Function at 0x14000e110
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov qword [rbp - 0x18], rdx
xor r15d, r15d
mov dword [rbp - 8], r15d
xor eax, eax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x38], r15
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
mov dword [rbp - 8], Ordinal_30
mov qword [rbp], r15
mov dword [rbp + 8], 1
xor r9d, r9d
lea r8, [rbp - 8]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000e1be
lea rdx, [rdi - 0x18]
or r12, 0xffffffffffffffff
jmp 0x14000f180
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp + 0x78]
call sub.MSVCR100.dll_memset
mov qword [rbp + 0x48], r15
xor eax, eax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x70], 0x68
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov r11, qword [rbp - 0x38]
mov qword [rbp + 0xc8], r11
mov word [rbp + 0xb0], r15w
mov dword [rbp + 0xac], 0x101
lea rax, [rbp + 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str._qe_Application__rd:true__f:xml__q:_System_EventID1001__
lea rcx, str.c:windows_system32wevtutil.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000e25d
lea rdx, [rdi - 0x18]
or r12, 0xffffffffffffffff
jmp 0x14000f180
mov dword [rbp - 0x6c], r15d
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000e270
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x110], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rbp + 0x111]
call sub.MSVCR100.dll_memset
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x6c]
mov r8d, 0x7f
lea rdx, [rbp + 0x110]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
or r12, 0xffffffffffffffff
test eax, eax
je 0x14000e48e
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x14000e2c9
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
test rax, rax
jne 0x14000e2da
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
je 0x14000e483
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x58], rbx
lea rcx, [rbp + 0x110]
lea rax, [rbp + 0x110]
test rax, 0xffffffffffff0000
jne 0x14000e334
movzx esi, cx
xor edx, edx
mov ecx, esi
call fcn.1400017e0
test rax, rax
je 0x14000e348
mov r8d, esi
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140001f70
jmp 0x14000e344
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x58]
call fcn.14000d9a0
mov rbx, qword [rbp - 0x58]
movsxd rcx, dword [rbx - 0x10]
mov qword [rbp + 0x10], rbx
mov r13, rbx
sub r13, rdi
sar r13, 1
mov r14d, dword [rdi - 0x10]
mov eax, r15d
test ecx, ecx
setns al
test eax, eax
je 0x14000e478
mov rdx, rcx
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
mov r15, rax
mov ecx, 0x7fffffff
sub ecx, eax
xor edx, edx
cmp ecx, r14d
setge dl
test edx, edx
je 0x14000e46d
lea esi, [r14 + rax]
test esi, esi
js 0x14000e462
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x14000e3c1
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.140001c20
mov rdi, qword [rsp + 0x60]
cmp r13, r14
lea r8, [rdi + r13*2]
jbe 0x14000e3ce
mov r8, qword [rbp + 0x10]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rdi + r14*2]
mov r9, rdx
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp esi, dword [rdi - 0xc]
jg 0x14000e457
mov dword [rdi - 0x10], esi
movsxd rax, esi
xor r15d, r15d
mov word [rdi + rax*2], r15w
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e40f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov byte [rbp + 0x110], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rbp + 0x111]
call sub.MSVCR100.dll_memset
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x6c]
mov r8d, 0x7f
lea rdx, [rbp + 0x110]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdi, qword [rsp + 0x60]
test eax, eax
jne 0x14000e2b5
jmp 0x14000e48e
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
int3
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000e49d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rdi - 0x10], 0
jne 0x14000e4ac
lea rdx, [rdi - 0x18]
jmp 0x14000f180
lea r8, [rsp + 0x60]
lea rdx, str._rootNode_
lea rcx, [rbp + 0x40]
call fcn.140004230
nop
lea r8, str.__rootNode_
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140002ce0
nop
mov r14, qword [rax]
lea rcx, [r14 - 0x18]
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x14000e623
cmp dword [rbx + 0x10], 0
jl 0x14000e523
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000e523
call fcn.140001b90
mov rdi, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000e51a
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
jmp 0x14000e61e
movsxd rsi, dword [r14 - 0x10]
test esi, esi
jne 0x14000e588
mov rsi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x14000e623
cmp dword [rbx + 0x10], 0
jge 0x14000e55c
cmp dword [rdi - 0xc], 0
jge 0x14000e54f
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rdi - 0x10], r15d
mov word [rdi], r15w
jmp 0x14000e623
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e576
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
jmp 0x14000e61e
test r14, r14
jne 0x14000e598
mov ecx, 0x80070057
call fcn.140001000
int3
mov r15d, dword [rdi - 0x10]
mov r13, r14
sub r13, rdi
sar r13, 1
test esi, esi
jns 0x14000e5b4
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, esi
or eax, ecx
jge 0x14000e5d6
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.140001c20
mov rdi, qword [rsp + 0x60]
lea rbx, [rsi + rsi]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, rbx
add rdx, rdx
cmp r13, r15
ja 0x14000e5f8
lea r8, [rdi + r13*2]
call qword [sym.imp.MSVCR100.dll_memmove_s]
jmp 0x14000e601
mov r8, r14
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp esi, dword [rdi - 0xc]
jg 0x14000e613
mov dword [rdi - 0x10], esi
xor r15d, r15d
mov word [rdi + rbx], r15w
jmp 0x14000e623
mov ecx, 0x80070057
call fcn.140001000
int3
mov qword [rsp + 0x60], rax
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e643
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e662
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x50], r15
mov qword [rbp + 0x18], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov dword [rbp - 0x40], r15d
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x80], rdi
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14000e6cb
test rbx, 0xffffffffffff0000
jne 0x14000e6cb
movzx esi, bx
xor edx, edx
mov ecx, esi
call fcn.1400017e0
test rax, rax
je 0x14000e6db
mov r8d, esi
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140003ad0
jmp 0x14000e6d7
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140004300
mov rdi, qword [rbp - 0x80]
mov eax, dword [rdi - 0x10]
add eax, 0xa
movsxd rdx, eax
mov ecx, reloc.ATL100.DLL_Ordinal_64
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
jne 0x14000e726
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e710
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000e721
mov rax, qword [rcx]
call qword [rax + Ordinal_17]
nop
jmp 0x14000f177
lea r8, [rsp + 0x68]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x14000e775
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e75f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000e770
mov rax, qword [rcx]
call qword [rax + Ordinal_17]
nop
jmp 0x14000f177
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x10], 0
test rbx, rbx
jne 0x14000e793
mov rbx, r15
mov qword [rbp - 0x20], rbx
jmp 0x14000e7b8
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x20], rax
test rax, rax
jne 0x14000e7b3
mov ecx, 0x8007000e
call fcn.140001000
int3
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rsi, qword [rbp - 0x28]
mov rdx, rsi
call qword [rax + 0x28]
mov r13, qword [rsp + 0x68]
test r13, r13
je 0x14000e82c
mov eax, 4
test rbx, rbx
je 0x14000e7eb
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
add eax, 6
add eax, 0xfffffffc
mov dword [rbp - 0x68], eax
mov rax, qword [r13]
lea r9, [rbp - 0x30]
mov r8d, 4
lea rdx, [rbp - 0x68]
mov rcx, r13
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
test eax, eax
js 0x14000e827
mov r8d, dword [rbp - 0x68]
test r8d, r8d
je 0x14000e827
mov rax, qword [r13]
lea r9, [rbp - 0x30]
mov rdx, rbx
mov rcx, r13
call qword [rax + reloc.ATL100.DLL_Ordinal_32]
mov r13, qword [rsp + 0x68]
mov rax, qword [r13]
lea r9, [rbp - 0x10]
mov r8d, 1
mov rdx, rsi
mov rcx, r13
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [rax + 0x28]
cmp dword [rdi - 8], 1
jle 0x14000e86d
mov edx, dword [rdi - 0x10]
lea rcx, [rbp - 0x80]
call fcn.1400038e0
mov rdi, qword [rbp - 0x80]
mov dword [rbp - 0x2c], r15d
mov word [rbp + 0xe0], r15w
xor eax, eax
mov qword [rbp + 0xe2], rax
mov qword [rbp + 0xea], rax
mov qword [rbp + 0xf2], rax
mov qword [rbp + 0xfa], rax
mov dword [rbp + 0x102], eax
mov word [rbp + 0x106], ax
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r9, [rbp - 0x2c]
mov r8d, 4
lea rdx, [rbp + 0xe0]
call qword [rax + 0x18]
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [0x1400de330]
call sub.XmlLite.dll_CreateXmlReader
test eax, eax
jns 0x14000e914
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e8fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000e90f
mov rax, qword [rcx]
call qword [rax + Ordinal_17]
nop
jmp 0x14000f177
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 4]
call qword [rax + 0x28]
test eax, eax
jns 0x14000e966
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e950
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000e961
mov rax, qword [rcx]
call qword [rax + Ordinal_17]
nop
jmp 0x14000f177
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x68]
call qword [rax + 0x18]
test eax, eax
jns 0x14000e9b6
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e9a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000e9b1
mov rax, qword [rcx]
call qword [rax + Ordinal_17]
nop
jmp 0x14000f177
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + Ordinal_17]
mov qword [rsp + 0x68], r15
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
lea r13, [0x1400de328]
mov rdi, r13
shr rdi, 0x10
test rdi, rdi
jne 0x14000ea1c
movzx esi, r13w
xor edx, edx
mov ecx, esi
call fcn.1400017e0
test rax, rax
je 0x14000ea73
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140001f70
mov rbx, qword [rsp + 0x70]
jmp 0x14000ea73
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14000ea73
cmp dword [rdx + 0x10], 0
jge 0x14000ea4a
cmp dword [rbx - 0xc], 0
jge 0x14000ea40
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r15d
mov word [rbx], r15w
jmp 0x14000ea73
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ea61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
test rdi, rdi
jne 0x14000eab6
movzx edi, r13w
xor edx, edx
mov ecx, edi
call fcn.1400017e0
test rax, rax
je 0x14000eb12
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140001f70
jmp 0x14000eb12
lea rdx, [rax - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14000eb12
cmp dword [rdx + 0x10], 0
jge 0x14000eae4
cmp dword [rax - 0xc], 0
jge 0x14000eada
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rax - 0x10], r15d
mov word [rax], r15w
jmp 0x14000eb12
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000eafb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov rbx, qword [rsp + 0x70]
xor r13b, r13b
xor r15b, r15b
xor r14b, r14b
xor sil, sil
xor ecx, ecx
call qword [sym.imp.MSVCR100.dll__time64]
mov qword [rbp + 0x38], rax
add rax, 0xffffffffffd87300
mov qword [rbp + 0x20], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.140010a70
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x38]
call fcn.140010a70
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x70]
call qword [rax + Ordinal_49]
test eax, eax
jne 0x14000f0b9
mov ecx, dword [rbp - 0x70]
dec ecx
je 0x14000ec5b
sub ecx, 2
je 0x14000ebe9
sub ecx, 0xa
je 0x14000ebe9
cmp ecx, 2
jne 0x14000eb80
test sil, sil
je 0x14000eb80
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x18]
call qword [rax + 0x78]
test eax, eax
js 0x14000eb80
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x78]
call qword [rax + 0x70]
test eax, eax
js 0x14000eb80
xor sil, sil
jmp 0x14000eb80
test sil, sil
je 0x14000eb80
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rbp - 0x78]
call qword [rax + 0x80]
test eax, eax
js 0x14000eb80
mov rdx, qword [rbp - 0x78]
xor eax, eax
test rdx, rdx
jne 0x14000ec1a
mov ecx, eax
jmp 0x14000ec29
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.140001e80
mov rdx, qword [rsp + 0x58]
cmp dword [rdx - 0x10], 0
je 0x14000eb80
lea rdx, [rsp + 0x58]
mov rcx, qword [rbp - 0x18]
call fcn.14000e040
xor sil, sil
jmp 0x14000eb80
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x78]
call qword [rax + 0x70]
test eax, eax
jns 0x14000ecce
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14000eb80
cmp dword [rdx + 0x10], 0
jge 0x14000eca0
cmp dword [rbx - 0xc], 0
jl 0x14000f082
xor eax, eax
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x14000eb80
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ecb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
jmp 0x14000eb80
mov rdx, qword [rsp + 0x78]
test rdx, rdx
jne 0x14000ecde
xor edi, edi
mov ecx, edi
jmp 0x14000ecf1
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
xor edi, edi
mov r8d, ecx
lea rcx, [rsp + 0x70]
call fcn.140001e80
lea rdx, str.Event
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14000ed20
xor r13b, r13b
xor r14b, r14b
xor sil, sil
lea rdx, str.Provider
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14000ed39
mov r13b, 1
jmp 0x14000ed42
test r13b, r13b
je 0x14000ee18
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_64]
test eax, eax
jne 0x14000ee18
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x78]
call qword [rax + 0x70]
test eax, eax
jne 0x14000ee18
mov rdx, qword [rsp + 0x78]
test rdx, rdx
jne 0x14000ed7e
mov ecx, edi
jmp 0x14000ed91
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
xor edi, edi
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.140001e80
lea rdx, [0x1400e0320]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14000ee18
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rbp - 0x78]
call qword [rax + 0x80]
test eax, eax
jne 0x14000ee18
mov rdx, qword [rbp - 0x78]
test rdx, rdx
jne 0x14000edda
mov ecx, edi
jmp 0x14000eded
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
xor edi, edi
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.140001e80
lea rdx, str.Windows_Error_Reporting
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14000ee18
mov r15b, 1
xor r13b, r13b
jmp 0x14000ee21
test r15b, r15b
je 0x14000f03d
lea rdx, str.TimeCreated
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14000f03d
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.ATL100.DLL_Ordinal_64]
test eax, eax
jne 0x14000f03d
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rsp + 0x78]
call qword [rax + 0x70]
test eax, eax
jne 0x14000f03d
mov rdx, qword [rsp + 0x78]
test rdx, rdx
jne 0x14000ee75
mov ecx, edi
jmp 0x14000ee88
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
xor edi, edi
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.140001e80
lea rdx, str.SystemTime
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14000f03d
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
xor r8d, r8d
lea rdx, [rbp - 0x78]
call qword [rax + 0x80]
test eax, eax
jne 0x14000f03d
mov rdx, qword [rbp - 0x78]
test rdx, rdx
jne 0x14000eed9
mov ecx, edi
jmp 0x14000eeea
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x58]
call fcn.140001e80
lea r8, [0x1400e02b8]
lea rdx, [0x1400e02b4]
lea rcx, [rsp + 0x58]
call fcn.140003ec0
mov r8d, Ordinal_20
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140001d30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x58]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000ef83
cmp dword [rdi + 0x10], 0
jl 0x14000ef74
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000ef74
call fcn.140001b90
mov rbx, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000ef69
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x14000ef83
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000efa2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor ebx, ebx
mov eax, ebx
mov rdx, qword [rbp - 0x60]
test rdx, rdx
setne al
test eax, eax
je 0x14000f0ae
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jle 0x14000efeb
mov eax, ebx
mov rdx, qword [rbp - 0x50]
test rdx, rdx
setne al
test eax, eax
je 0x14000f08d
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
js 0x14000f030
mov eax, ebx
mov rdx, qword [rbp - 0x60]
test rdx, rdx
setne al
test eax, eax
je 0x14000f0a3
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
je 0x14000f030
mov eax, ebx
mov rdx, qword [rbp - 0x50]
test rdx, rdx
setne al
test eax, eax
je 0x14000f098
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
je 0x14000f030
mov rbx, qword [rsp + 0x70]
jmp 0x14000f03d
mov r14b, 1
xor r15b, r15b
mov rbx, qword [rsp + 0x70]
jmp 0x14000f042
test r14b, r14b
je 0x14000f05c
lea rdx, str.Data
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14000f05c
mov sil, 1
xor r14b, r14b
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
js 0x14000eb80
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0xa0]
jmp 0x14000eb80
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80004005
call fcn.140001000
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f0d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f0f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f11a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f13b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f166
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000f177
mov rax, qword [rcx]
call qword [rax + Ordinal_17]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14000f197
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
sar rcx, 3
test ecx, ecx
mov eax, 0x80004005
mov edx, 0
cmovg eax, edx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400cafa0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret