Function at 0x140071f10
Capabilities:
Create process on windows
Create process suspended
Delete file
Persist via run registry key

Disassembly:
push rbp
push r12
push r13
lea rbp, [rsp - 0x5c40]
mov eax, 0x5d40
call fcn.14024c240
sub rsp, rax
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x5d60], rbx
mov qword [rsp + 0x5d68], rsi
mov qword [rsp + 0x5d70], rdi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rbp + 0x5c30], rax
xor r8d, r8d
lea rdx, str.CBaseFuncSub::FS_ExecuteGetDevInfo
lea rcx, [rsp + 0x50]
call fcn.1400075a0
nop
xor edi, edi
call fcn.140102a14
mov r11, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x140071f92
mov ecx, 0x80004005
call fcn.140005210
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x80], rbx
mov ecx, 0x9d
call fcn.1401027e8
test rax, rax
je 0x140071fc8
mov r8d, 0x9d
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140005b00
mov rbx, qword [rbp - 0x80]
mov rcx, qword [0x1403b9760]
mov rax, qword [rcx]
xor r8d, r8d
mov edx, 0x3f2
call qword [rax + 0x28]
mov rcx, qword [0x1403b9760]
mov rax, qword [rcx]
mov r8, rbx
mov edx, 0x3f2
call qword [rax + 0x38]
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0xc30]
call fcn.14024b970
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x20]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x430]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1430]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x2c30]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x3c30]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x4430]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x4c30]
call fcn.14024b970
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x220]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1c30]
call fcn.14024b970
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x2430]
call fcn.14024b970
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x50]
call fcn.14024b970
mov dword [rbp - 0x50], 0x68
mov r13d, 1
mov word [rbp - 0x10], r13w
mov dword [rbp - 0x14], r13d
mov qword [rsp + 0x60], rdi
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0xc30]
lea rdx, str.ProgramFilesFolder
mov rcx, rax
call qword [r9 + 0x18]
lea r9, str.CanonGetDev
lea r8, [rbp + 0xc30]
lea rdx, [0x1402e3978]
lea rcx, [rbp + 0xc30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, str.GetDevInfo.exe
lea r8, [rbp + 0xc30]
lea rdx, [0x1402dd6b0]
lea rcx, [rbp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0xc30]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x5430]
lea rdx, str.RebootYesNo
mov rcx, rax
call qword [r9 + 0x18]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x3c30]
lea rdx, str.DYNLEVEL
mov rcx, rax
call qword [r9 + 0x18]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x4430]
lea rdx, str.GETDEVLEVEL
mov rcx, rax
call qword [r9 + 0x18]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x2c30]
lea rdx, str.UILevel
mov rcx, rax
call qword [r9 + 0x18]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x4c30]
lea rdx, [0x1402dda38]
mov rcx, rax
call qword [r9 + 0x18]
lea rcx, [rbp + 0x4430]
call fcn.14024740c
mov esi, eax
lea r9, [rbp + 0x4c30]
lea r8, str._t_t_tDDI_s_
lea edx, [r13 + 6]
lea rcx, [rsp + 0x50]
call fcn.140007780
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x3430]
call fcn.14024b970
mov rcx, qword [0x1403b9750]
mov rdx, qword [rcx]
call qword [rdx + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x3430]
lea rdx, str.SILENTREBOOT
mov rcx, rax
call qword [r9 + 0x18]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [0x1402e3828]
lea rdx, str.GETDEVREBOOT
mov rcx, rax
call qword [r9 + 0x20]
lea r8, str._t_t_t____________________
lea edx, [r13 + 6]
lea rcx, [rsp + 0x50]
call fcn.140007780
lea r9, [rbp + 0x3430]
lea r8, str._t_t_tSILENTREBOOT_s_
lea edx, [r13 + 6]
lea rcx, [rsp + 0x50]
call fcn.140007780
lea r9, [rbp + 0x2c30]
lea r8, str._t_t_tUILevel_s_
lea edx, [r13 + 6]
lea rcx, [rsp + 0x50]
call fcn.140007780
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x1c30]
lea rdx, str.GETDEVININAME
mov rcx, rax
call qword [r9 + 0x18]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rbp + 0x2430]
lea rdx, str.GETDEVRUNONCEVALUENAME
mov rcx, rax
call qword [r9 + 0x18]
lea rdx, [0x1402e5094]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x1c30]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test esi, esi
jne 0x1400723c0
lea r8, str._t_t_tGETDEVLEVEL_is_0
lea edx, [rsi + 7]
lea rcx, [rsp + 0x50]
call fcn.140007780
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rsi + 2]
lea rcx, [rsp + 0x50]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400723bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140072d58
cmp esi, r13d
jl 0x140072ce9
cmp word [rbp + 0x3430], 0x30
jne 0x14007275b
cmp word [rbp + 0x2c30], 0x32
jne 0x140072769
mov rcx, qword [0x1403b9758]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x170]
cmp eax, 0xffffffff
je 0x14007275b
cmp esi, r13d
jne 0x140072466
cmp word [rbp + 0x4c30], 0x59
je 0x140072466
lea r8, str._t_t_tCase_dont_Dynamic_Silent__for_DynamicLevel1
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x50]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140072461
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140072d58
lea r8, str._t_t_tSilent_GetDeviceInfo_Execute__
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
lea r9, [rbp + 0x1c30]
lea r8, [rbp + 0xc30]
lea rdx, str.__s__s_s
lea rcx, [rbp + 0x430]
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 4
call fcn.140245848
mov r12, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4000020
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140072528
or edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, r12
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1403b9768]
mov r9d, 0xf003f
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rax, qword [rcx]
cmp dword [r12], 0
je 0x14007268a
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x20], rdx
mov rdx, 0xffffffff80000002
call qword [rax + 0xf0]
test eax, eax
je 0x140072575
lea rdx, str._t_t_tRegOpenKeyEx
lea rcx, [rsp + 0x50]
call fcn.140029dc0
lea r9, [rbp + 0x1c30]
lea r8, [rbp + 0xc30]
lea rdx, str.__1__s_s
lea rcx, [rbp + 0x430]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rbp + 0x430]
lea r8, str._t_t_tCmdLine_s_
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
lea r9, [rbp + 0x430]
lea r8, [rbp + 0x20]
lea rdx, str._s__s
lea rcx, [rbp + 0x1430]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdi, qword [0x1403b9768]
mov rsi, qword [rdi]
lea rcx, [rbp + 0x1430]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1430]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rbp + 0x2430]
mov rdx, qword [rbp - 0x60]
mov rcx, rdi
call qword [rsi + 0x110]
test eax, eax
je 0x14007262a
lea rdx, str._t_t_tRegSetValueEx
lea rcx, [rsp + 0x50]
call fcn.140029dc0
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
mov rdx, qword [rbp - 0x60]
call qword [rax + pe_nt_image_headers64]
mov esi, eax
mov rcx, qword [0x1403b9770]
mov r8, qword [rcx]
mov edx, 0xa0
call qword [r8 + 0x18]
mov edi, 0x80010040
mov dword [0x1403b95bc], 0x40
mov rcx, qword [0x1403b9750]
mov r8, qword [rcx]
call qword [r8 + 0x48]
mov r9, qword [rax]
lea r8, [0x1402e2d90]
lea rdx, str.GETDEVREBOOT
mov rcx, rax
call qword [r9 + 0x20]
jmp 0x1400726f3
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x20], rdx
mov rdx, 0xffffffff80000002
call qword [rax + 0xf0]
mov esi, eax
test eax, eax
jne 0x1400726d5
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea r8, [rbp + 0x2430]
mov rdx, qword [rbp - 0x78]
call qword [rax + 0x120]
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
mov rdx, qword [rbp - 0x78]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str._t_t_tDeleteFile
lea rcx, [rsp + 0x50]
call fcn.140029dc0
mov rcx, r12
call fcn.140245808
mov r9d, edi
lea r8, str.instRes___08x
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
mov r9d, esi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007274a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x50]
call fcn.140007730
mov eax, esi
jmp 0x140072d64
cmp word [rbp + 0x2c30], 0x32
je 0x140072b1b
mov rcx, qword [0x1403b9758]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x170]
cmp eax, 0xffffffff
je 0x140072b1b
cmp esi, r13d
jne 0x1400727ea
cmp word [rbp + 0x3c30], 0x30
jne 0x1400727ea
lea r8, str._t_t_tGETDEVLEVEL1_DYNLEVEL0.
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x50]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400727e5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140072d58
lea r8, str._t_t_tNormal_GetDeviceInfo_Execute__
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
lea r9, [rbp + 0x1c30]
lea r8, [rbp + 0xc30]
lea rdx, str.__s__s_s
lea rcx, [rbp + 0x430]
call qword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 4
call fcn.140245848
mov r12, rax
test rax, rax
je 0x140072a19
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xc30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4000020
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400728b5
or edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, r12
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [r12], 0
je 0x140072a19
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, 0xf003f
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rdx, 0xffffffff80000002
call qword [rax + 0xf0]
test eax, eax
je 0x140072902
lea rdx, str._t_t_tRegOpenKeyEx
lea rcx, [rsp + 0x50]
call fcn.140029dc0
lea r9, [rbp + 0x1c30]
lea r8, [rbp + 0xc30]
lea rdx, str.__1__s_s
lea rcx, [rbp + 0x430]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rbp + 0x430]
lea r8, str._t_t_tCmdLine_s_
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
lea r9, [rbp + 0x430]
lea r8, [rbp + 0x20]
lea rdx, str._s__s
lea rcx, [rbp + 0x1430]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdi, qword [0x1403b9768]
mov rsi, qword [rdi]
lea rcx, [rbp + 0x1430]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1430]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rbp + 0x2430]
mov rdx, qword [rbp - 0x70]
mov rcx, rdi
call qword [rsi + 0x110]
test eax, eax
je 0x1400729b7
lea rdx, str._t_t_tRegSetValueEx
lea rcx, [rsp + 0x50]
call fcn.140029dc0
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
mov rdx, qword [rbp - 0x70]
call qword [rax + pe_nt_image_headers64]
mov esi, eax
mov rcx, qword [0x1403b9770]
mov r8, qword [rcx]
mov edx, 0xa0
call qword [r8 + 0x18]
mov edi, 0x80010040
mov dword [0x1403b95bc], 0x40
mov rcx, qword [0x1403b9750]
mov rdx, qword [rcx]
call qword [rdx + 0x48]
mov r9, qword [rax]
lea r8, [0x1402e2d90]
lea rdx, str.GETDEVREBOOT
mov rcx, rax
call qword [r9 + 0x20]
jmp 0x140072a99
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x20], rdx
mov r9d, 0xf003f
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rdx, 0xffffffff80000002
call qword [rax + 0xf0]
mov esi, eax
test eax, eax
jne 0x140072a7b
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea r8, [rbp + 0x2430]
mov rdx, qword [rbp - 0x68]
call qword [rax + 0x120]
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
mov rdx, qword [rbp - 0x68]
call qword [rax + pe_nt_image_headers64]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str._t_t_tDeleteFile
lea rcx, [rsp + 0x50]
call fcn.140029dc0
mov rcx, r12
call fcn.140245808
test esi, esi
je 0x140072abb
lea r8, str._t_t_tRegistry_Process_error.
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
mov r9d, edi
lea r8, str.instRes___08x
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
mov r9d, esi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140072b0a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x50]
call fcn.140007730
mov eax, esi
jmp 0x140072d64
mov rcx, qword [0x1403b9758]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x170]
cmp eax, 0xffffffff
je 0x140072ce9
cmp word [rbp + 0x3430], 0x31
jne 0x140072ce9
cmp esi, r13d
jne 0x140072bb4
cmp word [rbp + 0x3c30], 0x30
jne 0x140072bb4
cmp word [rbp + 0x2c30], 0x32
je 0x140072bb4
lea r8, str._t_t_tDynamic__DYNLEVEL0.
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x50]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140072baf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x140072d58
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
mov r9d, 0xf003f
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rdx, 0xffffffff80000002
call qword [rax + 0xf0]
test eax, eax
je 0x140072bf7
lea rdx, str._t_t_tRegOpenKeyEx
lea rcx, [rsp + 0x50]
call fcn.140029dc0
lea r9, [rbp + 0x1c30]
lea r8, [rbp + 0xc30]
lea rdx, str.__1__s_s
lea rcx, [rbp + 0x430]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rbp + 0x430]
lea r8, str._t_t_tCmdLine_s_
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
lea r9, [rbp + 0x430]
lea r8, [rbp + 0x20]
lea rdx, str._s__s
lea rcx, [rbp + 0x1430]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdi, qword [0x1403b9768]
mov rsi, qword [rdi]
lea rcx, [rbp + 0x1430]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1430]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea r8, [rbp + 0x2430]
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call qword [rsi + 0x110]
test eax, eax
je 0x140072cad
lea rdx, str.RegSetValueEx
lea rcx, [rsp + 0x50]
call fcn.140029dc0
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x78]
call qword [rax + pe_nt_image_headers64]
mov edi, eax
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [0x1402e2d90]
lea rdx, str.GETDEVREBOOT
mov rcx, rax
call qword [r9 + 0x20]
lea rax, [rbp + 0x1430]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x430]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str._t_t_tbRet_d_szGetDevExe_s_szCmdLine_s_szRunOnce_s
mov edx, 7
lea rcx, [rsp + 0x50]
call fcn.140007780
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x50]
call fcn.140007780
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140072d58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x50]
call fcn.140007730
xor eax, eax
mov rcx, qword [rbp + 0x5c30]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x5d40]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret