Function at 0x140004ba0
Capabilities:
Delete directory
Delete registry value
Enumerate files on windows
Get installed programs
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xe80
mov qword [rsp + 0xdd8], 0xfffffffffffffffe
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0xe78], rax
call fcn.1400047a0
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x128]
call fcn.140009910
mov r9, qword [0x1400256b8]
xor r8d, r8d
lea rdx, [0x14003fa50]
lea rcx, [rsp + 0x128]
call fcn.140009120
nop
mov rax, qword [0x1400256b8]
mov qword [rsp + 0x9d8], rax
lea rcx, [0x14002570c]
call fcn.140015f90
mov qword [rsp + 0x9d0], rax
mov r9, qword [rsp + 0x9d0]
mov r8, qword [rsp + 0x9d8]
lea rdx, [0x14002570c]
lea rcx, [rsp + 0x128]
call fcn.140009680
mov qword [rsp + 0x9e0], rax
mov r9, qword [rsp + 0x9e0]
xor r8d, r8d
lea rdx, [rsp + 0x6f8]
lea rcx, [rsp + 0x128]
call fcn.140008180
mov qword [rsp + 0xde0], rax
mov rax, qword [rsp + 0xde0]
mov qword [rsp + 0x9e8], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x9e8]
lea rcx, [rsp + 0x128]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x6f8]
call fcn.140009910
lea rax, [rsp + 0x9f0]
mov qword [rsp + 0x9f8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x720]
call fcn.140009910
lea rcx, str._n_____DIAS_installation_folder___
call fcn.140015f90
mov qword [rsp + 0xa00], rax
mov r8, qword [rsp + 0xa00]
lea rdx, str._n_____DIAS_installation_folder___
lea rcx, [rsp + 0x720]
call fcn.14000a940
nop
lea rcx, [rsp + 0x720]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x720]
call fcn.140009910
lea rcx, [rsp + 0x128]
call fcn.1400065f0
mov dword [rsp + 0x44], eax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.140009910
mov r9, qword [0x1400256b8]
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x100]
call fcn.140009120
nop
mov rax, qword [0x1400256b8]
mov qword [rsp + 0xa10], rax
lea rcx, [0x14002570c]
call fcn.140015f90
mov qword [rsp + 0xa08], rax
mov r9, qword [rsp + 0xa08]
mov r8, qword [rsp + 0xa10]
lea rdx, [0x14002570c]
lea rcx, [rsp + 0x100]
call fcn.140009680
mov qword [rsp + 0xa18], rax
mov r9, qword [rsp + 0xa18]
xor r8d, r8d
lea rdx, [rsp + 0x748]
lea rcx, [rsp + 0x100]
call fcn.140008180
mov qword [rsp + 0xde8], rax
mov rax, qword [rsp + 0xde8]
mov qword [rsp + 0xa20], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0xa20]
lea rcx, [rsp + 0x100]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x748]
call fcn.140009910
lea rax, [rsp + 0xa28]
mov qword [rsp + 0xa30], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x770]
call fcn.140009910
lea rcx, str._n_____Canon_folder___
call fcn.140015f90
mov qword [rsp + 0xa38], rax
mov r8, qword [rsp + 0xa38]
lea rdx, str._n_____Canon_folder___
lea rcx, [rsp + 0x770]
call fcn.14000a940
nop
lea rcx, [rsp + 0x770]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x770]
call fcn.140009910
lea r8, [rsp + 0x100]
lea rdx, str.__del_dir_:
lea rcx, [rsp + 0x798]
call fcn.14000d8b0
mov qword [rsp + 0xdf0], rax
mov rax, qword [rsp + 0xdf0]
mov qword [rsp + 0xdf8], rax
mov rcx, qword [rsp + 0xdf8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x798]
call fcn.140009910
mov dword [rsp + 0x150], 0
lea rdi, [rsp + 0x154]
xor eax, eax
mov ecx, 0x13c
rep stosb byte [rdi], al
lea r8, [0x140025f94]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x88]
call fcn.14000d9c0
nop
mov byte [rsp + 0x40], 0
cmp qword [rsp + 0xa8], 0x10
jb 0x140004f47
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xe00], rax
jmp 0x140004f57
lea rax, [rsp + 0x90]
mov qword [rsp + 0xe00], rax
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0xe00]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x2e8], rax
cmp qword [rsp + 0x2e8], 0
je 0x14000502e
lea rdx, [0x140025f90]
lea rcx, [rsp + 0x17c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140004ff6
lea rdx, [0x140025f8c]
lea rcx, [rsp + 0x17c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140004ff6
mov eax, dword [rsp + 0x150]
and eax, 0x10
test eax, eax
je 0x140004fef
mov r8d, 4
lea rdx, [rsp + 0x17c]
lea rcx, str.DIAS
call fcn.140016dbc
test eax, eax
jne 0x140004fe6
jmp 0x140004ff6
mov byte [rsp + 0x40], 1
jmp 0x140005014
mov byte [rsp + 0x40], 1
jmp 0x140005014
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140004f84
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x2e8], 0
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x1400050ac
lea rax, [rsp + 0xa40]
mov qword [rsp + 0xa48], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x7c0]
call fcn.140009910
lea rcx, str.____not_empty._skipped_deletion.
call fcn.140015f90
mov qword [rsp + 0xa50], rax
mov r8, qword [rsp + 0xa50]
lea rdx, str.____not_empty._skipped_deletion.
lea rcx, [rsp + 0x7c0]
call fcn.14000a940
nop
lea rcx, [rsp + 0x7c0]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x7c0]
call fcn.140009910
jmp 0x1400050f8
cmp qword [rsp + 0x120], 0x10
jb 0x1400050c9
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0xe08], rax
jmp 0x1400050d9
lea rax, [rsp + 0x108]
mov qword [rsp + 0xe08], rax
mov rcx, qword [rsp + 0xe08]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1400050f8
lea rcx, [rsp + 0x100]
call fcn.140006f30
call fcn.140004760
movzx eax, al
test eax, eax
jne 0x14000528c
lea rdx, [0x14003faf0]
lea rcx, [rsp + 0x2f0]
call fcn.140008200
nop
lea rax, [rsp + 0xa58]
mov qword [rsp + 0xa60], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x320]
call fcn.140009910
nop
mov rcx, qword [rsp + 0x308]
mov rax, qword [rsp + 0x310]
sub rax, rcx
cqo
mov ecx, 0x28
idiv rcx
test rax, rax
jne 0x14000516f
mov dword [rsp + 0xe10], 1
jmp 0x14000517a
mov dword [rsp + 0xe10], 0
movzx eax, byte [rsp + 0xe10]
test eax, eax
jne 0x14000525e
lea r8, [0x14002570c]
lea rdx, [0x14003faa0]
lea rcx, [rsp + 0x7e8]
call fcn.14000d9c0
mov qword [rsp + 0xe18], rax
mov rax, qword [rsp + 0xe18]
mov qword [rsp + 0xe20], rax
lea rcx, [rsp + 0x2f0]
call fcn.140008500
mov r8, rax
mov rdx, qword [rsp + 0xe20]
lea rcx, [rsp + 0x810]
call fcn.14000dac0
mov qword [rsp + 0xe28], rax
mov rax, qword [rsp + 0xe28]
mov qword [rsp + 0xaa0], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0xaa0]
lea rcx, [rsp + 0x320]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x810]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x7e8]
call fcn.140009910
lea rcx, [rsp + 0x320]
call fcn.140006410
lea rcx, [rsp + 0x2f0]
call fcn.140008800
jmp 0x140005140
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x320]
call fcn.140009910
nop
lea rcx, [rsp + 0x2f0]
call fcn.140009d20
nop
lea rcx, [rsp + 0x2f0]
call fcn.140008e90
lea rax, [rsp + 0xae0]
mov qword [rsp + 0xae8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x838]
call fcn.140009910
lea rcx, str._n_____registry_entries____
call fcn.140015f90
mov qword [rsp + 0xaf0], rax
mov r8, qword [rsp + 0xaf0]
lea rdx, str._n_____registry_entries____
lea rcx, [rsp + 0x838]
call fcn.14000a940
nop
lea rcx, [rsp + 0x838]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x838]
call fcn.140009910
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARECanonCBTSETUPCBTUser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005473
lea rdx, str.SOFTWARECanonCBTSETUPCBTUser
lea rcx, [rsp + 0x348]
call fcn.140007f70
nop
lea rdx, str.DIAS
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [rsp + 0x290], eax
lea r8, [rsp + 0x348]
lea rdx, [0x140025f58]
lea rcx, [rsp + 0x860]
call fcn.14000d8b0
mov qword [rsp + 0xe30], rax
mov rax, qword [rsp + 0xe30]
mov qword [rsp + 0xe38], rax
lea r8, str.__Value:
mov rdx, qword [rsp + 0xe38]
lea rcx, [rsp + 0x888]
call fcn.14000d9c0
mov qword [rsp + 0xe40], rax
mov rax, qword [rsp + 0xe40]
mov qword [rsp + 0xe48], rax
lea r8, str.DIAS
mov rdx, qword [rsp + 0xe48]
lea rcx, [rsp + 0x8b0]
call fcn.14000d9c0
mov qword [rsp + 0xe50], rax
mov rax, qword [rsp + 0xe50]
mov qword [rsp + 0xe58], rax
mov rcx, qword [rsp + 0xe58]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x8b0]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x888]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x860]
call fcn.140009910
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x348]
call fcn.140009910
call fcn.140004760
movzx eax, al
test eax, eax
jne 0x140005577
lea rax, [rsp + 0xb10]
mov qword [rsp + 0xb18], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x8d8]
call fcn.140009910
lea rcx, str.SOFTWARECanonCBT
call fcn.140015f90
mov qword [rsp + 0xb20], rax
mov r8, qword [rsp + 0xb20]
lea rdx, str.SOFTWARECanonCBT
lea rcx, [rsp + 0x8d8]
call fcn.14000a940
nop
lea rdx, [rsp + 0x8d8]
mov rcx, 0xffffffff80000002
call fcn.140005eb0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x8d8]
call fcn.140009910
lea rax, [rsp + 0xb28]
mov qword [rsp + 0xb30], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x900]
call fcn.140009910
lea rcx, str.SOFTWARECanonCBT
call fcn.140015f90
mov qword [rsp + 0xb38], rax
mov r8, qword [rsp + 0xb38]
lea rdx, str.SOFTWARECanonCBT
lea rcx, [rsp + 0x900]
call fcn.14000a940
nop
lea rdx, [rsp + 0x900]
mov rcx, 0xffffffff80000002
call fcn.140005c00
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x900]
call fcn.140009910
lea rdx, str.SOFTWARECanonDIAS
lea rcx, [rsp + 0xb0]
call fcn.140007f70
nop
lea rdx, [rsp + 0xb0]
mov rcx, 0xffffffff80000002
call fcn.140005eb0
lea rdx, [rsp + 0xb0]
mov rcx, 0xffffffff80000002
call fcn.140005c00
lea rdx, str.SOFTWARECanonDIAS
lea rcx, [rsp + 0x58]
call fcn.140007f70
nop
mov rax, qword [0x1400256b8]
mov qword [rsp + 0xb78], rax
lea rcx, [0x14002570c]
call fcn.140015f90
mov qword [rsp + 0xb70], rax
mov r9, qword [rsp + 0xb70]
mov r8, qword [rsp + 0xb78]
lea rdx, [0x14002570c]
lea rcx, [rsp + 0x58]
call fcn.140009680
mov qword [rsp + 0xb80], rax
mov r9, qword [rsp + 0xb80]
xor r8d, r8d
lea rdx, [rsp + 0x928]
lea rcx, [rsp + 0x58]
call fcn.140008180
mov qword [rsp + 0xe60], rax
mov rax, qword [rsp + 0xe60]
mov qword [rsp + 0xb88], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0xb88]
lea rcx, [rsp + 0x58]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x928]
call fcn.140009910
cmp qword [rsp + 0x78], 0x10
jb 0x14000568d
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xe68], rax
jmp 0x14000569a
lea rax, [rsp + 0x60]
mov qword [rsp + 0xe68], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0xe68]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400057c5
mov dword [rsp + 0x49c], 0
mov dword [rsp + 0x370], 0
mov dword [rsp + 0x374], 0x104
xor eax, eax
cmp eax, 1
je 0x14000579c
lea rax, [rsp + 0x490]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x374]
lea r8, [rsp + 0x380]
mov edx, dword [rsp + 0x49c]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x498], eax
cmp dword [rsp + 0x498], 0x103
jne 0x14000575c
jmp 0x14000579c
lea rax, [rsp + 0x380]
test rax, rax
jne 0x14000577b
lea rcx, [rsp + 0x380]
call fcn.140015f90
test rax, rax
je 0x140005786
mov dword [rsp + 0x370], 1
mov eax, dword [rsp + 0x49c]
add eax, 1
mov dword [rsp + 0x49c], eax
jmp 0x1400056ee
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x370], 0
jne 0x1400057c5
lea rdx, [rsp + 0x58]
mov rcx, 0xffffffff80000002
call fcn.140005c00
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallDIAS
lea rcx, [rsp + 0xd8]
call fcn.140007f70
nop
lea rax, [rsp + 0xba8]
mov qword [rsp + 0xbb0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x950]
call fcn.140009910
lea rcx, str._n____registry_the_installer_might_have_set___
call fcn.140015f90
mov qword [rsp + 0xbb8], rax
mov r8, qword [rsp + 0xbb8]
lea rdx, str._n____registry_the_installer_might_have_set___
lea rcx, [rsp + 0x950]
call fcn.14000a940
nop
lea rcx, [rsp + 0x950]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x950]
call fcn.140009910
lea rdx, [rsp + 0xd8]
mov rcx, 0xffffffff80000002
call fcn.140005eb0
lea rdx, [rsp + 0xd8]
mov rcx, 0xffffffff80000002
call fcn.140005c00
xor eax, eax
cmp eax, 1
je 0x140005a7a
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunonce
lea rcx, [rsp + 0x5b8]
call fcn.140007f70
nop
lea rax, [rsp + 0xbd8]
mov qword [rsp + 0xbe0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x978]
call fcn.140009910
lea rcx, str._n____registry_for_the_startup_progs___obsolete_for_the_current_DIAS_____
call fcn.140015f90
mov qword [rsp + 0xbe8], rax
mov r8, qword [rsp + 0xbe8]
lea rdx, str._n____registry_for_the_startup_progs___obsolete_for_the_current_DIAS_____
lea rcx, [rsp + 0x978]
call fcn.14000a940
nop
lea rcx, [rsp + 0x978]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x978]
call fcn.140009910
cmp qword [rsp + 0x5d8], 0x10
jb 0x140005925
mov rax, qword [rsp + 0x5c0]
mov qword [rsp + 0xe70], rax
jmp 0x140005935
lea rax, [rsp + 0x5c0]
mov qword [rsp + 0xe70], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rsp + 0xe70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000597b
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x5b8]
call fcn.140009910
jmp 0x140005a7a
mov dword [rsp + 0x6f0], 0
jmp 0x140005999
mov eax, dword [rsp + 0x6f0]
add eax, 1
mov dword [rsp + 0x6f0], eax
xor eax, eax
cmp eax, 1
je 0x140005a52
mov dword [rsp + 0x4c], 0x104
mov dword [rsp + 0x5b0], 0x104
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x5e0]
mov edx, dword [rsp + 0x6f0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x290], eax
cmp dword [rsp + 0x290], 0
je 0x140005a19
jmp 0x140005a52
mov r8d, 8
lea rdx, str.DiasCmd
lea rcx, [rsp + 0x5e0]
call fcn.140016b40
test eax, eax
jne 0x140005a4d
lea rdx, [rsp + 0x5e0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x140005988
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x5b8]
call fcn.140009910
jmp 0x140005a7a
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
lea rcx, [rsp + 0x298]
call fcn.140007f70
nop
lea rdx, str.CanonDIAS
lea rcx, [rsp + 0x2c0]
call fcn.140007f70
nop
lea rax, [rsp + 0xc78]
mov qword [rsp + 0xc80], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x9a0]
call fcn.140009910
lea rcx, str._n____registry_for_the_startup_Win9x_progs___obsolete_for_the_current_DIAS_____
call fcn.140015f90
mov qword [rsp + 0xca8], rax
mov r8, qword [rsp + 0xca8]
lea rdx, str._n____registry_for_the_startup_Win9x_progs___obsolete_for_the_current_DIAS_____
lea rcx, [rsp + 0x9a0]
call fcn.14000a940
nop
lea rcx, [rsp + 0x9a0]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x9a0]
call fcn.140009910
lea r8, [rsp + 0x2c0]
lea rdx, [rsp + 0x298]
mov rcx, 0xffffffff80000002
call fcn.1400060d0
mov dword [rsp + 0x9c8], 1
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x2c0]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x298]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd8]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x88]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x100]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x128]
call fcn.140009910
mov eax, dword [rsp + 0x9c8]
mov rcx, qword [rsp + 0xe78]
xor rcx, rsp
call fcn.140016740
add rsp, 0xe80
pop rdi
ret