Function at 0x494fa0
Capabilities:
Persist via run registry key

Disassembly:
lea r12, [rsp - 0x70]
cmp r12, qword [r14 + 0x10]
jbe 0x495492
push rbp
mov rbp, rsp
sub rsp, 0xe8
movq qword [rsp + 0xe0], xmm15
mov byte [rsp + 0x2f], 0
movups xmmword [rsp + 0xd0], xmm15
call fcn.0048e460
test rcx, rcx
jne 0x494ff4
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0xa0], rax
call fcn.00492dc0
lea rcx, [rbx - 1]
jmp 0x495020
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rdi
mov rax, qword [rsp + 0xd0]
mov rbx, rdi
add rsp, 0xe8
pop rbp
ret
dec rcx
nop dword [rax + rax]
test rcx, rcx
jl 0x495049
movzx esi, byte [rax + rcx]
cmp sil, 0x5c
je 0x495049
cmp sil, 0x2f
je 0x495049
cmp sil, 0x2e
jne 0x495018
mov rdx, rbx
sub rbx, rcx
mov rcx, rbx
mov rbx, rdx
jmp 0x49504b
xor ecx, ecx
mov rdx, rbx
sub rbx, rcx
cmp rdx, rbx
jb 0x49546b
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x88], rax
lea rax, [0x004d5fc0]
call fcn.0040caa0
mov qword [rsp + 0xc8], rax
mov ebx, 0x2d
lea rax, [0x00501025]
call fcn.0046f5e0
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0xb8], rcx
nop
lea rax, [0x004e7780]
call fcn.0040caa0
mov qword [rax + 0x18], 0xc
cmp dword [0x00615ad0], 0
je 0x4950ce
mov rcx, qword [rax + 0x10]
call fcn.00464180
mov qword [r11], rcx
mov qword [rsp + 0x80], rax
lea rcx, [0x004f9463]
mov qword [rax + 0x10], rcx
nop
lea rax, [0x004eb740]
call fcn.0040caa0
cmp dword [0x00615ad0], 0
jne 0x495102
mov rcx, qword [rsp + 0x80]
nop
jmp 0x495112
call fcn.00464180
mov rcx, qword [rsp + 0x80]
mov qword [r11], rcx
mov qword [rsp + 0x78], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 0x10], 0xd
lea rcx, [0x004f983b]
mov qword [rax + 8], rcx
lea rax, [0x004d74a0]
call fcn.0040caa0
mov ecx, 0x80000001
mov qword [rax], rcx
mov rcx, qword [rsp + 0xc0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 2
mov rcx, qword [rsp + 0xb8]
mov qword [rax + 0x20], rcx
mov rbx, rax
mov ecx, 5
mov rdi, rcx
mov rax, qword [rsp + 0x78]
call fcn.0046d160
nop
test rax, rax
je 0x495225
mov ebx, 0xa
call fcn.00493b80
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x004fe095]
call fcn.0044e1c0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x98], rax
lea rax, [0x004e0200]
call fcn.0040caa0
mov rcx, qword [rsp + 0x40]
mov qword [rax + 8], rcx
cmp dword [0x00615ad0], 0
jne 0x4951e2
mov rcx, qword [rsp + 0x98]
nop
jmp 0x4951f2
call fcn.00464180
mov rcx, qword [rsp + 0x98]
mov qword [r11], rcx
mov qword [rax], rcx
lea rcx, [0x00521688]
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
add rsp, 0xe8
pop rbp
ret
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rcx]
movups xmmword [rsp + 0x58], xmm15
lea rsi, [0x004954a0]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xe0], rdx
mov byte [rsp + 0x2f], 1
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x30]
call fcn.0046f5e0
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x48]
call fcn.0046f5e0
mov qword [rsp + 0xa8], rax
nop
lea rax, [0x004e7780]
call fcn.0040caa0
mov qword [rax + 0x18], 0xc
cmp dword [0x00615ad0], 0
je 0x4952b7
mov rcx, qword [rax + 0x10]
call fcn.00464180
mov qword [r11], rcx
mov qword [rsp + 0x70], rax
lea rcx, [0x004f9463]
mov qword [rax + 0x10], rcx
nop
lea rax, [0x004eb740]
call fcn.0040caa0
cmp dword [0x00615ad0], 0
jne 0x4952e4
mov rcx, qword [rsp + 0x70]
jmp 0x4952f1
call fcn.00464180
mov rcx, qword [rsp + 0x70]
mov qword [r11], rcx
mov qword [rsp + 0x68], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 0x10], 0xe
mov rcx, qword [rsp + 0x48]
shl rcx, 1
mov qword [rsp + 0x50], rcx
lea rdx, [0x004f9b6f]
mov qword [rax + 8], rdx
lea rax, [0x004d76e0]
call fcn.0040caa0
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 1
mov rcx, qword [rsp + 0xa8]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rax + 0x28], rcx
mov rbx, rax
mov ecx, 6
mov rdi, rcx
mov rax, qword [rsp + 0x68]
call fcn.0046d160
nop word [rax + rax]
test rax, rax
je 0x495437
mov ebx, 0xa
call fcn.00493b80
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x004fe55d]
call fcn.0044e1c0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x90], rax
lea rax, [0x004e0200]
call fcn.0040caa0
mov rcx, qword [rsp + 0x38]
mov qword [rax + 8], rcx
cmp dword [0x00615ad0], 0
jne 0x4953e2
mov rcx, qword [rsp + 0x90]
nop
jmp 0x4953f2
call fcn.00464180
mov rcx, qword [rsp + 0x90]
mov qword [r11], rcx
mov qword [rax], rcx
lea rcx, [0x00521688]
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rax
mov byte [rsp + 0x2f], 0
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rdx]
call rax
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
add rsp, 0xe8
pop rbp
ret
movups xmmword [rsp + 0xd0], xmm15
mov byte [rsp + 0x2f], 0
mov rdx, qword [rsp + 0xe0]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xd0]
add rsp, 0xe8
pop rbp
ret
mov rcx, rbx
call fcn.00464540
nop
call fcn.00434c20
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
add rsp, 0xe8
pop rbp
ret
call fcn.00462280
jmp fcn.00494fa0