Function at 0x14001bff0
Capabilities:
Create thread
Get common file path
Query or enumerate registry value
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6f0]
sub rsp, 0x7f0
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rbp + 0x6e0], rax
movzx r15d, cl
lea r8, [0x140108348]
cmp qword [0x140108360], 8
cmovae r8, qword [0x140108348]
lea rdx, [0x140108388]
cmp qword [0x1401083a0], 8
cmovae rdx, qword [0x140108388]
lea rcx, str.enabled
lea rax, str.disabled
test r15b, r15b
cmove rax, rcx
lea rcx, str.service
lea r9, str.process
cmovne r9, rcx
mov qword [rsp + 0x20], rax
lea rcx, str._____s___s___s__s____
call fcn.14007de10
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
lea rax, str.SYSTEMCurrentControlSetServicesSophos_Endpoint_DefenseTamperProtectionServices
mov qword [rbp + 0x1b0], rax
lea rax, str.Protected
mov qword [rbp + 0x1b8], rax
xor ebx, ebx
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], bx
lea r8d, [rbx + 0x14]
lea rdx, str.Sophos_Clean_Service
lea rcx, [rbp + 0x40]
call fcn.140009140
nop
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], bx
mov rdx, qword [rbp + 0x1b0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14001c120
lea rcx, [rbp + 0x20]
call fcn.140009140
nop
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x1c0]
call fcn.1400853e0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14001c18b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c185
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d936
call fcn.140091bc0
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x14001c1cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c1c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d93c
call fcn.140091bc0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov r14, rbx
test r15b, r15b
je 0x14001c2cc
lea rcx, [rbp + 0x1b0]
call fcn.14001bec0
mov byte [0x14010d000], al
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
jne 0x14001c24d
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
lea rax, [rbp + 0x1e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x1e8]
test eax, eax
cmovne rcx, rbx
mov qword [rbp + 0x1e8], rcx
mov rax, qword [rbp + 0x1e0]
test rax, rax
jne 0x14001c27c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x1e0], rax
test rax, rax
je 0x14001c2c0
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
je 0x14001c2c0
mov dword [rsp + 0x20], 1
mov r9, rax
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x14001c2a5
mov r14, qword [rbp + 0x1e0]
jmp 0x14001c2c0
cmp eax, 0x3fa
jne 0x14001c2c0
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x1e8], rbx
lea rcx, str.Tamper_protection_monitor_is_enabled
call fcn.14007de10
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], bx
mov r8d, 6
lea rdx, str._PATH_
lea rcx, [rbp + 0x60]
call fcn.140009140
nop
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140084190
mov rdi, rax
lea rcx, [0x14010d060]
cmp rcx, rax
je 0x14001c343
call fcn.1400373e0
mov rdx, qword [0x14010d060]
mov rcx, qword [rdi]
mov qword [0x14010d060], rcx
mov qword [rdi], rdx
mov rdx, qword [0x14010d068]
mov rcx, qword [rdi + 8]
mov qword [0x14010d068], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rcx + 8]
cmp byte [rsi + 0x19], 0
jne 0x14001c38c
mov r8, qword [rsi + 0x10]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140037720
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rdi + 0x20]
call fcn.1400090d0
mov edx, 0x40
mov rcx, rdi
call fcn.140091bc0
cmp byte [rsi + 0x19], 0
je 0x14001c352
mov rcx, qword [rsp + 0x30]
mov edx, 0x40
call fcn.140091bc0
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x14001c3d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c3d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d942
call fcn.140091bc0
movzx edx, r15b
call fcn.14001b9b0
call fcn.140031080
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x180], rbx
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], 7
mov word [rbp + 0x180], bx
lea rdx, [rbp + 0x4d0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rbp + 0x158], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x170], xmm1
mov qword [rbp + 0x150], rbx
lea rax, [rbp + 0x4d0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001c480
lea rdx, [rbp + 0x4d0]
lea rcx, [rbp + 0x180]
call fcn.140009140
mov byte [rbp + 0x1a0], 0
mov dword [rbp + 0x1f8], ebx
mov dword [rbp + 0x1f4], 4
mov qword [rbp + 0x148], rbx
xor dil, dil
lea rdx, [0x140107690]
cmp qword [0x1401076a8], 8
cmovae rdx, qword [0x140107690]
lea rax, [rbp + 0x148]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c54d
lea rax, [rbp + 0x1f4]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1f8]
xor r8d, r8d
lea rdx, str.TraceEnabled
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c540
cmp dword [rbp + 0x200], eax
setne dil
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x1a0], dil
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], bx
mov r8d, 0x10
lea rdx, str.Endpoint_Defense
lea rcx, [rbp + 0xa0]
call fcn.140009140
nop
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], bx
mov r8d, 6
lea rdx, str.Sophos
lea rcx, [rbp + 0x80]
call fcn.140009140
nop
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x128]
call fcn.140083f60
nop
lea r8, [rbp + 0xa0]
mov rdx, rax
lea rcx, [rbp + 0x360]
call fcn.1400853e0
nop
mov rdx, qword [rbp + 0x140]
cmp rdx, 8
jb 0x14001c639
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d948
call fcn.140091bc0
mov qword [rbp + 0x138], rbx
mov qword [rbp + 0x140], 7
mov word [rbp + 0x128], bx
mov rdx, qword [rbp + 0x98]
cmp rdx, 8
jb 0x14001c699
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c693
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d94e
call fcn.140091bc0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x14001c6df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c6da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d954
call fcn.140091bc0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], bx
mov r8d, 4
lea rdx, str.Data
lea rcx, [rbp + 0xc0]
call fcn.140009140
nop
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x340]
call fcn.1400853e0
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 8
jb 0x14001c77a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c775
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d95a
call fcn.140091bc0
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], bx
mov r8d, 5
lea rdx, str.Clean
lea rcx, [rbp + 0xe0]
call fcn.140009140
nop
lea r8, [rbp + 0xe0]
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x2e0]
call fcn.1400853e0
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x14001c815
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c810
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d960
call fcn.140091bc0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
mov r8d, 7
lea rdx, str.Staging
lea rcx, [rsp + 0x40]
call fcn.140009140
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x2c0]
call fcn.1400853e0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001c8a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c89b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d966
call fcn.140091bc0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
mov r8d, 4
lea rdx, str.Drop
lea rcx, [rsp + 0x60]
call fcn.140009140
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x320]
call fcn.1400853e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14001c92b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c926
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d96c
call fcn.140091bc0
mov qword [rbp], rbx
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], 7
mov word [rbp], bx
mov r8d, 5
lea rdx, str.Clean
lea rcx, [rbp]
call fcn.140009140
nop
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], bx
mov r8d, 6
lea rdx, str.Sophos
lea rcx, [rbp - 0x80]
call fcn.140009140
nop
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x108]
call fcn.140083f60
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp + 0x268]
call fcn.1400853e0
nop
mov rdx, qword [rbp + 0x120]
cmp rdx, 8
jb 0x14001c9ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c9e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d972
call fcn.140091bc0
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x120], 7
mov word [rbp + 0x108], bx
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14001ca46
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ca40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d978
call fcn.140091bc0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x14001ca86
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ca81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d97e
call fcn.140091bc0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], 7
mov word [rbp - 0x20], bx
mov r8d, 4
lea rdx, str.Logs
lea rcx, [rbp - 0x20]
call fcn.140009140
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x240]
call fcn.1400853e0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14001cb09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d984
call fcn.140091bc0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], bx
mov r8d, 8
lea rdx, str.Deferred
lea rcx, [rbp - 0x40]
call fcn.140009140
nop
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x300]
call fcn.1400853e0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14001cb8c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d98a
call fcn.140091bc0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], bx
mov r8d, 4
lea rdx, str.Misc
lea rcx, [rbp - 0x60]
call fcn.140009140
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x380]
call fcn.1400853e0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14001cc0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cc0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d930
call fcn.140091bc0
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x3a0]
call fcn.140008e10
nop
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x3c0]
call fcn.140008e10
nop
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x480]
call fcn.140008e10
nop
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x4a0]
call fcn.140008e10
nop
lea rax, [rbp + 0x3e0]
mov qword [rbp + 0x148], rax
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x3e0]
call fcn.140008e10
nop
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x400]
call fcn.140008e10
nop
lea rax, [rbp + 0x420]
mov qword [rbp + 0x148], rax
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x420]
call fcn.140008e10
nop
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x440]
call fcn.140008e10
nop
mov qword [rbp + 0x460], rbx
mov qword [rbp + 0x470], rbx
mov qword [rbp + 0x478], 7
mov word [rbp + 0x460], bx
lea rax, vtable.CleanHost.0
mov qword [rbp + 0x288], rax
lea rax, [rbp + 0x3a0]
mov qword [rbp + 0x290], rax
lea rax, [rbp + 0x3e0]
mov qword [rbp + 0x298], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
movzx r8d, r15b
lea rcx, [rbp + 0x2a0]
call fcn.140017890
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x218], xmm0
movups xmmword [rbp + 0x228], xmm0
lea rax, vtable.SspClient.0
mov qword [rbp + 0x218], rax
mov dword [rbp + 0x220], 0x2710
mov rax, qword [0x140111120]
mov qword [rbp + 0x228], rax
movzx eax, byte [rbp + 0x1a0]
mov byte [rbp + 0x230], al
lea rax, [rbp + 0x288]
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x218]
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x2a0]
mov qword [rbp + 0x168], rax
lea rax, vtable.Clean::HasherSha1Gladman.0
mov qword [rbp + 0x208], rax
lea rax, [rbp + 0x208]
mov qword [rbp + 0x170], rax
lea rax, vtable.Clean::HasherSha2Gladman.0
mov qword [rbp + 0x210], rax
lea rax, [rbp + 0x210]
mov qword [rbp + 0x178], rax
lea rdx, [rbp + 0x240]
cmp qword [rbp + 0x258], 8
cmovae rdx, qword [rbp + 0x240]
mov r8, qword [rbp + 0x250]
lea rcx, [rbp + 0x180]
call fcn.140009140
mov rdi, qword [0x140111188]
test rdi, rdi
je 0x14001ce29
lea rcx, [rdi + 0x30]
call fcn.1400090d0
mov edx, 0x58
mov rcx, rdi
call fcn.140091bc0
lea rax, [rbp + 0x150]
mov qword [0x140111188], rax
mov rcx, qword [0x140111180]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rbp + 0x238]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x1400313d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140111178], rax
mov ecx, 0x118
call fcn.140091bc8
mov rsi, rax
mov qword [rbp + 0x100], rax
xor edx, edx
mov r8d, 0x118
mov rcx, rax
call fcn.140096c20
lea rax, vtable.AutoSafeRestore.0
mov qword [rsi], rax
lea rcx, [rsi + 8]
lea rdx, [rbp + 0x380]
call fcn.14002c620
nop
lea rax, [rbp + 0x3a0]
mov qword [rsi + 0x90], rax
lea rax, [rbp + 0x218]
mov qword [rsi + 0x98], rax
lea rax, [rbp + 0x2a0]
mov qword [rsi + 0xa0], rax
mov qword [rsi + 0xa8], rbx
mov qword [rsi + 0xb0], rbx
mov qword [rsi + 0xb8], rbx
mov byte [rsi + 0xc0], r15b
lea rdi, [rsi + 0xf0]
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
lfence
mov ecx, 0x10
call fcn.140091bc8
mov qword [rax + 8], rbx
mov qword [rdi], rax
mov qword [rax], rdi
lea rcx, [rsi + 0xc8]
mov edx, 0xfa0
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
nop
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xa8], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0xb8], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9, rsi
lea r8, [0x140003b80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0xb0], rax
test rax, rax
jne 0x14001cfb1
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x14007fe1f.0]
mov rsi, rbx
mov qword [0x14010cfb0], rsi
movzx r8d, r15b
lea rdx, [rbp + 0x3a0]
call fcn.140011610
mov ecx, 0xc5
lea r12d, [rcx - 1]
test r15b, r15b
je 0x14001d023
mov eax, r12d
cmp byte [0x14010d000], 0
cmove eax, ecx
bts eax, 8
mov dword [0x14010d018], eax
mov dword [0x14010d010], 0x10
mov qword [0x14010d01c], rbx
mov dword [0x14010d014], 4
mov qword [0x14010d024], rbx
lea rdx, [0x14010d010]
mov rcx, qword [0x140111128]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [0x14010cff8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, str.Started
call fcn.14007de10
mov edi, 0x3e8
mov r13d, 0xffffffff
cmp byte [0x14010cff0], 0
cmovne edi, r13d
mov esi, 0xea60
nop word [rax + rax]
mov rax, qword [0x140111120]
mov qword [rbp + 0x4c0], rax
mov qword [rbp + 0x4c8], r14
mov ecx, ebx
test r14, r14
setne cl
inc ecx
mov r9d, edi
test r15b, r15b
je 0x14001d09b
mov eax, r13d
cmp qword [rbp + 0x1e8], 0
cmove eax, esi
cmp eax, edi
cmovb r9d, eax
xor r8d, r8d
lea rdx, [rbp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x14001d0c3
sub eax, 1
je 0x14001d35a
cmp eax, 0x101
je 0x14001d35d
lea rcx, str.Stopping...
call fcn.14007de10
mov rcx, qword [0x14010cff8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test r15b, r15b
je 0x14001d133
cmp byte [0x14010d000], 0
mov eax, 0xc5
cmove r12d, eax
bts r12d, 8
mov dword [0x14010d018], r12d
mov dword [0x14010d010], 0x10
mov qword [0x14010d01c], rbx
mov dword [0x14010d014], 3
mov qword [0x14010d024], rbx
lea rdx, [0x14010d010]
mov rcx, qword [0x140111128]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [0x14010cfd0]
mov rdi, rcx
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x14001d16b
xor r9d, r9d
mov r8d, r13d
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], rbx
mov rcx, qword [0x14010cfd0]
mov rax, qword [rdi + 0x18]
cmp rax, 0xffffffffffffffff
je 0x14001d18d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x18], 0xffffffffffffffff
mov rcx, qword [0x14010cfd0]
test rcx, rcx
je 0x14001d1a3
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14007fe1f.0]
mov rdx, qword [0x14010cfc0]
test rdx, rdx
je 0x14001d1d6
xor r9d, r9d
mov r8d, r13d
mov rcx, qword [0x14010cfe8]
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov rcx, qword [0x14010cfc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14010cfc0], rbx
mov rcx, qword [0x14010cfe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14010cfc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14010cfd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [0x14010cfb0]
test rdi, rdi
je 0x14001d29e
mov rdx, qword [rdi + 0xb0]
test rdx, rdx
je 0x14001d285
xor r9d, r9d
mov r8d, esi
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x14001d242
xor edx, edx
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0xb8], rbx
mov qword [rdi + 0xb0], rbx
mov qword [rdi + 0xa8], rbx
mov rdi, qword [0x14010cfb0]
test rdi, rdi
je 0x14001d29e
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x14007fe1f.0]
mov rdx, qword [0x140111178]
test rdx, rdx
je 0x14001d2f8
xor r9d, r9d
mov r8d, r13d
mov rcx, qword [0x140111180]
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
test eax, eax
je 0x14001d2e4
mov rdx, qword [0x140111178]
test rdx, rdx
je 0x14001d2f8
xor r9d, r9d
mov r8d, r13d
mov rcx, qword [0x140111180]
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
test eax, eax
jne 0x14001d2f8
mov rcx, qword [0x140111178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140111178], rbx
mov rsi, qword [rbp + 0x100]
nop
mov rdi, qword [0x140111198]
xor r14b, r14b
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rdi + 0x50]
test rax, rax
je 0x14001d5a6
mov r8, qword [rdi + 0x48]
mov rcx, qword [rdi + 0x40]
dec rcx
mov rax, r8
shr rax, 1
and rcx, rax
mov rdx, r8
and edx, 1
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + rcx*8]
mov rsi, qword [rcx + rdx*8]
sub qword [rdi + 0x50], 1
jne 0x14001d593
mov r8, rbx
jmp 0x14001d596
mov r14, rbx
cmp byte [0x14010cff0], 0
jne 0x14001d375
movzx edx, r15b
call fcn.14001b9b0
test al, al
cmovne edi, r13d
test r15b, r15b
je 0x14001d060
test r14, r14
jne 0x14001d454
mov r14, rbx
cmp qword [rbp + 0x1e8], rbx
jne 0x14001d3e0
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
lea rax, [rbp + 0x1e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x1e8]
test eax, eax
cmovne rcx, rbx
mov qword [rbp + 0x1e8], rcx
cmp qword [rbp + 0x1e0], rbx
jne 0x14001d405
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x1e0], rax
test rax, rax
je 0x14001d454
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
je 0x14001d454
mov dword [rsp + 0x20], 1
mov r9, qword [rbp + 0x1e0]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x14001d439
mov r14, qword [rbp + 0x1e0]
jmp 0x14001d454
cmp eax, 0x3fa
jne 0x14001d454
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x1e8], rbx
xor sil, sil
mov dword [rbp + 0x1f0], ebx
mov dword [rbp + 0x1fc], 4
cmp qword [rbp + 0x1e8], 0
jne 0x14001d4be
lea rdx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rdx, qword [rbp + 0x1c0]
lea rax, [rbp + 0x1e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x1e8]
test eax, eax
cmovne rcx, rbx
mov qword [rbp + 0x1e8], rcx
cmp qword [rbp + 0x1e0], 0
jne 0x14001d4df
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x1e0], rax
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
je 0x14001d541
lea rax, [rbp + 0x1fc]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x1b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d526
cmp dword [rbp + 0x1f0], eax
setne sil
jmp 0x14001d541
cmp eax, 0x3fa
jne 0x14001d541
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x1e8], rbx
mov byte [0x14010d000], sil
cmp dword [0x14010d014], 2
jne 0x14001d555
mov eax, ebx
jmp 0x14001d563
movzx eax, sil
xor eax, 1
add eax, r12d
bts eax, 8
cmp eax, dword [0x14010d018]
mov esi, 0xea60
je 0x14001d060
mov dword [0x14010d018], eax
lea rdx, [0x14010d010]
mov rcx, qword [0x140111128]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
jmp 0x14001d060
inc r8
mov qword [rdi + 0x48], r8
mov r14b, 1
mov rax, qword [rdi + 0x50]
test rax, rax
jne 0x14001d5bb
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
test r14b, r14b
je 0x14001d5ed
test rsi, rsi
je 0x14001d300
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x14007fe1f.0]
jmp 0x14001d300
cmp qword [0x140111190], 0
je 0x14001d5fc
call fcn.14003aeb0
mov rcx, qword [0x140111198]
test rcx, rcx
je 0x14001d619
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14007fe1f.0]
mov rcx, qword [0x140111180]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1401111a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14010cff0], 0
je 0x14001d6bd
mov byte [0x14010cff0], 0
mov rcx, qword [0x14010d110]
test rcx, rcx
je 0x14001d6bd
call fcn.1400789d0
mov rsi, qword [0x14010d110]
test rsi, rsi
je 0x14001d6bd
cmp qword [rsi + 0x98], 0
je 0x14001d6bd
cmp dword [rsi + 0x90], 0
jbe 0x14001d6bd
nop word [rax + rax]
mov ecx, ebx
mov rax, qword [rsi + 0x98]
mov rdi, qword [rax + rcx*8]
test rdi, rdi
je 0x14001d6b3
mov rdi, qword [rdi + 0x38]
test rdi, rdi
je 0x14001d6b3
cmp qword [rdi + 8], 0
je 0x14001d6b3
mov edx, r13d
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001d6a2
inc ebx
cmp ebx, dword [rsi + 0x90]
jb 0x14001d680
lea rcx, str.Stopped
call fcn.14007de10
nop
lea rax, vtable.Clean::HasherSha2Gladman.0
mov qword [rbp + 0x210], rax
lea rax, vtable.Clean::HasherSha1Gladman.0
mov qword [rbp + 0x208], rax
lea rax, vtable.Clean::IFalsePositiveManager.0
mov qword [rbp + 0x218], rax
lea rax, vtable.Clean::IQuarantineManager.0
mov qword [rbp + 0x2a0], rax
lea rax, vtable.CleanHost.0
mov qword [rbp + 0x288], rax
lea rcx, [rbp + 0x460]
call fcn.1400090d0
lea rcx, [rbp + 0x440]
call fcn.1400090d0
lea rcx, [rbp + 0x420]
call fcn.1400090d0
lea rcx, [rbp + 0x400]
call fcn.1400090d0
lea rcx, [rbp + 0x3e0]
call fcn.1400090d0
nop
lea rcx, [rbp + 0x4a0]
call fcn.1400090d0
lea rcx, [rbp + 0x480]
call fcn.1400090d0
nop
lea rcx, [rbp + 0x3c0]
call fcn.1400090d0
lea rcx, [rbp + 0x3a0]
call fcn.1400090d0
nop
mov r8, qword [rbp + 0x398]
cmp r8, 8
jb 0x14001d7a3
inc r8
mov rdx, qword [rbp + 0x380]
lea rcx, [rbp + 0x380]
call fcn.140009640
nop
mov r8, qword [rbp + 0x318]
cmp r8, 8
jb 0x14001d7c7
inc r8
mov rdx, qword [rbp + 0x300]
lea rcx, [rbp + 0x300]
call fcn.140009640
nop
mov r8, qword [rbp + 0x258]
cmp r8, 8
jb 0x14001d7eb
inc r8
mov rdx, qword [rbp + 0x240]
lea rcx, [rbp + 0x240]
call fcn.140009640
nop
mov r8, qword [rbp + 0x280]
cmp r8, 8
jb 0x14001d80f
inc r8
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0x268]
call fcn.140009640
nop
mov r8, qword [rbp + 0x338]
cmp r8, 8
jb 0x14001d833
inc r8
mov rdx, qword [rbp + 0x320]
lea rcx, [rbp + 0x320]
call fcn.140009640
nop
mov r8, qword [rbp + 0x2d8]
cmp r8, 8
jb 0x14001d857
inc r8
mov rdx, qword [rbp + 0x2c0]
lea rcx, [rbp + 0x2c0]
call fcn.140009640
nop
mov r8, qword [rbp + 0x2f8]
cmp r8, 8
jb 0x14001d87b
inc r8
mov rdx, qword [rbp + 0x2e0]
lea rcx, [rbp + 0x2e0]
call fcn.140009640
nop
mov r8, qword [rbp + 0x358]
cmp r8, 8
jb 0x14001d89f
inc r8
mov rdx, qword [rbp + 0x340]
lea rcx, [rbp + 0x340]
call fcn.140009640
nop
mov r8, qword [rbp + 0x378]
cmp r8, 8
jb 0x14001d8c3
inc r8
mov rdx, qword [rbp + 0x360]
lea rcx, [rbp + 0x360]
call fcn.140009640
nop
lea rcx, [rbp + 0x180]
call fcn.1400090d0
nop
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
je 0x14001d8e2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1e0]
test rcx, rcx
je 0x14001d8f4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1c0]
call fcn.1400090d0
mov rcx, qword [rbp + 0x6e0]
xor rcx, rsp
call fcn.140091ba0
lea r11, [rsp + 0x7f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
int3