Function at 0x14004f790
Capabilities:
Check for time delay via gettickcount
Check os version
Enumerate processes
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb18]
sub rsp, 0xbf0
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rbp + 0xae0], rax
mov r15, rcx
mov qword [rbp - 0x78], rcx
xor r14d, r14d
mov word [rbp + 0x8d0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x8d2]
call fcn.1400c7c50
mov qword [r15 + 0x1d8], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [rsp + 0x58], eax
mov r8d, dword [0x1401a9d80]
imul r8d, r8d
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xb
sub r8d, edx
cmp r8d, 0xa
jne 0x14004f859
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [rsp + 0x70], r14d
or r12, 0xffffffffffffffff
lea edi, [r12 + 2]
lea r13d, [r12 + 0x66]
nop dword [rax]
cmp byte [r15 + 0x121], 0
je 0x14004f895
mov ebx, dword [r15 + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, ebx
jb 0x14004f895
test ebx, ebx
jne 0x1400508e5
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov ebx, dword [0x1401a9d80]
lea r8d, [rbx + 1]
imul r8d, ebx
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xe
sub r8d, edx
cmp r8d, 4
jne 0x14004f8e0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov dword [0x1401a9d80], eax
cmp rsi, 0xffffffffffffffff
je 0x140050c7c
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0x70]
call fcn.1400c7c50
mov dword [rbp + 0x70], 0x238
mov dword [rsp + 0x48], r14d
lea eax, [rbx + 1]
imul eax, ebx
and eax, 0x80000007
jge 0x14004f91b
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 7
jne 0x14004f98a
test ebx, ebx
je 0x14004f98a
mov eax, ebx
and eax, 0x80000001
jge 0x14004f934
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14004f949
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
mov dword [0x1401a9d80], eax
jmp 0x14004f956
lea ebx, [rbx*2 + 1]
mov dword [0x1401a9d80], ebx
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, ebx
sub ecx, eax
je 0x14004f978
sub ecx, 2
je 0x14004f97b
dec ecx
je 0x14004f97d
jmp 0x14004f986
add ebx, 2
inc ebx
add ebx, 2
mov dword [0x1401a9d80], ebx
test ebx, ebx
jne 0x14004f924
lea rdx, [rbp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140050bb7
nop
mov eax, dword [0x1401a9d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 5
jne 0x14004f9d6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401a9d80], eax
mov eax, 0x63
mov word [rbp + 0x8b0], ax
mov dword [rbp + 0x8b4], 0x6f0072
mov eax, 0x6d
mov word [rbp + 0x8b8], ax
mov eax, 0x2e
mov word [rbp + 0x8bc], ax
mov word [rbp + 0x8c4], r14w
mov qword [rbp + 0x2c0], r14
mov qword [rbp + 0x2c8], r14
mov qword [rbp + 0x2c8], 7
mov qword [rbp + 0x2c0], r14
mov word [rbp + 0x2b0], r14w
cmp word [rbp + 0x9c], 0
jne 0x14004fa43
mov r8, r14
jmp 0x14004fa5b
lea rax, [rbp + 0x9c]
mov r8, r12
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004fa50
lea rdx, [rbp + 0x9c]
lea rcx, [rbp + 0x2b0]
call fcn.140053fa0
nop
mov dword [rbp + 0x8c0], 0x650078
mov word [rbp + 0x8be], r13w
mov word [rbp + 0x8ba], r13w
mov eax, 0x68
mov word [rbp + 0x8b2], ax
lea rax, [rbp + 0x8b0]
mov rdx, r12
nop
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14004faa0
lea rcx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 8
cmovae rcx, qword [rbp + 0x2b0]
mov r9, rdx
mov r10, qword [rbp + 0x2c0]
cmp r10, rdx
cmovb r9, r10
test r9, r9
je 0x14004fb04
lea r8, [rbp + 0x8b0]
nop
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x14004faf8
add rcx, 2
add r8, 2
dec r9
jne 0x14004fae0
jmp 0x14004fb04
mov r9d, edi
cmp word [rcx], ax
cmovb r9d, r12d
jmp 0x14004fb07
mov r9d, r14d
movsxd rax, r9d
test r9d, r9d
jne 0x14004fb1a
cmp r10, rdx
jb 0x14004fb1e
mov eax, r14d
setne al
test eax, eax
je 0x14004fb68
cmp qword [rbp + 0x2c8], 8
jb 0x14004fb34
mov rcx, qword [rbp + 0x2b0]
call fcn.1400c27f0
mov qword [rbp + 0x2c8], 7
mov qword [rbp + 0x2c0], r14
mov word [rbp + 0x2b0], r14w
lea rdx, [rbp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14004fde1
jmp 0x14004f9a0
cmp dword [r15 + 0x2d8], 1
jne 0x14004fb7d
mov dword [r15 + 0x2d8], 2
mov r13d, dword [rbp + 0x90]
mov dword [rsp + 0x48], r13d
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r15 + 0x1d8], rax
test rax, rax
je 0x14004fd57
test r13d, r13d
je 0x14004fd57
mov r8d, 0x104
lea rdx, [rbp + 0x8d0]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x140050964
cmp word [rbp + 0x8d0], 0
jne 0x14004fbdf
mov r8, r14
jmp 0x14004fbfb
lea rax, [rbp + 0x8d0]
mov r8, r12
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004fbf0
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x2b0]
call fcn.140053fa0
mov r8, qword [rbp + 0x2c0]
add r8, 0xfffffffffffffff6
mov r9, r12
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x2b0]
call fcn.140053ab0
mov rcx, rax
lea rax, [rbp + 0x8b0]
mov rdx, r12
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14004fc40
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14004fc58
mov rcx, qword [rcx]
mov r9, rdx
cmp r10, rdx
cmovb r9, r10
test r9, r9
je 0x14004fc94
lea r8, [rbp + 0x8b0]
nop
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x14004fc88
add rcx, 2
add r8, 2
dec r9
jne 0x14004fc70
jmp 0x14004fc94
mov r9d, edi
cmp word [rcx], ax
cmovb r9d, r12d
jmp 0x14004fc97
mov r9d, r14d
movsxd rax, r9d
test r9d, r9d
jne 0x14004fcb2
cmp r10, rdx
jae 0x14004fca9
mov eax, r12d
jmp 0x14004fcb2
mov eax, r14d
cmp r10, rdx
setne al
test eax, eax
setne bl
cmp qword [rbp + 0x348], 8
jb 0x14004fccd
mov rcx, qword [rbp + 0x330]
call fcn.1400c27f0
mov qword [rbp + 0x348], 7
mov qword [rbp + 0x340], r14
mov word [rbp + 0x330], r14w
test bl, bl
je 0x14004fd3f
mov rcx, qword [r15 + 0x1d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, dword [rbp + 0x78]
mov dword [rsp + 0x48], r13d
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r15 + 0x1d8], rax
test rax, rax
je 0x140050928
mov r8d, 0x104
lea rdx, [rbp + 0x8d0]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1400508ec
cmp qword [rbp + 0x2c8], 8
jb 0x14004fdc1
mov rcx, qword [rbp + 0x2b0]
call fcn.1400c27f0
jmp 0x14004fdc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov r13d, dword [rbp + 0x78]
mov dword [rsp + 0x48], r13d
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r15 + 0x1d8], rax
test rax, rax
je 0x1400509dc
mov r8d, 0x104
lea rdx, [rbp + 0x8d0]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1400509a0
cmp qword [rbp + 0x2c8], 8
jb 0x14004fdbc
mov rcx, qword [rbp + 0x2b0]
call fcn.1400c27f0
mov edi, 1
mov r13d, 0x65
mov word [rbp + 0x2b0], r14w
mov qword [rbp + 0x2c0], r14
mov qword [rbp + 0x2c8], 7
mov rax, qword [r15 + 0x1d8]
inc rax
test rax, 0xfffffffffffffffe
jne 0x14004fe00
mov ecx, dword [r15 + 0x1e4]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r15 + 0x1d8]
dec rax
cmp rax, 0xfffffffffffffffd
mov esi, dword [rsp + 0x58]
ja 0x14004f870
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov r13d, r14d
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x14004ff7f
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14004fe96
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140002550
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], 0x104
jl 0x140050a53
mov dword [rbx - 0x10], 0x104
mov word [rbx + 0x208], r14w
mov r9d, 0x104
mov r8, rbx
xor edx, edx
mov rcx, qword [r15 + 0x1d8]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
lea rcx, [rbx - 0x18]
call fcn.1400025b0
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.1400462f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14004ff54
cmp dword [rdi + 0x10], 0
jl 0x14004ff45
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14004ff45
call fcn.1400025b0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
jg 0x14004ff3a
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x14004ff54
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140002460
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004ff6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rbx, qword [rsp + 0x40]
jmp 0x14005029c
call fcn.140048e00
test al, al
jne 0x14004fff5
mov r15d, r14d
lea rsi, [rbp + 0x570]
mov r10d, r14d
nop word [rax + rax]
lea ebx, [r10 + 1]
lea ecx, [r15 + 1]
mov r8d, dword [0x1401a9d80]
mov eax, r8d
cdq
idiv ecx
mov r9d, edx
mov ecx, r8d
sub ecx, r15d
imul r9d, ecx
mov eax, r8d
cdq
idiv ebx
add r9d, eax
sub r9d, r10d
mov dword [rsi], r9d
mov edx, r9d
lea rcx, [0x140133488]
call fcn.1400c3124
mov r10d, ebx
add rsi, 4
cmp ebx, 9
jl 0x14004ffa0
inc r15d
cmp r15d, 0x17
jl 0x14004ff92
lea rax, [rbp - 0x80]
mov qword [rsp + 0x68], rax
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rcx, [rbp + 0x8d0]
lea rax, [rbp + 0x8d0]
test rax, 0xffffffffffff0000
jne 0x14005004d
movzx ebx, cx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14005007e
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140002750
jmp 0x14005007e
lea rcx, [rbp + 0x8d0]
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140050060
mov r8d, eax
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp - 0x80]
call fcn.140002460
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x18]
call fcn.1400462f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400500e5
cmp dword [rdi + 0x10], 0
jl 0x1400500d6
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400500d6
call fcn.1400025b0
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
jg 0x1400500cb
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x1400500e5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140002460
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400500fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
cmp byte [0x1401aa981], 0
jne 0x14005014f
movzx eax, byte [0x1401a4d90]
xor al, 0x2c
movzx eax, al
mov word [0x1401a5560], ax
movzx eax, byte [0x1401a4d91]
xor al, 0x47
movzx eax, al
mov word [0x1401a5562], ax
movzx eax, byte [0x1401a4d92]
xor al, 0x3d
movzx eax, al
mov word [0x1401a5564], ax
mov byte [0x1401aa981], 1
mov rbx, qword [rsp + 0x40]
mov rax, rbx
lea rdx, [0x1401a5560]
sub rdx, rbx
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140050178
add rax, 2
test cx, cx
jne 0x140050161
mov eax, r14d
jmp 0x14005017d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14005029c
mov rdi, qword [rsp + 0x50]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400501b2
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140002550
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 0xc], 0x104
jl 0x140050a5e
mov dword [rdi - 0x10], 0x104
mov word [rdi + 0x208], r14w
mov r9d, 0x104
mov r8, rdi
xor edx, edx
mov rsi, qword [rbp - 0x78]
mov rcx, qword [rsi + 0x1d8]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x68], rax
lea rcx, [rdi - 0x18]
call fcn.1400025b0
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call fcn.1400462f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140050274
cmp dword [rbx + 0x10], 0
jl 0x140050265
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140050265
call fcn.1400025b0
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
dec ecx
jg 0x14005025a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140050274
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140002460
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005028c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov rbx, qword [rsp + 0x40]
jmp 0x1400502a0
mov rsi, qword [rbp - 0x78]
cmp dword [rbx - 0x10], 0
je 0x140050324
cmp byte [0x1401aa981], 0
jne 0x1400502ef
movzx eax, byte [0x1401a4d90]
xor al, 0x2c
movzx eax, al
mov word [0x1401a5560], ax
movzx eax, byte [0x1401a4d91]
xor al, 0x47
movzx eax, al
mov word [0x1401a5562], ax
movzx eax, byte [0x1401a4d92]
xor al, 0x3d
movzx eax, al
mov word [0x1401a5564], ax
mov byte [0x1401aa981], 1
mov rax, rbx
lea rdx, [0x1401a5560]
sub rdx, rbx
nop dword [rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140050317
add rax, 2
test cx, cx
jne 0x140050300
mov eax, r14d
jmp 0x14005031c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140050a69
mov r8d, r14d
cmp r15d, 0x714
jne 0x1400503bd
lea rcx, [rbp - 0x38]
call fcn.140046910
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140050397
cmp dword [rbx + 0x10], 0
jl 0x140050388
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140050388
call fcn.1400025b0
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
dec ecx
jg 0x14005037d
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140050397
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140002460
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400503af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], 0
je 0x140050444
cmp byte [0x1401aa981], 0
jne 0x140050411
movzx ecx, byte [0x1401a4d90]
xor cl, 0x2c
movzx ecx, cl
mov word [0x1401a5560], cx
movzx eax, byte [0x1401a4d91]
xor al, 0x47
movzx eax, al
mov word [0x1401a5562], ax
movzx eax, byte [0x1401a4d92]
xor al, 0x3d
movzx eax, al
mov word [0x1401a5564], ax
mov byte [0x1401aa981], 1
mov rax, rbx
lea rdx, [0x1401a5560]
sub rdx, rbx
nop
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140050437
add rax, 2
test cx, cx
jne 0x140050420
mov eax, r14d
jmp 0x14005043c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140050a69
mov qword [rsi + 0x1d8], r14
mov edx, r8d
lea rcx, [rbp + 0x3d0]
call fcn.140048d40
mov rsi, rax
mov edx, r15d
lea rcx, [rbp + 0x390]
call fcn.140048d40
mov rdi, rax
mov edx, r13d
lea rcx, [rbp + 0x350]
call fcn.140048d40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x2f0]
call fcn.140048d40
nop
lea r8, str.___:
mov rdx, rax
lea rcx, [rbp + 0x310]
call fcn.14002d3b0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x3f0]
call fcn.140054640
nop
lea r8, str.___:
mov rdx, rax
lea rcx, [rbp + 0x370]
call fcn.14002d3b0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.140054640
nop
lea r8, str.___:
mov rdx, rax
lea rcx, [rbp + 0x410]
call fcn.14002d3b0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140054640
nop
cmp qword [rbp + 0x428], 0x10
jb 0x14005052a
mov rcx, qword [rbp + 0x410]
call fcn.1400c27f0
mov qword [rbp + 0x428], 0xf
mov qword [rbp + 0x420], r14
mov byte [rbp + 0x410], 0
cmp qword [rbp + 0x3c8], 0x10
jb 0x140050559
mov rcx, qword [rbp + 0x3b0]
call fcn.1400c27f0
mov qword [rbp + 0x3c8], 0xf
mov qword [rbp + 0x3c0], r14
mov byte [rbp + 0x3b0], 0
cmp qword [rbp + 0x388], 0x10
jb 0x140050588
mov rcx, qword [rbp + 0x370]
call fcn.1400c27f0
mov qword [rbp + 0x388], 0xf
mov qword [rbp + 0x380], r14
mov byte [rbp + 0x370], 0
cmp qword [rbp + 0x408], 0x10
jb 0x1400505b7
mov rcx, qword [rbp + 0x3f0]
call fcn.1400c27f0
mov qword [rbp + 0x408], 0xf
mov qword [rbp + 0x400], r14
mov byte [rbp + 0x3f0], 0
cmp qword [rbp + 0x328], 0x10
jb 0x1400505e6
mov rcx, qword [rbp + 0x310]
call fcn.1400c27f0
mov qword [rbp + 0x328], 0xf
mov qword [rbp + 0x320], r14
mov byte [rbp + 0x310], 0
cmp qword [rbp + 0x308], 0x10
jb 0x140050615
mov rcx, qword [rbp + 0x2f0]
call fcn.1400c27f0
mov qword [rbp + 0x308], 0xf
mov qword [rbp + 0x300], r14
mov byte [rbp + 0x2f0], 0
cmp qword [rbp + 0x368], 0x10
jb 0x140050644
mov rcx, qword [rbp + 0x350]
call fcn.1400c27f0
mov qword [rbp + 0x368], 0xf
mov qword [rbp + 0x360], r14
mov byte [rbp + 0x350], 0
cmp qword [rbp + 0x3a8], 0x10
jb 0x140050673
mov rcx, qword [rbp + 0x390]
call fcn.1400c27f0
mov qword [rbp + 0x3a8], 0xf
mov qword [rbp + 0x3a0], r14
mov byte [rbp + 0x390], 0
cmp qword [rbp + 0x3e8], 0x10
jb 0x1400506a2
mov rcx, qword [rbp + 0x3d0]
call fcn.1400c27f0
mov qword [rbp + 0x3e8], 0xf
mov qword [rbp + 0x3e0], r14
mov byte [rbp + 0x3d0], 0
mov esi, dword [rsp + 0x70]
mov eax, esi
inc esi
mov dword [rsp + 0x70], esi
cmp eax, 5
jge 0x140050b7b
mov r9d, dword [0x1401a9d80]
lea r8d, [r9 + 1]
mov ecx, r8d
imul ecx, r9d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xf
cmove r9d, r8d
mov dword [0x1401a9d80], r9d
lea rbx, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 0x10
cmovae rbx, qword [rbp + 0x2d0]
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
test rbx, rbx
je 0x140050768
test rbx, 0xffffffffffff0000
jne 0x140050768
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x140050776
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140002750
jmp 0x140050776
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.1400032d0
nop
cmp byte [0x1401aa998], 0
jne 0x1400507d2
movzx eax, byte [0x1401a4d90]
xor al, 0x4f
movzx eax, al
mov word [0x1401a5920], ax
movzx eax, byte [0x1401a4d91]
xor al, 0xa
movzx eax, al
mov word [0x1401a5922], ax
movzx eax, byte [0x1401a4d92]
xor al, 0xd
movzx eax, al
mov word [0x1401a5924], ax
movzx eax, byte [0x1401a4d93]
xor al, 0x10
movzx eax, al
mov word [0x1401a5926], ax
mov byte [0x1401aa998], 1
lea rdx, [0x1401a5920]
lea rcx, [rbp - 0x40]
call fcn.1400022a0
nop
lea r8, [rsp + 0x78]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14000ea60
nop
mov r15, qword [rbp - 0x78]
lea rcx, [r15 + 0x1c0]
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
call fcn.14000f520
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140050826
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005083f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140050858
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [r15 + 0x1e4]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp + 0x2e8], 0x10
jb 0x140050883
mov rcx, qword [rbp + 0x2d0]
call fcn.1400c27f0
mov qword [rbp + 0x2e8], 0xf
mov qword [rbp + 0x2e0], r14
mov byte [rbp + 0x2d0], 0
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400508b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
mov edi, 1
mov esi, dword [rsp + 0x58]
lea r13d, [rdi + 0x64]
jg 0x14004f870
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004f870
mov eax, edi
jmp 0x140050d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x550]
call fcn.140048d40
mov r10, rax
call fcn.14004c1d0
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x58]
call fcn.14004cf50
lea rdx, [0x14016ca48]
lea rcx, [rbp + 0x58]
call fcn.1400ca6e8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x430]
call fcn.140048d40
mov rbx, rax
call fcn.14004cb90
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x18]
call fcn.14004cf50
lea rdx, [0x14016ca48]
lea rcx, [rbp + 0x18]
call fcn.1400ca6e8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x490]
call fcn.140048d40
mov r10, rax
call fcn.14004ca20
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x48]
call fcn.14004cf50
lea rdx, [0x14016ca48]
lea rcx, [rbp + 0x48]
call fcn.1400ca6e8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x530]
call fcn.140048d40
mov r10, rax
call fcn.14004b180
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x38]
call fcn.14004cf50
lea rdx, [0x14016ca48]
lea rcx, [rbp + 0x38]
call fcn.1400ca6e8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4d0]
call fcn.140048d40
mov rbx, rax
mov edx, edi
lea rcx, [rbp + 0x510]
call fcn.140048d40
nop
lea r8, [0x140135f00]
mov rdx, rax
lea rcx, [rbp + 0x450]
call fcn.14002d3b0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x470]
call fcn.140054640
mov r10, rax
call fcn.14004bde0
mov rdx, rax
mov r8, r10
lea rcx, [rbp]
call fcn.14004cf50
lea rdx, [0x14016ca48]
lea rcx, [rbp]
call fcn.1400ca6e8
nop
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, r14
lea rdx, str.0.0.0.0
nop word [rax + rax]
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140050a99
cmp rcx, 8
jne 0x140050a80
mov eax, r14d
jmp 0x140050a9e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140050b2b
mov qword [rsi + 0x1d8], r14
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.140019690
nop
mov dl, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140053980
mov dl, 0x20
lea rcx, [rsp + 0x60]
call fcn.140053980
mov dl, 0x2f
lea rcx, [rsp + 0x60]
call fcn.140053980
mov r10, qword [rsp + 0x60]
mov eax, 1
sub eax, dword [r10 - 8]
or eax, dword [r10 - 0xc]
jge 0x140050b06
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14001a390
mov r10, qword [rsp + 0x60]
call fcn.14004c0e0
mov rdx, rax
mov r8, r10
lea rcx, [rbp - 0x10]
call fcn.14004ce90
lea rdx, [0x14016ca48]
lea rcx, [rbp - 0x10]
call fcn.1400ca6e8
nop
lea rcx, [rsi + 0x190]
lea rdx, [rsp + 0x40]
call fcn.1400023c0
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0x1d0], eax
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140050b5b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140050b74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140050d40
lea r10, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 0x10
cmovae r10, qword [rbp + 0x2d0]
call fcn.14004bc50
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x28]
call fcn.14004ce90
lea rdx, [0x14016ca48]
lea rcx, [rbp + 0x28]
call fcn.1400ca6e8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4b0]
call fcn.140048d40
mov rdi, rax
call fcn.14004ba40
mov rbx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x68], rax
lea rcx, [0x1401a19a8]
mov rdx, qword [0x1401a19a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x68], rax
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
test rbx, rbx
je 0x140050c2e
nop
inc r12
cmp word [rbx + r12*2], 0
jne 0x140050c20
mov r14d, r12d
mov r8d, r14d
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140002460
cmp qword [rdi + 0x18], 0x10
jb 0x140050c47
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.1400032d0
lea r8, [0x140133994]
lea rdx, [0x140133998]
lea rcx, [rbp - 0x60]
call fcn.14000e600
nop
lea rdx, [0x14016ca48]
lea rcx, [rbp - 0x60]
call fcn.1400ca6e8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4f0]
call fcn.140048d40
mov rdi, rax
call fcn.14004bef0
mov rbx, rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x68], rax
lea rcx, [0x1401a19a8]
mov rdx, qword [0x1401a19a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x68], rax
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
test rbx, rbx
je 0x140050cf2
inc r12
cmp word [rbx + r12*2], 0
jne 0x140050ce4
mov r14d, r12d
mov r8d, r14d
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140002460
cmp qword [rdi + 0x18], 0x10
jb 0x140050d0b
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.1400032d0
lea r8, [0x140133994]
lea rdx, [0x140133998]
lea rcx, [rbp - 0x70]
call fcn.14000e600
nop
lea rdx, [0x14016ca48]
lea rcx, [rbp - 0x70]
call fcn.1400ca6e8
nop
mov rcx, qword [rbp + 0xae0]
xor rcx, rsp
call fcn.1400c2810
lea r11, [rsp + 0xbf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret