Function at 0x1401c3e90
Capabilities:
Check if file exists
Create thread
Get file attributes
Reference sql statements
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x91d8]
mov eax, 0x92d8
call fcn.140247340
sub rsp, rax
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov r12, rcx
mov dword [0x14037cae8], 1
xor r13d, r13d
cmp qword [0x14037c298], r13
jne 0x1401c3f52
lea ecx, [r13 + 0x28]
call fcn.14018ef40
mov rdi, rax
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c3f48
lea rax, vtable.CKnownFolders.0
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rbp + 0x9230], rbx
mov qword [rbx], r13
mov qword [rbx + 8], r13
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [rdi + 0x18]
mov qword [rbp + 0x9230], rbx
mov qword [rbx], r13
mov qword [rbx + 8], r13
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
mov rcx, rdi
call fcn.14007eee0
nop
jmp 0x1401c3f4b
mov rdi, r13
mov qword [0x14037c298], rdi
cmp qword [0x14037c368], 0
jne 0x1401c3fca
mov ecx, 0x68
call fcn.14018ef40
mov rbx, rax
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c3fc0
mov qword [rax], r13
mov qword [rax + 8], r13
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14000b0b0
mov qword [rbx], rax
mov dword [rbx + 0x3c], r13d
mov qword [rbx + 0x40], 1
mov dword [rbx + 0x48], r13d
mov qword [rbx + 0x50], r13
mov qword [rbx + 0x60], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x58], eax
mov dword [rbx + 0x38], PathResolve
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x1401c3fc3
mov rbx, r13
mov qword [0x14037c368], rbx
cmp qword [0x14037c378], 0
jne 0x1401c40b5
mov ecx, 0xd8
call fcn.14018ef40
mov rdi, rax
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c40ab
lea rax, vtable.CInvestigatorItemNotifier.0
mov qword [rdi], rax
lea rbx, [rdi + 0x30]
mov qword [rbp + 0x9230], rbx
mov qword [rbx], r13
mov qword [rbx + 8], r13
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [rdi + 0x40]
mov qword [rbp + 0x9230], rbx
mov qword [rbx], r13
mov qword [rbx + 8], r13
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [rdi + 0x50]
mov qword [rbp + 0x9230], rbx
mov qword [rbx], r13
mov qword [rbx + 8], r13
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
mov qword [rdi + 0x88], r13
mov qword [rdi + 0xa8], r13
mov qword [rdi + 0xa0], r13
mov qword [rdi + 0xb8], r13
mov qword [rdi + 0xc0], r13
mov qword [rdi + 0xc8], r13
mov qword [rdi + 0xd0], r13
lea rcx, [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, rdi
call fcn.1401ca8b0
nop
jmp 0x1401c40ae
mov rdi, r13
mov qword [0x14037c378], rdi
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140033180
test eax, eax
je 0x1401c40df
mov rcx, qword [0x1403517c8]
add rcx, 0xdb8
call fcn.140033300
call fcn.1400ff2f0
call fcn.1401c5860
mov ecx, WSACleanup
call fcn.14018ef40
mov rdi, rax
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4154
lea rbx, [rax + 0x28]
mov qword [rbp + 0x9230], rbx
mov qword [rbx], r13
mov qword [rbx + 8], r13
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
mov qword [rdi + 0x68], r13
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x38], rax
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x1401c4157
mov rdi, r13
mov qword [0x14037c3b8], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x1401c67f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x14037c2a8], 0
jne 0x1401c422f
mov ecx, WSACleanup
call fcn.14018ef40
mov rbx, rax
mov qword [rbp + 0x9230], rax
