Function at 0x140009328
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2888]
mov eax, 0x2960
call fcn.140015ca0
sub rsp, rax
mov rax, qword [0x140017100]
xor rax, rsp
mov qword [rbp + 0x2850], rax
mov rdi, rcx
lea rax, [rbp + 0xa8]
lea rcx, [rbp + 0xa40]
mov r15d, 1
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], 0x11c
mov qword [rbp + 0x98], rax
mov dword [rbp + 0xa0], r15d
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx edx, byte [0x14001a7f2]
xor r13d, r13d
test eax, eax
mov rax, qword [0x1400198c0]
cmovne edx, r15d
mov r12d, 0x104
mov byte [0x14001a7f2], dl
mov word [rax], r13w
mov rax, qword [0x1400190a0]
mov word [rax], r13w
lea rax, [rbp + 0xc0]
mov dword [rbp + 0xb8], r12d
mov qword [rbp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea esi, [r15 + 0x1f]
lea ecx, [rsi + 2]
mov rbx, rax
cmp word [rax], cx
jne 0x1400093fc
add rbx, 2
jmp 0x1400093ff
movzx ecx, si
movzx eax, word [rbx]
test ax, ax
je 0x140009422
cmp ax, cx
je 0x140009418
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140009407
cmp word [rbx], r13w
je 0x140009422
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x14001af18], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x14001a7e0], rax
cmp rax, 0xffffffffffffffff
je 0x14000944f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x140009456
mov qword [0x14001a7e0], r13
mov edi, 0x7fe
lea rcx, [rbp + 0x1052]
xor edx, edx
mov r8d, edi
mov dword [rbp - 0x3c], r13d
mov word [rbp + 0x1050], r13w
call sub.msvcrt.dll_memset
lea rcx, [rbp + 0x1852]
mov r8d, edi
xor edx, edx
mov word [rbp + 0x1850], r13w
call sub.msvcrt.dll_memset
lea r11, [rbp + 0x1050]
lea rax, [rbp + 0x1850]
mov qword [rbp - 0x80], r11
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x68], r13d
mov dword [0x14001afa4], r13d
cmp word [rbx], si
je 0x1400094be
cmp word [rbx], 9
jne 0x1400094c4
add rbx, 2
jmp 0x1400094b3
cmp word [rbx], 0x2f
je 0x1400094d4
cmp word [rbx], 0x2d
jne 0x140009740
lea rax, [rbx + 2]
test rax, rax
je 0x140009740
movzx eax, word [rax]
or ax, si
cmp ax, 0x60
jne 0x140009740
add rbx, 4
mov qword [rsp + 0x68], rbx
cmp word [rbx], si
je 0x140009505
cmp word [rbx], 9
jne 0x14000950b
add rbx, 2
jmp 0x1400094f5
lea rax, [rbp + 0x1050]
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x68]
mov r8d, 0x400
mov qword [rbp - 0x28], rax
call fcn.140008f90
test al, al
jne 0x140009582
xor edx, edx
xor ecx, ecx
call fcn.140006c20
cmp dword [rbp + 0xb8], r12d
jle 0x14000954d
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rbp + 0xc0]
mov dword [rbp + 0xb8], r12d
mov qword [rbp + 0xb0], rax
cmp dword [rbp + 0xa0], r15d
jle 0x140009578
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x667
jmp 0x14000b3a6
mov eax, dword [rbp + 0xb8]
lea rdx, [0x1400017e0]
mov r9d, 0x20019
add eax, eax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rbp - 0x4c], eax
lea rax, [rbp - 0x10]
mov dword [rbp - 0x50], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400096f8
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x4c]
lea r9, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0xb0]
lea rdx, [rbp + 0x1050]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
jne 0x140009672
mov ebx, dword [rbp - 0x4c]
shr ebx, 1
cmp ebx, r12d
jle 0x140009614
mov edx, ebx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x14000961b
lea rdi, [rbp + 0xc0]
test rdi, rdi
je 0x1400096ad
mov rcx, qword [rbp + 0xb0]
lea rax, [rbp + 0xc0]
cmp rcx, rax
je 0x14000963d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x4c]
lea r9, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x1050]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rbp + 0xb0], rdi
mov dword [rbp + 0xb8], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400096f8
cmp dword [rbp - 0x50], r15d
jne 0x1400096f8
mov rbx, qword [rbp + 0xb0]
mov rdx, rsi
movzx edi, word [rbx]
mov qword [rsp + 0x68], rbx
cmp di, dx
je 0x1400096a7
cmp di, 9
jne 0x140009d37
add rbx, 2
jmp 0x140009690
cmp dword [rbp + 0xb8], r12d
jle 0x1400096c3
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rbp + 0xc0]
mov dword [rbp + 0xb8], r12d
mov qword [rbp + 0xb0], rax
cmp dword [rbp + 0xa0], r15d
jle 0x1400096ee
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0xe
jmp 0x14000b3a6
cmp dword [rbp + 0xb8], r12d
jle 0x14000970e
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rbp + 0xc0]
mov dword [rbp + 0xb8], r12d
mov qword [rbp + 0xb0], rax
cmp dword [rbp + 0xa0], r15d
jle 0x140009739
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x14000b3a6
mov r14d, 0x7fffffff
mov rax, rbx
mov ecx, r14d
cmp word [rax], r13w
je 0x14000975b
add rax, 2
sub rcx, r15
jne 0x14000974c
test rcx, rcx
je 0x14000b360
mov rsi, r14
sub rsi, rcx
inc esi
cmp esi, r12d
jle 0x140009787
movsxd rdx, esi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x14000978e
lea rdi, [rbp + 0xc0]
test rdi, rdi
je 0x1400096ad
mov rcx, qword [rbp + 0xb0]
lea rax, [rbp + 0xc0]
cmp rcx, rax
je 0x1400097b0
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [0x140001868]
mov qword [rbp + 0xb0], rdi
mov dword [rbp + 0xb8], esi
mov qword [rbp + 0xb60], rax
mov word [rdi], r13w
lea rax, [0x140001878]
mov qword [rbp + 0xb78], rax
lea rax, [0x1400018a0]
lea rdi, [0x140001890]
mov qword [rbp + 0xb98], rax
lea rax, [0x1400018a8]
lea rcx, [rbp + 0xcc0]
mov qword [rbp + 0xba8], rax
lea rax, [0x1400018b4]
lea rdx, [0x140001a10]
mov qword [rbp + 0xbb0], rax
lea rax, [0x1400018c0]
mov r8d, LeaveCriticalSection
mov qword [rbp + 0xbc0], rax
lea rax, [0x1400018d0]
mov qword [rbp + 0xb68], r13
mov qword [rbp + 0xbc8], rax
lea rax, [0x1400018d8]
mov byte [rbp + 0xb70], r13b
mov qword [rbp + 0xbd8], rax
lea rax, [0x1400018e8]
mov qword [rbp + 0xb80], r13
mov qword [rbp + 0xbe0], rax
lea rax, [0x140001918]
mov byte [rbp + 0xb88], r13b
mov qword [rbp + 0xbf0], rax
lea rax, [0x140001930]
mov qword [rbp + 0xb90], rdi
mov qword [rbp + 0xbf8], rax
lea rax, [0x140001960]
mov byte [rbp + 0xba0], r15b
mov qword [rbp + 0xc08], rax
lea rax, [0x140001980]
mov byte [rbp + 0xbb8], r15b
mov qword [rbp + 0xc10], rax
lea rax, [0x1400019a0]
mov byte [rbp + 0xbd0], r15b
mov qword [rbp + 0xc20], rax
lea rax, [0x1400019c0]
mov byte [rbp + 0xbe8], r15b
mov qword [rbp + 0xc28], rax
lea rax, [0x1400019e0]
mov byte [rbp + 0xc00], r15b
mov qword [rbp + 0xc38], rax
lea rax, [0x1400019e8]
mov byte [rbp + 0xc18], r15b
mov qword [rbp + 0xc40], rax
mov eax, dword [0x1400019f0]
mov byte [rbp + 0xc30], r15b
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], eax
movzx eax, word [0x1400019f4]
mov byte [rbp + 0xc48], r15b
mov word [rbp + 0xc54], ax
mov eax, dword [0x1400019f8]
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], eax
movzx eax, word [0x1400019fc]
mov word [rbp + 0xc5c], ax
mov rax, qword [0x140001a00]
mov qword [rbp + 0xc70], rax
mov eax, dword [0x140001a08]
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], eax
movzx eax, word [0x140001a0c]
mov word [rbp + 0xc7c], ax
call sub.msvcrt.dll_memcpy
mov r11, r14
mov rax, rdi
cmp word [rax], r13w
je 0x14000999b
add rax, 2
sub r11, r15
jne 0x14000998c
test r11, r11
je 0x14000b360
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x58]
sub r14, r11
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x70], r13
call fcn.1400069a0
mov rdi, rax
test rax, rax
je 0x140009a86
mov rsi, qword [rbp - 0x70]
cmp word [rdi], r13w
je 0x140009a86
cmp word [rdi], 0x2d
je 0x1400099e2
cmp word [rdi], 0x2f
jne 0x140009a57
lea r15, [rsi - 1]
cmp r15, 1
jne 0x140009a1c
or dword [rsp + 0x28], reloc.ADVAPI32.dll_TraceMessage
lea rax, [0x140001a30]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r15d
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140009b60
cmp r14, r15
mov r15d, 1
jne 0x140009a57
lea rax, [0x140001890]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r15d
mov ecx, 0x409
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140009b66
mov rsi, r13
mov qword [rbp - 0x70], r13
cmp qword [rbp - 0x58], r13
je 0x140009a7a
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x58]
call fcn.1400069a0
mov rsi, qword [rbp - 0x70]
mov rdi, rax
jmp 0x140009a7d
mov rdi, r13
test rdi, rdi
jne 0x1400099cc
lea rax, [rbp + 0xc58]
mov byte [rbp + 0xb70], r15b
mov byte [rbp + 0xb88], r15b
mov qword [rbp + 0xb68], rax
lea rax, [rbp + 0xc50]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x58]
mov qword [rbp + 0xb80], rax
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x70], r13
call fcn.1400069a0
mov rbx, rax
test rax, rax
je 0x140009c40
mov rdi, qword [rbp - 0x70]
cmp word [rbx], r13w
je 0x140009c40
cmp word [rbx], 0x2d
je 0x140009aeb
cmp word [rbx], 0x2f
jne 0x140009b3f
mov r14d, r13d
mov rsi, r13
lea r15, [rbp + 0xb60]
mov rax, qword [r15]
or dword [rsp + 0x28], reloc.ADVAPI32.dll_TraceMessage
lea r9d, [rdi - 1]
lea r8, [rbx + 2]
mov edx, 1
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140009b8e
inc r14d
inc rsi
add r15, 0x18
cmp r14d, 0xa
jb 0x140009af8
xor r13d, r13d
mov r12d, 0x104
lea r15d, [r13 + 1]
lea rcx, [rbp + 0xb0]
mov r9b, r15b
mov r8, rdi
mov rdx, rbx
mov dword [rbp + 0xbc], r12d
call fcn.140006a94
jmp 0x140009c02
mov r15d, 1
lea rax, [rbp + 0xc70]
mov byte [rbp + 0xb70], r13b
mov byte [rbp + 0xb88], r13b
mov qword [rbp + 0xb68], rax
lea rax, [rbp + 0xcc0]
jmp 0x140009aa9
lea rax, [rsi + rsi*2]
xor r13d, r13d
mov r12d, 0x104
mov r10, qword [rbp + rax*8 + 0xb68]
mov r9b, byte [rbp + rax*8 + 0xb70]
mov dword [rbp + 0xbc], r12d
mov r8d, r13d
test r10, r10
je 0x140009be0
mov r8d, 0x7fffffff
mov rcx, r10
mov edx, r13d
mov eax, r8d
cmp word [rcx], r13w
je 0x140009bd8
add rcx, 2
dec rax
jne 0x140009bc9
test rax, rax
jne 0x140009c2f
mov r8, r13
mov edx, 0x80070057
test edx, edx
js 0x140009c93
lea rcx, [rbp + 0xb0]
mov rdx, r10
call fcn.140006a94
mov r15d, 1
mov ebx, eax
test eax, eax
jne 0x140009c98
mov rdi, r13
mov qword [rbp - 0x70], r13
cmp qword [rbp - 0x58], r13
je 0x140009c34
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x58]
call fcn.1400069a0
mov rdi, qword [rbp - 0x70]
mov rbx, rax
jmp 0x140009c37
sub r8, rax
jmp 0x140009be5
mov rbx, r13
test rbx, rbx
jne 0x140009ad5
mov rbx, qword [rbp + 0xb0]
mov rax, r13
test rbx, rbx
je 0x140009c75
mov r8d, 0x7fffffff
mov rax, rbx
mov edx, r13d
mov ecx, r8d
cmp word [rax], r13w
je 0x140009c6d
add rax, 2
sub rcx, r15
jne 0x140009c5e
test rcx, rcx
jne 0x140009ce0
mov rax, r13
mov edx, 0x80070057
test edx, edx
jns 0x140009ce8
cmp dword [rbp + 0xb8], r12d
jle 0x14000b376
mov rcx, rbx
jmp 0x14000b370
mov ebx, 0x65b
cmp dword [rbp + 0xb8], r12d
jle 0x140009cae
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rbp + 0xb8], r12d
cmp dword [rbp + 0xa0], 1
lea rax, [rbp + 0xc0]
mov qword [rbp + 0xb0], rax
jle 0x140009cd9
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
jmp 0x14000b3a6
mov rax, r8
sub rax, rcx
jmp 0x140009c7a
mov edx, LeaveCriticalSection
test rax, rax
je 0x140009d2a
lea rcx, [rbx - 2]
lea rcx, [rcx + rax*2]
cmp word [rcx], dx
je 0x140009d05
cmp word [rcx], 9
jne 0x140009d2a
cmp rcx, rbx
jb 0x140009d2a
mov word [rcx], r13w
mov rbx, qword [rbp + 0xb0]
sub rcx, 2
jmp 0x140009cfa
cmp di, dx
je 0x140009d26
cmp di, 9
jne 0x140009d37
add rbx, 2
movzx edi, word [rbx]
mov qword [rsp + 0x68], rbx
test di, di
jne 0x140009d1b
mov r15, qword [0x14001af28]
mov esi, r13d
mov r14d, 0x667
lea r8, [0x1400021b0]
mov eax, 0x45
test di, di
je 0x14000a38f
cmp di, 0x2f
je 0x140009e90
cmp di, 0x2d
je 0x140009e90
lea rcx, [rbp + 0x830]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x830]
lea rdx, [rbp + 0x820]
lea rcx, [rsp + 0x68]
mov qword [rbp + 0x820], rax
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
call fcn.140009060
test eax, eax
je 0x14000a2dd
mov r15, qword [rbp + 0x820]
test r15, r15
je 0x140009e3e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x14001a7dc]
lea rcx, [0x1400198c0]
add edx, 2
mov edi, eax
add edx, eax
call fcn.14000c0e4
test al, al
je 0x140009e37
mov rax, qword [0x1400198c0]
movsxd rbx, dword [0x14001a7dc]
mov r8d, LeaveCriticalSection
mov rcx, rbx
inc ebx
mov word [rax + rcx*2], r8w
lea eax, [rdi + 1]
movsxd rcx, ebx
movsxd rdx, eax
mov rax, qword [0x1400198c0]
mov r8, r15
lea rcx, [rax + rcx*2]
mov dword [0x14001a7dc], ebx
call fcn.140004eb8
test eax, eax
js 0x140009e37
add ebx, edi
mov dword [0x14001a7dc], ebx
mov r15, qword [rbp + 0x820]
mov rbx, qword [rsp + 0x68]
mov edx, LeaveCriticalSection
movzx edi, word [rbx]
cmp di, dx
je 0x140009e56
cmp di, 9
jne 0x140009e61
add rbx, 2
mov qword [rsp + 0x68], rbx
jmp 0x140009e48
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x140009e84
test r15, r15
je 0x140009e84
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r15, qword [0x14001af28]
jmp 0x14000a2c3
mov r15, qword [0x14001af28]
jmp 0x14000a2c8
add rbx, 2
mov qword [rsp + 0x68], rbx
movzx eax, word [rbx]
mov ecx, eax
or ecx, edx
cmp r13w, ax
je 0x140009eaf
add rbx, 2
mov qword [rsp + 0x68], rbx
mov r12, r8
mov eax, 0x52
movzx eax, ax
or eax, edx
cmp eax, ecx
je 0x140009ece
add r12, 2
movzx eax, word [r12]
test ax, ax
jne 0x140009eb7
cmp word [r12], r13w
je 0x14000a18f
cmp word [rbx], dx
je 0x140009efb
cmp word [rbx], r13w
je 0x140009ef0
cmp word [rbx], 9
je 0x140009ef0
mov r13d, 1
cmp word [rbx], dx
je 0x140009efb
cmp word [rbx], 9
jne 0x140009f06
add rbx, 2
mov qword [rsp + 0x68], rbx
jmp 0x140009ef0
lea rax, [rbp + 0x1050]
mov qword [rbp - 0x28], rax
xor eax, eax
cmp word [r12], 0x63
jne 0x140009f24
test r13d, r13d
jne 0x14000a311
cmp word [r12], 0x50
jne 0x140009fb6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax + 0xa]
cmp ebx, 1
jle 0x140009f57
movsxd rdx, ebx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x140009f5e
lea rdi, [rbp + 0xa8]
xor r15d, r15d
test rdi, rdi
je 0x14000a37d
mov rcx, qword [rbp + 0x98]
lea rax, [rbp + 0xa8]
cmp rcx, rax
je 0x140009f83
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x68]
mov r8d, ebx
mov qword [rbp + 0x98], rdi
mov dword [rbp + 0xa0], ebx
mov qword [rbp + 8], rdi
call fcn.140008f90
test al, al
je 0x14000a325
mov r15, qword [0x14001af28]
jmp 0x140009fe9
cmp word [r12], 0x71
je 0x140009fc6
cmp word [r12], 0x63
jne 0x140009fcb
test r13d, r13d
je 0x140009ff5
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x68]
mov r8d, 0x400
call fcn.140008f90
xor ecx, ecx
test al, al
je 0x14000a327
mov rbx, qword [rsp + 0x68]
mov edx, LeaveCriticalSection
xor eax, eax
movzx edi, word [rbx]
cmp di, dx
je 0x14000a003
cmp di, 9
jne 0x14000a00e
add rbx, 2
mov qword [rsp + 0x68], rbx
jmp 0x140009ff5
cmp word [r12], 0x46
je 0x14000a02e
cmp word [r12], 0x71
je 0x14000a02e
cmp word [r12], 0x4a
je 0x14000a02e
cmp word [r12], 0x6c
jne 0x14000a0aa
test r13d, r13d
je 0x14000a0aa
cmp word [r12], 0x71
lea rax, [rbp + 0x1850]
lea r10, [rbp + 0x1050]
lea rdx, [rbp + 0x1850]
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x70], r10
mov qword [rbp - 0x80], rdx
je 0x14000a0b3
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x68]
mov r8d, 0x400
call fcn.140008f90
xor r13d, r13d
test al, al
je 0x14000a384
mov rbx, qword [rsp + 0x68]
lea r8d, [r13 + 0x20]
movzx edi, word [rbx]
cmp di, r8w
je 0x14000a094
cmp di, 9
jne 0x14000a09f
add rbx, 2
mov qword [rsp + 0x68], rbx
jmp 0x14000a085
mov rdx, qword [rbp - 0x80]
mov r10, qword [rsp + 0x70]
jmp 0x14000a0b6
mov r10, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x80]
xor r13d, r13d
cmp word [r12], 0x61
jb 0x14000a0f9
cmp word [r12], 0x7a
ja 0x14000a0f9
lea rax, [0x1400021b0]
mov rcx, r10
sub r12, rax
lea rax, [0x140000000]
sar r12, 1
call qword [rax + r12*8 + 0x17660]
test eax, eax
jne 0x14000a18f
mov r15, qword [0x14001af28]
jmp 0x14000a296
test r15, r15
je 0x14000a1f1
cmp word [r12], 0x50
mov eax, 0x41
jne 0x14000a172
cmp word [r15], ax
jne 0x14000a172
lea rdx, [rbp + 0x2050]
mov ecx, eax
call fcn.1400080c0
test eax, eax
jne 0x14000a18f
lea rdx, [rbp + 0xc80]
lea ecx, [rax + 0x1e]
mov r15, r12
mov qword [0x14001af28], r12
lea rax, [rbp + 0xc80]
sub r10, rdx
test rcx, rcx
je 0x14000a165
movzx edx, word [r10 + rax]
test dx, dx
je 0x14000a160
mov word [rax], dx
add rax, 2
dec rcx
jne 0x14000a145
test rcx, rcx
jne 0x14000a169
sub rax, 2
mov word [rax], r13w
jmp 0x14000a296
cmp word [r15], 0x50
jne 0x14000a18f
cmp word [r12], ax
jne 0x14000a18f
mov ecx, eax
call fcn.1400080c0
test eax, eax
je 0x14000a296
xor edx, edx
xor ecx, ecx
call fcn.140006c20
mov esi, r14d
call fcn.1400092d4
test esi, esi
jne 0x14000a446
cmp qword [0x14001af28], r13
jne 0x14000a1c5
xor edx, edx
xor ecx, ecx
call fcn.140006c20
mov esi, r14d
test esi, esi
jne 0x14000a446
mov eax, dword [0x14001afa4]
test eax, eax
je 0x14000a446
lea r14, [0x140000000]
test eax, eax
je 0x14000a4fe
xor edx, edx
xor ecx, ecx
call qword [0x140017780]
jmp 0x14000a512
cmp word [r12], 0x50
mov r15, r12
mov qword [0x14001af28], r12
je 0x14000a248
lea r8, [rbp + 0x2050]
mov ecx, 0x400
lea rax, [rbp + 0x2050]
sub rdx, r8
mov qword [rbp - 0x80], rdx
test rcx, rcx
je 0x14000a240
movzx edx, word [rdx + rax]
test dx, dx
je 0x14000a23b
mov word [rax], dx
mov rdx, qword [rbp - 0x80]
add rax, 2
dec rcx
jne 0x14000a21d
test rcx, rcx
jne 0x14000a244
sub rax, 2
mov word [rax], r13w
lea rdx, [rbp + 0xc80]
mov ecx, LeaveCriticalSection
lea rax, [rbp + 0xc80]
sub r10, rdx
test rcx, rcx
je 0x14000a27e
movzx edx, word [r10 + rax]
test dx, dx
je 0x14000a279
mov word [rax], dx
add rax, 2
dec rcx
jne 0x14000a25e
test rcx, rcx
jne 0x14000a282
sub rax, 2
mov word [rax], r13w
mov eax, 0x45
cmp word [r12], ax
je 0x14000a38f
lea r11, [rbp + 0x1050]
lea rax, [rbp + 0x1850]
mov word [rbp + 0x1050], r13w
mov word [rbp + 0x1850], r13w
mov r12d, 0x104
mov qword [rbp - 0x80], r11
mov qword [rsp + 0x70], rax
mov edx, LeaveCriticalSection
test di, di
je 0x14000a38a
lea r8, [0x1400021b0]
jmp 0x140009d5c
xor edx, edx
xor ecx, ecx
call fcn.140006c20
mov esi, r14d
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000a19b
mov rcx, qword [rbp + 0x820]
test rcx, rcx
je 0x14000a19b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14000a19b
xor edx, edx
xor ecx, ecx
call fcn.140006c20
mov esi, r14d
xor r13d, r13d
jmp 0x14000a19b
xor ecx, ecx
xor edx, edx
call fcn.140006c20
cmp dword [rbp + 0xb8], reloc.ADVAPI32.dll_TraceMessage
jle 0x14000a347
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0xa0], 1
lea rax, [rbp + 0xc0]
mov dword [rbp + 0xb8], reloc.ADVAPI32.dll_TraceMessage
mov qword [rbp + 0xb0], rax
jle 0x14000a375
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, r14d
jmp 0x14000b3a6
mov esi, 0xe
jmp 0x14000a31d
xor edx, edx
xor ecx, ecx
jmp 0x14000a329
mov eax, 0x45
test r15, r15
je 0x14000a19b
mov edi, 0x59
lea ebx, [rdi + 1]
cmp ax, word [r15]
je 0x14000a3be
cmp di, word [r15]
je 0x14000a3be
cmp bx, word [r15]
je 0x14000a3be
call fcn.1400092d4
mov r15, qword [0x14001af28]
cmp word [r15], 0x50
lea rax, [0x1400021b0]
lea rdx, [rbp + 0x2050]
cmove rdx, qword [rbp + 0x98]
sub r15, rax
lea r14, [0x140000000]
lea rcx, [rbp + 0xc80]
sar r15, 1
call qword [r14 + r15*8 + 0x17660]
mov rcx, qword [0x14001af28]
mov esi, eax
cmp word [rcx], di
je 0x14000a446
cmp word [rcx], bx
je 0x14000a446
test eax, eax
jne 0x14000a435
lea eax, [rsi + 0x45]
cmp word [rcx], ax
jne 0x14000a423
mov dword [0x14001afa4], 1
jmp 0x14000a1e2
mov eax, dword [0x14001afa4]
mov dword [rbp - 0x68], 1
jmp 0x14000a1da
cmp eax, 0x8000
jne 0x14000a494
mov dword [0x14001afa4], r13d
mov esi, r13d
cmp dword [rbp + 0xb8], reloc.ADVAPI32.dll_TraceMessage
jle 0x14000a45f
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0xa0], 1
lea rax, [rbp + 0xc0]
mov dword [rbp + 0xb8], reloc.ADVAPI32.dll_TraceMessage
mov qword [rbp + 0xb0], rax
jle 0x14000a48d
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x14000b3a6
mov eax, 0x4eb
cmp esi, eax
jg 0x14000a4c6
je 0x14000a1bd
cmp esi, 0xfffffffe
jl 0x14000a4f2
test esi, esi
js 0x14000a1bf
cmp esi, 1
jle 0x14000a4f2
cmp esi, 3
jle 0x14000a4bf
cmp esi, 0x7b
jne 0x14000a4f2
mov esi, 0x653
jmp 0x14000a4f2
cmp esi, 0x642
jl 0x14000a4f2
cmp esi, 0x644
jle 0x14000a1bd
cmp esi, 0x669
je 0x14000a1bd
cmp esi, 0xbc2
je 0x14000a1bd
mov ecx, esi
call fcn.140008aac
jmp 0x14000a1bd
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [0x140001a38]
call fcn.140013e34
cmp dword [rbp - 0x68], r13d
je 0x14000a574
cmp dword [0x14001afa4], r13d
jne 0x14000a581
mov ebx, r13d
movsxd rcx, ebx
lea r8, [0x140002318]
mov r9d, 1
lea rax, [rcx*4 + 0x1afa0]
lea rdx, [rcx*8 + 0x198b0]
shl rcx, 4
add rcx, r8
add rax, r14
lea r8d, [r9 + 3]
add rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x14000a56d
inc ebx
cmp ebx, 1
jl 0x14000a524
jmp 0x14000a574
mov dword [rbp - 0x3c], 1
cmp dword [0x14001afa4], r13d
je 0x14000b310
mov rax, qword gs:[0x60]
mov r9, qword [rsp + 0x68]
mov r10d, r13d
mov rcx, qword [rax + 0x20]
mov rbx, 0xffffffff80000001
bts dword [rcx + 8], 0x13
xor eax, eax
lea edi, [rax + 0x20]
lea r11d, [rax + 0x30]
mov qword [rbp + 0xc60], rax
mov qword [rbp + 0xc68], rax
cmp word [r9], r11w
jb 0x14000a5e2
cmp word [r9], 0x39
ja 0x14000a5e2
mov eax, r10d
and eax, ebx
jge 0x14000a5d4
dec eax
or eax, 0xfffffffe
inc eax
neg eax
movzx eax, word [r9]
sbb r8d, r8d
sub eax, r11d
jmp 0x14000a616
mov eax, 0x41
cmp word [r9], ax
jb 0x14000a697
cmp word [r9], 0x46
ja 0x14000a697
mov eax, r10d
and eax, ebx
jge 0x14000a60a
dec eax
or eax, 0xfffffffe
inc eax
neg eax
movzx eax, word [r9]
sbb r8d, r8d
sub eax, 0x37
and r8d, 0xfffffff1
add r8d, 0x10
imul r8d, eax
cmp r10d, edi
jge 0x14000a646
mov eax, r10d
inc r10d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
or byte [rbp + rcx + 0xc60], r8b
add r9, 2
jmp 0x14000a5b9
cmp dword [rbp + 0xb8], reloc.ADVAPI32.dll_TraceMessage
jle 0x14000a65f
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rbp + 0xb8], reloc.ADVAPI32.dll_TraceMessage
cmp dword [rbp + 0xa0], 1
lea rax, [rbp + 0xc0]
mov qword [rbp + 0xb0], rax
jle 0x14000a68d
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x641
jmp 0x14000b3a6
cmp r10d, edi
jne 0x14000a646
xor edi, edi
mov r14b, dil
mov r15b, dil
mov r12b, dil
mov byte [rsp + 0x60], dil
cmp word [r9], di
je 0x14000a6b6
add r9, 2
cmp word [r9], 0x43
jne 0x14000a6c5
mov r13b, 1
jmp 0x14000a752
cmp word [r9], 0x55
jne 0x14000a6d4
mov r13b, 1
mov r15b, r13b
jmp 0x14000a752
cmp word [r9], ax
jne 0x14000a6e4
mov r12b, 1
mov byte [rsp + 0x60], r12b
jmp 0x14000a752
cmp word [r9], 0x4d
je 0x14000a6f8
mov eax, 0x45
cmp word [r9], ax
jne 0x14000a752
jmp 0x14000a6fb
mov r14b, 1
lea r8, [r9 + 4]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
test rax, rax
je 0x14000b2f7
cmp rax, 0xffffffffffffffff
je 0x14000b2f7
or edx, reloc.ADVAPI32.dll_TraceMessage
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14000a74b
mov edx, edi
lea rcx, [0x140001ad0]
jmp 0x14000b306
mov rbx, 0xffffffff80000001
or qword [rsp + 0x78], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 2
lea r8d, [rdx - 1]
lea r9, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x14000a790
or qword [rsp + 0x78], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x14000a646
test r14b, r14b
jne 0x14000a79b
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test r14b, r14b
je 0x14000a7c0
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp]
lea edx, [rdi + 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r14d, r14d
test eax, eax
je 0x14000a858
cmp byte [0x14001b3e0], r14b
jne 0x14000a7fa
lea rcx, [rbp + 0x10]
call fcn.140005358
mov rbx, qword [rbp + 0x10]
jmp 0x14000a804
lea rbx, [0x14001b3f0]
mov eax, r14d
test eax, eax
jne 0x14000a847
mov rcx, qword [rbp]
lea rax, [rbp + 0x30]
lea r8, [rbp + 0xce0]
mov r9d, 0x58
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000a847
mov rcx, qword [rbp + 0xce0]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb edi, edi
and edi, 2
inc edi
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x104
jmp 0x14000a899
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0xe42]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0xe40], r14w
mov ebx, eax
call sub.msvcrt.dll_memset
mov r9d, ebx
mov ebx, 0x104
lea r8, [0x140001b40]
lea rcx, [rbp + 0xe40]
mov edx, ebx
call fcn.1400050f4
test r15b, r15b
je 0x14000a8a8
cmp edi, 1
jne 0x14000a8b8
mov edi, 7
test r12b, r12b
je 0x14000a8fb
test edi, edi
jne 0x14000a8f1
mov edi, 4
jmp 0x14000a8fb
test edi, edi
jne 0x14000a8c3
mov edi, 6
jmp 0x14000a8a8
lea rcx, [0x140001b80]
xor edx, edx
call fcn.1400087fc
cmp dword [rbp + 0xb8], ebx
jle 0x14000a8e6
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rbp + 0xb8], ebx
jmp 0x14000a669
cmp edi, 1
jne 0x14000a8d1
mov edi, 5
mov r12d, 0x100
mov r15d, 3
mov dword [rbp - 0x30], r12d
mov r8d, r15d
test edi, edi
je 0x14000a92b
cmp edi, 1
je 0x14000a92b
cmp edi, 4
je 0x14000a92b
cmp edi, 5
je 0x14000a92b
cmp edi, 6
je 0x14000a92b
cmp edi, 7
jne 0x14000a931
mov r8d, 2
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xd40]
call fcn.140005458
mov ebx, eax
test eax, eax
je 0x14000a980
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000a958
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0xb8], reloc.ADVAPI32.dll_TraceMessage
jle 0x14000a971
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rbp + 0xb8], reloc.ADVAPI32.dll_TraceMessage
jmp 0x140009cb5
movsxd rbx, dword [rbp - 0x30]
mov dword [rbp - 0x18], ebx
mov dword [rbp - 0x5c], ebx
mov dword [rbp - 0x48], ebx
mov dword [rbp - 0x40], ebx
mov dword [rbp - 0x34], ebx
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], ebx
cmp ebx, r12d
jle 0x14000a9c1
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [rbp - 0x5c]
mov qword [rbp + 0x3e0], rax
test rax, rax
jne 0x14000a9e0
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r14d
jmp 0x14000a9e0
lea rcx, [rbp + 0x3f0]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rbp + 0x3f0]
mov qword [rbp + 0x3e0], r11
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], ebx
cmp ebx, r12d
jle 0x14000aa0b
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x600], rax
test rax, rax
jne 0x14000aa2a
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r14d
jmp 0x14000aa2a
lea rcx, [rbp + 0x610]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rbp + 0x610]
mov qword [rbp + 0x600], r11
movsxd rax, dword [rbp - 0x48]
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], eax
cmp eax, r12d
jle 0x14000aa59
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x4f0], rax
test rax, rax
jne 0x14000aa78
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r14d
jmp 0x14000aa78
lea rcx, [rbp + 0x500]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rbp + 0x500]
mov qword [rbp + 0x4f0], r11
movsxd rax, dword [rbp - 0x40]
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], eax
cmp eax, r12d
jle 0x14000aaaa
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
mov qword [rbp + 0x2d0], rax
test rax, rax
jne 0x14000aac9
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r14d
jmp 0x14000aac9
lea rcx, [rbp + 0x2e0]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rbp + 0x2e0]
mov qword [rbp + 0x2d0], rbx
movsxd rax, dword [rbp - 0x34]
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], eax
cmp eax, r12d
jle 0x14000aaff
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, qword [rbp + 0x2d0]
mov qword [rbp + 0x710], rax
test rax, rax
jne 0x14000ab1e
mov dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r14d
jmp 0x14000ab1e
lea rcx, [rbp + 0x720]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x720]
mov qword [rbp + 0x710], rax
mov r9, qword [rbp + 0x600]
mov rdx, qword [rbp + 0x3e0]
lea rcx, [rbp - 0x34]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x4f0]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x5c]
lea rcx, [rbp + 0xd40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x14000ac2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x14000ab98
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000abb3
mov rcx, qword [rbp + 0x710]
test rcx, rcx
je 0x14000abb3
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000abce
mov rcx, qword [rbp + 0x2d0]
test rcx, rcx
je 0x14000abce
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000abe9
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x14000abe9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000ac04
mov rcx, qword [rbp + 0x600]
test rcx, rcx
je 0x14000ac04
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000a958
mov rcx, qword [rbp + 0x3e0]
test rcx, rcx
je 0x14000a958
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14000a958
mov rcx, qword [rbp + 0x3e0]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
or edx, reloc.ADVAPI32.dll_TraceMessage
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r15d
call qword [0x140017770]
mov ebx, eax
test eax, eax
je 0x14000ad1b
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000ac79
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140001c50]
mov edx, ebx
call fcn.1400087fc
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000aca2
mov rcx, qword [rbp + 0x710]
test rcx, rcx
je 0x14000aca2
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000acbd
mov rcx, qword [rbp + 0x2d0]
test rcx, rcx
je 0x14000acbd
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000acd8
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x14000acd8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000acf3
mov rcx, qword [rbp + 0x600]
test rcx, rcx
je 0x14000acf3
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], r12d
jle 0x14000a646
mov rcx, qword [rbp + 0x3e0]
test rcx, rcx
je 0x14000a646
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14000a646
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r15, rax
test rax, rax
jne 0x14000ad4f
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000ac87
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ac87
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
test rax, rax
jne 0x14000adf4
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000ad7c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000ad9b
mov rcx, qword [rbp + 0x710]
test rcx, rcx
je 0x14000ad9b
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000adb5
mov rcx, qword [rbp + 0x2d0]
test rcx, rcx
je 0x14000adb5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000adcf
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x14000adcf
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000ade9
mov rcx, qword [rbp + 0x600]
test rcx, rcx
je 0x14000ade9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jmp 0x14000acfa
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x78], r14
call fcn.1400091f4
mov rbx, rax
test rax, rax
jne 0x14000ae55
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000ae1f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140001cb0]
xor edx, edx
call fcn.1400087fc
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14000ae3c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000ad7c
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14000ad7c
mov rax, qword [0x14001ab90]
mov dword [rbp - 0x60], r14d
mov dword [rbp - 0x38], r14d
mov qword [rbp - 8], r14
mov qword [rbp - 0x20], r14
test rax, rax
jne 0x14000ae8e
lea rcx, [0x1400013f8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x14001ab90], rax
test rax, rax
je 0x14000b2d8
lea rdx, [0x140001408]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b2d8
lea r8, [rbp - 0x20]
lea rdx, [0x140002288]
lea rcx, [0x140002178]
call rax
test eax, eax
jne 0x14000b2d8
mov rcx, qword [rbp - 0x20]
lea r9, [rbp - 8]
lea r8, [0x140002178]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x18]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r14, qword [rbp - 8]
xor eax, eax
test r14, r14
je 0x14000b2d8
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000af05
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x70], rax
mov rax, qword [r14]
lea r8, [rsp + 0x70]
lea rdx, [0x140002238]
mov rcx, r14
call qword [rax]
mov r11, qword [r14]
mov rcx, r14
call qword [r11 + 0x10]
mov rcx, qword [rbp - 0x78]
xor r14d, r14d
mov dword [rbp - 0x64], edi
test rcx, rcx
je 0x14000af3d
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rbp - 0x38]
mov qword [rbp - 0x78], r14
mov r10, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x78]
lea r8, [rbp + 0xc60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
lea rdx, [rbp - 0x64]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov r9d, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [r10 + 0x70]
test eax, eax
je 0x14000afb3
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000af96
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140001d10]
xor edx, edx
call fcn.1400087fc
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
jmp 0x14000ae2d
mov r8d, dword [rbp - 0x60]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x14000afee
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000afdd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140001d80]
mov edx, eax
jmp 0x14000af9f
mov rcx, qword [rbp - 0x78]
call qword [0x140017768]
test eax, eax
je 0x14000b2d8
mov rcx, qword [rsp + 0x70]
lea r8, [rbp - 0x80]
lea rdx, [0x140002188]
mov rax, qword [rcx]
call qword [rax]
xor eax, eax
mov edx, eax
cmp edi, dword [rbp - 0x64]
jne 0x14000b028
cmp edi, 6
je 0x14000b028
cmp edi, 7
jne 0x14000b02c
lea rdx, [rbp - 0x64]
mov rcx, qword [rbp - 0x80]
lea r8, [rbp + 0xc60]
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rbp - 0x80]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rbp - 0x80]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov r10, qword [rcx]
mov r9b, byte [rsp + 0x60]
mov edx, dword [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x38]
mov r8b, r13b
mov dword [rsp + 0x20], eax
call qword [r10 + 0x148]
mov rcx, qword [rsp + 0x78]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14000b0a3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x78], 0xffffffffffffffff
xor r13d, r13d
test edi, edi
je 0x14000b0b6
lea rcx, [0x140001df0]
jmp 0x14000af9d
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x138]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14000b0e0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000b0f0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 3
mov qword [rbp + 0x28], r12
mov bl, r13b
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], r15
mov edi, 0x1cff
mov dword [0x14001a7d4], eax
mov ecx, eax
or r12d, reloc.ADVAPI32.dll_TraceMessage
lea rdx, [rbp + 0x18]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x14000b200
cmp eax, 1
je 0x14000b1f7
cmp eax, 2
jne 0x14000b17c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
mov dword [rbp - 0x44], r13d
mov rax, qword [rcx]
lea rdx, [rbp - 0x44]
call qword [rax + 0x160]
mov r8d, dword [rbp - 0x44]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x14000b1cd
mov qword [rbp + 0x18], rax
jmp 0x14000b1c3
cmp eax, 3
jne 0x14000b200
jmp 0x14000b19d
cmp dword [rbp + 0x40], 0x12
je 0x14000b1bd
lea rcx, [rbp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rbp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x14000b183
jmp 0x14000b1bf
mov bl, 1
test bl, bl
jne 0x14000b200
mov ecx, 3
jmp 0x14000b115
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000b1de
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140001d80]
mov edx, eax
call fcn.1400087fc
jmp 0x14000ad7c
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000b232
mov rcx, qword [rbp + 0x710]
test rcx, rcx
je 0x14000b232
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000b24c
mov rcx, qword [rbp + 0x2d0]
test rcx, rcx
je 0x14000b24c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000b266
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x14000b266
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000b280
mov rcx, qword [rbp + 0x600]
test rcx, rcx
je 0x14000b280
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + reloc.ADVAPI32.dll_TraceMessage], edi
jle 0x14000b29a
mov rcx, qword [rbp + 0x3e0]
test rcx, rcx
je 0x14000b29a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp - 0x68], r13d
je 0x14000b2b9
cmp dword [0x14001afa4], r13d
jne 0x14000b2b9
mov ecx, dword [0x14001afa0]
test ecx, ecx
je 0x14000b2b9
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rbp - 0x3c], r13d
je 0x14000a446
mov ecx, 0x641
call fcn.140008aac
jmp 0x14000a646
mov rcx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14000b2e9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x14000ae2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140001a60]
mov edx, eax
call fcn.1400087fc
jmp 0x14000a646
mov dword [0x14001a7d4], 1
lea rcx, [rbp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14000b34a
cmp dword [0x14001afac], r13d
je 0x14000b29a
cmp dword [0x14001ab98], r13d
je 0x14000b29a
lea rcx, [rbp + 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x14000b31a
cmp dword [rbp + 0xb8], r12d
jle 0x14000b376
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rbp + 0xc0]
mov dword [rbp + 0xb8], r12d
mov qword [rbp + 0xb0], rax
cmp dword [rbp + 0xa0], r15d
jle 0x14000b3a1
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x65b
mov rcx, qword [rbp + 0x2850]
xor rcx, rsp
call fcn.140015330
lea r11, [rsp + 0x2960]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret