Function at 0x1401caaf0
Capabilities:
Authenticate hmac
Get installed programs
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x430
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm14
movaps xmmword [rax - 0xd8], xmm15
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rbp + 0x288], rax
mov rsi, rdx
mov r12, rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x18], rdx
mov rcx, rdx
call fcn.1401c7630
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
je 0x1401caba2
movss xmm2, dword [0x140374a68]
mov edx, 1
mov rcx, rsi
call fcn.1400e40c0
mov rdx, rsi
mov rcx, r12
call fcn.1401ce870
xorps xmm10, xmm10
test al, al
je 0x1401cabce
movaps xmm2, xmm10
mov edx, 9
mov rcx, rsi
call fcn.1400e40c0
or qword [rsi + 0x40], 0x10000000
mov r8d, 0xf
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d84b0
nop
xor r8d, r8d
lea rdx, str.Critical
mov rcx, rax
call fcn.1401ff540
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401cac05
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
test bl, bl
je 0x1401cac3c
mov edx, 9
mov rcx, rsi
call fcn.1400d7f50
movss xmm13, dword [0x1403748a8]
test al, al
je 0x1401cac29
movaps xmm2, xmm10
jmp 0x1401cac2d
movaps xmm2, xmm13
mov edx, 0x4d
mov rcx, rsi
call fcn.1400e40c0
jmp 0x1401cac45
movss xmm13, dword [0x1403748a8]
mov rcx, rsi
call fcn.1400d1050
lea rdi, [0x140348ca0]
test al, al
je 0x1401caf90
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
jne 0x1401caf90
mov rcx, rsi
call fcn.1400d88e0
mov r15, rax
movss xmm7, dword [0x140374954]
test rax, rax
je 0x1401caf98
mov rcx, qword [rax]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x1401caf98
lea r13, str.Win64
movsd xmm6, qword [0x140374830]
nop word [rax + rax]
mov qword [rsp + 0x50], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401cacc7
mov qword [rsp + 0x48], rdi
jmp 0x1401cacec
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.1402bd21c
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.140200570
nop
xor r8d, r8d
lea rdx, [0x140347d14]
lea rcx, [rsp + 0x48]
call fcn.1402019e0
test al, al
je 0x1401caf10
xor r8d, r8d
lea rdx, str.CurrentVersionRun_
lea rcx, [rsp + 0x48]
call fcn.1401ffc40
test eax, eax
jle 0x1401caf10
movaps xmm1, xmm6
lea rcx, [rbp + 0x260]
call fcn.1400eacf0
mov r9, rax
mov r8, rsi
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.1401ca3f0
test al, al
jne 0x1401caf78
mov rcx, rsi
call fcn.1401c7c20
test al, al
je 0x1401caf10
mov rcx, rsi
call fcn.1401c7c90
test rax, rax
je 0x1401caf10
mov rcx, qword [rax]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1401caf10
mov edi, dword [rsp + 0x54]
mov r11, qword [rax + 0x20]
cmp edi, dword [r11 + 0xc]
jne 0x1401cadd1
mov rdx, qword [rsp + 0x48]
mov r10, qword [r11]
sub r10, rdx
nop word [rax + rax]
movzx r9d, word [rdx]
movzx r8d, word [rdx + r10]
sub r9d, r8d
jne 0x1401cadc7
add rdx, 2
test r8d, r8d
jne 0x1401cadb0
test r9d, r9d
sete dl
test dl, dl
jne 0x1401cae2c
cmp byte [rax + 0x19], 0
jne 0x1401cae1e
mov rdx, qword [rax + 0x10]
cmp byte [rdx + 0x19], 0
jne 0x1401cadfe
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
jne 0x1401cae1e
nop dword [rax]
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1401cadf0
jmp 0x1401cae1e
mov rdx, qword [rax + 8]
cmp byte [rdx + 0x19], 0
jne 0x1401cae1b
cmp rax, qword [rdx + 0x10]
jne 0x1401cae1b
mov rax, rdx
mov rdx, qword [rdx + 8]
cmp byte [rdx + 0x19], 0
je 0x1401cae08
mov rax, rdx
cmp rax, rcx
je 0x1401caf09
jmp 0x1401cad90
xor r14b, r14b
xor dil, dil
mov eax, dword [r11 + 0x14]
cmp eax, 5
jae 0x1401cae57
mov ecx, dword [r11 + 0x10]
cmp ecx, 0x14
jae 0x1401cae57
cmp eax, 2
jae 0x1401cae52
cmp ecx, 0xa
jb 0x1401caf09
mov dil, 1
jmp 0x1401cae5a
mov r14b, 1
movaps xmm2, xmm7
mov edx, 0x49
mov rcx, rsi
call fcn.1400e40c0
test r14b, r14b
je 0x1401caeed
mov eax, dword [rsi + 0x40]
shr rax, 0xb
and al, 1
lea rdx, str.Win32
cmovne rdx, r13
lea rcx, [rbp - 0x78]
call fcn.1401fd200
nop
mov edx, dword [rbp - 0x6c]
inc edx
lea rcx, [rbp - 0x78]
call fcn.1401ff260
movsxd rcx, dword [rbp - 0x6c]
mov rax, qword [rbp - 0x78]
mov edx, 0x2f
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x6c]
inc edx
lea rcx, [rbp - 0x78]
call fcn.140200570
lea rdx, str.Backdoor.Behavior
lea rcx, [rbp - 0x78]
call fcn.1401fd8b0
lea r8, [rbp - 0x78]
mov edx, 2
mov rcx, rsi
call fcn.1400d9700
nop
cmp dword [rbp - 0x70], 0
jle 0x1401caf09
mov rcx, qword [rbp - 0x78]
call fcn.1402b9c20
jmp 0x1401caf09
test dil, dil
lea rdi, [0x140348ca0]
je 0x1401caf10
movabs rax, 0x2000000000
or qword [rsi + 0x40], rax
jmp 0x1401caf10
lea rdi, [0x140348ca0]
cmp dword [rsp + 0x50], 0
jle 0x1401caf21
mov rcx, qword [rsp + 0x48]
call fcn.1402b9c20
cmp byte [rbx + 0x19], 0
jne 0x1401caf6e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401caf4e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401caf6e
nop dword [rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401caf40
jmp 0x1401caf6e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401caf6b
cmp rbx, qword [rax + 0x10]
jne 0x1401caf6b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401caf58
mov rbx, rax
cmp rbx, qword [r15]
je 0x1401caf98
jmp 0x1401cacb0
cmp dword [rsp + 0x50], 0
jle 0x1401caf89
mov rcx, qword [rsp + 0x48]
call fcn.1402b9c20
xor al, al
jmp 0x1401ce248
movss xmm7, dword [0x140374954]
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401caffc
lea rdx, [rsi + 8]
lea rcx, [rbp - 0x68]
call fcn.1400e32e0
nop
lea rdx, [rsi + 8]
mov rcx, r12
call fcn.1401c9e20
test al, al
je 0x1401cafed
mov edx, dword [rsi + 0x14]
add edx, 0xfffffff8
js 0x1401cafed
lea rcx, [rsi + 8]
call fcn.1401fd730
mov ecx, 0x202e
cmp ax, cx
jne 0x1401cafed
movaps xmm2, xmm7
mov edx, 0x15
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rbp - 0x60], 0
jle 0x1401caffc
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
mov rcx, rsi
call fcn.1400d83e0
movss xmm12, dword [0x1403748b8]
test al, al
je 0x1401cb02d
mov eax, dword [rsi + 0x40]
shr rax, 0x1e
test al, 1
je 0x1401cb02d
movaps xmm2, xmm12
mov edx, 0x46
mov rcx, rsi
call fcn.1400e40c0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x34
movss xmm6, dword [0x140374848]
test al, 1
je 0x1401cb0a6
mov rax, rcx
shr rax, 0x24
test al, 1
jne 0x1401cb0a6
mov rax, rcx
shr rax, 0x1c
test al, 1
jne 0x1401cb0a6
shr rcx, 0x1a
test cl, 1
jne 0x1401cb0a6
mov rcx, qword [r12 + 8]
call fcn.1400f0ad0
test al, al
je 0x1401cb076
movaps xmm2, xmm7
jmp 0x1401cb099
mov rcx, rsi
call fcn.1400d1050
test al, al
je 0x1401cb096
mov rcx, rsi
call fcn.1400d8450
cmp qword [rax + 8], 1
ja 0x1401cb096
movaps xmm2, xmm7
jmp 0x1401cb099
movaps xmm2, xmm6
mov edx, 0x47
mov rcx, rsi
call fcn.1400e40c0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x35
test al, 1
je 0x1401cb108
mov rax, rcx
shr rax, 0x24
test al, 1
jne 0x1401cb108
mov rax, rcx
shr rax, 0x1c
test al, 1
jne 0x1401cb108
shr rcx, 0x1a
test cl, 1
jne 0x1401cb108
mov rcx, qword [r12 + 8]
call fcn.1400f0ad0
test al, al
je 0x1401cb0e7
movaps xmm2, xmm7
jmp 0x1401cb0fb
mov rcx, rsi
call fcn.1400d1050
test al, al
je 0x1401cb0f8
movaps xmm2, xmm7
jmp 0x1401cb0fb
movaps xmm2, xmm6
mov edx, 0x48
mov rcx, rsi
call fcn.1400e40c0
mov eax, dword [rsi + 0x40]
shr rax, 0xd
movabs r15, 0x100000000
movss xmm6, dword [0x140374950]
test al, 1
je 0x1401cb156
movaps xmm2, xmm10
mov edx, 0x2a
mov rcx, rsi
call fcn.1400e40c0
mov rax, qword [rsi + 0x40]
shr rax, 0x23
test al, 1
je 0x1401cb156
movaps xmm2, xmm6
mov edx, 0x3e
mov rcx, rsi
call fcn.1400e40c0
or qword [rsi + 0x40], r15
mov rax, qword [rsi + 0x40]
shr rax, 0x20
test al, 1
jne 0x1401cb290
lea r14, [rsi + 8]
lea rdx, [rbp + 0x10]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1401cb196
cmp word [rbp + 0x3c], 0
jne 0x1401cb188
or qword [rsi + 0x40], r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1401cb290
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1401cb1e3
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x20000
lea r8d, [rax + 2]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1401cb1f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401cb290
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1401cb290
mov rdx, qword [r12 + 8]
mov rcx, r14
call fcn.1401f6410
mov rdi, rax
lea rax, vtable.Core::SharedPtr_class_HitmanPro35::FileSystemBase_.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdi
xor ebx, ebx
mov qword [rbp - 0x48], rbx
test rdi, rdi
je 0x1401cb244
lea ecx, [rbx + 4]
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x1401cb238
mov dword [rax], 0
mov qword [rbp - 0x48], rax
jmp 0x1401cb23e
xor ebx, ebx
mov qword [rbp - 0x48], rbx
mov dword [rbx], 1
test rdi, rdi
je 0x1401cb262
mov rax, qword [rdi]
lea r8, [rsp + 0x68]
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x20]
test al, al
je 0x1401cb262
or qword [rsi + 0x40], r15
test rbx, rbx
je 0x1401cb290
mov eax, dword [rbx]
test eax, eax
jle 0x1401cb271
dec eax
mov dword [rbx], eax
cmp dword [rbx], 0
jne 0x1401cb290
test rdi, rdi
je 0x1401cb288
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, rbx
call fcn.1402177e0
mov rax, qword [rsi + 0x40]
shr rax, 0x20
test al, 1
je 0x1401cb2bc
mov rdx, qword [rsi + 8]
lea rcx, str.Cloaked__s__r_n
call fcn.1402bbf64
movaps xmm2, xmm6
mov edx, 3
mov rcx, rsi
call fcn.1400e40c0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x21
test al, 1
je 0x1401cb2d5
movaps xmm2, xmm6
mov edx, 3
jmp 0x1401cb2eb
shr rcx, 0x18
test cl, 1
je 0x1401cb2f3
movss xmm2, dword [0x140374a50]
mov edx, 4
mov rcx, rsi
call fcn.1400e40c0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cb34e
bt rcx, 8
jb 0x1401cb320
lea rcx, [rsi + 8]
xor r8d, r8d
lea rdx, str..dll
call fcn.1401ff110
test al, al
jne 0x1401cb34e
mov eax, dword [rsi + 0x40]
shr rax, 0x18
test al, 1
je 0x1401cb34e
mov rcx, rsi
call fcn.1400d7e80
comiss xmm12, xmm0
jbe 0x1401cb34e
movss xmm2, dword [0x140374a20]
mov edx, 5
mov rcx, rsi
call fcn.1400e40c0
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cb399
mov edx, 0x400
mov rcx, rsi
call fcn.1401c4080
test al, al
je 0x1401cb399
lea rcx, [rsi + 8]
mov r8d, 1
lea rdx, str..NET
call fcn.1401fefd0
test al, al
je 0x1401cb399
movss xmm2, dword [0x140374a44]
mov edx, 0x28
mov rcx, rsi
call fcn.1400e40c0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cb3c2
shr rcx, 0x2f
test cl, 1
je 0x1401cb3c2
movaps xmm2, xmm10
mov edx, 0x3c
mov rcx, rsi
call fcn.1400e40c0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cb420
bt rcx, 8
jb 0x1401cb420
lea rcx, [rsi + 8]
xor r8d, r8d
lea rdx, str..dll
call fcn.1401ff110
test al, al
je 0x1401cb420
mov rcx, rsi
call fcn.1401c75a0
cmp eax, 1
jne 0x1401cb420
lea edx, [rax + 3]
mov rcx, rsi
call fcn.1401c4080
test al, al
je 0x1401cb420
movss xmm2, dword [0x140374a4c]
mov edx, 0x29
mov rcx, rsi
call fcn.1400e40c0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
movss xmm8, dword [0x1403748e0]
movss xmm6, dword [0x1403748f0]
test al, 1
je 0x1401cb5f0
xor r14b, r14b
shr rcx, 0x1b
test cl, 1
jne 0x1401cb4ea
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x58]
call fcn.1400d44f0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400e32e0
nop
xor r8d, r8d
lea rdx, [0x14034de00]
lea rcx, [rsp + 0x78]
call fcn.1401ff540
test al, al
je 0x1401cb4c8
xor edi, edi
lea rbx, str.8L6_
nop dword [rax]
nop dword [rax + rax]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [rsp + 0x58]
call fcn.1401fefd0
test al, al
jne 0x1401cb4c5
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, 3
jb 0x1401cb4a0
jmp 0x1401cb4c8
mov r14b, 1
cmp dword [rbp - 0x80], 0
jle 0x1401cb4d9
mov rcx, qword [rsp + 0x78]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cb4ea
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
mov r9, qword [rsi + 0x40]
mov rax, r9
shr rax, 0x1b
test al, 1
jne 0x1401cb502
test r14b, r14b
je 0x1401cb5f0
mov r8, qword [rsi + 0x50]
test r8, r8
je 0x1401cb5f0
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cb538
nop
cmp dword [rcx + 0x20], 1
jge 0x1401cb52c
mov rcx, qword [rcx + 0x10]
jmp 0x1401cb532
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cb520
cmp rdx, rax
je 0x1401cb548
cmp dword [rdx + 0x20], 1
mov qword [rsp + 0x68], rdx
jle 0x1401cb54d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cb565
cmp qword [rax + 0x28], 0
jne 0x1401cb5f0
test r8, r8
je 0x1401cb5f0
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cb598
nop
cmp dword [rcx + 0x20], 0xe
jge 0x1401cb58c
mov rcx, qword [rcx + 0x10]
jmp 0x1401cb592
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cb580
cmp rdx, rax
je 0x1401cb5a8
cmp dword [rdx + 0x20], 0xe
mov qword [rsp + 0x68], rdx
jle 0x1401cb5ad
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cb5f0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401cb5f0
movss xmm0, dword [rcx]
comiss xmm0, xmm8
jbe 0x1401cb5f0
movaps xmm2, xmm6
test r14b, r14b
jne 0x1401cb5df
shr r9, 0x1a
test r9b, 1
je 0x1401cb5e3
movaps xmm2, xmm10
mov edx, 0x3f
mov rcx, rsi
call fcn.1400e40c0
mov eax, dword [rsi + 0x40]
shr rax, 9
movss xmm11, dword [0x1403747f0]
movss xmm7, dword [0x14037492c]
mov rcx, rsi
test al, 1
je 0x1401cb698
mov r8d, 9
lea rdx, [rsp + 0x58]
call fcn.1400d84b0
nop
xor r8d, r8d
lea rdx, str.Boot
lea rcx, [rsp + 0x58]
call fcn.1401ff540
test al, al
jne 0x1401cb66c
xor r8d, r8d
lea rdx, str.System
lea rcx, [rsp + 0x58]
call fcn.1401ff540
test al, al
jne 0x1401cb66c
xor r8d, r8d
lea rdx, str.AutoLoad
lea rcx, [rsp + 0x58]
call fcn.1401ff540
test al, al
je 0x1401cb67e
movaps xmm2, xmm11
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cb73b
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
jmp 0x1401cb73b
call fcn.1400d1050
test al, al
je 0x1401cb70c
movaps xmm6, xmm11
movsxd rax, dword [r12 + 0x1f4]
cmp dword [rsi + 0x14], eax
jl 0x1401cb6f2
mov r8, rax
mov rdx, qword [r12 + 0x1e8]
mov rcx, qword [rsi + 8]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401cb6f2
movaps xmm6, xmm12
mov eax, dword [rsi + 0x40]
shr rax, 0xa
test al, 1
je 0x1401cb6e1
movaps xmm6, xmm7
lea rcx, [rsi + 8]
call fcn.1401c7410
test al, al
jne 0x1401cb6f2
addss xmm6, xmm7
movaps xmm2, xmm6
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e40c0
movss xmm6, dword [0x1403748f0]
jmp 0x1401cb73b
lea rdx, [rsi + 8]
mov rcx, qword [r12 + 8]
call fcn.1400faa70
test al, al
je 0x1401cb73b
lea rdx, [rsi + 8]
mov rcx, rsi
call fcn.1400ec540
movaps xmm2, xmm11
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e40c0
lea r13, [rsi + 8]
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d2ff0
nop
mov rdi, qword [r12 + 0x100]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401cb784
nop
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x20]
call fcn.1402b9aac
test eax, eax
jns 0x1401cb778
mov rbx, qword [rbx + 0x10]
jmp 0x1401cb77e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401cb760
cmp rdi, qword [r12 + 0x100]
je 0x1401cb7a7
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.1402b9aac
test eax, eax
js 0x1401cb7a7
mov qword [rsp + 0x68], rdi
jmp 0x1401cb7b4
mov rax, qword [r12 + 0x100]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r12 + 0x100]
jne 0x1401cb7f2
movsxd rax, dword [r12 + 0x224]
cmp dword [rsp + 0x64], eax
jl 0x1401cb804
mov r8, rax
mov rdx, qword [r12 + 0x218]
mov rcx, qword [rsp + 0x58]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401cb804
movaps xmm2, xmm11
mov edx, 7
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cb815
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
mov rax, qword [r12 + 0x110]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401cb8bb
movsxd rax, dword [rbx + 0x2c]
cmp dword [r13 + 0xc], eax
jl 0x1401cb84c
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
jne 0x1401cb8ab
cmp byte [rbx + 0x19], 0
jne 0x1401cb89e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cb87e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cb89e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cb870
jmp 0x1401cb89e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cb89b
cmp rbx, qword [rax + 0x10]
jne 0x1401cb89b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cb888
mov rbx, rax
cmp rbx, qword [r12 + 0x110]
jmp 0x1401cb823
movaps xmm2, xmm6
mov edx, 8
mov rcx, rsi
call fcn.1400e40c0
mov rax, qword [rsi + 0x40]
shr rax, 0x2c
test al, 1
je 0x1401cb8ed
mov edx, 7
mov rcx, rsi
call fcn.1400d7f50
test al, al
jne 0x1401cb8ed
movss xmm2, dword [0x1403748ac]
mov edx, 0x3b
mov rcx, rsi
call fcn.1400e40c0
movsxd rax, dword [r12 + 0x194]
cmp dword [r13 + 0xc], eax
jl 0x1401cb9e5
mov r8, rax
mov rdx, qword [r12 + 0x188]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401cb9e5
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d44f0
nop
mov rax, qword [r12 + 0x120]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401cb9d4
movsxd rax, dword [rbx + 0x2c]
cmp dword [rsp + 0x64], eax
jl 0x1401cb966
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.1402bba28
test eax, eax
sete al
test al, al
jne 0x1401cb9c3
cmp byte [rbx + 0x19], 0
jne 0x1401cb9b6
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cb990
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cb9b6
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cb982
jmp 0x1401cb9b6
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cb9b3
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401cb9b3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cb9a0
mov rbx, rax
cmp rbx, qword [r12 + 0x120]
jmp 0x1401cb93c
movaps xmm2, xmm7
mov edx, 6
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cb9e5
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
mov r8, qword [rsi + 0x50]
movss xmm6, dword [0x1403748fc]
test r8, r8
je 0x1401cbb95
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cba28
nop word [rax + rax]
cmp dword [rcx + 0x20], 2
jge 0x1401cba1c
mov rcx, qword [rcx + 0x10]
jmp 0x1401cba22
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cba10
cmp rdx, rax
je 0x1401cba38
cmp dword [rdx + 0x20], 2
mov qword [rsp + 0x68], rdx
jle 0x1401cba3d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cbb95
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401cbb95
cmp qword [rcx + 8], 0
seta al
test al, al
je 0x1401cbb95
movabs rax, 0x8000000000000000
test qword [rsi + 0x40], rax
je 0x1401cbb95
mov rdx, r13
mov rcx, r12
call fcn.1401c9e20
test al, al
je 0x1401cbb95
mov r8, qword [rsi + 0x50]
test r8, r8
jne 0x1401cba9f
xor ebx, ebx
jmp 0x1401cbaf2
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cbac8
nop
cmp dword [rcx + 0x20], 2
jge 0x1401cbabc
mov rcx, qword [rcx + 0x10]
jmp 0x1401cbac2
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cbab0
cmp rdx, rax
je 0x1401cbad8
cmp dword [rdx + 0x20], 2
mov qword [rsp + 0x68], rdx
jle 0x1401cbadd
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
jne 0x1401cbaee
xor ebx, ebx
jmp 0x1401cbaf2
mov rbx, qword [rax + 0x28]
mov rbx, qword [rbx]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d8450
cmp rbx, qword [rax]
je 0x1401cbb95
nop dword [rax]
mov rdx, qword [rbx + 0x20]
shr rdx, 0x20
mov rcx, qword [r12 + 8]
call fcn.1400fd450
test rax, rax
je 0x1401cbb85
cmp byte [rbx + 0x19], 0
jne 0x1401cbb76
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cbb51
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cbb76
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cbb43
jmp 0x1401cbb76
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cbb73
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401cbb73
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cbb60
mov rbx, rax
mov rcx, rsi
call fcn.1400d8450
cmp rbx, qword [rax]
jne 0x1401cbb10
jmp 0x1401cbb95
movaps xmm2, xmm6
mov edx, 0xa
mov rcx, rsi
call fcn.1400e40c0
mov r8, qword [rsi + 0x50]
movss xmm15, dword [0x140374a28]
movss xmm9, dword [0x140374888]
test r8, r8
je 0x1401cbc77
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cbbdc
cmp dword [rcx + 0x20], 3
jge 0x1401cbbd0
mov rcx, qword [rcx + 0x10]
jmp 0x1401cbbd6
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cbbc4
cmp rdx, rax
je 0x1401cbbec
cmp dword [rdx + 0x20], 3
mov qword [rsp + 0x68], rdx
jle 0x1401cbbf1
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cbc13
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401cbc13
cmp qword [rcx + 8], 0
seta al
test al, al
jne 0x1401cbc87
test r8, r8
je 0x1401cbc77
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401cbc40
cmp dword [rcx + 0x20], 4
jge 0x1401cbc34
mov rcx, qword [rcx + 0x10]
jmp 0x1401cbc3a
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401cbc28
cmp rdx, rax
je 0x1401cbc50
cmp dword [rdx + 0x20], 4
mov qword [rsp + 0x68], rdx
jle 0x1401cbc55
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401cbc77
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401cbc77
cmp qword [rcx + 8], 0
seta al
test al, al
jne 0x1401cbc87
mov rcx, rsi
call fcn.1400d83e0
test al, al
je 0x1401cbe0f
movaps xmm2, xmm11
mov edx, 0xb
mov rcx, rsi
call fcn.1400e40c0
movsxd rax, dword [r12 + 0x1a4]
cmp dword [r13 + 0xc], eax
jl 0x1401cbcc3
mov r8, rax
mov rdx, qword [r12 + 0x198]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
jne 0x1401cbcee
movsxd rax, dword [r12 + 0x1b4]
cmp dword [r13 + 0xc], eax
jl 0x1401cbcff
mov r8, rax
mov rdx, qword [r12 + 0x1a8]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401cbcff
movaps xmm2, xmm11
mov edx, 0xc
mov rcx, rsi
call fcn.1400e40c0
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 9
test al, 1
jne 0x1401cbd96
bt rcx, 8
jb 0x1401cbd2f
xor r8d, r8d
lea rdx, str..dll
mov rcx, r13
call fcn.1401ff110
test al, al
jne 0x1401cbd96
mov rcx, rsi
call fcn.1401c7cf0
mov rcx, rsi
cmp eax, 0xfa0
jb 0x1401cbd4c
movaps xmm2, xmm15
mov edx, 0xd
jmp 0x1401cbd91
mov rdx, qword [r12 + 8]
call fcn.1400d9a60
test eax, eax
jg 0x1401cbd96
mov rdx, qword [r12 + 8]
mov rcx, rsi
call fcn.1400d9d40
test eax, eax
jle 0x1401cbd7a
movss xmm2, dword [0x140374a24]
mov edx, 0xe
jmp 0x1401cbd8e
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
jne 0x1401cbd96
movaps xmm2, xmm9
mov edx, 0xf
mov rcx, rsi
call fcn.1400e40c0
mov rcx, rsi
call fcn.1401c7720
test al, al
je 0x1401cbde0
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cbdcf
mov edx, 4
mov rcx, rsi
call fcn.1400d8600
test al, al
je 0x1401cbdcf
mov edx, 2
mov rcx, rsi
call fcn.1400d8600
test al, al
jne 0x1401cbde0
movaps xmm2, xmm9
mov edx, 0x10
mov rcx, rsi
call fcn.1400e40c0
mov rcx, rsi
call fcn.1401c7890
test al, al
je 0x1401cbe0f
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
je 0x1401cbdfe
movaps xmm2, xmm10
jmp 0x1401cbe02
movaps xmm2, xmm9
mov edx, 0x11
mov rcx, rsi
call fcn.1400e40c0
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cbf08
mov rdx, r13
lea rcx, [rsp + 0x78]
call fcn.1400d44f0
nop
mov rdi, qword [r12 + 0x130]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401cbe64
nop
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbx + 0x20]
call fcn.1402b9aac
test eax, eax
jns 0x1401cbe58
mov rbx, qword [rbx + 0x10]
jmp 0x1401cbe5e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401cbe40
cmp rdi, qword [r12 + 0x130]
je 0x1401cbe87
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.1402b9aac
test eax, eax
js 0x1401cbe87
mov qword [rsp + 0x68], rdi
jmp 0x1401cbe94
mov rax, qword [r12 + 0x130]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x68]
mov rbx, qword [rbx]
cmp rbx, qword [r12 + 0x130]
je 0x1401cbef8
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d2ff0
nop
mov eax, dword [rsp + 0x64]
cmp dword [rbx + 0x3c], eax
jne 0x1401cbed4
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x30]
call fcn.1402b9aac
test eax, eax
sete al
test al, al
jne 0x1401cbee6
movaps xmm2, xmm12
mov edx, 0x12
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cbef8
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
nop
cmp dword [rbp - 0x80], 0
jle 0x1401cbf08
mov rcx, qword [rsp + 0x78]
call fcn.1402b9c20
mov eax, dword [rsi + 0x40]
shr rax, 0x15
lea r15, vtable.Core::Array_class_Core::String_.0
movss xmm14, dword [0x1403748f8]
movss xmm10, dword [0x140374798]
test al, 1
je 0x1401cc5eb
mov rdx, r13
lea rcx, [rbp - 0x10]
call fcn.1400e32e0
nop
mov rdi, qword [r12 + 0xf0]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401cbf73
nop
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbx + 0x20]
call fcn.1402b9aac
test eax, eax
jns 0x1401cbf67
mov rbx, qword [rbx + 0x10]
jmp 0x1401cbf6d
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401cbf50
cmp rdi, qword [r12 + 0xf0]
je 0x1401cbf95
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rbp - 0x10]
call fcn.1402b9aac
test eax, eax
js 0x1401cbf95
mov qword [rsp + 0x68], rdi
jmp 0x1401cbfa2
mov rax, qword [r12 + 0xf0]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r12 + 0xf0]
je 0x1401cbfc9
movss xmm2, dword [0x1403748ac]
mov edx, 0x15
mov rcx, rsi
call fcn.1400e40c0
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d44f0
nop
mov qword [rbp - 0x58], r15
xor ebx, ebx
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x48], rbx
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140347c20]
lea rcx, [rsp + 0x58]
call fcn.140200db0
cmp dword [rbp - 0x50], 2
jg 0x1401cc106
mov rdx, r13
mov rcx, r12
call fcn.1401c9e20
test al, al
jne 0x1401cc106
mov qword [rbp + 0x260], r15
mov dword [rbp + 0x268], ebx
mov qword [rbp + 0x270], rbx
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
nop
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140347f58]
lea rcx, [rsp + 0x58]
call fcn.140200db0
test eax, eax
jle 0x1401cc0b6
mov edi, dword [rbp + 0x268]
test edi, edi
jle 0x1401cc0b6
mov r14, qword [rbp + 0x270]
nop dword [rax]
nop word [rax + rax]
movsxd rcx, ebx
shl rcx, 4
add rcx, r14
mov r8d, 1
lea rdx, str.plug
call fcn.1401ff540
test al, al
jne 0x1401cc0ef
inc ebx
cmp ebx, edi
jl 0x1401cc090
mov eax, dword [rsi + 0x40]
shr rax, 9
test al, 1
je 0x1401cc0cb
movss xmm2, dword [0x140374954]
jmp 0x1401cc0e1
mov rcx, rsi
call fcn.1400d1050
test al, al
je 0x1401cc0dd
movaps xmm2, xmm14
jmp 0x1401cc0e1
movaps xmm2, xmm9
mov edx, 0x14
mov rcx, rsi
call fcn.1400e40c0
nop
mov qword [rbp + 0x260], r15
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
xor ebx, ebx
mov eax, dword [rsi + 0x40]
shr rax, 0xa
test al, 1
je 0x1401cc122
movaps xmm2, xmm13
mov edx, 0x13
mov rcx, rsi
call fcn.1400e40c0
mov r8d, 2
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400d84b0
nop
cmp dword [rbp - 0x7c], 0
jle 0x1401cc174
lea rdx, [rsp + 0x78]
mov rcx, qword [r12 + 8]
call fcn.1400fbd30
test al, al
je 0x1401cc156
mov edx, 0x16
jmp 0x1401cc169
lea rcx, [rsp + 0x78]
call fcn.1401ce9c0
test al, al
je 0x1401cc174
mov edx, 0x1c
movaps xmm2, xmm6
mov rcx, rsi
call fcn.1400e40c0
xor r12b, r12b
movdqa xmm0, xmmword [0x140374a80]
movdqu xmmword [rbp + 0x260], xmm0
lea rdi, [rbp + 0x260]
nop
mov r8d, dword [rdi]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d84b0
nop
xor r8d, r8d
lea rdx, str.TODO:
mov rcx, rax
call fcn.1401fefd0
movzx r14d, al
cmp dword [rbp - 0x60], 0
jle 0x1401cc1c5
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
test r14b, r14b
jne 0x1401cc1db
inc ebx
add rdi, 4
movsxd rax, ebx
cmp rax, 4
jb 0x1401cc190
jmp 0x1401cc1de
mov r12b, 1
mov r8d, 3
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.1400d84b0
nop
cmp dword [rbp - 0x6c], 0
jle 0x1401cc23c
mov r8d, 1
lea rdx, str.TODO:
lea rcx, [rbp - 0x78]
call fcn.1402019e0
test al, al
jne 0x1401cc22b
mov r8d, 1
lea rdx, str.aaaaa
lea rcx, [rbp - 0x78]
call fcn.1402019e0
test al, al
je 0x1401cc23c
movaps xmm2, xmm11
mov edx, 0x17
mov rcx, rsi
call fcn.1400e40c0
xor r15b, r15b
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1400d84b0
nop
cmp dword [rsp + 0x54], 0
je 0x1401cc404
mov r8d, 1
lea rdx, str.0.0.0.0
lea rcx, [rsp + 0x48]
call fcn.1401ff540
lea r14, vtable.Core::Array_class_Core::String_.0
test al, al
jne 0x1401cc40b
mov qword [rbp + 0x260], r14
mov dword [rbp + 0x268], 0
mov qword [rbp + 0x270], 0
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
nop
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140347c20]
lea rcx, [rsp + 0x48]
call fcn.140200db0
cmp eax, 2
jge 0x1401cc3ae
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140353a8c]
lea rcx, [rsp + 0x48]
call fcn.140200db0
cmp eax, 2
jl 0x1401cc3ab
mov rdi, qword [0x14041a158]
test rdi, rdi
jne 0x1401cc311
xor ebx, ebx
jmp 0x1401cc34a
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401cc315
test ebx, ebx
jle 0x1401cc34a
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x48]
call fcn.1402bd21c
jmp 0x1401cc351
cmp dword [rsp + 0x54], 0
jle 0x1401cc35d
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140200570
mov eax, dword [rbp + 0x268]
test eax, eax
jle 0x1401cc3ae
xor ebx, ebx
mov rdi, qword [rbp + 0x270]
mov r14d, eax
test rbx, rbx
jle 0x1401cc389
lea rdx, [0x140347c20]
lea rcx, [rsp + 0x48]
call fcn.1401fd8b0
mov rdx, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.1401fd8b0
inc rbx
add rdi, 0x10
dec r14
jne 0x1401cc373
lea r14, vtable.Core::Array_class_Core::String_.0
jmp 0x1401cc3ae
mov r15b, 1
mov qword [rbp + 0x260], r14
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7e30
test r15b, r15b
jne 0x1401cc40b
cmp dword [rbp - 0x6c], 0
jle 0x1401cc427
xor edi, edi
lea rbx, str.virus
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [rbp - 0x78]
call fcn.1401fefd0
test al, al
jne 0x1401cc427
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, 5
jb 0x1401cc3e0
jmp 0x1401cc427
lea r14, vtable.Core::Array_class_Core::String_.0
movss xmm13, dword [0x140374848]
movaps xmm2, xmm13
mov edx, 0x18
mov rcx, rsi
call fcn.1400e40c0
jmp 0x1401cc430
movss xmm13, dword [0x140374848]
cmp dword [rbp - 0x7c], 3
jl 0x1401cc47d
lea rcx, [rsp + 0x78]
call fcn.1401c9ee0
test al, al
jne 0x1401cc47d
mov r8d, 1
lea rdx, str.TODO:
lea rcx, [rsp + 0x78]
call fcn.1402019e0
test al, al
jne 0x1401cc47d
test r12b, r12b
jne 0x1401cc4be
mov r8d, 1
lea rdx, str.Microsoft_Corporation
lea rcx, [rsp + 0x78]
call fcn.1401ff540
jmp 0x1401cc4be
mov r8d, 5
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d84b0
cmp dword [rax + 0xc], 5
jle 0x1401cc49b
movaps xmm6, xmm10
jmp 0x1401cc49f
movaps xmm6, xmm13
cmp dword [rbp - 0x60], 0
jle 0x1401cc4ae
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
movaps xmm2, xmm6
mov edx, 0x1a
mov rcx, rsi
call fcn.1400e40c0
mov rcx, rsi
call fcn.1401c7510
mov ebx, eax
test eax, eax
je 0x1401cc51d
cmp eax, 1
jne 0x1401cc4df
mov edx, eax
mov rcx, rsi
call fcn.1401c7490
test al, al
jne 0x1401cc51d
movd xmm6, ebx
cvtdq2ps xmm6, xmm6
mov edx, 8
mov rcx, rsi
call fcn.1401c7490
test al, al
jne 0x1401cc508
mov edx, 0x100
mov rcx, rsi
call fcn.1401c7490
test al, al
je 0x1401cc50d
mulss xmm6, xmm11
movaps xmm2, xmm6
mov edx, 0x1d
mov rcx, rsi
call fcn.1400e40c0
mov edx, 0x200
mov rcx, rsi
call fcn.1401c7490
test al, al
je 0x1401cc53e
movaps xmm2, xmm7
mov edx, 0x43
mov rcx, rsi
call fcn.1400e40c0
mov edx, 0x400
mov rcx, rsi
call fcn.1401c7490
test al, al
je 0x1401cc560
movaps xmm2, xmm13
mov edx, 0x44
mov rcx, rsi
call fcn.1400e40c0
mov edx, 0x800
mov rcx, rsi
call fcn.1401c7490
test al, al
je 0x1401cc583
movaps xmm2, xmm13
mov edx, 0x45
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x50], 0
jle 0x1401cc595
mov rcx, qword [rsp + 0x48]
call fcn.1402b9c20
nop
cmp dword [rbp - 0x70], 0
jle 0x1401cc5a5
mov rcx, qword [rbp - 0x78]
call fcn.1402b9c20
nop
cmp dword [rbp - 0x80], 0
jle 0x1401cc5b6
mov rcx, qword [rsp + 0x78]
call fcn.1402b9c20
nop
mov qword [rbp - 0x58], r14
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cc5d8
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
nop
cmp dword [rbp - 8], 0
jle 0x1401cc5e7
mov rcx, qword [rbp - 0x10]
call fcn.1402b9c20
mov r12, qword [rbp - 0x30]
call fcn.140114e00
lea r14, [rsi + 0x20]
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
movsd xmm13, qword [0x140374988]
divsd xmm0, xmm13
cvtpd2ps xmm0, xmm0
xorps xmm6, xmm6
comiss xmm6, xmm0
jbe 0x1401cc632
movaps xmm2, xmm9
jmp 0x1401cc6cf
call fcn.140114e00
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
comiss xmm12, xmm1
jbe 0x1401cc667
movaps xmm2, xmm11
jmp 0x1401cc6cf
call fcn.140114e00
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
comiss xmm7, xmm1
ja 0x1401cc6cb
call fcn.140114e00
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x140374954]
comiss xmm0, xmm1
jbe 0x1401cc6dc
movaps xmm2, xmm10
mov edx, 0x1e
mov rcx, rsi
call fcn.1400e40c0
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cc813
mov rcx, rsi
call fcn.1400d7e80
movss xmm7, dword [0x1403748a8]
comiss xmm7, xmm0
ja 0x1401cc81b
mov rcx, rsi
call fcn.1400d7e80
mov rcx, rsi
comiss xmm12, xmm0
jbe 0x1401cc742
call fcn.1401c7510
movss xmm8, dword [0x140374848]
cmp eax, 2
jl 0x1401cc824
movaps xmm2, xmm8
mov edx, 0x20
mov rcx, rsi
call fcn.1400e40c0
jmp 0x1401cc824
call fcn.1400d7e80
comiss xmm8, xmm0
jbe 0x1401cc7a3
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401cc77c
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401cc77c
movaps xmm6, xmm10
cmp dword [rsi + 0x38], 0x400000
jb 0x1401cc78c
addss xmm6, xmm11
jmp 0x1401cc791
addss xmm6, xmm9
movaps xmm2, xmm6
mov edx, 0x20
mov rcx, rsi
call fcn.1400e40c0
jmp 0x1401cc81b
mov rcx, rsi
call fcn.1400d7e80
comiss xmm0, xmm8
jb 0x1401cc81b
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401cc7e0
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401cc7e0
movaps xmm6, xmm11
movss xmm8, dword [0x140374848]
cmp dword [rsi + 0x38], 0x400000
jb 0x1401cc7f9
addss xmm6, xmm8
jmp 0x1401cc801
addss xmm6, dword [0x1403748f0]
movaps xmm2, xmm6
mov edx, 0x20
mov rcx, rsi
call fcn.1400e40c0
jmp 0x1401cc824
movss xmm7, dword [0x1403748a8]
movss xmm8, dword [0x140374848]
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401cc9f6
mov edx, 6
mov rcx, rsi
call fcn.1400d8600
test al, al
je 0x1401cc8cb
mov r8d, 6
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1400d84b0
nop
cmp dword [rsp + 0x64], 0
je 0x1401cc8ba
mov rbx, qword [rsp + 0x58]
mov r8d, 0xa
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.1402bd028
mov rdx, qword [rsp + 0x68]
sub rdx, rbx
sar rdx, 1
movsxd rcx, dword [rsp + 0x64]
cmp rdx, rcx
jne 0x1401cc8ba
lea ecx, [rax + 0x7fffffff]
cmp ecx, 0xfffffffd
ja 0x1401cc8ba
dec eax
cmp eax, 0x2fe
ja 0x1401cc8ba
movss xmm2, dword [0x140374954]
mov edx, 0x25
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cc8cb
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x10
test al, 1
je 0x1401cc993
shr rcx, 0x26
test cl, 1
je 0x1401cc8fc
movss xmm2, dword [0x140374998]
mov edx, 0x21
mov rcx, rsi
call fcn.1400e40c0
movss xmm2, dword [0x140374950]
mov edx, 0x24
mov rcx, rsi
call fcn.1400e40c0
xor r15d, r15d
mov qword [rbp - 0x80], r15
lea edx, [r15 + 0x16]
lea rcx, [rsp + 0x78]
call fcn.1401ff260
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
lea r9d, [r15 + 0x16]
lea r8, str.Labels_EwsAuthenticode
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
lea edx, [r15 + 0x16]
lea rcx, [rsp + 0x78]
call fcn.140200570
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.1400f57b0
nop
cmp dword [rbp - 0x80], r15d
jle 0x1401cc972
mov rcx, qword [rsp + 0x78]
call fcn.1402b9c20
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.140169670
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cc9f9
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
jmp 0x1401cc9f9
mov rax, rcx
shr rax, 0x1a
test al, 1
je 0x1401cc9f6
mov rax, rcx
shr rax, 0x26
test al, 1
je 0x1401cc9bb
movss xmm2, dword [0x140374998]
mov edx, 0x21
mov rcx, rsi
jmp 0x1401cc9f1
shr rcx, 0x11
test cl, 1
mov rcx, rsi
je 0x1401cc9e4
call fcn.1400d1050
test al, al
je 0x1401cc9d6
movaps xmm2, xmm12
jmp 0x1401cc9da
movaps xmm2, xmm8
mov edx, 0x26
mov rcx, rsi
jmp 0x1401cc9f1
movss xmm2, dword [0x140374a3c]
mov edx, 0x22
call fcn.1400e40c0
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401cca57
shr rcx, 0x1a
test cl, 1
je 0x1401cca57
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e32e0
nop
xor r8d, r8d
lea rdx, str..cpl
mov rcx, rax
call fcn.1401ff540
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401cca42
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
test bl, bl
je 0x1401cca57
movaps xmm2, xmm8
mov edx, 0x23
mov rcx, rsi
call fcn.1400e40c0
mov rcx, rsi
call fcn.1400d1050
mov edi, 0x5c
test al, al
je 0x1401ccfc4
mov rcx, rsi
call fcn.1400d88e0
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d88e0
cmp rbx, qword [rax]
je 0x1401cceb1
movss xmm15, dword [0x140374954]
mov r14d, edi
nop word [rax + rax]
mov qword [rsp + 0x50], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401ccabe
lea rax, [0x140348ca0]
mov qword [rsp + 0x48], rax
jmp 0x1401ccae3
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.1402bd21c
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.140200570
nop
mov r8d, 1
lea rdx, [0x140347d14]
lea rcx, [rsp + 0x48]
call fcn.1402019e0
test al, al
je 0x1401ccdf3
mov edx, r14d
mov rcx, qword [rsp + 0x48]
call fcn.1402bcdb4
mov rdi, rax
test rax, rax
je 0x1401ccdbf
sub rdi, qword [rsp + 0x48]
sar rdi, 1
test edi, edi
jle 0x1401ccdbf
mov r8d, 1
lea rdx, [0x140347f70]
lea rcx, [rsp + 0x48]
call fcn.1402019e0
test al, al
je 0x1401ccb67
lea r8d, [rdi + 1]
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.1401ff870
mov edi, eax
test edi, edi
jle 0x1401ccdbf
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.1402011d0
nop
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x78]
call fcn.1402019e0
test al, al
jne 0x1401ccd5b
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun
lea rcx, [rsp + 0x78]
call fcn.1402019e0
test al, al
jne 0x1401ccd5b
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
lea rcx, [rsp + 0x78]
call fcn.1402019e0
lea rcx, [rsp + 0x78]
test al, al
je 0x1401cccc1
mov r8d, 0x36
lea rdx, [rsp + 0x58]
call fcn.1402011d0
nop
xor r8d, r8d
lea rdx, str.Notify_
lea rcx, [rsp + 0x58]
call fcn.1402019e0
test al, al
je 0x1401ccc20
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401ccc16
movaps xmm2, xmm11
jmp 0x1401ccc19
movaps xmm2, xmm7
mov edx, 0x2d
jmp 0x1401ccc9e
xor r8d, r8d
lea rdx, str.Shell
lea rcx, [rsp + 0x58]
call fcn.1401ff540
test al, al
jne 0x1401ccc68
xor r8d, r8d
lea rdx, str.UserInit
lea rcx, [rsp + 0x58]
call fcn.1401ff540
test al, al
jne 0x1401ccc68
xor r8d, r8d
lea rdx, str.System
lea rcx, [rsp + 0x58]
call fcn.1401ff540
test al, al
je 0x1401ccca7
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x30
test al, 1
je 0x1401ccc86
shr rcx, 0x15
test cl, 1
je 0x1401ccc95
movaps xmm2, xmm15
jmp 0x1401ccc99
shr rcx, 0x1a
test cl, 1
je 0x1401ccc95
movaps xmm2, xmm8
jmp 0x1401ccc99
movaps xmm2, xmm12
mov edx, 0x2e
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ccdaf
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
jmp 0x1401ccdaf
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindowsAppInit_DLLs
call fcn.1401ff540
test al, al
je 0x1401cccf3
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401ccce5
movaps xmm2, xmm8
jmp 0x1401ccce9
movaps xmm2, xmm12
mov edx, 0x2f
jmp 0x1401ccda6
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
lea rcx, [rsp + 0x78]
call fcn.1401ff540
test al, al
je 0x1401ccd27
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401ccd1c
movaps xmm2, xmm8
jmp 0x1401ccd20
movaps xmm2, xmm12
mov edx, 0x30
jmp 0x1401ccda6
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
lea rcx, [rsp + 0x78]
call fcn.1402019e0
test al, al
je 0x1401ccdaf
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401ccd50
movaps xmm2, xmm11
jmp 0x1401ccd54
movaps xmm2, xmm12
mov edx, 0x31
jmp 0x1401ccda6
movaps xmm6, xmm8
movsxd rax, dword [r12 + 0x1e4]
cmp dword [r13 + 0xc], eax
jl 0x1401ccd9e
mov r8, rax
mov rdx, qword [r12 + 0x1d8]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401ccd9e
mov edx, 4
mov rcx, rsi
call fcn.1401c4080
test al, al
jne 0x1401ccd9e
movaps xmm6, xmm7
movaps xmm2, xmm6
mov edx, 0x2c
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rbp - 0x80], 0
jle 0x1401ccdbf
mov rcx, qword [rsp + 0x78]
call fcn.1402b9c20
xor r8d, r8d
lea rdx, str.HKLMSYSTEMCurrentControlSetControlSecurityProvidersSecurityProviders
lea rcx, [rsp + 0x48]
call fcn.1402019e0
test al, al
je 0x1401cce29
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401ccde8
movaps xmm2, xmm8
jmp 0x1401ccdec
movaps xmm2, xmm12
mov edx, 0x32
jmp 0x1401cce20
lea rdx, [rsp + 0x48]
mov rcx, qword [r12 + 8]
call fcn.1400faa70
test al, al
je 0x1401cce29
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401cce17
movaps xmm2, xmm10
jmp 0x1401cce1b
movaps xmm2, xmm9
mov edx, 0x33
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x50], 0
jle 0x1401cce3a
mov rcx, qword [rsp + 0x48]
call fcn.1402b9c20
cmp byte [rbx + 0x19], 0
jne 0x1401cce8e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cce6e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cce8e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cce60
jmp 0x1401cce8e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cce8b
cmp rbx, qword [rax + 0x10]
jne 0x1401cce8b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cce78
mov rbx, rax
mov rcx, rsi
call fcn.1400d88e0
cmp rbx, qword [rax]
jne 0x1401ccaa0
movss xmm15, dword [0x140374a28]
lea r14, [rsi + 0x20]
mov edi, 0x5c
mov rcx, rsi
call fcn.1400d88e0
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d88e0
cmp rbx, qword [rax]
je 0x1401ccfc4
lea rdi, [0x140348ca0]
nop word [rax + rax]
mov qword [rbp - 0x70], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401ccef5
mov qword [rbp - 0x78], rdi
jmp 0x1401ccf17
lea rcx, [rbp - 0x78]
call fcn.1401ff260
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.1402bd21c
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.140200570
nop
mov r8d, 1
lea rdx, [0x140347d14]
lea rcx, [rbp - 0x78]
call fcn.1402019e0
test al, al
je 0x1401ccf55
mov r8d, 1
lea rdx, str._shellopencommand_
lea rcx, [rbp - 0x78]
call fcn.1401ff110
nop
cmp dword [rbp - 0x70], 0
jle 0x1401ccf64
mov rcx, qword [rbp - 0x78]
call fcn.1402b9c20
cmp byte [rbx + 0x19], 0
jne 0x1401ccfae
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ccf8e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ccfae
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ccf80
jmp 0x1401ccfae
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ccfab
cmp rbx, qword [rax + 0x10]
jne 0x1401ccfab
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ccf98
mov rbx, rax
mov rcx, rsi
call fcn.1400d88e0
cmp rbx, qword [rax]
jne 0x1401ccee0
mov edi, 0x5c
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 9
test al, 1
je 0x1401ccff1
shr rcx, 0x1a
test cl, 1
jne 0x1401ccfe0
movaps xmm10, xmm8
movaps xmm2, xmm10
mov edx, 0x34
mov rcx, rsi
call fcn.1400e40c0
xor r15b, r15b
mov byte [rsp + 0x40], r15b
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x26
movss xmm7, dword [0x140374a40]
test al, 1
jne 0x1401cd38b
mov rax, rcx
shr rax, 0x20
test al, 1
jne 0x1401cd38b
mov rax, rcx
shr rax, 0x22
test al, 1
jne 0x1401cd38b
shr rcx, 0xa
test cl, 1
jne 0x1401cd38b
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e32e0
nop
mov r8d, 1
lea rdx, str..cpl
mov rcx, rax
call fcn.1401ff540
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401cd073
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
test bl, bl
jne 0x1401cd38b
mov rdx, r13
lea rcx, [rsp + 0x68]
call fcn.1400d2ff0
nop
xorps xmm8, xmm8
movaps xmm6, xmm8
mov rdx, r13
mov rcx, qword [r12 + 8]
call fcn.1400f61e0
test al, al
je 0x1401cd0af
movss xmm6, dword [0x140374a48]
jmp 0x1401cd1ee
mov qword [rsp + 0x50], 0
mov edx, dword [rsp + 0x74]
test edx, edx
jne 0x1401cd0ce
lea rax, [0x140348ca0]
mov qword [rsp + 0x48], rax
jmp 0x1401cd0f9
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd r9, dword [rsp + 0x74]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call fcn.1402bd21c
mov edx, dword [rsp + 0x74]
lea rcx, [rsp + 0x48]
call fcn.140200570
nop
cmp dword [rsp + 0x54], 3
jle 0x1401cd1d1
lea rdx, [rsp + 0x48]
mov rcx, qword [r12 + 8]
call fcn.1400f62a0
test al, al
jne 0x1401cd1b0
cmp dword [rsp + 0x54], 0
je 0x1401cd1d1
mov edx, edi
mov rcx, qword [rsp + 0x48]
call fcn.1402bcbec
test rax, rax
je 0x1401cd1d1
sub rax, qword [rsp + 0x48]
sar rax, 1
test eax, eax
js 0x1401cd1d1
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.1400d2ff0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsp + 0x50]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x48]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x48]
call fcn.140200570
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cd104
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
jmp 0x1401cd104
xor r8d, r8d
lea rdx, str.ExpertHelper
lea rcx, [rsp + 0x68]
call fcn.1401fefd0
test al, al
je 0x1401cd1ce
movaps xmm6, xmm15
jmp 0x1401cd1d1
movaps xmm6, xmm7
cmp dword [rsp + 0x50], 0
jle 0x1401cd1e2
mov rcx, qword [rsp + 0x48]
call fcn.1402b9c20
ucomiss xmm6, xmm8
jp 0x1401cd1ee
je 0x1401cd371
cmp dword [rsp + 0x74], 3
jle 0x1401cd371
mov edx, edi
mov r8d, 3
lea rcx, [rsp + 0x68]
call fcn.1401ff870
cmp eax, 0xffffffff
je 0x1401cd371
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1c4], eax
jne 0x1401cd241
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1b8]
call fcn.1402b9aac
test eax, eax
sete al
test al, al
jne 0x1401cd371
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1d4], eax
jne 0x1401cd26e
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1c8]
call fcn.1402b9aac
test eax, eax
sete al
test al, al
jne 0x1401cd371
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1e4], eax
jne 0x1401cd29b
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1d8]
call fcn.1402b9aac
test eax, eax
sete al
test al, al
jne 0x1401cd371
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1f4], eax
jne 0x1401cd2c8
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1e8]
call fcn.1402b9aac
test eax, eax
sete al
test al, al
jne 0x1401cd371
mov rax, qword [r12 + 0x140]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401cd358
nop dword [rax]
movsxd rax, dword [rbx + 0x2c]
cmp dword [rsp + 0x74], eax
jl 0x1401cd304
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x68]
call fcn.1402bba28
test eax, eax
sete al
test al, al
jne 0x1401cd371
cmp byte [rbx + 0x19], 0
jne 0x1401cd34e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cd32e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cd34e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cd320
jmp 0x1401cd34e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cd34b
cmp rbx, qword [rax + 0x10]
jne 0x1401cd34b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cd338
mov rbx, rax
cmp rbx, qword [r12 + 0x140]
jne 0x1401cd2e0
mov r15b, 1
mov byte [rsp + 0x40], r15b
movaps xmm2, xmm6
mov edx, 0x35
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x70], 0
jle 0x1401cd382
mov rcx, qword [rsp + 0x68]
call fcn.1402b9c20
test r15b, r15b
jne 0x1401cd9cf
movsxd rax, dword [r12 + 0x1d4]
cmp dword [r13 + 0xc], eax
jl 0x1401cd3ba
mov r8, rax
mov rdx, qword [r12 + 0x1c8]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
jne 0x1401cd9cf
movsxd rax, dword [r12 + 0x1c4]
cmp dword [r13 + 0xc], eax
jl 0x1401cd9cf
mov r8, rax
mov rdx, qword [r12 + 0x1b8]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401cd9cf
mov eax, dword [rsi + 0x14]
cmp eax, dword [r12 + 0x1c4]
jle 0x1401cd9cf
xor edx, edx
mov r14d, edx
mov dword [rbp - 0x40], edx
cmp dword [r12 + 0x158], edx
jl 0x1401cd9cb
mov r15d, edx
mov qword [rbp], rdx
mov r13, 0xfffffffffffffff0
mov qword [rbp - 0x38], r13
lea rcx, [0x140347f78]
movss xmm8, dword [0x140374a44]
nop word [rax + rax]
lea rdi, [0x140347f70]
test r14d, r14d
cmove rdi, rcx
test rdi, rdi
jne 0x1401cd45c
mov ebx, edx
mov qword [rsp + 0x50], rdi
jmp 0x1401cd477
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401cd460
mov qword [rsp + 0x50], 0
test ebx, ebx
jne 0x1401cd485
lea rax, [0x140348ca0]
mov qword [rsp + 0x48], rax
jmp 0x1401cd4aa
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd r9, ebx
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x48]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140200570
nop
test r15, r15
jle 0x1401cd547
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd rcx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.140200570
mov rdi, qword [r12 + 0x160]
mov ebx, dword [rsp + 0x54]
add ebx, dword [r13 + rdi + 0xc]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd r9, dword [r13 + rdi + 0xc]
mov ecx, dword [rsp + 0x50]
movsxd rax, dword [rsp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [r13 + rdi]
call fcn.1402bd21c
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.140200570
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401ff260
movsxd rcx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.140200570
lea rdx, [0x140351240]
lea rcx, [rsp + 0x48]
call fcn.1401fd8b0
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400ec370
mov r12, rax
test rax, rax
je 0x1401cd97c
mov rax, qword [rbp - 0x30]
mov r8d, dword [rax + 0x1c4]
inc r8d
lea rdx, [rbp - 0x68]
lea rcx, [rsi + 8]
call fcn.1402011d0
nop
lea rdi, vtable.Core::Array_class_Core::String_.0
mov qword [rbp - 0x58], rdi
xor ebx, ebx
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x48], rbx
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140347f58]
lea rcx, [rbp - 0x68]
call fcn.140200db0
test eax, eax
jle 0x1401cd94d
lea rax, [0x140348ca0]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rbx
mov eax, ebx
cmp dword [rbp - 0x50], 2
setg al
inc eax
mov r14d, ebx
movsxd r15, eax
test eax, eax
jle 0x1401cd935
mov r13, qword [rbp - 0x48]
lea rdi, [r13 + 0xc]
cmp dword [rdi], 3
jle 0x1401cd657
movsxd rdx, r14d
shl rdx, 4
add rdx, r13
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax + 8]
call fcn.1400f5d80
test al, al
jne 0x1401cd668
inc r14d
inc rbx
add rdi, 0x10
cmp rbx, r15
jge 0x1401cd6a2
jmp 0x1401cd637
shl rbx, 4
add rbx, r13
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401ff260
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.140200570
cmp dword [rbp - 0x7c], 0
jle 0x1401cd92a
movaps xmm6, xmm7
mov byte [rsp + 0x40], 1
mov eax, dword [rsi + 0x40]
bt rax, 8
jb 0x1401cd6d9
xor r8d, r8d
lea rdx, str..dll
lea rcx, [rsi + 8]
call fcn.1401ff110
test al, al
je 0x1401cd6d9
movaps xmm6, xmm8
xor r15d, r15d
mov qword [rbp - 0x10], r15
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401cd92a
lea ecx, [rax + 0x10]
call fcn.1402b968c
mov rdi, rax
lea r14, vtable.Core::Win32::RegistryKey.0
test rax, rax
je 0x1401cd72e
mov rax, qword [rbp - 0x10]
mov qword [rdi], r14
mov qword [rdi + 8], rax
jmp 0x1401cd731
mov rdi, r15
test rdi, rdi
je 0x1401cd92a
lea rbx, [0x140348ca0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r15
lea r8, [rbp - 0x78]
lea rdx, str.Publisher
mov rcx, rdi
call fcn.1400d8b50
xor r8d, r8d
lea rdx, str.virus
lea rcx, [rbp - 0x78]
call fcn.1401fefd0
test al, al
jne 0x1401cd908
xor r8d, r8d
lea rdx, str.anti
lea rcx, [rbp - 0x78]
call fcn.1401fefd0
test al, al
jne 0x1401cd908
movaps xmm2, xmm6
mov edx, 0x35
mov rcx, rsi
call fcn.1400e40c0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r15
lea r8, [rsp + 0x58]
lea rdx, str.DisplayName
mov rcx, rdi
call fcn.1400d8b50
test al, al
je 0x1401cd8f5
mov eax, dword [rbp - 0x6c]
test eax, eax
jne 0x1401cd80a
lea edx, [rax + 9]
lea rcx, [rbp - 0x78]
call fcn.1401ff260
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 9
lea r8, [0x140364fe0]
mov rcx, qword [rbp - 0x78]
call fcn.1402bd21c
mov edx, 9
lea rcx, [rbp - 0x78]
call fcn.140200570
mov eax, dword [rbp - 0x6c]
cmp eax, 3
jle 0x1401cd8f5
cmp dword [rsp + 0x64], 3
jle 0x1401cd8f5
mov r9, qword [rsp + 0x58]
mov r8, qword [rbp - 0x78]
lea rdx, str.SOFTWARE_ws_ws
lea rcx, [rbp + 0x260]
call fcn.1401ff700
mov rbx, rax
mov ecx, dword [0x14042c9f8]
test cl, 1
jne 0x1401cd86f
or ecx, 1
mov dword [0x14042c9f8], ecx
mov qword [0x14042ca00], r14
mov qword [0x14042ca08], 0xffffffff80000001
lea rcx, [0x140301800]
call fcn.1402bb344
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [0x14042ca08]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401cd8b9
lea ecx, [rax + 0x10]
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x1401cd8b9
mov rax, qword [rsp + 0x68]
mov qword [rbx], r14
mov qword [rbx + 8], rax
jmp 0x1401cd8bc
mov rbx, r15
cmp dword [rbp + 0x268], 0
jle 0x1401cd8d1
mov rcx, qword [rbp + 0x260]
call fcn.1402b9c20
test rbx, rbx
je 0x1401cd8f5
movaps xmm2, xmm15
mov edx, 0x36
mov rcx, rsi
call fcn.1400e40c0
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cd90d
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
jmp 0x1401cd90d
mov byte [rsp + 0x40], 0
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp - 0x70], 0
jle 0x1401cd92a
mov rcx, qword [rbp - 0x78]
call fcn.1402b9c20
mov r13, qword [rbp - 0x38]
lea rdi, vtable.Core::Array_class_Core::String_.0
cmp dword [rbp - 0x80], 0
jle 0x1401cd945
mov rcx, qword [rsp + 0x78]
call fcn.1402b9c20
mov r15, qword [rbp]
mov r14d, dword [rbp - 0x40]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp - 0x58], rdi
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7e30
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cd97c
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
nop
cmp dword [rsp + 0x50], 0
jle 0x1401cd98d
mov rcx, qword [rsp + 0x48]
call fcn.1402b9c20
inc r14d
mov dword [rbp - 0x40], r14d
inc r15
mov qword [rbp], r15
add r13, 0x10
mov qword [rbp - 0x38], r13
mov r12, qword [rbp - 0x30]
cmp r14d, dword [r12 + 0x158]
lea rcx, [0x140347f78]
mov edx, 0
jle 0x1401cd440
movzx r15d, byte [rsp + 0x40]
lea r13, [rsi + 8]
lea r14, [rsi + 0x20]
xor dil, dil
mov edx, 7
mov rcx, rsi
call fcn.1400d8600
test al, al
jne 0x1401cdaa5
mov rcx, rsi
call fcn.1400d7e80
movss xmm6, dword [0x1403748ac]
comiss xmm6, xmm0
ja 0x1401cdaad
cmp dword [rsi + 0x38], 0x500000
jae 0x1401cdaad
call fcn.140114e00
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400cb050
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm0, xmm0
comiss xmm0, dword [0x140374950]
ja 0x1401cdaad
lea rax, [0x140348ca0]
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.1400d7a50
nop
lea r9, [rsp + 0x58]
mov r8, rax
mov rdx, r13
mov rcx, qword [r12 + 0x228]
call fcn.1401f96c0
nop
test al, al
je 0x1401cda92
mov dil, 1
lea r8, [rsp + 0x58]
mov edx, 7
mov rcx, rsi
call fcn.14000b8f0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401cdaad
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
jmp 0x1401cdaad
movss xmm6, dword [0x1403748ac]
mov edx, 7
mov rcx, rsi
call fcn.1400d8600
test al, al
je 0x1401cdb2a
mov r8d, 7
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d84b0
nop
mov byte [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x68]
mov rcx, r12
call fcn.1401ce580
movzx ebx, byte [rsp + 0x40]
test al, al
je 0x1401cdb09
test bl, bl
je 0x1401cdb0d
movss xmm2, dword [0x1403748f0]
mov edx, 0x38
mov rcx, rsi
call fcn.1400e40c0
test bl, bl
jne 0x1401cdb1b
test dil, dil
je 0x1401cdb1b
mov rcx, rsi
call fcn.1401c7a40
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cdb2a
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
test r15b, r15b
je 0x1401cdca9
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400d2ff0
nop
lea r14, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.1.0
mov qword [rbp + 0x260], r14
lea r15, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.0
mov qword [rbp + 0x268], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
xor edi, edi
mov dword [rbp + 0x280], edi
lea r8, [rbp + 0x260]
lea rdx, [rbp - 0x68]
mov rcx, qword [r12 + 8]
call fcn.1400f64b0
test al, al
je 0x1401cdc7f
lea ecx, [rdi + 0x18]
call fcn.1402b968c
mov rbx, rax
test rax, rax
je 0x1401cdbb7
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
mov qword [rbx], rax
lea rax, [rbp + 0x260]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rdi
jmp 0x1401cdbba
mov rbx, rdi
lea rax, vtable.Core::SharedPtr_class_Core::Collections::Generic::IEnumerator_class_Core::String__.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
test rbx, rbx
je 0x1401cdbfc
mov ecx, 4
call fcn.1402b968c
mov rdi, rax
test rax, rax
je 0x1401cdbf0
mov dword [rax], 0
mov qword [rbp - 0x48], rax
jmp 0x1401cdbf6
xor edi, edi
mov qword [rbp - 0x48], rdi
mov dword [rdi], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
je 0x1401cdc5a
nop dword [rax + rax]
mov byte [rsp + 0x40], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r8, rax
lea r9, [rsp + 0x40]
mov rcx, r12
call fcn.1401ce580
test al, al
je 0x1401cdc4e
cmp byte [rsp + 0x40], 0
je 0x1401cdc4e
movss xmm2, dword [0x1403748f0]
mov edx, 0x39
mov rcx, rsi
call fcn.1400e40c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
jne 0x1401cdc10
test rdi, rdi
je 0x1401cdc7f
mov eax, dword [rdi]
test eax, eax
jle 0x1401cdc69
dec eax
mov dword [rdi], eax
cmp dword [rdi], 0
jne 0x1401cdc7f
mov rcx, rbx
call fcn.1402177e0
mov rcx, rdi
call fcn.1402177e0
nop
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x268], r15
lea rcx, [rbp + 0x268]
call fcn.14011a150
nop
cmp dword [rbp - 0x60], 0
jle 0x1401cdca9
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.1400d8790
nop
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.14000a400
nop
mov rdx, rax
lea rcx, [r12 + 0xd0]
call fcn.14000a580
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x260]
lea rcx, [r12 + 0xd0]
call fcn.1401cf0d0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401cdd05
mov rcx, qword [rbp - 0x58]
call fcn.1402b9c20
mov edx, 7
mov rcx, rsi
call fcn.1400d8600
test al, al
je 0x1401cdeeb
mov rdx, qword [r13]
lea rcx, str.INTERNET_FILE:__ws_r_n
call fcn.1402ba358
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.14000a400
nop
mov rdx, rax
lea rcx, [r12 + 0xc0]
call fcn.14000a580
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x260]
lea rcx, [r12 + 0xc0]
call fcn.1401cf0d0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401cdd79
mov rcx, qword [rbp - 0x58]
call fcn.1402b9c20
mov rbx, qword [r12 + 0xd0]
mov r8, qword [rbx + 8]
cmp byte [r8 + 0x19], 0
jne 0x1401cddd0
nop dword [rax]
mov rax, qword [r8 + 0x20]
mov r9, qword [rbp - 0x28]
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x1401cddb4
add rax, 2
test ecx, ecx
jne 0x1401cdda0
test edx, edx
jns 0x1401cddbe
mov r8, qword [r8 + 0x10]
jmp 0x1401cddc4
mov rbx, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], 0
je 0x1401cdd90
nop dword [rax + rax]
mov r10, qword [r12 + 0xd0]
mov r8, qword [r10 + 8]
cmp byte [r8 + 0x19], 0
jne 0x1401cde2b
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp - 0x28]
mov r9, qword [r8 + 0x20]
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x1401cde14
add rax, 2
test ecx, ecx
jne 0x1401cde00
test edx, edx
jns 0x1401cde20
mov r10, r8
mov r8, qword [r8]
jmp 0x1401cde24
mov r8, qword [r8 + 0x10]
cmp byte [r8 + 0x19], 0
je 0x1401cddf0
cmp rbx, r10
je 0x1401ce019
mov rdi, qword [rbx + 0x30]
cmp rdi, rsi
je 0x1401cde8d
mov edx, 7
mov rcx, rdi
call fcn.1400d8600
test al, al
jne 0x1401cde8d
mov rdx, qword [rdi + 8]
lea rcx, str.RE_QUEUEING:__s_r_n
call fcn.1402bbf64
mov rax, qword [rbx + 0x30]
mov edx, dword [rax + 0x38]
lea rcx, str._tSize_u_r_n
call fcn.1402bbf64
mov rdx, qword [rbp - 0x28]
lea rcx, str._tHash_s_r_n
call fcn.1402bbf64
mov rdx, qword [rbx + 0x30]
mov rcx, r12
call fcn.1401c8680
cmp byte [rbx + 0x19], 0
jne 0x1401cddd0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401cdec2
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401cddd0
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401cdeb1
jmp 0x1401cddd0
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401cdee3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401cdee3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401cded0
mov rbx, rax
jmp 0x1401cddd0
cmp qword [r12 + 0xc8], 0
jbe 0x1401ce019
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x18]
lea rcx, [r12 + 0xc0]
call fcn.1400c8c90
mov rax, qword [rax]
cmp rax, qword [r12 + 0xc0]
je 0x1401ce019
mov rbx, qword [rax + 0x30]
mov r8, qword [rbx + 8]
mov rdx, qword [r13]
lea rcx, str.FILE_CAME_FROM_INTERNET_r_n_ws_r_n_ws_r_n
call fcn.1402ba358
mov edx, 0xb
mov rcx, rsi
call fcn.1400d7f50
mov rdx, r13
mov rcx, r12
test al, al
je 0x1401cdf63
call fcn.1401c9e20
movss xmm13, dword [0x140374848]
test al, al
jne 0x1401cdf7b
jmp 0x1401cdf7f
call fcn.1401c9e20
movss xmm13, dword [0x140374848]
test al, al
je 0x1401cdf7b
movaps xmm14, xmm13
jmp 0x1401cdf7f
movaps xmm14, xmm6
movaps xmm2, xmm14
mov edx, 0x3a
mov rcx, rsi
call fcn.1400e40c0
mov r8d, 7
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400d84b0
nop
cmp dword [rsp + 0x64], 0
jle 0x1401ce006
mov edx, 7
mov rcx, rsi
call fcn.1400d8600
test al, al
jne 0x1401cdfce
lea r8, [rsp + 0x58]
mov edx, 7
mov rcx, rsi
call fcn.14000b8f0
mov byte [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x58]
mov rcx, r12
call fcn.1401ce580
test al, al
je 0x1401ce006
cmp byte [rsp + 0x40], 0
je 0x1401ce006
movss xmm2, dword [0x1403748f0]
mov edx, 0x38
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ce022
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
jmp 0x1401ce022
movss xmm13, dword [0x140374848]
mov edx, 7
mov rcx, rsi
call fcn.1400d7f50
test al, al
je 0x1401ce093
mov edx, 9
mov rcx, rsi
call fcn.1400d7f50
test al, al
je 0x1401ce093
mov eax, dword [rsi + 0x40]
shr rax, 9
test al, 1
jne 0x1401ce093
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400e32e0
nop
xor r8d, r8d
lea rdx, str..sys
lea rcx, [rbp - 0x68]
call fcn.1401ff540
test al, al
je 0x1401ce084
movaps xmm2, xmm6
mov edx, 0x37
mov rcx, rsi
call fcn.1400e40c0
nop
cmp dword [rbp - 0x60], 0
jle 0x1401ce093
mov rcx, qword [rbp - 0x68]
call fcn.1402b9c20
mov eax, dword [rsi + 0x40]
shr rax, 0x1c
test al, 1
je 0x1401ce0c0
mov edx, 0x800
mov rcx, rsi
call fcn.1401c4080
test al, al
je 0x1401ce0c0
movaps xmm2, xmm13
mov edx, 0x41
mov rcx, rsi
call fcn.1400e40c0
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401ce226
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401ce226
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.1402bba28
test eax, eax
sete al
test al, al
je 0x1401ce226
xor r8d, r8d
lea rdx, str.services.exe
mov rcx, r13
call fcn.1401ff110
test al, al
je 0x1401ce226
xor eax, eax
mov qword [rbp - 0x80], rax
lea edx, [rax + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401ff260
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0xc
lea r8, str.services.exe
mov rcx, qword [rsp + 0x78]
call fcn.1402bd21c
mov edx, 0xc
lea rcx, [rsp + 0x78]
call fcn.140200570
nop
lea r8, [rsp + 0x78]
lea rdx, [r12 + 0x178]
lea rcx, [rsp + 0x58]
call fcn.1400d2bd0
nop
cmp dword [rbp - 0x80], 0
jle 0x1401ce186
mov rcx, qword [rsp + 0x78]
call fcn.1402b9c20
mov eax, dword [r13 + 0xc]
cmp dword [rsp + 0x64], eax
jne 0x1401ce215
mov rdx, qword [r13]
mov rcx, qword [rsp + 0x58]
call fcn.1402b9aac
test eax, eax
sete al
test al, al
je 0x1401ce215
mov eax, dword [rsi + 0x40]
shr rax, 0xe
movss xmm6, dword [0x140374954]
test al, 1
jne 0x1401ce1e6
cmp byte [r12 + 0x30], 0
je 0x1401ce1e6
movaps xmm2, xmm6
mov edx, 0x40
mov rcx, rsi
call fcn.1400e40c0
movabs rbx, 0x2000000000
or qword [rsi + 0x40], rbx
jmp 0x1401ce1f0
movabs rbx, 0x2000000000
mov edx, 0x800
mov rcx, rsi
call fcn.1401c4080
test al, al
je 0x1401ce215
movaps xmm2, xmm6
mov edx, 0x42
mov rcx, rsi
call fcn.1400e40c0
or qword [rsi + 0x40], rbx
cmp dword [rsp + 0x60], 0
jle 0x1401ce226
mov rcx, qword [rsp + 0x58]
call fcn.1402b9c20
cmp byte [r12 + 0x31], 0
je 0x1401ce237
mov rcx, rsi
call fcn.1401ce2b0
nop
cmp dword [rbp - 0x20], 0
jle 0x1401ce246
mov rcx, qword [rbp - 0x28]
call fcn.1402b9c20
mov al, 1
mov rcx, qword [rbp + 0x288]
xor rcx, rsp
call fcn.1402b9610
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret