Function at 0x140053ed0
Capabilities:
Check for time delay via gettickcount
Check os version
Enumerate processes
Get disk size
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x828]
sub rsp, 0x900
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
mov r12, rcx
mov qword [rsp + 0x70], rcx
xor r14d, r14d
mov word [rbp + 0x5e0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x5e2]
call fcn.1400cd020
mov qword [r12 + 0x1d0], r14
mov r8d, dword [0x1401b4d80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x140053f77
dec r8d
mov dword [0x1401b4d80], r8d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x78], r14d
or r15, 0xffffffffffffffff
lea ebx, [r15 + 0x66]
lea edi, [rbx - 0x64]
lea r13d, [r15 + 0x79]
nop word [rax + rax]
cmp byte [r12 + 0x119], 0
je 0x140053fcc
mov ebx, dword [r12 + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, ebx
jb 0x140053fc7
test ebx, ebx
jne 0x140055043
mov ebx, 0x65
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400553ef
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0x70]
call fcn.1400cd020
mov dword [rbp + 0x70], 0x238
mov dword [rsp + 0x48], r14d
lea rdx, [rbp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14005532b
nop word [rax + rax]
mov eax, 0x63
mov word [rbp + 0x5c0], ax
mov dword [rbp + 0x5c4], 0x6f0072
mov eax, 0x6d
mov word [rbp + 0x5c8], ax
mov eax, 0x2e
mov word [rbp + 0x5cc], ax
mov word [rbp + 0x5d4], r14w
mov qword [rbp + 0x2c0], r14
mov qword [rbp + 0x2c8], r14
mov qword [rbp + 0x2c8], 7
mov qword [rbp + 0x2c0], r14
mov word [rbp + 0x2b0], r14w
cmp word [rbp + 0x9c], 0
jne 0x14005408d
mov r8, r14
jmp 0x1400540ab
lea rax, [rbp + 0x9c]
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400540a0
lea rdx, [rbp + 0x9c]
lea rcx, [rbp + 0x2b0]
call fcn.1400589a0
nop
mov r8d, dword [0x1401b4d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xe
jne 0x140054103
call fcn.1400c84d4
mov r8d, dword [0x1401b4d80]
cmp r8d, eax
jne 0x140054103
dec r8d
mov dword [0x1401b4d80], r8d
mov word [rbp + 0x5d2], bx
mov word [rbp + 0x5ce], bx
mov word [rbp + 0x5ca], bx
mov eax, 0x68
mov word [rbp + 0x5c2], ax
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 1
jne 0x140054177
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r8d, dword [0x1401b4d80]
mov word [rbp + 0x5d0], r13w
lea rax, [rbp + 0x5c0]
mov rdx, r15
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140054190
lea rcx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 8
cmovae rcx, qword [rbp + 0x2b0]
mov r10, rdx
mov r11, qword [rbp + 0x2c0]
cmp r11, rdx
cmovb r10, r11
test r10, r10
je 0x1400541f4
lea r9, [rbp + 0x5c0]
nop
movzx eax, word [r9]
cmp word [rcx], ax
jne 0x1400541e8
add rcx, 2
add r9, 2
dec r10
jne 0x1400541d0
jmp 0x1400541f4
mov r10d, edi
cmp word [rcx], ax
cmovb r10d, r15d
jmp 0x1400541f7
mov r10d, r14d
movsxd rax, r10d
test r10d, r10d
jne 0x14005420a
cmp r11, rdx
jb 0x140054212
mov eax, r14d
setne al
test eax, eax
je 0x140054297
imul r8d, r8d
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0x16
jne 0x14005424d
mov edx, reloc.OLEAUT32.dll_LoadRegTypeLib
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400c8aec
nop
cmp qword [rbp + 0x2c8], 8
jb 0x140054263
mov rcx, qword [rbp + 0x2b0]
call fcn.1400c7bc0
mov qword [rbp + 0x2c8], 7
mov qword [rbp + 0x2c0], r14
mov word [rbp + 0x2b0], r14w
lea rdx, [rbp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140054514
jmp 0x140054020
cmp dword [r12 + 0x2d0], 1
jne 0x1400542ae
mov dword [r12 + 0x2d0], 2
mov r13d, dword [rbp + 0x90]
mov dword [rsp + 0x48], r13d
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r12 + 0x1d0], rax
test rax, rax
je 0x140054487
test r13d, r13d
je 0x140054487
mov r8d, 0x104
lea rdx, [rbp + 0x5e0]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1400550c2
cmp word [rbp + 0x5e0], 0
jne 0x140054311
mov r8, r14
jmp 0x14005432b
lea rax, [rbp + 0x5e0]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140054320
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x2b0]
call fcn.1400589a0
mov r8, qword [rbp + 0x2c0]
add r8, 0xfffffffffffffff6
mov r9, r15
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x2b0]
call fcn.1400584a0
mov rcx, rax
lea rax, [rbp + 0x5c0]
mov rdx, r15
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140054370
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x140054388
mov rcx, qword [rcx]
mov r9, rdx
cmp r10, rdx
cmovb r9, r10
test r9, r9
je 0x1400543c4
lea r8, [rbp + 0x5c0]
nop
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x1400543b8
add rcx, 2
add r8, 2
dec r9
jne 0x1400543a0
jmp 0x1400543c4
mov r9d, edi
cmp word [rcx], ax
cmovb r9d, r15d
jmp 0x1400543c7
mov r9d, r14d
movsxd rax, r9d
test r9d, r9d
jne 0x1400543e2
cmp r10, rdx
jae 0x1400543d9
mov eax, r15d
jmp 0x1400543e2
mov eax, r14d
cmp r10, rdx
setne al
test eax, eax
setne bl
cmp qword [rbp + 0x348], 8
jb 0x1400543fd
mov rcx, qword [rbp + 0x330]
call fcn.1400c7bc0
mov qword [rbp + 0x348], 7
mov qword [rbp + 0x340], r14
mov word [rbp + 0x330], r14w
test bl, bl
je 0x14005446f
mov rcx, qword [r12 + 0x1d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x78]
mov dword [rsp + 0x48], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r12 + 0x1d0], rax
test rax, rax
je 0x140055086
mov r8d, 0x104
lea rdx, [rbp + 0x5e0]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14005504a
cmp qword [rbp + 0x2c8], 8
jb 0x1400544f0
mov rcx, qword [rbp + 0x2b0]
call fcn.1400c7bc0
jmp 0x1400544f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, dword [rbp + 0x78]
mov dword [rsp + 0x48], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r12 + 0x1d0], rax
test rax, rax
je 0x14005513a
mov r8d, 0x104
lea rdx, [rbp + 0x5e0]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1400550fe
cmp qword [rbp + 0x2c8], 8
jb 0x1400544eb
mov rcx, qword [rbp + 0x2b0]
call fcn.1400c7bc0
mov edi, 1
mov r13d, 0x78
lea ebx, [r13 - 0x13]
mov word [rbp + 0x2b0], r14w
mov qword [rbp + 0x2c0], r14
mov qword [rbp + 0x2c8], 7
mov rax, qword [r12 + 0x1d0]
inc rax
test rax, 0xfffffffffffffffe
jne 0x140054535
mov ecx, dword [r12 + 0x1dc]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1401b4d80]
mov eax, ecx
imul eax, ecx
and eax, 0x80000007
jge 0x140054557
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 5
jne 0x140054564
dec ecx
mov dword [0x1401b4d80], ecx
mov rax, qword [r12 + 0x1d0]
dec rax
cmp rax, 0xfffffffffffffffd
mov esi, dword [rsp + 0x58]
ja 0x140053fa0
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov r13d, r14d
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1400546b5
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400545f2
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400024c0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], 0x104
jl 0x1400551b1
mov dword [rbx - 0x10], 0x104
mov word [rbx + 0x208], r14w
mov r9d, 0x104
mov r8, rbx
xor edx, edx
mov rcx, qword [r12 + 0x1d0]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
lea rcx, [rbx - 0x18]
call fcn.140002520
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x28]
call fcn.140049390
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400546ac
cmp dword [rdi + 0x10], 0
jl 0x14005469d
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14005469d
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140054692
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x1400546ac
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
mov rdx, qword [rbp - 0x28]
jmp 0x140054888
lea rax, [rbp - 0x18]
mov qword [rsp + 0x68], rax
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp - 0x18]
call fcn.140002220
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140049390
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140054730
cmp dword [rdi + 0x10], 0
jl 0x140054721
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140054721
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140054716
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140054730
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140054748
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call fcn.14004dd20
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140055320
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
sub rdx, rdi
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x14005478c
add rcx, 2
test ax, ax
jne 0x140054775
mov eax, r14d
jmp 0x140054791
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400548aa
mov rbx, qword [rsp + 0x50]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400547c6
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400024c0
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0xc], 0x104
jl 0x1400551bc
mov dword [rbx - 0x10], 0x104
mov word [rbx + 0x208], r14w
mov r9d, 0x104
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x1d0]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x68], rax
lea rcx, [rbx - 0x18]
call fcn.140002520
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x38]
call fcn.140049390
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140054884
cmp dword [rdi + 0x10], 0
jl 0x140054875
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140054875
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14005486a
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140054884
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005489c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0x40]
mov r12d, eax
cmp dword [rdi - 0x10], 0
je 0x1400548f4
call fcn.14004dd20
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x1400551c7
mov rcx, rdi
sub rdx, rdi
nop
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x1400548e7
add rcx, 2
test ax, ax
jne 0x1400548d0
mov eax, r14d
jmp 0x1400548ec
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400551d2
mov esi, r14d
mov ecx, dword [0x1401b4d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xd
jne 0x140054a53
mov rbx, r14
call fcn.1400c84d4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp + rbx*8 + 0x570], xmm0
inc rbx
cmp rbx, 9
jb 0x140054934
mov r8, r14
mov r9d, 8
lea r10d, [r9 + 1]
mov ecx, 8
cmp r8, rcx
jge 0x140054a44
cmp r9, 4
jl 0x140054a0d
lea rax, [rbp + 0x5a0]
mov edx, 4
sub rdx, r8
shr rdx, 2
inc rdx
mov ecx, 2
sub rcx, rdx
shl rcx, 2
nop word [rax + rax]
movsd xmm0, qword [rax + 0x10]
movsd xmm1, qword [rax + 8]
comisd xmm0, xmm1
jbe 0x1400549ba
movsd qword [rax + 0x10], xmm1
movsd qword [rax + 8], xmm0
movsd xmm0, qword [rax + 8]
movsd xmm1, qword [rax]
comisd xmm0, xmm1
jbe 0x1400549d2
movsd qword [rax + 8], xmm1
movsd qword [rax], xmm0
movsd xmm0, qword [rax]
movsd xmm1, qword [rax - 8]
comisd xmm0, xmm1
jbe 0x1400549ea
movsd qword [rax], xmm1
movsd qword [rax - 8], xmm0
movsd xmm0, qword [rax - 8]
movsd xmm1, qword [rax - 0x10]
comisd xmm0, xmm1
jbe 0x140054a04
movsd qword [rax - 8], xmm1
movsd qword [rax - 0x10], xmm0
sub rax, 0x20
dec rdx
jne 0x1400549a0
cmp rcx, r8
jle 0x140054a44
movsd xmm0, qword [rbp + rcx*8 + 0x570]
movsd xmm1, qword [rbp + rcx*8 + 0x568]
comisd xmm0, xmm1
jbe 0x140054a3c
movsd qword [rbp + rcx*8 + 0x570], xmm1
movsd qword [rbp + rcx*8 + 0x568], xmm0
dec rcx
cmp rcx, r8
jg 0x140054a12
inc r8
dec r9
dec r10
jne 0x140054960
cmp r12d, 0x714
jne 0x140054ae3
lea rcx, [rbp - 0x30]
call fcn.140049e80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140054abe
cmp dword [rdi + 0x10], 0
jl 0x140054aaf
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140054aaf
call fcn.140002520
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140054aa4
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
jmp 0x140054abe
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400023d0
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140054ad6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdi, qword [rsp + 0x40]
cmp dword [rdi - 0x10], 0
je 0x140054b34
call fcn.14004dd20
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x1400552e0
mov rcx, rdi
sub rdx, rdi
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x140054b27
add rcx, 2
test ax, ax
jne 0x140054b10
mov eax, r14d
jmp 0x140054b2c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400551d2
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x1d0], r14
mov edx, esi
lea rcx, [rbp + 0x3d0]
call fcn.14004c550
mov rsi, rax
mov edx, r12d
lea rcx, [rbp + 0x390]
call fcn.14004c550
mov rdi, rax
mov edx, r13d
lea rcx, [rbp + 0x350]
call fcn.14004c550
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x2f0]
call fcn.14004c550
nop
lea r8, [0x140142690]
mov rdx, rax
lea rcx, [rbp + 0x310]
call fcn.14002e9e0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x3f0]
call fcn.140059040
nop
lea r8, [0x140142690]
mov rdx, rax
lea rcx, [rbp + 0x370]
call fcn.14002e9e0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.140059040
nop
lea r8, [0x140142690]
mov rdx, rax
lea rcx, [rbp + 0x410]
call fcn.14002e9e0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140059040
nop
cmp qword [rbp + 0x428], 0x10
jb 0x140054c1e
mov rcx, qword [rbp + 0x410]
call fcn.1400c7bc0
mov qword [rbp + 0x428], 0xf
mov qword [rbp + 0x420], r14
mov byte [rbp + 0x410], 0
cmp qword [rbp + 0x3c8], 0x10
jb 0x140054c4d
mov rcx, qword [rbp + 0x3b0]
call fcn.1400c7bc0
mov qword [rbp + 0x3c8], 0xf
mov qword [rbp + 0x3c0], r14
mov byte [rbp + 0x3b0], 0
cmp qword [rbp + 0x388], 0x10
jb 0x140054c7c
mov rcx, qword [rbp + 0x370]
call fcn.1400c7bc0
mov qword [rbp + 0x388], 0xf
mov qword [rbp + 0x380], r14
mov byte [rbp + 0x370], 0
cmp qword [rbp + 0x408], 0x10
jb 0x140054cab
mov rcx, qword [rbp + 0x3f0]
call fcn.1400c7bc0
mov qword [rbp + 0x408], 0xf
mov qword [rbp + 0x400], r14
mov byte [rbp + 0x3f0], 0
cmp qword [rbp + 0x328], 0x10
jb 0x140054cda
mov rcx, qword [rbp + 0x310]
call fcn.1400c7bc0
mov qword [rbp + 0x328], 0xf
mov qword [rbp + 0x320], r14
mov byte [rbp + 0x310], 0
cmp qword [rbp + 0x308], 0x10
jb 0x140054d09
mov rcx, qword [rbp + 0x2f0]
call fcn.1400c7bc0
mov qword [rbp + 0x308], 0xf
mov qword [rbp + 0x300], r14
mov byte [rbp + 0x2f0], 0
cmp qword [rbp + 0x368], 0x10
jb 0x140054d38
mov rcx, qword [rbp + 0x350]
call fcn.1400c7bc0
mov qword [rbp + 0x368], 0xf
mov qword [rbp + 0x360], r14
mov byte [rbp + 0x350], 0
cmp qword [rbp + 0x3a8], 0x10
jb 0x140054d67
mov rcx, qword [rbp + 0x390]
call fcn.1400c7bc0
mov qword [rbp + 0x3a8], 0xf
mov qword [rbp + 0x3a0], r14
mov byte [rbp + 0x390], 0
cmp qword [rbp + 0x3e8], 0x10
jb 0x140054d96
mov rcx, qword [rbp + 0x3d0]
call fcn.1400c7bc0
mov qword [rbp + 0x3e8], 0xf
mov qword [rbp + 0x3e0], r14
mov byte [rbp + 0x3d0], 0
mov eax, dword [0x1401b4d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x140054ded
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esi, dword [rsp + 0x78]
mov eax, esi
inc esi
mov dword [rsp + 0x78], esi
lea rbx, [rbp + 0x2d0]
cmp eax, 5
jge 0x1400552eb
cmp qword [rbp + 0x2e8], 0x10
cmovae rbx, qword [rbp + 0x2d0]
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
test rbx, rbx
je 0x140054e60
test rbx, 0xffffffffffff0000
jne 0x140054e60
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x140054e6d
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400026c0
jmp 0x140054e6d
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140003500
nop
lea r13, [0x1401b0978]
mov rbx, r13
cmp byte [0x1401b5fbc], 0
jne 0x140054ed3
movzx eax, byte [0x1401afda0]
xor al, 0x50
movzx eax, al
mov word [0x1401b0978], ax
movzx eax, byte [0x1401afda1]
xor al, 8
movzx eax, al
mov word [reloc.OLEAUT32.dll_VariantClear], ax
movzx eax, byte [0x1401afda2]
xor al, 0xc
movzx eax, al
mov word [0x1401b097c], ax
movzx eax, byte [0x1401afda3]
xor al, 0x1f
movzx eax, al
mov word [0x1401b097e], ax
mov byte [0x1401b5fbc], 1
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
test r13, 0xffffffffffff0000
jne 0x140054f15
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x140054f3c
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.1400026c0
jmp 0x140054f3c
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [r13 + rax*2], 0
jne 0x140054f20
mov r8d, eax
mov rdx, r13
lea rcx, [rbp - 0x78]
call fcn.1400023d0
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x40]
call fcn.14000f640
nop
mov r12, qword [rsp + 0x70]
lea rcx, [r12 + 0x1b8]
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
call fcn.140010100
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140054f81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140054f9a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140054fb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [r12 + 0x1dc]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp + 0x2e8], 0x10
jb 0x140054fde
mov rcx, qword [rbp + 0x2d0]
call fcn.1400c7bc0
mov qword [rbp + 0x2e8], 0xf
mov qword [rbp + 0x2e0], r14
mov byte [rbp + 0x2d0], 0
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140055011
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
mov edi, 1
mov esi, dword [rsp + 0x58]
lea ebx, [rdi + 0x64]
lea r13d, [rdi + 0x77]
jg 0x140053fa0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140053fa0
mov eax, edi
jmp 0x1400554bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x550]
call fcn.14004c550
mov rbx, rax
call fcn.1400503c0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x58]
call fcn.1400514f0
lea rdx, [0x140177a50]
lea rcx, [rbp + 0x58]
call fcn.1400cfab8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x430]
call fcn.14004c550
mov r10, rax
call fcn.140051190
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x18]
call fcn.1400514f0
lea rdx, [0x140177a50]
lea rcx, [rbp + 0x18]
call fcn.1400cfab8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x490]
call fcn.14004c550
mov r10, rax
call fcn.140050f90
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x48]
call fcn.1400514f0
lea rdx, [0x140177a50]
lea rcx, [rbp + 0x48]
call fcn.1400cfab8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x530]
call fcn.14004c550
mov r10, rax
call fcn.14004f210
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x38]
call fcn.1400514f0
lea rdx, [0x140177a50]
lea rcx, [rbp + 0x38]
call fcn.1400cfab8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4d0]
call fcn.14004c550
mov rbx, rax
mov edx, edi
lea rcx, [rbp + 0x510]
call fcn.14004c550
nop
lea r8, [0x140143b54]
mov rdx, rax
lea rcx, [rbp + 0x450]
call fcn.14002e9e0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x470]
call fcn.140059040
mov r10, rax
call fcn.14004fef0
mov rdx, rax
mov r8, r10
lea rcx, [rbp]
call fcn.1400514f0
lea rdx, [0x140177a50]
lea rcx, [rbp]
call fcn.1400cfab8
nop
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, r14
lea rdx, [0x140143b58]
nop dword [rax]
movzx eax, word [rdi + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x1400551f9
cmp rcx, 8
jne 0x1400551e0
mov eax, r14d
jmp 0x1400551fe
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14005528b
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x1d0], r14
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1400197c0
nop
mov dl, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140058370
mov dl, 0x20
lea rcx, [rsp + 0x60]
call fcn.140058370
mov dl, 0x2f
lea rcx, [rsp + 0x60]
call fcn.140058370
mov rax, qword [rsp + 0x60]
mov ecx, 1
sub ecx, dword [rax - 8]
or ecx, dword [rax - 0xc]
jge 0x140055264
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14001a2a0
call fcn.140050280
mov rdx, rax
mov r8, qword [rsp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.140051430
lea rdx, [0x140177a50]
lea rcx, [rbp - 0x10]
call fcn.1400cfab8
nop
mov rbx, qword [rsp + 0x70]
lea rcx, [rbx + 0x188]
lea rdx, [rsp + 0x40]
call fcn.140002340
mov eax, dword [rsp + 0x48]
mov dword [rbx + 0x1c8], eax
lea rdx, [rdi - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400552c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400552d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400554bc
mov ecx, 0x80004005
call fcn.140001920
nop
cmp qword [rbp + 0x2e8], 0x10
cmovae rbx, qword [rbp + 0x2d0]
call fcn.14004fdc0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x28]
call fcn.140051430
lea rdx, [0x140177a50]
lea rcx, [rbp + 0x28]
call fcn.1400cfab8
nop
mov ecx, 0x80004005
call fcn.140001920
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4b0]
call fcn.14004c550
mov rdi, rax
call fcn.14004faf0
mov rbx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x68], rax
lea rcx, str._k_f_
mov rdx, qword [str._k_f_]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x68], rax
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
test rbx, rbx
je 0x1400553a1
inc r15
cmp word [rbx + r15*2], 0
jne 0x140055393
mov r14d, r15d
mov r8d, r14d
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.1400023d0
cmp qword [rdi + 0x18], 0x10
jb 0x1400553ba
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140003500
lea r8, [0x14013e604]
lea rdx, [0x14013e608]
lea rcx, [rbp - 0x60]
call fcn.14000f190
nop
lea rdx, [0x140177a50]
lea rcx, [rbp - 0x60]
call fcn.1400cfab8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4f0]
call fcn.14004c550
mov rdi, rax
call fcn.140050010
mov rbx, rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x68], rax
lea rcx, str._k_f_
mov rdx, qword [str._k_f_]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x68], rax
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
test rbx, rbx
je 0x14005546e
nop word [rax + rax]
inc r15
cmp word [rbx + r15*2], 0
jne 0x140055460
mov r14d, r15d
mov r8d, r14d
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.1400023d0
cmp qword [rdi + 0x18], 0x10
jb 0x140055487
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.140003500
lea r8, [0x14013e604]
lea rdx, [0x14013e608]
lea rcx, [rbp - 0x70]
call fcn.14000f190
nop
lea rdx, [0x140177a50]
lea rcx, [rbp - 0x70]
call fcn.1400cfab8
nop
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.1400c7be0
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret