Function at 0x1400363c0
Capabilities:
Resume thread

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x158
mov qword [rsp + 0x140], 0xfffffffffffffffe
mov ebx, edx
mov r14, rcx
mov dword [rsp + 0x20], edx
lea r9, str.bPreKick_d
lea r8, str.KickModule
lea rdx, [0x1400ff6f8]
mov rcx, qword [rcx + 0x178]
call fcn.140081070
xor ebp, ebp
mov esi, ebp
mov dword [rsp + 0x1b8], ebp
mov rax, qword [r14 + 0x180]
bt qword [rax], 0x19
jb 0x14003728e
mov rdx, qword [rax + 0x70]
test rdx, rdx
je 0x140036465
cmp dword [rax + 0x20], 0x80000000
je 0x140036465
mov rcx, qword [rax + 0x20]
test rcx, rcx
js 0x14003645f
cmp rcx, qword [rdx + 0x10]
jge 0x14003645f
mov rax, qword [rdx + 8]
mov r15, qword [rax + rcx*8]
mov qword [rsp + 0x68], r15
jmp 0x14003646d
call fcn.1400a0610
int3
mov r15, rbp
mov qword [rsp + 0x68], rbp
lea rcx, [rsp + 0xa8]
call fcn.1400aa430
nop
lea r13, method.CPtrArray.virtual_0
mov qword [rsp + 0xa8], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, str.pAryKickMdlInfo_x__bPreKick_d
lea r8, str.GetKickModule
lea rdx, str.CPrinter
mov rcx, qword [r15]
call fcn.140080c70
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0xa8]
movzx r8d, word [r15 + 0x24]
mov rdx, qword [r15 + 0x30]
mov rcx, qword [r15 + 0x18]
call fcn.1400715d0
mov edi, eax
mov dword [rsp + 0x20], eax
lea r9, [0x1400fb428]
lea r8, str.GetKickModule
lea rdx, str.CPrinter
mov rcx, qword [r15]
call fcn.140080e70
or r12, 0xffffffffffffffff
test edi, edi
je 0x1400371eb
movzx r13d, word [r15 + 0x20]
mov word [rsp + 0x1b0], r13w
mov rax, qword [r14 + 0x180]
mov rsi, qword [rax + 0x48]
mov r12d, 1
test rsi, rsi
je 0x14003659b
mov ebx, ebp
mov rdi, rbp
mov rax, qword [rsi + 0x10]
test rax, rax
jle 0x14003659d
nop
test ebx, ebx
jne 0x14003659d
test rdi, rdi
js 0x140036572
cmp rdi, rax
jge 0x140036572
test rdi, rdi
js 0x140036595
cmp rdi, rax
jge 0x140036595
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi*8]
jmp 0x140036575
mov rcx, rbp
lea rdx, str.deviceop.exe
call fcn.1400cdd20
test eax, eax
cmove ebx, r12d
add rdi, r12
mov rax, qword [rsi + 0x10]
cmp rdi, rax
jge 0x14003659d
jmp 0x140036550
call fcn.1400a0610
int3
mov ebx, ebp
mov rdi, rbp
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x70]
call fcn.1400aa430
nop
lea rsi, method.CPtrArray.virtual_0
mov qword [rsp + 0x70], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsp + 0x98], rax
mov rdx, rbp
mov qword [rsp + 0xa0], rdx
movsxd rbx, ebx
mov qword [rsp + 0x40], rbx
cmp qword [rsp + 0xb8], rdx
jle 0x140036d91
nop
nop
nop
nop
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
test rdx, rdx
js 0x140036d8b
cmp rdx, qword [rsp + 0xb8]
jge 0x140036d8b
mov rax, qword [rsp + 0xb0]
mov r12, qword [rax + rdx*8]
mov qword [rsp + 0xd8], r12
mov r15, rbp
mov rax, qword [r12 + 8]
cmp qword [rax + 0x10], rcx
jle 0x140036bb6
nop
nop
test r15, r15
js 0x140036d6d
cmp r15, qword [rax + 0x10]
jge 0x140036d6d
mov rax, qword [rax + 8]
mov r12, qword [rax + r15*8]
mov rdi, qword [r12 + 8]
mov rax, rdi
cmp word [rdi], 0
je 0x140036694
nop
nop
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
cmp word [rax], 0
jne 0x140036680
cmp rdi, rax
ja 0x1400366bf
movzx ecx, word [rax]
cmp cx, 0x2f
je 0x1400366bf
cmp cx, 0x5c
je 0x1400366bf
cmp cx, 0x3a
je 0x1400366bf
cmp rax, rdi
je 0x1400366cb
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharPrevW]
cmp rdi, rax
jbe 0x140036694
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov rdi, rax
lea rdx, str.deviceop.exe
mov rcx, rdi
call fcn.1400cdd20
test eax, eax
je 0x1400368cc
mov r13, qword [r12 + 8]
mov rax, qword [r14 + 0x180]
mov rsi, qword [rax + 0x48]
test rsi, rsi
je 0x14003675c
mov ebx, ebp
mov rdi, rbp
mov rax, qword [rsi + 0x10]
test rax, rax
jle 0x14003675c
test ebx, ebx
jne 0x140036b45
test rdi, rdi
js 0x140036733
cmp rdi, rax
jge 0x140036733
test rdi, rdi
js 0x140036d5c
cmp rdi, rax
jge 0x140036d5c
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi*8]
jmp 0x140036736
mov rcx, rbp
mov rdx, r13
call fcn.1400cdd20
test eax, eax
mov eax, 1
cmove ebx, eax
add rdi, rax
mov rax, qword [rsi + 0x10]
cmp rdi, rax
jl 0x140036705
test ebx, ebx
jne 0x140036b5c
mov rdx, qword [r12 + 0x20]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0x130], rax
mov rdx, qword [r12]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0x110], rax
mov rdx, qword [r12 + 8]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0x118], rax
mov rdx, qword [r12 + 0x18]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0x128], rax
mov rdx, qword [r12 + 0x10]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0x120], rax
mov rdx, qword [r12 + 0x28]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0x138], rax
mov rdi, qword [rsp + 0x60]
test rdi, rdi
jne 0x14003683e
lea ecx, [rdi + 0x30]
call fcn.140091360
mov rdi, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140036836
mov rcx, rax
call fcn.1400aa430
nop
lea r13, method.CPtrArray.virtual_0
mov qword [rdi], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rdi + 0x28], rax
jmp 0x140036839
mov rdi, rbp
mov qword [rsp + 0x60], rdi
mov edx, 8
lea r8d, [rdx + 0x28]
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140036b73
mov r9d, 0x30
lea r8, [rsp + 0x110]
mov rdx, r9
mov rcx, rax
call fcn.1400cd500
test eax, eax
jne 0x1400368a3
mov r8, rbx
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.1400aa678
mov r13w, word [rsp + 0x1b0]
mov rbx, qword [rsp + 0x40]
lea rsi, method.CPtrArray.virtual_0
jmp 0x140036b96
mov r8, rbx
xor edx, edx
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13w, word [rsp + 0x1b0]
mov rbx, qword [rsp + 0x40]
lea rsi, method.CPtrArray.virtual_0
jmp 0x140036b96
mov rcx, qword [r14 + 0x180]
mov rax, qword [rcx]
test al, 1
je 0x1400368e5
bt rax, 9
jae 0x140036b3a
movabs rax, 0x8000000000000000
test qword [rcx], rax
jne 0x140036b3a
cmp r13w, 0xe
je 0x140036b3a
cmp r13w, 0x13
je 0x140036b3a
test rbx, rbx
je 0x140036921
mov qword [rsp + 0x50], 3
jmp 0x140036b96
test r13w, r13w
je 0x140036943
cmp r13w, 8
je 0x140036943
cmp r13w, 1
je 0x140036943
mov qword [rsp + 0x50], 5
jmp 0x140036b96
mov rbx, qword [r12 + 0x10]
call fcn.14009d5e8
mov rcx, rax
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
je 0x140036d62
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
test rbx, rbx
je 0x1400369b3
test rbx, 0xffffffffffff0000
jne 0x14003699e
movzx edi, bx
mov ecx, edi
call fcn.1400a1868
test rax, rax
je 0x1400369c6
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000a990
jmp 0x1400369c6
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x1400369b5
mov ecx, ebp
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140003940
nop
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x68]
call fcn.140048940
mov rdx, qword [r12 + 0x20]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0x100], rax
mov rdx, qword [r12]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0xe0], rax
mov rdx, qword [r12 + 8]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0xe8], rax
mov rdx, qword [r12 + 0x18]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0xf8], rax
mov rdi, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0xf0], rax
mov rdx, qword [r12 + 0x28]
mov rcx, qword [r14 + 0x188]
call fcn.140013c20
mov qword [rsp + 0x108], rax
mov rbx, qword [rsp + 0x60]
test rbx, rbx
jne 0x140036ab6
lea ecx, [rbx + 0x30]
call fcn.140091360
mov rbx, rax
mov qword [rsp + 0x148], rax
test rax, rax
je 0x140036aae
mov rcx, rax
call fcn.1400aa430
nop
mov qword [rbx], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rbx + 0x28], rax
jmp 0x140036ab1
mov rbx, rbp
mov qword [rsp + 0x60], rbx
mov edx, 8
lea r8d, [rdx + 0x28]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140036b0f
mov r9d, 0x30
lea r8, [rsp + 0xe0]
mov rdx, r9
mov rcx, rax
call fcn.1400cd500
test eax, eax
jne 0x140036aff
mov r8, rsi
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.1400aa678
jmp 0x140036b0f
mov r8, rsi
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rdx, [rdi - 0x18]
or rax, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140036b8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x40]
lea rsi, method.CPtrArray.virtual_0
jmp 0x140036b96
mov qword [rsp + 0x50], 1
jmp 0x140036b96
mov r13w, word [rsp + 0x1b0]
mov rbx, qword [rsp + 0x40]
lea rsi, method.CPtrArray.virtual_0
jmp 0x140036b96
mov r13w, word [rsp + 0x1b0]
mov rbx, qword [rsp + 0x40]
lea rsi, method.CPtrArray.virtual_0
jmp 0x140036b96
mov r13w, word [rsp + 0x1b0]
mov rbx, qword [rsp + 0x40]
lea rsi, method.CPtrArray.virtual_0
jmp 0x140036b96
mov rbx, qword [rsp + 0x40]
lea rsi, method.CPtrArray.virtual_0
add r15, 1
mov r12, qword [rsp + 0xd8]
mov rax, qword [r12 + 8]
cmp r15, qword [rax + 0x10]
jl 0x140036650
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140036c27
movzx eax, byte [r12]
mov byte [rsp + 0x58], al
mov edx, 8
lea r8d, [rdx + 8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140036c27
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [rsp + 0x58]
mov rdx, r9
mov rcx, rax
call fcn.1400cd500
test eax, eax
jne 0x140036c14
mov r8, rdi
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x70]
call fcn.1400aa678
jmp 0x140036c27
mov r8, rdi
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [r14 + 0x180]
mov r12, qword [r12 + 8]
test r12, r12
je 0x140036d2d
mov rbx, rbp
mov rax, qword [r12 + 0x10]
test rax, rax
jle 0x140036d1e
nop
test rbx, rbx
js 0x140036d73
cmp rbx, rax
jge 0x140036d73
mov rax, qword [r12 + 8]
mov rdi, qword [rax + rbx*8]
mov r8, qword [rdi + 0x20]
mov rcx, qword [rsi + 0x190]
test r8, r8
je 0x140036c86
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rdi]
mov rcx, qword [rsi + 0x190]
test r8, r8
je 0x140036ca0
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rdi + 8]
mov rcx, qword [rsi + 0x190]
test r8, r8
je 0x140036cbb
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rdi + 0x18]
mov rcx, qword [rsi + 0x190]
test r8, r8
je 0x140036cd6
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rdi + 0x10]
mov rcx, qword [rsi + 0x190]
test r8, r8
je 0x140036cf1
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rdi + 0x28]
mov rcx, qword [rsi + 0x190]
test r8, r8
je 0x140036d0c
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rbx, 1
mov rax, qword [r12 + 0x10]
cmp rbx, rax
jl 0x140036c50
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0xa0]
add rdx, 1
mov qword [rsp + 0xa0], rdx
cmp rdx, qword [rsp + 0xb8]
jge 0x140036d79
mov rbx, qword [rsp + 0x40]
lea rsi, method.CPtrArray.virtual_0
jmp 0x140036600
call fcn.1400a0610
int3
mov ecx, 0x80004005
call fcn.1400034f0
int3
call fcn.1400a0610
int3
call fcn.1400a0610
int3
mov r12d, 1
mov rdi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
jmp 0x140036d91
call fcn.1400a0610
int3
mov ebx, dword [rsp + 0x1a8]
test ebx, ebx
jne 0x140036dce
cmp r13w, 0xe
je 0x140036dce
test rdi, rdi
je 0x140036dce
mov rdx, qword [r15 + 0x58]
cmp dword [rdx - 0x10], ebx
cmove rdx, rbp
mov rcx, r14
call fcn.140037dd0
mov rdx, rdi
mov rcx, r14
call fcn.140037d20
mov rcx, r14
call fcn.140037880
mov rcx, qword [rsp + 0x80]
test rcx, rcx
jle 0x14003715d
test ebx, ebx
je 0x140036e27
mov qword [r14 + 0x1d8], rcx
mov r14, rcx
mov eax, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400913a4
mov r15, rax
mov rcx, qword [rsp + 0x1a0]
mov qword [rcx + 0x1c8], rax
mov dword [rsp + 0x1b0], 2
jmp 0x140036e65
mov qword [r14 + 0x1d0], rcx
mov r14, rcx
mov eax, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400913a4
mov r15, rax
mov rcx, qword [rsp + 0x1a0]
mov qword [rcx + 0x1c0], rax
mov dword [rsp + 0x1b0], ebp
mov eax, r12d
mov rdi, rbp
test r14, r14
jle 0x140037148
cmp eax, 1
jne 0x140036f62
test rdi, rdi
js 0x140036f5c
cmp rdi, qword [rsp + 0x80]
jge 0x140036f5c
mov rax, qword [rsp + 0x78]
mov r12, qword [rax + rdi*8]
mov r13, qword [rcx + 0x188]
mov rsi, rbp
test r12, r12
je 0x140036ef3
mov edx, 8
lea r8d, [rdx + 8]
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140036ef3
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8, r12
mov rdx, r9
mov rcx, rax
call fcn.1400cd500
test eax, eax
jne 0x140036ee4
mov rsi, rbx
jmp 0x140036ef3
mov r8, rbx
xor edx, edx
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x50
call fcn.140091360
mov qword [rsp + 0x1b8], rax
test rax, rax
je 0x140036f22
mov r9d, dword [rsp + 0x1b0]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.14002b570
jmp 0x140036f25
mov rax, rbp
mov qword [r15 + rdi*8], rax
mov rcx, qword [rax + 0x40]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, byte [rsi]
and eax, 1
add rdi, 1
cmp rdi, r14
mov rcx, qword [rsp + 0x1a0]
jl 0x140036e74
mov r12d, 1
jmp 0x140037148
call fcn.1400a0610
int3
cmp rdi, r14
jge 0x140037142
nop
nop
test rdi, rdi
js 0x14003713c
cmp rdi, qword [rsp + 0x80]
jge 0x14003713c
mov rax, qword [rsp + 0x78]
mov rsi, qword [rax + rdi*8]
mov r12, qword [rcx + 0x188]
mov r13, rbp
test rsi, rsi
je 0x140036fe6
mov edx, 8
lea r8d, [rdx + 8]
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140036fe6
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8, rsi
mov rdx, r9
mov rcx, rax
call fcn.1400cd500
test eax, eax
jne 0x140036fd7
mov r13, rbx
jmp 0x140036fe6
mov r8, rbx
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x50
call fcn.140091360
mov rbx, rax
mov qword [rsp + 0x1b8], rax
test rax, rax
je 0x140037118
lea rax, [0x1400febc8]
mov qword [rbx], rax
call fcn.1400a02a0
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rax, qword [rcx + 0x140]
mov qword [rbx + 0x10], rax
mov rax, qword [rcx + 0x148]
mov qword [rbx + 0x18], rax
mov esi, dword [rsp + 0x1b0]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
lea r9, str.lpMdlInfo_x__idx_u__dwFlag_x
lea r8, [0x1400fea88]
lea rdx, [0x1400fea88]
call fcn.140080c70
mov qword [rbx + 0x28], r13
mov rax, qword [r13 + 8]
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x20], rcx
mov dword [rbx + 0x34], esi
mov dword [rbx + 0x30], edi
mov eax, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400913a4
mov qword [rbx + 0x48], rax
mov r8, qword [rbx + 0x20]
shl r8, 3
xor edx, edx
mov rcx, rax
call fcn.1400cfef0
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x14002bed0]
call fcn.1400a16ac
mov qword [rbx + 0x38], rax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
lea ecx, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdx, rax
mov rax, qword [rbx + 0x28]
movzx ecx, byte [rax]
mov byte [rdx], cl
mov rax, qword [rbx + 0x20]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 0x38]
mov qword [rdx + 0x10], rax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea rcx, [0x14002c360]
call fcn.1400a16ac
mov qword [rbx + 0x40], rax
jmp 0x14003711b
mov rbx, rbp
mov qword [r15 + rdi*8], rbx
add rdi, 1
cmp rdi, r14
mov rcx, qword [rsp + 0x1a0]
jl 0x140036f70
mov r12d, 1
jmp 0x140037148
call fcn.1400a0610
int3
mov r12d, 1
mov esi, r12d
mov rcx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x1a0]
jmp 0x140037164
mov esi, dword [rsp + 0x1b8]
lea r13, method.CPtrArray.virtual_0
mov qword [rsp + 0x70], r13
test rcx, rcx
jle 0x1400371cc
mov rdi, rbp
test rdi, rdi
js 0x1400371c6
cmp rdi, rcx
jge 0x1400371c6
mov rax, qword [rsp + 0x78]
mov r8, qword [rax + rdi*8]
test r8, r8
je 0x1400371a8
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x80]
add rdi, 1
cmp rdi, rcx
jl 0x140037178
or r12, 0xffffffffffffffff
mov r8, r12
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400aa464
jmp 0x1400371d0
call fcn.1400a0610
int3
or r12, 0xffffffffffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
nop
lea rcx, [rsp + 0x70]
call fcn.1400aa450
jmp 0x140037202
test ebx, ebx
jne 0x140037202
xor edx, edx
mov rcx, r14
call fcn.140037d20
mov rcx, r14
call fcn.140037880
nop
mov qword [rsp + 0xa8], r13
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
jle 0x14003726d
test rbp, rbp
js 0x140037267
cmp rbp, rcx
jge 0x140037267
mov rax, qword [rsp + 0xb0]
mov r8, qword [rax + rbp*8]
test r8, r8
je 0x14003724a
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0xb8]
add rbp, 1
cmp rbp, rcx
jl 0x140037217
mov r8, r12
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.1400aa464
jmp 0x14003726d
call fcn.1400a0610
int3
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
nop
lea rcx, [rsp + 0xa8]
call fcn.1400aa450
jmp 0x140037369
test ebx, ebx
jne 0x140037369
mov rdx, qword [rax + 0x70]
test rdx, rdx
je 0x1400372c7
cmp dword [rax + 0x20], 0x80000000
je 0x1400372c7
mov rcx, qword [rax + 0x20]
test rcx, rcx
js 0x1400372c1
cmp rcx, qword [rdx + 0x10]
jge 0x1400372c1
mov rax, qword [rdx + 8]
mov rcx, qword [rax + rcx*8]
jmp 0x1400372ca
call fcn.1400a0610
int3
mov rcx, rbp
test rcx, rcx
je 0x1400372da
cmp word [rcx + 0x20], 0xe
je 0x140037369
mov qword [rsp + 0x20], 4
lea r9, str.lParam_u
lea r8, str.SendDeviceOpStatus
lea rdx, [0x1400ff6f8]
mov rcx, qword [r14 + 0x178]
call fcn.140081070
mov rdx, qword [r14 + 0x180]
mov rcx, qword [rdx + 0x38]
mov rax, qword [rdx]
test al, 0x10
je 0x14003733c
bt rax, 0x1b
jae 0x14003733c
cmp rcx, rsi
je 0x14003733c
test rcx, rcx
je 0x14003733c
mov edx, 0x8011
mov r9d, 4
lea r8d, [r9 - 3]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x20], ebp
lea r9, [0x1400fb428]
lea r8, str.SendDeviceOpStatus
lea rdx, [0x1400ff6f8]
mov rcx, qword [r14 + 0x178]
call fcn.140081270
mov rcx, r14
call fcn.140037880
mov dword [rsp + 0x20], esi
lea r9, [0x1400fb428]
lea r8, str.KickModule
lea rdx, [0x1400ff6f8]
mov rcx, qword [r14 + 0x178]
call fcn.140081270
mov eax, esi
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret