Function at 0x14000e230
Capabilities:
Inspect section memory permissions
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c8
mov qword [rsp + 0x200], 0xfffffffffffffffe
mov r14, rcx
xor ebx, ebx
mov esi, ebx
mov dword [rsp + 0x320], ebx
mov qword [rsp + 0x98], rbx
mov r15, rbx
mov qword [rsp + 0x78], rbx
mov r13, rbx
mov qword [rsp + 0x68], rbx
mov rbp, rbx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xc0], rbx
mov rdx, rcx
lea rcx, [rsp + 0x250]
call fcn.140009210
nop
call fcn.14001f9e0
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14000e2c5
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov rax, qword [r14 + 0x170]
cmp dword [rax - 0x10], 0
jne 0x14000e318
lea rdx, [rbx - 0x18]
or r12d, 0xffffffff
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14000e301
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x250]
call fcn.140002e60
mov eax, 0x21
jmp 0x14001000f
lea r12, [r14 + 0x178]
mov qword [rsp + 0x1a0], r12
mov rcx, qword [r12]
test rcx, rcx
je 0x14000e33c
call fcn.140031d90
xor r11d, r11d
mov qword [r12], r11
lea r8, [0x14004e230]
mov rdx, qword [r14 + 0x170]
mov rcx, r12
call fcn.140031ca0
mov r9, qword [r12]
test r9, r9
je 0x14000ffdd
test eax, eax
jne 0x14000ffdd
lea edx, [rax + 2]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x318]
call fcn.1400323b0
cmp eax, 1
je 0x14000e3b7
lea rdx, [rbx - 0x18]
or r12d, 0xffffffff
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14000e3a0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x250]
call fcn.140002e60
mov eax, 0x23
jmp 0x14001000f
mov eax, 0xfeff
cmp word [rsp + 0x318], ax
jne 0x14000e473
lea rdx, str.__detected_as_Unicode.
lea rcx, [rsp + 0xf0]
call fcn.140004c40
nop
lea r8, [r14 + 0x170]
lea rdx, str.INFO:_Input_file_for_restore_operation:__
lea rcx, [rsp + 0x158]
call fcn.140004340
nop
lea r8, [rsp + 0xf0]
mov rdx, rax
lea rcx, [rsp + 0x248]
call fcn.1400041c0
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x158]
add rdx, 0xffffffffffffffe8
or r12d, 0xffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e447
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e54f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000e54f
lea rdx, str.__detected_as_ANSI.
lea rcx, [rsp + 0xe0]
call fcn.140004c40
nop
lea r8, [r14 + 0x170]
lea rdx, str.INFO:_Input_file_for_restore_operation:__
lea rcx, [rsp + 0x1f0]
call fcn.140004340
nop
lea r8, [rsp + 0xe0]
mov rdx, rax
lea rcx, [rsp + 0x218]
call fcn.1400041c0
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x1f0]
add rdx, 0xffffffffffffffe8
or r12d, 0xffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e4f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e513
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [r14 + 0x178]
call fcn.140031d90
lea r8, [0x14004bdb8]
mov rdx, qword [r14 + 0x170]
lea rcx, [r14 + 0x178]
call fcn.140031ca0
cmp qword [r14 + 0x178], 0
je 0x14000ffa8
test eax, eax
jne 0x14000ffa8
xor edi, edi
jmp 0x14000e57b
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
mov r15, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0xfa00
or eax, ecx
jge 0x14000e5a8
mov edx, 0xfa00
lea rcx, [rsp + 0x70]
call fcn.140002720
mov rbx, qword [rsp + 0x70]
mov r8, qword [r14 + 0x178]
mov edx, 0xfa00
mov rcx, rbx
call fcn.140031f60
test rax, rax
je 0x14000feea
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140030ec8
test eax, eax
js 0x14000fedf
cmp eax, dword [rbx - 0xc]
jg 0x14000fedf
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000e606
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xb0], rdi
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14000e621
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xc0], rdi
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x14000e63f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x98], rdi
test r15, r15
je 0x14000e655
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, rdi
mov qword [rsp + 0x78], rdi
test r13, r13
je 0x14000e668
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x68], rdi
test rbp, rbp
je 0x14000e67e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0xa8], edi
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xa4], edi
mov dword [rsp + 0xbc], edi
mov dword [rsp + 0xa0], edi
call fcn.14001f9e0
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
je 0x14000fed4
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbp, [rax + 0x18]
mov qword [rsp + 0x80], rbp
call fcn.14001f9e0
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
je 0x14000fec9
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x328], edi
mov r13, rbx
cmp word [rbx], 0
je 0x14000e792
xor r14d, r14d
nop dword [rax]
movzx edx, word [r13]
lea rcx, str._r_n__t
call fcn.14003060c
test rax, rax
je 0x14000e730
test rdi, rdi
jne 0x14000e733
mov rdi, r13
jmp 0x14000e733
mov rdi, r14
add r13, 2
cmp word [r13], r14w
jne 0x14000e710
mov r14, qword [rsp + 0x310]
test rdi, rdi
je 0x14000e792
sub rdi, rbx
sar rdi, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14000e773
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.140002720
mov rbx, qword [rsp + 0x70]
test edi, edi
js 0x14000fc71
cmp edi, dword [rbx - 0xc]
jg 0x14000fc71
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor r11d, r11d
mov word [rbx + rax*2], r11w
lea rdx, [0x14004e190]
lea rcx, [rsp + 0x70]
call fcn.140004070
mov rdi, qword [rsp + 0x70]
mov eax, dword [rdi - 0x10]
test eax, eax
jne 0x14000e810
lea rdx, [rsi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e7cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
mov esi, dword [rsp + 0x320]
mov rbp, qword [rsp + 0x90]
mov r13, qword [rsp + 0x68]
mov edi, 0
jg 0x14000e57b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000e57b
test eax, eax
jns 0x14000e819
mov r13d, r12d
jmp 0x14000e83b
lea rdx, [0x14004e188]
mov rcx, rdi
call fcn.1400305a4
mov r13, rax
test rax, rax
jne 0x14000e835
mov r13d, r12d
jmp 0x14000e83b
sub r13, rdi
sar r13, 1
mov r8d, r13d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x70]
call fcn.1400030b0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbp, 0xffffffffffffffe8
cmp rcx, rbp
je 0x14000e8b3
cmp dword [rbp + 0x10], 0
jl 0x14000e8a1
mov rax, qword [rbp]
cmp qword [rcx], rax
jne 0x14000e8a1
call fcn.140002780
mov rbx, rax
mov eax, r12d
lock xadd dword [rbp + 0x10], eax
dec eax
test eax, eax
jg 0x14000e893
mov rcx, qword [rbp]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x80], rax
jmp 0x14000e8b3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x80]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x128]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e8d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea ebp, [r13 + 2]
mov rbx, qword [rsp + 0x70]
test ebp, ebp
js 0x14000ea17
cmp ebp, dword [rdi - 0x10]
jg 0x14000ea17
movsxd rax, ebp
lea rcx, [rbx + rax*2]
lea rdx, [0x14004e180]
call fcn.1400305a4
mov rsi, rax
test rax, rax
je 0x14000ea17
sub rsi, rbx
sar rsi, 1
cmp esi, 0xffffffff
je 0x14000ea17
mov r9d, esi
sub r9d, r13d
dec r9d
mov r8d, ebp
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x70]
call fcn.140002f30
mov rcx, qword [rax]
call fcn.140031f54
mov dword [rsp + 0xc8], eax
mov rdx, qword [rsp + 0x1c0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e96e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, dword [rdi - 0x10]
sub r8d, esi
sub r8d, 2
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0x70]
call fcn.140003010
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x60]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000e9eb
cmp dword [rbx + 0x10], 0
jl 0x14000e9dc
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000e9dc
call fcn.140002780
mov rdi, rax
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x14000e9d1
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14000e9eb
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x138]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000eb37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000eb37
test ebp, ebp
js 0x14000ea48
cmp ebp, dword [rdi - 0x10]
jg 0x14000ea48
movsxd rax, ebp
lea rcx, [rbx + rax*2]
lea rdx, [0x14004d66c]
call fcn.1400305a4
mov rsi, rax
test rax, rax
jne 0x14000ea40
mov esi, r12d
jmp 0x14000ea4b
sub rsi, rbx
sar rsi, 1
jmp 0x14000ea4b
mov esi, r12d
mov r9d, esi
sub r9d, r13d
mov r8d, ebp
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x70]
call fcn.140002f30
mov rcx, qword [rax]
call fcn.140031f54
mov dword [rsp + 0xc8], eax
mov rdx, qword [rsp + 0x1e0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ea98
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, dword [rdi - 0x10]
sub r8d, esi
dec r8d
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x70]
call fcn.140003010
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x60]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000eb14
cmp dword [rbx + 0x10], 0
jl 0x14000eb05
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000eb05
call fcn.140002780
mov rdi, rax
mov eax, r12d
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x14000eafa
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14000eb14
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000eb37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x60]
movsxd rbx, dword [rsi - 0x10]
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14000eb62
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140002720
mov rsi, qword [rsp + 0x60]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rsi
call fcn.1400308bc
test ebx, ebx
js 0x14000febe
cmp ebx, dword [rsi - 0xc]
jg 0x14000febe
mov dword [rsi - 0x10], ebx
xor edi, edi
mov word [rsi + rbx*2], di
cmp dword [rsi - 0x10], edi
jne 0x14000ec58
lea r8, [rsp + 0x80]
lea rdx, str.INFO:_Omitting_SD_of:__
lea rcx, [rsp + 0x1d0]
call fcn.140004340
nop
lea r8, str.__because_neither_owner__group__DACL_nor_SACL_were_backed_up.
mov rdx, rax
lea rcx, [rsp + 0x238]
call fcn.140004270
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x1d0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ebf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ec18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
mov esi, dword [rsp + 0x320]
mov rbp, qword [rsp + 0x90]
mov r13, qword [rsp + 0x68]
jg 0x14000e57b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000e57b
mov r15, qword [rsp + 0x80]
add r15, 0xffffffffffffffe8
mov rcx, r15
call fcn.140002780
add rax, 0x18
mov qword [rsp + 0x110], rax
lea rdx, [rsp + 0x110]
mov rcx, r14
call fcn.140004790
test eax, eax
je 0x14000ed8c
lea rdx, str.__because_a_filter_keyword_matched.
lea rcx, [rsp + 0x100]
call fcn.140004c40
nop
lea r8, [rsp + 0x80]
lea rdx, str.INFO:_Omitting_SD_of:__
lea rcx, [rsp + 0x1b0]
call fcn.140004340
nop
lea r8, [rsp + 0x100]
mov rdx, rax
lea rcx, [rsp + 0x228]
call fcn.1400041c0
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x1b0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ed0a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ed2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ed4f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [r15 + 0x10], eax
dec eax
test eax, eax
mov esi, dword [rsp + 0x320]
mov rbp, qword [rsp + 0x90]
mov r13, qword [rsp + 0x68]
jg 0x14000e576
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
lea rdx, [0x14004e0a4]
lea rcx, [rsp + 0xd0]
call fcn.140004c40
nop
lea r8, [rsp + 0x80]
lea rdx, str.INFO:_Restoring_SD_of:__
lea rcx, [rsp + 0x168]
call fcn.140004340
nop
lea r8, [rsp + 0xd0]
mov rdx, rax
lea rcx, [rsp + 0x208]
call fcn.1400041c0
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x168]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ee06
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ee29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.14001f9e0
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
je 0x14000feb3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x88], rdi
cmp dword [rsi - 0x10], 0
jl 0x14000f076
lea rdx, [0x14004e068]
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.1400305a4
mov rbp, rax
test rax, rax
je 0x14000f085
sub rbp, rbx
sar rbp, 1
cmp ebp, 0xffffffff
je 0x14000f08f
mov eax, 0x20000000
mov dword [rsp + 0x328], eax
lea r13d, [rbp + 2]
test r13d, r13d
js 0x14000ef82
cmp r13d, dword [rsi - 0x10]
jg 0x14000ef82
movsxd rax, r13d
lea rcx, [rbx + rax*2]
lea rdx, [0x14004e064]
call fcn.1400305a4
test rax, rax
je 0x14000ef82
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14000ef82
sub eax, ebp
lea r9d, [rax - 2]
mov r8d, r13d
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x60]
call fcn.140002f30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000ef56
cmp dword [rdi + 0x10], 0
jl 0x14000ef44
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000ef44
call fcn.140002780
mov rbx, rax
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000ef36
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x88], rax
jmp 0x14000ef56
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x88]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x1b8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f01b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000f01b
mov r8d, r13d
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x60]
call fcn.140004190
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000eff8
cmp dword [rdi + 0x10], 0
jl 0x14000efe6
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000efe6
call fcn.140002780
mov rbx, rax
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000efd8
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x88], rax
jmp 0x14000eff8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x88]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x178]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f01b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x88]
cmp dword [rdi - 0x10], 0
jl 0x14000f063
lea rdx, [0x14004e060]
mov rcx, rdi
call fcn.1400305a4
test rax, rax
je 0x14000f059
sub rax, rdi
sar rax, 1
mov r13d, dword [rsp + 0x328]
cmp eax, 0xffffffff
mov eax, 0x80000000
cmovne r13d, eax
jmp 0x14000f06b
mov r13d, dword [rsp + 0x328]
jmp 0x14000f06b
mov r13d, dword [rsp + 0x328]
or r13d, 4
mov rbx, qword [rsp + 0x60]
jmp 0x14000f097
mov rbx, qword [rsp + 0x60]
mov r13d, dword [rsp + 0x328]
jmp 0x14000f097
mov r13d, dword [rsp + 0x328]
jmp 0x14000f097
mov r13d, dword [rsp + 0x328]
cmp dword [rsi - 0x10], 0
jl 0x14000f2ac
lea rdx, [0x14004e058]
mov rcx, rbx
call fcn.1400305a4
mov rbp, rax
test rax, rax
je 0x14000f2ac
sub rbp, rbx
sar rbp, 1
cmp ebp, 0xffffffff
je 0x14000f2ac
or r13d, 8
mov dword [rsp + 0x328], r13d
mov r14d, 0x10000000
lea r13d, [rbp + 2]
test r13d, r13d
js 0x14000f1c7
cmp r13d, dword [rsi - 0x10]
jg 0x14000f1c7
movsxd rax, r13d
lea rcx, [rbx + rax*2]
lea rdx, [0x14004e064]
call fcn.1400305a4
test rax, rax
je 0x14000f1c7
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14000f1c7
sub eax, ebp
lea r9d, [rax - 2]
mov r8d, r13d
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x60]
call fcn.140002f30
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000f19b
cmp dword [rdi + 0x10], 0
jl 0x14000f189
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000f189
call fcn.140002780
mov rbx, rax
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000f17b
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x88], rax
jmp 0x14000f19b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x88]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x1c8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f260
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000f260
mov r8d, r13d
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x60]
call fcn.140004190
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000f23d
cmp dword [rdi + 0x10], 0
jl 0x14000f22b
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000f22b
call fcn.140002780
mov rbx, rax
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
dec eax
test eax, eax
jg 0x14000f21d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x88], rax
jmp 0x14000f23d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x88]
call fcn.140003420
nop
mov rdx, qword [rsp + 0x188]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f260
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x88]
cmp dword [rdi - 0x10], 0
jl 0x14000f294
lea rdx, [0x14004e060]
mov rcx, rdi
call fcn.1400305a4
test rax, rax
je 0x14000f294
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
mov eax, 0x40000000
cmovne r14d, eax
mov r13d, dword [rsp + 0x328]
or r13d, r14d
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x310]
cmp dword [rsi - 0x10], 0
jl 0x14000f2d5
lea rdx, [0x14004e050]
mov rcx, rbx
call fcn.1400305a4
test rax, rax
je 0x14000f2d5
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14000f2d5
or r13d, 1
cmp dword [rsi - 0x10], 0
jl 0x14000f2fe
lea rdx, [0x14004e048]
mov rcx, rbx
call fcn.1400305a4
test rax, rax
je 0x14000f2fe
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14000f2fe
or r13d, 2
xor r9d, r9d
lea r8, [rsp + 0xb0]
lea edx, [r9 + 1]
mov rcx, rbx
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x14000f4c7
cmp dword [r14 + 0x8c], eax
je 0x14000fc7c
lea rdx, [0x14004e044]
lea rcx, [rsp + 0xd8]
call fcn.140004c40
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x1e8]
mov rcx, r14
call fcn.1400045c0
mov rbx, rax
lea r8, [rsp + 0x80]
lea rdx, str.ERROR:_Restoring_SD_of__
lea rcx, [rsp + 0x198]
call fcn.140004340
nop
lea r8, [rsp + 0xd8]
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.1400041c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400041c0
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x1d8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f3d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x198]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f3f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1e8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f41c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f440
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f464
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f485
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [r15 + 0x10], eax
dec eax
test eax, eax
mov esi, dword [rsp + 0x320]
mov rbp, qword [rsp + 0x90]
mov r13, qword [rsp + 0x68]
mov edi, 0
jg 0x14000e56f
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rbp, qword [rsp + 0x90]
mov qword [rsp + 0x48], rbp
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
lea r8, [rsp + 0xa8]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14000f6f4
cmp dword [r14 + 0x8c], 0
je 0x14000fd0b
lea rdx, [0x14004e044]
lea rcx, [rsp + 0xe8]
call fcn.140004c40
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x118]
mov rcx, r14
call fcn.1400045c0
mov rbx, rax
lea r8, [rsp + 0x80]
lea rdx, str.ERROR:_Restoring_SD_of__
lea rcx, [rsp + 0x1f8]
call fcn.140004340
nop
lea r8, [rsp + 0xe8]
mov rdx, rax
lea rcx, [rsp + 0x1a8]
call fcn.1400041c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x220]
call fcn.1400041c0
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x1a8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f609
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1f8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f62d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f651
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f675
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f699
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f6ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [r15 + 0x10], eax
dec eax
test eax, eax
mov esi, dword [rsp + 0x320]
mov r13, qword [rsp + 0x68]
mov edi, 0
jg 0x14000e568
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
mov edx, dword [rsp + 0xa8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0xc0], rax
mov edx, dword [rsp + 0xb8]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x98], rax
mov edx, dword [rsp + 0xa4]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
mov qword [rsp + 0x78], rax
mov edx, dword [rsp + 0xbc]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov qword [rsp + 0x68], rax
mov edx, dword [rsp + 0xa0]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbp
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x98]
lea r8, [rsp + 0xa8]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x14000f98c
cmp dword [r14 + 0x8c], eax
je 0x14000fd92
lea rdx, [0x14004e044]
lea rcx, [rsp + 0xf8]
call fcn.140004c40
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x140]
mov rcx, r14
call fcn.1400045c0
mov rbx, rax
lea r8, [rsp + 0x80]
lea rdx, str.ERROR:_Restoring_SD_of__
lea rcx, [rsp + 0x130]
call fcn.140004340
nop
lea r8, [rsp + 0xf8]
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.1400041c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x230]
call fcn.1400041c0
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f8a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f8c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f8e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f90d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f931
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000f952
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [r15 + 0x10], eax
dec eax
test eax, eax
mov esi, dword [rsp + 0x320]
mov r13, qword [rsp + 0x68]
mov edi, 0
jg 0x14000e561
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
mov esi, dword [rsp + 0xc8]
cmp esi, 1
jne 0x14000f9bd
mov rcx, r15
call fcn.140002780
add rax, 0x18
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x150]
call fcn.140002ea0
mov ebx, eax
jmp 0x14000f9cc
xor eax, eax
mov ebx, eax
cmp esi, 4
mov eax, 1
cmove ebx, eax
mov rcx, r15
call fcn.140002780
add rax, 0x18
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x48], ebx
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rbp
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8d, esi
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x250]
call fcn.14000d980
mov esi, eax
mov dword [rsp + 0x320], eax
mov ecx, dword [rsp + 0x280]
mov dword [r14 + 0x88], ecx
test eax, eax
je 0x14000fc01
lea rdx, str.__failed_with:
lea rcx, [rsp + 0x108]
call fcn.140004c40
nop
mov r8d, dword [r14 + 0x88]
lea rdx, [rsp + 0x190]
mov rcx, r14
call fcn.1400045c0
mov rbx, rax
lea r8, [rsp + 0x80]
lea rdx, str.ERROR:_Writing_SD_to__
lea rcx, [rsp + 0x180]
call fcn.140004340
nop
lea r8, [rsp + 0x108]
mov rdx, rax
lea rcx, [rsp + 0x170]
call fcn.1400041c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.1400041c0
mov rdx, rax
mov rcx, r14
call fcn.1400044d0
nop
mov rdx, qword [rsp + 0x170]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000faf2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x180]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fb16
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x190]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fb3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fb5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [r14 + 0x88]
cmp eax, 5
je 0x14000fb7c
cmp eax, 2
je 0x14000fb7c
cmp dword [r14 + 0x8c], 0
je 0x14000fe19
xor edi, edi
mov dword [r14 + 0x88], edi
mov esi, edi
mov dword [rsp + 0x320], edi
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fbb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fbd3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [r15 + 0x10], eax
dec eax
test eax, eax
mov r13, qword [rsp + 0x68]
jg 0x14000e55a
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fc1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fc3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, r12d
lock xadd dword [r15 + 0x10], eax
dec eax
test eax, eax
mov r13, qword [rsp + 0x68]
mov edi, 0
jg 0x14000e553
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x78]
jmp 0x14000e57b
mov ecx, 0x80070057
call fcn.140001000
nop
mov esi, 0x1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14 + 0x88], eax
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fcaa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fccb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fe9d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x90]
mov r13, qword [rsp + 0x68]
xor edi, edi
jmp 0x14000feec
mov esi, 0x1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14 + 0x88], eax
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fd39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fd5a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fea5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
xor edi, edi
jmp 0x14000feec
mov esi, 0x1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r14 + 0x88], eax
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fdc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fde1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fea5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
xor edi, edi
jmp 0x14000feec
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fe3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fe5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000fe81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp esi, 0x2c
jne 0x14000fea5
xor edi, edi
mov dword [r14 + 0x88], edi
mov esi, edi
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
jmp 0x14000feec
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
xor edi, edi
jmp 0x14000feec
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
xor edi, edi
mov r14, qword [rsp + 0x1a0]
mov rcx, qword [r14]
test rcx, rcx
je 0x14000ff04
call fcn.140031d90
mov qword [r14], rdi
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000ff1f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xb0], rdi
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x14000ff35
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x14000ff4b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14000ff5e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x14000ff6c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x14000ff7b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14000ff97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x250]
call fcn.140002e60
mov eax, esi
jmp 0x14001000f
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14000ffc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x250]
call fcn.140002e60
mov eax, 0x22
jmp 0x14001000f
lea rdx, [rbx - 0x18]
or r12d, 0xffffffff
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14000fffd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x250]
call fcn.140002e60
mov eax, 0x22
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret