Function at 0x10002aaa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
sub rsp, 0x158
mov qword [rsp + 0x120], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov qword [rax - 0x18], r14
mov qword [rax - 0x20], r15
mov esi, r8d
mov edi, edx
mov ebx, ecx
xor r15d, r15d
mov dword [rsp + 0x40], r15d
xor edx, edx
lea r8d, [r15 + 0x54]
lea rcx, [rsp + 0x44]
call sub.msvcrt.dll_memset
mov dword [0x1000a8998], 2
mov r14, 0xffffffffffffffff
mov qword [0x1000a8990], r14
lea rcx, [0x1000a89b8]
call fcn.100022020
mov dword [0x1000a8a48], ebx
mov dword [0x1000a8a4c], edi
mov dword [0x1000a8a50], esi
lea rcx, [rsp + 0x118]
call fcn.100031870
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002ab9f
cmp dword [rbx + 0x10], r15d
jl 0x10002ab8e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002ab8e
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002ab81
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a58], rax
jmp 0x10002ab9f
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a58]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002abc2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x110]
call fcn.100032220
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a60]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002ac36
cmp dword [rbx + 0x10], 0
jl 0x10002ac25
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002ac25
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002ac18
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a60], rax
jmp 0x10002ac36
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a60]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002ac59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea rcx, [rsp + 0xe8]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a80]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002accf
cmp dword [rbx + 0x10], 0
jl 0x10002acbe
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002acbe
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002acb1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a80], rax
jmp 0x10002accf
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a80]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002acf2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8a80]
cmp dword [rax - 0x10], 0
jne 0x10002aed9
mov rbx, r15
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x10002aed9
test rbx, rbx
jne 0x10002aed9
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x139
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002ad50
mov rbx, r15
jmp 0x10002adbb
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002ad66
mov rbx, r15
jmp 0x10002adb6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002ad7c
mov rbx, r15
jmp 0x10002adb6
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 8
cmp rbx, rdx
jae 0x10002ada9
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002ad92
cmp rbx, rdx
jb 0x10002adae
mov rbx, r15
jmp 0x10002adb6
cmp word [rbx], 0
cmove rbx, r15
test rbx, rbx
jne 0x10002addc
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x10002ad25
jmp 0x10002aed9
test rdi, rdi
je 0x10002aed9
mov edx, 0x139
mov r8d, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10002aed9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002aed9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10002aed9
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 8
cmp rbx, rdx
jae 0x10002aed9
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002ae45
cmp rbx, rdx
jae 0x10002aed9
movzx eax, word [rbx]
test ax, ax
je 0x10002aed9
movzx edi, ax
mov rcx, qword [0x1000a8a80]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x10002ae9c
mov edx, edi
lea rcx, [0x1000a8a80]
call fcn.1000140c0
mov rcx, qword [0x1000a8a80]
lea rsi, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rsi
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x10002aece
mov rax, qword [0x1000a8a80]
cmp edi, dword [rax - 0xc]
jg 0x10002aece
mov dword [rax - 0x10], edi
mov rax, qword [0x1000a8a80]
mov word [rsi + rax], 0
jmp 0x10002aed9
mov ecx, 0x80070057
call fcn.100013860
int3
mov edx, 1
lea rcx, [rsp + 0xb8]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a88]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002af52
cmp dword [rbx + 0x10], 0
jl 0x10002af41
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002af41
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002af34
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a88], rax
jmp 0x10002af52
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a88]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002af75
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8a88]
cmp dword [rax - 0x10], 0
jne 0x10002b161
mov rbx, r15
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x10002b161
lea r12d, [rbp + 0xb]
nop
test rbx, rbx
jne 0x10002b161
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x139
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002afdb
mov rbx, r15
jmp 0x10002b049
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002aff1
mov rbx, r15
jmp 0x10002b044
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002b007
mov rbx, r15
jmp 0x10002b044
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, r12d
nop
nop
cmp rbx, rdx
jae 0x10002b037
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002b020
cmp rbx, rdx
jb 0x10002b03c
mov rbx, r15
jmp 0x10002b044
cmp word [rbx], 0
cmove rbx, r15
test rbx, rbx
jne 0x10002b06a
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x10002afb0
jmp 0x10002b161
test rdi, rdi
je 0x10002b161
mov edx, 0x139
mov r8d, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10002b161
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002b161
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10002b161
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
nop
cmp rbx, rcx
jae 0x10002b161
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add r12d, 0xffffffff
jne 0x10002b0d0
cmp rbx, rcx
jae 0x10002b161
movzx eax, word [rbx]
test ax, ax
je 0x10002b161
movzx edi, ax
mov rcx, qword [0x1000a8a88]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x10002b124
mov edx, edi
lea rcx, [0x1000a8a88]
call fcn.1000140c0
mov rcx, qword [0x1000a8a88]
lea rsi, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rsi
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x10002b156
mov rax, qword [0x1000a8a88]
cmp edi, dword [rax - 0xc]
jg 0x10002b156
mov dword [rax - 0x10], edi
mov rax, qword [0x1000a8a88]
mov word [rax + rsi], 0
jmp 0x10002b161
mov ecx, 0x80070057
call fcn.100013860
int3
mov edx, 2
lea rcx, [rsp + 0x108]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a90]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002b1da
cmp dword [rbx + 0x10], 0
jl 0x10002b1c9
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002b1c9
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002b1bc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a90], rax
jmp 0x10002b1da
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a90]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002b1fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8a90]
cmp dword [rax - 0x10], 0
jne 0x10002b3e1
mov rbx, r15
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x10002b3e1
lea r12d, [rbp + 0xc]
test rbx, rbx
jne 0x10002b3e1
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x139
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002b25f
mov rbx, r15
jmp 0x10002b2c9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002b275
mov rbx, r15
jmp 0x10002b2c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002b28b
mov rbx, r15
jmp 0x10002b2c4
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, r12d
nop
cmp rbx, rdx
jae 0x10002b2b7
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002b2a0
cmp rbx, rdx
jb 0x10002b2bc
mov rbx, r15
jmp 0x10002b2c4
cmp word [rbx], 0
cmove rbx, r15
test rbx, rbx
jne 0x10002b2ea
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x10002b234
jmp 0x10002b3e1
test rdi, rdi
je 0x10002b3e1
mov edx, 0x139
mov r8d, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10002b3e1
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002b3e1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10002b3e1
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
nop
cmp rbx, rcx
jae 0x10002b3e1
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add r12d, 0xffffffff
jne 0x10002b350
cmp rbx, rcx
jae 0x10002b3e1
movzx eax, word [rbx]
test ax, ax
je 0x10002b3e1
movzx edi, ax
mov rcx, qword [0x1000a8a90]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x10002b3a4
mov edx, edi
lea rcx, [0x1000a8a90]
call fcn.1000140c0
mov rcx, qword [0x1000a8a90]
lea rsi, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rsi
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x10002b3d6
mov rax, qword [0x1000a8a90]
cmp edi, dword [rax - 0xc]
jg 0x10002b3d6
mov dword [rax - 0x10], edi
mov rax, qword [0x1000a8a90]
mov word [rsi + rax], 0
jmp 0x10002b3e1
mov ecx, 0x80070057
call fcn.100013860
int3
mov r13d, 7
mov edx, r13d
lea rcx, [rsp + 0xc8]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a98]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002b45e
cmp dword [rbx + 0x10], 0
jl 0x10002b44d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002b44d
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002b440
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a98], rax
jmp 0x10002b45e
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a98]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002b481
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8a98]
mov r12d, 0xe
cmp dword [rax - 0x10], 0
jne 0x10002b671
mov rbx, r15
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
lea ebp, [r12 - 0xd]
test rax, rax
je 0x10002b671
nop
nop
test rbx, rbx
jne 0x10002b671
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x139
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002b4eb
mov rbx, r15
jmp 0x10002b559
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002b501
mov rbx, r15
jmp 0x10002b554
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002b517
mov rbx, r15
jmp 0x10002b554
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, r12d
nop
nop
cmp rbx, rdx
jae 0x10002b547
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002b530
cmp rbx, rdx
jb 0x10002b54c
mov rbx, r15
jmp 0x10002b554
cmp word [rbx], 0
cmove rbx, r15
test rbx, rbx
jne 0x10002b57a
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x10002b4c0
jmp 0x10002b671
test rdi, rdi
je 0x10002b671
mov edx, 0x139
mov r8d, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10002b671
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002b671
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10002b671
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, r12d
cmp rbx, rdx
jae 0x10002b671
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002b5e1
cmp rbx, rdx
jae 0x10002b671
movzx eax, word [rbx]
test ax, ax
je 0x10002b671
movzx edi, ax
mov rcx, qword [0x1000a8a98]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x10002b634
mov edx, edi
lea rcx, [0x1000a8a98]
call fcn.1000140c0
mov rcx, qword [0x1000a8a98]
lea rsi, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rsi
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x10002b666
mov rax, qword [0x1000a8a98]
cmp edi, dword [rax - 0xc]
jg 0x10002b666
mov dword [rax - 0x10], edi
mov rax, qword [0x1000a8a98]
mov word [rsi + rax], 0
jmp 0x10002b671
mov ecx, 0x80070057
call fcn.100013860
int3
mov edx, 8
lea rcx, [rsp + 0xf8]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8aa0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002b6ea
cmp dword [rbx + 0x10], 0
jl 0x10002b6d9
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002b6d9
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002b6cc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8aa0], rax
jmp 0x10002b6ea
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8aa0]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002b70d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8aa0]
cmp dword [rax - 0x10], 0
jne 0x10002b8f1
mov rbx, r15
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x10002b8f1
test rbx, rbx
jne 0x10002b8f1
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002b76b
mov rbx, r15
jmp 0x10002b7d9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002b781
mov rbx, r15
jmp 0x10002b7d4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002b797
mov rbx, r15
jmp 0x10002b7d4
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, r12d
nop
nop
cmp rbx, rdx
jae 0x10002b7c7
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002b7b0
cmp rbx, rdx
jb 0x10002b7cc
mov rbx, r15
jmp 0x10002b7d4
cmp word [rbx], 0
cmove rbx, r15
test rbx, rbx
jne 0x10002b7fa
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x10002b740
jmp 0x10002b8f1
test rdi, rdi
je 0x10002b8f1
mov edx, 0x13a
mov r8d, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10002b8f1
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002b8f1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10002b8f1
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
nop
cmp rbx, rcx
jae 0x10002b8f1
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add r12d, 0xffffffff
jne 0x10002b860
cmp rbx, rcx
jae 0x10002b8f1
movzx eax, word [rbx]
test ax, ax
je 0x10002b8f1
movzx edi, ax
mov rcx, qword [0x1000a8aa0]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x10002b8b4
mov edx, edi
lea rcx, [0x1000a8aa0]
call fcn.1000140c0
mov rcx, qword [0x1000a8aa0]
lea rsi, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rsi
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x10002b8e6
mov rax, qword [0x1000a8aa0]
cmp edi, dword [rax - 0xc]
jg 0x10002b8e6
mov dword [rax - 0x10], edi
mov rax, qword [0x1000a8aa0]
mov word [rsi + rax], 0
jmp 0x10002b8f1
mov ecx, 0x80070057
call fcn.100013860
int3
mov edx, 3
lea rcx, [rsp + 0xd8]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8aa8]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002b96a
cmp dword [rbx + 0x10], 0
jl 0x10002b959
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002b959
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002b94c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8aa8], rax
jmp 0x10002b96a
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8aa8]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002b98d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8aa8]
cmp dword [rax - 0x10], 0
jne 0x10002bb70
mov rbx, r15
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov r12d, 1
test rax, rax
je 0x10002bb70
lea ebp, [r12 + 9]
test rbx, rbx
jne 0x10002bb70
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x139
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002b9f1
mov rbx, r15
jmp 0x10002ba59
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002ba07
mov rbx, r15
jmp 0x10002ba54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002ba1d
mov rbx, r15
jmp 0x10002ba54
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, ebp
cmp rbx, rdx
jae 0x10002ba47
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002ba30
cmp rbx, rdx
jb 0x10002ba4c
mov rbx, r15
jmp 0x10002ba54
cmp word [rbx], 0
cmove rbx, r15
test rbx, rbx
jne 0x10002ba7c
mov edx, r12d
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc r12d
test rax, rax
jne 0x10002b9c6
jmp 0x10002bb70
test rdi, rdi
je 0x10002bb70
mov edx, 0x139
mov r8d, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10002bb70
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002bb70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10002bb70
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
cmp rbx, rcx
jae 0x10002bb70
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ebp, 0xffffffff
jne 0x10002bae0
cmp rbx, rcx
jae 0x10002bb70
movzx eax, word [rbx]
test ax, ax
je 0x10002bb70
movzx edi, ax
mov rcx, qword [0x1000a8aa8]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x10002bb33
mov edx, edi
lea rcx, [0x1000a8aa8]
call fcn.1000140c0
mov rcx, qword [0x1000a8aa8]
lea rsi, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rsi
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x10002bb65
mov rax, qword [0x1000a8aa8]
cmp edi, dword [rax - 0xc]
jg 0x10002bb65
mov dword [rax - 0x10], edi
mov rax, qword [0x1000a8aa8]
mov word [rsi + rax], 0
jmp 0x10002bb70
mov ecx, 0x80070057
call fcn.100013860
int3
mov edx, 5
lea rcx, [rsp + 0xa0]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a70]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002bbe9
cmp dword [rbx + 0x10], 0
jl 0x10002bbd8
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002bbd8
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002bbcb
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a70], rax
jmp 0x10002bbe9
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a70]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002bc0c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8a70]
cmp dword [rax - 0x10], 0
jne 0x10002bdf3
mov rbx, r15
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x10002bdf3
nop
test rbx, rbx
jne 0x10002bdf3
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002bc6b
mov rbx, r15
jmp 0x10002bcd9
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002bc81
mov rbx, r15
jmp 0x10002bcd4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002bc97
mov rbx, r15
jmp 0x10002bcd4
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 6
nop
cmp rbx, rdx
jae 0x10002bcc7
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002bcb0
cmp rbx, rdx
jb 0x10002bccc
mov rbx, r15
jmp 0x10002bcd4
cmp word [rbx], 0
cmove rbx, r15
test rbx, rbx
jne 0x10002bcfa
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x10002bc40
jmp 0x10002bdf3
test rdi, rdi
je 0x10002bdf3
mov edx, 0x13b
mov r8d, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10002bdf3
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002bdf3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10002bdf3
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, 6
cmp rbx, rdx
jae 0x10002bdf3
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002bd63
cmp rbx, rdx
jae 0x10002bdf3
movzx eax, word [rbx]
test ax, ax
je 0x10002bdf3
movzx edi, ax
mov rcx, qword [0x1000a8a70]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x10002bdb6
mov edx, edi
lea rcx, [0x1000a8a70]
call fcn.1000140c0
mov rcx, qword [0x1000a8a70]
lea rsi, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rsi
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x10002bde8
mov rax, qword [0x1000a8a70]
cmp edi, dword [rax - 0xc]
jg 0x10002bde8
mov dword [rax - 0x10], edi
mov rax, qword [0x1000a8a70]
mov word [rsi + rax], 0
jmp 0x10002bdf3
mov ecx, 0x80070057
call fcn.100013860
int3
mov edx, 6
lea rcx, [rsp + 0xa8]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a78]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002be6c
cmp dword [rbx + 0x10], 0
jl 0x10002be5b
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002be5b
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002be4e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a78], rax
jmp 0x10002be6c
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a78]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002be8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8a78]
cmp dword [rax - 0x10], 0
jne 0x10002c071
mov rbx, r15
xor edx, edx
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
mov ebp, 1
test rax, rax
je 0x10002c071
test rbx, rbx
jne 0x10002c071
xor r9d, r9d
lea edx, [rbx + 6]
mov r8d, 0x13b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rsi, rax
test rax, rax
jne 0x10002beed
mov rbx, r15
jmp 0x10002bf59
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x10002bf03
mov rbx, r15
jmp 0x10002bf54
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x10002bf19
mov rbx, r15
jmp 0x10002bf54
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rbx
mov ecx, r13d
nop
cmp rbx, rdx
jae 0x10002bf47
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add ecx, 0xffffffff
jne 0x10002bf30
cmp rbx, rdx
jb 0x10002bf4c
mov rbx, r15
jmp 0x10002bf54
cmp word [rbx], 0
cmove rbx, r15
test rbx, rbx
jne 0x10002bf7a
mov edx, ebp
lea rcx, [0x1000a92a0]
call fcn.100047064
mov rdi, rax
inc ebp
test rax, rax
jne 0x10002bec2
jmp 0x10002c071
test rdi, rdi
je 0x10002c071
mov edx, 0x13b
mov r8d, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x10002c071
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x10002c071
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x10002c071
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
nop
cmp rbx, rcx
jae 0x10002c071
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
add r13d, 0xffffffff
jne 0x10002bfe0
cmp rbx, rcx
jae 0x10002c071
movzx eax, word [rbx]
test ax, ax
je 0x10002c071
movzx edi, ax
mov rcx, qword [0x1000a8a78]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x10002c034
mov edx, edi
lea rcx, [0x1000a8a78]
call fcn.1000140c0
mov rcx, qword [0x1000a8a78]
lea rsi, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rsi
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x10002c066
mov rax, qword [0x1000a8a78]
cmp edi, dword [rax - 0xc]
jg 0x10002c066
mov dword [rax - 0x10], edi
mov rax, qword [0x1000a8a78]
mov word [rsi + rax], 0
jmp 0x10002c071
mov ecx, 0x80070057
call fcn.100013860
int3
mov edx, 4
lea rcx, [rsp + 0xb0]
call fcn.1000339c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8a68]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002c0ea
cmp dword [rbx + 0x10], 0
jl 0x10002c0d9
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002c0d9
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002c0cc
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8a68], rax
jmp 0x10002c0ea
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8a68]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002c10d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [0x1000a8a68]
cmp dword [rax - 0x10], 0
jne 0x10002c140
xor edx, edx
mov ecx, 0x1389
call fcn.1000138a0
test rax, rax
je 0x10002c140
mov r8d, 0x1389
mov rdx, rax
lea rcx, [0x1000a8a68]
call fcn.1000149f0
lea rcx, [0x1000a9318]
mov rax, qword [0x1000a9318]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov edx, 1
mov r8d, edx
lea rcx, [rsp + 0xc0]
call fcn.100033bf0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002c1cb
cmp dword [rbx + 0x10], 0
jl 0x10002c1bc
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002c1bc
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002c1b1
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x10002c1cb
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002c1ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0x10], 0
je 0x10002c223
mov dword [rsp + 0x28], 0xa050
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [0x1000a89a0], rax
test rax, rax
jne 0x10002c23c
mov edx, 0x66
mov rcx, qword [0x1000a8958]
call qword [sym.imp.USER32.dll_LoadBitmapW]
mov qword [0x1000a89a0], rax
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0xd0]
call fcn.100033bf0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002c2ae
cmp dword [rbx + 0x10], 0
jl 0x10002c29f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002c29f
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002c294
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x10002c2ae
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002c2d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x30]
cmp dword [rdx - 0x10], 0
je 0x10002c303
mov dword [rsp + 0x28], 0xa050
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [0x1000a89a8], rax
test rax, rax
jne 0x10002c31c
mov edx, 0x65
mov rcx, qword [0x1000a8958]
call qword [sym.imp.USER32.dll_LoadBitmapW]
mov qword [0x1000a89a8], rax
mov qword [0x1000a89b0], r15
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rsp + 0xe0]
call fcn.100033bf0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [0x1000a8ab0]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x10002c39d
cmp dword [rbx + 0x10], 0
jl 0x10002c38c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x10002c38c
call fcn.100014130
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x10002c37f
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [0x1000a8ab0], rax
jmp 0x10002c39d
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1000a8ab0]
call fcn.100014b20
nop
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002c3c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1000a8ab0]
cmp dword [rdx - 0x10], 0
je 0x10002c3f2
mov dword [rsp + 0x28], 0x8050
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [0x1000a89b0], rax
jmp 0x10002c3f9
mov rax, qword [0x1000a89b0]
test rax, rax
jne 0x10002c47d
lea edx, [rax + 0x64]
mov rcx, qword [0x1000a8958]
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [0x1000a89b0], rax
mov rax, qword [0x1000a8ab0]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x10002c47d
cmp dword [rdx + 0x10], 0
jge 0x10002c452
cmp dword [rax - 0xc], 0
jge 0x10002c440
mov ecx, 0x80070057
call fcn.100013860
int3
mov dword [rax - 0x10], r15d
mov rax, qword [0x1000a8ab0]
mov word [rax], 0
jmp 0x10002c47d
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002c469
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1000a8ab0], rax
mov dword [rsp + 0x40], 0x58
mov dword [rsp + 0x44], 0x808
mov rax, qword [0x1000a8958]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xf0]
call fcn.10001fd30
nop
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002c4d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [0x100020670]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], 0x3e8
lea rcx, [rsp + 0x40]
call qword [0x100013188]
mov qword [0x1000a89c0], rax
mov dword [rsp + 0x44], 0x3008
lea rax, [0x100026f70]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1000a8a68]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x50], 0x3e9
mov rax, qword [0x1000a8958]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
call qword [0x100013188]
mov qword [0x1000a89c8], rax
mov dword [rsp + 0x44], 0x3008
lea rax, [0x100021b80]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1000a8aa8]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x50], 0x3ea
lea rcx, [rsp + 0x40]
call qword [0x100013188]
mov qword [0x1000a89d0], rax
mov dword [rsp + 0x44], 0x808
lea rax, [0x10002a570]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], 0x3eb
lea rcx, [rsp + 0x40]
call qword [0x100013188]
mov qword [0x1000a89d8], rax
mov dword [0x1000a89e0], 0x60
mov rax, qword [0x1000a8958]
mov qword [0x1000a89f0], rax
mov rax, qword [0x1000a89b0]
mov qword [0x1000a89f8], rax
mov qword [0x1000a89e8], r15
lea rcx, [rsp + 0x100]
call fcn.10001fd30
nop
mov rax, qword [rax]
mov qword [0x1000a8a00], rax
mov rdx, qword [rsp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10002c628
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [0x1000a89c0]
mov qword [0x1000a8a18], rax
mov dword [0x1000a89e4], 0x11d8122
mov rax, qword [0x1000a89a0]
mov qword [0x1000a8a28], rax
mov rax, qword [0x1000a89a8]
mov qword [0x1000a8a38], rax
mov dword [0x1000a8a10], r15d
mov dword [0x1000a8a08], 4
lea rax, [0x10001fc00]
mov qword [0x1000a8a20], rax
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x10002c69b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
mov r12, qword [rsp + 0x150]
mov r13, qword [rsp + 0x148]
mov r14, qword [rsp + 0x140]
mov r15, qword [rsp + 0x138]
add rsp, 0x158
ret