Function at 0x140046708
Capabilities:
Query service status
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rbp + 0x128], rax
mov rdi, rdx
xor r13d, r13d
mov dword [rbp - 0x70], r13d
test rcx, rcx
je 0x140049007
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
lea r8, [rdx + 8]
lea rdx, [rcx - 1]
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.1400f62c8
mov ebx, eax
test eax, eax
js 0x140049012
mov rsi, qword [0x14016b540]
mov rcx, qword [rsp + 0x40]
mov qword [0x14016b540], rcx
mov qword [rbp + 0xb0], rsi
mov rbx, qword [rdi]
movzx eax, word [rbx]
sub ax, 0x2d
mov edx, 0xfffd
lea edi, [r13 + 2]
test dx, ax
jne 0x1400467ab
add rbx, rdi
mov rax, qword [rcx]
lea rdx, [0x14011d168]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x1400467cd
call fcn.1400497c0
jmp 0x1400469a5
mov dword [rbp - 0x40], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp - 0x40]
xor edx, edx
lea rcx, str.MpCmdRun_Assert
mov rax, qword [rax + 0xa0]
call fcn.1400fece0
nop
mov ecx, dword [rbp - 0x40]
test eax, eax
cmovs ecx, r13d
mov dword [rbp - 0x40], ecx
test ecx, ecx
je 0x140046807
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov qword [rsp + 0x48], r13
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.MpCmdRunWithTracing
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x140046853
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140046844
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call fcn.1400fece0
mov qword [rsp + 0x48], r13
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140064034
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.RestrictPrivileges
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov r14d, 1
lea r12, str.Reinvoke
test rax, rax
je 0x14004692c
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, r12
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
jne 0x14004692c
lea rdx, str.SignaturesUpdateService
mov rcx, rbx
call fcn.140005abc
test eax, eax
je 0x14004692c
lea rdx, str.SignatureUpdate
mov rcx, rbx
call fcn.140005abc
test eax, eax
je 0x14004692c
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.WaitForCompletion
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov dword [rbp - 0x28], r13d
test rax, rax
je 0x1400468ee
lea rdx, [rbp - 0x28]
mov dil, r14b
jmp 0x1400468f4
mov dil, r13b
mov rdx, r13
movzx ecx, dil
call fcn.140050378
test dil, dil
je 0x140046923
test eax, eax
js 0x140048edb
mov eax, dword [rbp - 0x28]
test eax, eax
jle 0x14004691b
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140048edb
jmp 0x14004698e
test eax, eax
jns 0x14004698e
mov edi, 2
lea rdx, str.Scan
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400469fc
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.ReturnHR
mov rax, qword [rax + 0x18]
call fcn.1400fece0
movzx ecx, byte [0x140169eec]
test rax, rax
cmovne ecx, r14d
mov byte [0x140169eec], cl
mov rcx, qword [rsp + 0x40]
call fcn.14004c368
cmp byte [0x140169eec], r13b
je 0x14004698e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400469a5
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call fcn.1400fece0
nop
mov qword [0x14016b540], rsi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400469bc
call fcn.140030c60
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400469d2
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call fcn.1400fece0
mov rcx, qword [rbp + 0x128]
xor rcx, rsp
call fcn.140030c40
mov rbx, qword [rsp + 0x280]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.SignatureUpdate
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046a42
call fcn.1400ed814
test al, al
je 0x140046a33
call fcn.1400ed7cc
cmp eax, r14d
jne 0x140046a33
lea rcx, str.A_process_other_than_WinDefend_attempted_to_trigger_a_signature_update_during_a_MOCAMP_update__rejecting_attempt_n
call fcn.1400ec5f0
jmp 0x14004698e
mov rcx, qword [rsp + 0x40]
call fcn.14004ecbc
jmp 0x14004698e
lea rdx, str.SignatureUpdateAndQuickScan
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046b47
call fcn.1400ed814
test al, al
je 0x140046a6c
call fcn.1400ed7cc
cmp eax, r14d
je 0x140046a22
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140046a9a
test byte [rcx + 0x1c], 4
je 0x140046a9a
mov edx, 0x1f
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
mov rcx, qword [rsp + 0x40]
call fcn.14004ecbc
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140046acb
test byte [rcx + 0x1c], 4
je 0x140046acb
mov edx, 0x20
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x50], r13
lea rax, str._ScanType
mov qword [rbp + 0xa0], rax
lea rax, [0x14011d3d4]
mov qword [rbp + 0xa8], rax
lea r9, [rbp + 0x50]
lea r8, [rbp + 0xa0]
mov rdx, rdi
lea rcx, [rbp + 0x18]
call fcn.1400f62c8
mov edi, eax
test eax, eax
js 0x140049030
mov rcx, qword [rbp + 0x18]
call fcn.14004c368
nop
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140046b29
call fcn.140030c60
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14004698e
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call fcn.1400fece0
jmp 0x14004698e
lea rdx, [0x14011d3d8]
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046b9f
call fcn.1400ed910
test al, al
jne 0x140046b95
mov dword [rbp - 0x24], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rcx, [rbp - 0x24]
mov rax, qword [rax + 0x98]
call fcn.1400fece0
nop
test eax, eax
js 0x14004905f
cmp dword [rbp - 0x24], r13d
je 0x14004905f
call fcn.1400ecd94
call fcn.1400768cc
jmp 0x14004698e
lea rdx, str.getfiles
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046d0c
call fcn.1400ecd94
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call fcn.1400fece0
mov r15, rax
mov rcx, qword [rsp + 0x40]
mov r8, qword [rcx]
mov rdx, r12
mov rax, qword [r8 + 0x18]
call fcn.1400fece0
test rax, rax
je 0x140046beb
sub r15, r14
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.SupportLogLocation
mov rax, qword [rax + 0x18]
call fcn.1400fece0
mov rdi, rax
mov r8, rax
mov rdx, rax
test rax, rax
setne r12b
test rax, rax
je 0x140046c24
movzx eax, word [rax]
neg ax
sbb rcx, rcx
and rdi, rcx
cmp r15, r14
ja 0x140048f69
test rdx, rdx
jne 0x140046c3b
test r15, r15
jne 0x140048f69
test r8, r8
je 0x140046c49
cmp r15, r14
jne 0x140048f69
call fcn.140046268
test al, al
jne 0x140046cfa
cmp r15, r14
jne 0x140046cca
mov qword [rbp + 0x20], r13
lea r8, [0x1401178d4]
test rdi, rdi
cmovne r8, rdi
lea rdx, str.GetFiles__SupportLogLocation__ls
lea rcx, [rbp + 0x20]
call fcn.1400f23a4
mov edi, eax
test eax, eax
js 0x140049076
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x20]
call fcn.140046450
test eax, eax
js 0x1400490bd
mov eax, dword [rbp - 0x70]
test eax, eax
jle 0x140046cad
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x1400490bd
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14004698e
call fcn.140030c60
jmp 0x14004698e
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.140046450
test eax, eax
js 0x140048ee3
mov eax, dword [rbp - 0x70]
test eax, eax
jle 0x140046cef
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140048ee3
jmp 0x14004698e
mov r8, rdi
mov dl, r12b
xor ecx, ecx
call fcn.14005a074
jmp 0x14004698e
lea rdx, str.getfilesdiagtrack
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046da7
call fcn.1400ecd94
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call fcn.1400fece0
mov rdi, rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x18]
mov rdx, r12
call fcn.1400fece0
test rax, rax
je 0x140046d58
sub rdi, r14
test rdi, rdi
jne 0x140048f69
call fcn.140046268
test al, al
jne 0x140046d9a
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.140046450
test eax, eax
js 0x140048eeb
mov eax, dword [rbp - 0x70]
test eax, eax
jle 0x140046d8f
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140048eeb
jmp 0x14004698e
xor r8d, r8d
xor edx, edx
mov cl, r14b
jmp 0x140046d02
lea rdx, str.WriteLogsForSvc
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046e09
call fcn.1400ecd94
mov ecx, r14d
call fcn.1400df5cc
test eax, eax
jns 0x14004698e
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140046dfd
test byte [rcx + 0x1c], r14b
je 0x140046dfd
mov edx, 0x94
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
lea rcx, str.ERROR:_Dumping_Log_Failed
jmp 0x140046a29
lea rdx, str.SpyNetService
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046e2d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.1400648e4
jmp 0x14004698e
lea rdx, str.SpyNetServiceDss
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046e45
mov dl, r14b
jmp 0x140046e1e
lea rdx, str.SampleHeaderService
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046e85
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.HighPriority
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne dl
mov rcx, qword [rsp + 0x40]
call fcn.140074f20
jmp 0x14004698e
lea rdx, str.SignaturesUpdateService
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046ec6
call fcn.1400ed814
test al, al
je 0x140046eb7
call fcn.1400ed7cc
cmp eax, r14d
jne 0x140046eb7
lea rcx, str.A_process_other_than_WinDefend_attempted_to_create_a_signature_update_service_during_a_MOCAMP_update__rejecting_attempt_n
jmp 0x140046a29
mov rcx, qword [rsp + 0x40]
call fcn.14006507c
jmp 0x14004698e
lea rdx, str.ClearClipboard
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046ee3
call fcn.1400493ec
jmp 0x14004698e
lea rdx, str.GetLoadLibraryWAddress32
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046f0d
mov rcx, qword [rsp + 0x40]
call fcn.14004951c
test eax, eax
js 0x140048ef3
jmp 0x14004698e
lea rdx, str.GetLoadLibraryWAddress
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046f37
mov rcx, qword [rsp + 0x40]
call fcn.14004951c
test eax, eax
js 0x140048efb
jmp 0x14004698e
lea rdx, str.RemoveDefinitions
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046f5e
call fcn.1400ecd94
mov rcx, qword [rsp + 0x40]
call fcn.14004e7bc
jmp 0x14004698e
lea rdx, str.Trace
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140046f82
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.140064034
jmp 0x14004698e
lea rdx, str.CaptureNetworkTrace
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047039
call fcn.1400ecd94
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.path
mov rax, qword [rax + 0x18]
call fcn.1400fece0
lea rbx, [0x1401178d4]
test rax, rax
cmovne rbx, rax
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpNetworkCapture]
mov edi, eax
test eax, eax
jns 0x140046ff4
mov edx, eax
lea rcx, str.Failed_to_start_network_trace__Error__lx_n
call fcn.1400ec5f0
mov edx, edi
lea rcx, str.Failed_to_start_network_trace__Error__lx_n
call fcn.14004aaf4
jmp 0x14004698e
cmp edi, r14d
jne 0x140047016
lea rcx, str.Successfully_stopped_Network_Capture_n
call fcn.1400ec5f0
lea rcx, str.Successfully_stopped_Network_Capture_n
call fcn.14004aaf4
jmp 0x14004698e
mov rdx, rbx
lea rcx, str.Successfully_started_Network_Capture__capturing_to__ws_n
call fcn.1400ec5f0
mov rdx, rbx
lea rcx, str.Successfully_started_Network_Capture__capturing_to__ws_n
call fcn.14004aaf4
jmp 0x14004698e
lea rdx, str.RestoreDefaults
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047063
call fcn.1400ecd94
call fcn.1400647ac
test eax, eax
js 0x140048f03
jmp 0x14004698e
lea rdx, str.UnregisterWSC
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047085
mov rcx, qword [rsp + 0x40]
call fcn.140066a68
jmp 0x14004698e
lea rdx, str.IdleTask
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400470d0
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
lea rdx, str.TaskName
mov rcx, rbx
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x1400490c5
or r8d, 0xffffffff
mov rdx, rax
mov rcx, rbx
call fcn.14006957c
jmp 0x14004698e
lea rdx, str.BuildSFC
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400470f2
mov rcx, qword [rsp + 0x40]
call fcn.1400693c0
jmp 0x14004698e
lea rdx, str.Restore
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047119
call fcn.1400ecd94
mov rcx, qword [rsp + 0x40]
call fcn.14006b944
jmp 0x14004698e
lea rdx, str.ServiceHardening
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x14004713b
call fcn.1400ecd94
call fcn.14006d0b0
jmp 0x14004698e
lea rdx, str.AddDynamicSignature
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047162
call fcn.1400ecd94
mov rcx, qword [rsp + 0x40]
call fcn.14004e380
jmp 0x14004698e
lea rdx, str.RemoveDynamicSignature
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047189
call fcn.1400ecd94
mov rcx, qword [rsp + 0x40]
call fcn.14004eb04
jmp 0x14004698e
lea rdx, str.ListAllDynamicSignatures
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400471ab
call fcn.1400ecd94
call fcn.14004e5d8
jmp 0x14004698e
lea rdx, str.DisableService
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400471f3
call fcn.1400ecd94
call fcn.1400ed814
test al, al
je 0x1400471e2
call fcn.1400ed7cc
cmp eax, r14d
jne 0x1400471e2
lea rcx, str.A_process_other_than_WinDefend_attempted_to_disable_the_service_during_a_MOCAMP_update__rejecting_attempt_n
jmp 0x140046a29
mov edx, 3
xor ecx, ecx
call fcn.14006cb08
jmp 0x14004698e
lea rdx, str.StopService
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047210
call fcn.1400ecd94
mov edx, r14d
jmp 0x1400471e7
lea rdx, str.UninstallServices
mov rcx, rbx
call fcn.140005abc
test eax, eax
je 0x140048ea7
lea rdx, str.MitigateServices
mov rcx, rbx
call fcn.140005abc
test eax, eax
je 0x140048ea7
lea rdx, str.PreloadMpSvc
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x14004726f
mov byte [0x140169eec], r14b
call fcn.1400ecd94
call fcn.140042b34
test eax, eax
js 0x140048f0b
jmp 0x14004698e
lea rdx, str.EnableService
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400472b3
call fcn.1400ecd94
call fcn.1400ed814
test al, al
je 0x1400472a6
call fcn.1400ed7cc
cmp eax, r14d
jne 0x1400472a6
lea rcx, str.A_process_other_than_WinDefend_attempted_to_enable_the_service_during_a_MOCAMP_update__rejecting_attempt_n
jmp 0x140046a29
mov edx, 3
mov ecx, r14d
jmp 0x1400471e9
lea rdx, str.RestartService
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400472f9
call fcn.1400ecd94
call fcn.1400ed814
test al, al
je 0x1400472ea
call fcn.1400ed7cc
cmp eax, r14d
jne 0x1400472ea
lea rcx, str.A_process_other_than_WinDefend_attempted_to_restart_the_service_during_a_MOCAMP_update__rejecting_attempt_n
jmp 0x140046a29
mov edx, r14d
xor ecx, ecx
call fcn.14006cb08
mov edx, r14d
jmp 0x1400472ab
lea rdx, str.ReloadEngine
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047390
mov dword [rbp + 0xb8], 0xd8b08b2d
mov dword [rbp + 0xbc], 0x4174215a
mov dword [rbp + 0xc0], 0xe83055ab
mov dword [rbp + 0xc4], 0x8781b424
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 4], eax
mov dword [rbp], r13d
mov qword [rbp + 0x58], r13
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp + 4]
mov edx, 4
lea rcx, [rbp + 0xb8]
call fcn.1400df8c4
mov ebx, eax
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14004737c
call qword [sym.imp.mpclient.dll_MpFreeMemory]
test ebx, ebx
js 0x14004910a
lea rcx, str.MpReloadEngine_finished._n
jmp 0x140046a29
lea rdx, str.EnableSxSMode
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047550
lea rcx, str.EnableSxSMode_n
call fcn.1400ec5f0
mov qword [rbp - 8], r13
lea rcx, [rbp - 8]
call fcn.1400c1ab4
test eax, eax
jns 0x1400473eb
mov edx, eax
lea rcx, str.ERROR:_MpGetProductServiceName_failed._hr___lx_n
call fcn.1400ec5f0
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14004698e
call qword [sym.imp.mpclient.dll_MpFreeMemory]
jmp 0x14004698e
mov r8d, r14d
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
jne 0x14004742d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14004741d
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x14004742d
mov edx, eax
lea rcx, str.OpenSCManager_failed._hr___lx_n
call fcn.1400ec5f0
mov r8d, 4
mov rdx, qword [rbp - 8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rbp + 0x90], rax
test rax, rax
jne 0x140047473
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140047463
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x140047473
mov edx, eax
lea rcx, str.OpenService_failed._hr___lx_n
call fcn.1400ec5f0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rax
mov dword [rbp + 0x120], eax
lea rdx, [rbp + 0x108]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400474c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400474b4
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1400474c4
mov edx, eax
lea rcx, str.QueryServiceStatus_failed._hr___lx_n
call fcn.1400ec5f0
cmp dword [rbp + 0x10c], r14d
jne 0x140049120
mov qword [rbp + 0x28], r13
lea rdx, [rbp + 0x28]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
test eax, eax
jns 0x1400474f3
mov edx, eax
lea rcx, str.MpManagerOpen_failed._hr___lx_n
call fcn.1400ec5f0
mov edx, 4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.mpclient.dll_MpManagerEnable]
mov r14d, eax
test eax, eax
js 0x140049137
lea rcx, str.Service_was_successfully_enabled_in_side_by_side_passive_mode._n
call fcn.1400ec5f0
nop
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14004752a
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
test rdi, rdi
je 0x140047539
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rbx, rbx
je 0x1400473d3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400473d3
lea rdx, str.WDEnable
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400475d0
lea rcx, str.WDEnable_n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
call fcn.1400e5fcc
test eax, eax
jne 0x1400475b1
mov cl, r14b
call fcn.1400496c8
test al, al
jne 0x1400475b1
mov dl, r14b
xor ecx, ecx
call fcn.1400665b0
test eax, eax
jns 0x1400475a9
mov edx, eax
lea rcx, str.ERROR:_RunCommandCollectWscInfo___failed___lx__n
call fcn.1400ec5f0
jmp 0x1400475b1
mov cl, r14b
call fcn.1400495f4
mov ecx, r14d
call qword [sym.imp.mpclient.dll_MpWDEnable]
mov ebx, eax
test eax, eax
js 0x14004914f
lea rcx, str.MpWDEnable_TRUE__finished._n
jmp 0x140046a29
lea rdx, str.WDDisable
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400476be
lea rcx, str.WDDisable_n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
mov dword [rbp - 0x50], r13d
lea r8, [rbp - 0x50]
call fcn.1400dfce4
mov ebx, eax
test eax, eax
jns 0x14004761b
mov edx, eax
lea rcx, str.ERROR:_CheckClientIdentity___failed___lx__n
call fcn.1400ec5f0
mov dword [rbp - 0x3c], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp - 0x3c]
xor edx, edx
lea rcx, str.MpCmdRun_DisableIdentityCheck
mov rax, qword [rax + 0xa0]
call fcn.1400fece0
nop
mov ecx, dword [rbp - 0x3c]
test eax, eax
cmovs ecx, r13d
mov dword [rbp - 0x3c], ecx
test ecx, ecx
je 0x140047654
mov eax, r14d
jmp 0x14004765f
test ebx, ebx
js 0x140049165
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x14004916d
call fcn.1400e5fcc
test eax, eax
jne 0x1400476a0
xor ecx, ecx
call fcn.1400496c8
test al, al
jne 0x1400476a0
mov dl, r14b
xor ecx, ecx
call fcn.1400665b0
test eax, eax
jns 0x140047699
mov edx, eax
lea rcx, str.ERROR:_RunCommandCollectWscInfo___failed___lx__n
call fcn.1400ec5f0
jmp 0x1400476a0
xor ecx, ecx
call fcn.1400495f4
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpWDEnable]
mov ebx, eax
test eax, eax
js 0x140049184
lea rcx, str.MpWDEnable_FALSE__finished._n
jmp 0x140046a29
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400476e3
mov rax, qword [rcx]
lea rdx, str.Force
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
mov dil, r14b
jne 0x1400476e6
mov dil, r13b
lea r15, str.ResetPlatform
mov rdx, r15
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400477b8
mov rdx, r15
lea rcx, str._ls_n
call fcn.1400ec5f0
call fcn.140046320
test al, al
je 0x140047744
test dil, dil
jne 0x14004772d
mov rcx, r15
call fcn.1400463cc
test al, al
je 0x14004698e
call fcn.140045c04
test eax, eax
jns 0x140047744
mov edx, eax
lea rcx, str.ERROR:_Failed_to_disable_TS_mode___lx__n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
mov qword [rbp - 0x18], r13
lea rcx, [rbp - 0x18]
call fcn.1400f2930
mov ebx, eax
test eax, eax
js 0x14004919a
mov rcx, qword [rbp - 0x18]
call fcn.140042e6c
mov ebx, eax
test eax, eax
jne 0x140047796
lea rcx, str.ResetPlatform_returned_successfully._n
call fcn.14004a438
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14004698e
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14004698e
cmp eax, r14d
jne 0x1400477a4
lea rcx, str.Already_running_inbox_binaries._n
jmp 0x140047778
cmp eax, 0x8000000a
jne 0x14004919a
lea rcx, str.ResetPlatform_returned_PENDING._Please_reboot_your_machine_to_reset_to_inbox_binaries._n
jmp 0x140047778
lea r15, str.RevertPlatform
mov rdx, r15
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x14004787b
mov rdx, r15
lea rcx, str._ls_n
call fcn.1400ec5f0
call fcn.140046320
test al, al
je 0x140047816
test dil, dil
jne 0x1400477ff
mov rcx, r15
call fcn.1400463cc
test al, al
je 0x14004698e
call fcn.140045c04
test eax, eax
jns 0x140047816
mov edx, eax
lea rcx, str.ERROR:_Failed_to_disable_TS_mode___lx__n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
lea rcx, [0x1401178d4]
call qword [sym.imp.mpclient.dll_MpUpdatePlatform]
mov ebx, eax
test eax, eax
jne 0x140047841
lea rcx, str.MpUpdatePlatform_returned_successfully.
call fcn.14004a438
jmp 0x14004698e
cmp ebx, r14d
jne 0x14004784f
lea rcx, str.Revert_not_needed._Already_running_inbox_binaries.
jmp 0x140047837
cmp ebx, 0x8000000a
jne 0x140047860
lea rcx, str.MpUpdatePlatform_returned_PENDING._Please_reboot_your_machine_for_the_revert_to_take_place.
jmp 0x140047837
mov edx, ebx
lea rcx, str.ERROR:_MpUpdatePlatform_failed___lx__n
call fcn.1400ec5f0
test ebx, ebx
js 0x140048f13
jmp 0x14004698e
lea r15, str.RollbackPlatform
mov rdx, r15
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x14004793f
mov rdx, r15
lea rcx, str._ls_n
call fcn.1400ec5f0
call fcn.140046320
test al, al
je 0x1400478d9
test dil, dil
jne 0x1400478c2
mov rcx, r15
call fcn.1400463cc
test al, al
je 0x14004698e
call fcn.140045c04
test eax, eax
jns 0x1400478d9
mov edx, eax
lea rcx, str.ERROR:_Failed_to_disable_TS_mode___lx__n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
call qword [sym.imp.mpclient.dll_MpRollbackPlatform]
mov ebx, eax
test eax, eax
jne 0x140047904
lea rcx, str.MpRollbackPlatform_returned_successfully._n
call fcn.14004a438
lea rcx, str.MpRollbackPlatform_returned_successfully.
jmp 0x140046a29
cmp ebx, 0x8000000a
jne 0x140047924
lea rcx, str.MpRollbackPlatform_returned_PENDING._Please_reboot_your_machine_to_rollback_to_the_last_known_good_platform._n
call fcn.14004a438
lea rcx, str.MpRollbackPlatform_returned_E_PENDING.
jmp 0x140046a29
mov edx, ebx
lea rcx, str.ERROR:_MpRollbackPlatform_failed___lx__n
call fcn.1400ec5f0
test ebx, ebx
js 0x140048f1b
jmp 0x14004698e
lea rdx, str.UnblockPlatform
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047a11
lea rcx, str.UnblockPlatform_n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x14011e8c0]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x14004798e
mov rax, r13
mov ecx, r14d
jmp 0x1400479b0
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x40]
call fcn.1400f69ec
test rax, rax
je 0x1400479e6
mov ecx, r13d
cmp word [rax], r13w
je 0x1400479e6
mov rdx, rax
call qword [sym.imp.mpclient.dll_MpUnblockPlatform]
mov ebx, eax
test eax, eax
jne 0x1400479cb
lea rcx, str.MpUnblockPlatform_returned_successfully.
jmp 0x140047837
mov edx, ebx
lea rcx, str.ERROR:_MpUnblockPlatform_failed___lx__n
call fcn.1400ec5f0
test ebx, ebx
js 0x140048f23
jmp 0x14004698e
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048f69
test byte [rcx + 0x1c], r14b
je 0x140048f69
mov edx, 0x23
jmp 0x140048f59
lea rdx, str.UnblockEngine
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047ae3
lea rcx, str.UnblockEngine_n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x14011e8c0]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x140047a60
mov rax, r13
mov ecx, r14d
jmp 0x140047a82
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x40]
call fcn.1400f69ec
test rax, rax
je 0x140047ab8
mov ecx, r13d
cmp word [rax], r13w
je 0x140047ab8
mov rdx, rax
call qword [sym.imp.mpclient.dll_MpUnblockEngine]
mov ebx, eax
test eax, eax
jne 0x140047a9d
lea rcx, str.MpUnblockEngine_returned_successfully.
jmp 0x140047837
mov edx, ebx
lea rcx, str.ERROR:_MpUnblockEngine_failed___lx__n
call fcn.1400ec5f0
test ebx, ebx
js 0x140048f2b
jmp 0x14004698e
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048f69
test byte [rcx + 0x1c], r14b
je 0x140048f69
mov edx, 0x24
jmp 0x140048f59
lea rdx, str.UnblockSignatures
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047b92
lea rcx, str.UnblockSignatures_n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x14011e8c0]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
je 0x140047b32
mov rax, r13
mov ecx, r14d
jmp 0x140047b5c
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x40]
call fcn.1400f69ec
test rax, rax
je 0x140048f3b
mov ecx, r13d
cmp word [rax], r13w
je 0x140048f3b
mov rdx, rax
call qword [sym.imp.mpclient.dll_MpUnblockSignatures]
mov ebx, eax
test eax, eax
jne 0x140047b77
lea rcx, str.MpUnblockSignatures_returned_successfully.
jmp 0x140047837
mov edx, ebx
lea rcx, str.ERROR:_MpUnblockSignatures_failed___lx__n
call fcn.1400ec5f0
test ebx, ebx
js 0x140048f33
jmp 0x14004698e
lea rdx, str.ValidateMapsConnection
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047db5
lea rcx, str.ValidateMapsConnection_n
call fcn.1400ec5f0
mov byte [0x140169eec], r14b
lea rcx, [0x14011ceb0]
call fcn.1400ec618
mov byte [rsp + 0x68], r13b
lea rcx, [rsp + 0x68]
call fcn.1400c33e4
lea r8, str.true
lea rcx, str.false
cmp byte [rsp + 0x68], r13b
cmove r8, rcx
mov edx, eax
lea rcx, str.MpIsConnectedToInternet__:_hr___lx__fIsConnectToInternet:__ls_n
call fcn.1400ec618
call fcn.1400c36f4
mov edx, eax
lea rcx, str.MpIsPaidNetwork__:_hr___lx__0___S_OK__paid__1___S_FALSE__not_paid__other___failure__n
call fcn.1400ec618
lea rcx, [0x14011d0a0]
call fcn.1400ec618
mov qword [rbp + 0x60], r13
lea r8, str.LastMAPSSuccessTime
lea rdx, str.SpyNet
lea rcx, [rbp + 0x60]
call fcn.1400c0a34
test eax, eax
js 0x140047d20
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0xf8], xmm1
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140047cf0
lea r8, [rbp + 0xf8]
lea rdx, [rbp + 0xe8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x140047cf0
mov qword [rbp + 0x30], r13
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x30]
call fcn.1400c1fcc
test eax, eax
js 0x140047caf
mov rdx, qword [rbp + 0x30]
lea rcx, str.Last_Successful_MAPS_connection:___ls__n
call fcn.1400ec618
jmp 0x140047ce0
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140047ce0
test byte [rcx + 0x1c], r14b
je 0x140047ce0
mov edx, 0x26
mov r9d, eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140047d51
call fcn.140030c60
jmp 0x140047d51
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140047d51
test byte [rcx + 0x1c], r14b
je 0x140047d51
mov edx, 0x27
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
jmp 0x140047d51
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140047d51
test byte [rcx + 0x1c], r14b
je 0x140047d51
mov edx, 0x28
mov r9d, eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov dword [rbp - 0x38], r13d
mov dword [rbp - 0x20], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
mov rax, qword [rax + 0x178]
call fcn.1400fece0
mov ebx, eax
test eax, eax
js 0x1400491b0
mov edx, dword [rbp - 0x38]
test edx, edx
jne 0x140047d95
lea rcx, str.ValidateMapsConnection_successfully_established_a_connection_to_MAPS_n
call fcn.1400ec618
jmp 0x14004698e
mov r8d, dword [rbp - 0x20]
lea rcx, str.ValidateMapsConnection_failed_to_establish_a_connection_to_MAPS__hr_lx_httpcode_ld__n
call fcn.1400ec618
mov ecx, dword [rbp - 0x38]
test ecx, ecx
js 0x140048f74
jmp 0x14004698e
lea rdx, str.DownloadOfflineScanner
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047dd7
mov rcx, qword [rsp + 0x40]
call fcn.14006f6a0
jmp 0x14004698e
lea rdx, str.SubmitSamples
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047df9
mov rcx, qword [rsp + 0x40]
call fcn.1400700f4
jmp 0x14004698e
lea rdx, str.GetDeviceTicket
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047e1b
mov rcx, qword [rsp + 0x40]
call fcn.14007312c
jmp 0x14004698e
lea rdx, str.Roles
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047e38
call fcn.14006ec5c
jmp 0x14004698e
lea rdx, str.RevokeTrustedUsn
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047e5a
mov rcx, qword [rsp + 0x40]
call fcn.1400756dc
jmp 0x14004698e
lea rdx, str.CheckExclusion
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140047fce
xor r8d, r8d
lea rdx, str.path
mov rcx, qword [rsp + 0x40]
call fcn.1400f69ec
mov rbx, rax
test rax, rax
je 0x140048f69
mov qword [rbp + 0x40], r13
lea rdx, [rbp + 0x40]
lea rcx, str.Real_Time_Protection
call qword [sym.imp.mpclient.dll_MpConfigOpen]
test eax, eax
js 0x1400491c6
mov qword [rbp + 0x38], r13
mov ecx, 2
mov dword [rbp + 0xc], ecx
mov dword [rbp + 8], r13d
mov qword [rsp + 0x28], r13
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 8]
lea r8, [rbp + 0xc]
lea rdx, str.IncludedLocalDriveLetters
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
test eax, eax
js 0x1400491ce
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x140047f08
cmp word [rdx], r13w
je 0x140047f08
lea rcx, str.WARNING:_Drive_letter_inclusion___ls__detected._The_exclusion_check_result_below_is_no_longer_accurate._n
call fcn.1400ec618
mov rdx, rbx
lea rcx, str.Validating_path___ls__..._n
call fcn.1400ec5f0
mov qword [rbp - 0x10], r13
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.1400c3bcc
test eax, eax
js 0x1400491d6
mov dword [rbp - 0x50], r13d
mov rdx, qword [rbp - 0x10]
lea rcx, str.Calling_into_service_to_check_exclusion_for___ls__..._n
call fcn.1400ec5f0
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x10]
call fcn.1400df714
test eax, eax
js 0x1400491de
mov ecx, dword [0x140169ee8]
mov eax, dword [rbp - 0x50]
test eax, eax
cmove ecx, r14d
mov dword [0x140169ee8], ecx
lea r9, str.excluded
lea rdx, str.not_excluded
cmove r9, rdx
mov dword [rsp + 0x20], ecx
mov r8, qword [rbp - 0x10]
mov rdx, rbx
lea rcx, str._ls___ls__is__ls._Exit_code_is__ld._n
call fcn.1400ec618
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140047fa6
call fcn.140030c60
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140047fb6
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14004698e
call qword [sym.imp.mpclient.dll_MpConfigClose]
jmp 0x14004698e
lea rdx, str.PerformanceReport
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048006
mov rcx, qword [rsp + 0x40]
call fcn.140095cc8
test eax, eax
jns 0x14004698e
mov edx, eax
lea rcx, str.Call_to_RunCommandMpPerformanceReport_failed_hr___lx_n
call fcn.1400ec5f0
jmp 0x14004698e
lea rdx, str.TPState
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048096
call fcn.140046320
test al, al
je 0x1400491e6
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x14011f1dc]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne bl
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x14011f1e8]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne al
test bl, bl
je 0x140048070
test al, al
jne 0x140048f7a
jmp 0x14004807f
neg al
sbb eax, eax
not eax
mov r14d, 2
and r14d, eax
mov ecx, r14d
call fcn.1400a05a8
mov ebx, eax
test eax, eax
js 0x140048f91
jmp 0x14004698e
lea rdx, str.TSMode
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x1400480bd
call fcn.140045d34
mov ebx, eax
test eax, eax
js 0x140048fa7
jmp 0x14004698e
lea rdx, [0x14011f360]
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x14004820e
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.default
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne dil
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x14011f1e8]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne bl
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x14011f1dc]
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne al
test dil, dil
je 0x14004813c
test al, al
jne 0x140048144
test bl, bl
jne 0x140048144
test al, al
je 0x140048149
test bl, bl
je 0x140048149
mov dl, r14b
jmp 0x14004814c
mov dl, r13b
test dil, dil
jne 0x14004815c
test al, al
jne 0x14004815c
test bl, bl
mov cl, r14b
je 0x14004815f
mov cl, r13b
test dl, dl
jne 0x1400491fd
test cl, cl
je 0x1400481d6
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
movdqa xmm1, xmmword [0x140141580]
movdqu xmmword [rbp + 0xd8], xmm1
mov word [rbp + 0xc8], r13w
lea rcx, [rbp + 0xc8]
call fcn.14007778c
test eax, eax
js 0x140049214
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 8
cmovae rdx, qword [rbp + 0xc8]
lea rcx, [0x14011f3e0]
call fcn.1400ec618
nop
lea rcx, [rbp + 0xc8]
call fcn.140045650
jmp 0x14004698e
test dil, dil
je 0x1400481e0
mov edi, r13d
jmp 0x1400481f6
test al, al
je 0x1400481e9
mov edi, r14d
jmp 0x1400481f6
mov edi, r13d
test bl, bl
mov ecx, 2
cmovne edi, ecx
mov r8d, edi
call fcn.1400c233c
mov r15d, eax
test eax, eax
js 0x140048fbd
jmp 0x14004698e
lea rdx, str.OSCA
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x14004822b
call fcn.140058a78
jmp 0x14004698e
lea rdx, str.MpCmdRunGetAadToken
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048beb
mov dword [rbp - 0x58], r13d
mov qword [rsp + 0x70], r13
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
test eax, eax
js 0x140048279
lea rdx, [rbp - 0x58]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.mpclient.dll_MpGetDevMode]
mov ecx, dword [rbp - 0x58]
test eax, eax
cmovs ecx, r13d
mov dword [rbp - 0x58], ecx
jmp 0x14004827c
mov ecx, dword [rbp - 0x58]
test ecx, ecx
jne 0x1400482b0
call fcn.1400ed7cc
cmp eax, r14d
jne 0x1400482b0
lea rcx, str.A_process_other_than_WinDefend_attempted_to_trigger_a_GetAadToken_request__rejecting_attempt_n
call fcn.1400ec5f0
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14004698e
call qword [sym.imp.mpclient.dll_MpHandleClose]
jmp 0x14004698e
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.UseLastLogonImpersonation
mov rax, qword [rax + 0x18]
call fcn.1400fece0
test rax, rax
setne r12b
xor edx, edx
lea rcx, str..pipeMpCmdRunGetAadToken
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x140048330
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048297
test byte [rcx + 0x1c], r14b
je 0x140048297
test eax, eax
jle 0x140048313
movzx eax, ax
or eax, 0x80070000
mov edx, 0x2a
mov r9d, eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
jmp 0x140048297
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 0xc0000000
lea rdx, str..pipeMpCmdRunGetAadToken
lea rcx, [rsp + 0x58]
call fcn.1400f1520
mov r15d, eax
test eax, eax
jns 0x1400483bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400483a6
test byte [rcx + 0x1c], r14b
je 0x1400483a6
lea edx, [rdi + 0x2c]
mov r9d, r15d
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
nop
mov rcx, qword [rsp + 0x58]
cmp rcx, rdi
je 0x140048297
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140048297
mov ecx, 2
mov dword [rbp + 0x10], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x14004841e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400483a6
test byte [rcx + 0x1c], r14b
je 0x1400483a6
test eax, eax
jle 0x140048411
movzx eax, ax
or eax, 0x80070000
mov edx, 0x2c
mov r9d, eax
jmp 0x140048395
mov qword [rsp + 0x60], r13
mov ebx, 0x1000
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140044940
test eax, eax
jns 0x14004848f
mov dword [0x140169ee8], 8
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048477
test byte [rcx + 0x1c], r14b
je 0x140048477
mov edx, 0x2d
mov r9d, 0x80070008
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400483a6
call fcn.140030c60
jmp 0x1400483a6
mov qword [rsp + 0x78], r13
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400f14bc
mov r15d, eax
test eax, eax
jns 0x1400484f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400484e5
test byte [rcx + 0x1c], r14b
je 0x1400484e5
mov edx, 0x2e
mov r9d, r15d
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140048477
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140048477
mov qword [rbp + 0x70], r13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x78], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x88], rax
mov dword [rbp - 0x80], ebx
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, ebx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
cmp eax, 0x3e5
jne 0x140048612
mov edx, 0x2710
mov rcx, qword [rbp + 0x88]
call fcn.1400f1e80
test al, al
je 0x1400485ae
mov eax, 0x5b4
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400484e5
test byte [rcx + 0x1c], r14b
je 0x1400484e5
mov edx, 0x2f
mov r9d, r15d
mov dword [rsp + 0x20], eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044484
jmp 0x1400484e5
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x70]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x140048644
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400484e5
test byte [rcx + 0x1c], r14b
je 0x1400484e5
mov edx, 0x30
mov r9d, eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
jmp 0x1400484e5
test r15d, r15d
jne 0x140048644
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400484e5
test byte [rcx + 0x1c], r14b
je 0x1400484e5
lea edx, [r15 + 0x31]
xor r9d, r9d
jmp 0x140048595
mov qword [rbp - 0x78], r13
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x78]
call fcn.1400f0f10
test eax, eax
jns 0x1400486b3
mov dword [0x140169ee8], 8
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x14004869c
test byte [rcx + 0x1c], r14b
je 0x14004869c
mov edx, 0x32
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400484e5
call fcn.140030c60
jmp 0x1400484e5
mov dword [rbp - 0x80], ebx
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, ebx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
cmp eax, 0x3e5
jne 0x1400487b6
mov edx, 0x2710
mov rcx, qword [rbp + 0x88]
call fcn.1400f1e80
test al, al
je 0x140048752
mov eax, 0x5b4
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x14004869c
test byte [rcx + 0x1c], r14b
je 0x14004869c
mov edx, 0x33
mov r9d, r15d
mov dword [rsp + 0x20], eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044484
jmp 0x14004869c
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x70]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1400487e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x14004869c
test byte [rcx + 0x1c], r14b
je 0x14004869c
mov edx, 0x34
mov r9d, eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
jmp 0x14004869c
test r15d, r15d
jne 0x1400487e8
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x14004869c
test byte [rcx + 0x1c], r14b
je 0x14004869c
lea edx, [r15 + 0x35]
xor r9d, r9d
jmp 0x140048739
mov qword [rbp - 0x60], r13
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400f0f10
test eax, eax
jns 0x140048857
mov dword [0x140169ee8], 8
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048840
test byte [rcx + 0x1c], r14b
je 0x140048840
mov edx, 0x36
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044764
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14004869c
call fcn.140030c60
jmp 0x14004869c
call fcn.1400c3f0c
mov r15d, eax
test eax, eax
jns 0x1400488a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048840
test byte [rcx + 0x1c], r14b
je 0x140048840
mov edx, 0x37
mov r9d, r15d
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
jmp 0x140048840
mov ecx, r14d
mov rax, qword [0x14016b838]
call fcn.1400fece0
mov r15d, eax
cmp eax, 0x80010106
je 0x1400488f3
test eax, eax
jns 0x1400488f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048840
test byte [rcx + 0x1c], r14b
je 0x140048840
mov edx, 0x38
jmp 0x14004888d
mov qword [rbp - 0x48], r13
lea rbx, [0x140162280]
test r12b, r12b
je 0x140048989
mov qword [rbp + 0x48], r13
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x48]
call fcn.1400f7118
test eax, eax
js 0x14004897a
mov r15, qword [rbp + 0x48]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14004893a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x48], r13
mov r9d, 4
mov rdx, r15
lea rcx, [rbp - 0x48]
call fcn.1400f7650
test eax, eax
jns 0x14004897a
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x14004897a
test byte [rcx + 0x1c], r14b
je 0x14004897a
mov edx, 0x39
mov r9d, eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140048989
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x68], r13
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp + 0x90]
call fcn.1400c43e4
nop
mov r15, qword [rbp - 0x60]
mov r12, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400489b8
call fcn.140030c60
mov qword [rbp - 0x68], r13
mov r9, r15
mov rdx, r12
lea rcx, [rbp - 0x68]
call fcn.1400c6768
mov r15d, eax
test eax, eax
jns 0x140048a26
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400489fa
mov eax, 2
test byte [rcx + 0x1c], al
je 0x1400489fa
lea edx, [rax + 0x38]
mov r9d, r15d
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov r15, qword [rbp - 0x60]
mov r12, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140048a14
call fcn.140030c60
mov qword [rbp - 0x68], r13
mov r9, r15
mov rdx, r12
lea rcx, [rbp - 0x68]
call fcn.1400c7ebc
mov r15d, eax
cmp byte [rbp + 0x98], r13b
je 0x140048a35
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test r15d, r15d
jns 0x140048a70
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048a64
test byte [rcx + 0x1c], r14b
je 0x140048a64
mov edx, 0x3b
mov r9d, r15d
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
mov rax, qword [0x14016b830]
call fcn.1400fece0
call fcn.1400c4378
test r15d, r15d
jns 0x140048aad
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140048a95
call fcn.140030c60
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140048840
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140048840
mov rdx, qword [rbp - 0x68]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r13w
jne 0x140048ab4
lea r8d, [rax*2 + 2]
mov dword [rbp - 0x80], r8d
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
cmp eax, 0x3e5
jne 0x140048bb4
mov edx, 0x2710
mov rcx, qword [rbp + 0x88]
call fcn.1400f1e80
test al, al
je 0x140048b57
mov eax, 0x5b4
mov dword [0x140169ee8], eax
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048a86
test byte [rcx + 0x1c], r14b
je 0x140048a86
mov edx, 0x3c
mov r9d, r15d
mov dword [rsp + 0x20], eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044484
jmp 0x140048a86
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x70]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x140048bdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048a86
test byte [rcx + 0x1c], r14b
je 0x140048a86
mov edx, 0x3d
mov r9d, eax
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
jmp 0x140048a86
test r15d, r15d
jne 0x140048bdf
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048a86
test byte [rcx + 0x1c], r14b
je 0x140048a86
lea edx, [r15 + 0x3e]
xor r9d, r9d
jmp 0x140048b3e
mov dword [0x140169ee8], r13d
jmp 0x140048a86
lea rdx, str.RasConnectionNotification
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048d8c
call fcn.1400ed7cc
cmp eax, r14d
jne 0x140048c18
lea rcx, str.A_process_other_than_WinDefend_attempted_to_trigger_a_RasConnectionNotification_setup__rejecting_attempt_n
jmp 0x140046a29
mov qword [rbp + 0x68], r13
mov qword [rbp - 0x50], 8
or rdi, 0xffffffffffffffff
mov qword [rbp - 0x30], rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 0x80000000
lea rdx, str..pipeRasConnectionNotification
lea rcx, [rbp - 0x30]
call fcn.1400f1520
mov r15d, eax
test eax, eax
jns 0x140048cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048c94
test byte [rcx + 0x1c], r14b
je 0x140048c94
lea edx, [rdi + 0x40]
mov r9d, r15d
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov rcx, qword [rbp - 0x30]
cmp rcx, rdi
je 0x14004698e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004698e
lea r8, [rbp + 0x68]
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x30]
call fcn.1400f1cb4
mov r15d, eax
test eax, eax
jns 0x140048cf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140169ee8], eax
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048c94
test byte [rcx + 0x1c], r14b
je 0x140048c94
mov edx, 0x40
jmp 0x140048c81
mov rdx, qword [rbp + 0x68]
test rdx, rdx
jne 0x140048d36
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048d27
test byte [rcx + 0x1c], r14b
je 0x140048d27
mov edx, 0x41
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
mov dword [0x140169ee8], 0x57
jmp 0x140048c94
mov r8d, 3
mov rcx, rdi
call fcn.1400057a0
mov dword [0x140169ee8], eax
test eax, eax
jle 0x140048d58
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x140048c94
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048c94
test byte [rcx + 0x1c], r14b
je 0x140048c94
mov edx, 0x42
mov r9d, eax
jmp 0x140048c84
lea rdx, str.Marker
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048e00
lea r8, str.No_message
lea rdx, str.message
mov rcx, qword [rsp + 0x40]
call fcn.1400f69ec
mov rbx, rax
mov rdx, rax
lea rcx, str.Sending_the_message:__ls_n
call fcn.1400ec618
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpServiceLogMessage]
mov ebx, eax
cmp eax, 0x800106cf
jne 0x140048dec
lea rcx, str.Error__the_message_is_too_long__n
call fcn.1400ec618
jmp 0x140048ed3
test ebx, ebx
js 0x140048ec5
lea rcx, str.Message_sent_n
jmp 0x140047d8b
lea rdx, str.DeviceControl
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048e34
mov rcx, qword [rsp + 0x40]
call fcn.1400a083c
mov ecx, dword [0x140169ee8]
test eax, eax
cmovs ecx, r14d
mov dword [0x140169ee8], ecx
jmp 0x14004698e
lea rdx, str.TrustCheck
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048e56
mov rcx, qword [rsp + 0x40]
call fcn.14004d610
jmp 0x14004698e
lea rdx, str.AdvertiseToast
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048e73
call fcn.14004921c
jmp 0x14004698e
lea rdx, [0x14011f8d8]
mov rcx, rbx
call fcn.140005abc
test eax, eax
je 0x140048e9d
lea rdx, [0x14011d168]
mov rcx, rbx
call fcn.140005abc
test eax, eax
jne 0x140048f69
call fcn.1400497c0
jmp 0x14004698e
mov byte [0x140169eec], r14b
call fcn.1400ecd94
call fcn.140041f50
test eax, eax
js 0x140048fff
jmp 0x14004698e
mov edx, ebx
lea rcx, str.Failed_to_send_the_message__hr___lx_n
call fcn.1400ec618
mov ecx, ebx
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
int3
mov ecx, ebx
call fcn.1400f10c4
int3
mov ecx, ebx
call fcn.1400f10c4
int3
mov ecx, ebx
call fcn.1400f10c4
int3
mov ecx, ebx
call fcn.1400f10c4
int3
mov ecx, ebx
call fcn.1400f10c4
int3
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048f69
test byte [rcx + 0x1c], r14b
je 0x140048f69
mov edx, 0x25
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
mov ecx, 0x80070667
call fcn.1400f10c4
int3
call fcn.1400f10c4
int3
lea rcx, str.You_cannot_specify_both_on_and_off_options_when_running_TPState_command._n
call fcn.1400ec618
mov ecx, 0x80070057
call fcn.1400f10c4
int3
mov edx, ebx
lea rcx, str.Call_to_RunTPStateCommand_failed_hr___lx_n
call fcn.1400ec618
mov ecx, ebx
call fcn.1400f10c4
int3
mov edx, ebx
lea rcx, str.Call_to_DoPrintTSModeCommand_failed_hr___lx_n
call fcn.1400ec618
mov ecx, ebx
call fcn.1400f10c4
int3
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140048fe7
test byte [rcx + 0x1c], r14b
je 0x140048fe7
mov dword [rsp + 0x28], r15d
mov r9d, edi
mov rcx, qword [rcx + 0x10]
call fcn.14004a28c
mov edx, r15d
lea rcx, str.Call_to_set_TDT_failed_hr___lx_n
call fcn.1400ec618
mov ecx, r15d
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, 0x80070057
call fcn.1400f10c4
nop
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140049028
lea rcx, str.Bad_Command_line____S_n
call fcn.14004a438
mov ecx, ebx
call fcn.1400f10c4
nop
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x140049057
test byte [rcx + 0x1c], r14b
je 0x140049057
mov edx, 0x21
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
mov ecx, edi
call fcn.1400f10c4
nop
lea rcx, str.This_command_is_for_service_use_only._n
call fcn.14004aaf4
mov ecx, 0x80070005
call fcn.1400f10c4
nop
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400490a7
test byte [rcx + 0x1c], r14b
je 0x1400490a7
mov edx, 0x22
mov r9d, edi
lea r8, [0x14011f948]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
mov edx, edi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400ec5f0
mov ecx, edi
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
nop
lea rbx, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, rbx
je 0x1400490f3
test byte [rcx + 0x1c], r14b
je 0x1400490f3
mov edx, 0x14
lea r8, [0x140130c70]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
lea rcx, str.ERROR:_Task_name_not_specified_n
call fcn.1400ec5f0
mov ecx, 0x80070667
call fcn.1400f10c4
int3
mov edx, ebx
lea rcx, str.ERROR:_MpReloadEngine_failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
nop
lea rcx, str.Cannot_put_service_into_SxS_mode._Service_should_be_stopped_n
call fcn.1400ec5f0
mov ecx, 0x80070032
call fcn.1400f10c4
nop
mov edx, r14d
lea rcx, str.Service_could_NOT_be_enabled_in_side_by_side_passive_mode._hr___lx._n
call fcn.1400ec5f0
mov ecx, r14d
call fcn.1400f10c4
nop
mov edx, ebx
lea rcx, str.ERROR:_MpWDEnable_TRUE__failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
int3
mov ecx, ebx
call fcn.1400f10c4
int3
lea rcx, str.You_do_not_have_access_to_perform_this_action_n
call fcn.1400ec5f0
mov ecx, 0x80070005
call fcn.1400f10c4
int3
mov edx, ebx
lea rcx, str.ERROR:_MpWDEnable_FALSE__failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
nop
mov edx, ebx
lea rcx, str.ERROR:_PlatformPlatform_failed___lx__n
call fcn.1400ec5f0
mov ecx, ebx
call fcn.1400f10c4
nop
mov edx, ebx
lea rcx, str.ERROR:_ValidateMapsConnection_failed___lx__n
call fcn.1400ec618
mov ecx, ebx
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
int3
mov ecx, eax
call fcn.1400f10c4
nop
lea rcx, str.Troubleshooting_mode_is_not_enabled__this_command_is_not_available._n
call fcn.1400ec618
mov ecx, 0x80070057
call fcn.1400f10c4
int3
lea rcx, str.Error__Two_or_more_flags_are_being_specified._n
call fcn.1400ec618
mov ecx, 0x80070057
call fcn.1400f10c4
nop
mov ecx, eax
call fcn.1400f10c4
int3