Function at 0x1400023e0
Capabilities:
Check os version
Copy file
Create directory
Extract resource via kernel32 functions
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5c0
mov rax, qword [0x140072030]
xor rax, rsp
mov qword [rsp + 0x5b0], rax
mov r15, rdx
mov qword [rsp + 0x88], rdx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
cmp ecx, 3
jne 0x140002746
lea rdx, [0x140069e18]
mov rcx, qword [r15 + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140003381
cmp qword [r15 + 8], rbx
je 0x140003381
mov edx, 0x100
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.SecurityHealthSecurityHealthSetup.exe
lea rcx, [rsp + 0xe8]
call fcn.1400043a0
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x1b0]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140002494
movabs r13, 0x7ffffffffffffffe
cmp rdi, r13
ja 0x1400038c2
mov qword [rsp + 0x50], 7
cmp rdi, 8
jae 0x1400024e7
mov qword [rsp + 0x48], rdi
add rdi, rdi
mov r8, rdi
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x38]
call fcn.140031700
mov word [rsp + rdi + 0x38], bx
jmp 0x14000259c
mov rax, rdi
or rax, 7
cmp rax, r13
jbe 0x140002503
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140002535
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140003931
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002561
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003931
mov rcx, rax
call fcn.14002f8a0
test rax, rax
je 0x1400038ce
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002573
test rcx, rcx
je 0x140002570
call fcn.14002f8a0
mov rsi, rax
jmp 0x140002573
mov rsi, rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r13
add rdi, rdi
mov r8, rdi
lea rdx, [rsp + 0x1b0]
mov rcx, rsi
call fcn.140031700
mov word [rsi + rdi], bx
mov r9, r14
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0xc8]
call fcn.140005620
lea rdx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rdx, qword [rsp + 0xc8]
xor r8d, r8d
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete dil
mov rdx, qword [rsp + 0xe0]
cmp rdx, 8
jb 0x140002626
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002621
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038c8
call fcn.14002f8dc
movdqa xmm0, xmmword [0x14006a120]
movdqu xmmword [rsp + 0xd8], xmm0
mov word [rsp + 0xc8], bx
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140002682
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000267c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038ce
call fcn.14002f8dc
nop
mov rdx, qword [rsp + 0x100]
cmp rdx, 8
jb 0x1400026ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038d4
call fcn.14002f8dc
test dil, dil
jne 0x1400038da
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400038e8
mov r8d, 0x100
lea rdx, str.securityhealthservice
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400038f6
lea r8, [rsp + 0x170]
mov edx, 0xca
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14000390f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003893
cmp ecx, 2
jne 0x140003381
mov esi, ebx
lea r14, [0x14006a070]
mov eax, 0xa
mov r8d, eax
mov rdx, qword [r14]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r13d, eax
mov rdx, qword [r15 + 8]
lea rcx, [rsp + 0x130]
call fcn.1400043a0
nop
lea r8, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
setae dl
mov r9, qword [rsp + 0x130]
cmovae r8, r9
mov rax, qword [rsp + 0x140]
lea r15, [r8 + rax*2]
lea rcx, [rsp + 0x130]
test dl, dl
je 0x1400027e3
lea rdi, [r9 + rax*2]
jmp 0x1400027ef
lea rdi, [rcx + rax*2]
lea r9, [rsp + 0x130]
mov r8d, 0x22
mov rdx, rdi
mov rcx, r9
call fcn.14000d250
mov r10, rax
cmp rax, rdi
je 0x14000282b
add rax, 2
cmp rax, rdi
je 0x14000282b
movzx ecx, word [rax]
cmp cx, 0x22
je 0x140002822
mov word [r10], cx
add r10, 2
add rax, 2
cmp rax, rdi
jne 0x140002811
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
setae r8b
cmovae rcx, qword [rsp + 0x130]
mov r9, r10
sub r9, rcx
sar r9, 1
sub r15, r10
sar r15, 1
mov rdi, qword [rsp + 0x140]
mov rax, rdi
sub rax, r9
cmp rax, r15
cmovb r15, rax
lea rax, [rsp + 0x130]
test r8b, r8b
cmovne rax, qword [rsp + 0x130]
lea rcx, [rax + r9*2]
sub rdi, r15
mov r8, rdi
sub r8, r9
lea r8, [r8*2 + 2]
lea rdx, [rcx + r15*2]
call fcn.140031700
mov qword [rsp + 0x140], rdi
mov rdx, qword [r14]
lea rcx, [rsp + 0xe8]
call fcn.1400043a0
mov rdi, rax
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x150]
call fcn.140004ce0
nop
mov r9, rdi
mov r8, rax
lea rcx, [rsp + 0xc8]
call fcn.140005620
or dword [rsp + 0x30], 0x80
mov rdx, qword [rsp + 0x168]
cmp rdx, 8
jb 0x140002933
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000292e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003937
call fcn.14002f8dc
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], 7
mov word [rsp + 0x150], bx
mov rdx, qword [rsp + 0x100]
cmp rdx, 8
jb 0x140002997
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002992
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000393d
call fcn.14002f8dc
lea rdx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rdx, qword [rsp + 0xc8]
lea r8, [0x140069ea0]
lea rcx, [rsp + 0xb8]
call fcn.140036080
mov r9, qword [rsp + 0xb8]
test r9, r9
je 0x1400029f0
mov rdx, r13
mov r8d, 1
mov rcx, r12
call fcn.14003666c
mov rcx, qword [rsp + 0xb8]
call fcn.140036264
mov rdx, qword [rsp + 0xe0]
cmp rdx, 8
jb 0x140002a38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003943
call fcn.14002f8dc
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], 7
mov word [rsp + 0xc8], bx
mov rdx, qword [rsp + 0x148]
cmp rdx, 8
jb 0x140002a9c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003949
call fcn.14002f8dc
inc esi
add r14, 8
cmp esi, 8
jae 0x140002ab4
mov r15, qword [rsp + 0x88]
jmp 0x140002758
mov dword [rsp + 0x78], ebx
mov r15, rbx
mov qword [rsp + 0xb8], rbx
lea r13, [0x140000000]
mov r12d, 0x5c
mov esi, ebx
mov dword [rsp + 0x30], ebx
mov r14, rbx
mov qword [rsp + 0x80], rbx
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [r13 + r15*8 + 0x69f20]
lea rcx, [rsp + 0x110]
call fcn.1400043a0
mov rdi, rax
mov rdx, qword [r13 + r14*8 + 0x69f10]
lea rcx, [rsp + 0x58]
call fcn.1400043a0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 1
jb 0x140002b57
lea r8, [rdx + 1]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 8
jb 0x140002b45
mov rax, qword [rcx]
mov r9d, 0x28
mov word [rax + rdx*2], r9w
mov word [rax + r8*2], bx
jmp 0x140002b76
mov qword [rsp + 0x20], 1
lea r9, [0x140069eac]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.1400058e0
mov rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x170], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x180], xmm1
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 7
mov word [rcx], bx
mov r9, rdi
lea r8, [rsp + 0x170]
lea rcx, [rsp + 0x38]
call fcn.140005620
nop
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140002bee
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 8
cmovae rax, qword [rsp + 0x38]
mov dword [rax + rcx*2], 0x29
lea rax, [rsp + 0x38]
jmp 0x140002c0f
mov qword [rsp + 0x20], 1
lea r9, [0x140069ea8]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x38]
call fcn.1400058e0
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe0], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xc8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xd8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140002c92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000394f
call fcn.14002f8dc
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], bx
mov rdx, qword [rsp + 0x188]
cmp rdx, 8
jb 0x140002cee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003955
call fcn.14002f8dc
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140002d30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000395b
call fcn.14002f8dc
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], bx
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x140002d8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003961
call fcn.14002f8dc
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], bx
lea rdx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rdx, qword [rsp + 0xc8]
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400032fc
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400032fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x90], rax
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 8]
lea rdi, [0x140069eb0]
test rcx, rcx
cmovne rdi, rcx
mov rdx, qword [r13 + r15*8 + 0x69f20]
lea rcx, [rsp + 0x170]
call fcn.1400043a0
mov rsi, rax
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.1400043a0
nop
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rcx, r9
sub rcx, r8
cmp rcx, 1
mov rcx, rax
jb 0x140002e83
lea rdx, [r8 + 1]
mov qword [rax + 0x10], rdx
cmp r9, 8
jb 0x140002e78
mov rcx, qword [rax]
mov word [rcx + r8*2], r12w
mov word [rcx + rdx*2], bx
jmp 0x140002e9f
mov qword [rsp + 0x20], 1
lea r9, [0x140069e9c]
xor r8d, r8d
lea edx, [r8 + 1]
call fcn.1400058e0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xe8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xf8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov r9, rsi
lea r8, [rsp + 0xe8]
lea rcx, [rsp + 0x150]
call fcn.140005620
nop
mov rdx, qword [rsp + 0x100]
cmp rdx, 8
jb 0x140002f27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003967
call fcn.14002f8dc
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x140002f6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000396d
call fcn.14002f8dc
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], bx
mov rdx, qword [rsp + 0x188]
cmp rdx, 8
jb 0x140002fd3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003973
call fcn.14002f8dc
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], 7
mov word [rsp + 0x170], bx
lea rcx, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae rcx, qword [rsp + 0x150]
call fcn.140035f88
test eax, eax
jne 0x1400032b0
mov rdx, qword [r13 + r14*8 + 0x69f10]
lea rcx, [rsp + 0xe8]
call fcn.1400043a0
mov r13, rax
mov r15, qword [rsp + 0x160]
movabs rax, 0x7ffffffffffffffe
mov rcx, rax
sub rcx, r15
cmp rcx, 1
jb 0x140003991
lea r12, [rsp + 0x150]
cmp qword [rsp + 0x168], 8
cmovae r12, qword [rsp + 0x150]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
lea r14, [r15 + 1]
mov edi, 7
lea rsi, [rsp + 0x58]
cmp r14, rdi
jbe 0x140003125
mov rdi, r14
or rdi, 7
cmp rdi, rax
jbe 0x1400030b2
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400030e2
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140003979
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000310e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003979
mov rcx, rax
call fcn.14002f8a0
test rax, rax
je 0x14000397f
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140003120
test rcx, rcx
je 0x14000311d
call fcn.14002f8a0
mov rsi, rax
jmp 0x140003120
mov rsi, rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rdi
lea rdi, [r15 + r15]
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.140031700
mov r12d, 0x5c
mov word [rsi + rdi], r12w
mov word [rsi + r14*2], bx
mov r9, r13
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x110]
call fcn.140005620
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400031aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000397f
call fcn.14002f8dc
nop
mov rdx, qword [rsp + 0x100]
cmp rdx, 8
jb 0x1400031f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003985
call fcn.14002f8dc
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae rdx, qword [rsp + 0x110]
lea r8, [0x140069ea0]
lea rcx, [rsp + 0xc0]
call fcn.140036080
mov r9, qword [rsp + 0xc0]
test r9, r9
je 0x140003251
mov edx, dword [rsp + 0x7c]
mov r8d, 1
mov rcx, qword [rsp + 0x90]
call fcn.14003666c
mov rcx, qword [rsp + 0xc0]
call fcn.140036264
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x140003299
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000398b
call fcn.14002f8dc
lea r13, [0x140000000]
mov r15, qword [rsp + 0xb8]
mov r14, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x168]
cmp rdx, 8
jb 0x1400032f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003997
call fcn.14002f8dc
mov esi, dword [rsp + 0x30]
mov rdx, qword [rsp + 0xe0]
cmp rdx, 8
jb 0x140003344
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000333f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000399d
call fcn.14002f8dc
inc esi
mov dword [rsp + 0x30], esi
inc r14
mov qword [rsp + 0x80], r14
cmp esi, 2
jb 0x140002af0
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
inc r15
mov qword [rsp + 0xb8], r15
cmp eax, 0x2a
jae 0x140003893
jmp 0x140002ad0
mov dword [rsp + 0x1b0], 0x11c
mov dword [rsp + 0x1bc], 0x1869f
mov r8b, 5
mov edx, 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8, rax
mov edx, 4
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x140003824
call fcn.140001da0
mov r12d, eax
lea rdx, [rsp + 0x3b0]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x100
lea rdx, [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x110]
call fcn.1400043a0
mov rdi, rax
mov rdx, qword [r15]
lea rcx, [rsp + 0x98]
call fcn.1400043a0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 2
jb 0x140003460
lea r8, [rdx + 2]
mov qword [rcx + 0x10], r8
mov rax, rcx
cmp r9, 8
jb 0x140003452
mov rax, qword [rcx]
mov dword [rax + rdx*2], 0x220020
mov word [rax + r8*2], bx
jmp 0x14000347f
mov qword [rsp + 0x20], 2
lea r9, [0x140069ec4]
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.1400058e0
mov rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0xe8], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0xf8], xmm1
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 7
mov word [rcx], bx
mov r9, rdi
lea r8, [rsp + 0xe8]
lea rcx, [rsp + 0x38]
call fcn.140005620
nop
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, rsi
cmp rax, 5
jb 0x14000350b
lea rax, [rsi + 5]
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x38]
cmp rcx, 8
cmovae rdi, qword [rsp + 0x38]
lea rcx, [rdi + rsi*2]
mov r8d, 0xa
lea rdx, str.__nul
call fcn.140031700
mov word [rdi + rsi*2 + 0xa], bx
lea rax, [rsp + 0x38]
jmp 0x14000352c
mov qword [rsp + 0x20], 5
lea r9, str.__nul
xor r8d, r8d
lea edx, [r8 + 5]
lea rcx, [rsp + 0x38]
call fcn.1400058e0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x180], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140003594
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000358f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039a3
call fcn.14002f8dc
movdqa xmm0, xmmword [0x14006a120]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], bx
mov rdx, qword [rsp + 0x100]
cmp rdx, 8
jb 0x1400035f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039a9
call fcn.14002f8dc
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x140003638
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003633
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039af
call fcn.14002f8dc
movdqa xmm0, xmmword [0x14006a120]
movdqu xmmword [rsp + 0xa8], xmm0
mov word [rsp + 0x98], bx
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x140003699
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003694
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039b5
call fcn.14002f8dc
movdqa xmm0, xmmword [0x14006a120]
movdqu xmmword [rsp + 0x120], xmm0
mov word [rsp + 0x110], bx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
lea r14, [rsp + 0x170]
mov rsi, qword [rsp + 0x170]
mov r15, qword [rsp + 0x188]
cmp r15, 8
cmovae r14, rsi
movabs r13, 0x7ffffffffffffffe
mov rdi, qword [rsp + 0x180]
cmp rdi, r13
ja 0x1400039bb
mov qword [rsp + 0x70], 7
cmp rdi, 8
jae 0x14000372b
mov qword [rsp + 0x68], rdi
mov r8d, 0x10
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140031700
jmp 0x1400037d5
mov rax, rdi
or rax, 7
cmp rax, r13
jbe 0x140003747
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000377a
mov r13, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r13, rax
lea rcx, [r13 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400039c0
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400037a6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400039c5
mov rcx, rax
call fcn.14002f8a0
test rax, rax
je 0x1400039ca
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400037b3
test rcx, rcx
je 0x1400037b3
call fcn.14002f8a0
mov rbx, rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r13
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rbx
call fcn.140031700
lea rdx, [rsp + 0x58]
mov ecx, r12d
call fcn.140001fb0
nop
cmp r15, 8
jb 0x140003893
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000381a
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400039d0
mov rcx, rsi
call fcn.14002f8dc
jmp 0x140003893
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400039d6
mov r8d, 0x100
lea rdx, str.securityhealthservice
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400039e4
lea r8, [rsp + 0xe8]
mov edx, 0xce
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400039fd
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor eax, eax
mov rcx, qword [rsp + 0x5b0]
xor rcx, rsp
call fcn.14002f880
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140001210
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140035f7c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140035f7c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call fcn.140035f7c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call fcn.140035f7c
nop
call fcn.140001170
nop
call fcn.140036ac8
nop
call fcn.140036ac8
int3
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140001170
int3
call fcn.140036ac8
nop
call fcn.140036ac8
int3
call fcn.140036ac8
nop
call fcn.140001210
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
nop
call fcn.140036ac8
int3
call fcn.140001210
call fcn.140001170
call fcn.140001170
call fcn.140036ac8
nop
call fcn.140036ac8
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140035f7c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call fcn.140035f7c
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, ebx
call fcn.140035f7c
int3