Function at 0x140006520
Capabilities:
Print debug messages

Disassembly:
test rdx, rdx
je 0x140006e92
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14009d2d0]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rsi, rdx
mov r14, rcx
mov rax, qword [rdx]
mov rcx, rdx
mov rax, qword [rax]
call qword [case.0x1400408d8.0]
test eax, eax
jne 0x140006e6c
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x18]
call qword [case.0x1400408d8.0]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movq rax, xmm0
cmp qword [0x140087d88], rax
jne 0x14000675f
mov rax, qword [0x140087d90]
cmp rax, qword [rbp + 0x18]
jne 0x14000675f
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
mov rax, qword [rsi]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov rax, qword [rax + 0x78]
call qword [case.0x1400408d8.0]
mov dword [rsp + 0x30], eax
cmp qword [rsp + 0x38], 4
je 0x14000662f
lea ecx, [r15 + 5]
call fcn.14002bb50
test eax, eax
je 0x140006e6c
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, str.GetRegValueData_returned_unexpected_value_size._Expected_sizeof_DWORD___found___d_
mov r9d, 0x1aa
mov qword [rsp + 0x20], rax
lea r8, str.CAacEventReporter::shutdown_reasoncode_changed
lea rdx, str.E:BTc1fd866d_3751_4c72_a231_f6b223727ef9_vscore_srcMcAPExeAccessProtectionHandler.cpp
mov ecx, 5
call fcn.140001f30
jmp 0x140006e6c
cmp eax, 4
je 0x14000665f
mov ecx, 5
call fcn.14002bb50
test eax, eax
je 0x140006e6c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, str.GetRegValueData_returned_unexpected_value_type._Expected_REG_DWORD__found___lx_
mov r9d, 0x1b0
jmp 0x14000660d
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x1400066a8
lea ecx, [rax + 5]
call fcn.14002bb50
test eax, eax
je 0x140006e6c
lea rax, str.GetRegValueData_returned_null_value_data
mov qword [rsp + 0x20], rax
mov r9d, 0x1b6
lea r8, str.CAacEventReporter::shutdown_reasoncode_changed
lea rdx, str.E:BTc1fd866d_3751_4c72_a231_f6b223727ef9_vscore_srcMcAPExeAccessProtectionHandler.cpp
mov ecx, 5
call fcn.14000da30
jmp 0x140006e6c
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
add eax, 0xfffdffff
cmp eax, 0x19
ja 0x140006714
mov ecx, 0x2000005
bt ecx, eax
jae 0x140006714
mov ecx, 1
call fcn.14002bb50
test eax, eax
je 0x140006704
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, str.ShutdownReasonCode_was_changed_for_system_restore__system_reset_or_system_upgrade__ReasonCode___lx_
mov qword [rsp + 0x20], rax
mov r9d, 0x1bf
lea r8, str.CAacEventReporter::shutdown_reasoncode_changed
lea rdx, str.E:BTc1fd866d_3751_4c72_a231_f6b223727ef9_vscore_srcMcAPExeAccessProtectionHandler.cpp
mov ecx, 1
call fcn.140001f30
mov dl, 1
mov rcx, qword [r14 + 0x48]
call fcn.140007680
jmp 0x140006e6c
mov ecx, 1
call fcn.14002bb50
test eax, eax
je 0x140006e6c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, str.ShutdownReasonCode_was_changed_to__lx
mov qword [rsp + 0x20], rax
mov r9d, 0x1c4
lea r8, str.CAacEventReporter::shutdown_reasoncode_changed
lea rdx, str.E:BTc1fd866d_3751_4c72_a231_f6b223727ef9_vscore_srcMcAPExeAccessProtectionHandler.cpp
mov ecx, 1
call fcn.140001f30
jmp 0x140006e6c
call fcn.14000de60
mov rcx, rax
test rax, rax
je 0x140006e99
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400408d8.0]
add rax, 0x18
mov qword [rsp + 0x30], rax
call fcn.14000de60
mov rcx, rax
test rax, rax
je 0x140006ea4
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x1400408d8.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, dword [0x1400a0fe0]
lea eax, [r8 + 1]
mov dword [0x1400a0fe0], eax
lea rdx, str.Aac_Event__d:
lea rcx, [rsp + 0x30]
call fcn.140008250
xor r15d, r15d
mov qword [rsp + 0x48], r15
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x140006810
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x140006810
lea rdx, str._tRule_ID:_s_
lea rcx, [rsp + 0x30]
call fcn.140008280
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x108]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tInitiator:_s_
lea rcx, [rsp + 0x30]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x108]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str.Initiator:_s_
lea rcx, [rsp + 0x38]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x38]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tPID:_d_
lea rcx, [rsp + 0x30]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x38]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tPID:_d_
lea rcx, [rsp + 0x38]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x40]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tTID:_d_
lea rcx, [rsp + 0x30]
call fcn.140008280
mov rax, qword [rsi]
mov dl, 1
mov rcx, rsi
mov rax, qword [rax + 0x110]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tTarget:_s_
lea rcx, [rsp + 0x30]
call fcn.140008280
mov rax, qword [rsi]
mov dl, 1
mov rcx, rsi
mov rax, qword [rax + 0x110]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tTarget:_s_
lea rcx, [rsp + 0x38]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x48]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tPID:_d_
lea rcx, [rsp + 0x30]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x48]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tPID:_d_
lea rcx, [rsp + 0x38]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x30]
call qword [case.0x1400408d8.0]
mov ecx, eax
call fcn.14000a010
mov word [rbp - 0x70], r15w
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000a190
nop
mov r8, qword [rbp - 0x68]
lea rdx, str._tTargetType:_s_
lea rcx, [rsp + 0x30]
call fcn.140008280
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x30]
call qword [case.0x1400408d8.0]
mov ecx, eax
call fcn.14000a010
mov word [rbp - 0x58], r15w
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14000a190
nop
mov r8, qword [rbp - 0x50]
lea rdx, str._tTargetType:_s_
lea rcx, [rsp + 0x38]
call fcn.140008280
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0xa8]
call qword [case.0x1400408d8.0]
mov r8d, eax
lea rdx, str._tWindows_Access_Mask:_x_
lea rcx, [rsp + 0x30]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x10]
call qword [case.0x1400408d8.0]
mov r8, rax
lea rdx, str._tAccess_Mask:_x_
lea rcx, [rsp + 0x30]
call fcn.140008280
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x1400408d8.0]
mov ecx, eax
call fcn.140009f30
mov word [rbp - 0x40], r15w
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14000a190
nop
mov r8, qword [rbp - 0x38]
lea rdx, str._tReaction_Type:_s
lea rcx, [rsp + 0x30]
call fcn.140008280
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x1400408d8.0]
mov ecx, eax
call fcn.140009f30
mov word [rbp - 0x28], r15w
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14000a190
nop
mov r8, qword [rbp - 0x20]
lea rdx, str._tReaction_Type:_s
lea rcx, [rsp + 0x38]
call fcn.140008280
nop
lea rcx, [rbp - 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rdi, qword [rsp + 0x30]
cmp dword [0x1400a0fdc], 0
je 0x140006aea
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x1400408d8.0]
add eax, 0xfffffff0
mov r12, 0xffffffffffffffff
mov rbx, qword [rsp + 0x38]
test eax, 0xffffffef
jne 0x140006e25
lea rax, [r14 + 0x20]
mov qword [rbp - 0x80], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp - 0x78], 1
cmp qword [r14 + 0x18], 0
je case.default.0x140006b58
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x30]
call qword [case.0x1400408d8.0]
dec eax
cmp eax, 5
ja case.default.0x140006b58
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x6ebc]
add rcx, rdx
jmp rcx
lea rdx, str.FileBlocked
jmp 0x140006b7c
lea rdx, str.RegBlocked
jmp 0x140006b7c
lea rdx, str.ProcessBlocked
jmp 0x140006b7c
lea rdx, str.HookBlocked
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
mov r9d, 1
lea r8d, [r9 + 3]
mov rax, qword [rax + 0x28]
call qword [case.0x1400408d8.0]
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r15w
mov r8, r12
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x140006bb0
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.14000ea70
nop
cmp qword [r14 + 0x10], 0x3e8
jbe 0x140006c42
lea rcx, [r14 + 8]
mov rdx, qword [rcx]
mov rdx, qword [rdx]
call fcn.140007db0
mov rsi, rax
mov rdx, qword [rax + 0x38]
cmp rdx, 8
jb 0x140006c24
mov rcx, qword [rax + 0x20]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140006c1f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006eaf
mov rcx, r8
call fcn.140043780
mov qword [rsi + 0x30], r15
mov qword [rsi + 0x38], 7
mov word [rsi + 0x20], r15w
mov edx, 0x40
mov rcx, rsi
call fcn.140043780
lea rax, [r14 + 8]
mov qword [rsp + 0x40], rax
mov r13, qword [rax]
mov rsi, qword [r13 + 8]
mov r14, r13
cmp byte [rsi + 0x19], 0
jne 0x140006c8b
nop dword [rax + rax]
lea rcx, [rsi + 0x20]
lea rdx, [rbp - 0x10]
call fcn.14000b2c0
test al, al
je 0x140006c77
mov rsi, qword [rsi + 0x10]
jmp 0x140006c7d
mov r13, rsi
mov rsi, qword [rsi]
cmp byte [rsi + 0x19], 0
je 0x140006c60
mov r14, qword [rsp + 0x40]
mov r14, qword [r14]
cmp byte [r13 + 0x19], 0
jne 0x140006cac
lea rdx, [r13 + 0x20]
lea rcx, [rbp - 0x10]
call fcn.14000b2c0
test al, al
jne 0x140006cac
cmp r13, r14
jne 0x140006dd9
mov rsi, qword [r14 + 8]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x58], r15d
cmp byte [rsi + 0x19], 0
jne 0x140006cf5
mov qword [rsp + 0x50], rsi
lea rcx, [rsi + 0x20]
lea rdx, [rbp - 0x10]
call fcn.14000b2c0
test al, al
je 0x140006ce1
mov dword [rsp + 0x58], r15d
mov rsi, qword [rsi + 0x10]
jmp 0x140006cef
mov dword [rsp + 0x58], 1
mov r14, rsi
mov rsi, qword [rsi]
cmp byte [rsi + 0x19], 0
je 0x140006cc0
cmp byte [r14 + 0x19], 0
jne 0x140006d0d
lea rdx, [r14 + 0x20]
lea rcx, [rbp - 0x10]
call fcn.14000b2c0
test al, al
je 0x140006d7e
movabs rax, 0x3ffffffffffffff
mov r13, qword [rsp + 0x40]
cmp qword [r13 + 8], rax
je 0x140006eb5
mov r14, qword [r13]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r15
mov ecx, 0x40
call fcn.1400437bc
mov rsi, rax
mov qword [rsp + 0x78], rax
lea rcx, [rax + 0x20]
lea rdx, [rbp - 0x10]
call fcn.14000c750
mov qword [rsi], r14
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], r14
mov word [rsi + 0x18], 0
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x50], xmm0
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.140008cb0
mov ecx, 1
call fcn.14002bb50
test eax, eax
je 0x140006dd9
cmp dword [rdi - 8], 1
jle 0x140006da4
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400092f0
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140086ef0]
mov qword [rsp + 0x20], rax
mov r9d, 0x18f
lea r8, str.CAacEventReporter::ReportEventW
lea rdx, str.E:BTc1fd866d_3751_4c72_a231_f6b223727ef9_vscore_srcMcAPExeAccessProtectionHandler.cpp
call fcn.140008340
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140006e1a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e93
call fcn.140043780
nop
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006e47
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400408d8.0]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x140006e6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400408d8.0]
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140043760
mov rbx, qword [rsp + 0x180]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14004fbe0
nop
mov ecx, 0x80004005
call fcn.14000ef90
nop
mov ecx, 0x80004005
call fcn.14000ef90
nop
call fcn.14004fbe0
int3
call fcn.14000b340
int3