Function at 0x14001f690
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x1010]
mov eax, 0x1110
call fcn.140038d50
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x1138], rbx
mov qword [rsp + 0x1140], rsi
mov qword [rsp + 0x1148], rdi
mov rax, qword [0x14007bec0]
xor rax, rsp
mov qword [rbp + 0x1000], rax
mov rbx, rcx
cmp qword [rcx], 0
je 0x14001f729
cmp qword [rcx + 8], 0
je 0x14001f729
cmp qword [rcx + 0x10], 0
je 0x14001f729
cmp qword [rcx + 0x18], 0
je 0x14001f729
cmp qword [rcx + 0x20], 0
je 0x14001f729
cmp qword [rcx + 0x28], 0
je 0x14001f729
cmp qword [rcx + 0x30], 0
je 0x14001f729
cmp qword [rcx + 0x38], 0
je 0x14001f729
cmp qword [rcx + 0x40], 0
je 0x14001f729
cmp qword [rcx + 0x48], 0
jne 0x1400200a8
mov qword [rsp + 0x78], 7
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov word [rsp + 0x60], r14w
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.1400214d0
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r14
mov word [rbp - 0x50], r14w
lea r8d, [r14 + 0x13]
lea rdx, str.slm_runtime_dev.dll
lea rcx, [rbp - 0x50]
call fcn.140002b60
nop
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140020d10
nop
cmp qword [rbp - 0x38], 8
jb 0x14001f796
mov rcx, qword [rbp - 0x50]
call fcn.140033ccc
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r14
mov word [rbp - 0x50], r14w
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x14001fdd3
mov r15d, 0x5c
mov word [rsp + 0x20], r15w
or r8, 0xffffffffffffffff
mov rcx, qword [rsp + 0x70]
cmp rcx, 1
jb 0x14001f880
dec rcx
cmp rcx, r8
cmova rcx, r8
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
lea rsi, [rax + rcx*2]
nop
cmp word [rsi], r15w
jne 0x14001f84a
mov ecx, 1
lea rdx, [rsp + 0x20]
mov rdi, rsi
movzx eax, word [rdx]
cmp word [rdi], ax
jne 0x14001f83a
add rdi, 2
add rdx, 2
dec rcx
je 0x14001f863
jmp 0x14001f823
mov ecx, 1
cmp word [rdi], ax
cmovb ecx, r8d
test ecx, ecx
je 0x14001f863
lea rcx, [rsp + 0x60]
call fcn.140002b50
cmp rsi, rax
je 0x14001f87c
sub rsi, 2
or r8, 0xffffffffffffffff
jmp 0x14001f810
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
sub rsi, rax
sar rsi, 1
jmp 0x14001f883
or r8, 0xffffffffffffffff
mov rsi, r8
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x60]
call fcn.140003250
nop
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r14
mov word [rbp - 0x50], r14w
mov r8d, 0x13
lea rdx, str.slm_runtime_dev.dll
lea rcx, [rbp - 0x50]
call fcn.140002b60
nop
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x28]
call fcn.140020d10
mov rdi, rax
lea rax, [rsp + 0x38]
cmp rax, rdi
je 0x14001f949
cmp qword [rsp + 0x50], 8
jb 0x14001f8f0
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
cmp qword [rdi + 0x18], 8
jae 0x14001f924
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140033fc0
jmp 0x14001f92f
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
mov qword [rdi], r14
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x50], rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
cmp qword [rbp - 0x10], 8
jb 0x14001f959
mov rcx, qword [rbp - 0x28]
call fcn.140033ccc
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r14
mov word [rbp - 0x28], r14w
cmp qword [rbp - 0x38], 8
jb 0x14001f97a
mov rcx, qword [rbp - 0x50]
call fcn.140033ccc
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x14001fdc3
lea rcx, str.ilocker.exe
call fcn.14000d290
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001fa2a
lea rcx, str.PiClient.exe
call fcn.14000d290
mov edi, eax
cmp eax, 0xffffffff
jne 0x14001fa2a
cmp qword [rbp - 0x60], 8
jb 0x14001f9da
mov rcx, qword [rbp - 0x78]
call fcn.140033ccc
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r14
mov word [rbp - 0x78], r14w
cmp qword [rsp + 0x50], 8
jb 0x14001f9fd
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
cmp qword [rsp + 0x78], 8
jb 0x14001fa23
mov rcx, qword [rsp + 0x60]
call fcn.140033ccc
xor eax, eax
jmp 0x1400200ad
mov qword [rsp + 0x28], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x28]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x28]
call fcn.140013920
mov word [rbp], r14w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 2]
call fcn.140037b90
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x14001facc
cmp qword [rbp - 0x60], 8
jb 0x14001fa90
mov rcx, qword [rbp - 0x78]
call fcn.140033ccc
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r14
mov word [rbp - 0x78], r14w
cmp qword [rsp + 0x50], 8
jb 0x14001fab3
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov r9d, 0x400
lea r8, [rbp]
xor edx, edx
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
jne 0x14001faee
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
lea rdi, [rbp]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp]
lea rcx, [rsp + 0x60]
call fcn.140002b60
mov word [rsp + 0x20], r15w
mov rcx, qword [rsp + 0x70]
cmp rcx, 1
jb 0x14001fbc0
dec rcx
cmp rcx, rsi
mov r8, rsi
cmova rcx, rsi
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
lea rsi, [rax + rcx*2]
nop word [rax + rax]
cmp word [rsi], 0x5c
jne 0x14001fb8a
mov ecx, 1
lea rdx, [rsp + 0x20]
mov rdi, rsi
movzx eax, word [rdx]
cmp word [rdi], ax
jne 0x14001fb7a
add rdi, 2
add rdx, 2
dec rcx
je 0x14001fba3
jmp 0x14001fb63
mov ecx, 1
cmp word [rdi], ax
cmovb ecx, r8d
test ecx, ecx
je 0x14001fba3
lea rcx, [rsp + 0x60]
call fcn.140002b50
cmp rsi, rax
je 0x14001fbbc
sub rsi, 2
or r8, 0xffffffffffffffff
jmp 0x14001fb50
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
sub rsi, rax
sar rsi, 1
jmp 0x14001fbc0
or rsi, 0xffffffffffffffff
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x60]
call fcn.140003250
mov rdi, rax
lea rax, [rbp - 0x78]
cmp rax, rdi
je 0x14001fc42
cmp qword [rbp - 0x60], 8
jb 0x14001fbf0
mov rcx, qword [rbp - 0x78]
call fcn.140033ccc
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r14
mov word [rbp - 0x78], r14w
cmp qword [rdi + 0x18], 8
jae 0x14001fc20
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.140033fc0
jmp 0x14001fc2a
mov rax, qword [rdi]
mov qword [rbp - 0x78], rax
mov qword [rdi], r14
mov rax, qword [rdi + 0x10]
mov qword [rbp - 0x68], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp - 0x60], rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
cmp qword [rbp - 0x10], 8
jb 0x14001fc52
mov rcx, qword [rbp - 0x28]
call fcn.140033ccc
mov qword [rbp - 0x38], 7
mov qword [rbp - 0x40], r14
mov word [rbp - 0x50], r14w
mov r8d, 0x13
lea rdx, str.slm_runtime_dev.dll
lea rcx, [rbp - 0x50]
call fcn.140002b60
nop
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x28]
call fcn.140020d10
mov rdi, rax
lea rax, [rsp + 0x38]
cmp rax, rdi
je 0x14001fd03
cmp qword [rsp + 0x50], 8
jb 0x14001fcaa
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
cmp qword [rdi + 0x18], 8
jae 0x14001fcde
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140033fc0
jmp 0x14001fce9
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
mov qword [rdi], r14
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x50], rax
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
cmp qword [rbp - 0x10], 8
jb 0x14001fd13
mov rcx, qword [rbp - 0x28]
call fcn.140033ccc
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], r14
mov word [rbp - 0x28], r14w
cmp qword [rbp - 0x38], 8
jb 0x14001fd34
mov rcx, qword [rbp - 0x50]
call fcn.140033ccc
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x14001fdc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140069ed0]
lea rcx, [rbp + 0x800]
call fcn.140005670
nop
cmp qword [rbp - 0x60], 8
jb 0x14001fd87
mov rcx, qword [rbp - 0x78]
call fcn.140033ccc
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r14
mov word [rbp - 0x78], r14w
cmp qword [rsp + 0x50], 8
jb 0x14001fdaa
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
cmp qword [rbp - 0x60], 8
jb 0x14001fdd3
mov rcx, qword [rbp - 0x78]
call fcn.140033ccc
mov edx, 1
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
jne 0x14001fe15
cmp qword [rsp + 0x50], 8
jb 0x14001fdfc
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 3
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 8], rax
test rax, rax
jne 0x14001fe58
cmp qword [rsp + 0x50], 8
jb 0x14001fe3f
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 0xd
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x14001fe9b
cmp qword [rsp + 0x50], 8
jb 0x14001fe82
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 0x19
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x14001fede
cmp qword [rsp + 0x50], 8
jb 0x14001fec5
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 0xa
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x14001ff21
cmp qword [rsp + 0x50], 8
jb 0x14001ff08
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 0xb
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x14001ff64
cmp qword [rsp + 0x50], 8
jb 0x14001ff4b
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 0xc
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x14001ffa7
cmp qword [rsp + 0x50], 8
jb 0x14001ff8e
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 6
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x14001ffea
cmp qword [rsp + 0x50], 8
jb 0x14001ffd1
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 5
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
test rax, rax
jne 0x14002002d
cmp qword [rsp + 0x50], 8
jb 0x140020014
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
mov edx, 0x21
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x140020070
cmp qword [rsp + 0x50], 8
jb 0x140020057
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
jmp 0x14001fa11
cmp qword [rsp + 0x50], 8
jb 0x140020082
mov rcx, qword [rsp + 0x38]
call fcn.140033ccc
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
cmp qword [rsp + 0x78], 8
jb 0x1400200a8
mov rcx, qword [rsp + 0x60]
call fcn.140033ccc
mov eax, 1
mov rcx, qword [rbp + 0x1000]
xor rcx, rsp
call fcn.140033cf0
lea r11, [rsp + 0x1110]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret