Function at 0x1400d3200
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor esi, esi
mov r13, r9
mov qword [rbp - 0x40], rsi
mov r14, rdx
mov rax, qword gs:[0x60]
mov edi, esi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
test byte [rax + 3], 2
jne 0x1400d3256
mov esi, 0x80070005
mov ecx, esi
jmp 0x1400d357e
mov rdi, qword [rdx + 8]
test rdi, rdi
je 0x1400d3278
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [0x1403a2250]
mov rcx, rdi
call rbx
mov qword [r14 + 8], rsi
mov rbx, qword [r14 + 0x10]
test rbx, rbx
je 0x1400d32ac
xor edx, edx
mov rcx, rbx
call fcn.14006fecc
lea rcx, [rbx + 8]
call fcn.1400689f4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [r14 + 0x10], rsi
mov rbx, qword [r14 + 0x40]
mov rdi, qword [rbx + 0x18]
test rdi, rdi
je 0x1400d32ff
cmp qword [rdi + 8], rsi
je 0x1400d32e7
lea rdx, [0x14041fec4]
lea rcx, [0x14040137c]
call fcn.1400e7a9c
cmp dword [0x140422760], esi
je 0x1400d32e3
mov rcx, qword [rdi + 8]
call fcn.14017ba20
mov qword [rdi + 8], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx + 0x18], rsi
mov dword [rbx], esi
mov dword [rbx + 0x34], 0xc004f07a
mov dword [rbx + 0x38], esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r12d, reloc.OLEAUT32.dll_SafeArrayGetDim
xor edx, edx
mov rcx, rax
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x1400d3574
lea rdx, [0x14041a210]
mov qword [rax], rsi
lea rcx, [0x140406564]
call fcn.1400e775c
mov qword [r15 + 8], rsi
mov rdi, r15
mov rbx, qword [r14 + 0x18]
test rbx, rbx
je 0x1400d3382
xor edx, edx
mov rcx, rbx
call fcn.140070008
lea rcx, [rbx + 8]
call fcn.140068a98
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [r14 + 0x18], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x1400d3577
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov rsi, qword [0x140421b10]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [0x1403a2250]
lea rax, [rbp - 0x40]
xor r9d, r9d
lea r8, [0x1403a9d58]
mov qword [rsp + 0x20], rax
lea rdx, str.msft:spp_stockobjects_plugins_params_named
mov rcx, rsi
call rbx
mov esi, eax
test eax, eax
jns 0x1400d33f1
mov ecx, eax
call fcn.140078308
jmp 0x1400d3514
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp - 0x38]
call fcn.140051e24
mov esi, eax
test eax, eax
js 0x1400d33e5
mov rbx, qword [rbp - 0x40]
lea rax, str.SppBindingAppId
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x18], 2
mov rax, qword [rbx]
mov rsi, qword [rax + 0x48]
mov rcx, rsi
call qword [0x1403a2250]
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call rsi
mov esi, eax
test eax, eax
jns 0x1400d3463
mov ecx, eax
call fcn.140078308
lea rdx, [0x14041ec24]
lea rcx, [0x140408408]
call fcn.1400e6078
jmp 0x1400d3514
test r13, r13
je 0x1400d34d5
lea rdx, [rbp - 0x28]
mov rcx, r13
call fcn.140051e24
mov esi, eax
test eax, eax
js 0x1400d33e5
lea rax, str.SppBindingSkuId
mov dword [rbp - 0x18], 2
mov qword [rbp - 0x20], rax
lea rdx, [0x14041a4d4]
mov rax, qword [rbp - 0x28]
lea rcx, [0x140408504]
mov qword [rbp - 0x10], rax
call fcn.1400e7410
mov rbx, qword [rbp - 0x40]
mov rax, qword [rbx]
mov rsi, qword [rax + 0x48]
mov rcx, rsi
call qword [0x1403a2250]
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rbx
call rsi
mov esi, eax
test eax, eax
js 0x1400d33e5
mov rax, qword [r14 + 0x40]
lea r9, [rbp - 0x30]
mov rdx, qword [rbp - 0x40]
mov r8, r12
mov rcx, qword [rbp + 0x40]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.140084f80
mov esi, eax
test eax, eax
js 0x1400d33e5
mov rax, qword [rbp - 0x30]
and qword [rbp - 0x30], 0
xor edi, edi
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], r12
test esi, esi
jns 0x1400d3522
cmp dword [rbp + 0x60], 1
jne 0x1400d352e
mov rdx, qword [rbp - 0x38]
mov r8, r12
call fcn.1400d8ac4
mov rax, qword [r14 + 0x18]
cmp dword [rax + 4], 0
jne 0x1400d3583
lea rdx, [0x14041ccf8]
lea rcx, [0x1403fe500]
call fcn.1400e7de0
cmp dword [rbp + 0x60], 1
jne 0x1400d3583
and qword [rsp + 0x28], 0
mov ecx, 2
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, esi
mov edx, 0x80000405
call fcn.140052c50
jmp 0x1400d3583
mov rdi, rsi
mov ecx, 0x8007000e
mov esi, ecx
call fcn.140078308
mov ecx, esi
call fcn.140078324
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400d3599
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400d35a8
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400d35d4
xor edx, edx
mov rcx, rdi
call fcn.14006fecc
lea rcx, [rdi + 8]
call fcn.1400689f4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x1400d35f7
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403a2250]
mov rcx, rbx
call rdi
and qword [rbp - 0x40], 0
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x1400d3615
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403a2250]
mov rcx, rbx
call rdi
mov eax, esi
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret