Function at 0x101bff0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1c60
call fcn.0105ee40
sub rsp, rax
mov rax, qword [0x010657f0]
xor rax, rsp
mov qword [rsp + 0x1c50], rax
movzx eax, word [0x01001c38]
mov word [rsp + 0xc20], ax
lea rax, [rsp + 0xc22]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x1020], ax
lea rax, [rsp + 0x1022]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x70], ax
lea rax, [rsp + 0x72]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x470], ax
lea rax, [rsp + 0x472]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
movzx eax, word [0x01001c38]
mov word [rsp + 0x1420], ax
lea rax, [rsp + 0x1422]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x870], 0
mov dword [rsp + 0x1c28], 0
mov dword [rsp + 0x1c2c], 0
mov qword [rsp + 0x878], 0
mov dword [rsp + 0x1c24], 0
mov dword [rsp + 0x1c30], 0
mov dword [rsp + 0x1c20], 0
mov r9d, 0x200
lea r8, [rsp + 0x470]
mov edx, 7
mov rcx, qword [0x01068158]
call qword [sym.imp.USER32.dll_LoadStringW]
mov r8, qword [rsp + 0x1c78]
mov edx, 0x200
lea rcx, [rsp + 0x470]
call fcn.01015be0
lea r8, [rsp + 0x470]
mov rdx, qword [rsp + 0x1c80]
mov rcx, qword [rsp + 0x1c78]
call fcn.01013c30
mov eax, dword [0x01066634]
and eax, 1
test eax, eax
je 0x101c253
movzx eax, word [0x01066434]
test eax, eax
je 0x101c253
mov rax, qword [rsp + 0x1c90]
add rax, 4
mov qword [rsp + 0x20], rax
lea r9, [0x01066234]
mov r8d, 0xd1
xor edx, edx
mov ecx, 3
call fcn.01033fa0
lea rdx, [rsp + 0x880]
mov rcx, qword [rsp + 0x1c70]
call fcn.0101d820
test eax, eax
je 0x101c253
mov rax, qword [rsp + 0x1c90]
add rax, 4
mov rcx, qword [rsp + 0x1c70]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x884]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xc0000132
mov eax, dword [rsp + 0x880]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x1c88]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1c78]
xor r8d, r8d
lea rdx, [0x01066434]
mov ecx, 1
call fcn.01033240
test eax, eax
je 0x101c253
mov dword [rsp + 0x870], 1
mov eax, dword [0x01066634]
and eax, 2
test eax, eax
je 0x101c3f6
movzx eax, word [0x01066334]
test eax, eax
je 0x101c3f6
mov rax, qword [rsp + 0x1c90]
add rax, 4
mov qword [rsp + 0x20], rax
lea r9, [0x01066234]
mov r8d, 0xd2
xor edx, edx
mov ecx, 3
call fcn.01033fa0
mov dword [rsp + 0x20], 0x800
lea r9, [rsp + 0x1420]
lea r8, [0x01066334]
lea rdx, [0x01002f88]
lea rcx, [0x01066638]
call fcn.01052500
mov r8, rax
mov edx, 0x200
lea rcx, [rsp + 0xc20]
call fcn.01013c30
mov dword [rsp + 0x20], 0x800
lea r9, [rsp + 0x1420]
lea r8, [0x01066334]
lea rdx, [0x01002f88]
lea rcx, [0x01066738]
call fcn.01052500
mov r8, rax
mov edx, 0x200
lea rcx, [rsp + 0x1020]
call fcn.01013c30
mov dword [rsp + 0x20], 0x800
lea r9, [rsp + 0x1420]
mov r8, qword [rsp + 0x1c78]
lea rdx, [0x01002f78]
lea rcx, [0x01066838]
call fcn.01052500
mov r8, rax
mov edx, 0x200
lea rcx, [rsp + 0x70]
call fcn.01013c30
lea rdx, [rsp + 0x880]
mov rcx, qword [rsp + 0x1c70]
call fcn.0101d820
test eax, eax
je 0x101c3f6
mov rax, qword [rsp + 0x1c90]
add rax, 4
mov rcx, qword [rsp + 0x1c70]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x884]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xc0000133
mov eax, dword [rsp + 0x880]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x1c88]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x1020]
lea rdx, [rsp + 0xc20]
mov ecx, 2
call fcn.01033240
test eax, eax
je 0x101c3f6
mov dword [rsp + 0x1c28], 1
mov eax, dword [0x01066634]
and eax, 4
test eax, eax
je 0x101c6c9
movzx eax, word [0x01066534]
test eax, eax
je 0x101c6c9
mov rax, qword [rsp + 0x1c90]
add rax, 4
mov qword [rsp + 0x20], rax
lea r9, [0x01066234]
mov r8d, 0xd3
xor edx, edx
mov ecx, 3
call fcn.01033fa0
mov r8d, 0x8bf
lea rdx, [0x01002fc8]
mov ecx, reloc.ODBC32.dll_SQLFreeStmt
call fcn.01014dd0
mov qword [rsp + 0x878], rax
cmp qword [rsp + 0x878], 0
je 0x101c6c9
lea rcx, [0x01066534]
call qword [sym.imp.MSVCR80.dll_wcslen]
mov dword [rsp + 0x1c20], eax
cmp dword [rsp + 0x1c20], 0
je 0x101c4ee
mov eax, dword [rsp + 0x1c20]
add eax, 1
cdqe
shl rax, 1
mov r8d, 0x8c1
lea rdx, [0x01002fc8]
mov ecx, eax
call fcn.01014dd0
mov rcx, qword [rsp + 0x878]
mov qword [rcx], rax
mov rax, qword [rsp + 0x878]
cmp qword [rax], 0
je 0x101c4ee
mov eax, dword [rsp + 0x1c20]
add eax, 1
cdqe
lea r8, [0x01066534]
mov rdx, rax
mov rax, qword [rsp + 0x878]
mov rcx, qword [rax]
call fcn.01013c30
mov rcx, qword [rsp + 0x1c78]
call qword [sym.imp.MSVCR80.dll_wcslen]
mov qword [rsp + 0x1c40], rax
mov rcx, qword [rsp + 0x1c88]
call qword [sym.imp.MSVCR80.dll_wcslen]
mov rcx, qword [rsp + 0x1c40]
lea rax, [rcx + rax + 2]
cmp rax, 0x400
jae 0x101c557
mov rax, qword [rsp + 0x1c88]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1c78]
lea r8, [0x01002fb8]
mov edx, 0x400
lea rcx, [rsp + 0x1420]
call fcn.01015ef0
jmp 0x101c571
mov r8, qword [rsp + 0x1c78]
mov edx, 0x400
lea rcx, [rsp + 0x1420]
call fcn.01013c30
lea rcx, [rsp + 0x1420]
call qword [sym.imp.MSVCR80.dll_wcslen]
mov dword [rsp + 0x1c20], eax
cmp dword [rsp + 0x1c20], 0
je 0x101c5f6
mov eax, dword [rsp + 0x1c20]
add eax, 1
cdqe
shl rax, 1
mov r8d, 0x8d3
lea rdx, [0x01002fc8]
mov ecx, eax
call fcn.01014dd0
mov rcx, qword [rsp + 0x878]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x878]
cmp qword [rax + 8], 0
je 0x101c5f6
mov eax, dword [rsp + 0x1c20]
add eax, 1
cdqe
lea r8, [rsp + 0x1420]
mov rdx, rax
mov rax, qword [rsp + 0x878]
mov rcx, qword [rax + 8]
call fcn.0101c790
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x878]
lea r8, [0x01034a10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.MSVCR80.dll__beginthreadex]
mov qword [rsp + 0x1c38], rax
cmp qword [rsp + 0x1c38], 0
je 0x101c64d
mov rcx, qword [rsp + 0x1c38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x1c38], 0
mov dword [rsp + 0x1c2c], 1
mov rax, qword [rsp + 0x1c90]
cmp dword [rax + 0x1e4], 0x37b9
je 0x101c6c9
lea rdx, [rsp + 0x880]
mov rcx, qword [rsp + 0x1c70]
call fcn.0101d820
test eax, eax
je 0x101c6c9
xor r8d, r8d
lea rdx, [rsp + 0x1c30]
lea rcx, [rsp + 0x1c24]
call fcn.01035c30
mov dword [rsp + 0x20], 4
mov r9d, dword [rsp + 0x1c30]
mov r8d, dword [rsp + 0x1c24]
mov edx, dword [rsp + 0x880]
mov rcx, qword [rsp + 0x1c70]
call fcn.01021eb0
cmp dword [rsp + 0x870], 0
jne 0x101c72f
cmp dword [rsp + 0x1c28], 0
jne 0x101c72f
cmp dword [rsp + 0x1c2c], 0
jne 0x101c72f
mov rax, qword [rsp + 0x1c90]
add rax, 4
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
lea rax, [0x01066234]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
mov r9d, 4
mov r8d, 0xc0000134
mov edx, 1
mov ecx, 3
call fcn.01033610
cmp dword [rsp + 0x870], 0
jne 0x101c75a
cmp dword [rsp + 0x1c28], 0
jne 0x101c75a
cmp dword [rsp + 0x1c2c], 0
jne 0x101c75a
mov dword [rsp + 0x1c48], 0
jmp 0x101c765
mov dword [rsp + 0x1c48], 1
mov eax, dword [rsp + 0x1c48]
mov rcx, qword [rsp + 0x1c50]
xor rcx, rsp
call fcn.010588f0
add rsp, 0x1c60
pop rdi
ret