Function at 0x140014980
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x440
mov rax, qword [0x1400a3758]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov dword [rbp - 0x58], r9d
mov edi, r8d
mov dword [rbp - 0x5c], r8d
mov dword [rbp + 8], edx
mov r14, rcx
mov qword [rbp - 0x78], rcx
mov rax, qword [rbp + 0x3d0]
mov qword [rbp - 0x50], rax
mov r13, qword [rbp + 0x380]
mov qword [rbp - 0x30], r13
mov rax, qword [rbp + 0x388]
mov qword [rbp - 8], rax
mov r12, qword [rbp + 0x390]
mov qword [rbp - 0x20], r12
mov rax, qword [rbp + 0x398]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x3b0]
mov qword [rbp + 0x10], rax
mov r15, qword [rbp + 0x3b8]
mov qword [rbp - 0x38], r15
mov eax, dword [rbp + 0x3c0]
mov dword [rbp - 0x48], eax
mov rax, qword [rbp + 0x3c8]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x3d8]
mov qword [rbp - 0x70], rax
mov ecx, dword [0x1400a6df8]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
xor ebx, ebx
mov eax, dword [rdx + rax]
cmp dword [0x1400a6630], eax
jg 0x14001675c
cmp edi, 0xffffffff
jne 0x1400150be
cmp r14, 1
je 0x1400150be
mov ecx, 0xf0
call fcn.14004bd50
mov rdi, rax
mov qword [rbp - 0x68], rax
mov rsi, 0xffffffffffffffff
test rax, rax
je 0x140014bc9
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 8], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0x18], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0x20], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0x28], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0x30], rax
mov word [rax], bx
mov qword [rdi + 0x60], rbx
mov qword [rdi + 0x68], rbx
mov qword [rdi + 0x70], rbx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0x90], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0x98], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0xa0], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0xa8], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0xb0], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0xb8], rax
mov word [rax], bx
lea ecx, [rsi + 3]
call fcn.140059d40
mov qword [rdi + 0xc8], rax
mov word [rax], bx
mov dword [rdi], ebx
mov byte [rdi + 0x10], bl
mov qword [rdi + 0x48], rsi
mov byte [rdi + 0x12], bl
mov word [rdi + 0x38], bx
mov qword [rdi + 0x40], rbx
mov byte [rdi + 0xc1], bl
mov qword [rdi + 0x7c], rbx
mov dword [rdi + 0x84], ebx
xorps xmm0, xmm0
movups xmmword [rdi + 0xd8], xmm0
mov qword [rdi + 0xe8], rbx
mov qword [rdi + 0xd0], rbx
mov qword [rdi + 0x88], rsi
mov dword [rdi + 0x50], esi
jmp 0x140014bcc
mov rdi, rbx
mov rdx, qword [r12]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], bx
jne 0x140014bd3
test rax, rax
je 0x140014d61
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140014c0e
mov rbx, qword [rdi + 0xa8]
mov rcx, rax
call fcn.140059d48
mov qword [rdi + 0xa8], rax
mov rcx, rbx
call fcn.140059d2c
xor ebx, ebx
lea rax, [rdi + 0x84]
lea rcx, [rdi + 0x90]
lea r10, [rdi + 0x88]
lea r8, [rdi + 0xb8]
lea rdx, [rdi + 0xb0]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r10
lea r9, [rdi + 0xa8]
mov rcx, qword [r12]
call fcn.1400182b0
mov rax, qword [r12]
mov rbx, qword [rdi + 0x30]
lea r12, [0x14007a7c4]
mov rcx, r12
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rdi + 0x30], rax
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [rbp - 0x28]
mov rax, qword [rax]
mov rbx, qword [rdi + 0x98]
mov rcx, r12
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rdi + 0x98], rax
mov rcx, rbx
call fcn.140059d2c
mov r8, qword [rbp + 0x18]
mov rax, qword [r8]
mov rbx, qword [rdi + 0xa0]
mov rcx, r12
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rdi + 0xa0], rax
mov rcx, rbx
call fcn.140059d2c
mov eax, dword [rbp + 0x3e0]
test eax, eax
js 0x140014ce9
mov dword [rdi + 0x50], eax
jmp 0x140014d9d
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rbp + 0x30]
call fcn.14004e310
mov dword [rsp + 0x20], 0x100
mov r9d, 0x2b8
lea r8, [rbp + 0x30]
xor edx, edx
mov rcx, qword [rdi + 0x30]
call fcn.14002cee0
cmp qword [rbp + 0x30], 0
jne 0x140014d2f
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1002
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
mov r8, qword [rbp + 0x30]
mov edx, esi
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [rdi + 0x50], eax
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x140014d9d
mov qword [rbp - 0x50], rbx
mov rax, qword [rbp - 8]
mov rax, qword [rax]
lea r12, [0x14007a7c4]
mov rcx, r12
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rbp - 0x50], rax
xor ecx, ecx
call fcn.140059d2c
lea rdx, [rdi + 0x90]
lea rcx, [rbp - 0x50]
call fcn.140017cb0
mov rax, qword [r13]
mov rbx, qword [rdi + 0x18]
mov rcx, r12
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rdi + 0x18], rax
mov rcx, rbx
call fcn.140059d2c
mov eax, dword [rbp + 8]
mov dword [rdi + 0x54], eax
movzx eax, byte [0x1400a36f0]
mov byte [rdi + 0xc0], al
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
mov rbx, qword [rdi + 0xc8]
mov rcx, r12
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rdi + 0xc8], rax
mov rcx, rbx
call fcn.140059d2c
mov r14d, 1
mov dword [rdi + 0x78], r14d
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov rbx, qword [rdi + 0x28]
mov rcx, r12
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rdi + 0x28], rax
mov rcx, rbx
call fcn.140059d2c
mov r8, qword [rbp + 0x10]
mov rax, qword [r8]
mov rbx, qword [rdi + 0x20]
test rax, rax
cmovne r12, rax
mov rcx, r12
call fcn.140059d48
mov qword [rdi + 0x20], rax
mov rcx, rbx
call fcn.140059d2c
mov word [rdi + 0x10], 0
mov dword [rdi + 0x58], esi
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [rdi + 0x7c], eax
mov eax, dword [rbp - 0x58]
mov dword [rdi], eax
mov eax, dword [rbp - 0x48]
mov byte [rdi + 0x12], al
xor ebx, ebx
mov word [rdi + 0x38], bx
mov rcx, qword [rbp - 0x70]
mov qword [rdi + 0xe8], rcx
mov qword [rdi + 0xd0], r15
mov byte [rdi + 0xc1], r14b
test al, al
jne 0x140014f20
lea edx, [rbx + 0x5c]
mov rcx, qword [r13]
call fcn.14004eb30
test rax, rax
je 0x140014f20
lea rdx, str.AutorunsDisabled
mov rcx, qword [r13]
call fcn.14004ebac
mov r13, rax
test rax, rax
je 0x140014f20
lea r15, [rax + 2]
lea rdx, str.AutorunsDisabled
mov rcx, r15
call fcn.14004ebac
test rax, rax
je 0x140014f0a
lea rdx, str.AutorunsDisabled
mov rcx, r15
call fcn.14004ebac
mov r13, rax
lea r15, [rax + 2]
lea rdx, str.AutorunsDisabled
mov rcx, r15
call fcn.14004ebac
test rax, rax
jne 0x140014ee0
lea rcx, [r13 + 0x20]
nop
movzx eax, word [rcx]
mov word [rcx - 0x22], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140014f10
cmp byte [rdi + 0x12], bl
jne 0x140014fa0
lea rdx, str.AutorunsDisabled
mov rcx, qword [rdi + 0x28]
call fcn.14004ebac
mov r13, rax
test rax, rax
je 0x140014fa0
lea r15, [rax + 2]
lea rdx, str.AutorunsDisabled
mov rcx, r15
call fcn.14004ebac
test rax, rax
je 0x140014f8a
nop word [rax + rax]
lea rdx, str.AutorunsDisabled
mov rcx, r15
call fcn.14004ebac
mov r13, rax
lea r15, [rax + 2]
lea rdx, str.AutorunsDisabled
mov rcx, r15
call fcn.14004ebac
test rax, rax
jne 0x140014f60
lea rcx, [r13 + 0x20]
nop
movzx eax, word [rcx]
mov word [rcx - 0x22], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140014f90
mov r15, qword [rbp - 0x10]
mov rdx, qword [r15]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x140014fb0
test rax, rax
je 0x140015005
mov rcx, qword [rdi + 0x28]
call fcn.14004ebac
mov qword [rdi + 0x40], rax
lea rcx, [rax + 2]
mov rdx, qword [r15]
call fcn.14004ebac
test rax, rax
je 0x140015005
nop dword [rax]
mov rcx, qword [rdi + 0x40]
add rcx, 2
mov rdx, qword [r15]
call fcn.14004ebac
mov qword [rdi + 0x40], rax
lea rcx, [rax + 2]
mov rdx, qword [r15]
call fcn.14004ebac
test rax, rax
jne 0x140014fe0
mov qword [rbp - 8], rdi
lock xadd dword [0x1400a4afc], r14d
inc r14d
mov dword [rdi + 0x5c], r14d
lea r10, [0x1400a6090]
mov rax, r10
lea rcx, [0x1400a6590]
mov r11, qword [rbp - 0x78]
nop
cmp qword [rax], r11
je 0x140015048
inc ebx
add rax, 0x40
cmp rax, rcx
jl 0x140015030
mov eax, dword [rdi + 0x5c]
jmp 0x14001672c
movsxd rax, ebx
shl rax, 6
mov dword [rdi + 0x58], esi
lea r9, [rax + r10]
mov rbx, qword [rax + r10 + 0x28]
mov rcx, qword [r9 + 0x28]
cmp rcx, qword [r9 + 0x30]
je 0x1400150a6
cmp rbx, rcx
jne 0x14001507a
mov qword [rcx], rdi
add qword [r9 + 0x28], 8
mov eax, dword [rdi + 0x5c]
jmp 0x14001672c
mov rax, qword [rcx - 8]
mov qword [rcx], rax
add qword [r9 + 0x28], 8
mov r8, rcx
sub r8, rbx
sub r8, 8
sub rcx, r8
mov rdx, rbx
call fcn.14004fcc0
mov qword [rbx], rdi
mov eax, dword [rdi + 0x5c]
jmp 0x14001672c
lea r8, [rbp - 8]
mov rdx, rbx
lea rcx, [r9 + 0x20]
call fcn.140013570
mov eax, dword [rdi + 0x5c]
jmp 0x14001672c
mov ecx, 2
call fcn.140059d40
mov qword [rbp - 0x50], rax
mov word [rax], bx
mov ecx, 2
call fcn.140059d40
mov r12, rax
mov qword [rbp], rax
mov word [rax], bx
mov ecx, 2
call fcn.140059d40
mov r15, rax
mov qword [rbp - 0x40], rax
mov word [rax], bx
mov ecx, 2
call fcn.140059d40
mov r13, rax
mov qword [rbp - 0x10], rax
mov word [rax], bx
lea rax, [fcn.1400072e0]
mov qword [rsp + 0x20], rax
lea r9, [0x140013ea0]
mov edx, 8
lea r8d, [rdx - 2]
lea rcx, [rbp + 0x2f0]
call fcn.14004bfcc
nop
mov ecx, 2
call fcn.140059d40
mov r14, rax
mov qword [rbp + 0x20], rax
mov word [rax], bx
mov ecx, 2
call fcn.140059d40
mov rsi, rax
mov qword [rbp - 0x68], rax
mov word [rax], bx
mov byte [rbp - 0x80], 0
lea rdi, [0x14007a7c4]
cmp dword [rbp - 0x58], 0x11
jne 0x1400151c6
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x1400151c6
mov rax, qword [rax + 0x18]
mov rbx, r14
mov rcx, rdi
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov r14, rax
mov qword [rbp + 0x20], rax
mov rcx, rbx
call fcn.140059d2c
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx + 0x20]
mov rbx, rsi
mov rcx, rdi
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov rsi, rax
mov qword [rbp - 0x68], rax
mov rcx, rbx
call fcn.140059d2c
xor ebx, ebx
mov r8d, 0xa
lea rdx, str._Verified_
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
call fcn.14005bd3c
mov dword [rbp + 8], eax
test eax, eax
sete byte [rbp - 0x60]
cmp dword [0x1400a48ec], 0
je 0x140015217
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140015217
mov rcx, rax
call fcn.140046000
mov byte [rbp - 0x80], al
cmp dword [0x1400a48e8], 0
je 0x140015241
test al, al
jne 0x140015241
jmp 0x1400166d7
cmp dword [0x1400a489c], 0
je 0x140015241
mov r8d, 0xa
lea rdx, str._Verified_
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
call fcn.14005bd3c
test eax, eax
je 0x1400166d7
mov qword [rbp - 0x70], rbx
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov rcx, rdi
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rbp - 0x70], rax
xor ecx, ecx
call fcn.140059d2c
mov rax, qword [rbp - 0x28]
cmp dword [rbp + 8], 0
cmove rax, qword [rbp - 0x18]
mov qword [rbp - 0x58], rbx
mov rax, qword [rax]
mov rcx, rdi
test rax, rax
cmovne rcx, rax
call fcn.140059d48
mov qword [rbp - 0x58], rax
xor ecx, ecx
call fcn.140059d2c
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x58]
movzx ecx, byte [rbp - 0x60]
call fcn.14001a1b0
test al, al
jne 0x1400166d7
mov rdi, 0xffffffffffffffff
mov r8d, dword [rbp - 0x5c]
cmp r8d, edi
je 0x140015417
mov edx, ebx
mov r9, rbx
lea r10, [0x1400a6090]
mov rax, r10
lea rcx, [0x1400a6590]
mov r11, qword [rbp - 0x78]
nop dword [rax + rax]
cmp qword [rax], r11
je 0x1400152f5
inc edx
inc r9
add rax, 0x40
cmp rax, rcx
jl 0x1400152e0
jmp 0x14001534c
movsxd rax, edx
shl rax, 6
mov rcx, qword [rax + r10 + 0x20]
cmp rcx, qword [rax + r10 + 0x28]
je 0x14001534c
nop dword [rax + rax]
mov rbx, qword [rcx]
cmp dword [rbx + 0x5c], r8d
je 0x14001534c
mov rax, qword [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
cmp rax, rdx
je 0x140015338
mov rbx, qword [rax]
cmp dword [rbx + 0x5c], r8d
je 0x14001534c
add rax, 8
cmp rax, rdx
jne 0x140015326
add rcx, 8
mov rax, r9
shl rax, 6
cmp rcx, qword [rax + r10 + 0x28]
jne 0x140015310
xor ebx, ebx
cmp qword [rbx + 0xe8], 0
jne 0x140015415
xor ecx, ecx
mov qword [rbp - 0x70], rcx
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov qword [rbp - 0x70], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r11, [rbx + 0x20]
lea rcx, [rbx + 0xc8]
lea rdx, [rbx + 0xa0]
lea r8, [rbx + 0x98]
lea r9, [rbx + 0x30]
lea r10, [rbx + 0x18]
mov dword [rsp + 0x80], edi
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 1
mov rax, qword [rbx + 0xd0]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r10
mov r9d, dword [rbx]
mov r8d, edi
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140014980
nop
mov rcx, qword [rbp - 0x70]
call fcn.140059d2c
mov qword [rbx + 0xe8], 1
mov r8d, dword [rbp - 0x5c]
xor ebx, ebx
cmp byte [0x1400a468e], 0
je 0x140015bd4
cmp r8d, 0xffffffff
je 0x140015a26
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x140015435
test rdi, rdi
je 0x140015491
lea rax, [rbp + 0x2f0]
cmp dword [0x1400a48a4], 0
cmove rax, rbx
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x50]
call fcn.1400182b0
mov r12, qword [rbp]
mov r15, qword [rbp - 0x40]
jmp 0x1400154af
mov rbx, r15
lea rcx, [0x14007a7c4]
call fcn.140059d48
mov r15, rax
mov qword [rbp - 0x40], rax
mov rcx, rbx
call fcn.140059d2c
movzx r9d, word [0x1400a2ce4]
mov r8, r15
lea rdx, str._s_c
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rax, qword [rbp - 0x30]
mov rdx, qword [rax]
lea rcx, [rbp - 8]
call fcn.14001f500
mov rbx, qword [rax]
movzx edi, word [0x1400a2ce4]
mov rdx, qword [0x1400a6628]
lea rcx, [rbp - 0x78]
call fcn.14001f500
mov qword [rsp + 0x20], rbx
mov r9d, edi
mov r8, qword [rax]
lea rdx, str._s_c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
mov rcx, qword [rbp - 8]
call fcn.140059d2c
movzx r8d, word [0x1400a2ce4]
mov rcx, qword [0x1400a6040]
cmp dword [rbp - 0x48], 0
lea rdx, str._cdisabled
je 0x14001554a
lea rdx, str._cenabled
call fcn.1400117d0
mov eax, dword [0x1400a4af8]
xor ebx, ebx
mov ecx, ebx
test al, 1
jne 0x140015568
nop dword [rax]
inc ecx
shr eax, 1
test al, 1
je 0x140015560
mov edx, ecx
shl rdx, 7
lea rax, [0x1400a2cf0]
add rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14001f500
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rax]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
mov rax, qword [0x1400a5b88]
test rax, rax
je 0x1400155bc
add rax, 0x210
jmp 0x1400155c3
lea rax, str.System_wide
movzx r8d, word [0x1400a2ce4]
mov r9, rax
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rdi, qword [rbp + 0x18]
mov rcx, qword [rdi]
call fcn.1400172d0
mov rdx, qword [rdi]
lea rcx, [rbp - 0x78]
call fcn.14001f500
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rax]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
cmp dword [0x1400a36f0], ebx
je 0x140015671
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
test rdx, rdx
je 0x140015788
cmp word [rdx], bx
je 0x140015788
lea rcx, [rbp - 0x78]
call fcn.14001f500
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rax]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
mov rdi, qword [rbp - 0x28]
mov rcx, qword [rdi]
call fcn.1400172d0
mov rdx, qword [rdi]
lea rcx, [rbp - 0x78]
call fcn.14001f500
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rax]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax]
lea rcx, [rbp - 0x78]
call fcn.14001f500
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rax]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
movzx r8d, word [0x1400a2ce4]
mov r9, r12
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov r8, qword [rbp + 0x10]
mov rdx, qword [r8]
lea rcx, [rbp - 0x78]
call fcn.14001f500
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rax]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbp - 0x78]
call fcn.140059d2c
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x1400158ff
cmp dword [rdi + 8], 1
jne 0x140015813
mov rax, qword [rdi + 0x48]
test rax, rax
je 0x140015813
mov rcx, qword [rax]
test rcx, rcx
je 0x140015813
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x140015813
mov rax, qword [rdi + 0x48]
test rax, rax
je 0x1400157e1
mov rcx, qword [rax]
jmp 0x1400157e4
mov rdi, qword [rbp - 0x28]
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400157c1
cmp word [rcx], bx
je 0x1400157c1
call fcn.1400172d0
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rdi]
lea rdx, str._c__Not_verified___s_
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
jmp 0x140015675
movzx r8d, word [0x1400a2ce4]
lea rdx, [0x140082f84]
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
jmp 0x140015675
mov rcx, rbx
mov edx, 0x2f
call fcn.14004eb30
test rax, rax
je 0x140015813
mov rax, qword [rdi + 0x48]
test rax, rax
je 0x140015801
mov rcx, qword [rax]
jmp 0x140015804
mov rcx, rbx
mov edx, 0x2f
call fcn.14004eb30
mov word [rax], 0x7c
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x140015841
mov rcx, qword [rax]
test rcx, rcx
je 0x140015841
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x140015841
mov rax, qword [rdi + 0x48]
test rax, rax
je 0x14001583c
mov rax, qword [rax]
jmp 0x140015848
mov rax, rbx
jmp 0x140015848
lea rax, str.Unknown
movzx r8d, word [0x1400a2ce4]
mov r9, rax
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x14001589a
mov rcx, qword [rax]
test rcx, rcx
je 0x140015885
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov rax, qword [rdi + 0x40]
jmp 0x140015887
mov ecx, ebx
test ecx, ecx
je 0x14001589a
test rax, rax
je 0x140015895
mov rax, qword [rax]
jmp 0x1400158a1
mov rax, rbx
jmp 0x1400158a1
lea rax, [0x140081cb0]
movzx r8d, word [0x1400a2ce4]
mov r9, rax
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x1400158ff
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400158ff
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x1400158ff
cmp byte [rbp - 0x80], bl
je 0x1400158ff
cmp byte [0x1400a468c], bl
je 0x1400158ff
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x1400158f3
mov rbx, qword [rax]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call fcn.140005440
cmp dword [0x1400a48a4], 0
je 0x1400159d8
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rbp + 0x2f0]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rbp + 0x2f8]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rbp + 0x308]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rbp + 0x310]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rbp + 0x300]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
movzx r8d, word [0x1400a2ce4]
mov r9, qword [rbp + 0x318]
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp dword [0x1400a48a8], 0
je 0x140015bbc
movzx r8d, word [0x1400a2ce4]
mov r9, r14
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
movzx r8d, word [0x1400a2ce4]
mov r9, rsi
lea rdx, str._c_s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
jmp 0x140015bbc
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp - 0x78]
call fcn.140013e60
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.140017cb0
mov eax, dword [0x1400a4af8]
test al, 1
jne 0x140015a58
nop dword [rax]
inc ebx
shr eax, 1
test al, 1
je 0x140015a50
movzx r15d, word [0x1400a2ce4]
mov rdi, qword [0x1400a5b88]
test rdi, rdi
je 0x140015a75
add rdi, 0x210
jmp 0x140015a7c
lea rdi, str.System_wide
mov edx, ebx
shl rdx, 7
lea rax, [0x1400a2cf0]
add rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14001f500
mov rcx, qword [rax]
movzx r9d, word [0x1400a2ce4]
mov rbx, qword [rbp - 0x30]
mov rax, qword [rbx]
mov dword [rsp + 0x80], r15d
mov dword [rsp + 0x78], r15d
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
mov r15, qword [rbp - 0x40]
mov r8, r15
lea rdx, str._s_c_s_c_c_c_s_c_s_c_c_c_c_c_c
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbp - 0x68]
call fcn.140059d2c
cmp qword [rbp - 0x38], 0
je 0x140015b33
movzx r8d, word [0x1400a2ce4]
mov r9d, r8d
lea rdx, str._c_c
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp dword [0x1400a48a4], 0
je 0x140015b69
movzx r8d, word [0x1400a2ce4]
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
mov r9d, r8d
lea rdx, str._c_c_c_c_c
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp dword [0x1400a48a8], 0
je 0x140015b90
movzx r8d, word [0x1400a2ce4]
mov r9d, r8d
lea rdx, str._c_c
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rax, qword [rbx]
mov rbx, qword [0x1400a6628]
test rax, rax
lea rcx, [0x14007a7c4]
cmovne rcx, rax
call fcn.140059d48
mov qword [0x1400a6628], rax
mov rcx, rbx
call fcn.140059d2c
lea rdx, [0x14007a934]
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
jmp 0x1400166a1
cmp byte [0x1400a468f], 0
je 0x1400161a4
cmp r8d, 0xffffffff
je 0x14001616f
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140015bf5
test rax, rax
je 0x140015c4f
lea rax, [rbp + 0x2f0]
cmp dword [0x1400a48a4], 0
cmove rax, rbx
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x50]
call fcn.1400182b0
mov r12, qword [rbp]
mov r15, qword [rbp - 0x40]
mov ecx, 1
call fcn.14005a668
mov qword [rbp - 0x78], rax
mov ecx, 0x3c
mov rdx, rax
call fcn.14005c798
lea rbx, str.item
mov ecx, 0x69
mov r13, qword [rbp - 0x78]
nop word [rax + rax]
mov rdx, r13
call fcn.14005c798
lea rbx, [rbx + 2]
movzx ecx, word [rbx]
test cx, cx
jne 0x140015c80
mov ecx, 0x3e
mov rdx, r13
call fcn.14005c798
mov rbx, qword [0x1400a6628]
mov ecx, 1
call fcn.14005a668
mov r9d, 1
mov r8, rbx
lea rdx, str.location
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp - 0x30]
mov rbx, qword [rax]
mov ecx, 1
call fcn.14005a668
mov r9d, 1
mov r8, rbx
lea rdx, str.itemname
mov rcx, rax
call fcn.14002b260
lea rax, str.Enabled
lea rbx, str.Disabled
cmp dword [rbp - 0x48], 0
cmovne rbx, rax
mov ecx, 1
call fcn.14005a668
mov rcx, rax
mov r9d, 1
mov r8, rbx
lea rdx, str.enabled
call fcn.14002b260
mov rax, qword [0x1400a5b88]
test rax, rax
je 0x140015d3f
add rax, 0x210
jmp 0x140015d46
lea rax, str.System_wide
mov qword [rbp - 0x78], rax
mov ebx, 1
mov ecx, ebx
call fcn.14005a668
mov rcx, rax
mov r9d, ebx
mov r8, qword [rbp - 0x78]
lea rdx, str.profile
call fcn.14002b260
mov r8, qword [rbp + 0x10]
mov rbx, qword [r8]
mov ecx, 1
call fcn.14005a668
mov r9d, 1
mov r8, rbx
lea rdx, str.launchstring
mov rcx, rax
call fcn.14002b260
mov r8, qword [rbp + 0x18]
mov rbx, qword [r8]
mov ecx, 1
call fcn.14005a668
mov r9d, 1
mov r8, rbx
lea rdx, [0x1400830a0]
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp - 0x28]
mov rbx, qword [rax]
mov ecx, 1
call fcn.14005a668
mov r9d, 1
mov r8, rbx
lea rdx, str.company
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp - 0x18]
mov rbx, qword [rax]
mov ecx, 1
call fcn.14005a668
mov r9d, 1
mov r8, rbx
lea rdx, str.signer
mov rcx, rax
call fcn.14002b260
mov ebx, 1
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, r12
lea rdx, [0x1400830d8]
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp - 0x20]
mov rbx, qword [rax]
mov ecx, 1
call fcn.14005a668
mov r9d, 1
mov r8, rbx
lea rdx, str.imagepath
mov rcx, rax
call fcn.14002b260
mov ebx, 1
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, r15
lea rdx, str.time
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140015f82
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140015ebd
mov rcx, qword [rcx]
test rcx, rcx
je 0x140015ebd
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x140015ebd
mov rax, qword [rbp - 0x38]
mov rax, qword [rax + 0x48]
xor ebx, ebx
test rax, rax
je 0x140015eb7
mov rax, qword [rax]
jmp 0x140015ec6
mov qword [rbp - 0x70], rbx
jmp 0x140015eca
lea rax, str.Unknown
xor ebx, ebx
mov qword [rbp - 0x70], rax
mov ecx, 1
call fcn.14005a668
mov rcx, rax
mov r9d, 1
mov r8, qword [rbp - 0x70]
lea rdx, str.vt_detection
call fcn.14002b260
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140015f24
mov rcx, qword [rcx]
test rcx, rcx
je 0x140015f24
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x140015f24
mov rax, qword [rbp - 0x38]
mov rax, qword [rax + 0x40]
test rax, rax
je 0x140015f1e
mov rax, qword [rax]
jmp 0x140015f2b
mov qword [rbp - 0x70], rbx
jmp 0x140015f2f
lea rax, [0x140081cb0]
mov qword [rbp - 0x70], rax
mov ecx, 1
call fcn.14005a668
mov rcx, rax
mov r9d, 1
mov r8, qword [rbp - 0x70]
lea rdx, str.vt_permalink
call fcn.14002b260
cmp byte [rbp - 0x80], 0
je 0x140015f7d
cmp byte [0x1400a468c], 0
je 0x140015f7d
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140015f71
mov rbx, qword [rcx]
mov r8, rbx
xor edx, edx
xor ecx, ecx
call fcn.140005440
mov ebx, 1
cmp dword [0x1400a48a4], 0
je 0x1400160a3
mov rax, qword [rbp + 0x2f0]
mov qword [rbp - 0x68], rax
cmp word [rax], 0
je 0x140015fbd
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, qword [rbp - 0x68]
lea rdx, str.md5hash
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp + 0x2f8]
mov qword [rbp - 0x68], rax
cmp word [rax], 0
je 0x140015feb
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, qword [rbp - 0x68]
lea rdx, str.sha1hash
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp + 0x308]
mov qword [rbp - 0x68], rax
cmp word [rax], 0
je 0x140016019
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, qword [rbp - 0x68]
lea rdx, str.pesha1hash
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp + 0x300]
mov qword [rbp - 0x68], rax
cmp word [rax], 0
je 0x140016047
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, qword [rbp - 0x68]
lea rdx, str.sha256hash
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp + 0x310]
mov qword [rbp - 0x68], rax
cmp word [rax], 0
je 0x140016075
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, qword [rbp - 0x68]
lea rdx, str.pesha256hash
mov rcx, rax
call fcn.14002b260
mov rax, qword [rbp + 0x318]
mov qword [rbp - 0x68], rax
cmp word [rax], 0
je 0x1400160a3
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, qword [rbp - 0x68]
lea rdx, str.impHash
mov rcx, rax
call fcn.14002b260
cmp dword [0x1400a48a8], 0
je 0x14001610b
mov rax, rdi
nop
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400160b0
test rax, rax
je 0x1400160e0
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, r14
lea rdx, str.wmi_query
mov rcx, rax
call fcn.14002b260
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x1400160e0
test rdi, rdi
je 0x14001610b
mov ecx, ebx
call fcn.14005a668
mov r9d, ebx
mov r8, rsi
lea rdx, str.script_language
mov rcx, rax
call fcn.14002b260
mov ecx, ebx
call fcn.14005a668
mov rbx, rax
mov ecx, 0x3c
mov rdx, rax
call fcn.14005c798
mov ecx, 0x2f
mov rdx, rbx
call fcn.14005c798
lea r13, str.item
mov ecx, 0x69
nop dword [rax + rax]
mov rdx, rbx
call fcn.14005c798
lea r13, [r13 + 2]
movzx eax, word [r13]
movzx ecx, ax
test ax, ax
jne 0x140016140
mov ecx, 0x3e
mov rdx, rbx
call fcn.14005c798
mov r13, qword [rbp - 0x10]
jmp 0x1400166d7
mov rax, qword [rbp - 0x30]
mov rax, qword [rax]
mov rbx, qword [0x1400a6628]
test rax, rax
lea rcx, [0x14007a7c4]
cmovne rcx, rax
call fcn.140059d48
mov qword [0x1400a6628], rax
mov rcx, rbx
call fcn.140059d2c
jmp 0x1400166a7
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
nop dword [rax + rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1400161b0
test rdi, rdi
je 0x14001620a
lea rax, [rbp + 0x2f0]
cmp dword [0x1400a48a4], 0
cmove rax, rbx
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x50]
call fcn.1400182b0
mov r12, qword [rbp]
mov r15, qword [rbp - 0x40]
mov rcx, qword [0x1400a6040]
cmp dword [rbp - 0x5c], 0xffffffff
je 0x140016239
lea rdx, [0x140083210]
call fcn.1400117d0
cmp dword [rbp - 0x48], 0
jne 0x140016245
lea rdx, str._DISABLED_
mov rcx, qword [0x1400a6040]
jmp 0x140016240
lea rdx, [0x14007a934]
call fcn.1400117d0
mov rax, qword [rbp - 0x30]
mov rax, qword [rax]
test rax, rax
lea rcx, [0x14007a7c4]
cmovne rcx, rax
call fcn.140059d48
mov rdi, rax
mov qword [rbp + 8], rax
xor ecx, ecx
call fcn.140059d2c
nop
cmp dword [rbp - 0x5c], 0xffffffff
jne 0x1400162b7
lea rdx, str.AutorunsDisabled
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax]
call fcn.14004ebac
test rax, rax
je 0x1400162b7
lea rdx, str.AutorunsDisabled
mov rcx, rdi
call fcn.14004ebac
mov word [rax - 2], bx
mov r8, rdi
lea rdx, [0x140082bac]
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
jmp 0x1400162d7
mov rax, qword [rbp - 0x30]
mov r8, qword [rax]
lea rdx, [0x140082bac]
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp dword [rbp - 0x5c], 0xffffffff
jne 0x14001633e
mov ecx, 2
call fcn.140059d40
mov qword [rbp - 0x78], rax
mov word [rax], bx
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x70]
call fcn.140013e60
lea rdx, [rbp - 0x78]
mov rcx, rax
call fcn.140017cb0
mov rbx, qword [rbp - 0x78]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140016310
test rax, rax
je 0x140016336
mov r8, rbx
lea rdx, str._n___Location_last_modified:__s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
nop
mov rcx, rbx
call fcn.140059d2c
mov r8, qword [rbp + 0x10]
mov r8, qword [r8]
cmp word [r8], 0
je 0x14001635f
lea rdx, str._n______s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp dword [rbp - 0x5c], 0xffffffff
je 0x140016685
mov r8, qword [rbp + 0x18]
mov r8, qword [r8]
cmp word [r8], 0
je 0x14001638a
lea rdx, str._n______s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp dword [0x1400a36f0], 0
je 0x1400163c2
mov rax, qword [rbp - 0x18]
mov r8, qword [rax]
test r8, r8
je 0x1400163a6
cmp word [r8], 0
jne 0x1400163d0
mov rax, qword [rbp - 0x28]
mov r8, qword [rax]
test r8, r8
je 0x1400163e3
cmp word [r8], 0
je 0x1400163e3
lea rdx, str._n______Not_verified___s
jmp 0x1400163d7
mov rax, qword [rbp - 0x28]
mov r8, qword [rax]
cmp word [r8], 0
je 0x1400163e3
lea rdx, str._n______s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp word [r12], 0
je 0x140016401
mov r8, r12
lea rdx, str._n______s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rax, qword [rbp - 0x20]
mov r8, qword [rax]
cmp word [r8], 0
je 0x140016422
lea rdx, str._n______s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov r8, r15
lea rdx, str._n______s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp dword [0x1400a48ec], 0
je 0x140016546
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x140016546
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140016496
mov rcx, qword [rax]
test rcx, rcx
je 0x140016496
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x140016496
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x14001647b
mov r8, qword [rax]
jmp 0x14001647e
xor r8d, r8d
lea rdx, str._n_____VT_detection:__s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
jmp 0x140016546
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1400164bf
mov rcx, qword [rax]
test rcx, rcx
je 0x1400164bf
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x1400164bf
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x1400164c6
mov rax, qword [rax]
jmp 0x1400164c6
lea rax, str.Unknown
mov r8, rax
lea rdx, str._n_____VT_detection:__s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140016505
mov rcx, qword [rcx]
test rcx, rcx
je 0x140016505
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x140016505
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x14001650c
mov rax, qword [rax]
jmp 0x14001650c
lea rax, [0x140081cb0]
mov r8, rax
lea rdx, str._n_____VT_permalink:__s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp byte [rbp - 0x80], 0
je 0x140016546
cmp byte [0x1400a468c], 0
je 0x140016546
mov r8, qword [rbx + 0x40]
test r8, r8
je 0x14001653d
mov r8, qword [r8]
xor edx, edx
xor ecx, ecx
call fcn.140005440
cmp dword [0x1400a48a4], 0
je 0x140016619
mov r8, qword [rbp + 0x2f0]
cmp word [r8], 0
je 0x140016574
lea rdx, str._n_____MD5:_______s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov r8, qword [rbp + 0x2f8]
cmp word [r8], 0
je 0x140016595
lea rdx, str._n_____SHA1:______s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov r8, qword [rbp + 0x308]
cmp word [r8], 0
je 0x1400165b6
lea rdx, str._n_____PESHA1:____s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov r8, qword [rbp + 0x300]
cmp word [r8], 0
je 0x1400165d7
lea rdx, str._n_____SHA256:____s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov r8, qword [rbp + 0x310]
cmp word [r8], 0
je 0x1400165f8
lea rdx, str._n_____PESHA256:__s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov r8, qword [rbp + 0x318]
cmp word [r8], 0
je 0x140016619
lea rdx, str._n_____IMPHASH:___s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
cmp dword [0x1400a48a8], 0
je 0x140016685
mov rax, 0xffffffffffffffff
mov rcx, rax
nop dword [rax]
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140016630
test rcx, rcx
je 0x140016660
mov r8, r14
lea rdx, str._n_____WMI_Query:________s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rsi + rax*2], 0
jne 0x140016660
test rax, rax
je 0x140016685
mov r8, rsi
lea rdx, str._n_____Script_Language:__s
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
lea rdx, [0x14007a934]
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
nop
mov rcx, rdi
call fcn.140059d2c
cmp dword [rbp - 0x5c], 0xffffffff
jne 0x1400166d7
lea rdx, str.AutorunsDisabled
mov rcx, qword [0x1400a6628]
call fcn.14004ebac
test rax, rax
je 0x1400166d7
lea rdx, str.AutorunsDisabled
mov rcx, qword [0x1400a6628]
call fcn.14004ebac
xor ecx, ecx
mov word [rax], cx
mov rcx, rsi
call fcn.140059d2c
nop
mov rcx, r14
call fcn.140059d2c
nop
lea r9, [fcn.1400072e0]
mov edx, 8
lea r8d, [rdx - 2]
lea rcx, [rbp + 0x2f0]
call fcn.14004c03c
nop
mov rcx, r13
call fcn.140059d2c
nop
mov rcx, r15
call fcn.140059d2c
nop
mov rcx, r12
call fcn.140059d2c
nop
mov rcx, qword [rbp - 0x50]
call fcn.140059d2c
xor eax, eax
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.14004bd30
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [0x1400a6630]
call fcn.14004c3c8
cmp dword [0x1400a6630], 0xffffffff
jne 0x140014a78
mov ecx, 2
call fcn.140059d40
mov qword [0x1400a6628], rax
mov word [rax], bx
lea rcx, [0x140076340]
call fcn.14004c344
lea rcx, [0x1400a6630]
call fcn.14004c35c
jmp 0x140014a78