Function at 0x1400324c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1403ceac0]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor ebx, ebx
mov qword [rcx + 0x18], rbx
xor r13b, r13b
xor r15b, r15b
mov esi, ebx
mov dword [rsp + 0x30], ebx
cmp qword [rcx], rbx
je 0x140032b09
mov rcx, qword [rcx + 8]
lea rax, [rcx - 1]
cmp rax, 0x7fff
ja 0x140032b09
lea rax, [rcx + 1]
mov r14d, 0x105
cmp rax, r14
cmova r14, rax
lea rcx, [r14 + r14]
call fcn.1402c79a8
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x140032554
lea eax, [rbx + 0xe]
jmp 0x140032b0e
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.1402b60e0
cmp qword [rdi + 8], 2
jbe 0x1400325b2
mov rdx, qword [rdi]
cmp word [rdx], 0x5c
je 0x1400325b2
cmp word [rdx + 2], 0x3a
je 0x1400325b2
mov r9, r14
mov r8, qword [rdi + 0x18]
xor ecx, ecx
call fcn.140032130
test al, al
jne 0x1400325c4
mov rcx, qword [rdi + 0x18]
call fcn.1402ba464
mov qword [rdi + 0x18], rbx
mov r14, rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f
setne r15b
mov esi, 2
mov dword [rsp + 0x30], esi
jmp 0x1400325c4
mov r8, qword [rdi]
mov rdx, r14
mov rcx, qword [rdi + 0x18]
call fcn.14003b970
mov r13b, 1
mov r12, qword [rdi + 0x10]
mov qword [rsp + 0x38], r12
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x68], ecx
test r15b, r15b
je 0x14003260f
lea rcx, str.NCPrivateLoadAndValidateMPTDll:_Looking_in_current_directory_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call fcn.1400322d0
mov esi, eax
mov dword [rsp + 0x30], eax
jmp 0x140032692
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x140032692
mov byte [rbp - 0x80], 0
mov dword [rbp - 0x7c], ecx
mov qword [rbp], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.14003b170
mov esi, eax
mov dword [rsp + 0x30], eax
cmp byte [rbp - 0x80], 0
je 0x140032692
mov dword [rbp + 0x10], 0xaac56b
mov dword [rbp + 0x14], 0x11d0cd44
mov dword [rbp + 0x18], 0xc000c28c
mov dword [rbp + 0x1c], 0xee95c24f
mov dword [rbp - 0x28], 2
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
cmp esi, 2
je 0x1400326a3
cmp esi, 0x80092003
jne 0x1400327f9
test r13b, r13b
jne 0x1400327f9
lea rcx, str.NCPrivateLoadAndValidateMPTDll:_Looking_in_EXE_directory_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140031f50
test rax, rax
je 0x1400327eb
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140031f50
mov ecx, dword [rsp + 0x58]
mov rbx, qword [rdi + 8]
add rcx, 2
add rbx, rcx
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x14003270a
cmp r14, rbx
jae 0x14003271a
mov rcx, rax
call fcn.1402ba464
mov qword [rdi + 0x18], 0
mov r14, rbx
lea rcx, [rbx + rbx]
call fcn.1402c79a8
mov qword [rdi + 0x18], rax
mov esi, select
test rax, rax
je 0x1400327df
mov rbx, qword [rdi]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140031f50
mov qword [rsp + 0x20], rbx
mov r9, rax
lea r8, str._ls_ls
mov rdx, r14
mov rcx, qword [rdi + 0x18]
call fcn.14003b790
test eax, eax
js 0x1400327da
mov rax, qword [rdi + 0x18]
mov byte [rbp - 0x80], 0
mov dword [rbp - 0x7c], 0
mov qword [rbp], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.14003b170
mov esi, eax
cmp byte [rbp - 0x80], 0
je 0x1400327ef
mov dword [rbp + 0x10], 0xaac56b
mov dword [rbp + 0x14], 0x11d0cd44
mov dword [rbp + 0x18], 0xc000c28c
mov dword [rbp + 0x1c], 0xee95c24f
mov dword [rbp - 0x28], 2
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
jmp 0x1400327ef
mov esi, reloc.WS2_32.dll_WSAGetLastError
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x140032825
mov esi, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
cmp esi, 0x80092026
je 0x140032aa9
cmp esi, 0x800b0101
je 0x140032aa9
cmp esi, 0x800b010e
je 0x140032aa9
test esi, esi
je 0x140032aa9
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14003283b
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
mov r15d, 0x104
test rbx, rbx
jne 0x1400328b6
mov r14d, r15d
mov rdi, 0xffffffffffffffff
mov ecx, r14d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1402974ec
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, r14d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r13d, eax
cmp r14d, eax
jne 0x1400328a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400328a7
add r14d, r14d
mov rcx, rbx
call fcn.140296f94
mov qword [rsp + 0x40], 0
jmp 0x140032850
test r13d, r13d
mov rdi, qword [rsp + 0x70]
je 0x1400328ea
mov dword [rsp + 0x48], r13d
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140032a91
mov edx, 0x8000
mov ecx, edx
xor r8d, r8d
nop
cmp word [rax], r8w
je 0x1400328ff
add rax, 2
sub rcx, 1
jne 0x1400328d0
xor edx, edx
mov r8d, 0x80070057
jmp 0x140032902
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140296f94
xor ebx, ebx
jmp 0x140032a91
sub rdx, rcx
test r8d, r8d
js 0x140032a91
xor eax, eax
test r8d, r8d
cmovns rax, rdx
mov qword [rbp + 0x10], rax
test rbx, rbx
jne 0x1400329ad
mov r14d, r15d
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
mov ecx, r14d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1402974ec
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, r14d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r13d, eax
cmp r14d, eax
jne 0x140032987
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140032987
add r14d, r14d
mov rcx, rbx
call fcn.140296f94
mov qword [rsp + 0x40], 0
jmp 0x140032930
test r13d, r13d
mov rdi, qword [rsp + 0x70]
je 0x140032998
mov dword [rsp + 0x48], r13d
jmp 0x1400329ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140296f94
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x10]
add rcx, 0x200
add rax, rcx
mov qword [rbp + 0x10], rax
lea rcx, [rax + rax]
call fcn.1402c79a8
mov r13, rax
test rax, rax
je 0x140032a91
test rbx, rbx
jne 0x140032a5c
mov rdi, 0xffffffffffffffff
nop dword [rax]
nop dword [rax + rax]
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1402974ec
mov rbx, rax
mov r8d, r15d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r14d, eax
cmp r15d, eax
jne 0x140032a42
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140032a42
add r15d, r15d
mov rcx, rbx
call fcn.140296f94
mov qword [rsp + 0x40], 0
jmp 0x1400329f0
test r14d, r14d
mov rdi, qword [rsp + 0x70]
jne 0x140032a5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140296f94
xor ebx, ebx
mov dword [rsp + 0x28], esi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.NotComDllGetInterface:__ls_loading__ls__WinVerifyTrust_failed_with__08x_n
mov rdx, qword [rbp + 0x10]
mov rcx, r13
call fcn.14003b790
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, r13
call fcn.1402ba464
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140032ae9
call fcn.1402ba464
mov qword [rdi + 0x18], 0
jmp 0x140032ae9
xor esi, esi
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140032ae4
xor edx, edx
lea r8d, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x140032ae9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [rdi + 0x18]
call fcn.1402ba464
mov qword [rdi + 0x18], 0
jmp 0x140032ae9
mov esi, 0x54f
test rbx, rbx
je 0x140032af6
mov rcx, rbx
call fcn.140296f94
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140032b05
call fcn.140296f94
mov eax, esi
jmp 0x140032b0e
mov eax, 0x57
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140296f70
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret