Function at 0x14002b510
Capabilities:
Check if file exists
Create thread
Terminate process

Disassembly:
jmp 0x14002b510
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f0
mov qword [rax - 0x428], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
movzx ebx, r8b
mov r12d, edx
mov rdi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0xd0], rcx
mov dword [rsp + 0x48], edx
xor ecx, ecx
call fcn.1400022ca
cmp byte [0x14007ca62], 0
je 0x14002b59b
cmp r12d, 0xffffffff
jne 0x14002b5ba
mov r9d, 0x3ba
lea r8, str.ServiceMain.cpp
lea rdx, str.sessionID_I____1
lea rcx, str.Assert:__s__in__s_at__i_n
call fcn.1400031a2
jmp 0x14002b5a1
cmp r12d, 0xffffffff
jne 0x14002b5ba
cmp byte [0x14007ca60], 0
je 0x14002c816
lea rcx, str.SpawnDriver:_Requested_driver_for_invalid_session_n
jmp 0x14002c811
test bl, bl
jne 0x14002b602
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call fcn.1400035b2
movzx ebx, al
cmp byte [0x14007ca60], 0
je 0x14002b5fa
lea rax, [0x1400646c4]
lea rdx, [0x140061e14]
test bl, bl
cmovne rdx, rax
lea rcx, str.IsUserLoggedIn___s__n
call fcn.1400031a2
test bl, bl
je 0x14002b602
xor bl, bl
jmp 0x14002b604
mov bl, 1
mov byte [rsp + 0x40], bl
cmp byte [0x14007ca60], 0
je 0x14002b634
lea rax, str.secure
lea r8, str.user
test bl, bl
cmovne r8, rax
mov edx, r12d
lea rcx, str.SpawnDriver:_session__i__s_n
call fcn.1400031a2
mov dword [rsp + 0x80], r12d
lea rsi, [rdi + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.140003a08
test rax, rax
je 0x14002b6b3
mov dword [rsp + 0xc0], r12d
mov dword [rsp + 0xa0], r12d
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call fcn.140003a08
test rax, rax
je 0x14002b68f
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call fcn.140002d88
movzx ecx, byte [rax]
jmp 0x14002b691
xor cl, cl
cmp bl, cl
jne 0x14002b6b3
cmp byte [0x14007ca60], 0
je 0x14002c816
lea rcx, str.SpawnDriver:_Driver_already_running._n
call fcn.1400031a2
jmp 0x14002c801
mov dword [rsp + 0xa8], r12d
lea rdx, [rsp + 0xa8]
mov rcx, rsi
call fcn.140003a08
test rax, rax
je 0x14002b6de
xor r8d, r8d
mov edx, r12d
mov rcx, rdi
call fcn.14000311b
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0xd8], rax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0xe0], rax
test rax, rax
je 0x14002b704
lock inc dword [rax + 8]
mov r12d, dword [rsp + 0x48]
lea rax, [rsp + 0xd8]
mov qword [rsp + 0xb0], rax
xor edi, edi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rdi
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x90]
call fcn.140001168
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14002b74f
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rbx, qword [rsp + 0xe0]
test rbx, rbx
je 0x14002b783
or r14, 0xffffffffffffffff
lock dec dword [rbx + 8]
jne 0x14002b77e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x14002b77e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov r12d, dword [rsp + 0x48]
mov qword [rsp + 0x138], 7
mov qword [rsp + 0x130], rdi
mov word [rsp + 0x120], di
xor r8d, r8d
lea rdx, [0x1400624f4]
lea rcx, [rsp + 0x120]
call fcn.140002ef5
nop
mov dword [rsp + 0xc8], r12d
mov dword [rsp + 0x78], r12d
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.140003a08
test rax, rax
je 0x14002b7ef
lea rdx, [rsp + 0xc8]
mov rcx, rsi
call fcn.140002d88
mov ebx, dword [rax + 0x10]
mov dword [rsp + 0x44], ebx
jmp 0x14002b7f3
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x88], r12d
mov dword [rsp + 0x60], r12d
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140003a08
test rax, rax
je 0x14002b835
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.140002d88
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
mov r13d, dword [rsp + 0x5c]
mov r15d, ecx
jmp 0x14002b840
mov r15d, edi
mov qword [rsp + 0x58], rdi
mov r13d, edi
mov dword [rsp + 0xb0], r15d
mov dword [rsp + 0xb4], r13d
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0xb8], r12d
lea rdx, [rsp + 0xb8]
mov rcx, rsi
call fcn.140003a08
test rax, rax
je 0x14002b884
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.140002d88
mov esi, dword [rax + 4]
jmp 0x14002b886
mov esi, edi
mov dword [rsp + 0x4c], esi
mov r14b, 1
mov edx, 0x201
lea rcx, [rsp + 0x440]
call fcn.14000332d
cmp qword [rax + 0x18], 8
jb 0x14002b8a9
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
sete bl
cmp qword [rsp + 0x458], 8
jb 0x14002b8cf
mov rcx, qword [rsp + 0x440]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test bl, bl
je 0x14002b8eb
cmp byte [0x14007ca60], 0
je 0x14002b8e8
lea rcx, str.Touch_driver_not_present__skipping_launch_n
call fcn.1400031a2
xor r14b, r14b
movzx ebx, byte [rsp + 0x40]
test bl, bl
je 0x14002b913
mov r8d, 6
lea rdx, str.SECURE
lea rcx, [rsp + 0x120]
call fcn.140002ef5
jmp 0x14002ba49
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x120]
mov ecx, r12d
call fcn.1400035b2
test al, al
jne 0x14002ba49
mov eax, 0xffff
mov word [rsp + 0x20], ax
lea r9, str.GetUserData__failed_n
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x460]
call fcn.1400037c9
nop
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.MSVCR110.dll_public:_void___cdecl_std::exception::constructor_class_std::exception_const____ptr64____ptr64]
nop
lea rax, vtable.CWacException.0
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x3d8], rax
mov eax, dword [rsp + 0x480]
mov dword [rsp + 0x3e0], eax
mov qword [rsp + 0x400], 0xf
mov qword [rsp + 0x3f8], rdi
mov byte [rsp + 0x3e8], 0
or rbx, 0xffffffffffffffff
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x488]
lea rcx, [rsp + 0x3e8]
call fcn.14000254a
nop
movzx eax, word [rsp + 0x4a8]
mov word [rsp + 0x408], ax
mov qword [rsp + 0x428], 0xf
mov qword [rsp + 0x420], rdi
mov byte [rsp + 0x410], 0
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x410]
call fcn.14000254a
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d0], rdi
mov qword [rsp + 0x430], rax
lea rdx, [0x14007a9b8]
lea rcx, [rsp + 0x3c0]
call sub.MSVCR110.dll__CxxThrowException
nop
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x14002ba7f
mov ecx, eax
call fcn.140003b34
test al, al
jne 0x14002ba62
mov dword [rsp + 0x44], edi
jmp 0x14002ba7f
cmp byte [0x14007ca60], 0
je 0x14002ba7f
mov r8d, dword [rsp + 0x44]
mov edx, r12d
lea rcx, str.SpawnDriver__i_:_Pen_user___i__already_running_n
call fcn.1400031a2
test r15d, r15d
je 0x14002bab8
mov ecx, r15d
call fcn.140003b34
test al, al
jne 0x14002ba98
mov r15d, edi
mov r13d, edi
jmp 0x14002bab8
cmp byte [0x14007ca60], 0
je 0x14002bab8
mov r8, qword [rsp + 0xb0]
mov edx, r12d
lea rcx, str.SpawnDriver__i_:_Pen_driver___i__already_running_n
call fcn.1400031a2
test esi, esi
je 0x14002bae8
mov ecx, esi
call fcn.140003b34
test al, al
jne 0x14002bacd
mov dword [rsp + 0x4c], edi
jmp 0x14002bae8
cmp byte [0x14007ca60], 0
je 0x14002bae8
mov r8d, esi
mov edx, r12d
lea rcx, str.SpawnDriver__i_:_Touch_driver___i__already_running_n
call fcn.1400031a2
mov esi, dword [rsp + 0x44]
test esi, esi
jne 0x14002bd1c
test bl, bl
jne 0x14002bd1c
mov ebx, edi
nop
cmp ebx, 0x28
jge 0x14002bd17
test esi, esi
jne 0x14002bd17
cmp byte [0x14007ca60], sil
je 0x14002bb42
lea r8, [rsp + 0x120]
cmp qword [rsp + 0x138], 8
cmovae r8, qword [rsp + 0x120]
mov edx, ebx
lea rcx, str.Attempt__d:_Spawning_Pen_User:_S_n
call fcn.1400031a2
mov qword [rsp + 0x298], 7
mov qword [rsp + 0x290], rdi
mov word [rsp + 0x280], di
mov r8d, 0xf
lea rdx, str.WinSta0default
lea rcx, [rsp + 0x280]
call fcn.140002ef5
nop
mov qword [rsp + 0x1f8], 7
mov qword [rsp + 0x1f0], rdi
mov word [rsp + 0x1e0], di
xor r8d, r8d
lea rdx, [0x1400624f4]
lea rcx, [rsp + 0x1e0]
call fcn.140002ef5
nop
mov qword [rsp + 0x218], 7
mov qword [rsp + 0x210], rdi
mov word [rsp + 0x200], di
xor r8d, r8d
lea rdx, [0x1400624f4]
lea rcx, [rsp + 0x200]
call fcn.140002ef5
nop
mov edx, 0x201
lea rcx, [rsp + 0x360]
call fcn.1400034b8
nop
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x1e0]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x200]
mov r8, rax
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x50]
call fcn.1400016ea
mov esi, dword [rax]
mov dword [rsp + 0x44], esi
cmp qword [rsp + 0x378], 8
jb 0x14002bc4e
mov rcx, qword [rsp + 0x360]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x378], 7
mov qword [rsp + 0x370], rdi
mov word [rsp + 0x360], di
cmp qword [rsp + 0x218], 8
jb 0x14002bc82
mov rcx, qword [rsp + 0x200]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x218], 7
mov qword [rsp + 0x210], rdi
mov word [rsp + 0x200], di
cmp qword [rsp + 0x1f8], 8
jb 0x14002bcb6
mov rcx, qword [rsp + 0x1e0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x1f8], 7
mov qword [rsp + 0x1f0], rdi
mov word [rsp + 0x1e0], di
cmp qword [rsp + 0x298], 8
jb 0x14002bcea
mov rcx, qword [rsp + 0x280]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test esi, esi
jne 0x14002bd05
cmp byte [0x14007ca60], sil
je 0x14002bd10
lea rcx, str.Failed_to_spawn_Pen_User_n
call fcn.1400031a2
jmp 0x14002bd10
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
jmp 0x14002bb00
movzx ebx, byte [rsp + 0x40]
test r15d, r15d
jne 0x14002c1f4
mov esi, edi
cmp esi, 0x28
jge 0x14002c188
test r15d, r15d
jne 0x14002c1f4
cmp byte [0x14007ca60], r15b
je 0x14002bd6a
lea r8, [rsp + 0x120]
cmp qword [rsp + 0x138], 8
cmovae r8, qword [rsp + 0x120]
mov edx, esi
lea rcx, str.Attempt__d:_Spawning_Pen_Driver:_S_n
call fcn.1400031a2
call fcn.14000283d
cmp eax, 0x14
je 0x14002bf59
call fcn.14000283d
cmp eax, 0x15
je 0x14002bf59
lea rdx, str.WinSta0default
test bl, bl
lea rax, str.WinSta0Winlogon
cmovne rdx, rax
mov qword [rsp + 0x2d8], 7
mov qword [rsp + 0x2d0], rdi
mov word [rsp + 0x2c0], di
cmp word [rdx], 0
jne 0x14002bdc1
mov r8, rdi
jmp 0x14002bdd0
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002bdc5
lea rcx, [rsp + 0x2c0]
call fcn.140002ef5
nop
lea rdx, [0x140064dec]
test bl, bl
lea rax, [0x140064de8]
cmovne rdx, rax
mov qword [rsp + 0x1b8], 7
mov qword [rsp + 0x1b0], rdi
mov word [rsp + 0x1a0], di
cmp word [rdx], 0
jne 0x14002be19
mov r8, rdi
jmp 0x14002be2b
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002be20
lea rcx, [rsp + 0x1a0]
call fcn.140002ef5
nop
mov edx, 0x201
lea rcx, [rsp + 0x300]
call fcn.140003297
mov rbx, rax
mov edx, 0x201
lea rcx, [rsp + 0x3a0]
call fcn.140001334
nop
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x1a0]
mov r8, rax
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x50]
call fcn.1400025d1
mov r15d, dword [rax]
mov r13d, dword [rax + 4]
cmp qword [rsp + 0x3b8], 8
jb 0x14002beb4
mov rcx, qword [rsp + 0x3a0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x3b8], 7
mov qword [rsp + 0x3b0], rdi
mov word [rsp + 0x3a0], di
cmp qword [rsp + 0x318], 8
jb 0x14002bee8
mov rcx, qword [rsp + 0x300]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x318], 7
mov qword [rsp + 0x310], rdi
mov word [rsp + 0x300], di
cmp qword [rsp + 0x1b8], 8
jb 0x14002bf1c
mov rcx, qword [rsp + 0x1a0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x1b8], 7
mov qword [rsp + 0x1b0], rdi
mov word [rsp + 0x1a0], di
cmp qword [rsp + 0x2d8], 8
jb 0x14002c155
mov rcx, qword [rsp + 0x2c0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x14002c155
lea rdx, str.WinSta0default
test bl, bl
lea rax, str.WinSta0Winlogon
cmovne rdx, rax
mov qword [rsp + 0x278], 7
mov qword [rsp + 0x270], rdi
mov word [rsp + 0x260], di
cmp word [rdx], 0
jne 0x14002bf94
mov r8, rdi
jmp 0x14002bfab
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002bfa0
lea rcx, [rsp + 0x260]
call fcn.140002ef5
nop
mov qword [rsp + 0x178], 7
mov qword [rsp + 0x170], rdi
mov word [rsp + 0x160], di
xor r8d, r8d
lea rdx, [0x1400624f4]
lea rcx, [rsp + 0x160]
call fcn.140002ef5
nop
lea rdx, [0x140064dec]
test bl, bl
lea rax, [0x140064de8]
cmovne rdx, rax
mov qword [rsp + 0x238], 7
mov qword [rsp + 0x230], rdi
mov word [rsp + 0x220], di
cmp word [rdx], 0
jne 0x14002c028
mov r8, rdi
jmp 0x14002c03b
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002c030
lea rcx, [rsp + 0x220]
call fcn.140002ef5
nop
mov edx, 0x201
lea rcx, [rsp + 0x380]
call fcn.140001334
nop
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x160]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x220]
mov r8, rax
lea rdx, [rsp + 0xf8]
mov rcx, qword [rsp + 0x50]
call fcn.1400025d1
mov r15d, dword [rax]
mov r13d, dword [rax + 4]
cmp qword [rsp + 0x398], 8
jb 0x14002c0b7
mov rcx, qword [rsp + 0x380]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x398], 7
mov qword [rsp + 0x390], rdi
mov word [rsp + 0x380], di
cmp qword [rsp + 0x238], 8
jb 0x14002c0eb
mov rcx, qword [rsp + 0x220]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x238], 7
mov qword [rsp + 0x230], rdi
mov word [rsp + 0x220], di
cmp qword [rsp + 0x178], 8
jb 0x14002c11f
mov rcx, qword [rsp + 0x160]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x178], 7
mov qword [rsp + 0x170], rdi
mov word [rsp + 0x160], di
cmp qword [rsp + 0x278], 8
jb 0x14002c15a
mov rcx, qword [rsp + 0x260]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x14002c15a
movzx ebx, byte [rsp + 0x40]
test r15d, r15d
jne 0x14002c176
cmp byte [0x14007ca60], r15b
je 0x14002c181
lea rcx, str.Failed_to_spawn_Pen_n
call fcn.1400031a2
jmp 0x14002c181
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
jmp 0x14002bd27
mov eax, dword [rsp + 0x44]
test r15d, r15d
jne 0x14002c1f8
test eax, eax
je 0x14002c1f8
mov r8d, eax
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002c1ec
cmp byte [0x14007ca60], r15b
je 0x14002c1c0
lea rcx, str.Spawn_Pen_Driver___Terminate_User_Process_n
call fcn.1400031a2
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14002c1e3
cmp byte [0x14007ca60], al
je 0x14002c1e3
lea rcx, str.Spawn_Pen_Driver___Terminate_User_Process_Failed_n
call fcn.1400031a2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov dword [rsp + 0x44], eax
jmp 0x14002c1f8
mov eax, dword [rsp + 0x44]
mov esi, dword [rsp + 0x4c]
test esi, esi
jne 0x14002c6ac
test r14b, r14b
je 0x14002c6ac
mov r14d, edi
cmp r14d, 0x28
jge 0x14002c6a8
test esi, esi
jne 0x14002c6a8
cmp byte [0x14007ca60], sil
je 0x14002c254
lea r8, [rsp + 0x120]
cmp qword [rsp + 0x138], 8
cmovae r8, qword [rsp + 0x120]
mov edx, r14d
lea rcx, str.Attempt__d:_Spawning_Touch_Driver:_S_n
call fcn.1400031a2
movzx ebx, byte [rsp + 0x40]
test bl, bl
je 0x14002c410
mov qword [rsp + 0x2b8], 7
mov qword [rsp + 0x2b0], rdi
mov word [rsp + 0x2a0], di
mov r8d, 0x10
lea rdx, str.WinSta0Winlogon
lea rcx, [rsp + 0x2a0]
call fcn.140002ef5
nop
mov qword [rsp + 0x1d8], 7
mov qword [rsp + 0x1d0], rdi
mov word [rsp + 0x1c0], di
xor r8d, r8d
lea rdx, [0x1400624f4]
lea rcx, [rsp + 0x1c0]
call fcn.140002ef5
nop
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], rdi
mov word [rsp + 0x180], di
mov r8d, 2
lea rdx, [0x140064ec0]
lea rcx, [rsp + 0x180]
call fcn.140002ef5
nop
mov edx, 0x201
lea rcx, [rsp + 0x320]
call fcn.14000332d
nop
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x1c0]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x180]
mov r8, rax
lea rdx, [rsp + 0x118]
mov rcx, qword [rsp + 0x50]
call fcn.1400025d1
mov esi, dword [rax]
mov dword [rsp + 0x4c], esi
cmp qword [rsp + 0x338], 8
jb 0x14002c370
mov rcx, qword [rsp + 0x320]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x338], 7
mov qword [rsp + 0x330], rdi
mov word [rsp + 0x320], di
cmp qword [rsp + 0x198], 8
jb 0x14002c3a4
mov rcx, qword [rsp + 0x180]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x198], 7
mov qword [rsp + 0x190], rdi
mov word [rsp + 0x180], di
cmp qword [rsp + 0x1d8], 8
jb 0x14002c3d8
mov rcx, qword [rsp + 0x1c0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x1d8], 7
mov qword [rsp + 0x1d0], rdi
mov word [rsp + 0x1c0], di
cmp qword [rsp + 0x2b8], 8
jb 0x14002c5b8
mov rcx, qword [rsp + 0x2a0]
jmp 0x14002c5b3
mov qword [rsp + 0x2f8], 7
mov qword [rsp + 0x2f0], rdi
mov word [rsp + 0x2e0], di
mov r8d, 0xf
lea rdx, str.WinSta0default
lea rcx, [rsp + 0x2e0]
call fcn.140002ef5
nop
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rdi
mov word [rsp + 0x240], di
xor r8d, r8d
lea rdx, [0x1400624f4]
lea rcx, [rsp + 0x240]
call fcn.140002ef5
nop
mov qword [rsp + 0x158], 7
mov qword [rsp + 0x150], rdi
mov word [rsp + 0x140], di
xor r8d, r8d
lea rdx, [0x1400624f4]
lea rcx, [rsp + 0x140]
call fcn.140002ef5
nop
mov edx, 0x201
lea rcx, [rsp + 0x340]
call fcn.14000332d
nop
mov dword [rsp + 0x30], r12d
lea rcx, [rsp + 0x2e0]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x140]
mov r8, rax
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x50]
call fcn.140001a3c
mov esi, dword [rax]
mov dword [rsp + 0x4c], esi
cmp qword [rsp + 0x358], 8
jb 0x14002c51c
mov rcx, qword [rsp + 0x340]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x358], 7
mov qword [rsp + 0x350], rdi
mov word [rsp + 0x340], di
cmp qword [rsp + 0x158], 8
jb 0x14002c550
mov rcx, qword [rsp + 0x140]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x158], 7
mov qword [rsp + 0x150], rdi
mov word [rsp + 0x140], di
cmp qword [rsp + 0x258], 8
jb 0x14002c584
mov rcx, qword [rsp + 0x240]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x258], 7
mov qword [rsp + 0x250], rdi
mov word [rsp + 0x240], di
cmp qword [rsp + 0x2f8], 8
jb 0x14002c5b8
mov rcx, qword [rsp + 0x2e0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test esi, esi
je 0x14002c695
test bl, bl
sete sil
mov r9d, 0x201
mov r8d, r12d
movzx edx, sil
movzx ecx, bl
call fcn.140003521
mov ebx, edi
nop dword [rax]
cmp ebx, 0x19
jge 0x14002c625
test rax, rax
jne 0x14002c62a
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14007ca60], 0
je 0x14002c60a
mov edx, ebx
lea rcx, str.Attempt__d:_Event_not_yet_created_n
call fcn.1400031a2
mov r9d, 0x201
mov r8d, r12d
movzx edx, sil
movzx ecx, byte [rsp + 0x40]
call fcn.140003521
inc ebx
jmp 0x14002c5e0
test rax, rax
je 0x14002c650
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x4c]
cmp byte [0x14007ca60], 0
je 0x14002c6a0
mov edx, esi
lea rcx, str.Process_created_correctly___i__n
call fcn.1400031a2
jmp 0x14002c6a0
cmp byte [0x14007ca60], 0
je 0x14002c665
lea rcx, str.Could_not_confirm_process_created_correctly_n
call fcn.1400031a2
mov r8d, dword [rsp + 0x4c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14002c693
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, edi
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r14d
jmp 0x14002c210
mov eax, dword [rsp + 0x44]
test esi, esi
jne 0x14002c6bd
test r15d, r15d
jne 0x14002c6bd
test eax, eax
je 0x14002c753
mov rbx, qword [rsp + 0x50]
add rbx, 0x40
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140002d88
movzx r14d, byte [rsp + 0x40]
mov byte [rax], r14b
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140002d88
mov dword [rax + 4], esi
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140002d88
mov dword [rax + 8], r15d
mov dword [rax + 0xc], r13d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140002d88
mov ecx, dword [rsp + 0x44]
mov dword [rax + 0x10], ecx
test r14b, r14b
je 0x14002c781
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140003477]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002c781
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x70], r12d
lea rbx, [rax + 0x40]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140003a08
test rax, rax
je 0x14002c781
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14000272a
nop
cmp qword [rsp + 0x138], 8
jb 0x14002c799
mov rcx, qword [rsp + 0x120]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x138], 7
mov qword [rsp + 0x130], rdi
mov word [rsp + 0x120], di
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14002c7c9
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14002c801
lock dec dword [rcx + 8]
jne 0x14002c801
mov rbx, qword [rsp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lock dec dword [rbx + 0xc]
jne 0x14002c801
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [0x14007ca60], 0
je 0x14002c816
lea rcx, str.SpawnDriver:_complete_n
call fcn.1400031a2
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140052d40
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret