Function at 0x14004ecbc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d0
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rsp + 0x6c8], rax
mov r13, rcx
call fcn.14004b51c
xor r14d, r14d
test al, al
je 0x14004fcfc
mov qword [rsp + 0x1b0], r14
lea rcx, [rsp + 0x1b0]
call fcn.1400c196c
test eax, eax
jns 0x14004ed49
lea r12, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004ed50
lea r15, [0x1401233c0]
test byte [rcx + 0x1c], 2
je 0x14004ed57
lea edx, [r14 + 0xb]
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044450
jmp 0x14004ed57
lea r12, [0x140162280]
lea r15, [0x1401233c0]
lea rcx, str.Start:_MpSignatureUpdate___n
call fcn.1400ec5f0
lea rcx, str.Signature_update_started_._._.
call fcn.14004a438
mov qword [rsp + 0xd0], r14
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
mov ebx, eax
test eax, eax
js 0x14004eddf
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call fcn.1400ed9fc
mov ebx, eax
test eax, eax
jns 0x14004ee21
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004edc8
test byte [rcx + 0x1c], 2
je 0x14004edc8
mov edx, 0xc
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, [0x140121e50]
call fcn.1400ec5f0
lea rcx, str.ERROR:_PrintEngineVersion_failed_with_hr_lx_n
jmp 0x14004ee1a
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004ee05
test byte [rcx + 0x1c], 2
je 0x14004ee05
mov edx, 0xd
mov r9d, ebx
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, [0x140121ee0]
call fcn.1400ec5f0
lea rcx, str.ERROR:_MpManagerOpen_failed_with_hr_lx_n
mov edx, ebx
call fcn.14004a438
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14004ee3c
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov qword [rsp + 0xd0], r14
mov ebx, 0x521c820
mov dword [rsp + 0xc8], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rsp + 0xc8]
mov edx, ebx
lea rcx, str.MpCmdRun_SignatureUpdateTerminationTimeOut
mov rax, qword [rax + 0xa0]
call fcn.1400fece0
nop
mov edx, dword [rsp + 0xc8]
test eax, eax
cmovs edx, ebx
mov dword [rsp + 0xc8], edx
mov qword [rsp + 0x1a8], r14
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1a8]
call fcn.1400f15e4
test eax, eax
js 0x14004ff97
mov qword [rsp + 0x1a0], r14
call fcn.1400ed910
test al, al
je 0x14004eeed
mov ecx, 0x18
call fcn.140031048
mov qword [rsp + 0x1d0], rax
lea rdx, str.53C9D589_6B66_4F30_9BAB_9A0193B0BAFC
mov rcx, rax
call fcn.1400ecac4
nop
test rax, rax
je 0x14004eee5
lock inc dword [rax + 8]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0xe8], r14
lea rdx, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
test eax, eax
js 0x14004ff9f
call fcn.1400f4a8c
mov dword [rsp + 0xc0], eax
shr rax, 0x20
mov dword [rsp + 0xc4], eax
mov rsi, qword [rsp + 0xc0]
mov qword [rsp + 0xc0], rsi
mov ebx, 5
xor edx, edx
mov r8d, 0x1b0
lea rcx, [rsp + 0x510]
call fcn.140032ec0
lea rdx, [rsp + 0x510]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.mpclient.dll_MpManagerStatusQuery]
test eax, eax
js 0x14004f143
test byte [rsp + 0x510], 1
je 0x14004f143
mov qword [rsp + 0x190], r14
lea rcx, [rsp + 0x190]
call fcn.1400f2930
test eax, eax
js 0x14004f130
mov qword [rsp + 0x188], r14
mov r9d, ebx
lea r8, str.WinDefend
mov rbx, qword [rsp + 0x190]
mov rdx, rbx
lea rcx, [rsp + 0x188]
call fcn.1400f2994
test eax, eax
js 0x14004f121
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x330], xmm0
movups xmmword [rsp + 0x340], xmm0
mov dword [rsp + 0x350], eax
mov rdi, qword [rsp + 0x188]
mov rdx, rdi
lea rcx, [rsp + 0x330]
call fcn.1400f2b40
test eax, eax
js 0x14004f109
mov r8d, dword [rsp + 0x334]
lea eax, [r8 - 2]
test eax, 0xfffffffd
jne 0x14004f0da
mov rax, qword [rsp + 0xc0]
cmp rax, rsi
jne 0x14004f054
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004f054
test byte [rcx + 0x1c], 2
je 0x14004f054
mov edx, 0xe
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044430
mov rax, qword [rsp + 0xc0]
mov rcx, rsi
sub rcx, rax
add rcx, 0x47868c00
movabs rax, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
mov eax, 0xfa
cmp edx, eax
cmova edx, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
je 0x14004f092
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14004f0a0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.1400f4a8c
mov dword [rsp + 0xd8], eax
shr rax, 0x20
mov dword [rsp + 0xdc], eax
mov rdi, qword [rsp + 0xd8]
mov qword [rsp + 0xc0], rdi
mov rax, rdi
sub rax, rsi
cmp rax, 0x47868c00
ja 0x14004f143
jmp 0x14004ef34
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004f109
test byte [rcx + 0x1c], 2
je 0x14004f109
mov edx, 0xf
mov dword [rsp + 0x20], r8d
lea r9, str.WinDefend
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044764
test rdi, rdi
je 0x14004f117
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14004f143
mov rcx, rbx
jmp 0x14004f13d
mov rcx, qword [rsp + 0x188]
test rcx, rcx
je 0x14004f117
jmp 0x14004f111
mov rcx, qword [rsp + 0x190]
test rcx, rcx
je 0x14004f143
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x20
call fcn.140031048
mov rbx, rax
mov qword [rsp + 0xd8], rax
mov dword [rax + 8], r14d
lea rax, vtable.CUpdateNotifications.0
mov qword [rbx], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x210], rax
mov qword [rax], r14
lea rcx, [rbx + 0x18]
mov qword [rsp + 0x1c0], rcx
mov dword [rcx], 0x80004005
mov edx, 1
mov rcx, rax
call fcn.1400f14bc
test eax, eax
js 0x14004ffa7
lock inc dword [rbx + 8]
mov qword [rsp + 0x198], rbx
lea rax, [0x14004e220]
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x308], rbx
mov rdi, r14
mov qword [rsp + 0xe0], r14
mov rax, qword [r13]
lea rdx, str.ScheduleJob
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov esi, 1
test rax, rax
lea eax, [rsi + 4]
cmovne esi, eax
mov dword [rsp + 0xc0], esi
mov rax, qword [r13]
lea rdx, [0x140122020]
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x14004f21d
bts esi, 0xa
mov dword [rsp + 0xc0], esi
mov rax, qword [r13]
lea rdx, [0x140122028]
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x14004f2ee
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004f260
test byte [rcx + 0x1c], 4
je 0x14004f260
mov edx, 0x10
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044430
or esi, 0x20
mov dword [rsp + 0xc0], esi
mov rax, qword [r13]
lea rdx, str.Path
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov rsi, rax
test rax, rax
je 0x14004f376
mov r8b, 1
mov edx, 8
lea rcx, [rsp + 0xe0]
call fcn.1400c1bbc
test eax, eax
js 0x14004ffaf
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x14004f2ae
inc rax
lea rdx, [rax + rax]
cmp rdx, rax
jae 0x14004f2ce
mov eax, 0x80070057
jmp 0x14004ffb6
mov r8, rsi
mov rdi, qword [rsp + 0xe0]
mov rcx, rdi
call fcn.1400c1c20
test eax, eax
js 0x14004ffb6
jmp 0x14004f376
mov rax, qword [r13]
lea rdx, str.HTTP
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
jne 0x14004f349
mov rax, qword [r13]
lea rdx, str.MMPC
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
jne 0x14004f349
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004f376
test byte [rcx + 0x1c], 4
je 0x14004f376
lea edx, [rax + 0x12]
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044430
jmp 0x14004f376
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004f36c
test byte [rcx + 0x1c], 4
je 0x14004f36c
mov edx, 0x11
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044430
or esi, 0x10
mov dword [rsp + 0xc0], esi
lea rcx, [rsp + 0x360]
call fcn.14004ae0c
mov rax, qword [0x14016b890]
mov qword [rsp + 0xd8], rax
test rax, rax
je 0x14004f65b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movabs rsi, 0x400000000000
cmp dword [0x140162450], 5
jbe 0x14004f64b
test qword [0x140162460], rsi
je 0x14004f64b
mov rax, qword [0x140162468]
and rax, rsi
cmp rax, qword [0x140162468]
jne 0x14004f64b
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0xf0], eax
mov rax, qword [r13]
lea rdx, str.ScheduleJob
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov ecx, r14d
test rax, rax
setne cl
mov dword [rsp + 0xf4], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xf8], eax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x1f0], rax
mov rdx, r14
lock xadd qword [rsp + 0x3e8], rdx
lea r8, [rsp + 0x3f0]
lea rcx, [rsp + 0x360]
call fcn.14004dce8
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x2f8], rax
mov rcx, qword [0x14016b888]
mov eax, dword [rcx + 0x48]
mov dword [rsp + 0xfc], eax
mov eax, dword [rcx + 0x44]
mov dword [rsp + 0x100], eax
mov eax, dword [rcx + 0x40]
mov dword [rsp + 0x104], eax
movzx eax, byte [rcx + 0x3c]
mov dword [rsp + 0x108], eax
movzx eax, byte [rcx + 0x3b]
mov dword [rsp + 0x10c], eax
movzx eax, byte [rcx + 0x3a]
mov dword [rsp + 0x110], eax
movzx eax, byte [rcx + 0x39]
mov dword [rsp + 0x114], eax
movzx eax, byte [rcx + 0x38]
mov dword [rsp + 0x118], eax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x1d8], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x1e0], rax
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x218], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x1f8], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], 0x2000000
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xf4]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xfc]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x104]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x10c]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x114]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x218]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x208]
mov qword [rsp + 0x20], rax
lea rdx, [0x14014df1a]
call fcn.140001320
mov rbx, qword [rsp + 0x198]
mov rdi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14004f665
movabs rsi, 0x400000000000
mov edx, dword [rsp + 0xc0]
lea rcx, str.Calling_MpUpdateStartEx_with_option__lx_n
call fcn.1400ec5f0
mov qword [rsp + 0x1c8], r14
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x300]
mov r8, rdi
mov edx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.mpclient.dll_MpUpdateStartEx]
mov r13d, eax
test eax, eax
js 0x14004ffbe
or edx, 0xffffffff
mov rcx, qword [rsp + 0x210]
mov rcx, qword [rcx]
call fcn.1400f1e80
test al, al
je 0x14004f6d7
mov r13d, 0x800705b4
jmp 0x14004f6e2
mov rax, qword [rsp + 0x1c0]
mov r13d, dword [rax]
lea rcx, [rsp + 0x360]
call fcn.14004b42c
mov rax, qword [0x14016b890]
mov qword [rsp + 0x1c0], rax
test rax, rax
je 0x14004f95e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140162450], 5
jbe 0x14004f950
test qword [0x140162460], rsi
je 0x14004f950
mov rax, qword [0x140162468]
and rax, rsi
cmp rax, qword [0x140162468]
jne 0x14004f950
mov dword [rsp + 0x11c], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x120], eax
mov rdx, r14
lock xadd qword [rsp + 0x3e8], rdx
lea r8, [rsp + 0x480]
lea rcx, [rsp + 0x360]
call fcn.14004dce8
lea rax, [rsp + 0x480]
mov qword [rsp + 0x220], rax
mov rcx, qword [0x14016b888]
mov eax, dword [rcx + 0x48]
mov dword [rsp + 0x124], eax
mov eax, dword [rcx + 0x44]
mov dword [rsp + 0x128], eax
mov eax, dword [rcx + 0x40]
mov dword [rsp + 0x12c], eax
movzx eax, byte [rcx + 0x3c]
mov dword [rsp + 0x130], eax
movzx eax, byte [rcx + 0x3b]
mov dword [rsp + 0x134], eax
movzx eax, byte [rcx + 0x3a]
mov dword [rsp + 0x138], eax
movzx eax, byte [rcx + 0x39]
mov dword [rsp + 0x13c], eax
movzx eax, byte [rcx + 0x38]
mov dword [rsp + 0x140], eax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x228], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x230], rax
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x238], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x240], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x248], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x258], 0x2000000
lea rax, [rsp + 0x11c]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x124]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x128]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x12c]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x134]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x138]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x13c]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x238]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x250]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x258]
mov qword [rsp + 0x20], rax
lea rdx, [0x14014de14]
call fcn.140001654
mov rbx, qword [rsp + 0x198]
mov rdi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r13d, r13d
js 0x14005000a
lea rax, str.Signature_update_finished._No_updates_needed_n
lea rcx, str.Signature_update_finished._n
test r13d, r13d
cmovne rcx, rax
call fcn.14004a438
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004f9a4
test byte [rcx + 0x1c], 4
je 0x14004f9a4
mov edx, 0x15
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044430
lea rcx, str.Finish:_MpSignatureUpdate___n
call fcn.1400ec5f0
mov r15, qword [0x14016b890]
test r15, r15
je 0x14004fc07
mov qword [rsp + 0x310], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x318], 1
cmp dword [0x140162450], 5
jbe 0x14004fbfd
test qword [0x140162460], rsi
je 0x14004fbfd
mov rax, qword [0x140162468]
and rax, rsi
cmp rax, qword [0x140162468]
jne 0x14004fbfd
mov dword [rsp + 0x144], r13d
lea rax, [0x14011fac6]
mov qword [rsp + 0x260], rax
lea rax, str.Platform.SignatureUpdate
mov qword [rsp + 0x268], rax
mov rcx, qword [0x14016b888]
mov eax, dword [rcx + 0x48]
mov dword [rsp + 0x148], eax
mov eax, dword [rcx + 0x44]
mov dword [rsp + 0x14c], eax
mov eax, dword [rcx + 0x40]
mov dword [rsp + 0x150], eax
movzx eax, byte [rcx + 0x3c]
mov dword [rsp + 0x154], eax
movzx eax, byte [rcx + 0x3b]
mov dword [rsp + 0x158], eax
movzx eax, byte [rcx + 0x3a]
mov dword [rsp + 0x15c], eax
movzx eax, byte [rcx + 0x39]
mov dword [rsp + 0x160], eax
movzx eax, byte [rcx + 0x38]
mov dword [rsp + 0x164], eax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x270], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x278], rax
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x280], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x288], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x290], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x298], rax
mov qword [rsp + 0x2a0], 0x1000000
mov qword [rsp + 0x2a8], 1
lea rax, [rsp + 0x144]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x268]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x148]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x14c]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x154]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x15c]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x164]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x278]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x280]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x288]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x298]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2a8]
lea rdx, [0x14014dcf9]
call 0x140001928
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rcx, qword [rsp + 0x1c8]
test rcx, rcx
je 0x14004fc1b
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
test rdi, rdi
je 0x14004fc38
cmp qword [rdi], r14
je 0x14004fc2e
mov rcx, qword [rdi]
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, rdi
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
test rbx, rbx
je 0x14004fc63
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jg 0x14004fc63
mov rcx, qword [rsp + 0x198]
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call fcn.1400fece0
nop
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14004fc77
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
jmp 0x14004fc88
mov rax, qword [rsp + 0x1a0]
test rax, rax
je 0x14004fcbb
or ecx, 0xffffffff
lock xadd dword [rax + 8], ecx
sub ecx, 1
jg 0x14004fcbb
mov rcx, qword [rsp + 0x1a0]
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call fcn.1400fece0
nop
mov rdx, qword [rsp + 0x1a8]
test rdx, rdx
je 0x14004fcd5
or r8, 0xffffffffffffffff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
nop
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14004fce9
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x14004fcfc
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rsp + 0x6c8]
xor rcx, rsp
call fcn.140030c40
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
mov ecx, eax
call fcn.1400f10c4
nop
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14004ffe4
test byte [rcx + 0x1c], 1
je 0x14004ffe4
mov edx, 0x13
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, r13d
lea rcx, str.ERROR:_MpUpdateStart_failed_with_hr_lx_n
call fcn.1400ec5f0
mov edx, r13d
lea rcx, [0x140122118]
call fcn.14004a438
mov ecx, r13d
call fcn.1400f10c4
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x140050030
test byte [rcx + 0x1c], 1
je 0x140050030
mov edx, 0x14
mov r9d, r13d
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, r13d
lea rcx, str.ERROR:_Signature_Update_failed_with_hr_lx_n
call fcn.1400ec5f0
mov edx, r13d
lea rcx, [0x140122118]
call fcn.14004a438
mov ecx, r13d
call fcn.1400f10c4
int3