Function at 0x140005f70
Capabilities:
Query or enumerate registry value
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x14004a040]
xor rax, rsp
mov qword [rbp + 0x130], rax
movzx r14d, r9b
mov byte [rsp + 0x50], r9b
mov r13d, r8d
mov r15, rdx
mov qword [rsp + 0x70], rdx
mov rsi, rcx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x40], rcx
xor r12d, r12d
mov dword [rsp + 0x68], r12d
mov ebx, r12d
mov qword [rbp - 0x80], rbx
cmp r8d, 1
je 0x140006099
test r9b, r9b
jne 0x140006099
test r8d, r8d
je 0x140006e79
cmp r8d, 0x43
jg 0x140006067
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.140004190
test al, al
je 0x140006067
lea ecx, [r12 + 0x10]
call fcn.140011908
mov rbx, rax
mov qword [rsp + 0x70], rax
lea rcx, [rbp - 0x50]
call fcn.140003e80
nop
mov dword [rsp + 0x68], 1
mov r8, qword [rax + 8]
mov edx, r13d
mov rcx, rbx
call fcn.140003930
mov rbx, rax
mov qword [rbp - 0x80], rax
lea rdi, vtable.Microsoft::WRL::Wrappers::HandleT_struct_Microsoft::WRL::Wrappers::HandleTraits::HANDLENullTraits_.0
mov qword [rbp - 0x50], rdi
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140006e84
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140006f52
jmp 0x140006e84
mov ecx, 0x10
call fcn.140011908
mov rbx, rax
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rax
mov edx, r13d
mov rcx, rbx
call fcn.140003930
mov rbx, rax
mov qword [rbp - 0x80], rax
jmp 0x140006e84
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rax
mov dword [rbp + 0x128], eax
mov word [rbp + 0x12c], ax
lea r8d, [rax + 0x27]
lea rdx, [rbp + 0xe0]
mov rcx, r15
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x140006fe3
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rax, [rbp + 0xe0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140006110
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x40]
call fcn.14000c000
nop
xor r8d, r8d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140004280
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140006180
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000617b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fe9
call fcn.140011900
cmp qword [rbp + 0xb0], 0
jne 0x140006328
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rax, [rbp + 0xe0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400061b0
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x40]
call fcn.14000c000
nop
mov r8d, 0x200
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.140004280
mov rbx, rax
lea rax, [rbp + 0xa0]
cmp rax, rbx
je 0x14000627a
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x14000623b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006236
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fef
call fcn.140011900
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], r12w
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x1400062c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fef
call fcn.140011900
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x14000631a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006315
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ff5
call fcn.140011900
cmp qword [rbp + 0xb0], 0
je 0x140006ffb
cmp byte [rbp + 0x1a0], 0
je 0x1400068b3
movups xmm0, xmmword [str.S_1_15_2_1]
movups xmmword [rbp + 0xc0], xmm0
mov eax, dword [0x1400419e0]
mov dword [rbp + 0xd0], eax
movzx eax, word [0x1400419e4]
mov word [rbp + 0xd4], ax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x80]
call fcn.1400032c0
nop
lea rsi, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova rsi, qword [rbp + 0xa0]
mov dword [rsp + 0x54], r12d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 7]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x1400063ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400063ff
mov edx, dword [rsp + 0x54]
lea ecx, [rax - 0x3a]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x54]
mov r8, rbx
mov edx, 7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetFileSecurityW]
test eax, eax
jne 0x1400064ab
test rbx, rbx
je 0x1400063ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x78]
call fcn.140009700
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rax, [rbp + 0xc0]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140006434
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x40]
call fcn.14000c000
nop
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.140003450
mov esi, eax
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x14000649e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007021
call fcn.140011900
test esi, esi
jne 0x140006f6c
jmp 0x14000655f
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r12d
mov qword [rbp - 0x78], 0x2000000
mov qword [rbp - 0x60], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp + 0x40], 1
mov qword [rbp + 0x50], r12
lea rax, [rsp + 0x60]
mov qword [rbp + 0x48], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp - 0x78]
mov rdx, qword [rbp + 0x98]
xor ecx, ecx
call qword [sym.imp.AUTHZ.dll_AuthzAccessCheck]
mov esi, dword [rsp + 0x60]
test eax, eax
cmove esi, r12d
test rbx, rbx
je 0x140006536
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
js 0x14000654c
and esi, 0x120089
cmp esi, 0x120089
jne 0x1400063ff
lea rdx, str.AppContainer_already_have_EXE_access._n
lea rcx, [0x14004b9a0]
call fcn.14000ba20
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rax, [rbp + 0xe0]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140006580
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x40]
call fcn.14000c000
nop
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.140004bb0
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x1400065ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fdd
call fcn.140011900
cmp qword [rbp + 0x70], 0
je 0x140007027
xor r12b, r12b
lea rcx, str.AppID_
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000704d
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
jbe 0x140006630
mov rdx, qword [rbp + 0x60]
test rdx, rdx
jne 0x140006630
xor edi, edi
jmp 0x14000663a
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140006630
mov r8d, edi
lea rcx, [rsp + 0x60]
call fcn.140002630
xor edi, edi
mov qword [rbp - 0x78], rdi
mov dword [rbp - 0x70], edi
mov qword [rbp - 0x68], rdi
mov r9d, 0x20019
mov rbx, qword [rsp + 0x60]
mov r8, rbx
lea rcx, [rbp - 0x78]
call fcn.1400029d0
test eax, eax
jne 0x140007058
mov dword [rsp + 0x54], edi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.LaunchPermission
mov r15, qword [rbp - 0x78]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x140006803
mov esi, eax
xor r14d, r14d
test eax, eax
je 0x140006704
cmp rax, 0x1000
jb 0x1400066e8
lea rcx, [rax + 0x27]
cmp rcx, rax
jbe 0x14000707e
call fcn.140011908
test rax, rax
je 0x140007084
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400066f3
mov rcx, rsi
call fcn.140011908
mov rdi, rax
lea r14, [rdi + rsi]
mov r8, rsi
xor edx, edx
mov rcx, rdi
call fcn.140033dd0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.LaunchPermission
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400067c5
cmp dword [rsp + 0x58], 3
jne 0x1400067c5
xor ecx, ecx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], ecx
mov qword [rbp - 0x78], 0x2000000
mov qword [rbp - 0x60], rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x58], rcx
mov qword [rbp + 0x40], 1
mov qword [rbp + 0x50], rcx
lea rax, [rsp + 0x60]
mov qword [rbp + 0x48], rax
lea rax, [rsp + 0x58]
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp - 0x78]
mov rdx, qword [rbp + 0x98]
call qword [sym.imp.AUTHZ.dll_AuthzAccessCheck]
test eax, eax
je 0x1400067c2
mov eax, dword [rsp + 0x60]
and eax, 0xb
cmp al, 0xb
jne 0x1400067c2
mov r12b, 1
jmp 0x1400067c5
xor r12b, r12b
test rdi, rdi
je 0x1400067fd
sub r14, rdi
mov rax, rdi
cmp r14, 0x1000
jb 0x1400067f2
add r14, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007084
mov rdx, r14
mov rcx, rdi
call fcn.140011900
movzx r14d, byte [rsp + 0x50]
test r15, r15
je 0x140006812
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r12b, r12b
jne 0x140006844
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.1400036c0
mov edi, eax
test eax, eax
jne 0x14000708a
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x140006885
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000687f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400070fb
call fcn.140011900
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140006898
call qword [rbp + 0x90]
nop
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x1400068ab
call qword [rbp + 0x80]
nop
mov r15, qword [rsp + 0x70]
xor r12d, r12d
cmp r13d, 1
jne 0x140006bd2
lea rcx, [rbp + 0x40]
call fcn.140002d70
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
lea r8d, [r13 + 9]
lea rdx, str._Embedding
lea rcx, [rbp + 0x80]
call fcn.14000c000
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
lea ecx, [r13 + 0x1f]
call fcn.140011908
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rax
lea rbx, [rax + 0x20]
mov qword [rbp + 0xd0], rbx
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0xc0]
mov qword [rbp - 0x68], rcx
lea rdx, [rbp + 0x80]
mov rcx, rax
call fcn.140009700
nop
mov rdx, rbx
mov rcx, rbx
call fcn.14000ca70
mov qword [rbp + 0xc8], rbx
lea r8, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova r8, qword [rbp + 0xa0]
lea r9, [rbp + 0xc0]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x60]
call fcn.140005ad0
nop
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x140006a6d
mov rsi, qword [rbp + 0xc8]
cmp rcx, rsi
je 0x140006a23
lea rbx, [rcx + 0x18]
nop dword [rax + rax]
mov rdx, qword [rbx]
cmp rdx, 7
jbe 0x1400069ff
mov rcx, qword [rbx - 0x18]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400069fa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007101
mov rcx, r8
call fcn.140011900
mov qword [rbx - 8], r12
mov qword [rbx], 7
mov word [rbx - 0x18], r12w
add rbx, 0x20
lea rax, [rbx - 0x18]
cmp rax, rsi
jne 0x1400069c0
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xd0]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007101
call fcn.140011900
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
lea r9, [0x140009690]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x80]
call fcn.140011958
test r14b, r14b
je 0x140006ac9
lea rdx, str.Process_created_in_suspended_mode._You_can_now_attach_a_debugger_for_investigation_of_startup_problems._nPress_any_key_to_continue.
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rcx, rax
call fcn.14000b6d0
call fcn.140008da0
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
jmp 0x140006add
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140007141
mov ecx, 0x10
call fcn.140011908
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.140003c10
mov rbx, rax
mov qword [rbp - 0x80], rax
lea rdi, vtable.Microsoft::WRL::Wrappers::HandleT_struct_Microsoft::WRL::Wrappers::HandleTraits::HANDLENullTraits_.0
mov qword [rbp + 0x70], rdi
cmp qword [rbp + 0x78], 0
je 0x140006b26
lea rcx, [rbp + 0x70]
call fcn.140009140
test al, al
je 0x140007107
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x60], rdi
cmp qword [rbp + 0x68], 0
je 0x140006b46
lea rcx, [rbp + 0x60]
call fcn.140009140
test al, al
je 0x140007121
mov qword [rbp + 0x68], r12
mov rsi, qword [rbp + 0x50]
mov rdi, qword [rbp + 0x48]
cmp rdi, rsi
je 0x140006b71
mov rcx, qword [rdi]
test rcx, rcx
je 0x140006b64
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], r12
add rdi, 0x10
cmp rdi, rsi
jne 0x140006b53
mov rdi, qword [rbp + 0x48]
test rdi, rdi
je 0x140006bba
mov rdx, qword [rbp + 0x58]
sub rdx, rdi
and rdx, 0xfffffffffffffff0
mov rax, rdi
cmp rdx, 0x1000
jb 0x140006ba6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000713b
mov rcx, rdi
call fcn.140011900
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r12
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140006e2f
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140006e2f
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov dword [rbp - 0x30], 0x70
mov qword [rsp + 0x58], r12
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140011c68
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140033dd0
mov qword [rbp + 0x38], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea edx, [r8 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov ecx, eax
call fcn.140002ce0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov r8d, 0xa
lea rdx, str._Embedding
lea rcx, [rbp + 0x80]
call fcn.14000c000
nop
lea rax, [rbp + 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xc0]
call fcn.140009020
nop
lea r8, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova r8, qword [rbp + 0xa0]
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, r13d
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x60]
call fcn.1400051b0
nop
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x140006d53
mov rdx, qword [rbp + 0xc8]
call fcn.14000ca70
mov rdx, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc0]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007191
call fcn.140011900
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
lea r9, [0x140009690]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x80]
call fcn.140011958
test r14b, r14b
je 0x140006d94
lea rdx, str.Process_created_in_suspended_mode._You_can_now_attach_a_debugger_for_investigation_of_startup_problems._nPress_any_key_to_continue.
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rcx, rax
call fcn.14000b6d0
call fcn.140008da0
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, 0x10
call fcn.140011908
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.140003c10
mov rbx, rax
mov qword [rbp - 0x80], rax
lea rdi, vtable.Microsoft::WRL::Wrappers::HandleT_struct_Microsoft::WRL::Wrappers::HandleTraits::HANDLENullTraits_.0
mov qword [rbp + 0x70], rdi
cmp qword [rbp + 0x78], 0
je 0x140006df6
lea rcx, [rbp + 0x70]
call fcn.140009140
test al, al
je 0x140007197
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x60], rdi
cmp qword [rbp + 0x68], 0
je 0x140006e16
lea rcx, [rbp + 0x60]
call fcn.140009140
test al, al
je 0x1400071b1
mov qword [rbp + 0x68], r12
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140006e2f
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rbp + 0x38]
call fcn.140011900
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x140006e75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400071cb
call fcn.140011900
mov rsi, qword [rbp - 0x50]
mov r8d, 4
test r13d, r13d
je 0x140006e8a
mov r8d, 0x100004
mov qword [rsi], r12
mov dword [rsp + 0x68], 2
mov qword [rsp + 0x20], rsi
lea r9, [0x1400425c0]
xor edx, edx
mov rcx, r15
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp r13d, 1
jne 0x140006ebd
cmp eax, 0x80070005
je 0x1400071d1
test eax, eax
js 0x140006f08
test rbx, rbx
je 0x140006edb
mov rcx, rbx
call fcn.140003dd0
mov edx, 0x10
mov rcx, rbx
call fcn.140011900
mov rax, rsi
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.1400118e0
mov rbx, qword [rsp + 0x298]
add rsp, 0x240
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, eax
lea rcx, [rbp + 0x80]
call fcn.140002ad0
nop
lea rcx, [rbp + 0x80]
call fcn.140002b90
mov rbx, rax
lea rdx, str.ERROR:
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rcx, rax
mov rdx, rbx
call fcn.14000b410
mov rcx, rax
call fcn.140009650
call fcn.1400185d4
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140006f64
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.140002cc0
nop
mov edx, esi
lea rcx, [rbp + 0x40]
call fcn.140002ad0
nop
lea rdx, str.ERROR:_Failed_to_grant_AppContainer_permissions_to_the_EXE__MSG_
lea rcx, [0x14004bc00]
call fcn.14000b410
mov rbx, rax
lea rcx, [rbp + 0x40]
call fcn.140002b90
mov rdx, rax
mov rcx, rbx
call fcn.14000b410
mov rcx, rax
lea rdx, [0x140041a10]
call fcn.14000b410
mov edx, esi
mov rcx, rax
call fcn.140009230
mov rcx, rax
lea rdx, [0x140041790]
call fcn.14000b410
mov rcx, rax
call fcn.140009650
mov ecx, 0xfffffffe
call fcn.1400185c8
nop
call fcn.14001d3f4
nop
call fcn.1400185d4
nop
call fcn.14001d3f4
nop
call fcn.14001d3f4
nop
call fcn.14001d3f4
int3
lea rdx, str.ERROR:_Unable_to_locate_COM_server_EXE_path.
lea rcx, [0x14004bc00]
call fcn.14000b410
mov rcx, rax
call fcn.140009650
mov ecx, 0xfffffffe
call fcn.1400185c8
nop
call fcn.14001d3f4
nop
lea rdx, str.ERROR:_Unable_to_locate_COM_server_AppID.
lea rcx, [0x14004bc00]
call fcn.14000b410
mov rcx, rax
call fcn.140009650
mov ecx, 0xfffffffe
call fcn.1400185c8
int3
mov ecx, 0x8007000e
call fcn.1400025d0
nop
lea rdx, str.ERROR:_Unable_to_open_server_AppID.
lea rcx, [0x14004bc00]
call fcn.14000b410
mov rcx, rax
call fcn.140009650
mov ecx, 0xfffffffe
call fcn.1400185c8
int3
call fcn.1400015d0
int3
call fcn.14001d3f4
nop
mov edx, edi
lea rcx, [rbp + 0x40]
call fcn.140002ad0
nop
lea rdx, str.ERROR:_Failed_to_grant_AppContainer_AppID_LaunchPermission__MSG_
lea rcx, [0x14004bc00]
call fcn.14000b410
mov rbx, rax
lea rcx, [rbp + 0x40]
call fcn.140002b90
mov rdx, rax
mov rcx, rbx
call fcn.14000b410
mov rcx, rax
lea rdx, [0x140041a10]
call fcn.14000b410
mov edx, edi
mov rcx, rax
call fcn.140009230
mov rcx, rax
lea rdx, [0x140041790]
call fcn.14000b410
mov rcx, rax
call fcn.140009650
mov ecx, 0xfffffffe
call fcn.1400185c8
nop
call fcn.14001d3f4
nop
call fcn.14001d3f4
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140007119
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.140002cc0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140007133
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.140002cc0
nop
call fcn.14001d3f4
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x80]
call fcn.140002ad0
nop
lea rdx, str.ERROR:
lea rcx, [0x14004b9a0]
call fcn.14000b410
mov rbx, rax
lea rcx, [rbp + 0x80]
call fcn.140002b90
mov rdx, rax
mov rcx, rbx
call fcn.14000b410
mov rcx, rax
call fcn.140009650
call fcn.1400185d4
nop
call fcn.14001d3f4
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400071a9
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.140002cc0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400071c3
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.140002cc0
nop
call fcn.14001d3f4
int3
lea rdx, str.ERROR:_CoCreateInstance_access_denied_when_trying_to_create_a_new_COM_server_instance._Have_you_remember_to_grant_AppContainer_permissions_
lea rcx, [0x14004bc00]
call fcn.14000b410
mov rcx, rax
call fcn.140009650
mov ecx, 0xfffffffd
call fcn.1400185c8
int3