Function at 0x14004eef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rsp + 0x6b8], rax
mov r13, rcx
lea rdi, [0x14016d280]
mov rcx, qword [0x14016d280]
lea r15, [0x14012c6b0]
cmp rcx, rdi
je 0x14004ef50
test byte [rcx + 0x1c], 8
je 0x14004ef50
mov edx, 0xa
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044360
call fcn.14004b680
xor r14d, r14d
test al, al
je 0x14004ff54
mov qword [rsp + 0x1b0], r14
lea rcx, [rsp + 0x1b0]
call fcn.1400c77b8
test eax, eax
jns 0x14004efa3
mov rcx, qword [0x14016d280]
cmp rcx, rdi
je 0x14004efa3
mov r12b, 2
test byte [rcx + 0x1c], r12b
je 0x14004efa6
lea edx, [r14 + 0xb]
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044380
jmp 0x14004efa6
mov r12b, 2
lea rcx, str.Start:_MpSignatureUpdate___n
call fcn.1400f5500
lea rcx, str.Signature_update_started_._._.
call fcn.14004a5a8
mov qword [rsp + 0xd8], r14
lea rdx, [rsp + 0xd8]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
mov ebx, eax
test eax, eax
js 0x14004f02e
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call fcn.1400f690c
mov ebx, eax
test eax, eax
jns 0x14004f070
mov rcx, qword [0x14016d280]
cmp rcx, rdi
je 0x14004f017
test byte [rcx + 0x1c], r12b
je 0x14004f017
mov edx, 0xc
mov r9d, eax
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, [0x14012b140]
call fcn.1400f5500
lea rcx, str.ERROR:_PrintEngineVersion_failed_with_hr_lx_n
jmp 0x14004f069
mov rcx, qword [0x14016d280]
cmp rcx, rdi
je 0x14004f054
test byte [rcx + 0x1c], r12b
je 0x14004f054
mov edx, 0xd
mov r9d, ebx
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, [0x14012b1d0]
call fcn.1400f5500
lea rcx, str.ERROR:_MpManagerOpen_failed_with_hr_lx_n
mov edx, ebx
call fcn.14004a5a8
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x14004f08b
call qword [sym.imp.mpclient.dll_MpHandleClose]
mov qword [rsp + 0xd8], r14
mov ebx, 0x521c820
mov dword [rsp + 0xc8], ebx
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rsp + 0xc8]
mov edx, ebx
lea rcx, str.MpCmdRun_SignatureUpdateTerminationTimeOut
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
test eax, eax
jns 0x14004f0c8
mov dword [rsp + 0xc8], ebx
jmp 0x14004f0cf
mov ebx, dword [rsp + 0xc8]
mov qword [rsp + 0x1a8], r14
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x20], rax
mov edx, ebx
lea rcx, [rsp + 0x1a8]
call fcn.1400fa510
test eax, eax
js 0x1400501ef
mov qword [rsp + 0x1a0], r14
call fcn.1400f6820
test al, al
je 0x14004f13f
mov ecx, 0x18
call fcn.140030f88
mov qword [rsp + 0x1c8], rax
lea rdx, str.53C9D589_6B66_4F30_9BAB_9A0193B0BAFC
mov rcx, rax
call fcn.1400f59d4
nop
test rax, rax
je 0x14004f137
lock inc dword [rax + 8]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0xe8], r14
lea rdx, [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
test eax, eax
js 0x1400501f7
call fcn.1400fd96c
mov dword [rsp + 0xc0], eax
shr rax, 0x20
mov dword [rsp + 0xc4], eax
mov rsi, qword [rsp + 0xc0]
mov qword [rsp + 0xc0], rsi
mov ebx, 5
xor edx, edx
mov r8d, 0x1b0
lea rcx, [rsp + 0x500]
call fcn.140032e00
lea rdx, [rsp + 0x500]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.mpclient.dll_MpManagerStatusQuery]
test eax, eax
js 0x14004f3a3
test byte [rsp + 0x500], 1
je 0x14004f3a3
mov qword [rsp + 0x190], r14
lea rcx, [rsp + 0x190]
call fcn.1400fb890
test eax, eax
js 0x14004f390
mov qword [rsp + 0x188], r14
mov r9d, ebx
lea r8, str.WinDefend
mov rbx, qword [rsp + 0x190]
mov rdx, rbx
lea rcx, [rsp + 0x188]
call fcn.1400fb8f4
test eax, eax
js 0x14004f381
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x328], xmm0
movups xmmword [rsp + 0x338], xmm0
mov dword [rsp + 0x348], eax
mov rdi, qword [rsp + 0x188]
mov rdx, rdi
lea rcx, [rsp + 0x328]
call fcn.1400fbaa0
test eax, eax
js 0x14004f369
mov r8d, dword [rsp + 0x32c]
lea eax, [r8 - 2]
test eax, 0xfffffffd
jne 0x14004f333
mov rax, qword [rsp + 0xc0]
cmp rax, rsi
jne 0x14004f2ad
mov rcx, qword [0x14016d280]
lea rdx, [0x14016d280]
cmp rcx, rdx
je 0x14004f2ad
test byte [rcx + 0x1c], r12b
je 0x14004f2ad
mov edx, 0xe
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044360
mov rax, qword [rsp + 0xc0]
mov rcx, rsi
sub rcx, rax
add rcx, 0x47868c00
movabs rax, 0x346dc5d63886594b
mul rcx
shr rdx, 0xb
mov eax, 0xfa
cmp edx, eax
cmova edx, eax
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
je 0x14004f2eb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14004f2f9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.1400fd96c
mov dword [rsp + 0xd0], eax
shr rax, 0x20
mov dword [rsp + 0xd4], eax
mov rdi, qword [rsp + 0xd0]
mov qword [rsp + 0xc0], rdi
mov rax, rdi
sub rax, rsi
cmp rax, 0x47868c00
ja 0x14004f3a3
jmp 0x14004f186
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x14004f369
test byte [rcx + 0x1c], r12b
je 0x14004f369
mov edx, 0xf
mov dword [rsp + 0x20], r8d
lea r9, str.WinDefend
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044694
test rdi, rdi
je 0x14004f377
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14004f3a3
mov rcx, rbx
jmp 0x14004f39d
mov rcx, qword [rsp + 0x188]
test rcx, rcx
je 0x14004f377
jmp 0x14004f371
mov rcx, qword [rsp + 0x190]
test rcx, rcx
je 0x14004f3a3
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0x20
call fcn.140030f88
mov rbx, rax
mov qword [rsp + 0xd0], rax
mov dword [rax + 8], r14d
lea rax, vtable.CUpdateNotifications.0
mov qword [rbx], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xc0], rax
mov qword [rax], r14
lea rcx, [rbx + 0x18]
mov qword [rsp + 0x210], rcx
mov dword [rcx], 0x80004005
mov edx, 1
mov rcx, rax
call fcn.1400fa3e8
test eax, eax
js 0x1400501ff
lock inc dword [rbx + 8]
mov qword [rsp + 0x198], rbx
lea rax, [0x14004e3e0]
mov qword [rsp + 0x2f8], rax
mov qword [rsp + 0x300], rbx
mov rdi, r14
mov qword [rsp + 0xe0], r14
mov rax, qword [r13]
lea rdx, str.ScheduleJob
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov r12d, 1
test rax, rax
lea esi, [r12 + 4]
cmovne r12d, esi
mov rax, qword [r13]
lea rdx, [0x14012b310]
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x14004f474
bts r12d, 0xa
mov rax, qword [r13]
lea rdx, [0x14012b318]
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x14004f550
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x14004f4be
test byte [rcx + 0x1c], 4
je 0x14004f4be
mov edx, 0x10
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044360
or r12d, 0x20
mov rax, qword [r13]
lea rdx, str.Path
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x14004f5e2
mov r8b, 1
mov edx, 8
lea rcx, [rsp + 0xe0]
call fcn.1400c7a08
test eax, eax
js 0x140050207
or rax, 0xffffffffffffffff
mov r8, qword [rsp + 0xd0]
inc rax
cmp word [r8 + rax*2], r14w
jne 0x14004f513
inc rax
lea rdx, [rax + rax]
cmp rdx, rax
jae 0x14004f533
mov eax, 0x80070057
jmp 0x14005020e
mov rdi, qword [rsp + 0xe0]
mov rcx, rdi
call fcn.1400c7a6c
test eax, eax
js 0x14005020e
jmp 0x14004f5e2
mov rax, qword [r13]
lea rdx, str.HTTP
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
jne 0x14004f5b4
mov rax, qword [r13]
lea rdx, str.MMPC
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
jne 0x14004f5b4
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x14004f5e2
test byte [rcx + 0x1c], 4
je 0x14004f5e2
mov edx, 0x12
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044360
jmp 0x14004f5e2
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x14004f5de
test byte [rcx + 0x1c], 4
je 0x14004f5de
mov edx, 0x11
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044360
or r12d, 0x10
lea rcx, [rsp + 0x350]
call fcn.14004af80
mov rax, qword [0x140176940]
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x14004f8c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x14016d460], esi
movabs rsi, 0x400000000000
jbe 0x14004f8b0
test qword [0x14016d470], rsi
je 0x14004f8b0
mov rax, qword [0x14016d478]
and rax, rsi
cmp rax, qword [0x14016d478]
jne 0x14004f8b0
mov dword [rsp + 0x1b8], r12d
mov rax, qword [r13]
lea rdx, str.ScheduleJob
mov rcx, r13
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov ecx, r14d
test rax, rax
setne cl
mov dword [rsp + 0xf0], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0xf4], eax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x2f0], rax
mov rdx, r14
lock xadd qword [rsp + 0x3d8], rdx
lea r8, [rsp + 0x3e0]
lea rcx, [rsp + 0x350]
call fcn.14004dea4
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0x1d0], rax
mov rcx, qword [0x140176938]
mov eax, dword [rcx + 0x48]
mov dword [rsp + 0xf8], eax
mov eax, dword [rcx + 0x44]
mov dword [rsp + 0xfc], eax
mov eax, dword [rcx + 0x40]
mov dword [rsp + 0x100], eax
movzx eax, byte [rcx + 0x3c]
mov dword [rsp + 0x104], eax
movzx eax, byte [rcx + 0x3b]
mov dword [rsp + 0x108], eax
movzx eax, byte [rcx + 0x3a]
mov dword [rsp + 0x10c], eax
movzx eax, byte [rcx + 0x39]
mov dword [rsp + 0x110], eax
movzx eax, byte [rcx + 0x38]
mov dword [rsp + 0x114], eax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x1d8], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x1e0], rax
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x1f8], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], 0x2000000
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xf4]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xfc]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x104]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x10c]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x114]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x208]
mov qword [rsp + 0x20], rax
lea rdx, [0x1401594aa]
call fcn.140001304
mov rbx, qword [rsp + 0x198]
mov rdi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14004f8ca
movabs rsi, 0x400000000000
mov edx, r12d
lea rcx, str.Calling_MpUpdateStartEx_with_option__lx_n
call fcn.1400f5500
mov qword [rsp + 0x1c0], r14
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2f8]
mov r8, rdi
mov edx, r12d
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.mpclient.dll_MpUpdateStartEx]
mov r12d, eax
test eax, eax
js 0x140050216
or edx, 0xffffffff
mov rcx, qword [rsp + 0xc0]
mov rcx, qword [rcx]
call fcn.1400faddc
test al, al
je 0x14004f934
mov r12d, 0x800705b4
jmp 0x14004f940
mov r12, qword [rsp + 0x210]
mov r12d, dword [r12]
lea rcx, [rsp + 0x350]
call fcn.14004b5a0
mov r13, qword [0x140176940]
test r13, r13
je 0x14004fbaf
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x14016d460], 5
jbe 0x14004fba6
test qword [0x14016d470], rsi
je 0x14004fba6
mov rax, qword [0x14016d478]
and rax, rsi
cmp rax, qword [0x14016d478]
jne 0x14004fba6
mov dword [rsp + 0x118], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x11c], eax
mov rdx, r14
lock xadd qword [rsp + 0x3d8], rdx
lea r8, [rsp + 0x470]
lea rcx, [rsp + 0x350]
call fcn.14004dea4
lea rax, [rsp + 0x470]
mov qword [rsp + 0x218], rax
mov rcx, qword [0x140176938]
mov eax, dword [rcx + 0x48]
mov dword [rsp + 0x120], eax
mov eax, dword [rcx + 0x44]
mov dword [rsp + 0x124], eax
mov eax, dword [rcx + 0x40]
mov dword [rsp + 0x128], eax
movzx eax, byte [rcx + 0x3c]
mov dword [rsp + 0x12c], eax
movzx eax, byte [rcx + 0x3b]
mov dword [rsp + 0x130], eax
movzx eax, byte [rcx + 0x3a]
mov dword [rsp + 0x134], eax
movzx eax, byte [rcx + 0x39]
mov dword [rsp + 0x138], eax
movzx eax, byte [rcx + 0x38]
mov dword [rsp + 0x13c], eax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x220], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x228], rax
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x230], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x238], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x240], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x248], rax
mov qword [rsp + 0x250], 0x2000000
lea rax, [rsp + 0x118]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x11c]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x218]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x124]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x128]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x12c]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x134]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x138]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x13c]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x238]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x248]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
mov qword [rsp + 0x20], rax
lea rdx, [0x1401593a4]
call fcn.14000161c
mov rbx, qword [rsp + 0x198]
mov rdi, qword [rsp + 0xe0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r12d, r12d
js 0x140050269
lea rax, str.Signature_update_finished._No_updates_needed_n
lea rcx, str.Signature_update_finished._n
test r12d, r12d
cmovne rcx, rax
call fcn.14004a5a8
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x14004fbfc
test byte [rcx + 0x1c], 4
je 0x14004fbfc
mov edx, 0x15
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044360
lea rcx, str.Finish:_MpSignatureUpdate___n
call fcn.1400f5500
mov r15, qword [0x140176940]
test r15, r15
je 0x14004fe5f
mov qword [rsp + 0x308], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x310], 1
cmp dword [0x14016d460], 5
jbe 0x14004fe55
test qword [0x14016d470], rsi
je 0x14004fe55
mov rax, qword [0x14016d478]
and rax, rsi
cmp rax, qword [0x14016d478]
jne 0x14004fe55
mov dword [rsp + 0x140], r12d
lea rax, [0x140128db6]
mov qword [rsp + 0x258], rax
lea rax, str.Platform.SignatureUpdate
mov qword [rsp + 0x260], rax
mov rcx, qword [0x140176938]
mov eax, dword [rcx + 0x48]
mov dword [rsp + 0x144], eax
mov eax, dword [rcx + 0x44]
mov dword [rsp + 0x148], eax
mov eax, dword [rcx + 0x40]
mov dword [rsp + 0x14c], eax
movzx eax, byte [rcx + 0x3c]
mov dword [rsp + 0x150], eax
movzx eax, byte [rcx + 0x3b]
mov dword [rsp + 0x154], eax
movzx eax, byte [rcx + 0x3a]
mov dword [rsp + 0x158], eax
movzx eax, byte [rcx + 0x39]
mov dword [rsp + 0x15c], eax
movzx eax, byte [rcx + 0x38]
mov dword [rsp + 0x160], eax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x268], rax
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x270], rax
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x278], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x280], rax
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x288], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x298], 0x1000000
mov qword [rsp + 0x2a0], 1
lea rax, [rsp + 0x140]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x258]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x144]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x148]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x14c]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x154]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x15c]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x268]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x278]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x280]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x288]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2a0]
lea rdx, [0x140159289]
call fcn.1400018d0
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rcx, qword [rsp + 0x1c0]
test rcx, rcx
je 0x14004fe73
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
test rdi, rdi
je 0x14004fe90
cmp qword [rdi], r14
je 0x14004fe86
mov rcx, qword [rdi]
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, rdi
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
test rbx, rbx
je 0x14004febb
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
sub eax, 1
jg 0x14004febb
mov rcx, qword [rsp + 0x198]
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call fcn.140107c30
nop
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14004fecf
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
jmp 0x14004fee0
mov rax, qword [rsp + 0x1a0]
test rax, rax
je 0x14004ff13
or ecx, 0xffffffff
lock xadd dword [rax + 8], ecx
sub ecx, 1
jg 0x14004ff13
mov rcx, qword [rsp + 0x1a0]
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call fcn.140107c30
nop
mov rdx, qword [rsp + 0x1a8]
test rdx, rdx
je 0x14004ff2d
or r8, 0xffffffffffffffff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
nop
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x14004ff41
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x14004ff54
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rsp + 0x6b8]
xor rcx, rsp
call fcn.140030b80
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, eax
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
mov ecx, eax
call fcn.1400f9fc4
nop
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x140050243
test byte [rcx + 0x1c], 1
je 0x140050243
mov edx, 0x13
mov r9d, r12d
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, r12d
lea rcx, str.ERROR:_MpUpdateStart_failed_with_hr_lx_n
call fcn.1400f5500
mov edx, r12d
lea rcx, [0x14012b408]
call fcn.14004a5a8
mov ecx, r12d
call fcn.1400f9fc4
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x140050296
test byte [rcx + 0x1c], 1
je 0x140050296
mov edx, 0x14
mov r9d, r12d
mov r8, r15
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, r12d
lea rcx, str.ERROR:_Signature_Update_failed_with_hr_lx_n
call fcn.1400f5500
mov edx, r12d
lea rcx, [0x14012b408]
call fcn.14004a5a8
mov ecx, r12d
call fcn.1400f9fc4
int3