Function at 0x1400f9a40
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf88]
mov eax, 0x1088
call fcn.140247340
sub rsp, rax
mov qword [rbp + 0x30], 0xfffffffffffffffe
lea rax, vtable.CFunctionEnterExit.0
mov qword [rbp + 0x38], rax
lea rbx, str.ncsLIBLoadConfigurationData
mov qword [rbp + 0x40], rbx
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x50]
call fcn.140249b10
mov r8, rbx
lea rdx, [0x1402862f8]
lea rcx, [rbp + 0x50]
call fcn.140006bc0
mov r13d, 1
mov r9d, r13d
mov r8d, r13d
lea rdx, [rbp + 0x50]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
call fcn.1400fafc0
lea r8, str.https:__www.superantispyware.com_professionalupgrade.html
mov edx, 0x104
lea rcx, [0x1403508f8]
call fcn.140253604
lea r8, str.https:__www.superantispyware.com_purchase_products_ex.html
mov edx, 0x104
lea rcx, [0x1403509fc]
call fcn.140253604
xor edx, edx
mov r8d, 0x104
lea rcx, [0x140350b00]
call fcn.140249b10
mov dword [rsp + 0x20], 0x104
lea r9, [0x14034ec34]
lea r8, [0x140296e88]
lea rdx, [0x140296ea0]
lea ecx, [r13 + 0x19]
call fcn.1400eab60
mov dword [rsp + 0x20], 0x104
lea rsi, [0x14034eb30]
mov r9, rsi
lea r8, [0x140296e88]
lea rdx, [0x140296ea0]
lea ecx, [r13 + 0x22]
call fcn.1400eab60
xor r12d, r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8d, 0x104
lea rdx, [0x14035148c]
lea rcx, [rbp + 0xfd0]
call fcn.1400e4b70
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x250]
call fcn.140249b10
mov dword [rbp + 0xfd8], 0x104
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0xf003f
xor r9d, r9d
lea r8, str.SOFTWAREMicrosoftInternet_Explorer
mov rdx, 0xffffffff80000002
call qword [rax + 0x128]
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rbp + 0xfd8]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0x250]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xfe0]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, str.svcVersion
mov rdx, qword [rsp + 0x68]
call qword [rax + 0x170]
test eax, eax
je 0x1400f9c58
mov rcx, qword [0x14037adb0]
mov rax, qword [rcx]
lea rdx, [rbp + 0xfd8]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0x250]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xfe0]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, str.Version
mov rdx, qword [rsp + 0x68]
call qword [rax + 0x170]
cmp qword [rsp + 0x68], r12
je 0x1400f9c6a
test eax, eax
lea r8, [rbp + 0x250]
je 0x1400f9c71
lea r8, str.IE_Not_Installed
mov r9d, dword [rbp + 0xfd8]
mov edx, 0x104
lea rcx, [0x140351590]
call fcn.1402532e8
lea r15, vtable.CSABString.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], r12d
mov rcx, r13
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400f9cc8
mov r8d, dword [rsp + 0x50]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x54], r13d
lea rdx, [rsp + 0x40]
lea rcx, str.standalonescan
call fcn.1400df720
mov ebx, eax
mov qword [rsp + 0x40], r15
add dword [rsp + 0x54], 0xffffffff
jne 0x1400f9cfb
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400f9cfb
call fcn.140247060
test ebx, ebx
je 0x1400f9d14
mov dword [0x1403508e0], r13d
mov dword [0x1403508e8], r13d
mov dword [0x1403508e4], r13d
mov r14, 0xffffffffffffffff
mov rax, r14
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x1400f9d20
test rax, rax
jne 0x1400f9d3e
lea rdx, [0x14034ec34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.1400fb680
mov r8d, 0x104
lea rdi, [0x14034e928]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rdx, rdi
lea rcx, [0x14034ea2c]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rdi
call fcn.1400fca30
cmp dword [0x1403508e0], 0
je 0x1400f9d98
mov rdx, rdi
lea rcx, [0x14034ec34]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rsi
lea rcx, [0x14034ed38]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.SAS_ALLUSER.DB3
lea rcx, [0x14034ed38]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [0x14034ec34]
lea rcx, [0x14034ee3c]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.SAS_CURRENTUSER.DB3
lea rcx, [0x14034ee3c]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
cmp dword [0x1403508e4], 0
jne 0x1400f9f01
mov r8, 0xffffffff80000002
lea rdx, [0x140338120]
lea rcx, [0x14034ee3c]
call fcn.1400f8c40
mov r8, 0xffffffff80000002
lea rdx, [0x140338120]
lea rcx, [0x14034ed38]
call fcn.1400f8c40
test eax, eax
je 0x1400f9e47
mov r8, 0xffffffff80000001
lea rdx, [0x140338120]
lea rcx, [0x14034ee3c]
call fcn.1400f8c40
test eax, eax
jne 0x1400f9e5a
lea rdx, [0x140338120]
lea rcx, str.SoftwareSUPERAntiSpyware.comSUPERAntiSpyware
call fcn.1400f96e0
cmp byte [0x1403509fc], 0
jne 0x1400f9e7b
lea r8, str.https:__www.superantispyware.com_purchase_products_ex.html
mov edx, 0x104
lea rcx, [0x1403509fc]
call fcn.140253604
cmp byte [0x1403508f8], 0
jne 0x1400f9e9c
lea r8, str.https:__www.superantispyware.com_professionalupgrade.html
mov edx, 0x104
lea rcx, [0x1403508f8]
call fcn.140253604
mov qword [0x140350478], r12
lea rdx, [0x14034ec34]
lea rcx, [0x14034ee3c]
call fcn.1400f8290
test eax, eax
jne 0x1400f9ed4
lea r8, [0x140338120]
lea rdx, [0x14034ee3c]
mov rcx, 0xffffffff80000001
call fcn.1400f9230
mov rdx, rsi
lea rcx, [0x14034ed38]
call fcn.1400f8290
test eax, eax
jne 0x1400f9f01
lea r8, [0x140338120]
lea rdx, [0x14034ed38]
mov rcx, 0xffffffff80000002
call fcn.1400f9230
lea rbx, [0x14034ef40]
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400f9f10
test rax, rax
jne 0x1400f9f74
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x820
lea rcx, [rbp + 0x360]
call fcn.140249b10
lea rcx, [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov r8d, 0x820
lea rdx, [rbp + 0x360]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ole32.dll_StringFromGUID2]
mov r8d, 0x40
lea rdx, [rbp + 0x360]
mov rcx, rbx
call fcn.1402532e0
lea rbx, [0x14034e6c8]
mov rax, r14
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x1400f9f80
test rax, rax
jne 0x1400f9faa
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.detect.wav
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, dword [0x14034e904]
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
cmp eax, ecx
cmovne eax, ecx
mov dword [0x14034e904], eax
mov eax, dword [0x1403508cc]
mov ecx, 0x64
cmp eax, ecx
cmovb eax, ecx
mov dword [0x1403508cc], eax
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xb80]
call fcn.140249b10
cmp dword [0x14034f044], 0
jne 0x1400fa0bf
mov dword [rbp + 0xfd0], 0x400
lea r9, [rbp + 0xfd0]
lea r8, [rbp + 0xb80]
xor edx, edx
lea rcx, str.https:__www.superantispyware.com
call qword [sym.imp.WININET.dll_InternetGetCookieA]
test eax, eax
je 0x1400fa0bf
mov r9d, 0x100000
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xb80]
call qword [sym.imp.SHLWAPI.dll_UrlUnescapeA]
mov dword [0x14034f044], r13d
lea r8, [0x14034f048]
lea rdx, str.ResellerId
lea rcx, [rbp + 0xb80]
call fcn.1400f7860
mov r9d, 0x100
lea r8, [0x14034f04c]
lea rdx, str.Referrer
lea rcx, [rbp + 0xb80]
call fcn.1400f7670
mov r9d, 0x40
lea r8, [0x14034f14c]
lea rdx, [0x1402b7154]
lea rcx, [rbp + 0xb80]
call fcn.1400f7670
mov r9d, 0x100
lea r8, [0x14034f18c]
lea rdx, str.Extra
lea rcx, [rbp + 0xb80]
call fcn.1400f7670
mov edx, 0x104
lea rcx, [0x140350584]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, str.TASKMGR.EXE
lea rcx, [0x140350584]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov edx, 0x104
lea rcx, [0x140350688]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, str.LSASS.EXE
lea rcx, [0x140350688]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
cmp dword [0x1403508e4], 0
jne 0x1400fa1a9
cmp dword [0x1403508ec], 0
jne 0x1400fa1a9
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x360]
call fcn.140249b10
mov rdx, rdi
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.sas_preconfig.db3
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1400fa1a2
mov r8, 0xffffffff80000002
lea rdx, [0x140338120]
lea rcx, [rbp + 0x360]
call fcn.1400f8c40
mov r8, 0xffffffff80000001
lea rdx, [0x140338120]
lea rcx, [rbp + 0x360]
call fcn.1400f8c40
mov dword [0x1403508ec], r13d
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x360]
call fcn.140249b10
lea rax, [rbp + 0x360]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, str.SUPERAntiSpyware.comSUPERAntiSpywareSetupOptions.db3
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1400fa61c
cmp qword [0x1403534f0], 0
jne 0x1400fa60f
lea rcx, [rbp - 0x40]
call fcn.14007ba30
nop
xor r8d, r8d
lea rdx, [rbp + 0x360]
lea rcx, [rbp - 0x40]
call fcn.14006d170
test eax, eax
je 0x1400fa5b9
mov ebx, r12d
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400fa263
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, str.SELECT_variable_value_FROM_SetupVariables
call qword [rax]
mov ebx, eax
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1400fa5b9
mov dword [0x14034e680], r13d
mov r14d, r12d
mov ecx, 0x20
call fcn.14018ef40
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400fa2c2
mov qword [rax + 8], r15
mov qword [rax + 0x10], r12
mov dword [rax + 0x18], r12d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbx + 0x10], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbx + 0x1c], r13d
mov qword [rbx], r12
jmp 0x1400fa2c5
mov rbx, r12
mov qword [0x1403534f0], rbx
mov esi, r12d
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r9, [rbp + 0xfd0]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x28]
test eax, eax
je 0x1400fa574
lea r15, [0x1402b3c20]
nop word [rax + rax]
cmp qword [rbp + 0xfd0], 0
je 0x1400fa553
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r9, [rbp + 0xfe8]
mov r8d, r13d
mov edx, esi
call qword [rax + 0x28]
test eax, eax
je 0x1400fa553
mov rbx, qword [rbp + 0xfe8]
test rbx, rbx
je 0x1400fa553
lea rdx, str.EmailRegProductId
mov rdi, qword [rbp + 0xfd0]
mov rcx, rdi
call fcn.1402523a0
test eax, eax
jne 0x1400fa379
mov r8, rbx
mov edx, 0x104
lea rcx, [0x140350d08]
call fcn.140253604
mov rdi, qword [rbp + 0xfd0]
mov rbx, qword [rbp + 0xfe8]
lea rdx, str.EmailRegTenant
mov rcx, rdi
call fcn.1402523a0
test eax, eax
jne 0x1400fa3ae
mov r8, rbx
mov edx, 0x104
lea rcx, [0x140350e0c]
call fcn.140253604
mov rdi, qword [rbp + 0xfd0]
mov rbx, qword [rbp + 0xfe8]
lea rdx, str.EmailRegistration
mov rcx, rdi
call fcn.1402523a0
test eax, eax
jne 0x1400fa3e3
mov r8, rbx
mov edx, 0x104
lea rcx, [0x140350c04]
call fcn.140253604
mov rdi, qword [rbp + 0xfd0]
mov rbx, qword [rbp + 0xfe8]
lea rdx, str.FreeEdition
mov rcx, rdi
call fcn.1402523a0
test eax, eax
jne 0x1400fa428
mov rax, r12
nop dword [rax]
movzx ecx, byte [rbx + rax]
inc rax
cmp cl, byte [r15 + rax - 1]
jne 0x1400fa419
cmp rax, 4
jne 0x1400fa400
cmp cl, byte [r15 + rax - 1]
mov eax, r12d
setne al
mov dword [0x14034e690], eax
mov r14d, r13d
lea rdx, str.UpdateCheck
mov rcx, rdi
call fcn.1402523a0
test eax, eax
jne 0x1400fa46c
mov rcx, r12
nop
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r15 + rcx - 1]
jne 0x1400fa46c
cmp rcx, 4
jne 0x1400fa440
mov rax, qword [0x1403534f0]
mov dword [rax], r13d
mov rdi, qword [rbp + 0xfd0]
mov rbx, qword [rbp + 0xfe8]
lea rdx, str.Diagnostic
mov rcx, rdi
call fcn.1402523a0
test eax, eax
jne 0x1400fa4ad
mov rcx, r12
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r15 + rcx - 1]
jne 0x1400fa4a6
cmp rcx, 4
jne 0x1400fa482
mov dword [0x140350f14], r13d
mov dword [0x140350f10], r12d
jmp 0x1400fa4ad
mov dword [0x140350f10], r13d
lea rdx, str.EmailAddress
mov rcx, rdi
call fcn.1402523a0
test eax, eax
jne 0x1400fa4e5
cmp byte [rbx], al
je 0x1400fa4e5
mov rcx, qword [0x1403534f0]
add rcx, 8
mov rdx, rbx
call fcn.140004820
mov rdi, qword [rbp + 0xfd0]
mov rbx, qword [rbp + 0xfe8]
lea rdx, str.ForceActivate
mov rcx, rdi
call fcn.1402523a0
test eax, eax
jne 0x1400fa52d
mov rcx, r12
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r15 + rcx - 1]
jne 0x1400fa52d
cmp rcx, 4
jne 0x1400fa500
mov rax, qword [0x1403534f0]
mov dword [rax + 4], r13d
mov rdi, qword [rbp + 0xfd0]
mov rbx, qword [rbp + 0xfe8]
lea rdx, str.InstallDir
mov rcx, rdi
call fcn.1402523a0
lea rdi, [0x14034e928]
test eax, eax
jne 0x1400fa553
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r9, [rbp + 0xfd0]
xor r8d, r8d
mov edx, esi
call qword [rax + 0x28]
test eax, eax
jne 0x1400fa300
mov rbx, qword [rsp + 0x60]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400fa595
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x14034e690]
test r14d, r14d
cmove eax, r13d
mov dword [0x14034e690], eax
lea rsi, [0x14034eb30]
lea rax, vtable.CSABSQL.0
mov qword [rbp - 0x40], rax
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400fa5e4
mov rax, qword [rcx]
mov edx, r13d
call qword [rax + 0x40]
mov qword [rbp - 0x10], r12
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rax, vtable.CSABByteString.0
mov qword [rbp - 0x38], rax
mov rdx, r13
mov rcx, qword [rbp - 0x30]
call fcn.140247060
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x14034e8d4], 0
jne 0x1400fa666
cmp byte [0x14034e8d8], 0
jne 0x1400fa666
cmp dword [0x14034e690], 0
jne 0x1400fa66d
mov dword [0x14034e8fc], r12d
mov dword [0x14034e6a0], r12d
mov dword [0x140350864], 3
mov dword [0x140350894], r12d
mov dword [0x1403507ac], r12d
mov dword [0x14035102c], r12d
jmp 0x1400fa66d
mov dword [0x14034e690], r13d
mov edx, 0x410
lea rcx, [rbp + 0x360]
cmp dword [0x1403508e0], 0
mov r8, rdi
jne 0x1400fa688
mov r8, rsi
call fcn.140253604
lea rdx, str.PROCESSLIST.BIN
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea r8, [rbp - 0x70]
xor edx, edx
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x1400fa6dd
lea rdx, [rbp + 0xfd0]
lea rcx, [rbp - 0x5c]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [0x140350800]
lea rcx, [rbp + 0xfd0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor eax, eax
cmp qword [0x1403508a0], rax
jne 0x1400fa6fe
cmp qword [0x1403508a8], rax
jne 0x1400fa6fe
lea rcx, [0x1403508a0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [0x14034e7cc]
cmp byte [0x14034e7cc], 0
jne 0x1400fa71e
lea rdx, [0x1402b6c80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdi, vtable.CSABUnicodeString.0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x58], r12
mov ecx, 2
call fcn.140247068
mov r15, rax
mov qword [rsp + 0x48], rax
mov rbx, r13
mov qword [rsp + 0x50], rbx
mov word [rax], r12w
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x58], r12
mov ecx, 2
call fcn.140247068
mov r14, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], r13
mov word [rax], r12w
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x78], r12
mov ecx, 2
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 1
mov word [rax], r12w
mov rcx, 0xffffffffffffffff
mov rdi, rcx
lea rax, [0x14034eb30]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400fa7a6
lea r12, [rdi + 1]
cmp r12, 1
jbe 0x1400fa7fb
mov eax, 2
mul r12
cmovo rax, rcx
mov rcx, rax
call fcn.140247068
mov rbx, rax
movzx ecx, word [r15]
mov word [rax], cx
mov edx, 2
mov rcx, r15
call fcn.140247060
mov r15, rbx
mov qword [rsp + 0x48], rbx
mov rbx, r12
mov qword [rsp + 0x50], rbx
lea rax, [0x14034eb30]
test rdi, rdi
je 0x1400fa819
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, edi
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ebx, ebx
mov word [r15 + rdi*2], bx
mov qword [rsp + 0x58], rdi
mov rcx, 0xffffffffffffffff
mov rdi, rcx
lea rax, [0x14034e928]
inc rdi
cmp byte [rax + rdi], bl
jne 0x1400fa836
lea r12, [rdi + 1]
cmp r12, 1
jbe 0x1400fa88a
mov eax, 2
mul r12
cmovo rax, rcx
mov rcx, rax
call fcn.140247068
mov rbx, rax
movzx ecx, word [r14]
mov word [rax], cx
mov edx, 2
mov rcx, r14
call fcn.140247060
mov r14, rbx
mov qword [rbp - 0x68], rbx
mov r13, r12
mov qword [rbp - 0x60], r12
xor ebx, ebx
lea rax, [0x14034e928]
test rdi, rdi
je 0x1400fa8a9
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9d, edi
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [r14 + rdi*2], bx
mov qword [rbp - 0x58], rdi
mov rcx, 0xffffffffffffffff
mov rdi, rcx
lea r13, [0x14034e7cc]
inc rdi
cmp byte [rdi + r13], 0
jne 0x1400fa8c3
lea r12, [rdi + 1]
cmp r12, 1
jbe 0x1400fa914
mov eax, 2
mul r12
cmovo rax, rcx
mov rcx, rax
call fcn.140247068
mov rbx, rax
movzx ecx, word [rsi]
mov word [rax], cx
mov edx, 2
mov rcx, rsi
call fcn.140247060
mov rsi, rbx
mov qword [rsp + 0x78], rbx
mov rax, r12
mov qword [rbp - 0x80], rax
xor ebx, ebx
jmp 0x1400fa918
mov rax, qword [rbp - 0x80]
test rdi, rdi
je 0x1400fa936
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, edi
mov r8, r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rsi + rdi*2], bx
mov qword [rbp - 0x78], rdi
mov r9, rsi
mov r8, r14
mov rdx, r15
lea rcx, [0x1403534f8]
call fcn.1400f7a60
nop
mov edx, 2
mov rcx, rsi
call fcn.140247060
nop
mov edx, 2
mov rcx, r14
call fcn.140247060
nop
mov edx, 2
mov rcx, r15
call fcn.140247060
call fcn.1400fb560
lea rdi, vtable.CSABString.0
mov qword [rsp + 0x40], rdi
xor esi, esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
lea ecx, [rsi + 1]
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400fa9c2
mov r8d, dword [rsp + 0x50]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x54], 1
lea rdx, [rsp + 0x40]
lea rcx, str.standalonescan
call fcn.1400df720
mov ebx, eax
mov qword [rsp + 0x40], rdi
add dword [rsp + 0x54], 0xffffffff
jne 0x1400fa9f8
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400fa9f8
call fcn.140247060
test ebx, ebx
je 0x1400fab67
mov dword [0x1403508e4], 1
mov dword [0x1403508e0], 1
mov dword [0x1403508e8], 1
mov dword [0x140350474], esi
mov dword [0x14034e680], 1
mov dword [0x14034f2ac], esi
mov byte [0x14034f2b0], 0
mov dword [0x14034e6bc], esi
mov dword [0x14034e6a0], esi
mov qword [0x14034e8fc], rsi
mov dword [0x140350790], esi
mov qword [0x140350830], rsi
mov dword [0x140350894], esi
mov dword [0x14035102c], esi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov ecx, 1
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400faaa0
mov r8d, dword [rsp + 0x50]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x54], 1
lea rdx, [rsp + 0x40]
lea rcx, str.silent
call fcn.1400df720
mov ebx, eax
mov qword [rsp + 0x40], rdi
add dword [rsp + 0x54], 0xffffffff
jne 0x1400faad6
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400faad6
call fcn.140247060
mov ecx, dword [0x14034e684]
test ebx, ebx
cmovne ecx, esi
mov dword [0x14034e684], ecx
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov ecx, 1
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400fab20
mov r8d, dword [rsp + 0x50]
inc r8d
lea rdx, [0x140286ae1]
mov rcx, rax
call fcn.1402496a0
mov dword [rsp + 0x54], 1
lea rdx, [rsp + 0x40]
lea rcx, str.nocookies
call fcn.1400df720
mov ebx, eax
mov qword [rsp + 0x40], rdi
add dword [rsp + 0x54], 0xffffffff
jne 0x1400fab56
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400fab56
call fcn.140247060
mov ecx, dword [0x140350840]
test ebx, ebx
cmovne ecx, esi
mov dword [0x140350840], ecx
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x150]
call fcn.140249b10
mov r8d, 0x100
lea rdx, [rbp + 0x150]
lea rcx, [0x14034ea2c]
call fcn.1400e31f0
test eax, eax
je 0x1400fae38
mov qword [rsp + 0x40], rdi
mov ebx, esi
mov dword [rsp + 0x50], ebx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rsp + 0x54], 1
mov r12d, esi
mov r13d, esi
lea rcx, [rbp + 0x150]
mov r15, 0xffffffffffffffff
mov rax, r15
inc rax
cmp byte [rcx + rax], r12b
jne 0x1400fabe1
test rax, rax
je 0x1400fae18
mov rcx, rsi
nop word [rax + rax]
lea r14, [rbp + 0x150]
add r14, rcx
cmp byte [r14], 0x2c
jne 0x1400facdd
inc r12d
cmp r12d, 3
jae 0x1400facdd
lea rax, vtable.CSABString.0
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x80], 1
mov ecx, 2
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400fac55
movzx ecx, word [0x14028b4b8]
mov word [rax], cx
mov dword [rbp - 0x7c], 1
lea ecx, [rbx + 2]
call fcn.140247068
test rdi, rdi
je 0x1400faca8
mov r15, rax
mov rdx, rdi
mov r8, rax
sub r8, rdi
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fac80
mov rcx, rdi
call fcn.140247060
mov rdi, r15
mov qword [rsp + 0x48], r15
mov r15, 0xffffffffffffffff
jmp 0x1400facb0
mov rdi, rax
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x1400facce
mov ecx, ebx
movzx eax, word [rsi]
mov word [rcx + rdi], ax
mov rbx, r15
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400facc1
mov dword [rsp + 0x50], ebx
test rsi, rsi
je 0x1400facdb
mov rcx, rsi
call fcn.140247060
xor esi, esi
cmp r12d, 2
je 0x1400fadf1
movsx ecx, byte [r14]
call fcn.140250738
test eax, eax
je 0x1400fadf1
mov word [rbp + 0xfd0], si
movzx eax, byte [r14]
mov byte [rbp + 0xfd0], al
lea rax, vtable.CSABString.0
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xfd0]
mov rsi, r15
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400fad20
mov dword [rbp - 0x80], esi
lea eax, [rsi + 1]
mov r15d, eax
mov ecx, eax
call fcn.140247068
mov r14, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400fad58
mov r8d, r15d
lea rdx, [rbp + 0xfd0]
mov rcx, rax
call fcn.1402496a0
mov dword [rbp - 0x7c], 1
test rdi, rdi
je 0x1400fada1
lea ecx, [rsi + 1]
add ecx, ebx
call fcn.140247068
mov rsi, rax
mov rdx, rdi
mov r8, rax
sub r8, rdi
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400fad80
mov rcx, rdi
call fcn.140247060
mov rdi, rsi
mov qword [rsp + 0x48], rsi
jmp 0x1400fadb3
lea ecx, [rbx + 1]
add ecx, esi
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x1400faddd
mov ecx, ebx
add rcx, rdi
mov r8, r15
mov rdx, r14
call fcn.1402496a0
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x1400fadd0
mov dword [rsp + 0x50], ebx
test r14, r14
je 0x1400fadea
mov rcx, r14
call fcn.140247060
mov r15, 0xffffffffffffffff
inc r13d
mov ecx, r13d
lea rdx, [rbp + 0x150]
mov rax, r15
inc rax
cmp byte [rdx + rax], 0
jne 0x1400fae01
cmp rcx, rax
mov esi, 0
jb 0x1400fac00
mov rdx, rdi
lea rcx, [0x14037d0a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
nop
test rdi, rdi
je 0x1400fae49
mov rcx, rdi
call fcn.140247060
jmp 0x1400fae49
movabs rax, 0x64696c61766e49
mov qword [0x14037d0a0], rax
mov eax, dword [0x14035086c]
cmp dword [0x140350790], 0
cmove eax, esi
mov dword [0x14035086c], eax
call fcn.1400fb560
cmp dword [0x1403508e4], 0
jne 0x1400faf66
cmp qword [0x14037add0], 0
jne 0x1400faf66
cmp byte [0x140350c04], 0
je 0x1400faf66
mov ecx, 0x40
call fcn.14018ef40
mov rbx, rax
mov qword [rbp + 0xfd0], rax
test rax, rax
je 0x1400faec9
lea rax, vtable.CSABCriticalSectionContainer.0
mov qword [rbx + 0x10], rax
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbx], esi
mov rcx, 0xffffffffffffffff
mov qword [rbx + 8], rcx
jmp 0x1400faecc
mov rbx, rsi
mov qword [0x14037add0], rbx
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rbx], 0
jne 0x1400faf5b
lea r8, [0x14034ec34]
mov edx, 0x410
lea rcx, [rbp + 0x360]
call fcn.140253604
lea rdx, str.event.log
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1400faf5b
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx], 1
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x50]
call fcn.140249b10
lea r8, str.ncsLIBLoadConfigurationData
lea rdx, str._s___Leavex
lea rcx, [rbp + 0x50]
call fcn.140006bc0
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0x50]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
nop
add rsp, 0x1088
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret