Function at 0x14019caf0
Capabilities:
Get file size
Log keystrokes via polling
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d8]
sub rsp, 0x4d8
mov qword [rbp + 0xc0], 0xfffffffffffffffe
mov ebx, edx
mov r13, rcx
xor r15d, r15d
mov dword [rbp - 0x80], r15d
mov r14d, 1
mov esi, r14d
mov dword [rbp + 0x430], r14d
test rcx, rcx
je 0x14019cb3e
mov dword [rcx], 8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
test ebx, ebx
jne 0x14019cb86
mov r8d, dword [0x14037b48c]
test r8d, r8d
je 0x14019cb86
mov edx, eax
sub edx, r8d
mov ecx, eax
sub ecx, r8d
dec ecx
cmp r8d, eax
cmovbe ecx, edx
cmp ecx, 0xea60
jae 0x14019cb86
test r13, r13
je 0x14019da8e
mov eax, dword [reloc.OLEAUT32.dll_VariantClear]
mov dword [r13], eax
jmp 0x14019da8e
mov dword [0x14037b48c], eax
mov byte [0x14037ae40], r15b
mov dword [0x14037ae28], r15d
lea r8, [0x1402bdee0]
mov edx, 0x21
lea rcx, [0x14033c490]
call fcn.140253604
lea r8, [0x1402bdee0]
mov edx, 0x21
lea rcx, [0x14033c4b8]
call fcn.140253604
lea rax, vtable.CSABInternet.0
mov qword [rbp + 0x50], rax
lea rdi, vtable.CSABByteString.0
mov qword [rbp + 0x70], rdi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x78], r15
mov rcx, r14
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x14019cc21
mov r8, qword [rbp + 0x88]
inc r8
mov rcx, rax
call fcn.1402496a0
mov rdx, r14
mov rcx, qword [rbp + 0x78]
call fcn.140247060
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x70]
call fcn.14000af20
nop
mov dword [rbp + 0x90], r15d
mov qword [rbp + 0x68], r15
mov ecx, 8
call fcn.140247068
mov qword [rbp + 0x58], rax
lea r8, str.SAS_APP
mov edx, 8
mov rcx, rax
call fcn.140253604
mov dword [rbp + 0x60], r14d
lea rax, vtable.CSABInternet_TryAll.0
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x98], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r15
mov dword [rbp + 0xb8], r15d
lea r9, str._application.php
lea r8, str.www.superantispyware.com
mov edx, SafeArrayUnaccessData
lea rcx, [rbp + 0x110]
call fcn.1400093a0
nop
lea rcx, [rbp + 0x110]
call fcn.140198e50
lea rcx, [rbp + 0x110]
call fcn.14019dae0
lea rcx, [rbp + 0x110]
call fcn.14019e240
xor edx, edx
lea rcx, str.06CD588E_4BD7_4ab9_9938_0949231C9484
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14019cd23
xor r9d, r9d
lea r8, [0x1402c55c8]
lea rdx, str.PRIVATE
lea rcx, [rbp + 0x110]
call fcn.140009cd0
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, ax
shr eax, 0xf
mov dword [0x14037adec], eax
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x40], r15
mov rcx, r14
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x14019cd62
mov r8, qword [rbp - 0x30]
inc r8
mov rcx, rax
call fcn.1402496a0
mov rdx, r14
mov rcx, qword [rbp - 0x40]
call fcn.140247060
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.14000af20
nop
lea rcx, [rbp + 0x110]
call fcn.14000af10
test eax, eax
jne 0x14019cd9c
xor r8d, r8d
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x110]
call fcn.14000ab00
mov qword [rbp - 0x78], r15
mov dword [rbp + 0x438], r15d
mov rbx, r15
cmp qword [rbp - 0x30], r15
cmovne rbx, qword [rbp - 0x40]
lea rcx, [rbp + 0x110]
call fcn.14000ad30
mov rdi, rax
lea rcx, [rbp + 0x110]
call fcn.14000ad40
mov rdx, rax
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x438]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffff
mov r9, rdi
xor r8d, r8d
lea rcx, [rbp + 0x50]
call fcn.1400e6ad0
mov r12, 0xffffffffffffffff
test eax, eax
je 0x14019d013
cmp qword [rbp - 0x78], 0
je 0x14019d013
mov dword [rsp + 0x78], r15d
lea rax, vtable.CSABByteString.0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], r15
mov rcx, r14
call fcn.140247068
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14000af20
nop
mov r8d, dword [rbp + 0x438]
mov rdx, qword [rbp - 0x78]
lea rcx, [rsp + 0x50]
call fcn.14000af20
mov edx, dword [rbp + 0x438]
mov rdi, qword [rsp + 0x58]
mov r9, rdi
test edx, edx
je 0x14019cffb
mov rsi, r9
mov ecx, edx
cmp edx, 2
jb 0x14019ceaa
nop
movzx eax, word [rsi]
cmp ax, word [0x140286114]
je 0x14019cf36
inc rsi
dec ecx
cmp ecx, 2
jae 0x14019ce90
mov esi, edx
add rsi, r9
mov r14, r15
mov rbx, r9
mov eax, esi
sub eax, r9d
je 0x14019cecd
nop dword [rax]
cmp byte [rbx], 0x7c
je 0x14019ced0
inc rbx
add eax, 0xffffffff
jne 0x14019cec0
mov rbx, r15
test rbx, rbx
je case.0x14019cf34.1029
xor eax, eax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], eax
lea r8d, [rax + 0x23]
mov rdx, r9
lea rcx, [rbp - 0x70]
call fcn.140258830
mov r8d, 0xa
lea rdx, [rbp + 0xc8]
lea rcx, [rbp - 0x70]
call fcn.140251de0
add eax, 0xfffffc00
cmp eax, 8
ja case.0x14019cf34.1029
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0x19dab0]
add rcx, r8
jmp rcx
test rsi, rsi
je 0x14019ceaa
lea r14, [rsi + 2]
jmp 0x14019ceb2
cmp dword [rsp + 0x78], 0
jne 0x14019cf5f
test r13, r13
je 0x14019cf58
mov dword [r13], r15d
mov dword [reloc.OLEAUT32.dll_VariantClear], r15d
lea rdi, [rbx + 1]
mov eax, esi
sub eax, edi
je 0x14019cf7d
mov rbx, rdi
nop dword [rax]
cmp byte [rbx], 0x7c
je 0x14019cf80
inc rbx
add eax, 0xffffffff
jne 0x14019cf70
mov rbx, r15
test rbx, rbx
je 0x14019cfd1
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x1b0]
call fcn.140249b10
mov r9, rbx
sub r9, rdi
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp + 0x1b0]
call fcn.140250550
lea rcx, [rbx + 1]
mov eax, esi
sub eax, ecx
je 0x14019cfd1
mov rbx, rcx
cmp byte [rbx], 0x7c
je 0x14019d066
inc rbx
add eax, 0xffffffff
jne 0x14019cfc0
mov rdi, qword [rsp + 0x58]
mov esi, dword [rbp + 0x430]
test r14, r14
je 0x14019cff5
mov edx, edi
sub edx, r14d
add edx, dword [rbp + 0x438]
mov r9, r14
jne 0x14019ce84
mov r14d, 1
mov rcx, qword [rbp - 0x78]
call fcn.140247060
mov qword [rbp - 0x78], r15
mov rdx, r14
mov rcx, rdi
call fcn.140247060
mov rdi, qword [0x14037add0]
test rdi, rdi
je 0x14019da23
cmp dword [0x14037b490], 0
jne 0x14019da23
test esi, esi
je 0x14019daa2
lea rax, [rdi + 0x10]
mov qword [rbp + 0x420], rax
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp dword [rdi], 0
jne 0x14019d64b
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14019da23
test rbx, rbx
je 0x14019cfd1
mov edx, ebx
sub edx, ecx
call fcn.1401a7ed0
mov edi, eax
lea rcx, [rbp + 0x1b0]
call fcn.140192aa0
cmp edi, eax
jne 0x14019d0a8
lea r8, [rbp + 0x1b0]
mov edx, 0x104
lea rcx, [0x14037ae40]
call fcn.140253604
mov dword [0x14037ae28], edi
lea rcx, [rbx + 1]
mov eax, esi
sub eax, ecx
je 0x14019cfd1
mov rbx, rcx
nop dword [rax]
cmp byte [rbx], 0x7c
je 0x14019d0d2
inc rbx
add eax, 0xffffffff
jne 0x14019d0c0
jmp 0x14019cfd1
test rbx, rbx
je 0x14019cfd1
mov edx, ebx
sub edx, ecx
call fcn.1401a7ed0
mov dword [0x14037ae2c], eax
lea rcx, [rbx + 1]
mov eax, esi
sub eax, ecx
je 0x14019cfd1
mov rbx, rcx
nop dword [rax + rax]
cmp byte [rbx], 0x7c
je 0x14019d112
inc rbx
add eax, 0xffffffff
jne 0x14019d100
jmp 0x14019cfd1
test rbx, rbx
je 0x14019cfd1
mov edx, ebx
sub edx, ecx
call fcn.1401a7ed0
mov dword [0x14037ae30], eax
lea r8, [rbx + 1]
mov eax, esi
sub eax, r8d
je 0x14019cfd1
mov rbx, r8
nop dword [rax]
cmp byte [rbx], 0x7c
je 0x14019d152
inc rbx
add eax, 0xffffffff
jne 0x14019d140
jmp 0x14019cfd1
test rbx, rbx
je 0x14019cfd1
mov rax, rbx
sub rax, r8
cmp rax, 0x20
jne 0x14019d180
mov byte [0x14033c490], 0
lea edx, [rax + 1]
mov r9, rax
lea rcx, [0x14033c490]
call fcn.140250550
lea r8, [rbx + 1]
mov ecx, esi
sub ecx, r8d
je 0x14019d19d
mov rax, r8
nop
cmp byte [rax], 0x7c
je 0x14019d1a0
inc rax
add ecx, 0xffffffff
jne 0x14019d190
mov rax, r15
test rax, rax
cmovne rsi, rax
sub rsi, r8
cmp rsi, 0x20
jne 0x14019cfd1
mov byte [0x14033c4b8], 0
lea edx, [rsi + 1]
mov r9, rsi
lea rcx, [0x14033c4b8]
call fcn.140250550
jmp 0x14019cfd1
lea rcx, [rbx + 1]
mov eax, esi
sub eax, ecx
je case.0x14019cf34.1029
mov rbx, rcx
cmp byte [rbx], 0x7c
je 0x14019d1f5
inc rbx
add eax, 0xffffffff
jne 0x14019d1e3
jmp case.0x14019cf34.1029
test rbx, rbx
je case.0x14019cf34.1029
xor eax, eax
mov qword [0x1403508b0], rax
mov qword [0x1403508b8], rax
mov edx, ebx
sub edx, ecx
call fcn.1401a7ed0
test r13, r13
je 0x14019d220
mov dword [r13], eax
mov dword [reloc.OLEAUT32.dll_VariantClear], eax
mov dword [rsp + 0x78], 1
test eax, eax
je 0x14019d26c
sub eax, 6
je 0x14019d260
cmp eax, 1
je 0x14019d26c
mov dword [0x14034e8d4], r15d
mov byte [0x14034e8d8], 0
mov rax, qword [0x14037ae08]
mov dword [rax + 0x2c], r15d
mov byte [rax + 0x30], 0
call fcn.1400fb560
jmp 0x14019d27a
mov dword [0x1403508d0], 1
jmp 0x14019d27a
mov qword [0x1403508d0], r15
mov dword [0x140350f24], r15d
cmp dword [0x14034e8d4], 0
jne 0x14019d290
cmp byte [0x14034e8d8], 0
je case.0x14019cf34.1029
lea rdi, [rbx + 1]
mov eax, esi
sub eax, edi
je 0x14019d2ad
mov rbx, rdi
nop dword [rax]
cmp byte [rbx], 0x7c
je 0x14019d2b0
inc rbx
add eax, 0xffffffff
jne 0x14019d2a0
mov rbx, r15
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x1b0]
call fcn.140249b10
test rbx, rbx
cmovne rsi, rbx
sub rsi, rdi
mov r9, rsi
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp + 0x1b0]
call fcn.140250550
lea rdx, str.LIFETIME
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x14019d319
mov eax, 0xffff
mov dword [0x1403508b0], 0xffffffff
mov word [0x1403508b6], ax
jmp 0x14019d3ad
lea rcx, [rbp + 0x1b0]
mov rax, r12
inc rax
cmp byte [rcx + rax], 0
jne 0x14019d323
cmp rax, 0xa
jb 0x14019d3ad
movzx eax, byte [rbp + 0x1b0]
mov byte [rbp + 0x428], al
movzx eax, byte [rbp + 0x1b1]
mov byte [rbp + 0x429], al
mov byte [rbp + 0x42a], 0
movzx eax, byte [rbp + 0x1b3]
mov byte [rbp + 0x420], al
movzx eax, byte [rbp + 0x1b4]
mov byte [rbp + 0x421], al
mov byte [rbp + 0x422], 0
lea rcx, [rbp + 0x428]
call fcn.1402520ac
mov word [0x1403508b2], ax
lea rcx, [rbp + 0x420]
call fcn.1402520ac
mov word [0x1403508b6], ax
lea rcx, [rbp + 0x1b6]
call fcn.1402520ac
mov word [0x1403508b0], ax
cmp dword [0x1403508d8], 0
jne 0x14019cfd1
xor edx, edx
lea ecx, [rdx + 1]
call fcn.1400fcba0
jmp 0x14019cfd1
mov dword [0x14037adec], 1
jmp case.0x14019cf34.1029
mov esi, r15d
mov dword [rbp + 0x430], r15d
jmp 0x14019cfdc
mov eax, r15d
cmp byte [rbx + 1], 0x30
setne al
mov dword [0x140351464], eax
jmp case.0x14019cf34.1029
lea rcx, [rbx + 1]
sub esi, ecx
mov edx, esi
call fcn.1401a7ed0
cmp dword [0x140351468], eax
jae case.0x14019cf34.1029
mov dword [0x140351468], eax
call fcn.1400fb560
mov dword [rbp - 0x80], 1
jmp case.0x14019cf34.1029
mov r9d, 1
mov r8d, r9d
lea rdx, str.New_Key_File
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, 1
mov r8d, r9d
cmp qword [0x1403517f8], 0
je 0x14019d633
inc rbx
sub esi, ebx
lea edx, [rsi + rsi]
mov dword [rsp + 0x70], edx
lea rcx, [rbp + 0xd0]
call fcn.1400c6330
nop
mov r8, qword [rbp + 0xf8]
test r8, r8
je 0x14019d48a
mov r8, qword [r8 + 0x10]
jmp 0x14019d48d
mov r8, r15
lea r9, [rsp + 0x70]
mov edx, esi
mov rcx, rbx
call fcn.14003c9b0
test eax, eax
je 0x14019d605
lea rbx, vtable.CSABString.0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], r15
mov dword [rbp - 0x60], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x68], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x5c], 1
lea rdx, [rbp - 0x70]
mov rcx, qword [0x1403517f8]
call fcn.140004ef0
cmp dword [rbp - 0x60], 0
je 0x14019d5ce
mov rdx, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.14000bd30
nop
mov rdx, qword [rax]
lea rcx, [rbp + 0x1b0]
call fcn.1400b9970
nop
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rbp + 0x1b0]
call fcn.1400ba2b0
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80
mov edx, 0xc0000000
mov r9d, 3
lea r8d, [r9 - 1]
lea rcx, [rbp + 0x1b0]
call fcn.1400bc1d0
test eax, eax
je 0x14019d5a3
mov rax, qword [rbp + 0xf8]
test rax, rax
je 0x14019d566
mov rdx, qword [rax + 0x10]
jmp 0x14019d569
mov rdx, r15
xor r9d, r9d
mov r8d, dword [rsp + 0x70]
lea rcx, [rbp + 0x1b0]
call fcn.1400bcb90
mov r9d, 1
lea rcx, vtable.CSASApplicationLogManager.0
mov r8d, r9d
test eax, eax
jne 0x14019d59a
lea rdx, str.Failed_To_Update_Key_File
jmp 0x14019d5ba
lea rdx, str.ERROR____Updated_Key_File
jmp 0x14019d5ba
mov r9d, 1
mov r8d, r9d
lea rdx, str.ERROR____Failed_To_Open_File
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
lea rcx, [rbp + 0x1b0]
call fcn.1400b9c00
jmp 0x14019d5eb
mov r9d, 1
mov r8d, r9d
lea rdx, str.ERROR____Path_Empty
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
mov qword [rbp - 0x70], rbx
add dword [rbp - 0x5c], 0xffffffff
jne 0x14019d622
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14019d622
call fcn.140247060
jmp 0x14019d622
mov r9d, 1
mov r8d, r9d
lea rdx, str.ERROR____Failed_To_Decode
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
lea rcx, [rbp + 0xd0]
call fcn.1400c65b0
jmp case.0x14019cf34.1029
lea rdx, str.ERROR____AVSDK_NULL
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
jmp case.0x14019cf34.1029
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
lea ecx, [r14 + 1]
call fcn.140247068
mov rbx, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x430]
mov r8d, r14d
mov rdx, rax
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp r14d, dword [rbp + 0x430]
jne 0x14019da0a
mov byte [r14 + rbx], 0
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14019da1d
nop
inc r12
cmp byte [rbx + r12], 0
jne 0x14019d6d0
lea edx, [r12 + 0x2000]
xor r8d, r8d
xor ecx, ecx
call fcn.14023f910
mov rdi, rax
mov r9d, r12d
mov r8, rbx
lea rdx, str.data
mov rcx, rax
call fcn.14023ff30
test eax, eax
jne 0x14019da1d
mov qword [rsp + 0x78], r15
mov dword [rbp + 0x428], r15d
lea r8, [rbp + 0x428]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.14023ff90
test eax, eax
jne 0x14019da1d
lea r9, str._application.php
lea r8, str.www.superantispyware.com
lea edx, [rax + 0x13]
lea rcx, [rbp + 0x160]
call fcn.1400093a0
nop
lea rcx, [rbp + 0x160]
call fcn.140198e50
lea rdi, vtable.CSABMD5.0
mov qword [rbp + 0xd0], rdi
mov r8d, r12d
mov rdx, rbx
lea rcx, [rbp + 0xd0]
call fcn.140190660
nop
lea rax, [0x14037ae40]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe8]
lea r8, str.METRICS__s__s
mov edx, 0x104
lea rcx, [rbp + 0x1b0]
call fcn.14000b150
mov r14d, 1
mov r9d, r14d
lea r8, [rbp + 0x1b0]
lea rdx, str.FILENAME
lea rcx, [rbp + 0x160]
call fcn.140009cd0
mov r9d, dword [rbp + 0x428]
mov r8, qword [rsp + 0x78]
lea rdx, str.DATA
lea rcx, [rbp + 0x160]
call fcn.14000afe0
lea rsi, vtable.CSABByteString.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r15
mov ecx, r14d
call fcn.140247068
mov rbx, rax
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x14019d839
mov r8, qword [rsp + 0x68]
inc r8
mov rcx, rax
call fcn.1402496a0
mov edx, r14d
mov rcx, qword [rsp + 0x58]
call fcn.140247060
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14000af20
nop
lea rcx, [rbp + 0x160]
call fcn.14000af10
test eax, eax
jne 0x14019d877
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x160]
call fcn.14000ab00
mov qword [rsp + 0x70], r15
lea rax, vtable.CSABInternet.0
mov qword [rbp - 0x20], rax
mov qword [rbp], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 8], r15
mov rcx, r14
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x14019d8c6
mov r8, qword [rbp + 0x18]
inc r8
mov rcx, rax
call fcn.1402496a0
mov rdx, r14
mov rcx, qword [rbp + 8]
call fcn.140247060
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rbp]
call fcn.14000af20
nop
mov dword [rbp + 0x20], r15d
mov qword [rbp - 8], r15
mov ecx, SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x18], rax
lea r8, str.SASThreatMap
mov edx, SafeArrayGetDim
mov rcx, rax
call fcn.140253604
mov dword [rbp - 0x10], r14d
lea rax, vtable.CSABInternet_TryAll.0
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x28], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r15
mov dword [rbp + 0x48], r15d
cmp qword [rsp + 0x68], 0
cmovne r15, qword [rsp + 0x58]
lea rcx, [rbp + 0x160]
call fcn.14000ad30
mov rbx, rax
lea rcx, [rbp + 0x160]
call fcn.14000ad40
mov rdx, rax
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x420]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
mov r9, rbx
xor r8d, r8d
lea rcx, [rbp - 0x20]
call fcn.1400e6ad0
test eax, eax
je 0x14019d9b7
cmp dword [rbp + 0x420], 2
jb 0x14019d9d8
mov rax, qword [rsp + 0x70]
movzx ecx, word [rax]
cmp cx, word [0x1402b7f54]
jne 0x14019d9d8
mov rcx, qword [0x14037add0]
call fcn.140197360
jmp 0x14019d9d8
cmp dword [rbp + 0x420], 1
jne 0x14019d9d8
mov ecx, dword [0x14037b490]
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0x2e
cmove ecx, r14d
mov dword [0x14037b490], ecx
lea rcx, [rbp - 0x20]
call fcn.1400e3a90
nop
mov qword [rsp + 0x50], rsi
mov rdx, r14
mov rcx, qword [rsp + 0x58]
call fcn.140247060
nop
mov qword [rbp + 0xd0], rdi
lea rcx, [rbp + 0x160]
call fcn.140009b50
jmp 0x14019da2a
mov rcx, rbx
call fcn.140247060
nop
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14d, 1
lea rsi, vtable.CSABByteString.0
cmp dword [0x14034e690], 0
je 0x14019da58
cmp dword [0x14034e8d4], 0
jne 0x14019da58
cmp byte [0x14034e8d8], 0
jne 0x14019da58
lea rdx, [0x1403508b0]
mov rcx, qword [0x14037ae08]
call fcn.1401a0b90
cmp dword [rbp - 0x80], 0
je 0x14019da67
mov ecx, r14d
call fcn.1401df410
nop
mov qword [rbp - 0x48], rsi
mov rdx, r14
mov rcx, qword [rbp - 0x40]
call fcn.140247060
nop
lea rcx, [rbp + 0x110]
call fcn.140009b50
nop
lea rcx, [rbp + 0x50]
call fcn.1400e3a90
add rsp, 0x4d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rdi
call fcn.140197360
jmp 0x14019da23