Function at 0x14005dce0
Capabilities:
Delete registry value
Extract resource via kernel32 functions
Persist via run registry key

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xae0
mov qword [rsp + 0x1c8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov r15, rcx
mov qword [rsp + 0x138], rcx
mov r14d, 1
mov dword [rsp + 0x54], r14d
mov dword [rsp + 0xa4], r14d
mov dword [rsp + 0x80], r14d
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x12c], r14d
xor ebx, ebx
mov qword [rsp + 0xe8], rbx
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x128], ebx
call fcn.1400696cc
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14005dd80
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x180], rax
call fcn.140069504
mov rdi, qword [rax + 8]
mov qword [rsp + 0x168], rdi
call fcn.140015a10
mov dword [rsp + 0x114], eax
mov eax, r14d
mov dword [rsp + 0x74], eax
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0x84], eax
mov dword [rsp + 0xa8], r14d
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0x130], r14d
mov dword [0x1400e9698], ebx
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140057ec0
call fcn.140069504
mov rcx, qword [rax + 8]
call fcn.14007442c
nop
mov dword [rdi + 0xdf4], r14d
mov dword [rdi + 0x6d0], r14d
call fcn.1400696cc
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14005de2a
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x120], rsi
call fcn.1400696cc
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14005de5b
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x150], rdi
mov ecx, 3
call fcn.1400696b8
test rax, rax
je 0x14005de9a
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140003a40
mov rdi, qword [rsp + 0x150]
mov ecx, 0x20
call fcn.1400696b8
test rax, rax
je 0x14005dec7
mov r8d, 0x20
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.140003a40
mov rsi, qword [rsp + 0x120]
mov qword [rsp + 0x20], rbx
mov r9d, 0x34
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.1400518a0
mov esi, eax
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
cmp esi, 7
jne 0x14005df6f
lea rdx, [rdi - 0x18]
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14005df12
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005df37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x58]
call fcn.140018910
nop
mov rdx, qword [rsp + 0x180]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x14005fd59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005fd59
mov dword [rsp + 0x7c], ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x90], rbx
cmp dword [0x1400e9130], 0
je 0x14005dfc1
mov rdx, qword [0x1400e93d8]
lea rcx, [r15 + 0x630]
call fcn.140074a10
mov esi, 5
mov dword [rsp + 0x78], esi
mov edx, esi
lea rcx, [r15 + 0x630]
call fcn.140074a80
mov rcx, qword [r15 + 0x670]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x14005dfc9
mov dword [rsp + 0x78], 5
call fcn.1400696cc
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14005dfe8
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x140], rdi
call fcn.1400696cc
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14005e019
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea r13, [rax + 0x18]
mov qword [rsp + 0xf0], r13
call fcn.1400696cc
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14005e04a
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0xf8], rsi
call fcn.1400696cc
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14005e07b
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x148], rax
call fcn.1400696cc
mov rcx, rax
mov eax, ebx
test rcx, rcx
setne al
test eax, eax
jne 0x14005e0ac
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea r12, [rax + 0x18]
mov qword [rsp + 0xc0], r12
mov ecx, 0x3e
call fcn.1400696b8
test rax, rax
je 0x14005e0eb
mov r8d, 0x3e
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.140003a40
mov rdi, qword [rsp + 0x140]
mov ecx, 0x3f
call fcn.1400696b8
test rax, rax
je 0x14005e118
mov r8d, 0x3f
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140003a40
mov r13, qword [rsp + 0xf0]
mov ecx, 0x41
call fcn.1400696b8
test rax, rax
je 0x14005e13d
mov r8d, 0x41
mov rdx, rax
lea rcx, [rsp + 0x148]
call fcn.140003a40
mov ecx, 0x40
call fcn.1400696b8
test rax, rax
je 0x14005e16a
mov r8d, 0x40
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.140003a40
mov rsi, qword [rsp + 0xf8]
mov ecx, 0x41
call fcn.1400696b8
test rax, rax
je 0x14005e197
mov r8d, 0x41
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.140003a40
mov r12, qword [rsp + 0xc0]
cmp dword [0x1400e9130], 0
je 0x14005e1c4
lea rcx, [r15 + 0x630]
mov edx, 0x3f2
call fcn.1400748c4
mov qword [rsp + 0x90], rax
mov rdx, rdi
mov rcx, rax
call fcn.140074a10
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov rcx, qword [r15 + 0x128]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x110], eax
cmp dword [0x1400e9130], 0
je 0x14005e27c
xor r9d, r9d
mov r8, r14
mov edx, 0x402
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x98]
test ecx, ecx
jle 0x14005e253
mov eax, 0x14
cdq
idiv ecx
test eax, eax
jg 0x14005e25c
mov eax, 0x66666667
imul ecx
mov ecx, edx
sar ecx, 3
mov eax, ecx
shr eax, 0x1f
add ecx, eax
mov eax, 2
cmp ecx, 1
cmovle ecx, eax
mov dword [rsp + 0x7c], ecx
mov dword [rsp + 0x50], ecx
mov eax, r14d
jmp 0x14005e25c
mov dword [rsp + 0x50], ebx
mov eax, 0x14
movsxd r8, eax
xor r9d, r9d
mov edx, 0x404
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0x98]
test eax, eax
jle 0x14005e4a4
lea rax, [r15 + 0xe8]
nop
nop
mov edx, ebx
mov rcx, rax
call fcn.140073478
mov r14, rax
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14005e333
lea r8, [r15 + 0x630]
mov rcx, r15
call fcn.140055610
mov dword [rsp + 0x5c], eax
cmp dword [0x1400e9130], 0
je 0x14005e32e
mov ecx, dword [rsp + 0x50]
test ecx, ecx
jg 0x14005e327
xor r9d, r9d
xor r8d, r8d
mov edx, 0x408
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0x14
jge 0x14005e321
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rdi
mov rcx, qword [rsp + 0x90]
call fcn.140074a10
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
jmp 0x14005e32e
mov eax, dword [rsp + 0x5c]
jmp 0x14005e32e
sub ecx, 1
mov dword [rsp + 0x50], ecx
cmp eax, 2
je 0x14005e34f
add ebx, 1
cmp ebx, dword [rsp + 0x98]
jge 0x14005e49e
lea rax, [r15 + 0xe8]
jmp 0x14005e290
movzx eax, word [r14 + 2]
shl eax, 0x10
or eax, 1
mov dword [r14], eax
mov rcx, r15
call fcn.14004b570
nop
lea rdx, [r12 - 0x18]
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14005e388
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005e3ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005e3d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005e3f7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005e41c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x150]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005e441
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005e466
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x58]
call fcn.140018910
nop
mov rdx, qword [rsp + 0x180]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x14005fd59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005fd59
mov r14d, 1
cmp dword [0x1400e9130], 0
je 0x14005e4d6
xor r9d, r9d
mov edx, 0x402
lea r8d, [r9 + 0x14]
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r13
mov rcx, qword [rsp + 0x90]
call fcn.140074a10
xor edi, edi
mov dword [rsp + 0x118], edi
mov rcx, qword [rsp + 0x98]
mov ebx, ecx
mov dword [rsp + 0x5c], edi
mov qword [rsp + 0x1a8], rdi
cmp dword [0x1400e9130], edi
je 0x14005e570
test ecx, ecx
jle 0x14005e538
mov eax, 0x14
cdq
idiv ecx
test eax, eax
jg 0x14005e541
mov eax, 0x66666667
imul ecx
mov ecx, edx
sar ecx, 3
mov eax, ecx
shr eax, 0x1f
add ecx, eax
cmp ecx, 1
mov eax, 2
cmovle ecx, eax
mov dword [rsp + 0x7c], ecx
mov dword [rsp + 0x50], ecx
mov eax, r14d
jmp 0x14005e541
mov dword [rsp + 0x50], edi
mov eax, 0x14
movsxd r8, eax
xor r9d, r9d
mov edx, 0x404
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [r15 + 0x630]
mov qword [rsp + 0x1a8], rax
mov rcx, qword [rsp + 0x98]
mov eax, edi
mov dword [rsp + 0x68], eax
test ecx, ecx
jle 0x14005eccd
lea rcx, [r15 + 0xe8]
or r14, 0xffffffffffffffff
nop
nop
mov edx, eax
call fcn.140073478
mov rsi, rax
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x100], edi
sub ebx, 1
mov dword [rsp + 0x6c], ebx
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14005ead4
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x100]
mov r8d, dword [rax]
mov rcx, r15
call fcn.1400558e0
mov r12d, eax
test eax, eax
jne 0x14005e681
movzx eax, word [rsi + 2]
shl eax, 0x10
or eax, 0x10
mov dword [rsi], eax
mov ecx, dword [rsp + 0x64]
cmp dword [rsp + 0x100], 1
mov eax, 1
cmove ecx, eax
mov dword [rsp + 0x64], ecx
cmp dword [0x1400e9130], r12d
je 0x14005eaa5
mov ebx, dword [rsp + 0x50]
test ebx, ebx
jg 0x14005e672
xor r9d, r9d
xor r8d, r8d
mov edx, 0x408
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0x28
jge 0x14005eaa1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r13
mov rcx, qword [rsp + 0x90]
call fcn.140074a10
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x50], eax
mov ebx, dword [rsp + 0x6c]
jmp 0x14005eaa5
sub ebx, eax
mov dword [rsp + 0x50], ebx
mov ebx, dword [rsp + 0x6c]
jmp 0x14005eaa5
mov rcx, r15
call fcn.14004b570
call fcn.1400696cc
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
je 0x14005ec5c
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
call fcn.1400696cc
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
je 0x14005ec51
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xd0], rbx
call fcn.1400696cc
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
je 0x14005ec46
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0xb8], rsi
mov rcx, qword [rsp + 0xe0]
movzx eax, word [rcx + 2]
shl eax, 0x10
or eax, 1
mov dword [rcx], eax
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 4
xor r8d, r8d
mov edx, dword [rsp + 0x68]
lea rcx, [r15 + 0xe8]
call fcn.140073648
mov dword [rsp + 0x118], 1
cmp r12d, 3
jne 0x14005e7a8
lea ecx, [r12 + 8]
call fcn.1400696b8
test rax, rax
je 0x14005e787
lea r8d, [r12 + 8]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140003a40
mov rsi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xe0]
mov r8, qword [r8 + 0x10]
mov rdx, rsi
lea rcx, [rsp + 0x88]
call fcn.1400040b0
jmp 0x14005e847
cmp r12d, 4
jne 0x14005e7fb
lea ecx, [r12 + 0xc]
call fcn.1400696b8
test rax, rax
je 0x14005e7da
lea r8d, [r12 + 0xc]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140003a40
mov rsi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xe0]
mov r8, qword [r8 + 0x10]
mov r9, r8
mov rdx, rsi
lea rcx, [rsp + 0x88]
call fcn.1400040b0
jmp 0x14005e847
mov ecx, 4
call fcn.1400696b8
test rax, rax
je 0x14005e828
mov r8d, 4
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140003a40
mov rsi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xe0]
mov r8, qword [r8 + 0x10]
mov r9, r8
mov rdx, rsi
lea rcx, [rsp + 0x88]
call fcn.1400040b0
cmp dword [rsp + 0x6c], 0
jle 0x14005eb82
mov ecx, 3
call fcn.1400696b8
test rax, rax
je 0x14005e87f
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140003a40
mov rbx, qword [rsp + 0xd0]
mov ecx, 0x12
call fcn.1400696b8
test rax, rax
je 0x14005e8ac
mov r8d, 0x12
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140003a40
mov rsi, qword [rsp + 0xb8]
mov r9d, dword [rsi - 0x10]
mov dword [rsp + 0x188], r9d
mov r8, rsi
mov rdx, rsi
mov rdi, qword [rsp + 0x88]
sub rdx, rdi
sar rdx, 1
mov qword [rsp + 0x1b8], rdx
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x18c], eax
lea r12d, [rax + r9]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r12d
or eax, ecx
jge 0x14005e91f
mov edx, r12d
lea rcx, [rsp + 0x88]
call fcn.140003180
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x1b8]
mov r8, rsi
mov r9d, dword [rsp + 0x188]
mov eax, dword [rsp + 0x18c]
cmp rdx, rax
ja 0x14005e92f
lea r8, [rdi + rdx*2]
movsxd rdx, r9d
add rdx, rdx
lea rcx, [rdi + rax*2]
mov r9, rdx
call fcn.140080540
test r12d, r12d
js 0x14005eb77
cmp r12d, dword [rdi - 0xc]
jg 0x14005eb77
mov dword [rdi - 0x10], r12d
movsxd rax, r12d
mov word [rdi + rax*2], 0
lea rax, [r15 + 0x630]
mov qword [rsp + 0x20], rax
mov r9d, 0x34
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.1400518a0
cmp eax, 7
je 0x14005eaf8
cmp dword [0x1400e9130], 0
je 0x14005ea0b
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, rax
call fcn.14006e388
mov ebx, dword [rsp + 0x50]
test ebx, ebx
jg 0x14005ea04
xor r9d, r9d
xor r8d, r8d
mov edx, 0x408
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0x28
jge 0x14005ea0b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r13
mov rcx, qword [rsp + 0x90]
call fcn.140074a10
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x50], eax
jmp 0x14005ea0b
sub ebx, 1
mov dword [rsp + 0x50], ebx
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005ea28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005ea4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005ea89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r13, qword [rsp + 0xf0]
xor edi, edi
mov rsi, qword [rsp + 0xe0]
mov ebx, dword [rsp + 0x6c]
jmp 0x14005eaa5
mov r13, qword [rsp + 0xf0]
xor edi, edi
mov rsi, qword [rsp + 0xe0]
mov ebx, dword [rsp + 0x6c]
jmp 0x14005eaa5
mov ebx, dword [rsp + 0x6c]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 4
xor r8d, r8d
mov edx, dword [rsp + 0x68]
lea rcx, [r15 + 0xe8]
call fcn.140073648
mov eax, dword [rsp + 0x68]
add eax, 1
mov dword [rsp + 0x68], eax
cmp eax, dword [rsp + 0x98]
jge 0x14005ec67
lea rcx, [r15 + 0xe8]
jmp 0x14005e590
mov ebx, 1
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005eb1a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005eb3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005eb6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edi, edi
mov r12d, edi
jmp 0x14005ec74
xor edi, edi
mov r12d, edi
jmp 0x14005ec74
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 3
call fcn.1400696b8
test rax, rax
je 0x14005ebaf
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140003a40
mov rbx, qword [rsp + 0xd0]
lea rax, [r15 + 0x630]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
mov r8, rbx
mov rdx, qword [rsp + 0x88]
mov rcx, r15
call fcn.1400518a0
mov r12d, 1
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005ebf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005ec1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005ec70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [rsp + 0x5c]
jmp 0x14005ec74
mov ecx, 0x80004005
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
int3
mov ebx, dword [rsp + 0x5c]
mov r12d, ebx
jmp 0x14005ec74
mov ebx, dword [rsp + 0x5c]
mov eax, dword [rsp + 0x64]
cmp eax, 1
jne 0x14005eca1
lea rcx, [rsp + 0x270]
call fcn.140022c30
cmp eax, 1
jne 0x14005eca1
xor r8d, r8d
mov edx, eax
lea rcx, [rsp + 0x270]
call fcn.140022810
test ebx, ebx
jne 0x14005ecbc
test r12d, r12d
jne 0x14005ecbc
mov rsi, qword [rsp + 0xf8]
mov r12, qword [rsp + 0xc0]
jmp 0x14005ecd1
mov edi, dword [rsp + 0xa0]
mov r13d, dword [rsp + 0x54]
jmp 0x14005f244
or r14, 0xffffffffffffffff
cmp dword [0x1400e9130], 0
je 0x14005ed21
xor r9d, r9d
mov edx, 0x402
lea r8d, [r9 + 0x28]
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rbx, qword [rsp + 0x90]
mov rcx, rbx
call fcn.140074a10
xor r9d, r9d
mov edx, 0x404
lea r8d, [r9 + 0x14]
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14005ed29
mov rbx, qword [rsp + 0x90]
mov rcx, r15
call fcn.14004fe60
mov dword [rsp + 0xa4], eax
mov dword [rsp + 0x70], eax
cmp dword [0x1400e9130], 0
je 0x14005ed68
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rsi
mov rcx, rbx
call fcn.140074a10
call fcn.140025210
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0x68], eax
lea rdx, [r15 + 0x630]
mov rcx, r15
call fcn.14005bf00
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x5c], eax
cmp dword [0x1400e9130], 0
je 0x14005edd5
xor r9d, r9d
mov edx, 0x402
lea r8d, [r9 + 0x50]
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r12
mov rcx, rbx
call fcn.140074a10
xor r9d, r9d
mov edx, 0x404
lea r8d, [r9 + 4]
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rsp + 0x114], 3
jne 0x14005edeb
lea rcx, str.Enum
call fcn.14001ffd0
cmp dword [0x1400e9130], 0
je 0x14005ee43
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r12
mov rcx, rbx
call fcn.140074a10
cmp dword [0x1400e9130], 0
je 0x14005ee43
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r12
mov rcx, rbx
call fcn.140074a10
call fcn.1400696cc
mov rdx, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x14005ee62
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x108], rbx
mov r13, qword [rsp + 0x168]
mov rdx, qword [r13 + 0x610]
lea rdi, [rdx - 0x18]
lea rsi, [rbx - 0x18]
cmp rdi, rsi
je 0x14005ef54
cmp dword [rsi + 0x10], 0
jl 0x14005ef3b
mov rcx, qword [rdi]
cmp rcx, qword [rsi]
jne 0x14005ef3b
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi + 0x10], 0
jl 0x14005eecb
cmp rax, qword [rdi]
jne 0x14005eecb
mov rbx, rdi
lock add dword [rdi + 0x10], 1
jmp 0x14005ef0a
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x14005eee7
call fcn.1400019f0
int3
mov eax, dword [rdi + 8]
mov dword [rbx + 8], eax
mov eax, dword [rdi + 8]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
lea r8, [rdi + 0x18]
add rdx, rdx
lea rcx, [rbx + 0x18]
call fcn.140080540
mov eax, r14d
lock xadd dword [rsi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005ef25
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 0x18
mov qword [rsp + 0x108], rbx
mov r12, qword [rsp + 0xc0]
jmp 0x14005ef54
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x108]
call fcn.140003c40
mov rbx, qword [rsp + 0x108]
xor eax, eax
lea rdi, [0x1400a9728]
mov rsi, rbx
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14005ef6f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x14005f02c
call fcn.14001b9c0
mov edi, eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x64], eax
call fcn.14001dd40
test edi, edi
je 0x14005f03c
test eax, eax
je 0x14005f03c
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x1f0]
call fcn.140080d50
mov rdx, qword [r13 + 0x5b8]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x158]
mov qword [rsp + 0x20], rdx
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005f03c
lea rdx, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
mov qword [rsp + 0x158], r13
jmp 0x14005f03c
mov eax, 1
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x64], eax
cmp dword [0x1400e9130], 0
je 0x14005f06d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r12
mov rcx, qword [rsp + 0x90]
call fcn.140074a10
mov r13d, dword [rsp + 0x54]
test r13d, r13d
je 0x14005f1c0
cmp dword [rsp + 0x114], 0xa
je 0x14005f093
call fcn.140032b40
mov dword [rsp + 0x12c], eax
jmp 0x14005f0a5
xor ecx, ecx
call fcn.140036ca0
mov dword [rsp + 0x74], eax
mov dword [rsp + 0xd8], eax
mov edi, 1
mov esi, dword [rsp + 0x74]
jmp 0x14005f1c7
mov edi, 1
mov esi, edi
cmp dword [0x1400e9130], 0
je 0x14005f1f8
xor r9d, r9d
xor r8d, r8d
mov edx, 0x405
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, r12
mov rcx, qword [rsp + 0x90]
call fcn.140074a10
lea rdx, [r15 + 0x630]
mov rcx, r15
call fcn.14004b590
mov dword [rsp + 0x128], eax
lea rdx, [rbx - 0x18]
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14005f22a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r13d, r13d
je 0x14005f244
test esi, esi
je 0x14005f244
cmp dword [rsp + 0x130], 0
je 0x14005f244
mov edi, dword [rsp + 0xa0]
lea rbx, [r15 + 0x630]
mov r9d, 0x50
mov r8, qword [rsp + 0x148]
lea edx, [r9 - 0x4b]
mov rcx, rbx
call fcn.140023f30
test r13d, r13d
je 0x14005f296
mov r8d, edi
mov rdx, rbx
mov rcx, r15
call fcn.1400561d0
mov ecx, dword [rsp + 0x84]
test eax, eax
mov r13, qword [rsp + 0xe8]
cmove ecx, r13d
mov dword [rsp + 0x84], ecx
jmp 0x14005f29e
mov r13, qword [rsp + 0xe8]
cmp dword [0x1400e9130], 0
je 0x14005f2d5
xor r9d, r9d
mov edx, 0x402
lea r8d, [r9 + 0x64]
mov rcx, qword [r15 + 0x758]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x90]
call fcn.140074a10
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x14005f96a
cmp dword [rsp + 0x74], 1
jne 0x14005f30d
call fcn.14002bb20
test eax, eax
jne 0x14005f956
test edi, edi
jne 0x14005f960
call fcn.14001ff90
mov ecx, eax
mov eax, dword [rsp + 0x54]
jmp 0x14005f96e
call fcn.1400696cc
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14005f32d
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xb0], rbx
lea rdx, [0x1400a4510]
mov r12, rdx
shr r12, 0x10
mov qword [rsp + 0x168], r12
jne 0x14005f38d
movzx edi, dx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14005f49e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140003a40
mov rbx, qword [rsp + 0xb0]
jmp 0x14005f49e
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14005f409
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14005f49e
cmp dword [rdx + 0x10], eax
jge 0x14005f3d7
cmp dword [rbx - 0xc], eax
jge 0x14005f3cb
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r13d
mov word [rbx], ax
jmp 0x14005f49e
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005f3ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xb0], rbx
jmp 0x14005f49e
mov esi, dword [rbx - 0x10]
mov r12, rdx
sub r12, rbx
sar r12, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14005f444
mov edx, edi
lea rcx, [rsp + 0xb0]
call fcn.140003180
mov rbx, qword [rsp + 0xb0]
lea rdx, [0x1400a4510]
cmp r12, rsi
ja 0x14005f464
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140081c40
jmp 0x14005f47c
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
mov r8, rdx
mov rdx, rsi
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x14005f94b
cmp edi, dword [rbx - 0xc]
jg 0x14005f94b
mov dword [rbx - 0x10], edi
mov word [rbx + rsi], 0
mov r12, qword [rsp + 0x168]
call fcn.1400696cc
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14005f4be
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0xc8], rsi
test r12, r12
jne 0x14005f512
lea rax, [0x1400a4510]
movzx edi, ax
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14005f62c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.140003a40
mov rsi, qword [rsp + 0xc8]
jmp 0x14005f62c
xor eax, eax
mov rcx, r14
lea rdx, [0x1400a4510]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14005f59d
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14005f62c
cmp dword [rdx + 0x10], eax
jge 0x14005f563
cmp dword [rsi - 0xc], eax
jge 0x14005f557
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rsi - 0x10], r13d
mov word [rsi], ax
jmp 0x14005f62c
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005f57b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0xc8], rsi
mov rbx, qword [rsp + 0xb0]
jmp 0x14005f62c
mov r12d, dword [rsi - 0x10]
mov r13, rdx
sub r13, rsi
sar r13, 1
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x14005f5d9
mov edx, edi
lea rcx, [rsp + 0xc8]
call fcn.140003180
mov rsi, qword [rsp + 0xc8]
lea rdx, [0x1400a4510]
cmp r13, r12
ja 0x14005f5f9
movsxd rax, edi
lea r12, [rax + rax]
lea r8, [rsi + r13*2]
mov r9, r12
mov rdx, r12
mov rcx, rsi
call fcn.140081c40
jmp 0x14005f611
movsxd rax, edi
lea r12, [rax + rax]
mov r9, r12
mov r8, rdx
mov rdx, r12
mov rcx, rsi
call fcn.140080540
test edi, edi
js 0x14005f940
cmp edi, dword [rsi - 0xc]
jg 0x14005f940
mov dword [rsi - 0x10], edi
mov word [rsi + r12], 0
mov ecx, 3
call fcn.1400696b8
mov r12, rax
test rax, rax
je 0x14005f776
mov edx, 1
lea r8d, [rdx + 5]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x14005f776
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005f776
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14005f776
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
add rdx, rdi
mov ecx, 3
cmp rdi, rdx
jae 0x14005f776
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
add ecx, 0xffffffff
jne 0x14005f6a0
cmp rdi, rdx
jae 0x14005f776
movzx eax, word [rdi]
test ax, ax
je 0x14005f776
movzx r12d, ax
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, r12d
or eax, ecx
jge 0x14005f6f9
mov edx, r12d
lea rcx, [rsp + 0xc8]
call fcn.140003180
mov rsi, qword [rsp + 0xc8]
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x14005f715
xor eax, eax
mov rcx, r14
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
lea rdi, [r12 + r12]
movsxd r9, ecx
add r9, r9
mov rdx, rdi
mov rcx, rsi
call fcn.140080540
test eax, eax
je 0x14005f754
cmp eax, 0xc
je 0x14005f74e
cmp eax, 0x16
je 0x14005f748
cmp eax, 0x22
je 0x14005f748
cmp eax, 0x50
je 0x14005f754
call fcn.14006766c
int3
call fcn.14006766c
int3
call fcn.140067624
int3
test r12d, r12d
js 0x14005f76b
cmp r12d, dword [rsi - 0xc]
jg 0x14005f76b
mov dword [rsi - 0x10], r12d
mov word [rdi + rsi], 0
jmp 0x14005f776
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x55
call fcn.1400696b8
mov r12, rax
test rax, rax
je 0x14005f8bc
mov edx, 6
mov r8, rdx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r13, rax
test rax, rax
je 0x14005f8bc
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005f8bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x14005f8bc
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rdi
cmp rdi, rcx
jae 0x14005f8bc
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
add dword [rsp + 0x78], 0xffffffff
jne 0x14005f7e4
cmp rdi, rcx
jae 0x14005f8bc
movzx eax, word [rdi]
test ax, ax
je 0x14005f8bc
movzx r12d, ax
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r12d
or eax, ecx
jge 0x14005f83f
mov edx, r12d
lea rcx, [rsp + 0xb0]
call fcn.140003180
mov rbx, qword [rsp + 0xb0]
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x14005f85b
xor eax, eax
mov rcx, r14
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
lea rdi, [r12 + r12]
movsxd r9, ecx
add r9, r9
mov rdx, rdi
mov rcx, rbx
call fcn.140080540
test eax, eax
je 0x14005f89a
cmp eax, 0xc
je 0x14005f894
cmp eax, 0x16
je 0x14005f88e
cmp eax, 0x22
je 0x14005f88e
cmp eax, 0x50
je 0x14005f89a
call fcn.14006766c
int3
call fcn.14006766c
int3
call fcn.140067624
int3
test r12d, r12d
js 0x14005f8b1
cmp r12d, dword [rbx - 0xc]
jg 0x14005f8b1
mov dword [rbx - 0x10], r12d
mov word [rdi + rbx], 0
jmp 0x14005f8bc
mov ecx, 0x80070057
call fcn.140001000
int3
lea rax, [r15 + 0x630]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
mov r8, rsi
mov rdx, rbx
mov rcx, r15
call fcn.1400518a0
nop
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005f8fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005f92f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rbx, [r15 + 0x630]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
jmp 0x14005f96e
lea rbx, [r15 + 0x630]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
jmp 0x14005f96e
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80070057
call fcn.140001000
nop
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
jmp 0x14005f96e
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
jmp 0x14005f96e
mov ecx, dword [rsp + 0x60]
cmp dword [rsp + 0x118], 1
je 0x14005f9c0
cmp dword [rsp + 0xa4], 0
je 0x14005f9c0
test eax, eax
je 0x14005f9c0
cmp dword [rsp + 0x80], 0
je 0x14005f9c0
test ecx, ecx
je 0x14005f9c0
cmp dword [rsp + 0x12c], 0
je 0x14005f9c0
cmp dword [rsp + 0x128], 0
je 0x14005f9c0
cmp dword [rsp + 0x84], 0
je 0x14005f9c0
cmp dword [rsp + 0xa8], 0
jne 0x14005faf1
call fcn.1400696cc
mov rdx, rax
mov r13, qword [rsp + 0xe8]
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14005f9e8
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x170], rsi
call fcn.1400696cc
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14005fa1d
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x190], rdi
mov ecx, 0x21
call fcn.1400696b8
test rax, rax
je 0x14005fa5f
mov r8d, 0x21
mov rdx, rax
lea rcx, [rsp + 0x170]
call fcn.140003a40
mov rsi, qword [rsp + 0x170]
mov ecx, 3
call fcn.1400696b8
test rax, rax
je 0x14005fa8c
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x190]
call fcn.140003a40
mov rdi, qword [rsp + 0x190]
mov qword [rsp + 0x20], rbx
mov r9d, 0x30
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.1400518a0
mov rcx, r15
call fcn.14004b570
nop
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005facb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x170]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005faf9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005faf9
mov r13, qword [rsp + 0xe8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xb]
mov rcx, qword [r15 + 0x128]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, r13d
mov rbx, qword [rsp + 0x98]
test ebx, ebx
jle 0x14005fb61
nop
mov edx, edi
lea rcx, [r15 + 0xe8]
call fcn.140073478
cmp word [rax], 0x10
jne 0x14005fb5a
mov rcx, rax
call fcn.140067524
movsxd r8, edi
xor r9d, r9d
mov edx, 0x1008
mov rcx, qword [r15 + 0x128]
call qword [sym.imp.USER32.dll_SendMessageW]
sub edi, 1
sub ebx, 1
add edi, 1
cmp edi, ebx
jl 0x14005fb20
xor r9d, r9d
mov esi, 1
mov r8, rsi
lea edx, [rsi + 0xa]
mov rcx, qword [r15 + 0x128]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r15
call fcn.14004b530
test eax, eax
je 0x14005fc21
call fcn.1400696cc
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14005fbac
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x1b0], rdi
mov ecx, 0x38
call fcn.1400696b8
test rax, rax
je 0x14005fbee
mov r8d, 0x38
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140003a40
mov rdi, qword [rsp + 0x1b0]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call fcn.1400518a0
nop
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005fc21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [0x1400e9698], esi
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005fc4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005fc71
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005fc96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005fcbb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005fce0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x150]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005fd05
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14005fd2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x58]
call fcn.140018910
nop
mov rdx, qword [rsp + 0x180]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x14005fd59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0xae0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret