Function at 0x1400274f0
Capabilities:
Compare security identifiers
Create process on windows
Create thread
Delete registry key
Enumerate process modules
Generate random numbers via rtlgenrandom
Generate random numbers via winapi
Get common file path
Get file version info
Get process image filename
Self delete
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x365f0
call fcn.14009f130
sub rsp, rax
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x365e0], rax
mov qword [rsp + 0xf8], rdx
mov dword [rsp + 0xd0], ecx
mov dword [rsp + 0x120], ecx
mov qword [rsp + 0x158], rdx
mov dword [rsp + 0x43c], 0xffffffff
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0xe5e0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x178], 0xffffffff
xor eax, eax
mov qword [rsp + 0x10e8], rax
mov dword [rsp + 0xe8], eax
xor edx, edx
mov r8d, 0xa080
lea rcx, [rsp + 0x11f0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0x185e0]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rsp + 0xc2c8], rax
mov word [rsp + 0xc2d0], ax
mov dword [rsp + 0xc8], eax
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rsp + 0x188], rax
mov dword [rsp + 0x10a8], eax
mov dword [rsp + 0x434], eax
xor edx, edx
mov r8d, 0x14000
lea rcx, [rsp + 0x225e0]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x1d8], rax
mov dword [rsp + 0x10d8], eax
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x70], eax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rsp + 0x10f0], xmm0
movups xmmword [rsp + 0x1100], xmm0
movups xmmword [rsp + 0x1110], xmm0
movups xmmword [rsp + 0x1120], xmm0
movups xmmword [rsp + 0x1130], xmm0
movups xmmword [rsp + 0x1140], xmm0
mov qword [rsp + 0x1150], rcx
xorps xmm1, xmm1
movups xmmword [rsp + 0x1180], xmm1
movups xmmword [rsp + 0x1190], xmm1
movups xmmword [rsp + 0x11a0], xmm1
movups xmmword [rsp + 0x11b0], xmm1
movups xmmword [rsp + 0x11c0], xmm1
movups xmmword [rsp + 0x11d0], xmm1
mov qword [rsp + 0x11e0], rcx
mov dword [rsp + 0x90], eax
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x198], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x10b4], eax
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0xb2c0]
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [0x1400d0308]
movups xmmword [rsp + 0xc3a0], xmm0
movzx eax, word [0x1400d0318]
mov word [rsp + 0xc3b0], ax
movups xmm0, xmmword [0x1400d5cd8]
movups xmmword [rsp + 0xc3b8], xmm0
movsd xmm1, qword [0x1400d5ce8]
movsd qword [rsp + 0xc3c8], xmm1
movzx eax, word [0x1400d5cf0]
mov word [rsp + 0xc3d0], ax
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0xd9e0]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rsp + 0x10d0], rax
mov qword [rsp + 0x190], rax
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0xd5e0]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x10b0], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x1160], xmm0
mov qword [rsp + 0xc0], rax
movups xmmword [rsp + 0x1170], xmm0
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0xdde0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0xe1e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc6e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xd3e0]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xc2f8], xmm0
movups xmmword [rsp + 0xc308], xmm0
mov dword [rsp + 0xc318], eax
mov byte [rsp + 0xc31c], al
movups xmmword [rsp + 0xc350], xmm0
movups xmmword [rsp + 0xc360], xmm0
movups xmmword [rsp + 0xc370], xmm0
movups xmmword [rsp + 0xc380], xmm0
mov qword [rsp + 0xc390], rax
mov word [rsp + 0xc398], ax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xd1e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xcfe0]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0xc2c0], eax
mov word [rsp + 0xc2c4], ax
mov dword [rsp + 0x440], eax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc4e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xcae0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc8e0]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
movups xmmword [rsp + 0x250], xmm0
xor eax, eax
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], rax
mov dword [rsp + 0x10ac], eax
movdqu xmmword [rsp + 0xb298], xmm0
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x78], eax
mov r15d, eax
mov qword [rsp + 0x58], rax
movdqu xmmword [rsp + 0xb270], xmm0
mov qword [rsp + 0xb280], rax
mov dword [rsp + 0x10a4], eax
mov dword [rsp + 0x10a0], eax
mov dword [rsp + 0x10b8], 1
mov dword [rsp + 0x98], eax
mov dword [rsp + 0xe0], eax
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1d0], rax
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0xc3e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0xcce0]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xc338], xmm0
mov dword [rsp + 0xc348], eax
mov qword [rsp + 0xc2e8], rax
mov word [rsp + 0xc2f0], ax
movups xmmword [rsp + 0xc320], xmm0
mov dword [rsp + 0xc330], eax
mov qword [rsp + 0xc2d8], rax
mov word [rsp + 0xc2e0], ax
mov qword [rsp + 0xb2a8], rax
mov qword [rsp + 0xb2b0], rax
mov qword [rsp + 0xb2b8], rax
lea r13, [0x140101140]
mov qword [rsp + 0x10e0], rax
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1a0], rax
mov dword [rsp + 0x438], eax
mov qword [rsp + 0xb8], rax
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xcde0]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x10bc], eax
mov qword [rsp + 0x10c8], rax
mov qword [rsp + 0x10c0], rax
mov dword [rsp + 0x430], eax
mov r12d, eax
mov qword [rsp + 0x50], rax
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x88], r14
call fcn.14003a5c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
test rax, rax
je 0x140027af1
xor eax, eax
mov dword [rsp + 0x68], eax
mov ebx, eax
lea rcx, [0x1400b1520]
cmp ebx, 0xa
jae 0x140027b03
mov eax, ebx
imul rdi, rax, 0x228
lea rdx, str.set_current_directory
add rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140027af1
lea rcx, [0x1400b1520]
mov qword [rcx + rdi + 0x18], rax
inc ebx
mov dword [rsp + 0x68], ebx
jmp 0x140027ab7
mov dword [rsp + 0x74], 0x102
mov esi, 1
jmp 0x140027e71
mov r9, rcx
mov r8, rsi
mov edx, 5
mov rcx, r13
call fcn.140089c00
cmp eax, 1
je 0x140027af1
call fcn.14007d1c0
lea rbx, [0x140112c58]
cmp eax, 1
jne 0x140027c91
mov rdx, rbx
mov rcx, r13
call fcn.140009120
test eax, eax
jne 0x140027af1
mov r12, rbx
mov qword [rsp + 0x50], rbx
lea r14, [0x140112d10]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x88], r14
mov dword [0x140113a0c], 1
xor edx, edx
mov r8d, 0xc50
lea rdi, [rsp + 0x450]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x30e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x30e
mov rdx, rbx
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, str.C:JenkinsWorkspaceBUILD_2GitReposiecsdk_srcenergy_server_driversesrvdriver.c
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2fec]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x4f25
mov eax, dword [0x140112c88]
mov dword [rsp + 0x46c], eax
inc eax
mov dword [0x140112c88], eax
mov r9d, esi
mov r8, rdi
mov rdx, rbx
mov rcx, r13
call fcn.1400056d0
mov dword [0x140112ca8], eax
mov qword [0x140112d20], rsi
xor eax, eax
mov dword [0x140112d1c], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x140027c84
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [0x140112ca8], eax
mov dword [rsp + 0x74], 0x102
jmp 0x140027e71
mov qword [rsp + 0x50], rbx
lea r14, [0x140112d10]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x88], r14
mov qword [sym.esrv.exe_p_exception_esrv], r13
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [rsp + 0x178], eax
or eax, 0x8003
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov r9, qword [rsp + 0xf8]
mov r8d, dword [rsp + 0xd0]
mov edx, 2
mov rcx, r13
call fcn.14001d910
mov r12, rbx
mov qword [rsp + 0x50], rbx
test eax, eax
je 0x140027dd1
mov dword [rsp + 0x430], 0x273
xor edx, edx
mov r8d, 0xc50
lea rdi, [rsp + 0x450]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x273
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x273
mov rdx, rbx
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5c20]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2fcc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5109
jmp 0x140027c29
mov dword [0x1401019f0], 1
lea rdx, str.Starting_Energy_Server.__COMMON_
mov rcx, r13
call fcn.140017150
lea rdx, str.Initializing_Energy_Server_Data.__COMMON_
mov rcx, r13
call fcn.140017150
xor edx, edx
mov rcx, r13
call fcn.14003cc10
mov dword [rsp + 0x74], 0x102
lea r15, [0x140187360]
jmp 0x140028a59
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140027e67
mov qword [r14 + 0x10], 1
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
jne 0x140036efb
mov esi, 1
mov r15, qword [rsp + 0x58]
cmp dword [0x1401219d8], 0
je 0x140027e88
cmp dword [rsp + 0x98], 1
jne 0x1400285df
cmp dword [0x1401219f0], 0
jne 0x140027e9a
cmp dword [0x140121a20], 1
je 0x140027ea7
cmp dword [0x140121a24], 1
jne 0x1400285df
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc4e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xcae0]
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rsp + 0xc4e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rsp + 0xc4e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400ce098]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xcae0]
call fcn.140001140
xor eax, eax
mov qword [rsp + 0xc2c8], rax
mov word [rsp + 0xc2d0], ax
mov qword [rsp + 0x150], 0xa
mov byte [0x14017ebd1], al
mov dword [rsp + 0x68], eax
mov edi, eax
nop dword [rax + rax]
mov ebx, edi
movsx eax, byte [rbx + r13 + 0x7da88]
test al, al
je 0x140027f7d
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
jne 0x140027f65
mov byte [rbx + r13 + 0x7da88], al
jmp 0x140027f75
movzx eax, byte [rbx + r13 + 0x7da88]
mov byte [rsp + rbx + 0xc2c8], al
inc edi
mov dword [rsp + 0x68], edi
jmp 0x140027f40
lea rcx, [rsp + 0xc2c8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rsp + 0x9c], eax
add eax, 0xffff3f94
cmp eax, 0x64
ja 0x14002856b
lfence
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc8e0]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x20], eax
lea r9, [0x1400ce300]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xc8e0]
call fcn.140001140
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
movups xmmword [rsp + 0x250], xmm0
mov dword [rsp + 0x1f0], WSACleanup
xor eax, eax
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], rax
mov word [rsp + 0x230], ax
mov dword [rsp + 0x22c], esi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb270], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb278], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb280], rax
xor eax, eax
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x78], eax
lea r9, [rsp + 0x180]
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x14002850b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14002818e
mov dword [rsp + 0x430], 3
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 3]
mov r12, qword [rsp + 0x50]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce0f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bdd24]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa9ca
jmp 0x140028281
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x180]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
mov qword [rsp + 0x58], rax
xor edx, edx
test rax, rax
jne 0x1400282f9
mov dword [rsp + 0x430], 3
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 3]
mov r12, qword [rsp + 0x50]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce280]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bddc4]
mov edx, 0x9f6
lea r8, [r15 - 1]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r15b
mov dword [rsp + 0xe98], 0xa989
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
mov r14, qword [rsp + 0x88]
mov qword [rsp + 0x60], r14
test r14, r14
je 0x1400285df
mov qword [r14 + 0x10], 1
xor eax, eax
mov dword [r14 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x1400285df
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
jmp 0x1400285df
mov r8, qword [rsp + 0x180]
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x180]
xor r8d, r8d
mov edx, esi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor edx, edx
test eax, eax
jne 0x1400283f8
mov dword [rsp + 0x430], 3
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 3]
mov r12, qword [rsp + 0x50]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce1f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bdd9c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa9a2
jmp 0x140028281
mov dword [rsp + 0x78], esi
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0xb270]
mov r8d, 0x20002
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x140028501
mov dword [rsp + 0x430], 3
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 3]
mov r12, qword [rsp + 0x50]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce170]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bdd54]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa9ba
jmp 0x140028281
mov qword [rsp + 0x258], r15
jmp 0x140028510
mov r15, qword [rsp + 0x58]
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80020
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xc8e0]
lea rcx, [rsp + 0xcae0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r14, qword [rsp + 0x88]
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
je 0x14002858a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x1a8], 0
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x1400285a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x1b0], 0
cmp dword [rsp + 0x78], 1
jne 0x1400285b9
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
test r15, r15
je 0x1400285da
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov r12, qword [rsp + 0x50]
cmp dword [0x1401219c8], 0
jne 0x140028604
mov dword [0x1401219c8], 1
mov rcx, qword [0x1401219d0]
test rcx, rcx
je 0x140028604
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x140121788], 1
jne 0x1400286ee
cmp qword [0x140121798], 0
je 0x1400286ee
cmp qword [0x1401217a0], 0
je 0x1400286ee
lea rdx, [0x1400ce0b0]
mov rcx, r13
call fcn.140017150
mov dword [0x1401217a8], 3
mov rcx, qword [0x1401217a0]
test rcx, rcx
je 0x140028658
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor ebx, ebx
mov dword [rsp + 0xac], ebx
mov edi, 0x102
nop word [rax + rax]
lea rdx, [rsp + 0x178]
mov rcx, qword [0x140121798]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
jne 0x1400286c6
cmp dword [rsp + 0x178], 0x103
jne 0x1400286c6
mov edx, 0x1f4
mov rcx, qword [0x140121798]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x178], eax
cmp eax, edi
jne 0x1400286c6
mov eax, ebx
inc ebx
mov dword [rsp + 0xac], ebx
cmp eax, 4
jae 0x1400286c6
jmp 0x140028670
mov qword [0x140121798], 0
mov rcx, qword [0x1401217a0]
test rcx, rcx
je 0x1400286ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401217a0], 0
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x14002870d
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x130], 0
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x14002872c
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x148], 0
mov rcx, qword [0x14017ed30]
test rcx, rcx
je 0x140028749
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ed30], 0
cmp dword [0x140112c90], 0
jbe 0x140028785
cmp dword [0x140113a0c], 0
jne 0x140028770
mov r8d, 1
lea rdx, [0x140112c58]
mov rcx, r13
call fcn.140006b50
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140112c58]
mov rcx, r13
call fcn.1400045a0
lea rdx, [0x140112c58]
mov rcx, r13
call fcn.140008db0
mov rcx, r13
call fcn.140018c50
cmp qword [0x1401139d8], 0
je 0x1400287d0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, qword [0x1401139d8]
cmp rcx, rax
je 0x1400287d0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x1401139d8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea r15, [0x140187360]
mov rdi, r15
xor eax, eax
mov ecx, 0xa8
rep stosb byte [rdi], al
mov qword [0x14011e2c8], rax
cmp dword [0x140185e4c], 1
jne 0x140028800
mov qword [0x14011e2b0], rax
mov dword [0x140185e4c], eax
cmp dword [0x140186e60], 1
jne 0x140028824
lea rcx, [0x140186e68]
call fcn.14007f5b0
xor eax, eax
mov qword [0x14011e2b8], rax
mov dword [0x140186e60], eax
mov rax, qword [0x140114130]
test rax, rax
je 0x14002888e
xor esi, esi
mov dword [rsp + 0xb0], esi
mov edi, esi
nop dword [rax + rax]
cmp edi, dword [0x140114128]
jae 0x140028876
mov ebx, edi
mov rcx, qword [rax + rbx*8]
test rcx, rcx
je 0x14002886b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140114130]
mov qword [rax + rbx*8], rsi
mov rax, qword [0x140114130]
inc edi
mov dword [rsp + 0xb0], edi
jmp 0x140028840
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x140114130], rax
mov dword [0x140114128], eax
cmp dword [0x1401139c0], 1
jne 0x1400288b8
mov rcx, qword [0x1401139b8]
test rcx, rcx
je 0x1400288b8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x1401139b8], rax
mov dword [0x1401139c0], eax
cmp dword [0x140121720], 1
jne 0x1400288e2
mov rcx, qword [0x140121728]
test rcx, rcx
je 0x1400288e2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x140121728], rax
mov dword [0x140121720], eax
cmp dword [0x1401139d0], 1
jne 0x14002890c
mov rcx, qword [0x1401139c8]
test rcx, rcx
je 0x14002890c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x1401139c8], rax
mov dword [0x1401139d0], eax
cmp dword [0x1401219d8], 0
jne 0x140028958
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x140028932
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], 0
cmp dword [0x1401219d8], 0
jne 0x140028958
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x140028958
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], 0
mov rcx, qword [rsp + 0x1a0]
test rcx, rcx
je 0x140028977
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [rsp + 0x1a0], rax
jmp 0x140028979
xor eax, eax
cmp qword [rsp + 0xb8], 0
je 0x1400289d6
mov dword [rsp + 0xcc], eax
mov esi, eax
nop dword [rax]
cmp esi, dword [rsp + 0x438]
jae 0x1400289c5
mov ebx, esi
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rdi + rbx*8]
test rcx, rcx
je 0x1400289ba
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + rbx*8], 0
inc esi
mov dword [rsp + 0xcc], esi
jmp 0x140028990
xor eax, eax
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0x438], eax
mov rcx, qword [0x1401217b0]
test rcx, rcx
je 0x1400289f7
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x1401217b0], rax
mov dword [0x1401217ac], eax
cmp dword [0x1401139e4], 1
je 0x140028a3e
cmp dword [0x1401219d8], 0
jne 0x140028a39
cmp dword [0x14017ed64], 0
jne 0x140028a32
cmp dword [0x14017ed60], 0
jne 0x140028a32
cmp dword [0x140113a7c], 0
jne 0x140028a2b
call fcn.140044bb0
jmp 0x140028a3e
call fcn.1400443f0
jmp 0x140028a3e
call fcn.140044590
jmp 0x140028a3e
call fcn.140044a30
cmp dword [0x1401219d8], 1
jne 0x140039865
cmp dword [rsp + 0x98], 0
jne 0x140039865
lea rsi, [0x140112c58]
lea rdi, [0x140186e68]
mov rcx, r13
call fcn.140018be0
cmp byte [str.ESRV_DRIVER], 0
je 0x140028a87
lea rdx, [0x1400d5678]
mov rcx, r13
call fcn.140016610
cmp dword [0x1401219d8], 1
jne 0x140029b31
mov dword [0x1401219c8], 0
mov rcx, qword [0x1401219d0]
test rcx, rcx
je 0x140028ab0
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rsp + 0x98], 0
mov eax, dword [0x1401219dc]
inc eax
mov ecx, eax
mov dword [0x1401219dc], eax
mov qword [0x14011e258], rcx
xor eax, eax
mov ebx, eax
cmp ecx, dword [0x1401219e0]
je 0x140028af5
mov eax, 1
mov dword [rsp + 0x98], eax
mov dword [rsp + 0xe0], eax
mov ebx, eax
xor eax, eax
mov qword [0x140174698], rax
mov qword [0x1401746a0], rax
mov qword [0x1401746a8], rax
mov qword [0x1401746b0], rax
mov qword [0x1401746b8], rax
mov qword [0x1401746c0], rax
mov qword [0x1401746c8], rax
mov qword [0x1401746d0], rax
mov qword [0x1401746d8], rax
mov qword [0x1401746e0], rax
mov qword [0x1401746e8], rax
mov qword [0x1401746f0], rax
mov qword [0x1401746f8], rax
mov qword [0x140174700], rax
mov qword [0x140174708], rax
mov qword [0x140174710], rax
mov qword [0x140174718], rax
mov qword [0x140174720], rax
mov qword [0x140174768], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [0x1401011a8], xmm0
movups xmmword [0x1401011b8], xmm0
mov qword [0x1401011c8], rcx
mov qword [0x140101180], rax
mov qword [0x140101188], rax
mov qword [0x140101190], rax
mov qword [0x140101198], rax
mov qword [0x140113978], rax
xorps xmm1, xmm1
movups xmmword [0x14011e198], xmm1
mov qword [0x14011e218], rax
movups xmmword [0x140171d48], xmm0
movups xmmword [0x140171d58], xmm0
movups xmmword [0x140171d68], xmm0
mov dword [0x140112cfc], eax
mov dword [0x140112d04], eax
mov dword [0x140112d0c], eax
movsd qword [0x140113968], xmm1
mov qword [0x140113970], rax
mov qword [0x140113960], rax
mov dword [0x14017ed38], eax
mov qword [0x14017ed40], rcx
mov qword [0x14017ed48], rcx
mov qword [0x14017ed60], rcx
mov dword [0x14017ed68], eax
mov qword [0x14017ee70], rcx
mov dword [0x14017ee78], eax
xor edx, edx
mov r8d, 0xd0
lea rcx, [0x14017ed98]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [0x14017ed88], rax
mov dword [0x140113990], eax
mov rdx, rsi
mov rcx, r13
call fcn.140009120
test eax, eax
je 0x140028c89
mov eax, 1
mov dword [0x1401219c8], eax
mov dword [rsp + 0x98], eax
mov dword [rsp + 0xe0], 2
mov esi, eax
jmp 0x140027e6c
mov qword [0x14011e298], rsi
mov esi, 1
cmp ebx, esi
jne 0x140028dde
mov dword [0x1401219c8], esi
cmp dword [rsp + 0xe0], esi
jne 0x140028dde
mov dword [rsp + 0x430], 0x85
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x85
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x85
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5af0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2f0c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5e72
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140027e6c
mov qword [r14 + 0x10], rsi
xor eax, eax
mov dword [r14 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x140027e6c
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
jmp 0x140027e6c
mov dword [rsp + 0x28], esi
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1d0]
lea r8, str.task
lea rdx, str.SYSTEMCurrentControlSetServicesUSER_ESRV_SVC_QUEENCREEK
mov rcx, 0xffffffff80000002
call fcn.14007f400
mov dword [rsp + 0x43c], eax
test eax, eax
jne 0x1400298fd
cmp qword [rsp + 0x1d0], 0
je 0x1400298fd
cmp qword [rsp + 0x1c8], 0
je 0x1400298fd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0xff
lea rdx, [rsp + 0xcde0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, eax
mov qword [rsp + 0x100], rax
lea rdi, [rax + 1]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
xor edx, edx
test rax, rax
jne 0x140028f50
mov dword [rsp + 0x430], 0x2b5
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x2b5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x2b5
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5930]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2d8c]
mov edx, 0x9f6
lea r8, [rbx - 1]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], bl
mov dword [rsp + 0xe98], 0x5ee8
jmp 0x140028d77
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0xcde0]
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x10e0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov r9, qword [rsp + 0x1c8]
mov r8, rbx
lea rdx, [rsp + 0x438]
mov rcx, qword [rsp + 0x1d0]
call fcn.14007cd50
mov qword [rsp + 0xb8], rax
test rax, rax
je 0x14002982c
cmp dword [rsp + 0x438], 0
je 0x14002982c
mov rcx, qword [rsp + 0x1d0]
test rcx, rcx
je 0x140028fde
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x1d0], 0
xor edx, edx
mov r8d, 0x9fff
lea rcx, [0x140114138]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0xc3e0]
call sub.VCRUNTIME140.dll_memset
mov r9, 0xffffffffffffffff
lea r8, [0x140171f18]
mov edx, 0xff
lea rcx, [rsp + 0xc3e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0xcce0]
call sub.VCRUNTIME140.dll_memset
mov r9, 0xffffffffffffffff
lea r8, [0x140171e14]
mov edx, 0xff
lea rcx, [rsp + 0xcce0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xc338], xmm0
mov dword [rsp + 0xc348], eax
lea r9, [rax - 1]
lea r8, [0x14017eb30]
lea edx, [rax + 0x14]
lea rcx, [rsp + 0xc338]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
xor eax, eax
mov qword [rsp + 0xc2e8], rax
mov word [rsp + 0xc2f0], ax
lea r9, [rax - 1]
lea r8, [0x14017eb44]
lea edx, [rax + 0xa]
lea rcx, [rsp + 0xc2e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xc320], xmm0
mov dword [rsp + 0xc330], eax
lea r9, [rax - 1]
lea r8, [0x14017eba0]
lea edx, [rax + 0x14]
lea rcx, [rsp + 0xc320]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
xor eax, eax
mov qword [rsp + 0xc2d8], rax
mov word [rsp + 0xc2e0], ax
lea r9, [rax - 1]
lea r8, [0x14017ebc8]
lea edx, [rax + 0xa]
lea rcx, [rsp + 0xc2d8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov r9, qword [rsp + 0x1c8]
mov r8, qword [rsp + 0xb8]
mov edx, dword [rsp + 0x438]
mov rcx, r13
call fcn.14004c280
test eax, eax
je 0x14002922f
cmp dword [0x1401140ec], 1
jne 0x14002915e
mov dword [0x1401140f0], 1
mov dword [0x140114108], 2
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5870]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2d2c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5f78
jmp 0x140028d77
mov eax, dword [0x140114108]
cmp dword [0x1401140ec], 1
cmove eax, esi
mov dword [0x140114108], eax
mov qword [rsp + 0x1c8], 0
lea rcx, [0x140121b98]
call fcn.14007f000
cmp eax, 1
jne 0x140029335
mov dword [rsp + 0x430], 0x6b
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x6b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x6b]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5810]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2cbc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5f93
jmp 0x140028d77
cmp dword [0x140121a04], 1
jne 0x14002942d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x14002942d
mov dword [rsp + 0x430], 0x69
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x69
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x69]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d57b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2a84]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5fcb
jmp 0x140028d77
lea rcx, [0x140121b98]
call fcn.14007f000
cmp eax, 1
jne 0x140029511
mov dword [rsp + 0x430], 0x6b
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x6b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x6b]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5750]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c297c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5ff5
jmp 0x140028d77
mov dword [0x140121bb4], 0
cmp dword [0x140121bb0], 1
jne 0x14002964a
mov dword [rsp + 0x430], 0x24a
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0x24a
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], ebx
lea rax, [0x1400d56f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c28ac]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x602a
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
test r14, r14
je 0x14002964a
mov qword [r14 + 0x10], rbx
xor eax, eax
mov dword [r14 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x14002964a
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
mov r8d, 0xff
lea rdx, [rsp + 0xc3e0]
lea rcx, [0x140171f18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140029704
mov r8d, 0xff
lea rdx, [rsp + 0xc3e0]
lea rcx, [0x140171f18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140029704
lea r8d, [rax + 0x14]
lea rdx, [rsp + 0xc338]
lea rcx, [0x14017eb30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140029704
lea r8d, [rax + 0xa]
lea rdx, [rsp + 0xc2e8]
lea rcx, [0x14017eb44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140029704
lea r8d, [rax + 0x14]
lea rdx, [rsp + 0xc320]
lea rcx, [0x14017eba0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140029704
lea r8d, [rax + 0xa]
lea rdx, [rsp + 0xc2d8]
lea rcx, [0x14017ebc8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14002b256
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x82
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x82
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 2
lea rax, [0x1400d5690]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2874]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6069
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
xor eax, eax
test r14, r14
je 0x14002b25d
mov qword [r14 + 0x10], rsi
mov dword [r14 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x14002b25b
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
jmp 0x14002b25b
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d58d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2d5c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5f19
jmp 0x140028d77
mov dword [rsp + 0x430], 0x6d
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x6d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x6d]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 3
lea rax, [0x1400d59f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2e74]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5eb3
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140029a21
mov qword [r14 + 0x10], rbx
xor eax, eax
mov dword [r14 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x140029a21
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x83
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0x83
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], ebx
lea rax, [0x1400d5990]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2e3c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x5eb9
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140029b31
mov qword [r14 + 0x10], rbx
xor eax, eax
mov dword [r14 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x140029b31
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
lea rdx, str.Parsing_User_Command.__COMMON_
mov rcx, r13
call fcn.140017150
cmp dword [0x140121b74], 1
jne 0x140029b67
lea rax, [0x140121b88]
mov qword [0x14011e2d0], rax
lea rax, [0x140121b78]
mov qword [0x14011e2d8], rax
jmp 0x140029b72
xorps xmm0, xmm0
movdqa xmmword [0x14011e2d0], xmm0
xor edx, edx
mov r8d, 0x1010
lea rbx, [0x140185e50]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x140186e68], xmm0
movups xmmword [0x140186e78], xmm0
movups xmmword [0x140186e88], xmm0
mov qword [0x140186e98], rax
mov rcx, rdi
call fcn.14007aa70
test eax, eax
jne 0x140029bc9
mov qword [0x14011e2b8], rdi
mov dword [0x140186e60], 1
jmp 0x140029bd8
xor eax, eax
mov qword [0x14011e2b8], rax
mov dword [0x140186e60], eax
mov rdx, rdi
mov rcx, rbx
call fcn.14007a6f0
test eax, eax
jne 0x140029bfa
mov qword [0x14011e2b0], rbx
mov dword [0x140185e4c], 1
jmp 0x140029c09
xor eax, eax
mov qword [0x14011e2b0], rax
mov dword [0x140185e4c], eax
call fcn.14007af00
movsd qword [0x14011e1a8], xmm0
call fcn.14007b8f0
mov qword [0x14011e248], rax
xor edx, edx
mov r8d, 0xa8
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0xb288], xmm0
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rsp + 0xb288], eax
cmp ebx, dword [str.Genu]
jne 0x140029c6a
cmp edx, dword [str.ineI]
jne 0x140029c6a
cmp ecx, dword [str.ntel]
jne 0x140029c6a
mov r8d, 1
jmp 0x140029c6d
xor r8d, r8d
mov dword [0x140187360], r8d
mov esi, 1
cmp r8d, esi
jne 0x140029ce1
movups xmmword [rsp + 0xb288], xmm0
mov eax, 7
xor ecx, ecx
cpuid
mov edi, ebx
mov dword [rsp + 0xb288], eax
mov dword [rsp + 0xb290], ecx
mov dword [rsp + 0xb294], edx
shr edi, 0x12
and edi, esi
mov dword [0x140187364], edi
movups xmmword [rsp + 0xb288], xmm0
mov eax, esi
xor ecx, ecx
cpuid
mov dword [rsp + 0xb288], eax
mov dword [rsp + 0xb28c], ebx
mov dword [rsp + 0xb294], edx
shr ecx, 0x1e
and ecx, esi
mov dword [0x140187368], ecx
jmp 0x140029ced
mov ecx, dword [0x140187368]
mov edi, dword [0x140187364]
cmp r8d, 1
jne 0x140029dde
cmp edi, r8d
jne 0x140029dde
cmp ecx, r8d
jne 0x140029dde
mov ecx, 0xa
mov dword [rsp + 0xe4], ecx
nop word [rax + rax]
mov eax, ecx
dec ecx
mov dword [rsp + 0xe4], ecx
test eax, eax
je 0x140029d3f
rdseed rax
mov qword [rsp + 0x10c8], rax
jb 0x140029d3f
jmp 0x140029d20
mov eax, dword [0x14018736c]
cmp ecx, 0xa
cmovae eax, esi
mov dword [0x14018736c], eax
xor eax, eax
mov ebx, eax
mov dword [rsp + 0x68], eax
nop dword [rax]
cmp eax, 0x10
jae 0x140029dcf
mov ecx, 0xa
mov dword [rsp + 0xe4], ecx
mov eax, ecx
dec ecx
mov dword [rsp + 0xe4], ecx
test eax, eax
je 0x140029d90
rdrand rax
mov qword [rsp + 0x10c8], rax
jb 0x140029d90
jmp 0x140029d71
mov eax, dword [0x140187370]
cmp ecx, 0xa
cmovae eax, esi
mov dword [0x140187370], eax
mov eax, ebx
lea rcx, [rax*8 + 0x86248]
add rcx, r13
mov r9d, 8
lea r8, [rsp + 0x10c8]
mov edx, r9d
call fcn.140039b10
inc ebx
mov dword [rsp + 0x68], ebx
mov eax, ebx
jmp 0x140029d60
mov dword [0x140187374], 1
jmp 0x140029f57
xor edx, edx
mov r8d, 0x800
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x140029e60
lea rdx, str.SystemFunction036
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rcx, rbx
test rax, rax
je 0x140029e5a
mov qword [rsp + 0x168], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x140029e60
mov edx, 0x80
lea rcx, [0x140187388]
mov rax, rdi
call qword [0x1400a4c40]
movzx eax, al
mov dword [rsp + 0xa4], eax
test eax, eax
je 0x140029e60
mov dword [0x14018737c], 1
jmp 0x140029f57
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x20], 0
mov r9d, esi
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x10c0]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140029ecf
lea r8, [0x140187388]
mov edx, 0x80
mov rcx, qword [rsp + 0x10c0]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140029ecf
xor edx, edx
mov rcx, qword [rsp + 0x10c0]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x140029ecf
mov qword [rsp + 0x10c0], 0
mov dword [0x140187380], 1
jmp 0x140029f57
mov r9d, 2
lea r8d, [r9 + 0x7e]
lea rdx, [0x140187388]
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x140029ef8
mov dword [0x140187384], 1
jmp 0x140029f57
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor eax, eax
mov dword [rsp + 0x68], eax
mov ebx, eax
cmp ebx, 0x20
jae 0x140029f4d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x10bc], eax
mov eax, ebx
lea rcx, [rax*4 + 0x86248]
add rcx, r13
mov r9d, 4
lea r8, [rsp + 0x10bc]
mov edx, r9d
call fcn.140039b10
inc ebx
mov dword [rsp + 0x68], ebx
jmp 0x140029f10
mov dword [0x140187378], 1
mov qword [0x14011e2c8], r15
mov r9d, 0x4002
mov r8, qword [rsp + 0xf8]
mov edx, dword [rsp + 0xd0]
mov rcx, r13
call fcn.14004c280
test eax, eax
je 0x14002a071
cmp dword [0x1401140ec], 1
jne 0x140029fa0
mov dword [0x1401140f0], 1
mov dword [0x14011410c], 2
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5600]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c284c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6399
jmp 0x140028d77
mov eax, dword [0x14011410c]
cmp dword [0x1401140ec], 1
mov esi, 1
cmove eax, esi
mov dword [0x14011410c], eax
cmp dword [0x140121a04], esi
jne 0x14002a179
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea edx, [rsi + 0x7f]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x14002a179
mov dword [rsp + 0x430], 0x69
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x69
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x68]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d55a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c27fc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x63d6
jmp 0x140028d77
lea rcx, [0x140121b98]
call fcn.14007f000
cmp eax, esi
jne 0x14002a257
mov dword [rsp + 0x430], 0x6b
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x6b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x6b]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5540]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2774]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6400
jmp 0x140028d77
mov dword [0x140121bb4], 0
cmp dword [0x140121bb0], esi
jne 0x14002a38a
mov dword [rsp + 0x430], 0x24a
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x24a
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], esi
lea rax, [0x1400d54e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c274c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6435
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
test r14, r14
je 0x14002a38a
mov qword [r14 + 0x10], rsi
xor eax, eax
mov dword [r14 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x14002a38a
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
mov r9, qword [0x1401214c0]
test r9, r9
je 0x14002a3c3
cmp byte [r9], 0
je 0x14002a3c3
mov edx, dword [0x1401214b8]
cmp edx, 1
jne 0x14002a3c9
mov rdi, qword [0x1401214e0]
mov ecx, dword [0x1401214d8]
mov rbx, qword [0x1401214d0]
mov eax, dword [0x1401214c8]
jmp 0x14002a419
mov edx, dword [0x1401214b8]
mov rdi, qword [0x1401214e0]
test rdi, rdi
je 0x14002a3f4
cmp byte [rdi], 0
je 0x14002a3f4
mov ecx, dword [0x1401214d8]
cmp ecx, 1
jne 0x14002a3fa
mov rbx, qword [0x1401214d0]
mov eax, dword [0x1401214c8]
jmp 0x14002a419
mov ecx, dword [0x1401214d8]
mov eax, dword [0x1401214c8]
cmp eax, 1
jne 0x14002b25b
mov rbx, qword [0x1401214d0]
test rbx, rbx
je 0x14002b25b
xor r14d, r14d
mov qword [rsp + 0x1c0], r14
cmp edx, 1
jne 0x14002a55e
test eax, eax
jne 0x14002a45c
test rbx, rbx
jne 0x14002a45c
test ecx, ecx
jne 0x14002a45c
test rdi, rdi
jne 0x14002a45c
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0x1a0]
mov rcx, r9
call fcn.14007d4d0
jmp 0x14002a6a1
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5480]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c26fc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6470
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
mov r14, qword [rsp + 0x60]
jmp 0x140028da3
cmp ecx, 1
jne 0x14002a667
test eax, eax
jne 0x14002a596
test rbx, rbx
jne 0x14002a596
test edx, edx
jne 0x14002a596
test r9, r9
jne 0x14002a596
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0x1a0]
mov rcx, rdi
call fcn.14007b050
jmp 0x14002a6a1
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5420]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c26a4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6490
jmp 0x14002a528
test edx, edx
jne 0x14002b185
test r9, r9
jne 0x14002b185
test ecx, ecx
jne 0x14002b185
test rdi, rdi
jne 0x14002b185
lea r8, [rsp + 0x1c0]
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.14007a880
mov dword [rsp + 0x6c], eax
cmp eax, 1
je 0x14002b0b6
cmp qword [rsp + 0x1c0], r14
je 0x14002b0b6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0xff
lea rdx, [rsp + 0xcde0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, eax
mov qword [rsp + 0x100], rax
lea rdi, [rax + 1]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
xor edx, edx
test rax, rax
jne 0x14002a7cf
mov dword [rsp + 0x430], 0x2b5
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x2b5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x2b5
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5300]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c261c]
mov edx, 0x9f6
lea r8, [rbx - 1]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6518
jmp 0x14002a528
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0xcde0]
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x10e0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov r9, qword [rsp + 0x1c0]
mov r8, rbx
lea rdx, [rsp + 0x438]
mov rcx, qword [rsp + 0x1a0]
call fcn.14007cd50
mov qword [rsp + 0xb8], rax
test rax, rax
je 0x14002afe5
cmp dword [rsp + 0x438], r14d
je 0x14002afe5
mov rax, qword [0x140114130]
test rax, rax
je 0x14002a8a3
mov dword [rsp + 0xb0], r14d
mov edi, r14d
cmp edi, dword [0x140114128]
jae 0x14002a88b
mov ebx, edi
mov rcx, qword [rax + rbx*8]
test rcx, rcx
je 0x14002a880
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140114130]
mov qword [rax + rbx*8], r14
mov rax, qword [0x140114130]
inc edi
mov dword [rsp + 0xb0], edi
jmp 0x14002a855
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x140114130], rax
mov dword [0x140114128], eax
xor edx, edx
mov r8d, 0x9fff
lea rcx, [0x140114138]
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsp + 0x1c0]
mov r8, qword [rsp + 0xb8]
mov edx, dword [rsp + 0x438]
mov rcx, r13
call fcn.14004c280
test eax, eax
je 0x14002a9cc
cmp dword [0x1401140ec], 1
jne 0x14002a8fb
mov dword [0x1401140f0], 1
mov dword [0x140114110], 2
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5240]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c259c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x65e8
jmp 0x14002a528
mov eax, dword [0x140114110]
cmp dword [0x1401140ec], 1
cmove eax, esi
mov dword [0x140114110], eax
lea rcx, [0x140121b98]
call fcn.14007f000
cmp eax, 1
jne 0x14002aac6
mov dword [rsp + 0x430], 0x6b
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x6b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x6b]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d51e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c256c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6601
jmp 0x14002a528
mov rdx, qword [0x1401214b0]
test rdx, rdx
je 0x14002acc2
mov r8, qword [0x1401214a0]
test r8, r8
je 0x14002acc2
mov r9, qword [0x1401214a8]
test r9, r9
je 0x14002acc2
mov rcx, r13
call fcn.140064090
cmp eax, 1
jne 0x14002abcd
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x24e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5180]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2544]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x661e
jmp 0x14002a528
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9d, __WSAFDIsSet
mov r8, qword [0x140121498]
mov edx, r9d
mov rcx, qword [0x1401214b0]
call fcn.14007e630
cmp eax, 1
jne 0x14002acc2
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x24e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5120]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c251c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6637
jmp 0x14002a528
cmp dword [0x140121a04], 1
jne 0x14002adba
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
jne 0x14002adba
mov dword [rsp + 0x430], 0x69
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x69
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x69]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d50c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c247c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x66b0
jmp 0x14002a528
lea rcx, [0x140121b98]
call fcn.14007f000
cmp eax, 1
jne 0x14002ae9e
mov dword [rsp + 0x430], 0x6b
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x6b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x6b]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5060]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c244c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x66da
jmp 0x14002a528
xor eax, eax
mov dword [0x140121bb4], eax
cmp dword [0x140121bb0], 1
jne 0x14002b25d
mov dword [rsp + 0x430], 0x24a
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x24a
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], esi
lea rax, [0x1400d5000]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c241c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x670f
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
mov r15, qword [rsp + 0x60]
xor eax, eax
test r15, r15
je 0x14002b262
mov qword [r15 + 0x10], rsi
mov dword [r15 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x14002afde
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
xor eax, eax
jmp 0x14002b262
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d52a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c25f4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x659c
jmp 0x14002a528
mov dword [rsp + 0x430], 0x6d
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x6d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x6d]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d5360]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2644]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x64ed
jmp 0x14002a528
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d53c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2674]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x64b5
jmp 0x14002a528
mov esi, 1
xor eax, eax
mov r15, qword [rsp + 0x60]
mov byte [0x140113aec], 0
mov dword [0x140113ae8], eax
mov dword [0x140113cec], eax
mov word [0x140113cf0], ax
xor edx, edx
mov r8d, 0x1fe
lea rbx, [0x140113aec]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x3fc
lea rdi, [0x140113cf0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [0x1401019f0]
mov edx, 0x1fe
mov rcx, rdi
call fcn.14007b520
test eax, eax
jne 0x14002b366
mov dword [0x140113cec], esi
mov qword [rsp + 0x20], rdi
lea r9, [0x1400cca04]
mov edx, 0x200
mov r8, 0xffffffffffffffff
lea rcx, [0x14011f498]
call fcn.140001140
xor r14d, r14d
mov word [0x14011f696], r14w
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rdi
mov r8d, 0x1fe
mov rdx, rbx
lea rcx, [rsp + 0x10e8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov dword [rsp + 0xe8], eax
cmp eax, 0x2a
je 0x14002b333
test eax, eax
je 0x14002b333
cmp eax, 0x50
jne 0x14002b369
mov dword [0x140113ae8], esi
mov qword [rsp + 0x20], rbx
lea r9, [0x1400c236c]
mov edx, 0x100
mov r8, 0xffffffffffffffff
lea rcx, [0x14011e618]
call fcn.140001030
mov byte [0x14011e717], r14b
jmp 0x14002b369
xor r14d, r14d
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0xe1e0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x1fe
lea rdx, [rsp + 0xe1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
test eax, eax
jne 0x14002b4aa
mov dword [rsp + 0x430], 0x3e
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x3e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x3e]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4fa0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c231c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x67ba
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x140027e6c
mov qword [r14 + 0x10], 1
jmp 0x140028db0
mov r8d, 0x1fe
lea rcx, [rsp + 0xd3e0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0xe1e0]
mov r8d, 0x1fe
lea rdx, [rsp + 0xd3e0]
lea rcx, [rsp + 0x10d0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1180], xmm0
movups xmmword [rsp + 0x1190], xmm0
movups xmmword [rsp + 0x11a0], xmm0
movups xmmword [rsp + 0x11b0], xmm0
movups xmmword [rsp + 0x11c0], xmm0
movups xmmword [rsp + 0x11d0], xmm0
mov qword [rsp + 0x11e0], rax
lea r8, [rsp + 0x1180]
lea rdx, [rsp + 0xd3e0]
mov rcx, r13
call fcn.140087e30
mov dword [rsp + 0x43c], eax
cmp eax, 1
jne 0x14002b61e
mov dword [rsp + 0x430], 0x5c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x5c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x5c]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4f40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c229c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x67e6
jmp 0x14002a528
mov eax, dword [0x1401219d8]
test eax, eax
jne 0x14002b94e
xor edx, edx
mov r8d, 0xda4
lea rbx, [0x1401850a8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.14007ba90
cmp eax, 1
jne 0x14002b76e
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x290
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x290
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], esi
lea rax, [0x1400d4ee0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c2274]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6801
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
test r15, r15
je 0x14002b76b
mov qword [r15 + 0x10], rsi
xor eax, eax
mov dword [r15 + 0xc], eax
mov rax, qword [0x140113960]
test rax, rax
je 0x14002b76b
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
xor r14d, r14d
mov qword [0x14011e2a8], rbx
call fcn.14007f390
mov eax, dword [0x1401219d8]
test eax, eax
jne 0x14002b94e
lea rcx, [rsp + 0x10b8]
call fcn.14001b950
cmp eax, 1
jne 0x14002b86f
mov dword [rsp + 0x430], 0x28f
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x28f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x28f
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d4e80]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c223c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6838
jmp 0x14002a528
cmp dword [rsp + 0x10b8], 0
je 0x14002b94e
mov dword [rsp + 0x430], 0x291
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x291
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x291
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d4e20]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c220c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6847
jmp 0x14002a528
xor edx, edx
mov r8d, 0x100
lea rcx, [0x14011e918]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x200
lea rcx, [0x14011fa98]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.SOFTWAREIntelSUR
mov rcx, 0xffffffff80000002
call fcn.14007b7c0
mov rdi, rax
test rax, rax
je 0x14002bb07
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0xc2f8], xmm0
movups xmmword [rsp + 0xc308], xmm0
mov dword [rsp + 0xc318], eax
mov byte [rsp + 0xc31c], al
movups xmmword [rsp + 0xc350], xmm0
movups xmmword [rsp + 0xc360], xmm0
movups xmmword [rsp + 0xc370], xmm0
movups xmmword [rsp + 0xc380], xmm0
mov qword [rsp + 0xc390], rax
mov word [rsp + 0xc398], ax
lea r9d, [rax + 0x4a]
lea r8, [rsp + 0xc350]
lea rdx, str.GUID
mov rcx, rdi
call fcn.14007afc0
mov ebx, eax
test eax, eax
jne 0x14002ba3b
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0xc350]
lea r8d, [rax + 0x25]
lea rdx, [rsp + 0xc2f8]
lea rcx, [rsp + 0x10e8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov dword [rsp + 0xe8], eax
test ebx, ebx
jne 0x14002baff
mov eax, dword [rsp + 0xe8]
cmp eax, 0x2a
je 0x14002ba5c
test eax, eax
je 0x14002ba5c
cmp eax, 0x50
jne 0x14002baff
lea rcx, [rsp + 0xc2f8]
call fcn.14007a5e0
test eax, eax
jne 0x14002baff
lea rax, [rsp + 0xc350]
cmp word [rsp + 0xc350], 0
lea rcx, str.00000000_0000_0000_0000_000000000000
cmove rax, rcx
mov qword [rsp + 0x20], rax
lea r9, [0x1400cc9ac]
mov edx, 0x100
mov r8, 0xffffffffffffffff
lea rcx, [0x14011fa98]
call fcn.140001140
mov word [0x14011fc96], r14w
lea rax, [rsp + 0xc2f8]
cmp byte [rsp + 0xc2f8], 0
lea rcx, [0x1400d0118]
cmove rax, rcx
mov qword [rsp + 0x20], rax
lea r9, [0x1400c21d4]
mov edx, 0x100
mov r8, 0xffffffffffffffff
lea rcx, [0x14011e918]
call fcn.140001030
mov byte [0x14011ea17], 0
mov rcx, rdi
call fcn.14007ddf0
cmp dword [0x140171f14], 1
jne 0x14002bb20
cmp byte [0x140171f18], 0
je 0x14002bb20
mov edi, 1
jmp 0x14002bb22
xor edi, edi
mov dword [rsp + 0x9c], edi
cmp edi, 1
jne 0x14002bb6e
lea rax, [0x14011f698]
mov qword [rsp + 0x28], rax
lea rax, str.SOFTWAREESRVids
mov qword [rsp + 0x20], rax
lea r9, [0x1400d3118]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [0x1401217c8]
call fcn.140001140
xor eax, eax
mov word [0x1401219c4], ax
cmp dword [0x1401219d8], 0
jne 0x14002d6e4
cmp dword [0x1401140ec], 0
jne 0x14002d004
cmp dword [0x140113a88], 1
jne 0x14002d004
lea rdx, str.Single_Instance_Only_Mode_Has_Been_Specified_By_User.__COMMON_
mov rcx, r13
call fcn.140017150
xor eax, eax
mov ebx, eax
mov dword [rsp + 0xa4], eax
mov dword [rsp + 0x108], eax
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xec], eax
cmp edi, 1
jne 0x14002bc23
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1401217c8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
mov eax, edi
cmovne ebx, eax
mov dword [rsp + 0xa4], ebx
mov dword [rsp + 0x108], ebx
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x1d8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1e0]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14002bd15
mov dword [rsp + 0x430], 0x75
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x75
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x74]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4d60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c20cc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x699c
jmp 0x14002a528
mov rcx, qword [rsp + 0x1e0]
call fcn.14007a4f0
mov qword [rsp + 0xd8], rax
test rax, rax
jne 0x14002be01
mov dword [rsp + 0x430], 0x75
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x75
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x74]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4d00]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c209c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x69b1
jmp 0x14002a528
mov rcx, qword [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
mov qword [rsp + 0x1e0], r14
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0xd5e0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x1fe
lea rdx, [rsp + 0xd5e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
test eax, eax
jne 0x14002bf1b
mov dword [rsp + 0x430], 0x3e
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x3e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 0x3e]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4ca0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1ff4]
mov edx, 0x9f6
lea r8, [r14 - 1]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x69e4
jmp 0x14002a528
mov r8d, 0x1fe
lea rcx, [rsp + 0xc6e0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0xd5e0]
mov r8d, 0x1fe
lea rdx, [rsp + 0xc6e0]
lea rcx, [rsp + 0x10d0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x10f0], xmm0
movups xmmword [rsp + 0x1100], xmm0
movups xmmword [rsp + 0x1110], xmm0
movups xmmword [rsp + 0x1120], xmm0
movups xmmword [rsp + 0x1130], xmm0
movups xmmword [rsp + 0x1140], xmm0
mov qword [rsp + 0x1150], rax
lea r8, [rsp + 0x10f0]
lea rdx, [rsp + 0xc6e0]
mov rcx, r13
call fcn.140087e30
mov dword [rsp + 0x43c], eax
cmp eax, 1
jne 0x14002c0bd
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x5c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x5c]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4c40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1f44]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6a15
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
mov r14, qword [rsp + 0x60]
jmp 0x140028da3
lea rcx, [rsp + 0xd5e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x190], rax
test rax, rax
jne 0x14002c1aa
mov dword [rsp + 0x430], 0x56
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x56
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x55]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4be0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1eb4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6a32
jmp 0x14002c07f
lea r8, [rsp + 0x1170]
mov rdx, rax
mov rcx, r13
call fcn.140002d40
mov ebx, eax
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x190], r14
test eax, eax
je 0x14002d46b
cmp ebx, 1
je 0x14002d46b
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0xdde0]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r8d, 0x1fe
lea rdx, [rsp + 0xdde0]
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
mov dword [rsp + 0x178], eax
test eax, eax
jne 0x14002c2f7
mov dword [rsp + 0x430], 0x127
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x127
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x127
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4b20]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1e24]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6a7a
jmp 0x14002c07f
mov edx, 0x1fe
lea rcx, [rsp + 0xdde0]
call fcn.14007cfb0
cmp eax, 1
jne 0x14002c3e2
mov dword [rsp + 0x430], 0x127
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x127
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x127
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4ab0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1dec]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6a90
jmp 0x14002c07f
xor edx, edx
lea rcx, [rsp + 0xdde0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r12d, eax
test eax, eax
jne 0x14002c4d5
mov dword [rsp + 0x430], 0x127
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x127
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x127
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4a40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1dbc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6aa8
mov eax, dword [rdi + 0x30]
jmp 0x14002c084
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov qword [rsp + 0x100], rax
xor edx, edx
test rax, rax
jne 0x14002c5ca
mov dword [rsp + 0x430], 0x248
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x248
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x248
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d49d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1d4c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6aba
mov eax, dword [rdi + 0x30]
jmp 0x14002c084
mov r8, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r9, rdi
mov r8d, r12d
xor edx, edx
lea rcx, [rsp + 0xdde0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x14002c6cb
mov dword [rsp + 0x430], 0x127
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x127
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0x127
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4960]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1d14]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6adb
mov eax, dword [rdi + 0x30]
jmp 0x14002c084
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13d, eax
cmp dword [0x1401019f4], 1
jne 0x14002c6ed
mov r14d, reloc.WS2_32.dll_listen
lea r15, [rsp + 0xc3b8]
jmp 0x14002c708
cmp dword [0x1401019f0], 1
jne 0x14002d38c
mov r14d, 9
lea r15, [rsp + 0xc3a0]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0xb2c0]
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x10b4]
mov edx, 0x1000
lea rcx, [rsp + 0xb2c0]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14002c81d
mov dword [rsp + 0x430], 0x78
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x78
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x77]
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
lea r13, [0x140101140]
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4870]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1cb4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6b22
mov eax, dword [rdi + 0x30]
jmp 0x14002c084
mov esi, dword [rsp + 0x10b4]
shr esi, 2
xor eax, eax
mov dword [rsp + 0xa8], eax
mov ebx, eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0xec], eax
mov edi, eax
mov dword [rsp + 0x10c], eax
cmp eax, esi
jae 0x14002cb8d
test ebx, ebx
jne 0x14002cb8d
mov ebx, eax
mov r8d, dword [rsp + rbx*4 + 0xb2c0]
cmp r8d, r13d
je 0x14002ce0f
mov dword [rsp + 0xa0], 0
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x14002c8cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14002c8cf
mov r8d, dword [rsp + rbx*4 + 0xb2c0]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14002ce0f
mov dword [rsp + 0xa0], 1
jmp 0x14002c8d7
mov rbx, qword [rsp + 0x80]
test rbx, rbx
je 0x14002ce0f
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0xd9e0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x1fe
lea rdx, [rsp + 0xd9e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
mov dword [rsp + 0x178], eax
test eax, eax
je 0x14002ce0f
mov edx, 0x1fe
lea rcx, [rsp + 0xd9e0]
call fcn.14007cfb0
cmp eax, 1
je 0x14002ce0f
mov edx, dword [rsp + 0x178]
lea rcx, [rsp + 0xd9e0]
call fcn.14007b640
mov r8d, dword [rsp + 0x178]
cmp r14, r8
cmova r8, r14
mov rdx, rax
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x14002ce0f
xor eax, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x198], rax
lea r8, [rsp + 0x198]
lea edx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14002cb81
mov rcx, qword [rsp + 0x198]
test rcx, rcx
je 0x14002cb81
call fcn.14007a4f0
mov qword [rsp + 0xf0], rax
test rax, rax
je 0x14002cb81
mov rcx, qword [rsp + 0x198]
test rcx, rcx
je 0x14002c9dd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov qword [rsp + 0x198], rbx
jmp 0x14002c9df
xor ebx, ebx
mov rdx, qword [rsp + 0xf0]
mov rdx, qword [rdx]
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, 1
jne 0x14002ce0f
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa0], 0
jne 0x14002cbcd
mov dword [rsp + 0x10b0], ebx
lea r9, [rsp + 0x10b0]
lea r8d, [rax + 7]
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14002cb81
mov r9d, 0x1fe
lea r8, [rsp + 0xd5e0]
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x14002cb81
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc6e0]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0xd5e0]
mov r8d, 0x1fe
lea rdx, [rsp + 0xc6e0]
lea rcx, [rsp + 0x10d0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x10f0], xmm0
movups xmmword [rsp + 0x1100], xmm0
movups xmmword [rsp + 0x1110], xmm0
movups xmmword [rsp + 0x1120], xmm0
movups xmmword [rsp + 0x1130], xmm0
movups xmmword [rsp + 0x1140], xmm0
mov qword [rsp + 0x1150], rax
lea r8, [rsp + 0x10f0]
lea rdx, [rsp + 0xc6e0]
lea rcx, [0x140101140]
call fcn.140087e30
mov dword [rsp + 0x43c], eax
cmp eax, 1
je 0x14002cb81
lea rcx, [rsp + 0xd5e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x190], rax
mov ecx, ebx
mov ebx, 1
test rax, rax
je 0x14002cb74
lea r8, [rsp + 0x1160]
mov rdx, rax
lea rcx, [0x140101140]
call fcn.140002d40
mov ebx, eax
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, eax
mov qword [rsp + 0x190], 0
test ecx, ecx
je 0x14002cb81
cmp ebx, 1
jne 0x14002cd57
mov dword [rsp + 0x70], 1
mov ebx, dword [rsp + 0x6c]
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x14002cba3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x14002cebf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15d, r15d
mov qword [rsp + 0x80], r15
jmp 0x14002cec2
xor edx, edx
lea rcx, [rsp + 0xd9e0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [rsp + 0x90], eax
test eax, eax
je 0x14002cb81
mov ebx, eax
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0xc0], rax
xor edx, edx
test rax, rax
jne 0x14002cd20
mov dword [rsp + 0x430], 0x248
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x248
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor ebx, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9d, 0x248
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
lea r13, [0x140101140]
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d47f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1c1c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], bl
mov dword [rsp + 0xe98], 0x6cb3
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, rdi
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, rdi
mov dword [rdi + 0x50], eax
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x140027e6c
mov qword [r14 + 0x10], rsi
mov dword [r14 + 0xc], ebx
jmp 0x140028db6
mov r8, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rsp + 0xc0]
mov r9, rbx
mov r8d, dword [rsp + 0x90]
xor edx, edx
lea rcx, [rsp + 0xd9e0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x14002cd5f
jmp 0x14002cb81
mov rbx, qword [rsp + 0xc0]
cmp dword [rsp + 0xa0], 0
jne 0x14002cd94
lea rdx, [rsp + 0x1160]
lea rcx, [rsp + 0x1170]
call fcn.140002cf0
test eax, eax
jne 0x14002cdd1
mov eax, 1
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0xec], eax
jmp 0x14002cdd1
mov r8d, r12d
cmp dword [rsp + 0x90], r12d
cmova r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x100]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
mov ebx, dword [rsp + 0x6c]
test eax, eax
mov eax, 1
cmove ebx, eax
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0xec], ebx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov eax, ebx
mov qword [rsp + 0x80], rbx
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14002ce19
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0xc0], rbx
mov dword [rsp + 0x90], ebx
jmp 0x14002ce11
xor ebx, ebx
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x14002ce2f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rsp + 0x198]
test rcx, rcx
je 0x14002ce4a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x198], rbx
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x14002ce68
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rsp + 0xf0], rbx
mov rax, qword [rsp + 0x190]
test rax, rax
je 0x14002ce86
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x190], rbx
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x14002ceab
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0xc0], rbx
mov dword [rsp + 0x90], ebx
inc edi
mov dword [rsp + 0x10c], edi
mov eax, edi
mov ebx, dword [rsp + 0x6c]
jmp 0x14002c846
xor r15d, r15d
mov rcx, qword [rsp + 0x198]
test rcx, rcx
je 0x14002cedd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x198], r15
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x14002cefb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rsp + 0xf0], r15
mov rax, qword [rsp + 0x190]
test rax, rax
je 0x14002cf19
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rsp + 0x190], r15
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14002cf3c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0xc0], r15
mov dword [rsp + 0x90], r15d
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x14002cf52
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14d, dword [rsp + 0x9c]
mov edi, dword [rsp + 0xa8]
cmp dword [rsp + 0x70], 1
je 0x14002d1ce
test r14d, r14d
jne 0x14002cf7e
cmp edi, 1
jne 0x14002cf7e
cmp ebx, edi
je 0x14002d1ce
mov esi, dword [rsp + 0xa4]
cmp r14d, 1
jne 0x14002cf9e
cmp esi, r14d
jne 0x14002cf9e
cmp edi, r14d
jne 0x14002cf9e
cmp ebx, r14d
je 0x14002d1d5
lea rdx, str....Single_Instance_Only_Mode_Requirements_Met.__COMMON_
lea r13, [0x140101140]
mov rcx, r13
call fcn.140017150
cmp r14d, 1
jne 0x14002cfce
cmp esi, r14d
jne 0x14002cfce
lea rdx, [0x1400d4280]
mov rcx, r13
call fcn.140017150
cmp edi, 1
jne 0x14002cfe2
lea rdx, [0x1400d4200]
mov rcx, r13
call fcn.140017150
cmp ebx, 1
jne 0x14002d004
mov rcx, r13
cmp dword [rsp + 0xa0], 0
jne 0x14002d1c2
lea rdx, [0x1400d4140]
call fcn.140017150
cmp dword [0x1401219d8], 0
jne 0x14002d6e4
cmp dword [0x140171f14], 1
jne 0x14002d6e4
cmp byte [0x140171f18], 0
je 0x14002d6e4
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1401217c8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x14002d59d
lea rax, [rsp + 0x10d8]
mov qword [rsp + 0x40], rax
lea rax, [0x1401217c0]
mov qword [rsp + 0x38], rax
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401217c8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14002d6e7
mov dword [rsp + 0x430], 0x72
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x72
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [r15 + 0x72]
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d3fd0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1b7c]
mov edx, 0x9f6
lea r8, [r15 - 1]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r15b
mov dword [rsp + 0xe98], 0x6efa
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, rdi
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, rdi
mov dword [rdi + 0x50], eax
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x140027e6c
mov qword [r14 + 0x10], rsi
mov dword [r14 + 0xc], r15d
jmp 0x140028db6
lea rdx, [0x1400d4060]
jmp 0x14002cfff
mov esi, dword [rsp + 0xa4]
lea rdx, str....Single_Instance_Only_Mode_Requirements_Not_Met.__COMMON_
lea r13, [0x140101140]
mov rcx, r13
call fcn.140017150
cmp dword [rsp + 0x70], 1
jne 0x14002d201
lea rdx, str.......A_Non_Critical_Error_Has_Been_Dedetected_During_Single_Instance_Only_Mode_Requirements_Checks._This_Has_Been_Declared_As_Suspicious.__COMMON_
mov rcx, r13
call fcn.140017150
cmp r14d, 1
jne 0x14002d21b
cmp esi, r14d
jne 0x14002d21b
lea rdx, str.......An_Instance_With_Same_Identifier_Has_Been_Found_During_Single_Instance_Only_Mode_Requirements_Checks.__COMMON_
mov rcx, r13
call fcn.140017150
cmp edi, 1
jne 0x14002d22f
lea rdx, str.......An_Instance_With_Same_Security_Identifier_Has_Been_Found_During_Single_Instance_Only_Mode_Requirements_Checks.__COMMON_
mov rcx, r13
call fcn.140017150
cmp ebx, 1
jne 0x14002d254
mov rcx, r13
cmp dword [rsp + 0xa0], 0
lea rdx, str.......An_Instance_With_Same_Embedded_Version_Information_Has_Been_Found_During_Single_Instance_Only_Mode_Requirements_Checks.__COMMON_
je 0x14002d24f
lea rdx, str.......An_Instance_With_Same_System_Version_Information_Has_Been_Found_During_Single_Instance_Only_Mode_Requirements_Checks.__COMMON_
call fcn.140017150
mov dword [rsp + 0x430], 0xa5
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa5
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 3
lea rbx, [0x1400d4390]
mov qword [rsp + 0x20], rbx
lea r9, [0x1400c1bbc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6e65
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, rdi
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, rdi
mov dword [rdi + 0x50], eax
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x140038ec9
mov qword [r14 + 0x10], rsi
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140038ec9
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [rdi + 0x50], eax
jmp 0x140038ec9
mov dword [rsp + 0x430], 0xa6
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9d, 0xa6
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
lea r13, [0x140101140]
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d48e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1ce4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6b00
mov eax, dword [rdi + 0x30]
jmp 0x14002d538
mov dword [rsp + 0x430], 0x51
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, 1
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x51
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
lea r9d, [rsi + 0x50]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d4b80]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1e64]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r14b
mov dword [rsp + 0xe98], 0x6a58
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
test r15, r15
mov dword [r12 + 0x50], eax
je 0x14002d593
mov qword [r15 + 0x10], rsi
mov dword [r15 + 0xc], r14d
mov rax, qword [0x140113960]
test rax, rax
je 0x14002d593
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
mov r14, qword [rsp + 0x60]
jmp 0x140027e6c
mov dword [0x1401217b8], 1
cmp dword [0x140113a88], 0
jne 0x14002d6e4
mov dword [rsp + 0x430], 0xa4
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
xor r15d, r15d
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa4
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 2
lea rax, [0x1400d3f50]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1a5c]
mov edx, 0x9f6
lea r8, [r15 - 1]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], r15b
mov dword [rsp + 0xe98], 0x6f18
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, rdi
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, rdi
mov dword [rdi + 0x50], eax
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x14002d6f6
mov qword [r14 + 0x10], rsi
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x14002d6f6
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [rdi + 0x50], eax
jmp 0x14002d6f6
xor r15d, r15d
mov esi, 1
mov r12, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
lea r8, [0x14011e240]
lea rdx, [0x14011e238]
lea rcx, [0x14011e230]
call fcn.14007b6a0
cmp eax, 1
jne 0x14002d845
mov dword [rsp + 0x430], 0x127
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x127
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x127
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 3
lea rax, [0x1400d3ed0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1a34]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6f62
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x14002d845
mov qword [r14 + 0x10], 1
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x14002d845
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
cmp dword [0x140101d70], 1
jne 0x14002dbf3
cmp qword [0x140101d88], 0
je 0x14002d9a7
mov rcx, r13
call fcn.1400648c0
test eax, eax
je 0x14002d991
cmp dword [0x1401140ec], 1
jne 0x14002d88d
mov dword [0x1401140f0], 1
mov dword [0x140114114], 2
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3e60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c19f4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6f8b
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
jmp 0x14002d1ac
mov eax, dword [0x140114114]
cmp dword [0x1401140ec], 1
cmove eax, esi
mov dword [0x140114114], eax
cmp qword [0x140101d98], 0
jne 0x14002d9bf
cmp qword [0x140101da8], 0
je 0x14002dad2
mov rcx, r13
call fcn.140065380
test eax, eax
je 0x14002dabc
cmp dword [0x1401140ec], 1
jne 0x14002d9ec
mov dword [0x1401140f0], 1
mov dword [0x140114118], 2
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3de0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c19ac]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6fb0
jmp 0x14002d958
mov eax, dword [0x140114118]
cmp dword [0x1401140ec], 1
cmove eax, esi
mov dword [0x140114118], eax
cmp qword [0x140101db8], 0
je 0x14002dbf3
mov rcx, r13
call fcn.140065730
test eax, eax
je 0x14002dbdd
cmp dword [0x1401140ec], 1
jne 0x14002db0d
mov dword [0x1401140f0], 1
mov dword [0x14011411c], 2
mov dword [rsp + 0x430], 0x249
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x249
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x249
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3d70]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1974]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x6fd2
jmp 0x14002d958
mov eax, dword [0x14011411c]
cmp dword [0x1401140ec], 1
cmove eax, esi
mov dword [0x14011411c], eax
lea r8, [rsp + 0x430]
lea rdx, [rsp + 0x43c]
mov rcx, r13
call fcn.140019670
cmp eax, 1
je 0x140039784
cmp dword [rsp + 0x43c], 0
je 0x140039784
cmp dword [rsp + 0x430], 0
jne 0x140039784
cmp dword [0x140121788], 1
jne 0x14002e4c8
cmp dword [0x1401219d8], 0
jne 0x14002e008
cmp qword [0x140121798], 0
jne 0x14002df38
lea rdx, str.Starting_Periodic_Startup_Dependencies_Checker_Thread.__SERVER_
mov rcx, r13
call fcn.140017150
xor edx, edx
cmp qword [0x1401217a0], rdx
jne 0x14002de6a
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401217a0], rax
test rax, rax
jne 0x14002dd64
mov dword [rsp + 0x430], 0x53
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3c40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1904]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7073
jmp 0x14002d958
lea rax, [0x140121790]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r13
lea r8, [0x140018cc0]
mov edx, 0x8000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x140121798], rax
test rax, rax
jne 0x14002e90a
mov dword [rsp + 0x430], 0x54
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x54
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 0x53]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3b20]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c188c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x709b
jmp 0x14002d958
mov dword [rsp + 0x430], 0xa7
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa7
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3bb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c18cc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7081
jmp 0x14002d958
mov dword [rsp + 0x430], 0xa7
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa7
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3aa0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1864]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x70b0
jmp 0x14002d958
mov rcx, r13
cmp qword [0x140121798], 0
je 0x14002e1eb
lea rdx, str.Resuming_Periodic_Startup_Dependencies_Checker_Thread.__SERVER_
call fcn.140017150
mov dword [0x1401217a8], 2
mov rcx, qword [0x1401217a0]
test rcx, rcx
je 0x14002e11b
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x14002e90a
mov dword [rsp + 0x430], 0x39
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x39
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 0x38]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d39e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1824]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x70dd
jmp 0x14002d958
mov dword [rsp + 0x430], 0xa7
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa7
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3950]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c17f4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x70eb
jmp 0x14002d958
lea rdx, [0x1400d3910]
call fcn.140017150
xor edx, edx
cmp qword [0x1401217a0], rdx
jne 0x14002e3fa
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401217a0], rax
test rax, rax
jne 0x14002e2f4
mov dword [rsp + 0x430], 0x53
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3880]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c17bc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7112
jmp 0x14002d958
lea rax, [0x140121790]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r13
lea r8, [0x140018cc0]
mov edx, 0x8000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x140121798], rax
test rax, rax
jne 0x14002e90a
mov dword [rsp + 0x430], 0x54
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x54
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 0x53]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3770]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1754]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x713a
jmp 0x14002d958
mov dword [rsp + 0x430], 0xa7
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa7
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3800]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c178c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7120
jmp 0x14002d958
cmp dword [0x1401219d8], 0
jne 0x14002e5b3
cmp qword [0x140121798], 0
je 0x14002e90a
mov dword [rsp + 0x430], 0xa7
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa7
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d36e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c16b4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x716a
jmp 0x14002d958
cmp qword [0x140121798], 0
je 0x14002e90a
lea rdx, [0x1400d36a0]
mov rcx, r13
call fcn.140017150
mov dword [0x1401217a8], 3
mov rcx, qword [0x1401217a0]
test rcx, rcx
je 0x14002ebeb
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x14002e6c6
mov dword [rsp + 0x430], 0x39
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x39
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 0x38]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3630]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c167c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x71a2
jmp 0x14002d958
mov ebx, r15d
mov dword [rsp + 0xac], ebx
mov edi, 0x102
nop word [rax + rax]
lea rdx, [rsp + 0x178]
mov rcx, qword [0x140121798]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
jne 0x14002eb1d
cmp dword [rsp + 0x178], 0x103
jne 0x14002e8e6
mov edx, 0x1f4
mov rcx, qword [0x140121798]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x178], eax
test eax, eax
je 0x14002e8e6
cmp eax, edi
jne 0x14002e818
mov eax, ebx
inc ebx
mov dword [rsp + 0xac], ebx
cmp eax, 4
jae 0x14002e74a
jmp 0x14002e6e0
mov dword [rsp + 0x430], 0x39
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x39
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 0x38]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3530]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c15a4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x71dd
jmp 0x14002d958
mov dword [rsp + 0x430], 0x39
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x39
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 0x38]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d34c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1574]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x71f3
jmp 0x14002d958
mov qword [0x140121798], r15
mov rcx, qword [0x1401217a0]
test rcx, rcx
je 0x14002ea4d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401217a0], r15
cmp dword [0x140121a00], 0
jne 0x14002efb7
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140187308], rax
xor edx, edx
test rax, rax
jne 0x14002ecbb
mov dword [rsp + 0x430], 0x259
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d3350]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c13c4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7653
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140027e6c
mov qword [r14 + 0x10], 1
mov dword [r14 + 0xc], r15d
jmp 0x140028db6
mov dword [rsp + 0x430], 0xa7
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa7
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d33e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c142c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x721c
jmp 0x14002d958
mov dword [rsp + 0x430], 0x39
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x39
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 0x38]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3450]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c14b4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7203
jmp 0x14002d958
mov dword [rsp + 0x430], 0xa7
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xa7
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d35a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1644]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x71b0
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140187300], rax
test rax, rax
jne 0x14002eda6
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d32c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c138c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x766b
jmp 0x14002e9ff
mov rcx, r13
call fcn.14009e160
cmp eax, 1
jne 0x14002ee84
mov dword [rsp + 0x430], 0x308
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d3240]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1354]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x767e
jmp 0x14002e9ff
mov eax, dword [0x140186eb8]
test eax, eax
cmove eax, esi
mov dword [0x140186eb8], eax
lea rax, [0x140186ec0]
mov qword [0x14011e2c0], rax
lea rdx, str.Spawning_Sampling_Management_Thread.__SERVER_
mov rcx, r13
call fcn.140017150
lea rax, [0x140187318]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r13
lea r8, [0x14009e210]
mov edx, 0x8000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x140187310], rax
test rax, rax
jne 0x14002efb7
mov dword [rsp + 0x430], 0x30a
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x30a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x30a
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d31b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1314]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x76a7
jmp 0x14002e9ff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ed30], rax
test rax, rax
jne 0x14002f0a7
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3130]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c12a4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7734
jmp 0x14002d958
cmp dword [0x1401219d8], 0
jne 0x14002f423
cmp dword [0x1401139e0], 1
jne 0x14002f423
mov dword [rsp + 0x128], r15d
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, r15d
test rax, rax
je 0x14002f109
lea rdx, str.RegisterApplicationRestart
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002f109
mov qword [rsp + 0x138], rax
mov eax, 1
mov dword [rsp + 0x128], eax
mov ebx, eax
lea rax, [rsp + 0x10a8]
mov qword [rsp + 0x20], rax
mov r9d, 0x14000
lea r8, [rsp + 0x225e0]
mov rdx, qword [rsp + 0xf8]
mov ecx, dword [rsp + 0xd0]
call fcn.1400644b0
test eax, eax
je 0x14002f210
mov dword [rsp + 0x430], 0x2d8
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x2d8
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x2d8
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d30a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1264]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7783
jmp 0x14002d958
cmp dword [rsp + 0x10a8], 1
jne 0x14002f423
cmp ebx, 1
jne 0x14002f423
lea edx, [rbx + 0xb]
lea rcx, [rsp + 0x225e0]
mov rax, qword [rsp + 0x138]
call qword [0x1400a4c40]
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
test eax, eax
je 0x14002f315
mov dword [rsp + 0x430], 0x2d9
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, ebx
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x2d9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x2d9
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3020]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c123c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x779f
jmp 0x14002d958
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x2da
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x2da
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], ebx
lea rax, [0x1400d2fa0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c120c]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x77a7
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x14002f428
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x14002f428
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
jmp 0x14002f428
mov ebx, 1
mov rcx, r13
cmp dword [0x140121a00], 0
jne 0x140036f05
lea rdx, str.Energy_Server_Starts.__SERVER_
call fcn.140017150
cmp dword [0x1401139e4], 1
je 0x14002f472
cmp dword [0x1401219d8], 0
jne 0x14002f46d
cmp dword [0x140185e40], 1
jne 0x14002f466
call fcn.1400448c0
jmp 0x14002f472
call fcn.140044650
jmp 0x14002f472
call fcn.140044af0
lea rdx, str.Creating_Driver_Ready_To_Quit_Synchronization_Object.__SERVER_
mov rcx, r13
call fcn.140017150
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017eeb0], rax
test rax, rax
jne 0x14002f571
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2f10]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c11dc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7852
jmp 0x14002d958
cmp dword [0x1401219d8], 0
jne 0x14002f6a3
lea rdx, [rsp + 0x10a0]
lea rcx, [rsp + 0x10a4]
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
cmp dword [0x1401219f4], 1
jne 0x14002f6a3
mov dword [rsp + 0x10a4], 0x3ff
mov eax, 1
mov dword [rsp + 0x10a0], eax
mov edx, eax
mov ecx, 0x3ff
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
cmp eax, 1
je 0x14002f69e
mov dword [rsp + 0x430], 0x277
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x277
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x277
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2ea0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c11a4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x791c
jmp 0x14002d958
mov ebx, 1
lea rdx, str.Loading_And_Configuring_Device.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, r13
call fcn.14001cb60
cmp eax, 1
jne 0x14002f793
mov dword [rsp + 0x430], 0x272
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x272
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x272
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2db0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c116c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x794d
jmp 0x14002d958
mov r8, qword [0x14017ed20]
test r8, r8
je 0x14002f7c4
mov rax, qword [0x140174490]
test rax, rax
je 0x14002f7c4
cmp byte [rax], 0
je 0x14002f7c4
lea r9, [0x1400b1520]
mov edx, 4
mov rcx, r13
call fcn.140089c00
lea rdx, str.Setting_up_Measurement_Interrupt.__SERVER_
mov rcx, r13
call fcn.140017150
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d50], rax
test rax, rax
jne 0x14002f8c3
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2cc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c10c4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x79a1
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d48], rax
xor edx, edx
test rax, rax
jne 0x14002f9b3
mov dword [rsp + 0x430], 0x259
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2c30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c108c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x79be
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d58], rax
xor edx, edx
test rax, rax
jne 0x14002faa1
mov dword [rsp + 0x430], 0x25a
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25a
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2bb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0ff4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x79db
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d68], rax
xor edx, edx
test rax, rax
jne 0x14002fb8f
mov dword [rsp + 0x430], 0x25b
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25b
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2b30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0f8c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x79f8
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d70], rax
test rax, rax
jne 0x14002fc7d
mov dword [rsp + 0x430], 0x25c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2aa0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0f54]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7a16
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d60], rax
test rax, rax
jne 0x14002fd6d
mov dword [rsp + 0x430], 0x25d
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25a
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2a30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0f1c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7a33
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d60], rax
test rax, rax
jne 0x14002fe5d
mov dword [rsp + 0x430], 0x25d
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25a
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d29a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0eec]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7a50
jmp 0x14002d958
lea rdx, str.Setting_up_Device_Control_Interrupt.__SERVER_
mov rcx, r13
call fcn.140017150
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d78], rax
xor edx, edx
test rax, rax
jne 0x14002ff5c
mov dword [rsp + 0x430], 0x25e
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d28f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0e2c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7b15
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d80], rax
xor edx, edx
test rax, rax
jne 0x14003004a
mov dword [rsp + 0x430], 0x25e
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2840]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0d94]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7b49
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140171d88], rax
test rax, rax
jne 0x140030138
mov dword [rsp + 0x430], 0x25e
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2790]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0d5c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7b78
jmp 0x14002d958
xorps xmm0, xmm0
movups xmmword [0x140171d90], xmm0
movups xmmword [0x140171da0], xmm0
movups xmmword [0x140171db0], xmm0
movups xmmword [0x140171dc0], xmm0
mov dword [rsp + 0x68], r15d
mov ebx, r15d
nop
cmp ebx, 8
jae 0x140030267
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, ebx
mov qword [r13 + rcx*8 + 0x70c50], rax
test rax, rax
jne 0x14003025c
mov dword [rsp + 0x430], 0x25e
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d26e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0cfc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7bb5
jmp 0x14002d958
inc ebx
mov dword [rsp + 0x68], ebx
jmp 0x140030160
mov dword [0x140101d48], 8
xorps xmm0, xmm0
movups xmmword [0x140171dd0], xmm0
movups xmmword [0x140171de0], xmm0
movups xmmword [0x140171df0], xmm0
movups xmmword [0x140171e00], xmm0
mov dword [rsp + 0x68], r15d
mov ebx, r15d
nop dword [rax + rax]
cmp ebx, 8
jae 0x1400303a7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, ebx
mov qword [r13 + rcx*8 + 0x70c90], rax
test rax, rax
jne 0x14003039c
mov dword [rsp + 0x430], 0x25e
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x25e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x25e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2650]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0cc4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7bdb
jmp 0x14002d958
inc ebx
mov dword [rsp + 0x68], ebx
jmp 0x1400302a0
mov dword [0x140101d4c], 8
mov ebx, 1
mov dword [0x140153d34], ebx
mov eax, dword [0x140101d48]
add eax, 8
jne 0x1400304fb
mov dword [rsp + 0x430], 0x25e
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x25e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x25e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d25d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0c8c]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7c49
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140027e6c
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140027e6c
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
jmp 0x140027e6c
lea rdx, str.Setting_up_Device_Status_Ready_Interrupt.__SERVER_
mov rcx, r13
call fcn.140017150
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14013fbf8], rax
test rax, rax
jne 0x1400305f5
mov dword [rsp + 0x430], 0x260
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x260
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x260
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2540]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0c54]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7c6b
jmp 0x14003048e
lea rcx, [0x14013fc00]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x14013fc28], ebx
lea rdx, str.Setting_up_Remote_Device_Interrupt_Event.__SERVER_
mov rcx, r13
call fcn.140017150
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140153c30], rax
test rax, rax
jne 0x140030702
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d24b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0c1c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7cb2
jmp 0x14003048e
lea rdx, str.Setting_up_Device_Interrupt_Handler_Remote_Access_Lock.__SERVER_
mov rcx, r13
call fcn.140017150
xor r9d, r9d
mov r8d, ebx
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x14012bbd8], rax
test rax, rax
jne 0x140030800
mov dword [rsp + 0x430], 0x53
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov esi, ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x53
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x53
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d2320]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0b84]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7ce8
jmp 0x14003048e
lea rdx, str.Setup_Thread_Synchronization_Data.__SERVER_
mov rcx, r13
call fcn.140017150
mov eax, dword [0x14017ed38]
cmp eax, ebx
jne 0x140030af2
lea rdx, str.Setup_Watchdog_Data.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, r13
call fcn.140042ce0
test eax, eax
je 0x140030907
mov dword [rsp + 0x430], 0x261
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x261
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x261
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2290]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0b54]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7d72
jmp 0x14003048e
lea rdx, str.Setup_Watchdog_synchronization_Data.__SERVER_
mov rcx, r13
call fcn.140017150
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ed70], rax
test rax, rax
jne 0x140030a01
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2200]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0ac4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7d8a
jmp 0x14003048e
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ee68], rax
test rax, rax
jne 0x140030aec
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2170]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0a14]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7d9e
jmp 0x14003048e
mov eax, dword [0x14017ed38]
cmp eax, 1
jne 0x140030baa
cmp qword [0x140187310], 0
je 0x140030baa
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x260], r15d
mov r9d, 0xff
lea r8, str.SAMPLING_MANAGER
mov edx, r9d
lea rcx, [rsp + 0x268]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword [0x140187310]
mov qword [rsp + 0x368], rax
mov eax, dword [0x140187318]
mov dword [rsp + 0x370], eax
mov rax, qword [0x140187308]
mov qword [rsp + 0x378], rax
mov eax, 1
mov dword [rsp + 0x20], eax
mov r9d, eax
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x260]
mov rcx, r13
call fcn.1400413c0
test eax, eax
jne 0x140027e67
mov rax, qword [rsp + 0x188]
mov qword [0x1401872f8], rax
xor r9d, r9d
xor r8d, r8d
mov esi, 1
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ed00], rax
test rax, rax
jne 0x140030c97
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d20d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c09e4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7dcf
jmp 0x14002d958
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ee88], rax
test rax, rax
jne 0x140030d82
mov dword [rsp + 0x430], 0x259
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x259
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x259
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d2050]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c09a4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7de9
jmp 0x14002d958
mov rcx, r13
cmp qword [0x140174698], 0
je 0x140030e82
lea rdx, str.Initializing_Device_Extra_Data___First_Call.__SERVER_
call fcn.140017150
mov rcx, r13
mov rax, qword [0x140174698]
call qword [0x1400a4c40]
test eax, eax
je 0x140030e8e
mov dword [rsp + 0x430], 0x24c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x24c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1fc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0924]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7ef9
jmp 0x14002d958
lea rdx, str.No_Initializing_Device_Extra_Data_Function_To_Call.__SERVER_
call fcn.140017150
mov ecx, dword [0x1401011a0]
test ecx, ecx
je 0x140031270
sub ecx, esi
je 0x14003107f
cmp ecx, esi
jne 0x140027e6c
lea rdx, str.Setting_interface_function_pointers_to_Ethernet.__SERVER_
mov rcx, r13
call fcn.140017150
lea rax, [0x14004a850]
mov qword [0x140101180], rax
lea rax, [0x14004a4c0]
mov qword [0x140101188], rax
lea rax, [0x14004a970]
mov qword [0x140101190], rax
lea rax, [0x14004ab10]
mov qword [0x140101198], rax
lea rax, [0x140065d20]
mov qword [0x140174478], rax
lea rdx, str.Pre_Parsing_Default_Ethernet_Interface_Options.__SERVER_
mov rcx, r13
call fcn.140017150
cmp qword [0x140174478], 0
je 0x14003127f
mov rbx, qword [0x140174468]
lea rax, str.ip127.0.0.1_port27015_useranonymous_passwordpassword
mov qword [0x140174468], rax
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0xe5e0]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x1400d1d98]
mov qword [rsp + 0x20], rax
lea r9, [0x1400cf9c8]
mov edx, 0x9fff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe5e0]
call fcn.140001030
lea rdx, [rsp + 0xe5e0]
mov rcx, r13
call fcn.140017150
mov rcx, r13
mov rax, qword [0x140174478]
call qword [0x1400a4c40]
test eax, eax
je 0x140031252
cmp dword [0x1401140ec], esi
jne 0x140030fb4
mov dword [0x1401140f0], esi
mov dword [0x140114120], 2
mov dword [rsp + 0x430], 0x24b
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x24b
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1d40]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c086c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8008
jmp 0x14002d958
lea rdx, str.Setting_interface_function_pointers_to_Serial.__SERVER_
mov rcx, r13
call fcn.140017150
lea rax, [0x14004a6e0]
mov qword [0x140101180], rax
lea rax, [0x14004a690]
mov qword [0x140101188], rax
lea rax, [fcn.14004a540]
mov qword [0x140101190], rax
lea rax, [fcn.14004aa90]
mov qword [0x140101198], rax
lea rax, [0x140066090]
mov qword [0x140174478], rax
lea rdx, str.Pre_Parsing_Default_Serial_Interface_Options.__SERVER_
mov rcx, r13
call fcn.140017150
cmp qword [0x140174478], 0
je 0x14003127f
mov rbx, qword [0x140174468]
lea rax, str.com1_baud9600_parityn_data8_stop1_xonn_dtry_rtsn
mov qword [0x140174468], rax
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0xe5e0]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x1400d1f08]
mov qword [rsp + 0x20], rax
lea r9, str....Default_Options:___s_.__SERVER_
mov edx, 0x9fff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe5e0]
call fcn.140001030
lea rdx, [rsp + 0xe5e0]
mov rcx, r13
call fcn.140017150
mov rcx, r13
mov rax, qword [0x140174478]
call qword [0x1400a4c40]
test eax, eax
je 0x140031252
cmp dword [0x1401140ec], esi
jne 0x140031187
mov dword [0x1401140f0], esi
mov dword [0x140114120], 2
mov dword [rsp + 0x430], 0x24b
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x24b
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1eb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c08ec]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x7f95
jmp 0x14002d958
mov eax, dword [0x140114120]
cmp dword [0x1401140ec], esi
cmove eax, esi
mov dword [0x140114120], eax
mov qword [0x140174468], rbx
jmp 0x14003127f
lea rdx, str.No_Pre_Parsing_Of_Default_Interface_Options.__SERVER_
mov rcx, r13
call fcn.140017150
cmp qword [0x140174468], 0
je 0x14003141c
cmp dword [0x1401011a0], 0
je 0x140031413
cmp qword [0x140174478], 0
je 0x140031413
lea rdx, str.Parsing_Interface_Options.__SERVER_
mov rcx, r13
call fcn.140017150
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0xe5e0]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [0x140174468]
mov qword [rsp + 0x20], rax
lea r9, str....Options:___s_.__SERVER_
mov edx, 0x9fff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe5e0]
call fcn.140001030
lea rdx, [rsp + 0xe5e0]
mov rcx, r13
call fcn.140017150
mov rcx, r13
mov rax, qword [0x140174478]
call qword [0x1400a4c40]
test eax, eax
je 0x140031403
cmp dword [0x1401140ec], esi
jne 0x140031338
mov dword [0x1401140f0], esi
mov dword [0x140114120], 2
mov dword [rsp + 0x430], 0x24b
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, esi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24b
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x24b
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1cb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0814]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8077
jmp 0x14002d958
cmp dword [0x1401140ec], esi
jne 0x14003142b
mov dword [0x140114120], esi
jmp 0x14003142b
lea rdx, str.No_Parsing_Interface_Options_Function_To_Call.__SERVER_
jmp 0x140031423
lea rdx, str.No_Interface_Options_To_Parse.__SERVER_
mov rcx, r13
call fcn.140017150
mov rax, qword [0x1401746c0]
test rax, rax
je 0x140031807
cmp qword [0x1401011d0], 0
je 0x140031802
lea rdx, str.Parsing_Device_Options.__SERVER_
mov rcx, r13
call fcn.140017150
mov r8, qword [0x1401011d8]
lea rdx, [0x1401011a8]
mov rcx, r13
mov rax, qword [0x1401746c0]
call qword [0x1400a4c40]
test eax, eax
je 0x1400317ea
cmp dword [0x1401140ec], 1
jne 0x1400314a0
mov dword [0x1401140f0], 1
mov dword [0x140114124], 2
jmp 0x140038ec9
lea rax, [rsp + 0xb2a8]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bbdcc]
mov r8d, 3
mov rdx, qword [0x1401011d8]
mov rcx, qword [0x1401011d0]
call fcn.14007a9e0
test eax, eax
jne 0x14003171a
mov rsi, r15
mov qword [rsp + 0x140], r15
mov rax, r15
cmp rax, 3
jae 0x14003171a
lea rdi, [rsi*8]
mov rbx, qword [rsp + rdi + 0xb2a8]
test rbx, rbx
je 0x140031707
test bl, 1
je 0x140031707
lfence
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0xe5e0]
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x140]
lea rax, [0x1400bbdcc]
movsx eax, byte [rsi + rax]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
lea r9, str.Device_Options_String_Has_An_Unbalanced_Count_Of_Character___c___zu_._It_Is_Supposed_To_Be_Balanced._Please_Check_The_Options_String.
mov edx, 0x9fff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe5e0]
call fcn.140001030
mov byte [rsp + 0x185de], 0
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0xe9c], eax
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x24d
mov r12, qword [rsp + 0x50]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 2
lea rax, [0x1400d1b30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c07c4]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x80f2
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
lea rax, [0x140000000]
mov rax, qword [rdi + rax + 0xa5968]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c075c]
mov edx, 0xff
lea r8, [rbx - 2]
lea rcx, [rsp + 0xea0]
call fcn.140001030
mov byte [rsp + 0xf9e], 0
lea rax, [rsp + 0xe5e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c072c]
mov edx, 0xff
lea r8, [rbx - 2]
lea rcx, [rsp + 0xf9f]
call fcn.140001030
mov byte [rsp + 0x109d], 0
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
mov r14, qword [rsp + 0x88]
mov qword [rsp + 0x60], r14
test r14, r14
je 0x140031707
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140031707
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
inc rsi
mov qword [rsp + 0x140], rsi
mov rax, rsi
jmp 0x1400314e3
mov dword [rsp + 0x430], 0x24d
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x24d
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1aa0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0664]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8102
jmp 0x14002d958
cmp dword [0x1401140ec], 1
jne 0x140031844
mov dword [0x140114124], 1
jmp 0x140038ec9
test rax, rax
jne 0x140031816
lea rdx, str.No_Parsing_Device_Options_Function_To_Call.__SERVER_
mov rcx, r13
call fcn.140017150
cmp qword [0x1401011d0], 0
jne 0x14003182f
lea rdx, str.No_Device_Options_String_To_Parse.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [0x1401140ec], 1
jne 0x140031844
mov dword [0x140114124], r15d
jmp 0x140038ec9
mov rcx, r13
cmp qword [0x140174698], 0
je 0x140031949
lea rdx, str.Initializing_Device_Extra_Data___Second_Call.__SERVER_
call fcn.140017150
mov rcx, r13
mov rax, qword [0x140174698]
call qword [0x1400a4c40]
test eax, eax
je 0x140031955
mov dword [rsp + 0x430], 0x24c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x24c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1a10]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0634]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x815f
jmp 0x14002d958
lea rdx, str.No_Initializing_Device_Extra_Data_Function___Second_Call.__SERVER_
call fcn.140017150
cmp dword [0x140101d70], 1
jne 0x140031a43
mov eax, dword [0x1401011e4]
dec eax
cmp eax, 0x7f
jbe 0x140031a54
mov dword [rsp + 0x430], 0x29e
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x29e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x29e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d18c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0604]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x818b
jmp 0x14002d958
mov eax, dword [0x1401011a8]
dec eax
cmp eax, 9
ja 0x140036dd2
mov rcx, r13
cmp dword [0x1401011a0], 0
je 0x140031b58
lea rdx, str.Opening_Interface.__SERVER_
call fcn.140017150
mov rcx, r13
mov rax, qword [0x140101180]
call qword [0x1400a4c40]
test eax, eax
je 0x140031b64
mov dword [rsp + 0x430], 0x24f
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x24f
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1780]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c054c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x81e0
jmp 0x14002d958
lea rdx, str.Proprietary_Interface_Managed_By_Device_Library__Open_.__SERVER_
call fcn.140017150
lea rdx, str.Setting_up_Inter_Process_Communication.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [0x1401219d8], 0
jne 0x140031bbf
cmp dword [0x140121a38], 0
jne 0x140031bbf
mov edi, r15d
mov dword [rsp + 0x110], r15d
mov rcx, r13
call fcn.1400981a0
mov ebx, eax
test eax, eax
je 0x140031bbb
inc edi
mov dword [rsp + 0x110], edi
cmp edi, 4
jae 0x140031cac
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
jne 0x140031b90
lea rdx, str....Setting_up_Socket_Inter_Process_Communication.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [rsp + 0xc8], 1
jne 0x140031d7c
mov dword [rsp + 0x430], 0x262
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x262
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x262
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d14a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c046c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x827c
jmp 0x14002d958
mov dword [rsp + 0x430], 0x278
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x278
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x278
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1560]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c050c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x823d
jmp 0x14002d958
mov edx, esi
mov rcx, r13
call fcn.1400458f0
test eax, eax
je 0x140031e5e
mov dword [rsp + 0x430], 0x262
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x262
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x262
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1400]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c03a4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x828e
jmp 0x14002d958
mov dword [rsp + 0xc8], esi
lea rdx, str.Opening_Device.__SERVER_
mov rcx, r13
call fcn.140017150
mov rdx, qword [0x1401011c8]
mov rcx, r13
mov rax, qword [0x1401746a8]
call qword [0x1400a4c40]
test eax, eax
je 0x140031fcb
mov dword [rsp + 0x430], 0x250
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x250
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x250
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1310]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c030c]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8439
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140036098
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140036098
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
jmp 0x140036098
lea rdx, str.Spawning_Collector_Thread.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [0x1401219d8], 1
jne 0x14003201d
mov rcx, qword [0x14017ed08]
test rcx, rcx
je 0x14003201d
lea rdx, [rsp + 0x434]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14003218c
cmp dword [rsp + 0x434], 0x103
je 0x14003218c
mov qword [0x14017ed08], r15
lea rax, [0x14017ed10]
mov r9, r13
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
cmp dword [0x140101d70], 1
lea r8, [0x140067f10]
jne 0x14003204c
lea r8, [0x14000d690]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x14017ed08], rax
test rax, rax
jne 0x140032263
mov dword [rsp + 0x430], 0x255
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x255
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x255
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1210]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c003c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x879b
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140035c1d
mov qword [r14 + 0x10], rsi
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140035c1d
mov r8d, esi
mov edx, esi
jmp 0x140035c0f
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1290]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c00d4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8776
jmp 0x14002d958
lea rdx, str.Spawning_Power_Management_Thread.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [0x1401219d8], 1
jne 0x1400322b5
mov rcx, qword [0x14017ee90]
test rcx, rcx
je 0x1400322b5
lea rdx, [rsp + 0x434]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1400323ba
cmp dword [rsp + 0x434], 0x103
je 0x1400323ba
mov qword [0x14017ee90], r15
lea rax, [0x14017ee98]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r13
lea r8, [0x14003cb80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x14017ee90], rax
test rax, rax
jne 0x140032491
mov dword [rsp + 0x430], 0x256
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x256
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x256
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d10f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bff94]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8817
jmp 0x14003212d
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1180]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bfffc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x87fd
jmp 0x14002d958
cmp dword [0x14017ed38], 1
jne 0x1400325c1
lea rdx, str.Spawning_Watchdog_Thread.__SERVER_
mov rcx, r13
call fcn.140017150
lea rax, [0x14017ed80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r13
lea r8, [0x140041710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x14017ed78], rax
test rax, rax
jne 0x1400325b2
mov dword [rsp + 0x430], 0x255
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x255
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x255
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1060]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bff64]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x887f
jmp 0x14003212d
mov dword [0x14017ed44], 1
mov esi, 1
lea rdx, [0x1400cf1a8]
mov rcx, r13
call fcn.140017150
lea rdx, str....Spawning_Socket_Inter_Process_Communication_Controller_Thread.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [0x1401219d8], 1
jne 0x140032912
mov ebx, r15d
mov dword [rsp + 0x94], ebx
nop word [rax + rax]
mov rcx, qword [0x14017eee0]
test rcx, rcx
je 0x14003280a
lea rdx, [rsp + 0x434]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1400326fd
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0f80]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bff2c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8973
jmp 0x14002d958
cmp dword [rsp + 0x434], 0x103
jne 0x140032803
inc ebx
mov dword [rsp + 0x94], ebx
cmp ebx, 0x14
ja 0x14003272c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140032600
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0ef0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bfecc]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x898d
jmp 0x14002d958
mov qword [0x14017eee0], r15
lea rax, [0x14017eee8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r13
lea r8, [0x14009c060]
mov edx, 0x200000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x14017eee0], rax
test rax, rax
jne 0x140032b31
mov dword [rsp + 0x430], 0x26d
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x26d
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0d80]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bfbb4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x89d7
jmp 0x14003212d
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ef00], rax
test rax, rax
jne 0x140032a44
mov dword [rsp + 0x430], 0x53
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x53
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x53
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d0e60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bfe94]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x89aa
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140035c1d
mov qword [r14 + 0x10], 1
jmp 0x14003216e
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ef08], rax
test rax, rax
jne 0x14003280a
mov dword [rsp + 0x430], 0x53
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x53
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x53
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d0df0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bfd84]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x89bf
jmp 0x1400329fa
lea rdx, str....Spawning_Socket_Inter_Process_Communication_Controller_Threads_Monitoring__Restart_Thread.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [0x1401219d8], 1
jne 0x140032d6a
mov ebx, r15d
mov dword [rsp + 0x94], ebx
nop word [rax + rax]
mov rcx, qword [0x14017eef0]
test rcx, rcx
je 0x140032d6a
lea rdx, [rsp + 0x434]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x140032c5d
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0ca0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf8d4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8a81
jmp 0x14002d958
cmp dword [rsp + 0x434], 0x103
jne 0x140032d63
inc ebx
mov dword [rsp + 0x94], ebx
cmp ebx, 0x14
ja 0x140032c8c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140032b60
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0c30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf89c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8a9b
jmp 0x14002d958
mov qword [0x14017eef0], r15
lea rax, [0x14017eef8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r13
lea r8, [0x14009a170]
mov edx, 0x8000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x14017eef0], rax
test rax, rax
jne 0x140032e72
mov dword [rsp + 0x430], 0x26e
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x26e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0bb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf874]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8ab7
jmp 0x14003212d
cmp dword [0x1401219d8], 0
jne 0x1400348a5
cmp dword [0x140121a24], 1
jne 0x140033986
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc4e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xd1e0]
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rsp + 0xc4e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140032f9e
mov dword [rsp + 0x430], 0x88
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x88
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x88
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d0b20]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf83c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8b34
jmp 0x1400329fa
lea rax, [rsp + 0xc4e0]
mov qword [rsp + 0x20], rax
lea r9, str._s_sc.exe
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xd1e0]
call fcn.140001140
mov word [rsp + 0xd3dc], r15w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xcfe0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14017ebc8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rsp + 0x20], eax
lea r9, str.sc_start_USER_ESRV_SVC_QUEENCREEK___start___run_as_users___register_port__u
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xcfe0]
call fcn.140001140
mov word [rsp + 0xd1dc], r15w
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
movups xmmword [rsp + 0x250], xmm0
mov dword [rsp + 0x1f0], WSACleanup
xor eax, eax
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], rax
mov word [rsp + 0x230], r15w
mov dword [rsp + 0x22c], esi
movups xmmword [rsp + 0xb270], xmm0
mov qword [rsp + 0xb280], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb270], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb278], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb280], rax
mov qword [rsp + 0x180], r15
mov dword [rsp + 0x78], r15d
lea r9, [rsp + 0x180]
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x14003352c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1400331da
mov dword [rsp + 0x430], 3
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 3
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d08b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf654]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8bf7
jmp 0x14002e9ff
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x180]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x58], rax
xor edx, edx
test rax, rax
jne 0x1400332cb
mov dword [rsp + 0x430], 3
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
lea r9d, [rbx + 3]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d09f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf804]
mov edx, 0x9f6
lea r8, [rbx - 1]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], bl
mov dword [rsp + 0xe98], 0x8ba7
jmp 0x14002e9ff
mov r8, qword [rsp + 0x180]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x180]
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor edx, edx
test eax, eax
jne 0x1400333c6
mov dword [rsp + 0x430], 3
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 3
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0980]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf744]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8bc5
jmp 0x14002e9ff
mov dword [rsp + 0x78], esi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0xb270]
mov r8d, 0x20002
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x140033522
mov dword [rsp + 0x430], 3
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 3
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0910]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf704]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8be2
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140027e6c
mov qword [r14 + 0x10], 1
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
jne 0x140028dc6
jmp 0x140027e6c
mov qword [rsp + 0x258], rbx
jmp 0x140033531
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80220
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xcfe0]
lea rcx, [rsp + 0xd1e0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140033c58
mov dword [rsp + 0x430], 0x27c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x27c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x27c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0850]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf5e4]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8c32
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x1400336b0
mov qword [r14 + 0x10], rsi
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x1400336b0
mov r8d, esi
mov edx, esi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
je 0x140033804
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
je 0x1400337fc
mov dword [rsp + 0x430], 0x42
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x42
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x42
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0660]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf424]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8cb6
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x1400337fc
mov qword [r14 + 0x10], 1
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x1400337fc
mov qword [rsp + 0x1a8], r15
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x140033958
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
je 0x140033950
mov dword [rsp + 0x430], 0x42
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x42
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x42
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d05e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf354]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8cc7
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, esi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140033950
mov qword [rsp + 0x1b0], r15
cmp dword [rsp + 0x78], 1
jne 0x140033968
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
test rbx, rbx
je 0x140033986
cmp dword [0x1401219d8], 0
jne 0x1400348a5
cmp dword [0x140121a20], 1
jne 0x1400348a5
xor eax, eax
mov dword [rsp + 0xc2c0], eax
mov word [rsp + 0xc2c4], ax
lea rcx, [0x14017ebc8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rsp + 0x20], eax
lea r9, str._05u
mov edx, 6
lea r8, [rdx - 7]
lea rcx, [rsp + 0xc2c0]
call fcn.140001030
mov byte [rsp + 0xc2c5], 0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, str..pipeuser_esrv_svc_queencreek
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140034027
mov dword [rsp + 0x430], 0x274
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x3f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
lea r9d, [rdi + 0x40]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d0530]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf2dc]
mov edx, 0x9f6
mov r8, rdi
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d27
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov rdi, qword [rsp + 0x50]
mov dword [rdi + 0x50], eax
test r14, r14
je 0x140033b42
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140033b42
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [rdi + 0x50], eax
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x274
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x274
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d04d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf2ac]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d2d
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140035c1d
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140035c1d
mov rax, qword [0x1401219d0]
mov qword [rsp + 0xb298], rax
mov rcx, qword [rsp + 0x1a8]
mov qword [rsp + 0xb2a0], rcx
test rax, rax
je 0x140033f57
test rcx, rcx
je 0x140033f57
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0xb298]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x178], eax
cmp eax, 1
je 0x140033d84
mov dword [rsp + 0x430], 0x27e
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x27e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x27e
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0730]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf53c]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8c91
jmp 0x14003212d
lea rdx, [rsp + 0x10ac]
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140033e72
mov dword [rsp + 0x430], 0x27f
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x27f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x27f
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d07f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf5ac]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8c66
jmp 0x14003212d
mov ecx, dword [rsp + 0x10ac]
test ecx, ecx
je 0x1400336b0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x430], 0x280
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x280
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x280
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0790]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf574]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8c7e
jmp 0x14003212d
mov dword [rsp + 0x430], 0x27d
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x27d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x27d
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d06c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf454]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8ca3
jmp 0x14003212d
mov dword [rsp + 0x114], r15d
mov ebx, r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x440]
mov r8d, 5
lea rdx, [rsp + 0xc2c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140034068
cmp dword [rsp + 0x440], 5
je 0x140034398
cmp ebx, 4
jae 0x140034078
inc ebx
mov dword [rsp + 0x114], ebx
jmp 0x140034032
cmp dword [rsp + 0x440], 5
je 0x140034398
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400341b5
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x41
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
lea r9d, [rbx + 0x40]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d0470]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf27c]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d54
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x1400341b5
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x1400341b5
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
mov dword [rsp + 0x430], 0x274
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x43
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
lea r9d, [rbx + 0x42]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d03f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf1fc]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d61
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov rdi, qword [rsp + 0x50]
mov dword [rdi + 0x50], eax
test r14, r14
je 0x1400342da
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x1400342da
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [rdi + 0x50], eax
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x274
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x274
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0380]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf1a4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d67
jmp 0x140033bfb
mov rcx, rdi
test eax, eax
jne 0x1400346b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400344cf
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x41
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
lea r9d, [rbx + 0x40]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d0320]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf0fc]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d73
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x1400344cf
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x1400344cf
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
mov dword [rsp + 0x430], 0x2cd
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x2cd
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x2cd
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d02b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf0dc]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d80
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov rdi, qword [rsp + 0x50]
mov dword [rdi + 0x50], eax
test r14, r14
je 0x1400345f6
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x1400345f6
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [rdi + 0x50], eax
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x274
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x274
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0230]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bf05c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d86
jmp 0x140033bfb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400348a5
mov dword [rsp + 0x430], 0x41
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x41
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov ebx, 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
lea r9d, [rbx + 0x40]
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d01c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400beff4]
mov edx, 0x9f6
lea r8, [rbx - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d98
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, ebx
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov rdi, qword [rsp + 0x50]
mov dword [rdi + 0x50], eax
test r14, r14
je 0x1400347e7
mov qword [r14 + 0x10], rbx
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x1400347e7
mov r8d, ebx
mov edx, ebx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [rdi + 0x50], eax
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], ebx
mov dword [rsp + 0x45c], ebx
mov dword [rsp + 0x498], 0x274
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r15
mov r9d, 0x274
mov rdx, rdi
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d0140]
mov qword [rsp + 0x20], rax
lea r9, [0x1400befcc]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x8d9e
jmp 0x140033bfb
cmp dword [0x14017ed38], 1
jne 0x140034c32
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x260], 2
mov r9d, 0xff
lea r8, str.SAMPLING_MANAGEMENT
mov edx, r9d
lea rcx, [rsp + 0x268]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword [0x140187310]
mov qword [rsp + 0x368], rax
mov eax, dword [0x140187318]
mov dword [rsp + 0x370], eax
mov rax, qword [0x140187308]
mov qword [rsp + 0x378], rax
mov rax, qword [0x140187300]
mov qword [rsp + 0x3c8], rax
mov eax, 1
mov dword [rsp + 0x20], eax
mov r9d, eax
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x260]
mov rcx, r13
call fcn.1400413c0
test eax, eax
jne 0x140027e67
mov rax, qword [rsp + 0x188]
mov qword [0x1401872f8], rax
cmp qword [0x14017eea0], 0
jne 0x140034973
pause
jmp 0x140034965
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x260], 1
mov r9d, 0xff
lea r8, str.POWER_MANAGEMENT
mov edx, r9d
lea rcx, [rsp + 0x268]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword [0x14017ee90]
mov qword [rsp + 0x368], rax
mov eax, dword [0x14017ee98]
mov dword [rsp + 0x370], eax
mov rax, qword [0x14017ee88]
mov qword [rsp + 0x378], rax
mov rax, qword [0x14017eea0]
mov qword [rsp + 0x3b8], rax
mov dword [rsp + 0x3c0], reloc.WS2_32.dll_recv
mov eax, 1
mov dword [rsp + 0x20], eax
mov r9d, eax
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x260]
mov rcx, r13
call fcn.1400413c0
test eax, eax
jne 0x140035c1d
mov rax, qword [rsp + 0x188]
mov qword [0x14017ee80], rax
cmp qword [0x14017ec78], 0xffffffffffffffff
jne 0x140034a3f
pause
jmp 0x140034a31
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x260], 3
mov r9d, 0xff
lea r8, [0x1400befa4]
mov edx, r9d
lea rcx, [rsp + 0x268]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword [0x14017eee0]
mov qword [rsp + 0x368], rax
mov eax, dword [0x14017eee8]
mov dword [rsp + 0x370], eax
mov qword [rsp + 0x378], r15
mov rax, qword [0x14017ec78]
mov qword [rsp + 0x3d0], rax
mov eax, 1
mov dword [rsp + 0x20], eax
mov r9d, eax
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x260]
mov rcx, r13
call fcn.1400413c0
test eax, eax
jne 0x140035c1d
mov rax, qword [rsp + 0x188]
mov qword [0x14017eec0], rax
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x260], r15d
mov r9d, 0xff
lea r8, str.IPC_MONITOR
mov edx, r9d
lea rcx, [rsp + 0x268]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword [0x14017eef0]
mov qword [rsp + 0x368], rax
mov eax, dword [0x14017eef8]
mov dword [rsp + 0x370], eax
mov rax, qword [0x14017ed00]
mov qword [rsp + 0x378], rax
mov eax, 1
mov dword [rsp + 0x20], eax
mov r9d, eax
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x260]
mov rcx, r13
call fcn.1400413c0
test eax, eax
jne 0x140035c1d
mov rax, qword [rsp + 0x188]
mov qword [0x14017eec8], rax
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x260], r15d
mov r9d, 0xff
lea r8, str.SERVER_KERNEL
mov edx, r9d
lea rcx, [rsp + 0x268]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword [0x14017ed08]
mov qword [rsp + 0x368], rax
mov eax, dword [0x14017ed10]
mov dword [rsp + 0x370], eax
mov rax, qword [0x14017ed00]
mov qword [rsp + 0x378], rax
mov eax, 1
mov dword [rsp + 0x20], eax
mov r9d, eax
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x260]
mov rcx, r13
call fcn.1400413c0
test eax, eax
jne 0x140035c1d
mov rax, qword [rsp + 0x188]
mov qword [0x14017ecf8], rax
mov esi, 1
lea rdx, str.Installing__CTRL__C__Signal_Handler.__SERVER_
mov rcx, r13
call fcn.140017150
mov edx, esi
lea rcx, [0x14001ba90]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x140034d28
mov dword [rsp + 0x430], 0x264
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x264
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov esi, 1
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x264
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d00c0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bef84]
mov edx, 0x9f6
lea r8, [rsi - 2]
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x909b
jmp 0x14003212d
cmp dword [0x140121b74], 1
jne 0x140034efc
lea rdx, str.Spawning_Driver_Clock_Thread.__SERVER_
mov rcx, r13
call fcn.140017150
lea rax, [0x140187418]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, r13
lea r8, [0x14008b300]
mov edx, 0x8000
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [0x140187410], rax
test rax, rax
jne 0x140034e49
mov dword [rsp + 0x430], 0x30a
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov dword [rsp + 0x490], 3
mov dword [rsp + 0x45c], esi
mov dword [rsp + 0x498], 0x30a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0x30a
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 5
lea rax, [0x1400d0040]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bef5c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x90f8
jmp 0x1400329fa
cmp dword [0x14017ed38], 1
jne 0x140034efc
xor edx, edx
mov r8d, 0x1d0
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x260], r15d
mov r9d, 0xff
lea r8, str.DRIVER_CLOCK
mov edx, r9d
lea rcx, [rsp + 0x268]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword [0x140187410]
mov qword [rsp + 0x368], rax
mov eax, dword [0x140187418]
mov dword [rsp + 0x370], eax
mov rax, qword [0x14017ed00]
mov qword [rsp + 0x378], rax
mov eax, 1
mov dword [rsp + 0x20], eax
mov r9d, eax
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x260]
mov rcx, r13
call fcn.1400413c0
test eax, eax
jne 0x140027e67
mov rax, qword [rsp + 0x188]
mov qword [0x140187408], rax
mov esi, 1
lea rdx, str.Waiting_For_User_Command.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [0x1401139e4], 1
je 0x140034f19
call fcn.140044730
mov rcx, qword [0x140187428]
test rcx, rcx
je 0x140034f2b
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0x1401219d8], r15d
mov rcx, qword [0x140171d60]
test rcx, rcx
je 0x140034f44
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [0x14017ed00]
test rcx, rcx
je 0x140035ae4
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x178], eax
lea rdx, str.Received_STOP_command.__SERVER_
mov rcx, r13
call fcn.140017150
lea rdx, str.Stopping_All_Threads.__SERVER_
mov rcx, r13
call fcn.140017150
cmp dword [0x1401219d8], 0
je 0x140034f9b
cmp dword [rsp + 0x98], 1
jne 0x140035c1d
cmp dword [0x1401219f0], 0
jne 0x140034fad
cmp dword [0x140121a20], 1
je 0x140034fba
cmp dword [0x140121a24], 1
jne 0x140035c1d
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc4e0]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xcae0]
call sub.VCRUNTIME140.dll_memset
mov edx, 0xff
lea rcx, [rsp + 0xc4e0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rsp + 0xc4e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400cedb8]
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xcae0]
call fcn.140001140
xor eax, eax
mov qword [rsp + 0xc2c8], rax
mov word [rsp + 0xc2d0], ax
mov qword [rsp + 0x150], 0xa
mov byte [0x14017ebd1], al
mov dword [rsp + 0x68], r15d
mov edi, r15d
mov ebx, edi
movsx eax, byte [rbx + r13 + 0x7da88]
test al, al
je 0x14003508d
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
jne 0x140035075
mov byte [rbx + r13 + 0x7da88], al
jmp 0x140035085
movzx eax, byte [rbx + r13 + 0x7da88]
mov byte [rsp + rbx + 0xc2c8], al
inc edi
mov dword [rsp + 0x68], edi
jmp 0x140035050
lea rcx, [rsp + 0xc2c8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rsp + 0x9c], eax
add eax, 0xffff3f94
cmp eax, 0x64
ja 0x1400357e6
lfence
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0xc8e0]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x20], eax
lea r9, str.sc_start_USER_ESRV_SVC_QUEENCREEK___start___run_as_users___unregister_port__u
mov edx, 0xff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xc8e0]
call fcn.140001140
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
movups xmmword [rsp + 0x250], xmm0
mov dword [rsp + 0x1f0], WSACleanup
xor eax, eax
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], rax
mov word [rsp + 0x230], r15w
mov dword [rsp + 0x22c], esi
movups xmmword [rsp + 0xb270], xmm0
mov qword [rsp + 0xb280], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb270], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb278], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xb280], rax
mov qword [rsp + 0x180], r15
mov dword [rsp + 0x78], r15d
lea r9, [rsp + 0x180]
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x140035648
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
je 0x140035944
mov dword [rsp + 0x430], 0xa7
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0xa7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0xa7
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cffb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bef2c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9296
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140035c1d
mov qword [r14 + 0x10], 1
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140035c1d
mov ecx, 1
mov r8d, ecx
mov edx, ecx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
cmp dword [0x1401219c8], 0
jne 0x140035c42
mov dword [0x1401219c8], 1
mov rcx, qword [0x1401219d0]
test rcx, rcx
je 0x140035c42
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140187300]
test rcx, rcx
je 0x140035c54
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140187310]
test rcx, rcx
je 0x140035d00
lea rdx, [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
je 0x140035c8e
test eax, eax
jne 0x140035d00
mov rax, qword [0x140187308]
cmp dword [rsp + 0x178], 0x103
jne 0x140035cd2
mov rcx, qword [0x14017ed30]
test rcx, rcx
je 0x140035d19
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ed30], r15
mov rcx, r13
call fcn.14009e1c0
cmp eax, 1
jne 0x140035e38
mov rcx, r13
cmp dword [0x1401011a0], 0
je 0x14003619e
lea rdx, str.Closing_Interface.__SERVER_
call fcn.140017150
mov rcx, r13
mov rax, qword [0x140101188]
call qword [0x1400a4c40]
test eax, eax
je 0x1400361aa
mov dword [rsp + 0x430], 0x253
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x253
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x253
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf8e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400beb7c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9870
jmp 0x140036e9f
lea rdx, str.Proprietary_Interface_Managed_By_Device_Library__Close_.__SERVER_
call fcn.140017150
mov rcx, r13
cmp qword [0x1401746a0], 0
je 0x1400362b1
lea rdx, str.Freeing_Device_Extra_Data.__SERVER_
call fcn.140017150
mov rcx, r13
mov rax, qword [0x1401746a0]
call qword [0x1400a4c40]
test eax, eax
je 0x1400362bd
mov dword [rsp + 0x430], 0x24c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x24c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x24c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf800]
mov qword [rsp + 0x20], rax
lea r9, [0x1400beaac]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x989d
jmp 0x140036e9f
lea rdx, str.No_Freeing_Device_Extra_Data_Function_To_Call.__SERVER_
call fcn.140017150
cmp dword [0x1401219d8], 1
jne 0x14003651c
lea rdx, str.Waiting_For_IPC_Inter_Process_Communication_Controller_Thread_End.__SERVER_
mov rcx, r13
call fcn.140017150
mov ebx, r15d
mov dword [rsp + 0x94], ebx
mov dword [0x1401219c8], 1
mov rcx, qword [0x1401219d0]
test rcx, rcx
je 0x1400362ff
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x14017eee0]
test rcx, rcx
je 0x14003651c
lea rdx, [rsp + 0x434]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1400363fe
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf720]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be9f4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x98c9
jmp 0x140036e9f
cmp dword [rsp + 0x434], 0x103
jne 0x140036515
inc ebx
mov dword [rsp + 0x94], ebx
cmp ebx, 0x14
ja 0x14003643c
lea rdx, str....Still_Waiting_For_IPC_Inter_Process_Communication_Controller_Thread_End.__SERVER_
mov rcx, r13
call fcn.140017150
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400362e3
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf620]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be9bc]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x98e7
jmp 0x140036e9f
mov qword [0x14017eee0], r15
lea rdx, str.Destroying_Device_Control_Interrupt.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, qword [0x140171d78]
test rcx, rcx
je 0x140036544
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d78], r15
mov rcx, qword [0x140171d80]
test rcx, rcx
je 0x14003655d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d80], r15
mov rcx, qword [0x140171d88]
test rcx, rcx
je 0x140036576
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d88], r15
mov dword [rsp + 0x68], r15d
mov edi, r15d
nop
cmp edi, 8
jae 0x1400365aa
mov ebx, edi
mov rcx, qword [r13 + rbx*8 + 0x70c50]
test rcx, rcx
je 0x1400365a2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + rbx*8 + 0x70c50], r15
inc edi
mov dword [rsp + 0x68], edi
jmp 0x140036580
mov dword [0x140101d48], r15d
mov dword [rsp + 0x68], r15d
mov edi, r15d
nop dword [rax]
cmp edi, 8
jae 0x1400365ea
mov ebx, edi
mov rcx, qword [r13 + rbx*8 + 0x70c90]
test rcx, rcx
je 0x1400365e2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + rbx*8 + 0x70c90], r15
inc edi
mov dword [rsp + 0x68], edi
jmp 0x1400365c0
mov dword [0x140101d4c], r15d
mov dword [0x140153d34], r15d
lea rdx, str.Destroying_Internal_Device_Control_Ready_Interrupt.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, qword [0x140153c30]
test rcx, rcx
je 0x140036620
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140153c30], r15
lea rdx, str.Destroying_Device_Interrupt_Handler_Remote_Access_Lock.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, qword [0x14012bbd8]
test rcx, rcx
je 0x140036648
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14012bbd8], r15
lea rdx, str.Destroying_Device_Status_Ready_Interrupt.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, qword [0x14013fbf8]
test rcx, rcx
je 0x140036670
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14013fbf8], r15
mov dword [0x14013fc28], r15d
lea rcx, [0x14013fc00]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rdx, str.Delete_Thread_Synchronization_Event.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, qword [0x14017ed00]
test rcx, rcx
je 0x1400366ac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ed00], r15
cmp qword [0x14017eeb0], 0
je 0x1400366d7
lea rdx, str.Signaling_Driver_Ready_To_Quit.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, qword [0x14017eeb0]
test rcx, rcx
je 0x1400366d7
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x14017ee90]
test rcx, rcx
je 0x14003674f
lea rdx, [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x178], 0x103
jne 0x14003674f
mov rax, qword [0x14017ee88]
test rax, rax
je 0x14003674f
mov rcx, qword [0x14017eea0]
test rcx, rcx
je 0x14003673f
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0xffffffff
mov rcx, qword [0x14017ee88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x14017ee88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ee88], r15
cmp dword [0x14017ed38], 1
jne 0x140036a48
cmp dword [0x14017ed44], 1
jne 0x140036a48
mov dword [0x1401219c8], 1
mov rcx, qword [0x1401219d0]
test rcx, rcx
je 0x140036785
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x1401219d8], 0
jne 0x1400367ae
mov rcx, qword [0x14017ed70]
test rcx, rcx
je 0x1400369ed
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1400369ed
mov ebx, r15d
mov dword [rsp + 0x94], ebx
mov rcx, qword [0x14017ee08]
test rcx, rcx
je 0x1400367d0
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop word [rax + rax]
mov rcx, qword [0x14017ed78]
test rcx, rcx
je 0x1400369ed
lea rdx, [rsp + 0x434]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1400368cf
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf4d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be8fc]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9b7a
jmp 0x140036e9f
cmp dword [rsp + 0x434], 0x103
jne 0x1400369e6
inc ebx
mov dword [rsp + 0x94], ebx
cmp ebx, 0x14
ja 0x14003690d
lea rdx, str.Still_Waiting_For_Watchdog_Threads_End
mov rcx, r13
call fcn.140017150
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400367d0
mov dword [0x1401219d8], r15d
mov dword [rsp + 0x430], 0x81
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x81
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x81
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf440]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be8c4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9b9a
jmp 0x140036e9f
mov qword [0x14017ed78], r15
mov rcx, qword [0x14017ee68]
test rcx, rcx
je 0x1400369ff
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, str.Abort_Auto_destruct.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, r13
call fcn.140042e20
mov rcx, qword [0x14017ed70]
test rcx, rcx
je 0x140036a2f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ed70], r15
mov rcx, qword [0x14017ee68]
test rcx, rcx
je 0x140036a48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ee68], r15
lea rdx, str.Destroying_Measurement_Interrupt.__SERVER_
mov rcx, r13
call fcn.140017150
mov rcx, qword [0x140171d50]
test rcx, rcx
je 0x140036a70
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d50], r15
mov rcx, qword [0x140171d48]
test rcx, rcx
je 0x140036a89
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d48], r15
mov rcx, qword [0x140171d58]
test rcx, rcx
je 0x140036aa2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d58], r15
mov rcx, qword [0x140171d68]
test rcx, rcx
je 0x140036abb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d68], r15
mov rcx, qword [0x140171d70]
test rcx, rcx
je 0x140036ad4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d70], r15
mov rcx, qword [0x140171d60]
test rcx, rcx
je 0x140036aed
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140171d60], r15
mov rcx, qword [0x14017eeb0]
test rcx, rcx
je 0x140036b06
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017eeb0], r15
mov rcx, qword [0x14017ee88]
test rcx, rcx
je 0x140036b1f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ee88], r15
cmp dword [0x1401219d8], 0
jne 0x140036ca4
cmp dword [0x140171f14], 1
jne 0x140036ca4
cmp dword [0x1401139e4], 1
je 0x140038dd6
mov dword [rsp + 0x430], 0x26f
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26f
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d1830]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c0584]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x81a1
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140027e67
mov qword [r14 + 0x10], 1
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140027e67
mov esi, 1
jmp 0x140028dc6
lea rdx, str.User_Command_Processing_Starts.__COMMAND_
call fcn.140017150
lea rdx, str.Parsing_User_Command.__COMMAND_
mov rcx, r13
call fcn.140017150
mov rcx, r13
mov rax, qword [0x140174768]
call qword [0x1400a4c40]
test eax, eax
je 0x14003700a
mov dword [rsp + 0x430], 0x263
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x263
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x263
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf1e0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be7cc]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9da3
jmp 0x140036e9f
mov edi, 1
mov dword [rsp + 0x118], edi
cmp dword [0x140174728], 8
jne 0x140037074
cmp dword [0x140174738], edi
jne 0x140037074
lea edx, [rdi + 9]
mov rcx, qword [0x140174740]
call fcn.140039af0
mov r8, rax
lea rdx, [0x1400cf148]
mov rcx, qword [0x140174740]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140037074
cmp dword [0x14017eb24], eax
jne 0x140037074
cmp dword [0x14017eb28], eax
jne 0x140037074
mov edi, r15d
mov dword [rsp + 0x118], r15d
mov ebx, r15d
jmp 0x1400371d6
lea rdx, [0x1400cf0f8]
mov rcx, r13
call fcn.140017150
mov edx, 2
mov rcx, r13
call fcn.1400458f0
test eax, eax
je 0x1400371cd
mov dword [rsp + 0x430], 0x262
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, edi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x262
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r15
mov r9d, 0x262
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf0a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be75c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9de2
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
mov rax, qword [rsp + 0x50]
inc dword [rax + 0x30]
mov r9d, edi
lea r8, [rsp + 0x450]
mov rdx, rax
mov rcx, r13
call fcn.1400056d0
mov r12, qword [rsp + 0x50]
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140027e67
mov qword [r14 + 0x10], rdi
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140027e67
mov esi, edi
mov r8d, edi
mov edx, edi
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
jmp 0x140027e6c
mov dword [rsp + 0xc8], edi
mov ebx, edi
lea rax, [rsp + 0x11f0]
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x1200]
mov qword [rsp + 0x170], rax
xor edx, edx
mov r8d, 0xa080
lea rcx, [rsp + 0x11f0]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x140174728]
dec eax
cmp eax, 8
ja case.default.0x14003722f
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x39ac4]
add rcx, rdx
jmp rcx
lea rdx, str.Sending_Command_STOP.__COMMAND_
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x11f0], 1
mov byte [rsp + 0x125d], 0x53
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x140038995
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cf030]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be65c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9ea1
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea rdx, [0x1400ce928]
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x11f0], 1
mov byte [rsp + 0x125d], 0x59
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x140038995
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cefd0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be634]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9f25
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea rdx, str.Sending_Command_RESET.__COMMAND_
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x11f0], 1
mov byte [rsp + 0x125d], 0x5a
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x140038995
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cef60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be5f4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x9fa9
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea rdx, [0x1400ce828]
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x11f0], 1
mov byte [rsp + 0x125d], 0x52
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x140038995
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ceef0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be5bc]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa02d
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea rdx, str.Sending_Command_SYNCH.__COMMAND_
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x11f0], 1
mov byte [rsp + 0x125d], 0x3e
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x140038995
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cee70]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be584]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa0b1
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea rdx, str.Sending_Command_FLUSH.__COMMAND_
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x11f0], 1
mov byte [rsp + 0x125d], 4
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x140038995
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cedd0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be544]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa135
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea rdx, str.Sending_Command_DEVICE_CONTROL.__COMMAND_
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x11f0], 1
mov byte [rsp + 0x125d], 0x43
cmp dword [0x140174748], 1
jne 0x140037f19
mov edx, 0x9fff
mov rcx, qword [0x140174740]
call fcn.140039af0
mov ebx, 0x9fff
sub rbx, rax
mov qword [rsp + 0xd8], rbx
jne 0x140037b63
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cece0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be514]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa1b6
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
mov r9, rax
mov r8, qword [0x140174740]
mov edx, 0x9fff
lea rcx, [rsp + 0x185e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov edx, 2
lea rcx, [0x1400be4dc]
call fcn.140039af0
sub rbx, rax
mov qword [rsp + 0xd8], rbx
jne 0x140037c9e
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cec30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be484]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa1cf
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
mov r9, rax
lea r8, [0x1400be454]
mov edx, 0x9fff
lea rcx, [rsp + 0x185e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
mov edx, 0x9fff
mov rcx, qword [0x140174750]
call fcn.140039af0
sub rbx, rax
mov qword [rsp + 0xd8], rbx
jne 0x140037dd9
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400cebb0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be424]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa1e8
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
mov r9, rax
mov edx, 0x9fff
lea rcx, [rsp + 0x185e0]
cmp dword [0x140174758], 0
mov r8, qword [0x140174750]
je 0x140037e00
mov r8, qword [0x140174760]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
cmp rbx, 0xa000
jb 0x140037f0f
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ceb30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be3f4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa20b
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea r8, [rsp + 0x185e0]
jmp 0x140037f29
cmp dword [0x140174738], 1
jne 0x140037f40
mov r8, qword [0x140174740]
mov r9d, 0xa000
mov edx, r9d
lea rcx, [rsp + 0x125e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x140038995
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ceaa0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be3c4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa250
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
mov rcx, r13
cmp ebx, 1
jne 0x14003885d
lea rdx, str.Sending_Command_STATUS.__COMMAND_
call fcn.140017150
mov dword [rsp + 0x11f0], ebx
mov byte [rsp + 0x125d], 0x54
cmp dword [0x140174748], ebx
jne 0x14003856a
mov edx, 0x9fff
mov rcx, qword [0x140174740]
call fcn.140039af0
mov ebx, 0x9fff
sub rbx, rax
mov qword [rsp + 0xd8], rbx
jne 0x1400381c4
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce9f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be394]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa2d5
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
mov r9, rax
mov r8, qword [0x140174740]
mov edx, 0x9fff
lea rcx, [rsp + 0x185e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov edx, 2
lea rcx, [0x1400be344]
call fcn.140039af0
sub rbx, rax
mov qword [rsp + 0xd8], rbx
jne 0x1400382ff
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce950]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be2fc]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa2ee
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
mov r9, rax
lea r8, [0x1400be2cc]
mov edx, 0x9fff
lea rcx, [rsp + 0x185e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
mov edx, 0x9fff
mov rcx, qword [0x140174750]
call fcn.140039af0
sub rbx, rax
mov qword [rsp + 0xd8], rbx
jne 0x14003843a
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce8d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be27c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa307
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
mov r9, rax
mov r8, qword [0x140174750]
mov edx, 0x9fff
lea rcx, [rsp + 0x185e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
cmp rbx, 0xa000
jb 0x140038560
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce850]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be16c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa31e
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea r8, [rsp + 0x185e0]
jmp 0x14003857a
cmp dword [0x140174738], 1
jne 0x140038591
mov r8, qword [0x140174740]
mov r9d, 0xa000
mov edx, r9d
lea rcx, [rsp + 0x125e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x1400386bf
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce7d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be0f4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa363
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
cmp dword [0x140121a28], 1
jne 0x14003872f
mov ebx, dword [0x140121a2c]
test ebx, ebx
je 0x14003872f
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0xe5e0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], ebx
lea r9, str.Delaying_IPC_Receive_By___u__ms_As_Requested_By_User.__COMMON_
mov edx, 0x9fff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe5e0]
call fcn.140001030
mov byte [rsp + 0x185de], 0
lea rdx, [rsp + 0xe5e0]
mov rcx, r13
call fcn.140017150
mov ecx, dword [0x140121a2c]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140047520
test eax, eax
je 0x140038924
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce750]
mov qword [rsp + 0x20], rax
lea r9, [0x1400be0a4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa3c0
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea rdx, str.Serving_Command_STATUS.__COMMAND_
call fcn.140017150
mov edx, 0xa
mov rcx, qword [0x140174740]
call fcn.140039af0
mov r8, rax
lea rdx, [0x1400ce6d8]
mov rcx, qword [0x140174740]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140038924
xor edx, edx
mov r8d, 0xa000
lea rcx, [rsp + 0x125e]
call sub.VCRUNTIME140.dll_memset
mov r9d, dword [0x140113984]
mov r8d, 0xa000
lea rdx, [rsp + 0x125e]
mov rcx, r13
call fcn.14007f6a0
mov dword [rsp + 0x43c], eax
cmp eax, 1
jne 0x14003890b
lea rax, str.Unable_To_Query_Data
mov qword [rsp + 0x20], rax
lea r9, [0x1400be054]
mov edx, 0xa000
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x125e]
call fcn.140001030
mov byte [rsp + 0xb25d], 0
mov byte [rsp + 0x125d], 0x41
lea r9, [0x1400bdfe4]
lea rax, [rsp + 0x125e]
jmp 0x14003894d
cmp byte [rsp + 0x125d], 0x41
jne 0x14003893f
lea r9, [0x1400bdfe4]
lea rax, [rsp + 0x125e]
jmp 0x14003894d
lea r9, [0x1400bdfb4]
lea rax, str._Incorrect_Answer_Received_From_Device_
mov qword [rsp + 0x20], rax
mov edx, 0x9fff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe5e0]
call fcn.140001030
mov byte [rsp + 0x185de], 0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, [rsp + 0xe5e0]
lea rdx, str.Status:___s_._n
call fcn.1400010a0
cmp dword [0x140112cfc], 1
jne 0x140038af1
mov rax, qword [0x140113960]
test rax, rax
je 0x140038af1
mov ecx, 1
mov r8d, ecx
mov edx, ecx
mov rcx, r13
call qword [0x1400a4c40]
test eax, eax
je 0x140038af1
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov ebx, 0x102
mov dword [rsp + 0x498], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, ebx
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 3
lea rax, [0x1400ce580]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bdf14]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa4d9
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
mov dword [r12 + 0x50], eax
test r14, r14
je 0x140038af1
mov qword [r14 + 0x10], 1
mov dword [r14 + 0xc], r15d
mov rax, qword [0x140113960]
test rax, rax
je 0x140038af1
mov ecx, 1
mov r8d, ecx
mov edx, ecx
mov rcx, r13
call qword [0x1400a4c40]
mov dword [r12 + 0x50], eax
cmp dword [0x140121a30], 1
jne 0x140038b61
mov ebx, dword [0x140121a34]
test ebx, ebx
je 0x140038b61
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0xe5e0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], ebx
lea r9, str.Delaying_Stop_By___u__ms_As_Requested_By_User.__COMMON_
mov edx, 0x9fff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe5e0]
call fcn.140001030
mov byte [rsp + 0x185de], 0
lea rdx, [rsp + 0xe5e0]
mov rcx, r13
call fcn.140017150
mov ecx, dword [0x140121a34]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 1
jne 0x140038dd6
lea rdx, [0x1400ce528]
mov rcx, r13
call fcn.140017150
lea edx, [rdi + 1]
mov rcx, r13
call fcn.140047120
test eax, eax
je 0x140038dce
mov dword [rsp + 0x430], 0x262
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, edi
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x262
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r15
mov r9d, 0x262
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce4d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bded4]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa525
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, edi
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
lea rdx, str.Sending_Command_RESTART.__COMMAND_
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x11f0], 1
mov byte [rsp + 0x125d], 0x3c
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 2
mov r9d, 0xa080
lea r8, [rsp + 0x11f0]
mov rdx, qword [0x14017ec80]
mov rcx, r13
call fcn.140046c10
test eax, eax
je 0x140038995
mov dword [rsp + 0x430], 0x26c
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x26c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x26c
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce680]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bdf84]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa499
mov eax, dword [r12 + 0x30]
mov dword [rsp + 0x46c], eax
inc dword [r12 + 0x30]
mov r9d, 1
lea r8, [rsp + 0x450]
mov rdx, r12
mov rcx, r13
call fcn.1400056d0
jmp 0x140036ed1
mov dword [rsp + 0xc8], r15d
lea rdx, str.Stopping_Energy_Server.__COMMON_
mov rcx, r13
call fcn.140017150
cmp dword [0x140121788], 1
jne 0x140038ec9
cmp qword [0x140121798], 0
je 0x140038ec9
cmp qword [0x1401217a0], 0
je 0x140038ec9
lea rdx, [0x1400ce490]
mov rcx, r13
call fcn.140017150
mov dword [0x1401217a8], 3
mov rcx, qword [0x1401217a0]
test rcx, rcx
je 0x140038e39
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, r15d
mov dword [rsp + 0xac], ebx
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x178]
mov rcx, qword [0x140121798]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, 1
jne 0x140038ea9
cmp dword [rsp + 0x178], 0x103
jne 0x140038ea9
mov edx, 0x1f4
mov rcx, qword [0x140121798]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x178], eax
cmp eax, 0x102
jne 0x140038ea9
mov eax, ebx
inc ebx
mov dword [rsp + 0xac], ebx
cmp eax, 4
jae 0x140038ea9
jmp 0x140038e50
mov qword [0x140121798], r15
mov rcx, qword [0x1401217a0]
test rcx, rcx
je 0x140038ec9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401217a0], r15
cmp dword [0x1401140ec], 1
jne 0x1400390dc
mov dword [rsp + 0x68], r15d
mov edi, r15d
nop
cmp edi, 0xd
jae 0x140038fc0
xor edx, edx
mov r8d, 0x9fff
lea rcx, [rsp + 0xe5e0]
call sub.VCRUNTIME140.dll_memset
mov ebx, edi
mov ecx, dword [r13 + rbx*4 + 0x12fb4]
test ecx, ecx
jne 0x140038f15
lea rax, [0x1400bde7c]
jmp 0x140038f2a
lea rax, str.FAILED
cmp ecx, 1
lea rcx, [0x1400bde44]
cmove rax, rcx
mov qword [rsp + 0x28], rax
lea rax, [0x140000000]
mov rax, qword [rax + rbx*8 + 0xa58b0]
mov qword [rsp + 0x20], rax
lea r9, str....CLI_Options___s__Check:___s_.__SERVER_.
mov edx, 0x9fff
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0xe5e0]
call fcn.140001030
mov byte [rsp + 0x185de], 0
mov ecx, dword [r13 + rbx*4 + 0x12fb4]
test ecx, ecx
je 0x140038fa5
sub ecx, 1
je 0x140038f93
cmp ecx, 1
jne 0x140038fb5
lea rdx, [rsp + 0xe5e0]
mov rcx, r13
call fcn.140016e10
jmp 0x140038fb5
lea rdx, [rsp + 0xe5e0]
mov rcx, r13
call fcn.1400171d0
jmp 0x140038fb5
lea rdx, [rsp + 0xe5e0]
mov rcx, r13
call fcn.140016fe0
inc edi
mov dword [rsp + 0x68], edi
jmp 0x140038ee0
cmp qword [0x1401746b8], 0
je 0x1400390dc
lea rdx, [0x1400ce148]
mov rcx, r13
call fcn.140017150
mov rdx, qword [0x1401011c8]
mov rcx, r13
mov rax, qword [0x1401746b8]
call qword [0x1400a4c40]
test eax, eax
je 0x1400390ce
mov dword [rsp + 0x430], 0x252
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x251
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x251
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce3d0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bde0c]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa5e9
jmp 0x140036e9f
cmp dword [0x1401139e4], 1
je 0x1400390dc
call fcn.140044bb0
cmp qword [0x1401139d8], 0
je 0x140039117
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, qword [0x1401139d8]
cmp rcx, rax
je 0x140039117
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x1401139d8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x1401139d8], r15
lea rsi, [0x140112c58]
cmp dword [0x140112c90], 0
jbe 0x140039152
cmp dword [0x140113a0c], 0
jne 0x140039141
mov r8d, 1
mov rdx, rsi
mov rcx, r13
call fcn.140006b50
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call fcn.1400045a0
mov rdx, rsi
mov rcx, r13
call fcn.140008db0
lea rdi, [0x140187360]
xor eax, eax
mov ecx, 0xa8
rep stosb byte [rdi], al
mov qword [0x14011e2c8], r15
cmp dword [0x140185e4c], 1
jne 0x14003918b
mov qword [0x14011e2b0], r15
mov dword [0x140185e4c], r15d
cmp dword [0x140186e60], 1
jne 0x1400391ae
lea rcx, [0x140186e68]
call fcn.14007f5b0
mov qword [0x14011e2b8], r15
mov dword [0x140186e60], r15d
mov rax, qword [0x140114130]
test rax, rax
je 0x140039212
mov dword [rsp + 0xb0], r15d
mov edi, r15d
cmp edi, dword [0x140114128]
jae 0x1400391fb
mov ebx, edi
mov rcx, qword [rax + rbx*8]
test rcx, rcx
je 0x1400391f0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x140114130]
mov qword [rax + rbx*8], r15
mov rax, qword [0x140114130]
inc edi
mov dword [rsp + 0xb0], edi
jmp 0x1400391c5
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140114130], r15
mov dword [0x140114128], r15d
cmp dword [0x1401139c0], 1
jne 0x14003923b
mov rcx, qword [0x1401139b8]
test rcx, rcx
je 0x14003923b
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401139b8], r15
mov dword [0x1401139c0], r15d
cmp dword [0x140121720], 1
jne 0x140039264
mov rcx, qword [0x140121728]
test rcx, rcx
je 0x140039264
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121728], r15
mov dword [0x140121720], r15d
cmp dword [0x1401139d0], 1
jne 0x14003928d
mov rcx, qword [0x1401139c8]
test rcx, rcx
je 0x14003928d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401139c8], r15
mov dword [0x1401139d0], r15d
mov eax, dword [0x1401219d8]
test eax, eax
jne 0x1400392d3
mov rcx, qword [0x140121498]
test rcx, rcx
je 0x1400392b6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x140121498], r15
mov eax, dword [0x1401219d8]
test eax, eax
jne 0x1400392d3
mov rcx, qword [0x1401214b0]
test rcx, rcx
je 0x1400392d3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401214b0], r15
mov rcx, qword [0x140187428]
test rcx, rcx
je 0x1400392ec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140187428], r15
mov rcx, qword [rsp + 0x1a0]
test rcx, rcx
je 0x140039307
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x1a0], r15
cmp qword [rsp + 0xb8], 0
je 0x140039370
mov dword [rsp + 0xcc], r15d
mov esi, r15d
nop dword [rax]
cmp esi, dword [rsp + 0x438]
jae 0x140039351
mov ebx, esi
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rdi + rbx*8]
test rcx, rcx
je 0x140039346
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi + rbx*8], r15
inc esi
mov dword [rsp + 0xcc], esi
jmp 0x140039320
mov qword [rsp + 0xb8], r15
mov dword [rsp + 0x438], r15d
mov dword [rsp + 0xcc], r15d
lea rsi, [0x140112c58]
mov rcx, qword [0x1401217b0]
test rcx, rcx
je 0x140039390
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [0x1401217b0], r15
mov dword [0x1401217ac], r15d
mov rcx, r13
call fcn.140018c50
cmp qword [0x14017ed20], 0
je 0x140039413
lea rdx, str.Unloading_Device_Dynamic_Library.__SERVER_
mov rcx, r13
call fcn.140017150
nop
mov rcx, qword [0x14017ed20]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14017ed20], r15
jmp 0x14003940c
mov qword [0x14017ed20], r15
cmp dword [0x1401219d8], 1
jne 0x140039437
cmp dword [rsp + 0x98], 0
jne 0x140039437
mov r12, qword [rsp + 0x50]
lea r15, [0x140187360]
jmp 0x140028a60
mov rcx, qword [0x140185090]
test rcx, rcx
je 0x140039450
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140185090], r15
mov rcx, qword [0x140121798]
test rcx, rcx
je 0x140039469
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140121798], r15
mov rcx, qword [0x140187310]
test rcx, rcx
je 0x140039482
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140187310], r15
mov rcx, qword [0x140171d78]
test rcx, rcx
je 0x1400394a5
mov eax, 1
mov dword [0x1401219c8], eax
mov dword [0x14017eeb8], eax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x14017eee0]
test rcx, rcx
je 0x140039553
mov dword [0x14017eeb8], 1
mov ebx, r15d
mov dword [rsp + 0x68], ebx
mov edx, 0x102
mov dword [rsp + 0x178], edx
test edx, edx
je 0x14003950c
mov rax, qword [0x140153c98]
test rax, rax
je 0x14003950c
mov rdx, qword [rax + 0x48]
test rdx, rdx
je 0x140039508
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [rsp + 0x178]
mov dword [rsp + 0x74], edx
mov rcx, qword [0x14017eee0]
jmp 0x14003950c
mov edx, dword [rsp + 0x74]
test rcx, rcx
je 0x140039530
mov edx, 0xfa
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, eax
mov dword [rsp + 0x74], eax
mov dword [rsp + 0x178], eax
mov rcx, qword [0x14017eee0]
mov eax, ebx
inc ebx
mov dword [rsp + 0x68], ebx
cmp eax, 0x64
jae 0x140039541
test edx, edx
jne 0x1400394d6
test rcx, rcx
je 0x140039553
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017eee0], r15
mov rcx, qword [0x14017eef0]
test rcx, rcx
je 0x14003956c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017eef0], r15
mov rcx, qword [0x14017ed08]
test rcx, rcx
je 0x140039585
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ed08], r15
mov rcx, qword [0x14017ee90]
test rcx, rcx
je 0x14003959e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ee90], r15
mov rcx, qword [0x14017ed78]
test rcx, rcx
je 0x1400395b7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ed78], r15
mov rcx, qword [0x140187410]
test rcx, rcx
je 0x1400395d0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140187410], r15
mov dword [rsp + 0x68], r15d
mov ebx, r15d
cmp ebx, dword [0x140111d38]
jae 0x140039605
mov edi, ebx
mov rcx, qword [r13 + rdi*8 + 0x11ad0]
test rcx, rcx
je 0x1400395fd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + rdi*8 + 0x11ad0], r15
inc ebx
mov dword [rsp + 0x68], ebx
jmp 0x1400395d8
mov rcx, qword [0x14017ef00]
test rcx, rcx
je 0x14003961e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ef00], r15
mov rcx, qword [0x14017ef08]
test rcx, rcx
je 0x140039637
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ef08], r15
mov rcx, qword [0x1401219d0]
test rcx, rcx
je 0x140039650
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401219d0], r15
cmp dword [0x1401140ec], 0
jne 0x140039683
mov eax, dword [rsp + 0x430]
test eax, eax
je 0x14003967c
cmp dword [0x140113a08], 0
jne 0x140039677
mov eax, 1
jmp 0x140039a96
jmp 0x140039a96
xor eax, eax
jmp 0x140039a96
cmp dword [0x1401140f0], 0
jne 0x140039693
xor eax, eax
jmp 0x140039a96
cmp dword [0x140113a08], 0
jne 0x1400396a6
mov eax, 1
jmp 0x140039a96
mov eax, dword [rsp + 0x430]
jmp 0x140039a96
mov dword [rsp + 0x430], 0x254
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x254
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x254
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400ce600]
mov qword [rsp + 0x20], rax
lea r9, [0x1400bdf54]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0xa4b8
jmp 0x140027e17
lea rdx, str....Folder_Existence_Dependency_Not_Met.__COMMON_.
mov rcx, r13
call fcn.140017150
mov dword [rsp + 0x430], 0x315
xor edx, edx
mov r8d, 0xc50
lea rcx, [rsp + 0x450]
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x454], eax
mov eax, 1
mov dword [rsp + 0x490], eax
mov dword [rsp + 0x45c], eax
mov dword [rsp + 0x498], 0x315
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
mov r9d, 0x315
mov rdx, r12
mov rcx, r13
call fcn.140002de0
mov dword [rsp + 0x494], eax
mov dword [rsp + 0x49c], 4
lea rax, [0x1400d3cf0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c1934]
mov edx, 0x9f6
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x4a0]
call fcn.140001030
mov byte [rsp + 0xe95], 0
mov dword [rsp + 0xe98], 0x700b
jmp 0x140027e17
mov rcx, qword [0x140185090]
test rcx, rcx
je 0x140039882
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov qword [0x140185090], rsi
jmp 0x140039884
xor esi, esi
mov rcx, qword [0x140121798]
test rcx, rcx
je 0x14003989d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140121798], rsi
mov rcx, qword [0x140187310]
test rcx, rcx
je 0x1400398b6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140187310], rsi
mov rcx, qword [0x140171d78]
test rcx, rcx
je 0x1400398d9
mov eax, 1
mov dword [0x1401219c8], eax
mov dword [0x14017eeb8], eax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [0x14017eee0]
test rax, rax
je 0x14003997b
mov dword [0x14017eeb8], 1
mov ebx, esi
mov dword [rsp + 0x68], ebx
mov edx, 0x102
mov dword [rsp + 0x178], edx
test edx, edx
je 0x140039932
mov rcx, qword [0x140153c98]
test rcx, rcx
je 0x140039932
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x140039932
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [rsp + 0x178]
mov rax, qword [0x14017eee0]
test rax, rax
je 0x140039955
mov edx, 0xfa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, eax
mov dword [rsp + 0x178], eax
mov rax, qword [0x14017eee0]
mov ecx, ebx
inc ebx
mov dword [rsp + 0x68], ebx
cmp ecx, 0x64
jae 0x140039966
test edx, edx
jne 0x140039909
test rax, rax
je 0x14003997b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017eee0], rsi
mov rcx, qword [0x14017eef0]
test rcx, rcx
je 0x140039994
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017eef0], rsi
mov rcx, qword [0x14017ed08]
test rcx, rcx
je 0x1400399ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ed08], rsi
mov rcx, qword [0x14017ee90]
test rcx, rcx
je 0x1400399c6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ee90], rsi
mov rcx, qword [0x14017ed78]
test rcx, rcx
je 0x1400399df
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ed78], rsi
mov rcx, qword [0x140187410]
test rcx, rcx
je 0x1400399f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140187410], rsi
mov dword [rsp + 0x68], esi
mov ebx, esi
nop
cmp ebx, dword [0x140111d38]
jae 0x140039a2d
mov edi, ebx
mov rcx, qword [r13 + rdi*8 + 0x11ad0]
test rcx, rcx
je 0x140039a25
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r13 + rdi*8 + 0x11ad0], rsi
inc ebx
mov dword [rsp + 0x68], ebx
jmp 0x140039a00
mov rcx, qword [0x14017ef00]
test rcx, rcx
je 0x140039a46
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ef00], rsi
mov rcx, qword [0x14017ef08]
test rcx, rcx
je 0x140039a5f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14017ef08], rsi
mov rcx, qword [0x1401219d0]
test rcx, rcx
je 0x140039a78
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401219d0], rsi
cmp dword [0x140113a08], 0
jne 0x140039a88
mov eax, 1
jmp 0x140039a96
mov eax, dword [rsp + 0x430]
jmp 0x140039a96
mov rcx, qword [rsp + 0x365e0]
xor rcx, rsp
call fcn.140001ea0
lea r11, [rsp + 0x365f0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret