
movaps xmm6, xmm15
jmp 0x1401cbbb1
movaps xmm6, xmm7
cmp dword [rsp + 0x50], 0
jle 0x1401cbbc2
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
ucomiss xmm6, xmm8
jp 0x1401cbbce
je 0x1401cbd51
cmp dword [rsp + 0x74], 3
jle 0x1401cbd51
mov edx, edi
mov r8d, 3
lea rcx, [rsp + 0x68]
call fcn.1401fd150
cmp eax, 0xffffffff
je 0x1401cbd51
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1c4], eax
jne 0x1401cbc21
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1b8]
call fcn.1402b71dc
test eax, eax
sete al
test al, al
jne 0x1401cbd51
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1d4], eax
jne 0x1401cbc4e
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1c8]
call fcn.1402b71dc
test eax, eax
sete al
test al, al
jne 0x1401cbd51
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1e4], eax
jne 0x1401cbc7b
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1d8]
call fcn.1402b71dc
test eax, eax
sete al
test al, al
jne 0x1401cbd51
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1f4], eax
jne 0x1401cbca8
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1e8]
call fcn.1402b71dc
test eax, eax
sete al
test al, al
jne 0x1401cbd51
mov rax, qword [r12 + 0x140]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401cbd38
nop dword [rax]
movsxd rax, dword [rbx + 0x2c]
cmp dword [rsp + 0x74], eax
jl 0x1401cbce4
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x68]
call fcn.1402b9158
test eax, eax
sete al
test al, al
jne 0x1401cbd51
cmp byte [rbx + 0x19], 0
jne 0x1401cbd2e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cbd0e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cbd2e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cbd00
jmp 0x1401cbd2e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cbd2b
cmp rbx, qword [rax + 0x10]
jne 0x1401cbd2b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cbd18
mov rbx, rax
cmp rbx, qword [r12 + 0x140]
jne 0x1401cbcc0
mov r15b, 1
mov byte [rsp + 0x40], r15b
movaps xmm2, xmm6
mov edx, 0x35
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x70], 0
jle 0x1401cbd62
mov rcx, qword [rsp + 0x68]
call fcn.1402b7350
test r15b, r15b
jne 0x1401cc3af
movsxd rax, dword [r12 + 0x1d4]
cmp dword [r13 + 0xc], eax
jl 0x1401cbd9a
mov r8, rax
mov rdx, qword [r12 + 0x1c8]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
jne 0x1401cc3af
movsxd rax, dword [r12 + 0x1c4]
cmp dword [r13 + 0xc], eax
jl 0x1401cc3af
mov r8, rax
mov rdx, qword [r12 + 0x1b8]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401cc3af
mov eax, dword [rsi + 0x14]
cmp eax, dword [r12 + 0x1c4]
jle 0x1401cc3af
xor edx, edx
mov r14d, edx
mov dword [rbp - 0x40], edx
cmp dword [r12 + 0x158], edx
jl 0x1401cc3ab
mov r15d, edx
mov qword [rbp], rdx
mov r13, 0xfffffffffffffff0
mov qword [rbp - 0x38], r13
lea rcx, [0x140345fb8]
movss xmm8, dword [0x140372234]
nop word [rax + rax]
lea rdi, [0x140345fb0]
test r14d, r14d
cmove rdi, rcx
test rdi, rdi
jne 0x1401cbe3c
mov ebx, edx
mov qword [rsp + 0x50], rdi
jmp 0x1401cbe57
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401cbe40
mov qword [rsp + 0x50], 0
test ebx, ebx
jne 0x1401cbe65
lea rax, [0x140346ce0]
mov qword [rsp + 0x48], rax
jmp 0x1401cbe8a
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x48]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401fde50
nop
test r15, r15
jle 0x1401cbf27
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd rcx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401fde50
mov rdi, qword [r12 + 0x160]
mov ebx, dword [rsp + 0x54]
add ebx, dword [r13 + rdi + 0xc]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd r9, dword [r13 + rdi + 0xc]
mov ecx, dword [rsp + 0x50]
movsxd rax, dword [rsp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [r13 + rdi]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401fde50
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401fcb40
movsxd rcx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401fde50
lea rdx, [0x14034f270]
lea rcx, [rsp + 0x48]
call fcn.1401fb190
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400eb0d0
mov r12, rax
test rax, rax
je 0x1401cc35c
mov rax, qword [rbp - 0x30]
mov r8d, dword [rax + 0x1c4]
inc r8d
lea rdx, [rbp - 0x68]
lea rcx, [rsi + 8]
call fcn.1401feab0
nop
lea rdi, vtable.Core::Array_class_Core::String_.0
mov qword [rbp - 0x58], rdi
xor ebx, ebx
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x48], rbx
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140345f98]
lea rcx, [rbp - 0x68]
call fcn.1401fe690
test eax, eax
jle 0x1401cc32d
lea rax, [0x140346ce0]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rbx
mov eax, ebx
cmp dword [rbp - 0x50], 2
setg al
inc eax
mov r14d, ebx
movsxd r15, eax
test eax, eax
jle 0x1401cc315
mov r13, qword [rbp - 0x48]
lea rdi, [r13 + 0xc]
cmp dword [rdi], 3
jle 0x1401cc037
movsxd rdx, r14d
shl rdx, 4
add rdx, r13
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax + 8]
call fcn.1400f4dd0
test al, al
jne 0x1401cc048
inc r14d
inc rbx
add rdi, 0x10
cmp rbx, r15
jge 0x1401cc082
jmp 0x1401cc017
shl rbx, 4
add rbx, r13
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x78]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401fde50
cmp dword [rbp - 0x7c], 0
jle 0x1401cc30a
movaps xmm6, xmm7
mov byte [rsp + 0x40], 1
mov eax, dword [rsi + 0x40]
bt rax, 8
jb 0x1401cc0b9
xor r8d, r8d
lea rdx, str..dll
lea rcx, [rsi + 8]
call fcn.1401fc9f0
test al, al
je 0x1401cc0b9
movaps xmm6, xmm8
xor r15d, r15d
mov qword [rbp - 0x10], r15
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401cc30a
lea ecx, [rax + 0x10]
call fcn.1402b6dbc
mov rdi, rax
lea r14, vtable.Core::Win32::RegistryKey.0
test rax, rax
je 0x1401cc10e
mov rax, qword [rbp - 0x10]
mov qword [rdi], r14
mov qword [rdi + 8], rax
jmp 0x1401cc111
mov rdi, r15
test rdi, rdi
je 0x1401cc30a
lea rbx, [0x140346ce0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r15
lea r8, [rbp - 0x78]
lea rdx, str.Publisher
mov rcx, rdi
call fcn.1400d8ae0
xor r8d, r8d
lea rdx, str.virus
lea rcx, [rbp - 0x78]
call fcn.1401fc8b0
test al, al
jne 0x1401cc2e8
xor r8d, r8d
lea rdx, str.anti
lea rcx, [rbp - 0x78]
call fcn.1401fc8b0
test al, al
jne 0x1401cc2e8
movaps xmm2, xmm6
mov edx, 0x35
mov rcx, rsi
call fcn.1400e4050
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r15
lea r8, [rsp + 0x58]
lea rdx, str.DisplayName
mov rcx, rdi
call fcn.1400d8ae0
test al, al
je 0x1401cc2d5
mov eax, dword [rbp - 0x6c]
test eax, eax
jne 0x1401cc1ea
lea edx, [rax + 9]
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 9
lea r8, [0x140362d78]
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, 9
lea rcx, [rbp - 0x78]
call fcn.1401fde50
mov eax, dword [rbp - 0x6c]
cmp eax, 3
jle 0x1401cc2d5
cmp dword [rsp + 0x64], 3
jle 0x1401cc2d5
mov r9, qword [rsp + 0x58]
mov r8, qword [rbp - 0x78]
lea rdx, str.SOFTWARE_ws_ws
lea rcx, [rbp + 0x260]
call fcn.1401fcfe0
mov rbx, rax
mov ecx, dword [0x140429a30]
test cl, 1
jne 0x1401cc24f
or ecx, 1
mov dword [0x140429a30], ecx
mov qword [0x140429a08], r14
mov qword [0x140429a10], 0xffffffff80000001
lea rcx, [0x1402fedf0]
call fcn.1402b8a74
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [0x140429a10]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401cc299
lea ecx, [rax + 0x10]
call fcn.1402b6dbc
mov rbx, rax
test rax, rax
je 0x1401cc299
mov rax, qword [rsp + 0x68]
mov qword [rbx], r14
mov qword [rbx + 8], rax
jmp 0x1401cc29c
mov rbx, r15
cmp dword [rbp + 0x268], 0
jle 0x1401cc2b1
mov rcx, qword [rbp + 0x260]
call fcn.1402b7350
test rbx, rbx
je 0x1401cc2d5
movaps xmm2, xmm15
mov edx, 0x36
mov rcx, rsi
call fcn.1400e4050
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cc2ed
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
jmp 0x1401cc2ed
mov byte [rsp + 0x40], 0
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp - 0x70], 0
jle 0x1401cc30a
mov rcx, qword [rbp - 0x78]
call fcn.1402b7350
mov r13, qword [rbp - 0x38]
lea rdi, vtable.Core::Array_class_Core::String_.0
cmp dword [rbp - 0x80], 0
jle 0x1401cc325
mov rcx, qword [rsp + 0x78]
call fcn.1402b7350
mov r15, qword [rbp]
mov r14d, dword [rbp - 0x40]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp - 0x58], rdi
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cc35c
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
nop
cmp dword [rsp + 0x50], 0
jle 0x1401cc36d
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
inc r14d
mov dword [rbp - 0x40], r14d
inc r15
mov qword [rbp], r15
add r13, 0x10
mov qword [rbp - 0x38], r13
mov r12, qword [rbp - 0x30]
cmp r14d, dword [r12 + 0x158]
lea rcx, [0x140345fb8]
mov edx, 0
jle 0x1401cbe20
movzx r15d, byte [rsp + 0x40]
lea r13, [rsi + 8]
lea r14, [rsi + 0x20]
xor dil, dil
mov edx, 7
mov rcx, rsi
call fcn.1400d8590
test al, al
jne 0x1401cc485
mov rcx, rsi
call fcn.1400d7e10
movss xmm6, dword [0x14037209c]
comiss xmm6, xmm0
ja 0x1401cc48d
cmp dword [rsi + 0x38], 0x500000
jae 0x1401cc48d
call fcn.140113b80
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm0, xmm0
comiss xmm0, dword [0x140372140]
ja 0x1401cc48d
lea rax, [0x140346ce0]
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.1400d79e0
nop
lea r9, [rsp + 0x58]
mov r8, rax
mov rdx, r13
mov rcx, qword [r12 + 0x228]
call fcn.1401f6fa0
nop
test al, al
je 0x1401cc472
mov dil, 1
lea r8, [rsp + 0x58]
mov edx, 7
mov rcx, rsi
call fcn.14000b8f0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cc48d
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
jmp 0x1401cc48d
movss xmm6, dword [0x14037209c]
mov edx, 7
mov rcx, rsi
call fcn.1400d8590
test al, al
je 0x1401cc50a
mov r8d, 7
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d8440
nop
mov byte [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x68]
mov rcx, r12
call fcn.1401ccf60
movzx ebx, byte [rsp + 0x40]
test al, al
je 0x1401cc4e9
test bl, bl
je 0x1401cc4ed
movss xmm2, dword [0x1403720e0]
mov edx, 0x38
mov rcx, rsi
call fcn.1400e4050
test bl, bl
jne 0x1401cc4fb
test dil, dil
je 0x1401cc4fb
mov rcx, rsi
call fcn.1401c6420
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cc50a
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
test r15b, r15b
je 0x1401cc689
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400d2fc0
nop
lea r14, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.0
mov qword [rbp + 0x260], r14
lea r15, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.1.0
mov qword [rbp + 0x268], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
xor edi, edi
mov dword [rbp + 0x280], edi
lea r8, [rbp + 0x260]
lea rdx, [rbp - 0x68]
mov rcx, qword [r12 + 8]
call fcn.1400f5500
test al, al
je 0x1401cc65f
lea ecx, [rdi + 0x18]
call fcn.1402b6dbc
mov rbx, rax
test rax, rax
je 0x1401cc597
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
mov qword [rbx], rax
lea rax, [rbp + 0x260]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rdi
jmp 0x1401cc59a
mov rbx, rdi
lea rax, vtable.Core::SharedPtr_class_Core::Collections::Generic::IEnumerator_class_Core::String__.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
test rbx, rbx
je 0x1401cc5dc
mov ecx, 4
call fcn.1402b6dbc
mov rdi, rax
test rax, rax
je 0x1401cc5d0
mov dword [rax], 0
mov qword [rbp - 0x48], rax
jmp 0x1401cc5d6
xor edi, edi
mov qword [rbp - 0x48], rdi
mov dword [rdi], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
je 0x1401cc63a
nop dword [rax + rax]
mov byte [rsp + 0x40], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r8, rax
lea r9, [rsp + 0x40]
mov rcx, r12
call fcn.1401ccf60
test al, al
je 0x1401cc62e
cmp byte [rsp + 0x40], 0
je 0x1401cc62e
movss xmm2, dword [0x1403720e0]
mov edx, 0x39
mov rcx, rsi
call fcn.1400e4050
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
jne 0x1401cc5f0
test rdi, rdi
je 0x1401cc65f
mov eax, dword [rdi]
test eax, eax
jle 0x1401cc649
dec eax
mov dword [rdi], eax
cmp dword [rdi], 0
jne 0x1401cc65f
mov rcx, rbx
call fcn.1402150f0
mov rcx, rdi
call fcn.1402150f0
nop
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x268], r15
lea rcx, [rbp + 0x268]
call fcn.140118ed0
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cc689
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.1400d8720
nop
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.14000a400
nop
mov rdx, rax
lea rcx, [r12 + 0xd0]
call fcn.14000a580
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x260]
lea rcx, [r12 + 0xd0]
call fcn.1401cdab0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401cc6e5
mov rcx, qword [rbp - 0x58]
call fcn.1402b7350
mov edx, 7
mov rcx, rsi
call fcn.1400d8590
test al, al
je 0x1401cc8cb
mov rdx, qword [r13]
lea rcx, str.INTERNET_FILE:__ws_r_n
call fcn.1402b7a88
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.14000a400
nop
mov rdx, rax
lea rcx, [r12 + 0xc0]
call fcn.14000a580
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x260]
lea rcx, [r12 + 0xc0]
call fcn.1401cdab0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401cc759
mov rcx, qword [rbp - 0x58]
call fcn.1402b7350
mov rbx, qword [r12 + 0xd0]
mov r8, qword [rbx + 8]
cmp byte [r8 + 0x19], 0
jne 0x1401cc7b0
nop dword [rax]
mov rax, qword [r8 + 0x20]
mov r9, qword [rbp - 0x28]
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x1401cc794
add rax, 2
test ecx, ecx
jne 0x1401cc780
test edx, edx
jns 0x1401cc79e
mov r8, qword [r8 + 0x10]
jmp 0x1401cc7a4
mov rbx, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], 0
je 0x1401cc770
nop dword [rax + rax]
mov r10, qword [r12 + 0xd0]
mov r8, qword [r10 + 8]
cmp byte [r8 + 0x19], 0
jne 0x1401cc80b
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp - 0x28]
mov r9, qword [r8 + 0x20]
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x1401cc7f4
add rax, 2
test ecx, ecx
jne 0x1401cc7e0
test edx, edx
jns 0x1401cc800
mov r10, r8
mov r8, qword [r8]
jmp 0x1401cc804
mov r8, qword [r8 + 0x10]
cmp byte [r8 + 0x19], 0
je 0x1401cc7d0
cmp rbx, r10
je 0x1401cc9f9
mov rdi, qword [rbx + 0x30]
cmp rdi, rsi
je 0x1401cc86d
mov edx, 7
mov rcx, rdi
call fcn.1400d8590
test al, al
jne 0x1401cc86d
mov rdx, qword [rdi + 8]
lea rcx, str.RE_QUEUEING:__s_r_n
call fcn.1402b9694
mov rax, qword [rbx + 0x30]
mov edx, dword [rax + 0x38]
lea rcx, str._tSize_u_r_n
call fcn.1402b9694
mov rdx, qword [rbp - 0x28]
lea rcx, str._tHash_s_r_n
call fcn.1402b9694
mov rdx, qword [rbx + 0x30]
mov rcx, r12
call fcn.1401c7060
cmp byte [rbx + 0x19], 0
jne 0x1401cc7b0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cc8a2
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cc7b0
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cc891
jmp 0x1401cc7b0
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cc8c3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401cc8c3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cc8b0
mov rbx, rax
jmp 0x1401cc7b0
cmp qword [r12 + 0xc8], 0
jbe 0x1401cc9f9
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x18]
lea rcx, [r12 + 0xc0]
call fcn.1400c8c90
mov rax, qword [rax]
cmp rax, qword [r12 + 0xc0]
je 0x1401cc9f9
mov rbx, qword [rax + 0x30]
mov r8, qword [rbx + 8]
mov rdx, qword [r13]
lea rcx, str.FILE_CAME_FROM_INTERNET_r_n_ws_r_n_ws_r_n
call fcn.1402b7a88
mov edx, 0xb
mov rcx, rsi
call fcn.1400d7ee0
mov rdx, r13
mov rcx, r12
test al, al
je 0x1401cc943
call fcn.1401c8800
movss xmm13, dword [0x140372038]
test al, al
jne 0x1401cc95b
jmp 0x1401cc95f
call fcn.1401c8800
movss xmm13, dword [0x140372038]
test al, al
je 0x1401cc95b
movaps xmm14, xmm13
jmp 0x1401cc95f
movaps xmm14, xmm6
movaps xmm2, xmm14
mov edx, 0x3a
mov rcx, rsi
call fcn.1400e4050
mov r8d, 7
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400d8440
nop
cmp dword [rsp + 0x64], 0
jle 0x1401cc9e6
mov edx, 7
mov rcx, rsi
call fcn.1400d8590
test al, al
jne 0x1401cc9ae
lea r8, [rsp + 0x58]
mov edx, 7
mov rcx, rsi
call fcn.14000b8f0
mov byte [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x58]
mov rcx, r12
call fcn.1401ccf60
test al, al
je 0x1401cc9e6
cmp byte [rsp + 0x40], 0
je 0x1401cc9e6
movss xmm2, dword [0x1403720e0]
mov edx, 0x38
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cca02
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
jmp 0x1401cca02
movss xmm13, dword [0x140372038]
mov edx, 7
mov rcx, rsi
call fcn.1400d7ee0
test al, al
je 0x1401cca73
mov edx, 9
mov rcx, rsi
call fcn.1400d7ee0
test al, al
je 0x1401cca73
mov eax, dword [rsi + 0x40]
shr rax, 9
test al, 1
jne 0x1401cca73
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e3270
nop
xor r8d, r8d
lea rdx, str..sys
lea rcx, [rbp - 0x68]
call fcn.1401fce20
test al, al
je 0x1401cca64
movaps xmm2, xmm6
mov edx, 0x37
mov rcx, rsi
call fcn.1400e4050
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cca73
mov rcx, qword [rbp - 0x68]
call fcn.1402b7350
mov eax, dword [rsi + 0x40]
shr rax, 0x1c
test al, 1
je 0x1401ccaa0
mov edx, 0x800
mov rcx, rsi
call fcn.1401c2a60
test al, al
je 0x1401ccaa0
movaps xmm2, xmm13
mov edx, 0x41
mov rcx, rsi
call fcn.1400e4050
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401ccc06
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401ccc06
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402b9158
test eax, eax
sete al
test al, al
je 0x1401ccc06
xor r8d, r8d
lea rdx, str.services.exe
mov rcx, r13
call fcn.1401fc9f0
test al, al
je 0x1401ccc06
xor eax, eax
mov qword [rbp - 0x80], rax
lea edx, [rax + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401fcb40
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0xc
lea r8, str.services.exe
mov rcx, qword [rsp + 0x78]
call fcn.1402ba94c
mov edx, 0xc
lea rcx, [rsp + 0x78]
call fcn.1401fde50
nop
lea r8, [rsp + 0x78]
lea rdx, [r12 + 0x178]
lea rcx, [rsp + 0x58]
call fcn.1400d2ba0
nop
cmp dword [rbp - 0x80], 0
jle 0x1401ccb66
mov rcx, qword [rsp + 0x78]
call fcn.1402b7350
mov eax, dword [r13 + 0xc]
cmp dword [rsp + 0x64], eax
jne 0x1401ccbf5
mov rdx, qword [r13]
mov rcx, qword [rsp + 0x58]
call fcn.1402b71dc
test eax, eax
sete al
test al, al
je 0x1401ccbf5
mov eax, dword [rsi + 0x40]
shr rax, 0xe
movss xmm6, dword [0x140372144]
test al, 1
jne 0x1401ccbc6
cmp byte [r12 + 0x30], 0
je 0x1401ccbc6
movaps xmm2, xmm6
mov edx, 0x40
mov rcx, rsi
call fcn.1400e4050
movabs rbx, 0x2000000000
or qword [rsi + 0x40], rbx
jmp 0x1401ccbd0
movabs rbx, 0x2000000000
mov edx, 0x800
mov rcx, rsi
call fcn.1401c2a60
test al, al
je 0x1401ccbf5
movaps xmm2, xmm6
mov edx, 0x42
mov rcx, rsi
call fcn.1400e4050
or qword [rsi + 0x40], rbx
cmp dword [rsp + 0x60], 0
jle 0x1401ccc06
mov rcx, qword [rsp + 0x58]
call fcn.1402b7350
cmp byte [r12 + 0x31], 0
je 0x1401ccc17
mov rcx, rsi
call fcn.1401ccc90
nop
cmp dword [rbp - 0x20], 0
jle 0x1401ccc26
mov rcx, qword [rbp - 0x28]
call fcn.1402b7350
mov al, 1
mov rcx, qword [rbp + 0x288]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret