Function at 0x140100510
Capabilities:
Hash data with md5

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37a0]
mov eax, 0x38a0
call fcn.140247340
sub rsp, rax
mov qword [rbp + 0x300], 0xfffffffffffffffe
mov qword [rsp + 0x38e8], rbx
mov esi, r8d
mov r13, rdx
mov r15, rcx
lea rax, vtable.CScopeTracker.0
mov qword [rbp + 0x2f0], rax
lea r14, str.SendFileMetaDataToServer
mov qword [rbp + 0x2f8], r14
mov r8, r14
lea rdx, [0x1402862f8]
lea rcx, [rbp + 0x17a0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x17a0]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
cmp dword [r15 + 0x4c], 0
je 0x1401005ca
mov r9d, 1
mov r8d, r9d
lea rdx, str.Stop_Sending_Data
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor edi, edi
jmp 0x140102741
cmp esi, 1
jne 0x140100609
mov ecx, dword [r15 + 0xa14]
lea eax, [rcx + 1]
mov dword [r15 + 0xa14], eax
cmp ecx, 0x32
jbe 0x140100614
mov r9d, esi
mov r8d, esi
lea rdx, str.Max_Verifies_Reached
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [r15 + 0x4c], esi
xor edi, edi
jmp 0x140102741
cmp esi, 2
jne 0x140100614
mov edx, dword [r15 + 0x24]
jmp 0x140100618
mov edx, dword [r15 + 0x1c]
test edx, edx
je 0x140100629
mov rcx, qword [r15 + 0x9b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
mov dword [rbp + 0x37f8], edi
lea r9, str._application.php
lea r8, str.www.superantispyware.com
lea edx, [rdi + 2]
lea rcx, [rbp - 0x80]
call fcn.1400093a0
nop
lea rcx, [rbp - 0x80]
call fcn.140198e50
mov rdx, qword [r13 + 0x18]
lea rcx, [rbp + 0x480]
call fcn.1400be890
nop
lea rcx, [rbp + 0x480]
call fcn.1400bb680
test rax, rax
jne 0x1401007ea
mov ebx, edi
mov qword [rbp + 0x37e0], rbx
lea rax, vtable.CSABString.0
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rdi
mov dword [rbp + 0x160], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rbp + 0x150]
call fcn.140005530
mov dword [rbp + 0x164], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp + 0x158]
cmp dword [rbp + 0x160], 0
je 0x14010271c
mov r9d, 1
lea r8, [0x1402b3c20]
lea rdx, str.VERIFY
lea rcx, [rbp - 0x80]
call fcn.140009cd0
mov r8d, esi
lea rdx, str.SENDINGSYSTEM
lea rcx, [rbp - 0x80]
call fcn.140009ea0
mov r9d, 1
lea r8, str.SASDIAGNOSTICITEM
lea rdx, str.REPORTTYPE
lea rcx, [rbp - 0x80]
call fcn.140009cd0
mov r8d, dword [r13 + 0x70]
lea rdx, str.ENUMSOURCE
lea rcx, [rbp - 0x80]
call fcn.140009ea0
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0xf80]
call fcn.140249b10
mov rsi, qword [r13 + 0x18]
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0x760]
call fcn.140249b10
mov r8d, 0x1040
lea rdx, [rbp + 0x17a0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea r12, [rbp + 0x17a0]
test eax, eax
cmove r12, rsi
mov r14, 0xffffffffffffffff
inc r14
cmp word [r12 + r14*2], 0
jne 0x140100790
mov rax, qword [r15 + 0x78]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140100850
mov rdx, qword [rbx + 0x10]
mov eax, dword [rdx + 0x40]
cmp eax, r14d
ja 0x1401007e1
mov r8d, eax
mov rdx, qword [rdx + 0x38]
mov rcx, r12
call fcn.140252d0c
test eax, eax
jne 0x1401007e1
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax + 0x40]
movzx eax, word [r12 + rcx*2]
cmp ax, 0x5c
je 0x14010080b
test ax, ax
je 0x14010080b
mov rbx, qword [rbx]
cmp rbx, qword [r15 + 0x78]
jmp 0x1401007a5
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x140102797
jmp 0x140100684
mov word [rbp + 0x760], di
mov rax, qword [rbx + 0x10]
mov r8, qword [rax + 0x50]
mov edx, 0x410
lea rcx, [rbp + 0x760]
call fcn.140251e40
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax + 0x40]
lea r8, [r12 + rcx*2]
cmp word [r8], 0x5c
jne 0x140100864
mov edx, 0x410
lea rcx, [rbp + 0x760]
call fcn.140251e40
jmp 0x140100864
mov r8, r12
mov edx, 0x410
lea rcx, [rbp + 0x760]
call fcn.140251ec0
lea rcx, [rbp + 0x760]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140100872
inc rax
cmp rax, 0x410
ja 0x1401008ab
mov rcx, rdi
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x760]
mov word [rbp + rcx + 0xf80], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140100890
jmp 0x1401008d0
lea rcx, [rbp + 0xf80]
sub rcx, rsi
nop word [rax + rax]
movzx eax, word [rsi]
mov word [rsi + rcx], ax
lea rsi, [rsi + 2]
test ax, ax
jne 0x1401008c0
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rbx, vtable.CSABStringW.0
mov qword [rbp + 0x180], rbx
mov qword [rbp + 0x188], rdi
mov dword [rbp + 0x190], edi
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.14002a980
mov dword [rbp + 0x194], 1
mov qword [rbp + 0x278], rbx
lea rax, [rbp + 0xf80]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140100923
mov dword [rbp + 0x288], ebx
lea ecx, [rbx*2 + 2]
call fcn.140247068
mov r14, rax
mov qword [rbp + 0x280], rax
test rax, rax
je 0x14010096b
mov ecx, ebx
lea rbx, [rcx + rcx]
mov r8, rbx
lea rdx, [rbp + 0xf80]
mov rcx, rax
call fcn.1402496a0
mov word [rbx + r14], di
mov dword [rbp + 0x28c], 1
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov r12, qword [rbp + 0x188]
test r12, r12
jne 0x140101e5f
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x58]
call fcn.140005530
mov dword [rsp + 0x6c], 1
mov r9d, 1
mov rsi, qword [rsp + 0x60]
mov r8, rsi
lea rdx, str.FILENAME
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x1401009f3
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, r12
lea rdx, str.FILENAMEW
lea rcx, [rbp - 0x80]
call fcn.140009f50
lea rcx, [rbp + 0xf80]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x140102847
lea rax, vtable.CSABString.0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x58]
call fcn.140005530
mov dword [rsp + 0x6c], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov r9d, 1
mov r8d, r9d
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
test rbx, rbx
je 0x140100a9f
mov rcx, rbx
call fcn.140247060
mov rcx, r14
call fcn.1400fef60
mov rcx, r12
call fcn.1400fef60
mov rcx, qword [r13 + 0x18]
test rcx, rcx
jne 0x140101e80
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
lea r12, vtable.CSABString.0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x58]
call fcn.140005530
mov dword [rsp + 0x6c], 1
mov r9d, 1
mov rsi, qword [rsp + 0x60]
mov r8, rsi
lea rdx, str.PROCESSPATH
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x140100b21
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, r14
lea rdx, str.DIRECTORYW
lea rcx, [rbp - 0x80]
call fcn.140009f50
mov r9d, 1
lea r8, [0x140286ae1]
lea rdx, str.COMMANDLINE
lea rcx, [rbp - 0x80]
call fcn.140009cd0
mov r9d, 1
mov r8, qword [rbp + 0x158]
lea rdx, [0x140286b20]
lea rcx, [rbp - 0x80]
call fcn.140009cd0
cmp dword [r13 + 0x38], 0
je 0x140100cbc
mov rcx, qword [r13 + 0x30]
test rcx, rcx
jne 0x140101e9e
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x58]
call fcn.140005530
mov dword [rsp + 0x6c], 1
mov r9d, 1
mov rsi, qword [rsp + 0x60]
mov r8, rsi
lea rdx, str.REGPATH
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x140100bfb
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r13 + 0x48]
test rcx, rcx
jne 0x140101ebc
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x58]
call fcn.140005530
mov dword [rsp + 0x6c], 1
mov r9d, 1
mov rsi, qword [rsp + 0x60]
mov r8, rsi
lea rdx, [0x14028ca78]
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x140100c6f
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, qword [r13 + 0x30]
lea rdx, str.REGPATHW
lea rcx, [rbp - 0x80]
call fcn.140009f50
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, qword [r13 + 0x48]
lea rdx, str.REGVALW
lea rcx, [rbp - 0x80]
call fcn.140009f50
mov rcx, qword [r13 + 0x18]
call fcn.14025f5f8
lea rcx, vtable.CSABStringW.0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14002a980
mov dword [rsp + 0x6c], 1
lea rax, vtable.CSABMD5.0
mov qword [rbp + 0x1b0], rax
mov eax, dword [rsp + 0x68]
lea r9d, [rax + rax]
mov r14, qword [rsp + 0x60]
test r9d, r9d
je 0x140100e18
xor eax, eax
mov qword [rbp + reloc.SHELL32.dll_IsUserAnAdmin], rax
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1c8], rax
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x1e0], rax
mov byte [rbp + 0x1e8], al
mov qword [rbp + 0x290], rdi
mov dword [rbp + 0x298], 0x67452301
mov dword [rbp + 0x29c], 0xefcdab89
mov dword [rbp + 0x2a0], 0x98badcfe
mov dword [rbp + 0x2a4], 0x10325476
mov r8, r14
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x1b0]
call fcn.1400390f0
lea r8, [rbp + 0x1b8]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x1b0]
call fcn.140039210
mov ebx, edi
lea rsi, [rbp + 0x1b8]
nop word [rax + rax]
movzx r8d, byte [rsi]
lea ecx, [rbx + rbx]
lea rax, [rbp + 0x1c8]
add rcx, rax
lea rdx, [0x14028a478]
call fcn.140006bc0
inc ebx
lea rsi, [rsi + 1]
cmp ebx, 0x10
jb 0x140100df0
mov r9d, 1
lea r8, [rbp + 0x1c8]
lea rdx, str.PATHNAMEMD5
lea rcx, [rbp - 0x80]
call fcn.140009cd0
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x27a0]
call fcn.140249b10
mov qword [rbp + 0x168], rdi
mov qword [rbp + 0x170], rdi
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x480]
call fcn.1400bae30
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x480]
call fcn.1400bb600
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [rsp + 0x4c]
movzx ecx, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
movzx r10d, word [rsp + 0x46]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._04d__02d__02d__02d:_02d:_02d
lea rcx, [rbp + 0x27a0]
call fcn.140006bc0
mov r9d, 1
lea r8, [rbp + 0x27a0]
lea rdx, str.CREATETIME
lea rcx, [rbp - 0x80]
call fcn.140009cd0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [rsp + 0x4c]
movzx ecx, word [rsp + 0x4a]
movzx r10d, word [rsp + 0x48]
movzx r11d, word [rsp + 0x46]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
lea rdx, str._04d__02d__02d__02d:_02d:_02d
lea rcx, [rbp + 0x27a0]
call fcn.140006bc0
mov r9d, 1
lea r8, [rbp + 0x27a0]
lea rdx, str.WRITETIME
lea rcx, [rbp - 0x80]
call fcn.140009cd0
mov qword [rbp + 0x178], 0xffffffffffffffff
mov r8d, 1
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x480]
call fcn.1400bb280
mov r8d, dword [rbp + 0x178]
lea rdx, str.SIZE
lea rcx, [rbp - 0x80]
call fcn.140009ea0
mov r9d, 1
lea r8, [0x140286ae1]
lea rdx, [0x140298f00]
lea rcx, [rbp - 0x80]
call fcn.140009cd0
lea r14, vtable.CSABStringW.0
mov qword [rbp + 0x138], r14
mov qword [rbp + 0x140], rdi
mov dword [rbp + 0x148], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x140], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x14c], 1
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov dword [rbp - 8], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x10], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 4], 1
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], rdi
mov dword [rbp + 0x98], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x90], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x9c], 1
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], rdi
mov dword [rbp + 0x80], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x78], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x84], 1
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], rdi
mov dword [rbp + 0x68], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x60], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x6c], 1
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x20], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x28], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x1c], 1
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rdi
mov dword [rbp + 0x50], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x48], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x54], 1
mov qword [rbp + 0x100], r14
mov qword [rbp + 0x108], rdi
mov dword [rbp + 0x110], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x108], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x114], 1
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], rdi
mov dword [rbp + 0xf8], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0xf0], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0xfc], 1
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], rdi
mov dword [rbp + 0xe0], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0xd8], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0xe4], 1
mov qword [rbp + 0xb8], r14
mov qword [rbp + 0xc0], rdi
mov dword [rbp + 0xc8], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0xc0], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0xcc], 1
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], rdi
mov dword [rbp + 0xb0], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0xa8], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0xb4], 1
lea rax, str.Comments
mov qword [rbp + 0x310], rax
lea rax, [rbp + 0x138]
mov qword [rbp + 0x318], rax
mov dword [rbp + 0x320], edi
lea rax, str.CompanyName
mov qword [rbp + 0x328], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x330], rax
mov dword [rbp + 0x338], edi
lea rax, str.Company
mov qword [rbp + 0x340], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x348], rax
mov dword [rbp + 0x350], edi
lea rax, str.FileDescription
mov qword [rbp + 0x358], rax
lea rax, [rbp + 0x88]
mov qword [rbp + 0x360], rax
mov dword [rbp + 0x368], edi
lea rax, [0x14028a6e0]
mov qword [rbp + 0x370], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0x378], rax
mov dword [rbp + 0x380], edi
lea rax, str.InternalName
mov qword [rbp + 0x388], rax
lea rax, [rbp + 0x58]
mov qword [rbp + 0x390], rax
mov dword [rbp + 0x398], edi
lea rax, str.LegalCopyright
mov qword [rbp + 0x3a0], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x3a8], rax
mov dword [rbp + 0x3b0], edi
lea rax, str.Copyright
mov qword [rbp + 0x3b8], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x3c0], rax
mov dword [rbp + 0x3c8], edi
lea rax, str.LegalTrademarks
mov qword [rbp + 0x3d0], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x3d8], rax
mov dword [rbp + 0x3e0], edi
lea rax, str.OriginalFilename
mov qword [rbp + 0x3e8], rax
lea rax, [rbp + 0x100]
mov qword [rbp + 0x3f0], rax
mov dword [rbp + 0x3f8], edi
lea rax, str.ProductName
mov qword [rbp + 0x400], rax
lea rax, [rbp + 0xe8]
mov qword [rbp + 0x408], rax
mov dword [rbp + 0x410], edi
lea rax, str.ProductVersion
mov qword [rbp + 0x418], rax
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x420], rax
mov dword [rbp + 0x428], edi
lea rax, str.PrivateBuild
mov qword [rbp + 0x430], rax
lea rax, [rbp + 0xb8]
mov qword [rbp + 0x438], rax
mov dword [rbp + 0x440], edi
lea rax, str.SpecialBuild
mov qword [rbp + 0x448], rax
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x450], rax
mov dword [rbp + 0x458], edi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x460], xmm0
mov dword [rbp + 0x470], edi
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x480]
call fcn.1400bfb10
test eax, eax
je 0x1401019bb
mov rcx, qword [rbp + 0x140]
call fcn.14025f5f8
mov rcx, qword [rbp - 0x10]
call fcn.14025f5f8
mov rcx, qword [rbp + 0x90]
call fcn.14025f5f8
mov rcx, qword [rbp + 0x78]
call fcn.14025f5f8
mov rcx, qword [rbp + 0x60]
call fcn.14025f5f8
mov rcx, qword [rbp - 0x28]
call fcn.14025f5f8
mov rcx, qword [rbp + 0x48]
call fcn.14025f5f8
mov rcx, qword [rbp + 0x108]
call fcn.14025f5f8
mov rcx, qword [rbp + 0xf0]
call fcn.14025f5f8
mov rcx, qword [rbp + 0xd8]
call fcn.14025f5f8
mov rcx, qword [rbp + 0xc0]
call fcn.14025f5f8
mov rcx, qword [rbp + 0xa8]
call fcn.14025f5f8
mov rcx, qword [rbp - 0x10]
test rcx, rcx
jne 0x140101eda
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.COMPANYNAME
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x140101518
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x78]
test rcx, rcx
jne 0x140101ef8
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.FILEVERSION
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x14010158c
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x90]
test rcx, rcx
jne 0x140101f16
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.FILEDESCRIPTION
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x140101603
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
jne 0x140101f34
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.INTERNALNAME
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x140101677
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
jne 0x140101f52
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.LEGALCOPYRIGHT
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x1401016eb
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x48]
test rcx, rcx
jne 0x140101f70
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.LEGALTRADEMARKS
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x14010175f
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0x108]
test rcx, rcx
jne 0x140101f8e
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.ORIGINALFILENAME
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x1401017d6
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
jne 0x140101fac
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.PRODUCTNAME
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x14010184d
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
jne 0x140101fca
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.PRODUCTVERSION
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x1401018c4
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
jne 0x140101fe8
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.PRIVATEBUILD
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x14010193b
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
jne 0x140102006
mov rbx, rdi
mov qword [rbp + 0x37e0], rbx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
lea rdx, [rbp + 0x37e0]
lea rcx, [rsp + 0x40]
call fcn.140005530
mov dword [rsp + 0x54], 1
mov r9d, 1
mov rsi, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.SPECIALBUILD
lea rcx, [rbp - 0x80]
call fcn.140009cd0
nop
test rsi, rsi
je 0x1401019b2
mov rcx, rsi
call fcn.140247060
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rdx, qword [r13 + 0x60]
lea rcx, [rbp + 0x260]
call fcn.140006f70
nop
lea r8, [rbp + 0x480]
lea rdx, [rbp + 0x260]
mov rcx, r15
call fcn.1400fe4a0
mov r9d, 1
mov r8, qword [rbp + 0x268]
lea rdx, str.FILEDATASOURCE
lea rcx, [rbp - 0x80]
call fcn.140009cd0
mov r8d, dword [0x140350478]
lea rdx, str.COREVERSION
lea rcx, [rbp - 0x80]
call fcn.140009ea0
mov r8d, dword [0x14035047c]
lea rdx, str.TRACEVERSION
lea rcx, [rbp - 0x80]
call fcn.140009ea0
mov r9d, 1
lea r8, [0x14034ef40]
lea rdx, str.BATCHID
lea rcx, [rbp - 0x80]
call fcn.140009cd0
mov r9d, 1
lea r8, [0x14034f000]
lea rdx, str.VERSION
lea rcx, [rbp - 0x80]
call fcn.140009cd0
mov r8d, 4
lea rdx, str.SCS_VERSION
lea rcx, [rbp - 0x80]
call fcn.140009df0
mov qword [rbp + 0x38], rdi
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x480]
call fcn.1400c1930
mov ebx, eax
mov dword [rbp + 0x28], eax
mov r8, qword [rbp + 0x38]
test r8, r8
je 0x140101ac4
cmp word [r8], 0
je 0x140101ac4
mov dword [rsp + 0x20], 1
mov r9d, 1
lea rdx, str.PUBLISHER
lea rcx, [rbp - 0x80]
call fcn.140009f50
mov r8d, ebx
lea rdx, str.CODESIGN
lea rcx, [rbp - 0x80]
call fcn.140009df0
lea rax, vtable.CSABInternet.0
mov qword [rbp + 0x1f0], rax
lea rax, vtable.CSABByteString.0
mov qword [rbp + 0x210], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x220], xmm0
mov qword [rbp + 0x218], rdi
mov ecx, 1
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp + 0x218]
test rdx, rdx
je 0x140101b41
mov r8, qword [rbp + 0x228]
inc r8
mov rcx, rax
call fcn.1402496a0
mov edx, 1
mov rcx, qword [rbp + 0x218]
call fcn.140247060
mov qword [rbp + 0x218], rbx
mov qword [rbp + 0x220], 1
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x210]
call fcn.14000af20
nop
mov dword [rbp + 0x230], edi
mov qword [rbp + 0x208], rdi
mov ecx, send
call fcn.140247068
mov qword [rbp + 0x1f8], rax
lea r8, str.SASDIAGNOSTICITEM
mov edx, send
mov rcx, rax
call fcn.140253604
mov dword [rbp + 0x200], 1
lea rax, vtable.CSABInternet_TryAll.0
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x238], rdi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], rdi
mov dword [rbp + 0x258], edi
lea rax, vtable.CSABByteString.0
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x128], rdi
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x120], rdi
mov ecx, 1
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp + 0x120]
test rdx, rdx
je 0x140101c2d
mov r8, qword [rbp + 0x130]
inc r8
mov rcx, rax
call fcn.1402496a0
mov edx, 1
mov rcx, qword [rbp + 0x120]
call fcn.140247060
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], 1
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x118]
call fcn.14000af20
nop
lea rcx, [rbp - 0x80]
call fcn.14000af10
test eax, eax
jne 0x140101c71
xor r8d, r8d
lea rdx, [rbp + 0x118]
lea rcx, [rbp - 0x80]
call fcn.14000ab00
lea rdx, [rbp - 0x80]
mov rcx, r15
call fcn.1400feaf0
mov qword [rbp + 0x30], rdi
mov dword [rsp + 0x70], edi
inc dword [r15 + 0xa10]
mov r9, qword [rbp - 0x80]
mov rax, qword [r9]
cmp rax, r9
je 0x140101cc9
mov r8, qword [r15 + 0xa08]
nop
mov rcx, qword [rax + 0x10]
add r8, qword [rcx + 0x18]
mov qword [r15 + 0xa08], r8
mov rcx, qword [rax + 0x10]
inc r8
add r8, qword [rcx + 0x38]
mov qword [r15 + 0xa08], r8
mov rax, qword [rax]
cmp rax, r9
jne 0x140101ca0
mov ecx, edi
nop dword [rax + rax]
mov eax, ecx
inc ecx
mov dword [rbp + 0x24], ecx
cmp eax, 4
jae 0x1401024fc
mov rax, rdi
cmp qword [rbp + 0x130], rdi
cmovne rax, qword [rbp + 0x120]
mov qword [rbp + 0x1a0], rax
lea rcx, [rbp - 0x80]
call fcn.14000ad30
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
call fcn.14000ad40
mov qword [rbp + 0x198], rax
mov dword [rbp + 0x20], edi
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x760]
call fcn.140249b10
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rbp + 0x760]
lea rcx, [rbp + 0x37e0]
call fcn.1400e4b70
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], SafeArrayGetDim
mov byte [rbp], 0
lea rax, [rbp + 0x760]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140101d70
lea rdx, [rbp + 0x760]
lea rcx, [rbp]
call fcn.1400b29c0
nop
lea r12, [rbp]
cmp qword [rbp + 0x18], 0x10
mov rbx, qword [rbp]
cmovae r12, rbx
lea rax, [rbp]
cmovae rax, rbx
mov r13, qword [rbp + 0x10]
add rax, r13
lea r14, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r14, rbx
mov rsi, rax
sub rsi, r14
cmp r14, rax
cmova rsi, rdi
test rsi, rsi
je 0x140101dea
mov rbx, rdi
nop dword [rax]
movsx ecx, byte [r14 + rbx]
call fcn.140250480
mov byte [r12 + rbx], al
inc rbx
cmp rbx, rsi
jne 0x140101dd0
mov r13, qword [rbp + 0x10]
lea rbx, [rbp]
mov r14, qword [rbp + 0x18]
cmp r14, 0x10
mov rsi, qword [rbp]
cmovae rbx, rsi
cmp r13, 5
jb 0x14010204c
lea r12, [rbx - 4]
add r12, r13
mov r8, r12
sub r8, rbx
mov edx, 0x76
mov rcx, rbx
call fcn.14024a300
test rax, rax
je 0x14010204c
nop dword [rax + rax]
mov rcx, rdi
lea r8, str.vista
nop word [rax + rax]
movzx edx, byte [rax + rcx]
inc rcx
cmp dl, byte [r8 + rcx - 1]
jne 0x140102024
cmp rcx, 5
jne 0x140101e40
mov ecx, edi
jmp 0x140102029
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027a2
jmp 0x140100998
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027ad
jmp 0x140100ac6
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027b8
jmp 0x140100ba7
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027c3
jmp 0x140100c1b
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027ce
jmp 0x1401014c4
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027d9
jmp 0x140101538
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027e4
jmp 0x1401015af
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027ef
jmp 0x140101623
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x1401027fa
jmp 0x140101697
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x140102805
jmp 0x14010170b
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x140102810
jmp 0x140101782
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x14010281b
jmp 0x1401017f9
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x140102826
jmp 0x140101870
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x140102831
jmp 0x1401018e7
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp + 0x37e0], rax
test rax, rax
je 0x14010283c
jmp 0x14010195e
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x14010209f
inc rax
mov r8, r12
sub r8, rax
mov edx, 0x76
mov rcx, rax
call fcn.14024a300
test rax, rax
jne 0x140101e30
lea rbx, [rbp]
cmp r14, 0x10
cmovae rbx, rsi
cmp r13, 2
jb 0x1401020e0
lea rsi, [rbx + r13]
lea r8, [rsi - 1]
sub r8, rbx
mov edx, 0x78
mov rcx, rbx
call fcn.14024a300
test rax, rax
je 0x1401020e0
movzx r14d, byte [0x1402b499d]
movzx r12d, byte [0x1402b499c]
nop
cmp byte [rax], r12b
jne 0x1401020ad
cmp byte [rax + 1], r14b
jne 0x1401020ad
mov ecx, edi
jmp 0x1401020b2
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x14010204c
mov r8d, edi
jmp 0x1401020e6
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1401020d4
inc rax
lea r8, [rsi - 1]
sub r8, rax
mov edx, 0x78
mov rcx, rax
call fcn.14024a300
test rax, rax
jne 0x140102090
jmp 0x1401020e0
sub rax, rbx
cmp rax, 0xffffffffffffffff
mov r8d, edi
jne 0x1401020e6
mov r8d, 1
mov rdx, qword [rbp + 0x198]
lea rcx, [rbp + 0x1f0]
mov rax, qword [rbp + 0x1f0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test eax, eax
je 0x14010214d
mov rax, qword [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
mov r8d, 0x400
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x1f0]
mov rax, qword [rbp + 0x1f0]
call qword [rax + 0x20]
mov ebx, eax
lea rcx, [rbp + 0x1f0]
mov rdx, qword [rbp + 0x1f0]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x140102150
mov ebx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14010218b
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140102186
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140102791
call fcn.140247060
test ebx, ebx
jne 0x1401021b0
inc dword [r15 + 0x9f0]
mov edx, 0x3e8
mov rcx, qword [r15 + 0x9b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [rbp + 0x24]
jmp 0x140101cd0
inc dword [r15 + 0x9d0]
cmp dword [rbp + 0x37f0], 2
jne 0x1401021c7
inc dword [r15 + 0x9d4]
lea rax, vtable.CSABString.0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x54], 1
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rbp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140005600
mov r13, qword [rsp + 0x48]
mov rbx, r13
mov esi, edi
mov r12d, edi
cmp byte [r13], dil
je 0x14010243a
lea rdx, [0x140286114]
mov rcx, rbx
call fcn.140248db4
mov r14, rdi
test rax, rax
je 0x140102241
mov byte [rax], r14b
mov r14d, 2
test esi, esi
jne 0x140102329
movzx eax, byte [rbx]
cmp al, byte [0x1402b7f54]
jne 0x140102297
movzx eax, byte [rbx + 1]
cmp al, byte [0x1402b7f55]
jne 0x140102297
movzx eax, byte [rbx + 2]
cmp al, byte [0x1402b7f56]
jne 0x140102297
mov r9d, 1
mov r8d, r9d
lea rdx, str.OK___RESPONSE
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [rbp + 0x37f8], 1
jmp 0x140102385
mov rcx, rdi
lea rdx, str.SKIP
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x1401022db
cmp rcx, 5
jne 0x1401022a1
mov r9d, 1
mov r8d, r9d
lea rdx, str.SKIP___RESPONSE
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [rbp + 0x37f8], edi
jmp 0x140102385
mov rcx, rdi
lea rdx, str.STOP
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140102369
cmp rcx, 5
jne 0x1401022f0
mov r9d, 1
mov r8d, r9d
lea rdx, str.STOP___RESPONSE
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [r15 + 0x4c], 1
jmp 0x140102385
cmp esi, 1
jne 0x140102369
mov r9d, esi
mov r8d, esi
lea rdx, str.SLEEP__
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, esi
mov r8d, esi
mov rdx, rbx
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, rbx
call fcn.1402520ac
mov r12d, eax
jmp 0x140102385
mov r9d, 1
mov r8d, r9d
lea rdx, str.Unknown_Server_Response
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140102390
add rax, r14
add rbx, rax
inc esi
cmp byte [rbx], 0
jne 0x140102221
test r12d, r12d
je 0x14010243a
mov eax, 0x927c0
cmp r12d, eax
cmova r12d, eax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x760]
call fcn.140249b10
mov r8d, r12d
lea rdx, str.Sleeping_Diagnostic_For:__d_MS
lea rcx, [rbp + 0x760]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x760]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
cmp dword [rbp + 0x37f0], 1
jne 0x14010241e
mov edx, r12d
mov rcx, qword [r15 + 0x9b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 1
mov r8d, r9d
lea rdx, str.Finished_Sleeping
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140102448
call fcn.140247060
mov ebx, dword [rbp + 0x37f8]
mov r9d, 1
lea rcx, vtable.CSASApplicationLogManager.0
mov r8d, r9d
test ebx, ebx
je 0x140102472
inc dword [r15 + 0x9d8]
lea rdx, str.Server_requsted_file_data_be_sent
jmp 0x140102480
inc dword [r15 + 0x9e0]
lea rdx, str.Server_already_has_this_file_or_does_not_want_it_for_some_reason
call fcn.140004a50
nop
cmp dword [rsp + 0x54], 1
jne 0x140102495
mov rcx, r13
call fcn.140247060
test ebx, ebx
je 0x140102502
mov eax, dword [rbp + 0x28]
cmp eax, 0xfffffffe
je 0x1401024c3
cmp eax, 1
jne 0x140102502
mov r9d, eax
mov r8d, eax
lea rdx, str.SWVS___DNS
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov ebx, edi
jmp 0x140102502
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x140102502
lea rcx, [0x14037d1a0]
call fcn.140078710
test eax, eax
je 0x140102502
mov r9d, 1
mov r8d, r9d
lea rdx, str.SWES___DNS
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov ebx, edi
jmp 0x140102502
mov ebx, dword [rbp + 0x37f8]
mov edi, ebx
lea rax, vtable.CSABByteString.0
mov qword [rbp + 0x118], rax
mov edx, 1
mov rcx, qword [rbp + 0x120]
call fcn.140247060
nop
lea rcx, [rbp + 0x1f0]
call fcn.1400e3a90
nop
cmp dword [rbp + 0x274], 1
jne 0x14010254f
mov rsi, qword [rbp + 0x268]
test rsi, rsi
je 0x14010254f
mov rcx, rsi
call fcn.140247060
nop
lea r14, vtable.CSABStringW.0
mov qword [rbp + 0xa0], r14
add dword [rbp + 0xb4], 0xffffffff
jne 0x140102578
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140102578
call fcn.140247060
nop
mov qword [rbp + 0xb8], r14
add dword [rbp + 0xcc], 0xffffffff
jne 0x14010259a
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x14010259a
call fcn.140247060
nop
mov qword [rbp + 0xd0], r14
add dword [rbp + 0xe4], 0xffffffff
jne 0x1401025bc
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1401025bc
call fcn.140247060
nop
mov qword [rbp + 0xe8], r14
add dword [rbp + 0xfc], 0xffffffff
jne 0x1401025de
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x1401025de
call fcn.140247060
nop
mov qword [rbp + 0x100], r14
add dword [rbp + 0x114], 0xffffffff
jne 0x140102600
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x140102600
call fcn.140247060
nop
mov qword [rbp + 0x40], r14
add dword [rbp + 0x54], 0xffffffff
jne 0x140102619
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140102619
call fcn.140247060
nop
mov qword [rbp - 0x30], r14
add dword [rbp - 0x1c], 0xffffffff
jne 0x140102632
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140102632
call fcn.140247060
nop
mov qword [rbp + 0x58], r14
add dword [rbp + 0x6c], 0xffffffff
jne 0x14010264b
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x14010264b
call fcn.140247060
nop
mov qword [rbp + 0x70], r14
add dword [rbp + 0x84], 0xffffffff
jne 0x140102667
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x140102667
call fcn.140247060
nop
mov qword [rbp + 0x88], r14
add dword [rbp + 0x9c], 0xffffffff
jne 0x140102689
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x140102689
call fcn.140247060
nop
mov qword [rbp - 0x18], r14
add dword [rbp - 4], 0xffffffff
jne 0x1401026a2
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1401026a2
call fcn.140247060
nop
mov qword [rbp + 0x138], r14
add dword [rbp + 0x14c], 0xffffffff
jne 0x1401026c4
mov rcx, qword [rbp + 0x140]
test rcx, rcx
je 0x1401026c4
call fcn.140247060
nop
lea rax, vtable.CSABMD5.0
mov qword [rbp + 0x1b0], rax
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x1401026e5
mov rcx, r14
call fcn.140247060
nop
mov r14, qword [rbp + 0x280]
test r14, r14
je 0x1401026fa
mov rcx, r14
call fcn.140247060
nop
mov r12, qword [rbp + 0x188]
test r12, r12
je 0x14010270e
mov rcx, r12
call fcn.140247060
lea r14, str.SendFileMetaDataToServer
mov rax, qword [rbp + 0x158]
test rax, rax
je 0x14010272a
mov rcx, rax
call fcn.140247060
nop
lea rcx, [rbp + 0x480]
call fcn.1400beab0
nop
lea rcx, [rbp - 0x80]
call fcn.140009b50
nop
mov r8, r14
lea rdx, [0x140286a98]
lea rcx, [rbp + 0x17a0]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x17a0]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
mov eax, edi
mov rbx, qword [rsp + 0x38e8]
add rsp, 0x38a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1402500e8
nop
mov ecx, 0x8007000e
call fcn.140004cd0
nop
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
nop
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
int3
mov ecx, 0x8007000e
call fcn.140004cd0
nop
mov ecx, 0x8007000e
call fcn.140004cd0
int3