Function at 0x140059370
Capabilities:
Check for time delay via gettickcount
Check os version
Enumerate processes
Get disk size
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7f8]
sub rsp, 0x8d0
mov qword [rbp], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x1401bbe90]
xor rax, rsp
mov qword [rbp + 0x790], rax
mov r13, rcx
xor r15d, r15d
mov word [rbp + 0x580], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x582]
call fcn.1400d2f00
mov qword [r13 + 0x1d0], r15
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [rsp + 0x38], eax
mov edx, dword [0x1401c3d80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 3
jne 0x14005943c
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [rsp + 0x50], r15d
or r12, 0xffffffffffffffff
lea ebx, [r12 + 0x66]
lea edi, [rbx - 0x64]
lea r14d, [r12 + 0x79]
movsd xmm8, qword [0x140153278]
movsd xmm6, qword [0x1401532a0]
movsd xmm7, qword [0x140153270]
nop dword [rax + rax]
cmp byte [r13 + 0x119], 0
je 0x14005949a
mov ebx, dword [r13 + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, ebx
jb 0x140059495
test ebx, ebx
jne 0x14005a51f
mov ebx, 0x65
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14005a88e
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0x60]
call fcn.1400d2f00
mov dword [rbp + 0x60], 0x238
mov dword [rsp + 0x3c], r15d
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14005a852
mov eax, 0x63
mov word [rbp + 0x560], ax
mov dword [rbp + 0x564], 0x6f0072
mov eax, 0x6d
mov word [rbp + 0x568], ax
mov eax, 0x2e
mov word [rbp + 0x56c], ax
mov word [rbp + 0x574], r15w
mov qword [rbp + 0x2b0], r15
mov qword [rbp + 0x2b8], r15
mov qword [rbp + 0x2b8], 7
mov qword [rbp + 0x2b0], r15
mov word [rbp + 0x2a0], r15w
cmp word [rbp + 0x8c], 0
jne 0x140059551
mov r8, r15
jmp 0x14005956b
lea rax, [rbp + 0x8c]
mov r8, r12
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140059560
lea rdx, [rbp + 0x8c]
lea rcx, [rbp + 0x2a0]
call fcn.14005dc40
nop
mov word [rbp + 0x572], bx
mov word [rbp + 0x56e], bx
mov word [rbp + 0x56a], bx
mov eax, 0x68
mov word [rbp + 0x562], ax
mov eax, dword [0x1401c3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 7
jne 0x1400595ef
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
lea eax, [r8 + 1]
mov dword [0x1401c3d80], eax
mov word [rbp + 0x570], r14w
lea rax, [rbp + 0x560]
mov rdx, r12
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140059601
lea rcx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 8
cmovae rcx, qword [rbp + 0x2a0]
mov r9, rdx
mov r10, qword [rbp + 0x2b0]
cmp r10, rdx
cmovb r9, r10
test r9, r9
je 0x140059664
lea r8, [rbp + 0x560]
nop
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x140059658
add rcx, 2
add r8, 2
dec r9
jne 0x140059640
jmp 0x140059664
mov r9d, edi
cmp word [rcx], ax
cmovb r9d, r12d
jmp 0x140059667
mov r9d, r15d
movsxd rax, r9d
test r9d, r9d
jne 0x14005967a
cmp r10, rdx
jb 0x14005967e
mov eax, r15d
setne al
test eax, eax
je 0x1400596c8
cmp qword [rbp + 0x2b8], 8
jb 0x140059694
mov rcx, qword [rbp + 0x2a0]
call fcn.1400cdaa0
mov qword [rbp + 0x2b8], 7
mov qword [rbp + 0x2b0], r15
mov word [rbp + 0x2a0], r15w
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140059941
jmp 0x1400594e4
cmp dword [r13 + 0x2d0], 1
jne 0x1400596dd
mov dword [r13 + 0x2d0], 2
mov r14d, dword [rbp + 0x80]
mov dword [rsp + 0x3c], r14d
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
test rax, rax
je 0x1400598b5
test r14d, r14d
je 0x1400598b5
mov r8d, 0x104
lea rdx, [rbp + 0x580]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14005a59e
cmp word [rbp + 0x580], 0
jne 0x14005973f
mov r8, r15
jmp 0x14005975b
lea rax, [rbp + 0x580]
mov r8, r12
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140059750
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x2a0]
call fcn.14005dc40
mov r8, qword [rbp + 0x2b0]
add r8, 0xfffffffffffffff6
mov r9, r12
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x2a0]
call fcn.14005d740
mov rcx, rax
lea rax, [rbp + 0x560]
mov rdx, r12
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400597a0
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x1400597b8
mov rcx, qword [rcx]
mov r9, rdx
cmp r10, rdx
cmovb r9, r10
test r9, r9
je 0x1400597f4
lea r8, [rbp + 0x560]
nop
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x1400597e8
add rcx, 2
add r8, 2
dec r9
jne 0x1400597d0
jmp 0x1400597f4
mov r9d, edi
cmp word [rcx], ax
cmovb r9d, r12d
jmp 0x1400597f7
mov r9d, r15d
movsxd rax, r9d
test r9d, r9d
jne 0x140059812
cmp r10, rdx
jae 0x140059809
mov eax, r12d
jmp 0x140059812
mov eax, r15d
cmp r10, rdx
setne al
test eax, eax
setne bl
cmp qword [rbp + 0x338], 8
jb 0x14005982d
mov rcx, qword [rbp + 0x320]
call fcn.1400cdaa0
mov qword [rbp + 0x338], 7
mov qword [rbp + 0x330], r15
mov word [rbp + 0x320], r15w
test bl, bl
je 0x14005989d
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x68]
mov dword [rsp + 0x3c], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
test rax, rax
je 0x14005a562
mov r8d, 0x104
lea rdx, [rbp + 0x580]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14005a526
cmp qword [rbp + 0x2b8], 8
jb 0x14005991d
mov rcx, qword [rbp + 0x2a0]
call fcn.1400cdaa0
jmp 0x14005991d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, dword [rbp + 0x68]
mov dword [rsp + 0x3c], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d0], rax
test rax, rax
je 0x14005a616
mov r8d, 0x104
lea rdx, [rbp + 0x580]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14005a5da
cmp qword [rbp + 0x2b8], 8
jb 0x140059918
mov rcx, qword [rbp + 0x2a0]
call fcn.1400cdaa0
mov edi, 1
mov r14d, 0x78
lea ebx, [r14 - 0x13]
mov word [rbp + 0x2a0], r15w
mov qword [rbp + 0x2b0], r15
mov qword [rbp + 0x2b8], 7
mov rax, qword [r13 + 0x1d0]
inc rax
test rax, 0xfffffffffffffffe
jne 0x140059960
mov ecx, dword [r13 + 0x1dc]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r13 + 0x1d0]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14005a4c5
lea rcx, [0x1401bb9a8]
mov rax, qword [0x1401bb9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rcx, [0x1401bb9a8]
mov rax, qword [0x1401bb9a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x1401c3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
mov eax, dword [0x1401c4e78]
cmp ecx, 2
mov ecx, 0x8b9f9e61
cmove eax, ecx
mov dword [0x1401c4e78], eax
call fcn.140046d80
test al, al
jne 0x140059a12
mov edx, 0x82
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400ce3cc
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x140059b10
mov esi, 1
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140059a4a
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400023b0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0xc], 0x104
jl 0x14005a68d
mov dword [rbx - 0x10], 0x104
xor eax, eax
mov word [rbx + 0x208], ax
mov r9d, 0x104
mov r8, rbx
xor edx, edx
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rax
lea rcx, [rbx - 0x18]
call fcn.140002410
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.14004d610
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140059b07
cmp dword [rdi + 0x10], 0
jl 0x140059af8
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140059af8
call fcn.140002410
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140059aed
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x140059b07
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400022c0
nop
mov rdx, qword [rbp - 0x58]
jmp 0x140059d53
lea rax, [rsp + 0x68]
mov qword [rsp + 0x78], rax
lea rcx, [0x1401bb9a8]
mov rax, qword [0x1401bb9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [rbp + 0x580]
lea rax, [rbp + 0x580]
test rax, 0xffffffffffff0000
jne 0x140059b6b
movzx ebx, cx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x140059b94
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400025b0
jmp 0x140059b94
lea rcx, [rbp + 0x580]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140059b75
mov r8d, eax
lea rdx, [rbp + 0x580]
lea rcx, [rsp + 0x68]
call fcn.1400022c0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x68]
call fcn.14004d610
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140059bf7
cmp dword [rdi + 0x10], 0
jl 0x140059be8
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140059be8
call fcn.140002410
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140059bdd
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x140059bf7
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400022c0
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140059c0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
call fcn.140052960
mov rdx, rax
xor r9d, r9d
mov ecx, r9d
test rax, rax
setne cl
test ecx, ecx
je 0x14005a847
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
sub rdx, rdi
nop
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x140059c57
add rcx, 2
test ax, ax
jne 0x140059c40
mov eax, r9d
jmp 0x140059c5c
sbb eax, eax
or eax, 1
mov esi, 1
test eax, eax
jne 0x140059d78
mov rbx, qword [rsp + 0x40]
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140059c96
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400023b0
mov rbx, qword [rsp + 0x40]
xor r9d, r9d
cmp dword [rbx - 0xc], 0x104
jl 0x14005a698
mov dword [rbx - 0x10], 0x104
mov word [rbx + 0x208], r9w
mov r9d, 0x104
mov r8, rbx
xor edx, edx
mov rcx, qword [r13 + 0x1d0]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x78], rax
lea rcx, [rbx - 0x18]
call fcn.140002410
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x48]
call fcn.14004d610
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140059d4f
cmp dword [rdi + 0x10], 0
jl 0x140059d40
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140059d40
call fcn.140002410
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140059d35
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x140059d4f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400022c0
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140059d67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
mov rdi, qword [rsp + 0x30]
mov r14d, eax
cmp dword [rdi - 0x10], 0
je 0x140059dc4
call fcn.140052960
mov rdx, rax
xor r9d, r9d
mov ecx, r9d
test rax, rax
setne cl
test ecx, ecx
je 0x14005a6a3
mov rcx, rdi
sub rdx, rdi
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x140059db7
add rcx, 2
test ax, ax
jne 0x140059da0
mov eax, r9d
jmp 0x140059dbc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14005a6ae
mov ebx, r9d
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xf
jne 0x140059e3d
movaps xmm3, xmm8
xorps xmm2, xmm2
movd xmm4, r8d
cvtdq2pd xmm4, xmm4
nop word [rax + rax]
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x140059e29
subsd xmm2, xmm3
divsd xmm3, xmm6
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm7
ja 0x140059e10
cmp r14d, 0x714
jne 0x140059ed7
lea rcx, [rbp - 0x50]
call fcn.14004e060
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140059ea8
cmp dword [rdi + 0x10], 0
jl 0x140059e99
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140059e99
call fcn.140002410
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140059e8e
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x140059ea8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400022c0
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140059ec0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8d, dword [0x1401c3d80]
mov rdi, qword [rsp + 0x30]
xor r9d, r9d
cmp dword [rdi - 0x10], 0
je 0x140059f2b
call fcn.140052960
mov rdx, rax
xor r9d, r9d
mov ecx, r9d
test rax, rax
setne cl
test ecx, ecx
je 0x14005a800
mov rcx, rdi
sub rdx, rdi
nop
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x140059f17
add rcx, 2
test ax, ax
jne 0x140059f00
mov eax, r9d
jmp 0x140059f1c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14005a6ae
mov r8d, dword [0x1401c3d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 2
jne 0x140059f9e
mov rax, qword [str.Q8CJyzt6675U]
mov qword [rbp - 0x78], rax
mov eax, dword [0x140151ef0]
mov dword [rbp - 0x70], eax
movzx eax, byte [0x140151ef4]
mov byte [rbp - 0x6c], al
lea rax, [rbp - 0x78]
mov rcx, r12
inc rcx
cmp byte [rax + rcx], 0
jne 0x140059f76
mov eax, 4
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.1400cd108
mov rcx, rax
call fcn.1400cebfc
xor r9d, r9d
mov qword [r13 + 0x1d0], r9
mov edx, ebx
lea rcx, [rbp + 0x3c0]
call fcn.140050ff0
mov rsi, rax
mov edx, r14d
lea rcx, [rbp + 0x380]
call fcn.140050ff0
mov rdi, rax
mov edx, r15d
lea rcx, [rbp + 0x340]
call fcn.140050ff0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x300]
call fcn.140050ff0
nop
lea r8, str.___:
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.140032590
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2e0]
call fcn.14005e2e0
nop
lea r8, str.___:
mov rdx, rax
lea rcx, [rbp + 0x360]
call fcn.140032590
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x3a0]
call fcn.14005e2e0
nop
lea r8, str.___:
mov rdx, rax
lea rcx, [rbp + 0x400]
call fcn.140032590
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.14005e2e0
nop
cmp qword [rbp + 0x418], 0x10
jb 0x14005a083
mov rcx, qword [rbp + 0x400]
call fcn.1400cdaa0
mov qword [rbp + 0x418], 0xf
xor r15d, r15d
mov qword [rbp + 0x410], r15
mov byte [rbp + 0x400], r15b
cmp qword [rbp + 0x3b8], 0x10
jb 0x14005a0b5
mov rcx, qword [rbp + 0x3a0]
call fcn.1400cdaa0
mov qword [rbp + 0x3b8], 0xf
mov qword [rbp + 0x3b0], r15
mov byte [rbp + 0x3a0], 0
cmp qword [rbp + 0x378], 0x10
jb 0x14005a0e4
mov rcx, qword [rbp + 0x360]
call fcn.1400cdaa0
mov qword [rbp + 0x378], 0xf
mov qword [rbp + 0x370], r15
mov byte [rbp + 0x360], 0
cmp qword [rbp + 0x2f8], 0x10
jb 0x14005a113
mov rcx, qword [rbp + 0x2e0]
call fcn.1400cdaa0
mov qword [rbp + 0x2f8], 0xf
mov qword [rbp + 0x2f0], r15
mov byte [rbp + 0x2e0], 0
cmp qword [rbp + 0x3f8], 0x10
jb 0x14005a142
mov rcx, qword [rbp + 0x3e0]
call fcn.1400cdaa0
mov qword [rbp + 0x3f8], 0xf
mov qword [rbp + 0x3f0], r15
mov byte [rbp + 0x3e0], 0
cmp qword [rbp + 0x318], 0x10
jb 0x14005a171
mov rcx, qword [rbp + 0x300]
call fcn.1400cdaa0
mov qword [rbp + 0x318], 0xf
mov qword [rbp + 0x310], r15
mov byte [rbp + 0x300], 0
cmp qword [rbp + 0x358], 0x10
jb 0x14005a1a0
mov rcx, qword [rbp + 0x340]
call fcn.1400cdaa0
mov qword [rbp + 0x358], 0xf
mov qword [rbp + 0x350], r15
mov byte [rbp + 0x340], 0
cmp qword [rbp + 0x398], 0x10
jb 0x14005a1cf
mov rcx, qword [rbp + 0x380]
call fcn.1400cdaa0
mov qword [rbp + 0x398], 0xf
mov qword [rbp + 0x390], r15
mov byte [rbp + 0x380], 0
cmp qword [rbp + 0x3d8], 0x10
jb 0x14005a1fe
mov rcx, qword [rbp + 0x3c0]
call fcn.1400cdaa0
mov qword [rbp + 0x3d8], 0xf
mov qword [rbp + 0x3d0], r15
mov byte [rbp + 0x3c0], 0
mov esi, dword [rsp + 0x50]
mov eax, esi
inc esi
mov dword [rsp + 0x50], esi
cmp eax, 5
jge 0x14005a80b
mov r8d, dword [0x1401c3d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 3
jne 0x14005a296
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.1400cd108
mov rcx, rax
call fcn.1400cebfc
lea rbx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0x10
cmovae rbx, qword [rbp + 0x2c0]
lea rcx, [0x1401bb9a8]
mov rax, qword [0x1401bb9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
test rbx, rbx
je 0x14005a2f6
test rbx, 0xffffffffffff0000
jne 0x14005a2f6
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14005a304
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400025b0
jmp 0x14005a304
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140003290
nop
call fcn.1400559a0
mov rbx, rax
lea rcx, [0x1401bb9a8]
mov rdx, qword [0x1401bb9a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
test rbx, rbx
je 0x14005a36c
test rbx, 0xffffffffffff0000
jne 0x14005a355
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14005a380
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400025b0
jmp 0x14005a380
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14005a360
jmp 0x14005a36f
mov eax, r15d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400022c0
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.14000fc80
nop
lea rcx, [r13 + 0x1b8]
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
call fcn.140010740
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005a3c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005a3db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005a3f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x1401c3d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 2
jne 0x14005a435
mov edx, 0xec
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400ce3cc
mov eax, dword [r13 + 0x1dc]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp + 0x2d8], 0x10
jb 0x14005a460
mov rcx, qword [rbp + 0x2c0]
call fcn.1400cdaa0
mov qword [rbp + 0x2d8], 0xf
mov qword [rbp + 0x2d0], r15
mov byte [rbp + 0x2c0], 0
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005a493
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
mov edi, 1
mov esi, dword [rsp + 0x38]
lea ebx, [rdi + 0x64]
lea r14d, [rdi + 0x77]
jg 0x140059470
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140059470
mov ecx, dword [0x1401c3d80]
imul ecx, ecx
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xf
mov esi, dword [rsp + 0x38]
jne 0x140059470
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [0x1401c3d80], r8d
jmp 0x140059470
mov eax, edi
jmp 0x14005a8ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4e0]
call fcn.140050ff0
mov rbx, rax
call fcn.140055710
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x38]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rbp + 0x38]
call fcn.1400d5998
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x420]
call fcn.140050ff0
mov rbx, rax
call fcn.1400566c0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x10]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rbp - 0x10]
call fcn.1400d5998
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x480]
call fcn.140050ff0
mov r10, rax
call fcn.140056490
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x48]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rbp + 0x48]
call fcn.1400d5998
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4a0]
call fcn.140050ff0
mov rbx, rax
call fcn.1400540a0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 8]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rbp + 8]
call fcn.1400d5998
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x520]
call fcn.140050ff0
mov rbx, rax
mov edx, edi
lea rcx, [rbp + 0x460]
call fcn.140050ff0
nop
lea r8, [0x140151e98]
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.140032590
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x4c0]
call fcn.14005e2e0
mov r10, rax
call fcn.140055160
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x28]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rbp + 0x28]
call fcn.1400d5998
nop
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, r9
lea rdx, str.0.0.0.0
nop dword [rax + rax]
movzx eax, word [rdi + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x14005a6d9
cmp rcx, 8
jne 0x14005a6c0
mov eax, r9d
jmp 0x14005a6de
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14005a7af
mov qword [r13 + 0x1d0], r9
lea rcx, [0x1401bb9a8]
mov rax, qword [0x1401bb9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14005a73b
test rdx, 0xffffffffffff0000
jne 0x14005a73b
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14005a746
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14001acf0
jmp 0x14005a746
lea rcx, [rsp + 0x48]
call fcn.14001a3d0
nop
mov dl, 0x5c
lea rcx, [rsp + 0x48]
call fcn.14005d610
mov dl, 0x20
lea rcx, [rsp + 0x48]
call fcn.14005d610
mov dl, 0x2f
lea rcx, [rsp + 0x48]
call fcn.14005d610
mov r10, qword [rsp + 0x48]
sub esi, dword [r10 - 8]
or esi, dword [r10 - 0xc]
jge 0x14005a78a
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.14001ae30
mov r10, qword [rsp + 0x48]
call fcn.140055620
mov rdx, rax
mov r8, r10
lea rcx, [rbp - 0x30]
call fcn.1400569e0
lea rdx, [0x1401867b8]
lea rcx, [rbp - 0x30]
call fcn.1400d5998
nop
lea rcx, [r13 + 0x188]
lea rdx, [rsp + 0x30]
call fcn.140002230
mov eax, dword [rsp + 0x3c]
mov dword [r13 + 0x1c8], eax
lea rdx, [rdi - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005a7e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005a7f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14005a8ca
mov ecx, 0x80004005
call fcn.140001920
nop
lea r10, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0x10
cmovae r10, qword [rbp + 0x2c0]
call fcn.140055000
mov rdx, rax
mov r8, r10
lea rcx, [rbp - 0x20]
call fcn.1400569e0
lea rdx, [0x1401867b8]
lea rcx, [rbp - 0x20]
call fcn.1400d5998
nop
mov ecx, 0x80004005
call fcn.140001920
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x500]
call fcn.140050ff0
mov rbx, rax
call fcn.140054e20
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x40]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rbp - 0x40]
call fcn.1400d5998
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x540]
call fcn.140050ff0
mov rbx, rax
call fcn.140055280
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x18]
call fcn.140056aa0
lea rdx, [0x1401867b8]
lea rcx, [rbp + 0x18]
call fcn.1400d5998
nop
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.1400cdac0
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret