Function at 0x140047490
Capabilities:
Set current directory

Disassembly:
mov rax, rsp
mov byte [rax + 0x10], dl
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4c0
mov qword [rax - 0x460], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401d4618]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
cmp byte [rcx], r12b
jne 0x140047bfa
test r8b, r8b
je 0x140047525
call fcn.140041eb8
lea rdx, [rsp + 0xa8]
mov rcx, rax
call fcn.1400201d4
nop
mov dword [rsp + 0x40], 1
lea rdx, [rsp + 0x98]
mov rcx, qword [rax]
call fcn.14001ffc0
nop
mov dword [rsp + 0x40], 3
mov rcx, qword [rax]
call fcn.140041ec0
test al, al
mov r14b, r12b
jne 0x140047528
mov r14b, 1
mov ecx, dword [rsp + 0x40]
test cl, 2
je 0x140047570
and dword [rsp + 0x40], 0xfffffffd
mov rdi, qword [rsp + 0xa0]
test rdi, rdi
je 0x140047570
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdi + 8], eax
add eax, ebx
jne 0x140047574
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x140047574
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140047574
or rbx, 0xffffffffffffffff
mov ecx, dword [rsp + 0x40]
test cl, 1
je 0x1400475b6
and dword [rsp + 0x40], 0xfffffffe
mov rdi, qword [rsp + 0xb0]
test rdi, rdi
je 0x1400475b6
mov eax, ebx
lock xadd dword [rdi + 8], eax
add eax, ebx
jne 0x1400475b6
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x1400475b6
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, reloc.Cabinet.dll_FCIDestroy
test r14b, r14b
je 0x140047be0
lea r9, str.Orchestration::Initialize___Initializing_Orchestration
mov ecx, 0x34d4db
lea r8d, [rdx + 0x24]
call sub.Mso20Win32Client.dll_Ordinal_489
call fcn.140041eb8
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.1400201d4
nop
lea rdx, [rsp + 0xb8]
mov rcx, qword [rax]
call fcn.14001ffc0
nop
mov rcx, qword [rax]
call fcn.140041ec0
mov r14b, al
mov rdi, qword [rsp + 0xc0]
test rdi, rdi
je 0x140047640
mov edx, ebx
lock xadd dword [rdi + 8], edx
add edx, ebx
jne 0x140047640
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x140047640
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdi, qword [rsp + 0xd0]
test rdi, rdi
je 0x140047674
mov eax, ebx
lock xadd dword [rdi + 8], eax
add eax, ebx
jne 0x140047674
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x140047674
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14b, r14b
je 0x140047682
lea rcx, [rsi + 0x28]
call fcn.14011ba44
call fcn.140041eb8
lea rdx, [rsp + 0xd8]
mov rcx, rax
call fcn.14001627c
nop
lea rdx, [rsp + 0x1e8]
mov rcx, qword [rax]
call fcn.1400f5250
cmp qword [rax + 0x18], 8
jb 0x1400476b2
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x1e8]
call fcn.14000867c
nop
mov rdi, qword [rsp + 0xe0]
test rdi, rdi
je 0x140047702
mov eax, ebx
lock xadd dword [rdi + 8], eax
add eax, ebx
jne 0x140047702
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x140047702
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov r15d, eax
test eax, eax
jne 0x14004795b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
lea r8, [rsp + 0x48]
lea rdx, str.Failed_to_acquire_Crypto_context._Last_error:__d
lea rcx, [rsp + 0x208]
call fcn.1400a2f5c
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x14004775f
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x4c], eax
mov eax, 7
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x198], r12
mov word [rsp + 0x188], r12w
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x178], r12
mov word [rsp + 0x168], r12w
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x158], r12
mov word [rsp + 0x148], r12w
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x138], r12
mov word [rsp + 0x128], r12w
lea rax, [rsp + 0x188]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x148]
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x300]
call fcn.1400354c0
mov r14, rax
lea rcx, [rsp + 0x270]
call fcn.1400f27cc
lea rcx, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov qword [rsp + 0x58], rcx
lea rcx, str.ContextData
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea r9, str.Orchestration::Initialize
mov edx, 0x3ae
mov ecx, 0x645102
mov r8d, 0xa
call fcn.14000ba08
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x2e0]
call fcn.14000867c
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x2c0]
call fcn.14000867c
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x298]
call fcn.14000867c
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x278]
call fcn.14000867c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x370]
call fcn.14000867c
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x350]
call fcn.14000867c
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x330]
call fcn.14000867c
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x310]
call fcn.14000867c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x128]
call fcn.14000867c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x148]
call fcn.14000867c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x168]
call fcn.14000867c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x188]
call fcn.14000867c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x208]
call fcn.14000867c
call fcn.140041eb8
lea rdx, [rsp + 0xe8]
mov rcx, rax
call fcn.14001627c
nop
lea rdx, [rsp + 0x228]
mov rcx, qword [rax]
call fcn.1400f5350
nop
lea r14, [rsi + 0x28]
mov rdx, rax
mov rcx, r14
call fcn.14011c984
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x228]
call fcn.14000867c
nop
mov rdi, qword [rsp + 0xf0]
test rdi, rdi
je 0x1400479d9
mov eax, ebx
lock xadd dword [rdi + 8], eax
add eax, ebx
jne 0x1400479d9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x1400479d9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r15d, r15d
je 0x1400479eb
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, [rsi + 8]
mov rcx, r14
call fcn.14011e280
call fcn.140098438
test al, al
jne 0x140047aa8
call fcn.140041eb8
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.1400201d4
nop
or dword [rsp + 0x40], 4
lea rdx, [rsp + 0x108]
mov rcx, qword [rax]
call fcn.14001ffc0
nop
or dword [rsp + 0x40], 8
mov rcx, qword [rax]
call fcn.140041ec0
test al, al
jne 0x140047aa8
call fcn.140041eb8
lea rdx, [rsp + 0xf8]
mov rcx, rax
call fcn.14001627c
nop
or dword [rsp + 0x40], 0x10
lea rdx, [rsp + 0x248]
mov rcx, qword [rax]
call fcn.1400f5410
nop
or dword [rsp + 0x40], 0x20
lea rdx, [0x14025d150]
cmp qword [0x14025d168], 8
cmovae rdx, qword [0x14025d150]
cmp qword [rax + 0x18], 8
jb 0x140047a93
mov rax, qword [rax]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
call fcn.1400076bc
test eax, eax
mov r14b, 1
je 0x140047aab
mov r14b, r12b
mov ecx, dword [rsp + 0x40]
test cl, 0x20
je 0x140047ad0
and dword [rsp + 0x40], 0xffffffdf
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x248]
call fcn.14000867c
nop
nop dword [rax]
mov ecx, dword [rsp + 0x40]
test cl, 0x10
je 0x140047b13
and dword [rsp + 0x40], 0xffffffef
mov rdi, qword [rsp + 0x100]
test rdi, rdi
je 0x140047b13
mov eax, ebx
lock xadd dword [rdi + 8], eax
add eax, ebx
jne 0x140047b13
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x140047b13
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov ecx, dword [rsp + 0x40]
test cl, 8
je 0x140047b56
and dword [rsp + 0x40], 0xfffffff7
mov rdi, qword [rsp + 0x110]
test rdi, rdi
je 0x140047b56
mov eax, ebx
lock xadd dword [rdi + 8], eax
add eax, ebx
jne 0x140047b56
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x140047b56
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
test byte [rsp + 0x40], 4
je 0x140047b91
mov rdi, qword [rsp + 0x120]
test rdi, rdi
je 0x140047b91
mov eax, ebx
lock xadd dword [rdi + 8], eax
add eax, ebx
jne 0x140047b91
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, ebx
lock xadd dword [rdi + 0xc], eax
add eax, ebx
jne 0x140047b91
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14b, r14b
je 0x140047bca
lea rcx, [rsp + 0x44]
call fcn.14009756c
test al, al
je 0x140047bca
lea r9, str.Orchestration::Initialize___Initializing_RSOD_during_Orchestration
mov edx, reloc.Cabinet.dll_FCIDestroy
mov ecx, 0x45025d
lea r8d, [rdx + 1]
call sub.Mso20Win32Client.dll_Ordinal_489
xor edx, edx
lea rcx, [rsp + 0x44]
call fcn.140098260
mov byte [rsi], 1
lea r9, str.Orchestration::Initialize___Done_Initializing_Orchestration
mov edx, reloc.Cabinet.dll_FCIDestroy
mov ecx, 0x34d4dc
jmp 0x140047bec
lea r9, str.Orchestration::Initialize___Skipping_Orchestration_because_no_Active_Config
mov ecx, 0x60a4d8
mov r8d, 0x64
call sub.Mso20Win32Client.dll_Ordinal_489
nop
jmp 0x140047c14
lea r9, str.Orchestration::Initialize___Orchestration_has_already_been_initialized.
mov edx, reloc.Cabinet.dll_FCIDestroy
mov ecx, 0x35410c
lea r8d, [rdx + 0x56]
call sub.Mso20Win32Client.dll_Ordinal_489
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.140121d80
mov rbx, qword [rsp + 0x500]
add rsp, 0x4c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret