Function at 0x140237670
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3d0
mov qword [rsp + 0x130], 0xfffffffffffffffe
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov r12, r8
mov qword [rsp + 0x58], r8
mov r13, rdx
mov qword [rsp + 0xa0], rdx
mov r14, rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xb0], rdx
call fcn.140048a14
mov r10, qword [rax + 8]
xor edi, edi
cmp dword [r10], 4
jbe 0x140237808
lea rax, str.started_execution
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x2e8], 0x24
lea rax, [r14 + 8]
cmp qword [rax + 0x18], 8
jb 0x14023770a
mov rax, qword [rax]
lea r14, [0x1402cb810]
mov rdx, r14
mov rcx, rdi
or rsi, 0xffffffffffffffff
test rax, rax
je 0x14023772f
mov rdx, rax
mov rcx, rsi
inc rcx
cmp word [rax + rcx*2], di
jne 0x140237726
mov qword [rsp + 0x2f0], rdx
lea eax, [rcx*2 + 2]
mov dword [rsp + 0x2f8], eax
mov dword [rsp + 0x2fc], edi
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x14023775a
mov rcx, qword [r13]
mov rdx, r14
mov rax, rdi
test rcx, rcx
je 0x140237774
mov rdx, rcx
mov rax, rsi
inc rax
cmp word [rcx + rax*2], di
jne 0x14023776b
mov qword [rsp + 0x300], rdx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x308], eax
mov dword [rsp + 0x30c], edi
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x1402377a0
mov rcx, qword [r12]
mov rdx, r14
mov rax, rdi
test rcx, rcx
je 0x1402377ba
mov rdx, rcx
mov rax, rsi
inc rax
cmp word [rcx + rax*2], di
jne 0x1402377b1
mov qword [rsp + 0x310], rdx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x318], eax
mov dword [rsp + 0x31c], edi
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140352493]
mov rcx, r10
call fcn.140001078
mov r14, qword [rsp + 0x78]
jmp 0x14023780c
or rsi, 0xffffffffffffffff
call fcn.14004e8c8
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.1401b5100
nop
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x14023789b
mov rcx, qword [rsp + 0x408]
mov r14d, 0x80004003
mov r9d, r14d
lea r8, str.amcorewcd_sourcecommands_adapters_src_restrictexecutionadapter.cpp
lea edx, [rbx + 0x28]
call fcn.140042ee8
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140237893
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x140237893
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov ecx, esi
lock xadd dword [rbx + 0xc], ecx
add ecx, esi
jne 0x140237893
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdx]
mov rax, qword [rcx + 8]
mov rcx, rdx
call qword [str.__v__]
mov eax, r14d
jmp 0x1402386cf
lea r15, [r14 + 8]
mov r8, r13
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.1401b5524
nop
mov rdx, qword [rsp + 0x60]
mov byte [rdx + 0x58], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd0], xmm0
mov r14, qword [rsp + 0x68]
mov r8, r14
lea rcx, [rsp + 0xd0]
call fcn.14004cf88
mov rax, qword [rbx]
lea rdx, [rsp + 0xd0]
mov rcx, rbx
mov rax, qword [rax + 0x30]
call qword [str.__v__]
nop
mov dword [rsp + 0xc0], edi
lea rbx, [0x1403f1100]
mov r8, rbx
lea rdx, [0x14005d200]
lea rcx, [0x1403f10f8]
call qword [sym.imp.msvcp_win.dll_int___cdecl_std::_Execute_once_struct_std::once_flag____ptr64__int____cdecl___void____ptr64__void____ptr64__void____ptr64____ptr64___void____ptr64_]
test eax, eax
jne 0x140237923
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_terminate]
int3
mov qword [rsp + 0xc8], rbx
lea r8, [rsp + 0xc0]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.140164fa4
nop
cmp dword [rsp + 0xc0], edi
jle 0x140237a68
mov dword [rsp + 0x30], 0x80070057
lea rdx, str.Parsing_the_JSON_configuration_parameters_string_has_failed_since_the_JSON_string_is_not_valid
lea rcx, [rsp + 0x1b8]
call fcn.140048750
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xa0]
call fcn.140048130
lea rcx, [rsp + 0x1b8]
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x20], 0xfc
mov r9d, dword [rsp + 0x30]
mov r8, r13
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1402386f4
nop
lea rcx, [rsp + 0x1b8]
call fcn.1400492c0
mov r15d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1402379d7
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.__v__]
nop
test r14, r14
je 0x140237a1a
mov eax, esi
lock xadd dword [r14 + 8], eax
add eax, esi
jne 0x140237a1a
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140237a1a
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__v__]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140237a60
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x140237a60
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov ecx, esi
lock xadd dword [rbx + 0xc], ecx
add ecx, esi
jne 0x140237a60
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [str.__v__]
mov eax, r15d
jmp 0x1402386cf
lea rdx, [0x140407c28]
lea rcx, [rsp + 0x50]
call fcn.1401605cc
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
call qword [str.__v__]
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.14005517c
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x88]
call fcn.14026ed88
nop
lea rdx, [0x140407c68]
lea rcx, [rsp + 0x138]
call fcn.14005517c
nop
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [0x140407c48]
mov rax, qword [rax + 8]
call qword [str.__v__]
test al, al
je 0x140237b19
lea rdx, [0x140407c48]
lea rcx, [rsp + 0x50]
call fcn.1401605cc
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
call qword [str.__v__]
mov rdx, rax
lea rcx, [rsp + 0x138]
call fcn.14005b588
movdqa xmm0, xmmword [0x140307960]
movdqu xmmword [rsp + 0x168], xmm0
mov word [rsp + 0x158], di
lea r12, [0x14040d0d0]
mov rax, r12
cmp qword [0x14040d0e8], 8
cmovae rax, qword [0x14040d0d0]
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x140237b59
mov rdx, qword [r15]
mov rcx, qword [r15 + 0x10]
cmp rcx, qword [0x14040d0e0]
jne 0x140237ba7
test rcx, rcx
je 0x140237b92
sub rdx, rax
movzx r8d, word [rax + rdx]
movzx r9d, word [rax]
cmp r8w, r9w
jne 0x140237b89
add rax, 2
sub rcx, 1
jne 0x140237b6e
jmp 0x140237b92
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x140237b94
mov eax, edi
test eax, eax
jne 0x140237ba7
lea rcx, [rsp + 0x158]
call fcn.140274d60
jmp 0x140237bb4
lea rcx, [rsp + 0x158]
call fcn.140274af0
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x140237d61
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
lea rdx, str.Failed_to_get_policy_path
lea rcx, [rsp + 0x1d8]
call fcn.140048750
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xe0]
call fcn.140048130
lea rcx, [rsp + 0x1d8]
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x20], 0xfe
mov r9d, dword [rsp + 0x30]
mov r8, r13
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1402386f4
nop
lea rcx, [rsp + 0x1d8]
call fcn.1400492c0
mov r15d, dword [rsp + 0x30]
lea rcx, [rsp + 0x158]
call fcn.1400492c0
nop
lea rcx, [rsp + 0x138]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140237ca2
mov rax, qword [rsp + 0x98]
sub rax, rcx
cmp rax, 0x1000
jb 0x140237c9c
test cl, 0x1f
jne 0x140237c95
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140237c95
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x140237c95
mov rcx, rax
jmp 0x140237c9c
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027abd8
nop
lea rcx, [rsp + 0x178]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140237cd0
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.__v__]
nop
test r14, r14
je 0x140237d13
mov eax, esi
lock xadd dword [r14 + 8], eax
add eax, esi
jne 0x140237d13
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140237d13
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__v__]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140237d59
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x140237d59
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov ecx, esi
lock xadd dword [rbx + 0xc], ecx
add ecx, esi
jne 0x140237d59
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [str.__v__]
mov eax, r15d
jmp 0x1402386cf
mov dl, 1
lea rcx, [rsp + 0x158]
call fcn.14023c970
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x140237f05
lea rdx, str.Failed_to_create_policy_path
lea rcx, [rsp + 0x1f8]
call fcn.140048750
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xf0]
call fcn.140048130
lea rcx, [rsp + 0x1f8]
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x20], 0xfe
mov r9d, dword [rsp + 0x30]
mov r8, r13
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1402386f4
nop
lea rcx, [rsp + 0x1f8]
call fcn.1400492c0
mov r15d, dword [rsp + 0x30]
lea rcx, [rsp + 0x158]
call fcn.1400492c0
nop
lea rcx, [rsp + 0x138]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140237e46
mov rax, qword [rsp + 0x98]
sub rax, rcx
cmp rax, 0x1000
jb 0x140237e40
test cl, 0x1f
jne 0x140237e39
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140237e39
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x140237e39
mov rcx, rax
jmp 0x140237e40
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027abd8
nop
lea rcx, [rsp + 0x178]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140237e74
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.__v__]
nop
test r14, r14
je 0x140237eb7
mov eax, esi
lock xadd dword [r14 + 8], eax
add eax, esi
jne 0x140237eb7
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140237eb7
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__v__]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140237efd
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x140237efd
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov ecx, esi
lock xadd dword [rbx + 0xc], ecx
add ecx, esi
jne 0x140237efd
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [str.__v__]
mov eax, r15d
jmp 0x1402386cf
mov qword [rsp + 0x70], rdi
lea r8, [0x1402cc570]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x298]
call fcn.1400547b0
nop
lea rdx, [rsp + 0x138]
cmp qword [rsp + 0x150], 8
cmovae rdx, qword [rsp + 0x138]
mov r8, qword [rsp + 0x148]
mov rcx, rax
call fcn.140054efc
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1a8], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x198], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x1a8], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x198]
call fcn.14023d2c0
nop
lea rcx, [rsp + 0x198]
call fcn.1400492c0
nop
lea rcx, [rsp + 0x298]
call fcn.1400492c0
mov rcx, qword [rsp + 0x70]
cmp rcx, rsi
jne 0x140238176
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
lea rdx, str.Failed_to_create_policy_file
lea rcx, [rsp + 0x218]
call fcn.140048750
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x100]
call fcn.140048130
lea rcx, [rsp + 0x218]
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x20], 0xfe
mov r9d, dword [rsp + 0x30]
mov r8, r13
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1402386f4
nop
lea rcx, [rsp + 0x218]
call fcn.1400492c0
mov r15d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14023804e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rcx, [rsp + 0x158]
call fcn.1400492c0
nop
lea rcx, [rsp + 0x138]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x1402380b7
mov rax, qword [rsp + 0x98]
sub rax, rcx
cmp rax, 0x1000
jb 0x1402380b1
test cl, 0x1f
jne 0x1402380aa
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1402380aa
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x1402380aa
mov rcx, rax
jmp 0x1402380b1
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027abd8
nop
lea rcx, [rsp + 0x178]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1402380e5
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.__v__]
nop
test r14, r14
je 0x140238128
mov eax, esi
lock xadd dword [r14 + 8], eax
add eax, esi
jne 0x140238128
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140238128
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__v__]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14023816e
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x14023816e
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov ecx, esi
lock xadd dword [rbx + 0xc], ecx
add ecx, esi
jne 0x14023816e
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [str.__v__]
mov eax, r15d
jmp 0x1402386cf
mov dword [rsp + 0x48], edi
mov r13, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
sub r13, rbx
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
mov r8d, r13d
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x140238502
cmp dword [rsp + 0x48], r13d
jne 0x140238502
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1402381cb
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
cmp qword [0x14040d0e8], 8
cmovae r12, qword [0x14040d0d0]
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x1402381e8
mov rcx, qword [r15]
mov rax, qword [r15 + 0x10]
cmp rax, qword [0x14040d0e0]
jne 0x1402382d0
test rax, rax
je 0x140238226
sub rcx, r12
movzx edx, word [rcx + r12]
movzx r8d, word [r12]
cmp dx, r8w
jne 0x14023821d
add r12, 2
sub rax, 1
jne 0x140238201
jmp 0x140238226
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x140238228
mov eax, edi
test eax, eax
jne 0x1402382d0
lea rcx, [rsp + 0x138]
call fcn.140274480
mov dword [rsp + 0x30], eax
test eax, eax
js 0x1402382e1
mov ecx, 0x66
call fcn.140274fd0
mov dword [rsp + 0x30], eax
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 4
jbe 0x1402382c0
lea rax, str.SendToastNotification_returned
mov qword [rsp + 0x3a0], rax
mov qword [rsp + 0x3a8], reloc.Cabinet.dll_SetCompressorInformation
lea rax, [rsp + 0x30]
mov qword [rsp + 0x3b0], rax
mov qword [rsp + 0x3b8], 4
lea rax, [rsp + 0x380]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140352468]
call fcn.140001078
cmp dword [rsp + 0x30], edi
jge 0x1402382e1
mov dword [rsp + 0x30], 0x802a0001
jmp 0x1402382e1
lea rcx, [rsp + 0x138]
call fcn.140274594
mov dword [rsp + 0x30], eax
call fcn.140048a14
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x140238416
lea rax, str.finished_execution
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x348], reloc.OLEAUT32.dll_SafeArrayGetLBound
cmp qword [r15 + 0x18], 8
jb 0x140238319
mov r15, qword [r15]
lea r8, [0x1402cb810]
mov rcx, r8
mov rax, rdi
test r15, r15
je 0x14023833b
mov rcx, r15
mov rax, rsi
inc rax
cmp word [r15 + rax*2], di
jne 0x140238331
mov qword [rsp + 0x350], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x358], eax
mov dword [rsp + 0x35c], edi
mov r15, qword [rsp + 0xa0]
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x14023836d
mov rcx, qword [r15]
mov rdx, r8
mov rax, rdi
test rcx, rcx
je 0x140238387
mov rdx, rcx
mov rax, rsi
inc rax
cmp word [rcx + rax*2], di
jne 0x14023837e
mov qword [rsp + 0x360], rdx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x368], eax
mov dword [rsp + 0x36c], edi
mov rdx, qword [rsp + 0x58]
cmp qword [rdx + 0x18], 8
jb 0x1402383b3
mov rdx, qword [rdx]
mov rcx, r8
mov rax, rdi
test rdx, rdx
je 0x1402383cd
mov rcx, rdx
mov rax, rsi
inc rax
cmp word [rdx + rax*2], di
jne 0x1402383c4
mov qword [rsp + 0x370], rcx
lea eax, [rax*2 + 2]
mov dword [rsp + 0x378], eax
mov dword [rsp + 0x37c], edi
lea rax, [rsp + 0x320]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140352425]
mov rcx, r10
call fcn.140001078
jmp 0x14023841e
mov r15, qword [rsp + 0xa0]
mov ebx, 0xfffffffe
mov eax, 3
cmp dword [rsp + 0x30], edi
cmovge ebx, eax
lea rdx, [0x1402cb810]
lea rcx, [rsp + 0x238]
call fcn.140048750
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x110]
call fcn.140048130
lea rcx, [rsp + 0x238]
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x20], bl
mov r9d, dword [rsp + 0x30]
mov r8, r15
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1402386f4
nop
lea rcx, [rsp + 0x238]
call fcn.1400492c0
mov ebx, dword [rsp + 0x30]
lea rcx, [rsp + 0x158]
call fcn.1400492c0
nop
lea rcx, [rsp + 0x138]
call fcn.1400492c0
nop
lea rcx, [rsp + 0x88]
call fcn.14005d48c
nop
lea rcx, [rsp + 0x178]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1402384e6
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.__v__]
nop
lea rcx, [rsp + 0x60]
call fcn.1400480e0
nop
lea rcx, [rsp + 0x38]
call fcn.1400480e0
mov eax, ebx
jmp 0x1402386cf
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rsp + 0x30], ecx
lea rdx, str.Failed_to_write_policy_content_to_file
lea rcx, [rsp + 0x258]
call fcn.140048750
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x120]
call fcn.140048130
lea rcx, [rsp + 0x258]
mov qword [rsp + 0x28], rcx
mov byte [rsp + 0x20], 0xfe
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0xa0]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1402386f4
nop
lea rcx, [rsp + 0x258]
call fcn.1400492c0
mov r15d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140238596
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rcx, [rsp + 0x158]
call fcn.1400492c0
nop
lea rcx, [rsp + 0x138]
call fcn.1400492c0
nop
test rbx, rbx
je 0x1402385fa
mov rax, qword [rsp + 0x98]
sub rax, rbx
cmp rax, 0x1000
jb 0x1402385f1
test bl, 0x1f
jne 0x1402385ea
mov rax, qword [rbx - 8]
cmp rax, rbx
jae 0x1402385ea
sub rbx, rax
sub rbx, 8
cmp rbx, 0x1f
ja 0x1402385ea
mov rbx, rax
jmp 0x1402385f1
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14027abd8
nop
lea rcx, [rsp + 0x178]
call fcn.1400492c0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140238628
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.__v__]
nop
test r14, r14
je 0x14023866b
mov eax, esi
lock xadd dword [r14 + 8], eax
add eax, esi
jne 0x14023866b
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x14023866b
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [str.__v__]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1402386b1
mov eax, esi
lock xadd dword [rcx + 8], eax
add eax, esi
jne 0x1402386b1
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [str.__v__]
mov ecx, esi
lock xadd dword [rbx + 0xc], ecx
add ecx, esi
jne 0x1402386b1
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [str.__v__]
mov eax, r15d
jmp 0x1402386cf
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.14027a710
add rsp, 0x3d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret