Function at 0x1401b96c0
Capabilities:
Authenticate hmac
Get installed programs
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x430
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
movaps xmmword [rax - 0xa8], xmm12
movaps xmmword [rax - 0xb8], xmm13
movaps xmmword [rax - 0xc8], xmm14
movaps xmmword [rax - 0xd8], xmm15
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0x288], rax
mov rsi, rdx
mov r12, rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x18], rdx
mov rcx, rdx
call fcn.1401b6200
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
je 0x1401b9772
movss xmm2, dword [0x14034cf58]
mov edx, 1
mov rcx, rsi
call fcn.1400e0c90
mov rdx, rsi
mov rcx, r12
call fcn.1401bd560
xorps xmm10, xmm10
test al, al
je 0x1401b979e
movaps xmm2, xmm10
mov edx, 9
mov rcx, rsi
call fcn.1400e0c90
or qword [rsi + 0x40], 0x10000000
mov r8d, 0xf
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d5080
nop
xor r8d, r8d
lea rdx, str.Critical
mov rcx, rax
call fcn.1401e9310
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401b97d5
mov rcx, qword [rbp - 0x68]
call fcn.140298600
test bl, bl
je 0x1401b980c
mov edx, 9
mov rcx, rsi
call fcn.1400d4b20
movss xmm13, dword [0x14034cd98]
test al, al
je 0x1401b97f9
movaps xmm2, xmm10
jmp 0x1401b97fd
movaps xmm2, xmm13
mov edx, 0x4d
mov rcx, rsi
call fcn.1400e0c90
jmp 0x1401b9815
movss xmm13, dword [0x14034cd98]
mov rcx, rsi
call fcn.1400d05e0
lea rdi, [0x140323de0]
test al, al
je 0x1401b9b60
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
jne 0x1401b9b60
mov rcx, rsi
call fcn.1400d54b0
mov r15, rax
movss xmm7, dword [0x14034ce44]
test rax, rax
je 0x1401b9b68
mov rcx, qword [rax]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x1401b9b68
lea r13, str.Win64
movsd xmm6, qword [0x14034cd20]
nop word [rax + rax]
mov qword [rsp + 0x50], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401b9897
mov qword [rsp + 0x48], rdi
jmp 0x1401b98bc
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.14029b4d8
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.1401ea290
nop
xor r8d, r8d
lea rdx, [0x14032309c]
lea rcx, [rsp + 0x48]
call fcn.1401eb700
test al, al
je 0x1401b9ae0
xor r8d, r8d
lea rdx, [0x14033e198]
lea rcx, [rsp + 0x48]
call fcn.1401e9960
test eax, eax
jle 0x1401b9ae0
movaps xmm1, xmm6
lea rcx, [rbp + 0x260]
call fcn.1400eb850
mov r9, rax
mov r8, rsi
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.1401b8fc0
test al, al
jne 0x1401b9b48
mov rcx, rsi
call fcn.1401b67f0
test al, al
je 0x1401b9ae0
mov rcx, rsi
call fcn.1401b6860
test rax, rax
je 0x1401b9ae0
mov rcx, qword [rax]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1401b9ae0
mov edi, dword [rsp + 0x54]
mov r11, qword [rax + 0x20]
cmp edi, dword [r11 + 0xc]
jne 0x1401b99a1
mov rdx, qword [rsp + 0x48]
mov r10, qword [r11]
sub r10, rdx
nop word [rax + rax]
movzx r9d, word [rdx]
movzx r8d, word [rdx + r10]
sub r9d, r8d
jne 0x1401b9997
add rdx, 2
test r8d, r8d
jne 0x1401b9980
test r9d, r9d
sete dl
test dl, dl
jne 0x1401b99fc
cmp byte [rax + 0x19], 0
jne 0x1401b99ee
mov rdx, qword [rax + 0x10]
cmp byte [rdx + 0x19], 0
jne 0x1401b99ce
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
jne 0x1401b99ee
nop dword [rax]
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x1401b99c0
jmp 0x1401b99ee
mov rdx, qword [rax + 8]
cmp byte [rdx + 0x19], 0
jne 0x1401b99eb
cmp rax, qword [rdx + 0x10]
jne 0x1401b99eb
mov rax, rdx
mov rdx, qword [rdx + 8]
cmp byte [rdx + 0x19], 0
je 0x1401b99d8
mov rax, rdx
cmp rax, rcx
je 0x1401b9ad9
jmp 0x1401b9960
xor r14b, r14b
xor dil, dil
mov eax, dword [r11 + 0x14]
cmp eax, 5
jae 0x1401b9a27
mov ecx, dword [r11 + 0x10]
cmp ecx, 0x14
jae 0x1401b9a27
cmp eax, 2
jae 0x1401b9a22
cmp ecx, 0xa
jb 0x1401b9ad9
mov dil, 1
jmp 0x1401b9a2a
mov r14b, 1
movaps xmm2, xmm7
mov edx, 0x49
mov rcx, rsi
call fcn.1400e0c90
test r14b, r14b
je 0x1401b9abd
mov eax, dword [rsi + 0x40]
shr rax, 0xb
and al, 1
lea rdx, str.Win32
cmovne rdx, r13
lea rcx, [rbp - 0x78]
call fcn.1401e6fd0
nop
mov edx, dword [rbp - 0x6c]
inc edx
lea rcx, [rbp - 0x78]
call fcn.1401e9030
movsxd rcx, dword [rbp - 0x6c]
mov rax, qword [rbp - 0x78]
mov edx, 0x2f
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x6c]
inc edx
lea rcx, [rbp - 0x78]
call fcn.1401ea290
lea rdx, str.Backdoor.Behavior
lea rcx, [rbp - 0x78]
call fcn.1401e7680
lea r8, [rbp - 0x78]
mov edx, 2
mov rcx, rsi
call fcn.1400d62d0
nop
cmp dword [rbp - 0x70], 0
jle 0x1401b9ad9
mov rcx, qword [rbp - 0x78]
call fcn.140298600
jmp 0x1401b9ad9
test dil, dil
lea rdi, [0x140323de0]
je 0x1401b9ae0
movabs rax, 0x2000000000
or qword [rsi + 0x40], rax
jmp 0x1401b9ae0
lea rdi, [0x140323de0]
cmp dword [rsp + 0x50], 0
jle 0x1401b9af1
mov rcx, qword [rsp + 0x48]
call fcn.140298600
cmp byte [rbx + 0x19], 0
jne 0x1401b9b3e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401b9b1e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401b9b3e
nop dword [rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401b9b10
jmp 0x1401b9b3e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401b9b3b
cmp rbx, qword [rax + 0x10]
jne 0x1401b9b3b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401b9b28
mov rbx, rax
cmp rbx, qword [r15]
je 0x1401b9b68
jmp 0x1401b9880
cmp dword [rsp + 0x50], 0
jle 0x1401b9b59
mov rcx, qword [rsp + 0x48]
call fcn.140298600
xor al, al
jmp 0x1401bce08
movss xmm7, dword [0x14034ce44]
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401b9bcc
lea rdx, [rsi + 8]
lea rcx, [rbp - 0x68]
call fcn.1400dfeb0
nop
lea rdx, [rsi + 8]
mov rcx, r12
call fcn.1401b89f0
test al, al
je 0x1401b9bbd
mov edx, dword [rsi + 0x14]
add edx, 0xfffffff8
js 0x1401b9bbd
lea rcx, [rsi + 8]
call fcn.1401e7500
mov ecx, 0x202e
cmp ax, cx
jne 0x1401b9bbd
movaps xmm2, xmm7
mov edx, 0x15
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rbp - 0x60], 0
jle 0x1401b9bcc
mov rcx, qword [rbp - 0x68]
call fcn.140298600
mov rcx, rsi
call fcn.1400d4fb0
movss xmm12, dword [0x14034cda8]
test al, al
je 0x1401b9bfd
mov eax, dword [rsi + 0x40]
shr rax, 0x1e
test al, 1
je 0x1401b9bfd
movaps xmm2, xmm12
mov edx, 0x46
mov rcx, rsi
call fcn.1400e0c90
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x34
movss xmm6, dword [0x14034cd38]
test al, 1
je 0x1401b9c76
mov rax, rcx
shr rax, 0x24
test al, 1
jne 0x1401b9c76
mov rax, rcx
shr rax, 0x1c
test al, 1
jne 0x1401b9c76
shr rcx, 0x1a
test cl, 1
jne 0x1401b9c76
mov rcx, qword [r12 + 8]
call fcn.1400f1660
test al, al
je 0x1401b9c46
movaps xmm2, xmm7
jmp 0x1401b9c69
mov rcx, rsi
call fcn.1400d05e0
test al, al
je 0x1401b9c66
mov rcx, rsi
call fcn.1400d5020
cmp qword [rax + 8], 1
ja 0x1401b9c66
movaps xmm2, xmm7
jmp 0x1401b9c69
movaps xmm2, xmm6
mov edx, 0x47
mov rcx, rsi
call fcn.1400e0c90
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x35
test al, 1
je 0x1401b9cd8
mov rax, rcx
shr rax, 0x24
test al, 1
jne 0x1401b9cd8
mov rax, rcx
shr rax, 0x1c
test al, 1
jne 0x1401b9cd8
shr rcx, 0x1a
test cl, 1
jne 0x1401b9cd8
mov rcx, qword [r12 + 8]
call fcn.1400f1660
test al, al
je 0x1401b9cb7
movaps xmm2, xmm7
jmp 0x1401b9ccb
mov rcx, rsi
call fcn.1400d05e0
test al, al
je 0x1401b9cc8
movaps xmm2, xmm7
jmp 0x1401b9ccb
movaps xmm2, xmm6
mov edx, 0x48
mov rcx, rsi
call fcn.1400e0c90
mov eax, dword [rsi + 0x40]
shr rax, 0xd
movabs r15, 0x100000000
movss xmm6, dword [0x14034ce40]
test al, 1
je 0x1401b9d26
movaps xmm2, xmm10
mov edx, 0x2a
mov rcx, rsi
call fcn.1400e0c90
mov rax, qword [rsi + 0x40]
shr rax, 0x23
test al, 1
je 0x1401b9d26
movaps xmm2, xmm6
mov edx, 0x3e
mov rcx, rsi
call fcn.1400e0c90
or qword [rsi + 0x40], r15
mov rax, qword [rsi + 0x40]
shr rax, 0x20
test al, 1
jne 0x1401b9e51
lea r14, [rsi + 8]
lea rdx, [rbp + 0x10]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x1401b9d66
cmp word [rbp + 0x3c], 0
jne 0x1401b9d58
or qword [rsi + 0x40], r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1401b9e51
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1401b9db3
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x20000
lea r8d, [rax + 2]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1401b9db3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401b9e51
mov rdx, qword [r12 + 8]
mov rcx, r14
call fcn.1401e02f0
mov rdi, rax
lea rax, vtable.Core::SharedPtr_class_HitmanPro35::FileSystemBase_.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdi
xor ebx, ebx
mov qword [rbp - 0x48], rbx
test rdi, rdi
je 0x1401b9e05
lea ecx, [rbx + 4]
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x1401b9df9
mov dword [rax], 0
mov qword [rbp - 0x48], rax
jmp 0x1401b9dff
xor ebx, ebx
mov qword [rbp - 0x48], rbx
mov dword [rbx], 1
test rdi, rdi
je 0x1401b9e23
mov rax, qword [rdi]
lea r8, [rsp + 0x68]
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x20]
test al, al
je 0x1401b9e23
or qword [rsi + 0x40], r15
test rbx, rbx
je 0x1401b9e51
mov eax, dword [rbx]
test eax, eax
jle 0x1401b9e32
dec eax
mov dword [rbx], eax
cmp dword [rbx], 0
jne 0x1401b9e51
test rdi, rdi
je 0x1401b9e49
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, rbx
call fcn.1402012c0
mov rax, qword [rsi + 0x40]
shr rax, 0x20
test al, 1
je 0x1401b9e7d
mov rdx, qword [rsi + 8]
lea rcx, str.Cloaked__s__r_n
call fcn.14029a88c
movaps xmm2, xmm6
mov edx, 3
mov rcx, rsi
call fcn.1400e0c90
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x21
test al, 1
je 0x1401b9e96
movaps xmm2, xmm6
mov edx, 3
jmp 0x1401b9eac
shr rcx, 0x18
test cl, 1
je 0x1401b9eb4
movss xmm2, dword [0x14034cf40]
mov edx, 4
mov rcx, rsi
call fcn.1400e0c90
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401b9f0f
bt rcx, 8
jb 0x1401b9ee1
lea rcx, [rsi + 8]
xor r8d, r8d
lea rdx, str..dll
call fcn.1401e8ee0
test al, al
jne 0x1401b9f0f
mov eax, dword [rsi + 0x40]
shr rax, 0x18
test al, 1
je 0x1401b9f0f
mov rcx, rsi
call fcn.1400d4a50
comiss xmm12, xmm0
jbe 0x1401b9f0f
movss xmm2, dword [0x14034cf10]
mov edx, 5
mov rcx, rsi
call fcn.1400e0c90
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401b9f5a
mov edx, 0x400
mov rcx, rsi
call fcn.1401b2c40
test al, al
je 0x1401b9f5a
lea rcx, [rsi + 8]
mov r8d, 1
lea rdx, str..NET
call fcn.1401e8da0
test al, al
je 0x1401b9f5a
movss xmm2, dword [0x14034cf34]
mov edx, 0x28
mov rcx, rsi
call fcn.1400e0c90
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401b9f83
shr rcx, 0x2f
test cl, 1
je 0x1401b9f83
movaps xmm2, xmm10
mov edx, 0x3c
mov rcx, rsi
call fcn.1400e0c90
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401b9fe1
bt rcx, 8
jb 0x1401b9fe1
lea rcx, [rsi + 8]
xor r8d, r8d
lea rdx, str..dll
call fcn.1401e8ee0
test al, al
je 0x1401b9fe1
mov rcx, rsi
call fcn.1401b6170
cmp eax, 1
jne 0x1401b9fe1
lea edx, [rax + 3]
mov rcx, rsi
call fcn.1401b2c40
test al, al
je 0x1401b9fe1
movss xmm2, dword [0x14034cf3c]
mov edx, 0x29
mov rcx, rsi
call fcn.1400e0c90
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
movss xmm8, dword [0x14034cdd0]
movss xmm6, dword [0x14034cde0]
test al, 1
je 0x1401ba1b0
xor r14b, r14b
shr rcx, 0x1b
test cl, 1
jne 0x1401ba0aa
lea rdx, [rsi + 8]
lea rcx, [rsp + 0x58]
call fcn.1400d2fb0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400dfeb0
nop
xor r8d, r8d
lea rdx, [0x140328b70]
lea rcx, [rsp + 0x78]
call fcn.1401e9310
test al, al
je 0x1401ba088
xor edi, edi
lea rbx, str.setup
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [rsp + 0x58]
call fcn.1401e8da0
test al, al
jne 0x1401ba085
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, 3
jb 0x1401ba060
jmp 0x1401ba088
mov r14b, 1
cmp dword [rbp - 0x80], 0
jle 0x1401ba099
mov rcx, qword [rsp + 0x78]
call fcn.140298600
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ba0aa
mov rcx, qword [rsp + 0x58]
call fcn.140298600
mov r9, qword [rsi + 0x40]
mov rax, r9
shr rax, 0x1b
test al, 1
jne 0x1401ba0c2
test r14b, r14b
je 0x1401ba1b0
mov r8, qword [rsi + 0x50]
test r8, r8
je 0x1401ba1b0
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ba0f8
nop
cmp dword [rcx + 0x20], 1
jge 0x1401ba0ec
mov rcx, qword [rcx + 0x10]
jmp 0x1401ba0f2
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ba0e0
cmp rdx, rax
je 0x1401ba108
cmp dword [rdx + 0x20], 1
mov qword [rsp + 0x68], rdx
jle 0x1401ba10d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401ba125
cmp qword [rax + 0x28], 0
jne 0x1401ba1b0
test r8, r8
je 0x1401ba1b0
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ba158
nop
cmp dword [rcx + 0x20], 0xe
jge 0x1401ba14c
mov rcx, qword [rcx + 0x10]
jmp 0x1401ba152
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ba140
cmp rdx, rax
je 0x1401ba168
cmp dword [rdx + 0x20], 0xe
mov qword [rsp + 0x68], rdx
jle 0x1401ba16d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401ba1b0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401ba1b0
movss xmm0, dword [rcx]
comiss xmm0, xmm8
jbe 0x1401ba1b0
movaps xmm2, xmm6
test r14b, r14b
jne 0x1401ba19f
shr r9, 0x1a
test r9b, 1
je 0x1401ba1a3
movaps xmm2, xmm10
mov edx, 0x3f
mov rcx, rsi
call fcn.1400e0c90
mov eax, dword [rsi + 0x40]
shr rax, 9
movss xmm11, dword [0x14034cce0]
movss xmm7, dword [0x14034ce1c]
mov rcx, rsi
test al, 1
je 0x1401ba258
mov r8d, 9
lea rdx, [rsp + 0x58]
call fcn.1400d5080
nop
xor r8d, r8d
lea rdx, str.Boot
lea rcx, [rsp + 0x58]
call fcn.1401e9310
test al, al
jne 0x1401ba22c
xor r8d, r8d
lea rdx, str.System
lea rcx, [rsp + 0x58]
call fcn.1401e9310
test al, al
jne 0x1401ba22c
xor r8d, r8d
lea rdx, str.AutoLoad
lea rcx, [rsp + 0x58]
call fcn.1401e9310
test al, al
je 0x1401ba23e
movaps xmm2, xmm11
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ba2fb
mov rcx, qword [rsp + 0x58]
call fcn.140298600
jmp 0x1401ba2fb
call fcn.1400d05e0
test al, al
je 0x1401ba2cc
movaps xmm6, xmm11
movsxd rax, dword [r12 + 0x1f4]
cmp dword [rsi + 0x14], eax
jl 0x1401ba2b2
mov r8, rax
mov rdx, qword [r12 + 0x1e8]
mov rcx, qword [rsi + 8]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401ba2b2
movaps xmm6, xmm12
mov eax, dword [rsi + 0x40]
shr rax, 0xa
test al, 1
je 0x1401ba2a1
movaps xmm6, xmm7
lea rcx, [rsi + 8]
call fcn.1401b5fe0
test al, al
jne 0x1401ba2b2
addss xmm6, xmm7
movaps xmm2, xmm6
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e0c90
movss xmm6, dword [0x14034cde0]
jmp 0x1401ba2fb
lea rdx, [rsi + 8]
mov rcx, qword [r12 + 8]
call fcn.1400fb810
test al, al
je 0x1401ba2fb
lea rdx, [rsi + 8]
mov rcx, rsi
call fcn.1400ed120
movaps xmm2, xmm11
mov edx, 0x1f
mov rcx, rsi
call fcn.1400e0c90
lea r13, [rsi + 8]
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d1ab0
nop
mov rdi, qword [r12 + 0x100]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401ba344
nop
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x20]
call fcn.14029848c
test eax, eax
jns 0x1401ba338
mov rbx, qword [rbx + 0x10]
jmp 0x1401ba33e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401ba320
cmp rdi, qword [r12 + 0x100]
je 0x1401ba367
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.14029848c
test eax, eax
js 0x1401ba367
mov qword [rsp + 0x68], rdi
jmp 0x1401ba374
mov rax, qword [r12 + 0x100]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r12 + 0x100]
jne 0x1401ba3b2
movsxd rax, dword [r12 + 0x224]
cmp dword [rsp + 0x64], eax
jl 0x1401ba3c4
mov r8, rax
mov rdx, qword [r12 + 0x218]
mov rcx, qword [rsp + 0x58]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401ba3c4
movaps xmm2, xmm11
mov edx, 7
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ba3d5
mov rcx, qword [rsp + 0x58]
call fcn.140298600
mov rax, qword [r12 + 0x110]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401ba47b
movsxd rax, dword [rbx + 0x2c]
cmp dword [r13 + 0xc], eax
jl 0x1401ba40c
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
jne 0x1401ba46b
cmp byte [rbx + 0x19], 0
jne 0x1401ba45e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ba43e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ba45e
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ba430
jmp 0x1401ba45e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ba45b
cmp rbx, qword [rax + 0x10]
jne 0x1401ba45b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ba448
mov rbx, rax
cmp rbx, qword [r12 + 0x110]
jmp 0x1401ba3e3
movaps xmm2, xmm6
mov edx, 8
mov rcx, rsi
call fcn.1400e0c90
mov rax, qword [rsi + 0x40]
shr rax, 0x2c
test al, 1
je 0x1401ba4ad
mov edx, 7
mov rcx, rsi
call fcn.1400d4b20
test al, al
jne 0x1401ba4ad
movss xmm2, dword [0x14034cd9c]
mov edx, 0x3b
mov rcx, rsi
call fcn.1400e0c90
movsxd rax, dword [r12 + 0x194]
cmp dword [r13 + 0xc], eax
jl 0x1401ba5a5
mov r8, rax
mov rdx, qword [r12 + 0x188]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401ba5a5
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d2fb0
nop
mov rax, qword [r12 + 0x120]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401ba594
movsxd rax, dword [rbx + 0x2c]
cmp dword [rsp + 0x64], eax
jl 0x1401ba526
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.14029a350
test eax, eax
sete al
test al, al
jne 0x1401ba583
cmp byte [rbx + 0x19], 0
jne 0x1401ba576
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ba550
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ba576
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ba542
jmp 0x1401ba576
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ba573
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401ba573
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ba560
mov rbx, rax
cmp rbx, qword [r12 + 0x120]
jmp 0x1401ba4fc
movaps xmm2, xmm7
mov edx, 6
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x60], 0
jle 0x1401ba5a5
mov rcx, qword [rsp + 0x58]
call fcn.140298600
mov r8, qword [rsi + 0x50]
movss xmm6, dword [0x14034cdec]
test r8, r8
je 0x1401ba755
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ba5e8
nop word [rax + rax]
cmp dword [rcx + 0x20], 2
jge 0x1401ba5dc
mov rcx, qword [rcx + 0x10]
jmp 0x1401ba5e2
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ba5d0
cmp rdx, rax
je 0x1401ba5f8
cmp dword [rdx + 0x20], 2
mov qword [rsp + 0x68], rdx
jle 0x1401ba5fd
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401ba755
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401ba755
cmp qword [rcx + 8], 0
seta al
test al, al
je 0x1401ba755
movabs rax, 0x8000000000000000
test qword [rsi + 0x40], rax
je 0x1401ba755
mov rdx, r13
mov rcx, r12
call fcn.1401b89f0
test al, al
je 0x1401ba755
mov r8, qword [rsi + 0x50]
test r8, r8
jne 0x1401ba65f
xor ebx, ebx
jmp 0x1401ba6b2
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ba688
nop
cmp dword [rcx + 0x20], 2
jge 0x1401ba67c
mov rcx, qword [rcx + 0x10]
jmp 0x1401ba682
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ba670
cmp rdx, rax
je 0x1401ba698
cmp dword [rdx + 0x20], 2
mov qword [rsp + 0x68], rdx
jle 0x1401ba69d
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
jne 0x1401ba6ae
xor ebx, ebx
jmp 0x1401ba6b2
mov rbx, qword [rax + 0x28]
mov rbx, qword [rbx]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d5020
cmp rbx, qword [rax]
je 0x1401ba755
nop dword [rax]
mov rdx, qword [rbx + 0x20]
shr rdx, 0x20
mov rcx, qword [r12 + 8]
call fcn.1400fdce0
test rax, rax
je 0x1401ba745
cmp byte [rbx + 0x19], 0
jne 0x1401ba736
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ba711
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ba736
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ba703
jmp 0x1401ba736
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ba733
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401ba733
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ba720
mov rbx, rax
mov rcx, rsi
call fcn.1400d5020
cmp rbx, qword [rax]
jne 0x1401ba6d0
jmp 0x1401ba755
movaps xmm2, xmm6
mov edx, 0xa
mov rcx, rsi
call fcn.1400e0c90
mov r8, qword [rsi + 0x50]
movss xmm15, dword [0x14034cf18]
movss xmm9, dword [0x14034cd78]
test r8, r8
je 0x1401ba837
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ba79c
cmp dword [rcx + 0x20], 3
jge 0x1401ba790
mov rcx, qword [rcx + 0x10]
jmp 0x1401ba796
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ba784
cmp rdx, rax
je 0x1401ba7ac
cmp dword [rdx + 0x20], 3
mov qword [rsp + 0x68], rdx
jle 0x1401ba7b1
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401ba7d3
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401ba7d3
cmp qword [rcx + 8], 0
seta al
test al, al
jne 0x1401ba847
test r8, r8
je 0x1401ba837
mov rax, qword [r8]
mov rcx, qword [rax + 8]
mov rdx, rax
cmp byte [rcx + 0x19], 0
jne 0x1401ba800
cmp dword [rcx + 0x20], 4
jge 0x1401ba7f4
mov rcx, qword [rcx + 0x10]
jmp 0x1401ba7fa
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x1401ba7e8
cmp rdx, rax
je 0x1401ba810
cmp dword [rdx + 0x20], 4
mov qword [rsp + 0x68], rdx
jle 0x1401ba815
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r8]
je 0x1401ba837
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1401ba837
cmp qword [rcx + 8], 0
seta al
test al, al
jne 0x1401ba847
mov rcx, rsi
call fcn.1400d4fb0
test al, al
je 0x1401ba9cf
movaps xmm2, xmm11
mov edx, 0xb
mov rcx, rsi
call fcn.1400e0c90
movsxd rax, dword [r12 + 0x1a4]
cmp dword [r13 + 0xc], eax
jl 0x1401ba883
mov r8, rax
mov rdx, qword [r12 + 0x198]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
jne 0x1401ba8ae
movsxd rax, dword [r12 + 0x1b4]
cmp dword [r13 + 0xc], eax
jl 0x1401ba8bf
mov r8, rax
mov rdx, qword [r12 + 0x1a8]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401ba8bf
movaps xmm2, xmm11
mov edx, 0xc
mov rcx, rsi
call fcn.1400e0c90
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 9
test al, 1
jne 0x1401ba956
bt rcx, 8
jb 0x1401ba8ef
xor r8d, r8d
lea rdx, str..dll
mov rcx, r13
call fcn.1401e8ee0
test al, al
jne 0x1401ba956
mov rcx, rsi
call fcn.1401b68c0
mov rcx, rsi
cmp eax, 0xfa0
jb 0x1401ba90c
movaps xmm2, xmm15
mov edx, 0xd
jmp 0x1401ba951
mov rdx, qword [r12 + 8]
call fcn.1400d6630
test eax, eax
jg 0x1401ba956
mov rdx, qword [r12 + 8]
mov rcx, rsi
call fcn.1400d6910
test eax, eax
jle 0x1401ba93a
movss xmm2, dword [0x14034cf14]
mov edx, 0xe
jmp 0x1401ba94e
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
jne 0x1401ba956
movaps xmm2, xmm9
mov edx, 0xf
mov rcx, rsi
call fcn.1400e0c90
mov rcx, rsi
call fcn.1401b62f0
test al, al
je 0x1401ba9a0
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401ba98f
mov edx, 4
mov rcx, rsi
call fcn.1400d51d0
test al, al
je 0x1401ba98f
mov edx, 2
mov rcx, rsi
call fcn.1400d51d0
test al, al
jne 0x1401ba9a0
movaps xmm2, xmm9
mov edx, 0x10
mov rcx, rsi
call fcn.1400e0c90
mov rcx, rsi
call fcn.1401b6460
test al, al
je 0x1401ba9cf
mov rax, qword [rsi + 0x40]
shr rax, 0x24
test al, 1
je 0x1401ba9be
movaps xmm2, xmm10
jmp 0x1401ba9c2
movaps xmm2, xmm9
mov edx, 0x11
mov rcx, rsi
call fcn.1400e0c90
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401baac8
mov rdx, r13
lea rcx, [rsp + 0x78]
call fcn.1400d2fb0
nop
mov rdi, qword [r12 + 0x130]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401baa24
nop
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbx + 0x20]
call fcn.14029848c
test eax, eax
jns 0x1401baa18
mov rbx, qword [rbx + 0x10]
jmp 0x1401baa1e
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401baa00
cmp rdi, qword [r12 + 0x130]
je 0x1401baa47
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsp + 0x78]
call fcn.14029848c
test eax, eax
js 0x1401baa47
mov qword [rsp + 0x68], rdi
jmp 0x1401baa54
mov rax, qword [r12 + 0x130]
mov qword [rsp + 0x68], rax
lea rbx, [rsp + 0x68]
mov rbx, qword [rbx]
cmp rbx, qword [r12 + 0x130]
je 0x1401baab8
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d1ab0
nop
mov eax, dword [rsp + 0x64]
cmp dword [rbx + 0x3c], eax
jne 0x1401baa94
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0x30]
call fcn.14029848c
test eax, eax
sete al
test al, al
jne 0x1401baaa6
movaps xmm2, xmm12
mov edx, 0x12
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x60], 0
jle 0x1401baab8
mov rcx, qword [rsp + 0x58]
call fcn.140298600
nop
cmp dword [rbp - 0x80], 0
jle 0x1401baac8
mov rcx, qword [rsp + 0x78]
call fcn.140298600
mov eax, dword [rsi + 0x40]
shr rax, 0x15
lea r15, vtable.Core::Array_class_Core::String_.0
movss xmm14, dword [0x14034cde8]
movss xmm10, dword [0x14034cc88]
test al, 1
je 0x1401bb1ab
mov rdx, r13
lea rcx, [rbp - 0x10]
call fcn.1400dfeb0
nop
mov rdi, qword [r12 + 0xf0]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x1401bab33
nop
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbx + 0x20]
call fcn.14029848c
test eax, eax
jns 0x1401bab27
mov rbx, qword [rbx + 0x10]
jmp 0x1401bab2d
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401bab10
cmp rdi, qword [r12 + 0xf0]
je 0x1401bab55
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rbp - 0x10]
call fcn.14029848c
test eax, eax
js 0x1401bab55
mov qword [rsp + 0x68], rdi
jmp 0x1401bab62
mov rax, qword [r12 + 0xf0]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov rax, qword [rax]
cmp rax, qword [r12 + 0xf0]
je 0x1401bab89
movss xmm2, dword [0x14034cd9c]
mov edx, 0x15
mov rcx, rsi
call fcn.1400e0c90
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.1400d2fb0
nop
mov qword [rbp - 0x58], r15
xor ebx, ebx
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x48], rbx
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7710
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140322fd0]
lea rcx, [rsp + 0x58]
call fcn.1401eaad0
cmp dword [rbp - 0x50], 2
jg 0x1401bacc6
mov rdx, r13
mov rcx, r12
call fcn.1401b89f0
test al, al
jne 0x1401bacc6
mov qword [rbp + 0x260], r15
mov dword [rbp + 0x268], ebx
mov qword [rbp + 0x270], rbx
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7710
nop
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x1403232c8]
lea rcx, [rsp + 0x58]
call fcn.1401eaad0
test eax, eax
jle 0x1401bac76
mov edi, dword [rbp + 0x268]
test edi, edi
jle 0x1401bac76
mov r14, qword [rbp + 0x270]
nop dword [rax]
nop word [rax + rax]
movsxd rcx, ebx
shl rcx, 4
add rcx, r14
mov r8d, 1
lea rdx, str.plug
call fcn.1401e9310
test al, al
jne 0x1401bacaf
inc ebx
cmp ebx, edi
jl 0x1401bac50
mov eax, dword [rsi + 0x40]
shr rax, 9
test al, 1
je 0x1401bac8b
movss xmm2, dword [0x14034ce44]
jmp 0x1401baca1
mov rcx, rsi
call fcn.1400d05e0
test al, al
je 0x1401bac9d
movaps xmm2, xmm14
jmp 0x1401baca1
movaps xmm2, xmm9
mov edx, 0x14
mov rcx, rsi
call fcn.1400e0c90
nop
mov qword [rbp + 0x260], r15
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7710
xor ebx, ebx
mov eax, dword [rsi + 0x40]
shr rax, 0xa
test al, 1
je 0x1401bace2
movaps xmm2, xmm13
mov edx, 0x13
mov rcx, rsi
call fcn.1400e0c90
mov r8d, 2
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400d5080
nop
cmp dword [rbp - 0x7c], 0
jle 0x1401bad34
lea rdx, [rsp + 0x78]
mov rcx, qword [r12 + 8]
call fcn.1400fc5c0
test al, al
je 0x1401bad16
mov edx, 0x16
jmp 0x1401bad29
lea rcx, [rsp + 0x78]
call fcn.1401bd6b0
test al, al
je 0x1401bad34
mov edx, 0x1c
movaps xmm2, xmm6
mov rcx, rsi
call fcn.1400e0c90
xor r12b, r12b
movdqa xmm0, xmmword [0x14034cf70]
movdqu xmmword [rbp + 0x260], xmm0
lea rdi, [rbp + 0x260]
nop
mov r8d, dword [rdi]
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d5080
nop
xor r8d, r8d
lea rdx, str.TODO:
mov rcx, rax
call fcn.1401e8da0
movzx r14d, al
cmp dword [rbp - 0x60], 0
jle 0x1401bad85
mov rcx, qword [rbp - 0x68]
call fcn.140298600
test r14b, r14b
jne 0x1401bad9b
inc ebx
add rdi, 4
movsxd rax, ebx
cmp rax, 4
jb 0x1401bad50
jmp 0x1401bad9e
mov r12b, 1
mov r8d, 3
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.1400d5080
nop
cmp dword [rbp - 0x6c], 0
jle 0x1401badfc
mov r8d, 1
lea rdx, str.TODO:
lea rcx, [rbp - 0x78]
call fcn.1401eb700
test al, al
jne 0x1401badeb
mov r8d, 1
lea rdx, str.aaaaa
lea rcx, [rbp - 0x78]
call fcn.1401eb700
test al, al
je 0x1401badfc
movaps xmm2, xmm11
mov edx, 0x17
mov rcx, rsi
call fcn.1400e0c90
xor r15b, r15b
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1400d5080
nop
cmp dword [rsp + 0x54], 0
je 0x1401bafc4
mov r8d, 1
lea rdx, str.0.0.0.0
lea rcx, [rsp + 0x48]
call fcn.1401e9310
lea r14, vtable.Core::Array_class_Core::String_.0
test al, al
jne 0x1401bafcb
mov qword [rbp + 0x260], r14
mov dword [rbp + 0x268], 0
mov qword [rbp + 0x270], 0
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7710
nop
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x140322fd0]
lea rcx, [rsp + 0x48]
call fcn.1401eaad0
cmp eax, 2
jge 0x1401baf6e
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x14032dda4]
lea rcx, [rsp + 0x48]
call fcn.1401eaad0
cmp eax, 2
jl 0x1401baf6b
mov rdi, qword [0x1403ec168]
test rdi, rdi
jne 0x1401baed1
xor ebx, ebx
jmp 0x1401baf0a
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401baed5
test ebx, ebx
jle 0x1401baf0a
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x48]
call fcn.14029b4d8
jmp 0x1401baf11
cmp dword [rsp + 0x54], 0
jle 0x1401baf1d
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401ea290
mov eax, dword [rbp + 0x268]
test eax, eax
jle 0x1401baf6e
xor ebx, ebx
mov rdi, qword [rbp + 0x270]
mov r14d, eax
test rbx, rbx
jle 0x1401baf49
lea rdx, [0x140322fd0]
lea rcx, [rsp + 0x48]
call fcn.1401e7680
mov rdx, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.1401e7680
inc rbx
add rdi, 0x10
dec r14
jne 0x1401baf33
lea r14, vtable.Core::Array_class_Core::String_.0
jmp 0x1401baf6e
mov r15b, 1
mov qword [rbp + 0x260], r14
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.1400c7710
test r15b, r15b
jne 0x1401bafcb
cmp dword [rbp - 0x6c], 0
jle 0x1401bafe7
xor edi, edi
lea rbx, str.virus
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rbx]
lea rcx, [rbp - 0x78]
call fcn.1401e8da0
test al, al
jne 0x1401bafe7
inc edi
add rbx, 8
movsxd rax, edi
cmp rax, 5
jb 0x1401bafa0
jmp 0x1401bafe7
lea r14, vtable.Core::Array_class_Core::String_.0
movss xmm13, dword [0x14034cd38]
movaps xmm2, xmm13
mov edx, 0x18
mov rcx, rsi
call fcn.1400e0c90
jmp 0x1401baff0
movss xmm13, dword [0x14034cd38]
cmp dword [rbp - 0x7c], 3
jl 0x1401bb03d
lea rcx, [rsp + 0x78]
call fcn.1401b8ab0
test al, al
jne 0x1401bb03d
mov r8d, 1
lea rdx, str.TODO:
lea rcx, [rsp + 0x78]
call fcn.1401eb700
test al, al
jne 0x1401bb03d
test r12b, r12b
jne 0x1401bb07e
mov r8d, 1
lea rdx, str.Microsoft_Corporation
lea rcx, [rsp + 0x78]
call fcn.1401e9310
jmp 0x1401bb07e
mov r8d, 5
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d5080
cmp dword [rax + 0xc], 5
jle 0x1401bb05b
movaps xmm6, xmm10
jmp 0x1401bb05f
movaps xmm6, xmm13
cmp dword [rbp - 0x60], 0
jle 0x1401bb06e
mov rcx, qword [rbp - 0x68]
call fcn.140298600
movaps xmm2, xmm6
mov edx, 0x1a
mov rcx, rsi
call fcn.1400e0c90
mov rcx, rsi
call fcn.1401b60e0
mov ebx, eax
test eax, eax
je 0x1401bb0dd
cmp eax, 1
jne 0x1401bb09f
mov edx, eax
mov rcx, rsi
call fcn.1401b6060
test al, al
jne 0x1401bb0dd
movd xmm6, ebx
cvtdq2ps xmm6, xmm6
mov edx, 8
mov rcx, rsi
call fcn.1401b6060
test al, al
jne 0x1401bb0c8
mov edx, 0x100
mov rcx, rsi
call fcn.1401b6060
test al, al
je 0x1401bb0cd
mulss xmm6, xmm11
movaps xmm2, xmm6
mov edx, 0x1d
mov rcx, rsi
call fcn.1400e0c90
mov edx, 0x200
mov rcx, rsi
call fcn.1401b6060
test al, al
je 0x1401bb0fe
movaps xmm2, xmm7
mov edx, 0x43
mov rcx, rsi
call fcn.1400e0c90
mov edx, 0x400
mov rcx, rsi
call fcn.1401b6060
test al, al
je 0x1401bb120
movaps xmm2, xmm13
mov edx, 0x44
mov rcx, rsi
call fcn.1400e0c90
mov edx, 0x800
mov rcx, rsi
call fcn.1401b6060
test al, al
je 0x1401bb143
movaps xmm2, xmm13
mov edx, 0x45
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x50], 0
jle 0x1401bb155
mov rcx, qword [rsp + 0x48]
call fcn.140298600
nop
cmp dword [rbp - 0x70], 0
jle 0x1401bb165
mov rcx, qword [rbp - 0x78]
call fcn.140298600
nop
cmp dword [rbp - 0x80], 0
jle 0x1401bb176
mov rcx, qword [rsp + 0x78]
call fcn.140298600
nop
mov qword [rbp - 0x58], r14
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7710
nop
cmp dword [rsp + 0x60], 0
jle 0x1401bb198
mov rcx, qword [rsp + 0x58]
call fcn.140298600
nop
cmp dword [rbp - 8], 0
jle 0x1401bb1a7
mov rcx, qword [rbp - 0x10]
call fcn.140298600
mov r12, qword [rbp - 0x30]
call fcn.140114940
lea r14, [rsi + 0x20]
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400ca960
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
movsd xmm13, qword [0x14034ce78]
divsd xmm0, xmm13
cvtpd2ps xmm0, xmm0
xorps xmm6, xmm6
comiss xmm6, xmm0
jbe 0x1401bb1f2
movaps xmm2, xmm9
jmp 0x1401bb28f
call fcn.140114940
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400ca960
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
comiss xmm12, xmm1
jbe 0x1401bb227
movaps xmm2, xmm11
jmp 0x1401bb28f
call fcn.140114940
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400ca960
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
comiss xmm7, xmm1
ja 0x1401bb28b
call fcn.140114940
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400ca960
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x14034ce44]
comiss xmm0, xmm1
jbe 0x1401bb29c
movaps xmm2, xmm10
mov edx, 0x1e
mov rcx, rsi
call fcn.1400e0c90
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401bb3d3
mov rcx, rsi
call fcn.1400d4a50
movss xmm7, dword [0x14034cd98]
comiss xmm7, xmm0
ja 0x1401bb3db
mov rcx, rsi
call fcn.1400d4a50
mov rcx, rsi
comiss xmm12, xmm0
jbe 0x1401bb302
call fcn.1401b60e0
movss xmm8, dword [0x14034cd38]
cmp eax, 2
jl 0x1401bb3e4
movaps xmm2, xmm8
mov edx, 0x20
mov rcx, rsi
call fcn.1400e0c90
jmp 0x1401bb3e4
call fcn.1400d4a50
comiss xmm8, xmm0
jbe 0x1401bb363
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401bb33c
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401bb33c
movaps xmm6, xmm10
cmp dword [rsi + 0x38], 0x400000
jb 0x1401bb34c
addss xmm6, xmm11
jmp 0x1401bb351
addss xmm6, xmm9
movaps xmm2, xmm6
mov edx, 0x20
mov rcx, rsi
call fcn.1400e0c90
jmp 0x1401bb3db
mov rcx, rsi
call fcn.1400d4a50
comiss xmm0, xmm8
jb 0x1401bb3db
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401bb3a0
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401bb3a0
movaps xmm6, xmm11
movss xmm8, dword [0x14034cd38]
cmp dword [rsi + 0x38], 0x400000
jb 0x1401bb3b9
addss xmm6, xmm8
jmp 0x1401bb3c1
addss xmm6, dword [0x14034cde0]
movaps xmm2, xmm6
mov edx, 0x20
mov rcx, rsi
call fcn.1400e0c90
jmp 0x1401bb3e4
movss xmm7, dword [0x14034cd98]
movss xmm8, dword [0x14034cd38]
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401bb5b6
mov edx, 6
mov rcx, rsi
call fcn.1400d51d0
test al, al
je 0x1401bb48b
mov r8d, 6
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1400d5080
nop
cmp dword [rsp + 0x64], 0
je 0x1401bb47a
mov rbx, qword [rsp + 0x58]
mov r8d, 0xa
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.14029b2e4
mov rdx, qword [rsp + 0x68]
sub rdx, rbx
sar rdx, 1
movsxd rcx, dword [rsp + 0x64]
cmp rdx, rcx
jne 0x1401bb47a
lea ecx, [rax + 0x7fffffff]
cmp ecx, 0xfffffffd
ja 0x1401bb47a
dec eax
cmp eax, 0x2fe
ja 0x1401bb47a
movss xmm2, dword [0x14034ce44]
mov edx, 0x25
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x60], 0
jle 0x1401bb48b
mov rcx, qword [rsp + 0x58]
call fcn.140298600
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x10
test al, 1
je 0x1401bb553
shr rcx, 0x26
test cl, 1
je 0x1401bb4bc
movss xmm2, dword [0x14034ce88]
mov edx, 0x21
mov rcx, rsi
call fcn.1400e0c90
movss xmm2, dword [0x14034ce40]
mov edx, 0x24
mov rcx, rsi
call fcn.1400e0c90
xor r15d, r15d
mov qword [rbp - 0x80], r15
lea edx, [r15 + 0x16]
lea rcx, [rsp + 0x78]
call fcn.1401e9030
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
lea r9d, [r15 + 0x16]
lea r8, str.Labels_EwsAuthenticode
mov rcx, qword [rsp + 0x78]
call fcn.14029b4d8
lea edx, [r15 + 0x16]
lea rcx, [rsp + 0x78]
call fcn.1401ea290
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.1400f6370
nop
cmp dword [rbp - 0x80], r15d
jle 0x1401bb532
mov rcx, qword [rsp + 0x78]
call fcn.140298600
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.14015c010
nop
cmp dword [rsp + 0x60], 0
jle 0x1401bb5b9
mov rcx, qword [rsp + 0x58]
call fcn.140298600
jmp 0x1401bb5b9
mov rax, rcx
shr rax, 0x1a
test al, 1
je 0x1401bb5b6
mov rax, rcx
shr rax, 0x26
test al, 1
je 0x1401bb57b
movss xmm2, dword [0x14034ce88]
mov edx, 0x21
mov rcx, rsi
jmp 0x1401bb5b1
shr rcx, 0x11
test cl, 1
mov rcx, rsi
je 0x1401bb5a4
call fcn.1400d05e0
test al, al
je 0x1401bb596
movaps xmm2, xmm12
jmp 0x1401bb59a
movaps xmm2, xmm8
mov edx, 0x26
mov rcx, rsi
jmp 0x1401bb5b1
movss xmm2, dword [0x14034cf2c]
mov edx, 0x22
call fcn.1400e0c90
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x15
test al, 1
je 0x1401bb617
shr rcx, 0x1a
test cl, 1
je 0x1401bb617
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400dfeb0
nop
xor r8d, r8d
lea rdx, str..cpl
mov rcx, rax
call fcn.1401e9310
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401bb602
mov rcx, qword [rbp - 0x68]
call fcn.140298600
test bl, bl
je 0x1401bb617
movaps xmm2, xmm8
mov edx, 0x23
mov rcx, rsi
call fcn.1400e0c90
mov rcx, rsi
call fcn.1400d05e0
mov edi, 0x5c
test al, al
je 0x1401bbb84
mov rcx, rsi
call fcn.1400d54b0
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d54b0
cmp rbx, qword [rax]
je 0x1401bba71
movss xmm15, dword [0x14034ce44]
mov r14d, edi
nop word [rax + rax]
mov qword [rsp + 0x50], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401bb67e
lea rax, [0x140323de0]
mov qword [rsp + 0x48], rax
jmp 0x1401bb6a3
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
call fcn.14029b4d8
mov edx, dword [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.1401ea290
nop
mov r8d, 1
lea rdx, [0x14032309c]
lea rcx, [rsp + 0x48]
call fcn.1401eb700
test al, al
je 0x1401bb9b3
mov edx, r14d
mov rcx, qword [rsp + 0x48]
call fcn.14029b070
mov rdi, rax
test rax, rax
je 0x1401bb97f
sub rdi, qword [rsp + 0x48]
sar rdi, 1
test edi, edi
jle 0x1401bb97f
mov r8d, 1
lea rdx, [0x1403232e0]
lea rcx, [rsp + 0x48]
call fcn.1401eb700
test al, al
je 0x1401bb727
lea r8d, [rdi + 1]
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.1401e9590
mov edi, eax
test edi, edi
jle 0x1401bb97f
lea r8d, [rdi + 1]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.1401eaef0
nop
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x78]
call fcn.1401eb700
test al, al
jne 0x1401bb91b
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun
lea rcx, [rsp + 0x78]
call fcn.1401eb700
test al, al
jne 0x1401bb91b
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon_
lea rcx, [rsp + 0x78]
call fcn.1401eb700
lea rcx, [rsp + 0x78]
test al, al
je 0x1401bb881
mov r8d, 0x36
lea rdx, [rsp + 0x58]
call fcn.1401eaef0
nop
xor r8d, r8d
lea rdx, str.Notify_
lea rcx, [rsp + 0x58]
call fcn.1401eb700
test al, al
je 0x1401bb7e0
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401bb7d6
movaps xmm2, xmm11
jmp 0x1401bb7d9
movaps xmm2, xmm7
mov edx, 0x2d
jmp 0x1401bb85e
xor r8d, r8d
lea rdx, str.Shell
lea rcx, [rsp + 0x58]
call fcn.1401e9310
test al, al
jne 0x1401bb828
xor r8d, r8d
lea rdx, str.UserInit
lea rcx, [rsp + 0x58]
call fcn.1401e9310
test al, al
jne 0x1401bb828
xor r8d, r8d
lea rdx, str.System
lea rcx, [rsp + 0x58]
call fcn.1401e9310
test al, al
je 0x1401bb867
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x30
test al, 1
je 0x1401bb846
shr rcx, 0x15
test cl, 1
je 0x1401bb855
movaps xmm2, xmm15
jmp 0x1401bb859
shr rcx, 0x1a
test cl, 1
je 0x1401bb855
movaps xmm2, xmm8
jmp 0x1401bb859
movaps xmm2, xmm12
mov edx, 0x2e
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x60], 0
jle 0x1401bb96f
mov rcx, qword [rsp + 0x58]
call fcn.140298600
jmp 0x1401bb96f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindowsAppInit_DLLs
call fcn.1401e9310
test al, al
je 0x1401bb8b3
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401bb8a5
movaps xmm2, xmm8
jmp 0x1401bb8a9
movaps xmm2, xmm12
mov edx, 0x2f
jmp 0x1401bb966
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
lea rcx, [rsp + 0x78]
call fcn.1401e9310
test al, al
je 0x1401bb8e7
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401bb8dc
movaps xmm2, xmm8
jmp 0x1401bb8e0
movaps xmm2, xmm12
mov edx, 0x30
jmp 0x1401bb966
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
lea rcx, [rsp + 0x78]
call fcn.1401eb700
test al, al
je 0x1401bb96f
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401bb910
movaps xmm2, xmm11
jmp 0x1401bb914
movaps xmm2, xmm12
mov edx, 0x31
jmp 0x1401bb966
movaps xmm6, xmm8
movsxd rax, dword [r12 + 0x1e4]
cmp dword [r13 + 0xc], eax
jl 0x1401bb95e
mov r8, rax
mov rdx, qword [r12 + 0x1d8]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401bb95e
mov edx, 4
mov rcx, rsi
call fcn.1401b2c40
test al, al
jne 0x1401bb95e
movaps xmm6, xmm7
movaps xmm2, xmm6
mov edx, 0x2c
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rbp - 0x80], 0
jle 0x1401bb97f
mov rcx, qword [rsp + 0x78]
call fcn.140298600
xor r8d, r8d
lea rdx, str.HKLMSYSTEMCurrentControlSetControlSecurityProvidersSecurityProviders
lea rcx, [rsp + 0x48]
call fcn.1401eb700
test al, al
je 0x1401bb9e9
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401bb9a8
movaps xmm2, xmm8
jmp 0x1401bb9ac
movaps xmm2, xmm12
mov edx, 0x32
jmp 0x1401bb9e0
lea rdx, [rsp + 0x48]
mov rcx, qword [r12 + 8]
call fcn.1400fb810
test al, al
je 0x1401bb9e9
mov eax, dword [rsi + 0x40]
shr rax, 0x1a
test al, 1
je 0x1401bb9d7
movaps xmm2, xmm10
jmp 0x1401bb9db
movaps xmm2, xmm9
mov edx, 0x33
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x50], 0
jle 0x1401bb9fa
mov rcx, qword [rsp + 0x48]
call fcn.140298600
cmp byte [rbx + 0x19], 0
jne 0x1401bba4e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401bba2e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401bba4e
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401bba20
jmp 0x1401bba4e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401bba4b
cmp rbx, qword [rax + 0x10]
jne 0x1401bba4b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401bba38
mov rbx, rax
mov rcx, rsi
call fcn.1400d54b0
cmp rbx, qword [rax]
jne 0x1401bb660
movss xmm15, dword [0x14034cf18]
lea r14, [rsi + 0x20]
mov edi, 0x5c
mov rcx, rsi
call fcn.1400d54b0
mov rbx, qword [rax]
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.1400d54b0
cmp rbx, qword [rax]
je 0x1401bbb84
lea rdi, [0x140323de0]
nop word [rax + rax]
mov qword [rbp - 0x70], 0
mov edx, dword [rbx + 0x2c]
test edx, edx
jne 0x1401bbab5
mov qword [rbp - 0x78], rdi
jmp 0x1401bbad7
lea rcx, [rbp - 0x78]
call fcn.1401e9030
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401ea290
nop
mov r8d, 1
lea rdx, [0x14032309c]
lea rcx, [rbp - 0x78]
call fcn.1401eb700
test al, al
je 0x1401bbb15
mov r8d, 1
lea rdx, str._shellopencommand_
lea rcx, [rbp - 0x78]
call fcn.1401e8ee0
nop
cmp dword [rbp - 0x70], 0
jle 0x1401bbb24
mov rcx, qword [rbp - 0x78]
call fcn.140298600
cmp byte [rbx + 0x19], 0
jne 0x1401bbb6e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401bbb4e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401bbb6e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401bbb40
jmp 0x1401bbb6e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401bbb6b
cmp rbx, qword [rax + 0x10]
jne 0x1401bbb6b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401bbb58
mov rbx, rax
mov rcx, rsi
call fcn.1400d54b0
cmp rbx, qword [rax]
jne 0x1401bbaa0
mov edi, 0x5c
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 9
test al, 1
je 0x1401bbbb1
shr rcx, 0x1a
test cl, 1
jne 0x1401bbba0
movaps xmm10, xmm8
movaps xmm2, xmm10
mov edx, 0x34
mov rcx, rsi
call fcn.1400e0c90
xor r15b, r15b
mov byte [rsp + 0x40], r15b
mov rcx, qword [rsi + 0x40]
mov rax, rcx
shr rax, 0x26
movss xmm7, dword [0x14034cf30]
test al, 1
jne 0x1401bbf4b
mov rax, rcx
shr rax, 0x20
test al, 1
jne 0x1401bbf4b
mov rax, rcx
shr rax, 0x22
test al, 1
jne 0x1401bbf4b
shr rcx, 0xa
test cl, 1
jne 0x1401bbf4b
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400dfeb0
nop
mov r8d, 1
lea rdx, str..cpl
mov rcx, rax
call fcn.1401e9310
movzx ebx, al
cmp dword [rbp - 0x60], 0
jle 0x1401bbc33
mov rcx, qword [rbp - 0x68]
call fcn.140298600
test bl, bl
jne 0x1401bbf4b
mov rdx, r13
lea rcx, [rsp + 0x68]
call fcn.1400d1ab0
nop
xorps xmm8, xmm8
movaps xmm6, xmm8
mov rdx, r13
mov rcx, qword [r12 + 8]
call fcn.1400f6da0
test al, al
je 0x1401bbc6f
movss xmm6, dword [0x14034cf38]
jmp 0x1401bbdae
mov qword [rsp + 0x50], 0
mov edx, dword [rsp + 0x74]
test edx, edx
jne 0x1401bbc8e
lea rax, [0x140323de0]
mov qword [rsp + 0x48], rax
jmp 0x1401bbcb9
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd r9, dword [rsp + 0x74]
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
call fcn.14029b4d8
mov edx, dword [rsp + 0x74]
lea rcx, [rsp + 0x48]
call fcn.1401ea290
nop
cmp dword [rsp + 0x54], 3
jle 0x1401bbd91
lea rdx, [rsp + 0x48]
mov rcx, qword [r12 + 8]
call fcn.1400f6e60
test al, al
jne 0x1401bbd70
cmp dword [rsp + 0x54], 0
je 0x1401bbd91
mov edx, edi
mov rcx, qword [rsp + 0x48]
call fcn.14029aea8
test rax, rax
je 0x1401bbd91
sub rax, qword [rsp + 0x48]
sar rax, 1
test eax, eax
js 0x1401bbd91
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.1400d1ab0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsp + 0x50]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x48]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x48]
call fcn.1401ea290
nop
cmp dword [rbp - 0x60], 0
jle 0x1401bbcc4
mov rcx, qword [rbp - 0x68]
call fcn.140298600
jmp 0x1401bbcc4
xor r8d, r8d
lea rdx, str.ExpertHelper
lea rcx, [rsp + 0x68]
call fcn.1401e8da0
test al, al
je 0x1401bbd8e
movaps xmm6, xmm15
jmp 0x1401bbd91
movaps xmm6, xmm7
cmp dword [rsp + 0x50], 0
jle 0x1401bbda2
mov rcx, qword [rsp + 0x48]
call fcn.140298600
ucomiss xmm6, xmm8
jp 0x1401bbdae
je 0x1401bbf31
cmp dword [rsp + 0x74], 3
jle 0x1401bbf31
mov edx, edi
mov r8d, 3
lea rcx, [rsp + 0x68]
call fcn.1401e9590
cmp eax, 0xffffffff
je 0x1401bbf31
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1c4], eax
jne 0x1401bbe01
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1b8]
call fcn.14029848c
test eax, eax
sete al
test al, al
jne 0x1401bbf31
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1d4], eax
jne 0x1401bbe2e
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1c8]
call fcn.14029848c
test eax, eax
sete al
test al, al
jne 0x1401bbf31
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1e4], eax
jne 0x1401bbe5b
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1d8]
call fcn.14029848c
test eax, eax
sete al
test al, al
jne 0x1401bbf31
mov eax, dword [rsp + 0x74]
cmp dword [r12 + 0x1f4], eax
jne 0x1401bbe88
mov rdx, qword [rsp + 0x68]
mov rcx, qword [r12 + 0x1e8]
call fcn.14029848c
test eax, eax
sete al
test al, al
jne 0x1401bbf31
mov rax, qword [r12 + 0x140]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401bbf18
nop dword [rax]
movsxd rax, dword [rbx + 0x2c]
cmp dword [rsp + 0x74], eax
jl 0x1401bbec4
mov r8, rax
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x68]
call fcn.14029a350
test eax, eax
sete al
test al, al
jne 0x1401bbf31
cmp byte [rbx + 0x19], 0
jne 0x1401bbf0e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401bbeee
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401bbf0e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401bbee0
jmp 0x1401bbf0e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401bbf0b
cmp rbx, qword [rax + 0x10]
jne 0x1401bbf0b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401bbef8
mov rbx, rax
cmp rbx, qword [r12 + 0x140]
jne 0x1401bbea0
mov r15b, 1
mov byte [rsp + 0x40], r15b
movaps xmm2, xmm6
mov edx, 0x35
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x70], 0
jle 0x1401bbf42
mov rcx, qword [rsp + 0x68]
call fcn.140298600
test r15b, r15b
jne 0x1401bc58f
movsxd rax, dword [r12 + 0x1d4]
cmp dword [r13 + 0xc], eax
jl 0x1401bbf7a
mov r8, rax
mov rdx, qword [r12 + 0x1c8]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
jne 0x1401bc58f
movsxd rax, dword [r12 + 0x1c4]
cmp dword [r13 + 0xc], eax
jl 0x1401bc58f
mov r8, rax
mov rdx, qword [r12 + 0x1b8]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401bc58f
mov eax, dword [rsi + 0x14]
cmp eax, dword [r12 + 0x1c4]
jle 0x1401bc58f
xor edx, edx
mov r14d, edx
mov dword [rbp - 0x40], edx
cmp dword [r12 + 0x158], edx
jl 0x1401bc58b
mov r15d, edx
mov qword [rbp], rdx
mov r13, 0xfffffffffffffff0
mov qword [rbp - 0x38], r13
lea rcx, [0x1403232e8]
movss xmm8, dword [0x14034cf34]
nop word [rax + rax]
lea rdi, [0x1403232e0]
test r14d, r14d
cmove rdi, rcx
test rdi, rdi
jne 0x1401bc01c
mov ebx, edx
mov qword [rsp + 0x50], rdi
jmp 0x1401bc037
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401bc020
mov qword [rsp + 0x50], 0
test ebx, ebx
jne 0x1401bc045
lea rax, [0x140323de0]
mov qword [rsp + 0x48], rax
jmp 0x1401bc06a
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsp + 0x50]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rsp + 0x48]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401ea290
nop
test r15, r15
jle 0x1401bc107
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd rcx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401ea290
mov rdi, qword [r12 + 0x160]
mov ebx, dword [rsp + 0x54]
add ebx, dword [r13 + rdi + 0xc]
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd r9, dword [r13 + rdi + 0xc]
mov ecx, dword [rsp + 0x50]
movsxd rax, dword [rsp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rsp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [r13 + rdi]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1401ea290
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401e9030
movsxd rcx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x48]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rsp + 0x54]
inc edx
lea rcx, [rsp + 0x48]
call fcn.1401ea290
lea rdx, [0x14032c040]
lea rcx, [rsp + 0x48]
call fcn.1401e7680
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400ecf50
mov r12, rax
test rax, rax
je 0x1401bc53c
mov rax, qword [rbp - 0x30]
mov r8d, dword [rax + 0x1c4]
inc r8d
lea rdx, [rbp - 0x68]
lea rcx, [rsi + 8]
call fcn.1401eaef0
nop
lea rdi, vtable.Core::Array_class_Core::String_.0
mov qword [rbp - 0x58], rdi
xor ebx, ebx
mov dword [rbp - 0x50], ebx
mov qword [rbp - 0x48], rbx
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7710
nop
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x1403232c8]
lea rcx, [rbp - 0x68]
call fcn.1401eaad0
test eax, eax
jle 0x1401bc50d
lea rax, [0x140323de0]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rbx
mov eax, ebx
cmp dword [rbp - 0x50], 2
setg al
inc eax
mov r14d, ebx
movsxd r15, eax
test eax, eax
jle 0x1401bc4f5
mov r13, qword [rbp - 0x48]
lea rdi, [r13 + 0xc]
cmp dword [rdi], 3
jle 0x1401bc217
movsxd rdx, r14d
shl rdx, 4
add rdx, r13
mov rax, qword [rbp - 0x30]
mov rcx, qword [rax + 8]
call fcn.1400f6940
test al, al
jne 0x1401bc228
inc r14d
inc rbx
add rdi, 0x10
cmp rbx, r15
jge 0x1401bc262
jmp 0x1401bc1f7
shl rbx, 4
add rbx, r13
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x78]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401ea290
cmp dword [rbp - 0x7c], 0
jle 0x1401bc4ea
movaps xmm6, xmm7
mov byte [rsp + 0x40], 1
mov eax, dword [rsi + 0x40]
bt rax, 8
jb 0x1401bc299
xor r8d, r8d
lea rdx, str..dll
lea rcx, [rsi + 8]
call fcn.1401e8ee0
test al, al
je 0x1401bc299
movaps xmm6, xmm8
xor r15d, r15d
mov qword [rbp - 0x10], r15
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401bc4ea
lea ecx, [rax + 0x10]
call fcn.14029806c
mov rdi, rax
lea r14, vtable.Core::Win32::RegistryKey.0
test rax, rax
je 0x1401bc2ee
mov rax, qword [rbp - 0x10]
mov qword [rdi], r14
mov qword [rdi + 8], rax
jmp 0x1401bc2f1
mov rdi, r15
test rdi, rdi
je 0x1401bc4ea
lea rbx, [0x140323de0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r15
lea r8, [rbp - 0x78]
lea rdx, str.Publisher
mov rcx, rdi
call fcn.1400d5720
xor r8d, r8d
lea rdx, str.virus
lea rcx, [rbp - 0x78]
call fcn.1401e8da0
test al, al
jne 0x1401bc4c8
xor r8d, r8d
lea rdx, str.anti
lea rcx, [rbp - 0x78]
call fcn.1401e8da0
test al, al
jne 0x1401bc4c8
movaps xmm2, xmm6
mov edx, 0x35
mov rcx, rsi
call fcn.1400e0c90
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], r15
lea r8, [rsp + 0x58]
lea rdx, str.DisplayName
mov rcx, rdi
call fcn.1400d5720
test al, al
je 0x1401bc4b5
mov eax, dword [rbp - 0x6c]
test eax, eax
jne 0x1401bc3ca
lea edx, [rax + 9]
lea rcx, [rbp - 0x78]
call fcn.1401e9030
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 9
lea r8, [0x14033e708]
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, 9
lea rcx, [rbp - 0x78]
call fcn.1401ea290
mov eax, dword [rbp - 0x6c]
cmp eax, 3
jle 0x1401bc4b5
cmp dword [rsp + 0x64], 3
jle 0x1401bc4b5
mov r9, qword [rsp + 0x58]
mov r8, qword [rbp - 0x78]
lea rdx, str.SOFTWARE_ws_ws
lea rcx, [rbp + 0x260]
call fcn.1401e94c0
mov rbx, rax
mov ecx, dword [0x1403fe620]
test cl, 1
jne 0x1401bc42f
or ecx, 1
mov dword [0x1403fe620], ecx
mov qword [0x1403fe5f8], r14
mov qword [0x1403fe600], 0xffffffff80000001
lea rcx, [0x1402de070]
call fcn.140299c6c
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [0x1403fe600]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401bc479
lea ecx, [rax + 0x10]
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x1401bc479
mov rax, qword [rsp + 0x68]
mov qword [rbx], r14
mov qword [rbx + 8], rax
jmp 0x1401bc47c
mov rbx, r15
cmp dword [rbp + 0x268], 0
jle 0x1401bc491
mov rcx, qword [rbp + 0x260]
call fcn.140298600
test rbx, rbx
je 0x1401bc4b5
movaps xmm2, xmm15
mov edx, 0x36
mov rcx, rsi
call fcn.1400e0c90
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
cmp dword [rsp + 0x60], 0
jle 0x1401bc4cd
mov rcx, qword [rsp + 0x58]
call fcn.140298600
jmp 0x1401bc4cd
mov byte [rsp + 0x40], 0
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp - 0x70], 0
jle 0x1401bc4ea
mov rcx, qword [rbp - 0x78]
call fcn.140298600
mov r13, qword [rbp - 0x38]
lea rdi, vtable.Core::Array_class_Core::String_.0
cmp dword [rbp - 0x80], 0
jle 0x1401bc505
mov rcx, qword [rsp + 0x78]
call fcn.140298600
mov r15, qword [rbp]
mov r14d, dword [rbp - 0x40]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp - 0x58], rdi
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.1400c7710
nop
cmp dword [rbp - 0x60], 0
jle 0x1401bc53c
mov rcx, qword [rbp - 0x68]
call fcn.140298600
nop
cmp dword [rsp + 0x50], 0
jle 0x1401bc54d
mov rcx, qword [rsp + 0x48]
call fcn.140298600
inc r14d
mov dword [rbp - 0x40], r14d
inc r15
mov qword [rbp], r15
add r13, 0x10
mov qword [rbp - 0x38], r13
mov r12, qword [rbp - 0x30]
cmp r14d, dword [r12 + 0x158]
lea rcx, [0x1403232e8]
mov edx, 0
jle 0x1401bc000
movzx r15d, byte [rsp + 0x40]
lea r13, [rsi + 8]
lea r14, [rsi + 0x20]
xor dil, dil
mov edx, 7
mov rcx, rsi
call fcn.1400d51d0
test al, al
jne 0x1401bc665
mov rcx, rsi
call fcn.1400d4a50
movss xmm6, dword [0x14034cd9c]
comiss xmm6, xmm0
ja 0x1401bc66d
cmp dword [rsi + 0x38], 0x500000
jae 0x1401bc66d
call fcn.140114940
mov r8, r14
lea rdx, [rbp + 0x260]
mov rcx, rax
call fcn.1400ca960
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rax + 8]
divsd xmm0, xmm13
cvtpd2ps xmm0, xmm0
comiss xmm0, dword [0x14034ce40]
ja 0x1401bc66d
lea rax, [0x140323de0]
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
lea rdx, [rbp - 0x58]
mov rcx, rsi
call fcn.1400d4620
nop
lea r9, [rsp + 0x58]
mov r8, rax
mov rdx, r13
mov rcx, qword [r12 + 0x228]
call fcn.1401e3430
nop
test al, al
je 0x1401bc652
mov dil, 1
lea r8, [rsp + 0x58]
mov edx, 7
mov rcx, rsi
call fcn.14000b7c0
nop
cmp dword [rsp + 0x60], 0
jle 0x1401bc66d
mov rcx, qword [rsp + 0x58]
call fcn.140298600
jmp 0x1401bc66d
movss xmm6, dword [0x14034cd9c]
mov edx, 7
mov rcx, rsi
call fcn.1400d51d0
test al, al
je 0x1401bc6ea
mov r8d, 7
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.1400d5080
nop
mov byte [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x68]
mov rcx, r12
call fcn.1401bd140
movzx ebx, byte [rsp + 0x40]
test al, al
je 0x1401bc6c9
test bl, bl
je 0x1401bc6cd
movss xmm2, dword [0x14034cde0]
mov edx, 0x38
mov rcx, rsi
call fcn.1400e0c90
test bl, bl
jne 0x1401bc6db
test dil, dil
je 0x1401bc6db
mov rcx, rsi
call fcn.1401b6610
nop
cmp dword [rbp - 0x60], 0
jle 0x1401bc6ea
mov rcx, qword [rbp - 0x68]
call fcn.140298600
test r15b, r15b
je 0x1401bc869
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400d1ab0
nop
lea r14, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.1.0
mov qword [rbp + 0x260], r14
lea r15, vtable.Core::Collections::Generic::LinkedList_class_Core::String_.0
mov qword [rbp + 0x268], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
xor edi, edi
mov dword [rbp + 0x280], edi
lea r8, [rbp + 0x260]
lea rdx, [rbp - 0x68]
mov rcx, qword [r12 + 8]
call fcn.1400f7070
test al, al
je 0x1401bc83f
lea ecx, [rdi + 0x18]
call fcn.14029806c
mov rbx, rax
test rax, rax
je 0x1401bc777
lea rax, vtable.Core::Collections::Generic::LinkedList_class_Core::String_::Enumerator_class_Core::String_.0
mov qword [rbx], rax
lea rax, [rbp + 0x260]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rdi
jmp 0x1401bc77a
mov rbx, rdi
lea rax, vtable.Core::SharedPtr_class_Core::Collections::Generic::IEnumerator_class_Core::String__.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
test rbx, rbx
je 0x1401bc7bc
mov ecx, 4
call fcn.14029806c
mov rdi, rax
test rax, rax
je 0x1401bc7b0
mov dword [rax], 0
mov qword [rbp - 0x48], rax
jmp 0x1401bc7b6
xor edi, edi
mov qword [rbp - 0x48], rdi
mov dword [rdi], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
je 0x1401bc81a
nop dword [rax + rax]
mov byte [rsp + 0x40], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r8, rax
lea r9, [rsp + 0x40]
mov rcx, r12
call fcn.1401bd140
test al, al
je 0x1401bc80e
cmp byte [rsp + 0x40], 0
je 0x1401bc80e
movss xmm2, dword [0x14034cde0]
mov edx, 0x39
mov rcx, rsi
call fcn.1400e0c90
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
test al, al
jne 0x1401bc7d0
test rdi, rdi
je 0x1401bc83f
mov eax, dword [rdi]
test eax, eax
jle 0x1401bc829
dec eax
mov dword [rdi], eax
cmp dword [rdi], 0
jne 0x1401bc83f
mov rcx, rbx
call fcn.1402012c0
mov rcx, rdi
call fcn.1402012c0
nop
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x268], r15
lea rcx, [rbp + 0x268]
call fcn.140119c60
nop
cmp dword [rbp - 0x60], 0
jle 0x1401bc869
mov rcx, qword [rbp - 0x68]
call fcn.140298600
lea rdx, [rbp - 0x28]
mov rcx, rsi
call fcn.1400d5360
nop
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.14000a2d0
nop
mov rdx, rax
lea rcx, [r12 + 0xd0]
call fcn.14000a450
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x260]
lea rcx, [r12 + 0xd0]
call fcn.1401bdce0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401bc8c5
mov rcx, qword [rbp - 0x58]
call fcn.140298600
mov edx, 7
mov rcx, rsi
call fcn.1400d51d0
test al, al
je 0x1401bcaab
mov rdx, qword [r13]
lea rcx, str.INTERNET_FILE:__ws_r_n
call fcn.140298d38
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x58]
call fcn.14000a2d0
nop
mov rdx, rax
lea rcx, [r12 + 0xc0]
call fcn.14000a450
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x260]
lea rcx, [r12 + 0xc0]
call fcn.1401bdce0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401bc939
mov rcx, qword [rbp - 0x58]
call fcn.140298600
mov rbx, qword [r12 + 0xd0]
mov r8, qword [rbx + 8]
cmp byte [r8 + 0x19], 0
jne 0x1401bc990
nop dword [rax]
mov rax, qword [r8 + 0x20]
mov r9, qword [rbp - 0x28]
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x1401bc974
add rax, 2
test ecx, ecx
jne 0x1401bc960
test edx, edx
jns 0x1401bc97e
mov r8, qword [r8 + 0x10]
jmp 0x1401bc984
mov rbx, r8
mov r8, qword [r8]
cmp byte [r8 + 0x19], 0
je 0x1401bc950
nop dword [rax + rax]
mov r10, qword [r12 + 0xd0]
mov r8, qword [r10 + 8]
cmp byte [r8 + 0x19], 0
jne 0x1401bc9eb
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp - 0x28]
mov r9, qword [r8 + 0x20]
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x1401bc9d4
add rax, 2
test ecx, ecx
jne 0x1401bc9c0
test edx, edx
jns 0x1401bc9e0
mov r10, r8
mov r8, qword [r8]
jmp 0x1401bc9e4
mov r8, qword [r8 + 0x10]
cmp byte [r8 + 0x19], 0
je 0x1401bc9b0
cmp rbx, r10
je 0x1401bcbd9
mov rdi, qword [rbx + 0x30]
cmp rdi, rsi
je 0x1401bca4d
mov edx, 7
mov rcx, rdi
call fcn.1400d51d0
test al, al
jne 0x1401bca4d
mov rdx, qword [rdi + 8]
lea rcx, str.RE_QUEUEING:__s_r_n
call fcn.14029a88c
mov rax, qword [rbx + 0x30]
mov edx, dword [rax + 0x38]
lea rcx, str._tSize_u_r_n
call fcn.14029a88c
mov rdx, qword [rbp - 0x28]
lea rcx, str._tHash_s_r_n
call fcn.14029a88c
mov rdx, qword [rbx + 0x30]
mov rcx, r12
call fcn.1401b7250
cmp byte [rbx + 0x19], 0
jne 0x1401bc990
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401bca82
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401bc990
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401bca71
jmp 0x1401bc990
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401bcaa3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401bcaa3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401bca90
mov rbx, rax
jmp 0x1401bc990
cmp qword [r12 + 0xc8], 0
jbe 0x1401bcbd9
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x18]
lea rcx, [r12 + 0xc0]
call fcn.1400c8720
mov rax, qword [rax]
cmp rax, qword [r12 + 0xc0]
je 0x1401bcbd9
mov rbx, qword [rax + 0x30]
mov r8, qword [rbx + 8]
mov rdx, qword [r13]
lea rcx, str.FILE_CAME_FROM_INTERNET_r_n_ws_r_n_ws_r_n
call fcn.140298d38
mov edx, 0xb
mov rcx, rsi
call fcn.1400d4b20
mov rdx, r13
mov rcx, r12
test al, al
je 0x1401bcb23
call fcn.1401b89f0
movss xmm13, dword [0x14034cd38]
test al, al
jne 0x1401bcb3b
jmp 0x1401bcb3f
call fcn.1401b89f0
movss xmm13, dword [0x14034cd38]
test al, al
je 0x1401bcb3b
movaps xmm14, xmm13
jmp 0x1401bcb3f
movaps xmm14, xmm6
movaps xmm2, xmm14
mov edx, 0x3a
mov rcx, rsi
call fcn.1400e0c90
mov r8d, 7
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400d5080
nop
cmp dword [rsp + 0x64], 0
jle 0x1401bcbc6
mov edx, 7
mov rcx, rsi
call fcn.1400d51d0
test al, al
jne 0x1401bcb8e
lea r8, [rsp + 0x58]
mov edx, 7
mov rcx, rsi
call fcn.14000b7c0
mov byte [rsp + 0x40], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x58]
mov rcx, r12
call fcn.1401bd140
test al, al
je 0x1401bcbc6
cmp byte [rsp + 0x40], 0
je 0x1401bcbc6
movss xmm2, dword [0x14034cde0]
mov edx, 0x38
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rsp + 0x60], 0
jle 0x1401bcbe2
mov rcx, qword [rsp + 0x58]
call fcn.140298600
jmp 0x1401bcbe2
movss xmm13, dword [0x14034cd38]
mov edx, 7
mov rcx, rsi
call fcn.1400d4b20
test al, al
je 0x1401bcc53
mov edx, 9
mov rcx, rsi
call fcn.1400d4b20
test al, al
je 0x1401bcc53
mov eax, dword [rsi + 0x40]
shr rax, 9
test al, 1
jne 0x1401bcc53
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.1400dfeb0
nop
xor r8d, r8d
lea rdx, str..sys
lea rcx, [rbp - 0x68]
call fcn.1401e9310
test al, al
je 0x1401bcc44
movaps xmm2, xmm6
mov edx, 0x37
mov rcx, rsi
call fcn.1400e0c90
nop
cmp dword [rbp - 0x60], 0
jle 0x1401bcc53
mov rcx, qword [rbp - 0x68]
call fcn.140298600
mov eax, dword [rsi + 0x40]
shr rax, 0x1c
test al, 1
je 0x1401bcc80
mov edx, 0x800
mov rcx, rsi
call fcn.1401b2c40
test al, al
je 0x1401bcc80
movaps xmm2, xmm13
mov edx, 0x41
mov rcx, rsi
call fcn.1400e0c90
mov eax, dword [rsi + 0x40]
shr rax, 0x15
test al, 1
je 0x1401bcde6
movsxd rax, dword [r12 + 0x184]
cmp dword [r13 + 0xc], eax
jl 0x1401bcde6
mov r8, rax
mov rdx, qword [r12 + 0x178]
mov rcx, qword [r13]
call fcn.14029a350
test eax, eax
sete al
test al, al
je 0x1401bcde6
xor r8d, r8d
lea rdx, [0x14033ade8]
mov rcx, r13
call fcn.1401e8ee0
test al, al
je 0x1401bcde6
xor eax, eax
mov qword [rbp - 0x80], rax
lea edx, [rax + 0xc]
lea rcx, [rsp + 0x78]
call fcn.1401e9030
mov eax, dword [rbp - 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0xc
lea r8, [0x14033ade8]
mov rcx, qword [rsp + 0x78]
call fcn.14029b4d8
mov edx, 0xc
lea rcx, [rsp + 0x78]
call fcn.1401ea290
nop
lea r8, [rsp + 0x78]
lea rdx, [r12 + 0x178]
lea rcx, [rsp + 0x58]
call fcn.1400d1690
nop
cmp dword [rbp - 0x80], 0
jle 0x1401bcd46
mov rcx, qword [rsp + 0x78]
call fcn.140298600
mov eax, dword [r13 + 0xc]
cmp dword [rsp + 0x64], eax
jne 0x1401bcdd5
mov rdx, qword [r13]
mov rcx, qword [rsp + 0x58]
call fcn.14029848c
test eax, eax
sete al
test al, al
je 0x1401bcdd5
mov eax, dword [rsi + 0x40]
shr rax, 0xe
movss xmm6, dword [0x14034ce44]
test al, 1
jne 0x1401bcda6
cmp byte [r12 + 0x30], 0
je 0x1401bcda6
movaps xmm2, xmm6
mov edx, 0x40
mov rcx, rsi
call fcn.1400e0c90
movabs rbx, 0x2000000000
or qword [rsi + 0x40], rbx
jmp 0x1401bcdb0
movabs rbx, 0x2000000000
mov edx, 0x800
mov rcx, rsi
call fcn.1401b2c40
test al, al
je 0x1401bcdd5
movaps xmm2, xmm6
mov edx, 0x42
mov rcx, rsi
call fcn.1400e0c90
or qword [rsi + 0x40], rbx
cmp dword [rsp + 0x60], 0
jle 0x1401bcde6
mov rcx, qword [rsp + 0x58]
call fcn.140298600
cmp byte [r12 + 0x31], 0
je 0x1401bcdf7
mov rcx, rsi
call fcn.1401bce70
nop
cmp dword [rbp - 0x20], 0
jle 0x1401bce06
mov rcx, qword [rbp - 0x28]
call fcn.140298600
mov al, 1
mov rcx, qword [rbp + 0x288]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret