Function at 0x140008680
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x40
mov rbx, qword [0x14003cf40]
mov r15, rcx
test rbx, rbx
je 0x1400086f9
mov rcx, rbx
call qword [0x14002a658]
mov edx, 5
mov ecx, 9
test eax, eax
cmovne edx, ecx
mov rcx, rbx
call qword [0x14002a5c0]
nop
test eax, eax
jne case.default.0x1400086f2
call qword [0x14002a3b8]
cmp eax, 5
jne case.default.0x1400086f2
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xf120
mov rcx, rbx
call qword [0x14002a5e8]
mov rcx, rbx
add rsp, 0x40
pop r15
pop r14
pop rbx
jmp qword [0x14002a668]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
xor r12d, r12d
test byte [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x140008889
lock bts qword [reloc.OLEAUT32.dll_SysReAllocString], 0x1f
jb 0x14000887d
mov rax, qword [0x14003cf38]
mov edi, r12d
cmp qword [rax + 0x10], r12
jbe 0x140008811
lea r14d, [r12 + 5]
nop
mov rcx, qword [rax + 0x20]
mov rdx, rdi
imul rdx, qword [rax + 0x18]
mov r8d, dword [rdx + rcx + 0xc]
test r8d, r8d
je 0x140008804
mov rax, qword gs:[0x30]
movzx edx, r8w
mov r8, r14
mov rcx, qword [rax + 0x60]
mov rsi, qword [rcx + 0x10]
mov rcx, rsi
call qword [0x14002a110]
mov rbp, rax
test rax, rax
je 0x1400087fd
mov rdx, rax
mov rcx, rsi
call qword [0x14002a108]
nop
test rax, rax
je 0x1400087fd
mov rcx, rax
call qword [0x14002a2f0]
mov rbx, rax
test rax, rax
je 0x1400087fd
mov rdx, rbp
mov rcx, rsi
call qword [0x14002a370]
test dword [rbx + 0xc], 0x40000000
je 0x1400087fd
movzx ecx, word [0x14003d848]
movzx eax, word [0x14003d424]
cmp cx, word [rbx + 0x16]
cmovl cx, word [rbx + 0x16]
cmp ax, word [rbx + 0x18]
mov word [0x14003d848], cx
cmovl ax, word [rbx + 0x18]
mov word [0x14003d424], ax
mov rax, qword [0x14003cf38]
inc rdi
cmp rdi, qword [rax + 0x10]
jb 0x140008750
add word [0x14003d424], 0x26
add word [0x14003d848], 0x70
lock bts qword [reloc.OLEAUT32.dll_SysReAllocString], 0
jb 0x140008889
mov rbx, qword [0x14003ba78]
test rbx, rbx
je 0x140008846
xor edx, edx
mov rcx, rbx
call qword [0x14002a858]
mov rax, 0xfffffffffffffffe
lock xadd qword [0x14003ba70], rax
shr rax, 1
and eax, 0x7fff
cmp rax, 1
jne 0x140008889
test rbx, rbx
je 0x140008889
mov rcx, rbx
call qword [0x14002a918]
mov qword [0x14003ba78], r12
jmp 0x140008889
lea rcx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.14000ab20
call fcn.14000b280
mov edx, 0xc
mov r8d, 0x104
mov rcx, rax
call qword [0x14002a8d8]
mov edx, 0x7ffffffe
lea rcx, [0x140032f90]
mov rsi, rax
lea rax, [0x140014940]
mov qword [0x14003cf30], rax
movzx eax, word [0x14003d848]
mov dword [rsi], 0xffff0001
lea rdi, [rsi + 0x1a]
mov dword [rsi + 4], r12d
mov dword [rsi + 8], 0x50000
mov dword [rsi + 0xc], 0x86c800c8
mov dword [rsi + 0x10], 3
mov word [rsi + 0x14], r12w
mov word [rsi + 0x16], ax
movzx eax, word [0x14003d424]
mov word [rsi + 0x18], ax
call fcn.14001bd18
lea rdx, [0x140032f90]
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
mov edx, 0x7ffffffe
lea rcx, [0x140032f90]
add rdi, rbx
call fcn.14001bd18
lea rdx, [0x140032f90]
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
mov edx, 0x7ffffffe
lea rcx, [0x140032f90]
add rdi, rbx
call fcn.14001bd18
lea rdx, [0x140032f90]
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
mov dword [rbx + rdi], 0x1900008
lea rcx, str.MS_Shell_Dlg
mov word [rbx + rdi + 4], r12w
mov edx, 0x7ffffffe
add rbx, 6
add rdi, rbx
call fcn.14001bd18
lea rdx, str.MS_Shell_Dlg
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
mov eax, 0x58
lea rcx, [rbx + 3]
add rcx, rdi
mov edx, 0x7ffffffe
and rcx, 0xfffffffffffffffc
mov qword [rcx], r12
lea rdi, [rcx + 0x18]
mov dword [rcx + 8], 0x56818a27
mov dword [rcx + 0xc], 0x60008
mov word [rcx + 0x10], ax
movzx eax, word [0x14003d424]
sub ax, 0xe
mov word [rcx + 0x12], ax
mov dword [rcx + 0x14], 0x68
lea rcx, str.SysTreeView32
call fcn.14001bd18
lea rdx, str.SysTreeView32
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
mov rcx, rdi
call fcn.14001b590
mov edx, 0x7ffffffe
lea rcx, [0x140032f90]
add rdi, rbx
call fcn.14001bd18
lea rdx, [0x140032f90]
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
mov word [rbx + rdi], r12w
lea rcx, [rbx + 5]
add rcx, rdi
mov eax, 0x66
and rcx, 0xfffffffffffffffc
mov edx, 0x7ffffffe
mov qword [rcx], r12
lea rdi, [rcx + 0x18]
mov dword [rcx + 8], 0x56010000
mov word [rcx + 0xc], ax
movzx eax, word [0x14003d424]
sub ax, 0x16
mov word [rcx + 0xe], ax
mov dword [rcx + 0x10], 0xe0032
mov dword [rcx + 0x14], 0x69
lea rcx, str.Button
call fcn.14001bd18
lea rdx, str.Button
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
mov edx, 0x7ffffffe
lea rcx, [0x140032f90]
add rdi, rbx
call fcn.14001bd18
lea rdx, [0x140032f90]
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
movzx eax, word [0x14003d848]
lea rcx, [rbx + 5]
mov word [rbx + rdi], r12w
add rcx, rdi
and rcx, 0xfffffffffffffffc
sub ax, 0x3a
mov edx, 0x7ffffffe
mov qword [rcx], r12
lea rdi, [rcx + 0x18]
mov dword [rcx + 8], 0x56010000
mov word [rcx + 0xc], ax
movzx eax, word [0x14003d424]
sub ax, 0x16
mov word [rcx + 0xe], ax
mov dword [rcx + 0x10], 0xe0032
mov dword [rcx + 0x14], 0x6a
lea rcx, str.Button
call fcn.14001bd18
lea rdx, str.Button
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
mov edx, 0x7ffffffe
lea rcx, [0x140032f90]
add rdi, rbx
call fcn.14001bd18
lea rdx, [0x140032f90]
mov rcx, rdi
lea rbx, [rax*2 + 2]
mov word [rdi + rax*2], r12w
mov r8, rbx
call fcn.14001b590
mov word [rbx + rdi], r12w
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
lea r9, [0x140008c40]
mov r8, r15
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov rcx, qword [rcx + 0x10]
call qword [0x14002a588]
call fcn.14000b280
mov r8, rsi
xor edx, edx
mov rcx, rax
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rbx
jmp qword [0x14002a848]
or rax, 0xffffffffffffffff
jmp 0x140063dfa
push rsp
and al, 0x38
lea r8, [rsp + 0x3c]
mov r9d, edi
mov rcx, rax
call qword [fcn.14006a310]
mov dword [rsp + 0x38], eax
and al, 0x38
and al, 0x38
cmp eax, 0xffffffff
jne 0x140063dd4
call qword [fcn.14006a1b8]
test eax, eax
je 0x140063dd4
mov ecx, eax
call fcn.14005f314
jmp 0x140063d9d
mov rcx, rbx
mov rax, rbx
lea rdx, [0x140079800]
sar rax, 5
and ecx, 0x1f
mov rax, qword [rdx + rax*8]
imul rcx, rcx, 0x58
and byte [rax + rcx + 8], 0xfd
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
add esp, 0x20
add esp, 0x20
pop rdi
ret
and al, 8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12d, r8d
mov r13, rdx
movsxd rbx, ecx
cmp ebx, 0xfffffffe
jne 0x140063e4e
call fcn.14005f2f4
xor edi, edi
mov dword [rax], edi
call fcn.14005f2d4
mov dword [rax], 9
or rax, 0xffffffffffffffff
jmp 0x140063f27
xor edi, edi
cmp ebx, edi
jl 0x140063efd
cmp ebx, dword [0x1400797e8]
jae 0x140063efd
mov rsi, rbx
mov r14, rbx
sar r14, 5
lea r15, [0x140079800]
and esi, 0x1f
imul rsi, rsi, 0x58
mov rax, qword [r15 + r14*8]
movsx ecx, byte [rax + rsi + 8]
and ecx, 1
jne 0x140063eb6
call fcn.14005f2f4
mov dword [rax], edi
call fcn.14005f2d4
mov dword [rax], 9
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14005f204
or rax, 0xffffffffffffffff
jmp 0x140063f27
mov ecx, ebx
call fcn.1400658d0
nop
mov rax, qword [r15 + r14*8]
test byte [rax + rsi + 8], 1
je 0x140063edb
mov r8d, r12d
mov rdx, r13
mov ecx, ebx
call fcn.140063d70
mov rdi, rax
jmp 0x140063ef1
call fcn.14005f2d4
mov dword [rax], 9
call fcn.14005f2f4
mov dword [rax], edi
or rdi, 0xffffffffffffffff
mov ecx, ebx
call fcn.140065978
mov rax, rdi
jmp 0x140063f27
call fcn.14005f2f4
mov dword [rax], edi
call fcn.14005f2d4
mov dword [rax], 9
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14005f204
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret