Function at 0x14000db88
Capabilities:
Get file attributes
Query environment variable
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2d0
mov rax, qword [0x14006f5c0]
xor rax, rsp
mov qword [rbp + 0x1c8], rax
xor r15d, r15d
mov r12, rdx
mov r14d, r15d
mov dword [rbp - 0x60], r15d
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000e95b
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdx, [rsp + 0x60]
xor ecx, ecx
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.14001bfb4
or rdi, 0xffffffffffffffff
test eax, eax
je 0x14000dc13
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14000e8fe
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, 0x100080
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, rdi
jne 0x14000dc50
call fcn.14001b570
mov esi, eax
jmp 0x14000e8fe
mov esi, 4
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x88]
mov dword [rsp + 0x20], esi
mov rcx, rbx
lea r9d, [rsi + 0x24]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
je 0x14000dcaa
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
movzx esi, ax
mov rcx, rbx
or esi, 0x80070000
test eax, eax
cmovle esi, eax
call qword [fcn.140037368]
test eax, eax
jne 0x14000e8fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000e8fe
mov rcx, qword [rbp + 0x1b8]
movabs rax, 0x10c388d000
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x1b8], rcx
sar rax, 0x20
mov dword [rbp + 0x10], ecx
mov rcx, rbx
mov dword [rbp + 0x14], eax
call qword [fcn.140037368]
test eax, eax
jne 0x14000dce5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov rcx, rax
test rax, rax
jne 0x14000dd02
mov esi, 0x80004005
jmp 0x14000e8fe
mov rax, qword [rsp + 0x60]
sub rcx, rax
sar rcx, 1
lea edx, [rcx - 1]
test edx, edx
js 0x14000e950
cmp edx, dword [rax - 0xc]
jg 0x14000e950
mov dword [rax - 0x10], edx
mov rax, qword [rsp + 0x60]
movsxd rcx, ecx
mov word [rax + rcx*2 - 2], r15w
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000e95b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea r8, str.WindowsSystem32_ntdll.dll
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x58]
call fcn.140010bd8
mov rcx, qword [rax]
call fcn.14001c18c
mov rdx, qword [rbp + 0x58]
mov ebx, eax
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14000dd8f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
cmp ebx, 9
jne 0x14000e8db
lea r8, str.WindowsSystem32downlevel_
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x18]
call fcn.140010bd8
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14001a3e0
mov rdx, qword [rbp + 0x18]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14000ddd7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000e95b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea r8, str.WindowsSystem32configSOFTWARE
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x20]
call fcn.140010bd8
lea rdx, [rbp - 0x30]
mov rcx, qword [rax]
call fcn.14000da40
mov rdx, qword [rbp + 0x20]
mov ebx, eax
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14000de38
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test ebx, ebx
je 0x14000de4f
movzx esi, bx
or esi, 0x80070000
test ebx, ebx
cmovle esi, ebx
jmp 0x14000e8bb
lea rax, fcn.1400129b0
mov qword [rbp + 0x198], r15
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0x160]
lea rax, [rbp - 0x30]
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0xa0]
lea rax, [rbp + 0xa0]
mov qword [rbp + 0xd8], rax
call fcn.1400129b0
mov rcx, qword [rbp + 0xd8]
mov qword [rbp + 0x198], rax
test rcx, rcx
je 0x14000debd
mov rax, qword [rcx]
lea rdx, [rbp + 0xa0]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0xd8], r15
lea r8, str.MicrosoftWindowsCurrentVersionComponent_Based_Servicing
mov qword [rsp + 0x78], r15
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x28]
call fcn.140010bd8
lea rcx, [rsp + 0x78]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov r8d, esi
mov rcx, 0xffffffff80000002
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rbp + 0x28]
mov ecx, edi
add rdx, 0xffffffffffffffe8
mov ebx, eax
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14000df1a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
test ebx, ebx
je 0x14000df31
movzx esi, bx
or esi, 0x80070000
test ebx, ebx
cmovle esi, ebx
jmp 0x14000e865
call fcn.140001b5c
mov rcx, rax
test rax, rax
je 0x14000e95b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rcx, [rbp + 0x60]
mov qword [rbp - 0x68], rax
lea rax, [rsp + 0x78]
mov qword [rbp + 0x60], rax
lea rax, [rbp - 0x68]
mov qword [rbp + 0x68], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x70], rax
call fcn.14000e974
test eax, eax
je 0x14000df8a
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14000e847
mov rax, qword [rbp - 0x68]
movsxd rcx, dword [rax - 0x10]
lea edx, [rcx - 1]
test edx, edx
js 0x14000e950
cmp edx, ecx
jg 0x14000e950
mov edx, 0x5c
cmp word [rax + rcx*2 - 2], dx
je 0x14000dfba
lea rcx, [rbp - 0x68]
call fcn.14001a668
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x14000e08d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x50]
call fcn.14001a8f4
mov edx, 0x3b
lea rcx, [rbp - 0x50]
call fcn.14001a668
mov rbx, qword [rbp - 0x50]
lea r13, [0x14005ce40]
xor r8d, r8d
xor edx, edx
mov rcx, r13
movsxd r15, dword [rbx - 0x10]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
mov esi, eax
test eax, eax
je 0x14000e064
lea edi, [rax + r15]
test edi, edi
js 0x14000e950
mov ecx, dword [rbx - 0xc]
lea edx, [r8 + 1]
sub edx, dword [rbx - 8]
sub ecx, edi
or ecx, edx
jge 0x14000e03b
mov edx, edi
lea rcx, [rbp - 0x50]
call fcn.1400020a8
mov rbx, qword [rbp - 0x50]
xor r8d, r8d
cmp edi, dword [rbx - 0xc]
jg 0x14000e950
movsxd rax, edi
lea rdx, [rbx + r15*2]
mov dword [rbx - 0x10], edi
mov rcx, r13
mov word [rbx + rax*2], r8w
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
or rdi, 0xffffffffffffffff
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
xor r15d, r15d
test eax, eax
jg 0x14000e08d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14005bcc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e0b5
mov rcx, qword [rbp - 0x68]
call rax
lea r8, str.CbsCore.dll
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x30]
call fcn.140010bd8
xor edx, edx
mov rcx, qword [rax]
lea r8d, [rdx + 8]
call qword [fcn.140037af0]
mov rdx, qword [rbp + 0x30]
mov rbx, rax
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14000e0f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test rbx, rbx
jne 0x14000e10a
call fcn.14001b570
mov esi, eax
jmp 0x14000e82f
lea rdx, str.CbsCoreInitialize
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CbsCoreFinalize
mov rcx, rbx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 8], rax
test r13, r13
je 0x14000e82a
test rax, rax
je 0x14000e82a
lea rax, fcn.140012990
mov qword [rbp + 0x158], r15
mov qword [rbp + 0xe0], rax
lea rdx, [rbp + 0x120]
lea rax, [rbp + 8]
mov qword [rbp + 0xe8], rax
lea rcx, [rbp + 0xe0]
lea rax, [rbp + 0xe0]
mov qword [rbp + 0x118], rax
call fcn.140012990
mov rcx, qword [rbp + 0x118]
mov qword [rbp + 0x158], rax
test rcx, rcx
je 0x14000e1b1
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x118], r15
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x78]
call fcn.14001a8f4
mov r8, rax
lea rcx, [0x14006f660]
mov rdx, r13
call fcn.140008960
mov esi, eax
test eax, eax
jne 0x14000e29c
mov rcx, qword [0x14006f770]
lea r8, [rbp - 0x38]
xorps xmm0, xmm0
mov qword [rbp - 0x70], r15
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x38], r15
mov edx, 0x130
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rbp - 0x38]
mov esi, eax
test eax, eax
js 0x14000e219
test rcx, rcx
jne 0x14000e2e1
mov esi, 0x80004003
test rcx, rcx
je 0x14000e224
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [rbp - 0x80]
test rdi, rdi
je 0x14000e298
mov r14, qword [rbp - 0x78]
cmp rdi, r14
je 0x14000e260
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e253
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rdi, 8
cmp rdi, r14
jne 0x14000e236
mov rdi, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x70]
mov rax, rdi
sub rdx, rdi
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14000e290
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e966
mov rcx, rdi
call fcn.14003b3dc
or rdi, 0xffffffffffffffff
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x14000e96c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x14000e82f
mov rax, qword [rcx]
lea rdx, [rbp + 0x120]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x158], r15
jmp 0x14000e82f
mov rax, qword [rcx]
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x18]
mov edx, 1
call qword [rax + 0x18]
test eax, eax
jne 0x14000e689
mov rdi, qword [rbp + 0x10]
mov rcx, qword [0x14006f770]
lea rdx, [rbp - 0x48]
mov r8, qword [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x68], r15
mov qword [rbp - 0x48], r15
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [rax + 0x30]
mov rcx, qword [rbp - 0x48]
mov esi, eax
test eax, eax
js 0x14000e349
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
lea rdx, [0x14005cc00]
call qword [rax]
mov rcx, qword [rbp - 0x48]
mov esi, eax
test rcx, rcx
je 0x14000e354
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
test esi, esi
js 0x14000e655
test rcx, rcx
je 0x14000e660
mov qword [rbp - 0x58], r15
lea r8, [rbp - 0x58]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x20]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14000e650
cmp word [rcx], r15w
je 0x14000e650
mov r8d, 0xc
lea rdx, str.Package_for_
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x14000e650
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 8]
mov qword [rbp - 8], r15
mov edx, 0xb
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14000e3e5
lea rdx, [0x14005bd3c]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x14000e650
mov rcx, qword [rsp + 0x68]
lea r8, [rbp]
mov qword [rbp - 0x40], r15
mov edx, 0x11
mov qword [rbp], r15
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x14000e436
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000e436
cmp word [rcx], r15w
je 0x14000e436
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x3c]
lea rdx, [0x14005bd40]
call fcn.140015560
cmp eax, 2
je 0x14000e5f2
jmp 0x14000e650
lea rdx, str.PackagesPending_
mov qword [rsp + 0x70], r15
lea rcx, [rbp + 0x50]
or r14d, 3
call fcn.1400022c8
mov r8, qword [rbp - 0x58]
lea rcx, [rbp + 0x48]
mov rdx, rax
call fcn.140010bd8
lea rcx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov r8d, 4
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000e4d3
lea rdx, str.Packages_
or r14d, 0xc
lea rcx, [rbp + 0x40]
call fcn.1400022c8
mov r8, qword [rbp - 0x58]
lea rcx, [rbp + 0x38]
mov rdx, rax
call fcn.140010bd8
lea rcx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov r8d, 4
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e4d6
mov r15b, 1
test r14b, 8
je 0x14000e4fe
mov rdx, qword [rbp + 0x38]
and r14d, 0xfffffff7
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e4fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test r14b, 4
je 0x14000e526
mov rdx, qword [rbp + 0x40]
and r14d, 0xfffffffb
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e526
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x48]
and r14d, 0xfffffffd
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e548
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x50]
and r14d, 0xfffffffe
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e56a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test r15b, r15b
je 0x14000e5d5
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
xor r15d, r15d
mov qword [rsp + 0x50], r15
xor r9d, r9d
mov qword [rsp + 0x48], r15
xor r8d, r8d
mov qword [rsp + 0x40], r15
xor edx, edx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14000e5d8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000e650
call qword [0x140057c38]
neg eax
sbb rcx, rcx
and qword [rsp + 0x70], rcx
jmp 0x14000e650
xor r15d, r15d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000e5f2
call qword [0x140057c38]
neg eax
sbb rcx, rcx
and qword [rsp + 0x70], rcx
cmp rdi, qword [rbp - 0x40]
ja 0x14000e650
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x20]
call fcn.1400022c8
mov rax, qword [rbp - 0x78]
cmp qword [rbp - 0x70], rax
je 0x14000e622
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.14001a8f4
add qword [rbp - 0x78], 8
jmp 0x14000e632
lea r8, [rbp - 0x20]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14001205c
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e650
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000e660
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x38]
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x18]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
je 0x14000e300
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000e698
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r14, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x80]
mov rax, r14
sub rax, rdi
test rax, 0xfffffffffffffff8
je 0x14000e7e8
mov ecx, 0x30
call fcn.1400408f4
mov rcx, qword [rbp - 0x78]
lea rdx, [0x14005cfd8]
sub rcx, qword [rbp - 0x80]
mov rdi, rax
lea rax, [0x14005cd90]
sar rcx, 3
mov qword [rdi], rax
lea rax, [0x14000b260]
mov qword [rdi + 0x10], rax
mov dword [rdi + 8], 1
mov qword [rdi], rdx
mov qword [rdi + 0x18], r12
mov dword [rdi + 0x20], r15d
mov dword [rdi + 0x24], ecx
mov dword [rdi + 0x28], r15d
mov rax, qword [rbp - 0x78]
sub rax, qword [rbp - 0x80]
test rax, 0xfffffffffffffff8
je 0x14000e7d5
xor r14d, r14d
lea rdx, [rsp + 0x60]
mov dword [rdi + 0x20], r15d
lea rcx, [rbp + 0x80]
mov r12d, esi
call fcn.14001a8f4
mov r8, rax
lea rcx, [0x14006f660]
mov rdx, r13
call fcn.140008960
mov esi, eax
test eax, eax
jne 0x14000e7a0
mov rax, qword [rbp - 0x80]
lea r8, [rbp - 0x10]
and qword [rbp - 0x10], 0
lea rcx, [0x14006f660]
mov rdx, qword [r14 + rax]
call fcn.140008c14
mov esi, eax
test eax, eax
jne 0x14000e791
mov rcx, qword [rbp - 0x10]
lea edx, [rsi + 5]
mov r9, rdi
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x58]
mov esi, eax
test eax, eax
js 0x14000e791
lea rcx, [0x14006f660]
call fcn.140008cd8
mov esi, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14000e7a0
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [0x14006f770], 0
jne 0x14000e7ad
call qword [rbp + 8]
mov rcx, qword [rbp - 0x78]
test esi, esi
cmove esi, r12d
sub rcx, qword [rbp - 0x80]
inc r15d
sar rcx, 3
movsxd rax, r15d
add r14, 8
cmp rax, rcx
jne 0x14000e717
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x10]
mov r14, qword [rbp - 0x78]
xor r15d, r15d
mov rdi, qword [rbp - 0x80]
jmp 0x14000e7ed
mov esi, 1
test rdi, rdi
je 0x14000e298
cmp rdi, r14
je 0x14000e260
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e81c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rdi, 8
cmp rdi, r14
jne 0x14000e7ff
jmp 0x14000e25c
mov esi, 0x80004002
test rbx, rbx
je 0x14000e847
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x14000e847
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp - 0x68]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14000e865
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000e87f
call qword [0x140057c38]
neg eax
sbb rcx, rcx
and qword [rsp + 0x78], rcx
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x14000e96c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x14000e8bb
mov rax, qword [rcx]
lea rdx, [rbp + 0x160]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x198], r15
mov rdx, qword [rbp - 0x30]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14000e8e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14000e8e0
mov esi, 0x80004002
mov rdx, qword [rbp - 0x28]
mov eax, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14000e8fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x60]
mov ecx, edi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14000e91e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, esi
mov rcx, qword [rbp + 0x1c8]
xor rcx, rsp
call fcn.1400408d0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002198
int3
mov ecx, 0x80004005
call fcn.140002198
int3
call fcn.140042010
int3
call fcn.1400398f8
int3