Function at 0x180006170
Capabilities:
Check for time delay via gettickcount
Check if file exists
Enumerate processes
Get common file path
Get startup folder
Get thread local storage value
Query environment variable
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2300]
mov eax, 0x2400
call fcn.1800edb30
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2440], rbx
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rbp + 0x22f0], rax
mov r12, r9
mov r15, r8
xor r13d, r13d
lea rdi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
cmp qword [0x1801c12f8], r13
je 0x1800062f5
lea rcx, [0x1801c12f8]
call fcn.1800cde80
mov rax, qword [0x1801c12f8]
cmp byte [rax + 0x78], r13b
je 0x1800062f5
cmp dword [rax + 0x80], 4
jb 0x1800062f5
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x210], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x210], xmm1
mov word [rbp + 0x200], r13w
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x180006233
mov r9, qword [r12]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x180006240
mov r8, qword [r15]
lea rdx, str.JumpToProtectMainPage_link___s__path___s
lea rcx, [rbp + 0x200]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x24c
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x200]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
test bl, bl
je 0x180006297
lea rdx, [rbp + 0x200]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x1800062dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800062d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e38
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], r13w
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov byte [rsp + 0x31], 0
lea r9, [rsp + 0x31]
lea r8, [rbp + 0x40]
call fcn.180018e00
mov esi, eax
cmp qword [0x1801c12f8], 0
je 0x18000644b
lea rcx, [0x1801c12f8]
call fcn.1800cde80
mov rcx, qword [0x1801c12f8]
cmp byte [rcx + 0x78], 0
je 0x18000644b
cmp dword [rcx + 0x80], 4
jb 0x18000644b
movzx ebx, byte [rcx + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x230], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x220], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
mov r8d, esi
lea rdx, str.GetProtectMainPage_dwErr__0x_X_protectMainPage___s
lea rcx, [rbp + 0x220]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x253
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x220]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
test bl, bl
je 0x1800063ed
lea rdx, [rbp + 0x220]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x180006433
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000642e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e3e
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], r13w
mov byte [rsp + 0x30], 0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.180011380
mov r14, 0xffffffffffffffff
test al, al
je 0x18000648d
cmp qword [rbp + 0x30], 0
jne 0x180006556
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x12f0]
call fcn.18010bfb0
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x12f0]
call fcn.1800333b0
test al, al
je 0x180006556
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x250], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x250], xmm1
mov word [rbp + 0x240], r13w
lea rax, [rbp + 0x12f0]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800064f0
lea rdx, [rbp + 0x12f0]
lea rcx, [rbp + 0x240]
call fcn.1800049a0
nop
lea rcx, [rbp + 0x20]
call fcn.180004910
movups xmm0, xmmword [rbp + 0x240]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x250]
movups xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movzx edi, byte [rsp + 0x30]
mov rax, qword [0x1801c12f8]
test rax, rax
je 0x180006694
lea rcx, [0x1801c12f8]
call fcn.1800cde80
mov rax, qword [0x1801c12f8]
cmp byte [rax + 0x78], 0
je 0x180006694
cmp dword [rax + 0x80], 4
jb 0x180006694
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x270], xmm1
mov word [rbp + 0x260], r13w
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
movzx r9d, dil
lea rdx, str.GetProtectMainPage_Other_Browser_protectMainPage___s__isLocked___d
lea rcx, [rbp + 0x260]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x261
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x260]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
test bl, bl
je 0x18000662f
lea rdx, [rbp + 0x260]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x278]
cmp rdx, 8
jb 0x180006675
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006670
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e44
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x270], xmm0
mov word [rbp + 0x260], r13w
mov rax, qword [0x1801c12f8]
cmp qword [rbp + 0x50], 0
jne 0x180006870
test dil, dil
jne 0x180006870
test rax, rax
je 0x1800067c7
lea rcx, [0x1801c12f8]
call fcn.1800cde80
mov rax, qword [0x1801c12f8]
cmp byte [rax + 0x78], dil
je 0x1800067c7
cmp dword [rax + 0x80], 4
jb 0x1800067c7
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x290], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x290], xmm1
mov word [rbp + 0x280], r13w
mov r8d, 0x1a
lea rdx, str.GetProtectMainPage
lea rcx, [rbp + 0x280]
call fcn.1800049a0
mov dword [rsp + 0x28], 0x266
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x280]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
test bl, bl
je 0x180006769
lea rdx, [rbp + 0x280]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 8
jb 0x1800067af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e4a
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x280], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006807
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e50
call fcn.1800ece80
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006858
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006853
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e56
call fcn.1800ece80
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov eax, esi
jmp 0x180008dfc
lea rcx, [rbp + 0xa0]
call fcn.1800a1000
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rcx, qword [rbp + 0xa0]
lea rdx, str.explorer.exe
call fcn.18010eb30
test eax, eax
je 0x180006ade
call fcn.180009640
test al, al
jne 0x180006ade
cmp qword [0x1801c12f8], 0
je 0x1800069d9
lea rcx, [0x1801c12f8]
call fcn.1800cde80
mov rax, qword [0x1801c12f8]
cmp byte [rax + 0x78], 0
je 0x1800069d9
cmp dword [rax + 0x80], 4
jb 0x1800069d9
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2b0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x2b0], xmm1
mov word [rbp + 0x2a0], r13w
mov r8d, 0x17
lea rdx, str.other_desk_close_swtich
lea rcx, [rbp + 0x2a0]
call fcn.1800049a0
mov dword [rsp + 0x28], 0x270
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x2a0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
test bl, bl
je 0x18000697b
lea rdx, [rbp + 0x2a0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 8
jb 0x1800069c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800069bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e5c
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x2b0], xmm0
mov word [rbp + 0x2a0], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180006a1f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e62
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006a77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006a72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e68
call fcn.1800ece80
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006ac8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ac3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e6e
call fcn.1800ece80
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
jmp 0x180008df7
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x360], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x360]
call fcn.1800049a0
nop
lea rcx, [rbp + 0x360]
call fcn.1800a0020
test al, al
sete bl
mov rdx, qword [rbp + 0x378]
cmp rdx, 8
jb 0x180006b72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006b6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e74
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x360], r13w
test bl, bl
je 0x180006ed7
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x140]
call fcn.1800049a0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006c68
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x6a4]
call fcn.18010bfb0
mov dword [rbp + 0x6a0], 0x238
lea rdx, [rbp + 0x6a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180006c5f
nop
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x6cc]
call fcn.18010eb30
mov rcx, rbx
test eax, eax
je 0x180006eca
lea rdx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180006c20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x180006cb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006cab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e7a
call fcn.1800ece80
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
test bl, bl
je 0x180006ed7
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180006dd3
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x190], xmm1
mov word [rbp + 0x180], r13w
mov r8d, 0xd
lea rdx, str.not_found_rtp
lea rcx, [rbp + 0x180]
call fcn.1800049a0
mov dword [rsp + 0x28], 0x293
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x180]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180006d75
lea rdx, [rbp + 0x180]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x180006dbb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006db6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e80
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180006e19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006e14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e86
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006e71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e8c
call fcn.1800ece80
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006ac8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ac3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e2c
jmp 0x180006ac3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x180006c6a
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x130], xmm1
mov word [rbp + 0x120], r13w
movdqu xmmword [rbp + 0x170], xmm0
movdqu xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x160], r13w
mov r8d, 0xa
lea rdx, str.2345PCSafe
lea rcx, [rbp + 0x160]
call fcn.1800049a0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x120]
call fcn.1800049a0
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x180006f9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e92
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r13w
lea rcx, [rbp + 0x120]
call fcn.18003f8b0
test al, al
je 0x18000734c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x390], xmm1
mov word [rbp + 0x380], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x380]
call fcn.1800049a0
nop
lea rcx, [rbp + 0x380]
call fcn.1800a0020
test al, al
sete bl
mov rdx, qword [rbp + 0x398]
cmp rdx, 8
jb 0x18000705d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007058
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e98
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x380], r13w
test bl, bl
je 0x18000734c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x310], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x310], xmm1
mov word [rbp + 0x300], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x300]
call fcn.1800049a0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x1800070cf
xor bl, bl
jmp 0x1800070e1
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.180008ec0
movzx ebx, al
mov rdx, qword [rbp + 0x318]
cmp rdx, 8
jb 0x180007127
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007122
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e9e
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x310], xmm0
mov word [rbp + 0x300], r13w
test bl, bl
jne 0x18000734c
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180007248
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x1b0], xmm1
mov word [rbp + 0x1a0], r13w
mov r8d, 0xe
lea rdx, str.not_found_tray
lea rcx, [rbp + 0x1a0]
call fcn.1800049a0
mov dword [rsp + 0x28], 0x2a0
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x1a0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x1800071ea
lea rdx, [rbp + 0x1a0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x180007230
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000722b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ea4
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], r13w
lea rcx, [rbp + 0x120]
call fcn.180004910
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x18000729b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180007296
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008eaa
call fcn.1800ece80
movdqa xmm0, xmmword [0x18016e140]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x1800072f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800072ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008eb0
call fcn.1800ece80
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180006ac8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ac3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e32
jmp 0x180006ac3
mov r8, qword [rbp + 0x30]
test r8, r8
je 0x180007522
mov rdi, r8
cmp r8, 1
jb 0x1800073da
mov rbx, r13
test r8, r8
je 0x1800073a8
nop word [rax + rax]
cmp r8, rbx
jbe 0x180008e26
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
movzx edx, word [rax + rbx*2]
lea rcx, str.__r_t_n
call fcn.18010b518
mov r8, qword [rbp + 0x30]
test rax, rax
je 0x1800073a8
inc rbx
cmp rbx, rdi
jb 0x180007370
test rbx, rbx
je 0x1800073da
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
sub r8, rbx
mov qword [rbp + 0x30], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.18010bb50
lea rdx, str.__r_t_n
lea rcx, [rbp + 0x20]
call fcn.18009d350
lea rcx, [rbp + 0x20]
call fcn.18009d4e0
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 5
lea rdx, str.http:
call fcn.180112610
test eax, eax
je 0x180007522
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 6
lea rdx, str.https:
call fcn.180112610
test eax, eax
je 0x180007522
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xb
lea rdx, str.about:blank
call fcn.180112610
test eax, eax
je 0x180007522
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xa
lea rdx, str.about:tabs
call fcn.180112610
test eax, eax
je 0x180007522
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x1d0], xmm1
mov word [rbp + 0x1c0], r13w
mov r8d, 7
lea rdx, str.http:__
lea rcx, [rbp + 0x1c0]
call fcn.1800049a0
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.18000ceb0
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x20]
call fcn.1800049a0
nop
lea rcx, [rbp + 0x1c0]
call fcn.180004910
mov eax, dword [0x1801c0a08]
test eax, eax
je 0x180007614
mov ebx, dword [0x1801c0a08]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
andps xmm1, xmmword [0x18016e1a0]
movsd xmm0, qword [0x18016e110]
comisd xmm0, xmm1
jb 0x180007614
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x18000760f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x4b0], xmm1
mov word [rbp + 0x4a0], r13w
mov r8d, 0x1c
lea rdx, str.JumpToProtectMainPage
lea rcx, [rbp + 0x4a0]
call fcn.1800049a0
mov dword [rsp + 0x28], CDefFolderMenu_Create2
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4a0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180007602
lea rdx, [rbp + 0x4a0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x4a0]
call fcn.180004910
nop
jmp 0x180008dca
call fcn.18000c3c0
test al, al
jne 0x180007629
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [0x1801c0a08], eax
mov eax, 1
xchg dword [0x1801be9ac], eax
test eax, eax
jne 0x18000763d
call fcn.1800269a0
lea rdx, [rbp + 0x40]
call fcn.180027090
test al, al
je 0x180007694
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x600]
call fcn.180016790
nop
mov r8, qword [rbp + 0x610]
test r8, r8
je 0x180007688
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 8
cmovae rdx, qword [rbp + 0x600]
lea rcx, [rbp + 0x40]
call fcn.18000ceb0
nop
lea rcx, [rbp + 0x600]
call fcn.180004910
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800076ba
mov rdx, qword [r15]
lea r8, [rbp + 0x60]
call fcn.180017720
mov ecx, dword [0x1801be99c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x18000779f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x4d0], xmm1
mov word [rbp + 0x4c0], r13w
cmp qword [r12 + 0x18], 8
jb 0x18000771c
mov r12, qword [r12]
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r9, qword [rbp + 0x60]
mov qword [rsp + 0x20], r12
mov r8, rdi
lea rdx, str.pAction___p_targetFileName___s_currentPath___s
lea rcx, [rbp + 0x4c0]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x2d2
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4c0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180007791
lea rdx, [rbp + 0x4c0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x4c0]
call fcn.180004910
jmp 0x1800077a6
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
xor edx, edx
mov ecx, dword [0x1801be99c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp qword [rbp + 0x50], 0
jne 0x18000789b
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, [0x1801612b8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x18000789b
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x18000788c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x4f0], xmm1
mov word [rbp + 0x4e0], r13w
mov r8d, 0x26
lea rdx, str.GetProtectMainPage_fail_and_path_is_ie
lea rcx, [rbp + 0x4e0]
call fcn.1800049a0
mov dword [rsp + 0x28], 0x2d8
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4e0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x18000787f
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x4e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
jmp 0x180008dca
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800078a8
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800078ce
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007bdc
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.18000cb60
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.180005640
nop
cmp qword [rbp + 0xf0], 0
jne 0x180007a17
cmp qword [rbp + 0x70], 0
jbe 0x180007bd0
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.18000cb60
nop
mov rdx, rax
lea rcx, [rbp + 0x660]
call fcn.180005640
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.18000cad0
nop
lea rcx, [rbp + 0x660]
call fcn.180004910
cmp qword [rbp + 0xf0], 0
jbe 0x180007bd0
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180007ad0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x510], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x510], xmm1
mov word [rbp + 0x500], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.targetFileName_guid_file_path___ws
lea rcx, [rbp + 0x500]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x2e9
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x500]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180007a0b
lea rdx, [rbp + 0x500]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x500]
jmp 0x180007acb
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180007ad0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x530], xmm1
mov word [rbp + 0x520], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.linkName_guid_file_path___ws
lea rcx, [rbp + 0x520]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x2ef
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x520]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180007ac4
lea rdx, [rbp + 0x520]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x520]
call fcn.180004910
cmp qword [rbp + 0xf0], 0
jbe 0x180007bd0
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, [0x1801612b8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180007b59
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str._shdocvw.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180007b59
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str.ieframe.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007bd0
lea rdx, [rbp + 0x680]
call fcn.18001ac10
nop
lea r8, [rbp + 0x40]
mov rdx, rax
call fcn.180019100
movzx ebx, al
lea rcx, [rbp + 0x680]
call fcn.180004910
test bl, bl
je 0x180007bd0
lea rcx, [rbp + 0xe0]
call fcn.180004910
nop
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
lea rcx, [rbp + 0x120]
call fcn.180004910
nop
lea rcx, [rbp + 0xa0]
call fcn.180004910
nop
lea rcx, [rbp + 0x20]
call fcn.180004910
nop
lea rcx, [rbp + 0x40]
call fcn.180004910
xor eax, eax
jmp 0x180008dfc
lea rcx, [rbp + 0xe0]
call fcn.180004910
cmp rdi, 1
jne 0x180007c92
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007c72
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x590], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x590], xmm1
mov word [rbp + 0x580], r13w
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rbp + 0x580]
call fcn.1800049a0
nop
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x60]
call fcn.180019100
movzx ebx, al
lea rcx, [rbp + 0x580]
call fcn.180004910
test bl, bl
je 0x180007c92
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
jmp 0x180007b9c
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180019100
test al, al
je 0x180007c92
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
jmp 0x180007b9c
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.18000cb60
nop
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180007db3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1af0]
call fcn.18010bfb0
mov r9d, 1
lea r8d, [r9 + 0xf]
lea rdx, [rbp + 0x1af0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180007db3
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
lea rdx, [rbp + 0x1af0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007db3
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
je 0x180007db3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xaf0]
call fcn.18010bfb0
mov r9d, 1
lea r8d, [r9 + 0x18]
lea rdx, [rbp + 0xaf0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rdx, rbx
lea rcx, [rbp + 0xaf0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, [rbp + 0xaf0]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180007d95
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0x100]
call fcn.1800049a0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0x80], r13w
xor r8d, r8d
lea rdx, [0x180160958]
lea rcx, [rbp + 0x80]
call fcn.1800049a0
nop
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r13w
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x5b0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x5b0], xmm1
mov word [rbp + 0x5a0], r13w
mov r8, r14
inc r8
cmp word [rdx + r8*2], 0
jne 0x180007e52
lea rcx, [rbp + 0x5a0]
call fcn.1800049a0
nop
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5a0]
call fcn.18001c680
mov ebx, eax
lea rcx, [rbp + 0x5a0]
call fcn.180004910
test ebx, ebx
jne 0x180008cf6
cmp qword [rbp + 0xd0], 0
jne 0x180007fd6
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, [0x1801612b8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007fd6
lea edx, [rbx + 4]
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180007f8c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x550], xmm1
mov word [rbp + 0x540], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180161420]
lea rcx, [rbp + 0x540]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x331
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x540]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180007f80
lea rdx, [rbp + 0x540]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x540]
call fcn.180004910
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x80]
call fcn.180019100
test al, al
je 0x180007fd6
lea rcx, [rbp + 0xc0]
call fcn.180004910
nop
lea rcx, [rbp + 0x80]
call fcn.180004910
nop
lea rcx, [rbp + 0x100]
call fcn.180004910
nop
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
jmp 0x180007b9c
cmp byte [rsp + 0x30], 0
je 0x1800087b6
lea rcx, [rsp + 0x48]
call fcn.18000e190
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.1800049a0
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqa xmmword [rbp + 0x2f0], xmm1
mov word [rbp + 0x2e0], r13w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x40]
call fcn.18000cb60
nop
lea r8, [rbp + 0x2c0]
mov rdx, rax
call fcn.180010f60
test al, al
je 0x180008741
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180008141
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x570], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x570], xmm1
mov word [rbp + 0x560], r13w
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180161440]
lea rcx, [rbp + 0x560]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x340
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x560]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180008135
lea rdx, [rbp + 0x560]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x560]
call fcn.180004910
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x80]
call fcn.180011870
test al, al
je 0x180008741
lea rdx, [rbp + 0x40]
call fcn.180027090
test al, al
je 0x1800081ba
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5c0]
call fcn.180016350
nop
mov r8, qword [rbp + 0x5d0]
test r8, r8
je 0x1800081ae
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 8
cmovae rdx, qword [rbp + 0x5c0]
lea rcx, [rbp + 0x40]
call fcn.18000ceb0
nop
lea rcx, [rbp + 0x5c0]
call fcn.180004910
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1e0]
call fcn.18000cb60
nop
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180008295
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x3b0], xmm1
mov word [rbp + 0x3a0], r13w
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r8, qword [rbp + 0xc0]
mov eax, dword [rbp + 0x2c4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x2c0]
lea rdx, [0x180161490]
lea rcx, [rbp + 0x3a0]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x34f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3a0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180008289
lea rdx, [rbp + 0x3a0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x3a0]
call fcn.180004910
cmp dword [rbp + 0x2c4], 1
jne 0x1800083c2
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2c8]
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x320]
call fcn.180010420
nop
mov r8, qword [rbp + 0x330]
test r8, r8
je 0x1800083b6
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rdx, qword [rbp + 0x320]
lea rcx, [rbp + 0x1e0]
call fcn.1800049a0
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x1800083b6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x3d0], xmm1
mov word [rbp + 0x3c0], r13w
lea r8, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae r8, qword [rbp + 0x320]
lea rdx, [0x180161510]
lea rcx, [rbp + 0x3c0]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x358
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3c0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x1800083a9
lea rdx, [rbp + 0x3c0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x3c0]
call fcn.180004910
nop
lea rcx, [rbp + 0x320]
call fcn.180004910
cmp dword [rbp + 0x2c0], 1
jne 0x1800084f4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x60]
call fcn.18000cb60
nop
mov r8, rax
lea rdx, [rbp + 0x340]
call fcn.18000fde0
nop
mov r8, qword [rbp + 0x350]
test r8, r8
je 0x1800084e8
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rdx, qword [rbp + 0x340]
lea rcx, [rbp + 0x1e0]
call fcn.1800049a0
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x1800084e8
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x3f0], xmm1
mov word [rbp + 0x3e0], r13w
lea r8, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae r8, qword [rbp + 0x340]
lea rdx, [0x180161550]
lea rcx, [rbp + 0x3e0]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x363
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3e0]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x1800084db
lea rdx, [rbp + 0x3e0]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x3e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x340]
call fcn.180004910
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x5e0]
call fcn.180011d10
nop
lea r8, [rbp + 0x1e0]
cmp qword [rbp + 0x5f0], 0
je 0x18000862a
lea rdx, [rbp + 0x5e0]
call fcn.180019100
test al, al
je 0x180008727
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x20]
call fcn.18000cb60
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000ed90
nop
lea rcx, [rbp + 0x5e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cc90
nop
mov rcx, qword [0x1801c0a98]
test rcx, rcx
je 0x1800085a6
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c0a98]
sub dword [0x1801be9a8], 1
jne 0x1800085c3
call fcn.180020590
mov rcx, rax
call fcn.180020920
mov rcx, qword [0x1801c0a98]
test rcx, rcx
je 0x1800085cf
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012ed0
nop
mov edx, 0x60
mov rcx, qword [rsp + 0x48]
call fcn.180004bd0
nop
lea rcx, [rbp + 0xc0]
call fcn.180004910
nop
lea rcx, [rbp + 0x80]
call fcn.180004910
nop
lea rcx, [rbp + 0x100]
call fcn.180004910
nop
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
jmp 0x180007b9c
lea rdx, [rbp + 0x80]
call fcn.180019100
test al, al
je 0x180008727
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp]
call fcn.18000cb60
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000ed90
nop
lea rcx, [rbp + 0x5e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cc90
nop
mov rcx, qword [0x1801c0a98]
test rcx, rcx
je 0x1800086b3
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c0a98]
sub dword [0x1801be9a8], 1
jne 0x1800086d0
call fcn.180020590
mov rcx, rax
call fcn.180020920
mov rcx, qword [0x1801c0a98]
test rcx, rcx
je 0x1800086dc
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012880
nop
lea rcx, [rbp + 0xc0]
call fcn.180004910
nop
lea rcx, [rbp + 0x80]
call fcn.180004910
nop
lea rcx, [rbp + 0x100]
call fcn.180004910
nop
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
jmp 0x180007b9c
lea rcx, [rbp + 0x5e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x1e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004910
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000cc90
nop
mov rcx, qword [0x1801c0a98]
test rcx, rcx
je 0x180008774
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801c0a98]
sub dword [0x1801be9a8], 1
jne 0x180008791
call fcn.180020590
mov rcx, rax
call fcn.180020920
mov rcx, qword [0x1801c0a98]
test rcx, rcx
je 0x18000879d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180012880
jmp 0x18000885e
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x18000885e
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x410], xmm1
mov word [rbp + 0x400], r13w
mov r8d, 0x1b
lea rdx, str.Other_Browser_Home
lea rcx, [rbp + 0x400]
call fcn.1800049a0
mov dword [rsp + 0x28], 0x37e
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x400]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180008852
lea rdx, [rbp + 0x400]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x400]
call fcn.180004910
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x650], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x650], xmm1
mov word [rbp + 0x640], r13w
movdqu xmmword [rbp + 0x630], xmm0
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r13w
lea rcx, [rsp + 0x40]
call fcn.18001b7a0
nop
lea rcx, [rsp + 0x40]
call fcn.18001b9c0
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.18001bbf0
test al, al
je 0x180008bff
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x640]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.18001bb40
test al, al
je 0x180008bff
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x1800089ac
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x430], xmm1
mov word [rbp + 0x420], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x1801615d0]
lea rcx, [rbp + 0x420]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x389
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x420]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x1800089a0
lea rdx, [rbp + 0x420]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x420]
call fcn.180004910
cmp qword [rbp + 0x70], 0
jne 0x180008a5e
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800089f8
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
jmp 0x180008a55
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x8e0]
call fcn.18010bfb0
mov r8d, 0x104
lea rdx, [rbp + 0x8e0]
lea rcx, str._ProgramFiles_Internet_Exploreriexplore.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180008a5e
lea rax, [rbp + 0x8e0]
nop
inc r14
cmp word [rax + r14*2], 0
jne 0x180008a40
mov r8, r14
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0x60]
call fcn.1800049a0
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180008ad1
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x40]
call fcn.1800049a0
mov r8d, 1
lea rdx, [0x18016164c]
lea rcx, [rbp + 0x40]
call fcn.18000ceb0
mov r8d, 0xb
lea rdx, [0x180161650]
lea rcx, [rbp + 0x40]
call fcn.18000ceb0
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180008b8f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x450], xmm1
mov word [rbp + 0x440], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r8, qword [rbp + 0x60]
lea rdx, [0x180161668]
lea rcx, [rbp + 0x440]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x3a3
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x440]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180008b83
lea rdx, [rbp + 0x440]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x440]
call fcn.180004910
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.180019100
test al, al
je 0x180008cc4
lea rcx, [rsp + 0x40]
call fcn.18001b800
nop
lea rcx, [rbp + 0x620]
call fcn.180004910
nop
lea rcx, [rbp + 0x640]
call fcn.180004910
nop
lea rcx, [rbp + 0xc0]
call fcn.180004910
nop
lea rcx, [rbp + 0x80]
call fcn.180004910
nop
lea rcx, [rbp + 0x100]
call fcn.180004910
nop
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
jmp 0x180007b9c
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov edi, eax
test eax, eax
je 0x180008cc4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x470], xmm1
mov word [rbp + 0x460], r13w
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
mov r8d, eax
lea rdx, str.RCBlackShortCut_Analyze_Fail___x_lnk___s
lea rcx, [rbp + 0x460]
call fcn.1800cf000
mov dword [rsp + 0x28], 0x3ab
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x460]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp edi, 1
jbe 0x180008cb8
lea rdx, [rbp + 0x460]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x460]
call fcn.180004910
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180008cd2
mov byte [rax + 8], 0
lea rcx, [rsp + 0x40]
call fcn.18001b800
nop
lea rcx, [rbp + 0x620]
call fcn.180004910
nop
lea rcx, [rbp + 0x640]
jmp 0x180008d93
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceae0
mov ebx, eax
test eax, eax
je 0x180008d99
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x18016e140]
movdqu xmmword [rbp + 0x490], xmm1
mov word [rbp + 0x480], r13w
lea rdx, str.GetShortCutTargetCmdEx_Fail
lea rcx, [rbp + 0x480]
call fcn.180004980
mov dword [rsp + 0x28], 0x3b1
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x480]
mov edx, 4
lea rcx, [0x1801c12f8]
call fcn.1800ceb30
cmp ebx, 1
jbe 0x180008d8c
lea rdx, [rbp + 0x480]
lea rcx, [0x1801c12f8]
call fcn.1800ceec0
nop
lea rcx, [rbp + 0x480]
call fcn.180004910
nop
lea rcx, [rbp + 0xc0]
call fcn.180004910
nop
lea rcx, [rbp + 0x80]
call fcn.180004910
nop
lea rcx, [rbp + 0x100]
call fcn.180004910
nop
lea rcx, [rbp + 0x60]
call fcn.180004910
nop
lea rcx, [rbp + 0x120]
call fcn.180004910
nop
lea rcx, [rbp + 0xa0]
call fcn.180004910
nop
lea rcx, [rbp + 0x20]
call fcn.180004910
nop
lea rcx, [rbp + 0x40]
call fcn.180004910
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x22f0]
xor rcx, rsp
call fcn.1800ece20
mov rbx, qword [rsp + 0x2440]
add rsp, 0x2400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800130c0
nop
call fcn.18010e944
int3
call fcn.18010e944
int3
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3
call fcn.18010e944
int3
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3
call fcn.18010e944
int3
call fcn.18010e944
int3
call fcn.18010e944
nop
call fcn.18010e944
nop
call fcn.18010e944
int3