Function at 0x14002ff20
Capabilities:
Check for windows sandbox via genuine state

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb40
mov rax, qword [0x140313918]
xor rax, rsp
mov qword [rsp + 0xb30], rax
mov rbx, rcx
lea rsi, vtable.srl::Exists.0
mov qword [rsp + 0x80], rsi
mov byte [rsp + 0x88], 0
mov edx, 0x1165e
lea rcx, [rsp + 0x810]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x80]
mov rdx, rax
call fcn.14004fb30
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x810], rdi
mov rdx, qword [rsp + 0x830]
cmp rdx, 8
jb 0x14002ffdd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x818]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ffd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031387
call fcn.14000410c
nop
mov qword [rsp + 0x90], rsi
mov byte [rsp + 0x98], 0
mov edx, 0x1165f
lea rcx, [rsp + 0x840]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x90]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x840], rdi
mov rdx, qword [rsp + 0x860]
cmp rdx, 8
jb 0x140030065
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x848]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003005f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003138d
call fcn.14000410c
nop
mov qword [rsp + 0xa0], rsi
mov byte [rsp + 0xa8], 0
mov edx, 0x11660
lea rcx, [rsp + 0x870]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xa0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x870], rdi
mov rdx, qword [rsp + 0x890]
cmp rdx, 8
jb 0x1400300ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x878]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400300e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031393
call fcn.14000410c
nop
mov qword [rsp + 0xb0], rsi
mov byte [rsp + 0xb8], 0
mov edx, 0x116c1
lea rcx, [rsp + 0x8a0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xb0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x8a0], rdi
mov rdx, qword [rsp + 0x8c0]
cmp rdx, 8
jb 0x140030175
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003016f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031399
call fcn.14000410c
nop
mov qword [rsp + 0xc0], rsi
mov byte [rsp + 0xc8], 0
mov edx, 0x116c0
lea rcx, [rsp + 0x330]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x330], rdi
mov rdx, qword [rsp + 0x350]
cmp rdx, 8
jb 0x1400301fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400301f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003139f
call fcn.14000410c
nop
mov qword [rsp + 0xd0], rsi
mov byte [rsp + 0xd8], 0
mov edx, 0x11661
lea rcx, [rsp + 0x360]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xd0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x360], rdi
mov rdx, qword [rsp + 0x380]
cmp rdx, 8
jb 0x140030285
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x368]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003027f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313a5
call fcn.14000410c
nop
mov qword [rsp + 0xe0], rsi
mov byte [rsp + 0xe8], 0
mov edx, 0x11662
lea rcx, [rsp + 0x390]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xe0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x390], rdi
mov rdx, qword [rsp + 0x3b0]
cmp rdx, 8
jb 0x14003030d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x398]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030307
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313ab
call fcn.14000410c
nop
mov qword [rsp + 0xf0], rsi
mov byte [rsp + 0xf8], 0
mov edx, 0x1168e
lea rcx, [rsp + 0x3c0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0xf0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x3c0], rdi
mov rdx, qword [rsp + 0x3e0]
cmp rdx, 8
jb 0x140030395
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003038f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313b1
call fcn.14000410c
nop
mov qword [rsp + 0x100], rsi
mov byte [rsp + 0x108], 0
mov edx, 0x11663
lea rcx, [rsp + 0x3f0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x100]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x3f0], rdi
mov rdx, qword [rsp + 0x410]
cmp rdx, 8
jb 0x14003041d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030417
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313b7
call fcn.14000410c
nop
mov qword [rsp + 0x110], rsi
mov byte [rsp + 0x118], 0
mov edx, 0x11666
lea rcx, [rsp + 0x420]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x110]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x420], rdi
mov rdx, qword [rsp + 0x440]
cmp rdx, 8
jb 0x1400304a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x428]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003049f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313bd
call fcn.14000410c
nop
mov qword [rsp + 0x120], rsi
mov byte [rsp + 0x128], 0
mov edx, 0x11653
lea rcx, [rsp + 0x450]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x120]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x450], rdi
mov rdx, qword [rsp + 0x470]
cmp rdx, 8
jb 0x14003052d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x458]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030527
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313c3
call fcn.14000410c
nop
mov qword [rsp + 0x130], rsi
mov byte [rsp + 0x138], 0
mov edx, 0x11667
lea rcx, [rsp + 0x480]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x130]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x480], rdi
mov rdx, qword [rsp + 0x4a0]
cmp rdx, 8
jb 0x1400305b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x488]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400305af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313c9
call fcn.14000410c
nop
mov qword [rsp + 0x140], rsi
mov byte [rsp + 0x148], 0
mov edx, 0x11668
lea rcx, [rsp + 0x4b0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x140]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x4b0], rdi
mov rdx, qword [rsp + 0x4d0]
cmp rdx, 8
jb 0x14003063d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030637
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313cf
call fcn.14000410c
nop
mov qword [rsp + 0x150], rsi
mov byte [rsp + 0x158], 0
mov edx, 0x11669
lea rcx, [rsp + 0x4e0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x150]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x4e0], rdi
mov rdx, qword [rsp + 0x500]
cmp rdx, 8
jb 0x1400306c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400306bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313d5
call fcn.14000410c
nop
mov qword [rsp + 0x160], rsi
mov byte [rsp + 0x168], 0
mov edx, 0x1166a
lea rcx, [rsp + 0x510]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x160]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x510], rdi
mov rdx, qword [rsp + 0x530]
cmp rdx, 8
jb 0x14003074d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030747
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313db
call fcn.14000410c
nop
mov qword [rsp + 0x170], rsi
mov byte [rsp + 0x178], 0
mov edx, 0x1166b
lea rcx, [rsp + 0x540]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x170]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x540], rdi
mov rdx, qword [rsp + 0x560]
cmp rdx, 8
jb 0x1400307d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400307cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313e1
call fcn.14000410c
nop
mov qword [rsp + 0x180], rsi
mov byte [rsp + 0x188], 0
mov edx, 0x1173b
lea rcx, [rsp + 0x570]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x180]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x570], rdi
mov rdx, qword [rsp + 0x590]
cmp rdx, 8
jb 0x14003085d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x578]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030857
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313e7
call fcn.14000410c
nop
mov qword [rsp + 0x190], rsi
mov byte [rsp + 0x198], 0
mov edx, 0x1173a
lea rcx, [rsp + 0x5a0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x190]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x5a0], rdi
mov rdx, qword [rsp + 0x5c0]
cmp rdx, 8
jb 0x1400308e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400308df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313ed
call fcn.14000410c
nop
mov qword [rsp + 0x1a0], rsi
mov byte [rsp + 0x1a8], 0
mov edx, 0x11739
lea rcx, [rsp + 0x5d0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1a0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x5d0], rdi
mov rdx, qword [rsp + 0x5f0]
cmp rdx, 8
jb 0x14003096d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030967
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313f3
call fcn.14000410c
nop
mov qword [rsp + 0x1b0], rsi
mov byte [rsp + 0x1b8], 0
mov edx, 0x11738
lea rcx, [rsp + 0x600]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1b0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x600], rdi
mov rdx, qword [rsp + 0x620]
cmp rdx, 8
jb 0x1400309f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x608]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400309ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313f9
call fcn.14000410c
nop
mov qword [rsp + 0x1c0], rsi
mov byte [rsp + 0x1c8], 0
mov edx, 0x11737
lea rcx, [rsp + 0x630]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1c0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x630], rdi
mov rdx, qword [rsp + 0x650]
cmp rdx, 8
jb 0x140030a7d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x638]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030a77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400313ff
call fcn.14000410c
nop
mov qword [rsp + 0x1d0], rsi
mov byte [rsp + 0x1d8], 0
mov edx, 0x11735
lea rcx, [rsp + 0x660]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1d0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x660], rdi
mov rdx, qword [rsp + 0x680]
cmp rdx, 8
jb 0x140030b05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x668]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030aff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031405
call fcn.14000410c
nop
mov qword [rsp + 0x1e0], rsi
mov byte [rsp + 0x1e8], 0
mov edx, 0x11745
lea rcx, [rsp + 0x690]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1e0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x690], rdi
mov rdx, qword [rsp + 0x6b0]
cmp rdx, 8
jb 0x140030b8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x698]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030b87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003140b
call fcn.14000410c
nop
mov qword [rsp + 0x1f0], rsi
mov byte [rsp + 0x1f8], 0
mov edx, 0x11746
lea rcx, [rsp + 0x6c0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x1f0]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x6c0], rdi
mov rdx, qword [rsp + 0x6e0]
cmp rdx, 8
jb 0x140030c15
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030c0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031411
call fcn.14000410c
nop
mov qword [rsp + 0x200], rsi
mov byte [rsp + 0x208], 0
mov edx, 0x11747
lea rcx, [rsp + 0x6f0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x200]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x6f0], rdi
mov rdx, qword [rsp + 0x710]
cmp rdx, 8
jb 0x140030c9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030c97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031417
call fcn.14000410c
nop
mov qword [rsp + 0x250], rsi
mov byte [rsp + 0x258], 0
mov edx, 0x1166c
lea rcx, [rsp + 0x720]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x250]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x720], rdi
mov rdx, qword [rsp + 0x740]
cmp rdx, 8
jb 0x140030d25
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x728]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030d1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003141d
call fcn.14000410c
nop
mov qword [rsp + 0x210], rsi
mov byte [rsp + 0x218], 0
mov edx, 0x116b6
lea rcx, [rsp + 0x750]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x210]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x750], rdi
mov rdx, qword [rsp + 0x770]
cmp rdx, 8
jb 0x140030dad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x758]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030da7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031423
call fcn.14000410c
nop
mov qword [rsp + 0x220], rsi
mov byte [rsp + 0x228], 0
mov edx, 0x11729
lea rcx, [rsp + 0x780]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x220]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x780], rdi
mov rdx, qword [rsp + 0x7a0]
cmp rdx, 8
jb 0x140030e35
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x788]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030e2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031429
call fcn.14000410c
nop
mov qword [rsp + 0x230], rsi
mov byte [rsp + 0x238], 0
mov edx, 0x1172a
lea rcx, [rsp + 0x7b0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x230]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x7b0], rdi
mov rdx, qword [rsp + 0x7d0]
cmp rdx, 8
jb 0x140030ebd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x7b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030eb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003142f
call fcn.14000410c
nop
mov qword [rsp + 0x240], rsi
mov byte [rsp + 0x248], 0
mov edx, 0x1173c
lea rcx, [rsp + 0x7e0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x240]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x7e0], rdi
mov rdx, qword [rsp + 0x800]
cmp rdx, 8
jb 0x140030f45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x7e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030f3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031435
call fcn.14000410c
nop
mov qword [rsp + 0x260], rsi
mov byte [rsp + 0x268], 0
mov edx, 0x1174e
lea rcx, [rsp + 0x8d0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x260]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x8d0], rdi
lea rcx, [rsp + 0x8d8]
call fcn.140009aa8
nop
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x58], 0
mov edx, 0x1175c
lea rcx, [rsp + 0x2a0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x2a0], rdi
lea rcx, [rsp + 0x2a8]
call fcn.140009aa8
nop
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x78], 0
mov edx, 0x1173d
lea rcx, [rsp + 0x2d0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x2d0], rdi
lea rcx, [rsp + 0x2d8]
call fcn.140009aa8
nop
mov qword [rsp + 0x28], rsi
mov byte [rsp + 0x30], 0
mov edx, 0x1174f
lea rcx, [rsp + 0x270]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x28]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x270], rdi
lea rcx, [rsp + 0x278]
call fcn.140009aa8
nop
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x68], 0
mov edx, 0x11744
lea rcx, [rsp + 0x300]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rax
call fcn.14004fb30
nop
mov qword [rsp + 0x300], rdi
lea rcx, [rsp + 0x308]
call fcn.140009aa8
nop
lea rdx, [rsp + 0x930]
mov rcx, rbx
call fcn.140032b80
test eax, eax
je 0x140031173
lea rdi, vtable.srl::Name.0
mov qword [rsp + 0x40], rdi
call fcn.140010210
mov rcx, rax
test rax, rax
je 0x14003143b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x930]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140031100
mov r8d, eax
lea rdx, [rsp + 0x930]
lea rcx, [rsp + 0x48]
call fcn.140002aa8
nop
mov edx, 0x11594
lea rcx, [rsp + 0x900]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x900]
call fcn.140021670
nop
mov qword [rsp + 0x40], rdi
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140031173
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140031450
mov dword [rsp + 0x24], 0
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140031201
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call rbx
test eax, eax
je 0x140031201
cmp dword [rsp + 0x24], 0
setne al
test al, al
je 0x140031201
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x68], 1
mov edx, 0x11660
lea rcx, [rsp + 0x300]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x300]
call fcn.140021670
nop
call fcn.140035420
lea rdx, [rsp + 0x260]
lea rcx, str.55c92734_d682_4d71_983e_d6ec3f16059f
call qword [sym.imp.RPCRT4.dll_UuidFromStringW]
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x260]
call qword [sym.imp.SLWGA.dll_SLIsGenuineLocal]
mov qword [rsp + 0x28], rsi
cmp dword [rsp + 0x38], 0
jne 0x140031276
mov byte [rsp + 0x30], 1
mov edx, 0x117a9
lea rcx, [rsp + 0x270]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x28]
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x270]
call fcn.140021670
nop
jmp 0x1400312ad
mov byte [rsp + 0x30], 0
mov edx, 0x117a9
lea rcx, [rsp + 0x270]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x28]
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x270]
call fcn.140021670
nop
call fcn.14002f910
call fcn.14002fae0
call fcn.1400505e0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140050b60
mov qword [rsp + 0x70], rsi
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x78], al
mov edx, 0x117ac
lea rcx, [rsp + 0x2d0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x70]
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x2d0]
call fcn.140021670
nop
mov byte [rsp + 0x20], 0
call fcn.1400505e0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140050e90
mov qword [rsp + 0x50], rsi
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x58], al
mov edx, 0x117ae
lea rcx, [rsp + 0x2a0]
call fcn.1400214e0
nop
xor r9d, r9d
lea r8, [rsp + 0x50]
mov rdx, rax
call fcn.14004fb30
nop
lea rcx, [rsp + 0x2a0]
call fcn.140021670
nop
mov al, 1
mov rcx, qword [rsp + 0xb30]
xor rcx, rsp
call fcn.140215e10
lea r11, [rsp + 0xb40]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
call fcn.14021f028
nop
mov ecx, 0x80004005
call fcn.140002d2c
int3