Function at 0x1400858b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x740]
sub rsp, 0x840
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rbp + 0x730], rax
mov edi, ecx
xor r14d, r14d
test ecx, ecx
jne 0x1400858f5
mov dword [0x140173e2c], r14d
mov qword [rsp + 0x20], r14
lea rcx, [rsp + 0x20]
call fcn.1400055e0
nop
mov rax, qword [rsp + 0x20]
lea rdx, [rax - 0x18]
mov rsi, qword [rdx]
mov rbx, 0xffffffffffffffff
cmp dword [rdx + 8], 0
je 0x140085964
cmp dword [rdx + 0x10], 0
jge 0x14008593d
cmp dword [rax - 0xc], 0
jl 0x140085cf2
mov dword [rax - 0x10], r14d
mov rax, qword [rsp + 0x20]
mov word [rax], r14w
jmp 0x140085964
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085952
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov edx, r14d
mov rax, qword [0x14017c768]
mov r8, qword [0x14017c778]
cmp dword [rax], edx
je 0x140085999
mov rcx, r8
nop dword [rax]
cmp qword [rcx], 0
je 0x140085999
cmp dword [rax], edi
je 0x1400859a6
inc edx
add rcx, 8
add rax, 4
cmp dword [rax], 0
jne 0x140085980
mov rdx, qword [r8]
test rdx, rdx
jne 0x1400859cd
mov r8d, r14d
jmp 0x1400859db
movsxd rax, edx
mov rdx, qword [r8 + rax*8]
test rdx, rdx
jne 0x1400859b7
mov r8d, r14d
jmp 0x1400859db
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400859c0
jmp 0x1400859db
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400859d0
lea rcx, [rsp + 0x20]
call fcn.140005a90
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.1400055e0
nop
mov rdx, qword [rsp + 0x20]
lea rcx, [rdx - 0x18]
mov rdi, qword [0x14017c780]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140085a5a
cmp dword [rdi + 0x10], 0
jl 0x140085a4a
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140085a4a
call fcn.140041570
mov rsi, rax
mov ecx, ebx
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x140085a3d
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [0x14017c780], rax
jmp 0x140085a5a
mov r8d, dword [rdx - 0x10]
lea rcx, [0x14017c780]
call fcn.140005a90
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x30]
call fcn.14012ce40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x3ff
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140085ac3
lea rcx, [rsp + 0x30]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x140085a94
dec eax
movsxd rcx, eax
test eax, eax
jle 0x140085ac3
cmp word [rsp + rcx*2 + 0x30], 0x5c
je 0x140085abb
dec eax
dec rcx
test rcx, rcx
jg 0x140085aa7
jmp 0x140085ac3
cdqe
mov word [rsp + rax*2 + 0x30], r14w
cmp dword [0x140173e2c], 0
jne 0x140085af7
mov rdx, qword [str.pl_rsrc_english.dll]
test rdx, rdx
jne 0x140085add
mov r8d, r14d
jmp 0x140085aeb
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x140085ae0
lea rcx, [0x14017c780]
call fcn.140005a90
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14017ae30], rax
test rax, rax
jne 0x140085c48
mov rdx, qword [str.pl_rsrc_english.dll]
test rdx, rdx
jne 0x140085b23
mov r8d, r14d
jmp 0x140085b3b
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140085b30
lea rcx, [0x14017c780]
call fcn.140005a90
mov word [rsp + 0x30], r14w
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x3ff
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140085bd6
lea rcx, [rsp + 0x30]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x140085b75
dec eax
movsxd rcx, eax
test eax, eax
jle 0x140085ba4
cmp word [rsp + rcx*2 + 0x30], 0x5c
je 0x140085b9c
dec eax
dec rcx
test rcx, rcx
jg 0x140085b88
jmp 0x140085ba4
cdqe
mov word [rsp + rax*2 + 0x30], r14w
mov r9, rbx
lea r8, [0x1401490d0]
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.1401163b0
mov r9, rbx
mov r8, qword [0x14017c780]
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.1401163b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14017ae30], rax
test rax, rax
jne 0x140085c8b
mov rdx, qword [str.pl_rsrc_english.dll]
lea rcx, [0x14017c780]
call fcn.140005550
lea rcx, [0x14017c780]
call fcn.140005690
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14017ae30], rax
mov r9d, InitCommonControls
lea r8, str.Process_Lasso
lea rdx, str.There_was_an_error_loading_the_resource_DLL_pl_rsrc_english.dll_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x800
call fcn.1400ff0c4
mov rdi, rax
mov r8, qword [rsp + 0x20]
mov edx, 0x400
mov rcx, rax
call fcn.140114274
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x140085c70
mov rdx, rdi
lea rcx, [0x14017c780]
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140085caa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140085cc6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x730]
xor rcx, rsp
call fcn.1400ff350
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002b00
int3