Function at 0x1400e0c90
Capabilities:
Create directory
Reference sql statements

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5b8]
sub rsp, 0x6b8
mov qword [rbp + 0x88], 0xfffffffffffffffe
lea rdi, vtable.CSABSQL.0
mov qword [rbp - 0x60], rdi
lea rsi, vtable.CSABByteString.0
mov qword [rbp - 0x58], rsi
xor r13d, r13d
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x50], r13
lea ecx, [r13 + 1]
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1400e0d0d
mov r8, qword [rbp - 0x40]
inc r8
mov rcx, rax
call fcn.1402496a0
lea edx, [r13 + 1]
mov rcx, qword [rbp - 0x50]
call fcn.140247060
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 1
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.14000af20
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbp - 0x38], r13d
mov qword [rbp - 0x30], r13
mov dword [rbp - 0x28], r13d
cmp qword [rbp - 0x48], 0xc
jae 0x1400e0d86
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1400e0d78
mov r8, qword [rbp - 0x40]
inc r8
mov rcx, rax
call fcn.1402496a0
mov edx, 1
mov rcx, qword [rbp - 0x50]
call fcn.140247060
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x1400e0d8a
mov rbx, qword [rbp - 0x50]
mov byte [rbx], 0
mov r9d, SafeArrayGetDim
lea r8, str.SABRegistry
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
call fcn.140250550
mov qword [rbp - 0x40], SafeArrayGetDim
mov qword [rbp + 0x608], r13
lea r15, vtable.CSABString.0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r13
mov dword [rbp - 0x70], r13d
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov ecx, r14d
call fcn.140247068
mov qword [rbp - 0x78], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x6c], 1
lea rcx, [rbp - 0x60]
call fcn.1400e0560
test eax, eax
jne 0x1400e0e00
mov ebx, r13d
jmp 0x1400e1d80
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x1a0]
call fcn.140249b10
lea rdx, [0x14034ec34]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.Quarantine
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
lea rdx, [rbp + 0x1a0]
call fcn.140036fc0
xor edx, edx
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.quarantine.db
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
lea rdx, [rbp + 0x1a0]
call fcn.1400370a0
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
mov edx, 1
call fcn.140037290
lea r8, [rbp - 0x80]
lea rdx, str.EnableRealTimeDirectDiskAccess
lea rcx, [rbp - 0x60]
call fcn.1400e0640
test eax, eax
je 0x1400e0eeb
lea rdx, [0x1402b3c20]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400e0eeb
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140030250
lea r8, [rbp - 0x80]
lea rdx, str.RealTimeMS
lea rcx, [rbp - 0x60]
call fcn.1400e0640
test eax, eax
je 0x1400e0f6a
mov rcx, qword [rbp - 0x78]
call fcn.1402520ac
mov edx, eax
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140037090
mov rcx, qword [rbp - 0x78]
call fcn.1402520ac
mov edx, eax
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140037080
mov rcx, qword [rbp - 0x78]
call fcn.1402520ac
mov edx, eax
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140037070
mov rcx, qword [rbp - 0x78]
call fcn.1402520ac
mov edx, eax
jmp 0x1400e0fb7
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
mov edx, 0x3e8
call fcn.140037090
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
mov edx, 0x3e8
call fcn.140037080
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
mov edx, 0x3e8
call fcn.140037070
mov edx, 0x3e8
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140037060
mov rcx, qword [0x1403517c8]
mov edx, 0x1388
add rcx, 0xdb8
call fcn.140036e80
mov rcx, qword [0x1403517c8]
mov edx, PathResolve
add rcx, 0xdb8
call fcn.140036e90
mov rcx, qword [0x1403517c8]
mov edx, 0x1f4
add rcx, 0xdb8
call fcn.1400372a0
lea r8, [rbp - 0x80]
lea rdx, str.LimitRealTimeExtensions
lea rcx, [rbp - 0x60]
call fcn.1400e0640
test eax, eax
je 0x1400e1140
lea rdx, [0x1402b3c20]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400e1140
mov ebx, r13d
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1075
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x608]
lea rdx, str.SELECT__FROM_sas_realtime_extensions_WHERE_activeyes
call qword [rax]
mov ebx, eax
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1400e1140
mov ebx, r13d
mov qword [rbp + 0x610], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x610]
lea r8, [0x140294f68]
xor edx, edx
call qword [rax + 0x40]
test eax, eax
je 0x1400e1113
mov qword [rbp + 0x600], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x600]
lea r8, str.extension
mov edx, ebx
call qword [rax + 0x40]
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
mov rdx, qword [rbp + 0x600]
call fcn.14002d540
inc ebx
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x610]
lea r8, [0x140294f68]
mov edx, ebx
call qword [rax + 0x40]
test eax, eax
jne 0x1400e10b2
mov rbx, qword [rbp + 0x608]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1136
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, r13d
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e116e
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x608]
lea rdx, str.SELECT__FROM_sas_realtime_registry_WHERE_activeyes
call qword [rax]
mov ebx, eax
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1400e154a
mov qword [rsp + 0x60], 0
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
lea r8, [0x140294f68]
xor edx, edx
call qword [rax + 0x40]
test eax, eax
je 0x1400e151a
mov edi, 2
lea esi, [rdi + 6]
lea r15d, [rdi + 0x1e]
mov r12d, dword [rbp + 0x600]
nop
mov qword [rbp + 0x40], 0
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x610]
lea r8, str.basekey
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x80]
lea r8, str.keypath
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x600]
lea r8, str.flags
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x70]
lea r8, str.recursive
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x78]
lea r8, str.datasource
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x68]
lea r8, str.preload
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x60]
lea r8, str.scanimmediately
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x58]
lea r8, str.trickle
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x50]
lea r8, str.tricklecount
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x48]
lea r8, str.tricklems
mov edx, r13d
call qword [rax + 0x40]
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x40]
lea r8, str.prescan
mov edx, r13d
call qword [rax + 0x40]
lea rdx, [0x1402b3bc0]
mov rcx, qword [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor ebx, ebx
test eax, eax
mov rax, 0xffffffff80000000
cmove rbx, rax
lea rdx, [0x1402b3bc8]
mov rcx, qword [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov rax, 0xffffffff80000001
cmove rbx, rax
lea rdx, [0x1402b3bd0]
mov rcx, qword [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov rax, 0xffffffff80000002
cmove rbx, rax
mov qword [rbp + 0x618], rbx
lea rdx, [0x1402b3bd8]
mov rcx, qword [rbp + 0x610]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400e138b
mov qword [rbp + 0x618], 0xffffffff80000003
jmp 0x1400e1394
test rbx, rbx
je 0x1400e14ec
lea rdx, str.ScanKeysNamedCLSID
mov rcx, qword [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
cmove r12d, edi
lea rdx, str.ScanValuesNamedCLSID
mov rcx, qword [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
cmove r12d, esi
lea rdx, str.ScanValuesContainingFilePath
mov rcx, qword [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
cmove r12d, r14d
lea rdx, str.ScanKeysAsService
mov rcx, qword [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
cmove r12d, r15d
lea rdx, str.ScanKeysAsCLSID
mov rcx, qword [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, 4
cmove r12d, eax
mov rcx, qword [rbp + 0x48]
call fcn.1402520ac
mov r15d, eax
mov rcx, qword [rbp + 0x50]
call fcn.1402520ac
mov r14d, eax
lea rdx, [0x1402b3c20]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor esi, esi
test eax, eax
sete sil
lea rdx, [0x1402b3c20]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor edi, edi
test eax, eax
sete dil
lea rdx, [0x1402b3c20]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor ebx, ebx
test eax, eax
sete bl
lea rdx, [0x1402b3c20]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor r9d, r9d
test eax, eax
sete r9b
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], ebx
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r8, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x618]
call fcn.14002d940
mov edi, 2
lea esi, [rdi + 6]
lea r14d, [rdi + 0xe]
lea r15d, [rdi + 0x1e]
inc r13d
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
lea r8, [0x140294f68]
mov edx, r13d
call qword [rax + 0x40]
test eax, eax
jne 0x1400e11c0
lea r15, vtable.CSABString.0
mov rbx, qword [rbp + 0x608]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e153d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r13d, r13d
mov ebx, r13d
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1578
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x608]
lea rdx, str.SELECT__FROM_sas_realtime_folders_WHERE_activeyes
call qword [rax]
mov ebx, eax
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1400e1822
mov r12d, r13d
mov dword [rbp + 0x600], r13d
mov qword [rsp + 0x60], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
lea r8, [0x140294f68]
xor edx, edx
call qword [rax + 0x40]
test eax, eax
je 0x1400e17f5
nop dword [rax]
mov qword [rbp + 0x610], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x610]
lea r8, str.folder
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x1400e17c7
mov rdx, qword [rbp + 0x610]
test rdx, rdx
je 0x1400e17c7
mov r8d, 1
lea rcx, [rbp + 0x10]
call fcn.14007b5e0
nop
mov r15, qword [rbp + 0x18]
mov rbx, qword [r15]
mov qword [rbp + 0x618], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x618]
lea r8, str.recursive
mov edx, r12d
call qword [rax + 0x40]
cmp rbx, r15
je 0x1400e1762
lea r12, vtable.CSABString.0
nop dword [rax]
mov qword [rsp + 0x68], r12
mov rcx, r14
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rsp + 0x7c], 1
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x90]
call fcn.140249b10
mov rcx, qword [rbx + 0x10]
mov rsi, qword [rcx + 0x18]
test rdi, rdi
je 0x1400e16a4
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x70], r13
test rsi, rsi
je 0x1400e1dfc
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x1400e16b4
mov dword [rsp + 0x78], eax
inc eax
mov r14d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400e16e8
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call fcn.1402496a0
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, rdi
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdx, [0x1402b3c20]
mov rcx, qword [rbp + 0x618]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov r8d, r13d
test eax, eax
sete r8b
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
lea rdx, [rbp + 0x90]
call fcn.14002d670
mov rbx, qword [rbx]
test rdi, rdi
je 0x1400e1752
mov rcx, rdi
call fcn.140247060
cmp rbx, r15
jne 0x1400e1650
mov r12d, dword [rbp + 0x600]
lea rax, vtable.CSABEnumFileObjectsFromEnvironmentExpandedRegExp.0
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400e179f
nop dword [rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400e1797
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbx]
cmp rbx, rax
jne 0x1400e1780
lea r15, vtable.CSABString.0
mov qword [rbp + 0x28], r15
add dword [rbp + 0x3c], 0xffffffff
jne 0x1400e17be
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x1400e17be
call fcn.140247060
lea rcx, [rbp + 0x18]
call fcn.140009af0
inc r12d
mov dword [rbp + 0x600], r12d
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
lea r8, [0x140294f68]
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
jne 0x1400e15c0
mov rbx, qword [rbp + 0x608]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1818
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, r13d
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1850
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x608]
lea rdx, str.SELECT__FROM_sas_realtime_folders_excluded_WHERE_activeyes
call qword [rax]
mov ebx, eax
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1400e1b02
mov r12d, r13d
mov dword [rbp + 0x600], r13d
mov qword [rsp + 0x60], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
lea r8, [0x140294f68]
xor edx, edx
call qword [rax + 0x40]
test eax, eax
je 0x1400e1ad5
nop dword [rax]
nop dword [rax + rax]
mov qword [rbp + 0x610], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x610]
lea r8, str.folder
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x1400e1aa7
mov rdx, qword [rbp + 0x610]
test rdx, rdx
je 0x1400e1aa7
mov r8d, 1
lea rcx, [rbp + 0x10]
call fcn.14007b5e0
nop
mov r15, qword [rbp + 0x18]
mov rbx, qword [r15]
mov qword [rbp + 0x618], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x618]
lea r8, str.recursive
mov edx, r12d
call qword [rax + 0x40]
cmp rbx, r15
je 0x1400e1a42
lea r12, vtable.CSABString.0
nop dword [rax]
mov qword [rsp + 0x68], r12
mov rcx, r14
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rsp + 0x7c], 1
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x90]
call fcn.140249b10
mov rcx, qword [rbx + 0x10]
mov rsi, qword [rcx + 0x18]
test rdi, rdi
je 0x1400e1984
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x70], r13
test rsi, rsi
je 0x1400e1e1f
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x1400e1994
mov dword [rsp + 0x78], eax
inc eax
mov r14d, eax
mov ecx, eax
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400e19c8
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call fcn.1402496a0
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, rdi
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdx, [0x1402b3c20]
mov rcx, qword [rbp + 0x618]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov r8d, r13d
test eax, eax
sete r8b
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
lea rdx, [rbp + 0x90]
call fcn.14002d380
mov rbx, qword [rbx]
test rdi, rdi
je 0x1400e1a32
mov rcx, rdi
call fcn.140247060
cmp rbx, r15
jne 0x1400e1930
mov r12d, dword [rbp + 0x600]
lea rax, vtable.CSABEnumFileObjectsFromEnvironmentExpandedRegExp.0
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400e1a7f
nop dword [rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400e1a77
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rax, qword [rbp + 0x18]
mov rbx, qword [rbx]
cmp rbx, rax
jne 0x1400e1a60
lea r15, vtable.CSABString.0
mov qword [rbp + 0x28], r15
add dword [rbp + 0x3c], 0xffffffff
jne 0x1400e1a9e
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x1400e1a9e
call fcn.140247060
lea rcx, [rbp + 0x18]
call fcn.140009af0
inc r12d
mov dword [rbp + 0x600], r12d
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
lea r8, [0x140294f68]
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
jne 0x1400e18a0
mov rbx, qword [rbp + 0x608]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1af8
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, r13d
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1b30
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x608]
lea rdx, str.SELECT__FROM_sas_realtime_processes_excluded_WHERE_activeyes
call qword [rax]
mov ebx, eax
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x1400e1d6d
mov r12d, r13d
mov qword [rbp + 0x610], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x610]
lea r8, [0x140294f68]
xor edx, edx
call qword [rax + 0x40]
test eax, eax
je 0x1400e1d40
mov qword [rbp + 0x600], r13
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x600]
lea r8, str.processpath
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x1400e1d17
mov rdx, qword [rbp + 0x600]
test rdx, rdx
je 0x1400e1d17
mov r8d, 1
lea rcx, [rbp + 0x10]
call fcn.14007b5e0
nop
mov r14, qword [rbp + 0x18]
mov rbx, qword [r14]
cmp rbx, r14
je 0x1400e1cc4
nop
mov qword [rsp + 0x68], r15
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov dword [rsp + 0x7c], 1
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x90]
call fcn.140249b10
mov rcx, qword [rbx + 0x10]
mov rsi, qword [rcx + 0x18]
test rdi, rdi
je 0x1400e1c26
mov rcx, rdi
call fcn.140247060
mov qword [rsp + 0x70], r13
test rsi, rsi
je 0x1400e1e42
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x1400e1c36
mov dword [rsp + 0x78], eax
lea ecx, [rax + 1]
mov r15d, ecx
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400e1c69
mov r8d, r15d
mov rdx, rsi
mov rcx, rax
call fcn.1402496a0
lea r15, vtable.CSABString.0
mov rdx, rdi
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
lea rdx, [rbp + 0x90]
call fcn.14002dab0
mov rbx, qword [rbx]
test rdi, rdi
je 0x1400e1cb7
mov rcx, rdi
call fcn.140247060
cmp rbx, r14
jne 0x1400e1bd0
mov r14, qword [rbp + 0x18]
lea rax, vtable.CSABEnumFileObjectsFromEnvironmentExpandedRegExp.0
mov qword [rbp + 0x10], rax
mov rbx, qword [r14]
cmp rbx, r14
je 0x1400e1cf6
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400e1cee
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov r14, qword [rbp + 0x18]
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x1400e1cd7
mov qword [rbp + 0x28], r15
add dword [rbp + 0x3c], 0xffffffff
jne 0x1400e1d0e
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x1400e1d0e
call fcn.140247060
lea rcx, [rbp + 0x18]
call fcn.140009af0
inc r12d
mov rcx, qword [rbp + 0x608]
mov rax, qword [rcx]
lea r9, [rbp + 0x610]
lea r8, [0x140294f68]
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
jne 0x1400e1b71
mov rbx, qword [rbp + 0x608]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1d63
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 1
lea rdi, vtable.CSABSQL.0
lea rsi, vtable.CSABByteString.0
mov qword [rbp - 0x80], r15
add dword [rbp - 0x6c], 0xffffffff
jne 0x1400e1d99
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400e1d99
call fcn.140247060
nop
mov qword [rbp - 0x60], rdi
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400e1dc0
mov r8, qword [rcx]
mov edx, 1
call qword [r8 + 0x40]
mov qword [rbp - 0x30], r13
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov qword [rbp - 0x58], rsi
mov edx, 1
mov rcx, qword [rbp - 0x50]
call fcn.140247060
mov eax, ebx
add rsp, 0x6b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rsp + 0x78], r13d
mov rcx, r14
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
jmp 0x1400e16ee
mov dword [rsp + 0x78], r13d
mov rcx, r14
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
jmp 0x1400e19ce
mov dword [rsp + 0x78], r13d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
jmp 0x1400e1c70