Function at 0x10122e0
Capabilities:
Check if file exists
Get memory capacity

Disassembly:
push rsi
push rdi
mov eax, 0x27a8
call fcn.0105fe80
sub rsp, rax
mov rax, qword [0x010667f0]
xor rax, rsp
mov qword [rsp + 0x2790], rax
lea rax, [rsp + 0x18f0]
lea rcx, [0x010020e0]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_gethostbyname
rep movsb byte [rdi], byte [rsi]
movzx eax, word [0x01001c50]
mov word [rsp + 0xf70], ax
lea rax, [rsp + 0xf72]
mov rdi, rax
xor eax, eax
mov ecx, 0x7e
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x17e0], ax
lea rax, [rsp + 0x17e2]
mov rdi, rax
xor eax, eax
mov ecx, 0x106
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x830], ax
lea rax, [rsp + 0x832]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x730], ax
lea rax, [rsp + 0x732]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x120], ax
lea rax, [rsp + 0x122]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x1110], ax
lea rax, [rsp + 0x1112]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x6b0], ax
lea rax, [rsp + 0x6b2]
mov rdi, rax
xor eax, eax
mov ecx, 0x7e
rep stosb byte [rdi], al
mov word [rsp + 0x13d0], 0
lea rax, [rsp + 0x13d2]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x230], ax
lea rax, [rsp + 0x232]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0xa0], ax
lea rax, [rsp + 0xa2]
mov rdi, rax
xor eax, eax
mov ecx, 0x7e
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x630], ax
lea rax, [rsp + 0x632]
mov rdi, rax
xor eax, eax
mov ecx, 0x7e
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x1000], ax
lea rax, [rsp + 0x1002]
mov rdi, rax
xor eax, eax
mov ecx, 0x106
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x1220], ax
lea rax, [rsp + 0x1222]
mov rdi, rax
xor eax, eax
mov ecx, 0x7e
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0xb70], ax
lea rax, [rsp + 0xb72]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x12b0], ax
lea rax, [rsp + 0x12b2]
mov rdi, rax
xor eax, eax
mov ecx, 0x106
rep stosb byte [rdi], al
movzx eax, word [0x01001c50]
mov word [rsp + 0x2550], ax
lea rax, [rsp + 0x2552]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
mov qword [rsp + 0x13c8], 0
mov dword [rsp + 0x12a0], 0
mov dword [rsp + 0xa30], 0
mov dword [rsp + 0x1210], 0
mov dword [rsp + 0x13c0], 0
mov dword [rsp + 0x2540], 0
mov dword [rsp + 0xb60], 0
mov dword [rsp + 0x17d4], 0
mov qword [rsp + 0x220], 0
mov dword [rsp + 0xff0], 0
mov dword [rsp + 0x1928], 0
mov dword [rsp + 0x17d0], 0
mov r9d, 0x40
lea r8, [rsp + 0xf70]
mov edx, 0x17
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov dword [rsp + 0x60], 0x38
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp qword [rsp + 0x68], 0
jne 0x1012614
mov eax, 0xffffffff
mov qword [rsp + 0x68], rax
xor edx, edx
mov rax, qword [rsp + 0x68]
mov ecx, 0x100000
div rcx
mov rax, rdx
test rax, rax
je 0x1012638
mov dword [rsp + 0x2750], 1
jmp 0x1012643
mov dword [rsp + 0x2750], 0
xor edx, edx
mov rax, qword [rsp + 0x68]
mov ecx, 0x100000
div rcx
add eax, dword [rsp + 0x2750]
mov dword [rsp + 0xb60], eax
mov dword [rsp + 0xa40], 0x114
lea rcx, [rsp + 0xa40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1012707
lea rcx, [rsp + 0xa54]
call fcn.01053890
cmp dword [rsp + 0xa50], 2
jne 0x10126a9
lea rax, [0x010020d8]
mov qword [rsp + 0x2758], rax
jmp 0x10126b8
lea rax, [0x010020d0]
mov qword [rsp + 0x2758], rax
lea rax, [rsp + 0xa54]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa4c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa48]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa44]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x2758]
lea r8, [0x01002098]
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x830]
call fcn.01016110
lea r8, [rsp + 0xf70]
mov edx, 0x40
lea rcx, [rsp + 0x6b0]
call fcn.0105ab90
lea r8, [0x01002088]
mov edx, 0x40
lea rcx, [rsp + 0xa0]
call fcn.0105ab90
cmp dword [0x010689c0], 0
je 0x1012765
mov r9d, 0x40
lea r8, [rsp + 0x630]
mov edx, 0x16e
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
jmp 0x1012785
mov r9d, 0x40
lea r8, [rsp + 0x630]
mov edx, 0x16f
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov eax, dword [0x010689e8]
and eax, 1
test eax, eax
jne 0x1012905
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x2550]
call fcn.010375d0
lea r8, [rsp + 0x2550]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rsp + 0x220], rax
cmp qword [rsp + 0x220], 0
jne 0x10128da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x17d4], eax
cmp dword [rsp + 0x17d4], 2
jne 0x1012874
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call fcn.0103eb00
mov r8d, 0x15e
xor edx, edx
mov ecx, 4
call fcn.01034b80
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x2550]
call fcn.010375d0
lea r8, [rsp + 0x2550]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rsp + 0x220], rax
cmp qword [rsp + 0x220], 0
jne 0x1012872
mov edx, 0x1f4
mov rcx, qword [0x01068930]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1012870
jmp 0x1013415
jmp 0x1012825
jmp 0x10128da
mov r8d, 0x400
lea rdx, [rsp + 0xb70]
mov ecx, dword [rsp + 0x17d4]
call fcn.01053650
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0x17d
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [rsp + 0xb70]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
cmp qword [rsp + 0x220], 0
je 0x10128f3
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call fcn.0103eb00
lea r8, [0x01002078]
lea rdx, [0x01002038]
lea rcx, [rsp + 0x1930]
call fcn.01020b80
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x1930]
call fcn.01020f20
test eax, eax
je 0x1012e5f
lea rdx, [0x01002028]
lea rcx, [rsp + 0x1930]
call fcn.01021c40
test eax, eax
jne 0x10129a4
lea rcx, [rsp + 0x1930]
call qword [sym.imp.SQLSVC.dll_QSQLLogoff]
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0x15f
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [0x01002028]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
lea rdx, [0x01002028]
lea rcx, [rsp + 0x1930]
call fcn.01021dd0
test eax, eax
jne 0x10129ce
mov r8d, 0x189
xor edx, edx
mov ecx, 4
call fcn.01034b80
lea rdx, [0x01002028]
lea rcx, [rsp + 0x1930]
call fcn.01021dd0
test eax, eax
jne 0x1012a0b
mov edx, 0x1f4
mov rcx, qword [0x01068930]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1012a09
jmp 0x1013415
jmp 0x10129ce
mov r9d, 1
lea r8, [0x01001e18]
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x2550]
call fcn.01015b10
lea r9, [rsp + 0x2550]
mov r8d, 1
mov edx, 1
mov rcx, qword [0x01069168]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x01068f38], rax
cmp qword [0x01068f38], 0
jne 0x1012a65
jmp 0x1013415
mov edx, 1
lea rcx, [rsp + 0x1930]
call fcn.01014d80
lea rax, [rsp + 0x13c8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
lea rax, [0x01069290]
mov qword [rsp + 0x20], rax
mov r9d, 0x12
mov r8w, 2
mov edx, 1
lea rcx, [rsp + 0x1930]
call qword [sym.imp.SQLSVC.dll_QSQLGetProperty]
test eax, eax
jne 0x1012b8b
lea r8, [0x01069290]
mov edx, 0x80
lea rcx, [rsp + 0x730]
call fcn.0105ab90
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rsp + 0x120]
lea r8, [0x01001c50]
lea rdx, [0x01002020]
lea rcx, [rsp + 0x730]
call fcn.010531b0
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCR80.dll__wtol]
mov dword [0x0106918c], eax
mov eax, dword [0x0106918c]
cdq
mov ecx, 0x2710
idiv ecx
mov eax, edx
mov dword [rsp + 0x2760], eax
mov eax, dword [0x0106918c]
cdq
mov ecx, 0xf4240
idiv ecx
mov eax, edx
cdq
mov ecx, 0x2710
idiv ecx
mov dword [rsp + 0x2764], eax
mov eax, dword [0x0106918c]
cdq
mov ecx, 0xf4240
idiv ecx
mov ecx, dword [rsp + 0x2760]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x2764]
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea r8, [0x01002000]
mov edx, 0x80
lea rcx, [0x01069290]
call fcn.01016110
lea rax, [rsp + 0x13c8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
lea rax, [0x01069190]
mov qword [rsp + 0x20], rax
mov r9d, 7
mov r8w, 2
mov edx, 1
lea rcx, [rsp + 0x1930]
call qword [sym.imp.SQLSVC.dll_QSQLGetProperty]
test eax, eax
jne 0x1012ca3
lea r8, [0x01069190]
mov edx, 0x80
lea rcx, [rsp + 0x730]
call fcn.0105ab90
mov dword [rsp + 0x20], pe_nt_image_headers64
lea r9, [rsp + 0x120]
lea r8, [0x01001c50]
lea rdx, [0x01002020]
lea rcx, [rsp + 0x730]
call fcn.010531b0
lea rcx, [rsp + 0x120]
call qword [sym.imp.MSVCR80.dll__wtol]
mov dword [rsp + 0xff0], eax
mov eax, dword [rsp + 0xff0]
cdq
mov ecx, 0x2710
idiv ecx
mov eax, edx
mov dword [rsp + 0x2768], eax
mov eax, dword [rsp + 0xff0]
cdq
mov ecx, 0xf4240
idiv ecx
mov eax, edx
cdq
mov ecx, 0x2710
idiv ecx
mov dword [rsp + 0x276c], eax
mov eax, dword [rsp + 0xff0]
cdq
mov ecx, 0xf4240
idiv ecx
mov ecx, dword [rsp + 0x2768]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x276c]
mov dword [rsp + 0x20], ecx
mov r9d, eax
lea r8, [0x01002000]
mov edx, 0x80
lea rcx, [0x01069190]
call fcn.01016110
lea rax, [rsp + 0x13c8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
lea rax, [rsp + 0x1110]
mov qword [rsp + 0x20], rax
mov r9d, 0x4af
mov r8w, 2
mov edx, 1
lea rcx, [rsp + 0x1930]
call qword [sym.imp.SQLSVC.dll_QSQLGetProperty]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0x84
lea rax, [rsp + 0x17e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa30]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x1930]
call fcn.010218a0
lea rax, [rsp + 0x17d0]
mov qword [rsp + 0x58], rax
lea rax, [0x010689e4]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x12b0]
mov qword [rsp + 0x48], rax
lea rax, [0x01069188]
mov qword [rsp + 0x40], rax
lea rax, [0x01069184]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1000]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1928]
mov qword [rsp + 0x28], rax
lea rax, [0x010689cc]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2540]
lea r8, [rsp + 0x1210]
lea rdx, [rsp + 0x13c0]
lea rcx, [rsp + 0x1930]
call fcn.01022020
cmp dword [0x01065104], 0
jne 0x1012dff
lea rax, [rsp + 0x18f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 1
lea rdx, [0x01001e80]
lea rcx, [rsp + 0x1930]
call fcn.01021550
lea rdx, [0x0106510c]
lea rcx, [rsp + 0x1930]
call fcn.0102adb0
test eax, eax
jne 0x1012e4f
lea rcx, [rsp + 0x1930]
call qword [sym.imp.SQLSVC.dll_QSQLLogoff]
mov r9d, 0x200
lea r8, [rsp + 0x13d0]
mov edx, 0x1b7
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
jmp 0x1013415
lea rcx, [rsp + 0x1930]
call qword [sym.imp.SQLSVC.dll_QSQLLogoff]
jmp 0x1012eb7
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0x63
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [0x01001c30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1958]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea r8, [0x01001e78]
mov edx, 0x40
lea rcx, [rsp + 0x1220]
call fcn.01016110
lea rax, [rsp + 0x1220]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x630]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x28], rax
lea rax, [0x01001c10]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c30]
mov r8d, 0x64
xor edx, edx
mov ecx, 4
call fcn.01034b80
movzx eax, word [0x01069290]
test eax, eax
je 0x1012f4e
lea rax, [0x01069290]
mov qword [rsp + 0x2770], rax
jmp 0x1012f5e
lea rax, [rsp + 0xf70]
mov qword [rsp + 0x2770], rax
mov eax, dword [rsp + 0x1928]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x2770]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1000]
mov r8d, 0x65
xor edx, edx
mov ecx, 4
call fcn.01034b80
movzx eax, word [0x01069190]
test eax, eax
je 0x1012fac
lea rax, [0x01069190]
mov qword [rsp + 0x2778], rax
jmp 0x1012fbc
lea rax, [rsp + 0xf70]
mov qword [rsp + 0x2778], rax
mov r9, qword [rsp + 0x2778]
mov r8d, 0x66
xor edx, edx
mov ecx, 4
call fcn.01034b80
movzx eax, word [rsp + 0x1110]
test eax, eax
je 0x1012ffa
lea rcx, [rsp + 0x1110]
call qword [sym.imp.MSVCR80.dll__wcsupr]
mov qword [rsp + 0x2780], rax
jmp 0x101300a
lea rax, [rsp + 0xf70]
mov qword [rsp + 0x2780], rax
lea rax, [0x01066e08]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2780]
mov r8d, 0x67
xor edx, edx
mov ecx, 4
call fcn.01034b80
mov eax, dword [rsp + 0xb60]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x010689ec]
mov r8d, 0x136
xor edx, edx
mov ecx, 4
call fcn.01034b80
lea rax, [rsp + 0x830]
mov qword [rsp + 0x20], rax
lea r9, [0x01068bf8]
mov r8d, 0x153
xor edx, edx
mov ecx, 4
call fcn.01034b80
cmp dword [rsp + 0xa30], 0
jne 0x101310e
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0x6a
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
movzx eax, word [rsp + 0x17e0]
test eax, eax
je 0x10130c6
lea rax, [rsp + 0x17e0]
mov qword [rsp + 0x2788], rax
jmp 0x10130d6
lea rax, [rsp + 0xf70]
mov qword [rsp + 0x2788], rax
mov rax, qword [rsp + 0x2788]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c30]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
cmp dword [rsp + 0x1210], 0
je 0x101316f
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0xff
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [0x01002028]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c30]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
cmp dword [rsp + 0x13c0], 0
jne 0x10131d0
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0x183
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [0x01002028]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c30]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
cmp dword [rsp + 0x2540], 0
jne 0x1013231
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0x184
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [0x01002028]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c30]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
lea rdx, str.MSSQLSERVER
lea rcx, [rsp + 0x12b0]
call qword [sym.imp.MSVCR80.dll_wcscmp]
test eax, eax
je 0x10132ae
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0x197
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, str.MSSQLSERVER
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x12b0]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c30]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
cmp dword [0x0106814c], 0
jne 0x101336a
cmp dword [0x0106918c], 0
jne 0x1013311
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, WSAGetLastError
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [0x01001c30]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
cmp dword [0x0106918c], 0x6c5660
jge 0x101336a
lea rax, [0x01001e70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
lea rax, [0x01001c30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 4
mov r8d, 0xc000006b
mov edx, 1
mov ecx, 3
call fcn.010341e0
jmp 0x1013415
cmp dword [rsp + 0x17d0], 2
je 0x10133b2
mov r9d, 0x200
lea r8, [rsp + 0x230]
mov edx, 0x1c8
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r8, [rsp + 0x230]
mov edx, 0x200
lea rcx, [rsp + 0x13d0]
call fcn.01016110
jmp 0x1013415
call fcn.0103f5b0
mov dword [rsp + 0x12a0], eax
cmp dword [rsp + 0x12a0], 0
jne 0x10133ec
mov r9d, 0x200
lea r8, [rsp + 0x13d0]
mov edx, 0x1c2
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
jmp 0x1013415
lea rcx, [0x01001e58]
call fcn.0103ed90
test eax, eax
jne 0x1013415
lea r9, [0x01001e58]
mov r8d, 0x16c
xor edx, edx
mov ecx, 1
call fcn.01034b80
cmp dword [rsp + 0x12a0], 0
jne 0x101347e
lea rcx, [rsp + 0x13d0]
call qword [sym.imp.MSVCR80.dll_wcslen]
test rax, rax
je 0x101347e
lea r9, [rsp + 0x13d0]
xor r8d, r8d
lea rdx, [0x01001bcc]
mov ecx, 1
call fcn.01034b80
lea rax, [rsp + 0x13d0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 2
mov r8d, 0x40000067
mov edx, 1
mov ecx, 1
call fcn.010341e0
xor edx, edx
mov rcx, qword [0x01068930]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x101349a
xor eax, eax
jmp 0x10134a1
mov eax, dword [rsp + 0x12a0]
mov rcx, qword [rsp + 0x2790]
xor rcx, rsp
call fcn.01059ab0
add rsp, 0x27a8
pop rdi
pop rsi
ret