Function at 0x140007e50
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0xf0
xor esi, esi
xor r14b, r14b
xor r13b, r13b
cmp qword [rcx], rsi
mov rbx, rcx
mov qword [rcx + 0x18], rsi
mov edi, esi
mov dword [r11 + 8], esi
je 0x14000841e
mov rax, qword [rcx + 8]
test rax, rax
je 0x14000841e
mov r15d, 0x8000
cmp rax, r15
ja 0x14000841e
mov qword [r11 + 0x18], r12
add rax, 1
mov r12d, 0x105
cmp rax, r12
cmova r12, rax
lea rcx, [r12 + r12]
call sub.msvcrt.dll_malloc
test rax, rax
mov qword [rbx + 0x18], rax
jne 0x140007ecf
lea eax, [rsi + 0xe]
jmp 0x14000839d
mov r8, r12
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x128], rbp
call sub.msvcrt.dll_memset
cmp qword [rbx + 8], 2
jbe 0x140007f38
mov rdx, qword [rbx]
cmp word [rdx], 0x5c
je 0x140007f38
cmp word [rdx + 2], 0x3a
je 0x140007f38
mov r8, qword [rbx + 0x18]
mov r9, r12
xor ecx, ecx
call fcn.140007b50
test al, al
jne 0x140007f4a
mov rcx, qword [rbx + 0x18]
call sub.msvcrt.dll_free
mov qword [rbx + 0x18], rsi
mov r12, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 2
cmp eax, 0x6f
mov dword [rsp + 0x120], edi
setne r13b
jmp 0x140007f4a
mov r8, qword [rbx]
mov rcx, qword [rbx + 0x18]
mov rdx, r12
call fcn.1400077b0
mov r14b, 1
mov rax, qword [rbx + 0x10]
mov rbp, rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rax
xor eax, eax
test r13b, r13b
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
je 0x140007f98
lea rcx, str.NCPrivateLoadAndValidateMPTDll:_Looking_in_current_directory_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call fcn.140007c70
mov edi, eax
mov dword [rsp + 0x120], eax
jmp 0x140008003
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140008003
mov qword [rsp + 0xe8], rax
xor eax, eax
lea rcx, [rsp + 0x98]
lea r8d, [rax + 0x50]
xor edx, edx
mov byte [rsp + 0x70], sil
mov dword [rsp + 0x74], esi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140007600
lea rcx, [rsp + 0x70]
mov edi, eax
mov dword [rsp + 0x120], eax
call fcn.140007580
cmp edi, 2
je 0x140008014
cmp edi, 0x80092003
jne 0x14000825f
test r14b, r14b
jne 0x14000825f
lea rcx, str.NCPrivateLoadAndValidateMPTDll:_Looking_in_EXE_directory_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x30]
call fcn.1400079f0
test rax, rax
je 0x14000824e
cmp qword [rsp + 0x48], rsi
jne 0x14000815d
mov rdi, qword [rsp + 0x38]
or r14, 0xffffffffffffffff
test rdi, rdi
jne 0x1400080d4
mov r13, qword [rsp + 0x30]
mov esi, 0x104
nop
nop
mov ecx, esi
mov eax, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.14000a810
test rax, rax
mov rdi, rax
mov qword [rsp + 0x38], rax
je 0x14000815d
mov r8d, esi
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, eax
mov ebp, eax
jne 0x1400080c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400080c3
mov rcx, rdi
add esi, esi
call fcn.14000a820
jmp 0x140008070
test ebp, ebp
je 0x140008133
test rdi, rdi
mov dword [rsp + 0x40], ebp
je 0x14000815d
mov dx, 0x5c
mov rcx, rdi
call sub.msvcrt.dll_wcsrchr
test rax, rax
mov rsi, rax
je 0x14000815d
sub rsi, rdi
mov eax, 2
sar rsi, 1
add esi, 1
mov r13d, esi
mul r13
cmovo rax, r14
mov rcx, rax
call fcn.14000a810
test rax, rax
mov rbp, rax
mov qword [rsp + 0x48], rax
je 0x14000815d
add esi, 0xffffffff
mov r8, rdi
mov rdx, r13
mov r9d, esi
mov rcx, rax
call fcn.140007820
test eax, eax
js 0x14000814c
mov dword [rsp + 0x50], esi
jmp 0x14000815d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call fcn.14000a820
mov qword [rsp + 0x38], 0
jmp 0x14000815d
mov rcx, rbp
call fcn.14000a820
mov qword [rsp + 0x48], 0
mov ecx, dword [rsp + 0x50]
mov rax, qword [rbx + 8]
lea rdi, [rcx + rax + 2]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140008178
cmp r12, rdi
jae 0x14000819a
test rcx, rcx
je 0x14000818a
call sub.msvcrt.dll_free
mov qword [rbx + 0x18], 0
lea rcx, [rdi + rdi]
mov r12, rdi
call sub.msvcrt.dll_malloc
mov qword [rbx + 0x18], rax
cmp qword [rbx + 0x18], 0
mov edi, 0xe
je 0x14000828b
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400079f0
mov rcx, qword [rbx + 0x18]
lea r8, str._ls_ls
mov r9, rax
mov rax, qword [rbx]
mov rdx, r12
mov qword [rsp + 0x20], rax
call fcn.140007970
test eax, eax
js 0x140008247
mov rax, qword [rbx + 0x18]
lea r8d, [rdi + 0x42]
lea rcx, [rsp + 0x98]
mov qword [rsp + 0xe8], rax
xor eax, eax
xor edx, edx
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x74], 0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140007600
lea rcx, [rsp + 0x70]
mov edi, eax
call fcn.140007580
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
jmp 0x14000825f
mov edi, 0x6f
jmp 0x14000828b
mov edi, dword [rsp + 0x120]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
cmp edi, 0x80092026
je 0x1400083bd
cmp edi, 0x800b0101
je 0x1400083bd
cmp edi, 0x800b010e
je 0x1400083bd
test edi, edi
je 0x1400083bd
mov rsi, qword [rbx + 0x18]
test rsi, rsi
jne 0x140008297
mov rsi, qword [rbx]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.140007170
test rax, rax
je 0x14000835b
test rsi, rsi
je 0x1400082f1
mov rcx, r15
mov rax, rsi
xor edx, edx
nop
nop
cmp word [rax], dx
je 0x1400082d9
add rax, 2
sub rcx, 1
jne 0x1400082c0
mov edx, 0x80070057
xor r15d, r15d
jmp 0x1400082eb
test rcx, rcx
jne 0x1400082e8
mov edx, 0x80070057
xor r15d, r15d
jmp 0x1400082eb
sub r15, rcx
test edx, edx
jns 0x1400082fd
jmp 0x1400082f6
mov edx, 0x80070057
xor r15d, r15d
test edx, edx
js 0x14000835b
lea rcx, [rsp + 0x30]
call fcn.140007250
lea r12, [r15 + rax + 0x200]
lea rcx, [r12 + r12]
call sub.msvcrt.dll_malloc
test rax, rax
mov rbp, rax
je 0x14000835b
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.140007170
lea r8, str.NotComDllGetInterface:__ls_loading__ls__WinVerifyTrust_failed_with__08x_n
mov rdx, r12
mov rcx, rbp
mov r9, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call fcn.140007970
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbp
call sub.msvcrt.dll_free
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140008371
call sub.msvcrt.dll_free
mov qword [rbx + 0x18], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140008380
call fcn.14000a820
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140008417
call fcn.14000a820
mov eax, edi
mov rbp, qword [rsp + 0x128]
mov r12, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x138]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov rcx, qword [rbx + 0x18]
xor edi, edi
test rcx, rcx
je 0x1400083f8
lea r8d, [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov qword [rbx + 0x20], rax
jne 0x1400083fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x18]
mov edi, eax
call sub.msvcrt.dll_free
mov qword [rbx + 0x18], 0
jmp 0x1400083fd
mov edi, 0x54f
test rbp, rbp
je 0x14000840a
mov rcx, rbp
call fcn.14000a820
test rsi, rsi
je 0x140008417
mov rcx, rsi
call fcn.14000a820
mov eax, edi
jmp 0x140008395
mov eax, 0x57
jmp 0x1400083a5