Function at 0x140005480
Capabilities:
Block operations on executable memory pages using arbitrary code guard
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x500
mov qword [rax - 0x470], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1400c5228]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rcx, qword [0x1400c5c50]
xor esi, esi
lea rax, [0x140028f90]
test rcx, rcx
jne 0x14003428c
mov qword [0x1400c5c50], rax
mov r14d, 1
mov dword [rsp + 0x68], r14d
lea ebx, [r14 + 3]
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea ecx, [rbx - 2]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
mov dword [rsp + 0x48], r14d
mov r8d, ebx
lea rdx, [rsp + 0x48]
lea ecx, [rbx + 4]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
mov dword [rsp + 0x60], 2
mov r8d, ebx
lea rdx, [rsp + 0x60]
lea r15d, [r14 + 8]
mov ecx, r15d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
mov dword [rsp + 0x50], r14d
mov r8d, ebx
lea rdx, [rsp + 0x50]
lea ecx, [rbx + 6]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
mov r12d, esi
mov dword [rsp + 0x48], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
js 0x1400342b8
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
mov rdi, rsi
mov qword [rsp + 0x78], rsi
call fcn.140005cc8
test al, al
je 0x140005701
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, str.SOFTWAREMicrosoftWindows_SearchGatherWindowsSystemIndexProtocols
mov rcx, 0xffffffff80000002
call fcn.14000b3e8
test eax, eax
jne 0x140005701
mov r15d, 0xff
mov ebx, esi
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
lea r8, [rsp + 0xe0]
mov edx, ebx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400056f5
mov rcx, r15
lea rax, [rsp + 0xe0]
cmp word [rax], si
je 0x140005609
add rax, 2
sub rcx, r14
jne 0x1400055fb
test rcx, rcx
je 0x1400342c2
mov rax, r15
sub rax, rcx
test rcx, rcx
je 0x140005673
mov rdx, r15
sub rdx, rax
lea rcx, [rsp + 0xe0]
lea rcx, [rcx + rax*2]
je 0x140005665
lea r8, [rax + 0x7ffffeff]
add r8, rdx
lea rax, [0x140093f3c]
sub rax, rcx
test r8, r8
je 0x140005665
movzx r9d, word [rcx + rax]
test r9w, r9w
je 0x140005665
mov word [rcx], r9w
add rcx, 2
sub r8, r14
sub rdx, r14
jne 0x140005645
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [rsp + 0xe0]
mov rcx, qword [rsp + 0x58]
call fcn.14000b3e8
test eax, eax
jne 0x1400056ed
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x68], r14d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.ProgIdHandler
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400056e2
lea rcx, [rsp + 0x2e0]
call fcn.140005c30
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
add ebx, r14d
jmp 0x1400055b5
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
cmp dword [0x1400c61d0], esi
jne 0x1400342ca
call fcn.140004030
test byte [0x1400c7702], 8
jne 0x140005c06
test byte [0x1400c7701], 8
jne 0x140034ab5
call fcn.14001ea24
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14001ffc0]
lea rcx, [0x1400c5f00]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x1400c5c78], sil
jne 0x140034ad7
mov byte [rsp + 0x61], r14b
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
call fcn.140025d08
nop
lea rcx, [rsp + 0xe0]
call fcn.1400210f0
nop
lea rcx, [rsp + 0x58]
call fcn.140020660
nop
lea rcx, [rsp + 0x70]
call fcn.14002062c
nop
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
test eax, eax
js 0x140034ae2
lea rdx, [rsp + 0x2e0]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
je 0x140034b57
lea rcx, [rsp + 0xe0]
call fcn.140004068
mov byte [rsp + 0x40], sil
mov ebx, 0xc0100000
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.140025820
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.140025820
mov rbx, qword [rsp + 0x68]
mov r8, rbx
lea rcx, [rsp + 0xe0]
call fcn.140021160
mov dword [rsp + 0x88], SafeArrayPutElement
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], esi
mov r15d, esi
cmp r15d, 0xf
jae 0x140005906
lea r8, str.SearchServiceMUT
mov edx, r14d
lea rcx, [rsp + 0x88]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rdx, rax
lea rcx, [0x1400c5f98]
call fcn.14000adc4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r13d, eax
mov rcx, qword [0x1400c5f98]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140034bc9
test eax, eax
jne 0x140034bc9
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000591e
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140005936
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.140020eb4
nop
mov rcx, rbx
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
lea rcx, [rsp + 0x68]
call fcn.140004378
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140034ca8
cmp dword [rsp + 0x68], 2
jne 0x1400059ba
mov ebx, r14d
cmp ebx, dword [rsp + 0x68]
jge 0x1400059ba
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
movzx eax, word [rcx]
sub ax, 0x2d
mov edx, 0xfffd
test dx, ax
jne 0x140034cb5
add rcx, 2
lea rdx, str.Embedding
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140034cc2
add ebx, r14d
jmp 0x14000597a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov ebx, eax
mov dword [rsp + 0x50], eax
mov r15d, eax
mov rcx, qword [rsp + 0x518]
test eax, eax
js 0x140034ccf
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x1400950b8]
mov r8d, r14d
xor edx, edx
lea rcx, [0x1400967d8]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x518]
test eax, eax
js 0x140034d09
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140005a44
mov rax, qword [rcx]
mov r8, r14
mov edx, 5
mov rax, qword [rax + 0x18]
call qword [case.0x140002c98.0]
mov rcx, qword [rsp + 0x518]
test eax, eax
js 0x140034d23
call fcn.140021184
mov r15d, eax
mov rcx, qword [rsp + 0x518]
test eax, eax
js 0x140034d3d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140005a73
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140002c98.0]
test r15d, r15d
js 0x140034ce3
mov bl, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x94], xmm0
mov dword [rsp + 0xa4], esi
mov r13d, 3
mov dword [rsp + 0x90], r13d
lea rax, str.AllowWindowsIndexer
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0xd0], xmm1
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140018384
test eax, eax
je 0x140034cfb
mov dl, bl
call fcn.1400045b8
mov rbx, qword [0x1400c7378]
test rbx, rbx
je 0x140034d60
cmp qword [rbx], rsi
je 0x140034d60
mov rax, qword [rbx + 0x38]
call qword [case.0x140002c98.0]
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14002b7d8
test eax, eax
js 0x140005b33
xor ecx, ecx
mov rax, qword [rbx + 8]
call qword [case.0x140002c98.0]
test eax, eax
jns 0x140034d57
mov rcx, qword [rsp + 0x518]
test eax, eax
jns 0x140005b53
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x194
call fcn.14002af2c
mov dword [rsp + 0x50], r13d
lea rcx, [rsp + 0x50]
call fcn.140028cf8
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
call qword [sym.imp.MSSRCH.DLL_public:_static_void___cdecl_CSearchServiceObj::Cleanup_void_]
mov byte [rsp + 0x40], r14b
lea rdx, [rsp + 0x40]
call fcn.140028e60
test byte [0x1400c7701], 8
jne 0x140034df1
test byte [0x1400c7702], 8
jne 0x140034e13
call fcn.14002bec4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
cmp byte [rsp + 0x61], sil
je 0x140005bbb
mov ecx, dword [0x1400c52a0]
cmp ecx, 0xffffffff
jne 0x140034e2c
test rdi, rdi
je 0x140005bd1
mov rcx, rdi
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
mov eax, r12d
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.14002c960
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rdx, [0x1400939e0]
lea rcx, [0x1400c4a30]
call fcn.14002bbc8
jmp 0x14000571f
cmp rcx, rax
je 0x1400054d6
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [rsp + 0xe0]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xe0]
call fcn.140043890
int3
mov eax, 0x800401f0
jmp 0x140005bd4
mov rax, rsi
jmp 0x140005618
lea r8, [0x1400c47f8]
mov rdx, qword [str.SrchCommon]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4600]
mov rdx, qword [str.SrchCIDSO]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c48e8]
mov rdx, qword [str.SrchCollator]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4870]
mov rdx, qword [str.SrchCollatorAdmin]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4888]
mov rdx, qword [str.SrchCollatorCatalogInfo]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4678]
mov rdx, qword [str.SrchCollatorCommand]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c48a0]
mov rdx, qword [str.pv_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4588]
mov rdx, qword [str.SrchCollatorCxn]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4948]
mov rdx, qword [str._v_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c47b0]
mov rdx, qword [str.Xv_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c45a0]
mov rdx, qword [str.SrchCollatorQuery]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4978]
mov rdx, qword [str.SrchCollatorRowset]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4618]
mov rdx, qword [str.SrchDatasource]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4630]
mov rdx, qword [str.SrchDSSQuery]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4738]
mov rdx, qword [str.SrchDSSConnection]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c46f0]
mov rdx, qword [str.0w_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4660]
mov rdx, qword [str.SrchDSSConnectionManager]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4930]
mov rdx, qword [str._bw_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c47c8]
mov rdx, qword [str._w_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4690]
mov rdx, qword [str.pw_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4720]
mov rdx, qword [str.SrchPHHttp]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c46c0]
mov rdx, qword [str.Pw_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c46a8]
mov rdx, qword [str.SrchPHSts]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4990]
mov rdx, qword [str.SrchPHMatrix]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c46d8]
mov rdx, qword [str.SrchPropertyDefs]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c47e0]
mov rdx, qword [str.SrchPropertyStore]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c48b8]
mov rdx, qword [str.SrchFilterDaemon]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4a08]
mov rdx, qword [str.SrchPHFile]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4540]
mov rdx, qword [str.SrchGatherPI]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c45b8]
mov rdx, qword [str._x_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c49a8]
mov rdx, qword [str.Px_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4828]
mov rdx, qword [str.SrchGatherDestruction]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4570]
mov rdx, qword [str.SrchGatherDirMon]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4708]
mov rdx, qword [str.SrchGatherHistoryHash]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4780]
mov rdx, qword [str.hx_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c45e8]
mov rdx, qword [str.SrchSimplePI]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c49d8]
mov rdx, qword [str.SrchSamplePI]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c48d0]
mov rdx, qword [str.SrchGatherPropMapper]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4918]
mov rdx, qword [str.SrchCscorePI]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4858]
mov rdx, qword [str.SrchCIWrapper]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c49c0]
mov rdx, qword [str._y_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4558]
mov rdx, qword [str.SrchIndexerProperties]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c49f0]
mov rdx, qword [str.SrchIndexerPlugin]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4840]
mov rdx, qword [str.SrchIndexerClient]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4960]
mov rdx, qword [str.xy_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4798]
mov rdx, qword [str.SrchAdmin]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4750]
mov rdx, qword [str.Py_t_]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4810]
mov rdx, qword [str.SrchXMLFilter]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4900]
mov rdx, qword [str.SrchSTRFilter]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4648]
mov rdx, qword [str.DaemonTest]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4a20]
mov rdx, qword [str.MSSearch_DAV]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c4768]
mov rdx, qword [str.SrchCluster]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
cmp dword [0x1400c61d0], esi
je 0x14000570d
lea r8, [0x1400c45d0]
mov rdx, qword [str.SrchServiceObj]
mov rcx, qword [0x1400c61f0]
call fcn.14005807c
nop
jmp 0x14000570d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x1400a2e28]
lea rcx, [0x1400c4a30]
call fcn.14004d0e0
nop
jmp 0x14000572c
call fcn.1400500ac
nop
jmp 0x14000576c
mov rcx, qword [rsp + 0x518]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xfa
call fcn.14004a748
mov r12d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140034b19
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140034b31
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.140020eb4
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
jmp 0x140005b6a
mov rcx, qword [rsp + 0x518]
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x104
call fcn.140050450
mov r12d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140034b8b
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140034ba3
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.140020eb4
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
jmp 0x140005b6a
xor edx, edx
lea rcx, [0x1400c5f98]
call fcn.14000adc4
cmp r13d, 0xb7
je 0x140034c37
mov r12d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140034bfb
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140034c13
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.140020eb4
nop
mov rcx, rbx
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
jmp 0x140005b6a
cmp r15d, 0xe
jne 0x140034c95
lea r12d, [r15 - 0xc]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140034c59
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140034c71
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
lea rcx, [rsp + 0xe0]
call fcn.140020eb4
nop
mov rcx, rbx
mov rax, qword [0x14008d258]
call qword [case.0x140002c98.0]
nop
jmp 0x140005b6a
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
add r15d, r14d
jmp 0x1400058b4
mov r12d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140005b6a
mov r12d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140005b6a
mov r12d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140005b6a
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x16f
call fcn.14002af2c
mov r12d, r15d
mov dword [rsp + 0x48], r15d
test ebx, ebx
js 0x140034cf6
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
jmp 0x140005b6a
mov bl, r14b
call fcn.140050034
nop
jmp 0x140005ae6
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x176
call fcn.14002af2c
nop
jmp 0x140005a15
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x179
call fcn.14002af2c
nop
jmp 0x140005a44
mov r9d, r15d
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x17d
call fcn.14002af2c
nop
jmp 0x140005a5c
add rbx, 0x48
jmp 0x140005afd
mov rax, qword [0x1400c77c0]
test rax, rax
je 0x140034d7a
call qword [case.0x140002c98.0]
test eax, eax
js 0x140005b33
mov eax, esi
mov rbx, qword [0x1400c75b0]
mov rcx, qword [0x1400c75b8]
jmp 0x140034dd0
mov r15, qword [rbx]
test r15, r15
je 0x140034dcc
mov rax, qword [r15 + 0x38]
call qword [case.0x140002c98.0]
mov rdx, rax
mov rcx, qword [r15]
call fcn.14002b7d8
test eax, eax
js 0x140005b33
xor ecx, ecx
mov rax, qword [r15 + 8]
call qword [case.0x140002c98.0]
test eax, eax
js 0x140005b33
mov rcx, qword [0x1400c75b8]
add rbx, 8
cmp rbx, rcx
jb 0x140034d8c
jmp 0x140005b33
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x1400a32a8]
lea rcx, [0x1400c4a30]
call fcn.14004d0e0
nop
jmp 0x140005b8c
lea rdx, [0x1400a2dd8]
lea rcx, [0x1400c4a30]
call fcn.14002bbc8
nop
jmp 0x140005b99
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop
jmp 0x140005bbb