Function at 0x140051eb0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2e8]
sub rsp, 0x3c0
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14035d8c0]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r13, rcx
mov byte [rbp - 0x60], 0
lea rcx, [rbp - 0x58]
call fcn.140015830
nop
lea r12, [0x1402f8cc8]
lea rdi, [0x1402f0688]
mov rdx, rdi
cmp byte [rbp - 0x60], 0
cmovne rdx, r12
mov r15, 0xffffffffffffffff
mov rax, r15
inc rax
cmp word [rdx + rax*2], 0
jne 0x140051f23
mov r8d, eax
lea rcx, [rbp - 0x58]
call fcn.140002a7c
mov rbx, qword [rbp - 0x58]
mov r9, rbx
xor r8d, r8d
mov edx, 0x1175e
mov rcx, qword [r13]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
lea rsi, vtable.ATL::CAtlStringMgr.0
lea r14, vtable.ATL::CWin32Heap.0
sub eax, 1
jg 0x140051fa8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052ba6
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x140052ba6
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x140052bae
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, rsi
jne 0x140052bb9
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x1402f4158]
cmp rdx, 0x10000
jae 0x140052003
movzx edx, dx
lea rcx, [rsp + 0x48]
call fcn.140012700
jmp 0x14005201e
mov rax, r15
inc rax
cmp word [rdx + rax*2], 0
jne 0x140052006
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x50]
call fcn.140015830
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x50]
call fcn.14007d3d0
mov r9, qword [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1175f
mov rcx, qword [r13]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x48]
call fcn.14004b190
lea rdx, [rbp + 0x60]
lea rcx, str.windows_systemappsmicrosoft.microsoftedge
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140052b60
mov byte [rbp - 0x50], 1
lea rcx, [rbp - 0x48]
call fcn.140015830
nop
cmp byte [rbp - 0x50], 0
cmovne rdi, r12
mov rax, r15
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400520a0
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x48]
call fcn.140002a7c
mov rbx, qword [rbp - 0x48]
mov r9, rbx
xor r8d, r8d
mov edx, 0x1175e
mov rcx, qword [r13]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005211a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052bc0
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x140052bc0
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x140052bc8
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, rsi
jne 0x140052bd3
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.windows_systemapps_
cmp rdx, 0x10000
jae 0x14005216b
movzx edx, dx
lea rcx, [rsp + 0x30]
call fcn.140012700
jmp 0x140052188
mov rax, r15
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140052170
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.140002a7c
nop
lea rcx, [rbp + 0x8c]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x140052192
lea rcx, [rbp + 0x8c]
mov qword [rsp + 0x38], rcx
lea rsi, [rbp + 0x8c]
mov rbx, qword [rsp + 0x30]
sub rsi, rbx
sar rsi, 1
mov r12d, dword [rbx - 0x10]
test eax, eax
js 0x140052bda
movsxd rdx, eax
lea rcx, [rbp + 0x8c]
call fcn.1402356b0
mov r14, rax
mov ecx, 0x7fffffff
sub ecx, eax
cmp ecx, r12d
jl 0x140052be5
lea edi, [rax + r12]
test edi, edi
js 0x140052bf0
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140052216
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140002a1c
mov rbx, qword [rsp + 0x30]
cmp rsi, r12
ja 0x140052224
lea rcx, [rbx + rsi*2]
mov qword [rsp + 0x38], rcx
movsxd rdx, r14d
lea rcx, [rbx + r12*2]
mov r9d, r14d
mov r8, qword [rsp + 0x38]
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x140052b9b
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor ecx, ecx
mov word [rbx + rax*2], cx
lea rdi, str.microsoftedge.exe
mov rax, r15
inc rax
cmp word [rdi + rax*2], cx
jne 0x140052257
mov r14, rdi
sub r14, rbx
sar r14, 1
mov esi, dword [rbx - 0x10]
mov dword [rsp + 0x38], esi
test eax, eax
js 0x140052bfb
movsxd rdx, eax
mov rcx, rdi
call fcn.1402356b0
mov r12, rax
mov eax, 0x7fffffff
sub eax, r12d
cmp eax, esi
jl 0x140052c06
add esi, r12d
js 0x140052c11
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400522c1
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.140002a1c
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
cmp r14, rax
ja 0x1400522ce
lea rdi, [rbx + r14*2]
movsxd rdx, r12d
lea rcx, [rbx + rax*2]
mov r9d, r12d
mov r8, rdi
call fcn.140002c18
cmp esi, dword [rbx - 0xc]
jg 0x140052b90
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor ecx, ecx
mov word [rbx + rax*2], cx
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x140052c1c
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
lea rsi, vtable.ATL::CAtlStringMgr.0
cmp rax, rsi
jne 0x140052c27
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
mov rbx, qword [rsp + 0x30]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
lea r14, str.Edge
test eax, eax
je 0x1400528d4
mov ecx, edi
call fcn.140238590
mov r12, rax
test rax, rax
je 0x1400528d4
mov r9, rax
mov r8d, edi
mov edx, dword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, r12
test eax, eax
je 0x1400528cf
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x38]
lea rdx, [0x1402f4204]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rcx, r12
test eax, eax
je 0x1400528cf
mov rax, qword [rbp - 0x38]
mov esi, dword [rax + 8]
mov r14d, esi
shr r14d, 0x10
mov ebx, dword [rax + 0xc]
mov edi, ebx
shr edi, 0x10
call fcn.1402358a0
movzx eax, bx
movzx r9d, si
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
mov r8d, r14d
lea rdx, str._d._d._d._d
lea rcx, [rsp + 0x40]
call fcn.14004d8a0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x40]
lea rcx, [rdi - 0x18]
call fcn.140002c94
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x78]
call fcn.140015830
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x78]
call fcn.14007d3d0
mov r9, qword [rsp + 0x78]
xor r8d, r8d
mov edx, 0x1175f
mov rcx, qword [r13]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x70]
call fcn.14004b190
mov byte [rbp - 0x30], 1
lea rcx, [rbp - 0x28]
call fcn.140015830
nop
lea r9, [rbp - 0x30]
xor r8d, r8d
mov edx, 0x1175e
mov rcx, r13
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
lea rsi, vtable.ATL::CAtlStringMgr.0
jg 0x1400524ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052c36
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r12, vtable.ATL::CWin32Heap.0
cmp rax, r12
jne 0x140052c2e
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400524d1
lea r12, vtable.ATL::CWin32Heap.0
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x140052c3e
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, rsi
jne 0x140052c49
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea r14, str.Edge
cmp r14, 0x10000
jae 0x140052523
movzx edx, r14w
lea rcx, [rsp + 0x60]
call fcn.140012700
jmp 0x14005254c
mov rax, r15
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140052530
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x60]
mov r9, rbx
mov r8d, dword [0x14036cb90]
mov edx, 0x116b9
mov rcx, qword [r13]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400525b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052c50
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x140052c50
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rcx, [rdi - 0x18]
call fcn.140002c94
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x78]
call fcn.140015830
nop
mov ebx, dword [0x14036cb90]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x78]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rbp - 0x78]
call fcn.14007d3d0
mov r9, qword [rbp - 0x78]
mov r8d, ebx
mov edx, 0x116b8
mov rcx, qword [r13]
call fcn.14001fdd0
nop
lea rcx, [rbp - 0x80]
call fcn.14004b190
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x18]
call fcn.140015830
nop
lea r9, [rbp - 0x20]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177b
mov rcx, r13
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052688
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052c58
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x140052c58
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 8]
call fcn.140015830
nop
lea r9, [rbp - 0x10]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177e
mov rcx, r13
call fcn.1400855d0
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400526fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052c60
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x140052c60
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp], 0
lea rcx, [rbp + 8]
call fcn.140015830
nop
lea r9, [rbp]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177c
mov rcx, r13
call fcn.1400855d0
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005276e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052c68
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x140052c68
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp + 0x10], 0
lea rcx, [rbp + 0x18]
call fcn.140015830
nop
lea r9, [rbp + 0x10]
mov r8d, dword [0x14036cb90]
mov edx, 0x11780
mov rcx, r13
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400527e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052c70
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x140052c70
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp + 0x20], 1
lea rcx, [rbp + 0x28]
call fcn.140015830
nop
lea r9, [rbp + 0x20]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177f
mov rcx, r13
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052854
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052c78
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x140052c78
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp + 0x30], 0
lea rcx, [rbp + 0x38]
call fcn.140015830
nop
lea r9, [rbp + 0x30]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177d
mov rcx, r13
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400528c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052c80
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x140052c80
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
inc dword [0x14036cb90]
jmp 0x1400528d4
call fcn.1402358a0
mov rcx, qword [0x14036cdf8]
cmp dword [rcx - 0x10], 0
jl 0x140052ac1
lea rdx, str.edge
call fcn.14022f558
test rax, rax
je 0x140052ac1
sub rax, qword [0x14036cdf8]
sar rax, 1
test eax, eax
js 0x140052ac1
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x140052c88
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, rsi
jne 0x140052c93
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x68], rax
cmp r14, 0x10000
jae 0x140052957
movzx edx, r14w
lea rcx, [rsp + 0x68]
call fcn.140012700
jmp 0x14005297c
mov rax, r15
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140052960
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x68]
mov r9, rbx
xor r8d, r8d
mov edx, 0x11717
mov rcx, qword [r13]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400529e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052ca2
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rbx, vtable.ATL::CWin32Heap.0
cmp rax, rbx
jne 0x140052c9a
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400529ed
lea rbx, vtable.ATL::CWin32Heap.0
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
call fcn.140002c94
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x68]
call fcn.140015830
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x68]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rbp - 0x68]
call fcn.14007d3d0
mov r9, qword [rbp - 0x68]
xor r8d, r8d
mov edx, 0x11724
mov rcx, qword [r13]
call fcn.14001fdd0
nop
lea rcx, [rbp - 0x70]
call fcn.14004b190
mov byte [rbp + 0x40], 1
lea rcx, [rbp + 0x48]
call fcn.140015830
nop
lea r9, [rbp + 0x40]
xor r8d, r8d
mov edx, 0x11760
mov rcx, r13
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052abf
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052caa
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbx
jne 0x140052caa
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
jmp 0x140052ac8
lea rbx, vtable.ATL::CWin32Heap.0
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052b15
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052cb2
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbx
jne 0x140052cb2
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140052b60
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x140052cba
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rbx
jne 0x140052cba
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14022b120
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
nop
call r8
jmp 0x140051fa8
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x140051fdb
call r8
jmp 0x14005211a
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x140052143
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14005232a
call r8
jmp 0x1400524d1
call r8
jmp 0x1400524ca
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x1400524fa
call r8
jmp 0x1400525b1
call r8
jmp 0x140052688
call r8
jmp 0x1400526fb
call r8
jmp 0x14005276e
call r8
jmp 0x1400527e1
call r8
jmp 0x140052854
call r8
jmp 0x1400528c7
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x140052935
call r8
jmp 0x1400529ed
call r8
jmp 0x1400529e6
call r8
jmp 0x140052abf
call r8
jmp 0x140052b15
call r8
jmp 0x140052b60