Function at 0x140123df0
Capabilities:
Accept command line arguments
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1d20]
mov eax, COleDispatchImpl::GetTypeInfoCount
call fcn.1400b3040
sub rsp, rax
mov rax, qword [0x1401b8010]
xor rax, rsp
mov qword [rbp + 0x1d10], rax
mov r14, rcx
xor esi, esi
mov dword [rsp + 0x40], esi
mov byte [rbp - 0x78], sil
lea rax, str.dll_dirs_F67BB3AD_7B5E_4C2D_A22B_747BC163AB78
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140123e7f
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140123e7f
mov ecx, 0x1000
call qword [case.0x140077645.0]
lea rcx, [rbp + 0x208]
call fcn.140063a70
mov rbx, rax
cmp byte [rax + 0x20], 0
je 0x140123f0b
cmp byte [rbp - 0x78], 0
je 0x140123ed7
lea rax, [rsp + 0x68]
cmp rax, rbx
je 0x140123f6b
lea rcx, [rsp + 0x68]
call fcn.140002e30
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
jmp 0x140123f6b
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov byte [rbp - 0x78], 1
jmp 0x140123f6b
cmp byte [rbp - 0x78], 0
je 0x140123f6b
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140123f55
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140123f50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140123f50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007e2a0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
mov byte [rbp - 0x78], 0
cmp byte [rbp + 0x228], 0
je 0x140123f81
lea rcx, [rbp + 0x208]
call fcn.140002e30
nop
lea rcx, [rbp + 0x170]
call fcn.14006b460
nop
cmp byte [rbp + 0x1a0], 0
jne 0x140124049
mov ecx, 0x10
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140123fd7
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x170], rsi
mov qword [rbx], rax
movzx eax, word [rbp + 0x178]
mov word [rbx + 8], ax
mov byte [rbp + 0x179], 0
jmp 0x140123fda
mov rbx, rsi
mov edi, 0x20
lea rax, [r14 + 0x5b8]
lea rcx, [rbp + 0x128]
cmp rax, rcx
je 0x140124021
mov r15, qword [rax]
mov qword [rax], rbx
test r15, r15
je 0x14012404d
cmp byte [r15 + 9], 0
je 0x14012400a
call fcn.14008a940
nop
mov rcx, r15
call fcn.140068810
mov edx, 0x10
mov rcx, r15
call fcn.14007e2a0
jmp 0x14012404d
test rbx, rbx
je 0x14012404d
cmp byte [rbx + 9], 0
je 0x140124032
call fcn.14008a940
nop
mov rcx, rbx
call fcn.140068810
mov edx, 0x10
mov rcx, rbx
call fcn.14007e2a0
jmp 0x14012404d
mov edi, dword [rsp + 0x40]
call fcn.1400641a0
mov rdx, rax
xor al, al
mov byte [rbp + 0x120], al
cmp byte [rdx + 0x20], al
je 0x140124076
lea rcx, [rbp + 0x100]
call fcn.140002bc0
mov al, 1
mov byte [rbp + 0x120], al
test al, al
jne 0x140124089
mov byte [rbp + 0xf0], al
or edi, 0x40
mov dword [rsp + 0x40], edi
jmp 0x1401240b9
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xd0]
call fcn.140063350
or edi, 0x40
mov dword [rsp + 0x40], edi
cmp byte [rbp + 0x120], 0
je 0x1401240b9
lea rcx, [rbp + 0x100]
call fcn.140002e30
nop
lea rcx, [rbp + 0xd0]
call fcn.140064220
mov byte [rbp + 0xf8], al
call fcn.140005ad0
mov qword [rbp + 0x958], rsi
mov qword [rbp + 0x968], rsi
mov qword [rbp + 0x970], 7
mov word [rbp + 0x958], si
mov r8d, 5
lea rdx, str._stop
lea rcx, [rbp + 0x958]
call fcn.140002f20
nop
xorps xmm0, xmm0
movss dword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x60]
mov dword [rbp + 0x10], eax
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rsi
lfence
mov ecx, 0x30
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x28], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], 7
mov qword [rbp + 0x48], 8
movss xmm0, dword [0x140189bf8]
movss dword [rbp + 0x10], xmm0
mov r8, rax
mov edx, 0x10
lea rcx, [rbp + 0x28]
call fcn.1400098f0
nop
lea r8, [rbp + 0x978]
lea rdx, [rbp + 0x958]
lea rcx, [rbp + 0x10]
call fcn.1400738e0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rsi
lfence
mov ecx, 0x40
call fcn.140002610
mov rbx, rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
lea rdi, [rax + 0x40]
mov qword [rbp - 0x18], rdi
lea rax, [rbp - 0x28]
mov qword [rbp - 0x50], rax
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], rbx
lea rax, [rbp - 0x28]
mov qword [rbp + 0xb8], rax
mov qword [rbp - 0x30], rbx
mov eax, dword [rbp + 0x10]
mov dword [rbx], eax
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
lfence
mov ecx, 0x30
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov rax, qword [rbp + 0x40]
mov qword [rbx + 0x30], rax
mov rax, qword [rbp + 0x48]
mov qword [rbx + 0x38], rax
mov rdx, qword [rbp + 0x30]
sub rdx, qword [rbp + 0x28]
sar rdx, 3
mov r8, qword [rbx + 8]
call fcn.1400098f0
mov rdx, qword [rbp + 0x18]
mov r8, rdx
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.1400782f0
nop
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xa8], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x50], rsi
lea r9, [0x140067340]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rbp + 0x10]
call fcn.14007e954
nop
lea r9, [fcn.140002b70]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x958]
call fcn.14007e954
mov dword [rbp - 0x40], esi
lea rax, [0x1401b91d8]
mov qword [rbp - 0x38], rax
cmp byte [rbp + 0xf0], 0
je 0x14012436e
lea r9, str.common
mov r8d, 0x7d1
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xd0]
call fcn.140063080
or dword [rsp + 0x40], 0x80
cmp byte [rbp + 0xa0], 0
je 0x14012437d
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 8
cmovae rdx, qword [rbp + 0x80]
mov qword [rbp - 0x10], 0xffffffff80000002
lea r9, [rbp - 0x40]
lea r8, str.NoRestrictBDAppsOnUpdate
lea rcx, [rbp - 0x10]
call fcn.140008080
mov edx, eax
mov qword [rbp - 0x10], rsi
mov rcx, qword [0x1401b91e0]
mov rax, qword [rbp - 0x38]
cmp qword [rax + 8], rcx
jne 0x140124357
cmp dword [rbp - 0x40], 0
jne 0x140124357
test edx, edx
je 0x140124357
cmp byte [rbp + 0xa0], 0
je 0x1401243d4
lea rcx, [rbp + 0x80]
call fcn.140002e30
jmp 0x1401243d4
cmp byte [rbp + 0xa0], 0
je 0x14012437d
lea rcx, [rbp + 0x80]
call fcn.140002e30
jmp 0x14012437d
mov byte [rbp + 0xa0], 0
or dword [rsp + 0x40], 0x80
mov qword [rbp - 8], rsi
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str..DEFAULTSoftwareSetID_bd.update.configure
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401243d4
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1401243d4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rbp - 0x28]
call fcn.1400643d0
test al, al
je 0x140124d0c
lea rdx, [r14 + 0x4f8]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPrintPreviewToolBar::OnToolHitTest]
cmp byte [r14 + 0x580], 0
je 0x140124519
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x140124461
mov dword [rsp + 0x58], esi
call fcn.140005ad0
mov qword [rsp + 0x50], rax
lock inc dword [rsp + 0x58]
mov ebx, dword [rsp + 0x40]
or ebx, 1
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x50]
call fcn.140005a30
mov dword [rbp - 0x70], 0x20
lea rcx, str._oaaction_
mov qword [rsp + 0x28], rcx
lea rcx, [0x14017cb20]
mov qword [rsp + 0x20], rcx
lea r9, [0x140000000]
lea r8, [rbp - 0x70]
movsx edx, si
mov rcx, rax
call fcn.140004c90
jmp 0x140124465
mov ebx, dword [rsp + 0x40]
test bl, 1
je 0x1401244a0
and ebx, 0xfffffffe
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x50], rsi
mov eax, 0xffffffff
lock xadd dword [rsp + 0x58], eax
cmp eax, 1
js 0x14012449b
call fcn.140005e40
mov eax, 0xffffffff
lock xadd dword [rsp + 0x58], eax
cmp eax, 1
jns 0x140124486
lock inc dword [rsp + 0x58]
lea rcx, [rbp + 0x9c0]
call fcn.14005ae10
nop
mov rdx, rax
lea rcx, [rbp + 0xa60]
call fcn.14001edd0
lea rcx, [r14 + 0x470]
mov rdx, rax
call fcn.14001d6a0
lea rcx, [rbp + 0xa60]
call fcn.14001d620
nop
lea rcx, [rbp + 0xa18]
call fcn.140008e10
lea rcx, [rbp + 0xa00]
call fcn.140024b10
lea rcx, [rbp + 0x9e8]
call fcn.140024b90
lea rcx, [rbp + 0x9c0]
call fcn.140007160
lea rcx, [r14 + 0x578]
call fcn.140061040
jmp 0x140124d0c
cmp byte [r14 + 0x574], 0
je 0x1401245c3
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x140124592
mov dword [rbp + 8], esi
call fcn.140005ad0
mov qword [rbp], rax
lock inc dword [rbp + 8]
mov ebx, dword [rsp + 0x40]
or ebx, 2
mov dword [rsp + 0x40], ebx
lea rcx, [rbp]
call fcn.140005a30
mov dword [rbp - 0x6c], 0x20
lea rcx, str._systemshutdown_
mov qword [rsp + 0x28], rcx
lea rcx, [0x14017d370]
mov qword [rsp + 0x20], rcx
lea r9, [0x140000000]
lea r8, [rbp - 0x6c]
movsx edx, si
mov rcx, rax
call fcn.140004c90
jmp 0x140124596
mov ebx, dword [rsp + 0x40]
test bl, 2
je 0x1401245a4
lea rcx, [rbp]
call fcn.140005a60
mov edx, dword [r14 + 0x570]
mov ecx, dword [r14 + 0x56c]
call fcn.14002a380
mov dword [r14 + 0x4f4], eax
jmp 0x140124d0c
cmp dword [r14 + 0x540], 0
je 0x1401245e3
lea rcx, [r14 + 0x178]
call fcn.140055280
call fcn.14011bd30
jmp 0x140124d0c
mov qword [rbp + 0x268], rsi
lea r8, [rbp + 0x230]
lea rcx, [rbp - 0x58]
call fcn.140065700
nop
lea rcx, [rsp + 0x48]
call fcn.14002c8f0
nop
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14012461d
call fcn.14002ca70
test al, al
jne 0x1401246ea
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x14012468b
mov rcx, qword [rax]
test rcx, rcx
je 0x14012468b
movzx eax, byte [rcx + 0x28]
test al, al
jne 0x140124686
lea r8, [0x14017d3e0]
mov edx, 4
lea rcx, [rbp + 0x270]
call fcn.140005190
nop
cmp byte [rax + 0x80], 0
je 0x140124668
lea rdx, str.An_instance_is_already_trying_to_start_bdappsrv
mov rcx, rax
call fcn.1400062b0
nop
lea rcx, [rbp + 0x308]
call fcn.140004f20
lea rcx, [rbp + 0x308]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
jmp 0x140124cf7
mov rbx, qword [rsp + 0x48]
lea r8, [0x14017d470]
mov edx, 4
lea rcx, [rbp + 0x368]
call fcn.140005190
nop
cmp byte [rax + 0x80], 0
je 0x1401246bd
lea rdx, str.Bdappsrv_down__try_to_start_it
mov rcx, rax
call fcn.1400062b0
nop
lea rcx, [rbp + 0x400]
call fcn.140004f20
lea rcx, [rbp + 0x400]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rdx, [0x140163ad0]
call fcn.140124fe0
test al, al
je 0x140124cf7
lea rcx, [rbp + 0x50]
call fcn.14002c8f0
mov rcx, rax
lea rax, [rsp + 0x48]
cmp rax, rcx
je 0x14012472b
mov rax, qword [rcx]
mov qword [rcx], rsi
mov rdi, rbx
mov rbx, rax
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x14012472b
mov rcx, rdi
call fcn.14001d620
mov edx, 0x50
mov rcx, rdi
call fcn.14007e2a0
mov rdi, qword [rbp + 0x50]
test rdi, rdi
je 0x140124749
mov rcx, rdi
call fcn.14001d620
mov edx, 0x50
mov rcx, rdi
call fcn.14007e2a0
test rbx, rbx
je 0x1401249ce
call fcn.14005d610
test al, al
je 0x140124918
mov byte [rbp + 0x5c], 0
mov qword [rbp + 0x938], rsi
mov qword [rbp + 0x948], rsi
mov qword [rbp + 0x950], 0xf
mov byte [rbp + 0x938], 0
mov r8d, 0x26
lea rdx, str.53049091_A20F_40B2_B25F_1CD4378522FE
lea rcx, [rbp + 0x938]
call fcn.140007230
nop
lea rdx, str.bd::process_broker::client::spawn_process_with_current_params
lea rcx, [rbp + 0x14d0]
call fcn.140004cf0
nop
mov byte [rbp + 0x200], 0
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1e0]
lea r8, [rbp + 0x938]
lea rdx, [rbp + 0x1a8]
call fcn.14005c900
nop
lea rcx, [rbp + 0x14d0]
call fcn.140004e30
nop
mov rdx, qword [rbp + 0x950]
cmp rdx, 0x10
jb 0x14012482d
inc rdx
mov rcx, qword [rbp + 0x938]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140124828
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140124828
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007e2a0
mov qword [rbp + 0x948], rsi
mov qword [rbp + 0x950], 0xf
mov byte [rbp + 0x938], 0
cmp byte [rbp + 0x1d8], 0
jne 0x1401248de
lea rcx, [rbp + 0x1a8]
call fcn.140009590
cmp byte [rax + 4], 0
je 0x1401248de
lea r8, [0x14017d510]
mov edx, 0x10
lea rcx, [rbp + 0x460]
call fcn.140005190
mov rbx, rax
cmp byte [rax + 0x80], 0
je 0x140124898
lea rdx, str.spawned_process_with_pid:
mov rcx, rax
call fcn.140006540
lea rcx, [rbp + 0x1a8]
call fcn.140009590
cmp byte [rax + 4], 0
je 0x1401248ae
mov edx, dword [rax]
jmp 0x1401248b0
mov edx, esi
cmp byte [rbx + 0x80], 0
je 0x1401248c3
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
nop
lea rcx, [rbp + 0x4f8]
call fcn.140004f20
lea rcx, [rbp + 0x4f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
jmp 0x1401248eb
lea rdx, [0x140163ad0]
call fcn.140124fe0
nop
movsx rax, byte [rbp + 0x1d8]
add rax, 1
je 0x140124cf7
cmp rax, 1
je 0x140124cf7
lea rcx, [rbp + 0x1b8]
call fcn.140002e30
jmp 0x140124cf7
call fcn.14002ca70
test al, al
jne 0x1401249ce
cmp byte [r14 + 0x585], al
je 0x1401249f7
call fcn.1400638e0
mov edx, 0x10
test al, al
je 0x1401249a5
lea r8, [0x14017d5c0]
lea rcx, [rbp + 0x558]
call fcn.140005190
nop
lea rdx, str.create_instance_with_removed_privileges
mov rcx, rax
call fcn.140005f20
nop
lea rcx, [rbp + 0x558]
call fcn.140005160
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea rcx, [rbp + 0x998]
call fcn.140002b80
nop
lea rcx, [rbp + 0x998]
call fcn.140119220
mov esi, eax
lea rcx, [rbp + 0x998]
call fcn.140002e30
jmp 0x140124cf7
lea r8, [0x14017d640]
lea rcx, [rbp + 0x650]
call fcn.140005190
nop
mov rcx, rax
call fcn.140005f40
nop
lea rcx, [rbp + 0x650]
call fcn.140005160
lea r8, str.GlobalVSSERV_ONLINE_NOTIFIER_EVENT
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
je 0x140124a7d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140124bad
call fcn.1400638e0
test al, al
jne 0x1401249ce
lea r8, str.CSecurityCenterApp::InitInstance
mov edx, 0x10
lea rcx, [rbp + 0x748]
call fcn.140005190
nop
lea rdx, str.create_elevated_instance_of_seccenter
mov rcx, rax
call fcn.140005f20
nop
lea rcx, [rbp + 0x748]
call fcn.140005160
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea rcx, [rbp + 0x978]
call fcn.140002b80
nop
lea rdx, str._no_bdappsrv
lea rcx, [rbp + 0x978]
call fcn.140002b50
lea rcx, [rbp + 0x978]
call fcn.1401197c0
mov esi, eax
lea rcx, [rbp + 0x978]
call fcn.140002e30
jmp 0x140124cf7
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x140124af1
lea rcx, [rbp + 0x130]
call fcn.140005aa0
nop
mov edi, dword [rsp + 0x40]
or edi, 4
mov dword [rsp + 0x40], edi
mov rcx, rax
call fcn.140005a30
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x68], 4
mov dword [rsp + 0x30], eax
lea rax, str.Vsserv_is_down._Close._OpenEvent_res___d
mov qword [rsp + 0x28], rax
lea rax, [0x14017cf30]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x68]
movsx edx, si
mov rcx, rbx
call fcn.140004c90
jmp 0x140124af5
mov edi, dword [rsp + 0x40]
test dil, 4
je 0x140124b0e
and edi, 0xfffffffb
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x130]
call fcn.140005a60
lea rcx, [rbp - 0x58]
call fcn.140065b90
test al, al
jne 0x140124b55
lea r8, [0x14017cfd0]
mov edx, 4
lea rcx, [rbp + 0x840]
call fcn.140005190
nop
lea rdx, str.An_instance_is_already_trying_to_start_vsserv
mov rcx, rax
call fcn.140005f20
nop
lea rcx, [rbp + 0x840]
call fcn.140005160
jmp 0x140124cf7
lea rcx, [rbp + 0xb50]
call fcn.14005ae10
nop
mov rdx, rax
lea rcx, [rbp + 0xab0]
call fcn.14001edd0
lea rcx, [r14 + 0x470]
mov rdx, rax
call fcn.14001d6a0
lea rcx, [rbp + 0xab0]
call fcn.14001d620
nop
lea rcx, [rbp + 0xb50]
call fcn.140021f40
lea rdx, [0x140163af0]
call fcn.140124fe0
test al, al
je 0x140124cf7
call fcn.14011bd30
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov dword [r14 + 0x4f0], eax
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x140124c28
lea rcx, [rbp + 0x140]
call fcn.140005aa0
nop
mov ebx, dword [rsp + 0x40]
or ebx, 8
mov dword [rsp + 0x40], ebx
mov rcx, rax
call fcn.140005a30
mov dword [rbp - 0x64], 0x20
lea rcx, str._UILOAD__Seccenter_InitInstance
mov qword [rsp + 0x28], rcx
lea rcx, [0x14017d0b0]
mov qword [rsp + 0x20], rcx
lea r9, [0x140000000]
lea r8, [rbp - 0x64]
movsx edx, si
mov rcx, rax
call fcn.140004c90
jmp 0x140124c2c
mov ebx, dword [rsp + 0x40]
test bl, 8
je 0x140124c44
and ebx, 0xfffffff7
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x140]
call fcn.140005a60
mov rcx, r14
call qword [sym.imp.mfc140u.dll_COleDispatchImpl::GetTypeInfoCount]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
call fcn.14005a030
mov ebx, eax
mov edx, eax
lea rcx, [rbp + 0x70]
call fcn.140122150
nop
mov ecx, ebx
call fcn.1401276d0
lea rcx, [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
lea rdx, [0x14017d030]
lea rcx, [rbp + 0xc0]
call fcn.140032550
lea r8, [0x14017d120]
lea rdx, str.instance
lea rcx, [rbp + 0x10b0]
call fcn.140028200
nop
lea r8, str.Local173E4F6A_B9D4_4AE1_A6F7_DCB622EAA207
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
je 0x140124d77
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x10b0]
call fcn.140004e30
nop
lea rcx, [rbp + 0xc0]
call fcn.140032660
nop
lea rcx, [rbp + 0x70]
call fcn.1400673c0
nop
lea rcx, [rsp + 0x48]
call fcn.14002f0e0
nop
lea rcx, [rbp - 0x58]
call fcn.140065a80
nop
lea rcx, [rbp - 0x28]
call fcn.1400685b0
nop
cmp byte [rbp + 0xf0], 0
je 0x140124d2c
lea rcx, [rbp + 0xd0]
call fcn.140063870
nop
lea rcx, [rbp + 0x170]
call fcn.1400672f0
nop
cmp byte [rbp - 0x78], 0
je 0x140124d49
lea rcx, [rsp + 0x68]
call fcn.140002e30
mov eax, esi
mov rcx, qword [rbp + 0x1d10]
xor rcx, rsp
call fcn.14007e250
lea r11, [rsp + 0x1e20]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1401253a0
nop
mov rcx, r14
call fcn.140126170
test al, al
jne 0x140124cd3
call fcn.1401256c0
test al, al
jne 0x140124cd3
lea rcx, [r14 + 0x178]
call fcn.140055540
test eax, eax
jne 0x140124dd9
xor edx, edx
lea rcx, str.securitycenter
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140124cd3
xor r8d, r8d
lea rdx, [r14 + 0x4f8]
mov rcx, rax
call fcn.1400e3130
jmp 0x140124cd3
lea rcx, [rbp + 0x10b0]
call fcn.140004e30
call fcn.1400b3c00
lea rdx, [0x140142e90]
mov ecx, 0x908
call fcn.14007e940
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140124e0e
mov rcx, rax
call fcn.140104570
jmp 0x140124e11
mov rax, rsi
mov qword [r14 + 0x1c0], rax
test rax, rax
jne 0x140124ea6
mov ecx, dword [0x1401c1658]
mov eax, dword [0x1401c165c]
add ecx, eax
je 0x140124e88
lea rcx, [rbp + 0x150]
call fcn.140005aa0
nop
mov ebx, dword [rsp + 0x40]
or ebx, 0x10
mov dword [rsp + 0x40], ebx
mov rcx, rax
call fcn.140005a30
mov dword [rbp - 0x60], 4
lea rcx, str.Out_of_memory__QUIT.
mov qword [rsp + 0x28], rcx
lea rcx, [0x14017d1c0]
mov qword [rsp + 0x20], rcx
lea r9, [0x140000000]
lea r8, [rbp - 0x60]
movsx edx, si
mov rcx, rax
call fcn.140004c90
jmp 0x140124e8c
mov ebx, dword [rsp + 0x40]
test bl, 0x10
je 0x140124ce0
lea rcx, [rbp + 0x150]
call fcn.140005a60
jmp 0x140124ce0
cmp qword [r14 + 0x470], 0
jne 0x140124ef4
lea rcx, [rbp + 0xbf0]
call fcn.14005ae10
nop
mov rdx, rax
lea rcx, [rbp + 0xb00]
call fcn.14001edd0
mov rdx, rax
lea rcx, [r14 + 0x470]
call fcn.14001d6a0
lea rcx, [rbp + 0xb00]
call fcn.14001d620
nop
lea rcx, [rbp + 0xbf0]
call fcn.140021f40
mov qword [rbp + 0x78], r14
lea rax, [0x140122a50]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], esi
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x160], xmm0
lea r8, [rbp + 0x78]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x60]
call fcn.14006b670
nop
lea r8, [0x14017d290]
lea rdx, str.hook_setup
lea rcx, [rbp + 0x18f0]
call fcn.140028200
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
xor r8d, r8d
lea rdx, [0x140120d60]
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [r14 + 0x5b0], rax
lea rcx, [rbp + 0x18f0]
call fcn.140004e30
lea r8, [0x14017d300]
lea rdx, str.init_services
lea rcx, [rbp + 0xc90]
call fcn.140028200
nop
cmp dword [rbp + 0x68], 0
je 0x140124f9b
lea rcx, [rbp + 0x60]
call fcn.140005350
movzx eax, byte [r14 + 0x469]
lea rcx, [rbp + 0xc90]
test al, al
jne 0x140124fb5
call fcn.140004e30
jmp 0x140124fbf
call fcn.140004e30
mov esi, 1
cmp dword [rbp + 0x68], 0
je 0x140124ce0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3