Function at 0x1401a7f20
Capabilities:
Check if file exists
Check mutex on windows
Create directory
Create process on windows
Get common file path
Get file attributes
Log keystrokes via polling
Self delete
Shutdown system

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x21c0]
mov eax, 0x22c0
call fcn.140247340
sub rsp, rax
mov qword [rbp + 0x170], 0xfffffffffffffffe
mov qword [rsp + 0x22f8], rbx
mov qword [rsp + 0x2300], rsi
mov qword [rsp + 0x2308], rdi
mov r14, r8
mov r15, rcx
mov edi, 1
mov dword [rbp - 0x60], edi
xor r13d, r13d
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
xor r8d, r8d
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x21f0]
call sub.gdiplus.dll_GdiplusStartup
mov r8d, 0x104
lea rdx, [rbp + 0x1180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x100
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x1180]
call fcn.1401a0910
test eax, eax
je 0x1401a8039
lea rcx, [rbp + 0x1180]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea rdx, str.SSUPDATE64.EXE
lea rcx, [rbp + 0x1180]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rax, str.0D3C4F0D_1C11_47bc_AD1C_BAB98712DBFB
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
lea r8, [0x1402c5050]
mov edx, 0x104
lea rcx, [rbp + 0x180]
call fcn.14000b150
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x180]
lea r8, [rbp + 0x1180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, 0x410
lea rdx, [rbp + 0x19a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x19a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401a808d
xor edx, edx
lea rcx, [rbp + 0x19a0]
call fcn.1401a1160
cmp eax, 0xffffffff
je 0x1401a807e
test eax, eax
jne 0x1401a808d
mov edx, 0x802
jmp 0x1401a8083
mov edx, 0x803
xor r8d, r8d
xor ecx, ecx
call fcn.1401aa230
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14018ef40
mov rbx, rax
test rax, rax
je 0x1401a80dd
lea rax, vtable.CSABWorkingSetManager.0
mov qword [rbx], rax
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
lea rcx, [0x14028b028]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 8], rax
test rax, rax
je 0x1401a80e0
lea rdx, str.SetProcessWorkingSetSize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
jmp 0x1401a80e0
mov rbx, r13
mov qword [0x1403517e0], rbx
lea rcx, str.netprofm.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14034e658], r15
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov dword [rbp + 0xe0], 8
mov dword [rbp + 0xe4], 0x1ff
lea rcx, [rbp + 0xe0]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x140337eb0], edi
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x902
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor ecx, ecx
call fcn.140190750
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x904
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
call fcn.1401dca50
call fcn.1400df910
mov rbx, qword [0x14037adb0]
mov rcx, qword [0x140337ed8]
test rcx, rcx
je 0x1401a81f7
mov rax, qword [rcx]
mov edx, edi
call qword [rax]
mov qword [0x140337ed8], r13
mov rcx, qword [0x140337ed0]
test rcx, rcx
je 0x1401a81f7
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0x3e0]
mov qword [0x140337ed0], rbx
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x90e
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [0x14037adb0]
call fcn.1400d9680
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x912
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, r13d
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0x180]
call fcn.140249b10
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [rbp + 0x180], r13w
je 0x1401a8568
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x91e
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdx, str.SUPERAntiSpyware.com
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x923
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdx, [0x1402b3758]
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x928
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401a8568
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x92b
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x60000
lea r8d, [r9 + 3]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401a8563
mov qword [rsp + 0x78], r13
mov dword [rbp + 0x21f0], ebx
mov word [rbp + 0x21f4], 0x100
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov dl, 1
lea rcx, [rbp + 0x21f0]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1401a855a
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x54], xmm0
mov qword [rbp - 0x40], 5
mov dword [rbp - 0x60], 0x1301ff
mov dword [rbp - 0x5c], 2
mov dword [rbp - 0x58], 3
mov dword [rbp - 0x44], r13d
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x70], r13
lea r9, [rbp - 0x70]
xor r8d, r8d
lea rdx, [rbp - 0x60]
mov esi, 1
mov ecx, esi
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
jne 0x1401a854f
mov qword [rsp + 0x30], r13
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8d, [rsi + 3]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
cmove ebx, esi
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x931
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test ebx, ebx
jne 0x1401a85f0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x936
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor eax, eax
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x160], rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x942
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rcx, str.SSUPDATE_RebootRequired
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
test ax, ax
je 0x1401a8833
call fcn.140249b10
mov r8d, 0x945
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9d, reloc.WSOCK32.dll_gethostbyname
lea r8, str.Restart_Required
lea rdx, str.SUPERAntiSpyware_must_restart_Windows_to_complete_the_update_process._r_n_r_nWould_you_like_to_restart_now_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x1401a882c
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
lea r8, str.ncsSABRebootSystem
lea rdx, [0x1402862f8]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
call fcn.1400fb560
mov qword [rbp + 0x21f0], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x21f0]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1401a87c3
lea r8, [rsp + 0x7c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [rsp + 0x78], edi
mov dword [rbp - 0x7c], 2
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, qword [rbp + 0x21f0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [0x14037adb0]
test rcx, rcx
je 0x1401a87e1
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 6]
call qword [rax + 0x290]
jmp 0x1401a87ed
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
nop
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
lea r8, str.ncsSABRebootSystem
lea rdx, str._s___Leavex
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
xor eax, eax
jmp 0x1401aa203
call fcn.140249b10
mov r8d, 0x94c
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
call fcn.1400f9a40
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x963
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14018ef40
mov r12, rax
test rax, rax
je 0x1401a89e2
lea rax, vtable.CSingularApplicationManager.0
mov qword [r12], rax
mov qword [r12 + 0x10], r13
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x35e
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9d, edi
mov r8d, edi
lea rdx, str.AcquireSingularProcessLock___Enter
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
xor edx, edx
mov r8d, 0xff3
lea rcx, [rbp + 0x18d]
call fcn.140249b10
movsd xmm0, qword [str.Local_sasapp]
movsd qword [rbp + 0x180], xmm0
mov eax, dword [0x1402c49f0]
mov dword [rbp + 0x188], eax
movzx eax, byte [0x1402c49f4]
mov byte [rbp + 0x18c], al
mov r9d, edi
mov r8d, edi
lea rdx, [rbp + 0x180]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
lea r8, [rbp + 0x180]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [r12 + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
mov r8d, edi
lea rcx, vtable.CSASApplicationLogManager.0
cmp eax, 0xb7
jne 0x1401a89cd
lea rdx, str.AcquireSingularProcessLock___Leave___Not_the_only_process
call fcn.140004a50
mov eax, r13d
mov dword [r12 + 8], eax
jmp 0x1401a89e5
lea rdx, str.AcquireSingularProcessLock___Leave___Only_Process
call fcn.140004a50
mov eax, edi
mov dword [r12 + 8], eax
jmp 0x1401a89e5
mov r12, r13
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x967
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r9d, edi
mov r8d, edi
lea rcx, vtable.CSASApplicationLogManager.0
cmp dword [r12 + 8], r13d
lea rdx, str.Only_Process
jne 0x1401a8a49
lea rdx, str.NOT_Only_Process
call fcn.140004a50
cmp dword [r12 + 8], r13d
jne 0x1401a8aa4
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x96d
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov edx, 0x2710
mov rcx, r12
call fcn.1401a13d0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x9da
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
call fcn.1400ddda0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x9df
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rcx, [0x14034eb30]
call fcn.140193f20
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x9e4
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
call fcn.140193b20
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x9e9
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, vtable.CSABString.0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], r13d
mov rcx, rdi
call fcn.140247068
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1401a8c01
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x74], edi
lea rdx, [rsp + 0x60]
lea rcx, str.uninstall
call fcn.1400df720
mov ebx, eax
mov qword [rsp + 0x60], rsi
add dword [rsp + 0x74], 0xffffffff
jne 0x1401a8c33
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401a8c33
call fcn.140247060
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
test ebx, ebx
je 0x1401a8c85
mov r8d, 0x9ee
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
call fcn.1401999d0
xor eax, eax
jmp 0x1401aa203
mov r8d, 0x9f7
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
call fcn.140226e20
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0x9fc
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, r14
xor ecx, ecx
call fcn.1400df970
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
test eax, eax
je 0x1401a8d49
call fcn.140249b10
mov r8d, 0xa01
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor eax, eax
jmp 0x1401aa203
call fcn.140249b10
mov r8d, 0xa06
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
inc dword [0x140351454]
mov qword [rbp - 0x68], r13
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0xf003f
xor r9d, r9d
lea r8, str.SoftwareSUPERAntiSpyware.comSUPERAntiSpyware
mov rdx, 0xffffffff80000002
call qword [rax + 0x128]
mov rsi, 0xffffffffffffffff
cmp qword [rbp - 0x68], r13
je 0x1401a8eb3
mov r9d, edi
mov r8d, edi
mov edx, 0xa0f
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
movzx eax, word [0x1402b6c8c]
mov word [rbp - 0x30], ax
movzx eax, byte [0x1402b6c8e]
mov byte [rbp - 0x2e], al
xor edx, edx
mov r8d, 0x101
lea rcx, [rbp - 0x2d]
call fcn.140249b10
cmp dword [0x1403508dc], r13d
je 0x1401a8e27
lea r8, [0x1402b3c20]
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.140253604
mov rcx, qword [0x14037adb0]
mov r10, qword [rcx]
lea rdx, [rbp - 0x30]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r13b
jne 0x1401a8e40
inc eax
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, str.ContextMenu
mov rdx, qword [rbp - 0x68]
call qword [r10 + 0x1b0]
mov r9d, edi
mov r8d, edi
mov edx, 0xa16
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
mov rdx, qword [rbp - 0x68]
call qword [rax + pe_nt_image_headers64]
mov r9d, edi
mov r8d, edi
mov edx, 0xa19
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0xa1c
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, vtable.CSABString.0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], r13d
mov rcx, rdi
call fcn.140247068
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1401a8f34
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x74], edi
lea r8, [rsp + 0x60]
lea rdx, str.CONTEXTMENU
mov rcx, r14
call fcn.1400df4c0
mov ebx, eax
lea rax, vtable.CSABString.0
mov qword [rsp + 0x60], rax
add dword [rsp + 0x74], 0xffffffff
jne 0x1401a8f70
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401a8f70
call fcn.140247060
test ebx, ebx
je 0x1401a8f91
mov r9d, edi
mov r8d, edi
mov edx, 0xa21
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov dword [0x14034e678], edi
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0xa25
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, vtable.CSABString.0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], r13d
mov rcx, rdi
call fcn.140247068
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1401a9012
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x74], edi
lea r8, [rsp + 0x60]
lea rdx, str.task
mov rcx, r14
call fcn.1400df4c0
mov ebx, eax
lea rax, vtable.CSABString.0
mov qword [rsp + 0x60], rax
add dword [rsp + 0x74], 0xffffffff
jne 0x1401a904e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401a904e
call fcn.140247060
test ebx, ebx
je 0x1401a907f
mov r9d, edi
mov r8d, edi
mov edx, 0xa2a
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov eax, dword [0x14034e674]
cmp dword [0x140350790], r13d
cmove eax, edi
mov dword [0x14034e674], eax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
mov r8d, 0xa2f
lea rdx, [0x140286ae4]
lea rcx, [rbp - 0x30]
call fcn.140006bc0
mov r9d, edi
mov r8d, edi
lea rdx, [rbp - 0x30]
lea rcx, vtable.CSASApplicationLogManager.0
mov rax, qword [vtable.CSASApplicationLogManager.0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, r12
call fcn.140193300
mov r9d, edi
mov r8d, edi
lea rcx, vtable.CSASApplicationLogManager.0
test eax, eax
jne 0x1401a9145
mov edx, 0xa73
call fcn.14007ee60
mov edx, 0x1388
mov rcx, r12
call fcn.1401a13d0
mov rbx, rax
test rax, rax
je 0x1401a9127
mov r9d, edi
mov r8d, edi
mov edx, 0xa78
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x20c
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageA]
mov r9d, edi
mov r8d, edi
mov edx, 0xa7e
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov eax, esi
jmp 0x1401aa203
mov edx, 0xa84
call fcn.14007ee60
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, 0x8000
test bx, ax
je 0x1401a919d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1401a919d
mov ecx, send
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1401a919d
xor r9d, r9d
lea r8, [0x140296e88]
lea rdx, str.CtrlShiftAlt_Are_Pressed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, edi
mov r8d, edi
mov edx, 0xa8a
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1401a9260
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1401a9260
mov r9d, edi
mov r8d, edi
mov edx, 0xa91
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r9d, 4
lea r8, [0x140296e88]
lea rdx, str.CtrlShift_Are_Pressed_r_n_r_nDo_you_wish_to_remove_SUPERAntiSpyware_from_startup_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x1401a9260
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x180]
call fcn.140249b10
mov r8d, 0x410
lea rdx, [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rbp + 0x180]
lea rcx, [0x140296e88]
call fcn.1400ea960
xor eax, eax
jmp 0x1401aa203
mov r9d, edi
mov r8d, edi
mov edx, 0xaa1
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.140249b10
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x180]
call fcn.140249b10
mov dword [rbp + 0x21f0], 0x800
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rbp + 0x21f0]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
lea r9, str.Start_Page
lea r8, str.SoftwareMicrosoftInternet_ExplorerMain
mov rdx, 0xffffffff80000001
call qword [rax + 0x1c0]
test eax, eax
je 0x1401a9336
mov rcx, qword [0x14037adb0]
mov r10, qword [rcx]
lea r8, [rbp - 0x30]
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [r8 + rax], r13b
jne 0x1401a9300
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, str.Start_Page
lea r8, str.SoftwareMicrosoftInternet_ExplorerMain
mov rdx, 0xffffffff80000001
call qword [r10 + 0x1e0]
mov dword [rbp + 0x21f0], 0x800
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rbp + 0x21f0]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r13
lea r9, str.Start_Page
lea r8, str.SoftwareMicrosoftInternet_ExplorerMain
mov rdx, 0xffffffff80000002
call qword [rax + 0x1c0]
test eax, eax
je 0x1401a93cd
mov rcx, qword [0x14037adb0]
mov r10, qword [rcx]
lea r9, [rbp - 0x30]
mov rax, rsi
inc rax
cmp byte [r9 + rax], r13b
jne 0x1401a9397
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, str.Start_Page
lea r8, str.SoftwareMicrosoftInternet_ExplorerMain
mov rdx, 0xffffffff80000002
call qword [r10 + 0x1e0]
mov r9d, edi
mov r8d, edi
mov edx, 0xaa6
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea r9, [0x14034e670]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x1c]
call fcn.140002dc8
mov r9d, edi
mov r8d, edi
mov edx, 0xaab
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r9d, edi
mov r8d, edi
mov edx, 0xab0
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
cmp dword [0x1403508e8], r13d
je 0x1401a9530
mov r9d, edi
mov r8d, edi
mov edx, 0xab5
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov qword [rbp + 0x21f0], r13
lea rdx, [rbp + 0x21f0]
lea rcx, [0x140350800]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [rbp + 0x21f4]
mov dword [rbp - 0x6c], eax
mov eax, dword [rbp + 0x21f0]
mov dword [rbp - 0x70], eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rbp + 0x21f0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [rbp + 0x21f4]
mov dword [rsp + 0x7c], eax
mov eax, dword [rbp + 0x21f0]
mov dword [rsp + 0x78], eax
movabs rcx, 0xfffffa7fd71bc000
add rcx, qword [rsp + 0x78]
cmp rcx, qword [rbp - 0x70]
jbe 0x1401a9530
mov r9d, edi
mov r8d, edi
mov edx, 0xacd
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r9d, reloc.COMCTL32.dll_InitCommonControls
lea r8, str.SUPERAntiSpyware_Tech_Edition
lea rdx, str.SUPERAntiSpyware_definition_database_is_outdated._r_n_r_nPlease_visit_www.superantispyware.com_and_r_ndownload_a_new_SUPERAntiSpyware_Tech_Edition.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x1401a9512
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.https:__www.superantispyware.com
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r9d, edi
mov r8d, edi
mov edx, 0xad9
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor eax, eax
jmp 0x1401aa203
mov r9d, edi
mov r8d, edi
mov edx, 0xae0
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r9d, edi
mov r8d, edi
lea rdx, str.Start_Application
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, edi
mov r8d, edi
mov edx, 0xae4
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
test r14, r14
je 0x1401a9591
mov r9d, edi
mov r8d, edi
mov rdx, r14
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, edi
mov r8d, edi
mov edx, 0xaeb
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea r14, vtable.CSABString.0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x70], r13d
mov rcx, rdi
call fcn.140247068
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1401a95e7
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x74], edi
lea rdx, [rsp + 0x60]
lea rcx, str.startwithwindows
call fcn.1400df720
mov ebx, eax
mov qword [rsp + 0x60], r14
add dword [rsp + 0x74], 0xffffffff
jne 0x1401a9619
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401a9619
call fcn.140247060
test ebx, ebx
je 0x1401a96b4
mov r9d, edi
mov r8d, edi
mov edx, 0xaf0
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x180]
call fcn.140249b10
lea r8, [0x14034ea2c]
mov edx, 0x410
lea rcx, [rbp + 0x180]
call fcn.140253604
lea rcx, [rbp + 0x180]
call fcn.1400fca30
lea rdx, str.SUPERAntiSpyware.exe
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov r9d, r13d
cmp eax, 0xffffffff
setne r9b
mov r8d, 0x400
lea rdx, [0x14034ea2c]
lea rcx, [0x140296e88]
call fcn.1400ea960
mov r9d, edi
mov r8d, edi
mov edx, 0xafc
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r9d, edi
mov r8d, edi
mov edx, 0xb04
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov dword [rbp + 0x120], 3
lea rax, [0x1401a2a60]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], r15
mov edx, 0x7f00
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x140], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp + 0x148], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x150], xmm0
lea rbx, str.SUPERANTISPYWARE
mov qword [rbp + 0x160], rbx
mov r9d, edi
mov r8d, edi
mov edx, 0xb12
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rcx, [rbp + 0x120]
call qword [sym.imp.USER32.dll_RegisterClassA]
mov r9d, edi
mov r8d, edi
mov edx, 0xb17
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, [0x140296e88]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
mov r9d, edi
mov r8d, edi
mov edx, 0xb26
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov r9d, edi
mov r8d, edi
mov edx, 0xb2b
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
cmp dword [0x14034e674], r13d
jne 0x1401a984b
mov r9d, edi
mov r8d, edi
mov edx, 0xb30
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor ecx, ecx
call fcn.140226ab0
mov r9d, edi
mov r8d, edi
mov edx, 0xb35
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r9d, edi
mov r8d, edi
mov edx, 0xb38
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
lea rdx, str.SABACCELERATORS
mov rcx, qword [0x14034e658]
call qword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov r13, rax
mov r9d, edi
mov r8d, edi
mov edx, 0xb3d
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov rcx, qword [0x1403517e0]
call fcn.140194510
mov r9d, edi
mov r8d, edi
mov edx, 0xb42
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x1401a9b22
cmp dword [rbp + 0xf0], 0x100
jne 0x1401a9a1a
cmp qword [rbp + 0xf8], 9
jne 0x1401a9a1a
call qword [sym.imp.USER32.dll_GetFocus]
mov rbx, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor r8d, r8d
xor edx, edx
test ax, ax
jns 0x1401a9997
mov rcx, qword [0x1403516a0]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140351698]
cmp rbx, rax
jne 0x1401a9942
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1401a9b05
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rdx, rax
mov r8d, edi
mov rcx, qword [0x140351698]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
cmp rbx, rax
jne 0x1401a9a1a
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1403516a0]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rdx, rax
mov r8d, edi
mov rcx, qword [0x1403516a0]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1401a9b05
mov rcx, qword [0x140351698]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x1403516a0]
cmp rbx, rax
jne 0x1401a99c9
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1401a9b05
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rdx, rax
mov r8d, edi
mov rcx, qword [0x1403516a0]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
cmp rbx, rax
jne 0x1401a9a1a
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140351698]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rdx, rax
mov r8d, edi
mov rcx, qword [0x140351698]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1401a9b05
lea r8, [rbp + 0xe8]
mov rdx, r13
mov rcx, qword [0x14034e650]
call qword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x1401a9b05
mov rcx, qword [0x1403516a0]
test rcx, rcx
je 0x1401a9a5a
lea rdx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x1401a9b05
mov rcx, qword [0x140351698]
test rcx, rcx
je 0x1401a9a7b
lea rdx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x1401a9b05
mov rbx, qword [0x14037cae0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401a9aeb
mov edx, SafeArrayGetDim
mov rcx, rbx
call fcn.1400dda20
mov rdi, rax
test rax, rax
je 0x1401a9ae6
mov rcx, qword [rax + 0x20]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x1401a9ad2
mov rcx, qword [rbx + 0x10]
lea rdx, [rbp + 0xe8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x1401a9add
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0x20]
jne 0x1401a9ab0
xor eax, eax
lea edi, [rax + 1]
test eax, eax
jne 0x1401a9b05
jmp 0x1401a9aeb
mov edi, 1
mov eax, edi
jmp 0x1401a9ad7
mov edi, 1
lea rcx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x1401a98d0
mov r9d, edi
mov r8d, edi
mov edx, 0xb8b
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov edx, edi
mov rcx, qword [0x14037c8c0]
call fcn.140190d20
cmp qword [0x14037af78], 0
je 0x1401a9b87
mov r9d, edi
mov r8d, edi
mov edx, 0xb93
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov edx, 0xffffffff
mov rcx, qword [0x14037af78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14037af78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, edi
mov r8d, edi
mov edx, 0xb9c
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.1400ff750
mov r9d, edi
mov r8d, edi
mov edx, 0xba1
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov rdi, qword [0x14037c2a8]
test rdi, rdi
je 0x1401a9c2b
mov dword [rdi + 0x40], 1
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, 0xffffffff
mov rcx, qword [0x14037c2a0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14037c2a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x14037c2a8]
test rbx, rbx
je 0x1401a9c2b
mov rcx, rbx
call fcn.14018e730
mov edx, WSACleanup
mov rcx, rbx
call fcn.140247060
call fcn.14022ecf0
mov ebx, 1
mov r9d, ebx
mov r8d, ebx
mov edx, 0xbae
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.140230120
mov r9d, ebx
mov r8d, ebx
mov edx, 0xbb1
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
call fcn.1401b3950
mov r9d, ebx
mov r8d, ebx
mov edx, 0xbb6
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
mov r9d, ebx
mov r8d, ebx
lea rdx, str.delete___g_poSABTrayIcon
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, qword [0x1403516b8]
test rcx, rcx
je 0x1401a9cb0
mov rax, qword [rcx]
mov edx, ebx
call qword [rax]
xor edi, edi
mov qword [0x1403516b8], rdi
mov r9d, ebx
mov r8d, ebx
mov edx, 0xbbc
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.14007ee60
cmp qword [0x14037adc8], rdi
je 0x1401a9f80
cmp dword [0x140350898], edi
je 0x1401a9f80
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rdi
mov dword [rbp - 0x78], 4
lea ecx, [rdi + 5]
call fcn.140247068
mov qword [rbp - 0x80], rax
test rax, rax
je 0x1401a9d2e
mov r8d, dword [rbp - 0x78]
inc r8d
lea rdx, [0x140287fe4]
mov rcx, rax
call fcn.1402496a0
mov dword [rbp - 0x74], ebx
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], 4
mov ecx, 5
call fcn.140247068
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1401a9d6e
mov r8d, dword [rsp + 0x70]
inc r8d
lea rdx, [0x140287fe4]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x74], ebx
cmp dword [0x14035089c], edi
je 0x1401a9f3a
lea r14, [0x140350584]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax], dil
jne 0x1401a9d90
test rax, rax
je 0x1401a9f33
mov rbx, rsi
inc rbx
cmp byte [r14 + rbx], dil
jne 0x1401a9da5
lea eax, [rbx + 1]
mov r15d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
test rax, rax
je 0x1401a9dd1
mov r8d, r15d
mov rdx, r14
mov rcx, rax
call fcn.1402496a0
mov r14, qword [rbp - 0x80]
mov ecx, dword [rbp - 0x78]
inc ecx
add ecx, ebx
call fcn.140247068
mov rbx, rax
test r14, r14
je 0x1401a9e1d
mov rdx, r14
mov r8, rax
sub r8, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401a9e00
mov rcx, r14
call fcn.140247060
mov qword [rbp - 0x80], rbx
jmp 0x1401a9e21
mov qword [rbp - 0x80], rax
test rbx, rbx
je 0x1401a9e4c
mov ecx, dword [rbp - 0x78]
add rcx, rbx
mov r8, r15
mov rdx, rdi
call fcn.1402496a0
mov rcx, qword [rbp - 0x80]
mov rax, rsi
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x1401a9e40
mov dword [rbp - 0x78], eax
test rdi, rdi
je 0x1401a9e59
mov rcx, rdi
call fcn.140247060
lea r14, [0x140350688]
mov rbx, rsi
inc rbx
cmp byte [r14 + rbx], 0
jne 0x1401a9e63
lea eax, [rbx + 1]
mov r15d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
test rax, rax
je 0x1401a9e90
mov r8d, r15d
mov rdx, r14
mov rcx, rax
call fcn.1402496a0
mov r14, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x70]
inc ecx
add ecx, ebx
call fcn.140247068
mov rbx, rax
test r14, r14
je 0x1401a9ede
mov rdx, r14
mov r8, rax
sub r8, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1401a9ec0
mov rcx, r14
call fcn.140247060
mov qword [rsp + 0x68], rbx
jmp 0x1401a9ee3
mov qword [rsp + 0x68], rax
test rbx, rbx
je 0x1401a9f0d
mov ecx, dword [rsp + 0x70]
add rcx, rbx
mov r8, r15
mov rdx, rdi
call fcn.1402496a0
mov rax, qword [rsp + 0x68]
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x1401a9f00
mov dword [rsp + 0x70], esi
test rdi, rdi
je 0x1401a9f1a
mov rcx, rdi
call fcn.140247060
lea rax, [rsp + 0x78]
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x58], rax
mov ebx, 1
xor edi, edi
lea r14, vtable.CSABString.0
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, qword [0x14034e4d8]
call fcn.1401a06f0
mov qword [rsp + 0x60], r14
add dword [rsp + 0x74], 0xffffffff
jne 0x1401a9f67
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401a9f67
call fcn.140247060
mov qword [rsp + 0x78], r14
add dword [rbp - 0x74], 0xffffffff
jne 0x1401a9f80
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1401a9f80
call fcn.140247060
mov r9d, ebx
mov r8d, ebx
lea rdx, str.ncsSABScannerUnInit
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
call fcn.1401fd550
mov rcx, r13
call qword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov r9d, ebx
mov r8d, ebx
lea rdx, str.WinMain___ncsLIBSaveConfigurationData
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
call fcn.1400fb560
mov r9d, ebx
mov r8d, ebx
lea rdx, str.WinMain___HtmlHelp
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, dword [0x14034e670]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x1d]
call fcn.140002dc8
mov r9d, ebx
mov r8d, ebx
lea rdx, str.if___g_poSABProcessListManager__
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, qword [0x1403517c8]
test rcx, rcx
je 0x1401aa0b0
add rcx, 0xdb8
call fcn.140033180
test eax, eax
je 0x1401aa03e
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.1400382a0
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140038400
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.14002a1a0
mov r9d, ebx
mov r8d, ebx
lea rdx, str.delete___g_poSABProcessListManager___Enter
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, qword [0x1403517c8]
test rcx, rcx
je 0x1401aa090
mov rax, qword [rcx]
mov edx, ebx
call qword [rax]
mov r9d, ebx
mov r8d, ebx
lea rdx, str.delete___g_poSABProcessListManager___Leave
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov qword [0x1403517c8], rdi
mov rcx, qword [0x1403517f8]
test rcx, rcx
je 0x1401aa0ca
mov rax, qword [rcx]
mov edx, ebx
call qword [rax]
mov qword [0x1403517f8], rdi
mov r9d, ebx
mov r8d, ebx
lea rdx, str.WinMain___OleUninitialize
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
call qword [sym.imp.ole32.dll_OleUninitialize]
mov r9d, ebx
mov r8d, ebx
lea rdx, str.WinMain___Leave
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov r9d, ebx
mov r8d, ebx
lea rdx, str.CloseLog
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rdx, qword [0x140337ea8]
test rdx, rdx
je 0x1401aa134
mov rcx, qword [0x140337ed0]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov r9d, ebx
mov r8d, ebx
lea rdx, str.WinMain___DestroySDKFunctionsObject
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov dword [0x140337eb0], edi
mov rcx, qword [0x14037adb0]
test rcx, rcx
je 0x1401aa187
mov rdx, qword [0x14037ae20]
test rdx, rdx
je 0x1401aa177
call fcn.140082600
mov rcx, qword [0x14037adb0]
test rcx, rcx
je 0x1401aa187
mov rax, qword [rcx]
mov edx, ebx
call qword [rax + 0x3e0]
mov rax, qword [r12]
mov edx, ebx
mov rcx, r12
call qword [rax]
cmp dword [0x14037adbc], 0
je 0x1401aa1fd
mov r8d, 0x410
lea rdx, [rbp + 0x1180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rbp + 0x1180]
mov edx, 0x410
lea rcx, [rbp + 0x180]
call fcn.140251ec0
lea rcx, [rbp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov dword [rsp + 0x28], ebx
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, str._showui
lea r8, [rbp + 0x1180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [rbp + 0xf8]
lea r11, [rsp + 0x22c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret