Function at 0x1400363e0
Capabilities:
Authenticate hmac

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0xc]
mov rbx, rcx
cmp edx, 0x32
jg 0x140036451
je 0x14003643f
sub edx, 1
je 0x14003643f
sub edx, 1
je 0x14003643f
sub edx, 1
je 0x14003643f
sub edx, 1
je 0x140036435
sub edx, 4
je 0x14003642e
sub edx, 8
je 0x140036424
cmp edx, 1
jne 0x1400364a6
add rsp, 0x20
pop rbx
jmp 0x140039ec0
add rsp, 0x20
pop rbx
jmp 0x140036694
call fcn.14003860c
jmp 0x140036444
add rsp, 0x20
pop rbx
jmp 0x140037de4
call fcn.140036f80
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140036b04
sub edx, 0x33
je 0x1400364a1
sub edx, 1
je 0x140036497
sub edx, 1
je 0x14003648d
sub edx, 1
je 0x140036483
sub edx, 1
je 0x140036479
cmp edx, 1
jne 0x1400364a6
add rsp, 0x20
pop rbx
jmp 0x14003b9e0
add rsp, 0x20
pop rbx
jmp 0x14003b840
add rsp, 0x20
pop rbx
jmp 0x14003b624
add rsp, 0x20
pop rbx
jmp 0x14003b438
add rsp, 0x20
pop rbx
jmp 0x14003b23c
call fcn.14003b040
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0x250], rax
lea rbx, [rcx + 0x2680]
mov rdx, rbx
lea rcx, [rbp + 0x30]
call fcn.1400294bc
nop
lea rdx, [0x14009e290]
lea rcx, [rbp + 0x30]
call fcn.140029944
lea rdx, str.Zoom.exe
lea rcx, [rbp + 0x30]
call fcn.140029944
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400294bc
nop
lea rdx, [0x14009e290]
lea rcx, [rsp + 0x20]
call fcn.140029944
lea rdx, str.airhost.exe
lea rcx, [rsp + 0x20]
call fcn.140029944
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x30]
call fcn.1400364ac
movsxd rdi, eax
mov edx, 0x65
lea rcx, [rbp + 0x140]
call fcn.140030fc4
mov rcx, rax
call fcn.1400295e0
mov rdx, rax
lea rcx, str.zoom.us_Installer_Engine
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rcx, [rbp + 0x140]
call fcn.140029560
test rbx, rbx
je 0x140036785
mov r8, rdi
xor r9d, r9d
mov edx, 0x7f2
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x1400beb24], 1
lea rcx, [rsp + 0x20]
call fcn.140029560
nop
lea rcx, [rbp + 0x30]
call fcn.140029560
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xbd0]
sub rsp, 0xcd0
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0xbc0], rax
mov rbx, rcx
xor r12d, r12d
cmp dword [0x1400bfa0c], r12d
jne 0x1400385b6
mov dword [0x1400bfa0c], 1
mov ecx, dword [rcx + 8]
mov eax, 0x3e9
cmp ecx, eax
jg 0x140038536
je 0x14003855a
test ecx, ecx
je 0x14003852d
sub ecx, 0x32
je 0x14003816b
sub ecx, 1
je 0x140038152
sub ecx, 1
je 0x140037f14
sub ecx, 1
je 0x140037ed9
sub ecx, 1
je 0x140037e87
cmp ecx, 0x3b2
je 0x14003855a
jmp 0x1400385af
mov r9d, 0x545
lea r8, str.c:jenkinsworkspaceClientClientWindows_releasewin_common_srcinstallerNoMSIInstallerInstallerManager.cpp
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.14000b3b8
nop
lea rdx, str._CInstallerManager::ProcessUnInstallCommand__State_is:_INSTALLSTATE_UNINSTALLED
lea rcx, [0x1400be0f0]
call fcn.14000475c
nop
lea rcx, [rsp + 0x20]
call fcn.14000b5e4
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x1400beb24], 1
jmp 0x1400385af
inc dword [rbx + 0x32e0]
mov eax, 0x66666667
imul dword [rbx + 0x32e0]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x5a
cmp edx, eax
cmovge edx, eax
mov r9d, edx
lea edx, [rax - 0x55]
lea r8d, [rax + 0xa]
mov rcx, rbx
call fcn.140039690
jmp 0x1400385af
mov rax, qword [rbx + 0x32c8]
cmp qword [rbx + 0x32c0], rax
je 0x140038025
call fcn.140035970
test al, al
je 0x140038025
cmp byte [rbx + 0x28a3], r12b
je 0x140037f4b
call fcn.14003a9c0
test eax, eax
jne 0x140038025
mov rcx, qword [rbx + 0x32c0]
add rcx, 8
call fcn.14001256c
mov rsi, rax
test rax, rax
je 0x140038025
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xba0], xmm0
mov dword [rbp + 0xbb0], r12d
lea rdi, [rsp + 0x70]
xor eax, eax
mov edx, 0x410
mov ecx, edx
rep stosb byte [rdi], al
lea rdi, [rbp + 0x380]
mov ecx, edx
rep stosb byte [rdi], al
lea rdi, [rbp + 0x790]
mov ecx, edx
rep stosb byte [rdi], al
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140035618
nop
cmp qword [rbp + 0xba0], r12
je 0x140037ff4
mov rcx, qword [rbp + 0xba8]
test rcx, rcx
je 0x140037ff4
mov qword [rsp + 0x20], r12
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov rax, qword [rax + 0x28]
call qword [case.0x14002b591.0]
test eax, eax
jne 0x140037ff4
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140037ff4
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x14002b591.0]
mov rcx, rsi
call fcn.140028090
nop
mov rcx, qword [rbp + 0xba0]
test rcx, rcx
je 0x14003800f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, [rsp + 0x70]
call fcn.14003588c
lea rdx, [rbp + 0x790]
call fcn.14003588c
mov rcx, qword [rbx + 0x32c0]
cmp rcx, qword [rbx + 0x32c8]
je 0x140038137
add rcx, 8
call fcn.14001256c
mov r14, rax
test rax, rax
je 0x140038137
call fcn.140006448
test al, al
je 0x14003812f
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov edi, 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r12w
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.1400055a4
nop
lea rdx, [rsp + 0x28]
call fcn.1400062d8
nop
mov esi, 0x1000
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400380d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, rsi
jb 0x1400380cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400385e7
call fcn.140028090
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r12w
lea rdx, [rsp + 0x28]
call fcn.1400067fc
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14003812f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, rsi
jb 0x14003812a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400385ed
call fcn.140028090
mov rcx, r14
call fcn.140028090
mov dword [rbx + 0x32e0], r12d
mov rcx, rbx
call fcn.140039200
mov dword [rbx + 8], 0x35
jmp 0x1400385af
call fcn.140051b98
test al, al
je 0x1400385af
mov dword [rbx + 8], 0x34
jmp 0x1400385af
lea r14, [rbx + 0x32c0]
mov rax, qword [r14]
mov qword [r14 + 8], rax
lea r15, [rbx + 0x28f0]
mov r8d, r12d
cmp byte [rbx + 0x28a3], r12b
setne r8b
mov rdx, r14
mov rcx, r15
call fcn.140043854
mov rdi, qword [r14]
mov rax, qword [rbx + 0x32c8]
cmp rdi, rax
je 0x1400382ae
mov esi, 0x80
mov rcx, rdi
lea rdx, [rsp + 0x70]
mov eax, 2
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
add rdx, rsi
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, rsi
sub rax, 1
jne 0x1400381be
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov eax, dword [rcx + 0x18]
mov dword [rdx + 0x18], eax
mov r9d, 0x4d9
lea r8, str.c:jenkinsworkspaceClientClientWindows_releasewin_common_srcinstallerNoMSIInstallerInstallerManager.cpp
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000b3b8
nop
lea rdx, str._Found_product
lea rcx, [0x1400be0f0]
call fcn.14000475c
mov rcx, rax
mov edx, dword [rsp + 0x70]
call fcn.14000268c
mov rcx, rax
lea rdx, str._state:
call fcn.14000475c
mov rcx, rax
mov edx, dword [rsp + 0x74]
call fcn.14000268c
mov rcx, rax
lea rdx, str._at:
call fcn.14000475c
mov rcx, rax
lea rdx, [rsp + 0x78]
call fcn.14000475c
nop
lea rcx, [rsp + 0x20]
call fcn.14000b5e4
add rdi, 0x11c
mov rax, qword [rbx + 0x32c8]
cmp rdi, rax
jne 0x1400381b1
mov edi, 7
mov esi, 0x1000
cmp qword [r14], rax
jne 0x140038427
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r12w
lea rcx, [rsp + 0x28]
call fcn.140018844
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14003831f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, rsi
jb 0x14003831a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400385f3
call fcn.140028090
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r12w
lea rdx, [rsp + 0x28]
call fcn.14005050c
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14003837d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, rsi
jb 0x140038378
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400385f9
call fcn.140028090
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r12w
xor r8d, r8d
lea rdx, [rsp + 0x28]
call fcn.14001b44c
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400383de
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, rsi
jb 0x1400383d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400385ff
call fcn.140028090
lea rax, str.Zoom_5.0.lnk
lea rdx, str.Zoom.lnk
cmp byte [rbx + 0x28a3], r12b
cmovne rdx, rax
or r8d, 0xffffffff
lea rcx, [rsp + 0x70]
call fcn.140029464
nop
lea rdx, [rsp + 0x70]
mov rcx, r15
call fcn.140045330
nop
lea rcx, [rsp + 0x70]
call fcn.140029560
mov dword [rbx + 8], 0x36
jmp 0x140038448
call fcn.140051b40
mov dword [rbx + 8], 0x33
mov r8d, 0x64
mov r9d, r8d
lea edx, [r8 - 0x63]
mov rcx, rbx
call fcn.140039690
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r12w
lea rdx, [rbx + 0x2a10]
lea rcx, [rsp + 0x48]
call fcn.140050324
nop
lea r8, [rsp + 0x28]
mov rcx, rax
call fcn.14001eb4c
nop
lea rcx, [rsp + 0x48]
call fcn.140005628
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400384c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, rsi
jb 0x1400384c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038605
call fcn.140028090
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x28], r12w
lea r8, [rsp + 0x28]
call fcn.14001b824
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400385af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, rsi
jb 0x140038523
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400385e1
call fcn.140028090
jmp 0x1400385af
mov dword [rbx + 8], 0x32
jmp 0x1400385af
sub ecx, 0x3ea
je 0x14003855a
sub ecx, 1
je 0x14003855a
sub ecx, 1
je 0x14003855a
sub ecx, 1
je 0x14003855a
sub ecx, 1
je 0x14003855a
cmp ecx, 0x7ca
jne 0x1400385af
mov r9d, 0x554
lea r8, str.c:jenkinsworkspaceClientClientWindows_releasewin_common_srcinstallerNoMSIInstallerInstallerManager.cpp
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.14000b3b8
nop
lea rdx, str._CInstallerManager::ProcessUnInstallCommand__Error__install_state_is:
lea rcx, [0x1400be0f0]
call fcn.14000475c
mov rcx, rax
mov edx, dword [rbx + 8]
call fcn.14000268c
nop
lea rcx, [rsp + 0x20]
call fcn.14000b5e4
mov rcx, rbx
call fcn.140038f28
mov dword [rbx + 8], 0x7d1
mov dword [0x1400bfa0c], r12d
mov rcx, qword [rbp + 0xbc0]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0xcd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.14005e65c
int3
call fcn.14005e65c
int3
call fcn.14005e65c
int3
call fcn.14005e65c
int3
call fcn.14005e65c
int3
call fcn.14005e65c
int3
call fcn.14005e65c
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xca0]
sub rsp, 0xda0
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0xc90], rax
add rcx, 0x2680
call fcn.1400295e0
mov rdx, rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc70], xmm0
and dword [rbp + 0xc80], 0
lea rdi, [rbp + 0x40]
xor eax, eax
mov r8d, 0x410
mov ecx, r8d
rep stosb byte [rdi], al
lea rdi, [rbp + 0x450]
mov ecx, r8d
rep stosb byte [rdi], al
lea rdi, [rbp + 0x860]
mov ecx, r8d
rep stosb byte [rdi], al
lea rcx, [rbp + 0x40]
call fcn.140035618
nop
xor ebx, ebx
cmp qword [rbp + 0xc70], rbx
je 0x140039faa
mov rcx, qword [rbp + 0xc78]
test rcx, rcx
je 0x140039faa
cmp dword [rbp + 0xc80], ebx
jne 0x140039f63
lea edi, [rbx + 8]
jmp 0x140039faf
and qword [rsp + 0x20], rbx
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov rax, qword [rax + 0x28]
call qword [case.0x14002b591.0]
mov ebx, eax
test eax, eax
jne 0x140039fa3
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140039fa3
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x14002b591.0]
mov ebx, eax
xor edi, edi
test eax, eax
setne dil
jmp 0x140039faf
mov edi, 1
jmp 0x140039faf
mov edi, 2
mov r9d, 0x858
lea r8, str.c:jenkinsworkspaceClientClientWindows_releasewin_common_srcinstallerNoMSIInstallerInstallerManager.cpp
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000b3b8
nop
lea rdx, str._CInstallerManager::ProcessInstallZoomService__Error:
lea rcx, [0x1400be0f0]
call fcn.14000475c
mov rcx, rax
mov edx, edi
call fcn.14000268c
mov rcx, rax
lea rdx, str._Ret:
call fcn.14000475c
mov rcx, rax
mov edx, ebx
call fcn.14000268c
nop
lea rcx, [rsp + 0x20]
call fcn.14000b5e4
mov edx, 0x65
lea rcx, [rsp + 0x30]
call fcn.140030fc4
mov rcx, rax
call fcn.1400295e0
mov rdx, rax
lea rcx, str.zoom.us_Installer_Engine
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140029560
test rbx, rbx
je 0x14003a05d
xor r8d, r8d
test edi, edi
sete r8b
xor r9d, r9d
mov edx, 0x7fc
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x1400beb24], 1
mov rcx, qword [rbp + 0xc70]
test rcx, rcx
je 0x14003a081
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, [rbp + 0x40]
call fcn.14003588c
lea rdx, [rbp + 0x860]
call fcn.14003588c
mov rcx, qword [rbp + 0xc90]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0xda0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x98]
sub rsp, 0x190
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0x80], rax
add rcx, 0x128
call fcn.1400348d0
cmp eax, 0x34
jne 0x14003b3fb
lea rcx, [rsp + 0x70]
call fcn.140029414
nop
lea rcx, [rsp + 0x70]
call fcn.140029f90
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140050324
nop
mov esi, 7
mov rax, qword [rsp + 0x40]
xor edi, edi
test rax, rax
je 0x14003b32a
lea r9, [rax - 1]
cmp rax, r9
jbe 0x14003b429
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
lea ecx, [rsi + 0x55]
cmp cx, word [rax + r9*2]
jne 0x14003b32a
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14003c3d0
mov rbx, rax
lea rax, [rsp + 0x30]
cmp rax, rbx
je 0x14003b320
lea rcx, [rsp + 0x30]
call fcn.140005628
lea r8d, [rsi + 0x19]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14007dfd0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rsi
mov word [rbx], di
lea rcx, [rsp + 0x50]
call fcn.140005628
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x50], di
mov byte [rsp + 0x20], dil
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14001ba44
nop
mov ebx, 0x1000
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14003b396
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x14003b391
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b42f
call fcn.140028090
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x1400beb24], 1
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14003b3e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, rbx
jb 0x14003b3dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b423
call fcn.140028090
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x30], di
lea rcx, [rsp + 0x70]
call fcn.140029560
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14005e65c
nop
call fcn.140004630
int3
call fcn.14005e65c
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0x70], rax
add rcx, 0x128
call fcn.1400348d0
cmp eax, 0x35
jne 0x14003b5ed
lea rcx, [rsp + 0x60]
call fcn.140029414
nop
lea rcx, [rsp + 0x60]
call fcn.140029f90
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140050324
nop
mov esi, 7
mov rax, qword [rsp + 0x30]
xor edi, edi
test rax, rax
je 0x14003b521
lea r9, [rax - 1]
cmp rax, r9
jbe 0x14003b618
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rax, qword [rsp + 0x20]
lea ecx, [rsi + 0x55]
cmp cx, word [rax + r9*2]
jne 0x14003b521
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14003c3d0
mov rbx, rax
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x14003b517
lea rcx, [rsp + 0x20]
call fcn.140005628
lea r8d, [rsi + 0x19]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007dfd0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rsi
mov word [rbx], di
lea rcx, [rsp + 0x40]
call fcn.140005628
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x40], di
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14001d108
nop
mov ebx, 0x1000
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003b588
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x14003b583
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b61e
call fcn.140028090
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x1400beb24], 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003b5d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x14003b5cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b612
call fcn.140028090
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x60]
call fcn.140029560
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14005e65c
nop
call fcn.140004630
int3
call fcn.14005e65c
int3
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x288]
sub rsp, 0x380
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rbx, rcx
xor edi, edi
cmp dword [0x1400bfa08], edi
jne 0x14003b80f
lea esi, [rdi + 1]
mov dword [0x1400bfa08], esi
mov eax, dword [rcx + 8]
test eax, eax
je 0x14003b6d6
cmp eax, 0x37
je 0x14003b695
cmp eax, 0x39
jne 0x14003b809
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x1400beb24], esi
jmp 0x14003b80f
mov dword [rcx + 8], 0x38
lea rcx, [rsp + 0x40]
call fcn.140029414
nop
lea rdx, str._regvdiau_as_admin
lea rcx, [rsp + 0x40]
call fcn.1400297dc
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14003bdc8
mov dword [rbx + 8], 0x39
lea rcx, [rsp + 0x40]
jmp 0x14003b804
mov edx, 0xd5
lea rcx, [rbp + 0x160]
call fcn.140030fc4
nop
mov edx, 0xd6
lea rcx, [rbp + 0x50]
call fcn.140030fc4
nop
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
call fcn.140016790
lea rcx, [rsp + 0x40]
call fcn.140029414
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r8, qword [rsp + 0x20]
lea rcx, [rbp + 0x50]
call fcn.1400295e0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140029db0
lea rcx, [rsp + 0x40]
call fcn.1400295e0
mov r9, rax
lea rcx, [rbp + 0x160]
call fcn.1400295e0
mov r8, rax
mov edx, 0x84e
mov rcx, qword [rbx + 0x120]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rsi
mov r8, rsi
mov edx, 0x851
mov rcx, qword [rbx + 0x120]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbx + 8], 0x7d1
lea rcx, [rsp + 0x40]
call fcn.140029560
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003b7e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b7db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b837
call fcn.140028090
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
lea rcx, [rbp + 0x50]
call fcn.140029560
nop
lea rcx, [rbp + 0x160]
call fcn.140029560
mov dword [0x1400bfa08], edi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14005e65c
nop
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor edi, edi
cmp dword [0x1400bfa10], edi
jne 0x14003b9b1
mov dword [0x1400bfa10], 1
add rcx, 0x128
call fcn.1400348d0
cmp eax, 0x37
jne 0x14003b99f
lea rcx, [rsp + 0x60]
call fcn.140029414
nop
lea rcx, [rsp + 0x60]
call fcn.140029f90
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140050324
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14003b939
lea r9, [rax - 1]
cmp rax, r9
jbe 0x14003b9d8
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rax, qword [rsp + 0x20]
lea ecx, [rdi + 0x5c]
cmp cx, word [rax + r9*2]
jne 0x14003b939
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14003c3d0
mov rbx, rax
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x14003b92f
lea rcx, [rsp + 0x20]
call fcn.140005628
lea r8d, [rdi + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007dfd0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rcx, [rsp + 0x40]
call fcn.140005628
lea rcx, [rsp + 0x20]
call fcn.14001682c
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003b982
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b97d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b9d2
call fcn.140028090
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x60]
call fcn.140029560
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x1400beb24], 1
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14005e65c
nop
call fcn.140004630
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x1400bba20]
xor rax, rsp
mov qword [rbp + 0x70], rax
add rcx, 0x128
call fcn.1400348d0
cmp eax, 0x38
jne 0x14003bb98
lea rcx, [rsp + 0x60]
call fcn.140029414
nop
lea rcx, [rsp + 0x60]
call fcn.140029f90
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140050324
nop
mov esi, 7
mov rax, qword [rsp + 0x30]
xor edi, edi
test rax, rax
je 0x14003bac9
lea r9, [rax - 1]
cmp rax, r9
jbe 0x14003bbc3
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rax, qword [rsp + 0x20]
lea ecx, [rsi + 0x55]
cmp cx, word [rax + r9*2]
jne 0x14003bac9
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14003c3d0
mov rbx, rax
lea rax, [rsp + 0x20]
cmp rax, rbx
je 0x14003babf
lea rcx, [rsp + 0x20]
call fcn.140005628
lea r8d, [rsi + 0x19]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14007dfd0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rsi
mov word [rbx], di
lea rcx, [rsp + 0x40]
call fcn.140005628
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov word [rsp + 0x40], di
mov r9b, 1
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14001daf4
nop
mov ebx, 0x1000
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003bb33
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x14003bb2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003bbc9
call fcn.140028090
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [0x1400beb24], 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003bb7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x14003bb7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003bbbd
call fcn.140028090
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x60]
call fcn.140029560
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400793d0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14005e65c
nop
call fcn.140004630
int3
call fcn.14005e65c
int3