Function at 0x14004cd80
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, rcx
mov r13d, 0x10
mov ecx, r13d
mov r12, r8
mov r14, rdx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
xor ebx, ebx
test rax, rax
je 0x14004d041
add dword [0x140134854], r13d
lea r9, [0x14012cf68]
mov qword [r14], rax
lea r8, [0x14012d4f8]
mov rdi, qword [r15 + 0xc0]
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call fcn.1400cbdc8
test rax, rax
je 0x14004ce03
mov rsi, qword [rdi + 0x40]
jmp 0x14004ce0a
lea rsi, [0x1400f48cb]
lea rdx, str.IDispatch
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__stricmp]
nop dword [rax + rax]
test eax, eax
jne 0x14004ce29
lea ecx, [rax + 9]
jmp 0x14004ce46
lea rdx, str.IUnknown
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__stricmp]
nop dword [rax + rax]
test eax, eax
jne 0x14004ce52
lea ecx, [rax + 0xd]
mov rax, qword [r14]
mov word [rax + 8], cx
jmp 0x14004d01d
cmp byte [rdi + 0x18], 0x12
jne 0x14004ceb3
mov rax, qword [r14]
mov ecx, 0x1a
mov word [rax + 8], cx
mov rcx, r13
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
je 0x14004d041
mov rcx, qword [r14]
lea r9, str.iid_is
add dword [0x140134854], r13d
xor edx, edx
mov r8d, 0x9a7
mov qword [rcx], rax
mov rax, qword [r14]
mov rcx, qword [rax]
mov eax, 0x18
mov word [rcx + 8], ax
xor ecx, ecx
call fcn.1400c9744
jmp 0x14004d01d
xor edx, edx
lea r9, str.iid_is
xor ecx, ecx
mov r8d, 0x9a7
call fcn.1400c9744
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax + 0x288]
call qword [case.0x1400cd70e.0]
mov rsi, rax
test rax, rax
jne 0x14004cff9
mov ecx, dword [rdi + 0xec]
mov r13d, 0x200
test r13d, ecx
jne 0x14004cf1d
mov rax, qword [0x140134390]
cmp word [rax], 6
jne 0x14004cf1d
or ecx, r13d
mov qword [rdi + 0xd0], rbx
mov dword [rdi + 0xec], ecx
mov qword [rdi + 0xc8], rbx
mov rsi, qword [rdi + 0xd0]
test rsi, rsi
jne 0x14004cff9
mov rax, qword [r15]
mov rcx, r15
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140031018
mov rax, qword [0x140134380]
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x28], 0x10001
mov qword [rbp - 0x20], rbx
mov dword [rbp - 0x18], ebx
movzx ecx, word [rax + 0x66]
mov rax, qword [rdi]
mov word [rbp - 0x14], cx
mov rcx, rdi
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0xc], 4
mov rax, qword [rax + 0xb8]
call qword [case.0x1400cd70e.0]
mov ecx, dword [rdi + 0xec]
mov rsi, rax
mov rdx, qword [0x140134390]
mov eax, ecx
test r13d, ecx
jne 0x14004cfbc
cmp word [rdx], 6
jne 0x14004cfbc
or eax, r13d
mov qword [rdi + 0xd0], rbx
mov dword [rdi + 0xec], eax
mov qword [rdi + 0xc8], rbx
mov rcx, qword [rdi + 0xd0]
test rcx, rcx
je 0x14004cff0
mov rsi, rcx
test r13d, eax
jne 0x14004cff0
cmp word [rdx], 6
jne 0x14004cff0
or eax, r13d
mov qword [rdi + 0xd0], rbx
mov dword [rdi + 0xec], eax
mov rsi, rbx
mov qword [rdi + 0xc8], rbx
lea rcx, [rbp - 0x50]
call fcn.14005668c
mov rax, qword [r14]
mov ecx, 0x1a
mov r8, r12
mov word [rax + 8], cx
mov rcx, rsi
mov rax, qword [rsi]
mov rdx, qword [r14]
mov rax, qword [rax + 0x10]
call qword [case.0x1400cd70e.0]
mov ebx, eax
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3