test rax, rax
je 0x1401c41f9
mov qword [rax], r13
mov qword [rax + 8], r13
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14000b0b0
mov qword [rbx], rax
mov qword [rbx + 0x40], r13
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rax
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x1401c41fc
mov rbx, r13
mov qword [0x14037c2a8], rbx
lea rax, [rbp + 0x9228]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x1401c5430]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14037c2a0], rax
mov rcx, qword [0x14037c378]
mov rax, qword [0x14037c3b8]
mov qword [rcx + 0xb0], rax
mov rdi, qword [rcx + 0x88]
mov edx, 0x875
mov rcx, qword [0x14034e658]
call qword [sym.imp.USER32.dll_LoadIconA]
mov rsi, rax
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8, rsi
mov r14, 0xffffffffffffffff
mov edx, r14d
mov rcx, qword [rdi]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov r15d, eax
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rdx, qword [0x14037c378]
mov rdi, qword [rdx + 0x88]
mov edx, 0x874
mov rcx, qword [0x14034e658]
call qword [sym.imp.USER32.dll_LoadIconA]
mov rsi, rax
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8, rsi
mov edx, r14d
mov rcx, qword [rdi]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov r14d, eax
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rdx, qword [0x14037c378]
mov rdi, qword [rdx + 0x88]
mov edx, 0x876
mov rcx, qword [0x14034e658]
call qword [sym.imp.USER32.dll_LoadIconA]
mov rsi, rax
lea rbx, [rdi + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8, rsi
mov rdx, 0xffffffffffffffff
mov rcx, qword [rdi]
call qword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DestroyIcon]
mov rdx, qword [0x14037c378]
mov dword [rdx + 0x90], r15d
mov dword [rdx + 0x94], r14d
mov dword [rdx + 0x98], edi
mov eax, dword [0x14037c328]
mov dword [rdx + 0x20], eax
cmp dword [0x14037c354], 0
je 0x1401c4375
mov eax, dword [0x14037c358]
mov dword [rdx + 0x24], eax
lea r8, [0x14034eb30]
mov edx, 0x410
lea rcx, [rbp - 0x70]
call fcn.140253604
lea rdx, str.sas_backlog.db3
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0x68
call fcn.14018ef40
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c43bb
mov rcx, rax
call fcn.14007ba30
jmp 0x1401c43be
mov rax, r13
mov qword [0x14037c340], rax
mov r8d, 1
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.14006d170
movabs r15, 0xaaaaaaaaaaaaaa9
test eax, eax
je 0x1401c4c54
mov rdx, qword [str.CREATE_TABLE__LOG____ID__INTEGER_NOT_NULL_PRIMARY_KEY_AUTOINCREMENT___PAGE__INTEGER___PATH__TEXT___NAME__TEXT___DATA__TEXT___TYPE__INTEGER___FIRST__INTEGER___LAST__INTEGER___GONE__INTEGER___CHANGE__INTEGER___FLAGS__TEXT___PUBLISHER__TEXT___FID__TEXT___]
mov rcx, qword [0x14037c340]
call fcn.140102f40
mov rdx, qword [0x14037c340]
mov rcx, qword [0x14037c378]
call fcn.1401d43c0
mov r14d, r13d
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.SELECT_DATA_FROM_LOG_WHERE_PAGE_u
mov edx, 0x28a0
lea rcx, [rbp + 0x6930]
call fcn.14000b150
mov rbx, qword [0x14037c340]
mov edi, r13d
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1401c4463
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x6930]
call qword [rax]
mov edi, eax
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x1401c44de
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x28]
test eax, eax
je 0x1401c44a1
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401c44a1
cmp byte [rcx], r14b
je 0x1401c44a1
call fcn.1402520ac
mov r14d, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [0x14037c340]
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1401c44ca
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp r14d, 1
jae 0x1401c4c54
mov r14d, r13d
mov dword [rbp + 0x9238], r13d
mov rbx, qword [0x14037c340]
mov esi, r13d
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1401c451b
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x48]
lea rdx, str.SELECT_ID_PATH_NAME_PUBLISHER_TYPE_FROM_LOG
call qword [rax]
mov esi, eax
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1401c4b29
mov r12d, r13d
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x28]
test eax, eax
je 0x1401c4b22
lea rsi, vtable.CSABUnicodeString.0
mov r8d, 0xa
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
call fcn.140251de0
mov dword [rbp + 0x9230], eax
mov rcx, qword [rsp + 0x48]
mov r10, qword [rcx]
lea r9, [rsp + 0x40]
mov r8d, 4
mov edx, r12d
call qword [r10 + 0x28]
test eax, eax
je 0x1401c45af
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401c45af
cmp byte [rcx], 0
je 0x1401c45af
mov r8d, 0xa
lea rdx, [rsp + 0x78]
call fcn.140251de0
mov r13d, eax
mov byte [rbp + 0x1c00], 0
xor ebx, ebx
mov word [rbp + 0x2830], bx
mov rcx, qword [rsp + 0x48]
mov r10, qword [rcx]
lea r9, [rsp + 0x40]
lea r8d, [rbx + 1]
mov edx, r12d
call qword [r10 + 0x28]
test eax, eax
je 0x1401c46ea
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401c46ea
lea rdi, [rbx - 1]
cmp byte [rcx], bl
je 0x1401c46f1
mov dword [rbp + 0x9228], 0x103e
mov rdx, rdi
inc rdx
cmp byte [rcx + rdx], bl
jne 0x1401c4606
lea r9, [rbp + 0x9228]
lea r8, [rbp + 0x2830]
call fcn.14003c9b0
mov eax, dword [rbp + 0x9228]
test eax, eax
jns 0x1401c462d
inc eax
sar eax, 1
cdqe
mov word [rbp + rax*2 + 0x2830], bx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], rbx
mov ecx, 2
call fcn.140247068
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov word [rax], bx
mov r9, qword [rsp + 0x40]
mov rdx, rdi
inc rdx
cmp byte [r9 + rdx], 0
jne 0x1401c4666
mov r8d, edx
test edx, edx
je 0x1401c4688
lea eax, [rdx - 1]
movsxd rcx, eax
cmp byte [rcx + r9], 0x5c
jne 0x1401c4688
lea r8d, [rdx - 1]
movsxd r8, r8d
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.1400e8040
mov dword [rbp + 0x9228], 0xc2f
mov edx, dword [rsp + 0x68]
add edx, edx
mov dword [rsp + 0x20], 2
lea r9, [rbp + 0x9228]
lea r8, [rbp + 0x1c00]
mov rcx, qword [rsp + 0x58]
call fcn.14000a430
movsxd rax, dword [rbp + 0x9228]
mov byte [rbp + rax + 0x1c00], 0
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.140247060
xor ebx, ebx
jmp 0x1401c46f1
mov rdi, 0xffffffffffffffff
mov byte [rbp + 0xfd0], 0
mov word [rbp + 0x3870], bx
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
mov r8d, 2
mov edx, r12d
call qword [rax + 0x28]
test eax, eax
je 0x1401c4877
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1401c4877
cmp byte [rcx], 0
je 0x1401c4877
mov dword [rbp + 0x9228], 0x103e
mov rdx, rdi
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1401c4744
lea r9, [rbp + 0x9228]
lea r8, [rbp + 0x3870]
call fcn.14003c9b0
mov eax, dword [rbp + 0x9228]
test eax, eax
jns 0x1401c476c
inc eax
sar eax, 1
cdqe
mov word [rbp + rax*2 + 0x3870], bx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], rbx
mov ecx, 2
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x58], rax
mov eax, 1
mov qword [rsp + 0x60], rax
mov word [rsi], bx
mov r14, qword [rsp + 0x40]
test r14, r14
jne 0x1401c47b0
mov rdi, rbx
jmp 0x1401c47ba
inc rdi
cmp byte [r14 + rdi], 0
jne 0x1401c47b0
lea r15, [rdi + 1]
cmp r15, 1
jbe 0x1401c47fd
mov eax, 2
mul r15
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140247068
mov rbx, rax
movzx ecx, word [rsi]
mov word [rax], cx
mov edx, 2
mov rcx, rsi
call fcn.140247060
mov rsi, rbx
mov rax, r15
xor ebx, ebx
test rdi, rdi
je 0x1401c481b
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, edi
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rsi + rdi*2], bx
mov dword [rbp + 0x9228], 0xc2f
lea edx, [rdi + rdi]
mov dword [rsp + 0x20], 2
lea r9, [rbp + 0x9228]
lea r8, [rbp + 0xfd0]
mov rcx, rsi
call fcn.14000a430
movsxd rax, dword [rbp + 0x9228]
mov byte [rbp + rax + 0xfd0], 0
mov edx, 2
mov rcx, rsi
call fcn.140247060
lea rsi, vtable.CSABUnicodeString.0
movabs r15, 0xaaaaaaaaaaaaaa9
cmp r13d, 0x400
jne 0x1401c48f2
cmp word [rbp + 0x2830], 0
je 0x1401c48f2
cmp word [rbp + 0x3870], 0
je 0x1401c48f2
lea r8, [rbp + 0x2830]
mov edx, 0x1040
lea rcx, [rbp + 0x48b0]
call fcn.140251ec0
lea r8, [0x140287d80]
mov edx, 0x1040
lea rcx, [rbp + 0x48b0]
call fcn.140251e40
lea r8, [rbp + 0x3870]
mov edx, 0x1040
lea rcx, [rbp + 0x48b0]
call fcn.140251e40
lea rcx, [rbp + 0x48b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1401c4ce0
mov byte [rbp + 0x3a0], 0
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
mov r8d, 3
mov edx, r12d
call qword [rax + 0x28]
test eax, eax
je 0x1401c4a23
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401c4a23
xor r13d, r13d
cmp byte [rax], r13b
je 0x1401c4a26
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], r13
lea ecx, [r13 + 2]
call fcn.140247068
mov rsi, rax
mov qword [rsp + 0x58], rax
mov eax, 1
mov qword [rsp + 0x60], rax
mov word [rsi], r13w
mov r14, qword [rsp + 0x40]
lea rcx, [rax - 2]
test r14, r14
jne 0x1401c4970
mov edi, r13d
jmp 0x1401c497d
mov rdi, rcx
inc rdi
cmp byte [r14 + rdi], 0
jne 0x1401c4973
lea r15, [rdi + 1]
cmp r15, 1
jbe 0x1401c49b7
mov eax, 2
mul r15
cmovo rax, rcx
mov rcx, rax
call fcn.140247068
mov rbx, rax
movzx ecx, word [rsi]
mov word [rax], cx
mov edx, 2
mov rcx, rsi
call fcn.140247060
mov rsi, rbx
mov rax, r15
test rdi, rdi
je 0x1401c49d5
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, edi
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rsi + rdi*2], r13w
mov dword [rbp + 0x9228], 0xc2f
lea edx, [rdi + rdi]
mov dword [rsp + 0x20], 2
lea r9, [rbp + 0x9228]
lea r8, [rbp + 0x3a0]
mov rcx, rsi
call fcn.14000a430
movsxd rax, dword [rbp + 0x9228]
mov byte [rbp + rax + 0x3a0], 0
mov edx, 2
mov rcx, rsi
call fcn.140247060
jmp 0x1401c4a26
xor r13d, r13d
mov eax, dword [rbp + 0x9230]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xfd0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1c00]
lea r8, str.UPDATE_LOG_SET_PATH_s__NAME_s__PUBLISHER_s_WHERE_ID_u
mov edx, 0x28a0
lea rcx, [rbp + 0x6930]
call fcn.14000b150
mov rdi, qword [0x14037c378]
lea rcx, [rbp + 0x6930]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1401c4a80
inc eax
mov ebx, eax
mov ecx, eax
call fcn.140247068
mov qword [rbp + 0x9228], rax
mov r8d, ebx
lea rdx, [rbp + 0x6930]
mov rcx, rax
call fcn.1402496a0
lea rbx, [rdi + 0x30]
mov rdi, qword [rbx]
mov rsi, qword [rdi + 8]
lea r9, [rbp + 0x9228]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.140009370
mov rdx, qword [rbx + 8]
movabs r15, 0xaaaaaaaaaaaaaa9
mov rcx, r15
sub rcx, rdx
cmp rcx, 1
jb 0x1401c53dc
lea rcx, [rdx + 1]
mov qword [rbx + 8], rcx
mov qword [rdi + 8], rax
mov qword [rsi], rax
inc r12d
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, r12d
call qword [rax + 0x28]
test eax, eax
jne 0x1401c454d
mov r14d, dword [rbp + 0x9238]
mov r12, qword [rbp + 0x9220]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.DELETE_FROM_LOG_WHERE_PAGE_u
mov edx, 0x28a0
lea rcx, [rbp + 0x6930]
call fcn.14000b150
mov rdi, qword [0x14037c340]
mov esi, r13d
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1401c4b7c
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x9228]
lea rdx, [rbp + 0x6930]
call qword [rax]
mov esi, eax
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1401c4bb7
mov rsi, qword [rbp + 0x9228]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1401c4bad
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.INSERT_INTO_LOG__PAGE_DATA__VALUES___u_1_
mov edx, 0x28a0
lea rcx, [rbp + 0x6930]
call fcn.14000b150
mov rdi, qword [0x14037c340]
mov esi, r13d
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1401c4c0a
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x9228]
lea rdx, [rbp + 0x6930]
call qword [rax]
mov esi, eax
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1401c4c45
mov rsi, qword [rbp + 0x9228]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x1401c4c3b
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, r14d
mov rcx, qword [0x14037c378]
call fcn.1401c96c0
mov r8d, r13d
cmp dword [0x140350f10], 0
sete r8b
or r8d, dword [0x14037c360]
mov rcx, qword [0x14037c2a8]
mov rdx, qword [0x14037c368]
mov rax, qword [0x14037c298]
mov qword [rdx + 0x50], rax
mov qword [rdx + 0x60], rcx
mov eax, dword [0x14037c328]
mov dword [rdx + 0x48], eax
mov eax, dword [0x14037c35c]
mov dword [rdx + 0x3c], eax
mov eax, dword [0x14033c720]
mov dword [rdx + 0x40], eax
mov dword [rdx + 0x44], r8d
mov rcx, qword [0x14037c378]
mov qword [rcx + 8], rdx
mov eax, dword [0x14033c724]
mov dword [rcx + 0x14], eax
add dword [0x14034e620], 0x20
mov ecx, 0x20
call fcn.140250fe4
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4cee
mov rcx, rax
call fcn.1400c2ae0
jmp 0x1401c4cf1
mov r14d, 1
xor r13d, r13d
jmp 0x1401c4b22
mov rax, r13
mov qword [0x14037c380], rax
add dword [0x14034e620], 0x58
mov ecx, 0x58
call fcn.140250fe4
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4d1f
mov rcx, rax
call fcn.1400b7b40
jmp 0x1401c4d22
mov rax, r13
mov qword [0x14037c388], rax
add dword [0x14034e620], 0x58
mov ecx, 0x58
call fcn.140250fe4
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4d50
mov rcx, rax
call fcn.1400b37f0
jmp 0x1401c4d53
mov rax, r13
mov qword [0x14037c390], rax
add dword [0x14034e620], 0x58
mov ecx, 0x58
call fcn.140250fe4
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4d81
mov rcx, rax
call fcn.1400b6770
jmp 0x1401c4d84
mov rax, r13
mov qword [0x14037c398], rax
add dword [0x14034e620], 0x30
mov ecx, PathResolve
call fcn.140250fe4
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4db2
mov rcx, rax
call fcn.1400c8c90
jmp 0x1401c4db5
mov rax, r13
mov qword [0x14037c3a0], rax
add dword [0x14034e620], 0x20
mov ecx, 0x20
call fcn.140250fe4
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4de3
mov rcx, rax
call fcn.1400c8230
jmp 0x1401c4de6
mov rax, r13
mov qword [0x14037c3a8], rax
add dword [0x14034e620], 0x20
mov ecx, 0x20
call fcn.140250fe4
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4e14
mov rcx, rax
call fcn.1400d9750
jmp 0x1401c4e17
mov rax, r13
mov qword [0x14037c3b0], rax
mov rbx, qword [0x14037cae0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401c4e61
mov edx, SafeArrayGetDim
mov rcx, rbx
call fcn.1400dda20
test rax, rax
je 0x1401c4e61
mov edx, 0x419
mov rcx, rax
call fcn.140191b00
test rax, rax
je 0x1401c4e61
cmp qword [rax + 8], 0
jne 0x1401c4f3c
mov rbx, qword [0x14037cae0]
mov rdi, qword [0x14034e658]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401c4f3c
mov edx, SafeArrayGetDim
mov rcx, rbx
call fcn.1400dda20
mov rbx, rax
test rax, rax
je 0x1401c4f3c
mov ecx, PathResolve
call fcn.14018ef40
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c4edc
mov qword [rax], rdi
mov dword [rax + 8], 0x87d
lea rcx, [0x1401cdd50]
mov qword [rax + 0x10], rcx
mov dword [rax + 0x18], 0x419
mov qword [rax + 0x20], 0x419
mov dword [rax + 0x28], 0x817
jmp 0x1401c4edf
mov rax, r13
mov qword [rbp + 0x9228], rax
mov rsi, qword [rbx + 0x30]
mov r14, qword [rsi + 8]
lea r9, [rbp + 0x9228]
mov r8, r14
mov rdx, rsi
lea rcx, [rbx + 0x30]
call fcn.140009370
mov rdx, rax
mov rax, qword [rbx + 0x38]
mov rcx, r15
sub rcx, rax
cmp rcx, 1
jb 0x1401c53e9
inc rax
mov qword [rbx + 0x38], rax
mov qword [rsi + 8], rdx
mov qword [r14], rdx
cmp dword [rbx + 8], 0xffffffff
jne 0x1401c4f3c
mov edx, 0x419
mov rcx, rbx
call fcn.1401b66d0
test r12, r12
je 0x1401c5353
mov r15d, r13d
mov rax, qword [r12]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401c536c
lea rdx, [0x140000000]
nop
mov eax, dword [rbx + 0x10]
add eax, 0xfffffbe6
cmp eax, 0xc
ja case.default.0x1401c4f77
mov ecx, dword [rdx + rax*4 + 0x1c53f8]
add rcx, rdx
jmp rcx
mov edi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x1401c4fd7
mov edi, 1
jmp 0x1401c4fd7
mov edi, 2
jmp 0x1401c4fd7
mov edi, 3
jmp 0x1401c4fd7
mov edi, 4
jmp 0x1401c4fd7
mov edi, 5
jmp 0x1401c4fd7
mov edi, 6
jmp 0x1401c4fd7
mov edi, 7
jmp 0x1401c4fd7
mov edi, 8
jmp 0x1401c4fd7
mov edi, 9
jmp 0x1401c4fd7
mov edi, 0xa
jmp 0x1401c4fd7
mov edi, VariantTimeToDosDateTime
jmp 0x1401c4fd7
mov edi, SafeArrayGetDim
jmp 0x1401c4fd7
mov edi, r13d
mov r14d, dword [0x14037c328]
mov rsi, qword [0x14037c378]
mov rcx, qword [rsi + 0x50]
mov rax, qword [rcx]
cmp rax, rcx
je 0x1401c5001
mov rdx, qword [rax + 0x10]
cmp dword [rdx], edi
je 0x1401c5071
mov rax, qword [rax]
cmp rax, rcx
jne 0x1401c4ff1
mov ecx, 8
call fcn.14018ef40
mov qword [rbp + 0x9228], rax
test rax, rax
je 0x1401c501f
mov dword [rax], edi
mov dword [rax + 4], r14d
jmp 0x1401c5022
mov rax, r13
mov qword [rbp + 0x9228], rax
mov rdi, qword [rsi + 0x50]
mov r14, qword [rdi + 8]
lea r9, [rbp + 0x9228]
mov r8, r14
mov rdx, rdi
lea rcx, [rsi + 0x50]
call fcn.140009370
mov rdx, qword [rsi + 0x58]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rdx
cmp rcx, 1
jb 0x1401c53cf
lea rcx, [rdx + 1]
mov qword [rsi + 0x58], rcx
mov qword [rdi + 8], rax
mov qword [r14], rax
inc r15d
mov esi, dword [rbx + 0x10]
mov rdi, qword [0x14037cae0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401c50be
mov edx, SafeArrayGetDim
mov rcx, rdi
call fcn.1400dda20
test rax, rax
je 0x1401c50be
mov edx, esi
mov rcx, rax
call fcn.140191b00
test rax, rax
je 0x1401c50b2
mov rsi, qword [rax + 8]
jmp 0x1401c50b5
mov rsi, r13
test rsi, rsi
jne 0x1401c5186
mov esi, dword [rbx + 0x10]
mov rdi, qword [0x14037cae0]
mov r14, qword [0x14034e658]
cmp esi, 0xffffffff
je 0x1401c5131
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401c5131
mov edx, SafeArrayGetDim
mov rcx, rdi
call fcn.1400dda20
mov rdi, rax
test rax, rax
je 0x1401c5131
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
lea r9, [0x1401d03b0]
mov r8d, 0x873
mov rdx, r14
mov rcx, rax
call fcn.140190b50
test rax, rax
je 0x1401c5131
cmp dword [rdi + 8], 0xffffffff
jne 0x1401c5131
mov edx, esi
mov rcx, rdi
call fcn.1401b66d0
mov esi, dword [rbx + 0x10]
mov rdi, qword [0x14037cae0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401c516f
mov edx, SafeArrayGetDim
mov rcx, rdi
call fcn.1400dda20
test rax, rax
je 0x1401c516f
mov edx, esi
mov rcx, rax
call fcn.140191b00
test rax, rax
je 0x1401c516f
mov rsi, qword [rax + 8]
jmp 0x1401c5172
mov rsi, r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x817
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, 0x4ff
mov rcx, rsi
test byte [0x14037c290], 1
je 0x1401c51a1
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
jmp 0x1401c51b6
mov edi, 5
cmp r15d, 1
cmove edi, r13d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, edi
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x4ff
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
lea r8, str.Collecting_Data...
mov edx, 0x59d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextA]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x17]
mov rcx, rsi
call fcn.1400ddaf0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
mov rcx, rsi
call fcn.1400ddaf0
xor r9d, r9d
mov edx, 0x402
lea r8d, [rdx - 0x1a]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetTimer]
mov edx, 0x4f8
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x1401c5247
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, 0x49a
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [rbx + 0x10]
mov rdi, qword [0x14037cae0]
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401c5299
mov edx, SafeArrayGetDim
mov rcx, rdi
call fcn.1400dda20
test rax, rax
je 0x1401c5299
xor r8d, r8d
mov edx, esi
mov rcx, rax
call fcn.1401a1600
mov rbx, qword [rbx]
cmp rbx, qword [r12]
lea rdx, [0x140000000]
jne 0x1401c4f60
lea rax, [rbp + 0x9228]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
mov r9, r12
lea r8, [0x1401c6380]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14037c338], rax
mov rbx, qword [0x14037cae0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401c5329
mov edx, SafeArrayGetDim
mov rcx, rbx
call fcn.1400dda20
mov rdi, rax
test rax, rax
je 0x1401c5329
cmp qword [rax + 0x48], 0
je 0x1401c5329
mov rbx, qword [rax + 0x50]
mov rbx, qword [rbx]
cmp rbx, qword [rax + 0x40]
je 0x1401c5329
mov edx, dword [rbx + 0x10]
mov rcx, rax
call fcn.1401a0170
test eax, eax
je 0x1401c5329
mov qword [rdi + 0x50], rbx
mov rcx, qword [0x14037add0]
test rcx, rcx
je 0x1401c5353
mov r8d, 1
test byte [0x14037c290], r8b
mov edx, 0x40a
jne 0x1401c534e
mov edx, 0x409
call fcn.14018fcb0
mov eax, 1
add rsp, 0x92d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401c5860
mov dword [0x14037cae8], r13d
mov rax, qword [r12]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [r12]
mov qword [rax + 8], rax
mov qword [r12 + 8], r13
cmp rcx, qword [r12]
je 0x1401c53b6
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140247060
mov rcx, rbx
cmp rbx, qword [r12]
jne 0x1401c53a0
mov rcx, r12
call fcn.140009af0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, r12
call fcn.140247060
xor eax, eax
jmp 0x1401c5358
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3