Function at 0x140031ac0
Capabilities:
Check for time delay via queryperformancecounter
Hash data with md5

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x848]
sub rsp, 0x910
mov qword [rbp + 0x1a0], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
movaps xmmword [rax - 0x48], xmm6
mov eax, r9d
mov r12, rdx
mov r13, rcx
cmp dword [rcx + 0x10c], 0
jne 0x140031d74
mov edx, 1
xor edi, edi
cmp dword [rbp + 0x870], edi
jne 0x140031de5
lea rax, [rcx + 0xb98]
mov qword [rbp - 0x78], rax
add rcx, 0xba0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea r14, [r13 + 0xb88]
mov rax, qword [r14]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140031ce8
movss xmm6, dword [0x14028c800]
nop word [rax + rax]
mov esi, dword [r13 + 0xbc8]
mov rdi, qword [rbx + 0x10]
xor eax, eax
mov qword [rbp + 0x850], rax
lea rcx, [rbp + 0x850]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm2, xmm2
cvtsi2sd xmm2, qword [rbp + 0x850]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi + 0x10]
subsd xmm2, xmm0
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rdi + 0x18]
divsd xmm2, xmm1
cvtpd2ps xmm0, xmm2
mulss xmm0, xmm6
cvttss2si rax, xmm0
cmp eax, esi
jbe 0x140031bf9
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140031bcb
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rdi, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r13 + 0xb90]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140247060
mov rbx, rdi
jmp 0x140031bfc
mov rbx, qword [rbx]
mov rax, qword [r14]
cmp rbx, rax
jne 0x140031b60
mov rbx, qword [rax]
xor edi, edi
cmp rbx, rax
je 0x140031ce8
mov r10d, dword [r12 + 0x1468]
mov r11d, edi
cmp r10d, 0xffffffff
setne r11b
nop dword [rax]
mov r9, qword [rbx + 0x10]
mov ecx, dword [r9 + 0x1488]
mov eax, edi
cmp ecx, 0xffffffff
setne al
cmp r11d, eax
jne 0x140031cdc
cmp r10d, ecx
jne 0x140031cdc
lea r8, [r9 + 0x38]
lea rax, [r12 + 0x18]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140031c75
add rax, 2
test ecx, ecx
jne 0x140031c61
test edx, edx
jne 0x140031cdc
lea r8, [r9 + 0x199c]
lea rax, [r12 + 0x197c]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140031ca4
add rax, 2
test ecx, ecx
jne 0x140031c90
test edx, edx
jne 0x140031cdc
lea r8, [r9 + 0x31fc]
lea rax, [r12 + 0x31dc]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140031cd4
add rax, 2
test ecx, ecx
jne 0x140031cc0
test edx, edx
je 0x140031d67
mov rbx, qword [rbx]
cmp rbx, qword [r14]
jne 0x140031c30
mov ecx, 0x3e30
call fcn.14018ef40
mov rdi, rax
mov qword [rbp + 0x850], rax
test rax, rax
je 0x140031d7b
lea rax, vtable.CProcessListRealtime2::CScannedItem.0
mov qword [rdi], rax
lea rax, vtable.CProcessListRealtime2::CTimer.0
mov qword [rdi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov rbx, rax
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
lea rcx, [rdi + 0x20]
call fcn.14002bff0
mov rdx, r12
lea rcx, [rdi + 0x20]
call fcn.14002caa0
jmp 0x140031d7d
lea rcx, [r13 + 0xba0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x140032ded
xor edi, edi
mov qword [rbp + 0x850], rdi
mov rbx, qword [r14]
mov rdi, qword [rbx + 8]
lea r9, [rbp + 0x850]
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140009370
mov rcx, rax
mov rdx, qword [r14 + 8]
movabs rax, 0xaaaaaaaaaaaaaa9
sub rax, rdx
cmp rax, 1
jb 0x140032e1b
lea rax, [rdx + 1]
mov qword [r14 + 8], rax
mov qword [rbx + 8], rcx
mov qword [rdi], rcx
lea rcx, [r13 + 0xba0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rbp + 0x868]
xor edi, edi
lea edx, [rdi + 1]
mov r15d, edi
lea rbx, vtable.CSABDataBuffer.0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x7c], 1
