Function at 0x14005a074
Capabilities:
Check for sandbox username or hostname
Copy file
Create directory
Get session user name
Parse pe header

Disassembly:
mov byte [rsp + 8], cl
mov r11, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x900
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rsp + 0x8f0], rax
mov byte [rsp + 0x68], dl
mov byte [rsp + 0x80], dl
mov qword [rsp + 0xd8], r8
and qword [rsp + 0x58], 0
and qword [r11 - 0x870], 0
and qword [r11 - 0x878], 0
and qword [r11 - 0x848], 0
and dword [rsp + 0x98], 0
lea rcx, [r11 - 0x848]
call fcn.1400f6f68
mov ebx, eax
test eax, eax
js 0x14005cdb3
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
js 0x14005cdfa
and dword [rsp + 0xa8], 0
and dword [rsp + 0xc8], 0
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xa8]
mov rax, qword [rax + 0x178]
call fcn.1400fece0
mov ebx, eax
jmp 0x14005a166
test ebx, ebx
jns 0x14005a1ab
lea r14, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a19b
test byte [rcx + 0x1c], 1
je 0x14005a19b
mov edx, 0x3f
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_ValidateMapsConnection_failed___lx__n
call fcn.1400ec618
jmp 0x14005a1e7
mov edx, dword [rsp + 0xa8]
test edx, edx
jne 0x14005a1c4
lea rcx, str.ValidateMapsConnection_successfully_established_a_connection_to_MAPS_n
call fcn.1400ec618
jmp 0x14005a1e0
mov r8d, dword [rsp + 0xc8]
lea rcx, str.ValidateMapsConnection_failed_to_establish_a_connection_to_MAPS__hr_lx_httpcode_ld__n
call fcn.1400ec618
and dword [rsp + 0xa8], 0
lea r14, [0x140162280]
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rcx, [rsp + 0x98]
mov rax, qword [rax + 0x30]
call fcn.1400fece0
mov ebx, eax
jmp 0x14005a21d
test ebx, ebx
js 0x14005ce41
cmp dword [rsp + 0x98], 0
je 0x14005ce81
lea rcx, [rsp + 0x58]
call fcn.140055b88
mov ebx, eax
jmp 0x14005a25c
test ebx, ebx
js 0x14005cec3
and qword [rsp + 0x60], 0
and qword [rsp + 0xb8], 0
lea r9, str.....Microsoft_Security_ClientSupport
mov r8, qword [rsp + 0x58]
lea rdx, str._s_s
lea rcx, [rsp + 0x60]
call fcn.1400f23a4
mov edi, eax
test eax, eax
jns 0x14005a2d5
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a2c0
test byte [rcx + 0x1c], 1
je 0x14005a2c0
mov edx, 0xf
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400ec5f0
mov rbx, qword [rsp + 0x60]
jmp 0x14005a348
xor edx, edx
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14005a33b
call fcn.1400f259c
mov edi, eax
cmp eax, 0x800700b7
je 0x14005a339
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a325
test byte [rcx + 0x1c], 1
je 0x14005a325
mov edx, 0x10
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, edi
mov rdx, rbx
lea rcx, str.ERROR:_CreateDirectoryW__ls__failed___lx__n
call fcn.1400ec5f0
jmp 0x14005a348
xor edi, edi
mov rax, rbx
xor ebx, ebx
mov qword [rsp + 0xb8], rax
test rbx, rbx
je 0x14005a356
mov rcx, rbx
call fcn.140030c60
nop
jmp 0x14005a370
test edi, edi
jns 0x14005a3c7
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a39e
test byte [rcx + 0x1c], 2
je 0x14005a39e
mov edx, 0x43
mov r9d, edi
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.WARNING:_GetAppLayerLogsDir___failed___lx__n
call fcn.1400ec5f0
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14005a3c7
call fcn.140030c60
and qword [rsp + 0xb8], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0xa0], 0
and qword [rsp + 0xb0], 0
lea r8, str._windir_Microsoft_AntimalwareSupport
lea rdx, [0x14011f3e0]
lea rcx, [rsp + 0x60]
call fcn.1400f23a4
mov esi, eax
test eax, eax
jns 0x14005a43f
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a427
test byte [rcx + 0x1c], 1
je 0x14005a427
mov edx, 0x11
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, esi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400ec5f0
mov rdi, qword [rsp + 0x60]
jmp 0x14005a51f
mov rdi, qword [rsp + 0x60]
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1400f16b0
mov esi, eax
test eax, eax
jns 0x14005a49c
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a484
test byte [rcx + 0x1c], 1
je 0x14005a484
mov edx, 0x12
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, esi
lea rcx, str.ERROR:_UtilExpandEnvironmentStrings___failed___lx__n
call fcn.1400ec5f0
mov rbx, qword [rsp + 0xa0]
jmp 0x14005a512
xor edx, edx
mov rbx, qword [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14005a505
call fcn.1400f259c
mov esi, eax
cmp eax, 0x800700b7
je 0x14005a503
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a4ef
test byte [rcx + 0x1c], 4
je 0x14005a4ef
mov edx, 0x13
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, esi
mov rdx, rbx
lea rcx, str.INFO:_CreateDirectoryW__ls__failed___lx_._Likely_that_WDO_was_never_run_on_this_machine._n
call fcn.1400ec5f0
jmp 0x14005a512
xor esi, esi
mov rax, rbx
xor ebx, ebx
mov qword [rsp + 0xb0], rax
test rbx, rbx
je 0x14005a51f
mov rcx, rbx
call fcn.140030c60
test rdi, rdi
je 0x14005a52d
mov rcx, rdi
call fcn.140030c60
nop
jmp 0x14005a547
test esi, esi
jns 0x14005a59e
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a575
test byte [rcx + 0x1c], 4
je 0x14005a575
mov edx, 0x44
mov r9d, esi
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, esi
lea rcx, str.GetOfflineScannerSupportDir___failed___lx_._Likely_that_WDO_was_never_run_on_this_machine._n
call fcn.1400ec5f0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14005a59e
call fcn.140030c60
and qword [rsp + 0xb0], 0
xor ecx, ecx
call fcn.1400df5cc
nop
jmp 0x14005a5bc
test eax, eax
jns 0x14005a5f3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a5e7
test byte [rcx + 0x1c], 1
je 0x14005a5e7
mov edx, 0x45
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
lea rcx, str.ERROR:_Dumping_Log_Failed
call fcn.1400ec5f0
cmp dword [rsp + 0x98], 2
jne 0x14005a8a2
lea rcx, str.Collecting_events_from_Operational_Event_Log..._n
call fcn.1400ec618
nop
mov r9, qword [rsp + 0x58]
lea r8, str.OperationalEvents.txt
lea rdx, str.Microsoft_Windows_Windows_Defender_Operational
lea rcx, [rsp + 0x81]
call fcn.140069aa4
mov ebx, eax
jmp 0x14005a63d
test ebx, ebx
js 0x14005a64e
jmp 0x14005a686
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a678
test byte [rcx + 0x1c], 1
je 0x14005a678
mov edx, 0x46
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Collecting_events_from_WHC_Event_Log..._n
call fcn.1400ec618
nop
mov r9, qword [rsp + 0x58]
lea r8, str.WHCEvents.txt
lea rdx, str.Microsoft_Windows_Windows_Defender_WHC
lea rcx, [rsp + 0x81]
call fcn.140069aa4
mov ebx, eax
jmp 0x14005a6c2
test ebx, ebx
jns 0x14005a70b
jmp 0x14005a6d3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a6fd
test byte [rcx + 0x1c], 1
je 0x14005a6fd
mov edx, 0x47
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___lx__n
call fcn.1400ec5f0
lea rax, str._windir_logscbs
mov qword [rsp + 0x4c0], rax
lea rax, str.cbs.log
mov qword [rsp + 0x4c8], rax
lea rax, str.CBS_Log
mov qword [rsp + 0x4d0], rax
lea rcx, str._windir__system32winevtlogs
mov qword [rsp + 0x4d8], rcx
lea rax, str.application.evtx
mov qword [rsp + 0x4e0], rax
lea rax, str.Application_Event_Log
mov qword [rsp + 0x4e8], rax
mov qword [rsp + 0x4f0], rcx
lea rax, str.system.evtx
mov qword [rsp + 0x4f8], rax
lea rax, str.System_Event_Log
mov qword [rsp + 0x500], rax
lea rax, str._localappdata_packagesMicrosoft.6365217CE6EB4_8wekyb3d8bbweLocalStateLogs
mov qword [rsp + 0x508], rax
lea rax, str.GibraltarTrace.log
mov qword [rsp + 0x510], rax
lea rax, str.User_Security_App_Log
mov qword [rsp + 0x518], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x520], xmm0
and qword [rsp + 0x530], 0
xor ebx, ebx
mov dword [rsp + 0x78], ebx
movsxd rax, ebx
lea rsi, [rax + rax*2]
mov r15, qword [rsp + rsi*8 + 0x4c0]
test r15, r15
je 0x14005a922
mov rdi, qword [rsp + rsi*8 + 0x4d0]
mov qword [rsp + 0x240], rdi
mov rdx, rdi
lea rcx, str.Getting__ls_..._n
call fcn.1400ec618
nop
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + rsi*8 + 0x4c8]
mov rcx, r15
call fcn.140054ff0
mov esi, eax
jmp 0x14005a857
test esi, esi
jns 0x14005a89b
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a889
test byte [rcx + 0x1c], 1
je 0x14005a889
mov edx, 0x48
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, esi
mov rdx, rdi
lea rcx, str.ERROR:_GetLogFile__ls__failed___lx__n
call fcn.1400ec5f0
inc ebx
jmp 0x14005a7cf
cmp dword [rsp + 0x98], 4
je 0x14005a922
lea rcx, str.Collecting_events_from_System_Event_Log..._n
call fcn.1400ec618
nop
mov rdx, qword [rsp + 0x58]
lea rcx, str.System
call fcn.1400606fc
mov ebx, eax
jmp 0x14005a8d9
test ebx, ebx
jns 0x14005a922
jmp 0x14005a8ea
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a914
test byte [rcx + 0x1c], 1
je 0x14005a914
mov edx, 0x49
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Collecting_configuration_information..._n
call fcn.1400ec618
nop
call fcn.140063938
mov ebx, eax
jmp 0x14005a943
test ebx, ebx
jns 0x14005a98c
jmp 0x14005a954
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a97e
test byte [rcx + 0x1c], 1
je 0x14005a97e
mov edx, 0x4a
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandConfigDump___failed__lx_n
call fcn.1400ec5f0
lea rcx, str.Collecting_effective_configuration_information..._n
call fcn.1400ec618
nop
call fcn.140063d08
mov ebx, eax
jmp 0x14005a9ba
test ebx, ebx
jns 0x14005a9f6
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005a9e8
test byte [rcx + 0x1c], 1
je 0x14005a9e8
mov edx, 0x4b
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandEffectiveConfigJsonDump___failed__lx_n
call fcn.1400ec5f0
and qword [rsp + 0x230], 0
lea rax, [rsp + 0x220]
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x220], rax
cmp dword [rsp + 0x98], 4
je 0x14005abab
xor edx, edx
mov ecx, 0xa0000
call fcn.1400f4b34
test eax, eax
js 0x14005ab2b
lea rcx, str.Collecting_Windows_Update_logs..._n
call fcn.1400ec618
and qword [rsp + 0x60], 0
lea rdx, str._windir_LogsWindowsUpdate
lea rcx, [rsp + 0x60]
call fcn.1400f16b0
mov ebx, eax
test eax, eax
js 0x14005aadb
lea r9, [rsp + 0x220]
lea r8, str..etl
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140053374
mov ebx, eax
jmp 0x14005aaa4
test ebx, ebx
jns 0x14005ab13
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005aad2
test byte [rcx + 0x1c], 1
je 0x14005aad2
mov edx, 0x4c
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
jmp 0x14005ab0c
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005ab05
test byte [rcx + 0x1c], 1
je 0x14005ab05
mov edx, 0x4d
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_UtilExpandEnvironmentStrings___failed___lx__n
mov edx, ebx
call fcn.1400ec5f0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14005abab
call fcn.140030c60
jmp 0x14005abab
lea rcx, str.Getting_Windows_Update_log..._n
call fcn.1400ec618
nop
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rdx, str.WindowsUpdate.log
lea rcx, str._windir_
call fcn.140054ff0
mov ebx, eax
jmp 0x14005ab6f
test ebx, ebx
jns 0x14005abab
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005ab9d
test byte [rcx + 0x1c], 1
je 0x14005ab9d
mov edx, 0x4e
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetLogFile_WINDOWS_UPDATE_LOG_FILENAME__failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Dumping_cache_filenames_to_log..._n
call fcn.1400ec618
nop
mov dword [rsp + 0x240], 0xf17c75d5
mov dword [rsp + 0x244], 0x455fbe59
mov dword [rsp + 0x248], 0x94bf508d
mov dword [rsp + 0x24c], 0x5888a325
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x50], eax
and dword [rsp + 0x78], 0
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x50]
mov edx, 4
lea rcx, [rsp + 0x240]
call fcn.1400df8c4
mov esi, eax
test eax, eax
jns 0x14005ac68
mov rax, qword [0x140162280]
cmp rax, r14
je 0x14005ac56
test byte [rax + 0x1c], 1
je 0x14005ac56
mov edx, 0x12
mov r9d, esi
lea r8, [0x14013c9a0]
mov rcx, qword [rax + 0x10]
call fcn.140044450
mov rax, qword [0x140162280]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14005ac81
call qword [sym.imp.mpclient.dll_MpFreeMemory]
jmp 0x14005ac7a
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14005ac78
call qword [sym.imp.mpclient.dll_MpFreeMemory]
xor esi, esi
mov rax, qword [0x140162280]
jmp 0x14005aca9
test esi, esi
jns 0x14005ace0
cmp rax, r14
je 0x14005acd0
test byte [rax + 0x1c], 1
je 0x14005acd0
mov edx, 0x4f
mov r9d, esi
lea r8, [0x140123930]
mov rcx, qword [rax + 0x10]
call fcn.140044450
mov edx, esi
lea rcx, str.ERROR:_MpDumpCache_failed___lx__n
call fcn.1400ec5f0
xor esi, esi
and dword [rsp + 0x78], 0
lea r15, str.MOAC_file_dump
movsxd rax, dword [rsp + 0x78]
lea rcx, [rax + rax*4]
lea rbx, [rcx*8]
mov qword [rsp + 0x240], rbx
lea rax, [rbx + r15]
mov qword [rsp + 0x60], rax
mov rdx, qword [rax]
test rdx, rdx
je 0x14005aed3
lea rcx, str.Getting__ls_..._n
call fcn.1400ec618
nop
lea rax, [rbx + 0x20]
add rax, r15
mov qword [rsp + 0x88], rax
mov r9, qword [rax]
lea rax, [rbx + 0x18]
add rax, r15
mov qword [rsp + 0xa0], rax
mov rdx, qword [rax]
lea rax, [rbx + 0x10]
add rax, r15
mov qword [rsp + 0x90], rax
mov r8, qword [rsp + 0x58]
mov rcx, qword [rax]
call fcn.140054ff0
test eax, eax
js 0x14005cf03
jmp 0x14005ada7
test esi, esi
jns 0x14005adc4
mov rax, qword [rsp + 0x60]
mov r8d, esi
mov rdx, qword [rax]
lea rcx, str.ERROR:__ls_failed___lx__n
call fcn.1400ec618
xor esi, esi
test byte [rbx + r15 + 8], 1
je 0x14005aeca
and qword [rsp + 0xc0], 0
mov rax, qword [rsp + 0xa0]
mov r8, qword [rax]
lea rdx, str._ls.bak
lea rcx, [rsp + 0xc0]
call fcn.1400f23a4
test eax, eax
js 0x14005cf0b
xor ebx, ebx
mov qword [rsp + 0x240], rbx
mov rax, qword [rsp + 0x88]
mov r8, qword [rax]
test r8, r8
je 0x14005ae3e
lea rdx, str._ls.bak
lea rcx, [rsp + 0x240]
call fcn.1400f23a4
test eax, eax
js 0x14005cf13
mov rbx, qword [rsp + 0x240]
mov rax, qword [rsp + 0x90]
mov r9, rbx
mov r8, qword [rsp + 0x58]
mov rdi, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, qword [rax]
call fcn.140054ff0
test eax, eax
js 0x14005cf1a
test rbx, rbx
je 0x14005ae77
mov rcx, rbx
call fcn.140030c60
nop
test rdi, rdi
je 0x14005ae85
mov rcx, rdi
call fcn.140030c60
nop
jmp 0x14005aead
test esi, esi
jns 0x14005aeca
mov r8d, esi
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
lea rcx, str.ERROR:__ls_failed___lx__n
call fcn.1400ec618
xor esi, esi
inc dword [rsp + 0x78]
jmp 0x14005acec
and qword [rsp + 0x210], 0
lea rax, [rsp + 0x200]
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x200], rax
lea rcx, str.Getting_Dynamic_Signatures..._n
call fcn.1400ec618
nop
and qword [rsp + 0x90], 0
and qword [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rdi, str.Scan
mov rcx, rdi
call qword [sym.imp.mpclient.dll_MpConfigOpen]
mov ebx, eax
test eax, eax
jns 0x14005af78
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005af61
test byte [rcx + 0x1c], 1
je 0x14005af61
mov edx, 0x14
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, ebx
mov rdx, rdi
lea rcx, str.ERROR:_MpConfigOpen__ls__failed___lx__n
call fcn.1400ec5f0
jmp 0x14005b009
mov dword [rsp + 0x50], 2
and dword [rsp + 0x78], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x50]
lea rsi, str.DynamicSignatureLocation
mov rdx, rsi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
mov ebx, eax
test eax, eax
jns 0x14005b056
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005aff4
test byte [rcx + 0x1c], 1
je 0x14005aff4
mov edx, 0x15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.14006041c
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, str.ERROR:_MpConfigGetValueString__ls_ls__failed___lx__n
call fcn.1400ec5f0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005b019
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov rax, qword [0x140162280]
cmp rax, r14
je 0x14005b047
test byte [rax + 0x1c], 1
je 0x14005b047
mov edx, 0x19
lea r8, [0x140123930]
mov rcx, qword [rax + 0x10]
call fcn.140044430
mov rax, qword [0x140162280]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14005b0a3
jmp 0x14005b096
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005b066
call qword [sym.imp.mpclient.dll_MpConfigClose]
lea r9, [rsp + 0x200]
lea r8, [0x140123950]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.140053374
mov ebx, eax
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14005b09c
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rax, qword [0x140162280]
jmp 0x14005b0cb
test ebx, ebx
jns 0x14005b100
cmp rax, r14
je 0x14005b0f2
test byte [rax + 0x1c], 1
je 0x14005b0f2
mov edx, 0x50
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rax + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetFastPathSignatureBlobs_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_product_service_s__registration_information..._n
call fcn.1400ec618
nop
call fcn.140068480
mov ebx, eax
jmp 0x14005b121
test ebx, ebx
jns 0x14005b16a
jmp 0x14005b132
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b15c
test byte [rcx + 0x1c], 1
je 0x14005b15c
mov edx, 0x51
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectServiceInfo__MsMpSvc___failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_filter_manager_information..._n
call fcn.1400ec618
nop
call fcn.14006e50c
mov ebx, eax
jmp 0x14005b18b
test ebx, ebx
jns 0x14005b1d4
jmp 0x14005b19c
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b1c6
test byte [rcx + 0x1c], 1
je 0x14005b1c6
mov edx, 0x52
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectFltmcInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_device_control_information..._n
call fcn.1400ec618
nop
call fcn.140077ee0
mov ebx, eax
jmp 0x14005b202
test ebx, ebx
jns 0x14005b23e
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b230
test byte [rcx + 0x1c], 1
je 0x14005b230
mov edx, 0x53
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectDeviceControlInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_system_information..._n
call fcn.1400ec618
nop
call fcn.14006d7d8
mov ebx, eax
jmp 0x14005b25f
test ebx, ebx
jns 0x14005b2a8
jmp 0x14005b270
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b29a
test byte [rcx + 0x1c], 1
je 0x14005b29a
mov edx, 0x54
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectSystemInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_Windows_proxy_information..._n
call fcn.1400ec618
nop
call fcn.14006df28
mov ebx, eax
jmp 0x14005b2c9
test ebx, ebx
jns 0x14005b312
jmp 0x14005b2da
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b304
test byte [rcx + 0x1c], 1
je 0x14005b304
mov edx, 0x55
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectWindowsProxyInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_ACPI_information..._n
call fcn.1400ec618
nop
call fcn.140077200
mov ebx, eax
jmp 0x14005b333
test ebx, ebx
jns 0x14005b37c
jmp 0x14005b344
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b36e
test byte [rcx + 0x1c], 1
je 0x14005b36e
mov edx, 0x56
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectAcpiInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_TDT_status_information..._n
call fcn.1400ec618
nop
xor ecx, ecx
call fcn.14007778c
mov ebx, eax
jmp 0x14005b39f
test ebx, ebx
jns 0x14005b3e8
jmp 0x14005b3b0
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b3da
test byte [rcx + 0x1c], 1
je 0x14005b3da
mov edx, 0x57
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectTDTInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_file_list_and_version_information..._n
call fcn.1400ec618
nop
call fcn.14006d180
mov ebx, eax
jmp 0x14005b409
test ebx, ebx
jns 0x14005b452
jmp 0x14005b41a
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b444
test byte [rcx + 0x1c], 1
je 0x14005b444
mov edx, 0x58
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectFileVersions_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_threat_information..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140059c64
mov ebx, eax
jmp 0x14005b478
test ebx, ebx
jns 0x14005b4c1
jmp 0x14005b489
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b4b3
test byte [rcx + 0x1c], 1
je 0x14005b4b3
mov edx, 0x59
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectStats_failed___lx__n
call fcn.1400ec5f0
and qword [rsp + 0x90], 0
mov edx, 0x3fab
call fcn.1400f4b8c
test eax, eax
js 0x14005b9c3
mov edx, 0xc8
call fcn.1400584d8
mov ebx, eax
jmp 0x14005b502
test ebx, ebx
jns 0x14005b53e
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b530
test byte [rcx + 0x1c], 2
je 0x14005b530
mov edx, 0x5a
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.Flushing_current_session_logs_for_Windows_Security_Service_failed___lx__n
call fcn.1400ec5f0
lea rdx, str._programdata_MicrosoftWindows_Security_HealthLogs
lea rcx, [rsp + 0x90]
call fcn.1400f16b0
mov ebx, eax
test eax, eax
jns 0x14005b5ab
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b582
test byte [rcx + 0x1c], 2
je 0x14005b582
mov edx, 0x5b
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.Getting_WDSP_log_location_failed___lx_._n
call fcn.1400ec5f0
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14005b5ab
call fcn.140030c60
and qword [rsp + 0x90], 0
lea rcx, str.Getting_security_health_service_related_registry_keys..._n
call fcn.1400ec618
nop
and qword [rsp + 0x60], 0
lea r9, str.SecurityHealthRegistry.txt
mov r8, qword [rsp + 0x58]
lea rdx, [0x140123d80]
lea rcx, [rsp + 0x60]
call fcn.1400f23a4
mov edi, eax
test eax, eax
jns 0x14005b625
mov rax, qword [0x140162280]
cmp rax, r14
je 0x14005b612
test byte [rax + 0x1c], 1
je 0x14005b612
mov edx, 0x20
mov r9d, edi
lea r8, [0x140123930]
mov rcx, qword [rax + 0x10]
call fcn.140044450
mov rax, qword [0x140162280]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14005b722
jmp 0x14005b716
mov r8b, 1
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
call fcn.1400ec718
mov edi, eax
test eax, eax
js 0x14005b6dd
or r8d, 0xffffffff
lea rdx, str.SoftwareMicrosoftWindows_Security_Health
mov rsi, 0xffffffff80000002
mov rcx, rsi
call fcn.140068ca8
lea rdi, str.___________________n
mov rcx, rdi
call fcn.1400ec6e0
or r8d, 0xffffffff
lea rdx, str.SoftwareMicrosoftWindows_Defender_Security_Center
mov rcx, rsi
call fcn.140068ca8
mov rcx, rdi
call fcn.1400ec6e0
or r8d, 0xffffffff
lea rdx, str.SoftwarePoliciesMicrosoftWindows_Defender_Security_Center
mov rcx, rsi
call fcn.140068ca8
mov rcx, rdi
call fcn.1400ec6e0
call fcn.14005426c
mov rdi, qword [0x14016b530]
and qword [0x14016b530], 0
test rdi, rdi
je 0x14005b6cc
mov rcx, rdi
call fcn.1400ebb64
mov edx, 0x48
mov rcx, rdi
call fcn.140030c60
test rbx, rbx
je 0x14005b6d9
mov rcx, rbx
call fcn.140030c60
xor edi, edi
jmp 0x14005b71b
mov rax, qword [0x140162280]
cmp rax, r14
je 0x14005b70e
test byte [rax + 0x1c], 1
je 0x14005b70e
mov edx, 0x21
mov r9d, edi
lea r8, [0x140123930]
mov rcx, qword [rax + 0x10]
call fcn.140044450
mov rax, qword [0x140162280]
test rbx, rbx
je 0x14005b722
mov rcx, rbx
call fcn.140030c60
mov rax, qword [0x140162280]
jmp 0x14005b74a
test edi, edi
jns 0x14005b77f
cmp rax, r14
je 0x14005b771
test byte [rax + 0x1c], 1
je 0x14005b771
mov edx, 0x5c
mov r9d, edi
lea r8, [0x140123930]
mov rcx, qword [rax + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_CollectWdspRegistryKeys_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_security_health_service_registration_info..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400535e4
mov ebx, eax
jmp 0x14005b7b2
test ebx, ebx
jns 0x14005b7ee
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b7e0
test byte [rcx + 0x1c], 1
je 0x14005b7e0
mov edx, 0x5d
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_CollectWdspServiceInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_Image_File_Execution_Option_state..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140054378
mov ebx, eax
jmp 0x14005b821
test ebx, ebx
jns 0x14005b85e
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b84f
test byte [rcx + 0x1c], 1
je 0x14005b84f
mov edx, 0x5e
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_DumpIFEOKeys_failed___lx__n
call fcn.1400ec5f0
nop
mov rcx, qword [rsp + 0x58]
call fcn.14005452c
mov ebx, eax
jmp 0x14005b884
test ebx, ebx
jns 0x14005b8c1
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005b8b2
test byte [rcx + 0x1c], 2
je 0x14005b8b2
mov edx, 0x5f
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.Exporting_Exploit_Mitigation_Policies_failed___lx__n
call fcn.1400ec5f0
nop
and qword [rsp + 0x70], 0
lea rdx, str._SystemRoot_System32WinevtLogsMicrosoft_Windows_Security_Mitigations_4KernelMode.evtx
lea rcx, [rsp + 0x70]
call fcn.1400f16b0
test eax, eax
js 0x14005b92b
and qword [rsp + 0x60], 0
lea r9, str.Microsoft_Windows_Security_Mitigations_4KernelMode.evtx
mov r8, qword [rsp + 0x58]
lea rdx, [0x140123d80]
lea rcx, [rsp + 0x60]
call fcn.1400f23a4
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
test eax, eax
js 0x14005b91c
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test rbx, rbx
je 0x14005b930
mov rcx, rbx
call fcn.140030c60
jmp 0x14005b930
mov rdi, qword [rsp + 0x70]
and qword [rsp + 0x70], 0
lea rdx, str._SystemRoot_System32WinevtLogsMicrosoft_Windows_Security_Mitigations_4UserMode.evtx
lea rcx, [rsp + 0x70]
call fcn.1400f16b0
test eax, eax
js 0x14005b99a
and qword [rsp + 0x60], 0
lea r9, str.Microsoft_Windows_Security_Mitigations_4UserMode.evtx
mov r8, qword [rsp + 0x58]
lea rdx, [0x140123d80]
lea rcx, [rsp + 0x60]
call fcn.1400f23a4
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
test eax, eax
js 0x14005b98b
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test rsi, rsi
je 0x14005b99f
mov rcx, rsi
call fcn.140030c60
jmp 0x14005b99f
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14005b9ac
mov rcx, rbx
call fcn.140030c60
test rdi, rdi
je 0x14005b9ba
mov rcx, rdi
call fcn.140030c60
nop
jmp 0x14005b9c3
lea rcx, str.Getting_WSC_information..._n
call fcn.1400ec618
nop
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.1400665b0
mov ebx, eax
jmp 0x14005b9f8
test ebx, ebx
jns 0x14005ba34
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005ba26
test byte [rcx + 0x1c], 1
je 0x14005ba26
mov edx, 0x60
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectWscInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_WSC_related_registry_keys_and_service_registration..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400668d0
mov ebx, eax
jmp 0x14005ba67
test ebx, ebx
jns 0x14005baa3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005ba95
test byte [rcx + 0x1c], 1
je 0x14005ba95
mov edx, 0x61
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectWscRegistryKeys_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_Windows_Task_Scheduler_registrations..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140058270
mov ebx, eax
jmp 0x14005bad6
test ebx, ebx
jns 0x14005bb12
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005bb04
test byte [rcx + 0x1c], 1
je 0x14005bb04
mov edx, 0x62
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetWinTaskSchedulerEntries_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_the_contents_of_the_internal_task_scheduler..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140054de4
mov ebx, eax
jmp 0x14005bb45
test ebx, ebx
jns 0x14005bb81
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005bb73
test byte [rcx + 0x1c], 1
je 0x14005bb73
mov edx, 0x63
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetInternalSchedulerEntries_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_Network_Protection_remote_data_n
call fcn.1400ec618
and qword [rsp + 0x1f0], 0
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x1e0], rax
and qword [rsp + 0x60], 0
and qword [rsp + 0x240], 0
mov edx, 0x4268
call fcn.1400f4b8c
test eax, eax
js 0x14005bbed
mov edx, 0x44f5
call fcn.1400f4b8c
test eax, eax
jns 0x14005bbed
lea rdi, str.NetworkService
mov r9, rdi
jmp 0x14005bbfb
lea r9, str.LocalService
lea rdi, str.NetworkService
lea rax, str.remote
mov qword [rsp + 0x28], rax
lea r15, str.AppDataLocalMicrosoftWindowsSafetyNetwork
mov qword [rsp + 0x20], r15
lea r8, str._windir_ServiceProfiles
lea rdx, str._ls_ls_ls_ls
lea rcx, [rsp + 0x60]
call fcn.1400f23a4
mov ebx, eax
test eax, eax
jns 0x14005bc67
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005bc5b
test byte [rcx + 0x1c], 2
je 0x14005bc5b
mov edx, 0x64
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.Building_remote_NP_dir_path_failed___lx_._n
jmp 0x14005bd57
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x240]
call fcn.1400f16b0
mov esi, eax
test eax, eax
jns 0x14005bcc9
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005bcb0
test byte [rcx + 0x1c], 2
je 0x14005bcb0
mov edx, 0x65
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, esi
mov rdx, qword [rsp + 0x60]
lea rcx, str.Expanding__ls_failed___lx_._n
call fcn.1400ec5f0
jmp 0x14005bd5e
lea r9, [rsp + 0x1e0]
lea r8, [0x140123950]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x240]
call fcn.140053374
mov ebx, eax
jmp 0x14005bd22
test ebx, ebx
jns 0x14005bd5e
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005bd50
test byte [rcx + 0x1c], 1
je 0x14005bd50
mov edx, 0x66
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n__Likely_that_Network_Protection_was_not_enabled_on_this_machine
mov edx, ebx
call fcn.1400ec5f0
lea rcx, str.Getting_Network_Protection_local_data_n
call fcn.1400ec618
and qword [rsp + 0x1d0], 0
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x1c8], rax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x1c0], rax
and qword [rsp + 0xa0], 0
and qword [rsp + 0xc0], 0
mov edx, 0x4268
call fcn.1400f4b8c
test eax, eax
js 0x14005bdc1
mov edx, 0x44f5
call fcn.1400f4b8c
test eax, eax
js 0x14005bdc8
lea rdi, str.LocalService
lea rax, str.local
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, rdi
lea r8, str._windir_ServiceProfiles
lea rdx, str._ls_ls_ls_ls
lea rcx, [rsp + 0xa0]
call fcn.1400f23a4
mov ebx, eax
test eax, eax
jns 0x14005be33
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005be27
test byte [rcx + 0x1c], 2
je 0x14005be27
mov edx, 0x67
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.Building_local_NP_dir_path_failed___lx_._n
jmp 0x14005bf0a
mov rbx, qword [rsp + 0xa0]
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.1400f16b0
mov edi, eax
test eax, eax
jns 0x14005be98
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005be7f
test byte [rcx + 0x1c], 2
je 0x14005be7f
mov edx, 0x68
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
mov r8d, edi
mov rdx, qword [rsp + 0xa0]
lea rcx, str.Expanding__ls_failed___lx_._n
call fcn.1400ec5f0
jmp 0x14005bf11
lea r9, [rsp + 0x1c0]
lea r8, [0x140123950]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xc0]
call fcn.140053374
mov ebx, eax
jmp 0x14005bed5
test ebx, ebx
jns 0x14005bf11
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005bf03
test byte [rcx + 0x1c], 1
je 0x14005bf03
mov edx, 0x69
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n__Likely_that_Network_Protection_was_not_enabled_on_this_machine
mov edx, ebx
call fcn.1400ec5f0
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14016baf8], eax
jg 0x14005cf22
cmp byte [0x14016bafc], 0
je 0x14005bfa9
lea rcx, str.Getting_Firewall_Auto_Resolve_Rules_from_Powershell..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140054738
mov ebx, eax
jmp 0x14005bf6d
test ebx, ebx
jns 0x14005bfa9
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005bf9b
test byte [rcx + 0x1c], 1
je 0x14005bf9b
mov edx, 0x6a
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetAutoResolveRules_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_WfpState_information..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140058034
mov ebx, eax
jmp 0x14005bfdc
test ebx, ebx
jns 0x14005c018
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c00a
test byte [rcx + 0x1c], 1
je 0x14005c00a
mov edx, 0x6b
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetWfpStateXML_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_Network_Protection_State_information..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140055218
mov ebx, eax
jmp 0x14005c04b
test ebx, ebx
jns 0x14005c087
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c079
test byte [rcx + 0x1c], 1
je 0x14005c079
mov edx, 0x6c
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetNpSupportFile_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_WDATP_information..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140075aa8
mov ebx, eax
jmp 0x14005c0ba
test ebx, ebx
jns 0x14005c0f6
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c0e8
test byte [rcx + 0x1c], 1
je 0x14005c0e8
mov edx, 0x6d
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectSenseInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_Printer_information..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.140075778
mov ebx, eax
jmp 0x14005c129
test ebx, ebx
jns 0x14005c165
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c157
test byte [rcx + 0x1c], 1
je 0x14005c157
mov edx, 0x6e
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectPrinterInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Collecting_WinRE_logs..._n
call fcn.1400ec618
and qword [rsp + 0x1b0], 0
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x1a0], rax
and qword [rsp + 0x190], 0
lea rax, [rsp + 0x180]
mov qword [rsp + 0x188], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x180], rax
and qword [rsp + 0x170], 0
lea rax, [rsp + 0x160]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x160], rax
and qword [rsp + 0x150], 0
lea rax, [rsp + 0x140]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x140], rax
and qword [rsp + 0x130], 0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x120], rax
and qword [rsp + 0x110], 0
lea rax, [rsp + 0x100]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x100], rax
mov ecx, 0xa0000
call fcn.1400f4c34
test eax, eax
je 0x14005c695
and qword [rsp + 0x88], 0
lea rdx, str._windir_LogsReagent
lea rcx, [rsp + 0x88]
call fcn.1400f16b0
mov ebx, eax
test eax, eax
jns 0x14005c2d2
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c2c6
test byte [rcx + 0x1c], 2
je 0x14005c2c6
mov edx, 0x6f
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.Getting_windirLogsReagent_failed___lx_._n
jmp 0x14005c3be
lea r9, [rsp + 0x1a0]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
call fcn.140053374
mov ebx, eax
jmp 0x14005c30f
test ebx, ebx
jns 0x14005c34c
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c33d
test byte [rcx + 0x1c], 1
je 0x14005c33d
mov edx, 0x70
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
call fcn.1400ec5f0
nop
lea r9, [rsp + 0x180]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
call fcn.140053374
mov ebx, eax
jmp 0x14005c389
test ebx, ebx
jns 0x14005c3c5
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c3b7
test byte [rcx + 0x1c], 1
je 0x14005c3b7
mov edx, 0x71
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
mov edx, ebx
call fcn.1400ec5f0
and qword [rsp + 0x78], 0
lea rdx, str._windir_PantherUnattendGC
lea rcx, [rsp + 0x78]
call fcn.1400f16b0
mov ebx, eax
test eax, eax
jns 0x14005c438
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c40c
test byte [rcx + 0x1c], 2
je 0x14005c40c
mov edx, 0x72
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.Getting_windirPantherUnattendGC_failed___lx_._n
call fcn.1400ec5f0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14005c525
call fcn.140030c60
and qword [rsp + 0x78], 0
jmp 0x14005c525
lea r9, [rsp + 0x160]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
call fcn.140053374
mov ebx, eax
jmp 0x14005c472
test ebx, ebx
jns 0x14005c4af
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c4a0
test byte [rcx + 0x1c], 1
je 0x14005c4a0
mov edx, 0x73
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
call fcn.1400ec5f0
nop
lea r9, [rsp + 0x140]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
call fcn.140053374
mov ebx, eax
jmp 0x14005c4e9
test ebx, ebx
jns 0x14005c525
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c517
test byte [rcx + 0x1c], 1
je 0x14005c517
mov edx, 0x74
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
call fcn.1400ec5f0
and qword [rsp + 0x70], 0
lea rdx, str._windir_System32_recovery
lea rcx, [rsp + 0x70]
call fcn.1400f16b0
mov ebx, eax
test eax, eax
jns 0x14005c578
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c56c
test byte [rcx + 0x1c], 2
je 0x14005c56c
mov edx, 0x75
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.Getting_windir_system32_recovery_failed___lx_._n
jmp 0x14005c65e
lea r9, [rsp + 0x120]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
call fcn.140053374
mov ebx, eax
jmp 0x14005c5b2
test ebx, ebx
jns 0x14005c5ef
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c5e0
test byte [rcx + 0x1c], 1
je 0x14005c5e0
mov edx, 0x76
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
call fcn.1400ec5f0
nop
lea r9, [rsp + 0x100]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
call fcn.140053374
mov ebx, eax
jmp 0x14005c629
test ebx, ebx
jns 0x14005c665
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c657
test byte [rcx + 0x1c], 1
je 0x14005c657
mov edx, 0x77
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
mov edx, ebx
call fcn.1400ec5f0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005c674
call fcn.140030c60
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14005c683
call fcn.140030c60
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14005c695
call fcn.140030c60
lea rcx, str.Dumping_list_of_processes_with_MpDetoursCopyAccelerator_injection..._n
call fcn.1400ec618
mov rcx, qword [rsp + 0x58]
call fcn.1400555cc
mov ebx, eax
test eax, eax
jns 0x14005c6e9
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c6db
test byte [rcx + 0x1c], 4
je 0x14005c6db
mov edx, 0x78
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.GetProcessesThatHaveCopyAcceleratorDTourAttached___failed___lx_._n
call fcn.1400ec5f0
lea rcx, str.Getting_fsutil_usn_journal_information..._n
call fcn.1400ec618
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400a0e04
mov ebx, eax
jmp 0x14005c70f
test ebx, ebx
jns 0x14005c758
jmp 0x14005c720
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c74a
test byte [rcx + 0x1c], 1
je 0x14005c74a
mov edx, 0x79
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectFsutilUsnJournalInfo_failed___lx__n
call fcn.1400ec5f0
lea rcx, str.Getting_snapshot_information..._n
call fcn.1400ec618
call fcn.14009ea60
mov ebx, eax
test eax, eax
jns 0x14005c7a7
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005c799
test byte [rcx + 0x1c], 4
je 0x14005c799
mov edx, 0x7a
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.RunCommandCollectSnapshotsInfo___failed___lx_._n
call fcn.1400ec5f0
lea rdx, [0x14016a660]
lea rcx, [rsp + 0x250]
call fcn.1400523d4
nop
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x4c0], rax
mov byte [rsp + 0x4c8], 1
xor eax, eax
mov dword [rsp + 0x4c9], eax
mov word [rsp + 0x4cd], ax
mov byte [rsp + 0x4cf], al
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x4d0], rax
mov byte [rsp + 0x4d8], 0
xor eax, eax
mov dword [rsp + 0x4d9], eax
mov word [rsp + 0x4dd], ax
mov byte [rsp + 0x4df], al
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x4e0], rax
mov byte [rsp + 0x4e8], 0
xor eax, eax
mov dword [rsp + 0x4e9], eax
mov word [rsp + 0x4ed], ax
mov byte [rsp + 0x4ef], al
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x4f0], rax
mov byte [rsp + 0x4f8], 0
xor eax, eax
mov dword [rsp + 0x4f9], eax
mov word [rsp + 0x4fd], ax
mov byte [rsp + 0x4ff], al
lea rax, [rsp + 0x250]
cmp qword [rsp + 0x268], 8
cmovae rax, qword [rsp + 0x250]
mov qword [rsp + 0x500], rax
mov byte [rsp + 0x508], 0
xor eax, eax
mov dword [rsp + 0x509], eax
mov word [rsp + 0x50d], ax
mov byte [rsp + 0x50f], al
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe8], xmm0
and qword [rsp + 0xf8], rax
lea ecx, [rax + 0x50]
call fcn.14004126c
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
lea rbx, [rax + 0x50]
mov qword [rsp + 0xf8], rbx
mov r8d, 0x50
lea rdx, [rsp + 0x4c0]
mov rcx, rax
call fcn.140033470
mov qword [rsp + 0xf0], rbx
and qword [rsp + 0x88], 0
lea rcx, [rsp + 0x88]
call fcn.14005291c
nop
lea rcx, str.Creating_CAB_file..._n
call fcn.1400ec618
xor ebx, ebx
mov qword [rsp + 0x88], rbx
cmp byte [rsp + 0x930], bl
je 0x14005c9e0
lea r8, str.DiagOutputDir
lea rdx, [rsp + 0x88]
lea rcx, [0x1400f5170]
call fcn.1400f5658
mov ebx, eax
test eax, eax
js 0x14005cf58
mov rbx, qword [rsp + 0x88]
mov rcx, rbx
call fcn.1400f1434
mov edi, eax
test eax, eax
js 0x14005cf98
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x270]
call fcn.140032ec0
lea rdx, [rsp + 0x270]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14005cfd8
test dword [rsp + 0x270], 0x400
je 0x14005c9d8
cmp dword [rsp + 0x294], 0xa0000003
je 0x14005d01b
mov rcx, rbx
mov rsi, rbx
jmp 0x14005c9e7
mov rcx, qword [rsp + 0x58]
xor esi, esi
lea rdx, [rsp + 0xe8]
call fcn.140053c40
mov edi, eax
test eax, eax
js 0x14005d060
mov rdx, qword [rsp + 0x58]
cmp byte [rsp + 0x930], 0
cmovne rdx, rsi
lea r8, str.SupportFiles.cab
lea rcx, str.Files_successfully_created_in__lsMp_ls_n
call fcn.1400ec618
xor edx, edx
mov r8d, 0x202
lea rcx, [rsp + 0x540]
call fcn.140032ec0
mov dword [rsp + 0xcc], 0x101
lea rdx, [rsp + 0xcc]
lea rcx, [rsp + 0x540]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14005ca61
mov r15b, 1
jmp 0x14005caa3
xor r15b, r15b
call fcn.1400f259c
mov edi, eax
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005ca95
test byte [rcx + 0x1c], 1
je 0x14005ca95
mov edx, 0x80
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_GetUserNameW___failed___lx__n
call fcn.1400ec5f0
and qword [rsp + 0xd0], 0
cmp qword [rsp + 0xd8], 0
jne 0x14005cb52
movzx esi, byte [rsp + 0x68]
mov edx, esi
lea rcx, [rsp + 0xd0]
call fcn.140055dc4
mov edi, eax
test eax, eax
jns 0x14005cb1a
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005caff
test byte [rcx + 0x1c], 1
je 0x14005caff
mov edx, 0x81
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_GetSupportLogLocationPathFromConfig___failed___lx__n
call fcn.1400ec5f0
cmp byte [rsp + 0x68], 0
jne 0x14005d0a0
jmp 0x14005cb2f
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rax
test rax, rax
jne 0x14005cb5a
mov edx, 0x3fab
call fcn.1400f4b8c
test eax, eax
js 0x14005cc21
mov edx, 0xc9
call fcn.1400584d8
mov edi, eax
jmp 0x14005cbe4
movzx esi, byte [rsp + 0x80]
mov r8, qword [rsp + 0xd8]
mov edx, esi
mov rcx, qword [rsp + 0x58]
call fcn.14005375c
mov edi, eax
test eax, eax
jns 0x14005cb2f
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005cb9e
test byte [rcx + 0x1c], 1
je 0x14005cb9e
mov edx, 0x82
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.Error:_CopySupportLogs_failed___lx__n
call fcn.1400ec5f0
cmp byte [rsp + 0x68], 0
jne 0x14005d0a8
jmp 0x14005cb2f
test edi, edi
jns 0x14005cc21
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005cc12
test byte [rcx + 0x1c], 2
je 0x14005cc12
mov edx, 0x83
mov r9d, edi
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.Purging_logs_for_Windows_Security_Service_failed___lx__n
call fcn.1400ec5f0
nop
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14005cc35
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
test rbx, rbx
je 0x14005cc43
mov rcx, rbx
call fcn.140030c60
nop
lea rcx, [rsp + 0xe8]
call fcn.140052aec
nop
lea rcx, [rsp + 0x250]
call fcn.140045650
nop
lea rcx, [rsp + 0x100]
call fcn.1400527a8
nop
lea rcx, [rsp + 0x120]
call fcn.1400527a8
nop
lea rcx, [rsp + 0x140]
call fcn.1400527a8
nop
lea rcx, [rsp + 0x160]
call fcn.1400527a8
nop
lea rcx, [rsp + 0x180]
call fcn.1400527a8
nop
lea rcx, [rsp + 0x1a0]
call fcn.1400527a8
nop
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14005ccc6
call fcn.140030c60
nop
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x14005ccdc
mov rcx, rbx
call fcn.140030c60
nop
lea rcx, [rsp + 0x1c0]
call fcn.1400527a8
nop
mov rcx, qword [rsp + 0x240]
test rcx, rcx
je 0x14005ccfd
call fcn.140030c60
nop
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14005cd10
mov rcx, rbx
call fcn.140030c60
nop
lea rcx, [rsp + 0x1e0]
call fcn.1400527a8
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14005cd31
call fcn.140030c60
nop
lea rcx, [rsp + 0x200]
call fcn.1400527a8
nop
lea rcx, [rsp + 0x220]
call fcn.1400527a8
nop
cmp qword [rsp + 0xe0], 0
je 0x14005cd5f
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14005cd72
call fcn.140030c60
nop
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14005cd85
call fcn.140030c60
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14005cd94
call fcn.140030c60
mov rcx, qword [rsp + 0x8f0]
xor rcx, rsp
call fcn.140030c40
add rsp, 0x900
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
lea r14, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005cde4
test byte [rcx + 0x1c], 1
je 0x14005cde4
mov edx, 0x3d
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_MpSmartCoInitialize_failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
lea r14, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005ce2b
test byte [rcx + 0x1c], 1
je 0x14005ce2b
mov edx, 0x3e
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_CoInitializeSecurity_failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005ce6b
test byte [rcx + 0x1c], 1
je 0x14005ce6b
mov edx, 0x40
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_MpGetInstalledProductIdentifier_failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005cea8
test byte [rcx + 0x1c], 1
je 0x14005cea8
mov edx, 0x41
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
mov ebx, 0x80070032
mov edx, ebx
lea rcx, str.ERROR:_MpGetInstalledProductIdentifier_return_unknown_product___lx_._n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005ceed
test byte [rcx + 0x1c], 1
je 0x14005ceed
mov edx, 0x42
mov r9d, ebx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_GetSupportDir___failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
mov ecx, eax
call fcn.1400f10c4
nop
lea rcx, [0x14016baf8]
call fcn.140030f10
cmp dword [0x14016baf8], 0xffffffff
jne 0x14005bf31
call fcn.1400f7d48
mov byte [0x14016bafc], al
lea rcx, [0x14016baf8]
call fcn.140030eb0
nop
jmp 0x14005bf31
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005cf82
test byte [rcx + 0x1c], 1
je 0x14005cf82
mov edx, 0x7b
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, ebx
lea rcx, str.ERROR:_CreateCab___failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005cfc2
test byte [rcx + 0x1c], 1
je 0x14005cfc2
mov edx, 0x7c
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_CreateCab___failed___lx__n
call fcn.1400ec5f0
mov ecx, edi
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005d000
test byte [rcx + 0x1c], 1
je 0x14005d000
lea edx, [rax + 0x7e]
mov r9, rbx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044708
mov ebx, 0x80070002
mov edx, ebx
lea rcx, str.ERROR:_CreateCab___failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005d045
test byte [rcx + 0x1c], 1
je 0x14005d045
mov edx, 0x7e
mov r9, rbx
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044708
mov ebx, 0x80070032
mov edx, ebx
lea rcx, str.Error:_CreateCab___failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
mov rcx, qword [0x140162280]
cmp rcx, r14
je 0x14005d08a
test byte [rcx + 0x1c], 1
je 0x14005d08a
mov edx, 0x7f
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_CreateCab___failed___lx__n
call fcn.1400ec5f0
mov ecx, edi
call fcn.1400f10c4
nop
mov ecx, edi
call fcn.1400f10c4
int3
lea eax, [rdi + 0x7ff8fffb]
cmp eax, 0x3e
ja 0x14005d0c3
movabs rcx, 0x4001000000000001
bt rcx, rax
jb 0x14005d0db
cmp edi, 0x800700a1
je 0x14005d0db
mov edx, edi
lea rcx, str.Error:_Copy_of_the_Support_Logs_failed___lx__n
call fcn.1400ec618
jmp 0x14005d102
test r15b, r15b
je 0x14005d0f6
lea rdx, [rsp + 0x540]
lea rcx, str.Username:__ws_Error:_Support_Log_Location_is_Invalid_or_Not_Accessible__n
call fcn.1400ec618
jmp 0x14005d102
lea rcx, str.Error:_Support_Log_Location_is_Invalid_or_Not_Accessible__n
call fcn.1400ec618
mov ecx, edi
call fcn.1400f10c4
int3