Function at 0x1400309b0
Capabilities:
Create service
Delete registry key
Delete service
Disable system features via registry on windows
Get common file path
Modify service
Persist via windows service
Query or enumerate registry value
Query service status
Set registry value
Start service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x27290
call fcn.1400ae240
sub rsp, rax
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rsp + 0x27280], rax
mov qword [rsp + 0xc8], rdx
mov edi, ecx
xor edx, edx
mov qword [rsp + 0x1d0], rdx
mov dword [rsp + 0x190], edx
mov qword [rsp + 0xf0], rdx
mov r14d, edx
mov qword [rsp + 0x70], rdx
mov r15d, edx
mov dword [rsp + 0x108], edx
mov dword [rsp + 0xdc], edx
mov dword [rsp + 0xd0], edx
mov ebx, edx
mov dword [rsp + 0xfc], edx
mov dword [rsp + 0xe8], edx
mov r13d, edx
mov r12d, edx
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xc0], rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x198], xmm0
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x1b0], eax
mov eax, 1
mov dword [rsp + 0x1c8], eax
mov esi, edx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0x80], rdx
mov r8d, 0x3fc
lea rcx, [rsp + 0xb790]
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
mov qword [rsp + 0x178], rcx
mov dword [rsp + 0x188], ecx
mov qword [rsp + 0x88], rcx
mov dword [rsp + 0xe0], ecx
mov dword [rsp + 0xd4], ecx
movups xmm0, xmmword [str.ESRV_SVC_QUEENCREEK]
movups xmmword [rsp + 0xaf30], xmm0
movups xmm1, xmmword [0x1400dca88]
movups xmmword [rsp + 0xaf40], xmm1
movsd xmm0, qword [0x1400dca98]
movsd qword [rsp + 0xaf50], xmm0
movups xmm1, xmmword [str.USER_ESRV_SVC_QUEENCREEK]
movups xmmword [rsp + 0xaf58], xmm1
movups xmm0, xmmword [0x1400dc9f8]
movups xmmword [rsp + 0xaf68], xmm0
movups xmm1, xmmword [0x1400dca08]
movups xmmword [rsp + 0xaf78], xmm1
movzx eax, word [0x1400dca18]
mov word [rsp + 0xaf88], ax
lea rax, [0x1400dc9d8]
mov qword [rsp + 0x128], rax
lea rax, str.__LIBRARY
mov qword [rsp + 0x130], rax
lea rax, [0x1400dc968]
mov qword [rsp + 0x138], rax
lea rax, [0x1400dc8f8]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x150], rcx
mov dword [rsp + 0x18c], ecx
movaps xmm0, xmmword [str.Intel_r__Energy_Checker_SDK._ESRV_Service_queencreek]
movaps xmmword [rsp + 0x13320], xmm0
movaps xmm1, xmmword [0x1400de630]
movaps xmmword [rsp + 0x13330], xmm1
movaps xmm0, xmmword [0x1400de640]
movaps xmmword [rsp + 0x13340], xmm0
movaps xmm1, xmmword [0x1400de650]
movaps xmmword [rsp + 0x13350], xmm1
movaps xmm0, xmmword [0x1400de660]
movaps xmmword [rsp + 0x13360], xmm0
movaps xmm1, xmmword [0x1400de670]
movaps xmmword [rsp + 0x13370], xmm1
movsd xmm0, qword [0x1400de680]
movsd qword [rsp + 0x13380], xmm0
movzx eax, word [0x1400de688]
mov word [rsp + 0x13388], ax
xor edx, edx
mov r8d, 0x4f46
lea rcx, [rsp + 0x1338a]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x4fb0
lea rcx, [rsp + 0xe370]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x4fb0
lea rcx, [rsp + 0x182d0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x27d8
lea rcx, [rsp + 0xbb90]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x1b8], 0x4fb0
xor eax, eax
mov dword [rsp + 0x148], eax
mov qword [rsp + 0xe40], rax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xaf90]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0xa080
lea rcx, [rsp + 0xeb0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0x1d280]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0xe78], xmm0
movups xmmword [rsp + 0xe88], xmm0
movups xmmword [rsp + 0xe98], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rsp + 0xe50], xmm1
movups xmmword [rsp + 0xe60], xmm1
mov qword [rsp + 0xe70], rax
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x1e4], eax
mov dword [rsp + 0x1e8], eax
mov dword [rsp + 0x1bc], eax
mov qword [rsp + 0x168], rax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xb390]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x1d8], 0xff
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xb590]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x1dc], 0xff
mov dword [rsp + 0x1e0], 7
mov dword [rsp + 0x1cc], 1
xor eax, eax
mov qword [rsp + 0xe48], rax
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x170], rax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xb190]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
nop
call fcn.1400954e0
lea rcx, [0x140113930]
cmp eax, 1
jne 0x140030f2d
lea rdi, [0x140125448]
mov rdx, rdi
call fcn.1400a0f40
test eax, eax
je 0x140030de9
mov r12, qword [rsp + 0x88]
mov r15d, esi
lea ebx, [rsi + 1]
xor r13d, r13d
jmp 0x14003e4a2
mov ebx, 1
mov dword [0x1401261fc], ebx
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x30f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x30f
mov r8d, eax
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, str.C:JenkinsWorkspaceBUILDGitReposiecsdk_srcenergy_server_driversesrvdriver.c
mov qword [rsp + 0x20], rax
lea r9, [0x1400dc898]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x2a3
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
lea r8, [rsp + 0x1f0]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140030f18
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov dword [rsp + 0x148], edi
lea rdi, [0x140125448]
mov rdx, rdi
call fcn.1400a0f40
mov qword [0x140130a88], rdi
mov ecx, 0x4fb0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0xf0], rax
xor edx, edx
test rax, rax
jne 0x1400310a8
mov r8d, 0xc50
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov r8d, eax
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400de560]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dc838]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x2f0
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
lea r8, [rsp + 0x1f0]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140031093
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8d, 0x4fb0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x4fb0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
mov qword [rsp + 0x70], rax
xor edx, edx
test rax, rax
jne 0x140031214
mov r8d, 0xc50
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov r8d, eax
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400de500]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dc7b8]
mov edx, 0x9f6
lea r8, [r14 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x30b
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
lea r8, [rsp + 0x1f0]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400311ff
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8d, 0x4fb0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x4fb0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0xb8], rax
xor edx, edx
test rax, rax
jne 0x140031380
mov r8d, 0xc50
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov r8d, eax
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400de450]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dc738]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x326
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
lea r8, [rsp + 0x1f0]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003136b
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8d, 0x4fb0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x4fb0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x80], rax
xor edx, edx
test rax, rax
jne 0x1400314ec
mov r8d, 0xc50
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov r8d, eax
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400de3f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dc6b8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x341
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
lea r8, [rsp + 0x1f0]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400314d7
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8d, 0x4fb0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [0x140199d50], 0x4fb0
mov qword [0x140113918], 0x27d8
mov r14d, 0x27d8
mov qword [rsp + 0xa0], r14
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov qword [rsp + 0x78], rax
xor edx, edx
test rax, rax
jne 0x14003167f
mov r8d, 0xc50
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov r8d, eax
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400de390]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dc638]
mov edx, 0x9f6
lea r8, [rsi - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x383
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
lea r8, [rsp + 0x1f0]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140031665
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [0x140113928], r14
mov qword [0x140113920], r14
mov eax, dword [rsp + 0x148]
mov dword [0x140113914], eax
mov rcx, qword [rsp + 0xc8]
mov qword [0x140199d58], rcx
cmp eax, 1
jle 0x14003e1b4
mov esi, 1
mov dword [rsp + 0x90], esi
nop dword [rax]
cmp esi, eax
jge 0x140031cae
mov r8, qword [0x140199d50]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
movsxd rax, esi
mov rcx, qword [rsp + 0xc8]
lea r15, [rcx + rax*8]
mov edx, 0x4002
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test rax, rax
je 0x140031b64
mov rdx, qword [0x140113918]
cmp rdx, rax
jbe 0x140031b64
cmp r14, rax
jbe 0x140031b64
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dc554]
mov r8, 0xffffffffffffffff
mov r15, qword [rsp + 0x70]
mov rcx, r15
call fcn.140001140
mov rdx, qword [0x140113918]
xor eax, eax
mov word [r15 + rdx*2 - 2], ax
mov rcx, r15
call fcn.140093690
mov rdx, qword [0x140113918]
lea rcx, [0x1400de248]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400de228]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
mov ecx, dword [0x140126180]
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [0x140126180], ecx
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc818]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc798]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
mov ecx, dword [rsp + 0xdc]
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [rsp + 0xdc], ecx
mov dword [rsp + 0x120], ecx
mov rdx, qword [0x140113918]
lea rcx, [0x1400de1f8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400de1c8]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
mov ecx, dword [rsp + 0xd0]
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [rsp + 0xd0], ecx
mov dword [rsp + 0x110], ecx
mov rdx, qword [0x140113918]
lea rcx, str.__AUTO_START
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400de188]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
mov r15d, dword [rsp + 0x108]
test eax, eax
mov eax, 1
cmove r15d, eax
mov dword [rsp + 0x108], r15d
mov dword [rsp + 0x114], r15d
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc728]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc6a8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x1400318c0
mov ecx, 1
mov dword [rsp + 0xfc], ecx
mov dword [rsp + 0x118], ecx
mov ebx, ecx
mov dword [rsp + 0x104], ecx
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc488]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc408]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140031909
mov ecx, 1
mov dword [rsp + 0xe8], ecx
mov dword [rsp + 0x11c], ecx
mov ebx, ecx
mov dword [rsp + 0x104], ecx
mov rdx, qword [0x140113918]
lea rcx, str.__START_OPTIONS_REGISTRY_KEY
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400de108]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
mov rdx, qword [0x140113918]
lea rcx, str.__UNREGISTER_PORT
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc258]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc718]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc698]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc628]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc5b8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc478]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc3f8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc2f8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc248]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc1c8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc148]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dc058]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dbfb8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dbf48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dbed8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dbec8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dbe58]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400dbae8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dae58]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x140031b41
mov rdx, qword [0x140113918]
lea rcx, [0x1400de0e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400de0c8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140031b4f
mov eax, 1
mov ebx, eax
mov dword [rsp + 0x104], eax
inc esi
mov dword [rsp + 0x90], esi
mov eax, dword [rsp + 0x148]
jmp 0x1400316d0
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a1
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400de2d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dc5c8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x3d1
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140031c8f
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp r15d, 1
je 0x14003e1af
cmp dword [rsp + 0xdc], 1
je 0x140031ccc
cmp dword [rsp + 0xd0], 1
jne 0x140031cd4
test ebx, ebx
je 0x14003e1af
movsxd rbx, eax
shl rbx, 3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
mov qword [rsp + 0x88], rax
xor edx, edx
test rax, rax
jne 0x140031e3b
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400de070]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbe68]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x4b3
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140031e24
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov ebx, eax
mov dword [rsp + 0x90], eax
cmp ebx, dword [rsp + 0x148]
jge 0x14003218c
movsxd rax, ebx
lea r12, [rax*8]
mov edx, 0x4002
mov rax, qword [rsp + 0xc8]
mov rcx, qword [r12 + rax]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea r15, [rax + 1]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
xor edx, edx
test rax, rax
jne 0x140031fe3
mov r8d, 0xc50
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400de010]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbe54]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x4dc
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140031fc4
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x88]
mov qword [r12 + rax], rsi
mov qword [rsp + 0x20], 0xffffffffffffffff
mov rax, qword [rsp + 0xc8]
mov r9, qword [r12 + rax]
mov r8, r15
mov rdx, rsi
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
test eax, eax
je 0x14003217e
cmp eax, 0x50
je 0x14003217e
xor edx, edx
mov r8d, 0xc50
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a0
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400ddfb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbe24]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x508
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003215f
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
inc ebx
mov dword [rsp + 0x90], ebx
jmp 0x140031e51
cmp dword [0x1401923fc], 0
jne 0x1400321aa
cmp dword [0x140192400], 0
jne 0x1400321aa
xor r15d, r15d
mov edx, r15d
lea ebx, [r15 + 1]
jmp 0x1400321b4
mov ebx, 1
mov edx, ebx
xor r15d, r15d
xor r9d, r9d
xor r8d, r8d
lea rcx, [0x140113930]
call fcn.140013b80
test eax, eax
je 0x140032313
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x274
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x274
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400ddf30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbdb8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x559
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400322f4
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r9d, 0x4002
mov r12, qword [rsp + 0x88]
mov r8, r12
mov edx, dword [rsp + 0x148]
lea rcx, [0x140113930]
call fcn.140062660
test eax, eax
je 0x140032495
cmp dword [0x1401268dc], 1
jne 0x140032358
mov dword [0x1401268e0], ebx
mov dword [0x1401268e4], 2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400ddeb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbd58]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x57d
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003247e
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov eax, dword [0x1401268e4]
cmp dword [0x1401268dc], 1
cmove eax, ebx
mov dword [0x1401268e4], eax
cmp dword [0x1401341f4], 1
jne 0x14003260f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x14003260f
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x69]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dde40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbc18]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x5bb
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400325f8
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rcx, [0x1401343a0]
call fcn.140097a20
cmp eax, 1
jne 0x14003275f
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], WSACleanup
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x6b]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400ddda0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbbb8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x5e5
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140032748
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov dword [0x1401343bc], r15d
lea rsi, [rsp + 0x1f0]
cmp dword [0x1401343b8], 1
jne 0x140032895
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x24b
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], ebx
lea rax, [0x1400ddd30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbb58]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], 0
mov dword [rsp + 0xc38], 0x618
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r15d
mov rax, qword [0x140126150]
test rax, rax
je 0x140032895
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
cmp dword [0x1401917f0], 0
je 0x1400329d7
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400ddcc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbae4]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x62b
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400329c0
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r10, qword [0x140192510]
test r10, r10
je 0x140032a13
cmp byte [r10], 0
je 0x140032a13
mov r9d, dword [0x140192508]
cmp r9d, 1
jne 0x140032a1a
mov rax, qword [0x140192530]
mov r8d, dword [0x140192528]
mov rcx, qword [0x140192520]
mov edx, dword [0x140192518]
jmp 0x140032a6d
mov r9d, dword [0x140192508]
mov rax, qword [0x140192530]
test rax, rax
je 0x140032a47
cmp byte [rax], 0
je 0x140032a47
mov r8d, dword [0x140192528]
cmp r8d, 1
jne 0x140032a4e
mov rcx, qword [0x140192520]
mov edx, dword [0x140192518]
jmp 0x140032a6d
mov r8d, dword [0x140192528]
mov edx, dword [0x140192518]
cmp edx, 1
jne 0x14003491a
mov rcx, qword [0x140192520]
test rcx, rcx
je 0x14003491a
mov qword [rsp + 0x1c0], r15
cmp r9d, 1
jne 0x140032be4
test edx, edx
jne 0x140032aaf
test rcx, rcx
jne 0x140032aaf
test r8d, r8d
jne 0x140032aaf
test rax, rax
jne 0x140032aaf
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0x170]
mov rcx, r10
call fcn.140095cd0
jmp 0x140032d83
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400ddc40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dbab4]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x65f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140032bcd
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp r8d, 1
jne 0x140032d53
test edx, edx
jne 0x140032c1e
test rcx, rcx
jne 0x140032c1e
test r9d, r9d
jne 0x140032c1e
test r10, r10
jne 0x140032c1e
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0x170]
mov rcx, rax
call fcn.1400930a0
jmp 0x140032d83
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400ddbe0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dba48]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x67f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140032d3c
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
test r9d, r9d
jne 0x1400347e5
test r10, r10
jne 0x1400347e5
test rax, rax
jne 0x1400347e5
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0x170]
call fcn.140092860
cmp eax, 1
je 0x1400346b2
mov r14, qword [rsp + 0x1c0]
test r14, r14
je 0x1400346b2
lea r14, [r14*8]
mov rdx, r14
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbx, rax
xor edx, edx
test rax, rax
jne 0x140032efc
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dda90]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db928]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x6e9
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140032ee5
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0xf0], rbx
mov rdx, r14
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbx, rax
xor edx, edx
test rax, rax
jne 0x140033063
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dda30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db8c8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x70c
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003304c
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x70], rbx
mov rdx, r14
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbx, rax
xor edx, edx
test rax, rax
jne 0x1400331ca
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dd9d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db868]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x72f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400331b3
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0xb8], rbx
mov rdx, r14
mov r15, qword [rsp + 0x80]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbx, rax
xor edx, edx
test rax, rax
jne 0x14003332f
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dd940]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db808]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x752
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140033320
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
jmp 0x14003e4a2
mov r8, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov r15, rbx
mov qword [rsp + 0x80], rbx
mov qword [0x140199d50], r14
shr r14, 1
mov qword [0x140113918], r14
mov qword [rsp + 0xa0], r14
mov rbx, qword [rsp + 0x1c0]
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rsi, rax
xor edx, edx
test rax, rax
jne 0x1400334ba
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dd8e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db7a8]
mov edx, 0x9f6
lea r8, [rsi - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x7a8
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400334ab
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
jmp 0x14003e4a2
mov r8, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x78], rsi
mov qword [0x140113928], rbx
mov qword [0x140113920], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0xff
lea rdx, [rsp + 0xb190]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
inc rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
xor edx, edx
test rax, rax
jne 0x14003364e
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dd880]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db748]
mov edx, 0x9f6
lea r8, [r15 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x7f1
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003363c
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, rbx
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0xb190]
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0xe48]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
test eax, eax
je 0x1400337c3
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a3
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dd800]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db608]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x811
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400337b1
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov edx, dword [rsp + 0x148]
test edx, edx
jle 0x14003382f
xor eax, eax
mov ebx, eax
mov dword [rsp + 0x90], eax
nop dword [rax]
cmp ebx, edx
jge 0x140033810
movsxd rax, ebx
lea rsi, [r12 + rax*8]
mov rcx, qword [rsi]
test rcx, rcx
je 0x140033805
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [rsi], rax
mov edx, dword [rsp + 0x148]
inc ebx
mov dword [rsp + 0x90], ebx
jmp 0x1400337e0
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor esi, esi
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x148], esi
mov rsi, qword [rsp + 0x78]
mov r9, qword [0x140113928]
mov r8, r15
lea rdx, [rsp + 0x148]
mov rcx, qword [rsp + 0x170]
call fcn.140095030
mov r12, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140034579
mov eax, dword [rsp + 0x148]
test eax, eax
je 0x140034579
mov rdx, qword [0x140126920]
xor r15d, r15d
test rdx, rdx
je 0x1400338f5
mov r8d, dword [0x140126918]
test r8d, r8d
je 0x1400338f5
mov ebx, r15d
mov dword [rsp + 0x90], ebx
cmp ebx, r8d
jge 0x1400338d2
movsxd rax, ebx
lea rsi, [rax*8]
mov rcx, qword [rdx + rsi]
test rcx, rcx
je 0x1400338ce
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140126920]
mov qword [rax + rsi], r15
mov rdx, qword [0x140126920]
mov r8d, dword [0x140126918]
inc ebx
jmp 0x14003388f
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140126920], r15
mov dword [0x140126918], r15d
mov eax, dword [rsp + 0x148]
mov rsi, qword [rsp + 0x78]
movsxd rbx, eax
shl rbx, 3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x140126920], rax
xor edx, edx
test rax, rax
jne 0x140033a50
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], recv
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [rbx + 0xb]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dd730]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db498]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x87e
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140033a3e
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ebx, r15d
mov dword [rsp + 0x90], ebx
mov edx, dword [rsp + 0x148]
cmp ebx, edx
jge 0x140033c34
movsxd rax, ebx
lea r15, [rax*8]
mov rdx, qword [0x140113928]
mov rcx, qword [r15 + r12]
call fcn.14003e890
lea rsi, [rax + 1]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [0x140126920]
mov qword [rcx + r15], rax
mov rax, qword [0x140126920]
mov rcx, qword [rax + r15]
xor edx, edx
test rcx, rcx
jne 0x140033bfb
mov r8d, 0xc50
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], recv
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [rbx + 0xb]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dd6d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db438]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x8a1
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140033be4
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
mov rax, qword [r15 + r12]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db3d8]
mov r8, 0xffffffffffffffff
mov rdx, rsi
mov rcx, qword [0x140126920]
mov rcx, qword [rcx + r15]
call fcn.140001030
inc ebx
jmp 0x140033a5e
mov dword [0x140126918], edx
mov r9, qword [0x140113920]
mov r8, r12
lea rcx, [0x140113930]
call fcn.140062660
lea rcx, [0x1401343a0]
call fcn.140097a20
mov r12d, eax
cmp eax, 1
jne 0x140033dad
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], WSACleanup
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [r12 + 0x6a]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd670]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db378]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x8d9
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140033d8e
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov rdx, qword [0x140126920]
xor r15d, r15d
test rdx, rdx
je 0x140033e81
cmp dword [0x140126918], r15d
jbe 0x140033e81
mov ebx, r15d
mov dword [rsp + 0x90], ebx
cmp ebx, dword [rsp + 0x148]
jge 0x140033e6a
movsxd rax, ebx
lea rsi, [rax*8]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsi + rax]
test rcx, rcx
je 0x140033e63
mov r15, qword [rdx + rsi]
test r15, r15
je 0x140033e63
mov rdx, qword [0x140113928]
call fcn.14003e890
lea rdx, [rax + 1]
mov qword [rsp + 0x20], r15
lea r9, [0x1400db318]
mov r8, 0xffffffffffffffff
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsi + rax]
call fcn.140001030
mov rcx, qword [0x140126920]
mov rcx, qword [rcx + rsi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140126920]
xor r15d, r15d
mov qword [rax + rsi], r15
mov rdx, qword [0x140126920]
inc ebx
jmp 0x140033dd0
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140126920], r15
mov dword [0x140126918], r15d
mov ebx, 1
test r12d, r12d
je 0x140033fec
cmp dword [0x1401268dc], ebx
jne 0x140033ea7
mov dword [0x1401268e0], ebx
mov dword [0x1401268e8], 2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd610]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db248]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x91b
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140033fcd
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov eax, dword [0x1401268e8]
cmp dword [0x1401268dc], 1
cmove eax, ebx
mov dword [0x1401268e8], eax
cmp dword [0x1401341f4], ebx
jne 0x140034169
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x140034169
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x69]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd590]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db1c8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x939
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003414a
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rcx, [0x1401343a0]
call fcn.140097a20
cmp eax, ebx
jne 0x1400342bc
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], WSACleanup
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x6b]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd530]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db168]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x965
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003429d
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov dword [0x1401343bc], r15d
lea rsi, [rsp + 0x1f0]
cmp dword [0x1401343b8], ebx
jne 0x1400343ed
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x24b
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], ebx
lea rax, [0x1400dd4d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db108]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], 0
mov dword [rsp + 0xc38], 0x998
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r15d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400343ed
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rdx, qword [0x140113928]
mov r12, qword [rsp + 0x88]
mov rcx, qword [r12 + 8]
call fcn.140093030
movsxd rdx, dword [rsp + 0x148]
mov r9, qword [0x140113920]
lea r8, [rsp + 0xe40]
mov rcx, r12
call fcn.140093880
mov qword [rsp + 0xc8], rax
test rax, rax
je 0x140034448
movsxd rcx, dword [rsp + 0x148]
cmp rcx, qword [rsp + 0xe40]
je 0x14003491a
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd470]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db0a8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x9c3
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140034562
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd7a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db528]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x84c
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400346a0
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], WSACleanup
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 0x6e]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400ddb20]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db988]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x6c1
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400347ce
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400ddb80]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db9e8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x69f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140034903
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x140114560], 1
jne 0x140034ddb
cmp qword [0x140114578], 0
je 0x140034ab5
lea rcx, [0x140113930]
call fcn.14007d0a0
test eax, eax
je 0x140034a9f
cmp dword [0x1401268dc], 1
jne 0x140034962
mov dword [0x1401268e0], ebx
mov dword [0x1401268ec], 2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd3f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400db048]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xa0e
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140034a88
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov eax, dword [0x1401268ec]
cmp dword [0x1401268dc], 1
cmove eax, ebx
mov dword [0x1401268ec], eax
cmp qword [0x140114588], 0
jne 0x140034acd
cmp qword [0x140114598], 0
je 0x140034c4d
lea rcx, [0x140113930]
call fcn.14007db60
test eax, eax
je 0x140034c37
cmp dword [0x1401268dc], 1
jne 0x140034afa
mov dword [0x1401268e0], ebx
mov dword [0x1401268ec], 2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd390]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dafe8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xa33
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140034c20
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov eax, dword [0x1401268ec]
cmp dword [0x1401268dc], 1
cmove eax, ebx
mov dword [0x1401268ec], eax
cmp qword [0x1401145a8], 0
je 0x140034ddb
lea rcx, [0x140113930]
call fcn.14007df10
test eax, eax
je 0x140034dc5
cmp dword [0x1401268dc], 1
jne 0x140034c88
mov dword [0x1401268e0], ebx
mov dword [0x1401268f4], 2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd330]
mov qword [rsp + 0x20], rax
lea r9, [0x1400daf88]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xa55
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140034dae
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov eax, dword [0x1401268f4]
cmp dword [0x1401268dc], 1
cmove eax, ebx
mov dword [0x1401268f4], eax
cmp dword [0x1401341f0], 0
je 0x14003e64b
lea rcx, [0x140113930]
call fcn.14007e330
test eax, eax
je 0x140034f39
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd2a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400daf28]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xa77
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140034f22
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov eax, dword [0x140186f30]
dec eax
cmp eax, 0xd
ja case.0x140034f5d.2
cdqe
lea rsi, [0x140000000]
mov eax, dword [rsi + rax*4 + 0x3e814]
add rax, rsi
jmp rax
lea rdx, str.Installing_The_ESRV_Service.
lea rcx, [0x140113930]
call fcn.14000c3d0
xor edx, edx
xor ecx, ecx
mov r8d, 0x400f003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
mov qword [rsp + 0xc0], rax
test rax, rax
jne 0x1400350e0
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd220]
mov qword [rsp + 0x20], rax
lea r9, [0x1400daec8]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xada
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400350c1
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov rsi, qword [rsp + 0xb8]
mov rdx, rsi
mov ecx, 0xff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x140035247
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b4
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dd1a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dae54]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xaf3
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140035228
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r9, 0xffffffffffffffff
lea r8, [0x1400dd168]
mov rdx, qword [0x140113918]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
cmp dword [rsp + 0x148], 2
jle 0x1400373d9
mov qword [rsp + 0x98], r15
mov rdx, qword [0x140113918]
lea rcx, [0x1400dadc8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rsi, rax
mov r9, rax
lea r8, [0x1400dad68]
mov rdx, qword [0x140113918]
mov rbx, qword [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rsi
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0x98], rsi
lea r15, [rbx + rsi*2]
mov rdx, qword [0x140113918]
cmp dword [0x140192404], 0
jne 0x140035331
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
mov r9, rax
mov r8, qword [rsp + 0xb8]
mov rdx, qword [0x140113918]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
lea r13, [0x140192538]
mov r15, qword [rsp + 0x80]
jmp 0x1400353c0
lea r13, [0x140192538]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
mov r9, rax
mov r8, r13
mov rdx, qword [0x140113918]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
lea rcx, [0x1400dd148]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
mov r15, qword [rsp + 0x80]
lea rcx, [r15 + rsi*2]
mov r9, rax
lea r8, [0x1400dd048]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
lea rcx, [0x1400dad08]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
lea rcx, [r15 + rsi*2]
mov r9, rax
lea r8, [0x1400daca8]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
lea rcx, [0x1400dac48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
lea rcx, [r15 + rsi*2]
mov r9, rax
lea r8, [0x1400dabe8]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
cmp dword [rsp + 0x148], 3
jl 0x140035804
cmp dword [0x1401923fc], 0
jne 0x140035598
cmp dword [0x140192400], 0
jne 0x140035598
mov rdx, qword [0x140113918]
lea rcx, [0x1400dab88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
lea rcx, [r15 + rsi*2]
mov r9, rax
lea r8, [0x1400dab28]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
lea rcx, [0x1400dd128]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
lea rcx, [r15 + rsi*2]
mov r9, rax
lea r8, [0x1400dd108]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
lea rcx, [0x1400daac8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
lea rcx, [r15 + rsi*2]
mov r9, rax
lea r8, [0x1400daa68]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
lea rcx, [0x1400daa08]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
lea rcx, [r15 + rsi*2]
mov r9, rax
lea r8, [0x1400da998]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov r15d, 2
mov dword [rsp + 0x90], r15d
cmp r15d, dword [rsp + 0x148]
jge 0x1400357f4
mov r8, qword [0x140199d50]
xor edx, edx
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
movsxd rax, r15d
mov rcx, qword [rsp + 0xc8]
lea r12, [rcx + rax*8]
mov rdx, qword [0x140113918]
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rax, qword [r12]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da928]
mov r8, 0xffffffffffffffff
mov rdx, qword [0x140113918]
mov rcx, rbx
call fcn.140001140
movsxd rcx, eax
mov qword [rsp + 0x1d0], rcx
mov rdx, qword [0x140113918]
xor eax, eax
mov word [rbx + rdx*2 - 2], ax
mov rcx, rbx
call fcn.140093690
cmp dword [rsp + 0xfc], 1
jne 0x14003567e
cmp dword [rsp + 0xe8], 1
jne 0x14003567e
cmp dword [rsp + 0xd0], 1
jne 0x14003567e
mov rdx, qword [0x140113918]
lea rcx, [0x1400da9f8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400da988]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x1400357f4
mov rdx, qword [0x140113918]
lea rcx, [0x1400dcd78]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov r8, rax
lea rdx, [0x1400dc538]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x1400357e1
mov rdx, qword [0x140113918]
lea rcx, [0x1400da924]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
mov rax, qword [rsp + 0x80]
lea rcx, [rax + rsi*2]
mov r9, rbx
lea r8, [0x1400da868]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
mov rax, qword [rsp + 0x80]
lea rcx, [rax + rsi*2]
mov r9, rbx
mov r8, qword [r12]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
lea rcx, [0x1400da808]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
mov r12, qword [rsp + 0x80]
lea rcx, [r12 + rsi*2]
mov r9, rax
lea r8, [0x1400da7a8]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
mov rdx, qword [0x140113918]
lea rcx, [0x1400da748]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
lea rcx, [r12 + rsi*2]
mov r9, rax
lea r8, [0x1400da6e8]
mov rdx, qword [0x140113918]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
sub r14, rbx
mov qword [rsp + 0xa0], r14
add rsi, rbx
mov qword [rsp + 0x98], rsi
jmp 0x1400357ec
inc r15d
mov dword [rsp + 0x90], r15d
inc r15d
jmp 0x14003559e
mov r15, qword [rsp + 0x80]
mov r12, qword [rsp + 0xc0]
cmp dword [0x1401923fc], 0
jne 0x140035863
cmp dword [0x140192400], 0
jne 0x140035863
xor esi, esi
cmp dword [0x140192528], esi
jne 0x1400358ce
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 2
lea r8, str.Energy_Server_Service_queencreek
lea rdx, [0x1400da668]
jmp 0x1400358aa
xor esi, esi
cmp dword [0x140192528], esi
jne 0x1400358ce
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r15
mov ebx, 1
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
lea r8, str.User_Energy_Server_Service_queencreek
lea rdx, [0x1400da5d8]
mov r9d, 0xf01ff
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r14, rax
mov qword [rsp + 0xb0], rax
jmp 0x1400358e9
mov qword [rsp + 0xb0], rsi
mov r14, rsi
mov ecx, 0x6f7
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, 1
test r14, r14
jne 0x140036319
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f7
jne 0x1400360a7
cmp qword [rsp + 0x170], r14
je 0x1400360a7
cmp qword [rsp + 0x1c0], r14
jbe 0x1400360a7
cmp dword [0x1401923fc], r14d
jne 0x140035972
cmp dword [0x140192400], r14d
jne 0x140035972
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [0x1400da578]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 2
lea r8, [0x1400dd000]
lea rdx, [0x1400da4f8]
jmp 0x1400359b1
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [0x1400da348]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
lea r8, [0x1400dcfb0]
lea rdx, [0x1400da218]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9d, 0xf01ff
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0xb0], rax
mov r14, rax
test rax, rax
jne 0x140035b1d
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ac
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ac
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dcf30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da488]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xd40
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140035b06
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x140035b36
cmp dword [0x140192400], 0
lea rdx, str.SYSTEMCurrentControlSetServicesESRV_SVC_QUEENCREEK
je 0x140035b3d
lea rdx, [0x1400dce40]
lea rax, [rsp + 0x18c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [rsp + 0x18c], 2
jne 0x140035f66
cmp qword [rsp + 0x150], 0
je 0x140035f66
test eax, eax
jne 0x140035f66
mov rsi, qword [rsp + 0xb8]
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
mov rdx, qword [0x140113918]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add rax, 2
lea rcx, [rbx + rax*2]
lea rdx, [0x1400dcd58]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
lea rdx, str.__AUTO
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
mov rdx, qword [0x140113918]
lea rcx, [0x1400da478]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea rbx, [rbx + rax*2]
add rbx, 0xfffffffffffffffc
mov dword [rbx], 0x2d0022
mov eax, 0x2d
mov word [rbx + 4], ax
mov rdx, qword [0x140113918]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 2
xor r8d, r8d
lea rdx, str._start
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140035da2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dcd00]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da3a8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xdd5
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140035d8b
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
lea rax, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSet_servicesESRV_SVC_QUEENCREEK_start
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, str.__s_____AUTO_START_____start_____start_options_registry_key____s_
mov edx, 0x1fe
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xb790]
call fcn.140001140
mov edx, 0x1fe
lea rcx, [rsp + 0xb790]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0xb790]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140036321
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dcb60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da2dc]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xe0b
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140035f4f
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b7
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dcdc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da418]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xd82
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140036090
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
cmp eax, 0x431
je 0x1400361ef
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ac
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ac
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dcaa0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da16c]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xe37
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400361d8
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2bc
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2bc
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dcb00]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da214]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xe24
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140036302
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
mov rsi, qword [rsp + 0xb8]
cmp dword [0x1401923fc], 0
jne 0x1400364b6
cmp dword [0x140192400], 0
jne 0x1400364b6
lea r8, [rsp + 0x1c8]
mov edx, 3
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1400364b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x140036497
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ad
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ad
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dca20]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da118]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xe6a
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003649f
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
jmp 0x14003649f
mov ebx, 1
xor r13d, r13d
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 1
je 0x1400364dd
cmp dword [0x140192400], 1
je 0x1400364dd
mov r12, qword [rsp + 0xb0]
mov ebx, 1
xor r15d, r15d
jmp 0x140037454
lea rax, [rsp + 0x1bc]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x158]
lea edx, [r9 + 4]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
cmp eax, 1
je 0x1400373bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14003665c
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2be
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2be
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc980]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da0c8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xea5
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140036645
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
mov esi, dword [rsp + 0x1bc]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x158], rax
test rax, rax
jne 0x1400367cd
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400dc910]
mov qword [rsp + 0x20], rax
lea r9, [0x1400da064]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xec0
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400367b6
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
lea rcx, [rsp + 0x1bc]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8, rax
mov edx, 4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
cmp eax, 1
je 0x140036939
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2be
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2be
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc8a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9fe4]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xedf
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140036922
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x1e4]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
cmp eax, 1
je 0x140036aaa
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2be
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2be
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc840]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9f18]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xefd
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140036a93
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
lea rdx, [rsp + 0x168]
lea rcx, str.S_1_1_0
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
cmp eax, 1
je 0x140036c0a
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2bf
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2bf
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc7c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9e88]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xf1d
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140036bf3
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1dc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb590]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1d8]
lea r8, [rsp + 0xb390]
mov rdx, qword [rsp + 0x168]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
cmp eax, 1
je 0x140036d9c
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2c0
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc740]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9e28]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xf3e
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140036d85
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x140036dbb
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov qword [rsp + 0x168], rax
jmp 0x140036dbd
xor eax, eax
mov dword [rsp + 0x20], eax
mov r9d, 2
lea r8d, [r9 + 0x2e]
lea rdx, [rsp + 0xb390]
lea rcx, [rsp + 0xe78]
call qword [sym.imp.ADVAPI32.dll_BuildExplicitAccessWithNameW]
lea r9, [rsp + 0x160]
mov r8, qword [rsp + 0x180]
lea rdx, [rsp + 0xe78]
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
je 0x140036f4b
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2c1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2c1
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc6c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9dc8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xf70
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140036f34
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
mov edx, ebx
lea rcx, [rsp + 0xe50]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp eax, ebx
je 0x1400370a0
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2c1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2c1
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc640]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9d68]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xf8c
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140037089
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
xor r9d, r9d
mov r8, qword [rsp + 0x160]
mov edx, ebx
lea rcx, [rsp + 0xe50]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp eax, ebx
je 0x140037200
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2c1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2c1
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc5d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9d08]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xfab
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400371e9
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
lea r8, [rsp + 0xe50]
mov edx, 4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
cmp eax, ebx
je 0x14003735b
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2c1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2c1
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc560]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9ca8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0xfc8
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140037344
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
jmp 0x14003e4a2
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x14003737b
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r15d, r15d
mov qword [rsp + 0x160], r15
jmp 0x14003737e
xor r15d, r15d
cmp qword [rsp + 0x158], 0
je 0x1400373c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x158]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x158], r15
mov r12, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
jmp 0x140037454
mov ebx, 1
mov r12, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
xor r15d, r15d
jmp 0x140037454
cmp dword [0x1401923fc], 0
jne 0x1400373fb
cmp dword [0x140192400], 0
jne 0x1400373fb
lea r8, [0x1400dc4f0]
lea rdx, [0x1400d9c28]
jmp 0x140037409
lea r8, [0x1400dc4a0]
lea rdx, [0x1400d9a68]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9d, 0xf01ff
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
lea r13, [0x140192538]
mov r12, rax
test r12, r12
jne 0x1400375a7
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ac
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ac
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc420]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9b58]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x103b
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140037588
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x140037757
cmp dword [0x140192400], 0
jne 0x14003773e
lea r8, [rsp + 0x1c8]
mov edx, 3
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14003773e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x14003771c
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ad
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ad
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc3a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9a64]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1065
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003771f
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
jmp 0x14003771f
xor r13d, r13d
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x140037757
cmp dword [0x140192400], 0
lea rdx, [0x1400dc330]
je 0x14003775e
lea rdx, [0x1400dc280]
lea rax, [rsp + 0x18c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [rsp + 0x18c], 2
jne 0x140038ceb
cmp qword [rsp + 0x150], 0
je 0x140038ceb
test eax, eax
jne 0x140038ceb
mov edx, 0x27d8
lea rcx, [rsp + 0x13320]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x13320]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.description
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140037959
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc170]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9938]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x10d0
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003793a
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140037ab8
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ba
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ba
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc0f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d98d8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x10e4
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140037a99
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x140126208], 1
je 0x14003e653
cmp dword [0x1401923fc], 0
jne 0x140037ade
cmp dword [0x140192400], 0
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogESRV_SVC_QUEENCREEK
je 0x140037ae5
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogUSER_ESRV_SVC_QUEENCREEK
lea rax, [rsp + 0x18c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [rsp + 0x18c], 1
jne 0x140037b4a
cmp qword [rsp + 0x150], 0
je 0x140037b4a
test eax, eax
jne 0x140037b4a
lea r14, [rsp + 0x1f0]
jmp 0x140037c70
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x2b7
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 2
lea rax, [0x1400dbf60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9878]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], 0
mov dword [rsp + 0xc38], 0x117d
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r15d
mov rax, qword [0x140126150]
test rax, rax
je 0x140037c70
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov dword [rsp + 0x190], ebx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.CategoryCount
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140037df3
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dbef0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9724]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x11c0
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140037dd4
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov dword [rsp + 0x190], 7
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TypesSupported
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140037f7a
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dbe70]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9654]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x11e2
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140037f5b
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x140192404], 0
jne 0x140037fc3
cmp dword [0x1401923fc], 0
jne 0x140037f9c
cmp dword [0x140192400], 0
lea r9, [0x1400d9774]
je 0x140037fa3
lea r9, [0x1400d96a4]
mov qword [rsp + 0x20], rsi
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe370]
call fcn.140001140
jmp 0x140038016
cmp dword [0x1401923fc], 0
jne 0x140037fe5
cmp dword [0x140192400], 0
jne 0x140037fe5
lea rax, [0x1400dbac8]
lea r9, [0x1400dbe28]
jmp 0x140037ff3
lea rax, [0x1400dae38]
lea r9, [0x1400dbe18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r8, 0xffffffffffffffff
mov edx, 0x27d8
lea rcx, [rsp + 0xe370]
call fcn.140001140
mov edx, 0x27d8
lea rcx, [rsp + 0xe370]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea ebx, [rax*2 + 2]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0xe370]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.CategoryMessageFile
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400381a9
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dbdc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9634]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x124f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003818a
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0xe370]
mov qword [rsp + 0x20], rax
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
lea rdx, str.EventMessageFile
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003831f
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dbd60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d95b8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x126a
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140038300
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x140038338
cmp dword [0x140192400], 0
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogApplicationESRV_SVC_QUEENCREEK
je 0x14003833f
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogApplicationUSER_ESRV_SVC_QUEENCREEK
lea rax, [rsp + 0x18c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [rsp + 0x18c], ebx
jne 0x140038bae
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x140038bae
test eax, eax
jne 0x140038bae
mov dword [rsp + 0x190], ebx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x1400da908]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003851b
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dbb60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d94f8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x12e6
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400384fc
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov dword [rsp + 0x190], 7
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x190]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x1400d94d8]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003869e
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dbb00]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9414]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1308
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003867f
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x140192404], 0
jne 0x1400386e7
cmp dword [0x1401923fc], 0
jne 0x1400386c0
cmp dword [0x140192400], 0
lea r9, [0x1400d9378]
je 0x1400386c7
lea r9, [0x1400d9318]
mov qword [rsp + 0x20], rsi
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe370]
call fcn.140001140
jmp 0x14003873a
cmp dword [0x1401923fc], 0
jne 0x140038709
cmp dword [0x140192400], 0
jne 0x140038709
lea rax, [0x1400da1f8]
lea r9, [0x1400dbab8]
jmp 0x140038717
lea rax, [0x1400da048]
lea r9, [0x1400dbaa8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r8, 0xffffffffffffffff
mov edx, 0x27d8
lea rcx, [rsp + 0xe370]
call fcn.140001140
mov edx, 0x27d8
lea rcx, [rsp + 0xe370]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea ebx, [rax*2 + 2]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0xe370]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400d9298]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400388cd
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dba50]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9238]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1375
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x1400388ae
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0xe370]
mov qword [rsp + 0x20], rax
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
lea rdx, [0x1400d91b8]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140038a43
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db9f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d91b4]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1390
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140038a24
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140038b96
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ba
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ba
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db990]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9118]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x13a4
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140038b77
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, str._OK_
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e653
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b7
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dbbc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9558]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x12a5
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140038ccc
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b7
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dc1f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d99f8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x10ad
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140038e15
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, str.Un_installing_The_ESRV_Service.
lea rcx, [0x140113930]
call fcn.14000c3d0
xor edx, edx
xor ecx, ecx
mov r8d, 0x400f003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
mov qword [rsp + 0xc0], rax
test rax, rax
jne 0x140038fac
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db930]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d9094]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x13d1
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140038f95
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x140038fc5
cmp dword [0x140192400], 0
lea rdx, [0x1400d8fd8]
je 0x140038fcc
lea rdx, [0x1400d8e88]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x140039131
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db8d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8f78]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x13f8
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140039112
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [rsp + 0x198]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140039293
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ae
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ae
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db870]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8f18]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x140f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140039274
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [rsp + 0x19c], 1
je 0x1400395c9
lea r8, [rsp + 0x198]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140039427
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x425
je 0x140039427
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x140039427
xor edx, edx
mov r8d, 0xc50
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2af
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2af
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db810]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8e84]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1430
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140039408
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d8dd8]
lea rcx, [0x140113930]
call fcn.14000c3d0
mov ecx, dword [rsp + 0x19c]
cmp ecx, 1
je 0x1400395be
mov eax, r13d
inc r13d
mov dword [rsp + 0xd8], r13d
cmp eax, 0x14
jl 0x1400392a1
cmp ecx, 1
je 0x1400395be
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2af
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2af
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db7b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8d78]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1448
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003959f
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r14, qword [rsp + 0xc0]
xor r15d, r15d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140039723
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b0
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db750]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8d18]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1466
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140039704
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x14003973c
cmp dword [0x140192400], 0
lea rdx, [0x1400db6b0]
je 0x140039743
lea rdx, [0x1400db610]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rsi, [rsp + 0x1f0]
test eax, 0xfffffffd
je 0x14003987d
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2bb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x2bb
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], ebx
lea rax, [0x1400db5b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8cb8]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], 0
mov dword [rsp + 0xc38], 0x14a7
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r15d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003987d
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
cmp dword [0x1401923fc], 0
jne 0x140039896
cmp dword [0x140192400], 0
lea rdx, [0x1400db530]
je 0x14003989d
lea rdx, [0x1400db4a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, 0xfffffffd
je 0x1400399dc
xor edx, edx
mov r8d, 0xc50
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2bb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x2bb
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 2
lea rax, [0x1400db440]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8c58]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], 0
mov dword [rsp + 0xc38], 0x14d2
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r15d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003e65b
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
jmp 0x14003e65b
lea rdx, [0x1400d8b38]
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e65b
lea rcx, [rsp + 0x1cc]
call fcn.140012da0
cmp eax, 1
jne 0x140039b47
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x290
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x290
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db3e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8bf8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x152f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140039b30
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [rsp + 0x1cc], 0
je 0x140039c92
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x292
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x292
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db380]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8b98]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x153f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140039c7b
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, str.Starting_The_ESRV_Service.
lea rcx, [0x140113930]
call fcn.14000c3d0
xor edx, edx
xor ecx, ecx
mov r8d, 0x400f003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0xc0], rax
test rax, rax
jne 0x140039e07
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db320]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8b34]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x155d
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140039df0
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x140039e20
cmp dword [0x140192400], 0
lea rdx, [0x1400d8ac8]
je 0x140039e27
lea rdx, [0x1400d8a38]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0xb0], rax
mov r12, rax
test rax, rax
jne 0x140039f94
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db2c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d89c4]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1584
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x140039f75
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8d, dword [0x1401917f4]
mov ecx, dword [0x1401923fc]
mov edx, dword [0x140192400]
test r8d, r8d
jne 0x14003a763
mov eax, ecx
cmp ecx, 1
je 0x140039fd1
cmp edx, 1
je 0x140039fd1
test r8d, r8d
jne 0x14003a763
test ecx, ecx
je 0x140039fd1
test edx, edx
jne 0x14003a763
test eax, eax
jne 0x140039fe9
test edx, edx
jne 0x140039fe9
lea r8, [0x1400d89c8]
lea rdx, [0x1400db250]
jmp 0x140039ff7
lea r8, [0x1400d87d8]
lea rdx, [0x1400db1d0]
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x182d0]
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov qword [rsp + 0x20], r13
mov r9d, 0xffff
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14003a17a
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db170]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d88b8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x15da
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003a15b
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x182d0]
mov r8d, 0x27d8
lea rdx, [rsp + 0xbb90]
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov r8d, 0x27d8
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0xbb90]
call fcn.1400957f0
mov r15, rax
test rax, rax
jne 0x14003a310
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400db110]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8858]
mov edx, 0x9f6
lea r8, [r15 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r15b
mov dword [rsp + 0xc38], 0x1609
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003a2f1
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r11d, ebx
mov dword [rsp + 0x90], ebx
mov r10d, dword [rsp + 0x188]
cmp r11d, r10d
jge 0x14003a382
movsxd rbx, r11d
mov r9, qword [r15 + rbx*8]
test r9, r9
je 0x14003a49b
mov rax, r9
lea rcx, [0x1400d9c18]
sub rcx, r9
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + rcx]
sub r8d, edx
jne 0x14003a364
inc rax
test edx, edx
jne 0x14003a350
test r8d, r8d
jne 0x14003a401
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r15 + rbx*8], r13
mov r10d, dword [rsp + 0x188]
mov r9d, r10d
mov dword [rsp + 0xf8], r10d
mov r14d, 1
mov r8d, r14d
mov dword [rsp + 0x90], r14d
mov edx, r14d
mov dword [rsp + 0xa8], edx
cmp r8d, r10d
jge 0x14003a4ab
cmp edx, r10d
jge 0x14003a4ab
movsxd rax, r8d
lea r11, [r15 + rax*8]
cmp qword [r11], 0
jne 0x14003a3db
inc edx
mov dword [rsp + 0xa8], edx
dec r9d
mov dword [rsp + 0xf8], r9d
cmp r8d, edx
je 0x14003a3f2
movsxd rax, edx
mov rcx, qword [r15 + rax*8]
mov qword [r11], rcx
mov r10d, dword [rsp + 0x188]
inc r8d
mov dword [rsp + 0x90], r8d
inc edx
jmp 0x14003a3a1
test r9, r9
je 0x14003a49b
mov rax, r9
lea r8, [0x1400d8848]
sub r8, r9
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003a433
inc rax
test ecx, ecx
jne 0x14003a420
test edx, edx
je 0x14003a36d
test r9, r9
je 0x14003a49b
mov rax, r9
lea r8, [0x1400d87c8]
sub r8, r9
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003a463
inc rax
test ecx, ecx
jne 0x14003a450
test edx, edx
je 0x14003a36d
test r9, r9
je 0x14003a49b
mov rax, r9
lea r8, [0x1400d8758]
sub r8, r9
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003a493
inc rax
test ecx, ecx
jne 0x14003a480
test edx, edx
je 0x14003a36d
inc r11d
mov dword [rsp + 0x90], r11d
jmp 0x14003a322
mov ecx, r9d
mov dword [rsp + 0x90], ecx
cmp ecx, r10d
jge 0x14003a4d4
movsxd rax, ecx
mov qword [r15 + rax*8], r13
inc ecx
mov dword [rsp + 0x90], ecx
mov r10d, dword [rsp + 0x188]
jmp 0x14003a4b5
mov dword [rsp + 0x188], r9d
mov dword [rsp + 0xf8], r13d
mov ebx, r13d
mov dword [rsp + 0x100], ebx
mov r13d, r14d
mov dword [rsp + 0x90], r14d
nop dword [rax]
cmp r13d, dword [rsp + 0x188]
jge 0x14003a77e
xor eax, eax
mov esi, eax
mov dword [rsp + 0x10c], eax
movsxd r12, r13d
nop dword [rax]
cmp esi, 4
jge 0x14003a6fb
cmp ebx, 1
jne 0x14003a70b
mov rcx, qword [r15 + r12*8]
cmp byte [rcx], 0x22
je 0x14003a6ed
mov edx, 0x27d8
call fcn.14003e890
mov r14, rax
lea rdx, [rax + 3]
mov rcx, qword [r15 + r12*8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r8, rax
test rax, rax
jne 0x14003a6b0
xor edx, edx
mov r8d, 0xc50
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400db0b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d86f8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1699
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003a691
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea edx, [r14 + 1]
mov dword [rsp + 0xa8], edx
test edx, edx
jle 0x14003a6d7
lea r9d, [rdx - 1]
movsxd rax, r9d
movzx ecx, byte [rax + r8]
movsxd rax, edx
mov byte [rax + r8], cl
mov edx, r9d
jmp 0x14003a6b4
mov byte [r8], 0x22
mov word [r8 + r14 + 1], 0x22
mov qword [r15 + r12*8], r8
xor eax, eax
lea r14d, [rax + 1]
cmp ebx, 1
jne 0x14003a70b
mov ebx, eax
mov dword [rsp + 0x100], eax
inc r13d
mov dword [rsp + 0x90], r13d
jmp 0x14003a500
mov edx, 0x27d8
mov rcx, qword [r15 + r12*8]
call fcn.140093030
movsxd rcx, esi
mov rax, qword [r15 + r12*8]
mov r8, qword [rsp + rcx*8 + 0x128]
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003a743
inc rax
test ecx, ecx
jne 0x14003a730
test edx, edx
jne 0x14003a753
mov ebx, r14d
mov dword [rsp + 0x100], ebx
jmp 0x14003a6fb
inc esi
mov dword [rsp + 0x10c], esi
xor eax, eax
jmp 0x14003a520
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x188], eax
mov r12, qword [rsp + 0x88]
mov r15, r12
jmp 0x14003a786
mov r12, qword [rsp + 0x88]
movsxd rbx, dword [rsp + 0x188]
shl rbx, 3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov qword [rsp + 0xe8], rax
xor edx, edx
test rax, rax
jne 0x14003a8f1
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400db050]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8698]
mov edx, 0x9f6
lea r8, [rsi - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x16dd
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003a8da
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x140192400]
cmp dword [0x1401923fc], 0
jne 0x14003a919
test eax, eax
jne 0x14003a927
lea rax, [rsp + 0xaf30]
jmp 0x14003a932
test eax, eax
jne 0x14003a927
lea rax, [rsp + 0xaf58]
jmp 0x14003a932
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax]
mov qword [rsi], rax
mov ebx, 1
mov r13d, ebx
mov dword [rsp + 0x90], ebx
mov dword [rsp + 0xa8], ebx
xor r11d, r11d
nop
cmp r13d, dword [rsp + 0x188]
jge 0x14003ac42
mov r12, r11
mov qword [rsp + 0x98], r11
movsxd rax, r13d
lea r14, [r15 + rax*8]
mov edx, 0x27d8
mov rcx, qword [r14]
call fcn.14003e890
mov qword [rsp + 0xc8], rax
cmp dword [rsp + 0xd4], 1
je 0x14003a999
cmp dword [rsp + 0xe0], 1
jne 0x14003a99d
add rax, 2
lea rsi, [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
xor edx, edx
test rax, rax
jne 0x14003ab00
mov r8d, 0xc50
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 5
lea rax, [0x1400daff0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8638]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1723
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003aae1
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
cmp dword [rsp + 0xd4], 1
je 0x14003ab1f
cmp dword [rsp + 0xe0], 1
jne 0x14003ab3f
mov rax, qword [r14]
cmp byte [rax], 0x22
je 0x14003ab3f
mov eax, 0x22
mov word [rbx], ax
mov eax, 1
mov r12d, eax
mov qword [rsp + 0x98], rax
shr rsi, 1
lea rdx, [rbx + r12*2]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, qword [r14]
mov r8, rsi
lea rcx, [rsp + 0x178]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
xor r11d, r11d
cmp dword [rsp + 0xd4], 1
jne 0x14003aba1
mov rax, qword [r14]
mov rcx, qword [rsp + 0xc8]
cmp byte [rax + rcx - 1], 0x22
je 0x14003aba1
mov rax, qword [rsp + 0x178]
mov ecx, 0x22
mov word [rbx + rax*2 - 2], cx
mov rax, qword [rsp + 0x178]
mov word [rbx + rax*2], r11w
movsxd r10, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0xe8]
mov qword [rcx + r10*8], rbx
mov rax, qword [r14]
mov rcx, rax
lea r9, [0x1400d85c8]
sub r9, rax
nop word [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x14003abe5
inc rcx
test edx, edx
jne 0x14003abd0
mov ecx, r11d
test r8d, r8d
sete cl
mov dword [rsp + 0xe0], ecx
lea r8, [0x1400d8558]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003ac13
inc rax
test ecx, ecx
jne 0x14003ac00
mov eax, r11d
test edx, edx
sete al
mov dword [rsp + 0xd4], eax
inc r13d
mov dword [rsp + 0x90], r13d
inc r10d
mov dword [rsp + 0xa8], r10d
mov ebx, 1
jmp 0x14003a950
lea rdx, [rsp + 0x198]
mov r12, qword [rsp + 0xb0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14003adac
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ae
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ae
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400daf90]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d84f8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x178e
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003ad8d
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov dword [rsp + 0xd8], ebx
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rsp + 0x19c]
cmp ecx, 1
je 0x14003af73
mov eax, ebx
inc ebx
mov dword [rsp + 0xd8], ebx
cmp eax, 0x14
jge 0x14003af6a
lea rdx, [rsp + 0x198]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14003af47
xor edx, edx
mov r8d, 0xc50
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ae
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ae
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400daf30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8498]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x17ba
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003af28
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d8438]
lea rcx, [0x140113930]
call fcn.14000c3d0
jmp 0x14003adc0
cmp ecx, 1
jne 0x14003b84b
mov rsi, qword [rsp + 0xe8]
mov r8, rsi
mov edx, dword [rsp + 0x188]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14003b833
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6f7
jne 0x14003b833
mov edx, dword [rsp + 0x188]
cmp edx, 4
jge 0x14003b0fd
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b1
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400daed0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d83d8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x17f3
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003b0de
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov ebx, 2
mov dword [rsp + 0x90], ebx
nop dword [rax]
cmp ebx, edx
jge 0x14003b148
movsxd rax, ebx
lea rsi, [rsi + rax*8]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14003b135
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [rsi], rax
mov edx, dword [rsp + 0x188]
inc ebx
mov dword [rsp + 0x90], ebx
mov rsi, qword [rsp + 0xe8]
jmp 0x14003b110
mov dword [rsp + 0x188], 2
mov edx, reloc.WS2_32.dll_socket
lea rcx, [0x1400d8368]
call fcn.14003e890
lea rbx, [rax*2 + 6]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
xor edx, edx
test rax, rax
jne 0x14003b2c7
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dae70]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d82d8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1829
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003b2a8
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
shr rbx, 1
lea rax, [0x1400d8338]
mov qword [rsp + 0x20], rax
lea r9, [0x1400dae28]
mov r8, 0xffffffffffffffff
mov rdx, rbx
mov rcx, r14
call fcn.140001140
xor r13d, r13d
mov word [r14 + rbx*2 - 2], r13w
mov qword [rsi + 0x10], r14
inc dword [rsp + 0x188]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xaf90]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r13
lea r9, str.__I64d_
mov edx, 0xff
lea r8, [r13 - 1]
lea rcx, [rsp + 0xaf90]
call fcn.140001140
mov word [rsp + 0xb18c], r13w
mov edx, 0xff
lea rcx, [rsp + 0xaf90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea rbx, [rax*2 + 2]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
xor edx, edx
test rax, rax
jne 0x14003b4c1
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b6
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dadd0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8268]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x187a
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003b4a2
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov r8, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
shr rbx, 1
lea rax, [rsp + 0xaf90]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8208]
mov r8, 0xffffffffffffffff
mov rdx, rbx
mov rcx, r14
call fcn.140001140
mov word [r14 + rbx*2 - 2], r13w
mov qword [rsi + 0x18], r14
inc dword [rsp + 0x188]
mov eax, 1
mov ebx, eax
mov dword [rsp + 0xd8], eax
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x19c]
cmp ecx, 1
je 0x14003b6cc
mov eax, ebx
inc ebx
mov dword [rsp + 0xd8], ebx
cmp eax, 0x14
jge 0x14003b6c3
lea rdx, [rsp + 0x198]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14003b6a0
xor edx, edx
mov r8d, 0xc50
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ae
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ae
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dad70]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d81a8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x18ba
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003b681
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400d8148]
lea rcx, [0x140113930]
call fcn.14000c3d0
jmp 0x14003b520
cmp ecx, 1
jne 0x14003b833
mov r8, qword [rsp + 0xe8]
mov edx, dword [rsp + 0x188]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x14003b833
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov ebx, 1
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b1
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dad10]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d8088]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x18f0
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003b814
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [0x1400d8024]
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e653
lea rdx, [0x1400d7f68]
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e653
lea rdx, str.Shutting_down_The_ESRV_Service.
lea rcx, [0x140113930]
call fcn.14000c3d0
lea rdx, str.Stopping_The_ESRV_Service.
lea rcx, [0x140113930]
call fcn.14000c3d0
xor edx, edx
xor ecx, ecx
mov r8d, 0x400f003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x14003b9e6
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dacb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7ec4]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1986
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003b9cf
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x14003b9ff
cmp dword [0x140192400], 0
lea rdx, [0x1400d7ec8]
je 0x14003ba06
lea rdx, [0x1400d7dd8]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x14003bb6b
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dac50]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7d78]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x19ad
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003bb4c
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [rsp + 0x198]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14003bccd
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ae
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ae
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dabf0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7d18]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x19c4
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003bcae
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov eax, dword [rsp + 0x19c]
dec eax
cmp eax, 6
ja case.0x14003bce5.2
mov ecx, dword [rsi + rax*4 + 0x3e84c]
add rcx, rsi
jmp rcx
lea rdx, [0x1400d7cb8]
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e65b
lea r8, [rsp + 0x198]
mov edx, ebx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14003be63
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2af
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2af
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dab90]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7bb8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x19ec
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003be44
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [0x1400d7b58]
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e65b
lea rdx, str.Resetting_The_ESRV_Services_Energy_Integration.
lea rcx, [0x140113930]
call fcn.14000c3d0
xor edx, edx
xor ecx, ecx
mov r8d, 0x400f003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x14003bfeb
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400dab30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7a68]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1a18
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003bfd4
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x14003c004
cmp dword [0x140192400], 0
lea rdx, [0x1400d79e8]
je 0x14003c00b
lea rdx, [0x1400d7958]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x14003c170
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400daad0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d78f8]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1a3f
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003c151
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea r8, [rsp + 0x198]
mov edx, 0x80
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14003c2d7
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ab
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ab
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400daa70]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7898]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1a5b
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003c2b8
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [0x1400d7838]
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e65b
lea rdx, str.Synchronizing_The_ESRV_Server.
lea rcx, [0x140113930]
call fcn.14000c3d0
xor edx, edx
xor ecx, ecx
mov r8d, 0x400f003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x14003c45f
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400daa10]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d77b8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1a86
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003c448
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x14003c478
cmp dword [0x140192400], 0
lea rdx, [0x1400d7738]
je 0x14003c47f
lea rdx, [0x1400d76a8]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x14003c5e4
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da9a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7648]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1aad
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003c5c5
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea r8, [rsp + 0x198]
mov edx, 0x7f
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14003c74b
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ab
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ab
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da930]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d75e8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1ac9
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003c72c
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [0x1400d7588]
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e65b
lea rdx, str.Flushing_The_ESRV_Server.
lea rcx, [0x140113930]
call fcn.14000c3d0
xor edx, edx
xor ecx, ecx
mov r8d, 0x400f003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x14003c8d3
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da870]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7528]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1af4
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003c8bc
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x14003c8ec
cmp dword [0x140192400], 0
lea rdx, [0x1400d74a8]
je 0x14003c8f3
lea rdx, [0x1400d7418]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x14003ca58
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da810]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d73b8]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1b1b
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003ca39
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea r8, [rsp + 0x198]
mov edx, 0x7d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14003cbbf
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ab
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ab
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da7b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7358]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1b37
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003cba0
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [0x1400d72f8]
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e65b
lea rdx, str.Device_Control.
lea rcx, [0x140113930]
call fcn.14000c3d0
mov edx, 2
lea rcx, [0x140113930]
call fcn.14005ba60
xor edx, edx
test eax, eax
je 0x14003cd32
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x263
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x263
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da750]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7288]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1b69
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003d2e0
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
jmp 0x14003d2e0
mov r8d, 0xa080
lea rcx, [rsp + 0xeb0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0xeb0], ebx
mov byte [rsp + 0xf1d], 0x43
cmp dword [0x140186f50], 1
jne 0x14003d0d3
mov edx, 0x9fff
mov rcx, qword [0x140186f48]
call fcn.14003e890
mov ebx, 0x9fff
sub rbx, rax
jne 0x14003ce81
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x26d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x26d
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da6f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7228]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1ba1
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
jmp 0x14003ccfe
mov r9, rax
mov r8, qword [0x140186f48]
mov edx, 0x9fff
lea rcx, [rsp + 0x1d280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov edx, 2
lea rcx, [0x1400d71c8]
call fcn.14003e890
sub rbx, rax
je 0x14003d2d0
mov r9, rax
lea r8, [0x1400d7168]
mov edx, 0x9fff
lea rcx, [rsp + 0x1d280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
mov edx, 0x9fff
mov rcx, qword [0x140186f58]
call fcn.14003e890
sub rbx, rax
jne 0x14003cfb9
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x26d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x26d
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da690]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7108]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1bcd
jmp 0x14003ce45
mov r9, rax
mov r8, qword [0x140186f58]
mov edx, 0x9fff
lea rcx, [rsp + 0x1d280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
cmp rbx, 0xa000
jb 0x14003d0ad
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov ebx, 1
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x26d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x26d
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da610]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d70a8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1be4
jmp 0x14003ce45
mov r9d, 0xa000
lea r8, [rsp + 0x1d280]
mov edx, r9d
lea rcx, [rsp + 0xf1e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov ebx, 1
jmp 0x14003d0fa
cmp dword [0x140186f40], 1
jne 0x14003d0fa
mov r9d, 0xa000
mov r8, qword [0x140186f48]
mov edx, r9d
lea rcx, [rsp + 0xf1e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
xor r13d, r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0xeb0]
mov rdx, qword [0x140191488]
lea rcx, [0x140113930]
call fcn.14005cd80
test eax, eax
je 0x14003d1f5
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x26d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x26d
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da580]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d7048]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1c2a
jmp 0x14003ccc3
mov edx, ebx
lea rcx, [0x140113930]
call fcn.14005d290
test eax, eax
je 0x14003d2d8
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x263
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x263
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da520]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d6fe8]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1c40
jmp 0x14003ccc3
mov ebx, 1
xor r13d, r13d
lea r14, [rsp + 0x1f0]
xor edx, edx
mov r8d, 0xc50
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ab
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ab
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da490]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d6f88]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], 0
mov dword [rsp + 0xc38], 0x1c59
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003d3fe
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, str.Querying_The_ESRV_Services_Status.
lea rcx, [0x140113930]
call fcn.14000c3d0
xor edx, edx
xor ecx, ecx
mov r8d, 0x400f003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
jne 0x14003d585
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a8
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da420]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d6ea8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1c82
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003d56e
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
cmp dword [0x1401923fc], 0
jne 0x14003d59e
cmp dword [0x140192400], 0
lea rdx, [0x1400d6e28]
je 0x14003d5a5
lea rdx, [0x1400d6d98]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r12, rax
test rax, rax
jne 0x14003d70a
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2a9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2a9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da3b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d6d38]
mov edx, 0x9f6
lea r8, [r12 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1ca9
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003d6eb
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [rsp + 0x198]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14003d86c
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2ae
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2ae
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400da350]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d6cd8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1cc0
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003d84d
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
lea rdx, [0x1400d6414]
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x198]
cmp eax, 0x20
ja 0x14003d8e5
je 0x14003d8d5
sub eax, 1
je 0x14003d8c5
sub eax, 1
je 0x14003d8b5
mov rsi, qword [rsp + 0x78]
cmp eax, 0xe
jne 0x14003d932
lea rax, str.The_Service_Runs_In_Its_Own_Process.
lea r9, [0x1400d6988]
jmp 0x14003d919
lea rax, str.The_Service_Is_A_File_System_Driver.
lea r9, str.___Type.........................:___s_
jmp 0x14003d914
lea rax, str.The_Service_Is_A_Device_Driver.
lea r9, [0x1400d6a88]
jmp 0x14003d914
lea rax, str.The_Service_Shares_A_Process_With_Other_Services.
lea r9, [0x1400d6878]
jmp 0x14003d914
sub eax, 0x100
je 0x14003d906
mov rsi, qword [rsp + 0x78]
cmp eax, 0x10
jne 0x14003d932
lea rax, str.The_Service_Runs_In_Its_Own_Process_And_Can_Interact_With_The_Desktop.
lea r9, [0x1400d6778]
jmp 0x14003d919
lea rax, str.The_Service_Can_Interact_With_The_Desktop.
lea r9, [0x1400d67f8]
mov rsi, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
mov edx, 0x27d8
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x19c]
dec eax
cmp eax, 6
ja case.default.0x14003d96b
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x3e868]
add rcx, rdx
jmp rcx
lea rax, str.The_Service_Continue_Is_Pending.
lea r9, str.___Current_Status...............:___s_
jmp 0x14003d9db
lea rax, str.The_Service_Pause_Is_Pending.
lea r9, [0x1400d65d8]
jmp 0x14003d9db
lea rax, str.The_Service_Is_Paused.
lea r9, [0x1400d64e8]
jmp 0x14003d9db
lea rax, str.The_Service_Is_Running.
lea r9, [0x1400d6358]
jmp 0x14003d9db
lea rax, str.The_Service_Is_Starting.
lea r9, [0x1400d6238]
jmp 0x14003d9db
lea rax, str.The_Service_Is_Stopping.
lea r9, [0x1400d6188]
jmp 0x14003d9db
lea rax, str.The_Service_Is_Not_Running.
lea r9, [0x1400d60d8]
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
mov edx, 0x27d8
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a4]
mov dword [rsp + 0x20], eax
lea r9, str.___Exit_Code....................:___u_
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x20], eax
lea r9, str.___Service_Specific_Exit_Code...:___u_
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1ac]
mov dword [rsp + 0x20], eax
lea r9, str.___Check_Point..................:___u_
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1b0]
mov dword [rsp + 0x20], eax
lea r9, str.___Wait_Hint....................:___u_
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x20], eax
lea r9, str.___Control_s__Accepted..........:___u_
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
test al, 0x10
je 0x14003db85
lea rax, str.The_Service_Is_a_network_component_that_can_accept_changes_in_its_binding_without_being_stopped_and_restarted.
mov qword [rsp + 0x20], rax
lea r9, str.___.............................:___s_
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
test al, 8
je 0x14003dbcd
lea rax, str.The_Service_Can_reread_its_startup_parameters_without_being_stopped_and_restarted.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5c58]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
test al, 2
je 0x14003dc15
lea rax, str.The_Service_Can_be_paused_and_continued.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5bd8]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
bt eax, 8
jae 0x14003dc5f
lea rax, str.The_Service_Can_perform_pre_shutdown_tasks.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5b58]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
test al, 4
je 0x14003dca7
lea rax, str.The_Service_Is_notified_when_system_shutdown_occurs.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5a08]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
test al, 1
je 0x14003dcef
lea rax, str.The_Service_Can_be_stopped.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5988]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
test al, 0x20
je 0x14003dd37
lea rax, str.The_Service_Is_notified_When_The_Computers_Hardware_Profile_Has_Changed.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5908]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
test al, 0x40
je 0x14003dd7f
lea rax, str.The_Service_Is_notified_When_The_Computers_Power_Status_Has_Changed.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5888]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
test al, al
jns 0x14003ddc7
lea rax, str.The_Service_Is_notified_When_The_Computers_Session_Status_Has_Changed.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d57c8]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
bt eax, 9
jae 0x14003de11
lea rax, str.The_Service_Is_notified_When_The_System_Time_Has_Changed.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5748]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
mov eax, dword [rsp + 0x1a0]
bt eax, 0xa
jae 0x14003de54
lea rax, str.The_Service_Is_notified_When_An_Event_For_Which_The_Service_Has_Registered_Occurs.
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5688]
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
cmp dword [0x1401923fc], 0
jne 0x14003de76
cmp dword [0x140192400], 0
jne 0x14003de76
lea r8, [0x1400d5618]
lea rdx, [0x1400d9f20]
jmp 0x14003de84
lea r8, [0x1400d55a8]
lea rdx, [0x1400d9e90]
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x182d0]
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov qword [rsp + 0x20], r13
mov r9d, 0xffff
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14003e002
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b9
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400d9e30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5548]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1e96
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003dfe8
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x182d0]
mov r8d, 0x27d8
lea rdx, [rsp + 0xbb90]
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rax, [rsp + 0xbb90]
mov qword [rsp + 0x20], rax
lea r9, str.___Image_Path...................:___s_
mov edx, 0x27d8
mov r8, 0xffffffffffffffff
mov rcx, rsi
call fcn.140001030
mov byte [rsi + 0x27d7], 0
mov rdx, rsi
lea rcx, [0x140113930]
call fcn.14000c380
jmp 0x14003e65b
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x24a
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400d9dd0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d5428]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1ec2
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], 1
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003e198
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
mov rsi, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov ebx, 1
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401978e8], rax
test rax, rax
jne 0x14003e317
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x53
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
lea r9d, [rbx + 0x52]
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400d9d70]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d53c8]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1ee7
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003e2fd
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
jmp 0x14003e4a2
xorps xmm0, xmm0
movups xmmword [0x140197920], xmm0
movups xmmword [0x140197930], xmm0
lea rax, [0x1400d5348]
mov qword [0x140197920], rax
lea rax, [0x14001cfa0]
mov qword [0x140197928], rax
xor r13d, r13d
mov qword [0x140197930], r13
mov qword [0x140197938], r13
lea rcx, [0x140197920]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14003e653
xor edx, edx
mov r8d, 0xc50
lea r14, [rsp + 0x1f0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x1f4], eax
mov dword [rsp + 0x230], 3
mov dword [rsp + 0x1fc], ebx
mov dword [rsp + 0x238], 0x2b3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
mov r9d, 0x2b3
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a5b80
mov dword [rsp + 0x234], eax
mov dword [rsp + 0x23c], 4
lea rax, [0x1400d9d10]
mov qword [rsp + 0x20], rax
lea r9, [0x1400d52e8]
mov edx, 0x9f6
lea r8, [r13 - 1]
lea rcx, [rsp + 0x240]
call fcn.140001030
mov byte [rsp + 0xc35], r13b
mov dword [rsp + 0xc38], 0x1f15
mov eax, dword [0x140125478]
mov dword [rsp + 0x20c], eax
inc eax
mov dword [0x140125478], eax
mov r9d, ebx
mov r8, r14
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a51e0
mov dword [0x140125498], eax
mov qword [0x140125510], rbx
mov dword [0x14012550c], r13d
mov rax, qword [0x140126150]
test rax, rax
je 0x14003e48d
mov r8d, ebx
mov edx, ebx
lea rcx, [0x140113930]
call qword [0x1400b4c70]
mov dword [0x140125498], eax
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
nop
cmp dword [0x140125480], 0
jbe 0x14003e4dc
cmp dword [0x1401261fc], 0
jne 0x14003e4c7
mov r8d, ebx
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.14009ece0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a4410
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a40a0
test r12, r12
je 0x14003e53d
mov edx, dword [rsp + 0x148]
test edx, edx
jle 0x14003e53d
mov ebx, r13d
mov dword [rsp + 0x90], ebx
cmp ebx, edx
jge 0x14003e52c
movsxd rax, ebx
lea rdi, [r12 + rax*8]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14003e528
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], r13
mov edx, dword [rsp + 0x148]
inc ebx
jmp 0x14003e4fe
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x88], r13
mov rcx, qword [rsp + 0x160]
test rcx, rcx
je 0x14003e558
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x160], r13
cmp qword [rsp + 0x158], 0
je 0x14003e584
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x158]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x158], r13
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x14003e59f
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x168], r13
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x14003e5bd
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0xf0], r13
test r14, r14
je 0x14003e5d0
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x70], r13
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x14003e5ee
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0xb8], r13
test r15, r15
je 0x14003e604
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x80], r13
test rsi, rsi
je 0x14003e617
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x78], r13
mov qword [0x140113920], r13
mov rcx, qword [0x1401978e8]
test rcx, rcx
je 0x14003e637
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401978e8], r13
mov eax, 1
jmp 0x14003e7e4
mov r12, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xc0]
cmp dword [0x140125480], 0
jbe 0x14003e6a0
cmp dword [0x140186f30], 0
je 0x14003e68b
cmp dword [0x1401261fc], 0
jne 0x14003e68b
mov r8d, 1
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.14009ece0
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a4410
mov rdx, rdi
lea rcx, [0x140113930]
call fcn.1400a40a0
test r12, r12
je 0x14003e6bd
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r14, r14
je 0x14003e6cb
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x88]
xor esi, esi
test rcx, rcx
je 0x14003e734
mov edx, dword [rsp + 0x148]
test edx, edx
jle 0x14003e734
mov ebx, esi
mov dword [rsp + 0x90], ebx
nop
cmp ebx, edx
jge 0x14003e726
movsxd rax, ebx
lea rdi, [rcx + rax*8]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14003e713
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], rsi
mov edx, dword [rsp + 0x148]
inc ebx
mov dword [rsp + 0x90], ebx
mov rcx, qword [rsp + 0x88]
jmp 0x14003e6f0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x14003e752
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0xf0], rsi
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14003e76a
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x70], rsi
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x14003e788
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0xb8], rsi
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x14003e7a6
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x80], rsi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14003e7bb
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x78], rsi
mov qword [0x140113920], rsi
mov rcx, qword [0x1401978e8]
test rcx, rcx
je 0x14003e7db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401978e8], rsi
xor eax, eax
jmp 0x14003e7e4
mov rcx, qword [rsp + 0x27280]
xor rcx, rsp
call fcn.140001ea0
lea r11, [rsp + 0x27290]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret