Function at 0x140006258
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x23d8]
mov eax, 0x24b0
call fcn.14000b240
sub rsp, rax
mov rax, qword [0x1400110e0]
xor rax, rsp
mov qword [rbp + 0x23a0], rax
mov rdi, rcx
mov dword [rbp + 0x670], 0x11c
lea rax, [rbp + 8]
mov r15d, 1
lea rcx, [rbp + 0x670]
mov dword [rbp], r15d
mov qword [rbp - 8], rax
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
xor r13d, r13d
test eax, eax
je 0x1400062dc
mov byte [0x1400120da], r15b
mov byte [0x140011dc4], r15b
mov rax, qword [0x1400100c0]
mov r12d, 0x104
mov word [rax], r13w
mov rax, qword [0x1400108d0]
mov word [rax], r13w
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], r12d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov esi, 0x20
mov rbx, rax
lea ecx, [rsi + 2]
cmp word [rax], cx
jne 0x140006326
add rbx, 2
jmp 0x140006329
movzx ecx, si
movzx eax, word [rbx]
test ax, ax
je 0x14000634c
cmp ax, cx
je 0x140006342
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140006331
cmp word [rbx], r13w
je 0x14000634c
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x1400120f0], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
nop dword [rax + rax]
mov qword [0x140011dd0], rax
cmp rax, 0xffffffffffffffff
je 0x140006385
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
nop dword [rax + rax]
cmp eax, 3
je 0x14000638c
mov qword [0x140011dd0], r13
mov edi, 0x800
mov dword [rbp - 0x54], r13d
mov r8d, edi
lea rcx, [rbp + 0xba0]
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, edi
lea rcx, [rbp + 0x13a0]
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [0x140011c14], r13d
mov r14d, 9
cmp word [rbx], si
je 0x1400063cf
cmp word [rbx], r14w
jne 0x1400063d5
add rbx, 2
jmp 0x1400063c4
movzx eax, word [rbx]
mov ecx, 0xfffd
sub ax, 0x2d
test cx, ax
jne 0x1400065d8
lea rax, [rbx + 2]
test rax, rax
je 0x1400065d8
movzx eax, word [rax]
or ax, si
cmp ax, 0x60
jne 0x1400065d8
add rbx, 4
mov rax, rbx
mov qword [rsp + 0x78], rbx
cmp word [rbx], si
je 0x14000641e
cmp word [rbx], r14w
jne 0x140006424
lea rbx, [rax + 2]
jmp 0x14000640b
lea rax, [rbp + 0xba0]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x78]
call fcn.140005380
test al, al
jne 0x140006473
xor edx, edx
xor ecx, ecx
call fcn.140009850
cmp dword [rbp + 0x18], r12d
jle 0x140006466
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], r15d
mov dword [rbp + 0x18], r12d
jmp 0x1400071c0
mov eax, dword [rbp + 0x18]
mov r9d, 0x20019
add eax, eax
mov dword [rbp - 0x78], r13d
cmp byte [0x1400120da], r13b
mov dword [rbp - 0x74], eax
jne 0x14000649e
cmp byte [0x140011dc4], r13b
mov eax, 0x20119
cmovne r9d, eax
lea rax, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006599
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x74]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x78]
mov rax, qword [rbp + 0x10]
lea rdx, [rbp + 0xba0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xea
jne 0x14000655d
mov edx, dword [rbp - 0x74]
lea rcx, [rbp + 0x10]
shr edx, 1
call fcn.14000968c
mov rcx, qword [rsp + 0x68]
test al, al
jne 0x14000652f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x140006638
lea rax, [rbp - 0x74]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x78]
mov rax, qword [rbp + 0x10]
lea rdx, [rbp + 0xba0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x140006599
cmp dword [rbp - 0x78], r15d
jne 0x140006599
mov rbx, qword [rbp + 0x10]
movzx edi, word [rbx]
mov qword [rsp + 0x78], rbx
cmp di, si
je 0x140006593
cmp di, r14w
jne 0x140006b9b
add rbx, 2
jmp 0x14000657c
cmp dword [rbp + 0x18], r12d
jle 0x1400065af
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], r12d
mov qword [rbp + 0x10], rax
cmp dword [rbp], r15d
jle 0x1400065d1
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
xor eax, eax
jmp 0x140008854
mov edi, 0x7fffffff
mov rax, rbx
mov edx, edi
cmp word [rax], r13w
je 0x1400065f1
add rax, 2
sub rdx, r15
jne 0x1400065e2
mov rcx, rdi
mov rax, rdx
sub rcx, rdx
neg rax
sbb r8, r8
and r8, rcx
test rdx, rdx
jne 0x140006627
cmp dword [rbp + 0x18], r12d
jle 0x14000661e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov dword [rbp + 0x18], r12d
jmp 0x140008831
lea edx, [r8 + 1]
lea rcx, [rbp + 0x10]
call fcn.14000968c
test al, al
jne 0x14000667a
cmp dword [rbp + 0x18], r12d
jle 0x14000664e
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], r12d
mov qword [rbp + 0x10], rax
cmp dword [rbp], r15d
jle 0x140006670
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0xe
jmp 0x140008854
mov rax, qword [rbp + 0x10]
lea rcx, str.package
mov qword [rbp + 0xa30], rcx
mov rdx, rdi
mov byte [rbp + 0xa40], r15b
mov byte [rbp + 0xa58], r15b
mov word [rax], r13w
lea rax, str.update
movsd xmm0, qword [str.PATCH]
movups xmm1, xmmword [0x14000cfa0]
mov qword [rbp + 0xa00], rax
lea rax, str.uninstall
mov qword [rbp + 0xa18], rax
lea rax, [0x14000ce20]
mov qword [rbp + 0xa38], rax
lea rax, str.help
mov qword [rbp + 0xa48], rax
lea rax, [0x14000ce34]
mov qword [rbp + 0xa50], rax
lea rax, str.quiet
mov qword [rbp + 0xa60], rax
lea rax, [0x14000ce50]
mov qword [rbp + 0xa68], rax
lea rax, str.passive
mov qword [rbp + 0xa78], rax
lea rax, str._qb___REBOOTPROMPTS
mov qword [rbp + 0xa80], rax
lea rax, str.norestart
mov qword [rbp + 0xa90], rax
lea rax, str.REBOOTReallySuppress
mov qword [rbp + 0xa98], rax
lea rax, str.forcerestart
mov qword [rbp + 0xaa8], rax
lea rax, str.REBOOTForce
mov qword [rbp + 0xab0], rax
lea rax, str.promptrestart
mov qword [rbp + 0xac0], rax
lea rax, str.REBOOTPROMPT__
mov qword [rbp + 0xac8], rax
lea rax, [0x14000cf60]
mov qword [rbp + 0xad8], rax
lea rax, [0x14000cf68]
mov qword [rbp + 0xae0], rax
mov eax, dword [0x14000cf70]
mov dword [rbp + 0x9b0], eax
movzx eax, word [0x14000cf74]
mov word [rbp + 0x9b4], ax
mov eax, dword [0x14000cf78]
mov dword [rbp + 0x9b8], eax
movzx eax, word [0x14000cf7c]
mov word [rbp + 0x9bc], ax
mov eax, dword [0x14000cf88]
mov dword [rbp + 0x9c8], eax
movzx eax, word [0x14000cf8c]
movsd qword [rbp + 0x9c0], xmm0
movups xmm0, xmmword [str.MSIPATCHREMOVE]
mov word [rbp + 0x9cc], ax
mov rax, rcx
mov byte [rbp + 0xa70], r15b
mov byte [rbp + 0xa88], r15b
mov byte [rbp + 0xaa0], r15b
mov byte [rbp + 0xab8], r15b
mov byte [rbp + 0xad0], r15b
mov byte [rbp + 0xae8], r15b
movups xmmword [rbp + 0x9e0], xmm0
movups xmmword [rbp + 0x9f0], xmm1
cmp word [rax], r13w
je 0x140006845
add rax, 2
sub rdx, r15
jne 0x140006836
mov rcx, rdi
mov rax, rdx
sub rcx, rdx
neg rax
sbb r14, r14
and r14, rcx
test rdx, rdx
je 0x140006608
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x80], r13
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.140003860
mov rsi, rax
test rax, rax
je 0x140006958
movzx eax, word [rax]
test ax, ax
je 0x140006958
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
jne 0x140006869
mov r15, qword [rbp - 0x80]
mov ecx, 1
lea r12, [r15 - 1]
cmp r12, rcx
jne 0x1400068e0
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x14000cfb0]
mov edx, ecx
mov qword [rsp + 0x20], rax
mov ecx, 0x409
lea r9d, [r15 - 1]
lea r8, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x14000692d
cmp r14, r12
jne 0x140006922
lea r9d, [r15 - 1]
mov dword [rsp + 0x28], r14d
lea rax, str.package
mov r15d, 1
mov edx, r15d
mov qword [rsp + 0x20], rax
lea r8, [rsi + 2]
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x140006933
jmp 0x140006869
mov r15d, 1
jmp 0x140006869
mov r15d, 1
lea rax, [rbp + 0x9c0]
mov byte [rbp + 0xa10], r13b
mov qword [rbp + 0xa08], rax
lea rax, [rbp + 0x9e0]
mov byte [rbp + 0xa28], r13b
jmp 0x14000697b
lea rax, [rbp + 0x9b8]
mov byte [rbp + 0xa10], r15b
mov qword [rbp + 0xa08], rax
lea rax, [rbp + 0x9b0]
mov byte [rbp + 0xa28], r15b
mov qword [rbp + 0xa20], rax
mov qword [rsp + 0x68], rbx
mov qword [rbp - 0x80], r13
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.140003860
mov rbx, rax
test rax, rax
je 0x140006aea
movzx eax, word [rax]
test ax, ax
je 0x140006aea
mov r12, qword [rbp - 0x80]
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
jne 0x140006a23
mov r14d, r13d
lea rcx, [rbx + 2]
mov rsi, r13
lea r15, [rbp + 0xa00]
mov rax, qword [r15]
lea r9d, [r12 - 1]
or dword [rsp + 0x28], 0xffffffff
mov r8, rcx
mov ecx, 0x409
mov qword [rsp + 0x20], rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
je 0x140006a47
mov eax, 1
lea rcx, [rbx + 2]
add r14d, eax
add rsi, rax
add r15, 0x18
cmp r14d, 0xa
jb 0x1400069d4
xor r13d, r13d
mov r15d, eax
mov dword [rbp + 0x1c], 0x104
mov r9b, r15b
mov r8, r12
mov rdx, rbx
lea rcx, [rbp + 0x10]
call fcn.14000233c
mov ebx, eax
test eax, eax
jne 0x140006aa5
jmp 0x14000698b
lea rax, [rsi + rsi*2]
mov dword [rbp + 0x1c], 0x104
mov rdx, qword [rbp + rax*8 + 0xa08]
xor r13d, r13d
mov r9b, byte [rbp + rax*8 + 0xa10]
test rdx, rdx
je 0x140006a9a
mov r10, rdi
lea r15d, [r13 + 1]
mov rax, rdx
cmp word [rax], r13w
je 0x140006a83
add rax, 2
sub r10, r15
jne 0x140006a74
mov rcx, rdi
mov rax, r10
sub rcx, r10
neg rax
sbb r8, r8
and r8, rcx
test r10, r10
jne 0x140006a33
mov ebx, 0x65b
mov r15d, 1
cmp dword [rbp + 0x18], 0x104
jle 0x140006abe
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], 0x104
mov qword [rbp + 0x10], rax
cmp dword [rbp], r15d
jle 0x140006ae3
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140008854
mov rbx, qword [rbp + 0x10]
test rbx, rbx
je 0x140008812
mov rcx, rdi
mov rax, rbx
cmp word [rax], r13w
je 0x140006b0c
add rax, 2
sub rcx, r15
jne 0x140006afd
sub rdi, rcx
mov rax, rcx
neg rax
sbb rdx, rdx
and rdx, rdi
test rcx, rcx
je 0x140008812
mov esi, 0x20
lea r15d, [rsi - 0x17]
test rdx, rdx
je 0x140006b58
lea rax, [rbx - 2]
lea rax, [rax + rdx*2]
cmp word [rax], si
je 0x140006b45
cmp word [rax], r15w
jne 0x140006b58
cmp rax, rbx
jb 0x140006b58
mov word [rax], r13w
sub rax, 2
mov rbx, qword [rbp + 0x10]
jmp 0x140006b3a
movzx edi, word [rbx]
mov qword [rsp + 0x78], rbx
test di, di
je 0x140006b93
cmp di, si
je 0x140006b74
mov eax, 9
cmp di, ax
jne 0x140006b85
add rbx, 2
mov qword [rsp + 0x78], rbx
movzx edi, word [rbx]
test di, di
jne 0x140006b65
mov r12d, 0x104
mov r15d, 9
jmp 0x140006b9e
mov r12d, 0x104
jmp 0x140006b9e
mov r15d, r14d
mov rsi, qword [0x140011b50]
mov r14d, r13d
mov dword [rbp - 0x68], r13d
lea r8, str.RUVEH_IJDqXFAtPYZlgmnc
mov r9d, 0x52
test di, di
je 0x1400071ea
lea r15d, [r9 - 0x32]
cmp di, 0x2f
je 0x140006cfc
cmp di, 0x2d
je 0x140006cfc
xor edx, edx
lea rcx, [rbp + 0x7a0]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x7a0]
mov dword [rbp + 0x798], r12d
lea rdx, [rbp + 0x790]
mov qword [rbp + 0x790], rax
lea rcx, [rsp + 0x78]
mov dword [rbp + 0x79c], r12d
call fcn.140004f84
test eax, eax
je 0x14000711d
mov rsi, qword [rbp + 0x790]
test rsi, rsi
je 0x140006caa
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
nop dword [rax + rax]
mov edx, dword [0x140011d20]
lea rcx, [0x1400100c0]
add edx, 2
mov ebx, eax
add edx, eax
call fcn.140005f1c
test al, al
je 0x140006ca3
movsxd rcx, dword [0x140011d20]
mov r8, rsi
mov rax, qword [0x1400100c0]
lea r11d, [rcx + 1]
mov word [rax + rcx*2], r15w
lea eax, [rbx + 1]
movsxd rdx, eax
mov rax, qword [0x1400100c0]
movsxd rcx, r11d
mov dword [0x140011d20], r11d
lea rcx, [rax + rcx*2]
call fcn.140009e04
test eax, eax
js 0x140006ca3
lea eax, [rbx + r11]
mov dword [0x140011d20], eax
mov rsi, qword [rbp + 0x790]
mov rbx, qword [rsp + 0x78]
mov r14d, 9
movzx edi, word [rbx]
cmp di, r15w
je 0x140006cc4
cmp di, r14w
jne 0x140006ccf
add rbx, 2
mov qword [rsp + 0x78], rbx
jmp 0x140006cb5
mov r14d, dword [rbp - 0x68]
cmp dword [rbp + 0x798], r12d
jle 0x140006cf0
test rsi, rsi
je 0x140006cf0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rsi, qword [0x140011b50]
jmp 0x140007102
lea rax, [rbx + 2]
mov edx, 0x20
movzx ecx, word [rax]
mov rbx, rax
or ecx, edx
cmp r13w, word [rax]
je 0x140006d17
add rbx, 2
mov qword [rsp + 0x78], rbx
mov r15, r8
movzx eax, r9w
movzx eax, ax
or eax, edx
cmp eax, ecx
je 0x140006d7b
add r15, 2
movzx eax, word [r15]
test ax, ax
jne 0x140006d23
xor edx, edx
xor ecx, ecx
call fcn.140009850
mov r14d, 0x667
call fcn.140004ae0
cmp dword [rbp + 0x18], 0x104
jle 0x140006d66
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov eax, 1
cmp dword [rbp], eax
jmp 0x140007344
cmp word [rbx], dx
ja 0x140006d98
movzx eax, word [rbx]
movabs rcx, 0x100000201
bt rcx, rax
jae 0x140006d98
mov r8d, r13d
jmp 0x140006d9e
mov r8d, 1
mov dword [rbp - 0x64], r8d
mov edi, 9
cmp word [rbx], dx
je 0x140006db1
cmp word [rbx], di
jne 0x140006dbc
add rbx, 2
mov qword [rsp + 0x78], rbx
jmp 0x140006da7
cmp word [r15], 0x63
lea rax, [rbp + 0xba0]
mov qword [rbp - 0x80], rax
mov edi, 1
jne 0x140006de1
test r8d, r8d
jne 0x140006d39
jmp 0x140006e6f
cmp word [r15], 0x50
jne 0x140006e36
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
nop dword [rax + rax]
lea rcx, [rbp - 8]
lea edx, [rax + 0xa]
call fcn.140009610
test al, al
je 0x140007182
mov rax, qword [rbp - 8]
lea rdx, [rbp - 0x40]
mov r8d, dword [rbp]
lea rcx, [rsp + 0x78]
mov qword [rbp - 0x40], rax
call fcn.140005380
test al, al
je 0x14000715a
mov rsi, qword [0x140011b50]
jmp 0x140006e65
cmp word [r15], 0x71
je 0x140006e44
cmp word [r15], 0x63
jne 0x140006e49
test r8d, r8d
je 0x140006e6f
mov r8d, 0x400
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x78]
call fcn.140005380
test al, al
je 0x14000715a
mov rbx, qword [rsp + 0x78]
mov edx, 0x20
mov r8d, 9
movzx edi, word [rbx]
cmp di, dx
je 0x140006e83
cmp di, r8w
jne 0x140006e8e
add rbx, 2
mov qword [rsp + 0x78], rbx
jmp 0x140006e75
movzx ecx, word [r15]
mov r8d, dword [rbp - 0x64]
lea eax, [rcx - 0x46]
cmp ax, 0x2b
ja 0x140006eaf
movabs rdx, 0x80000000011
bt rdx, rax
jb 0x140006eca
lea r13, [rbp + 0xba0]
movzx edx, cx
lea r12, [rbp + 0x13a0]
cmp cx, 0x6c
jne 0x140006f4d
lea r13, [rbp + 0xba0]
movzx edx, cx
lea r12, [rbp + 0x13a0]
test r8d, r8d
je 0x140006f4d
lea rax, [rbp + 0x13a0]
mov qword [rbp - 0x80], rax
lea r12, [rbp + 0xba0]
lea r13, [rbp + 0x13a0]
cmp cx, 0x71
je 0x140006f4d
mov r8d, 0x400
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x78]
call fcn.140005380
test al, al
je 0x14000718d
mov rbx, qword [rsp + 0x78]
mov eax, 0x20
lea r14d, [rax - 0x17]
movzx edi, word [rbx]
cmp di, ax
je 0x140006f37
cmp di, r14w
jne 0x140006f42
add rbx, 2
mov qword [rsp + 0x78], rbx
jmp 0x140006f29
movzx ecx, word [r15]
mov r14d, dword [rbp - 0x68]
movzx edx, cx
lea eax, [rdx - 0x61]
cmp ax, 0x19
ja 0x140006f9b
lea rax, str.RUVEH_IJDqXFAtPYZlgmnc
sub r15, rax
sar r15, 1
movabs r10, 0xfec0a6591e564070
lea rax, [0x14000c010]
mov rdx, r13
mov rax, qword [rax + r15*8]
mov rcx, r12
call qword [0x14000c668]
xor r13d, r13d
test eax, eax
jne 0x140006d39
mov rsi, qword [0x140011b50]
jmp 0x1400070e6
test rsi, rsi
je 0x140007046
mov eax, 0x41
cmp dx, 0x50
jne 0x140007019
cmp word [rsi], ax
jne 0x140007019
mov ecx, eax
lea rdx, [rbp + 0x1ba0]
call fcn.1400095b4
xor r13d, r13d
test eax, eax
jne 0x140006d39
lea edx, [rax + 0x1e]
mov qword [0x140011b50], r15
lea rax, [rbp + 0xb00]
mov rsi, r15
sub r12, rax
lea rcx, [rbp + 0xb00]
lea r10d, [r13 + 1]
movzx eax, word [rcx + r12]
test ax, ax
je 0x140007005
mov word [rcx], ax
add rcx, 2
sub rdx, r10
jne 0x140006fef
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r13w
jmp 0x1400070e6
cmp word [rsi], 0x50
jne 0x140006d39
cmp dx, ax
jne 0x140006d39
mov ecx, eax
mov rdx, r13
call fcn.1400095b4
xor r13d, r13d
test eax, eax
jne 0x140006d39
jmp 0x1400070e6
mov qword [0x140011b50], r15
mov rsi, r15
mov r10d, 1
cmp dx, 0x50
je 0x14000709d
lea rax, [rbp + 0x1ba0]
mov r8d, 0x400
sub r13, rax
lea rdx, [rbp + 0x1ba0]
movzx eax, word [rdx + r13]
test ax, ax
je 0x140007089
mov word [rdx], ax
add rdx, 2
sub r8, r10
jne 0x140007073
xor r13d, r13d
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], r13w
jmp 0x1400070a0
xor r13d, r13d
lea rax, [rbp + 0xb00]
mov r8d, 0x1e
sub r12, rax
lea rdx, [rbp + 0xb00]
movzx eax, word [r12 + rdx]
test ax, ax
je 0x1400070cd
mov word [rdx], ax
add rdx, 2
sub r8, r10
jne 0x1400070b7
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r13w
cmp cx, 0x45
je 0x1400071e4
mov word [rbp + 0xba0], r13w
mov r12d, 0x104
mov word [rbp + 0x13a0], r13w
mov r15d, 0x20
test di, di
je 0x1400071e4
lea r8, str.RUVEH_IJDqXFAtPYZlgmnc
mov r9d, 0x52
jmp 0x140006bc6
xor edx, edx
xor ecx, ecx
call fcn.140009850
mov r14d, 0x667
cmp dword [rbp + 0x798], r12d
jle 0x140007365
mov rcx, qword [rbp + 0x790]
test rcx, rcx
je 0x140007365
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x140006d48
xor edx, edx
xor ecx, ecx
call fcn.140009850
cmp dword [rbp + 0x18], r12d
jle 0x140007179
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], edi
mov dword [rbp + 0x18], r12d
jmp 0x1400071c0
mov r14d, 0xe
jmp 0x140006d48
xor edx, edx
xor ecx, ecx
call fcn.140009850
cmp dword [rbp + 0x18], 0x104
jle 0x1400071af
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov r10d, 1
mov dword [rbp + 0x18], 0x104
cmp dword [rbp], r10d
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
jle 0x1400071da
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0x667
jmp 0x140008854
mov r15d, 9
test rsi, rsi
je 0x14000736b
movzx eax, word [rsi]
mov ebx, 1
cmp ax, 0x45
je 0x140007216
sub ax, 0x59
cmp ax, bx
jbe 0x140007216
call fcn.140004ae0
mov rsi, qword [0x140011b50]
mov rax, rsi
lea rcx, str.RUVEH_IJDqXFAtPYZlgmnc
sub rax, rcx
lea rdx, [rbp + 0x1ba0]
sar rax, 1
cmp word [rsi], 0x50
cmove rdx, qword [rbp - 8]
movabs r10, 0xfec0a6591e564070
lea r8, [0x14000c010]
mov rax, qword [r8 + rax*8]
lea rcx, [rbp + 0xb00]
call qword [0x14000c668]
mov rcx, qword [0x140011b50]
mov r14d, eax
movzx eax, word [rcx]
lea ecx, [rax - 0x59]
cmp cx, bx
jbe 0x140007320
test r14d, r14d
jne 0x140007299
cmp ax, 0x45
jne 0x14000728b
mov dword [0x140011c14], ebx
mov dword [rbp - 0x74], r13d
jmp 0x1400073b6
mov eax, dword [0x140011c14]
mov dword [rbp - 0x74], ebx
jmp 0x1400073b2
cmp r14d, 0x8000
jne 0x1400072b1
mov dword [0x140011c14], r13d
mov r14d, r13d
jmp 0x140006d4d
mov eax, 0x4eb
cmp r14d, eax
jg 0x1400072e6
je 0x140007397
cmp r14d, 0xfffffffe
jl 0x140007316
test r14d, r14d
js 0x140007397
lea eax, [r14 - 2]
cmp eax, ebx
jbe 0x1400072de
cmp r14d, 0x7b
jne 0x140007316
mov r14d, 0x653
jmp 0x140007316
cmp r14d, 0x642
jl 0x140007316
cmp r14d, 0x644
jle 0x140007397
cmp r14d, 0x669
je 0x140007397
cmp r14d, 0xbc2
je 0x140006d4d
mov ecx, r14d
call fcn.140002dcc
jmp 0x140007397
cmp dword [rbp + 0x18], 0x104
jle 0x140007339
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], ebx
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], 0x104
jle 0x14000735d
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, r14d
jmp 0x140008854
mov r15d, 9
call fcn.140004ae0
test r14d, r14d
jne 0x140007392
cmp qword [0x140011b50], r13
jne 0x140007392
xor edx, edx
xor ecx, ecx
call fcn.140009850
mov r14d, 0x667
jmp 0x140006d4d
mov ebx, 1
mov dword [rbp - 0x74], r13d
test r14d, r14d
jne 0x140006d4d
mov eax, dword [0x140011c14]
test eax, eax
je 0x140006d4d
test eax, eax
je 0x1400073d3
movabs r10, 0xe0948e0d50584070
mov rax, qword [0x140010030]
xor edx, edx
xor ecx, ecx
call qword [0x14000c668]
jmp 0x1400073ed
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
nop dword [rax + rax]
lea rcx, str.OLEAUT32.dll
call fcn.14000aca0
cmp dword [rbp - 0x74], r13d
je 0x140007436
cmp dword [0x140011c14], r13d
jne 0x140007443
lea rax, [0x14001175c]
mov r9d, ebx
mov r8d, 4
mov qword [rsp + 0x20], rax
lea rdx, [0x1400100a8]
lea rcx, [0x14000dc68]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
nop dword [rax + rax]
mov ecx, dword [rbp - 0x54]
test eax, eax
cmovne ecx, ebx
mov dword [rbp - 0x54], ecx
cmp dword [0x140011c14], r13d
je 0x1400087ba
mov rax, qword gs:[0x60]
mov edx, 0x20
mov r10, qword [rsp + 0x78]
xorps xmm0, xmm0
mov r8d, r13d
mov rcx, qword [rax + 0x20]
lea r11d, [rdx + 0x21]
bts dword [rcx + 8], 0x13
movups xmmword [rbp + 0x9d0], xmm0
movzx ecx, word [r10]
lea eax, [rcx - 0x30]
cmp ax, r15w
ja 0x140007492
mov edx, r8d
lea r9d, [rcx - 0x30]
mov eax, ecx
shl eax, 4
and dl, bl
mov edx, 0x20
jmp 0x1400074ae
movzx eax, cx
sub ax, r11w
cmp ax, 5
ja 0x140007512
lea r9d, [rcx - 0x37]
mov ecx, r8d
mov eax, r9d
shl eax, 4
and cl, bl
cmove r9d, eax
cmp r8d, edx
jge 0x1400074d8
mov eax, r8d
test r8d, r8d
jns 0x1400074c3
lea eax, [rbx + r8]
sar eax, 1
add r8d, ebx
cdqe
or byte [rbp + rax + 0x9d0], r9b
add r10, 2
jmp 0x140007470
lea rcx, str.ServerMain__CA_:_Wrong_command_line
mov edx, 0x57
call fcn.140005a3c
cmp dword [rbp + 0x18], 0x104
jle 0x140007502
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], ebx
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
jmp 0x140008778
cmp r8d, edx
je 0x140007520
lea rcx, str.ServerMain__CA_:_Parsing_command_line_failed
jmp 0x1400074df
mov byte [rsp + 0x61], r13b
mov sil, r13b
mov byte [rsp + 0x60], r13b
mov dil, r13b
mov byte [rsp + 0x70], r13b
mov r15b, r13b
mov r12b, r13b
test cx, cx
je 0x140007548
add r10, 2
movzx ecx, word [r10]
cmp cx, 0x43
jne 0x140007557
mov byte [rsp + 0x61], bl
jmp 0x140007630
cmp cx, 0x55
jne 0x140007569
mov byte [rsp + 0x61], bl
mov r15b, bl
jmp 0x140007630
cmp cx, r11w
jne 0x14000757b
mov r12b, bl
mov byte [rsp + 0x70], bl
jmp 0x140007630
cmp cx, 0x4d
je 0x140007597
mov eax, 0x52
cmp cx, ax
je 0x14000759a
cmp cx, 0x45
jne 0x140007630
jmp 0x14000759e
mov sil, bl
mov byte [rsp + 0x60], bl
lea r8, [r10 + 4]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
nop dword [rax + rax]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000879b
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test edi, edi
je 0x14000762b
mov edx, edi
lea rcx, str.ServerMain__CA_:_Wait_on_synchronization_event_failed
call fcn.140005a3c
cmp dword [rbp + 0x18], 0x104
jle 0x140007614
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov r10d, 1
cmp dword [rbp], r10d
mov qword [rbp + 0x10], rax
jmp 0x140008778
mov dil, byte [rsp + 0x60]
or qword [rbp - 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop dword [rax + rax]
mov ebx, 1
lea r9, [rbp - 0x70]
mov rcx, rax
mov r8d, ebx
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x140007689
or qword [rbp - 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x3f0
je 0x140007689
mov edx, eax
lea rcx, str.ServerMain__CA_:_Access_to_token_failed
jmp 0x1400074e4
test sil, sil
jne 0x14000769a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop dword [rax + rax]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
nop dword [rax + rax]
test sil, sil
je 0x1400076d8
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop dword [rax + rax]
cmp byte [0x1400120da], r13b
mov esi, r13d
setne sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
lea r8, [rbp - 0x40]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
je 0x1400077bf
lea rcx, [rsp + 0x68]
call fcn.14000372c
test eax, eax
jne 0x1400077a8
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x9b8]
mov r9d, 0x58
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xb40]
lea ebx, [r9 - 0x57]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
nop dword [rax + rax]
test eax, eax
je 0x1400077a8
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbp + 0xb40]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x14000779a
cmp byte [0x1400120da], r13b
je 0x14000778b
movzx eax, dil
xor eax, ebx
lea esi, [rax*2 + 3]
jmp 0x1400077a8
mov al, dil
neg al
sbb esi, esi
and esi, 0xfffffffe
add esi, 4
jmp 0x1400077a8
cmp byte [0x1400120da], r13b
mov esi, r13d
setne sil
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov ebx, 0x104
jmp 0x1400077fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x790]
mov r8d, 0x208
mov ebx, eax
call sub.msvcrt.dll_memset
mov r9d, ebx
lea r8, str.OpenProcessToken_failed_with__d
mov ebx, 0x104
lea rcx, [rbp + 0x790]
mov edx, ebx
call fcn.140009eec
test r15b, r15b
mov r15d, 1
je 0x14000781f
cmp esi, r15d
jne 0x140007816
lea ecx, [r15 + 8]
mov esi, ecx
jmp 0x140007824
test esi, esi
jne 0x14000783c
mov esi, 8
mov ecx, 9
test r12b, r12b
je 0x14000788b
test esi, esi
jne 0x140007876
mov esi, 6
mov edi, 0x100
mov dword [rbp - 0x78], edi
jmp 0x1400078b7
lea rcx, str.ServerMain__CA_:_Error:_icacContext_in_CA_server_should_be_EEUI_but_is_not_any_impersonated_type
mov edx, 0x57
call fcn.140005a3c
cmp dword [rbp + 0x18], ebx
jle 0x140007862
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], r15d
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], ebx
jmp 0x14000877f
cmp esi, r15d
jne 0x140007882
mov esi, 7
jmp 0x140007832
lea rcx, str.ServerMain__CA_:_Error:_icacContext_in_CA_server_should_be_AISImpersonated_but_is_not_any_impersonated_type
jmp 0x140007843
mov edi, 0x100
mov eax, esi
mov dword [rbp - 0x78], edi
test esi, esi
je 0x1400078b7
cmp eax, r15d
je 0x1400078b7
cmp eax, 6
je 0x1400078b7
cmp eax, 7
je 0x1400078b7
cmp eax, 8
je 0x1400078b7
mov r8d, 3
cmp eax, ecx
jne 0x1400078bd
mov r8d, 2
xor r9d, r9d
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xa00]
call fcn.140003d68
mov ebx, eax
test eax, eax
je 0x1400078ff
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x1400078ec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, ebx
lea rcx, str.ServerMain__CA_:_Error:_Access_to_SD
call fcn.140005a3c
jmp 0x140006aa5
movsxd rbx, dword [rbp - 0x78]
mov dword [rbp + 0x9b0], ebx
mov dword [rbp - 0x58], ebx
mov dword [rbp - 0x48], ebx
mov dword [rbp - 0x4c], ebx
mov dword [rbp - 0x50], ebx
mov dword [rbp + 0x348], ebx
cmp ebx, edi
jle 0x140007948
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov ebx, dword [rbp - 0x58]
mov qword [rbp + 0x340], rax
test rax, rax
jne 0x140007967
mov dword [rbp + 0x348], r13d
jmp 0x140007967
mov r8, rdi
lea rcx, [rbp + 0x350]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x350]
mov qword [rbp + 0x340], rax
mov dword [rbp + 0x568], ebx
cmp ebx, edi
jle 0x140007997
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x560], rax
test rax, rax
jne 0x1400079b6
mov dword [rbp + 0x568], r13d
jmp 0x1400079b6
mov r8, rdi
lea rcx, [rbp + 0x570]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x570]
mov qword [rbp + 0x560], rax
movsxd rax, dword [rbp - 0x48]
mov dword [rbp + 0x458], eax
cmp eax, edi
jle 0x1400079ea
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x450], rax
test rax, rax
jne 0x140007a09
mov dword [rbp + 0x458], r13d
jmp 0x140007a09
mov r8, rdi
lea rcx, [rbp + 0x460]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x460]
mov qword [rbp + 0x450], rax
movsxd rax, dword [rbp - 0x4c]
mov dword [rbp + 0x238], eax
cmp eax, edi
jle 0x140007a40
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov qword [rbp + 0x230], rax
mov rbx, rax
test rax, rax
jne 0x140007a5f
mov dword [rbp + 0x238], r13d
jmp 0x140007a5f
mov r8, rdi
lea rcx, [rbp + 0x240]
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rbp + 0x240]
mov qword [rbp + 0x230], rbx
movsxd rax, dword [rbp - 0x50]
mov dword [rbp + 0x678], eax
cmp eax, edi
jle 0x140007a9a
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov rbx, qword [rbp + 0x230]
mov qword [rbp + 0x670], rax
test rax, rax
jne 0x140007ab9
mov dword [rbp + 0x678], r13d
jmp 0x140007ab9
mov r8, rdi
lea rcx, [rbp + 0x680]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x680]
mov qword [rbp + 0x670], rax
mov r9, qword [rbp + 0x560]
lea rcx, [rbp - 0x50]
mov rdx, qword [rbp + 0x340]
lea r8, [rbp + 0x9b0]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0xa00]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x450]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
nop dword [rax + rax]
test eax, eax
jne 0x140007c02
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x70]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x140007b47
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, ebx
lea rcx, str.ServerMain__CA_:_Error:_Format_SD
call fcn.140005a3c
cmp dword [rbp + 0x678], edi
jle 0x140007b75
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x140007b75
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x140007b95
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x140007b95
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x140007bb5
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x140007bb5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x140007bd5
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x140007bd5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x140006aa5
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x140006aa5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x140006aa5
movabs r10, 0xb25c1fa67cd7f270
mov rcx, qword [rbp + 0x340]
xor r9d, r9d
mov rax, qword [0x140010038]
xor r8d, r8d
mov qword [rsp + 0x40], r13
or edx, 0xffffffff
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [0x14000c668]
mov ebx, eax
test eax, eax
je 0x140007d40
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x140007c68
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, ebx
lea rcx, str.ServerMain__CA_:_CoInitializeSecurity_failed
call fcn.140005a3c
cmp dword [rbp + 0x678], edi
jle 0x140007c96
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x140007c96
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x140007cb6
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x140007cb6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x140007cd6
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x140007cd6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x140007cf6
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x140007cf6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x140007d16
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x140007d16
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x18], 0x104
jle 0x140007d2f
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp], r15d
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
jmp 0x140008778
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov r12, rax
test rax, rax
jne 0x140007d8f
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x140007d75
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Error:_Watch_for_the_shutdown_signal
jmp 0x140007c71
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
xor r15d, r15d
mov r13, rax
test rax, rax
jne 0x140007e91
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x140007dca
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Error:_Watch_for_change_of_owning_process_signal
call fcn.140005a3c
cmp dword [rbp + 0x678], edi
jle 0x140007e04
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x140007e04
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x140007e24
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x140007e24
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x140007e44
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x140007e44
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x140007e64
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x140007e64
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x1400075fb
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x1400075fb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x1400075fb
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x68], r15
mov qword [rbp - 0x60], r15
call fcn.140002b30
mov rbx, rax
test rax, rax
jne 0x140007f1c
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x140007ec1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, 0x641
lea rcx, str.ServerMain__CA_:_Connection_to_Service_failed.
call fcn.140005a3c
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140007ef2
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140007de4
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
jmp 0x140007de4
mov dword [rbp - 0x64], r15d
mov dword [rbp - 0x44], r15d
call fcn.1400028bc
mov r15, rax
test rax, rax
jne 0x140007f77
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x140007f47
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
lea rcx, str.ServerMain__CA_:_Create_Custom_Action_Server_failed.
mov edx, 0x641
call fcn.140005a3c
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, rbx
call qword [0x14000c668]
jmp 0x140007ed2
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rbp + 0x9c0], rax
test rcx, rcx
je 0x140007fac
mov rdx, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rdx + 0x10]
call qword [0x14000c668]
mov rax, qword [rbp + 0x9c0]
movabs r10, 0xdee01e7974d59970
lea r8, [rsp + 0x68]
mov rcx, r15
lea rdx, [0x14000dca0]
call qword [0x14000c668]
mov rax, qword [r15]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, r15
call qword [0x14000c668]
mov rcx, qword [rbp - 0x60]
mov dword [rbp - 0x68], esi
mov rax, qword [rbx]
mov r15, qword [rax + 0x70]
test rcx, rcx
je 0x14000800f
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
movabs r10, 0xf9218e5958547970
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x44]
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x9d0]
lea rax, [rbp - 0x60]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea rdx, [rbp - 0x68]
lea rax, [rbp - 0x64]
mov qword [rsp + 0x28], rax
mov rax, r15
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [0x14000c668]
test eax, eax
je 0x140008081
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x140008075
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
lea rcx, str.ServerMain__CA_:_Process_not_registered_with_service.
jmp 0x140007f4e
mov r8d, dword [rbp - 0x64]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x1400080d0
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x1400080b6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Could_not_open_synchronization_handle.
jmp 0x140007f53
movabs r10, 0x89713e9c58dc2070
mov rcx, qword [rbp - 0x60]
mov rax, qword [0x140010048]
call qword [0x14000c668]
test eax, eax
jne 0x140008159
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x140008105
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov edx, 0x641
lea rcx, str.ServerMain__CA_:_Connect_to_remote_object_failed.
call fcn.140005a3c
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, rbx
call qword [0x14000c668]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140007ef2
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
jmp 0x140007ef2
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
mov rax, qword [rax]
lea r8, [rbp - 0x80]
lea rdx, [0x14000dd30]
call qword [0x14000c668]
xor edx, edx
cmp esi, dword [rbp - 0x68]
jne 0x140008192
lea eax, [rsi - 8]
lea r10d, [rdx + 1]
cmp eax, r10d
ja 0x140008196
lea rdx, [rbp - 0x68]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xa5e517ed34589370
mov rax, qword [rax + 0x140]
lea r8, [rbp + 0x9d0]
call qword [0x14000c668]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xc088865f3adc0a70
mov rax, qword [rax + 0x150]
mov rdx, r12
call qword [0x14000c668]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xb195a7073ed57170
mov rax, qword [rax + 0x158]
mov rdx, r13
call qword [0x14000c668]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xd190276570d97270
mov rdx, qword [rbp - 0x70]
mov r9b, byte [rsp + 0x70]
mov r8b, byte [rsp + 0x61]
mov rax, qword [rax + 0x148]
mov qword [rsp + 0x30], rdx
mov edx, dword [rbp - 0x44]
mov dword [rsp + 0x28], edx
mov dl, byte [rsp + 0x60]
mov byte [rsp + 0x20], dl
mov edx, dword [rbp - 0x64]
call qword [0x14000c668]
mov rcx, qword [rbp - 0x70]
mov esi, eax
cmp rcx, 0xffffffffffffffff
je 0x14000825d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or qword [rbp - 0x70], 0xffffffffffffffff
test esi, esi
je 0x140008397
mov edx, 0x641
lea rcx, str.ServerMain__CA_:_Impersonation_token_not_saved.
call fcn.140005a3c
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, rbx
call qword [0x14000c668]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400082b0
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400082d1
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
cmp dword [rbp + 0x678], edi
jle 0x1400082f1
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x1400082f1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x140008311
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x140008311
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x140008331
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x140008331
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x140008351
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x140008351
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x140008371
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x140008371
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x18], 0x104
jle 0x14000838a
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
jmp 0x140008770
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xab612fba3ad29870
mov rdx, qword [rbp - 0x60]
mov rax, qword [rax + 0x138]
call qword [0x14000c668]
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
mov rcx, rbx
call qword [0x14000c668]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400083f3
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140008414
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
xor r8d, r8d
mov qword [rbp + 0x9e0], r15
mov esi, 0x1cff
mov qword [rbp + 0x9e8], r12
or r9d, 0xffffffff
mov qword [rbp + 0x9f0], r13
lea rdx, [rbp + 0x9e0]
mov dword [rsp + 0x20], esi
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop dword [rax + rax]
xor r13d, r13d
test eax, eax
je 0x140008640
lea ebx, [r13 + 1]
cmp eax, ebx
je 0x140008631
cmp eax, 2
jne 0x1400084d0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x80]
mov dword [rsp + 0x78], r13d
mov rax, qword [rcx]
movabs r10, 0xed5c3ea87c5b3870
mov rax, qword [rax + 0x160]
lea rdx, [rsp + 0x78]
call qword [0x14000c668]
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x140008554
mov qword [rbp + 0x9e0], rax
jmp 0x140008525
cmp eax, 3
jne 0x140008640
jmp 0x140008505
cmp dword [rbp - 0x30], 0x12
je 0x140008640
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
nop dword [rax + rax]
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp - 0x38]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084db
xor r8d, r8d
mov dword [rsp + 0x20], esi
or r9d, 0xffffffff
lea rdx, [rbp + 0x9e0]
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
nop dword [rax + rax]
test eax, eax
je 0x140008640
jmp 0x14000845f
mov rcx, qword [rbp - 0x70]
cmp rcx, 0xffffffffffffffff
je 0x14000856a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Could_not_open_synchronization_handle.
call fcn.140005a3c
cmp dword [rbp + 0x678], edi
jle 0x1400085a4
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x1400085a4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x1400085c4
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x1400085c4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x1400085e4
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x1400085e4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x140008604
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x140008604
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x1400074e9
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x1400074e9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
jmp 0x1400074e9
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x14000c668]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp dword [rbp + 0x678], edi
jle 0x14000868a
mov rcx, qword [rbp + 0x670]
test rcx, rcx
je 0x14000868a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x238], edi
jle 0x1400086aa
mov rcx, qword [rbp + 0x230]
test rcx, rcx
je 0x1400086aa
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x458], edi
jle 0x1400086ca
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x1400086ca
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x568], edi
jle 0x1400086ea
mov rcx, qword [rbp + 0x560]
test rcx, rcx
je 0x1400086ea
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp + 0x348], edi
jle 0x14000870a
mov rcx, qword [rbp + 0x340]
test rcx, rcx
je 0x14000870a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
cmp dword [rbp - 0x74], r13d
je 0x14000872f
cmp dword [0x140011c14], r13d
jne 0x14000872f
mov ecx, dword [0x14001175c]
test ecx, ecx
je 0x14000872f
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
nop dword [rax + rax]
call qword [sym.imp.ole32.dll_CoUninitialize]
nop dword [rax + rax]
cmp dword [rbp - 0x54], r13d
je 0x140006d4d
mov ecx, 0x641
call fcn.140002dcc
cmp dword [rbp + 0x18], 0x104
jle 0x140008768
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x10], rcx
mov eax, 1
cmp dword [rbp], eax
mov dword [rbp + 0x18], 0x104
jle 0x140008791
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0x641
jmp 0x140008854
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Open_synchronization_event_failed
call fcn.140005a3c
jmp 0x140008371
xor r9d, r9d
lea rcx, [rbp - 0x38]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
nop dword [rax + rax]
test eax, eax
jne 0x1400087f0
cmp dword [0x140011eb0], r13d
je 0x14000870a
cmp dword [0x140011c10], r13d
je 0x14000870a
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
nop dword [rax + rax]
lea rcx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [rax + rax]
jmp 0x1400087ba
cmp dword [rbp + 0x18], 0x104
jle 0x14000882a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov dword [rbp + 0x18], 0x104
lea rax, [rbp + 0x20]
mov qword [rbp + 0x10], rax
cmp dword [rbp], r15d
jle 0x14000884f
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0x65b
mov rcx, qword [rbp + 0x23a0]
xor rcx, rsp
call fcn.1400014c0
lea r11, [rsp + 0x24b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret