Function at 0x180005290
Capabilities:
Check for time delay via gettickcount
Check if file exists
Enumerate processes
Get common file path
Get startup folder
Get thread local storage value
Query environment variable
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2300]
mov eax, 0x2400
call fcn.1800e3a10
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2440], rbx
mov rax, qword [0x1801a8080]
xor rax, rsp
mov qword [rbp + 0x22f0], rax
mov r12, r9
mov r15, r8
xor r13d, r13d
lea rdi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
cmp qword [0x1801b0198], r13
je 0x180005415
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rax, qword [0x1801b0198]
cmp byte [rax + 0x78], r13b
je 0x180005415
cmp dword [rax + 0x80], 4
jb 0x180005415
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x210], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x210], xmm1
mov word [rbp + 0x200], r13w
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x180005353
mov r9, qword [r12]
mov r8, r15
cmp qword [r15 + 0x18], 8
jb 0x180005360
mov r8, qword [r15]
lea rdx, str.JumpToProtectMainPage_link___s__path___s
lea rcx, [rbp + 0x200]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x24a
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x200]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test bl, bl
je 0x1800053b7
lea rdx, [rbp + 0x200]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x1800053fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800053f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f58
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x210], xmm0
mov word [rbp + 0x200], r13w
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov byte [rsp + 0x31], 0
lea r9, [rsp + 0x31]
lea r8, [rbp + 0x40]
call fcn.180017ff0
mov esi, eax
cmp qword [0x1801b0198], 0
je 0x18000556b
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rcx, qword [0x1801b0198]
cmp byte [rcx + 0x78], 0
je 0x18000556b
cmp dword [rcx + 0x80], 4
jb 0x18000556b
movzx ebx, byte [rcx + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x230], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x220], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
mov r8d, esi
lea rdx, str.GetProtectMainPage_dwErr__0x_X_protectMainPage___s
lea rcx, [rbp + 0x220]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x251
mov qword [rsp + 0x20], rdi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x220]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test bl, bl
je 0x18000550d
lea rdx, [rbp + 0x220]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 8
jb 0x180005553
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000554e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f5e
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x220], r13w
mov byte [rsp + 0x30], 0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.180010880
mov r14, 0xffffffffffffffff
test al, al
je 0x1800055ad
cmp qword [rbp + 0x30], 0
jne 0x180005676
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x12f0]
call fcn.1801023f0
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x12f0]
call fcn.180032130
test al, al
je 0x180005676
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x250], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x250], xmm1
mov word [rbp + 0x240], r13w
lea rax, [rbp + 0x12f0]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180005610
lea rdx, [rbp + 0x12f0]
lea rcx, [rbp + 0x240]
call fcn.18000c0b0
nop
lea rcx, [rbp + 0x20]
call fcn.18000c040
movups xmm0, xmmword [rbp + 0x240]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rbp + 0x250]
movups xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movdqu xmmword [rbp + 0x250], xmm0
mov word [rbp + 0x240], r13w
movzx edi, byte [rsp + 0x30]
mov rax, qword [0x1801b0198]
test rax, rax
je 0x1800057b4
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rax, qword [0x1801b0198]
cmp byte [rax + 0x78], 0
je 0x1800057b4
cmp dword [rax + 0x80], 4
jb 0x1800057b4
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x270], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x270], xmm1
mov word [rbp + 0x260], r13w
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
movzx r9d, dil
lea rdx, str.GetProtectMainPage_Other_Browser_protectMainPage___s__isLocked___d
lea rcx, [rbp + 0x260]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x25f
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x260]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test bl, bl
je 0x18000574f
lea rdx, [rbp + 0x260]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x278]
cmp rdx, 8
jb 0x180005795
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005790
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f64
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x270], xmm0
mov word [rbp + 0x260], r13w
mov rax, qword [0x1801b0198]
cmp qword [rbp + 0x50], 0
jne 0x180005990
test dil, dil
jne 0x180005990
test rax, rax
je 0x1800058e7
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rax, qword [0x1801b0198]
cmp byte [rax + 0x78], dil
je 0x1800058e7
cmp dword [rax + 0x80], 4
jb 0x1800058e7
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x290], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x290], xmm1
mov word [rbp + 0x280], r13w
mov r8d, 0x1a
lea rdx, str.GetProtectMainPage
lea rcx, [rbp + 0x280]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x264
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x280]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test bl, bl
je 0x180005889
lea rdx, [rbp + 0x280]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x298]
cmp rdx, 8
jb 0x1800058cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800058ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f6a
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x290], xmm0
mov word [rbp + 0x280], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180005927
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005922
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f70
call fcn.1800e2d24
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180005978
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005973
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f76
call fcn.1800e2d24
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
mov eax, esi
jmp 0x180007f1c
lea rcx, [rbp + 0xa0]
call fcn.180098210
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rcx, qword [rbp + 0xa0]
lea rdx, str.explorer.exe
call fcn.180104c68
test eax, eax
je 0x180005bfe
call fcn.180008760
test al, al
jne 0x180005bfe
cmp qword [0x1801b0198], 0
je 0x180005af9
lea rcx, [0x1801b0198]
call fcn.1800c5900
mov rax, qword [0x1801b0198]
cmp byte [rax + 0x78], 0
je 0x180005af9
cmp dword [rax + 0x80], 4
jb 0x180005af9
movzx ebx, byte [rax + 0x84]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2b0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x2b0], xmm1
mov word [rbp + 0x2a0], r13w
mov r8d, 0x17
lea rdx, str.other_desk_close_swtich
lea rcx, [rbp + 0x2a0]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x26e
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x2a0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
test bl, bl
je 0x180005a9b
lea rdx, [rbp + 0x2a0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 8
jb 0x180005ae1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005adc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f7c
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x2b0], xmm0
mov word [rbp + 0x2a0], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180005b3f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f82
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180005b97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005b92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f88
call fcn.1800e2d24
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180005be8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005be3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f8e
call fcn.1800e2d24
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
jmp 0x180007f17
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x360], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x360]
call fcn.18000c0b0
nop
lea rcx, [rbp + 0x360]
call fcn.180097230
test al, al
sete bl
mov rdx, qword [rbp + 0x378]
cmp rdx, 8
jb 0x180005c92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005c8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f94
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x360], r13w
test bl, bl
je 0x180005ff7
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
mov r8d, 0x11
lea rdx, str.2345RTProtect.exe
lea rcx, [rbp + 0x140]
call fcn.18000c0b0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180005d88
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x6a4]
call fcn.1801023f0
mov dword [rbp + 0x6a0], 0x238
lea rdx, [rbp + 0x6a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180005d7f
nop
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x6cc]
call fcn.180104c68
mov rcx, rbx
test eax, eax
je 0x180005fea
lea rdx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005d40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x180005dd0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005dcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f9a
call fcn.1800e2d24
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r13w
test bl, bl
je 0x180005ff7
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180005ef3
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x190], xmm1
mov word [rbp + 0x180], r13w
mov r8d, 0xd
lea rdx, str.not_found_rtp
lea rcx, [rbp + 0x180]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x291
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x180]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180005e95
lea rdx, [rbp + 0x180]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x180005edb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005ed6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fa0
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r13w
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x180005f39
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fa6
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180005f91
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005f8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fac
call fcn.1800e2d24
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180005be8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005be3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f4c
jmp 0x180005be3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
jmp 0x180005d8a
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x130], xmm1
mov word [rbp + 0x120], r13w
movdqu xmmword [rbp + 0x170], xmm0
movdqu xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x160], r13w
mov r8d, 0xa
lea rdx, str.2345PCSafe
lea rcx, [rbp + 0x160]
call fcn.18000c0b0
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
lea rcx, [rbp + 0x120]
call fcn.18000c0b0
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x1800060bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800060b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fb2
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x160], r13w
lea rcx, [rbp + 0x120]
call fcn.180037630
test al, al
je 0x18000646c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x390], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x390], xmm1
mov word [rbp + 0x380], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x380]
call fcn.18000c0b0
nop
lea rcx, [rbp + 0x380]
call fcn.180097230
test al, al
sete bl
mov rdx, qword [rbp + 0x398]
cmp rdx, 8
jb 0x18000617d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006178
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fb8
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x390], xmm0
mov word [rbp + 0x380], r13w
test bl, bl
je 0x18000646c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x310], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x310], xmm1
mov word [rbp + 0x300], r13w
mov r8d, 0x10
lea rdx, str.2345SafeTray.exe
lea rcx, [rbp + 0x300]
call fcn.18000c0b0
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x1800061ef
xor bl, bl
jmp 0x180006201
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.180007fe0
movzx ebx, al
mov rdx, qword [rbp + 0x318]
cmp rdx, 8
jb 0x180006247
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006242
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fbe
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x310], xmm0
mov word [rbp + 0x300], r13w
test bl, bl
jne 0x18000646c
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180006368
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x1b0], xmm1
mov word [rbp + 0x1a0], r13w
mov r8d, 0xe
lea rdx, str.not_found_tray
lea rcx, [rbp + 0x1a0]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x29e
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x1a0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x18000630a
lea rdx, [rbp + 0x1a0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 8
jb 0x180006350
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000634b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fc4
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], r13w
lea rcx, [rbp + 0x120]
call fcn.18000c040
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x1800063bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800063b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fca
call fcn.1800e2d24
movdqa xmm0, xmmword [0x180163640]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x180006413
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000640e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007fd0
call fcn.1800e2d24
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x180005be8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005be3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007f52
jmp 0x180005be3
mov r8, qword [rbp + 0x30]
test r8, r8
je 0x180006642
mov rdi, r8
cmp r8, 1
jb 0x1800064fa
mov rbx, r13
test r8, r8
je 0x1800064c8
nop word [rax + rax]
cmp r8, rbx
jbe 0x180007f46
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rax, qword [rbp + 0x20]
movzx edx, word [rax + rbx*2]
lea rcx, str.__r_t_n
call fcn.1801018a0
mov r8, qword [rbp + 0x30]
test rax, rax
je 0x1800064c8
inc rbx
cmp rbx, rdi
jb 0x180006490
test rbx, rbx
je 0x1800064fa
cmp r8, rbx
cmovb rbx, r8
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
sub r8, rbx
mov qword [rbp + 0x30], r8
lea r8, [r8*2 + 2]
lea rdx, [rcx + rbx*2]
call fcn.180101f90
lea rdx, str.__r_t_n
lea rcx, [rbp + 0x20]
call fcn.180094560
lea rcx, [rbp + 0x20]
call fcn.1800946f0
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 5
lea rdx, str.http:
call fcn.180108ad0
test eax, eax
je 0x180006642
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 6
lea rdx, str.https:
call fcn.180108ad0
test eax, eax
je 0x180006642
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xb
lea rdx, str.about:blank
call fcn.180108ad0
test eax, eax
je 0x180006642
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rcx, qword [rbp + 0x20]
mov r8d, 0xa
lea rdx, str.about:tabs
call fcn.180108ad0
test eax, eax
je 0x180006642
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x1d0], xmm1
mov word [rbp + 0x1c0], r13w
mov r8d, 7
lea rdx, str.http:__
lea rcx, [rbp + 0x1c0]
call fcn.18000c0b0
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x1c0]
call fcn.18000c370
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
lea rcx, [rbp + 0x20]
call fcn.18000c0b0
nop
lea rcx, [rbp + 0x1c0]
call fcn.18000c040
mov eax, dword [0x1801af8b8]
test eax, eax
je 0x180006734
mov ebx, dword [0x1801af8b8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
andps xmm1, xmmword [0x1801636a0]
movsd xmm0, qword [0x180163610]
comisd xmm0, xmm1
jb 0x180006734
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x18000672f
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4b0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x4b0], xmm1
mov word [rbp + 0x4a0], r13w
mov r8d, 0x1c
lea rdx, str.JumpToProtectMainPage
lea rcx, [rbp + 0x4a0]
call fcn.18000c0b0
mov dword [rsp + 0x28], CDefFolderMenu_Create2
lea rax, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rax
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4a0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180006722
lea rdx, [rbp + 0x4a0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x4a0]
call fcn.18000c040
nop
jmp 0x180007eea
call fcn.18000b4e0
test al, al
jne 0x180006749
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [0x1801af8b8], eax
mov eax, 1
xchg dword [0x1801ad85c], eax
test eax, eax
jne 0x18000675d
call fcn.180025a90
lea rdx, [rbp + 0x40]
call fcn.180026180
test al, al
je 0x1800067b4
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x600]
call fcn.180015c60
nop
mov r8, qword [rbp + 0x610]
test r8, r8
je 0x1800067a8
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 8
cmovae rdx, qword [rbp + 0x600]
lea rcx, [rbp + 0x40]
call fcn.18000c370
nop
lea rcx, [rbp + 0x600]
call fcn.18000c040
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800067da
mov rdx, qword [r15]
lea r8, [rbp + 0x60]
call fcn.180016910
mov ecx, dword [0x1801ad84c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x1800068bf
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4d0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x4d0], xmm1
mov word [rbp + 0x4c0], r13w
cmp qword [r12 + 0x18], 8
jb 0x18000683c
mov r12, qword [r12]
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r9, qword [rbp + 0x60]
mov qword [rsp + 0x20], r12
mov r8, rdi
lea rdx, str.pAction___p_targetFileName___s_currentPath___s
lea rcx, [rbp + 0x4c0]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x2d0
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4c0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x1800068b1
lea rdx, [rbp + 0x4c0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x4c0]
call fcn.18000c040
jmp 0x1800068c6
lea rsi, str.RC::RCApiHookNewFuns::JumpToProtectMainPage
xor edx, edx
mov ecx, dword [0x1801ad84c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp qword [rbp + 0x50], 0
jne 0x1800069bb
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, [0x180156b98]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800069bb
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x1800069ac
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x4f0], xmm1
mov word [rbp + 0x4e0], r13w
mov r8d, 0x26
lea rdx, str.GetProtectMainPage_fail_and_path_is_ie
lea rcx, [rbp + 0x4e0]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x2d6
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x4e0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x18000699f
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x4e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
jmp 0x180007eea
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x1800069c8
mov rcx, qword [r15]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800069ee
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180006cfc
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.18000bd20
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.180004760
nop
cmp qword [rbp + 0xf0], 0
jne 0x180006b37
cmp qword [rbp + 0x70], 0
jbe 0x180006cf0
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.18000bd20
nop
mov rdx, rax
lea rcx, [rbp + 0x660]
call fcn.180004760
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.18000bc30
nop
lea rcx, [rbp + 0x660]
call fcn.18000c040
cmp qword [rbp + 0xf0], 0
jbe 0x180006cf0
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180006bf0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x510], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x510], xmm1
mov word [rbp + 0x500], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.targetFileName_guid_file_path___ws
lea rcx, [rbp + 0x500]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x2e7
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x500]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180006b2b
lea rdx, [rbp + 0x500]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x500]
jmp 0x180006beb
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180006bf0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x530], xmm1
mov word [rbp + 0x520], r13w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r8, qword [rbp + 0xe0]
lea rdx, str.linkName_guid_file_path___ws
lea rcx, [rbp + 0x520]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x2ed
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x520]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180006be4
lea rdx, [rbp + 0x520]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x520]
call fcn.18000c040
cmp qword [rbp + 0xf0], 0
jbe 0x180006cf0
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, [0x180156b98]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180006c79
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str._shdocvw.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x180006c79
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rcx, qword [rbp + 0xe0]
lea rdx, str.ieframe.dll
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180006cf0
lea rdx, [rbp + 0x680]
call fcn.180019e00
nop
lea r8, [rbp + 0x40]
mov rdx, rax
call fcn.1800182f0
movzx ebx, al
lea rcx, [rbp + 0x680]
call fcn.18000c040
test bl, bl
je 0x180006cf0
lea rcx, [rbp + 0xe0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
lea rcx, [rbp + 0x120]
call fcn.18000c040
nop
lea rcx, [rbp + 0xa0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x20]
call fcn.18000c040
nop
lea rcx, [rbp + 0x40]
call fcn.18000c040
xor eax, eax
jmp 0x180007f1c
lea rcx, [rbp + 0xe0]
call fcn.18000c040
cmp rdi, 1
jne 0x180006db2
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180006d92
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x590], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x590], xmm1
mov word [rbp + 0x580], r13w
xor r8d, r8d
lea rdx, [0x180156244]
lea rcx, [rbp + 0x580]
call fcn.18000c0b0
nop
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x60]
call fcn.1800182f0
movzx ebx, al
lea rcx, [rbp + 0x580]
call fcn.18000c040
test bl, bl
je 0x180006db2
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
jmp 0x180006cbc
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.1800182f0
test al, al
je 0x180006db2
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
jmp 0x180006cbc
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.18000bd20
nop
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180006ed3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1af0]
call fcn.1801023f0
mov r9d, 1
lea r8d, [r9 + 0xf]
lea rdx, [rbp + 0x1af0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180006ed3
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
lea rdx, [rbp + 0x1af0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180006ed3
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
test rax, rax
je 0x180006ed3
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xaf0]
call fcn.1801023f0
mov r9d, 1
lea r8d, [r9 + 0x18]
lea rdx, [rbp + 0xaf0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rdx, rbx
lea rcx, [rbp + 0xaf0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rax, [rbp + 0xaf0]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x180006eb5
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0x100]
call fcn.18000c0b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x90], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x90], xmm1
mov word [rbp + 0x80], r13w
xor r8d, r8d
lea rdx, [0x180156244]
lea rcx, [rbp + 0x80]
call fcn.18000c0b0
nop
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r13w
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x5b0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x5b0], xmm1
mov word [rbp + 0x5a0], r13w
mov r8, r14
inc r8
cmp word [rdx + r8*2], 0
jne 0x180006f72
lea rcx, [rbp + 0x5a0]
call fcn.18000c0b0
nop
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5a0]
call fcn.18001b870
mov ebx, eax
lea rcx, [rbp + 0x5a0]
call fcn.18000c040
test ebx, ebx
jne 0x180007e16
cmp qword [rbp + 0xd0], 0
jne 0x1800070f6
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
lea rdx, [0x180156b98]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x1800070f6
lea edx, [rbx + 4]
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x1800070ac
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x550], xmm1
mov word [rbp + 0x540], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180156d00]
lea rcx, [rbp + 0x540]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x32f
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x540]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x1800070a0
lea rdx, [rbp + 0x540]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x540]
call fcn.18000c040
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x80]
call fcn.1800182f0
test al, al
je 0x1800070f6
lea rcx, [rbp + 0xc0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x80]
call fcn.18000c040
nop
lea rcx, [rbp + 0x100]
call fcn.18000c040
nop
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
jmp 0x180006cbc
cmp byte [rsp + 0x30], 0
je 0x1800078d6
lea rcx, [rsp + 0x48]
call fcn.18000d750
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.18000c0b0
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqa xmmword [rbp + 0x2f0], xmm1
mov word [rbp + 0x2e0], r13w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x40]
call fcn.18000bd20
nop
lea r8, [rbp + 0x2c0]
mov rdx, rax
call fcn.180010470
test al, al
je 0x180007861
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180007261
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x570], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x570], xmm1
mov word [rbp + 0x560], r13w
lea r9, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r9, qword [rbp + 0xc0]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180156d20]
lea rcx, [rbp + 0x560]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x33e
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x560]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180007255
lea rdx, [rbp + 0x560]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x560]
call fcn.18000c040
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x80]
call fcn.180010d70
test al, al
je 0x180007861
lea rdx, [rbp + 0x40]
call fcn.180026180
test al, al
je 0x1800072da
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x5c0]
call fcn.180015820
nop
mov r8, qword [rbp + 0x5d0]
test r8, r8
je 0x1800072ce
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 8
cmovae rdx, qword [rbp + 0x5c0]
lea rcx, [rbp + 0x40]
call fcn.18000c370
nop
lea rcx, [rbp + 0x5c0]
call fcn.18000c040
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x1e0]
call fcn.18000bd20
nop
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x1800073b5
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3b0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x3b0], xmm1
mov word [rbp + 0x3a0], r13w
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae r8, qword [rbp + 0xc0]
mov eax, dword [rbp + 0x2c4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x2c0]
lea rdx, [0x180156d70]
lea rcx, [rbp + 0x3a0]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x34d
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3a0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x1800073a9
lea rdx, [rbp + 0x3a0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x3a0]
call fcn.18000c040
cmp dword [rbp + 0x2c4], 1
jne 0x1800074e2
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2c8]
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x320]
call fcn.18000f930
nop
mov r8, qword [rbp + 0x330]
test r8, r8
je 0x1800074d6
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rdx, qword [rbp + 0x320]
lea rcx, [rbp + 0x1e0]
call fcn.18000c0b0
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x1800074d6
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x3d0], xmm1
mov word [rbp + 0x3c0], r13w
lea r8, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae r8, qword [rbp + 0x320]
lea rdx, [0x180156df0]
lea rcx, [rbp + 0x3c0]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x356
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3c0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x1800074c9
lea rdx, [rbp + 0x3c0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x3c0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x320]
call fcn.18000c040
cmp dword [rbp + 0x2c0], 1
jne 0x180007614
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rsp + 0x60]
call fcn.18000bd20
nop
mov r8, rax
lea rdx, [rbp + 0x340]
call fcn.18000f2f0
nop
mov r8, qword [rbp + 0x350]
test r8, r8
je 0x180007608
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rdx, qword [rbp + 0x340]
lea rcx, [rbp + 0x1e0]
call fcn.18000c0b0
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180007608
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x3f0], xmm1
mov word [rbp + 0x3e0], r13w
lea r8, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae r8, qword [rbp + 0x340]
lea rdx, [0x180156e30]
lea rcx, [rbp + 0x3e0]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x361
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x3e0]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x1800075fb
lea rdx, [rbp + 0x3e0]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x3e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x340]
call fcn.18000c040
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x5e0]
call fcn.180011210
nop
lea r8, [rbp + 0x1e0]
cmp qword [rbp + 0x5f0], 0
je 0x18000774a
lea rdx, [rbp + 0x5e0]
call fcn.1800182f0
test al, al
je 0x180007847
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x20]
call fcn.18000bd20
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000e2a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x2e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000be50
nop
mov rcx, qword [0x1801af948]
test rcx, rcx
je 0x1800076c6
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801af948]
sub dword [0x1801ad858], 1
jne 0x1800076e3
call fcn.18001f680
mov rcx, rax
call fcn.18001fa10
mov rcx, qword [0x1801af948]
test rcx, rcx
je 0x1800076ef
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.1800123d0
nop
mov edx, 0x60
mov rcx, qword [rsp + 0x48]
call fcn.18000ca90
nop
lea rcx, [rbp + 0xc0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x80]
call fcn.18000c040
nop
lea rcx, [rbp + 0x100]
call fcn.18000c040
nop
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
jmp 0x180006cbc
lea rdx, [rbp + 0x80]
call fcn.1800182f0
test al, al
je 0x180007847
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp]
call fcn.18000bd20
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000e2a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x2e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000be50
nop
mov rcx, qword [0x1801af948]
test rcx, rcx
je 0x1800077d3
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801af948]
sub dword [0x1801ad858], 1
jne 0x1800077f0
call fcn.18001f680
mov rcx, rax
call fcn.18001fa10
mov rcx, qword [0x1801af948]
test rcx, rcx
je 0x1800077fc
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180011d80
nop
lea rcx, [rbp + 0xc0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x80]
call fcn.18000c040
nop
lea rcx, [rbp + 0x100]
call fcn.18000c040
nop
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
jmp 0x180006cbc
lea rcx, [rbp + 0x5e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x2e0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x2c8]
call fcn.18000be50
nop
mov rcx, qword [0x1801af948]
test rcx, rcx
je 0x180007894
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [0x1801af948]
sub dword [0x1801ad858], 1
jne 0x1800078b1
call fcn.18001f680
mov rcx, rax
call fcn.18001fa10
mov rcx, qword [0x1801af948]
test rcx, rcx
je 0x1800078bd
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180011d80
jmp 0x18000797e
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x18000797e
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x410], xmm1
mov word [rbp + 0x400], r13w
mov r8d, 0x1b
lea rdx, str.Other_Browser_Home
lea rcx, [rbp + 0x400]
call fcn.18000c0b0
mov dword [rsp + 0x28], 0x37c
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x400]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180007972
lea rdx, [rbp + 0x400]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x400]
call fcn.18000c040
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x650], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x650], xmm1
mov word [rbp + 0x640], r13w
movdqu xmmword [rbp + 0x630], xmm0
movdqu xmmword [rbp + 0x630], xmm1
mov word [rbp + 0x620], r13w
lea rcx, [rsp + 0x40]
call fcn.18001a990
nop
lea rcx, [rsp + 0x40]
call fcn.18001abb0
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.18001ade0
test al, al
je 0x180007d1f
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x640]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.18001ad30
test al, al
je 0x180007d1f
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180007acc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x430], xmm1
mov word [rbp + 0x420], r13w
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x180156eb0]
lea rcx, [rbp + 0x420]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x387
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x420]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180007ac0
lea rdx, [rbp + 0x420]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x420]
call fcn.18000c040
cmp qword [rbp + 0x70], 0
jne 0x180007b7e
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rcx, qword [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180007b18
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
jmp 0x180007b75
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x8e0]
call fcn.1801023f0
mov r8d, 0x104
lea rdx, [rbp + 0x8e0]
lea rcx, str._ProgramFiles_Internet_Exploreriexplore.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180007b7e
lea rax, [rbp + 0x8e0]
nop
inc r14
cmp word [rax + r14*2], 0
jne 0x180007b60
mov r8, r14
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0x60]
call fcn.18000c0b0
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
lea rdx, str.2345explorer.exe
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180007bf1
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x40]
call fcn.18000c0b0
mov r8d, 1
lea rdx, [0x180156f2c]
lea rcx, [rbp + 0x40]
call fcn.18000c370
mov r8d, 0xb
lea rdx, [0x180156f30]
lea rcx, [rbp + 0x40]
call fcn.18000c370
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180007caf
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x450], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x450], xmm1
mov word [rbp + 0x440], r13w
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae r9, qword [rbp + 0x40]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r8, qword [rbp + 0x60]
lea rdx, [0x180156f48]
lea rcx, [rbp + 0x440]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x3a1
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x440]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180007ca3
lea rdx, [rbp + 0x440]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x440]
call fcn.18000c040
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call fcn.1800182f0
test al, al
je 0x180007de4
lea rcx, [rsp + 0x40]
call fcn.18001a9f0
nop
lea rcx, [rbp + 0x620]
call fcn.18000c040
nop
lea rcx, [rbp + 0x640]
call fcn.18000c040
nop
lea rcx, [rbp + 0xc0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x80]
call fcn.18000c040
nop
lea rcx, [rbp + 0x100]
call fcn.18000c040
nop
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
jmp 0x180006cbc
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov edi, eax
test eax, eax
je 0x180007de4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x470], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x470], xmm1
mov word [rbp + 0x460], r13w
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
mov r8d, eax
lea rdx, str.RCBlackShortCut_Analyze_Fail___x_lnk___s
lea rcx, [rbp + 0x460]
call fcn.1800c6a80
mov dword [rsp + 0x28], 0x3a9
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x460]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp edi, 1
jbe 0x180007dd8
lea rdx, [rbp + 0x460]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x460]
call fcn.18000c040
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180007df2
mov byte [rax + 8], 0
lea rcx, [rsp + 0x40]
call fcn.18001a9f0
nop
lea rcx, [rbp + 0x620]
call fcn.18000c040
nop
lea rcx, [rbp + 0x640]
jmp 0x180007eb3
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c6560
mov ebx, eax
test eax, eax
je 0x180007eb9
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x490], xmm0
movdqa xmm1, xmmword [0x180163640]
movdqu xmmword [rbp + 0x490], xmm1
mov word [rbp + 0x480], r13w
lea rdx, str.GetShortCutTargetCmdEx_Fail
lea rcx, [rbp + 0x480]
call fcn.18000bbc0
mov dword [rsp + 0x28], 0x3af
mov qword [rsp + 0x20], rsi
lea r9, str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea r8, [rbp + 0x480]
mov edx, 4
lea rcx, [0x1801b0198]
call fcn.1800c65b0
cmp ebx, 1
jbe 0x180007eac
lea rdx, [rbp + 0x480]
lea rcx, [0x1801b0198]
call fcn.1800c6940
nop
lea rcx, [rbp + 0x480]
call fcn.18000c040
nop
lea rcx, [rbp + 0xc0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x80]
call fcn.18000c040
nop
lea rcx, [rbp + 0x100]
call fcn.18000c040
nop
lea rcx, [rbp + 0x60]
call fcn.18000c040
nop
lea rcx, [rbp + 0x120]
call fcn.18000c040
nop
lea rcx, [rbp + 0xa0]
call fcn.18000c040
nop
lea rcx, [rbp + 0x20]
call fcn.18000c040
nop
lea rcx, [rbp + 0x40]
call fcn.18000c040
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x22f0]
xor rcx, rsp
call fcn.1800e2d00
mov rbx, qword [rsp + 0x2440]
add rsp, 0x2400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800125c0
nop
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
int3
call fcn.180107ee8
nop
call fcn.180107ee8
nop
call fcn.180107ee8
int3