Function at 0x1400507f0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc8]
sub rsp, 0x1c8
mov qword [rbp + 0xb0], 0xfffffffffffffffe
mov r14, rdx
xor edi, edi
mov dword [rbp + 0x58], edi
mov eax, dword [0x14012b660]
test al, 1
jne 0x1400508a4
or eax, 1
mov dword [0x14012b660], eax
lea ecx, [rdi + 0x18]
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005087d
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x1400d22d0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140050880
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [0x14012b658], rbx
test rbx, rbx
jne 0x140050897
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
lea rcx, [0x1400cf210]
call fcn.1400a8ffc
nop
mov qword [rbp + 0x128], rdi
mov rax, qword [r14 + 0x338]
lea r15, [0x140126af0]
test rax, rax
je 0x1400509cb
cmp word [rax], 0
je 0x1400509cb
mov rax, rdi
movsxd rcx, dword [0x140126e7c]
test rcx, rcx
jle 0x1400508f7
nop dword [rax + rax]
cmp dword [r15 + rax*4 + 0x450], 0x26
je 0x1400509cb
inc rax
cmp rax, rcx
jl 0x1400508e0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050928
lea r8, [0x14012b658]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x14005092b
mov rbx, rdi
test rbx, rbx
jne 0x14005093b
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x14005094c
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rdx, qword [r14 + 0x338]
lea rcx, [rbp - 8]
call fcn.140003fe0
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050992
lea r8, [rbp - 8]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140050995
mov rbx, rdi
test rbx, rbx
jne 0x1400509a5
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400509b6
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400509cb
call fcn.140009910
mov rax, qword [r14 + 0x340]
test rax, rax
je 0x140050ae2
cmp word [rax], 0
je 0x140050ae2
mov rax, rdi
movsxd rcx, dword [0x140126e7c]
test rcx, rcx
jle 0x140050a0e
cmp dword [r15 + rax*4 + 0x450], 0x409
je 0x140050ae2
inc rax
cmp rax, rcx
jl 0x1400509f4
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050a3f
lea r8, [0x14012b658]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140050a42
mov rbx, rdi
test rbx, rbx
jne 0x140050a52
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050a63
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rdx, qword [r14 + 0x340]
lea rcx, [rbp]
call fcn.140003fe0
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050aa9
lea r8, [rbp]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140050aac
mov rbx, rdi
test rbx, rbx
jne 0x140050abc
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050acd
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rcx, qword [rbp]
test rcx, rcx
je 0x140050ae2
call fcn.140009910
mov rax, qword [r14 + 0x358]
test rax, rax
je 0x140050f55
cmp word [rax], 0
je 0x140050f55
mov rax, rdi
movsxd rcx, dword [0x140126e7c]
test rcx, rcx
jle 0x140050b2a
nop dword [rax + rax]
cmp dword [r15 + rax*4 + 0x450], 0x408
je 0x140050f55
inc rax
cmp rax, rcx
jl 0x140050b10
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050b5b
lea r8, [0x14012b658]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140050b5e
mov rbx, rdi
test rbx, rbx
jne 0x140050b6e
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050b7f
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050bca
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.Command_Line:_n
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140050bcd
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x48], rbx
test rbx, rbx
jne 0x140050be1
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050c0f
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140050c12
mov rsi, rdi
test rsi, rsi
jne 0x140050c22
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050c33
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov rcx, qword [r14 + 0x358]
call fcn.1400a8238
mov r15, rax
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140050c55
cmp rcx, 0x64
jbe 0x140050ecd
mov r12d, edi
mov rsi, rax
lea r14, [rax + 0xc8]
nop word [rax + rax]
movzx r13d, word [r14]
mov word [r14], di
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050cc8
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140050ccb
test rsi, rsi
jne 0x140050e0a
jmp 0x140050ccb
mov rbx, rdi
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x140050ec2
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050d06
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140050d09
mov rsi, rdi
test rsi, rsi
je 0x140050eb7
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050d23
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050d71
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str._n
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140050e15
jmp 0x140050d74
mov rbx, rdi
mov qword [rbp + 0x20], rbx
test rbx, rbx
je 0x140050eac
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050daf
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140050db2
mov rsi, rdi
test rsi, rsi
je 0x140050ea1
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050dcc
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov word [r14], r13w
add r12d, 0x64
add r14, 0xc8
movsxd rax, r12d
lea rsi, [r15 + rax*2]
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], 0
jne 0x140050df5
cmp rax, 0x64
jbe 0x140050e20
jmp 0x140050c80
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
movsxd rax, r12d
lea rdx, [r15 + rax*2]
lea rcx, [rbp - 0x70]
call fcn.140003fe0
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050e5f
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140050e62
mov rbx, rdi
test rbx, rbx
jne 0x140050e72
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050e83
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140050f47
call fcn.140009910
jmp 0x140050f47
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rdx, qword [r14 + 0x358]
lea rcx, [rbp - 0x30]
call fcn.140003fe0
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050f0c
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140050f0f
mov rbx, rdi
test rbx, rbx
jne 0x140050f1f
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050f30
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140050f4e
call fcn.140009910
jmp 0x140050f4e
mov r14, qword [rbp + 0x118]
lea r15, [0x140126af0]
mov rax, qword [r14 + 0x348]
test rax, rax
je 0x140051130
cmp word [rax], 0
je 0x140051130
mov rax, rdi
movsxd rcx, dword [0x140126e7c]
test rcx, rcx
jle 0x140050f9a
nop
cmp dword [r15 + rax*4 + 0x450], 0x425
je 0x140051130
inc rax
cmp rax, rcx
jl 0x140050f80
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140050fcb
lea r8, [0x14012b658]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140050fce
mov rbx, rdi
test rbx, rbx
jne 0x140050fde
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140050fef
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005103a
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.Path:_n
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14005103d
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x98], rbx
test rbx, rbx
jne 0x140051054
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051085
lea r8, [rbp + 0x98]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140051088
mov rsi, rdi
test rsi, rsi
jne 0x140051098
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400510a9
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov rdx, qword [r14 + 0x348]
lea rcx, [rbp - 0x60]
call fcn.140003fe0
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400510f7
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x1400510fa
mov rbx, rdi
test rbx, rbx
jne 0x14005110a
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x14005111b
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140051130
call fcn.140009910
mov rax, qword [r14 + 0x388]
test rax, rax
je 0x1400512fb
cmp word [rax], 0
je 0x1400512fb
mov rax, rdi
movsxd rcx, dword [0x140126e7c]
test rcx, rcx
jle 0x14005117a
nop dword [rax]
cmp dword [r15 + rax*4 + 0x450], 0x676
je 0x1400512fb
inc rax
cmp rax, rcx
jl 0x140051160
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400511ab
lea r8, [0x14012b658]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x1400511ae
mov rbx, rdi
test rbx, rbx
jne 0x1400511be
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400511cf
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005120b
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.Package:_n
call fcn.1400a6ce0
mov qword [rbx], rax
jmp 0x14005120e
mov rbx, rdi
mov qword [rbp + 0x30], rbx
test rbx, rbx
jne 0x140051222
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051250
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140051253
mov rsi, rdi
test rsi, rsi
jne 0x140051263
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051274
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov rdx, qword [r14 + 0x388]
lea rcx, [rbp - 0x10]
call fcn.140003fe0
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400512c2
lea r8, [rbp - 0x10]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x1400512c5
mov rbx, rdi
test rbx, rbx
jne 0x1400512d5
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400512e6
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400512fb
call fcn.140009910
mov rax, qword [r14 + 0x350]
test rax, rax
je 0x1400514ce
cmp word [rax], 0
je 0x1400514ce
mov rax, rdi
movsxd rcx, dword [0x140126e7c]
test rcx, rcx
jle 0x14005133e
cmp dword [r15 + rax*4 + 0x450], 0x49d
je 0x1400514ce
inc rax
cmp rax, rcx
jl 0x140051324
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005136f
lea r8, [0x14012b658]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140051372
mov rbx, rdi
test rbx, rbx
jne 0x140051382
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051393
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400513de
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.Comment:_n
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400513e1
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x70], rbx
test rbx, rbx
jne 0x1400513f5
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051423
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140051426
mov rsi, rdi
test rsi, rsi
jne 0x140051436
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051447
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov rdx, qword [r14 + 0x350]
lea rcx, [rbp - 0x50]
call fcn.140003fe0
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051495
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140051498
mov rbx, rdi
test rbx, rbx
jne 0x1400514a8
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400514b9
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x1400514ce
call fcn.140009910
cmp qword [r14 + 0x3d0], 0
je 0x140051bee
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005150d
lea r8, [0x14012b658]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140051510
mov rbx, rdi
test rbx, rbx
jne 0x140051520
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051531
call fcn.140009910
mov qword [rbp + 0x128], rbx
lea rdx, str.rundll32.exe
mov rcx, qword [r14 + 0x48]
call fcn.1400a9bbc
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
test eax, eax
jne 0x140051609
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051594
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.Rundll_Target:_n
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140051597
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x40], rbx
test rbx, rbx
jne 0x1400515ab
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400515d9
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x1400515dc
mov rsi, rdi
test rsi, rsi
jne 0x1400515ec
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400515fd
call fcn.140009910
mov qword [rbp + 0x128], rsi
jmp 0x1400517fb
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051648
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, str.COM_Class:_n
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14005164b
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x90], rbx
test rbx, rbx
jne 0x140051662
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051693
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140051696
mov rsi, rdi
test rsi, rsi
jne 0x1400516a6
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400516b7
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov rdx, qword [r14 + 0x3b8]
test rdx, rdx
je 0x140051803
lea rcx, [rbp - 0x20]
call fcn.140003fe0
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005170e
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rbx, rax
jmp 0x140051711
mov rbx, rdi
test rbx, rbx
jne 0x140051721
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051732
call fcn.140009910
mov qword [rbp + 0x128], rbx
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140051747
call fcn.140009910
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005178b
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x1400e5d98]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14005178e
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x50], rbx
test rbx, rbx
jne 0x1400517a2
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400517d0
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x1400517d3
mov rsi, rdi
test rsi, rsi
jne 0x1400517e3
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400517f4
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov rsi, qword [r14 + 0x3d0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005184f
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140051852
test rsi, rsi
je 0x140051852
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x80], rbx
test rbx, rbx
jne 0x140051869
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005189a
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x14005189d
mov rsi, rdi
test rsi, rsi
jne 0x1400518ad
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x1400518be
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
cmp qword [r14 + 0x3c8], 0
je 0x140051a5b
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x14005191f
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x1400e5d98]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140051922
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x60], rbx
test rbx, rbx
jne 0x140051936
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051964
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140051967
mov rsi, rdi
test rsi, rsi
jne 0x140051977
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051988
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov rsi, qword [r14 + 0x3c8]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400519e3
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400519e6
test rsi, rsi
je 0x1400519e6
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x18], rbx
test rbx, rbx
jne 0x1400519fa
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051a28
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140051a2b
mov rsi, rdi
test rsi, rsi
jne 0x140051a3b
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051a4c
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
cmp qword [r14 + 0x3c0], 0
je 0x1400528e3
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051aad
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
lea rcx, [0x1400e5d98]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140051ab0
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x28], rbx
test rbx, rbx
jne 0x140051ac4
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051af2
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140051af5
mov rsi, rdi
test rsi, rsi
jne 0x140051b05
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051b16
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
mov rsi, qword [r14 + 0x3c0]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov rbx, rax
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051b71
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140051b74
test rsi, rsi
je 0x140051b74
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rbx, rdi
mov qword [rbp + 0x38], rbx
test rbx, rbx
jne 0x140051b88
mov ecx, 0x8007000e
call fcn.1400a6a90
nop
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400a8e40
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140051bb6
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x128]
mov rcx, rax
call fcn.140003e80
mov rsi, rax
jmp 0x140051bb9
mov rsi, rdi
test rsi, rsi
jne 0x140051bc9
mov ecx, 0x8007000e
call fcn.1400a6a90
int3
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140051bda
call fcn.140009910
mov qword [rbp + 0x128], rsi
mov rcx, rbx
call fcn.140009910
jmp 0x1400528e3
lea rdx, str.taskeng.exe
mov rcx, qword [r14 + 0x48]
call fcn.1400a9bbc
test eax, eax
je 0x140052783
lea rdx, str.taskhost.exe
mov rcx, qword [r14 + 0x48]
call fcn.1400a9bbc
test eax, eax
je 0x140052783
lea rdx, str.taskhostex.exe
mov rcx, qword [r14 + 0x48]
call fcn.1400a9bbc
test eax, eax
je 0x140052783
lea rdx, str.taskhostw.exe
mov rcx, qword [r14 + 0x48]
call fcn.1400a9bbc
test eax, eax
je 0x140052783
invalid
invalid
invalid