Function at 0x140117eb0
Capabilities:
Check os version
Get session information
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1270]
mov eax, 0x1370
call fcn.140359d40
sub rsp, rax
movaps xmmword [rsp + 0x1360], xmm6
movaps xmmword [rsp + 0x1350], xmm7
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x1240], rax
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x60], r13d
call fcn.140109600
mov dword [rsp + 0x60], eax
lea rax, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rax
je 0x140117f50
test byte [rcx + 0x1c], 1
je 0x140117f50
cmp byte [rcx + 0x19], 4
jb 0x140117f50
mov eax, dword [rsi + 0x24]
mov ebx, dword [rsi + 0x20]
lea edx, [r13 + 0x1c]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsi + 0x30]
mov rcx, qword [rcx + 0x10]
call fcn.140115540
mov edi, dword [rsi + 0x30]
cmp edi, 4
ja 0x140117f74
lea r15, [rsi + 0x2c]
cmp dword [r15], 0xffffffff
jne 0x14011804a
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov dword [r15], eax
jmp 0x14011804a
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
movups xmmword [rbp + 0x860], xmm0
mov r8d, 0x20
lea rdx, [rbp + 0x850]
lea rcx, [rsi + 0xb8]
call fcn.14035bb80
test eax, eax
jne 0x140118034
xorps xmm0, xmm0
movups xmmword [rbp + 0x4d0], xmm0
mov edx, edi
lea rcx, [rbp + 0x4d0]
call fcn.14009c110
mov rax, qword [rbp + 0x4d0]
test rax, rax
je 0x140117fe0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rsi + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rsi + 0xc8], xmm1
mov rcx, qword [rbp + 0x4d8]
test rcx, rcx
je 0x140118034
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140118034
mov rbx, qword [rbp + 0x4d8]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140118034
mov rcx, qword [rbp + 0x4d8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
lea r15, [rsi + 0x2c]
cmp dword [r15], 0xffffffff
jne 0x14011804a
mov rdx, r15
mov ecx, dword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp qword [rsi + 0x68], r13
jne 0x1401180f8
mov edx, dword [rsi + 0x30]
cmp edx, 4
jbe 0x1401180f8
xorps xmm0, xmm0
movups xmmword [rbp + 0x4e0], xmm0
lea rcx, [rbp + 0x4e0]
call fcn.14009c110
nop
mov rdx, qword [rbp + 0x4e0]
test rdx, rdx
je 0x1401180a4
add rdx, 0x20
lea rcx, [rsi + 0x58]
cmp rcx, rdx
je 0x1401180a4
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14011809e
mov rdx, qword [rdx]
call fcn.1400739a0
nop
mov rcx, qword [rbp + 0x4e8]
test rcx, rcx
je 0x1401180f8
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1401180f8
mov rbx, qword [rbp + 0x4e8]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1401180f8
mov rcx, qword [rbp + 0x4e8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
cmp byte [rsi + 0x154], 0
je 0x140118108
mov al, 1
jmp 0x1401181ce
mov edx, dword [rsi + 0x24]
mov rax, qword [0x140687ec0]
mov rcx, qword [0x140687ec8]
cmp rax, rcx
je 0x14011812d
nop
cmp dword [rax], edx
je 0x14011817a
add rax, 0x78
cmp rax, rcx
jne 0x140118120
movsxd r9, dword [rsi + 0x24]
lea eax, [r9 - 1]
mov rdx, qword [0x140688218]
cmp eax, 0x3f
ja 0x1401181a1
mov qword [rsp + 0x70], 1
lea r8, [r9 - 1]
mov rax, r8
shr rax, 6
mov ebx, 1
test rax, rax
je 0x140118167
mov rbx, r13
mov qword [rsp + 0x70], rbx
and r8d, 0x3f
je 0x1401181a4
mov ecx, r8d
shl rbx, cl
mov qword [rsp + 0x70], rbx
jmp 0x1401181a4
lea rcx, [rax + 0x30]
cmp qword [rcx + 0x18], 8
jb 0x140118188
mov rcx, qword [rcx]
test rcx, rcx
je 0x14011812d
lea rdx, [0x1405f3480]
call fcn.1403681bc
test eax, eax
jne 0x14011812d
mov al, 1
jmp 0x1401181ce
mov rbx, rdx
mov rax, qword [rsi + 0xe0]
and rax, rbx
mov qword [rbp + 0x110], rax
cmp rax, rdx
je 0x1401181be
mov al, 1
jmp 0x1401181ce
mov edx, dword [rsi + 0x28]
mov ecx, r9d
call fcn.1400e4a70
test al, al
setne al
mov byte [rsi + 0x154], al
cmp dword [rsi + 0x20], 0x3e7
je 0x140118451
cmp qword [rsi + 0x68], 0
jbe 0x140118451
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x580], xmm1
lea rbx, [rsi + 0x58]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140118208
mov rcx, qword [rbx]
lea r8, [rbp + 0x580]
xor edx, edx
call fcn.140091490
test al, al
je 0x140118227
mov rax, qword [rbp + 0x580]
movzx ecx, byte [rax]
mov byte [rsi + 0x50], cl
mov qword [rbp + 0x468], r13
mov qword [rbp + 0x478], r13
mov qword [rbp + 0x480], 7
mov word [rbp + 0x468], r13w
mov qword [rbp + 0x488], r13
mov qword [rbp + 0x498], r13
mov qword [rbp + 0x4a0], 7
mov word [rbp + 0x488], r13w
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140118276
mov rcx, qword [rbx]
lea r8, [rbp + 0x488]
lea rdx, [rbp + 0x468]
call fcn.1401d50f0
test al, al
je 0x1401182f6
lea rcx, [rsi + 0x78]
lea rax, [rbp + 0x468]
cmp rcx, rax
je 0x1401182c0
lea rdx, [rbp + 0x468]
cmp qword [rbp + 0x480], 8
cmovae rdx, qword [rbp + 0x468]
mov r8, qword [rbp + 0x478]
call fcn.1400739a0
lea rcx, [rsi + 0x98]
lea rax, [rbp + 0x488]
cmp rcx, rax
je 0x1401182f6
lea rdx, [rbp + 0x488]
cmp qword [rbp + 0x4a0], 8
cmovae rdx, qword [rbp + 0x488]
mov r8, qword [rbp + 0x498]
call fcn.1400739a0
cmp qword [rsi + 0x88], 0
jne 0x140118348
cmp qword [rbx + 0x18], 8
jb 0x14011830a
mov rbx, qword [rbx]
mov edx, 0x5c
mov rcx, rbx
call fcn.14035b2dc
test rax, rax
je 0x140118320
lea rbx, [rax + 2]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140118330
lea rcx, [rsi + 0x78]
mov rdx, rbx
call fcn.1400739a0
nop
mov rdx, qword [rbp + 0x4a0]
cmp rdx, 8
jb 0x14011838e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x488]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140118389
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011aec4
call fcn.140359090
mov qword [rbp + 0x498], r13
mov qword [rbp + 0x4a0], 7
mov word [rbp + 0x488], r13w
mov rdx, qword [rbp + 0x480]
cmp rdx, 8
jb 0x1401183ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x468]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401183e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011aeca
call fcn.140359090
mov qword [rbp + 0x478], r13
mov qword [rbp + 0x480], 7
mov word [rbp + 0x468], r13w
mov rbx, qword [rbp + 0x588]
test rbx, rbx
je 0x140118451
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140118451
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140118451
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
mov r8d, dword [rsi + 0x28]
mov edx, dword [rsi + 0x20]
lea rcx, [rbp + 0x448]
call fcn.1401cb8b0
nop
mov ecx, dword [rsi + 0x24]
mov rbx, qword [0x140688228]
mov rax, qword [rbx + 8]
mov rdx, rbx
cmp byte [rax + 0x19], 0
jne 0x140118497
nop dword [rax]
cmp dword [rax + 0x20], ecx
jge 0x14011848b
mov rax, qword [rax + 0x10]
jmp 0x140118491
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140118480
cmp byte [rdx + 0x19], 0
jne 0x1401184a2
cmp ecx, dword [rdx + 0x20]
jge 0x1401184a5
mov rdx, rbx
cmp rdx, rbx
jne 0x1401184cb
mov qword [rbp + 0x5d0], r13
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x5e0], xmm0
mov word [rbp + 0x5d0], r13w
jmp 0x1401184dc
add rdx, 0x28
lea rcx, [rbp + 0x5d0]
call fcn.1400733c0
nop
cmp dword [rsi + 0x20], 0x226
jne 0x1401185b8
mov ebx, dword [rsi + 0x30]
call fcn.1401d6120
test al, al
je 0x1401185b8
mov ecx, ebx
call fcn.14011fbb0
test al, al
jne 0x1401185b4
mov edx, ebx
lea rcx, [rbp + 0x560]
call fcn.1401d2b90
nop
lea rbx, [rbp + 0x560]
cmp qword [rbp + 0x578], 8
cmovae rbx, qword [rbp + 0x560]
mov edx, 0x5c
mov rcx, rbx
call fcn.14035b2dc
test rax, rax
je 0x140118544
lea rbx, [rax + 2]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140118550
mov rcx, rbx
call fcn.1401d5cd0
nop
mov rdx, qword [rbp + 0x578]
cmp eax, 0xcd74644c
jne 0x1401186bf
cmp rdx, 8
jb 0x1401185b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401185af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011aed0
call fcn.140359090
mov byte [rsi + 0x50], 1
mov rcx, r13
mov edx, dword [rsi + 0x20]
mov rax, r13
lea rbx, [0x1405e8930]
nop dword [rax + rax]
mov edi, 3
lea r12d, [rdi + 6]
cmp dword [rax + rbx], edx
je 0x140118707
inc rcx
add rax, 0x18
cmp rax, 0x4c8
jb 0x1401185d0
mov r13d, 2
mov rcx, rsi
call fcn.140094560
mov edx, 8
test byte [rsi + 0x158], 1
je 0x14011a6e6
mov ecx, dword [rsi + 0x20]
cmp ecx, 1
jbe 0x14011a6e6
cmp ecx, 0x23a
je 0x14011a6e6
cmp ecx, 0x65
je 0x14011a6e6
cmp ecx, 0x14
je 0x14011a6e6
cmp ecx, 0x3e7
jne 0x14011a4a7
call fcn.1400d5880
mov rdi, rax
mov rcx, qword [rax]
mov r14, qword [rcx + 0x18]
lea r11, [rsi + 0x130]
cmp qword [r11 + 0x18], 8
jb 0x140118667
mov r11, qword [r11]
lea r10, [rsi + 0x58]
cmp qword [r10 + 0x18], 8
jb 0x140118675
mov r10, qword [r10]
lea rbx, [rsi + 0x78]
cmp qword [rbx + 0x18], 8
jb 0x140118683
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.14011e720
mov r8d, 8
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rbx
mov r9d, 0x320
movzx edx, ax
mov rcx, rdi
mov rax, r14
call qword [case.0x1401cd220.0]
call fcn.140089400
jmp 0x14011a6e6
cmp rdx, 8
jb 0x1401185b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x560]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401186fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011aed0
call fcn.140359090
jmp 0x1401185b8
lea rax, [rcx + rcx*2]
mov eax, dword [rbx + rax*8 + 4]
add eax, 0xfffffffe
cmp eax, edi
ja 0x1401185f1
mov qword [rbp + 0x3e8], r13
mov rdi, r13
mov qword [rbp + 0x3f8], r13
mov ecx, 7
mov qword [rbp + 0x400], rcx
mov word [rbp + 0x3e8], r13w
cmp edx, 0x245
jne 0x1401187db
cmp qword [rsi + 0x108], 0
jne 0x1401187db
mov ebx, dword [rsi + 0x30]
xor r8d, r8d
lea rdx, [rsi + 0x58]
lea rcx, [rbp + 0x130]
call fcn.14007c930
nop
lea r9, [rsi + 0xe8]
mov r8d, ebx
lea rdx, [rsi + 0x58]
mov rcx, rax
call fcn.14007b570
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x1401187cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401187c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011aed6
call fcn.140359090
mov rcx, qword [rbp + 0x400]
mov rdi, qword [rbp + 0x3f8]
mov r14, qword [rbp + 0x458]
test r14, r14
je 0x140118bbb
cmp dword [rsi + 0x20], 0x64
jne 0x140118947
lea r9, [rbp + 0x448]
cmp qword [rbp + 0x460], 8
cmovae r9, qword [rbp + 0x448]
mov rax, rcx
sub rax, rdi
cmp r14, rax
ja 0x140118850
lea rax, [rdi + r14]
mov qword [rbp + 0x3f8], rax
lea rbx, [rbp + 0x3e8]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rdi*2]
lea r8, [r14 + r14]
mov rdx, r9
call fcn.14035bc80
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r13w
jmp 0x14011886b
lfence
mov rdx, qword [rbp + 0x458]
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
mov rdx, qword [rbp + 0x3f8]
mov rbx, qword [rbp + 0x400]
mov rax, rbx
sub rax, rdx
cmp rax, 2
jb 0x1401188b1
lea rcx, [rdx + 2]
mov qword [rbp + 0x3f8], rcx
lea rax, [rbp + 0x3e8]
cmp rbx, 8
cmovae rax, qword [rbp + 0x3e8]
mov dword [rax + rdx*2], 0xa000d
mov word [rax + rcx*2], r13w
jmp 0x1401188d5
lfence
mov qword [rsp + 0x20], 2
lea r9, [0x1405e494c]
mov edx, 2
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
mov rdx, qword [rbp + 0x3f8]
mov rbx, qword [rbp + 0x400]
mov rax, rbx
sub rax, rdx
cmp rax, 2
jb 0x14011891e
lea rcx, [rdx + 2]
mov qword [rbp + 0x3f8], rcx
lea rax, [rbp + 0x3e8]
cmp rbx, 8
cmovae rax, qword [rbp + 0x3e8]
mov dword [rax + rdx*2], 0xa000d
mov word [rax + rcx*2], r13w
jmp 0x140118bbb
lfence
mov qword [rsp + 0x20], 2
lea r9, [0x1405e494c]
mov edx, 2
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
jmp 0x140118bbb
lea rcx, [rbp + 0x5d0]
cmp qword [rbp + 0x5e8], 8
cmovae rcx, qword [rbp + 0x5d0]
lea rax, [rbp + 0x448]
cmp qword [rbp + 0x460], 8
cmovae rax, qword [rbp + 0x448]
mov qword [rsp + 0x30], rcx
lea rcx, str.Policy
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, str.Mitigation
lea r8, str.__12ls__ls_r_n__12ls__ls_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1401189c0
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140118a1c
lea rdi, [rdx + rcx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140118a37
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
lea rdx, [rsi + 0x18]
lea rcx, [rbp + 0x610]
call fcn.1401d6660
nop
lea rax, [rbp + 0x610]
cmp qword [rbp + 0x628], 8
cmovae rax, qword [rbp + 0x610]
mov qword [rsp + 0x20], rax
lea r9, str.Timestamp
lea r8, str.__12ls__ls_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140118a93
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140118aef
lea rdi, [rdx + rcx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140118b0a
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
mov rdx, qword [rbp + 0x3f8]
mov rbx, qword [rbp + 0x400]
mov rax, rbx
sub rax, rdx
cmp rax, 2
jb 0x140118b50
lea rcx, [rdx + 2]
mov qword [rbp + 0x3f8], rcx
lea rax, [rbp + 0x3e8]
cmp rbx, 8
cmovae rax, qword [rbp + 0x3e8]
mov dword [rax + rdx*2], 0xa000d
mov word [rax + rcx*2], r13w
jmp 0x140118b75
lfence
mov qword [rsp + 0x20], 2
lea r9, [0x1405e494c]
mov edx, 2
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
nop
mov rdx, qword [rbp + 0x628]
cmp rdx, 8
jb 0x140118bbb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x610]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140118bb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011aedc
call fcn.140359090
lea rcx, [rbp + 0x1f8]
call fcn.14006b440
nop
cmp byte [rax + 0x20], 0
je 0x140118bef
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
jmp 0x140118c17
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 0xf
mov r8d, 7
lea rdx, str.0.0.0.0
lea rcx, [rsp + 0x78]
call fcn.140073120
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
lea rcx, [rbp + 0x220]
call fcn.140122260
mov r14d, dword [rax + 8]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140118c73
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140118c6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011aee2
call fcn.140359090
mov byte [rsp + 0x78], 0
cmp byte [rbp + 0x218], 0
je 0x140118c8d
lea rcx, [rbp + 0x1f8]
call fcn.140073500
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x734]
call fcn.14035c350
mov dword [rbp + 0x730], 0x114
lea rcx, [rbp + 0x730]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, 1
xor ecx, ecx
cpuid
mov edi, eax
sar edi, 0x10
and edi, 0xf0
mov ecx, eax
sar ecx, 8
and ecx, 0xf
add edi, ecx
mov ebx, eax
sar ebx, 0xc
and ebx, 0xf0
sar eax, 4
and eax, 0xf
add ebx, eax
call fcn.1401d3720
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x73c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x738]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp + 0x734]
lea r8, [0x1405f9bc0]
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x870]
call fcn.14011ef00
mov byte [rsp + 0x50], 0
mov byte [rsp + 0x51], 0
mov dword [rsp + 0x64], r13d
cmp edi, 6
jne 0x140118d99
lea r8, [rsp + 0x64]
lea rdx, [rsp + 0x51]
lea rcx, [rsp + 0x50]
call fcn.1400856f0
test al, al
jne 0x140118d6a
lea r8, [0x1405f9bbc]
jmp 0x140118d88
cmp byte [rsp + 0x50], 0
jne 0x140118d7a
lea r8, [0x1405fa6b8]
jmp 0x140118d88
cmp byte [rsp + 0x51], 0
jne 0x140118d99
lea r8, [0x1405f7434]
mov edx, 0x80
lea rcx, [rbp + 0x870]
call fcn.140374040
lea rax, [rbp + 0x870]
mov qword [rsp + 0x20], rax
lea r9, str.Platform
lea r8, str.__12ls__ls_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140118dd4
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140118e30
lea rdi, [rdx + rcx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140118e4b
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
call fcn.1401d74b0
test eax, eax
je 0x140118f29
cmp eax, 1
jne 0x140118e66
lea r8, str.Minimal
jmp 0x140118e72
cmp eax, 2
jne 0x140118e83
lea r8, str.Network
mov edx, 0x80
lea rcx, [rbp + 0x870]
call fcn.140368338
lea r9, [rbp + 0x870]
lea r8, str.Safe_Mode
lea rdx, str.__12ls__ls_r_n
lea rcx, [rbp + 0x970]
call fcn.1400ed690
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140118eb2
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140118f0e
lea rdi, [rdx + rcx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140118f29
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
mov r9d, dword [rsi + 0x30]
cmp r9d, 4
jbe 0x140118fd7
lea r8, [0x1405f9c60]
lea rdx, str.__12ls__u_r_n
lea rcx, [rbp + 0x970]
call fcn.1400ed690
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140118f60
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140118fbc
lea rdi, [rdx + rcx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140118fd7
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
cmp dword [rsi + 0x30], 4
jbe 0x140119237
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x508], xmm1
mov qword [rbp + 0x518], r13
lfence
mov ecx, 0x10
call fcn.1403590cc
mov qword [rax + 8], r13
mov qword [rbp + 0x4f8], rax
lea rcx, [rbp + 0x4f8]
mov qword [rax], rcx
lea rdx, [rbp + 0x4f8]
mov ecx, dword [rsi + 0x30]
call fcn.140117620
test al, al
je 0x14011922b
mov qword [rbp + 0x420], r13
mov rdx, r13
mov qword [rbp + 0x430], rdx
mov r8d, 7
mov qword [rbp + 0x438], r8
mov word [rbp + 0x420], r13w
mov rdi, qword [rbp + 0x510]
mov r14, qword [rbp + 0x518]
add r14, rdi
cmp rdi, r14
je 0x14011920e
nop word [rax + rax]
mov rcx, qword [rbp + 0x508]
dec rcx
and rcx, rdi
mov rax, qword [rbp + 0x500]
mov rbx, qword [rax + rcx*8]
test rdx, rdx
je 0x1401190f9
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x1401190d5
lea rcx, [rdx + 2]
mov qword [rbp + 0x430], rcx
lea rax, [rbp + 0x420]
cmp r8, 8
cmovae rax, qword [rbp + 0x420]
mov dword [rax + rdx*2], 0x20002c
mov word [rax + rcx*2], r13w
jmp 0x1401190f9
lfence
mov qword [rsp + 0x20], 2
lea r9, [0x1405f9c78]
mov edx, 2
lea rcx, [rbp + 0x420]
call fcn.1400735a0
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x140119107
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp + 0x420]
call fcn.140073720
inc rdi
cmp rdi, r14
je 0x140119131
mov r8, qword [rbp + 0x438]
mov rdx, qword [rbp + 0x430]
jmp 0x140119080
cmp qword [rbp + 0x430], 0
je 0x140119207
lea rax, [rbp + 0x420]
cmp qword [rbp + 0x438], 8
cmovae rax, qword [rbp + 0x420]
mov qword [rsp + 0x20], rax
lea r9, str.Service
lea r8, str.__12ls__ls_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140119190
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1401191ec
lea rdi, [rcx + rdx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140119207
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
mov r8, qword [rbp + 0x438]
cmp r8, 8
jb 0x14011922b
inc r8
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x420]
call fcn.140073b50
nop
lea rcx, [rbp + 0x4f8]
call fcn.14011e990
movzx edx, word [rsi + 0x34]
test dx, dx
je 0x140119377
mov eax, 0x8664
cmp dx, ax
jne 0x140119253
mov ecx, r12d
jmp 0x140119277
mov eax, 0xaa64
cmp dx, ax
jne 0x140119264
mov ecx, 0xc
jmp 0x140119277
mov ecx, r13d
mov ebx, 5
mov eax, 0x1c4
cmp dx, ax
cmove ecx, ebx
lea rax, [0x140607390]
lea rbx, [0x1406073d0]
cmp dword [rax], ecx
je 0x14011929b
add rax, 0x10
cmp rax, rbx
jne 0x140119285
lea rax, [0x140606c30]
jmp 0x1401192a4
mov rax, qword [rax + 8]
test rax, rax
je 0x1401192cc
mov qword [rsp + 0x20], rax
lea r9, [0x1405f9c98]
lea r8, str.__12ls__S_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
jmp 0x1401192e9
mov r9d, edx
lea r8, [0x1405f9c98]
lea rdx, str.__12ls__04X_r_n
lea rcx, [rbp + 0x970]
call fcn.1400ed690
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140119300
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011935c
lea rdi, [rcx + rdx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140119377
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
lea rcx, [rsi + 0xd8]
mov rax, qword [rcx]
cmp rax, qword [0x140688218]
je 0x140119477
lea rdx, [rbp + 0xb0]
call fcn.1400e8690
cmp qword [rax + 0x18], 8
jb 0x1401193a4
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, str.Enabled
lea r8, str.__12ls__ls_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
mov r8, qword [rbp + 0xc8]
cmp r8, 8
jb 0x1401193ed
inc r8
mov rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 0xb0]
call fcn.140073b50
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140119400
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011945c
lea rdi, [rcx + rdx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140119477
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
lea rcx, [rsi + 0xe0]
mov rax, qword [rcx]
cmp rax, qword [0x140688218]
je 0x140119577
lea rdx, [rbp + 0x90]
call fcn.1400e8690
cmp qword [rax + 0x18], 8
jb 0x1401194a4
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea r9, str.Silent
lea r8, str.__12ls__ls_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
mov r8, qword [rbp + 0xa8]
cmp r8, 8
jb 0x1401194ed
inc r8
mov rdx, qword [rbp + 0x90]
lea rcx, [rbp + 0x90]
call fcn.140073b50
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140119500
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011955c
lea rdi, [rdx + rcx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140119577
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
movabs rdi, 0x7ffffffffffffffe
mov r13d, 6
cmp qword [rsi + 0x68], 0
jbe 0x140119bbf
lea r8, str.Application
lea rdx, str.__12ls
lea rcx, [rbp + 0x970]
call fcn.1400ed690
lea rbx, [rsi + 0x58]
lea rax, [rbp + 0x970]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1401195c0
mov rdx, qword [rbx + 0x10]
mov rax, rdi
sub rax, rdx
cmp rax, rcx
jb 0x14011aee8
lfence
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1401195ed
mov rax, qword [rbx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x970]
lea rcx, [rbp]
call fcn.14007d050
nop
mov r8d, 2
lea rdx, [0x1405e494c]
lea rcx, [rbp]
call fcn.140073720
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea r13d, [r12 + 0x1e]
lea rdx, [rbp - 0x20]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x3e8]
call fcn.140073720
nop
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x140119696
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.140073b50
nop
mov r8, qword [rbp + 0x18]
cmp r8, 8
jb 0x1401196b0
inc r8
mov rdx, qword [rbp]
lea rcx, [rbp]
call fcn.140073b50
mov qword [rbp + 0x4f0], r12
mov qword [rbp + 0x4c0], r12
cmp qword [rbx + 0x18], 8
jb 0x1401196c8
mov rbx, qword [rbx]
test rbx, rbx
je 0x14011993d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80
lea r8d, [r9 + 3]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14011993d
lea rdx, [rbp + 0x6f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x140119743
mov rcx, qword [rbp + 0x6f4]
mov qword [rbp + 0x4f0], rcx
mov rcx, qword [rbp + 0x704]
mov qword [rbp + 0x4c0], rcx
cmp edi, 1
sete al
test al, al
je 0x140119933
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x630]
call fcn.1401d6660
nop
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x650]
call fcn.1401d6660
nop
cmp qword [rbp + 0x640], 0
jbe 0x140119849
lea rax, [rbp + 0x630]
cmp qword [rbp + 0x648], 8
cmovae rax, qword [rbp + 0x630]
mov qword [rsp + 0x20], rax
lea r9, str.Created
lea r8, str.__12ls__ls_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1401197d2
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14011982e
lea rdi, [rdx + rcx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r12w
jmp 0x140119849
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
cmp qword [rbp + 0x660], 0
jbe 0x14011991a
lea rax, [rbp + 0x650]
cmp qword [rbp + 0x668], 8
cmovae rax, qword [rbp + 0x650]
mov qword [rsp + 0x20], rax
lea r9, str.Modified
lea r8, str.__12ls__ls_r_n
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1401198a2
mov rcx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x400]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1401198fe
lea rdi, [rdx + rcx]
mov qword [rbp + 0x3f8], rdi
lea rbx, [rbp + 0x3e8]
cmp r8, 8
cmovae rbx, qword [rbp + 0x3e8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x970]
call fcn.14035bc80
mov word [rbx + rdi*2], r12w
jmp 0x14011991a
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x3e8]
call fcn.1400735a0
nop
lea rcx, [rbp + 0x650]
call fcn.140073b90
nop
lea rcx, [rbp + 0x630]
call fcn.140073b90
movabs rdi, 0x7ffffffffffffffe
lea rdx, [rbp + 0x5b0]
mov rcx, rsi
call fcn.1400eee40
nop
cmp qword [rbp + 0x5c0], 0
jbe 0x140119a73
lea r8, str.Description
lea rdx, str.__12ls
lea rcx, [rbp + 0x970]
call fcn.1400ed690
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140119983
mov rax, rdi
sub rax, qword [rbp + 0x5c0]
cmp rax, rdx
jb 0x14011aeee
lfence
lea rcx, [rbp + 0x5b0]
cmp qword [rbp + 0x5c8], 8
cmovae rcx, qword [rbp + 0x5b0]
mov rax, qword [rbp + 0x5c0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x1d8]
call fcn.14007d050
nop
mov r8d, 2
lea rdx, [0x1405e494c]
lea rcx, [rbp + 0x1d8]
call fcn.140073720
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or r13d, 0x60
lea rdx, [rbp + 0xf0]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x3e8]
call fcn.140073720
nop
lea rcx, [rbp + 0xf0]
call fcn.140073b90
nop
lea rcx, [rbp + 0x1d8]
call fcn.140073b90
mov ecx, dword [rsi + 0x20]
cmp qword [rsi + 0x120], 0
jbe 0x140119e54
cmp ecx, 0x190
jne 0x140119bc7
lea r8, str.Filename_of_the_process_blocked:
lea rdx, str._ls_r_n
lea rcx, [rbp + 0x970]
call fcn.1400ed690
mov r8d, 2
lea rdx, [0x1405e494c]
lea rcx, [rbp + 0x3e8]
call fcn.140073720
lea rdx, [rsi + 0x110]
lea rax, [rbp + 0x970]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140119ae0
mov rbx, qword [rdx + 0x10]
mov rax, rdi
sub rax, rbx
cmp rax, rcx
jb 0x14011aef4
lfence
cmp qword [rdx + 0x18], 8
jb 0x140119b0a
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x1b8]
call fcn.14007d050
nop
mov r8d, 2
lea rdx, [0x1405e494c]
lea rcx, [rbp + 0x1b8]
call fcn.140073720
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or r13d, 0x180
lea rdx, [rbp + 0xd0]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 8
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x3e8]
call fcn.140073720
nop
lea rcx, [rbp + 0xd0]
call fcn.140073b90
nop
lea rcx, [rbp + 0x1b8]
jmp 0x140119e4f
xor r12d, r12d
jmp 0x14011993d
sub ecx, 0xe6
je 0x140119c20
sub ecx, 0x1e
je 0x140119c17
sub ecx, 0xf0
je 0x140119bfc
sub ecx, 0x32
je 0x140119bf3
cmp ecx, 0xa
je 0x140119e54
lea rbx, str.Filename
jmp 0x140119c27
lea rbx, str.Camera
jmp 0x140119c27
lea rax, str.Filename
lea rbx, [0x1405f9de4]
cmp byte [rsi + 0x155], 0
cmove rbx, rax
jmp 0x140119c27
lea rbx, str.Violation
jmp 0x140119c27
lea rbx, str.Library
mov r8d, 2
lea rdx, [0x1405e494c]
lea rcx, [rbp + 0x3e8]
call fcn.140073720
mov r9, rbx
lea r8, str.__12ls
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
lea rdx, [rsi + 0x110]
lea rax, [rbp + 0x970]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140119c72
mov rbx, qword [rdx + 0x10]
mov rax, rdi
sub rax, rbx
cmp rax, rcx
jb 0x14011aefa
lfence
cmp qword [rdx + 0x18], 8
jb 0x140119c9c
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x178]
call fcn.14007d050
bts r13d, 9
lea r8, [0x1405e494c]
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x230]
call fcn.14007cfe0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140119cec
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x3e8]
call fcn.140073720
nop
lea rcx, [rbp + 0x230]
call fcn.140073b90
nop
lea rcx, [rbp + 0x178]
call fcn.140073b90
cmp dword [rsi + 0x20], 0x320
jne 0x140119e54
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x550], r12
mov qword [rbp + 0x558], 7
mov word [rbp + 0x540], r12w
lea rcx, [rsi + 0x110]
cmp qword [rcx + 0x18], 8
jb 0x140119d54
mov rcx, qword [rcx]
lea rdx, [rbp + 0x540]
call fcn.1400826e0
test al, al
je 0x140119e48
lea r8, str.Created_By
lea rdx, str.__12ls
lea rcx, [rbp + 0x970]
call fcn.1400ed690
lea rax, [rbp + 0x970]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140119d90
mov rax, rdi
sub rax, qword [rbp + 0x550]
cmp rax, rdx
jb 0x14011af00
lfence
lea rcx, [rbp + 0x540]
cmp qword [rbp + 0x558], 8
cmovae rcx, qword [rbp + 0x540]
mov rax, qword [rbp + 0x550]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x970]
lea rcx, [rbp + 0x198]
call fcn.14007d050
bts r13d, 0xa
lea r8, [0x1405e494c]
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x250]
call fcn.14007cfe0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140119e1e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x3e8]
call fcn.140073720
nop
lea rcx, [rbp + 0x250]
call fcn.140073b90
nop
lea rcx, [rbp + 0x198]
call fcn.140073b90
nop
lea rcx, [rbp + 0x540]
call fcn.140073b90
mov r9d, dword [rsi + 0x20]
mov dword [rsp + 0x54], r9d
lea rbx, [rsi + 0x58]
cmp dword [0x14067635c], 0
je 0x140119f7f
cmp dword [0x140676358], 0
je 0x140119f7f
cmp dword [0x140676354], 0
je 0x140119f7f
mov ecx, r9d
call fcn.1401cb9c0
test al, al
je 0x140119fc7
cmp r9d, 0x1f7
je 0x140119fc7
lea rdx, [rsp + 0x54]
lea rcx, [0x1406878c8]
call fcn.140083380
mov ecx, dword [0x14067635c]
cmp dword [rax], ecx
jae 0x140119ee3
lea rdx, [rsp + 0x54]
call fcn.1400831f0
mov rdx, rbx
mov rcx, rax
call fcn.1400830c0
mov ecx, dword [0x140676358]
cmp dword [rax], ecx
jb 0x140119fc7
mov rcx, qword [str.0cg_]
lea rdi, str.0cg_
cmp rcx, rdi
je 0x140119f64
test byte [rcx + 0x1c], 1
je 0x140119f33
cmp byte [rcx + 0x19], 4
jb 0x140119f33
cmp qword [rbx + 0x18], 8
jb 0x140119f0c
mov rbx, qword [rbx]
mov edx, 0xc
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x1405f33e0]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
mov rcx, qword [str.0cg_]
cmp rcx, rdi
je 0x140119f64
test byte [rcx + 0x1c], 1
je 0x140119f64
cmp byte [rcx + 0x19], 4
jb 0x140119f64
mov eax, dword [rsi + 0x24]
mov ebx, dword [rsi + 0x20]
mov edx, 0x1d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsi + 0x30]
mov rcx, qword [rcx + 0x10]
call fcn.140115540
mov r8d, 0x11
lea rdx, str._r_nOUTBREAK_MODE_r_n
lea rcx, [rbp + 0x3e8]
call fcn.140073720
jmp 0x140119fce
mov rcx, qword [str.0cg_]
lea rdi, str.0cg_
cmp rcx, rdi
je 0x140119fce
test byte [rcx + 0x1c], 1
je 0x140119fce
cmp byte [rcx + 0x19], 4
jb 0x140119fce
cmp qword [rbx + 0x18], 8
jb 0x140119fa8
mov rbx, qword [rbx]
mov edx, 0xb
mov dword [rsp + 0x20], r9d
mov r9, rbx
lea r8, [0x1405f33e0]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
jmp 0x140119fce
lea rdi, str.0cg_
mov r8d, 2
lea rdx, [0x1405e494c]
lea rcx, [rbp + 0x3e8]
call fcn.140073720
lea r14, [rsi + 0x130]
lea r8, [rbp + 0x3e8]
cmp qword [rbp + 0x400], 8
cmovae r8, qword [rbp + 0x3e8]
mov r9, qword [rbp + 0x3f8]
mov rcx, r14
call fcn.14011f940
mov qword [rbp + 0x6b0], r12
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x6c0], xmm0
mov word [rbp + 0x6b0], r12w
mov qword [rbp + 0x6d0], r12
movdqu xmmword [rbp + 0x6e0], xmm0
mov word [rbp + 0x6d0], r12w
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x410], xmm1
lfence
mov ecx, 0x20
call fcn.1403590cc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x410], rax
mov ecx, dword [rsi + 0x20]
cmp ecx, 0x1f4
jg 0x14011a101
je 0x14011a129
cmp ecx, 0x64
jg 0x14011a0d8
je 0x14011a0b2
sub ecx, 1
je 0x14011a1e3
sub ecx, 9
je 0x14011a1e3
cmp ecx, 0xa
je 0x14011a1e3
jmp 0x14011a1a5
lea r8, [rbp + 0x410]
mov rdx, r14
mov ecx, dword [rsi + 0x30]
call fcn.14011af20
mov rdx, r14
lea rcx, [rbp + 0x410]
call fcn.14011b240
jmp 0x14011a1e3
cmp ecx, 0x65
je 0x14011a1e3
cmp ecx, 0x1d6
jne 0x14011a1a5
lea rcx, [rsi + 0xb8]
mov rdx, r14
call fcn.14011bc00
jmp 0x14011a1a5
sub ecx, 0x1f7
je 0x14011a1e3
sub ecx, 7
je 0x14011a129
sub ecx, 0x32
je 0x14011a1e3
sub ecx, 0xa
je 0x14011a1e3
cmp ecx, 0x28
jne 0x14011a1a5
mov r8d, 2
lea rdx, [0x1405e494c]
mov rcx, r14
call fcn.140073720
mov qword [rbp + 0x3e0], r12
xor bl, bl
lea rax, [rbp + 0x440]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3e0]
mov r8d, 0x1d
mov edx, dword [r15]
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14011a1a5
mov rcx, qword [rbp + 0x3e0]
mov eax, dword [rbp + 0x440]
cmp eax, 1
jne 0x14011a185
cmp byte [rcx], al
jmp 0x14011a18d
cmp eax, 4
jb 0x14011a190
cmp dword [rcx], 1
sete bl
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test bl, bl
je 0x14011a1a5
mov rdx, r14
mov ecx, dword [r15]
call fcn.14011b660
lea r8, [rbp + 0x410]
mov rdx, r14
mov ecx, dword [rsi + 0x30]
call fcn.14011af20
lea r8, [rbp + 0x410]
mov rdx, r14
mov ecx, dword [rsi + 0x30]
call fcn.14011b0b0
mov rdx, r14
lea rcx, [rbp + 0x410]
call fcn.14011b240
mov rdx, r14
mov ecx, dword [rsi + 0x30]
call fcn.14011b3d0
cmp qword [rsi + 0x108], 0
jne 0x14011a21a
mov rcx, qword [str.0cg_]
cmp rcx, rdi
je 0x14011a21a
test byte [rcx + 0x1c], 1
je 0x14011a21a
cmp byte [rcx + 0x19], 4
jb 0x14011a21a
mov edx, 0x1e
lea r8, [0x1405fa6c0]
mov rcx, qword [rcx + 0x10]
call fcn.14007d150
mov rdi, qword [rsi + 0x100]
mov r15, qword [rsi + 0xe8]
mov r12, qword [rsi + 0x108]
add r12, rdi
cmp rdi, r12
je 0x14011a459
test r15, r15
je 0x14011a245
mov rax, qword [r15]
jmp 0x14011a247
xor eax, eax
mov rcx, qword [rax + 0x10]
dec rcx
and rcx, rdi
mov rax, qword [rax + 8]
mov rbx, qword [rax + rcx*8]
lea rcx, [rbx + 0x10]
mov r8d, 0x20
lea rdx, [0x1405e8ef0]
call fcn.14035bb80
test eax, eax
je 0x14011a451
mov edx, dword [rbx]
lea rcx, [rbp + 0x690]
call fcn.1401d1960
nop
xor eax, eax
mov qword [rbp + 0x520], rax
mov qword [rbp + 0x530], rax
mov qword [rbp + 0x538], 7
mov word [rbp + 0x520], ax
cmp qword [rbx + 0x40], rax
je 0x14011a387
lea rcx, [rbx + 0x30]
mov rdx, qword [rcx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rdx
cmp rax, 2
jb 0x14011af06
lfence
cmp qword [rcx + 0x18], 8
jb 0x14011a2de
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 2
lea r9, [0x1405f9e48]
lea rcx, [rbp + 0x158]
call fcn.14007d050
nop
mov r8d, 1
lea rdx, [0x1405f95c0]
lea rcx, [rbp + 0x158]
call fcn.140073720
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x60], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm6
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
or r13d, 0x1800
lea rcx, [rbp + 0x520]
call fcn.140073b90
movups xmmword [rbp + 0x520], xmm7
movups xmmword [rbp + 0x530], xmm6
xor eax, eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], ax
lea rcx, [rbp + 0x60]
call fcn.140073b90
nop
lea rcx, [rbp + 0x158]
call fcn.140073b90
lea rcx, [rbx + 8]
lea rdx, [rbp + 0x670]
call fcn.1401d12c0
nop
lea rcx, [rbp + 0x670]
cmp qword [rbp + 0x688], 8
cmovae rcx, qword [rbp + 0x670]
lea rax, [rbp + 0x520]
cmp qword [rbp + 0x538], 8
cmovae rax, qword [rbp + 0x520]
lea r9, [rbp + 0x690]
cmp qword [rbp + 0x6a8], 8
cmovae r9, qword [rbp + 0x690]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r8, str._r_n_s_s_r_n_s
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x970]
call fcn.1400770b0
lea rax, [rbp + 0x970]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14011a410
lea rdx, [rbp + 0x970]
mov rcx, r14
call fcn.140073720
nop
lea rcx, [rbp + 0x670]
call fcn.140073b90
nop
lea rcx, [rbp + 0x520]
call fcn.140073b90
nop
lea rcx, [rbp + 0x690]
call fcn.140073b90
inc rdi
jmp 0x14011a232
lea rcx, [rbp + 0x410]
call fcn.140075de0
nop
lea rcx, [rbp + 0x6d0]
call fcn.140073b90
nop
lea rcx, [rbp + 0x6b0]
call fcn.140073b90
nop
lea rcx, [rbp + 0x5b0]
call fcn.140073b90
nop
lea rcx, [rbp + 0x3e8]
call fcn.140073b90
mov edi, 3
lea r12d, [rdi + 6]
jmp 0x1401185f7
cmp ecx, 0x226
jne 0x14011a4f9
call fcn.1400d5880
mov r10, rax
mov rcx, qword [rax]
mov r11, qword [rcx + 0x28]
lea rbx, [rsi + 0x130]
cmp qword [rbx + 0x18], 8
jb 0x14011a4cf
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.14011e720
mov r8d, r12d
mov qword [rsp + 0x20], rbx
mov r9d, 0x258
movzx edx, ax
mov rcx, r10
mov rax, r11
call qword [case.0x1401cd220.0]
jmp 0x14011a6e6
cmp ecx, 0xa
jne 0x14011a55b
call fcn.1400d5880
mov r10, rax
mov rcx, qword [rax]
mov r11, qword [rcx + 0x20]
lea r9, [rsi + 0x110]
cmp qword [r9 + 0x18], 8
jb 0x14011a51e
mov r9, qword [r9]
lea rbx, [rsi + 0x58]
cmp qword [rbx + 0x18], 8
jb 0x14011a52c
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.14011e720
mov r8d, r12d
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rbx
mov r9d, 0xfa
movzx edx, ax
mov rcx, r10
mov rax, r11
call qword [case.0x1401cd220.0]
jmp 0x14011a6e6
lea eax, [rcx - 0x1f5]
cmp eax, 1
jbe 0x14011a5f1
cmp ecx, 0x64
cmove r12w, di
call fcn.1400d5880
mov r11, rax
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
lea r9, [rsi + 0x130]
cmp qword [r9 + 0x18], 8
jb 0x14011a592
mov r9, qword [r9]
lea r10, [rbp + 0x448]
cmp qword [rbp + 0x460], 8
cmovae r10, qword [rbp + 0x448]
lea rbx, [rsi + 0x58]
cmp qword [rbx + 0x18], 8
jb 0x14011a5b7
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.14011e720
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rbx
mov r9d, 0x38f
movzx r8d, r12w
movzx edx, ax
mov rcx, r11
mov rax, rdi
call qword [case.0x1401cd220.0]
call fcn.140089400
jmp 0x14011a6e6
xor eax, eax
mov qword [rbp + 0x590], rax
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x5a0], xmm0
mov word [rbp + 0x590], ax
mov r8d, 0xd
cmp ecx, 0x1f6
cmovne r8, rdx
lea rax, str.Unblock
lea rdx, str.Auto_unblock
cmovne rdx, rax
lea rcx, [rbp + 0x590]
call fcn.1400739a0
lea rbx, [rsi + 0x110]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14011a653
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rbp + 0x590]
call fcn.140073720
call fcn.1400d5880
mov r11, rax
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
lea r9, [rbp + 0x590]
cmp qword [rbp + 0x5a8], 8
cmovae r9, qword [rbp + 0x590]
lea r10, [rbp + 0x448]
cmp qword [rbp + 0x460], 8
cmovae r10, qword [rbp + 0x448]
cmp qword [rbx + 0x18], 8
jb 0x14011a6aa
mov rbx, qword [rbx]
mov rcx, rsi
call fcn.14011e720
mov r8d, r12d
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rbx
mov r9d, 0x38f
movzx edx, ax
mov rcx, r11
mov rax, rdi
call qword [case.0x1401cd220.0]
nop
lea rcx, [rbp + 0x590]
call fcn.140073b90
call fcn.14011c100
mov qword [rbp + 0x4c8], rax
mov eax, dword [rsi + 0x20]
mov dword [rsp + 0x68], eax
lea rbx, [rsi + 0x58]
lea r8, [rsi + 0x158]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.140082c50
movzx r14d, byte [rsi + 0x154]
mov ecx, dword [rsi + 0x20]
call fcn.1401cb9c0
test al, al
je 0x14011a7f9
xor edx, edx
mov cl, 1
call fcn.1401d3b80
mov rdi, rax
xor r12d, r12d
test rax, rax
je 0x14011a7fc
mov qword [rbp + 0x408], r12
mov eax, 8
mov dword [rbp + 0x444], eax
lea rcx, [0x140686990]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rax, [rbp + 0x444]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x408]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.TotalUserAlerts
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x408]
test eax, eax
cmovne rcx, r12
mov qword [rbp + 0x408], rcx
inc dword [rbp + 0x408]
test r14b, r14b
je 0x14011a7b3
inc dword [rbp + 0x40c]
mov eax, 8
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x408]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.TotalUserAlerts
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140686990]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14011a7fc
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x4a8], xmm0
lea rax, vtable.AlertCollaterals.0
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x4b0], r12
mov qword [rbp + 0x4b8], r12
lfence
mov ecx, 0x30
call fcn.1403590cc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x4b0], rax
mov ecx, dword [rsi + 0x20]
mov rdi, qword [rbp + 0x4c8]
cmp ecx, 0x1f5
jg 0x14011a89b
je 0x14011aaec
test ecx, ecx
je 0x14011ab0e
sub ecx, 1
je 0x14011ab0e
sub ecx, 9
je 0x14011a885
sub ecx, 0xa
je 0x14011a885
cmp ecx, 0x51
je 0x14011ab0e
jmp 0x14011a8d0
call fcn.140109600
cmp eax, 4
jne 0x14011ab0e
xor r8d, r8d
jmp 0x14011ab03
mov edx, ecx
sub edx, 0x1f6
je 0x14011aaec
sub edx, 0x30
je 0x14011a885
sub edx, 0xa
je 0x14011a885
sub edx, 0xa
je 0x14011ab0e
cmp edx, 0x14a
je 0x14011ab0e
cmp ecx, 0x1f7
je 0x14011a8df
lea rdx, [rbp + 0x4a8]
mov rcx, rsi
call fcn.140075190
call fcn.140109600
sub eax, 3
je 0x14011a8f3
sub eax, 1
je 0x14011a8f3
cmp eax, 1
jne 0x14011a8fb
mov rcx, rsi
call fcn.1400cd990
mov r9d, dword [rsi + 0x20]
mov dword [rsp + 0x58], r9d
cmp dword [0x14067635c], 0
jne 0x14011a947
mov rcx, qword [str.0cg_]
lea r14, str.0cg_
cmp rcx, r14
je 0x14011a9a8
test byte [rcx + 0x1c], 1
je 0x14011a9a8
cmp byte [rcx + 0x19], 4
jb 0x14011a9a8
mov edx, 0xd
lea r8, [0x1405f33e0]
mov rcx, qword [rcx + 0x10]
call fcn.140082b10
jmp 0x14011a9a1
mov ecx, r9d
call fcn.1401cb9c0
test al, al
je 0x14011a99a
cmp r9d, 0x1f7
je 0x14011a99a
lea rdx, [rsp + 0x58]
lea rcx, [0x1406878c8]
call fcn.140083380
mov edx, dword [0x14067635c]
cmp dword [rax], edx
jb 0x14011a99a
lea rdx, [rsp + 0x58]
lea rcx, [0x1406878c8]
call fcn.140083380
xor edx, edx
mov eax, dword [rax]
div dword [0x14067635c]
test edx, edx
jne 0x14011aa9c
lea r14, str.0cg_
mov rcx, qword [str.0cg_]
mov r9d, dword [rsi + 0x20]
mov dword [rsp + 0x5c], r9d
cmp dword [0x140676358], 0
jne 0x14011aa3f
cmp rcx, r14
je 0x14011a9f6
test byte [rcx + 0x1c], 1
je 0x14011a9f6
cmp byte [rcx + 0x19], 4
jb 0x14011a9f6
cmp qword [rbx + 0x18], 8
jb 0x14011a9d9
mov rbx, qword [rbx]
mov edx, 0xe
mov dword [rsp + 0x20], r9d
mov r9, rbx
lea r8, [0x1405f33e0]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
lea r8, [rbp + 0x118]
lea rdx, [rbp + 0x4a8]
mov rcx, rsi
call fcn.1400eff80
call fcn.140109600
sub eax, 3
je 0x14011aa24
sub eax, 1
je 0x14011aa24
cmp eax, 1
jne 0x14011ab15
mov r8b, 1
mov rdx, rdi
mov rcx, rsi
call fcn.1400ccee0
mov rcx, rsi
call fcn.1400cd330
jmp 0x14011ab15
mov ecx, r9d
call fcn.1401cb9c0
test al, al
je 0x14011a9f6
cmp r9d, 0x1f7
je 0x14011a9f6
lea rdx, [rsp + 0x5c]
call fcn.1400831f0
mov rdx, rbx
mov rcx, rax
call fcn.1400830c0
mov ecx, dword [0x140676358]
cmp dword [rax], ecx
jb 0x14011a9f6
lea rdx, [rsp + 0x5c]
call fcn.1400831f0
mov rdx, rbx
mov rcx, rax
call fcn.1400830c0
xor edx, edx
mov eax, dword [rax]
div dword [0x140676358]
test edx, edx
je 0x14011a9f6
jmp 0x14011aaa3
lea r14, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, r14
je 0x14011aa0c
test byte [rcx + 0x1c], 1
je 0x14011aa0c
cmp byte [rcx + 0x19], 4
jb 0x14011aa0c
mov eax, dword [rsi + 0x24]
mov ebx, dword [rsi + 0x20]
mov edx, 0x1f
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
mov r9d, dword [rsi + 0x30]
mov rcx, qword [rcx + 0x10]
call fcn.140115540
jmp 0x14011aa0c
call fcn.140109600
sub eax, 3
je 0x14011ab00
sub eax, 1
je 0x14011ab00
cmp eax, 1
jne 0x14011ab0e
mov r8b, 1
mov rdx, rdi
mov rcx, rsi
call fcn.1400ccee0
lea r14, str.0cg_
mov ecx, 0x98
call fcn.1400fb220
test al, al
jne 0x14011ab8b
mov qword [rbp - 0x40], r12
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp - 0x30], xmm0
mov r8d, 0x1a
lea rdx, str.HMPA_DUMP_SERVICE_ON_ALERT
lea rcx, [rbp - 0x40]
call fcn.1400739a0
or r13d, 1
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x1170]
call fcn.14035c350
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
mov r8d, 0x64
lea rdx, [rbp + 0x1170]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x14011ab8b
xor bl, bl
jmp 0x14011ab8d
mov bl, 1
test r13b, 1
je 0x14011ab9c
lea rcx, [rbp - 0x40]
call fcn.140073b90
test bl, bl
je 0x14011ac15
mov qword [rbp + 0x20], r12
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r12w
xor r8d, r8d
lea rdx, [0x1405e4f00]
lea rcx, [rbp + 0x20]
call fcn.1400739a0
nop
mov qword [rbp + 0x40], r12
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r12w
xor r8d, r8d
lea rdx, [0x1405e4f00]
lea rcx, [rbp + 0x40]
call fcn.1400739a0
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.1401efdb0
nop
lea rcx, [rbp + 0x40]
call fcn.140073b90
nop
lea rcx, [rbp + 0x20]
call fcn.140073b90
mov eax, dword [rsi + 0x20]
cmp eax, 0x64
jne 0x14011ac2d
mov ecx, dword [rsi + 0x30]
cmp ecx, 4
jbe 0x14011ac34
call fcn.1400e3ed0
mov eax, dword [rsi + 0x20]
cmp eax, 0x384
je 0x14011ac9d
cmp byte [rsi + 0x154], 0
jne 0x14011ac5c
mov eax, dword [rsi + 0x158]
shr eax, 4
test al, 1
je 0x14011ac5c
mov ecx, 0xc
call fcn.1400fb220
test al, al
je 0x14011ad02
mov ecx, dword [rsi + 0x20]
call fcn.1401cb9c0
test al, al
je 0x14011ad02
mov rcx, qword [str.0cg_]
cmp rcx, r14
je 0x14011ac9d
test byte [rcx + 0x1c], 1
je 0x14011ac9d
cmp byte [rcx + 0x19], 4
jb 0x14011ac9d
mov edx, 0x20
mov r9d, dword [rsi + 0x30]
lea r8, [0x1405fa6c0]
mov rcx, qword [rcx + 0x10]
call fcn.140082b10
mov bl, 1
lea rcx, [rbp + 0x4a8]
call fcn.1401153f0
nop
lea rcx, [rbp + 0x5d0]
call fcn.140073b90
nop
lea rcx, [rbp + 0x448]
call fcn.140073b90
movzx eax, bl
mov rcx, qword [rbp + 0x1240]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x1370]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp dword [rsi + 0x20], 0x1f4
jne 0x14011ad1d
call fcn.1401d61d0
test al, al
je 0x14011ad1d
cmp byte [rsi + 0x155], 0
jne 0x14011ac9d
mov qword [rbp + 0x270], rdi
mov rdx, rsi
lea rcx, [rbp + 0x278]
call fcn.14011f450
nop
mov rdi, qword [0x1406880e0]
mov rax, qword [rdi + 8]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x60], r12d
mov rcx, rdi
mov rdx, qword [rbp + 0x270]
cmp byte [rax + 0x19], 0
jne 0x14011ad87
nop word [rax + rax]
mov qword [rbp - 0x68], rax
cmp qword [rax + 0x20], rdx
jae 0x14011ad74
mov dword [rbp - 0x60], r12d
mov rax, qword [rax + 0x10]
jmp 0x14011ad81
mov dword [rbp - 0x60], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14011ad60
cmp byte [rcx + 0x19], 0
jne 0x14011ad97
cmp rdx, qword [rcx + 0x20]
jae 0x14011ae24
movabs rax, 0xa72f05397829cb
cmp qword [0x1406880e8], rax
je 0x14011aebe
lea r14, [0x1406880e0]
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], r12
lfence
mov ecx, 0x188
call fcn.1403590cc
mov rbx, rax
mov qword [rbp + 0x88], rax
mov rcx, qword [rbp + 0x270]
mov qword [rax + 0x20], rcx
lea rcx, [rax + 0x28]
lea rdx, [rbp + 0x278]
call fcn.14011f450
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
movups xmm0, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0x120], xmm0
mov r8, rbx
lea rdx, [rbp + 0x120]
mov rcx, r14
call fcn.140070e40
nop
lea rcx, [rbp + 0x278]
call fcn.14006b020
cmp dword [rsp + 0x60], 4
je 0x14011ae48
lea rdx, [rbp + 0x4c8]
call fcn.14011eac0
jmp 0x14011ac9d
mov ecx, dword [rsi + 0x2c]
call fcn.14011cc10
test al, al
je 0x14011ac9d
mov qword [rbp + 0x5f0], r12
movdqa xmm0, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x600], xmm0
mov word [rbp + 0x5f0], r12w
lea rcx, [rbp + 0x5f0]
call fcn.140117160
test al, al
je 0x14011aeab
lea rdx, [rbp + 0x5f0]
mov ecx, dword [rsi + 0x2c]
call fcn.140117350
test al, al
je 0x14011aeab
lea rcx, [rbp + 0x5f0]
call fcn.140073b90
jmp 0x14011ac9d
lea rcx, [rbp + 0x5f0]
call fcn.140073b90
xor bl, bl
jmp 0x14011ac9f
call fcn.140071a80
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.1400737a0
nop
call fcn.1400737a0
int3
call fcn.1400737a0
int3
call fcn.1400737a0
nop
call fcn.1400737a0
nop
call fcn.1400737a0
int3