Function at 0x180033910
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x370
mov qword [rsp + 0x2d0], 0xfffffffffffffffe
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x170], r9
mov qword [rsp + 0x160], r8
mov rsi, rdx
mov rbx, rcx
mov r8, qword [rsp + 0x3d0]
mov qword [rsp + 0x190], r8
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x3e0]
mov qword [rsp + 0x180], r8
mov r14, qword [rsp + 0x3e8]
mov r13, qword [rsp + 0x3f8]
mov r15, qword [rsp + 0x400]
mov rax, qword [rsp + 0x408]
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0x430]
mov qword [rsp + 0x1b0], rcx
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x440]
mov qword [rsp + 0x158], rcx
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x458]
mov qword [rsp + 0x108], rcx
mov rax, qword [rsp + 0x460]
mov qword [rsp + 0xa8], rax
test rbx, rbx
jne 0x180033a12
xor al, al
jmp 0x180035159
test rax, rax
je 0x180033a1f
xor r12d, r12d
mov dword [rax], r12d
jmp 0x180033a22
xor r12d, r12d
mov qword [rsp + 0x90], r12
mov edx, 0x23
mov rcx, rbx
call fcn.180058724
test rax, rax
je 0x180033ae2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
call fcn.180058e74
mov rdi, rax
test rax, rax
je 0x180035153
mov rdx, rax
movzx ecx, byte [rbx]
mov byte [rdx], cl
inc rbx
inc rdx
test cl, cl
jne 0x180033a62
mov edx, 0x23
mov rcx, rax
call fcn.180058724
test rax, rax
je 0x180033a86
mov byte [rax], 0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test eax, eax
je 0x180033b3c
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x90], rax
test rax, rax
je 0x180035153
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x180033b3c
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180035153
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x90], rax
test rax, rax
je 0x180035153
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp qword [rsp + 0x90], 0
je 0x180035153
mov qword [rsp + 0xc8], r12
test rsi, rsi
je 0x180033baa
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180033baa
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xc8], rax
test rax, rax
je 0x180033baa
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x140], r12
mov qword [rsp + 0x148], r12
mov qword [rsp + 0x118], r12
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x138], r12
lea rcx, str.idmcchandler2.dll.6.38.2.x64
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x178], rax
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xd8], r12
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x100], r12
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0x98], r12
test r14, r14
je 0x180033d3e
cmp dword [rsp + 0x3f0], 0
je 0x180033d16
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180033cb0
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x130], rax
test rax, rax
je 0x180033cb0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180033d16
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
test eax, eax
je 0x180033d16
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x150], rax
test rax, rax
je 0x180033d16
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180033d3e
mov eax, dword [rsp + 0x428]
bts eax, 9
mov dword [rsp + 0x8c], eax
jmp 0x180033d4c
mov eax, dword [rsp + 0x428]
mov dword [rsp + 0x8c], eax
test r15, r15
je 0x180033db7
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180033db7
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180033db7
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x148], rax
test rax, rax
je 0x180033db7
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [rsp + 0x410], 0
je 0x180033de3
mov rbx, qword [rsp + 0x418]
mov rdx, rbx
mov rcx, qword [rsp + 0x90]
call fcn.18001e1f0
mov qword [rsp + 0x140], rax
jmp 0x180033deb
mov rbx, qword [rsp + 0x418]
mov rsi, qword [rsp + 0xe0]
test rsi, rsi
je 0x180033e5e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180033e5e
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180033e5e
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x118], rax
test rax, rax
je 0x180033e5e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, [rsp + 0x188]
mov qword [rsp + 0x20], rdx
lea r9, [0x180088588]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [0x1800885a8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
movsxd r15, eax
test eax, eax
je 0x180033ef0
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x180033ebd
cmp r15d, 0x8001010d
jne 0x180033ebd
mov dword [rax], 1
mov r12, qword [rsp + 0xc8]
jmp 0x180034fb8
mov r9, r15
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r8, [0x180030760]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, qword [rsp + 0xc8]
jmp 0x180034fb8
lea rcx, [rsp + 0x198]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov r14, r12
mov qword [rsp + 0x168], r12
mov rsi, r12
mov qword [rsp + 0xe8], r12
mov r13, qword [rsp + 0x78]
test r13, r13
je 0x180033f81
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180033f81
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov r14, rax
mov qword [rsp + 0x168], rax
test rax, rax
je 0x180033f81
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rsp + 0x198], r12w
mov dword [rsp + 0xe4], r12d
mov dword [rsp + 0xe0], SafeArrayCopy
mov edi, 8
mov ecx, edi
lea r8, [rsp + 0xe0]
lea edx, [rdi - 7]
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov r13, rax
mov qword [rsp + 0x220], rax
test rax, rax
je 0x180034c90
mov dword [rsp + 0x60], r12d
test r14, r14
je 0x180033ffd
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
mov r8, r12
cmovne r8, r14
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
jmp 0x18003400e
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 1
mov r8, qword [rsp + 0x140]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 2
mov r8, qword [rsp + 0x118]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 3
mov r8, qword [rsp + 0x148]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 4
mov r8, qword [rsp + 0x150]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 5
mov r14, qword [rsp + 0x1b0]
test r14, r14
je 0x180034106
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180034110
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x18003411a
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov r15, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x180034122
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x180034122
mov r15, qword [rsp + 0xa0]
jmp 0x180034122
mov r15, qword [rsp + 0xa0]
jmp 0x180034122
mov r15, qword [rsp + 0xa0]
mov r8, r15
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 6
test rbx, rbx
je 0x18003416e
mov r8d, 0xa
lea rdx, [rsp + 0x2e0]
mov rcx, rbx
call fcn.18005c068
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x138], rax
jmp 0x180034176
mov rax, qword [rsp + 0x138]
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], r12
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x78], r12
test rcx, rcx
je 0x1800341a9
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rsp + 0x78]
call qword [0x1800a9408]
mov dword [rsp + 0x88], eax
bt eax, 0x1f
jb 0x18003428f
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x18003428f
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0xa8], r12
lea r8, [0x1800870c0]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xa8]
call fcn.1800535c0
nop
bt dword [rsp + 0x88], 0x1f
jb 0x180034282
cmp qword [rsp + 0xa8], 0
je 0x180034282
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x80], r12
test rcx, rcx
je 0x180034246
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, qword [rdi]
lea r9, [rsp + 0x80]
lea r8, [0x1800886c8]
lea rdx, str._mozilla.org_cookiemanager_1
mov rcx, rdi
call qword [rax + 0x20]
mov dword [rsp + 0x88], eax
bt eax, 0x1f
jae 0x180034282
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.180053530
nop
lea rcx, [rsp + 0xa8]
call fcn.180053510
lea rcx, [rsp + 0x298]
call qword [0x1800a9468]
nop
lea rcx, [rsp + 0x278]
call qword [0x1800a9468]
nop
lea rcx, [rsp + 0x258]
call qword [0x1800a9468]
nop
mov ebx, r12d
mov dword [rsp + 0x110], ebx
mov r14, qword [rsp + 0x70]
test r14, r14
je 0x18003437e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x18003437e
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x18003433e
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x128], rax
test rax, rax
je 0x18003433e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x258]
mov rdx, r14
mov rcx, qword [rsp + 0x80]
call fcn.18002e540
mov ebx, eax
mov dword [rsp + 0x110], eax
lea r9, [rsp + 0x278]
lea r8, [rsp + 0x298]
mov rdx, r14
lea rcx, [0x1800aa7f0]
call fcn.18004df30
mov dword [rsp + 0x60], 7
mov r8, qword [rsp + 0x128]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 8
mov r8, qword [rsp + 0x178]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 9
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x258]
call qword [0x1800a9480]
test eax, eax
je 0x180034479
test ebx, ebx
je 0x18003446f
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x258]
call qword [0x1800a9480]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, qword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180034483
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
mov qword [rsp + 0xb8], rax
test rax, rax
je 0x18003448b
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x258]
call qword [0x1800a9480]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
mov r8, qword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x18003448b
mov rbx, qword [rsp + 0xb8]
jmp 0x18003448b
mov rbx, qword [rsp + 0xb8]
jmp 0x18003448b
mov rbx, qword [rsp + 0xb8]
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 0xa
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x298]
call qword [0x1800a9480]
test eax, eax
je 0x180034549
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x298]
call qword [0x1800a9480]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, qword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180034553
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x18003455b
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x298]
call qword [0x1800a9480]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
mov r8, qword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x18003455b
mov rbx, qword [rsp + 0xd0]
jmp 0x18003455b
mov rbx, qword [rsp + 0xd0]
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], SafeArrayDestroy
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x278]
call qword [0x1800a9480]
test eax, eax
je 0x180034619
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x278]
call qword [0x1800a9480]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, qword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180034623
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
mov qword [rsp + 0xf0], rax
test rax, rax
je 0x18003462b
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x278]
call qword [0x1800a9480]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
mov r8, qword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x18003462b
mov rbx, qword [rsp + 0xf0]
jmp 0x18003462b
mov rbx, qword [rsp + 0xf0]
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
lea rcx, [rsp + 0x238]
call qword [0x1800a9468]
nop
lea rcx, [rsp + 0x1d0]
call qword [0x1800a9468]
nop
lea rcx, [rsp + 0x200]
call qword [0x1800a9468]
nop
mov ebx, r12d
mov dword [rsp + 0x120], ebx
mov r14, qword [rsp + 0x158]
test r14, r14
je 0x180034794
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180034794
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x1800346ee
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x100], rax
test rax, rax
je 0x1800346ee
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x200]
mov rdx, r14
mov rcx, qword [rsp + 0x80]
call fcn.18002e540
mov ebx, eax
mov dword [rsp + 0x120], eax
lea r9, [rsp + 0x1d0]
lea r8, [rsp + 0x238]
mov rdx, r14
lea rcx, [0x1800aa7f0]
call fcn.18004df30
mov r14, qword [rsp + 0x68]
test r14, r14
je 0x180034794
cmp dword [rsp + 0x450], 0
je 0x180034794
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180034794
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xf8], rax
test rax, rax
je 0x180034794
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x60], SafeArrayDestroy
mov r8, qword [rsp + 0x100]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], SafeArrayDestroy
mov r8, qword [rsp + 0xf8]
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], SafeArrayDestroy
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x200]
call qword [0x1800a9480]
test eax, eax
je 0x18003488f
test ebx, ebx
je 0x180034885
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x200]
call qword [0x1800a9480]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180034899
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x1800348a1
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x200]
call qword [0x1800a9480]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x1800348a1
mov rbx, qword [rsp + 0xb0]
jmp 0x1800348a1
mov rbx, qword [rsp + 0xb0]
jmp 0x1800348a1
mov rbx, qword [rsp + 0xb0]
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], reloc.OLEAUT32.dll_SafeArrayDestroy
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x238]
call qword [0x1800a9480]
test eax, eax
je 0x18003495f
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x238]
call qword [0x1800a9480]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180034969
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
mov qword [rsp + 0xc0], rax
test rax, rax
je 0x180034971
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x238]
call qword [0x1800a9480]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x180034971
mov rbx, qword [rsp + 0xc0]
jmp 0x180034971
mov rbx, qword [rsp + 0xc0]
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], reloc.OLEAUT32.dll_SafeArrayGetDim
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x1d0]
call qword [0x1800a9480]
test eax, eax
je 0x180034a2f
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x1d0]
call qword [0x1800a9480]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180034a39
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
mov qword [rsp + 0xd8], rax
test rax, rax
je 0x180034a41
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x1d0]
call qword [0x1800a9480]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x180034a41
mov rbx, qword [rsp + 0xd8]
jmp 0x180034a41
mov rbx, qword [rsp + 0xd8]
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 0x11
mov rbx, qword [rsp + 0x108]
test rbx, rbx
je 0x180034ad2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x180034adc
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180034ae6
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov r14, rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x180034aee
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x180034aee
mov r14, qword [rsp + 0x98]
jmp 0x180034aee
mov r14, qword [rsp + 0x98]
jmp 0x180034aee
mov r14, qword [rsp + 0x98]
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov dword [rsp + 0x60], 0x12
cmp dword [0x1800a7898], 0
je 0x180034bf6
lea rdx, [0x1800a789c]
mov rax, qword [0x1800a7890]
test rax, rax
cmovne rdx, rax
lea rcx, [rsp + 0x108]
call fcn.180003e60
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, str.Accept_Language:
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0xe8], rax
mov rbx, qword [rsp + 0x108]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x68], rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0xe8]
call fcn.180003d90
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [0x18008bab8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rsp + 0x158], rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0xe8]
call fcn.180003d90
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rsi, qword [rsp + 0xe8]
mov r8, rsi
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x180034c07
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
mov eax, 0x2008
mov word [rsp + 0x198], ax
mov qword [rsp + 0x1a0], r13
lea rcx, [rsp + 0x200]
call qword [0x1800a9478]
nop
lea rcx, [rsp + 0x1d0]
call qword [0x1800a9478]
nop
lea rcx, [rsp + 0x238]
call qword [0x1800a9478]
nop
lea rcx, [rsp + 0x258]
call qword [0x1800a9478]
nop
lea rcx, [rsp + 0x278]
call qword [0x1800a9478]
nop
lea rcx, [rsp + 0x298]
call qword [0x1800a9478]
nop
lea rcx, [rsp + 0x80]
call fcn.180053510
nop
lea rcx, [rsp + 0x78]
call fcn.180053510
jmp 0x180034cb0
test r14, r14
je 0x180034ca7
mov word [rsp + 0x198], di
mov qword [rsp + 0x1a0], r14
jmp 0x180034cb0
mov word [rsp + 0x198], r12w
mov rdi, r12
mov qword [rsp + 0x230], r12
mov rbx, r12
mov qword [rsp + 0x228], rbx
mov r13, r12
mov qword [rsp + 0x1f0], r12
mov r14, r12
mov qword [rsp + 0x1c0], r12
mov rax, qword [rsp + 0x160]
test rax, rax
je 0x180034d45
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, eax
test eax, eax
je 0x180034d45
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rdi, rax
mov qword [rsp + 0x230], rax
test rax, rax
je 0x180034d45
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, qword [rsp + 0x160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rsp + 0x170]
test rax, rax
je 0x180034dae
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, eax
test eax, eax
je 0x180034dae
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
mov qword [rsp + 0x228], rax
test rax, rax
je 0x180034dae
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, qword [rsp + 0x170]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rsp + 0x180]
test rax, rax
je 0x180034e17
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, eax
test eax, eax
je 0x180034e17
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov r13, rax
mov qword [rsp + 0x1f0], rax
test rax, rax
je 0x180034e17
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, qword [rsp + 0x180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rsp + 0x190]
test rax, rax
je 0x180034e80
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
or r9d, 0xffffffff
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, eax
test eax, eax
je 0x180034e80
mov edx, eax
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov r14, rax
mov qword [rsp + 0x1c0], rax
test rax, rax
je 0x180034e80
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, qword [rsp + 0x190]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rsp + 0x2b8], r12w
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x2b8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x198]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov rcx, qword [rsp + 0x188]
mov rax, qword [rcx]
lea rdx, [rsp + 0x1d0]
mov qword [rsp + 0x58], rdx
lea rdx, [rsp + 0x200]
mov qword [rsp + 0x50], rdx
mov edx, dword [rsp + 0x8c]
mov dword [rsp + 0x48], edx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x130]
mov qword [rsp + 0x20], rdx
mov r12, qword [rsp + 0xc8]
mov r9, r12
mov r8, r14
mov rdx, qword [rsp + 0x90]
call qword [rax + 0x20]
mov r15d, eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rcx, qword [rsp + 0x220]
test rcx, rcx
je 0x180034f63
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
test rdi, rdi
je 0x180034f71
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x180034f7f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r13, r13
je 0x180034f8d
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x180034fa0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14, r14
je 0x180034faf
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r12, r12
je 0x180034fda
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x130]
test rax, rax
je 0x180034ff0
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x150]
test rax, rax
je 0x180035006
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x18003501c
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x148]
test rax, rax
je 0x180035032
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x118]
test rax, rax
je 0x180035048
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x18003505b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x18003506e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x178]
test rax, rax
je 0x180035084
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x180035097
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x1800350aa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1800350bd
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1800350d0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1800350e3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x1800350f6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x128]
test rax, rax
je 0x18003510c
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x180035122
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0xf8]
test rax, rax
je 0x180035138
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x18003514b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r15d, r15d
sete al
jmp 0x180035159
xor al, al
jmp 0x180035159
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.1800590c0
add rsp, 0x370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret