Function at 0x140004a40
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14009d2d0]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor ebx, ebx
mov qword [rcx + 0x18], rbx
xor r15b, r15b
xor r13b, r13b
mov esi, ebx
mov dword [rsp + 0x30], ebx
cmp qword [rcx], rbx
je 0x1400050d9
mov rcx, qword [rcx + 8]
lea rax, [rcx - 1]
cmp rax, 0x7fff
ja 0x1400050d9
lea rax, [rcx + 1]
mov r14d, 0x105
cmp rax, r14
cmova r14, rax
lea rcx, [r14 + r14]
call fcn.14004f290
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x140004ad4
lea eax, [rbx + 0xe]
jmp 0x1400050de
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.1400464e0
cmp qword [rdi + 8], 2
jbe 0x140004b36
mov rdx, qword [rdi]
cmp word [rdx], 0x5c
je 0x140004b36
cmp word [rdx + 2], 0x3a
je 0x140004b36
mov r9, r14
mov r8, qword [rdi + 0x18]
xor ecx, ecx
call fcn.140004200
test al, al
jne 0x140004b91
mov rcx, qword [rdi + 0x18]
call fcn.14004a7f8
mov qword [rdi + 0x18], rbx
mov r14, rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f
setne r13b
mov esi, 2
mov dword [rsp + 0x30], esi
jmp 0x140004b91
mov r8, qword [rdi]
mov rcx, qword [rdi + 0x18]
test r14, r14
je 0x140004b8e
cmp r14, 0x7fffffff
ja 0x140004b8b
mov rdx, r14
mov r9d, 0x7ffffffe
sub r9, r14
sub r8, rcx
nop word [rax + rax]
lea rax, [r9 + rdx]
test rax, rax
je 0x140004b8b
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140004b82
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140004b60
jmp 0x140004b87
test rdx, rdx
jne 0x140004b8b
sub rcx, 2
mov word [rcx], bx
mov r15b, 1
mov r12, qword [rdi + 0x10]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x68], ecx
test r13b, r13b
je 0x140004bdc
lea rcx, str.NCPrivateLoadAndValidateMPTDll:_Looking_in_current_directory_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call fcn.140004400
mov esi, eax
mov dword [rsp + 0x30], eax
jmp 0x140004c5f
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x140004c5f
mov byte [rbp - 0x80], 0
mov dword [rbp - 0x7c], ecx
mov qword [rbp], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.140004800
mov esi, eax
mov dword [rsp + 0x30], eax
cmp byte [rbp - 0x80], 0
je 0x140004c5f
mov dword [rbp + 0x10], 0xaac56b
mov dword [rbp + 0x14], 0x11d0cd44
mov dword [rbp + 0x18], 0xc000c28c
mov dword [rbp + 0x1c], 0xee95c24f
mov dword [rbp - 0x28], 2
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
cmp esi, 2
je 0x140004c70
cmp esi, 0x80092003
jne 0x140004dc6
test r15b, r15b
jne 0x140004dc6
lea rcx, str.NCPrivateLoadAndValidateMPTDll:_Looking_in_EXE_directory_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.1400045f0
test rax, rax
je 0x140004db8
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.1400045f0
mov ecx, dword [rsp + 0x58]
mov rbx, qword [rdi + 8]
add rcx, 2
add rbx, rcx
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x140004cd7
cmp r14, rbx
jae 0x140004ce7
mov rcx, rax
call fcn.14004a7f8
mov qword [rdi + 0x18], 0
mov r14, rbx
lea rcx, [rbx + rbx]
call fcn.14004f290
mov qword [rdi + 0x18], rax
mov esi, 0xe
test rax, rax
je 0x140004dac
mov rbx, qword [rdi]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.1400045f0
mov qword [rsp + 0x20], rbx
mov r9, rax
lea r8, str._ls_ls
mov rdx, r14
mov rcx, qword [rdi + 0x18]
call fcn.140004980
test eax, eax
js 0x140004da7
mov rax, qword [rdi + 0x18]
mov byte [rbp - 0x80], 0
mov dword [rbp - 0x7c], 0
mov qword [rbp], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.140004800
mov esi, eax
cmp byte [rbp - 0x80], 0
je 0x140004dbc
mov dword [rbp + 0x10], 0xaac56b
mov dword [rbp + 0x14], 0x11d0cd44
mov dword [rbp + 0x18], 0xc000c28c
mov dword [rbp + 0x1c], 0xee95c24f
mov dword [rbp - 0x28], 2
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.WINTRUST.dll_WinVerifyTrust]
jmp 0x140004dbc
mov esi, 0x6f
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
jmp 0x140004df2
mov esi, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
cmp esi, 0x80092026
je 0x140005079
cmp esi, 0x800b0101
je 0x140005079
cmp esi, 0x800b010e
je 0x140005079
test esi, esi
je 0x140005079
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x140004e08
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
mov r15d, 0x104
test rbx, rbx
jne 0x140004e86
mov r14d, r15d
mov rdi, 0xffffffffffffffff
nop dword [rax]
mov ecx, r14d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140043788
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, r14d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r13d, eax
cmp r14d, eax
jne 0x140004e77
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140004e77
add r14d, r14d
mov rcx, rbx
call fcn.140043780
mov qword [rsp + 0x40], 0
jmp 0x140004e20
test r13d, r13d
mov rdi, qword [rsp + 0x70]
je 0x140004eba
mov dword [rsp + 0x48], r13d
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140005061
mov edx, 0x8000
mov ecx, edx
xor r8d, r8d
nop
cmp word [rax], r8w
je 0x140004ecf
add rax, 2
sub rcx, 1
jne 0x140004ea0
xor edx, edx
mov r8d, 0x80070057
jmp 0x140004ed2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140043780
xor ebx, ebx
jmp 0x140005061
sub rdx, rcx
test r8d, r8d
js 0x140005061
xor eax, eax
test r8d, r8d
cmovns rax, rdx
mov qword [rbp + 0x10], rax
test rbx, rbx
jne 0x140004f7d
mov r14d, r15d
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
mov ecx, r14d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140043788
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, r14d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r13d, eax
cmp r14d, eax
jne 0x140004f57
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140004f57
add r14d, r14d
mov rcx, rbx
call fcn.140043780
mov qword [rsp + 0x40], 0
jmp 0x140004f00
test r13d, r13d
mov rdi, qword [rsp + 0x70]
je 0x140004f68
mov dword [rsp + 0x48], r13d
jmp 0x140004f7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140043780
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x10]
add rcx, 0x200
add rax, rcx
mov qword [rbp + 0x10], rax
lea rcx, [rax + rax]
call fcn.14004f290
mov r13, rax
test rax, rax
je 0x140005061
test rbx, rbx
jne 0x14000502c
mov rdi, 0xffffffffffffffff
nop dword [rax]
nop dword [rax + rax]
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140043788
mov rbx, rax
mov r8d, r15d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r14d, eax
cmp r15d, eax
jne 0x140005012
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140005012
add r15d, r15d
mov rcx, rbx
call fcn.140043780
mov qword [rsp + 0x40], 0
jmp 0x140004fc0
test r14d, r14d
mov rdi, qword [rsp + 0x70]
jne 0x14000502c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.140043780
xor ebx, ebx
mov dword [rsp + 0x28], esi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, str.NotComDllGetInterface:__ls_loading__ls__WinVerifyTrust_failed_with__08x_n
mov rdx, qword [rbp + 0x10]
mov rcx, r13
call fcn.140004980
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, r13
call fcn.14004a7f8
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400050b9
call fcn.14004a7f8
mov qword [rdi + 0x18], 0
jmp 0x1400050b9
xor esi, esi
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400050b4
xor edx, edx
lea r8d, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x1400050b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [rdi + 0x18]
call fcn.14004a7f8
mov qword [rdi + 0x18], 0
jmp 0x1400050b9
mov esi, 0x54f
test rbx, rbx
je 0x1400050c6
mov rcx, rbx
call fcn.140043780
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400050d5
call fcn.140043780
mov eax, esi
jmp 0x1400050de
mov eax, 0x57
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140043760
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret