Function at 0x14009e204
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa0
mov rsi, rcx
mov r14d, edx
lea rcx, str.hid________pgISIQlzapCL
mov dword [rbp - 0x11], SQLAllocHandle
mov rbx, r9
mov dword [rbp - 0xd], 0x11
mov rdi, r8
mov dword [rbp - 9], SQLAllocHandle
mov dword [rbp - 0x49], 0x5b0020
mov dword [rbp - 0x45], 0x730025
mov dword [rbp - 0x41], 0x20005d
mov dword [rbp - 0x3d], 0x770025
mov dword [rbp - 0x39], 0x20005a
mov dword [rbp - 0x35], 0x3e002d
mov dword [rbp - 0x31], 0x250020
mov dword [rbp - 0x2d], 0x5a0077
mov dword [rbp - 0x29], 0xa
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140122ff0]
lea rcx, str.hid________VZ8WzIqhMJ7n
movups xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], SQLGetData
mov qword [rbp + 0x1b], Ordinal_36
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r12, qword [rbp + 0x7f]
lea rcx, [rbp - 0x49]
mov r13, qword [rbp + 0x77]
mov r9, r12
mov r8, r13
mov rdx, rbx
call fcn.14000b314
test rsi, rsi
je 0x14009e44b
test r14d, r14d
je 0x14009e579
mov qword [rbp + 0x57], r14
lea rbx, [rsi + 0xc]
lea r14, str.unknown_
mov edi, 3
lea r13, str.NONE
lea r15, str.___u__
lea rcx, str.____
call fcn.14000b314
test rsi, rsi
je 0x14009e335
lea rdx, [rbp - 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x14009e335
lea rcx, [rbp - 1]
call fcn.1400116ac
cmp dword [rbx - 4], 4
jae 0x14009e345
mov eax, dword [rbx - 4]
mov rdx, qword [r13 + rax*8]
jmp 0x14009e348
mov rdx, r14
lea rax, str.____s__
mov rcx, r15
cmovb rcx, rax
call fcn.14000b314
mov edx, dword [rbx]
mov r8d, 1
mov rcx, qword [rbx + 4]
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
cmp dword [rbx - 4], 2
jne 0x14009e433
xor eax, eax
mov ecx, 0x40
mov word [rbp - 0x59], ax
mov rax, qword [rbp + 0x77]
movzx eax, word [rax]
add ax, word [r12]
add ax, word [reloc.WLDAP32.dll_Ordinal_12]
movzx edx, ax
mov word [rbp - 0x57], dx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x14009e433
mov rdx, qword [rbp + 0x77]
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
lea rdx, [0x140131b40]
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov rdx, r12
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
movzx eax, word [rbx]
lea r12, [rbp - 0x11]
mov word [rbp - 0x1f], ax
mov r13, rdi
mov word [rbp - 0x21], ax
mov rax, qword [rbx + 4]
mov qword [rbp - 0x19], rax
mov ecx, dword [r12]
lea r8, [rbp - 0x59]
mov r9d, 0x1000
lea rdx, [rbp - 0x21]
call fcn.140092384
lea r12, [r12 + 4]
sub r13, 1
jne 0x14009e3fc
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, qword [rbp + 0x7f]
lea r13, str.NONE
add rsi, 0x18
add rbx, 0x18
sub qword [rbp + 0x57], 1
jne 0x14009e30a
jmp 0x14009e579
test rdi, rdi
je 0x14009e579
lea rcx, [rbp + 7]
call fcn.14000b314
lea rdx, [rbp + 0x57]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x14009e477
lea rcx, [rbp + 0x57]
call fcn.1400116ac
cmp dword [rdi + 8], 4
jae 0x14009e492
mov eax, dword [rdi + 8]
lea r13, str.NONE
mov r14, qword [r13 + rax*8]
mov r13, qword [rbp + 0x77]
jmp 0x14009e499
lea r14, str.unknown_
lea rax, str.____s__
mov rdx, r14
lea rcx, str.___u__
cmovb rcx, rax
call fcn.14000b314
mov edx, dword [rdi + 0xc]
lea rbx, [rdi + 0x10]
mov rcx, rbx
mov r8d, 1
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
cmp dword [rdi + 8], 2
jne 0x14009e579
movzx eax, word [r13]
xor esi, esi
add ax, word [r12]
add ax, word [reloc.WLDAP32.dll_Ordinal_12]
movzx edx, ax
lea ecx, [rsi + 0x40]
mov word [rbp - 0x57], dx
mov word [rbp - 0x59], si
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x51], rax
test rax, rax
je 0x14009e579
mov rdx, r13
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
lea rdx, [0x140131b40]
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov rdx, r12
lea rcx, [rbp - 0x59]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
movzx eax, word [rdi + 0xc]
lea edi, [rsi + 3]
mov qword [rbp - 0x19], rbx
lea rbx, [rbp - 0x11]
mov word [rbp - 0x1f], ax
mov word [rbp - 0x21], ax
mov ecx, dword [rbx]
lea r8, [rbp - 0x59]
mov r9d, 0x1000
lea rdx, [rbp - 0x21]
call fcn.140092384
lea rbx, [rbx + 4]
sub rdi, 1
jne 0x14009e550
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret