Function at 0x10005a614
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor eax, eax
mov rbx, rcx
mov r12, r8
mov qword [rsp + 0x148], r8
mov rsi, rdx
mov qword [r11 - 0x3f0], rdx
lea ecx, [rax + 1]
mov qword [r11 - 0x3e8], rax
mov qword [r11 - 0x358], rax
mov qword [r11 - 0x360], rax
cmp dword [0x10011bd04], eax
jne 0x10005a680
mov edi, eax
cmp r8, rax
jne 0x10005a682
mov edi, ecx
mov qword [rsp + 0x108], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x94], eax
mov r13, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x8c], eax
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
mov dword [rsp + 0x98], eax
mov r14, rax
mov qword [rsp + 0x78], rax
mov r15, rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x90], eax
mov rbp, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + reloc.certcli.dll_Ordinal_256], rax
mov eax, dword [0x10011bd14]
lea rcx, [rsp + 0x150]
xor edx, edx
mov r8d, Ordinal_147
mov dword [rsp + 0x118], eax
call sub.msvcrt.dll_memset
and dword [rsp + 0x88], ebp
xor edx, edx
lea r8d, [rdx + 0x38]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll_memset
or qword [rsp + 0xc8], 0xffffffffffffffff
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call fcn.100057248
mov ebx, eax
test eax, eax
je 0x10005a780
mov r9d, 1
mov edx, 0xe14013e
mov r8d, eax
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10005ad8d
lea rax, [rsp + 0xa8]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x240]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], reloc.certcli.dll_Ordinal_260
mov qword [rsp + 0x20], rax
call fcn.1000397bc
mov ebx, eax
test eax, eax
je 0x10005a7c1
xor r9d, r9d
mov edx, 0xe1e013e
jmp 0x10005a771
mov rcx, qword [rsp + 0xb0]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xc8]
call fcn.1000c8b48
mov ebx, eax
test eax, eax
je 0x10005a7eb
xor r9d, r9d
mov edx, 0xe21013e
jmp 0x10005a771
mov esi, 1
lea r8, [0x100016300]
lea rcx, [rsp + 0x108]
xor edx, edx
mov r9d, esi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10005a831
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
xor r9d, r9d
mov edx, 0xe2b013e
mov ebx, eax
jmp 0x10005a771
lea r8, [0x100016408]
lea rdx, [0x100016420]
lea rcx, [rsp + 0xc8]
mov r9d, edi
call fcn.100058054
mov ebx, eax
test eax, eax
je 0x10005a862
xor r9d, r9d
mov edx, 0xe36013e
jmp 0x10005a771
lea rax, [rsp + 0x80]
mov r9d, esi
lea r8, [0x100016440]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
lea rsi, [0x100016458]
lea rcx, [rsp + 0xc8]
mov rdx, rsi
call fcn.100057eac
mov ebx, eax
test eax, eax
je 0x10005a8af
xor r9d, r9d
mov edx, 0xe44013e
jmp 0x10005a771
lea rax, [rsp + 0x50]
lea r8, [0x100016478]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], ebp
mov eax, 1
mov r9d, eax
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.100057eac
mov ebx, eax
test eax, eax
je 0x10005a8f7
xor r9d, r9d
mov edx, 0xe4f013e
jmp 0x10005a771
mov ebp, dword [rsp + 0x50]
mov dword [rsp + 0x84], r13d
mov edx, 0xe0000102
mov eax, ebp
sub eax, 2
je 0x10005aa46
mov ecx, 1
cmp eax, ecx
je 0x10005a960
mov ecx, 0x98b
call fcn.1000ba420
lea r9, [0x100016478]
lea r8, [0x100016478]
lea rcx, [0x100016500]
mov rdx, rax
call fcn.1000b99b0
mov r8d, 0x8007000d
xor r9d, r9d
mov edx, 0xe8b013e
xor ecx, ecx
mov ebx, r8d
call fcn.1000b51b8
jmp 0x10005ad83
cmp dword [rsp + 0x80], 0x80
mov r15d, Ordinal_36
je 0x10005a9b0
mov ecx, 0x98b
call fcn.1000ba420
lea r8, [0x100016440]
lea rcx, [0x1000164c8]
mov rdx, rax
call fcn.1000b99b0
mov edx, 0xe72013e
mov r8d, 0x8007000d
mov ebx, r8d
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10005ad7e
lea rax, [rsp + 0x50]
mov r9d, ecx
lea r8, [0x1000164e8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0xc8]
mov rdx, rsi
call fcn.100057eac
test eax, eax
je 0x10005aa3e
mov r9d, eax
mov r8d, eax
mov edx, 0xe7d013e
xor ecx, ecx
call fcn.1000b51b8
lea rax, [rsp + 0x50]
lea r8, [0x100016558]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x138]
mov r9d, edi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.100058378
mov ebx, eax
test eax, eax
je 0x10005aaf1
mov r8d, eax
mov edx, 0xeac013e
jmp 0x10005a9a1
mov r15d, Ordinal_65
jmp 0x10005a9f6
cmp dword [rsp + 0x80], 0x28
mov r15d, reloc.WLDAP32.dll_Ordinal_16
jne 0x10005aa66
lea eax, [r15 - 0xf]
mov r13d, eax
mov dword [rsp + 0x84], eax
jmp 0x10005aa74
cmp dword [rsp + 0x80], 0x40
jne 0x10005be89
lea rax, [rsp + 0x80]
lea r8, [0x100016528]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], r14d
mov eax, 1
mov r9d, eax
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.100057eac
mov ebx, eax
test eax, eax
je 0x10005aac0
mov r8d, eax
mov edx, 0xe99013e
jmp 0x10005a9a1
cmp dword [rsp + 0x80], 3
je 0x10005a9f6
mov ecx, 0x98b
call fcn.1000ba420
lea rcx, [0x100016538]
mov rdx, rax
call fcn.1000b99b0
mov edx, 0xea1013e
jmp 0x10005a998
lea rax, [rsp + 0x140]
lea r8, [0x100016568]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], r14d
mov r9d, edi
mov rdx, rsi
call fcn.100057f84
mov ebx, eax
test eax, eax
je 0x10005ab30
mov r8d, eax
mov edx, 0xeb5013e
jmp 0x10005a9a1
lea rax, [rsp + 0x80]
lea r8, [0x100016580]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], r14d
mov eax, 1
mov r9d, eax
mov rdx, rsi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.100057eac
test eax, eax
je 0x10005ab7f
xor r9d, r9d
mov r8d, eax
mov edx, 0xec0013e
xor ecx, ecx
call fcn.1000b51b8
mov r9, qword [rsp + 0x140]
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x108]
lea rax, [rsp + 0x150]
mov ecx, r15d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], r14d
call fcn.100056400
mov ebx, eax
test eax, eax
je 0x10005abc4
mov r8d, eax
mov edx, 0xed0013e
jmp 0x10005a9a1
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0x150]
call fcn.100056ce0
mov ebx, eax
test eax, eax
je 0x10005ac0d
xor r9d, r9d
mov r8d, eax
mov edx, 0xed7013e
xor ecx, ecx
call fcn.1000b51b8
cmp dword [0x10011bd00], 2
jl 0x10005ad7e
cmp r15d, 0x40
jne 0x10005ad7e
mov ecx, 1
cmp dword [0x10011bd04], r14d
jne 0x10005ac2c
mov eax, dword [0x10011bd14]
test edi, edi
cmove eax, ecx
mov dword [0x10011bd14], eax
cmp dword [0x10011be54], r14d
jne 0x10005ac61
mov eax, 0x8404
lea rdx, [rsp + 0x80]
lea rcx, [0x10011acf0]
mov word [rsp + 0x80], ax
call fcn.10003e374
mov ecx, 1
mov dword [0x10011be54], ecx
lea r14, [0x100016708]
cmp ebp, 2
je 0x10005ac77
cmp r15d, 0x40
jne 0x10005b831
lea rax, [rsp + 0x50]
lea rbx, [0x100016598]
lea r9, [rsp + 0x150]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb8]
lea rdx, [0x1000165b0]
mov qword [rsp + 0x28], rax
mov eax, 0xe0000102
lea rcx, [rsp + 0xc8]
mov r8, rbx
mov dword [rsp + 0x20], eax
call fcn.100057bd0
test eax, eax
je 0x10005ace7
lea rdx, [0x1000165e0]
cmp r15d, 0x40
lea rcx, [0x100016630]
cmove rcx, rdx
xor r9d, r9d
mov edx, 0xefd013e
mov r8d, eax
call fcn.1000b51b8
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005ad16
lea rcx, [0x10000cc00]
call fcn.1000b99b0
lea rdx, [0x1000165b0]
lea rcx, [0x100016398]
call fcn.1000b99b0
lea rcx, [0x100010718]
mov rdx, rbx
call fcn.1000b99b0
mov rbx, qword [rsp + 0xb8]
mov esi, dword [rsp + 0x50]
test rbx, rbx
je 0x10005afbc
mov edx, esi
mov rcx, rbx
call fcn.1000584cc
and dword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov r9d, esi
mov r8, rbx
xor edx, edx
xor ecx, ecx
call fcn.10004df1c
mov ebx, eax
test eax, eax
je 0x10005afa8
mov edx, 0xf0b013e
mov r8d, eax
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
xor eax, eax
lea rdi, [rsp + 0x240]
mov ecx, 0x208
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x10005adb9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x10005adcc
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x10005ade8
mov ecx, dword [rsp + 0x8c]
xor eax, eax
mov rdi, r13
rep stosb byte [rdi], al
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x10005ae0c
mov ecx, dword [rsp + 0x94]
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x110]
test rax, rax
je 0x10005ae22
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x10005ae30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x10005ae43
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x10005ae59
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x120]
test rcx, rcx
je 0x10005ae6c
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x128]
test rdx, rdx
je 0x10005ae90
mov ecx, dword [rsp + 0x98]
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x10005ae9e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15, r15
je 0x10005aeba
mov ecx, dword [rsp + 0x90]
xor eax, eax
mov rdi, r15
rep stosb byte [rdi], al
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x10005aec8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + reloc.certcli.dll_Ordinal_256]
test rax, rax
je 0x10005aede
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x10005aef1
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x10005af04
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea rcx, [rsp + 0x160]
call fcn.1000f0160
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x10005af26
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp qword [rsp + 0xc8], 0xffffffffffffffff
je 0x10005af3e
lea rcx, [rsp + 0xc8]
call fcn.1000c8dd0
cmp qword [rsp + 0xb0], 0
je 0x10005af6e
cmp dword [0x10011bd20], 0
jne 0x10005af60
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x118]
mov dword [0x10011bd14], eax
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1000ef870
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov rbx, qword [rsp + 0xb8]
xor eax, eax
mov ecx, 0xe0000102
test rbx, rbx
cmove eax, ecx
lea rcx, [rsp + 0x94]
lea r9, [rsp + 0x150]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xc0]
lea r8, [0x100016678]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0xc8]
lea rdx, [0x1000165b0]
mov dword [rsp + 0x20], eax
call fcn.100057bd0
test eax, eax
je 0x10005b034
lea r9, [0x100016680]
cmp r15d, 0x40
lea rcx, [0x1000166b8]
cmove rcx, r9
mov r8d, eax
mov edx, 0xf1e013e
xor r9d, r9d
call fcn.1000b51b8
test edi, edi
je 0x10005b052
lea r8, [0x100016678]
lea rdx, [0x1000165b0]
lea rcx, [0x1000166f0]
call fcn.1000b99b0
test rbx, rbx
je 0x10005b0bf
cmp qword [rsp + 0xc0], 0
je 0x10005b0bf
mov ecx, 0x98f
call fcn.1000ba420
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], 0x2400
test rax, rax
mov r8, r14
mov r9, rbx
cmovne r8, rax
mov eax, dword [rsp + 0x94]
mov edx, edi
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xc0]
mov rcx, r12
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call fcn.100058c04
mov ebx, eax
test eax, eax
je 0x10005b0bf
mov edx, 0xf35013e
jmp 0x10005ad6c
lea rax, [rsp + 0x50]
mov esi, 1
lea r8, [0x100016718]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], 0
lea rdx, [0x100016730]
lea rcx, [rsp + 0xc8]
