Function at 0x1400940f4
Capabilities:
Create directory
Set file attributes
Write file on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x820
mov qword [r11 - 0x658], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14016b400]
xor rax, rsp
mov qword [rsp + 0x810], rax
movzx esi, dl
mov r13, rcx
lea rdi, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov qword [r11 - 0x7b8], rdi
lea r14, str.CVssHardwareProviderWrapper::CreateDataStore
mov qword [r11 - 0x7b0], r14
lea r15, str.CORHWDBC
mov qword [r11 - 0x7a8], r15
mov dword [rsp + 0xa8], 0x72
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
xor r12d, r12d
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [r12 + 0x78]
lea rcx, [r11 - 0x790]
call sub.msvcrt.dll_memset
xor r8d, r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x150]
call fcn.14001cce0
nop
mov qword [rsp + 0x138], r12
mov dword [rsp + 0x2d8], r12d
mov word [rsp + 0x2dc], 0x500
mov edx, 0x80
lea r8d, [r12 + 2]
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeAcl]
test eax, eax
jne 0x1400942ec
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140094206
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r15
mov dword [rsp + 0xa8], 0x87
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x140], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x1400942ad
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, [0x14010e588]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
mov r15d, 0xf
cmp byte [rsp + 0x133], 0
je 0x1400942f2
lea rbx, [rsp + 0xb8]
mov edi, r15d
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400942d9
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x1400942c8
lea rdi, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
jmp 0x1400942f2
mov r15d, 0xf
lea rax, [rsp + 0x138]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, 1
lea rcx, [rsp + 0x2d8]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x140094436
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140094351
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
lea rax, str.CORHWDBC
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], RegisterTypeLib
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x88], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x1400943ff
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, [0x14011e770]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x140094436
lea rbx, [rsp + 0xb8]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094425
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x140094414
lea rdi, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov r9, qword [rsp + 0x138]
mov edx, 2
mov r8d, 0x101f0000
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AddAccessAllowedAce]
test eax, eax
jne 0x140094559
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140094474
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
lea rax, str.CORHWDBC
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0xaa
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x88], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x140094522
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, [0x14010e5a8]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x140094559
lea rbx, [rsp + 0xb8]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094548
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x140094537
lea rdi, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
mov qword [rsp + 0x138], r12
mov edx, 1
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x140094684
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14009459f
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
lea rax, str.CORHWDBC
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0xb5
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x14009464d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, [0x14010e5d0]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x140094684
lea rbx, [rsp + 0xb8]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094673
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x140094662
lea rdi, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
xor r9d, r9d
lea r8, [rsp + 0x2f0]
lea edx, [r9 + 1]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x1400947a3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400946be
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
lea rax, str.CORHWDBC
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0xbb
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x14009476c
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, [0x14010e610]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x1400947a3
lea rbx, [rsp + 0xb8]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094792
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x140094781
lea rdi, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
xor eax, eax
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x1c0], 0x18
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x1c8], rax
mov dword [rsp + 0x1d0], 1
lea rcx, [rsp + 0x600]
call fcn.14009543c
lea r9, [rsp + 0x600]
lea r8, str._sSystem_Volume_Information
mov edx, 0x144
lea rcx, [rsp + 0x370]
call fcn.140027130
mov ebx, eax
mov dword [rsp + 0x158], eax
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x140094898
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
lea rax, str.CORHWDBC
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0xd1
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea r9, str.StringCchPrintfW__
mov r8d, ebx
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x150]
call fcn.1400dcb7c
lea rdx, [rsp + 0x370]
call fcn.140095424
test al, al
jne 0x140094ad3
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x370]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x1400949c5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400948e0
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
lea rax, str.CORHWDBC
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0xda
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x14009498e
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, str.CreateDirectory
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x1400949c5
lea rbx, [rsp + 0xb8]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400949b4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x1400949a3
lea rdi, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov edx, 0x2006
lea rcx, [rsp + 0x370]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
jne 0x140094ad3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400949f5
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r14
lea rax, str.CORHWDBC
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], pe_nt_image_headers64
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x140094aa3
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, str.SetFileAttributes
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x140094ad3
lea rbx, [rsp + 0xb8]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094ac9
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x140094ab8
lea rax, str.7cc467ef_6865_4831_853f_2a4817fd1bcaDB
lea rdx, str.7cc467ef_6865_4831_853f_2a4817fd1bcaALT
test sil, sil
cmove rdx, rax
movzx eax, byte [r13 + 0x1a3]
movzx ecx, byte [r13 + 0x1a2]
movzx r8d, byte [r13 + 0x1a1]
movzx r9d, byte [r13 + 0x1a0]
movzx r10d, byte [r13 + 0x19f]
movzx r11d, byte [r13 + 0x19e]
movzx ebx, byte [r13 + 0x19d]
movzx edi, byte [r13 + 0x19c]
movzx esi, word [r13 + 0x19a]
movzx r14d, word [r13 + 0x198]
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r14d
mov eax, dword [r13 + 0x194]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x600]
lea r8, str._sSystem_Volume_Information_.8x__.4x__.4x__.2x_.2x__.2x_.2x_.2x_.2x_.2x_.2x._s
mov edx, 0x144
lea rcx, [rsp + 0x370]
call fcn.140027130
mov ebx, eax
mov dword [rsp + 0x158], eax
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x140094c37
lea r14, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov qword [rsp + 0x90], r14
lea r13, str.CVssHardwareProviderWrapper::CreateDataStore
mov qword [rsp + 0x98], r13
lea rax, str.CORHWDBC
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0xf5
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea r9, str.StringCchPrintfW__
mov r8d, ebx
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x150]
call fcn.1400dcb7c
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x1c0]
mov edx, 0xc0000000
mov r8d, 3
lea rcx, [rsp + 0x370]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rsi, rax
lea rax, [0x1400f83d0]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rsi
cmp rsi, 0xffffffffffffffff
jne 0x140094d94
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140094ca6
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
lea r14, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
mov qword [rsp + 0x90], r14
lea r13, str.CVssHardwareProviderWrapper::CreateDataStore
mov qword [rsp + 0x98], r13
lea rdi, str.CORHWDBC
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xa8], 0x108
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x140094d62
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, str.CreateFile
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x140094da9
lea rbx, [rsp + 0xb8]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094d88
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x140094d77
jmp 0x140094da2
lea r14, str.base_stor_vssmodulescoord_srchwwrpdb.cxx
lea r13, str.CVssHardwareProviderWrapper::CreateDataStore
lea rdi, str.CORHWDBC
mov edx, 0x2006
lea rcx, [rsp + 0x370]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
test eax, eax
jne 0x140094eb7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140094dd9
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xa8], reloc.OLEAUT32.dll_VarUI4FromDisp
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x140094e80
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, str.SetFileAttributes
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x140094eb7
lea rbx, [rsp + 0xb8]
mov rdi, r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094ea6
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub rdi, 1
jne 0x140094e95
lea rdi, str.CORHWDBC
mov dword [rsp + 0x2e0], 0x9d4feff5
mov qword [rsp + 0x2e4], 1
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x140]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, [rsp + 0x2e0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x140094f04
cmp dword [rsp + 0x140], 0xc
je 0x140094fed
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x140094f19
movzx ebx, ax
or ebx, 0x80070000
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xa8], 0x124
mov dword [rsp + 0xac], 1
mov dword [rsp + 0xb0], 0xff
mov dword [rsp + 0x130], 0x1000000
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
mov qword [rsp + 0x80], rax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x140094fc0
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x208]
call fcn.14000aeb0
lea r9, [0x14011e910]
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400dc9fc
nop
cmp byte [rsp + 0x133], 0
je 0x140094fed
lea rbx, [rsp + 0xb8]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140094fe3
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov qword [rbx], r12
add rbx, 8
sub r15, 1
jne 0x140094fd2
lea rcx, [rsp + 0x1e0]
call fcn.140014248
nop
jmp 0x140095003
mov eax, dword [rsp + 0x158]
test eax, eax
jns 0x140095044
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x140095028
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x148], eax
lea rdx, [0x140167770]
lea rcx, [rsp + 0x148]
call sub.msvcrt.dll__CxxThrowException
nop
lea rcx, [rsp + 0x150]
call fcn.14001ce00
mov rcx, qword [rsp + 0x810]
xor rcx, rsp
call fcn.1400321c0
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret