Function at 0x1400554b0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
test r8, r8
je 0x14005483a
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xab0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0xb08], rbx
mov rax, qword [0x1400c2038]
xor rax, rsp
mov qword [rsp + COleControlSite::XOleIPSite::GetCapture], rax
mov r14, r8
mov rbx, rdx
mov r15, rcx
mov rcx, qword [rdx + 0x168]
test rcx, rcx
je 0x1400547d3
call fcn.140041220
mov edi, eax
test eax, eax
js 0x1400547d3
mov rcx, qword [r14 + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov dword [rsp + 0x20], 0
lea r9, str.lu_a_
lea r8, str.lu_a_
xor edx, edx
mov rcx, rax
call sub.MSVCR90.dll___RTDynamicCast
mov r12, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140054810
mov rcx, qword [rbx + 0x168]
test rcx, rcx
jne 0x1400536dd
xor r13d, r13d
jmp 0x14005374b
mov edx, edi
call fcn.140040fc0
mov r13, rax
test rax, rax
je 0x14005374b
call fcn.140014ed0
mov rcx, rax
mov rdx, r13
call fcn.140042220
cmp dword [r13 + 0x84], 0x108
jne 0x14005374b
lea rdx, [0x14009a260]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
nop
lea r9, [rsp + 0x4b0]
xor r8d, r8d
mov edx, 0xfff1
mov rcx, r14
call fcn.1400057c0
nop
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140054810
call fcn.140001270
mov rbp, rax
cmp qword [rax + 0x20], 0
ja 0x140053764
mov ebx, 0x78
jmp 0x1400542ba
lea rcx, [rsp + 0x4d8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void____ptr64]
mov dword [rsp + CDaoRecordset::AllocDatabase], 0
cmp qword [rbp + 0x28], 0x10
jb 0x14005378a
mov rdx, qword [rbp + 0x10]
jmp 0x14005378e
lea rdx, [rbp + 0x10]
test rdx, rdx
je 0x1400537a1
lea rcx, [rsp + 0x4d8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const____ptr64____ptr64]
cmp qword [rsp + 0x4f0], 0x20
jne 0x140053c7d
mov byte [rsp + 0x5b0], 0
xor eax, eax
mov qword [rsp + 0x5b1], rax
mov qword [rsp + CRichEditCtrl::CanPaste], rax
mov qword [rsp + 0x5c1], rax
mov qword [rsp + 0x5c9], rax
mov qword [rsp + 0x5d1], rax
mov qword [rsp + 0x5d9], rax
mov qword [rsp + CDaoTableDef::classCDaoTableDef], rax
mov dword [rsp + reloc.mfc90u.dll_CDaoWorkspace::classCDaoWorkspace], eax
mov word [rsp + CPropertyPage::Cleanup], ax
mov byte [rsp + reloc.mfc90u.dll_CRecordView::classCRecordView], al
lea r8, [rsp + 0x4e0]
cmp qword [rsp + 0x4f8], 0x10
cmovae r8, qword [rsp + 0x4e0]
lea edx, [rax + 0x40]
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
xor r11d, r11d
mov qword [rsp + 0x5c8], r11
xor ebx, ebx
xor r9d, r9d
lea r10, [rsp + 0xb0]
nop dword [rax + rax]
mov edx, r9d
shl edx, 0x18
xor ecx, ecx
lea r8d, [rcx + 8]
nop dword [rax]
mov eax, ecx
xor eax, edx
bt eax, 0x1f
jae 0x140053874
add ecx, ecx
xor ecx, 0x4c10db7
jmp 0x140053876
add ecx, ecx
add edx, edx
sub r8, 1
jne 0x140053860
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jb 0x140053850
lea r9, [rsp + 0x5b2]
lea r10d, [r8 + 8]
nop dword [rax]
movzx ecx, byte [r9 - 2]
mov eax, ebx
shr rax, 0x18
xor rcx, rax
shl ebx, 8
mov edx, dword [rsp + rcx*4 + 0xb0]
xor edx, ebx
movzx ecx, byte [r9 - 1]
mov eax, edx
shr rax, 0x18
xor rcx, rax
shl edx, 8
mov r8d, dword [rsp + rcx*4 + 0xb0]
xor r8d, edx
mov ecx, r8d
shr rcx, 0x18
movzx eax, byte [r9]
xor rcx, rax
shl r8d, 8
mov edx, dword [rsp + rcx*4 + 0xb0]
xor edx, r8d
movzx ecx, byte [r9 + 1]
mov eax, edx
shr rax, 0x18
xor rcx, rax
shl edx, 8
mov ebx, dword [rsp + rcx*4 + 0xb0]
xor ebx, edx
add r9, 4
sub r10, 1
jne 0x1400538a0
lea r8, [rsp + 0x4e0]
cmp qword [rsp + 0x4f8], 0x10
cmovae r8, qword [rsp + 0x4e0]
lea edx, [r10 + 0x40]
lea rcx, [rsp + 0x5b0]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + 0x920], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x921]
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x5c8]
mov edx, 0x80
lea rcx, [rsp + 0x920]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + 0x928], 0
mov dword [rsp + 0x48], 0
lea r8, [rsp + 0x48]
lea rdx, [0x14008be28]
lea rcx, [rsp + 0x920]
call qword [sym.imp.MSVCR90.dll_sscanf]
cmp dword [rsp + 0x48], ebx
jne 0x140053c7d
mov byte [rsp + 0x720], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x721]
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x5b0]
mov edx, 0x80
lea rcx, [rsp + 0x720]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + 0x728], 0
mov dword [rsp + 0x3c], 0
lea r8, [rsp + 0x3c]
lea rdx, [0x14008be28]
lea rcx, [rsp + 0x720]
call qword [sym.imp.MSVCR90.dll_sscanf]
mov ebx, dword [rsp + 0x3c]
mov byte [rsp + CImageList::FromHandlePermanent], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0xa21]
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x5b8]
mov edx, 0x80
lea rcx, [rsp + 0xa20]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + CRuntimeClass::FromName], 0
mov dword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
lea rdx, [0x14008be28]
lea rcx, [rsp + 0xa20]
call qword [sym.imp.MSVCR90.dll_sscanf]
mov edi, dword [rsp + 0x40]
mov byte [rsp + CDC::FillSolidRect], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + reloc.mfc90u.dll_CScrollView::FillOutsideRect]
call sub.MSVCR90.dll_memset
lea r8, [rsp + reloc.mfc90u.dll_CRichEditCtrl::CanPaste]
mov edx, 0x80
lea rcx, [rsp + 0x9a0]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::Find], 0
mov dword [rsp + 0x4c], 0
lea r8, [rsp + 0x4c]
lea rdx, [0x14008be28]
lea rcx, [rsp + 0x9a0]
call qword [sym.imp.MSVCR90.dll_sscanf]
mov r11d, dword [rsp + 0x4c]
xor ebx, r11d
xor edi, r11d
cmp bx, 0x1e
jne 0x140053c7d
shr ebx, 0x10
cmp bx, 1
jne 0x140053c7d
mov eax, 0x9a
cmp edi, eax
je 0x140053b0e
lea eax, [rdi - 0x99]
cmp eax, 4
ja 0x140053c7d
mov byte [rsp + reloc.mfc90u.dll_CPropertyPage::Cleanup], 0
xor eax, eax
mov qword [rsp + 0x5f1], rax
mov qword [rsp + 0x5f9], rax
mov qword [rsp + 0x601], rax
mov qword [rsp + 0x609], rax
mov qword [rsp + reloc.mfc90u.dll_CFileFind::Close], rax
mov qword [rsp + 0x619], rax
mov qword [rsp + CFtpFileFind::CloseContext], rax
mov dword [rsp + CDocObjectServer::XOleDocumentView::CloseView], eax
mov word [rsp + ATL::CStringT<char,class StrTraitMFC_DLL<char,class ATL::ChTraitsCRT<char> > >::CollateNoCase], ax
mov byte [rsp + CDaoWorkspace::CommitTrans], al
lea r8, [rsp + 0x4e0]
cmp qword [rsp + 0x4f8], 0x10
cmovae r8, qword [rsp + 0x4e0]
lea edx, [rax + 0x40]
lea rcx, [rsp + reloc.mfc90u.dll_CPropertyPage::Cleanup]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + 0x8a0], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x8a1]
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x5f8]
mov edx, 0x80
lea rcx, [rsp + 0x8a0]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + COlePasteSpecialDialog::DoModal], 0
mov dword [rsp + 0x44], 0
lea r8, [rsp + 0x44]
lea rdx, [0x14008be28]
lea rcx, [rsp + 0x8a0]
call qword [sym.imp.MSVCR90.dll_sscanf]
mov ebx, dword [rsp + 0x44]
mov byte [rsp + CDHtmlDialog::DDX_DHtml_ElementText], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x7a1]
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x600]
mov edx, 0x80
lea rcx, [rsp + 0x7a0]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + CDHtmlDialog::DDX_DHtml_ElementTextWithFormat], 0
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
lea rdx, [0x14008be28]
lea rcx, [rsp + 0x7a0]
call qword [sym.imp.MSVCR90.dll_sscanf]
xor ebx, dword [rsp + 0x50]
mov eax, 0x9a
cmp ebx, eax
je 0x140053c7d
cmp ebx, 0x99
jne 0x140053c7d
lea rcx, [rsp + 0x4d8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
jmp 0x1400542ba
lea rdx, [0x14008ac97]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const____ptr64____ptr64]
nop
cmp qword [rbp + 0x28], 0x10
jb 0x140053ca0
mov rbx, qword [rbp + 0x10]
jmp 0x140053ca4
lea rbx, [rbp + 0x10]
call fcn.140007060
test rbx, rbx
jne 0x140053cb3
xor r12d, r12d
jmp 0x140053ce0
lea r8, [rsp + 0x4b0]
mov rdx, rbx
mov rcx, rax
call fcn.1400070e0
mov r12, rax
test rax, rax
je 0x140053ce0
lea rdx, [rsp + 0x4b0]
lea rcx, [rbp + 8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64]
cmp dword [rbp + 0x30], 0
je 0x140053d11
cmp qword [rbp + 0x28], 0x10
jb 0x140053cf3
mov rbx, qword [rbp + 0x10]
jmp 0x140053cf7
lea rbx, [rbp + 0x10]
call fcn.140007060
lea r8, [rbp + 0x998]
mov rdx, rbx
mov rcx, rax
call fcn.140007f30
mov r12, rax
test r12, r12
je 0x140054293
cmp qword [r12 + 0x18], 0x20
jne 0x140054293
mov byte [rsp + 0x530], 0
xor eax, eax
mov qword [rsp + 0x531], rax
mov qword [rsp + 0x539], rax
mov qword [rsp + 0x541], rax
mov qword [rsp + 0x549], rax
mov qword [rsp + 0x551], rax
mov qword [rsp + 0x559], rax
mov qword [rsp + 0x561], rax
mov dword [rsp + COleControlSite::BindDefaultProperty], eax
mov word [rsp + reloc.mfc90u.dll_CDaoRecordset::BindFields], ax
mov byte [rsp + 0x56f], al
cmp qword [r12 + 0x20], 0x10
jb 0x140053d90
lea rsi, [r12 + 8]
mov r8, qword [rsi]
jmp 0x140053d98
lea rsi, [r12 + 8]
mov r8, rsi
mov edx, 0x40
lea rcx, [rsp + 0x530]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
xor r11d, r11d
mov qword [rsp + 0x548], r11
xor ebx, ebx
xor r9d, r9d
lea r10, [rsp + 0xb0]
nop word [rax + rax]
mov edx, r9d
shl edx, 0x18
xor ecx, ecx
lea r8d, [rcx + 8]
nop dword [rax]
mov eax, ecx
xor eax, edx
bt eax, 0x1f
jae 0x140053df4
add ecx, ecx
xor ecx, 0x4c10db7
jmp 0x140053df6
add ecx, ecx
add edx, edx
sub r8, 1
jne 0x140053de0
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jb 0x140053dd0
lea r9, [rsp + 0x532]
lea r10d, [r8 + 8]
nop dword [rax]
movzx ecx, byte [r9 - 2]
mov eax, ebx
shr rax, 0x18
xor rcx, rax
shl ebx, 8
mov edx, dword [rsp + rcx*4 + 0xb0]
xor edx, ebx
movzx ecx, byte [r9 - 1]
mov eax, edx
shr rax, 0x18
xor rcx, rax
shl edx, 8
mov r8d, dword [rsp + rcx*4 + 0xb0]
xor r8d, edx
mov ecx, r8d
shr rcx, 0x18
movzx eax, byte [r9]
xor rcx, rax
shl r8d, 8
mov edx, dword [rsp + rcx*4 + 0xb0]
xor edx, r8d
movzx ecx, byte [r9 + 1]
mov eax, edx
shr rax, 0x18
xor rcx, rax
shl edx, 8
mov ebx, dword [rsp + rcx*4 + 0xb0]
xor ebx, edx
add r9, 4
sub r10, 1
jne 0x140053e20
cmp qword [r12 + 0x20], 0x10
jb 0x140053ea3
mov r8, qword [rsi]
jmp 0x140053ea6
mov r8, rsi
mov edx, 0x40
lea rcx, [rsp + 0x530]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
lea rcx, [rsp + 0x548]
call fcn.1400040c0
cmp eax, ebx
jne 0x140054293
mov byte [rsp + CException::Delete], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x821]
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x530]
mov edx, 0x80
lea rcx, [rsp + 0x820]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + 0x828], 0
mov dword [rsp + 0x34], 0
lea r8, [rsp + 0x34]
lea rdx, [0x14008be28]
lea rcx, [rsp + 0x820]
call qword [sym.imp.MSVCR90.dll_sscanf]
mov ebx, dword [rsp + 0x34]
lea rcx, [rsp + 0x538]
call fcn.1400040c0
mov edi, eax
lea rcx, [rsp + 0x540]
call fcn.1400040c0
xor ebx, eax
xor edi, eax
cmp bx, 0x1e
jne 0x140054293
shr ebx, 0x10
cmp bx, 1
jne 0x140054293
mov ebp, 0x9a
cmp edi, ebp
je 0x140053f81
lea eax, [rdi - 0x99]
cmp eax, 4
ja 0x140054293
cmp qword [r12 + 0x18], 0x20
jne 0x14005426a
mov byte [rsp + 0x570], 0
xor eax, eax
mov qword [rsp + 0x571], rax
mov qword [rsp + 0x579], rax
mov qword [rsp + 0x581], rax
mov qword [rsp + CMiniFrameWnd::CalcBorders], rax
mov qword [rsp + CStatusBar::CalcFixedLayout], rax
mov qword [rsp + 0x599], rax
mov qword [rsp + 0x5a1], rax
mov dword [rsp + CDragListBox::CancelDrag], eax
mov word [rsp + CDragListBox::CancelDrag], ax
mov byte [rsp + 0x5af], al
cmp qword [r12 + 0x20], 0x10
jb 0x140053ff2
mov r8, qword [rsi]
jmp 0x140053ff5
mov r8, rsi
mov edx, 0x40
lea rcx, [rsp + 0x570]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
xor r11d, r11d
mov qword [rsp + CMiniFrameWnd::CalcBorders], r11
xor ebx, ebx
xor r9d, r9d
lea r10, [rsp + 0xb0]
mov edx, r9d
shl edx, 0x18
xor ecx, ecx
lea r8d, [rcx + 8]
nop dword [rax]
mov eax, ecx
xor eax, edx
bt eax, 0x1f
jae 0x140054044
add ecx, ecx
xor ecx, 0x4c10db7
jmp 0x140054046
add ecx, ecx
add edx, edx
sub r8, 1
jne 0x140054030
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jb 0x140054020
lea r9, [rsp + 0x572]
lea r10d, [r8 + 8]
nop dword [rax]
mov ecx, ebx
shr rcx, 0x18
movzx eax, byte [r9 - 2]
xor rcx, rax
shl ebx, 8
mov edx, dword [rsp + rcx*4 + 0xb0]
xor edx, ebx
mov ecx, edx
shr rcx, 0x18
movzx eax, byte [r9 - 1]
xor rcx, rax
shl edx, 8
mov r8d, dword [rsp + rcx*4 + 0xb0]
xor r8d, edx
mov ecx, r8d
shr rcx, 0x18
movzx eax, byte [r9]
xor rcx, rax
shl r8d, 8
mov edx, dword [rsp + rcx*4 + 0xb0]
xor edx, r8d
mov ecx, edx
shr rcx, 0x18
movzx eax, byte [r9 + 1]
xor rcx, rax
shl edx, 8
mov ebx, dword [rsp + rcx*4 + 0xb0]
xor ebx, edx
add r9, 4
sub r10, 1
jne 0x140054070
cmp qword [r12 + 0x20], 0x10
jb 0x1400540f3
mov r8, qword [rsi]
jmp 0x1400540f6
mov r8, rsi
mov edx, 0x40
lea rcx, [rsp + 0x570]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
lea rcx, [rsp + 0x588]
call fcn.1400040c0
cmp eax, ebx
jne 0x14005426a
mov byte [rsp + 0x670], 0
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x671]
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x570]
mov edx, 0x80
lea rcx, [rsp + 0x670]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
mov byte [rsp + COleServerItem::CopyToClipboard], 0
mov dword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
lea rdx, [0x14008be28]
lea rcx, [rsp + 0x670]
call qword [sym.imp.MSVCR90.dll_sscanf]
mov ebx, dword [rsp + 0x38]
lea rcx, [rsp + 0x578]
call fcn.1400040c0
mov edi, eax
lea rcx, [rsp + 0x580]
call fcn.1400040c0
xor ebx, eax
xor edi, eax
cmp bx, 0x1e
jne 0x14005426a
shr ebx, 0x10
cmp bx, 1
jne 0x14005426a
cmp edi, ebp
je 0x1400541cc
lea eax, [rdi - 0x99]
cmp eax, 4
ja 0x14005426a
mov byte [rsp + CDaoWorkspace::CommitTrans], 0
xor eax, eax
mov qword [rsp + CDaoWorkspace::CommitTrans], rax
mov qword [rsp + CPropertySheet::CommonConstruct], rax
mov qword [rsp + ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CompareNoCase], rax
mov qword [rsp + COleControlSite::ConnectSink], rax
mov qword [rsp + ATL::CStringT<char,class StrTraitMFC_DLL<char,class ATL::ChTraitsCRT<char> > >::Construct], rax
mov qword [rsp + CPropertySheet::Construct], rax
mov qword [rsp + COleServerDoc::XOleInPlaceObject::ContextSensitiveHelp], rax
mov dword [rsp + 0x669], eax
mov word [rsp + 0x66d], ax
mov byte [rsp + 0x66f], al
cmp qword [r12 + 0x20], 0x10
jb 0x14005422f
mov rsi, qword [rsi]
mov r8, rsi
mov edx, 0x40
lea rcx, [rsp + 0x630]
call qword [sym.imp.MSVCR90.dll_strcpy_s]
lea rcx, [rsp + 0x638]
call fcn.1400040c0
mov ebx, eax
lea rcx, [rsp + 0x640]
call fcn.1400040c0
xor ebx, eax
cmp ebx, ebp
cmove ebx, ebp
jmp 0x14005426f
mov ebx, 0x9e
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x4d8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov r12, qword [rsp + 0x58]
jmp 0x1400542ba
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x4d8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void____ptr64]
mov ebx, 0x78
mov r12, qword [rsp + 0x58]
call fcn.140001270
mov rcx, rax
mov r9, r13
mov r8d, ebx
lea rdx, [rsp + 0x508]
call fcn.140074eb0
nop
cmp qword [rsp + 0x520], 0
je 0x140054337
lea r9, [rsp + 0x508]
xor r8d, r8d
mov edx, 0xfff2
mov rcx, r14
call fcn.1400057c0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.http:__www.m3datarecovery.com_store_checkout.php_productid17
lea rdx, [0x14008b1c0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x508]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140054810
mov ecx, 8
call sub.mfc90u.dll_CSplitterWnd::CSplitterWnd
test rax, rax
je 0x140054352
lea rcx, [rsp + 0x60]
mov qword [rax], rcx
xor ebp, ebp
jmp 0x140054357
xor ebp, ebp
mov rax, rbp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.1400149e0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbp
mov ecx, COlePasteSpecialDialog::DoModal
call sub.mfc90u.dll_CSplitterWnd::CSplitterWnd
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14005439a
mov rdx, r14
mov rcx, rax
call fcn.140019b60
mov rsi, rax
jmp 0x14005439d
mov rsi, rbp
mov dword [rsp + 0x30], 0x9d
lea rcx, [r15 + 0x28]
lea rdx, [0x14008ac98]
call qword [sym.imp.mfc90u.dll_CTreeCtrl::CTreeCtrl]
mov dword [rsp + 0x98], ebp
lea rcx, [rsp + 0x670]
mov rdx, r13
mov r8d, 0xa8
call sub.MSVCR90.dll_memcpy
mov ecx, 0x10
call sub.mfc90u.dll_CSplitterWnd::CSplitterWnd
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140054477
lea rax, [0x14009a398]
mov qword [rdi], rax
mov ecx, 0xf8
call sub.mfc90u.dll_CSplitterWnd::CSplitterWnd
mov rbx, rax
test rax, rax
je 0x14005446e
lea rax, method.FunctorImplBase_void_.virtual_0
mov qword [rbx], rax
mov qword [rbx + 8], r15
lea rax, [0x140052f70]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], r14
lea rcx, [rbx + 0x20]
lea rdx, [rsp + 0x670]
mov r8d, 0xa8
call sub.MSVCR90.dll_memcpy
lea r11, [rsp + 0x60]
mov qword [rbx + 0xc8], r11
mov qword [rbx + 0xd0], rsi
lea rax, [rsp + 0x30]
mov qword [rbx + 0xd8], rax
lea rax, [rsp + 0x98]
mov qword [rbx + 0xe0], rax
jmp 0x140054471
mov rbx, rbp
mov qword [rdi + 8], rbx
jmp 0x14005447a
mov rdi, rbp
mov eax, dword [0x1400c9cf0]
test al, 1
jne 0x1400544a6
or eax, 1
mov dword [0x1400c9cf0], eax
lea rcx, [0x1400c9bc0]
call fcn.1400063a0
lea rcx, [0x140088a50]
call fcn.140077554
nop
mov r8b, 1
mov rdx, rdi
lea rcx, [0x1400c9bc0]
call fcn.140006830
mov r11d, dword [0x1400c9bb4]
test r11b, 1
jne 0x1400544e9
or r11d, 1
mov dword [0x1400c9bb4], r11d
lea rcx, [0x1400c9c60]
call fcn.140005f90
lea rcx, [0x140088a40]
call fcn.140077554
nop
xor r8d, r8d
mov rdx, rsi
lea rcx, [0x1400c9c60]
call fcn.1400060a0
mov r11, qword [rsp + 0x88]
mov rdi, qword [r11]
mov rax, qword [rsp + 0x60]
mov rbx, rax
nop
mov rsi, r11
test rbx, rbx
je 0x14005451d
cmp rbx, rax
je 0x14005452b
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov r11, qword [rsp + 0x88]
cmp rdi, rsi
je 0x140054595
test rbx, rbx
jne 0x140054540
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov r11, rbp
jmp 0x140054543
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x28]
jne 0x14005454f
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov edx, 1
mov rcx, qword [rdi + 0x10]
call fcn.140036fd0
test eax, eax
jne 0x1400545d5
test rbx, rbx
jne 0x140054571
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov r11, rbp
jmp 0x140054574
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x28]
jne 0x140054580
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov rdi, qword [rdi]
mov r11, qword [rsp + 0x88]
mov rax, qword [rsp + 0x60]
jmp 0x140054510
mov rcx, qword [r11]
mov qword [r11], r11
mov rax, qword [rsp + 0x88]
mov qword [rax + 8], rax
mov qword [rsp + 0x90], rbp
cmp rcx, qword [rsp + 0x88]
je 0x14005471d
nop dword [rax]
mov rbx, qword [rcx]
call sub.mfc90u.dll_CStatusBar::CStatusBar
mov rcx, rbx
cmp rbx, qword [rsp + 0x88]
jne 0x1400545c0
cmp qword [rsp + 0x90], 0
je 0x14005471d
mov rax, qword [r12]
mov edx, 2
mov rcx, r12
call qword [rax]
mov rcx, rax
mov dword [rsp + 0x20], ebp
lea r9, str.lu_a_
lea r8, str.lu_a_
xor edx, edx
call sub.MSVCR90.dll___RTDynamicCast
mov rbx, rax
test rax, rax
jne 0x14005468b
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x88]
mov qword [rax + 8], rax
mov qword [rsp + 0x90], rbp
mov rax, qword [rsp + 0x88]
cmp rcx, rax
je 0x14005465d
mov rbx, qword [rcx]
call sub.mfc90u.dll_CStatusBar::CStatusBar
mov rcx, rbx
mov rax, qword [rsp + 0x88]
cmp rbx, rax
jne 0x140054645
mov rcx, rax
call sub.mfc90u.dll_CStatusBar::CStatusBar
mov qword [rsp + 0x88], rbp
mov rcx, qword [rsp + 0x60]
call sub.mfc90u.dll_CStatusBar::CStatusBar
nop
lea rcx, [rsp + 0x508]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140054810
cmp dword [rsp + 0x30], 0x99
jne 0x1400546a0
mov eax, 0x9d
mov dword [rsp + 0x30], eax
jmp 0x1400546af
call fcn.14000e7a0
mov dword [rax], 0x9a
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x3f8], eax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140042470
cmp dword [rsp + 0x30], 0x9d
je 0x14005470c
lea rdx, str.IDS_DRIVE_CAN_NOT_FIXED
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
nop
lea r9, [rsp + 0x4b0]
xor r8d, r8d
mov edx, 0xfff1
mov rcx, r14
call fcn.1400057c0
nop
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov rax, qword [r12]
mov edx, 2
mov rcx, r12
call qword [rax + 8]
jmp 0x14005475b
lea rdx, str.IDS_RAW_TO_DATA_RECOVERY_TIP
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
nop
lea r9, [rsp + 0x4b0]
xor r8d, r8d
mov edx, 0xfff2
mov rcx, r14
call fcn.1400057c0
nop
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x88]
mov qword [rax + 8], rax
mov qword [rsp + 0x90], rbp
mov rax, qword [rsp + 0x88]
cmp rcx, rax
je 0x1400547a8
nop word [rax + rax]
mov rbx, qword [rcx]
call sub.mfc90u.dll_CStatusBar::CStatusBar
mov rcx, rbx
mov rax, qword [rsp + 0x88]
cmp rbx, rax
jne 0x140054790
mov rcx, rax
call sub.mfc90u.dll_CStatusBar::CStatusBar
mov qword [rsp + 0x88], rbp
mov rcx, qword [rsp + 0x60]
call sub.mfc90u.dll_CStatusBar::CStatusBar
nop
lea rcx, [rsp + 0x508]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
jmp 0x140054810
lea rdx, str.IDS_NOSTORAGE_SELECTED
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const____ptr64____ptr64]
nop
lea r9, [rsp + 0x4b0]
xor r8d, r8d
mov edx, 0xfff1
mov rcx, r14
call fcn.1400057c0
nop
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
mov rcx, qword [rsp + 0xaa0]
xor rcx, rsp
call fcn.140077470
mov rbx, qword [rsp + 0xb08]
add rsp, 0xab0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
repz ret
add rcx, 0xfffffffffffffc48
jmp 0x1400554b0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x1400cf030]
mov rsi, rcx
test al, 1
jne 0x1400554eb
or eax, 1
lea rcx, [0x140088af0]
mov dword [0x1400cf034], 0x99
mov dword [0x1400cf030], eax
call fcn.140077554
mov dword [0x1400cf034], 0x9d
call fcn.14000e670
mov rdi, qword [rax]
mov rbx, rax
call fcn.140008800
lea r9, str.raw_drive_recovery
lea r8, str.start_recovery
mov rcx, rbx
mov rdx, rax
mov dword [rsp + 0x20], 0xffffffff
call qword [rdi + 8]
mov r11d, dword [0x1400cfbb8]
test r11b, 1
jne 0x140055562
or r11d, 1
lea rcx, [0x1400cfb88]
mov dword [0x1400cfbb8], r11d
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1400cfbb0]
call qword [0x14008a728]
lea rcx, [0x140088bf0]
call fcn.140077554
lea rdx, [rsi + 0x400]
lea rcx, [0x1400cfb88]
mov r8, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140053620