mov esi, dword [rbp + 0x878]
lea r14, [r12 + 0x18]
test esi, esi
je 0x140031e6c
mov rcx, qword [r13 + 0x170]
mov rax, qword [rcx]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x8000080
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
mov r9d, edx
mov r8d, 0x80000000
mov rdx, r14
call qword [rax + 0x20]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140031f97
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, r13
call fcn.140034510
xor ebx, ebx
jmp 0x140031eee
mov ebx, edi
cmp eax, 3
jb 0x140031f0d
cmp dword [r13 + 0xcc0], 0
je 0x140031e9e
lea r8, [rsp + 0x68]
mov rdx, r14
mov rcx, r13
call fcn.140034640
mov ebx, eax
test eax, eax
jne 0x140031f9f
lea edx, [rax + 1]
mov rcx, qword [r13 + 0x170]
mov rax, qword [rcx]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x8000080
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
mov r9d, edx
mov r8d, 0x80000000
mov rdx, r14
call qword [rax + 0x20]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140031f97
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, r13
call fcn.140034510
test eax, eax
mov eax, 1
cmovne ebx, eax
mov rcx, qword [r13 + 0x170]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x38]
jmp 0x140031f93
mov rcx, qword [r13 + 0x170]
mov rax, qword [rcx]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x8000080
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
mov r9d, edx
mov r8d, 0x80000000
mov rdx, r14
call qword [rax + 0x20]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140031f77
lea r8, [rsp + 0x68]
mov rdx, rax
mov rcx, r13
call fcn.140034510
test eax, eax
mov eax, 1
cmovne ebx, eax
mov rcx, qword [r13 + 0x170]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x38]
test ebx, ebx
jne 0x140031f9d
cmp dword [r13 + 0xcc0], 0
je 0x140031f97
lea r8, [rsp + 0x68]
mov rdx, r14
mov rcx, r13
call fcn.140034640
mov ebx, eax
test ebx, ebx
jne 0x140031f9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
mov eax, 1
mov dword [rbp - 0x38], eax
mov qword [rbp - 0x34], 2
mov ebx, edi
mov dword [rbp + 0x850], ebx
nop word [rax + rax]
mov eax, ebx
mov edi, dword [rbp + rax*4 - 0x38]
test edi, edi
je 0x140032dc2
cmp dword [r13 + 0x10c], 0
jne 0x140032dc2
lea rcx, [rbp + 0x1b0]
call fcn.1400270b0
nop
lea rdx, [r12 + 0x838]
cmp byte [rdx], 0
je 0x14003200e
lea rcx, [rbp + 0x1e0]
call fcn.140004820
mov rcx, qword [rbp + 0x1e8]
call fcn.140250f2c
cmp word [r14], 0
je 0x140032062
test r14, r14
jne 0x140032023
xor ebx, ebx
mov qword [rsp + 0x40], rbx
jmp 0x14003203d
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140032e28
mov rdx, rbx
lea rcx, [rbp + 0x1f8]
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x200]
call fcn.14025f5f8
mov eax, dword [r12 + 0x1468]
mov dword [rbp + 0x228], eax
lea rdx, [r12 + 0xc48]
cmp byte [rdx], 0
je 0x140032095
lea rcx, [rbp + 0x460]
call fcn.140004820
mov rcx, qword [rbp + 0x468]
call fcn.140250f2c
lea rdx, [r12 + 0x1058]
cmp byte [rdx], 0
je 0x1400320ba
lea rcx, [rbp + 0x478]
call fcn.140004820
mov rcx, qword [rbp + 0x480]
call fcn.140250f2c
lea rdx, [r12 + 0x156c]
cmp byte [rdx], 0
je 0x1400320d3
lea rcx, [rbp + 0x290]
call fcn.140004820
lea rdx, [r12 + 0x219c]
cmp byte [rdx], 0
je 0x1400320ec
lea rcx, [rbp + 0x260]
call fcn.140004820
lea rdx, [r12 + 0x39fc]
cmp byte [rdx], 0
je 0x140032105
lea rcx, [rbp + 0x2c0]
call fcn.140004820
lea rdx, [r12 + 0x2dcc]
cmp byte [rdx], 0
je 0x14003211e
lea rcx, [rbp + 0x210]
call fcn.140004820
lea rcx, [r12 + 0x197c]
cmp word [rcx], 0
je 0x14003216a
test rcx, rcx
jne 0x14003213a
xor ebx, ebx
mov qword [rsp + 0x40], rbx
jmp 0x140032151
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140032e33
mov rdx, rbx
lea rcx, [rbp + 0x278]
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [r12 + 0x31dc]
cmp word [rcx], 0
je 0x1400321b6
test rcx, rcx
jne 0x140032186
xor ebx, ebx
mov qword [rsp + 0x40], rbx
jmp 0x14003219d
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140032e3e
mov rdx, rbx
lea rcx, [rbp + 0x2d8]
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rdx, [r12 + 0x146c]
cmp byte [rdx], 0
je 0x1400321cf
lea rcx, [rbp + 0x2f0]
call fcn.140004820
lea rcx, vtable.CSABDataBuffer.0
mov qword [rsp + 0x48], rcx
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x5c], 1
lea eax, [rbx + 1]
cmp dword [rsp + 0x78], ebx
je 0x140032927
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x140032927
mov dword [rbp + 0x230], eax
cmp edi, 2
jne 0x140032518
cmp dword [r12 + 0x1468], 0xffffffff
je 0x140032cd0
cmp dword [r12 + 0x3e0c], ebx
je 0x140032cd0
mov rdi, qword [r12 + 8]
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rcx, qword [r13 + 0x170]
mov rax, qword [rcx]
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayGetElement
lea r9, [rbp - 0x50]
mov r8, qword [r12 + 0x10]
mov rdx, rdi
call qword [rax + 0x3d8]
test eax, eax
je 0x140032cc9
mov r9, qword [rbp - 0x50]
mov r8d, dword [rbp - 0x48]
lea rdx, str.Module_Size:__x___Module_Base:__x
lea rcx, [rbp + 0xa0]
call fcn.140006bc0
mov rbx, qword [rbp - 0x48]
cmp ebx, 0x4000000
jae 0x140032cc9
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x1400322be
cmp dword [rsp + 0x60], 0
jne 0x1400322be
lea rcx, [rsp + 0x48]
mov rax, qword [rsp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov dword [rsp + 0x58], 0
mov edx, ebx
lea rcx, [rsp + 0x48]
mov rax, qword [rsp + 0x48]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x58]
test rcx, rcx
cmovne eax, ebx
mov dword [rsp + 0x58], eax
mov r8d, eax
xor edx, edx
call fcn.140249b10
xor ebx, ebx
mov qword [rbp + 0x20], rbx
mov rcx, qword [r13 + 0x170]
mov r10, qword [rcx]
mov eax, dword [rbp - 0x48]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rbp - 0x50]
mov rdx, rdi
call qword [r10 + 0x340]
test eax, eax
je 0x140032cc9
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400323cd
mov r8d, dword [rsp + 0x78]
lea rcx, [rbp - 0x20]
call fcn.14002beb0
nop
mov rcx, qword [rbp + 0x250]
test rcx, rcx
je 0x140032366
call fcn.140247060
mov qword [rbp + 0x250], rbx
lea rcx, [rbp - 8]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140032371
mov dword [rbp + 0x258], eax
lea ecx, [rax + 1]
call fcn.140247068
mov rcx, rax
mov qword [rbp + 0x250], rax
test rax, rax
je 0x1400323aa
mov r8d, dword [rbp + 0x258]
inc r8d
lea rdx, [rbp - 8]
call fcn.1402496a0
mov ebx, 1
mov dword [rbp + 0x240], ebx
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x238], rax
mov eax, dword [rsp + 0x58]
mov dword [rbp + 0x22c], eax
jmp 0x140032438
mov rcx, qword [rbp + 0x250]
test rcx, rcx
je 0x1400323e5
call fcn.140247060
mov qword [rbp + 0x250], rbx
mov dword [rbp + 0x258], 4
mov ecx, 5
call fcn.140247068
mov rcx, rax
mov qword [rbp + 0x250], rax
test rax, rax
je 0x14003241e
mov r8d, dword [rbp + 0x258]
inc r8d
lea rdx, [0x14028b498]
call fcn.1402496a0
mov eax, 1
mov dword [rbp + 0x240], eax
mov qword [rbp + 0x238], rbx
mov dword [rbp + 0x22c], ebx
mov ebx, eax
lea rax, vtable.CSABString.0
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x58], 8
mov ecx, 9
call fcn.140247068
mov rdi, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140032476
movsd xmm0, qword [str._MEMORY_]
movsd qword [rax], xmm0
movzx eax, byte [0x14028a888]
mov byte [rdi + 8], al
mov dword [rbp - 0x54], ebx
mov rsi, qword [rbp + 0x2f8]
mov ecx, dword [rbp + 0x300]
add ecx, 9
call fcn.140247068
mov rbx, rax
test rsi, rsi
je 0x1400324c0
mov rdx, rsi
mov r8, rax
sub r8, rsi
nop
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400324a0
mov rcx, rsi
call fcn.140247060
mov qword [rbp + 0x2f8], rbx
jmp 0x1400324c7
mov qword [rbp + 0x2f8], rax
test rbx, rbx
je 0x140032500
mov ecx, dword [rbp + 0x300]
movsd xmm0, qword [rdi]
movsd qword [rcx + rbx], xmm0
movzx eax, byte [rdi + 8]
mov byte [rcx + rbx + 8], al
mov rcx, qword [rbp + 0x2f8]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400324f1
mov dword [rbp + 0x300], eax
test rdi, rdi
je 0x14003250d
mov rcx, rdi
call fcn.140247060
mov esi, dword [rbp + 0x878]
jmp 0x14003265a
lea rax, vtable.CSABMD5.0
mov qword [rbp - 0x20], rax
xor eax, eax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov byte [rbp + 0x18], al
mov qword [rbp + 0x40], rbx
mov dword [rbp + 0x48], 0x67452301
mov dword [rbp + 0x4c], 0xefcdab89
mov dword [rbp + 0x50], 0x98badcfe
mov dword [rbp + 0x54], 0x10325476
mov r9d, dword [rsp + 0x78]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400390f0
lea r8, [rbp - 0x18]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140039210
lea rdi, [rbp - 0x18]
movzx r8d, byte [rdi]
lea ecx, [rbx + rbx]
lea rax, [rbp - 8]
add rcx, rax
lea rdx, [0x14028a478]
call fcn.140006bc0
inc ebx
lea rdi, [rdi + 1]
cmp ebx, 0x10
jb 0x1400325b0
mov rcx, qword [rbp + 0x250]
test rcx, rcx
je 0x1400325f1
call fcn.140247060
mov qword [rbp + 0x250], 0
lea rcx, [rbp - 8]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140032600
mov dword [rbp + 0x258], eax
lea ecx, [rax + 1]
call fcn.140247068
mov rcx, rax
mov qword [rbp + 0x250], rax
test rax, rax
je 0x140032639
mov r8d, dword [rbp + 0x258]
inc r8d
lea rdx, [rbp - 8]
call fcn.1402496a0
mov eax, 1
mov dword [rbp + 0x240], eax
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x238], rax
mov eax, dword [rsp + 0x78]
mov dword [rbp + 0x22c], eax
cmp dword [r13 + 0x10c], 0
jne 0x14003285b
lea r9, [rbp + 0x1b0]
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, r13
call fcn.140029d80
lea rax, str.Comments
mov qword [rbp + 0xa0], rax
lea rax, [rbp + 0x340]
mov qword [rbp + 0xa8], rax
lea rax, str.CompanyName
mov qword [rbp + 0xb0], rax
lea rax, [rbp + 0x358]
mov qword [rbp + 0xb8], rax
lea rax, str.Company
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0x358]
mov qword [rbp + 0xc8], rax
lea rax, str.FileDescription
mov qword [rbp + 0xd0], rax
lea rax, [rbp + 0x370]
mov qword [rbp + 0xd8], rax
lea rax, [0x14028a6e0]
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 0x388]
mov qword [rbp + 0xe8], rax
lea rax, str.InternalName
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x3a0]
mov qword [rbp + 0xf8], rax
lea rax, str.LegalCopyright
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0x3b8]
mov qword [rbp + 0x108], rax
lea rax, str.Copyright
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x3b8]
mov qword [rbp + 0x118], rax
lea rax, str.LegalTrademarks
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x3d0]
mov qword [rbp + 0x128], rax
lea rax, str.OriginalFilename
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x3e8]
mov qword [rbp + 0x138], rax
lea rax, str.ProductName
mov qword [rbp + 0x140], rax
lea rax, [rbp + 0x400]
mov qword [rbp + 0x148], rax
lea rax, str.ProductVersion
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x418]
mov qword [rbp + 0x158], rax
lea rax, str.PrivateBuild
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x430]
mov qword [rbp + 0x168], rax
lea rax, str.SpecialBuild
mov qword [rbp + 0x170], rax
lea rax, [rbp + 0x448]
mov qword [rbp + 0x178], rax
lea rax, str.TranslationCodes
mov qword [rbp + 0x180], rax
lea rax, [rbp + 0x328]
mov qword [rbp + 0x188], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x190], xmm0
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xa0]
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, r13
call fcn.140034840
mov dword [rbp + 0x308], eax
xor ebx, ebx
cmp dword [r13 + 0x10c], 0
jne 0x140032cc9
mov dword [rbp - 0x70], ebx
mov qword [rsp + 0x40], rbx
xor edi, edi
mov eax, edi
mov edx, dword [rbp + 0x868]
cmp edx, 1
setne al
mov rcx, qword [r13 + 0x198]
test rcx, rcx
je 0x14003299c
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
lea r9, [rbp - 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x1b0]
call fcn.140017e00
mov ebx, eax
test eax, eax
je 0x140032996
cmp qword [rsp + 0x40], rdi
je 0x140032996
mov rcx, qword [r13 + 0x180]
mov rax, qword [rcx]
lea rdx, str.Detected_Rule_ID
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rbp + 0x28]
call qword [rax + 0x20]
mov rdx, qword [rbp + 0x28]
test rdx, rdx
je 0x140032907
mov rcx, qword [r13 + 0x180]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rax, qword [rsp + 0x40]
mov edx, dword [rbp + 0x868]
test rax, rax
je 0x14003299c
mov rax, qword [rax + 0x68]
cmp byte [rax], 0x2a
cmove ebx, edi
jmp 0x14003299c
mov rcx, qword [rbp + 0x250]
test rcx, rcx
je 0x14003293f
call fcn.140247060
mov qword [rbp + 0x250], rbx
mov dword [rbp + 0x258], 4
mov ecx, 5
call fcn.140247068
mov rcx, rax
mov qword [rbp + 0x250], rax
test rax, rax
je 0x140032978
mov r8d, dword [rbp + 0x258]
inc r8d
lea rdx, [0x14028b498]
call fcn.1402496a0
mov eax, 1
mov dword [rbp + 0x240], eax
mov qword [rbp + 0x22c], rbx
mov qword [rbp + 0x238], rbx
jmp 0x14003285d
mov edx, dword [rbp + 0x868]
test esi, esi
je 0x1400329b5
test ebx, ebx
je 0x140032cc9
cmp dword [r13 + 0x10c], edi
je 0x140032d2d
test ebx, ebx
je 0x140032cc9
cmp dword [r13 + 0x10c], edi
jne 0x140032cc9
cmp edx, 3
jne 0x1400329f7
test esi, esi
jne 0x1400329f7
mov eax, 1
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9d, edx
mov r8, qword [rbp + 0x860]
mov rdx, r12
mov rcx, r13
call fcn.140031ac0
mov ebx, eax
test ebx, ebx
je 0x140032cc9
test esi, esi
jne 0x140032cc9
mov ebx, 1
mov r15d, ebx
cmp dword [rbp + 0x220], edi
je 0x140032c81
lea rax, vtable.CSABString.0
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x58], 6
lea ecx, [rsi + 7]
call fcn.140247068
mov rcx, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140032a5e
mov eax, dword [str.CLSID_]
mov dword [rcx], eax
movzx eax, word [0x14028b03c]
mov word [rcx + 4], ax
movzx eax, byte [0x14028b03e]
mov byte [rcx + 6], al
mov dword [rbp - 0x54], ebx
mov rdx, qword [rbp + 0x218]
lea rcx, [rbp - 0x68]
call fcn.140028ca0
mov rsi, qword [rbp - 0x60]
mov rdx, rsi
lea rcx, [rbp + 0x30]
call fcn.14000bd30
nop
mov rdi, qword [rbp + 0x30]
test rdi, rdi
jne 0x140032a95
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x78], rax
jmp 0x140032aae
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140032e10
mov rdx, rbx
lea rcx, [rbp + 0x278]
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x268]
test rcx, rcx
je 0x140032ae3
call fcn.140247060
xor eax, eax
mov qword [rbp + 0x268], rax
jmp 0x140032ae5
xor eax, eax
test rsi, rsi
je 0x140032b2b
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x140032af1
mov dword [rbp + 0x270], eax
lea ecx, [rax + 1]
call fcn.140247068
mov rcx, rax
mov qword [rbp + 0x268], rax
test rax, rax
je 0x140032b4b
mov r8d, dword [rbp + 0x270]
inc r8d
mov rdx, rsi
call fcn.1402496a0
jmp 0x140032b4b
mov dword [rbp + 0x270], eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x268], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
lea rcx, str.HKEY_CLASSES_ROOT
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140032e54
mov rdx, rax
lea rcx, [rbp + reloc.SHELL32.dll_IsUserAnAdmin]
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x298]
test rcx, rcx
je 0x140032b9d
call fcn.140247060
xor ebx, ebx
mov qword [rbp + 0x298], rbx
jmp 0x140032b9f
xor ebx, ebx
mov dword [rbp + 0x2a0], reloc.COMCTL32.dll_InitCommonControls
mov ecx, send
call fcn.140247068
mov rcx, rax
mov qword [rbp + 0x298], rax
test rax, rax
je 0x140032bd8
mov r8d, dword [rbp + 0x2a0]
inc r8d
lea rdx, [0x14028be38]
call fcn.1402496a0
mov rcx, qword [rbp + 0x2c8]
test rcx, rcx
je 0x140032bf0
call fcn.140247060
mov qword [rbp + 0x2c8], rbx
mov dword [rbp + 0x2d0], ebx
mov ecx, 1
call fcn.140247068
mov rcx, rax
mov qword [rbp + 0x2c8], rax
test rax, rax
je 0x140032c25
mov r8d, dword [rbp + 0x2d0]
inc r8d
lea rdx, [0x140286ae1]
call fcn.1402496a0
lea rcx, [0x1402849c8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140032e49
mov rdx, rax
lea rcx, [rbp + 0x2d8]
call fcn.14002a980
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
cmp dword [rbp - 0x54], 1
jne 0x140032c79
test rsi, rsi
je 0x140032c79
mov rcx, rsi
call fcn.140247060
mov esi, dword [rbp + 0x878]
xor edi, edi
mov rcx, qword [r13 + 0x180]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r12
mov edx, dword [rbp + 0x868]
mov dword [rsp + 0x20], edx
mov r9, qword [rsp + 0x40]
lea r8, [rbp + 0x1b0]
mov rdx, r13
call qword [rax + 0x60]
test eax, eax
je 0x140032cc6
mov rcx, qword [rbp + 0x860]
test rcx, rcx
je 0x140032cc9
mov rax, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x140032cc9
mov r15d, edi
lea rcx, vtable.CSABDataBuffer.0
cmp dword [rsp + 0x78], 0
je 0x140032d92
xor eax, eax
mov dword [rbp + 0x230], eax
mov ebx, dword [rbp + 0x850]
inc ebx
mov dword [rbp + 0x850], ebx
mov qword [rsp + 0x48], rcx
add dword [rsp + 0x5c], 0xffffffff
jne 0x140032d13
cmp dword [rsp + 0x60], eax
jne 0x140032d13
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140032d13
call fcn.140247060
nop
lea rcx, [rbp + 0x1b0]
call fcn.140027e10
test r15d, r15d
jne 0x140032dc2
jmp 0x140031fc0
mov dword [rbp + 0x230], edi
lea rbx, vtable.CSABDataBuffer.0
mov qword [rsp + 0x48], rbx
add dword [rsp + 0x5c], 0xffffffff
jne 0x140032d5d
cmp dword [rsp + 0x60], 0
jne 0x140032d5d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140032d5d
call fcn.140247060
nop
lea rcx, [rbp + 0x1b0]
call fcn.140027e10
nop
mov qword [rsp + 0x68], rbx
add dword [rsp + 0x7c], 0xffffffff
jne 0x140032d8b
cmp dword [rbp - 0x80], 0
jne 0x140032d8b
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140032d8b
call fcn.140247060
mov eax, 1
jmp 0x140032ded
mov qword [rsp + 0x48], rcx
add dword [rsp + 0x5c], 0xffffffff
jne 0x140032db5
cmp dword [rsp + 0x60], 0
jne 0x140032db5
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140032db5
call fcn.140247060
nop
lea rcx, [rbp + 0x1b0]
call fcn.140027e10
nop
lea rbx, vtable.CSABDataBuffer.0
mov qword [rsp + 0x68], rbx
add dword [rsp + 0x7c], 0xffffffff
jne 0x140032dea
cmp dword [rbp - 0x80], 0
jne 0x140032dea
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140032dea
call fcn.140247060
mov eax, r15d
mov rbx, qword [rsp + 0x958]
movaps xmm6, xmmword [rsp + 0x900]
add rsp, 0x910
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140004cd0
nop
lea rcx, str.list_T__too_long
call fcn.1402453d0
nop
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
nop
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3