Function at 0x14001cd10
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor r13d, r13d
movsd xmm0, qword [str.XSafe_Tray_App]
movsd qword [rbp + 0x48], xmm0
mov eax, dword [0x140053d40]
mov dword [rbp + 0x50], eax
movzx eax, word [0x140053d44]
mov word [rbp + 0x54], ax
movzx eax, byte [0x140053d46]
mov byte [rbp + 0x56], al
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x40], r13
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
lea rax, [0x14001bd80]
mov qword [rbp - 0x48], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x48]
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_RegisterClassA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, str.XSafe_Monitor
lea rdx, [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x14005df70], 0x3d0
mov qword [0x14005df78], rax
mov dword [0x14005df80], 1
mov dword [0x14005df84], 7
mov dword [0x14005df88], 0x401
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [0x14005df90], rax
lea r8, str.XSafe__
mov edx, 0x80
lea rcx, [0x14005df98]
call fcn.14002f254
lea rdx, [0x14005df70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
call fcn.14000b0a0
movsx r14d, al
call fcn.14000b090
movsx r15d, al
mov ebx, r15d
imul ebx, r14d
call fcn.14000b0d0
movsx edi, al
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, edi
lea eax, [rax + rbx*4]
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d167
call fcn.14000b0f0
mov ecx, r13d
test eax, eax
sete cl
xorps xmm2, xmm2
cvtsi2sd xmm2, rcx
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
lea eax, [rbx + rbx*4]
lea esi, [rdi + rax*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, esi
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001cf67
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14001cf67
lea r9d, [r13 + 0xa]
jmp 0x14001cfd1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, edi
lea eax, [rax + rbx*2]
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001cfcc
lea edx, [rbx + rbx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, edi
lea eax, [rax + rdx*2]
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si r9d, xmm0
jmp 0x14001cfd1
mov r9d, dword [rsp + 0x60]
lea ecx, [rbx + rdi]
movsx r8d, byte [reloc.OLEAUT32.dll_VariantCopy]
lea eax, [rcx + rbx*4]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
imul r8d, r9d
test r8d, r8d
je 0x14001d167
lea rdx, [0x140053d58]
lea rcx, [0x14005c4f0]
call fcn.140021a20
mov rcx, rax
call fcn.140021cd0
call fcn.14000b470
lea eax, [rbx + rbx*2]
lea r9d, [rdi + rax*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r9d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, esi
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d0ea
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14001e0e5
call fcn.14000b0d0
movsx edx, al
mov ecx, r14d
imul ecx, r15d
lea r8d, [rdx + rcx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d15a
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r9d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si eax, xmm0
jmp 0x14001d15e
mov eax, dword [rsp + 0x60]
cmp r13d, eax
jl 0x14001e0e5
call fcn.14000b6d0
call fcn.14000b0a0
movsx r8d, al
call fcn.14000b090
movsx ecx, al
imul r8d, ecx
call fcn.14000b0d0
movsx ecx, al
add r8d, ecx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d4df
call fcn.14000c2d0
mov rcx, r13
test eax, eax
sete cl
xorps xmm2, xmm2
cvtsi2sd xmm2, rcx
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea r11d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r11d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d282
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14001d282
mov r9d, 0xa
jmp 0x14001d326
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d321
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si r9d, xmm0
jmp 0x14001d326
mov r9d, dword [rsp + 0x60]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea r10d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r10d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
imul r8d, r9d
test r8d, r8d
je 0x14001d4df
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r8d, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
add r8d, ecx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r11d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d453
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14001ddec
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r10d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d4d2
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si eax, xmm0
jmp 0x14001d4d6
mov eax, dword [rsp + 0x60]
cmp r13d, eax
jl 0x14001ddec
mov ecx, 8
call fcn.140025604
lea rcx, [0x14001b3a0]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140023c20]
xor edx, edx
xor ecx, ecx
call fcn.14002c9f8
mov qword [rbp], rax
test rax, rax
je 0x14001e192
mov qword [rbp + 0x10], r13
cmp dword [rbp + 8], 0
je 0x14001e187
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call fcn.140024bd4
test eax, eax
jne 0x14001e187
xorps xmm0, xmm0
movaps xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp], xmm0
call fcn.14001aeb0
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x60], r13
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x60]
call fcn.1400140e0
mov r9d, eax
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*8]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d8e2
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
shr r9d, 0x1f
mov eax, r9d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm1, xmm0
movsd qword [rsp + 0x60], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea r10d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r10d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d685
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14001d685
mov r9d, 0xa
jmp 0x14001d729
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d724
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si r9d, xmm0
jmp 0x14001d729
mov r9d, dword [rsp + 0x60]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r8d, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
add r8d, ecx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
imul r8d, r9d
test r8d, r8d
je 0x14001d8e2
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r10d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r10d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d837
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14001ddec
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001d8d5
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si eax, xmm0
jmp 0x14001d8d9
mov eax, dword [rsp + 0x60]
cmp r13d, eax
jl 0x14001ddec
mov ecx, 0x10
call fcn.140025604
mov r15, rax
mov qword [rsp + 0x68], rax
lea rax, vtable.ProcessCreationEventSink.0
mov qword [r15], rax
mov dword [r15 + 8], 1
mov ecx, 0x18
call fcn.140025604
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14001d945
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], 1
lea rcx, str.SELECT__FROM_Win32_ProcessStartTrace
call fcn.140025010
mov qword [rbx], rax
jmp 0x14001d948
mov rbx, r13
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x14001e1a1
mov ecx, 0x18
call fcn.140025604
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14001d995
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
mov qword [rdi + 8], r13
mov dword [rdi + 0x10], 1
lea rcx, [0x140053da8]
call fcn.140025010
mov qword [rdi], rax
jmp 0x14001d998
mov rdi, r13
mov qword [rsp + 0x70], rdi
test rdi, rdi
je 0x14001e1ac
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
mov r9d, 0x80
mov r8, qword [rbx]
mov rdx, qword [rdi]
call qword [rax + 0xb8]
mov r14d, eax
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14001da0d
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001d9ee
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14001da00
call fcn.140025360
mov qword [rdi + 8], r13
mov edx, 0x18
mov rcx, rdi
call fcn.140025360
mov qword [rsp + 0x70], r13
lock xadd dword [rbx + 0x10], esi
cmp esi, 1
jne 0x14001da4c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001da2d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001da3f
call fcn.140025360
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.140025360
mov qword [rsp + 0x68], r13
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r8d, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
add r8d, ecx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001de1e
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
shr r14d, 0x1f
mov eax, r14d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm1, xmm0
movsd qword [rsp + 0x60], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea ebx, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ebx
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001db60
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14001db60
mov ecx, 0xa
jmp 0x14001dc02
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001dbfe
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si ecx, xmm0
jmp 0x14001dc02
mov ecx, dword [rsp + 0x60]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ebx
movsx r8d, byte [0x14005bcd0]
xor edx, edx
div r8d
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
imul r8d, ecx
test r8d, r8d
je 0x14001de1e
lea rdx, [0x140053db0]
lea rcx, [0x14005c4f0]
call fcn.140021a20
mov rcx, rax
call fcn.140021cd0
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
imul r8d, edx, 7
call fcn.14000b0d0
movsx ecx, al
add r8d, ecx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, ebx
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001dd45
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
jne 0x14001ddec
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001dde3
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si eax, xmm0
jmp 0x14001dde7
mov eax, dword [rsp + 0x60]
cmp r13d, eax
jge 0x14001de1e
mov eax, 1
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.140025340
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000b090
movsx edx, al
call fcn.14000b0a0
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea r12d, [rcx + rdx*2]
call fcn.14000b090
movsx ebx, al
call fcn.14000b0a0
movsx ecx, al
imul ebx, ecx
call fcn.14000b0d0
movsx r14d, al
lea esi, [r14 + rbx*2]
mov edi, dword [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x18]
call qword [sym.imp.USER32.dll_GetMessageW]
movd xmm2, eax
cvtdq2pd xmm2, xmm2
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x60], xmm1
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r12d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001df11
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14001df11
mov edi, 0xa
jmp 0x14001df75
lea esi, [r14 + rbx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, esi
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001df75
lea edx, [rbx + rbx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r14d
lea eax, [rax + rdx*2]
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rsp + 0x60]
cvttsd2si edi, xmm0
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, esi
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
imul r8d, edi
test r8d, r8d
je 0x14001dfb8
lea rcx, [rbp + 0x18]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x18]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14001de64
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x20]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea r8d, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
add r8d, ecx
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
sub r8d, eax
mov eax, r8d
xorps xmm2, xmm2
cvtsi2sd xmm2, rax
movsx eax, byte [0x14005bcd2]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movsx eax, byte [0x14005bcd4]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm0, xmm0
subsd xmm1, xmm0
mulsd xmm1, xmm2
movsd qword [rsp + 0x68], xmm1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*4]
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001e0ec
call fcn.14000b0b0
movsx edx, al
movsx eax, byte [0x14005e1b0]
imul edx, eax
lea r8d, [rdx + rdx*4]
call fcn.14000b0e0
movsx ecx, al
sub r8d, ecx
call fcn.14000b0c0
movsx ecx, al
add r8d, ecx
movsx ecx, byte [0x14005bcd4]
add ecx, r8d
je 0x14001e0ec
xor eax, eax
jmp 0x14001ddf1
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
mov r8d, eax
movsx eax, byte [0x14005bcd3]
cmp r8d, eax
je 0x14001e17f
call fcn.14000b0a0
movsx edx, al
call fcn.14000b090
movsx ecx, al
imul edx, ecx
lea edx, [rdx + rdx*2]
call fcn.14000b0d0
movsx ecx, al
lea r8d, [rcx + rdx*2]
movsx eax, byte [reloc.OLEAUT32.dll_VariantCopy]
add eax, r8d
movsx ecx, byte [0x14005bcd0]
xor edx, edx
div ecx
movsx ecx, byte [0x14005bcd3]
sub eax, ecx
mov ecx, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
mulsd xmm0, qword [rsp + 0x68]
mov eax, r13d
jmp 0x14001ddf1
mov ecx, 1
call fcn.140023e7c
nop
mov dword [rbp + 8], r13d
mov ecx, 6
call fcn.140023e7c
nop
mov ecx, 0x8007000e
call fcn.140025000
nop
mov ecx, 0x8007000e
call fcn.140025000
int3