Function at 0x140032b40
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Set file attributes

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50b0
call fcn.1400a28a0
sub rsp, rax
mov qword [rsp + 0x110], 0xfffffffffffffffe
mov qword [rsp + 0x50e0], rbx
mov qword [rsp + 0x50e8], rbp
mov qword [rsp + 0x50f0], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x50a0], rax
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x26d0]
call fcn.1400633b0
nop
lea rcx, [rsp + 0xe8]
call fcn.140067970
nop
lea rcx, [rsp + 0xc0]
call fcn.140067970
nop
call fcn.1400696cc
mov rcx, rax
xor r12d, r12d
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x140032be2
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rbp, [0x1400a4510]
mov rbx, rbp
or rsi, 0xffffffffffffffff
shr rbx, 0x10
jne 0x140032c26
movzx edi, bp
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x140032c46
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140003a40
jmp 0x140032c46
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.140003c40
nop
call fcn.1400696cc
mov rcx, rax
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x140032c66
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
test rbx, rbx
jne 0x140032c9b
movzx edi, bp
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x140032cbb
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140003a40
jmp 0x140032cbb
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.140003c40
nop
call fcn.1400696cc
mov rcx, rax
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x140032cdb
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x140032d10
movzx edi, bp
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x140032d30
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140003a40
jmp 0x140032d30
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140003c40
nop
lea rcx, [rsp + 0x120]
call fcn.1400633b0
nop
lea rcx, [rsp + 0x80]
call fcn.140067970
nop
mov dword [rsp + 0x58], r12d
call fcn.140069504
mov rdi, qword [rax + 8]
call fcn.140015a10
mov dword [rsp + 0x5c], eax
mov rdi, qword [rdi + 0x560]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140032d8e
cmp rax, qword [rdi - 0x18]
jne 0x140032d8e
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x140032dcc
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x140032daa
call fcn.1400019f0
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.140080540
lea rdi, [rbx + 0x18]
mov qword [rsp + 0x40], rdi
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140067be4
mov ebp, r12d
lea r13, [rdi - 0x10]
nop
test ebp, ebp
js 0x140032e90
cmp ebp, dword [r13]
jge 0x140032e90
movsxd rax, ebp
lea rcx, [rdi + rax*2]
mov dx, 9
call fcn.1400804a0
mov rbx, rax
test rax, rax
je 0x140032e90
sub rbx, rdi
sar rbx, 1
test ebx, ebx
js 0x140032e90
cmp ebx, ebp
jle 0x140032e88
mov r9d, ebx
sub r9d, ebp
mov r8d, ebp
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.140003560
nop
lea r8, [rsp + 0x78]
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x80]
call fcn.140068200
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032e83
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
jmp 0x140032e88
mov rdi, qword [rsp + 0x40]
lea ebp, [rbx + 1]
jmp 0x140032df0
mov r8d, ebp
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140003e50
nop
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x80]
call fcn.140068200
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032ede
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 0x104
lea rcx, [rsp + 0x4c80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140032fce
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032f21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x80]
call fcn.140067fc8
nop
lea rcx, [rsp + 0x120]
call fcn.1400636d0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032f5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140032f7f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140032f9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xc0]
call fcn.140067fc8
nop
lea rcx, [rsp + 0xe8]
call fcn.140067fc8
nop
lea rcx, [rsp + 0x26d0]
call fcn.1400636d0
xor eax, eax
jmp 0x140033d1f
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x4c80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140033050
mov rbx, qword [rsp + 0x30]
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400330df
cmp dword [rdx + 0x10], eax
jge 0x140033022
cmp dword [rbx - 0xc], eax
jge 0x140033016
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], ax
jmp 0x1400330df
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033039
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x1400330df
mov rbx, qword [rsp + 0x30]
mov ebp, dword [rbx - 0x10]
lea r13, [rsp + 0x4c80]
sub r13, rbx
sar r13, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140033088
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp r13, rbp
ja 0x1400330a8
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r13*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.140081c40
jmp 0x1400330c5
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x4c80]
mov rdx, rbp
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x140033d14
cmp edi, dword [rbx - 0xc]
jg 0x140033d14
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], 0
xor eax, eax
mov rcx, rsi
lea r13, str.infother_
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov rbp, r13
sub rbp, rbx
sar rbp, 1
mov r14d, dword [rbx - 0x10]
lea edi, [r14 + rcx - 1]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x14003312c
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp rbp, r14
ja 0x140033135
lea r13, [rbx + rbp*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rbx + r14*2]
mov r9, rdx
mov r8, r13
call fcn.140080540
test edi, edi
js 0x140033d09
cmp edi, dword [rbx - 0xc]
jg 0x140033d09
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14003318f
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
mov r9d, 1
lea r8, str.Canon
mov rdx, rbx
lea rcx, [rsp + 0x120]
call fcn.140066260
mov r13d, eax
test eax, eax
jle 0x1400332b0
mov dword [rsp + 0x58], 1
lea rdi, [rbx - 0x18]
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi + 0x10], 0
jl 0x1400331e9
cmp rax, qword [rdi]
jne 0x1400331e9
mov rbp, rdi
lock add dword [rdi + 0x10], 1
mov rbx, qword [rsp + 0x30]
jmp 0x140033228
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi + 8]
call qword [rax]
mov rbp, rax
test rax, rax
jne 0x140033205
call fcn.1400019f0
int3
mov eax, dword [rdi + 8]
mov dword [rbp + 8], eax
mov eax, dword [rdi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rdi + 0x18]
add rdx, rdx
lea rcx, [rbp + 0x18]
call fcn.140080540
lea rax, [rbp + 0x18]
mov qword [rsp + 0xb8], rax
mov r9d, r13d
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.14002c360
mov dword [rsp + 0x38], eax
mov rbp, qword [rdi]
cmp dword [rdi + 8], 0
je 0x1400332b0
cmp dword [rdi + 0x10], 0
jge 0x140033283
cmp dword [rbx - 0xc], 0
jge 0x140033278
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], 0
jmp 0x1400332b0
mov eax, esi
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003329d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x4c80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14003332d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400333b7
cmp dword [rdx + 0x10], eax
jge 0x1400332ff
cmp dword [rbx - 0xc], eax
jge 0x1400332f3
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], ax
jmp 0x1400333b7
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033316
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x1400333b7
mov ebp, dword [rbx - 0x10]
lea r13, [rsp + 0x4c80]
sub r13, rbx
sar r13, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140033360
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp r13, rbp
ja 0x140033380
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r13*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.140081c40
jmp 0x14003339d
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x4c80]
mov rdx, rbp
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x140033cfe
cmp edi, dword [rbx - 0xc]
jg 0x140033cfe
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], 0
xor eax, eax
mov rcx, rsi
lea rdx, str.inf_
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r15, [rcx - 1]
mov r13, rdx
mov rbp, rdx
sub rbp, rbx
sar rbp, 1
mov r14d, dword [rbx - 0x10]
lea edi, [r14 + rcx - 1]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x140033407
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp rbp, r14
ja 0x140033410
lea r13, [rbx + rbp*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rbx + r14*2]
mov r9, rdx
mov r8, r13
call fcn.140080540
test edi, edi
js 0x140033cf3
cmp edi, dword [rbx - 0xc]
jg 0x140033cf3
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14003346a
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
mov r9d, 1
lea r8, str.Canon
mov rdx, rbx
lea rcx, [rsp + 0x120]
call fcn.140066260
mov r13d, eax
test eax, eax
jle 0x14003364e
mov r14d, 1
lea rbp, [rbx - 0x18]
mov rcx, qword [rbp]
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
cmp dword [rbp + 0x10], 0
jl 0x1400334c4
cmp rax, qword [rbp]
jne 0x1400334c4
mov rdi, rbp
lock add dword [rbp + 0x10], r14d
mov rbx, qword [rsp + 0x30]
jmp 0x140033503
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbp + 8]
call qword [rax]
mov rdi, rax
test rax, rax
jne 0x1400334e0
call fcn.1400019f0
int3
mov eax, dword [rbp + 8]
mov dword [rdi + 8], eax
mov eax, dword [rbp + 8]
add eax, r14d
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rbp + 0x18]
add rdx, rdx
lea rcx, [rdi + 0x18]
call fcn.140080540
lea rax, [rdi + 0x18]
mov qword [rsp + 0xb0], rax
mov r9d, r13d
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.14002c360
test eax, eax
je 0x140033653
cmp dword [rsp + 0x38], 0
jne 0x140033653
test rbx, rbx
je 0x140033563
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
mov r12, rcx
test ecx, ecx
js 0x140033643
cmp r12d, dword [rbx - 0xc]
jg 0x140033643
mov dword [rbx - 0x10], r12d
movsxd rax, r12d
mov word [rbx + rax*2], 0
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14003359b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x80]
call fcn.140067fc8
nop
lea rcx, [rsp + 0x120]
call fcn.1400636d0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400335d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400335f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [rbp + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140033613
mov rcx, qword [rbp]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xc0]
call fcn.140067fc8
nop
lea rcx, [rsp + 0xe8]
call fcn.140067fc8
nop
lea rcx, [rsp + 0x26d0]
call fcn.1400636d0
xor eax, eax
jmp 0x140033d1f
mov ecx, 0x80070057
call fcn.140001000
int3
mov r14d, dword [rsp + 0x58]
test rbx, rbx
jne 0x14003365d
mov ecx, r12d
jmp 0x140033677
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x140033ce8
cmp ecx, dword [rbx - 0xc]
jg 0x140033ce8
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
test r14d, r14d
jne 0x140033b4e
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x64], 0x208
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003370c
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.SystemRoot
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140033764
cmp dword [rdx + 0x10], 0
jge 0x14003373b
cmp dword [rbx - 0xc], 0
jge 0x140033730
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], 0
jmp 0x140033764
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033752
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x4c80]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x1400337e1
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14003386b
cmp dword [rdx + 0x10], eax
jge 0x1400337b3
cmp dword [rbx - 0xc], eax
jge 0x1400337a7
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], ax
jmp 0x14003386b
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400337ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x14003386b
mov ebp, dword [rbx - 0x10]
lea r13, [rsp + 0x4c80]
sub r13, rbx
sar r13, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140033814
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp r13, rbp
ja 0x140033834
movsxd rax, edi
lea rbp, [rax + rax]
lea r8, [rbx + r13*2]
mov r9, rbp
mov rdx, rbp
mov rcx, rbx
call fcn.140081c40
jmp 0x140033851
movsxd rax, edi
lea rbp, [rax + rax]
mov r9, rbp
lea r8, [rsp + 0x4c80]
mov rdx, rbp
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x140033b43
cmp edi, dword [rbx - 0xc]
jg 0x140033b43
mov dword [rbx - 0x10], edi
mov word [rbx + rbp], 0
xor eax, eax
mov rcx, rsi
lea r15, str.inf_
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
mov rbp, r15
sub rbp, rbx
sar rbp, 1
mov r13d, dword [rbx - 0x10]
lea edi, [r13 + rcx - 1]
mov edx, 1
sub edx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, edx
jge 0x1400338b8
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
cmp rbp, r13
ja 0x1400338c1
lea r15, [rbx + rbp*2]
movsxd rdx, r14d
add rdx, rdx
lea rcx, [rbx + r13*2]
mov r9, rdx
mov r8, r15
call fcn.140080540
test edi, edi
js 0x140033b38
cmp edi, dword [rbx - 0xc]
jg 0x140033b38
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14003391b
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140003180
mov rbx, qword [rsp + 0x30]
mov r9d, 1
lea r8, str.Canon
mov rdx, rbx
lea rcx, [rsp + 0x120]
call fcn.140066260
mov r13d, eax
test eax, eax
jle 0x140033afa
lea rbp, [rbx - 0x18]
mov rcx, qword [rbp]
mov rdx, qword [rcx]
call qword [rdx + 0x20]
mov rcx, rax
cmp dword [rbp + 0x10], 0
jl 0x14003396f
cmp rax, qword [rbp]
jne 0x14003396f
mov rdi, rbp
lock add dword [rbp + 0x10], 1
mov rbx, qword [rsp + 0x30]
jmp 0x1400339ae
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbp + 8]
call qword [rax]
mov rdi, rax
test rax, rax
jne 0x14003398b
call fcn.1400019f0
int3
mov eax, dword [rbp + 8]
mov dword [rdi + 8], eax
mov eax, dword [rbp + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rbp + 0x18]
add rdx, rdx
lea rcx, [rdi + 0x18]
call fcn.140080540
lea rax, [rdi + 0x18]
mov qword [rsp + 0xa8], rax
mov r9d, r13d
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.14002c360
test eax, eax
je 0x140033afa
cmp dword [rsp + 0x38], 0
jne 0x140033afa
test rbx, rbx
je 0x140033a0f
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r12d, ecx
test ecx, ecx
js 0x140033aef
cmp r12d, dword [rbx - 0xc]
jg 0x140033aef
mov dword [rbx - 0x10], r12d
movsxd rax, r12d
mov word [rbx + rax*2], 0
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033a47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x80]
call fcn.140067fc8
nop
lea rcx, [rsp + 0x120]
call fcn.1400636d0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033a84
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033aa5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [rbp + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140033abf
mov rcx, qword [rbp]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xc0]
call fcn.140067fc8
nop
lea rcx, [rsp + 0xe8]
call fcn.140067fc8
nop
lea rcx, [rsp + 0x26d0]
call fcn.1400636d0
xor eax, eax
jmp 0x140033d1f
mov ecx, 0x80070057
call fcn.140001000
int3
test rbx, rbx
je 0x140033b18
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r12d, ecx
test ecx, ecx
js 0x140033b2d
cmp r12d, dword [rbx - 0xc]
jg 0x140033b2d
mov dword [rbx - 0x10], r12d
movsxd rax, r12d
mov word [rbx + rax*2], 0
jmp 0x140033b4e
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov eax, dword [rsp + 0x5c]
cmp eax, 2
je 0x140033b60
cmp eax, 3
jne 0x140033c13
mov word [rsp + 0x4e90], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x4e92]
call fcn.140080d50
mov dword [rsp + 0x38], 1
lea r8, [rsp + 0x4c80]
lea rdx, str._sINFDrvData.BIN
lea rcx, [rsp + 0x4e90]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x20
lea rcx, [rsp + 0x4e90]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140033bcd
lea rcx, [rsp + 0x4e90]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x4c80]
lea rdx, str._sINFDrvIDX.BIN
lea rcx, [rsp + 0x4e90]
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x20
lea rcx, [rsp + 0x4e90]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140033c19
lea rcx, [rsp + 0x4e90]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
jmp 0x140033c1d
mov edi, dword [rsp + 0x38]
jmp 0x140033c1d
mov edi, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033c3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x80]
call fcn.140067fc8
nop
lea rcx, [rsp + 0x120]
call fcn.1400636d0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033c7b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140033c9c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140033cbb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xc0]
call fcn.140067fc8
nop
lea rcx, [rsp + 0xe8]
call fcn.140067fc8
nop
lea rcx, [rsp + 0x26d0]
call fcn.1400636d0
mov eax, edi
jmp 0x140033d1f
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov rcx, qword [rsp + 0x50a0]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x50b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret