Function at 0x14003ca4c
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x128]
sub rsp, 0x228
mov qword [rbp + 0xc0], 0xfffffffffffffffe
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov edi, r9d
mov dword [rbp - 0x30], r9d
mov qword [rbp + 0x58], r8
mov qword [rbp + 0x90], rdx
mov r12, rcx
mov qword [rbp - 0x38], rcx
mov r15, qword [rbp + 0x190]
mov qword [rbp - 0x28], r15
mov r14, qword [rbp + 0x198]
mov qword [rbp - 0x68], r14
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x80], rax
xor ecx, ecx
mov dword [rbp - 0x10], ecx
mov dword [rbp - 0x5c], ecx
mov r13d, ecx
mov qword [rbp - 8], rcx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x78], rcx
mov ebx, ecx
mov qword [rbp - 0x40], rcx
mov esi, ecx
mov qword [rbp - 0x58], rcx
mov qword [rbp], rcx
mov dword [rsp + 0x70], ecx
mov qword [rbp + 8], rcx
mov byte [rbp - 0x5e], cl
mov byte [rbp - 0x60], cl
mov dword [rbp - 0x20], ecx
mov byte [rbp - 0x50], cl
mov byte [rbp - 0x6f], cl
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
lea rax, [0x14017d3a8]
mov rcx, qword [0x14017d3a8]
cmp rcx, rax
je 0x14003cb4a
test byte [rcx + 0x1c], 1
je 0x14003cb4a
cmp byte [rcx + 0x19], 4
jb 0x14003cb4a
mov edx, 0x1fc
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
cmp edi, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
je 0x14003cb6c
lea r8, [0x140004670]
mov edx, 0x2f0e
lea rcx, [0x140003c50]
call fcn.1400a8be8
mov rax, qword [rbp + 0x40]
mov byte [rax], bl
mov rax, qword [rbp + 0x80]
and dword [rax], ebx
lea rax, [r12 + 0x18]
mov qword [rbp + 0xb8], rax
lea rdi, [rax + 0x40]
mov qword [rbp + 0x10], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r12 + 0xe0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [r12 + 0xe0]
mov dword [r14 + 0x10], r11d
lea rcx, [rbp - 0x50]
call fcn.1400b2d34
mov edi, eax
test eax, eax
jns 0x14003cc0c
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003ee85
test byte [rcx + 0x1c], 1
je 0x14003ee85
cmp byte [rcx + 0x19], 2
jb 0x14003ee85
mov edx, 0x1fd
mov r9d, edi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
jmp 0x14003ee85
lea r8, [rbp - 8]
lea rdx, [0x140001800]
mov rcx, qword [r12 + 0x158]
call fcn.1400a9ab8
mov edi, eax
test eax, eax
js 0x14003ee81
mov r13d, dword [rbp - 0x30]
mov ebx, r13d
shl rbx, 4
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp + 0x28], rax
test rax, rax
jne 0x14003cc55
mov edi, 0x8007000e
jmp 0x14003ee7d
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r11d, r13d
shl r11d, 4
mov ebx, r11d
mov ecx, r11d
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x14003cc4b
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
cmp dword [r14 + 8], r13d
jae 0x14003ed41
mov al, sil
mov byte [rsp + 0x74], 0
mov byte [rbp - 0x70], 0
neg al
sbb eax, eax
and eax, dword [rbp - 0x20]
mov dword [rbp - 0x20], eax
xor al, al
mov byte [rbp - 0x80], al
mov ebx, dword [r14 + 8]
mov r15d, ebx
imul r15, r15, 0x170
add r15, qword [r12 + 0xd8]
mov qword [rbp - 0x78], r15
mov rax, qword [rbp + 0x58]
mov r13, qword [rax + rbx*8]
mov qword [rsp + 0x78], r13
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [r12 + reloc.ADVAPI32.dll_TraceEvent], ebx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp + 0x100]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test byte [r15 + 0x54], 1
je 0x14003cd2f
mov ecx, dword [r14 + 8]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax + rcx*8]
call fcn.1400a987c
mov r13d, eax
test eax, eax
js 0x14003d026
jmp 0x14003ce66
xor ebx, ebx
mov rax, qword [r12 + 0x1b0]
cmp dword [rax + 0x50], ebx
jbe 0x14003cd77
xor esi, esi
mov r14, qword [rax + 0x58]
add r14, rsi
mov qword [rbp + 0x78], r14
mov rdx, r13
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14003cd6f
inc ebx
add rsi, 0x38
mov rax, qword [r12 + 0x1b0]
cmp ebx, dword [rax + 0x50]
jb 0x14003cd40
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x58]
mov rax, qword [r12 + 0x1b0]
cmp ebx, dword [rax + 0x50]
jne 0x14003cddc
mov r13d, dword [r15 + 0x20]
test r13d, r13d
js 0x14003cdcc
mov r13d, 0x80780020
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003cdd3
test byte [rcx + 0x1c], 1
je 0x14003cdd3
cmp byte [rcx + 0x19], 2
jb 0x14003cdd3
mov edx, 0x1fe
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
mov rcx, qword [0x14017d3a8]
mov byte [rbp - 0x70], 1
jmp 0x14003e98f
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x14003cdf4
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x78]
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x14003ce4e
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003ce3f
test byte [rcx + 0x1c], 1
je 0x14003ce3f
cmp byte [rcx + 0x19], 2
jb 0x14003ce3f
mov edx, 0x1ff
mov r9, r13
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
mov rcx, qword [0x14017d3a8]
mov r13d, 0x80780020
mov byte [rbp - 0x70], 1
jmp 0x14003e996
lea rdx, [rbp - 0x40]
call fcn.1400a987c
mov r13d, eax
test eax, eax
js 0x14003d026
mov rbx, qword [rbp + 0x10]
test byte [r15 + 0x54], 0x40
je 0x14003ced0
mov rdx, r15
mov rcx, r12
call fcn.14003b494
mov edi, eax
test eax, eax
js 0x14003ee67
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r12 + 0xe4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [r12 + 0xe4]
mov dword [r14 + 0xc], r11d
mov eax, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
shl rax, 4
movups xmm0, xmmword [rbp + 0x100]
mov rcx, qword [rbp + 0x28]
movdqu xmmword [rax + rcx], xmm0
inc dword [r14 + 8]
mov al, byte [rbp - 0x80]
jmp 0x14003ecc5
test byte [r15 + 0x54], 8
jne 0x14003cf71
test byte [r15 + 0x54], 0x20
jne 0x14003cefa
lea r8, [0x140004690]
mov edx, 0x2faa
lea rcx, [0x140003c50]
call fcn.1400a8be8
mov rax, qword [0x14017d3a8]
lea rcx, [0x14017d3a8]
cmp rax, rcx
je 0x14003cf4e
test byte [rax + 0x1c], 1
je 0x14003cf4e
cmp byte [rax + 0x19], 4
jb 0x14003cf4e
lea rdx, [r15 + 0x44]
lea rcx, [rbp + 0x98]
call fcn.14002853c
nop
or dword [rbp - 0x10], 1
mov edx, 0x200
mov r9, qword [rax]
lea r8, [0x140003c28]
mov rcx, qword [0x14017d3a8]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
nop
mov eax, dword [rbp - 0x10]
test al, 1
je 0x14003cec4
and eax, 0xfffffffe
mov dword [rbp - 0x10], eax
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x14003cec4
mov r8b, 1
mov edx, 8
mov rcx, r12
call fcn.1400449b4
mov dword [r14 + 0x2c], 8
mov rbx, qword [rbp - 0x28]
mov eax, dword [rbx + 8]
cmp dword [r14 + 8], eax
jne 0x14003cfaa
cmp qword [rbx + 0x30], 0
je 0x14003cfaa
mov rsi, qword [rbx + 0x30]
mov qword [rbp - 0x58], rsi
jmp 0x14003d556
test rsi, rsi
je 0x14003cfc3
cmp rsi, qword [r14 + 0x30]
je 0x14003cfc3
cmp rsi, qword [rbx + 0x30]
je 0x14003cfc3
mov rcx, rsi
call fcn.1400e0d04
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], rax
test byte [r15 + 0x54], 1
je 0x14003d032
mov rcx, r12
call fcn.140045a68
mov r13d, eax
test eax, eax
jns 0x14003d032
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003e98f
test byte [rcx + 0x1c], 1
je 0x14003e98f
cmp byte [rcx + 0x19], 2
jb 0x14003e98f
mov edx, 0x201
mov r9d, edi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
jmp 0x14003e98f
lea r14, [r12 + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
imul r11, r11, 0x170
add r11, qword [r12 + 0xd8]
xor edi, edi
mov qword [r11], rdi
mov qword [r11 + 8], rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [r12 + 0x154], 0x10
jne 0x14003d0a0
cmp byte [r12 + 0x17c], dil
jne 0x14003d088
cmp byte [r12 + 0x17d], dil
je 0x14003d0a0
lea r8, [0x1400046d0]
mov edx, 0x2fe4
lea rcx, [0x140003c50]
call fcn.1400a8be8
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d0e4
test byte [rcx + 0x1c], 1
je 0x14003d0e4
mov rbx, qword [rbp - 0x40]
cmp byte [rcx + 0x19], 4
jb 0x14003d0e8
mov edx, 0x202
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ed50
jmp 0x14003d0e8
mov rbx, qword [rbp - 0x40]
mov ecx, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
imul rcx, rcx, 0x170
add rcx, 0x8c
add rcx, qword [r12 + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r11d, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
lea rax, [rsp + 0x70]
mov rcx, rbx
test r11b, 2
je 0x14003d175
shr r11d, 4
and r11b, 1
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9b, byte [r12 + 0x17d]
mov r8b, byte [r12 + 0x17c]
mov dl, r11b
call fcn.1400d9664
mov esi, eax
jmp 0x14003d268
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], dil
xor r9d, r9d
mov r8b, byte [r12 + 0x17d]
mov dl, byte [r12 + 0x17c]
call fcn.1400d9830
mov esi, eax
test eax, eax
jne 0x14003d268
mov rbx, qword [rbp - 0x48]
mov qword [rbp - 0x58], rbx
test rbx, rbx
jne 0x14003d1f6
lea r8, [0x14000cff0]
mov edx, 0x1fb9
lea rcx, [0x14000cc88]
call fcn.1400a8be8
cmp byte [rbx + 0xb8], dil
je 0x14003d242
mov edx, 0x2000
mov rcx, r15
call fcn.14002b168
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d270
test byte [rcx + 0x1c], 1
je 0x14003d270
cmp byte [rcx + 0x19], 4
jb 0x14003d270
mov edx, 0x203
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
jmp 0x14003d270
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d270
test byte [rcx + 0x1c], 1
je 0x14003d270
cmp byte [rcx + 0x19], 4
jb 0x14003d270
mov edx, 0x204
jmp 0x14003d230
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x58], rax
mov ecx, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
imul rcx, rcx, 0x170
mov rax, qword [r12 + 0xd8]
add rax, 0x94
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r10, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp r10, rax
je 0x14003d338
test byte [r10 + 0x1c], 1
je 0x14003d338
cmp byte [r10 + 0x19], 4
jb 0x14003d338
mov edx, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
imul rdx, rdx, 0x170
mov rcx, qword [r12 + 0xd8]
mov eax, dword [rdx + rcx + 0x8c]
mov dword [rbp + 0x88], eax
mov eax, dword [rdx + rcx + 0x90]
mov dword [rbp + 0x8c], eax
mov eax, dword [rdx + rcx + 0x94]
mov dword [rbp + 0x68], eax
mov eax, dword [rdx + rcx + 0x98]
mov dword [rbp + 0x6c], eax
mov rcx, qword [rbp + 0x68]
sub rcx, qword [rbp + 0x88]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x205
lea r8, [0x140003c28]
mov rcx, qword [r10 + 0x10]
call fcn.140029954
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
imul r11, r11, 0x170
add r11, qword [r12 + 0xd8]
mov rdi, qword [rbp + 0x30]
mov qword [r11], rdi
mov rbx, qword [rbp + 0x20]
mov qword [r11 + 8], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rbp - 0x68]
mov qword [r14 + 0x20], rbx
mov qword [r14 + 0x18], rdi
mov ecx, esi
test esi, esi
je 0x14003d54e
dec ecx
je 0x14003d518
sub ecx, 3
je 0x14003d47e
dec ecx
je 0x14003d419
dec ecx
je 0x14003d47e
dec ecx
je 0x14003d419
sub ecx, 0xf
je 0x14003d47e
cmp ecx, 9
je 0x14003d47e
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d400
test byte [rcx + 0x1c], 1
je 0x14003d400
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14003d404
mov edx, 0x208
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003d404
mov edi, dword [rsp + 0x70]
mov ecx, esi
mov edx, edi
lea r8, [rbp - 0x5c]
call fcn.140120c90
mov r13d, eax
jmp 0x14003d026
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d460
test byte [rcx + 0x1c], 1
je 0x14003d460
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14003d464
mov edx, 0x207
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003d464
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x5c]
mov edx, edi
mov ecx, esi
call fcn.140120c90
mov r13d, eax
mov byte [rsp + 0x74], 1
jmp 0x14003d026
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d4c5
test byte [rcx + 0x1c], 1
je 0x14003d4c5
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14003d4c9
mov edx, 0x206
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003d4c9
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x5c]
mov edx, edi
mov ecx, esi
call fcn.140120c90
mov r13d, eax
mov rsi, r15
test byte [r15 + 0x54], 1
jne 0x14003d501
lea rdx, [rbp - 0x6f]
mov rcx, qword [rbp - 0x40]
call fcn.14003c7e4
test eax, eax
js 0x14003d501
cmp byte [rbp - 0x6f], 0
mov eax, 0x80780169
cmove r13d, eax
mov byte [rbp - 0x70], 1
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
jmp 0x14003e999
mov rax, qword [r12 + 0x18]
lea rcx, [r12 + 0x18]
call qword [rax + CoRevokeClassObject]
mov rcx, qword [0x14017d3a8]
mov rsi, r15
lea rdi, [0x14017d3a8]
mov r15, qword [rsp + 0x78]
test al, al
je 0x14003e99e
mov r13d, 0x80780167
jmp 0x14003e99e
mov rsi, qword [rbp - 0x58]
mov rbx, qword [rbp - 0x28]
mov qword [r14 + 0x30], rsi
mov eax, dword [rbx + 8]
cmp dword [r14 + 8], eax
jne 0x14003d590
cmp qword [rbx + 0x30], 0
jne 0x14003d575
test byte [r15 + 0x54], 1
jne 0x14003d575
mov qword [rbx + 0x30], rsi
cmp dword [r14 + 8], eax
jne 0x14003d590
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14003d590
mov qword [rbp], rcx
mov edx, dword [rbx + 0x40]
jmp 0x14003d639
mov rcx, qword [rbp]
test rcx, rcx
je 0x14003d5ab
cmp rcx, qword [r14 + 0x38]
je 0x14003d5ab
cmp rcx, qword [rbx + 0x38]
je 0x14003d5ab
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
mov qword [rbp], rcx
xor edx, edx
mov dword [rbp - 0x18], edx
test byte [r12 + 0x154], 2
je 0x14003d639
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x18]
lea rdx, [rbp]
mov rcx, rsi
call fcn.1400dd3dc
mov ebx, eax
test eax, eax
je 0x14003d62e
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d623
test byte [rcx + 0x1c], 1
je 0x14003d623
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14003d627
mov edx, 0x209
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003d627
mov edi, dword [rsp + 0x70]
mov ecx, ebx
jmp 0x14003d406
mov rcx, qword [rbp]
mov edx, dword [rbp - 0x18]
mov rbx, qword [rbp - 0x28]
mov qword [r14 + 0x38], rcx
mov dword [r14 + 0x40], edx
mov eax, dword [rbx + 8]
cmp dword [r14 + 8], eax
jne 0x14003d65f
cmp qword [rbx + 0x38], 0
jne 0x14003d65f
test byte [r15 + 0x54], 1
jne 0x14003d65f
mov qword [rbx + 0x38], rcx
mov dword [rbx + 0x40], edx
mov r8b, 1
mov ebx, 9
mov edx, ebx
mov rcx, r12
call fcn.1400449b4
mov edx, ebx
mov rcx, r14
call fcn.14002cdf8
test byte [r12 + 0x154], 2
je 0x14003d6d6
lea r8, [rsp + 0x70]
mov rdx, qword [rbp]
mov rcx, rsi
call fcn.1400dd598
mov ebx, eax
test eax, eax
je 0x14003d6d6
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d623
test byte [rcx + 0x1c], 1
je 0x14003d623
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14003d627
mov edx, 0x20a
jmp 0x14003d604
mov rax, qword [rbp + 8]
test rax, rax
je 0x14003d6ed
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbp + 8], 0
lea rdx, [r15 + 0x44]
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9, [0x140004178]
mov r8d, dword [r15 + 0x54]
mov rcx, qword [r12 + 0x1d8]
call fcn.140131854
mov r13d, eax
test eax, eax
js 0x14003d026
lea r14, [r12 + 0x28]
mov rcx, r14
call fcn.14011e39c
mov rdi, qword [rbp + 8]
mov rdx, rdi
mov rcx, r12
call fcn.140038a9c
mov r13d, eax
test eax, eax
jns 0x14003d799
mov byte [rsp + 0x74], 1
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003e98b
test byte [rcx + 0x1c], 1
je 0x14003e98b
cmp byte [rcx + 0x19], 2
jb 0x14003e98b
mov edx, 0x20b
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
jmp 0x14003e98b
xor edx, edx
mov rcx, r14
call fcn.14011e208
mov edi, eax
test eax, eax
js 0x14003ee5a
xor ebx, ebx
xor esi, esi
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0xa8]
mov rdi, qword [rbp - 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x14003d7e4
mov rcx, rdi
call fcn.140154be4
mov r13d, eax
jmp 0x14003d7f5
mov rbx, qword [rbp + 0xa0]
mov rsi, qword [rbp + 0xa8]
xor r13d, r13d
and qword [rbp + 0x48], 0
xor dil, dil
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140004720]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003d8f9
and dword [rbp - 0x18], eax
mov dword [rbp - 0x48], 4
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140004778]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003d882
mov eax, dword [rbp - 0x18]
shl rax, 0x14
test rax, rax
je 0x14003d879
cmp rax, rsi
jae 0x14003d879
mov rsi, rax
mov dil, 1
lea r15, [0x14017d3a8]
jmp 0x14003d8bd
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
cmp rcx, r15
je 0x14003d8ed
test byte [rcx + 0x1c], 1
je 0x14003d8c4
cmp byte [rcx + 0x19], 5
jb 0x14003d8c4
mov edx, 0x20c
lea r9, [0x140004720]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
mov rcx, qword [0x14017d3a8]
cmp rcx, r15
je 0x14003d8ed
test byte [rcx + 0x1c], 1
je 0x14003d8ed
cmp byte [rcx + 0x19], 4
jb 0x14003d8ed
mov edx, 0x20d
lea r9, [0x140004720]
mov r8, rsi
mov rcx, qword [rcx + 0x10]
call fcn.1400297a4
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003d934
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003d942
test byte [rcx + 0x1c], 1
je 0x14003d942
cmp byte [rcx + 0x19], 5
jb 0x14003d942
mov edx, 0x20e
lea r9, [0x140004720]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
lea rax, [0x14017d3a8]
mov rcx, qword [0x14017d3a8]
test r13d, r13d
jns 0x14003d959
mov byte [rsp + 0x74], 1
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x78]
jmp 0x14003d50c
cmp rcx, rax
je 0x14003d987
test byte [rcx + 0x1c], 1
je 0x14003d987
cmp byte [rcx + 0x19], 4
jb 0x14003d987
mov edx, 0x20f
mov qword [rsp + 0x20], rsi
mov r9, rbx
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001deac
mov rcx, r14
call fcn.14011e39c
test byte [r12 + 0x154], 2
je 0x14003db45
mov r15, qword [rbp - 0x68]
mov eax, dword [r15 + 0xc]
mov r8, qword [rbp - 0x28]
cmp eax, dword [r8 + 0xc]
jne 0x14003d9d7
mov bl, 1
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
cmp rcx, r15
je 0x14003da3e
test byte [rcx + 0x1c], bl
je 0x14003da3e
cmp byte [rcx + 0x19], 4
jb 0x14003da3e
mov edx, 0x210
jmp 0x14003da1f
ja 0x14003d9f5
lea r8, [0x140004790]
mov edx, 0x310d
lea rcx, [0x140003c50]
call fcn.1400a8be8
mov r8, qword [rbp - 0x28]
xor bl, bl
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003da3e
test byte [rcx + 0x1c], 1
je 0x14003da3e
cmp byte [rcx + 0x19], 4
jb 0x14003da3e
mov edx, 0x211
mov eax, dword [r15 + 0xc]
mov r9d, dword [r8 + 0xc]
mov dword [rsp + 0x20], eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.1400285b4
mov rcx, qword [0x14017d3a8]
mov edx, 0x1400000
cmp rsi, rdx
ja 0x14003daa1
neg bl
sbb r13d, r13d
and r13d, 0x44
add r13d, 0x80780030
mov byte [rsp + 0x74], 1
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003da94
test byte [rcx + 0x1c], 1
je 0x14003da94
cmp byte [rcx + 0x19], 3
jb 0x14003da94
mov edx, 0x212
mov r9, rsi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140029954
mov rcx, qword [0x14017d3a8]
mov r14, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x78]
jmp 0x14003e999
test dil, dil
jne 0x14003daf6
mov eax, 0x40000000
cmp rsi, rax
ja 0x14003daf6
test bl, bl
je 0x14003daf6
mov r13d, 0x80780080
mov byte [rsp + 0x74], 1
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003da94
test byte [rcx + 0x1c], 1
je 0x14003da94
cmp byte [rcx + 0x19], 3
jb 0x14003da94
mov edx, 0x213
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001deac
jmp 0x14003da8d
sub rsi, rdx
cmp rsi, 0x1100000
ja 0x14003db45
neg bl
sbb r13d, r13d
and r13d, 0x44
add r13d, 0x80780030
mov byte [rsp + 0x74], 1
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003da94
test byte [rcx + 0x1c], 1
je 0x14003da94
cmp byte [rcx + 0x19], 3
jb 0x14003da94
mov edx, 0x214
jmp 0x14003da7a
mov dil, 1
mov byte [rbp - 0x5d], dil
mov rbx, qword [rbp + 0x18]
test byte [r12 + 0x154], 4
je 0x14003db8b
mov r9d, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
shl r9d, 4
add r9, rbx
lea r8, [rbp - 0x5d]
mov rdx, qword [rbp + 0x90]
mov rcx, r12
call fcn.140037248
mov edi, eax
test eax, eax
js 0x14003ee54
mov dil, byte [rbp - 0x5d]
mov byte [rbp - 0x5f], dil
lea r15, [r12 + 0x58]
mov qword [rbp - 0x18], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
imul r11, r11, 0x170
add r11, qword [r12 + 0xd8]
and qword [r11], 0
and qword [r11 + 8], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003dc3a
test byte [rcx + 0x1c], 1
je 0x14003dc0f
cmp byte [rcx + 0x19], 4
jb 0x14003dc0f
mov edx, 0x215
mov r9, rsi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140029954
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003dc3a
test byte [rcx + 0x1c], 1
je 0x14003dc3a
cmp byte [rcx + 0x19], 4
jb 0x14003dc3a
mov edx, 0x216
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
mov ecx, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
imul rcx, rcx, 0x170
add rcx, 0x9c
add rcx, qword [r12 + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
test byte [r12 + 0x154], 2
je 0x14003dd03
mov rdx, qword [r14]
cmp rdx, 0xffffffffffffffff
jne 0x14003dc83
or rdx, rdx
cmp qword [r14 + 8], 0xffffffffffffffff
cmovne rdx, qword [r14 + 8]
mov ecx, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
shl ecx, 4
add rcx, rbx
cmp dword [r12 + reloc.ADVAPI32.dll_TraceEvent], 4
sete r8b
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x4f]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x5f]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r12
mov r9, rsi
mov rdx, qword [rbp + 8]
mov rbx, qword [rbp - 0x58]
mov rcx, rbx
call fcn.1400da50c
mov r12d, eax
mov sil, byte [rbp - 0x4f]
jmp 0x14003e1d5
and qword [rbp - 0x48], 0
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0xd0]
call sub.msvcrt.dll_memset
test dil, dil
jne 0x14003ddc4
xor edx, edx
mov rcx, r14
call fcn.14011e208
mov edi, eax
test eax, eax
js 0x14003ee54
mov rdi, qword [rbp + 8]
mov rcx, rdi
call fcn.1400b01b0
mov bl, al
mov rcx, r14
call fcn.14011e39c
test bl, bl
je 0x14003ddc4
mov dword [rbp + 0xd0], 2
lea r8, [rbp + 0xd0]
mov rdx, rdi
mov rcx, r14
call fcn.140140e44
test eax, eax
jns 0x14003ddc4
mov rcx, qword [0x14017d3a8]
lea r15, [0x14017d3a8]
cmp rcx, r15
je 0x14003d94c
test byte [rcx + 0x1c], 1
je 0x14003d94c
cmp byte [rcx + 0x19], 2
jb 0x14003d94c
mov edx, 0x217
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
jmp 0x14003d94c
lea r9, [rbp - 0x48]
mov r8, qword [rbp + 0x50]
mov rsi, qword [rbp - 0x78]
mov rdx, rsi
mov rcx, r12
call fcn.14003aaf8
test eax, eax
jns 0x14003ddf2
mov r13d, eax
mov rcx, qword [0x14017d3a8]
mov r14, qword [rbp - 0x68]
jmp 0x14003d50c
xor edx, edx
mov rcx, r14
call fcn.14011e208
mov edi, eax
test eax, eax
js 0x14003ee54
lea rdx, [rbp + 0x38]
mov rdi, qword [rbp + 8]
mov rcx, rdi
call fcn.14013d010
mov ebx, eax
mov rcx, r14
call fcn.14011e39c
test ebx, ebx
jns 0x14003de6e
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003de66
test byte [rcx + 0x1c], 1
je 0x14003de66
cmp byte [rcx + 0x19], 2
jb 0x14003de66
mov edx, 0x218
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
mov r13d, ebx
jmp 0x14003dde9
movups xmm0, xmmword [rbp + 0xd8]
movdqu xmmword [rbp + 0xf0], xmm0
mov ecx, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
shl ecx, 4
add rcx, qword [rbp + 0x18]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x38], r14
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x5f]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r12
lea rdx, [fcn.140038804]
mov rbx, qword [rbp - 0x58]
mov rcx, rbx
call fcn.1400dbf0c
mov r12d, eax
test eax, eax
jne 0x14003e007
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x14003df78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003df5a
test byte [rcx + 0x1c], 1
je 0x14003df5a
cmp byte [rcx + 0x19], 2
jb 0x14003df5a
mov edx, 0x219
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
mov eax, dword [rsp + 0x70]
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
mov r12, qword [rbp - 0x38]
mov r14, qword [rbp - 0x68]
jmp 0x14003e999
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
mov dword [rsp + 0x70], eax
test eax, eax
je 0x14003dfb4
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003df5a
test byte [rcx + 0x1c], 1
je 0x14003df5a
cmp byte [rcx + 0x19], 2
jb 0x14003df5a
mov edx, 0x21a
jmp 0x14003df3c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14003e000
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003df5a
test byte [rcx + 0x1c], 1
je 0x14003df5a
cmp byte [rcx + 0x19], 2
jb 0x14003df5a
mov edx, 0x21b
jmp 0x14003df3c
xor r14d, r14d
mov qword [rbp + 0x38], r14
mov r15, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp r15, rdi
je 0x14003e0db
test byte [r15 + 0x1c], 4
je 0x14003e0db
cmp byte [r15 + 0x19], 4
jb 0x14003e0db
movzx eax, byte [rsi + 0x147]
movzx ecx, byte [rsi + 0x146]
movzx r8d, byte [rsi + 0x145]
movzx r9d, byte [rsi + 0x144]
movzx r10d, byte [rsi + 0x143]
movzx r11d, byte [rsi + 0x142]
movzx ebx, byte [rsi + 0x141]
movzx edi, byte [rsi + 0x140]
movzx esi, word [rsi + 0x13e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x13c]
mov edx, 0x21c
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rsi, qword [rbp - 0x78]
mov r9d, dword [rsi + reloc.ADVAPI32.dll_TraceEvent]
lea r8, [0x140003c28]
mov rcx, qword [r15 + 0x10]
call fcn.1400285fc
mov rbx, qword [rbp - 0x58]
lea rdi, [0x14017d3a8]
test rbx, rbx
jne 0x14003e0f8
lea r8, [0x14000cff0]
mov edx, 0x1fae
lea rcx, [0x14000cc88]
call fcn.1400a8be8
movups xmm0, xmmword [rbx + 0x30]
movdqu xmmword [rsi + 0x148], xmm0
mov r15, qword [0x14017d3a8]
cmp r15, rdi
je 0x14003e1c6
test byte [r15 + 0x1c], 4
je 0x14003e1c6
cmp byte [r15 + 0x19], 4
jb 0x14003e1c6
movzx eax, byte [rsi + 0x157]
movzx ecx, byte [rsi + 0x156]
movzx r8d, byte [rsi + 0x155]
movzx r9d, byte [rsi + 0x154]
movzx r10d, byte [rsi + 0x153]
movzx r11d, byte [rsi + 0x152]
movzx ebx, byte [rsi + 0x151]
movzx edi, byte [rsi + 0x150]
movzx esi, word [rsi + 0x14e]
mov rdx, qword [rbp - 0x78]
movzx r14d, word [rdx + 0x14c]
mov edx, 0x21d
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rax, qword [rbp - 0x78]
mov r9d, dword [rax + reloc.ADVAPI32.dll_TraceEvent]
lea r8, [0x140003c28]
mov rcx, qword [r15 + 0x10]
call fcn.1400285fc
mov sil, 1
mov byte [rbp - 0x4f], sil
mov dil, byte [rbp - 0x5d]
mov r15, qword [rbp - 0x18]
mov r14, qword [rbp - 0x38]
mov ecx, dword [r14 + reloc.ADVAPI32.dll_TraceEvent]
imul rcx, rcx, 0x170
mov rax, qword [r14 + 0xd8]
add rax, 0xa4
add rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r10, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp r10, rax
je 0x14003e28c
test byte [r10 + 0x1c], 1
je 0x14003e28c
cmp byte [r10 + 0x19], 4
jb 0x14003e28c
mov edx, dword [r14 + reloc.ADVAPI32.dll_TraceEvent]
imul rdx, rdx, 0x170
mov rcx, qword [r14 + 0xd8]
mov eax, dword [rdx + rcx + 0x9c]
mov dword [rbp + 0x70], eax
mov eax, dword [rdx + rcx + 0xa0]
mov dword [rbp + 0x74], eax
mov eax, dword [rdx + rcx + 0xa4]
mov dword [rbp + 0x60], eax
mov eax, dword [rdx + rcx + 0xa8]
mov dword [rbp + 0x64], eax
mov rcx, qword [rbp + 0x60]
sub rcx, qword [rbp + 0x70]
movabs rax, 0x346dc5d63886594b
mul rcx
mov r9, rdx
shr r9, 0xb
mov edx, 0x21e
lea r8, [0x140003c28]
mov rcx, qword [r10 + 0x10]
call fcn.140029954
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [rbp - 0x5f]
cmp byte [rbp - 0x60], 0
je 0x14003e2ba
mov rax, qword [rbp - 0x78]
mov byte [rax + 0x84], 1
test bl, bl
jne 0x14003e2ba
mov edx, CoRevokeClassObject
mov rcx, rax
call fcn.14002b168
test dil, dil
jne 0x14003e30d
test bl, bl
je 0x14003e30d
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003e2f7
test byte [rcx + 0x1c], 1
je 0x14003e2f7
cmp byte [rcx + 0x19], 4
jb 0x14003e2f7
mov edx, 0x21f
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
mov rax, qword [r14 + 0x188]
mov rcx, qword [rbp - 0x78]
mov qword [rcx + 0x78], rax
and dword [rcx + 0x80], 0
mov byte [rbp - 0x5e], 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [r14 + reloc.ADVAPI32.dll_TraceEvent]
imul r11, r11, 0x170
add r11, qword [r14 + 0xd8]
mov rdi, qword [rbp + 0x30]
mov qword [r11], rdi
mov rbx, qword [rbp + 0x20]
mov qword [r11 + 8], rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rbp - 0x68]
mov qword [r14 + 0x20], rbx
mov qword [r14 + 0x18], rdi
mov ecx, r12d
xor ebx, ebx
test r12d, r12d
je 0x14003e7ad
dec ecx
je 0x14003e773
sub ecx, 3
je 0x14003e6cc
dec ecx
je 0x14003e646
dec ecx
je 0x14003e6cc
dec ecx
je 0x14003e46b
cmp ecx, 0xd
je 0x14003e405
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003e3e0
test byte [rcx + 0x1c], 1
je 0x14003e3e0
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14003e3e4
mov edx, 0x227
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003e3e4
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x5c]
mov edx, edi
mov ecx, r12d
call fcn.140120c90
mov r13d, eax
mov rcx, qword [0x14017d3a8]
mov r12, qword [rbp - 0x38]
jmp 0x14003d950
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003e450
test byte [rcx + 0x1c], 1
je 0x14003e450
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14003e454
mov edx, 0x222
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x14
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003e454
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x5c]
mov edx, edi
mov ecx, 0x14
call fcn.140120c90
mov byte [rsp + 0x74], 1
jmp 0x14003e3f2
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x14003e4b6
test byte [rcx + 0x1c], 1
je 0x14003e4b6
mov edi, dword [rsp + 0x70]
cmp byte [rcx + 0x19], 2
jb 0x14003e4ba
mov edx, 0x223
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 7
mov r9, qword [rsp + 0x78]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003e4ba
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x5c]
mov edx, edi
mov ecx, 7
call fcn.140120c90
mov r13d, eax
mov byte [rbp - 0x5e], bl
cmp eax, 0x8078002a
jne 0x14003e620
cmp edi, 0x70
jne 0x14003e631
mov rcx, qword [0x14017d3a8]
cmp rcx, r12
je 0x14003e515
test byte [rcx + 0x1c], 1
je 0x14003e515
cmp byte [rcx + 0x19], 4
jb 0x14003e515
mov edx, 0x224
mov r9, qword [rbp - 8]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
mov qword [rbp - 0x18], rbx
mov dword [rbp - 0x48], ebx
cmp dword [rbp - 0x20], ebx
je 0x14003e539
lea r8, [0x1400047d0]
mov edx, 0x3249
lea rcx, [0x140003c50]
call fcn.1400a8be8
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x48]
mov rdi, qword [rbp - 0x58]
mov rcx, rdi
call fcn.1400d9ef0
test eax, eax
jne 0x14003e631
mov r12, qword [rbp - 0x38]
cmp byte [r12 + 0x428], bl
mov rbx, qword [rbp - 0x18]
mov rdx, rbx
je 0x14003e579
mov rcx, qword [r12 + 0x158]
call fcn.140136ae0
jmp 0x14003e581
mov rcx, r12
call fcn.140034430
test eax, eax
js 0x14003e5f0
xor r13d, r13d
mov byte [rbp - 0x80], 1
inc dword [rbp - 0x20]
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003da98
test byte [rcx + 0x1c], 1
je 0x14003da98
cmp byte [rcx + 0x19], 4
jb 0x14003da98
mov edx, 0x225
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], rax
mov r15, qword [rsp + 0x78]
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ed50
mov rcx, qword [0x14017d3a8]
mov rsi, qword [rbp - 0x78]
jmp 0x14003e99e
mov rcx, qword [0x14017d3a8]
lea rdx, [0x14017d3a8]
cmp rcx, rdx
je 0x14003e63c
test byte [rcx + 0x1c], 1
je 0x14003e63c
cmp byte [rcx + 0x19], 2
jb 0x14003e63c
mov r8d, eax
mov rdx, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400287b8
jmp 0x14003e628
mov r12, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x58]
test r13d, r13d
jns 0x14003e7b5
mov rcx, qword [0x14017d3a8]
mov r12, qword [rbp - 0x38]
mov byte [rsp + 0x74], 1
jmp 0x14003d950
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003e694
test byte [rcx + 0x1c], 1
je 0x14003e694
mov edi, dword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x14003e69d
mov edx, 0x221
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 5
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003e69d
mov r15, qword [rsp + 0x78]
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x5c]
mov edx, edi
mov ecx, 5
call fcn.140120c90
mov r13d, eax
cmp dword [rbp - 0x5c], ebx
jne 0x14003e6be
mov dword [rbp - 0x5c], eax
mov r13d, 0x80780166
mov byte [rsp + 0x74], 1
mov rsi, qword [rbp - 0x78]
jmp 0x14003e75c
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003e717
test byte [rcx + 0x1c], 1
je 0x14003e717
mov edi, dword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
cmp byte [rcx + 0x19], 2
jb 0x14003e720
mov edx, 0x220
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028d10
jmp 0x14003e720
mov r15, qword [rsp + 0x78]
mov edi, dword [rsp + 0x70]
lea r8, [rbp - 0x5c]
mov edx, edi
mov ecx, r12d
call fcn.140120c90
mov r13d, eax
mov rsi, qword [rbp - 0x78]
test byte [rsi + 0x54], 1
jne 0x14003e758
lea rdx, [rbp - 0x6f]
mov rcx, qword [rbp - 0x40]
call fcn.14003c7e4
test eax, eax
js 0x14003e758
cmp byte [rbp - 0x6f], bl
mov eax, 0x80780169
cmove r13d, eax
mov byte [rbp - 0x70], 1
mov r12, qword [rbp - 0x38]
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
jmp 0x14003e99e
mov rcx, qword [rbp + 0xb8]
mov rax, qword [rcx]
call qword [rax + CoRevokeClassObject]
mov rcx, qword [0x14017d3a8]
mov r12, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x78]
mov r15, qword [rsp + 0x78]
lea rdi, [0x14017d3a8]
test al, al
jne 0x14003d543
mov r13d, dword [r12 + 0x20]
jmp 0x14003e99e
mov r12, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x58]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [rbp - 0x78]
inc dword [rbx + 0x10]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [rbx + 0x10]
mov dword [r14 + 0x28], r11d
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r12 + 0xe4]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [r12 + 0xe4]
mov dword [r14 + 0xc], r11d
mov eax, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
add rax, rax
movups xmm0, xmmword [rbp + 0x100]
mov rcx, qword [rbp + 0x28]
movdqu xmmword [rcx + rax*8], xmm0
test byte [r12 + 0x154], 2
jne 0x14003e84a
mov rcx, rbx
call fcn.14002c798
test eax, eax
jns 0x14003e84a
mov r8d, eax
mov edx, 0x80780151
mov rsi, rbx
mov rcx, rbx
call fcn.14002b100
jmp 0x14003d505
test sil, sil
jne 0x14003e88e
mov rax, qword [rbp]
cmp qword [r14 + 0x38], rax
je 0x14003e871
lea r8, [0x1400047e8]
mov edx, 0x329e
lea rcx, [0x140003c50]
call fcn.1400a8be8
and qword [r14 + 0x38], 0
and dword [r14 + 0x40], 0
mov r13d, 0x80780030
mov byte [rsp + 0x74], 1
mov rsi, rbx
jmp 0x14003d505
and qword [rbp - 0x48], 0
lea rdx, [rbp - 0x48]
mov rcx, rdi
call fcn.1400e1d24
test eax, eax
je 0x14003e8bb
lea r8, [0x140004810]
mov edx, 0x32ac
lea rcx, [0x140003c50]
call fcn.1400a8be8
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x14003e8fb
mov rcx, qword [0x14017d3a8]
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x14003e902
test byte [rcx + 0x1c], 1
je 0x14003e902
cmp byte [rcx + 0x19], 2
jb 0x14003e902
mov edx, 0x228
mov r9, qword [rsp + 0x78]
mov r8, rbx
mov rcx, qword [rcx + 0x10]
call fcn.1400297a4
jmp 0x14003e902
lea rdi, [0x14017d3a8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rbp - 0x78]
mov rcx, qword [rsi + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsi + 0x28], rbx
mov rcx, qword [rsi + 0xd0]
add rcx, 0x58
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
jle 0x14003e94a
xor r8d, r8d
mov edx, 0x8078007d
mov rcx, rsi
call fcn.14002b100
mov ebx, reloc.ADVAPI32.dll_GetTraceEnableFlags
mov edx, ebx
mov rcx, rsi
call fcn.14002b240
mov edx, ebx
mov rcx, r14
call fcn.14002cdf8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [r12 + 0x154], 2
jne 0x14003e982
mov rdx, rsi
mov rcx, r12
call fcn.1400464bc
mov rcx, qword [0x14017d3a8]
jmp 0x14003e999
mov r14, qword [rbp - 0x68]
lea rdi, [0x14017d3a8]
mov rsi, r15
mov r15, qword [rsp + 0x78]
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x14003ea3d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.VirtDisk.dll_DetachVirtualDisk]
test eax, eax
je 0x14003e9ed
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x14003e9ed
test byte [rcx + 0x1c], 1
je 0x14003e9ed
cmp byte [rcx + 0x19], 3
jb 0x14003e9ed
mov edx, 0x229
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14003ea30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x14003ea37
test byte [rcx + 0x1c], 1
je 0x14003ea37
cmp byte [rcx + 0x19], 3
jb 0x14003ea37
mov edx, 0x22a
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
xor ebx, ebx
mov qword [rbp + 0x38], rbx
mov ebx, 0x80780030
cmp r13d, ebx
je 0x14003ea5f
cmp r13d, 0x8078002a
jne 0x14003eb1b
cmp dword [rsp + 0x70], 0x70
jne 0x14003eb3c
test byte [r12 + 0x154], 2
jne 0x14003eaa6
mov rcx, rsi
call fcn.14002c798
test eax, eax
jns 0x14003eaa6
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x14003eaa6
test byte [rcx + 0x1c], 1
je 0x14003eaa6
cmp byte [rcx + 0x19], 3
jb 0x14003eaa6
mov edx, 0x22b
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
lea r9, [0x1400fe8fc]
mov r8, qword [r12 + 0x188]
mov edx, dword [r12 + reloc.ADVAPI32.dll_TraceEvent]
mov rcx, qword [r12 + 0x158]
call fcn.14012eb30
test eax, eax
jns 0x14003eb14
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x14003eb1b
test byte [rcx + 0x1c], 1
je 0x14003eb1b
cmp byte [rcx + 0x19], 2
jb 0x14003eb1b
mov edx, 0x22c
mov dword [rsp + 0x28], eax
mov rax, qword [r12 + 0x160]
mov qword [rsp + 0x20], rax
mov r9, qword [r12 + 0x158]
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.140028ec8
mov rcx, qword [0x14017d3a8]
cmp r13d, ebx
jne 0x14003eb3c
test byte [r12 + 0x154], 2
je 0x14003eb3c
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0xc]
cmp dword [r14 + 0xc], eax
ja 0x14003ecd8
mov rbx, r15
cmp qword [rsi + 0x58], 0
cmovne rbx, qword [rsi + 0x58]
test r13d, r13d
jns 0x14003ec18
mov edx, reloc.ADVAPI32.dll_GetTraceLoggerHandle
mov rcx, r14
call fcn.14002cdf8
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x14003eb94
test byte [rcx + 0x1c], 1
je 0x14003eb94
cmp byte [rcx + 0x19], 2
jb 0x14003eb94
mov edx, 0x22e
mov dword [rsp + 0x20], r13d
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov r9d, r13d
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call fcn.14004c6b0
mov edi, eax
test eax, eax
jns 0x14003ebe9
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003ebe7
test byte [rcx + 0x1c], 1
je 0x14003ebe7
cmp byte [rcx + 0x19], 3
jb 0x14003ebe7
mov edx, 0x22f
mov dword [rsp + 0x20], r13d
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
xor edi, edi
mov r8d, dword [rbp - 0x5c]
mov edx, r13d
mov rcx, rsi
call fcn.14002b330
cmp byte [rbp - 0x70], 0
je 0x14003ed17
cmp byte [rbp - 0x50], 0
je 0x14003ec94
cmp byte [rsi + 0x68], 0
jne 0x14003ed17
jmp 0x14003ec94
cmp rcx, rdi
je 0x14003ec41
test byte [rcx + 0x1c], 1
je 0x14003ec41
cmp byte [rcx + 0x19], 4
jb 0x14003ec41
mov edx, 0x230
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
xor r9d, r9d
mov r8b, 1
mov rdx, rbx
mov rcx, r12
call fcn.14004c6b0
mov edi, eax
test eax, eax
jns 0x14003ec94
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14003ec94
test byte [rcx + 0x1c], 1
je 0x14003ec94
cmp byte [rcx + 0x19], 3
jb 0x14003ec94
mov edx, 0x231
mov dword [rsp + 0x20], r13d
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ecbc
mov al, byte [rbp - 0x80]
test al, al
jne 0x14003ec9f
inc dword [r14 + 8]
and qword [r14 + 0x18], 0
and qword [r14 + 0x20], 0
and dword [r14 + 0x28], 0
mov dword [r14 + 0x2c], reloc.ADVAPI32.dll_RegisterTraceGuidsW
and qword [r14 + 0x30], 0
and qword [r14 + 0x38], 0
and dword [r14 + 0x40], 0
mov r13d, dword [rbp - 0x30]
mov rsi, qword [rbp - 0x58]
cmp dword [r14 + 8], r13d
jae 0x14003ed3d
jmp 0x14003cc98
mov edx, 4
mov rcx, r14
call fcn.14002cdf8
mov rcx, qword [0x14017d3a8]
cmp rcx, rdi
je 0x14003ed35
test byte [rcx + 0x1c], 1
je 0x14003ed35
cmp byte [rcx + 0x19], 4
jb 0x14003ed35
mov edx, 0x22d
mov r9, r15
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001ec40
jmp 0x14003ed35
mov al, byte [rsp + 0x74]
mov rcx, qword [rbp + 0x40]
mov byte [rcx], al
mov eax, dword [rbp - 0x5c]
mov rcx, qword [rbp + 0x80]
mov dword [rcx], eax
mov edi, r13d
jmp 0x14003ee63
mov r13d, dword [rbp - 0x30]
mov rsi, qword [rbp - 0x58]
mov r15, qword [rbp - 0x28]
mov rdx, qword [rbp + 0x40]
mov rcx, r12
call fcn.14003916c
mov edi, eax
test eax, eax
js 0x14003ee67
lea rcx, [r12 + 0x28]
xor edx, edx
call fcn.14011e208
mov edi, eax
test eax, eax
js 0x14003ee67
mov r14d, dword [r15 + 0xc]
xor ebx, ebx
test r13d, r13d
je 0x14003ee30
xor esi, esi
xor r15d, r15d
mov edx, ebx
mov r11d, ebx
shl r11, 4
add r11, qword [rbp + 0x28]
lea rcx, [0x14000ab48]
mov r8, qword [r11]
cmp r8, qword [rcx]
jne 0x14003edab
mov r8, qword [r11 + 8]
cmp r8, qword [rcx + 8]
jne 0x14003edab
xor eax, eax
jmp 0x14003edb0
sbb eax, eax
sbb eax, reloc.ADVAPI32.dll_TraceEvent
test eax, eax
je 0x14003ee1a
mov r10, qword [r12 + 0xd8]
imul rdx, rdx, 0x170
lea rcx, [r10 + 0x78]
add rcx, rdx
mov r8d, r15d
add r8, qword [rbp + 0x18]
lea r9, [rdx + 0x44]
add r9, r10
mov eax, dword [r10 + rsi + 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
mov rax, qword [rbp + 0x90]
mov qword [rsp + 0x28], rax
mov eax, dword [r10 + rsi + 0x54]
mov dword [rsp + 0x20], eax
mov r8d, r14d
mov rdx, r11
mov rcx, r12
call fcn.140037604
mov edi, eax
inc r14d
test eax, eax
js 0x14003ee54
inc ebx
add r15d, 0x10
add rsi, 0x170
cmp ebx, r13d
jb 0x14003ed81
mov r15, qword [rbp - 0x68]
cmp r14d, dword [r15 + 0xc]
je 0x14003ee60
lea r8, [0x140004828]
mov edx, 0x337d
lea rcx, [0x140003c50]
call fcn.1400a8be8
jmp 0x14003ee60
mov r14, qword [rbp - 0x68]
jmp 0x14003ee63
mov r14, qword [rbp - 0x68]
jmp 0x14003ee67
mov r14, r15
mov rsi, qword [rbp - 0x58]
mov rax, qword [rbp + 8]
test rax, rax
je 0x14003ee79
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r15, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x40]
mov r13, qword [rbp - 8]
mov rcx, qword [rbp]
test rcx, rcx
je 0x14003eea0
cmp rcx, qword [r14 + 0x38]
je 0x14003eea0
cmp rcx, qword [r15 + 0x38]
je 0x14003eea0
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x14003eeb9
cmp rsi, qword [r14 + 0x30]
je 0x14003eeb9
cmp rsi, qword [r15 + 0x30]
je 0x14003eeb9
mov rcx, rsi
call fcn.1400e0d04
test rbx, rbx
je 0x14003eec7
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x14003eed9
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x14003eeeb
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test r13, r13
je 0x14003eef9
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rbx, [r12 + 0x28]
mov rcx, rbx
call fcn.14011e39c
test edi, edi
jns 0x14003effb
mov rcx, qword [0x14017d3a8]
lea rsi, [0x14017d3a8]
cmp rcx, rsi
je 0x14003ef58
test byte [rcx + 0x1c], 1
je 0x14003ef58
cmp byte [rcx + 0x19], 2
jb 0x14003ef58
lea rdx, [0x140005617]
lea r8, [0x140004848]
mov rax, qword [rbp + 0x40]
cmp byte [rax], 0
cmovne r8, rdx
mov edx, edi
mov rcx, qword [rcx + 0x10]
call fcn.14002898c
mov rcx, qword [0x14017d3a8]
cmp byte [rbp - 0x5e], 0
jne 0x14003f009
test byte [r12 + 0x154], 4
je 0x14003f009
xor edx, edx
mov rcx, rbx
call fcn.14011e208
test eax, eax
jns 0x14003efb5
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x14003f02f
test byte [rcx + 0x1c], 1
je 0x14003f009
cmp byte [rcx + 0x19], 2
jb 0x14003f009
mov edx, 0x233
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
jmp 0x14003f002
mov rcx, r12
call fcn.1400352e4
test eax, eax
jns 0x14003eff1
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x14003eff1
test byte [rcx + 0x1c], 1
je 0x14003eff1
cmp byte [rcx + 0x19], 2
jb 0x14003eff1
mov edx, 0x234
mov r9d, eax
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001de24
mov rcx, rbx
call fcn.14011e39c
jmp 0x14003f002
lea rsi, [0x14017d3a8]
mov rcx, qword [0x14017d3a8]
cmp rcx, rsi
je 0x14003f02f
test byte [rcx + 0x1c], 1
je 0x14003f02f
cmp byte [rcx + 0x19], 4
jb 0x14003f02f
mov edx, 0x235
lea r8, [0x140003c28]
mov rcx, qword [rcx + 0x10]
call fcn.14001dd24
mov eax, edi
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140168920
add rsp, 0x228
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret