Function at 0x14006ec20
Capabilities:
Create process on windows
Enumerate processes
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov qword [rbp + 0x220], 0xfffffffffffffffe
mov qword [rsp + 0x8c0], rbx
mov rax, qword [0x14011d8d0]
xor rax, rsp
mov qword [rbp + 0x760], rax
movsxd rdi, edx
mov r14, rcx
mov r15, rdi
shl r15, 6
mov qword [rbp - 0x28], r15
mov rdx, qword [rcx + 0xa8]
mov rdx, qword [r15 + rdx + 0x28]
call fcn.140068a20
test al, al
jne 0x14006ec94
mov dword [r14 + 0x20], 0xa0010005
xor bl, bl
jmp 0x140070dec
xor r13d, r13d
mov dword [rbp - 0x78], r13d
mov dword [rbp - 0x74], r13d
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea r9, [rbp - 0x78]
lea r8d, [r13 + 3]
mov edx, edi
mov rcx, qword [r14 + 0x38]
call fcn.140089390
lea r9, [rbp - 0x74]
xor r8d, r8d
mov edx, edi
mov rcx, qword [r14 + 0x38]
call fcn.140089390
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov eax, dword [r14 + 0x10]
cmp eax, 0xa
je 0x14006f034
cmp eax, 0xb
je 0x14006f034
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
mov rcx, r14
call fcn.1400669d0
test al, al
jne 0x14006edc7
mov dword [r14 + 0x20], 0xa0011000
xor bl, bl
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006ed82
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006eda2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006edc2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x140070dcf
lea rcx, [rbp + 0x230]
call fcn.14004a620
nop
lea r8, [rbp - 0x40]
mov edx, dword [rbp - 0x60]
lea rcx, [rbp + 0x230]
call fcn.1400480e0
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov rax, qword [r14 + 0xa8]
lea rdx, [rax + r15 + 8]
lea r8, [rbp - 0x18]
lea rcx, [rbp + 0x230]
call fcn.14004bf40
mov r13, qword [rbp - 0x10]
mov rcx, r13
mov r12, qword [rbp - 0x18]
sub rcx, r12
movabs rax, 0x2e8ba2e8ba2e8ba3
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x14006eef5
mov dword [r14 + 0x20], 0xa0011000
xor bl, bl
test r12, r12
je 0x14006ee72
cmp r12, r13
je 0x14006ee6a
mov rcx, r12
call fcn.14002be60
add r12, 0x160
cmp r12, r13
jne 0x14006ee52
mov r12, qword [rbp - 0x18]
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rcx, [rbp + 0x230]
call fcn.14004bd80
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006eeb0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006eed0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006eef0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x140070dcf
mov rdx, qword [r12 + 0x60]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
or rsi, 0xffffffffffffffff
cmp rcx, rdi
je 0x14006ef60
cmp dword [rdi + 0x10], 0
jl 0x14006ef4a
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006ef4a
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006ef3a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x68], rax
mov rbx, qword [rsp + 0x70]
jmp 0x14006ef58
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.140001e80
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
mov rdx, qword [r12 + 0x78]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14006efc2
cmp dword [rbx + 0x10], 0
jl 0x14006efac
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14006efac
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006efa1
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x14006efba
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140001e80
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
test r12, r12
je 0x14006eff0
cmp r12, r13
je 0x14006efe8
nop dword [rax]
mov rcx, r12
call fcn.14002be60
add r12, 0x160
cmp r12, r13
jne 0x14006efd0
mov r12, qword [rbp - 0x18]
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
xor r13d, r13d
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
lea rcx, [rbp + 0x230]
call fcn.14004bd80
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f02a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x70]
jmp 0x14006f220
mov rax, qword [r14 + 0xa8]
mov r8, qword [rax + r15 + 0x20]
mov qword [rbp + 0x18], r8
lea rcx, [r8 - 0x18]
lea r12, [rdi - 0x18]
or rsi, 0xffffffffffffffff
cmp rcx, r12
je 0x14006f1c9
cmp dword [r12 + 0x10], 0
jl 0x14006f0a1
mov rax, qword [r12]
cmp qword [rcx], rax
jne 0x14006f0a1
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [r12 + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006f08e
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
add rdi, 0x18
mov qword [rsp + 0x68], rdi
mov rbx, qword [rsp + 0x70]
jmp 0x14006f1c9
movsxd r13, dword [r8 - 0x10]
test r13d, r13d
jne 0x14006f11c
mov r13, qword [r12]
cmp dword [r12 + 8], 0
je 0x14006f1c6
cmp dword [r12 + 0x10], 0
jge 0x14006f0e3
cmp dword [rdi - 0xc], 0
jge 0x14006f0d3
mov ecx, 0x80070057
call fcn.140001000
int3
xor r13d, r13d
mov dword [rdi - 0x10], r13d
mov word [rdi], r13w
jmp 0x14006f1c9
mov eax, esi
lock xadd dword [r12 + 0x10], eax
dec eax
test eax, eax
jg 0x14006f0ff
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
mov rbx, qword [rsp + 0x70]
jmp 0x14006f1c6
test r8, r8
jne 0x14006f12c
mov ecx, 0x80070057
call fcn.140001000
int3
mov eax, dword [rdi - 0x10]
mov dword [rbp - 0x60], eax
mov r15, r8
sub r15, rdi
sar r15, 1
test r13d, r13d
jns 0x14006f14b
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [r12 + 0x10]
mov eax, dword [r12 + 0xc]
sub eax, r13d
or eax, ecx
jge 0x14006f177
mov edx, r13d
lea rcx, [rsp + 0x68]
call fcn.140001c20
mov rdi, qword [rsp + 0x68]
mov r8, qword [rbp + 0x18]
mov eax, dword [rbp - 0x60]
lea r12, [r13 + r13]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
mov r9, r12
add rdx, rdx
cmp r15, rax
ja 0x14006f19d
lea r8, [rdi + r15*2]
call qword [sym.imp.MSVCR100.dll_memmove_s]
jmp 0x14006f1a3
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp r13d, dword [rdi - 0xc]
jg 0x14006f1bb
mov dword [rdi - 0x10], r13d
xor r13d, r13d
mov word [r12 + rdi], r13w
mov r15, qword [rbp - 0x28]
jmp 0x14006f1c9
mov ecx, 0x80070057
call fcn.140001000
int3
xor r13d, r13d
lea rdx, [rbx - 0x18]
mov r12, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14006f225
cmp dword [rdx + 0x10], 0
jge 0x14006f1f7
cmp dword [rbx - 0xc], 0
jge 0x14006f1ed
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x14006f225
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f20d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov rdi, qword [rsp + 0x68]
mov r12, qword [r14 + 0xa8]
mov edx, Ordinal_49
mov rcx, qword [r15 + r12 + 0x28]
call qword [sym.imp.MSVCR100.dll_wcsrchr]
mov r11, rax
test rax, rax
jne 0x14006f249
mov r11d, esi
jmp 0x14006f251
sub r11, qword [r15 + r12 + 0x28]
sar r11, 1
mov rax, qword [r14 + 0xa8]
lea rcx, [r15 + rax + 0x28]
mov r8d, r11d
lea rdx, [rbp + 0x10]
call fcn.140006920
nop
mov ecx, dword [rbp - 0x78]
test ecx, ecx
je 0x14006f705
dec ecx
jne 0x1400701cd
lea rdx, str..msi
mov rdi, qword [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14006f474
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x68], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x80], rax
mov rax, qword [r14 + 0xa8]
mov rcx, qword [r15 + rax + 0x28]
sub rcx, 0x18
call fcn.140001b90
add rax, 0x18
mov qword [rbp + 0xe0], rax
lea r9, [rbp + 0x80]
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0xe0]
mov rcx, r14
call fcn.140067c50
lea r8, reloc.ATL100.DLL_Ordinal_32
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x1f8]
call fcn.140002ce0
nop
lea r8, [rbp + 0x80]
mov rdx, rax
lea rcx, [rbp + 0x1e8]
call fcn.140008ad0
nop
lea r8, reloc.ATL100.DLL_Ordinal_32
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.140002ce0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp + 0x208]
call fcn.140008ad0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14006f3c1
cmp dword [rdi + 0x10], 0
jl 0x14006f3b2
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006f3b2
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006f3a7
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14006f3c1
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x208]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f3e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x200]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f405
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1e8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f427
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1f8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f449
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f46b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x68]
jmp 0x1400701b3
lea rdx, str..msp
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14006f65b
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x20], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov rax, qword [r14 + 0xa8]
mov rcx, qword [r15 + rax + 0x28]
sub rcx, 0x18
call fcn.140001b90
add rax, 0x18
mov qword [rbp + 0xc8], rax
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0xc8]
mov rcx, r14
call fcn.140067c50
lea r8, reloc.ATL100.DLL_Ordinal_32
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x100]
call fcn.140002ce0
nop
lea r8, [rbp + 0x38]
mov rdx, rax
lea rcx, [rbp + 0x1b8]
call fcn.140008ad0
nop
lea r8, reloc.ATL100.DLL_Ordinal_32
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140002ce0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140008ad0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14006f5ab
cmp dword [rdi + 0x10], 0
jl 0x14006f59c
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006f59c
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006f591
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14006f5ab
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x190]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f5cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f5ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1b8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f611
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f633
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f652
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x20]
jmp 0x1400701b3
mov rax, qword [r14 + 0xa8]
lea r8, [r15 + rax + 0x28]
lea rdx, [0x1400ddcb0]
lea rcx, [rbp + 0x1c0]
call fcn.140004230
nop
lea r8, [0x1400e7df4]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.140002ce0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140008ad0
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140002250
nop
mov rdx, qword [rbp + 0x1a0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f6d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f6f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1c0]
jmp 0x1400701b3
mov ecx, dword [rbp - 0x74]
test ecx, ecx
je 0x14006fc61
dec ecx
je 0x14006fbf8
dec ecx
jne 0x1400701cd
lea rdx, str..msi
mov rdi, qword [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14006f90b
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x78], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x48], rax
mov rax, qword [r14 + 0xa8]
mov rcx, qword [r15 + rax + 0x28]
sub rcx, 0x18
call fcn.140001b90
add rax, 0x18
mov qword [rbp + 0x120], rax
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x78]
lea rdx, [rbp + 0x120]
mov rcx, r14
call fcn.140067c50
lea r8, reloc.ATL100.DLL_Ordinal_32
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x140]
call fcn.140002ce0
nop
lea r8, [rbp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.140008ad0
nop
lea r8, reloc.ATL100.DLL_Ordinal_32
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140002ce0
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.140008ad0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14006f85b
cmp dword [rdi + 0x10], 0
jl 0x14006f84c
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006f84c
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006f841
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14006f85b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x1b0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f87d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f89f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1d0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f8c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f8e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006f902
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x78]
jmp 0x1400701b3
lea rdx, str..msp
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14006fafe
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x90], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x58], rax
mov rax, qword [r14 + 0xa8]
mov rcx, qword [r15 + rax + 0x28]
sub rcx, 0x18
call fcn.140001b90
add rax, 0x18
mov qword [rbp + 0x1e0], rax
lea r9, [rbp + 0x58]
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x1e0]
mov rcx, r14
call fcn.140067c50
lea r8, reloc.ATL100.DLL_Ordinal_32
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x1f0]
call fcn.140002ce0
nop
lea r8, [rbp + 0x58]
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140008ad0
nop
lea r8, reloc.ATL100.DLL_Ordinal_32
mov rdx, rax
lea rcx, [rbp + 0x1c8]
call fcn.140002ce0
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.140008ad0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14006fa4b
cmp dword [rdi + 0x10], 0
jl 0x14006fa3c
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006fa3c
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006fa31
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14006fa4b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x150]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fa6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1c8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fa8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x160]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fab1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1f0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fad3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006faf2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x90]
jmp 0x1400701b3
mov rax, qword [r14 + 0xa8]
lea r8, [r15 + rax + 0x28]
lea rdx, [0x1400ddcb0]
lea rcx, [rbp + 0x180]
call fcn.140004230
nop
lea r8, [0x1400e7df4]
mov rdx, rax
lea rcx, [rbp + 0x1d8]
call fcn.140002ce0
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140008ad0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14006fba8
cmp dword [rdi + 0x10], 0
jl 0x14006fb99
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006fb99
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006fb8e
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14006fba8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x170]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fbca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x1d8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fbec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x180]
jmp 0x1400701b3
lea rcx, [rbx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400701cd
cmp dword [rdi + 0x10], 0
jl 0x14006fc4b
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006fc4b
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006fc3d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x1400701cd
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140001e80
jmp 0x1400701cd
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rcx, [rdi - 0x18]
lea rbx, [rax - 0x18]
cmp rcx, rbx
je 0x14006fcd0
cmp dword [rbx + 0x10], 0
jl 0x14006fcc0
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14006fcc0
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006fcb6
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x14006fcd0
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140001e80
lea rdx, str..msi
mov rdi, qword [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x14006feba
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x30], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x28], rax
mov rax, qword [r14 + 0xa8]
mov rcx, qword [r15 + rax + 0x28]
sub rcx, 0x18
call fcn.140001b90
add rax, 0x18
mov qword [rbp + 0xd0], rax
lea r9, [rbp + 0x28]
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0xd0]
mov rcx, r14
call fcn.140067c50
lea r8, reloc.ATL100.DLL_Ordinal_32
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x108]
call fcn.140002ce0
nop
lea r8, [rbp + 0x28]
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.140008ad0
nop
lea r8, reloc.ATL100.DLL_Ordinal_32
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.140002ce0
nop
lea r8, [rbp - 0x58]
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.140008ad0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14006fe0a
cmp dword [rdi + 0x10], 0
jl 0x14006fdfb
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006fdfb
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006fdf0
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14006fe0a
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fe2c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fe4e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fe70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006fe92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14006feb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x30]
jmp 0x140070194
lea rdx, str..msp
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcsicmp]
test eax, eax
jne 0x1400700a0
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x50], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x40], rax
mov rax, qword [r14 + 0xa8]
mov rcx, qword [r15 + rax + 0x28]
sub rcx, 0x18
call fcn.140001b90
add rax, 0x18
mov qword [rbp + 0x118], rax
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x118]
mov rcx, r14
call fcn.140067c50
lea r8, reloc.ATL100.DLL_Ordinal_32
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x158]
call fcn.140002ce0
nop
lea r8, [rbp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x148]
call fcn.140008ad0
nop
lea r8, reloc.ATL100.DLL_Ordinal_32
mov rdx, rax
lea rcx, [rbp + 0x138]
call fcn.140002ce0
nop
lea r8, [rbp - 0x58]
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.140008ad0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14006fff0
cmp dword [rdi + 0x10], 0
jl 0x14006ffe1
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14006ffe1
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14006ffd6
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14006fff0
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x128]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070012
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x138]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070034
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070056
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x158]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070078
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070097
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x50]
jmp 0x140070194
mov rax, qword [r14 + 0xa8]
lea r8, [r15 + rax + 0x28]
lea rdx, [0x1400ddcb0]
lea rcx, [rbp + 0x188]
call fcn.140004230
nop
lea r8, [0x1400e7df4]
mov rdx, rax
lea rcx, [rbp + 0x178]
call fcn.140002ce0
nop
lea r8, [rbp - 0x58]
mov rdx, rax
lea rcx, [rbp + 0x168]
call fcn.140008ad0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140070149
cmp dword [rdi + 0x10], 0
jl 0x14007013a
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14007013a
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14007012f
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140070149
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140001e80
nop
mov rdx, qword [rbp + 0x168]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007016b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x178]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007018d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x188]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400701af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400701cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, r14
call fcn.140069e70
mov rcx, r14
test al, al
je 0x1400701ea
xor edx, edx
call fcn.140065600
xor bl, bl
jmp 0x140070d70
mov edx, 1
call fcn.140065600
cmp dword [r14 + 0x10], 4
jne 0x140070208
mov edx, 1
mov rcx, r14
call fcn.140065a00
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
mov rdi, qword [r14 + 0xa8]
mov edx, 0x5c
mov rcx, qword [r15 + rdi + 0x28]
call qword [sym.imp.MSVCR100.dll_wcsrchr]
test rax, rax
je 0x140070295
sub rax, qword [r15 + rdi + 0x28]
sar rax, 1
cmp eax, 0xffffffff
je 0x140070295
mov rcx, qword [r14 + 0xa8]
lea r8d, [rax + 1]
lea rcx, [r15 + rcx + 0x28]
lea rdx, [rbp + 0x198]
call fcn.140001d30
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140002250
nop
mov rdx, qword [rbp + 0x198]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070295
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x80], r13
mov qword [rbp + 0x18], r13
call fcn.140021f80
test al, al
je 0x140070326
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rbp - 0x68]
call sub.WTSAPI32.dll_WTSQueryUserToken
mov dword [rbp + 0x88], r13d
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x18]
lea edx, [r9 + 0xb]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140070319
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
jmp 0x140070885
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x80], rax
jmp 0x140070885
xor edx, edx
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x324]
call sub.MSVCR100.dll_memset
mov dword [rbp + 0x320], 0x238
lea rcx, [0x14011d880]
mov rdx, qword [0x14011d880]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x50], rbx
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx]
call qword [rax + 0xc0]
cmp eax, 3
jne 0x1400705ac
mov qword [rbp + 0x98], r13
mov dword [rbp + 0xa0], r13d
mov qword [rbp + 0xa8], r13
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x28], rdi
mov r9d, 0x20019
lea r8, str.SOFTWARESony_CorporationVAIO_Care
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x98]
call fcn.140008440
test eax, eax
jne 0x14007057d
mov dword [rbp - 0x2c], r13d
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.HighAuthorityProcess
mov r13, qword [rbp + 0x98]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007055e
mov eax, dword [rbp + 0x70]
cmp eax, 1
je 0x14007041f
cmp eax, 2
jne 0x14007055e
mov r12d, dword [rbp - 0x2c]
shr r12d, 1
jns 0x140070433
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r12d
or eax, ecx
jge 0x140070455
mov edx, r12d
lea rcx, [rbp - 0x28]
call fcn.140001c20
mov rdi, qword [rbp - 0x28]
lea eax, [r12 + r12]
mov dword [rbp - 0x30], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, str.HighAuthorityProcess
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007055e
mov eax, dword [rbp + 0x60]
cmp eax, 1
je 0x14007049a
cmp eax, 2
jne 0x14007055e
test rdi, rdi
je 0x1400704c7
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x1400704be
test al, 1
jne 0x14007055e
shr rax, 1
cmp word [rdi + rax*2 - 2], 0
je 0x1400704c7
jmp 0x14007055e
xor r12d, r12d
mov word [rdi], r12w
jmp 0x1400704ca
xor r12d, r12d
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x140070553
cmp eax, dword [rdi - 0xc]
jg 0x140070553
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r12w
cmp dword [rdi - 0x10], 0
je 0x14007055e
lea rcx, [rdi - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14007055e
cmp dword [rbx + 0x10], 0
jl 0x140070541
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140070541
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14007052c
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x50], rax
mov r13, qword [rbp + 0x98]
mov rdi, qword [rbp - 0x28]
jmp 0x14007055e
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.140001e80
jmp 0x14007055e
mov ecx, 0x80070057
call fcn.140001000
int3
test r13, r13
je 0x140070576
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r13d, r13d
mov qword [rbp + 0x98], r13
mov dword [rbp + 0xa0], r13d
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070598
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1400705c2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400705c2
mov r8d, Ordinal_17
lea rdx, str.vaioupdt.exe
lea rcx, [rbp - 0x50]
call fcn.140001e80
lea rcx, [rbp - 0x50]
call fcn.140002050
mov dword [rbp - 0x38], r13d
lea rdx, [rbp + 0x320]
mov rcx, r15
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140070811
lea r13, [rbp + 0x34c]
shr r13, 0x10
lea rbx, [rbp + 0x34c]
nop dword [rax + rax]
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x70], rdi
test r13, r13
jne 0x140070640
movzx ebx, bx
xor edx, edx
mov ecx, ebx
call fcn.1400017e0
test rax, rax
je 0x14007066a
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140001f70
jmp 0x140070666
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0x34c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x34c]
lea rcx, [rbp - 0x70]
call fcn.140001e80
mov rdi, qword [rbp - 0x70]
movsxd rbx, dword [rdi - 0x10]
test ebx, ebx
js 0x140070803
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140070696
mov edx, ebx
lea rcx, [rbp - 0x70]
call fcn.140001c20
mov rdi, qword [rbp - 0x70]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcslwr_s]
cmp ebx, dword [rdi - 0xc]
jg 0x1400707f8
mov dword [rdi - 0x10], ebx
xor ecx, ecx
mov word [rdi + rbx*2], cx
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x1400706e5
cmp dword [rdi - 0x10], ecx
jl 0x1400706e5
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_wcsstr]
test rax, rax
je 0x1400706e5
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x1400707bb
movsxd r12, dword [rdi - 0x10]
test r12d, r12d
js 0x1400707ed
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r12d
or eax, ecx
jge 0x140070714
mov edx, r12d
lea rcx, [rbp - 0x70]
call fcn.140001c20
mov rdi, qword [rbp - 0x70]
lea eax, [r12 + 1]
movsxd rdx, eax
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcslwr_s]
cmp r12d, dword [rdi - 0xc]
jg 0x1400707e2
mov dword [rdi - 0x10], r12d
xor ecx, ecx
mov word [rdi + r12*2], cx
test rbx, rbx
je 0x140070760
cmp dword [rdi - 0x10], ecx
jl 0x140070760
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_wcsstr]
test rax, rax
je 0x140070760
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
jne 0x1400707bb
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0x320]
call sub.MSVCR100.dll_memset
mov dword [rbp + 0x320], 0x238
lea rdx, [rbp + 0x320]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1400707e0
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
lea rbx, [rbp + 0x34c]
jg 0x140070600
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400705f1
mov eax, dword [rbp + 0x328]
mov dword [rbp - 0x38], eax
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007080e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x14007080e
jmp 0x1400707c4
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
xor r13d, r13d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp - 0x38]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
lea r8, [rbp - 0x68]
mov edx, 0xa
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
mov r9d, 2
xor r8d, r8d
mov edx, 0x2000000
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070885
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rbp + 8], r13
xor r8d, r8d
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp + 8]
call sub.USERENV.dll_CreateEnvironmentBlock
mov qword [rbp + 0xb0], r13
xor eax, eax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
xor edx, edx
lea r8d, [rax + 0x60]
lea rcx, [rbp + 0x2b8]
call sub.MSVCR100.dll_memset
mov dword [rbp + 0x2b0], 0x68
cmp qword [r14 + 0xc8], 0
jne 0x1400708ed
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r14 + 0xc8], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rcx, [0x14011d880]
mov rax, qword [0x14011d880]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x78], rdi
mov rcx, qword [r14 + 0x30]
call fcn.1400222f0
mov ecx, dword [r14 + 0x10]
cmp ecx, 1
jne 0x140070936
test al, al
je 0x1400709b5
cmp ecx, 0xb
je 0x1400709b5
cmp ecx, 0xa
je 0x1400709b5
cmp ecx, 7
je 0x1400709b5
cmp ecx, 8
je 0x1400709b5
mov rcx, qword [rsp + 0x60]
add rcx, 0xffffffffffffffe8
lea rbx, [rdi - 0x18]
cmp rcx, rbx
je 0x140070b5b
cmp dword [rbx + 0x10], 0
jl 0x14007099d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007099d
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14007098f
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
add rdi, 0x18
mov qword [rsp + 0x78], rdi
jmp 0x140070b5b
mov rdx, qword [rsp + 0x60]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140001e80
jmp 0x140070b56
mov word [rbp + 0x560], r13w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x562]
call sub.MSVCR100.dll_memset
mov r8d, 0x100
lea rdx, [rbp + 0x560]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0x560]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0x560]
lea rcx, [rsp + 0x78]
call fcn.140003c10
mov edx, 0x5c
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_wcsrchr]
test rax, rax
je 0x140070aef
sub rax, rdi
sar rax, 1
cmp eax, 0xffffffff
je 0x140070aef
mov r8d, eax
lea rdx, [rbp + 0x1a8]
lea rcx, [rsp + 0x78]
call fcn.140001d30
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140002250
nop
mov rdx, qword [rbp + 0x1a8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070a7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x78]
lea rcx, [rdx - 0x18]
mov rdi, qword [rbp - 0x48]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140070ad8
cmp dword [rdi + 0x10], 0
jl 0x140070acb
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140070acb
call fcn.140001b90
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140070ac1
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x48], rax
jmp 0x140070ad8
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x48]
call fcn.140001e80
mov r8d, Ordinal_20
lea rdx, str.ShellExeProxy.exe
lea rcx, [rsp + 0x78]
call fcn.140003c10
mov r8d, Ordinal_17
lea rdx, str._RunInstaller
lea rcx, [rbp - 0x20]
call fcn.140003c10
mov r8d, 1
lea rdx, reloc.ATL100.DLL_Ordinal_32
lea rcx, [rbp - 0x20]
call fcn.140003c10
mov rdx, qword [rsp + 0x60]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x20]
call fcn.140003c10
mov r8d, 1
lea rdx, reloc.ATL100.DLL_Ordinal_32
lea rcx, [rsp + 0x78]
call fcn.140003c10
mov rdx, qword [rbp - 0x20]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140003c10
mov rdi, qword [rsp + 0x78]
cmp dword [rdi - 8], 1
jle 0x140070b73
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140001930
mov rdi, qword [rsp + 0x78]
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x4000410
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rdi
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140070c5c
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x210], rax
mov rax, qword [r14 + 0xc8]
mov qword [rbp + 0x218], rax
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp + 0x210]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
jne 0x140070c0a
mov byte [r14 + 0x72], al
xor bl, bl
jmp 0x140070c0c
mov bl, 1
mov dword [rbp - 0x34], r13d
lea rdx, [rbp - 0x34]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp - 0x34], 0xfffffb2e
jne 0x140070c40
cmp dword [rbp - 0x74], 1
jne 0x140070c40
cmp dword [rbp - 0x78], 0
jne 0x140070c40
mov dword [r14 + 0x20], 0xa0010007
xor bl, bl
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140070c72
xor bl, bl
cmp dword [rbp - 0x74], 1
jne 0x140070c72
cmp dword [rbp - 0x78], 0
jne 0x140070c72
mov dword [r14 + 0x20], 0xa0010007
mov rcx, qword [r14 + 0xc8]
test rcx, rcx
je 0x140070c8b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 0xc8], r13
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x140070dfb
cmp eax, dword [rdi - 0xc]
jg 0x140070dfb
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r13w
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140070cc5
call sub.USERENV.dll_DestroyEnvironmentBlock
mov qword [rbp + 8], r13
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140070cf2
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x140070ce8
cmp rcx, rax
jne 0x140070ce8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x68], r13
jmp 0x140070d01
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x68], r13
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140070d05
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x80], r13
cmp dword [r14 + 0x10], 4
jne 0x140070d17
xor edx, edx
mov rcx, r14
call fcn.140065a00
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070d32
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070d51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070d70
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070d8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070daf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140070dcf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsp + 0x60]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140070dec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor edx, edx
mov rcx, r14
call fcn.140065600
movzx eax, bl
jmp 0x140070e06
mov ecx, 0x80070057
call fcn.140001000
nop
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400cafa0
mov rbx, qword [rsp + 0x8c0]
add rsp, 0x870
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret