Function at 0x140093140
Capabilities:
Persist via active setup registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x26a0]
mov eax, 0x27a0
call fcn.140247340
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x27e0], rbx
mov r14, rcx
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1400b2890
mov rbx, rax
mov qword [rsp + 0x40], rax
lea r15, vtable.._AVCKeyToScan__1__ScanActiveSetupInstalledComponents_CSASScanner__QEAAXXZ_.0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 0xffffffff80000002
lea rax, [0x14029af58]
mov qword [rbp - 0x70], rax
mov rdi, qword [rbx + 8]
lea r9, [rbp - 0x80]
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14007a610
movabs r13, 0x666666666666665
mov rcx, r13
mov rdx, qword [rsp + 0x48]
sub rcx, rdx
cmp rcx, 1
jb 0x140093eac
inc rdx
mov qword [rsp + 0x48], rdx
mov qword [rbx + 8], rax
mov qword [rdi], rax
mov edi, esi
mov qword [rbp + 0x26f8], rsi
mov r10, qword [r14 + 0x28]
mov eax, dword [r14 + 0x14e4]
or eax, 0x20019
lea rcx, [rbp + 0x26f8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffff80000003
lea rcx, [r14 + 0x28]
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140093391
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0xe80]
call fcn.140249b10
cmp dword [r14 + 0x127c], esi
jne 0x14009337f
mov rax, qword [r14 + 0x28]
mov dword [rsp + 0x20], 0x410
lea r9, [rbp + 0xe80]
mov r8d, edi
mov rdx, qword [rbp + 0x26f8]
lea rcx, [r14 + 0x28]
call qword [rax + 0x30]
test eax, eax
jne 0x14009337f
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x16a0]
call fcn.140249b10
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0xe80]
mov byte [rbp + rcx + 0x16a0], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400932b0
lea rcx, [rbp + 0x16a0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400932d1
movups xmm0, xmmword [str.SOFTWAREMicrosoftActive_SetupInstalled_Components]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x14029afa0]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x14029afb0]
movups xmmword [rcx + 0x20], xmm0
mov eax, dword [0x14029afc0]
mov dword [rcx + 0x30], eax
movzx eax, word [reloc.WSOCK32.dll_WSAStartup]
mov word [rcx + 0x34], ax
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 0xffffffff80000001
lea rax, [rbp + 0x16a0]
mov qword [rsp + 0x78], rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14007a610
mov rcx, r13
mov rdx, qword [rsp + 0x48]
sub rcx, rdx
cmp rcx, 1
jb 0x140093e8b
inc rdx
mov qword [rsp + 0x48], rdx
mov qword [rbx + 8], rax
mov qword [rsi], rax
inc edi
cmp dword [r14 + 0x127c], 0
mov esi, 0
je 0x140093262
mov rax, qword [r14 + 0x28]
mov rdx, qword [rbp + 0x26f8]
lea rcx, [r14 + 0x28]
call qword [rax + 0x28]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsi]
cmp dword [r14 + 0x127c], 0
jne 0x140093e2a
lea r15, str.KeyFileName
nop
cmp rbx, rsi
je 0x140093e2a
xor edi, edi
mov r13d, edi
mov qword [rbp + 0x26f0], rdi
mov r10, qword [r14 + 0x28]
mov eax, dword [r14 + 0x14e4]
or eax, 0x20019
lea rcx, [rbp + 0x26f0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x18]
lea rcx, [r14 + 0x28]
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140093e19
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x1290]
call fcn.140249b10
cmp dword [r14 + 0x127c], edi
jne 0x140093e07
mov rax, qword [r14 + 0x28]
mov dword [rsp + 0x20], 0x410
lea r9, [rbp + 0x1290]
mov r8d, r13d
mov rdx, qword [rbp + 0x26f0]
lea rcx, [r14 + 0x28]
call qword [rax + 0x30]
test eax, eax
jne 0x140093e02
mov edx, 0xffffffff
mov rcx, qword [r14 + 0x1290]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x60], rdi
mov r10, qword [r14 + 0x28]
mov eax, dword [r14 + 0x14e4]
or eax, 0x20019
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
lea r8, [rbp + 0x1290]
mov rdx, qword [rbp + 0x26f0]
lea rcx, [r14 + 0x28]
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140093df1
lea rsi, str.StubPath
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rdi
mov r15d, edi
nop dword [rax]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x16a0]
call fcn.140249b10
mov dword [rbp + 0x26e8], 0x1000
mov rax, qword [r14 + 0x28]
lea rcx, [rbp + 0x26e8]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x16a0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rsi
mov rdx, qword [rsp + 0x60]
lea rcx, [r14 + 0x28]
call qword [rax + 0x60]
test eax, eax
jne 0x140093dcb
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rax - 1]
lea r8, [rbp + 0x16a0]
xor edx, edx
lea ecx, [rax + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea edx, [rax - 1]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rsi, rax
test rax, rax
je 0x140093576
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp + 0x16a0]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
jne 0x140093e98
mov qword [rbp - 0x60], rsi
test rsi, rsi
je 0x140093ea1
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0xe80]
call fcn.140249b10
mov qword [rsp + 0x28], 0x410
lea rax, [rbp + 0xe80]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rbp + 0x16a0]
xor edx, edx
mov rcx, r14
call fcn.140092b20
mov rcx, qword [r14 + 0x12d8]
test rcx, rcx
je 0x1400935e7
mov rax, qword [rcx]
mov r9d, 2
lea r8, [rbp + 0xe80]
mov edx, 0x400
call qword [rax + 0x20]
lea rcx, [rbp + 0x830]
call fcn.1400270b0
nop
mov dword [rbp + 0x8b0], 1
mov rcx, qword [rbp + 0x868]
test rcx, rcx
je 0x140093618
call fcn.140247060
xor eax, eax
mov qword [rbp + 0x868], rax
lea rcx, [rbp + 0xe80]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140093626
mov dword [rbp + 0x870], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x868], rax
test rax, rax
je 0x140093662
mov r8d, dword [rbp + 0x870]
inc r8d
lea rdx, [rbp + 0xe80]
mov rcx, rax
call fcn.1402496a0
mov rdi, qword [rbx + 0x20]
mov rcx, qword [rbp + 0x8e8]
test rcx, rcx
je 0x140093682
call fcn.140247060
xor eax, eax
mov qword [rbp + 0x8e8], rax
jmp 0x140093684
xor eax, eax
test rdi, rdi
je 0x1400936ca
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x140093690
mov dword [rbp + 0x8f0], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x8e8], rax
test rax, rax
je 0x1400936ea
mov r8d, dword [rbp + 0x8f0]
inc r8d
mov rdx, rdi
mov rcx, rax
call fcn.1402496a0
jmp 0x1400936ea
mov dword [rbp + 0x8f0], eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x8e8], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x18]
cmp rax, 0xffffffff80000000
jne 0x140093701
lea rdi, [0x14028be38]
xor eax, eax
jmp 0x14009373d
cmp rax, 0xffffffff80000002
jne 0x140093714
lea rdi, str.HKEY_LOCAL_MACHINE
xor eax, eax
jmp 0x14009373d
cmp rax, 0xffffffff80000001
jne 0x140093727
lea rdi, str.HKEY_CURRENT_USER
xor eax, eax
jmp 0x14009373d
lea rdi, str.HKEY_USERS
cmp rax, 0xffffffff80000003
mov eax, 0
cmovne rdi, rax
mov rcx, qword [rbp + 0x918]
test rcx, rcx
je 0x140093757
call fcn.140247060
xor eax, eax
mov qword [rbp + 0x918], rax
test rdi, rdi
je 0x14009379d
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x140093763
mov dword [rbp + 0x920], eax
lea ecx, [rax + 1]
call fcn.140247068
mov qword [rbp + 0x918], rax
test rax, rax
je 0x1400937bd
mov r8d, dword [rbp + 0x920]
inc r8d
mov rdx, rdi
mov rcx, rax
call fcn.1402496a0
jmp 0x1400937bd
mov dword [rbp + 0x920], eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x918], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov eax, dword [r14 + 0x14e8]
mov dword [rbp + 0x98c], eax
xor r9d, r9d
lea r8, [rbp + 0x830]
mov rdx, qword [rbp + 0x868]
mov rcx, r14
call fcn.1400876f0
inc dword [r14 + 0x12a0]
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
mov eax, dword [r14 + 0x12c4]
mov dword [rsp + 0x20], eax
lea r9, [r14 + 0x13e0]
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0x830]
mov rcx, qword [r14 + 0x12c8]
call fcn.140017e00
test eax, eax
jne 0x1400938d0
xor eax, eax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 1
mov eax, dword [r14 + 0x12c4]
mov dword [rsp + 0x20], eax
lea r9, [r14 + 0x13e0]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x830]
mov rcx, qword [r14 + 0x12c8]
call fcn.140017e00
test eax, eax
je 0x140093dac
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400938d0
lea rcx, [rbp - 0x50]
call fcn.1400279f0
nop
lea rdx, [rbp + 0x830]
lea rcx, [rbp - 0x40]
call fcn.1400284d0
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x608]
call fcn.14000db90
xor edi, edi
mov dword [rbp + 0x40], edi
mov qword [rbp + 0x48], rdi
lea rcx, [rbp - 0x50]
call fcn.1400283f0
jmp 0x1400938d2
xor edi, edi
lea rax, vtable.CSASDescriptor.0
mov qword [rbp - 0x50], rax
lea rax, vtable.CSASDescriptor.1.0
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x40]
call fcn.1400270b0
nop
lea rcx, [rbp + 0x608]
call fcn.14000cb90
nop
lea rax, vtable.CSABString.0
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x7d0], rdi
mov dword [rbp + 0x7d8], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x7d0], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x7dc], 1
lea rax, vtable.CSABString.0
mov qword [rbp + 0x7e0], rax
mov qword [rbp + 0x7e8], rdi
mov dword [rbp + 0x7f0], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x7e8], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x7f4], 1
lea rax, vtable.CSABString.0
mov qword [rbp + 0x7f8], rax
mov qword [rbp + 0x800], rdi
mov dword [rbp + 0x808], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x800], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rbp + 0x80c], 1
mov dword [rbp + 0x7b8], edi
mov qword [rbp + 0x7c0], rdi
mov qword [rbp + 0x818], rdi
lea rdx, [rbp + 0x830]
lea rcx, [rbp - 0x40]
call fcn.1400284d0
mov dword [rbp + 0x40], edi
mov qword [rbp + 0x48], rdi
mov rdi, qword [rsp + 0x58]
lea rdx, [rdi + 8]
lea rcx, [rbp + 0x610]
call fcn.140004780
lea rdx, [rdi + 0x20]
lea rax, [rbp + 0x628]
cmp rax, rdx
je 0x140093a22
mov rdx, qword [rdx]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [rbp + 0x628]
call fcn.14000bbb0
lea rdx, [rdi + 0x30]
lea rax, [rbp + 0x638]
cmp rax, rdx
je 0x140093a47
mov rdx, qword [rdx]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [rbp + 0x638]
call fcn.14000bbb0
lea rdx, [rdi + 0x50]
lea rax, [rbp + 0x658]
cmp rax, rdx
je 0x140093a6c
mov rdx, qword [rdx]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [rbp + 0x658]
call fcn.14000bbb0
lea rdx, [rdi + 0x40]
lea rax, [rbp + 0x648]
cmp rax, rdx
je 0x140093a91
mov rdx, qword [rdx]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [rbp + 0x648]
call fcn.14000bbb0
mov eax, dword [rdi + 0x70]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140093aca
cmp eax, 0xffffffff
jne 0x140093ab9
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140093ab0
mov dword [rbp + 0x678], eax
mov qword [rbp + 0x670], rcx
xor edx, edx
jmp 0x140093ad9
xor edx, edx
mov dword [rbp + 0x678], edx
mov qword [rbp + 0x670], rdx
mov eax, dword [rdi + 0x88]
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x140093b0f
cmp eax, 0xffffffff
jne 0x140093b00
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140093af7
mov dword [rbp + 0x690], eax
mov qword [rbp + 0x688], rcx
jmp 0x140093b1c
mov dword [rbp + 0x690], edx
mov qword [rbp + 0x688], rdx
mov eax, dword [rdi + 0xa0]
mov rcx, qword [rdi + 0x98]
test rcx, rcx
je 0x140093b58
cmp eax, 0xffffffff
jne 0x140093b49
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140093b40
mov dword [rbp + 0x6a8], eax
mov qword [rbp + 0x6a0], rcx
jmp 0x140093b65
mov dword [rbp + 0x6a8], edx
mov qword [rbp + 0x6a0], rdx
mov eax, dword [rdi + 0xb8]
mov rcx, qword [rdi + 0xb0]
test rcx, rcx
je 0x140093b9b
cmp eax, 0xffffffff
jne 0x140093b8c
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140093b83
mov dword [rbp + 0x6c0], eax
mov qword [rbp + 0x6b8], rcx
jmp 0x140093ba8
mov dword [rbp + 0x6c0], edx
mov qword [rbp + 0x6b8], rdx
mov eax, dword [rdi + 0xc0]
mov dword [rbp + 0x6c8], eax
lea rdx, [rdi + 0xc8]
lea rax, [rbp + 0x6d0]
cmp rax, rdx
je 0x140093bdc
mov rdx, qword [rdx]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [rbp + 0x6d0]
call fcn.14000bbb0
mov eax, dword [rdi + 0xd8]
mov dword [rbp + 0x6e0], eax
mov eax, dword [rdi + 0xdc]
mov dword [rbp + 0x6e4], eax
mov eax, dword [rdi + 0x100]
mov dword [rbp + 0x708], eax
mov eax, dword [rdi + 0x104]
mov dword [rbp + 0x70c], eax
mov eax, dword [rdi + 0x108]
mov dword [rbp + 0x710], eax
mov eax, dword [rdi + 0x10c]
mov dword [rbp + 0x714], eax
mov eax, dword [rdi + 0x110]
mov dword [rbp + 0x718], eax
mov eax, dword [rdi + 0x114]
mov dword [rbp + 0x71c], eax
lea rdx, [rdi + 0x118]
lea rcx, [rbp + 0x720]
call fcn.140004780
mov eax, dword [rdi + 0x130]
mov dword [rbp + 0x738], eax
mov eax, dword [rdi + 0x134]
mov dword [rbp + 0x73c], eax
lea rdx, [rdi + 0xe0]
lea rax, [rbp + 0x6e8]
cmp rax, rdx
je 0x140093c8f
mov rdx, qword [rdx]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [rbp + 0x6e8]
call fcn.14000b910
xor eax, eax
mov dword [rbp + 0x740], eax
mov rax, qword [rdi + 0x170]
mov qword [rbp + 0x778], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp + 0x780], rax
mov eax, dword [rdi + 0x180]
mov dword [rbp + 0x788], eax
mov eax, dword [rdi + 0x184]
mov dword [rbp + 0x78c], eax
lea rdx, [rdi + 0x198]
lea rax, [rbp + 0x7a0]
cmp rax, rdx
je 0x140093cf3
mov rdx, qword [rdx]
mov r8, rdx
mov rdx, qword [rdx]
lea rcx, [rbp + 0x7a0]
call fcn.14000ba70
lea r8, [rbp - 0x50]
mov edx, 0x402
mov rcx, r14
call fcn.14007e430
lea r8, [rbp - 0x50]
mov edx, 0x400
mov rcx, r14
call fcn.14007e430
nop
lea rax, vtable.CSASDescriptor.0
mov qword [rbp - 0x50], rax
lea rax, vtable.CSASDescriptor.1.0
mov qword [rbp - 0x48], rax
lea rdi, vtable.CSABString.0
mov qword [rbp + 0x7f8], rdi
add dword [rbp + 0x80c], 0xffffffff
jne 0x140093d54
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x140093d54
call fcn.140247060
mov qword [rbp + 0x7e0], rdi
add dword [rbp + 0x7f4], 0xffffffff
jne 0x140093d75
mov rcx, qword [rbp + 0x7e8]
test rcx, rcx
je 0x140093d75
call fcn.140247060
mov qword [rbp + 0x7c8], rdi
add dword [rbp + 0x7dc], 0xffffffff
jne 0x140093d96
mov rcx, qword [rbp + 0x7d0]
test rcx, rcx
je 0x140093d96
call fcn.140247060
lea rcx, [rbp + 0x608]
call fcn.14000d760
lea rcx, [rbp - 0x40]
call fcn.140027e10
nop
lea rcx, [rbp + 0x830]
call fcn.140027e10
nop
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor edi, edi
lea rsi, str.StubPath
inc r15d
cmp qword [rsp + r15*8 + 0x68], 0
jne 0x1400934c0
mov rax, qword [r14 + 0x28]
mov rdx, qword [rsp + 0x60]
lea rcx, [r14 + 0x28]
call qword [rax + 0x28]
lea r15, str.KeyFileName
inc r13d
cmp dword [r14 + 0x127c], 0
je 0x140093421
mov rsi, qword [rsp + 0x40]
mov rax, qword [r14 + 0x28]
mov rdx, qword [rbp + 0x26f0]
lea rcx, [r14 + 0x28]
call qword [rax + 0x28]
mov rbx, qword [rbx]
cmp dword [r14 + 0x127c], 0
je 0x1400933b0
mov rdi, qword [rsi]
mov qword [rsi], rsi
mov qword [rsi + 8], rsi
cmp rdi, rsi
je 0x140093e63
nop dword [rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov edx, 0x28
mov rcx, rdi
call fcn.140247060
mov rdi, rbx
cmp rbx, rsi
jne 0x140093e40
mov edx, 0x28
mov rcx, rsi
call fcn.140247060
mov rbx, qword [rsp + 0x27e0]
add rsp, 0x27a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
nop
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, 0x8007000e
call fcn.140004cd0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3