Function at 0x1402bdc4c
Capabilities:
Check mutex on windows
Create process on windows
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17f0]
mov eax, 0x18f0
call fcn.1400cbf30
sub rsp, rax
mov qword [rbp + 0x128], 0xfffffffffffffffe
mov qword [rsp + 0x1940], rbx
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp + 0x17e0], rax
mov r13, rdx
mov rdi, rcx
mov qword [rbp - 0x80], rcx
add rcx, 0x50
call fcn.14000c244
xor ebx, ebx
mov r12b, bl
mov byte [rsp + 0x44], bl
mov byte [rsp + 0x4c], bl
mov byte [rsp + 0x45], bl
mov byte [rsp + 0x42], bl
or dword [rsp + 0x48], 0xffffffff
or dword [rsp + 0x60], 0xffffffff
mov byte [rsp + 0x50], bl
mov byte [rsp + 0x40], bl
mov r14b, bl
mov byte [rsp + 0x43], bl
mov byte [rsp + 0x46], bl
mov byte [rsp + 0x41], bl
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
mov rax, qword [r13]
lea r15d, [rbx + 2]
cmp dword [rax - 0x10], ebx
jne 0x1402bdd35
call fcn.1402cb090
test al, al
je 0x1402bdd1f
mov edx, r15d
lea rcx, [0x1402ba51c]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1402bfe19
mov esi, 1
mov byte [rsp + 0x44], sil
mov r12b, sil
mov dword [rsp + 0x48], ebx
jmp 0x1402bf3bf
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.14000c4d8
nop
lea rcx, [rsp + 0x58]
call fcn.14000b994
mov rbx, qword [rsp + 0x58]
mov esi, 1
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._uac
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bddad
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bddad
mov byte [rsp + 0x50], sil
lea r8, [0x140330de8]
lea rdx, str._uac
lea rcx, [rsp + 0x58]
call fcn.14000b658
lea rcx, [rsp + 0x58]
call fcn.14000bbfc
mov rbx, qword [rsp + 0x58]
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._updatesuccess
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bddd7
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x1402bde09
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._updatefailed
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bdfa6
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bdfa6
call fcn.140247150
mov r12b, sil
xor edi, edi
mov r14b, dil
mov dword [rsp + 0x4c], r14d
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x42], dil
mov dword [rsp + 0x48], edi
mov rcx, qword [r13]
cmp dword [rcx - 0x10], edi
jl 0x1402bf38f
lea rdx, [0x14034da64]
call fcn.1400bee84
test rax, rax
je 0x1402bf38f
sub rax, qword [r13]
sar rax, 1
or r14, 0xffffffffffffffff
cmp eax, r14d
jle 0x1402bf38f
lea r8d, [rax + 1]
lea rdx, [rbp - 0x58]
mov rcx, r13
call fcn.14000b630
nop
mov rax, qword [rbp - 0x58]
cmp dword [rax - 0x10], edi
je 0x1402bdf73
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x60]
call fcn.14000c4d8
nop
lea rcx, [rbp - 0x60]
call fcn.14000b994
mov rbx, qword [rbp - 0x60]
cmp dword [rbx - 0x10], edi
jl 0x1402bdec4
lea rdx, [0x14034da68]
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bdec4
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x1402bdec4
mov r12b, dil
jmp 0x1402bdf56
lea rcx, [rbp + 0x40]
call fcn.1402bac4c
nop
mov rdx, qword [rax]
lea rcx, [rbp - 0x20]
call fcn.14000cb18
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402bdefb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x28], 5
lea rax, [0x140330de8]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x58]
mov r8, qword [rbp - 0x20]
lea rdx, [0x14034e618]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movzx r12d, r12b
cmp rax, 0x20
cmovg r12d, edi
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402bdf52
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x60]
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402bdf73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1402bf1c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
mov r14b, byte [rsp + 0x43]
jmp 0x1402bf397
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._auto
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402be03d
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402be03d
mov r12b, sil
mov byte [rsp + 0x45], sil
mov byte [rsp + 0x42], sil
xor r13d, r13d
cmp dword [rbx - 0x10], r13d
jl 0x1402be033
lea rdx, str._shutdown
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402be00a
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402be00a
or dword [rdi + 0x58], esi
jmp 0x1402be033
cmp dword [rbx - 0x10], r13d
jl 0x1402be033
lea rdx, str._restart
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402be033
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402be033
or dword [rdi + 0x58], r15d
mov dword [rsp + 0x48], r13d
jmp 0x1402bf397
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._debug
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402be680
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402be680
xor r12d, r12d
mov edi, r12d
mov rcx, qword [r13]
cmp dword [rcx - 0x10], r12d
jl 0x1402be0e2
lea rdx, [0x14034da64]
call fcn.1400bee84
test rax, rax
je 0x1402be0e2
sub rax, qword [r13]
sar rax, 1
cmp eax, 0xffffffff
jle 0x1402be0e2
lea r8d, [rax + 1]
lea rdx, [rbp + 0xa0]
mov rcx, r13
call fcn.14000b630
mov rbx, qword [rbp + 0xa0]
cmp dword [rbx - 0x10], r12d
je 0x1402be0c6
mov rcx, rbx
call fcn.1400beacc
mov edi, eax
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402be0e2
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rdx, str.v_d._02d._03d
lea rcx, [rbp + 0xb0]
call fcn.14023ec8c
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x12d8]
mov qword [rbp + 0x12d0], rax
mov r13d, 3
mov r8d, r13d
lea rcx, [rbp + 0x12d0]
call fcn.140008c4c
nop
imul edi, edi, 0x3e8
mov edx, edi
mov rcx, qword [rbp + 0x12d0]
call fcn.140243c14
nop
lea rax, [rbp + 0x12d8]
mov rcx, qword [rbp + 0x12d0]
cmp rcx, rax
je 0x1402be14b
call fcn.1400be914
nop
mov rdx, qword [rbp + 0xb0]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402be16d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
lea rdi, str._INFO__
mov ebx, 0x7d0
cmp dword [rax], ebx
ja 0x1402be243
lea rcx, [rbp + 0xc0]
call fcn.14023e21c
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1638]
mov qword [rbp + 0x1630], rax
mov r8d, r13d
lea rcx, [rbp + 0x1630]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x650]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
lea rdx, [0x14034dac8]
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x1630]
call fcn.14000b410
nop
lea rcx, [rbp + 0x650]
call fcn.14000aec4
nop
lea rax, [rbp + 0x1638]
mov rcx, qword [rbp + 0x1630]
cmp rcx, rax
je 0x1402be21a
call fcn.1400be914
nop
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
or r13, 0xffffffffffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1402be247
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1402be247
or r13, 0xffffffffffffffff
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402be309
call fcn.1400046d0
mov r8, qword [rax]
lea rdx, [rbp + 0xd0]
mov rcx, rax
call qword [r8 + 0x18]
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1758]
mov qword [rbp + 0x1750], rax
mov r8d, 3
lea rcx, [rbp + 0x1750]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x460]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x1750]
call fcn.14000b410
nop
lea rcx, [rbp + 0x460]
call fcn.14000aec4
nop
lea rax, [rbp + 0x1758]
mov rcx, qword [rbp + 0x1750]
cmp rcx, rax
je 0x1402be2e6
call fcn.1400be914
nop
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1402be309
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402be3cb
call fcn.1400046d0
mov r8, qword [rax]
lea rdx, [rbp + 0xd8]
mov rcx, rax
call qword [r8 + 0x20]
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1128]
mov qword [rbp + 0x1120], rax
mov r8d, 3
lea rcx, [rbp + 0x1120]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0xa30]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x1120]
call fcn.14000b410
nop
lea rcx, [rbp + 0xa30]
call fcn.14000aec4
nop
lea rax, [rbp + 0x1128]
mov rcx, qword [rbp + 0x1120]
cmp rcx, rax
je 0x1402be3a8
call fcn.1400be914
nop
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1402be3cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402be487
call fcn.1400046d0
mov r8, qword [rax]
lea rdx, [rbp + 0x38]
mov rcx, rax
call qword [r8 + 0x28]
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1488]
mov qword [rbp + 0x1480], rax
mov r8d, 3
lea rcx, [rbp + 0x1480]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x270]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x1480]
call fcn.14000b410
nop
lea rcx, [rbp + 0x270]
call fcn.14000aec4
nop
lea rax, [rbp + 0x1488]
mov rcx, qword [rbp + 0x1480]
cmp rcx, rax
je 0x1402be467
call fcn.1400be914
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1402be487
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402be549
call fcn.1400046d0
mov r8, qword [rax]
lea rdx, [rbp + 0x98]
mov rcx, rax
call qword [r8 + 0x30]
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1248]
mov qword [rbp + 0x1240], rax
mov r8d, 3
lea rcx, [rbp + 0x1240]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0xe10]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x1240]
call fcn.14000b410
nop
lea rcx, [rbp + 0xe10]
call fcn.14000aec4
nop
lea rax, [rbp + 0x1248]
mov rcx, qword [rbp + 0x1240]
cmp rcx, rax
je 0x1402be526
call fcn.1400be914
nop
mov rdx, qword [rbp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1402be549
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402be619
lea rcx, [rbp + 0x48]
call fcn.140239840
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x16c8]
mov qword [rbp + 0x16c0], rax
mov r8d, 3
lea rcx, [rbp + 0x16c0]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x840]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
lea rdx, str.Username:
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x16c0]
call fcn.14000b410
mov rcx, rax
lea rdx, [0x14034dad4]
call fcn.14000b410
nop
lea rcx, [rbp + 0x840]
call fcn.14000aec4
nop
lea rax, [rbp + 0x16c8]
mov rcx, qword [rbp + 0x16c0]
cmp rcx, rax
je 0x1402be5f9
call fcn.1400be914
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1402be619
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402be65f
call fcn.140243bb4
lea rdx, [rbp + 0xc20]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
lea rdx, str.Application_Started
call fcn.14000b410
nop
lea rcx, [rbp + 0xc20]
call fcn.14000aec4
mov r12b, sil
mov byte [rsp + 0x4c], sil
mov byte [rsp + 0x44], sil
xor eax, eax
mov byte [rsp + 0x42], al
mov dword [rsp + 0x48], eax
mov rbx, qword [rsp + 0x58]
jmp 0x1402bf397
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._delete
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402be6cf
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402be6cf
mov r12b, sil
mov byte [rsp + 0x45], sil
mov byte [rsp + 0x42], sil
mov rdx, r13
lea rcx, [rsp + 0x68]
call fcn.14000c244
xor eax, eax
mov dword [rsp + 0x48], eax
jmp 0x1402bf397
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._cleanie
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bed7b
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bed7b
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.14000c4d8
nop
lea r8, [0x140330de8]
lea rdx, str._cleanie
lea rcx, [rsp + 0x70]
call fcn.14000b658
lea rcx, [rsp + 0x70]
call fcn.14000bbfc
mov rcx, rax
call fcn.14000baec
mov rcx, qword [rsp + 0x70]
xor r13d, r13d
cmp dword [rcx - 0x10], r13d
jl 0x1402bed4c
lea rdx, str._log
call fcn.1400bee84
test rax, rax
je 0x1402bed4c
mov rcx, qword [rsp + 0x70]
sub rax, rcx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bed4c
mov edi, r13d
cmp dword [rcx - 0x10], r13d
jl 0x1402be7e5
lea rdx, [0x14034da64]
call fcn.1400bee84
test rax, rax
je 0x1402be7e5
sub rax, qword [rsp + 0x70]
sar rax, 1
cmp eax, 0xffffffff
jle 0x1402be7e5
lea r8d, [rax + 1]
lea rdx, [rbp + 0xc8]
lea rcx, [rsp + 0x70]
call fcn.14000b630
mov rbx, qword [rbp + 0xc8]
cmp dword [rbx - 0x10], r13d
je 0x1402be7c9
mov rcx, rbx
call fcn.1400beacc
mov edi, eax
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402be7e5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rdx, str.v_d._02d._03d
lea rcx, [rbp + 0x58]
call fcn.14023ec8c
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1368]
mov qword [rbp + 0x1360], rax
mov r8d, 3
lea rcx, [rbp + 0x1360]
call fcn.140008c4c
nop
imul edi, edi, 0x3e8
mov edx, edi
mov rcx, qword [rbp + 0x1360]
call fcn.140243c14
nop
lea rax, [rbp + 0x1368]
mov rcx, qword [rbp + 0x1360]
cmp rcx, rax
je 0x1402be848
call fcn.1400be914
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402be867
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
lea rdi, str._INFO__
mov ebx, 0x7d0
cmp dword [rax], ebx
ja 0x1402be939
lea rcx, [rbp + 0xa8]
call fcn.14023e21c
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x15a8]
mov qword [rbp + 0x15a0], rax
mov r8d, 3
lea rcx, [rbp + 0x15a0]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x368]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
lea rdx, [0x14034dac8]
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x15a0]
call fcn.14000b410
nop
lea rcx, [rbp + 0x368]
call fcn.14000aec4
nop
lea rax, [rbp + 0x15a8]
mov rcx, qword [rbp + 0x15a0]
cmp rcx, rax
je 0x1402be917
call fcn.1400be914
nop
mov rdx, qword [rbp + 0xa8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402be939
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402be9f4
call fcn.1400046d0
mov r8, qword [rax]
lea rdx, [rbp + 0x68]
mov rcx, rax
call qword [r8 + 0x18]
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1098]
mov qword [rbp + 0x1090], rax
mov r8d, 3
lea rcx, [rbp + 0x1090]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x558]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x1090]
call fcn.14000b410
nop
lea rcx, [rbp + 0x558]
call fcn.14000aec4
nop
lea rax, [rbp + 0x1098]
mov rcx, qword [rbp + 0x1090]
cmp rcx, rax
je 0x1402be9d5
call fcn.1400be914
nop
mov rdx, qword [rbp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402be9f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402beab5
call fcn.1400046d0
mov r8, qword [rax]
lea rdx, [rbp + 0xf0]
mov rcx, rax
call qword [r8 + 0x20]
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x11b8]
mov qword [rbp + 0x11b0], rax
mov r8d, 3
lea rcx, [rbp + 0x11b0]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x748]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x11b0]
call fcn.14000b410
nop
lea rcx, [rbp + 0x748]
call fcn.14000aec4
nop
lea rax, [rbp + 0x11b8]
mov rcx, qword [rbp + 0x11b0]
cmp rcx, rax
je 0x1402bea93
call fcn.1400be914
nop
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402beab5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402beb70
call fcn.1400046d0
mov r8, qword [rax]
lea rdx, [rbp + 0x78]
mov rcx, rax
call qword [r8 + 0x28]
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1008]
mov qword [rbp + 0x1000], rax
mov r8d, 3
lea rcx, [rbp + 0x1000]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0x938]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x1000]
call fcn.14000b410
nop
lea rcx, [rbp + 0x938]
call fcn.14000aec4
nop
lea rax, [rbp + 0x1008]
mov rcx, qword [rbp + 0x1000]
cmp rcx, rax
je 0x1402beb51
call fcn.1400be914
nop
mov rdx, qword [rbp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402beb70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402bec31
call fcn.1400046d0
mov r8, qword [rax]
lea rdx, [rbp + 0xb8]
mov rcx, rax
call qword [r8 + 0x30]
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x13f8]
mov qword [rbp + 0x13f0], rax
mov r8d, 3
lea rcx, [rbp + 0x13f0]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0xb28]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x13f0]
call fcn.14000b410
nop
lea rcx, [rbp + 0xb28]
call fcn.14000aec4
nop
lea rax, [rbp + 0x13f8]
mov rcx, qword [rbp + 0x13f0]
cmp rcx, rax
je 0x1402bec0f
call fcn.1400be914
nop
mov rdx, qword [rbp + 0xb8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bec31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402bed06
lea rcx, [rbp + 0x88]
call fcn.140239840
nop
mov rdx, qword [rax]
lea rax, [rbp + 0x1518]
mov qword [rbp + 0x1510], rax
mov r8d, 3
lea rcx, [rbp + 0x1510]
call fcn.140008c4c
nop
call fcn.140243bb4
lea rdx, [rbp + 0xd18]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
lea rdx, str.Username:
call fcn.14000b410
mov rcx, rax
mov rdx, qword [rbp + 0x1510]
call fcn.14000b410
mov rcx, rax
lea rdx, [0x14034dad4]
call fcn.14000b410
nop
lea rcx, [rbp + 0xd18]
call fcn.14000aec4
nop
lea rax, [rbp + 0x1518]
mov rcx, qword [rbp + 0x1510]
cmp rcx, rax
je 0x1402bece4
call fcn.1400be914
nop
mov rdx, qword [rbp + 0x88]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bed06
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140243a84
cmp dword [rax], ebx
ja 0x1402bed4c
call fcn.140243bb4
lea rdx, [rbp + 0xf08]
mov rcx, rax
call fcn.14000b014
nop
lea rcx, [rax + 8]
mov rdx, rdi
call fcn.14000b410
mov rcx, rax
lea rdx, str.Application_Started
call fcn.14000b410
nop
lea rcx, [rbp + 0xf08]
call fcn.14000aec4
call fcn.1402bd44c
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402be676
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1402be676
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._cleaner
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bedcd
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bedcd
xor edi, edi
mov r13d, edi
mov dword [rsp + 0x48], edi
mov r14b, dil
mov r12b, sil
mov dword [rsp + 0x4c], r14d
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x42], dil
mov r14d, dword [rsp + 0x60]
jmp 0x1402beec2
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._registry
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bee03
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bee03
xor edi, edi
mov r13d, r15d
mov dword [rsp + 0x48], r15d
jmp 0x1402bedae
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._tools
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bee3d
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bee3d
xor edi, edi
lea r13d, [rdi + 3]
mov dword [rsp + 0x48], r13d
jmp 0x1402bedae
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._options
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bef67
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bef67
mov r12b, sil
xor edi, edi
mov r14b, dil
mov dword [rsp + 0x4c], r14d
mov byte [rsp + 0x44], sil
mov byte [rsp + 0x42], dil
lea r13d, [rdi + 8]
mov dword [rsp + 0x48], r13d
cmp dword [rbx - 0x10], edi
jl 0x1402beeb7
lea rdx, str._monitoring
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402beeb7
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
lea r14d, [rdi + 0x15]
jne 0x1402beebd
mov r14d, 0xe
mov dword [rsp + 0x60], r14d
mov qword [0x140489510], rdi
mov edx, 4
lea rcx, [0x1402ba51c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdi, qword [0x140489510]
xor eax, eax
test rdi, rdi
je 0x1402bf394
call fcn.1402cb090
xor r12d, r12d
mov rcx, rdi
test al, al
je 0x1402bef03
call fcn.1402ba1fc
jmp 0x1402bef33
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41b
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1402bef2a
mov rcx, rdi
call qword [sym.imp.USER32.dll_OpenIcon]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
cmp r14d, 0xffffffff
je 0x1402bef4b
cmp r14d, 0xe
movsxd r8, r14d
jne 0x1402bef4e
movsxd r8, r13d
mov r9, rsi
mov edx, 0x410
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r14b, r12b
jmp 0x1402bf397
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._export
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402beffa
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402beffa
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.14000c4d8
nop
lea rbx, [0x140330de8]
mov r8, rbx
lea rdx, str._export
lea rcx, [rsp + 0x78]
call fcn.14000b658
mov r8, rbx
lea rdx, [0x14034dbb8]
lea rcx, [rsp + 0x78]
call fcn.14000b658
lea rcx, [rsp + 0x78]
call fcn.14000bbfc
mov rcx, rax
call fcn.14000baec
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.1402bad1c
nop
mov rdx, qword [rsp + 0x78]
jmp 0x1402bed57
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, [0x14034da68]
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bf054
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bf054
mov r12b, sil
xor eax, eax
mov r14b, al
mov dword [rsp + 0x4c], r14d
mov byte [rsp + 0x44], al
mov byte [rsp + 0x42], sil
mov dword [rsp + 0x48], 8
mov byte [rsp + 0x40], sil
mov r14b, sil
mov byte [rsp + 0x43], sil
jmp 0x1402bf397
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._clean
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bf07e
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x1402bf0a8
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._analyze
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bf0d1
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bf0d1
mov r12b, sil
mov byte [rsp + 0x45], sil
mov byte [rsp + 0x42], sil
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000c244
mov r14b, sil
mov byte [rsp + 0x43], sil
jmp 0x1402be6c4
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._scanreg
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bf129
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bf129
mov r12b, sil
mov byte [rsp + 0x46], sil
mov byte [rsp + 0x42], sil
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000c244
mov r14b, sil
mov byte [rsp + 0x43], sil
mov dword [rsp + 0x48], r15d
jmp 0x1402bf397
xor eax, eax
cmp dword [rbx - 0x10], eax
jl 0x1402bf1d3
lea rdx, str._createskipuac
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bf1d3
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bf1d3
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x78]
call fcn.14000c4d8
nop
lea rbx, [0x140330de8]
mov r8, rbx
lea rdx, str._createskipuac
lea rcx, [rbp - 0x78]
call fcn.14000b658
mov r8, rbx
lea rdx, [0x14034dbb8]
lea rcx, [rbp - 0x78]
call fcn.14000b658
lea rcx, [rbp - 0x78]
call fcn.14000bbfc
mov rcx, rax
call fcn.14000baec
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x148]
call fcn.14000c4d8
mov rdx, rax
mov rcx, rdi
call fcn.1402bbf3c
nop
mov rdx, qword [rbp - 0x78]
jmp 0x1402bed57
mov r14b, byte [rsp + 0x43]
jmp 0x1402be676
xor edi, edi
cmp dword [rbx - 0x10], edi
jl 0x1402bf381
lea rdx, str._register
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bf315
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bf315
lea rax, vtable.Piriform::Common::CCommandLineParser.0
mov qword [rbp + 0x10], rax
mov rdx, r13
lea rcx, [rbp + 0x18]
call fcn.14000c4d8
nop
lea rdx, str.___nN__aA__mM__eE_______
lea rcx, [rbp - 0x28]
call fcn.14000cb18
nop
lea rdx, str.___kK__eE__yY_______
lea rcx, [rbp - 0x30]
call fcn.14000cb18
nop
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x10]
call fcn.1402c950c
nop
lea r8, [rbp - 0x30]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x10]
call fcn.1402c950c
nop
call fcn.1402a64a8
cmp eax, esi
je 0x1402bf271
cmp eax, r15d
jne 0x1402bf287
call fcn.140004658
mov rcx, rax
lea r8, [rbp - 8]
lea rdx, [rbp - 0x48]
call fcn.14028e970
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1402bf2aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1402bf2c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1402bf2e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1402bf307
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x10]
call fcn.1402c913c
jmp 0x1402be676
cmp dword [rbx - 0x10], edi
jl 0x1402bf381
lea rdx, str._unregister
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bf353
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bf353
call fcn.1402a64a8
cmp eax, esi
je 0x1402bf347
cmp eax, r15d
jne 0x1402bf397
call fcn.140004658
call fcn.14028fa90
jmp 0x1402bf397
cmp dword [rbx - 0x10], edi
jl 0x1402bf381
lea rdx, str._monitor
mov rcx, rbx
call fcn.1400bee84
test rax, rax
je 0x1402bf381
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1402bf381
mov byte [rsp + 0x41], sil
mov r12b, sil
jmp 0x1402bf397
mov r12b, sil
mov byte [rsp + 0x44], sil
mov dword [rsp + 0x48], edi
jmp 0x1402bf397
mov r14b, dil
jmp 0x1402bf397
mov r14b, al
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bf3b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r12b, r12b
je 0x1402bfe19
mov rdi, qword [rbp - 0x80]
mov rbx, qword [rdi + 0x20]
mov rdi, qword [rbx]
mov rcx, rbx
call qword [rdi + 0x38]
mov edx, eax
mov rcx, rbx
call qword [rdi + 0x30]
mov r13, qword [rbp - 0x80]
mov r11, qword [r13 + 0x20]
mov rcx, qword [r11 + 8]
mov rdi, qword [r13 + 0x30]
mov rax, qword [rcx]
lea rdx, [rbp + 0x28]
call qword [rax + 0x250]
nop
mov rbx, qword [rdi]
mov rcx, qword [rax]
call fcn.1400beacc
mov r8d, eax
mov rdx, qword [0x140487620]
mov rcx, rdi
call qword [rbx + 0x48]
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
xor ebx, ebx
test eax, eax
jg 0x1402bf42f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [r13 + 0x20]
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x30]
call qword [rax + 0x290]
mov rcx, qword [rax]
call fcn.1400beacc
cmp eax, esi
sete r13b
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bf471
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.1402bc12c
test al, al
je 0x1402bf637
test r14b, r14b
jne 0x1402bf48c
cmp byte [rsp + 0x40], bl
mov dil, sil
je 0x1402bf48f
mov dil, bl
lea r8, str.Piriform_CCleaner_PreventSecondRegistration
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov qword [rbp + 0x140], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1402bf4da
xor edi, edi
mov r12b, dil
xor edx, edx
lea rcx, str.PiriformRegistration
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x1402bf4ec
mov rcx, rax
call fcn.1402ba1fc
jmp 0x1402bf4ec
call fcn.140004658
mov rcx, rax
mov dl, dil
call fcn.140290090
xor edi, edi
test rbx, rbx
je 0x1402bf4fa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
test r12b, r12b
je 0x1402bf6a8
mov al, byte [rsp + 0x40]
cmp byte [rsp + 0x45], bl
jne 0x1402bf643
cmp byte [rsp + 0x46], bl
jne 0x1402bf643
test al, al
jne 0x1402bf643
test r13b, r13b
je 0x1402bf643
call fcn.140004658
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1402bf637
mov rax, qword [rcx]
call qword [rax + 0x20]
mov dil, byte [rsp + 0x41]
test al, al
je 0x1402bf63d
test dil, dil
jne 0x1402bf63d
mov edx, r15d
lea rcx, [rbp + 0xe0]
call fcn.140246f70
nop
mov rcx, qword [rbp + 0xe0]
test rcx, rcx
je 0x1402bf5f6
mov rax, qword [rcx]
call qword [rax + 0x38]
test al, al
je 0x1402bf5f6
mov rax, qword [0x14048abe8]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
call qword [rax + 0x298]
mov rcx, qword [rax]
call fcn.1400beacc
cmp eax, esi
sete bl
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
xor r15d, r15d
test eax, eax
jg 0x1402bf5cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x1402bf5e7
mov rcx, qword [rbp + 0xe0]
mov rax, qword [rcx]
call qword [rax + 0x18]
test al, al
je 0x1402bf5f9
mov r12b, r15b
jmp 0x1402bf5f9
mov r14b, sil
mov dword [rsp + 0x4c], r14d
mov r14b, byte [rsp + 0x43]
jmp 0x1402bf5f9
xor r15d, r15d
mov rbx, qword [rbp + 0xe8]
test rbx, rbx
je 0x1402bf62f
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x1402bf62f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
or eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
dec eax
jne 0x1402bf62f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov al, byte [rsp + 0x40]
xor ebx, ebx
jmp 0x1402bf648
mov al, byte [rsp + 0x40]
jmp 0x1402bf643
mov al, byte [rsp + 0x40]
jmp 0x1402bf648
mov dil, byte [rsp + 0x41]
test r12b, r12b
je 0x1402bf6ad
test al, al
je 0x1402bf670
call fcn.140004658
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1402bf669
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
jne 0x1402bf670
mov byte [rsp + 0x40], bl
mov r12b, bl
test r12b, r12b
je 0x1402bf6ad
test r14b, r14b
je 0x1402bf6ad
call fcn.140004658
mov edx, 4
mov rcx, rax
call fcn.14028ef60
test al, al
jne 0x1402bf6a3
call fcn.140004658
call fcn.1402902b0
test al, al
jne 0x1402bf6a3
mov r12b, bl
jmp 0x1402bf6ad
mov r12b, sil
jmp 0x1402bf6ad
mov dil, byte [rsp + 0x41]
mov rax, qword [0x14048abe8]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x50]
call qword [rax + 0x300]
mov rcx, qword [rax]
call fcn.1400beacc
cmp eax, esi
sete r15b
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bf6f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x14048abe8]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x60]
call qword [rax + 0x310]
mov rcx, qword [rax]
call fcn.1400beacc
cmp eax, esi
sete r14b
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bf73f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r12b, r12b
je 0x1402bfe19
test dil, dil
je 0x1402bf847
call fcn.140004658
mov edx, 8
mov rcx, rax
call fcn.14028ef60
mov r12b, al
test al, al
je 0x1402bfe19
call fcn.1400045d4
mov rcx, rax
call fcn.1402cb7c8
mov r12b, al
test al, al
je 0x1402bfe19
test r15b, r15b
jne 0x1402bf847
test r14b, r14b
jne 0x1402bf847
lea rdx, [0x14034e614]
lea rcx, [rbp - 0x38]
call fcn.14000cb18
nop
mov rax, qword [0x14048abe8]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x38]
call qword [rax + 0x168]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bf7e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x14034e614]
lea rcx, [rbp - 0x40]
call fcn.14000cb18
nop
mov rax, qword [0x14048abe8]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax + 0x178]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bf832
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, str._MONITOR
lea rdx, str.CCleaner_Monitoring
mov ecx, esi
call fcn.1402e52dc
cmp byte [rsp + 0x40], bl
je 0x1402bf852
call fcn.140247150
mov edi, dword [rsp + 0x4c]
test dil, dil
jne 0x1402bf8ce
call fcn.140004658
mov dl, bl
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1402bf873
mov rax, qword [rcx]
call qword [rax + 0x20]
mov dl, al
neg dl
sbb ebx, ebx
and ebx, 0xfffffff9
mov rax, qword [0x14048abe8]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
call qword [rax + 0x390]
mov qword [rbp + 0x70], rax
lea edx, [rbx + 0xa]
lea rcx, [rbp + 0x70]
call fcn.1402ba2dc
xor ebx, ebx
cmp byte [rsp + 0x45], bl
jne 0x1402bf8ce
cmp byte [rsp + 0x46], bl
jne 0x1402bf8ce
test r13b, r13b
je 0x1402bf8ce
test al, al
je 0x1402bf8ce
cmp byte [rsp + 0x40], bl
jne 0x1402bf8ce
movzx edi, dil
cmp byte [rsp + 0x41], bl
cmove edi, esi
mov dword [rsp + 0x4c], edi
mov dword [rbp - 0x50], 0x12
call fcn.14000475c
mov rcx, rax
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x130]
call fcn.1400678bc
nop
mov r13, qword [rbp - 0x80]
lea rdi, [r13 + 8]
mov rcx, qword [rax]
mov qword [rbp + 0x150], rcx
mov rdx, qword [rax + 8]
mov qword [rax + 8], rbx
mov qword [rax], rbx
mov qword [rdi], rcx
mov rbx, qword [rdi + 8]
mov qword [rdi + 8], rdx
test rbx, rbx
je 0x1402bf93a
lock dec dword [rbx + 8]
jne 0x1402bf93a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1402bf93a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rbx, qword [rbp + 0x138]
test rbx, rbx
je 0x1402bf964
lock dec dword [rbx + 8]
jne 0x1402bf964
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1402bf964
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rcx, qword [rdi]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x10]
test rax, rax
je 0x1402bfe19
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [r13 + 0x18], rax
mov ebx, dword [rsp + 0x48]
cmp ebx, 0xffffffff
je 0x1402bfaaf
mov rdx, rdi
lea rcx, [rbp - 0x18]
call fcn.140005694
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1402bfa88
mov rax, qword [rcx]
mov edx, ebx
call qword [rax + 0xa8]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov ebx, dword [rsp + 0x60]
cmp ebx, 0xffffffff
je 0x1402bfa88
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
lea rdx, [rbp + 0xf8]
call qword [rax + 0xc0]
nop
xor ecx, ecx
cmp qword [rbp + 0xf8], rcx
je 0x1402bfa5d
lea rdx, [rbp + 0xf8]
lea rcx, [rbp]
call fcn.140005694
nop
mov rcx, qword [rbp]
test rcx, rcx
je 0x1402bfa35
mov rax, qword [rcx]
mov edx, ebx
call qword [rax + 0xa8]
mov rcx, qword [rbp]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp]
mov rax, qword [rcx]
call qword [rax + 0x38]
nop
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1402bfa5d
lock dec dword [rbx + 8]
jne 0x1402bfa5d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1402bfa5d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rbx, qword [rbp + 0x100]
test rbx, rbx
je 0x1402bfa88
lock dec dword [rbx + 8]
jne 0x1402bfa88
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1402bfa88
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x1402bfaaf
lock dec dword [rbx + 8]
jne 0x1402bfaaf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1402bfaaf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rax, qword [r13 + 0x20]
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
mov r8d, 0x3c
lea rdx, [rbp + 0x80]
call qword [rax + 0x438]
mov rcx, qword [rax]
call fcn.1400beacc
cmp eax, esi
sete r13b
mov rdx, qword [rbp + 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bfafd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp - 0x80]
mov rax, qword [rax + 0x20]
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
mov r8d, 0x3d
lea rdx, [rbp + 0x90]
call qword [rax + 0x438]
mov rcx, qword [rax]
call fcn.1400beacc
cmp eax, esi
sete bl
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bfb4e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
cmp byte [rsp + 0x45], al
jne 0x1402bfbc1
cmp byte [rsp + 0x46], al
jne 0x1402bfbc1
cmp byte [rsp + 0x40], al
jne 0x1402bfbc1
test r13b, r13b
je 0x1402bfbc1
mov r13b, byte [rsp + 0x41]
test r13b, r13b
je 0x1402bfb75
test bl, bl
je 0x1402bfbc1
mov r8b, bl
mov dl, sil
lea rcx, [rbp + 0x160]
call fcn.1402978a8
nop
xor eax, eax
test r13b, r13b
je 0x1402bfb9f
xor edx, edx
lea rcx, [rbp + 0x160]
call fcn.1402979b8
jmp 0x1402bfbb5
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140004510
nop
lea rcx, [rbp + 0x160]
call fcn.140297758
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov bl, byte [rsp + 0x44]
mov al, bl
neg al
sbb edx, edx
and edx, 5
call qword [r8 + 0x58]
xor r13d, r13d
cmp byte [rsp + 0x50], r13b
je 0x1402bfc35
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov r13, qword [rbp - 0x80]
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rax - 2]
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.USER32.dll_SetWindowPos]
xor r13d, r13d
mov al, byte [rsp + 0x41]
test bl, bl
je 0x1402bfc6a
test al, al
jne 0x1402bfc6a
call fcn.140004658
mov edx, 8
mov rcx, rax
call fcn.14028ef60
test al, al
je 0x1402bfc66
test r15b, r15b
jne 0x1402bfc61
test r14b, r14b
je 0x1402bfc66
call fcn.1402bbb4c
mov al, byte [rsp + 0x41]
mov bl, byte [rsp + 0x45]
mov r15b, byte [rsp + 0x46]
mov r14d, dword [rsp + 0x4c]
mov r13b, byte [rsp + 0x40]
test bl, bl
jne 0x1402bfc98
test r15b, r15b
jne 0x1402bfc98
test r14b, r14b
jne 0x1402bfc98
test r13b, r13b
jne 0x1402bfc98
test al, al
je 0x1402bfe19
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1400057ec
nop
mov rcx, qword [rbp - 0x70]
xor edi, edi
test rcx, rcx
je 0x1402bfdf1
mov rax, qword [rcx]
mov dl, byte [rsp + 0x42]
call qword [rax + 0x28]
test bl, bl
je 0x1402bfd30
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov edx, esi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r11, qword [rsp + 0x68]
cmp dword [r11 - 0x10], edi
je 0x1402bfd30
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov r8d, esi
lea rdx, [rbp + 0x118]
call qword [rax + 0x50]
nop
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x1402bfd06
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x30]
nop
mov rbx, qword [rbp + 0x120]
test rbx, rbx
je 0x1402bfd30
lock dec dword [rbx + 8]
jne 0x1402bfd30
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1402bfd30
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test r15b, r15b
je 0x1402bfda8
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov ebx, 6
mov edx, ebx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r11, qword [rsp + 0x68]
cmp dword [r11 - 0x10], edi
je 0x1402bfda8
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov r8d, ebx
lea rdx, [rbp + 0x108]
call qword [rax + 0x50]
nop
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1402bfd7e
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x30]
nop
mov rbx, qword [rbp + 0x110]
test rbx, rbx
je 0x1402bfda8
lock dec dword [rbx + 8]
jne 0x1402bfda8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1402bfda8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test r14b, r14b
je 0x1402bfdbc
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov edx, 3
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r13b, r13b
je 0x1402bfdd0
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov edx, 4
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x41], dil
je 0x1402bfde6
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov edx, 5
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x38]
nop
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x1402bfe19
lock dec dword [rbx + 8]
jne 0x1402bfe19
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1402bfe19
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bfe39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, r12b
mov rcx, qword [rbp + 0x17e0]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0x1940]
add rsp, 0x18f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret