Function at 0x14001ba70
Capabilities:
Accept command line arguments
Enumerate processes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1560
call fcn.1400a3470
sub rsp, rax
mov rax, qword [0x14010c1d0]
xor rax, rsp
mov qword [rsp + 0x1550], rax
mov r15, r8
xor esi, esi
mov dword [rsp + 0x50], esi
mov byte [rsp + 0xc60], sil
lea rax, str.dll_dirs_F67BB3AD_7B5E_4C2D_A22B_747BC163AB78
mov qword [rsp + 0xba8], rax
mov rax, qword [rsp + 0xba8]
mov qword [rsp + 0xba8], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001bb04
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001bb04
mov ecx, 0x1000
call qword [case.0x14003c22e.0]
lea rcx, [rsp + 0x610]
call fcn.14000c820
mov rdx, rax
lea rcx, [rsp + 0xc40]
call fcn.14000cf30
lea rcx, [rsp + 0x610]
call fcn.140020150
nop
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], 7
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xba8], rax
mov qword [rsp + 0xc68], rsi
lea r12, [0x14010cdf0]
mov qword [rsp + 0xc70], r12
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [rsp + 0x300], xmm0
movups xmm1, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0x310], xmm1
lea rax, [rsp + 0xc68]
mov qword [rsp + 0x38], rax
lea r9, [0x1400ef760]
lea rcx, [rsp + 0x378]
call fcn.1400094b0
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x378]
lea rcx, [rsp + 0x3a0]
call fcn.140019930
nop
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x14001bc21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bc1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d938
call fcn.1400a2ab0
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], si
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], 7
mov r8d, 0xa
lea rdx, [0x1400ef760]
lea rcx, [rsp + 0x1e0]
call fcn.14003d860
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0xb10]
call fcn.140032d90
nop
lea rcx, [rsp + 0x3a0]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea rcx, [rsp + 0xcc8]
call fcn.1400396f0
nop
lea rcx, [rsp + 0xb10]
call fcn.140031dd0
nop
mov rcx, qword [rsp + 0x3d8]
test rcx, rcx
je 0x14001bce5
mov rax, qword [rcx]
lea rdx, [rsp + 0x3a0]
cmp rcx, rdx
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14003c22e.0]
mov qword [rsp + 0x3d8], rsi
call fcn.14000cff0
xor cl, cl
mov byte [rsp + 0xd30], cl
cmp byte [rax + 0x20], cl
je 0x14001bd11
mov rdx, rax
lea rcx, [rsp + 0xd10]
call fcn.140021ef0
mov cl, 1
mov byte [rsp + 0xd30], cl
test cl, cl
jne 0x14001bd1e
mov byte [rsp + 0xc18], cl
jmp 0x14001bd34
lea rdx, [rsp + 0xd10]
lea rcx, [rsp + 0xbf8]
call fcn.14000bfc0
nop
lea rcx, [rsp + 0xd10]
call fcn.140020150
nop
lea rcx, [rsp + 0xbf8]
call fcn.14000d070
mov byte [rsp + 0xc20], al
test al, al
jne 0x14001bd96
cmp byte [rsp + 0xc18], al
je 0x14001bd71
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
mov eax, 5
jmp 0x14001d90b
lea rcx, [0x1400ee574]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
call fcn.14000cff0
xor cl, cl
mov byte [rsp + 0xcc0], cl
cmp byte [rax + 0x20], cl
je 0x14001bdcf
mov rdx, rax
lea rcx, [rsp + 0xca0]
call fcn.140021ef0
mov cl, 1
mov byte [rsp + 0xcc0], cl
test cl, cl
je 0x14001d8c5
lea rcx, [rsp + 0xca0]
cmp qword [rsp + 0xcb8], 8
cmovae rcx, qword [rsp + 0xca0]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
nop
lea rcx, [rsp + 0xca0]
call fcn.140020150
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xbe0], xmm0
mov qword [rsp + 0xbf0], rax
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x150], 7
mov word [rsp + 0x138], si
lea r8d, [rax + 5]
lea rdx, str._stop
lea rcx, [rsp + 0x138]
call fcn.14003d860
nop
mov dword [rsp + 0x90], 0
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x200], eax
mov qword [rsp + 0x208], rsi
mov qword [rsp + 0x210], rsi
mov ecx, 0x30
call fcn.1400a2ac0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x218], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], 7
mov qword [rsp + 0x238], 8
mov dword [rsp + 0x200], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x218]
call fcn.1400274f0
nop
lea rbx, [rsp + 0x138]
nop
mov r8, rbx
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x200]
call fcn.140035b40
add rbx, 0x20
lea rax, [rsp + 0x158]
cmp rbx, rax
jne 0x14001bef0
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x170], 7
mov word [rsp + 0x158], si
mov r8d, 4
lea rdx, str.stop
lea rcx, [rsp + 0x158]
call fcn.14003d860
nop
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x240], eax
mov qword [rsp + 0x248], rsi
mov qword [rsp + 0x250], rsi
mov ecx, 0x30
call fcn.1400a2ac0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x248], rax
mov qword [rsp + 0x258], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x260], xmm0
mov qword [rsp + 0x270], 7
mov qword [rsp + 0x278], 8
mov dword [rsp + 0x240], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x258]
call fcn.1400274f0
nop
lea rbx, [rsp + 0x158]
nop
mov r8, rbx
lea rdx, [rsp + 0x5f0]
lea rcx, [rsp + 0x240]
call fcn.140035b40
add rbx, 0x20
lea rax, [rsp + 0x178]
cmp rbx, rax
jne 0x14001bff0
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x190], 7
mov word [rsp + 0x178], si
mov r8d, 8
lea rdx, str.stop_all
lea rcx, [rsp + 0x178]
call fcn.14003d860
nop
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x280], eax
mov qword [rsp + 0x288], rsi
mov qword [rsp + 0x290], rsi
mov ecx, 0x30
call fcn.1400a2ac0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x298], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x2a0], xmm0
mov qword [rsp + 0x2b0], 7
mov qword [rsp + 0x2b8], 8
mov dword [rsp + 0x280], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x298]
call fcn.1400274f0
nop
lea rbx, [rsp + 0x178]
nop
mov r8, rbx
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x280]
call fcn.140035b40
add rbx, 0x20
lea rax, [rsp + 0x198]
cmp rbx, rax
jne 0x14001c0f0
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x130], 7
mov word [rsp + 0x118], si
mov r8d, 9
lea rdx, str._stop_all
lea rcx, [rsp + 0x118]
call fcn.14003d860
nop
mov dword [rsp + 0x88], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x2c0], eax
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x2d0], rsi
mov ecx, 0x30
call fcn.1400a2ac0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x2c8], rax
mov qword [rsp + 0x2d8], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x2e0], xmm0
mov qword [rsp + 0x2f0], 7
mov qword [rsp + 0x2f8], 8
mov dword [rsp + 0x2c0], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x2d8]
call fcn.1400274f0
nop
lea rbx, [rsp + 0x118]
nop
mov r8, rbx
lea rdx, [rsp + 0x5d0]
lea rcx, [rsp + 0x2c0]
call fcn.140035b40
add rbx, 0x20
lea rax, [rsp + 0x138]
cmp rbx, rax
jne 0x14001c1f0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xbe0], xmm0
mov qword [rsp + 0xbf0], rsi
lea r8, [rsp + 0x300]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xbe0]
call fcn.14002ce40
nop
lea r9, [fcn.14001d970]
mov edx, 0x40
lea r8d, [rdx - 0x3c]
lea rcx, [rsp + 0x200]
call fcn.1400a3014
nop
lea r9, [fcn.140005fe0]
mov ebx, 1
mov r8d, ebx
lea edx, [rbx + 0x1f]
lea rcx, [rsp + 0x118]
call fcn.1400a3014
nop
lea r9, [fcn.140005fe0]
mov r8d, ebx
lea edx, [rbx + 0x1f]
lea rcx, [rsp + 0x178]
call fcn.1400a3014
nop
lea r9, [fcn.140005fe0]
mov r8d, ebx
lea edx, [rbx + 0x1f]
lea rcx, [rsp + 0x158]
call fcn.1400a3014
nop
lea r9, [fcn.140005fe0]
mov r8d, ebx
lea edx, [rbx + 0x1f]
lea rcx, [rsp + 0x138]
call fcn.1400a3014
mov qword [rsp + 0xc30], rsi
mov edi, esi
mov r14, r12
mov qword [rsp + 0xc38], r12
cmp byte [rsp + 0xc18], sil
je 0x14001c41e
lea r9, str.Desktop
mov r8d, 0xc8
lea rdx, [rsp + 0xc78]
lea rcx, [rsp + 0xbf8]
call fcn.14000bd10
mov dword [rsp + 0x50], 0x3e
cmp byte [rsp + 0xc98], dil
je 0x14001c42e
lea rdx, [rsp + 0xc78]
cmp qword [rsp + 0xc90], 8
cmovae rdx, qword [rsp + 0xc78]
mov dword [rsp + 0xbd8], esi
mov dword [rsp + 0xc28], 4
lea rax, [rsp + 0xc28]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xbd8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9d, [rbx + 0xf]
lea r8, str.NoRestrictBDAppsOnUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea rbx, [0x14010ce88]
test eax, eax
je 0x14001c3d1
mov dword [rsp + 0x1d0], eax
mov qword [rsp + 0x1d8], rbx
movaps xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0xc30], xmm0
mov r14, qword [rsp + 0xc38]
mov edi, dword [rsp + 0xc30]
mov rcx, qword [0x14010cdf8]
mov rdx, qword [r14 + 8]
cmp rdx, rcx
jne 0x14001c3ee
test edi, edi
jne 0x14001c3ee
mov eax, dword [rsp + 0xbd8]
jmp 0x14001c3f5
mov eax, esi
cmp rdx, rcx
jne 0x14001c40f
test edi, edi
jne 0x14001c40f
test eax, eax
je 0x14001c40f
lea rcx, [rsp + 0xc78]
call fcn.140020150
jmp 0x14001c4de
lea rcx, [rsp + 0xc78]
call fcn.140020150
jmp 0x14001c442
mov byte [rsp + 0xc98], dil
mov dword [rsp + 0x50], 0x3e
lea rcx, [rsp + 0xc78]
call fcn.140020150
lea rbx, [0x14010ce88]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd00], xmm0
mov qword [rsp + 0xba0], rsi
lea rax, [rsp + 0xba0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str..DEFAULTSoftwareSetID_bd.update.configure
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001c4a5
mov dword [rsp + 0x1c0], eax
mov qword [rsp + 0x1c8], rbx
movaps xmm0, xmmword [rsp + 0x1c0]
movdqa xmmword [rsp + 0xd00], xmm0
jmp 0x14001c4de
mov qword [rsp + 0xd08], r12
mov rcx, qword [rsp + 0xba0]
test rcx, rcx
je 0x14001c4de
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rsp + 0xbe0]
call fcn.1400140e0
test al, al
je 0x14001c87b
lea rcx, [rsp + 0x58]
call fcn.1400077f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xbc0], xmm0
mov dword [rsp + 0xbb8], esi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0xbb8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xbc0], rax
movsxd rax, dword [rsp + 0xbb8]
mov qword [rsp + 0xbc8], rax
mov qword [rsp + 0xba8], rsi
mov ecx, dword [0x140112b70]
mov eax, dword [0x140112b74]
add ecx, eax
je 0x14001c65f
mov dword [rsp + 0x70], esi
call fcn.140021750
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov dword [rsp + 0x50], 0x3f
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x14001c57a
call fcn.140021750
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
mov edi, 0xffffffff
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001c5ff
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0xef4]
call fcn.1400a5940
mov dword [rsp + 0xef0], 0x238
lea rdx, [rsp + 0xef0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001c5f6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0xef8], eax
je 0x14001c5ef
lea rdx, [rsp + 0xef0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14001c5c9
mov edi, dword [rsp + 0xf10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x9c], 0x10
lea rdx, [0x1400ef7c8]
test r15, r15
cmovne rdx, r15
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], eax
lea rax, str.First_log:_pid_lu_parent_pid_lu_lpCmdLine__s_
mov qword [rsp + 0x28], rax
lea rdi, str.wWinMain
mov qword [rsp + 0x20], rdi
lea r9, [0x140000000]
lea r8, [rsp + 0x9c]
movsx edx, si
mov rcx, r14
call fcn.140001cf0
jmp 0x14001c666
lea rdi, str.wWinMain
mov r15d, dword [rsp + 0x50]
test r15b, 1
je 0x14001c6af
and r15d, 0xfffffffe
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x68], rsi
mov eax, 0xffffffff
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
js 0x14001c6a5
nop
call fcn.14002ade0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
jns 0x14001c690
lock inc dword [rsp + 0x70]
mov r15d, dword [rsp + 0x50]
mov r8, rdi
mov edx, 0x10
lea rcx, [rsp + 0x638]
call fcn.140003650
bts r15d, 7
cmp byte [rsp + 0x6b8], 0
je 0x14001c6e7
lea rdx, str.Cmd_line_arguments:
lea rcx, [rsp + 0x638]
call fcn.14002bd90
mov rbx, rsi
mov r12, qword [rsp + 0xbc8]
mov r14, qword [rsp + 0xbc0]
nop word [rax + rax]
cmp rbx, r12
je 0x14001c755
test r14, r14
je 0x14001d93e
cmp rbx, r12
jae 0x14001d93e
cmp byte [rsp + 0x6b8], 0
je 0x14001c750
mov rdx, qword [r14 + rbx*8]
lea rcx, [rsp + 0x638]
call fcn.14002bd90
cmp byte [rsp + 0x6b8], 0
je 0x14001c750
lea rdx, [0x1400ef758]
lea rcx, [rsp + 0x638]
call fcn.140034a00
inc rbx
jmp 0x14001c700
lea rcx, [rsp + 0x638]
call fcn.1400038d0
cmp r12, 2
jae 0x14001c834
mov r8, rdi
mov edx, 4
lea rcx, [rsp + 0x4d8]
call fcn.140003650
nop
cmp byte [rsp + 0x558], 0
je 0x14001c7a1
lea rdx, str.Config_file_is_missing.
lea rcx, [rsp + 0x4d8]
call fcn.14002bd90
nop
lea rcx, [rsp + 0x4d8]
call fcn.1400038d0
nop
test r14, r14
je 0x14001c7be
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
cmp byte [rsp + 0x58], 0
je 0x14001c7cf
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001c7e9
call fcn.14002ade0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001c7e9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xbe0]
call fcn.140023f10
nop
cmp byte [rsp + 0xc18], 0
je 0x14001c80f
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
mov eax, 0xa0
jmp 0x14001d90b
call fcn.14001b520
test al, al
jne 0x14001c8c6
test r14, r14
je 0x14001c850
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
cmp byte [rsp + 0x58], 0
je 0x14001c861
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001c87b
call fcn.14002ade0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001c87b
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xbe0]
call fcn.140023f10
nop
cmp byte [rsp + 0xc18], 0
je 0x14001c8a1
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
mov eax, 0x42b
jmp 0x14001d90b
mov rax, qword [r14 + 8]
lea rbx, [rax + 2]
cmp word [rax], 0x2f
cmovne rbx, rax
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14001c8e0
mov rdx, rbx
lea rcx, [0x14010ce30]
call fcn.14003d860
mov r8, rdi
mov edx, 0x10
lea rcx, [rsp + 0x828]
call fcn.140003650
bts r15d, 9
cmp byte [rsp + 0x8a8], 0
je 0x14001c94d
lea rdx, str.Config_path:
lea rcx, [rsp + 0x828]
call fcn.14002bd90
cmp byte [rsp + 0x8a8], 0
je 0x14001c94d
mov rdx, rbx
lea rcx, [rsp + 0x828]
call fcn.14002bd90
nop
lea rcx, [rsp + 0x828]
call fcn.1400038d0
mov rdi, rsi
mov qword [rsp + 0xbb0], rsi
mov ecx, 0x48
call fcn.1400a2ac0
mov r13, rax
mov qword [rsp + 0xbd0], rax
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0x110], 7
mov word [rsp + 0xf8], si
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x14001c9a5
mov rdx, rbx
lea rcx, [rsp + 0xf8]
call fcn.14003d860
nop
bts r15d, 0xa
mov dword [rsp + 0x50], r15d
lea rdx, [rsp + 0xf8]
mov rcx, r13
call fcn.140045190
mov rbx, rax
bts r15d, 0xb
bt r15d, 0xa
jae 0x14001ca53
btr r15d, 0xa
mov rdx, qword [rsp + 0x110]
cmp rdx, 8
jb 0x14001ca37
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ca32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d944
call fcn.1400a2ab0
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0x110], 7
mov word [rsp + 0xf8], si
mov rdx, qword [0x14010ce70]
mov qword [0x14010ce70], rbx
test rdx, rdx
je 0x14001ca6b
call fcn.1400254b0
call fcn.14001b7b0
lea r8, str.wWinMain
mov edx, 0x10
lea rcx, [rsp + 0x730]
call fcn.140003650
bts r15d, 0xc
mov dword [rsp + 0x50], r15d
cmp byte [rsp + 0x7b0], 0
je 0x14001cab1
lea rdx, str.Cmd_line_arguments:
lea rcx, [rsp + 0x730]
call fcn.14002bd90
mov rbx, rsi
cmp rbx, r12
je 0x14001cb09
test r14, r14
je 0x14001d956
cmp rbx, r12
jae 0x14001d956
cmp byte [rsp + 0x7b0], 0
je 0x14001cb04
mov rdx, qword [r14 + rbx*8]
lea rcx, [rsp + 0x730]
call fcn.14002bd90
cmp byte [rsp + 0x7b0], 0
je 0x14001cb04
lea rdx, [0x1400ef758]
lea rcx, [rsp + 0x730]
call fcn.140034a00
inc rbx
jmp 0x14001cab4
lea rcx, [rsp + 0x730]
call fcn.1400038d0
nop
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0xdf0]
call fcn.1400a5940
mov r13d, 1
mov edx, r13d
lea rcx, [rsp + 0xdf0]
call fcn.1400209a0
nop
lea rdx, [0x1400ef8d4]
lea rcx, [rsp + 0xe00]
call fcn.14002bd90
lea rdx, [0x14010ce50]
cmp qword [0x14010ce68], 8
cmovae rdx, qword [0x14010ce50]
mov r8, qword [0x14010ce60]
mov rcx, rax
call fcn.140034d30
lea rdx, [0x1400ef8cc]
mov rcx, rax
call fcn.14002bd90
lea rdx, [0x1400ef8d4]
lea rcx, [rsp + 0xe00]
call fcn.14002bd90
cmp qword [0x14010ce48], 8
lea rdx, [0x14010ce30]
cmovae rdx, qword [0x14010ce30]
mov r8, qword [0x14010ce40]
mov rcx, rax
call fcn.140034d30
lea rdx, [0x1400ef8d4]
mov rcx, rax
call fcn.14002bd90
mov rbx, qword [0x14010ce70]
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0xe08]
call fcn.140025580
bts r15d, 0xd
mov dword [rsp + 0x50], r15d
mov r8, rbx
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0xa8]
call fcn.14001b250
lea rcx, [rsp + 0xbb0]
cmp rcx, rax
je 0x14001cc31
mov rdx, qword [rax]
mov qword [rax], rsi
mov rdi, rdx
mov qword [rsp + 0xbb0], rdx
mov rbx, qword [rsp + 0xa8]
test rbx, rbx
je 0x14001cc54
mov rcx, rbx
call fcn.14000bb00
mov edx, 0x78
mov rcx, rbx
call fcn.1400a2ab0
nop
mov rdx, qword [rsp + 0x1b0]
cmp rdx, 8
jb 0x14001cc9c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cc97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d94a
call fcn.1400a2ab0
mov qword [rsp + 0x1a8], rsi
mov qword [rsp + 0x1b0], 7
mov word [rsp + 0x198], si
lea rcx, [rsp + 0xdf0]
call fcn.1400045e0
nop
jmp 0x14001cce6
lea r15, str.wWinMain
mov rax, qword [0x14010ce70]
movzx ecx, word [rax + 0x42]
movzx eax, cx
shr ax, 8
test al, al
je 0x14001cd0b
cmp cl, 1
sete al
jmp 0x14001cd0d
mov eax, esi
test al, al
je 0x14001d24c
mov qword [rsp + 0xbd0], rsi
lea rcx, [rsp + 0xbd0]
call fcn.1400122e0
nop
mov rbx, qword [rsp + 0xbd0]
test rbx, rbx
je 0x14001d231
call fcn.1400139f0
test al, al
je 0x14001d231
mov byte [rsp + 0xd4], 0
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], 0xf
mov byte [rsp + 0xd8], 0
mov r8d, 0x26
lea rdx, str.6917A0A7_7341_43EB_B354_FC4C103B1EC1
lea rcx, [rsp + 0xd8]
call fcn.14003dcd0
nop
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [rsp + 0x1130], eax
mov r9, 0xffffffffffffffff
lea r8, str.bd::process_broker::client::spawn_process_with_current_params
mov edx, 0x102
lea rcx, [rsp + 0x1134]
call fcn.1400a96a0
lea r8, [0x1400ee314]
mov edx, 0x104
lea rcx, [rsp + 0x1134]
call fcn.1400b3c10
mov r9, 0xffffffffffffffff
lea r8, str.bd::process_broker::client::spawn_process_with_current_params
mov edx, 0x104
lea rcx, [rsp + 0x133c]
call fcn.1400a96a0
mov ecx, dword [0x140112b70]
mov eax, dword [0x140112b74]
add ecx, eax
je 0x14001cec6
mov dword [rsp + 0x80], esi
call fcn.140021750
mov qword [rsp + 0x78], rax
lock inc dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
test rax, rax
jne 0x14001ce3f
call fcn.140021750
mov qword [rsp + 0x78], rax
lock inc dword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0xa0], 0x20
lea rax, [rsp + 0x1134]
mov qword [rsp + 0x30], rax
lea rax, str.____s
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x133c]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rsp + 0xa0]
movsx edx, r13w
call fcn.140001cf0
nop
mov qword [rsp + 0x78], rsi
mov eax, 0xffffffff
lock xadd dword [rsp + 0x80], eax
cmp eax, 1
js 0x14001cebe
call fcn.14002ade0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x80], eax
cmp eax, 1
jns 0x14001cea6
lock inc dword [rsp + 0x80]
mov byte [rsp + 0x358], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x338]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xdb0]
call fcn.1400129a0
nop
lea rcx, [rsp + 0x1130]
call fcn.140001d50
nop
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0x10
jb 0x14001cf4a
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cf45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d950
call fcn.1400a2ab0
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], 0xf
mov byte [rsp + 0xd8], 0
cmp byte [rsp + 0xde0], 0
jne 0x14001d0d8
cmp byte [rsp + 0xdb4], 0
je 0x14001d0d8
mov r8, r15
mov edx, 0x10
lea rcx, [rsp + 0x4d8]
call fcn.140003650
nop
cmp byte [rsp + 0x558], 0
je 0x14001cfb7
lea rdx, str.Process_will_be_respawned_by_process_broker_
lea rcx, [rsp + 0x4d8]
call fcn.14002bd90
nop
lea rcx, [rsp + 0x4d8]
call fcn.1400038d0
nop
lea rcx, [rsp + 0xdb0]
call fcn.14001f1e0
nop
mov rbx, qword [rsp + 0xbd0]
test rbx, rbx
je 0x14001cff6
mov rcx, rbx
call fcn.14000fc80
mov edx, 0x50
mov rcx, rbx
call fcn.1400a2ab0
nop
mov rbx, qword [rsp + 0xbb0]
test rbx, rbx
je 0x14001d019
mov rcx, rbx
call fcn.14000bb00
mov edx, 0x78
mov rcx, rbx
call fcn.1400a2ab0
nop
mov rbx, qword [rsp + 0xba8]
test rbx, rbx
je 0x14001d051
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001d036
mov qword [rbx], rsi
call fcn.1400247e0
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001d043
call fcn.1400247e0
mov edx, 8
mov rcx, rbx
call fcn.1400a2ab0
nop
mov rcx, qword [rsp + 0xbc0]
test rcx, rcx
je 0x14001d065
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
cmp byte [rsp + 0x58], 0
je 0x14001d076
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d090
call fcn.14002ade0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d090
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xbe0]
call fcn.140023f10
nop
cmp byte [rsp + 0xc18], 0
je 0x14001d0b6
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
xor eax, eax
jmp 0x14001d90b
mov r8, r15
mov edx, 4
lea rcx, [rsp + 0x4d8]
call fcn.140003650
nop
cmp byte [rsp + 0x558], 0
je 0x14001d10d
lea rdx, str.Process_browker_spawn_failed_
lea rcx, [rsp + 0x4d8]
call fcn.14002bd90
nop
lea rcx, [rsp + 0x4d8]
call fcn.1400038d0
nop
lea rcx, [rsp + 0xdb0]
call fcn.14001f1e0
nop
mov rbx, qword [rsp + 0xbd0]
test rbx, rbx
je 0x14001d14c
mov rcx, rbx
call fcn.14000fc80
mov edx, 0x50
mov rcx, rbx
call fcn.1400a2ab0
nop
mov rbx, qword [rsp + 0xbb0]
test rbx, rbx
je 0x14001d16f
mov rcx, rbx
call fcn.14000bb00
mov edx, 0x78
mov rcx, rbx
call fcn.1400a2ab0
nop
mov rbx, qword [rsp + 0xba8]
test rbx, rbx
je 0x14001d1a7
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001d18c
mov qword [rbx], rsi
call fcn.1400247e0
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001d199
call fcn.1400247e0
mov edx, 8
mov rcx, rbx
call fcn.1400a2ab0
nop
mov rcx, qword [rsp + 0xbc0]
test rcx, rcx
je 0x14001d1bb
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
cmp byte [rsp + 0x58], 0
je 0x14001d1cc
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d1e6
call fcn.14002ade0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d1e6
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xbe0]
call fcn.140023f10
nop
cmp byte [rsp + 0xc18], 0
je 0x14001d20c
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
mov eax, 5
jmp 0x14001d90b
test rbx, rbx
je 0x14001d24c
mov rcx, rbx
call fcn.14000fc80
mov edx, 0x50
mov rcx, rbx
call fcn.1400a2ab0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xd40], xmm0
movups xmmword [rsp + 0xd50], xmm0
movups xmmword [rsp + 0xd60], xmm0
movups xmmword [rsp + 0xd70], xmm0
movups xmmword [rsp + 0xd80], xmm0
movups xmmword [rsp + 0xd90], xmm0
mov qword [rsp + 0xda0], rax
lea rcx, [rsp + 0xd40]
call fcn.140041420
nop
lea rax, [rsp + 0xd40]
mov qword [0x14010ce78], rax
mov byte [0x14010ce80], 1
cmp r12, 2
jbe 0x14001d462
mov rbx, qword [r14 + 0x10]
mov r8d, 7
lea rdx, str.crash
mov rcx, rbx
call fcn.1400b3290
mov rcx, rbx
test eax, eax
jne 0x14001d349
call fcn.140013d00
mov ebx, eax
lea r8, str.check_intentional_crash
mov edx, 0x10
lea rcx, [rsp + 0x3e0]
call fcn.140003650
nop
cmp byte [rsp + 0x460], 0
je 0x14001d330
lea rdx, str.Crash_interval:
lea rcx, [rsp + 0x3e0]
call fcn.14002bd90
cmp byte [rsp + 0x460], 0
je 0x14001d330
mov edx, ebx
lea rcx, [rsp + 0x3e0]
call fcn.140021520
nop
lea rcx, [rsp + 0x3e0]
call fcn.1400038d0
mov ecx, ebx
call fcn.140013f40
jmp 0x14001d7c0
lea rdx, str.stop
call fcn.1400b3120
test eax, eax
je 0x14001d400
lea rdx, str._stop
mov rcx, rbx
call fcn.1400b3120
test eax, eax
je 0x14001d400
lea rdx, str.stop_all
mov rcx, rbx
call fcn.1400b3120
test eax, eax
je 0x14001d39e
lea rdx, str._stop_all
mov rcx, rbx
call fcn.1400b3120
test eax, eax
jne 0x14001d462
call fcn.14001afa0
test al, al
je 0x14001d3b9
lea rcx, [rsp + 0xd40]
call fcn.140043890
jmp 0x14001d7c0
mov r8, r15
mov edx, 4
lea rcx, [rsp + 0x3e0]
call fcn.140003650
nop
cmp byte [rsp + 0x460], 0
je 0x14001d3ee
lea rdx, str.Stopping_processes_requires_admin_rigths_
lea rcx, [rsp + 0x3e0]
call fcn.14002bd90
nop
lea rcx, [rsp + 0x3e0]
call fcn.1400038d0
jmp 0x14001d7c0
call fcn.14001afa0
test al, al
je 0x14001d41b
lea rcx, [rsp + 0xd40]
call fcn.1400433f0
jmp 0x14001d7c0
mov r8, r15
mov edx, 4
lea rcx, [rsp + 0x3e0]
call fcn.140003650
nop
cmp byte [rsp + 0x460], 0
je 0x14001d450
lea rdx, str.Stopping_process_requires_admin_rigths_
lea rcx, [rsp + 0x3e0]
call fcn.14002bd90
nop
lea rcx, [rsp + 0x3e0]
call fcn.1400038d0
jmp 0x14001d7c0
mov rcx, qword [0x14010ce70]
movzx ebx, word [rcx + 0x40]
movzx eax, bx
shr ax, 8
test al, al
je 0x14001d5b9
call fcn.14001afa0
cmp al, bl
je 0x14001d5b2
mov r8, r15
mov edx, 4
lea rcx, [rsp + 0x3e0]
call fcn.140003650
nop
cmp byte [rsp + 0x460], 0
je 0x14001d4be
lea rdx, str.Admin_rights_mismatch_
lea rcx, [rsp + 0x3e0]
call fcn.14002bd90
nop
lea rcx, [rsp + 0x3e0]
call fcn.1400038d0
nop
lea rcx, [rsp + 0xd40]
call fcn.1400419e0
nop
test rdi, rdi
je 0x14001d4f5
mov rcx, rdi
call fcn.14000bb00
mov edx, 0x78
mov rcx, rdi
call fcn.1400a2ab0
nop
mov rbx, qword [rsp + 0xba8]
test rbx, rbx
je 0x14001d52d
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001d512
mov qword [rbx], rsi
call fcn.1400247e0
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001d51f
call fcn.1400247e0
mov edx, 8
mov rcx, rbx
call fcn.1400a2ab0
nop
test r14, r14
je 0x14001d53c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
cmp byte [rsp + 0x58], 0
je 0x14001d54d
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d567
call fcn.14002ade0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d567
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xbe0]
call fcn.140023f10
nop
cmp byte [rsp + 0xc18], 0
je 0x14001d58d
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
mov eax, 0x42b
jmp 0x14001d90b
mov rcx, qword [0x14010ce70]
movzx edx, word [rcx + 0x44]
movzx eax, dx
shr ax, 8
test al, al
je 0x14001d5d0
cmp dl, 1
sete al
jmp 0x14001d5d2
mov eax, esi
test al, al
je 0x14001d7b2
mov ecx, 8
call fcn.1400a2ac0
mov qword [rsp + 0xd0], rax
xor ecx, ecx
mov qword [rax], rcx
lea rcx, [0x1400f0ce8]
mov qword [rsp + 0x338], rcx
lea rcx, [rsp + 0x338]
mov qword [rsp + 0x370], rcx
lea r8, [rsp + 0x338]
mov edx, r13d
mov rcx, rax
call fcn.14000dd50
mov rdi, rax
mov rbx, qword [rsp + 0xba8]
mov qword [rsp + 0xba8], rax
test rbx, rbx
je 0x14001d665
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001d658
mov qword [rbx], rsi
call fcn.1400247e0
mov rdx, qword [rbx]
test rdx, rdx
je 0x14001d658
call fcn.1400247e0
mov edx, 8
mov rcx, rbx
call fcn.1400a2ab0
mov rax, qword [rdi]
test rax, rax
je 0x14001d7b2
mov rcx, qword [rax]
test rcx, rcx
je 0x14001d7b2
movzx eax, byte [rcx + 0x28]
test al, al
jne 0x14001d7b2
mov r8, r15
mov edx, 4
lea rcx, [rsp + 0x3e0]
call fcn.140003650
nop
cmp byte [rsp + 0x460], 0
je 0x14001d6be
lea rdx, str.Multiple_instances_not_allowed_
lea rcx, [rsp + 0x3e0]
call fcn.14002bd90
nop
lea rcx, [rsp + 0x3e0]
call fcn.1400038d0
nop
lea rcx, [rsp + 0xd40]
call fcn.1400419e0
nop
mov rbx, qword [rsp + 0xbb0]
test rbx, rbx
je 0x14001d6fd
mov rcx, rbx
call fcn.14000bb00
mov edx, 0x78
mov rcx, rbx
call fcn.1400a2ab0
nop
mov rdx, qword [rdi]
test rdx, rdx
je 0x14001d71a
mov qword [rdi], rsi
call fcn.1400247e0
mov rdx, qword [rdi]
test rdx, rdx
je 0x14001d71a
call fcn.1400247e0
mov edx, 8
mov rcx, rdi
call fcn.1400a2ab0
nop
mov rcx, qword [rsp + 0xbc0]
test rcx, rcx
je 0x14001d73c
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
cmp byte [rsp + 0x58], 0
je 0x14001d74d
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d767
call fcn.14002ade0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14001d767
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0xbe0]
call fcn.140023f10
nop
cmp byte [rsp + 0xc18], 0
je 0x14001d78d
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
mov eax, 0x42b
jmp 0x14001d90b
lea rcx, [rsp + 0xd40]
call fcn.140042e40
nop
lea rcx, [rsp + 0xd40]
call fcn.1400419e0
nop
mov byte [0x14010ce80], 0
lea rcx, [rsp + 0xbb0]
call fcn.14001dac0
nop
lea rcx, [rsp + 0xba8]
call fcn.14001d9e0
nop
lea rcx, [rsp + 0xbc0]
call fcn.14003df30
nop
lea rcx, [rsp + 0x58]
call fcn.140007ae0
nop
lea rcx, [rsp + 0xbe0]
call fcn.140023f10
nop
cmp byte [rsp + 0xc18], 0
je 0x14001d830
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
xor eax, eax
jmp 0x14001d90b
lea rcx, [rsp + 0xca0]
call fcn.140020150
nop
cmp byte [rsp + 0xc18], 0
je 0x14001d8eb
lea rcx, [rsp + 0xbf8]
call fcn.14000c6e0
nop
lea rcx, [rsp + 0xcc8]
call fcn.14001da30
nop
lea rcx, [rsp + 0xc40]
call fcn.140020150
mov eax, 0x1f
mov rcx, qword [rsp + 0x1550]
xor rcx, rsp
call fcn.1400a2a50
lea r11, [rsp + 0x1560]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400a99c0
nop
call fcn.1400a99c0
nop
call fcn.1400a99c0
nop
call fcn.1400a99c0
nop
call fcn.1400a99c0
nop
call fcn.1400a99c0
int3