mov r9d, esi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.100057eac
mov ebx, eax
test eax, eax
je 0x10005b109
mov edx, 0xf44013e
jmp 0x10005ad6c
mov r14d, dword [rsp + 0x50]
cmp ebp, 2
lea r12, [0x1000167b0]
lea rax, [0x100016778]
lea rbp, [0x100016750]
cmove r12, rax
test r13d, r13d
cmovne r12, rbp
test r14d, r14d
je 0x10005b417
cmp dword [rsp + 0x84], 0
lea r13, [rsp + 0x1e0]
lea rax, [0x100016598]
cmovne r13, rax
mov ebp, esi
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x10005b176
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0xa0], 0
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x10005b18f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0x58], 0
lea r8, [0x1000167d8]
lea rcx, [rsp + 0x1e0]
mov r9d, ebp
mov edx, Ordinal_41
call fcn.10003e304
lea r11, [rsp + 0x50]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r9, [rsp + 0x150]
lea rcx, [rsp + 0xc8]
mov r8, r13
mov rdx, r12
call fcn.100057bd0
mov ebx, eax
test eax, eax
jne 0x10005b4a3
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005b208
lea rcx, [0x10000cc00]
call fcn.1000b99b0
lea rcx, [0x1000166f0]
mov r8, r13
mov rdx, r12
call fcn.1000b99b0
mov esi, dword [rsp + 0x50]
mov rbx, qword [rsp + 0xa0]
mov edx, esi
mov rcx, rbx
call fcn.1000584cc
and dword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov r9d, esi
mov r8, rbx
xor edx, edx
xor ecx, ecx
call fcn.10004df1c
mov ebx, eax
test eax, eax
jne 0x10005b499
lea r8, [0x1000167e8]
lea edx, [rax + 0x24]
lea rcx, [rsp + 0x210]
mov r9d, ebp
call fcn.10003e304
lea r11, [rsp + 0x8c]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x210]
lea rdx, [0x100016730]
lea rcx, [rsp + 0xc8]
call fcn.100057bd0
mov ebx, eax
test eax, eax
jne 0x10005b48f
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005b2e1
lea r8, [rsp + 0x210]
lea rdx, [0x100016730]
lea rcx, [0x1000166f0]
call fcn.1000b99b0
cmp dword [0x10011bd04], 0
mov rbx, qword [rsp + 0x58]
je 0x10005b30b
mov ecx, dword [0x10011bd44]
mov r8d, dword [rsp + 0x8c]
mov rdx, rbx
or ecx, 0x1804
call fcn.1000afa70
mov ecx, 0x990
call fcn.1000ba420
mov r9, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x148]
test rax, rax
lea r8, [0x1000167f8]
mov edx, edi
cmovne r8, rax
mov eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x38], 0xa400
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
call fcn.100058c04
mov ebx, eax
test eax, eax
jne 0x10005b485
lea r8, [0x1000167d8]
lea edx, [rax + 0x26]
lea rcx, [rsp + 0x1e0]
mov r9d, ebp
call fcn.10003e304
and dword [rsp + 0x30], ebx
lea esi, [rbx + 1]
lea r8, [rsp + 0x1e0]
lea rdx, [0x1000167b0]
lea rcx, [rsp + 0xc8]
mov r9d, esi
mov dword [rsp + 0x28], edi
and dword [rsp + 0x20], ebx
call fcn.1000581cc
mov ebx, eax
test eax, eax
jne 0x10005b47b
lea rax, [rsp + 0x80]
lea r9d, [rsi + 1]
lea r8, [rsp + 0x1e0]
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], ebx
lea rdx, [0x1000167b0]
lea rcx, [rsp + 0xc8]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.100057eac
mov ebx, eax
test eax, eax
jne 0x10005b471
add ebp, esi
lea eax, [rbp - 1]
cmp eax, r14d
jb 0x10005b157
mov r13d, dword [rsp + 0x84]
lea rbp, [0x100016750]
lea r14, [0x100016598]
test r13d, r13d
jne 0x10005b520
lea rax, [rsp + 0x84]
lea r9, [rsp + 0x150]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x110]
mov r8, r14
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], r13d
mov rdx, rbp
call fcn.100057bd0
mov ebx, eax
test eax, eax
je 0x10005b4ad
mov edx, 0xfc4013e
jmp 0x10005ad6c
mov edx, 0xfb4013e
jmp 0x10005ad6c
mov edx, 0xfa9013e
jmp 0x10005ad6c
mov edx, 0xf9a013e
jmp 0x10005ad6c
mov edx, 0xf85013e
jmp 0x10005ad6c
mov edx, 0xf7a013e
jmp 0x10005ad6c
mov edx, 0xf69013e
jmp 0x10005ad6c
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005b4c9
lea rcx, [0x10000cc00]
call fcn.1000b99b0
lea rcx, [0x1000166f0]
mov r8, r14
mov rdx, rbp
call fcn.1000b99b0
mov rbx, qword [rsp + 0x110]
mov edx, dword [rsp + 0x84]
mov rcx, rbx
call fcn.1000584cc
mov r9d, dword [rsp + 0x84]
and dword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call fcn.10004df1c
mov ebx, eax
test eax, eax
je 0x10005b520
mov edx, 0xfd2013e
jmp 0x10005ad6c
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x150]
lea rdx, [0x10000f06c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r8, r14
call fcn.100057bd0
mov ebx, eax
test eax, eax
je 0x10005b568
mov edx, 0xfe0013e
jmp 0x10005ad6c
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005b584
lea rcx, [0x10000cc00]
call fcn.1000b99b0
lea rdx, [0x10000f06c]
lea rcx, [0x1000166f0]
mov r8, r14
call fcn.1000b99b0
mov esi, dword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov edx, esi
mov rcx, r12
call fcn.1000584cc
and dword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov r9d, esi
mov r8, r12
xor edx, edx
xor ecx, ecx
call fcn.10004df1c
mov ebx, eax
test eax, eax
je 0x10005b5d9
mov r8d, eax
mov edx, 0xfee013e
jmp 0x10005b7e9
mov edx, esi
mov rcx, r12
call fcn.100058db0
test eax, eax
je 0x10005b5f9
xor r9d, r9d
mov r8d, eax
mov edx, 0xff1013e
xor ecx, ecx
call fcn.1000b51b8
test r13d, r13d
je 0x10005b6e4
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x150]
lea rdx, [0x100016810]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x130]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r8, r14
call fcn.100057bd0
mov ebx, eax
test eax, eax
je 0x10005b650
mov r8d, eax
mov edx, 0x1000013e
jmp 0x10005b7e9
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005b66c
lea rcx, [0x10000cc00]
call fcn.1000b99b0
lea rdx, [0x100016810]
lea rcx, [0x1000166f0]
mov r8, r14
call fcn.1000b99b0
mov esi, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x130]
mov edx, esi
mov rcx, rbp
call fcn.1000584cc
and dword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov r9d, esi
mov r8, rbp
xor edx, edx
xor ecx, ecx
call fcn.10004df1c
mov ebx, eax
test eax, eax
je 0x10005b6c4
mov r8d, eax
mov edx, 0x100e013e
jmp 0x10005b7e9
mov edx, esi
mov rcx, rbp
call fcn.100058db0
test eax, eax
je 0x10005b6e4
xor r9d, r9d
mov r8d, eax
mov edx, 0x1011013e
xor ecx, ecx
call fcn.1000b51b8
lea rax, [rsp + reloc.certcli.dll_Ordinal_256]
lea r14, [0x100016840]
lea r9, [rsp + 0x150]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x100016820]
lea rcx, [rsp + 0xc8]
mov rdx, r14
call fcn.1000582c8
mov ebx, eax
test eax, eax
je 0x10005b72f
mov r8d, eax
mov edx, 0x101e013e
jmp 0x10005b7e9
mov r9, qword [rsp + reloc.certcli.dll_Ordinal_256]
lea r8, [0x100016820]
lea rcx, [0x100016260]
mov rdx, r14
call fcn.1000b99b0
and qword [rsp + 0xa8], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0x150]
mov qword [rsp + 0x28], rax
lea r8, [0x100016868]
lea rcx, [rsp + 0xc8]
xor ebp, ebp
mov rdx, r14
and dword [rsp + 0x20], ebp
call fcn.100057bd0
mov rsi, qword [rsp + 0xa8]
mov ebx, eax
test eax, eax
je 0x10005b7aa
mov r8d, eax
mov edx, 0x73b013e
jmp 0x10005b7bf
cmp dword [rsp + 0x50], 4
je 0x10005b7cb
mov r8d, 0x8007000d
mov edx, 0x740013e
mov ebx, r8d
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10005b7cf
mov ebp, dword [rsi]
xor ebx, ebx
test rsi, rsi
je 0x10005b7dd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x10005b80c
mov r8d, ebx
mov edx, 0x102d013e
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x58]
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
jmp 0x10005ad92
lea r8, [0x100016868]
lea rcx, [0x100016880]
mov r9d, ebp
mov rdx, r14
call fcn.1000b99b0
lea r14, [0x100016708]
mov ecx, 1
test r13d, r13d
je 0x10005b87a
test edi, edi
je 0x10005b85d
lea rcx, [rsp + 0xc8]
call fcn.10005a440
test eax, eax
je 0x10005b85d
xor r9d, r9d
mov r8d, eax
mov edx, 0x103a013e
xor ecx, ecx
call fcn.1000b51b8
mov rbp, qword [rsp + 0x68]
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov r14, qword [rsp + 0x78]
xor ebx, ebx
jmp 0x10005be56
lea rax, [rsp + 0x50]
mov r9d, ecx
mov ebx, 0xe0000102
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ecx
lea r8, [0x100016718]
lea rdx, [0x1000168a8]
lea rcx, [rsp + 0xc8]
call fcn.100057eac
test eax, eax
je 0x10005b8eb
lea rdx, [0x1000168b8]
xor r12d, r12d
cmp r15d, 0x40
lea rcx, [0x1000168e0]
mov r8d, eax
mov ebp, ebx
cmove rcx, rdx
xor r9d, r9d
mov edx, 0x1055013e
mov dword [rsp + 0x88], ebx
call fcn.1000b51b8
jmp 0x10005b8f7
mov r12d, dword [rsp + 0x50]
mov ebp, dword [rsp + 0x88]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x150]
lea r8, [0x100016908]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x120]
lea rdx, [0x1000168a8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xc8]
mov dword [rsp + 0x20], ebx
call fcn.100057bd0
test eax, eax
je 0x10005b95f
lea rdx, [0x100016930]
cmp r15d, 0x40
lea rcx, [0x100016970]
cmove rcx, rdx
xor r9d, r9d
mov edx, 0x1065013e
mov r8d, eax
call fcn.1000b51b8
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005b98e
lea rcx, [0x10000cc00]
call fcn.1000b99b0
lea rdx, [0x1000168a8]
lea rcx, [0x100016398]
call fcn.1000b99b0
lea rdx, [0x100016908]
lea rcx, [0x100010718]
call fcn.1000b99b0
mov r13, qword [rsp + 0x120]
test r13, r13
je 0x10005baed
mov esi, dword [rsp + 0x50]
mov rcx, r13
mov edx, esi
call fcn.1000584cc
and dword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov r9d, esi
mov r8, r13
xor edx, edx
xor ecx, ecx
call fcn.10004df1c
mov ebx, eax
test eax, eax
je 0x10005b9e9
mov edx, 0x1073013e
jmp 0x10005ad6c
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x150]
lea r8, [0x1000169b0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x128]
lea rdx, [0x1000168a8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xc8]
mov dword [rsp + 0x20], ebp
call fcn.100057bd0
mov ebx, eax
test eax, eax
je 0x10005ba3a
mov edx, 0x107d013e
jmp 0x10005ad6c
test edi, edi
je 0x10005ba58
lea r8, [0x1000169b0]
lea rdx, [0x1000168a8]
lea rcx, [0x1000166f0]
call fcn.1000b99b0
mov ecx, 0x98f
call fcn.1000ba420
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0x2400
test rax, rax
mov r9, r13
mov r13, qword [rsp + 0x148]
cmovne r14, rax
mov eax, 1
mov edx, edi
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x98]
mov r8, r14
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x128]
mov rcx, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call fcn.100058818
mov ebx, eax
test eax, eax
je 0x10005baf5
lea rax, [0x1000169c8]
lea rcx, [0x1000169f8]
cmp r15d, 0x40
cmove rcx, rax
mov r8d, ebx
mov edx, 0x1096013e
xor r9d, r9d
call fcn.1000b51b8
test r13, r13
jne 0x10005ad79
jmp 0x10005baf5
mov r13, qword [rsp + 0x148]
test edi, edi
je 0x10005bb13
lea r8, [0x100016730]
lea rdx, [0x1000168a8]
lea rcx, [0x1000166f0]
call fcn.1000b99b0
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x150]
lea r8, [0x100016730]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
lea rdx, [0x1000168a8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0xc8]
mov dword [rsp + 0x20], ebp
call fcn.100057bd0
mov ebx, eax
test r12d, r12d
je 0x10005bb66
test eax, eax
je 0x10005bb66
mov edx, 0x10ac013e
jmp 0x10005ad6c
xor esi, esi
test r12d, r12d
je 0x10005bd02
inc esi
lea r8, [0x100016a28]
lea rcx, [rsp + 0x1e0]
mov r9d, esi
mov edx, 0x2a
call fcn.10003e304
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
lea rbp, [0x100016778]
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x1e0]
lea rcx, [rsp + 0xc8]
mov rdx, rbp
call fcn.100057bd0
mov ebx, eax
test eax, eax
jne 0x10005bcf8
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005bbf4
lea rcx, [0x10000cc00]
call fcn.1000b99b0
lea r8, [rsp + 0x1e0]
lea rcx, [0x1000166f0]
mov rdx, rbp
call fcn.1000b99b0
mov ebp, dword [rsp + 0x50]
mov r14, qword [rsp + 0x78]
mov edx, ebp
mov rcx, r14
call fcn.1000584cc
and dword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov r9d, ebp
mov r8, r14
xor edx, edx
xor ecx, ecx
call fcn.10004df1c
mov ebx, eax
test eax, eax
jne 0x10005bceb
mov ecx, 0x990
call fcn.1000ba420
lea r8, [0x1000167f8]
mov r9, r14
test rax, rax
mov edx, edi
mov rcx, r13
cmovne r8, rax
lea eax, [rbx + 1]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x40], 0xa400
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
call fcn.100058818
mov ebx, eax
test eax, eax
je 0x10005bcc8
lea rax, [0x100016a40]
lea rcx, [0x100016a70]
cmp r15d, 0x40
cmove rcx, rax
mov r8d, ebx
mov edx, 0x10e2013e
xor r9d, r9d
call fcn.1000b51b8
test r13, r13
jne 0x10005ad7e
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebp, dword [rsp + 0x88]
xor r14d, r14d
mov qword [rsp + 0x78], r14
cmp esi, r12d
jb 0x10005bb71
jmp 0x10005bd07
mov r8d, eax
mov edx, 0x10cd013e
jmp 0x10005a9a1
mov edx, 0x10bf013e
jmp 0x10005ad6c
mov r14, qword [rsp + 0x78]
lea rax, [0x100016aa0]
mov dword [rsp + 0x30], ebp
lea rbx, [0x100016ae0]
cmp r15d, 0x40
lea rsi, [0x1000168a8]
lea r8, [0x100016b20]
cmove rbx, rax
lea rax, [rsp + 0x150]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov rdx, rsi
mov dword [rsp + 0x20], edi
call fcn.100059e58
test eax, eax
je 0x10005bd6a
xor r9d, r9d
mov r8d, eax
mov edx, 0x10fd013e
mov rcx, rbx
call fcn.1000b51b8
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x150]
lea r8, [0x100016b50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov dword [rsp + 0x20], ebp
call fcn.100057bd0
test eax, eax
je 0x10005bdcb
lea rdx, [0x100016b80]
cmp r15d, 0x40
lea rcx, [0x100016bd0]
cmove rcx, rdx
xor r9d, r9d
mov edx, 0x110d013e
mov r8d, eax
call fcn.1000b51b8
lea rcx, [0x10000c564]
call fcn.1000b99b0
test edi, edi
je 0x10005bdf6
lea rcx, [0x10000cc00]
call fcn.1000b99b0
lea rcx, [0x100016398]
mov rdx, rsi
call fcn.1000b99b0
lea rdx, [0x100016b50]
lea rcx, [0x100010718]
call fcn.1000b99b0
mov rbp, qword [rsp + 0x68]
test rbp, rbp
je 0x10005b862
mov edi, dword [rsp + 0x50]
mov rcx, rbp
mov edx, edi
call fcn.1000584cc
and dword [rsp + 0x28], 0
or dword [rsp + 0x20], 0xffffffff
mov r9d, edi
mov r8, rbp
xor edx, edx
xor ecx, ecx
call fcn.10004df1c
mov ebx, eax
test eax, eax
je 0x10005be60
xor r9d, r9d
mov r8d, eax
mov edx, 0x111b013e
xor ecx, ecx
call fcn.1000b51b8
mov r15, qword [rsp + 0x70]
jmp 0x10005ad88
mov edx, edi
mov rcx, rbp
call fcn.100058db0
test eax, eax
je 0x10005b862
xor r9d, r9d
mov r8d, eax
mov edx, 0x111e013e
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10005b862
mov ecx, 0x98b
call fcn.1000ba420
lea r9, [0x100016440]
lea r8, [0x100016440]
lea rcx, [0x100016498]
mov rdx, rax
call fcn.1000b99b0
mov edx, 0xe65013e
jmp 0x10005a998