Function at 0x140009320
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8b8]
sub rsp, 0x990
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [0x1400f1200]
xor rax, rsp
mov qword [rbp + 0x820], rax
movzx r15d, cl
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x1400d7e20]
movdqu xmmword [rbp + 0x1c0], xmm1
xor r12d, r12d
mov word [rbp + 0x1b0], r12w
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x80], r12
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x68], r12
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov r8d, 0x101
lea rdx, [rbp + 0x400]
lea rcx, str.USERNAME
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140009507
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
mov ebx, eax
jle 0x1400093f5
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x1400093fe
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000940e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14000941d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000942d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000943c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000944c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14000945b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000946a
mov rax, qword [rcx]
call qword [rax + 0x10]
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 8
jb 0x1400094b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a3dc
call fcn.140078eb4
movzx eax, bl
mov rcx, qword [rbp + 0x820]
xor rcx, rsp
call fcn.140078e50
lea r11, [rsp + 0x990]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r8d, 0x111
lea rdx, [rbp + 0x1d0]
lea rcx, str.USERDOMAIN
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400093e0
lea r8, [0x1400c75e8]
mov edx, 0x111
lea rcx, [rbp + 0x1d0]
call fcn.14007ff50
lea r8, [rbp + 0x400]
mov edx, 0x111
lea rcx, [rbp + 0x1d0]
call fcn.14007ff50
mov r8d, 0xc
lea rdx, str.Autorun_for
lea rcx, [rbp + 0x1b0]
call fcn.140007410
lea rax, [rbp + 0x400]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140009583
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x1b0]
call fcn.14000ae00
mov r8d, 0x104
lea rdx, [rbp + 0x610]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400b8640]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400b8650]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x50]
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm11, xmmword [rbp + 0x98]
movsd xmm10, qword [rbp + 0xa8]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm9, xmmword [rbp + 0xe0]
movsd xmm8, qword [rbp + 0xf0]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm7, xmmword [rbp + 0xc8]
movsd xmm6, qword [rbp + 0xd8]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movaps xmmword [rbp + 0x150], xmm11
movsd qword [rbp + 0x160], xmm10
movaps xmmword [rbp + 0x10], xmm9
movsd qword [rbp + 0x20], xmm8
movaps xmmword [rbp - 0x10], xmm7
movsd qword [rbp], xmm6
movups xmm0, xmmword [rbp + 0xb0]
movaps xmmword [rbp + 0x30], xmm0
movsd xmm1, qword [rbp + 0xc0]
movsd qword [rbp + 0x40], xmm1
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x10]
lea rdx, [rbp + 0x30]
mov rcx, qword [rsp + 0x60]
call rbx
mov ebx, eax
lea rcx, [rbp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0xc8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
js 0x1400093fe
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x38]
mov ecx, 0x18
call fcn.140078e70
mov rbx, rax
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14000973e
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x1400c7610]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a34d
jmp 0x140009741
mov rbx, r12
mov qword [rbp + 0xf8], rbx
test rbx, rbx
je 0x14000a342
lea r8, [rbp - 0x80]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x60]
call rdi
mov edi, eax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000979d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000977e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009790
call fcn.140078eb4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140078eb4
mov r13d, 8
test edi, edi
jns 0x140009960
mov qword [rbp - 0x78], r12
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
mov rbx, qword [rdx + 0x38]
lea ecx, [r13 + 0x10]
call fcn.140078e70
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400097f7
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x1400c75e8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000a358
jmp 0x1400097fa
mov rdi, r12
mov qword [rbp + 0x178], rdi
test rdi, rdi
je 0x14000a3e2
lea r8, [rbp - 0x78]
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x60]
call rbx
mov ebx, eax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x140009856
mov rcx, qword [rdi]
test rcx, rcx
je 0x140009837
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140009849
call fcn.140078eb4
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140078eb4
test ebx, ebx
js 0x1400093fe
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x58]
mov word [rbp + 0x68], r13w
lea rcx, [0x1400c73d0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x70], rax
test rax, rax
je 0x14000a3ed
movups xmm6, xmmword [rbp + 0x68]
movsd xmm7, qword [rbp + 0x78]
mov ecx, 0x18
call fcn.140078e70
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400098ce
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [0x1400c7610]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000a363
jmp 0x1400098d1
mov rdi, r12
mov qword [rbp + 0x170], rdi
test rdi, rdi
je 0x14000a3f8
movaps xmmword [rbp + 0x190], xmm6
movsd qword [rbp + 0x1a0], xmm7
lea r9, [rbp - 0x80]
lea r8, [rbp + 0x190]
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x78]
call rbx
mov ebx, eax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x140009943
mov rcx, qword [rdi]
test rcx, rcx
je 0x140009923
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140009935
call fcn.140078eb4
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140078eb4
nop
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x140009960
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400093fe
mov qword [rbp - 0x58], r12
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x68]
lea rdi, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 8
cmovae rdi, qword [rbp + 0x1b0]
mov ecx, 0x18
call fcn.140078e70
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400099c4
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400099c7
test rdi, rdi
jne 0x14000a36e
jmp 0x1400099c7
mov rbx, r12
mov qword [rbp + 0x138], rbx
test rbx, rbx
je 0x14000a403
lea r8, [rbp - 0x58]
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x80]
call r14
mov edi, eax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140009a23
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009a04
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009a16
call fcn.140078eb4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140078eb4
test edi, edi
js 0x140009a47
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
mov edx, esi
call qword [rax + 0x58]
mov ebx, eax
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x1400093fe
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r8, [rsp + 0x70]
xor edx, edx
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
call qword [rax + 0x38]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x50]
mov ecx, 0x18
call fcn.140078e70
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009ac4
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000a379
jmp 0x140009ac7
mov rdi, r12
mov qword [rbp + 0x118], rdi
test rdi, rdi
je 0x14000a342
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x68]
call rbx
mov ebx, eax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x140009b1e
mov rcx, qword [rdi]
test rcx, rcx
je 0x140009aff
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140009b11
call fcn.140078eb4
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140078eb4
test ebx, ebx
js 0x1400093fe
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
call qword [rax + 0x58]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0xb0]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x80]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0xe0]
mov ecx, 0x18
call fcn.140078e70
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009bc0
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.PT0S
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000a384
jmp 0x140009bc3
mov rdi, r12
mov qword [rbp + 0x110], rdi
test rdi, rdi
je 0x14000a342
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x78]
call rbx
mov ebx, eax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x140009c1b
mov rcx, qword [rdi]
test rcx, rcx
je 0x140009bfc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140009c0e
call fcn.140078eb4
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140078eb4
test ebx, ebx
js 0x1400093fe
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x90]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov edx, 4
call qword [rax + 0x110]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov qword [rbp - 0x50], r12
mov qword [rsp + 0x68], r12
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
mov edx, 9
call qword [rax + 0x50]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea r8, [rsp + 0x68]
lea rdx, [0x1400b8660]
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
js 0x1400093fe
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x48]
mov ecx, 0x18
call fcn.140078e70
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009d0b
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.Trigger1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a38f
jmp 0x140009d0e
mov rbx, r12
mov qword [rbp + 0x108], rbx
test rbx, rbx
je 0x14000a445
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call rdi
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140009d65
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009d46
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009d58
call fcn.140078eb4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140078eb4
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0xa8]
mov ecx, 0x18
call fcn.140078e70
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009db1
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.PT03S
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a39a
jmp 0x140009db4
mov rbx, r12
mov qword [rbp + 0x180], rbx
test rbx, rbx
je 0x14000a445
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x68]
call rdi
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140009e0b
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009dec
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140009dfe
call fcn.140078eb4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140078eb4
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0xb8]
mov ecx, 0x18
call fcn.140078e70
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009e57
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000a3a5
jmp 0x140009e5a
mov rdi, r12
mov qword [rbp + 0x120], rdi
test rdi, rdi
je 0x14000a445
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x68]
call rbx
mov ebx, eax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x140009eb2
mov rcx, qword [rdi]
test rcx, rcx
je 0x140009e93
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140009ea5
call fcn.140078eb4
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140078eb4
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
js 0x1400093fe
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x70], r12
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
call qword [rax + 0x88]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
lea r8, [rbp - 0x60]
xor edx, edx
call qword [rax + 0x60]
mov ebx, eax
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
js 0x1400093fe
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, str.MbLk
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
js 0x1400093fe
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x58]
mov ecx, 0x18
call fcn.140078e70
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140009f81
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x610]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14000a3b0
jmp 0x140009f84
mov rdi, r12
mov qword [rbp + 0x128], rdi
test rdi, rdi
je 0x14000a40e
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x70]
call rbx
mov ebx, eax
mov eax, esi
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x140009fdb
mov rcx, qword [rdi]
test rcx, rcx
je 0x140009fbc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140009fce
call fcn.140078eb4
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140078eb4
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
js 0x1400093fe
mov qword [rsp + 0x58], r12
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x78]
mov ebx, eax
test eax, eax
js 0x1400093fe
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x40]
mov ecx, 0x18
call fcn.140078e70
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a055
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.Principal1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a3bb
jmp 0x14000a058
mov rbx, r12
mov qword [rbp + 0x130], rbx
test rbx, rbx
je 0x14000a43a
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x58]
call rdi
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000a0af
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a090
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a0a2
call fcn.140078eb4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140078eb4
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x60]
mov ecx, 0x18
call fcn.140078e70
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a0f8
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000a3c6
jmp 0x14000a0fb
mov rbx, r12
mov qword [rbp + 0x140], rbx
test rbx, rbx
je 0x14000a43a
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x58]
call rdi
nop
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000a152
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000a133
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000a145
call fcn.140078eb4
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140078eb4
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov edx, 3
call qword [rax + 0x70]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
test r15b, r15b
je 0x14000a176
mov edx, 1
jmp 0x14000a178
xor edx, edx
call qword [rax + 0x90]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
js 0x1400093fe
mov word [rbp - 0x30], r13w
lea rcx, str.D:_A__FA___WD_
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x28], rax
test rax, rax
je 0x14000a419
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax]
mov r15, qword [rcx + 0x88]
movups xmm8, xmmword [rbp - 0x30]
movsd xmm9, qword [rbp - 0x20]
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm10, xmmword [rbp + 0x80]
movsd xmm11, qword [rbp + 0x90]
mov word [rbp + 0x50], r13w
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x14000a424
movups xmm6, xmmword [rbp + 0x50]
movsd xmm7, qword [rbp + 0x60]
mov r14, qword [rsp + 0x70]
lea rbx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 8
cmovae rbx, qword [rbp + 0x1b0]
mov ecx, 0x18
call fcn.140078e70
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000a26c
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
jne 0x14000a26f
test rbx, rbx
jne 0x14000a3d1
jmp 0x14000a26f
mov rdi, r12
mov qword [rbp + 0x100], rdi
test rdi, rdi
je 0x14000a42f
movaps xmmword [rbp + 0x30], xmm8
movsd qword [rbp + 0x40], xmm9
movaps xmmword [rbp - 0x10], xmm10
movsd qword [rbp], xmm11
movaps xmmword [rbp + 0x10], xmm6
movsd qword [rbp + 0x20], xmm7
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 3
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 6
mov r8, r14
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x80]
call r15
mov ebx, eax
lock xadd dword [rdi + 0x10], esi
cmp esi, 1
jne 0x14000a31a
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000a2fa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r12
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000a30c
call fcn.140078eb4
mov qword [rdi + 8], r12
mov edx, 0x18
mov rcx, rdi
call fcn.140078eb4
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x1400093fe
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
call fcn.14007fed8
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
int3
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
int3
mov ecx, 0x8007000e
call fcn.14007a0b0
int3
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
nop
mov ecx, 0x8007000e
call fcn.14007a0b0
int3
mov ecx, 0x8007000e
call fcn.14007a0b0
int3