Function at 0x140010414
Capabilities:
Get hostname
Persist via windows service
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x278]
sub rsp, 0x378
mov rax, qword [0x140050310]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov rdi, r9
mov r14, rcx
xor esi, esi
mov eax, edx
lea r9d, [rsi + 2]
sub eax, r9d
je 0x1400113fb
sub eax, 0xe
je 0x1400113f3
sub eax, 0x3e
je 0x14001132d
sub eax, 0xc2
je 0x140010ffb
sub eax, 1
je 0x14001095c
sub eax, 0x3ef
je 0x140010945
sub eax, 0x7b00
je 0x140010676
sub eax, r9d
je 0x1400105e9
cmp eax, r9d
je 0x14001056d
cmp edx, dword [0x1400515c8]
jne 0x14001142a
test byte [rdi + 0x18], 0x40
je 0x1400104d3
mov qword [0x1400515d0], rsi
mov eax, dword [0x140051808]
and eax, 7
mov dword [0x140050190], eax
jmp 0x14001142a
test byte [rdi + 0x18], 8
je 0x14001142a
mov r15d, 0x40d
mov edx, r15d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x68], rsi
movsxd rbx, eax
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea r9, [rsp + 0x48]
mov r8, rbx
mov edx, 0x133c
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea edx, [r15 - 0x22]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rdx, rdi
call fcn.14000fcd4
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x14001142a
mov r13d, esi
lea rdi, str.Use_Counts
mov r15d, 0x40d
mov qword [rsp + 0x4c], rsi
mov dword [rsp + 0x54], esi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x48], 8
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
movsxd rbx, r13d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea r9, [rsp + 0x48]
mov r8, rbx
mov edx, 0x133c
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_SendMessageW]
inc r13d
lea rdi, [rdi + 0x18]
cmp r13d, 7
jb 0x14001057d
jmp 0x140010663
mov r13d, esi
lea rdi, str.Use_Counts
mov r15d, 0x40d
mov qword [rsp + 0x4c], rsi
mov dword [rsp + 0x54], esi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x48], 8
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
movsxd rbx, r13d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea r9, [rsp + 0x48]
mov r8, rbx
mov edx, 0x133c
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_SendMessageW]
inc r13d
lea rdi, [rdi + 0x18]
cmp r13d, 7
jb 0x1400105f9
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x14001142a
cmp byte [0x1400515b6], sil
je 0x14001069e
mov r9d, InitCommonControls
lea r8, [0x14003e408]
lea rdx, str.You_must_run_the_64_bit_version_for_memory_analysis
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14001142a
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rbx, rax
mov qword [rbp - 0x78], rax
mov rdx, qword [0x140051998]
test rdx, rdx
je 0x14001088f
mov rcx, qword [rdx]
test rcx, rcx
je 0x1400106e2
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov rdx, qword [0x140051998]
jmp 0x1400106e4
mov eax, esi
test eax, eax
je 0x14001088f
test rdx, rdx
je 0x1400106f6
mov rdi, qword [rdx]
jmp 0x1400106f9
mov rdi, rsi
lea rcx, [0x1400518c0]
call fcn.14000e258
mov r8, rdi
lea rdx, [rsp + 0x30]
lea rcx, [0x1400518c0]
call fcn.140007db8
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400107cd
cmp qword [rax], rsi
je 0x140010738
mov rcx, qword [rax]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
jmp 0x14001073a
mov eax, esi
test eax, eax
je 0x1400107cd
lea r8, [rsp + 0x30]
lea rdx, str.Error_importing_file:_r_n
lea rcx, [rsp + 0x40]
call fcn.140005d74
mov rdi, rax
lea rax, [rsp + 0x30]
cmp rax, rdi
je 0x140010784
lea rcx, [rsp + 0x30]
call fcn.140005354
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140010784
lock inc dword [rax + 0x10]
mov rbx, qword [rbp - 0x78]
lea rcx, [rsp + 0x40]
call fcn.140005354
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14001079b
mov rsi, qword [rax]
mov r9d, InitCommonControls
lea r8, [0x14003e408]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14001086c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [0x14003fc78]
lea rcx, [rsp + 0x40]
call fcn.140004974
nop
lea rdx, [0x14003e408]
lea rcx, [rbp - 0x80]
call fcn.140004974
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14000da50
nop
lea r8, [0x140051998]
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.14000da50
mov rcx, qword [rax]
test rcx, rcx
je 0x140010836
mov rsi, qword [rcx]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rcx, [rsp + 0x38]
call fcn.140005354
nop
lea rcx, [rsp + 0x70]
call fcn.140005354
nop
lea rcx, [rbp - 0x80]
call fcn.140005354
nop
lea rcx, [rsp + 0x40]
call fcn.140005354
lea rdx, [0x1400379e0]
lea rcx, [0x140051998]
call fcn.14000d9b4
nop
lea rcx, [rsp + 0x30]
call fcn.140005354
jmp 0x140010937
lea rcx, [0x1400518c0]
call fcn.14000e258
lea rcx, [0x1400518c0]
call fcn.14000a5e4
mov rcx, r14
test al, al
je 0x14001091c
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [0x140051848]
test rax, rax
je 0x140010937
mov rcx, qword [rax]
test rcx, rcx
je 0x1400108e4
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov rax, qword [0x140051848]
jmp 0x1400108e6
mov ecx, esi
test ecx, ecx
je 0x140010937
test rax, rax
je 0x1400108f4
mov rdx, qword [rax]
jmp 0x1400108f7
mov rdx, rsi
lea rcx, [0x1400518c0]
call fcn.1400078bc
test al, al
je 0x140010910
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.Error_exporting
mov rcx, r14
jmp 0x140010923
lea rdx, str.Error_refreshing_database
mov r9d, InitCommonControls
lea r8, [0x14003e408]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x14001142a
mov r9, rdi
mov edx, 0x500
mov rcx, qword [0x140051898]
mov rcx, qword [rcx]
jmp 0x140011370
movzx ebx, r8w
mov eax, 0x9c8d
cmp ebx, eax
ja 0x140010cc7
je 0x140010c32
mov ecx, ebx
sub ecx, r9d
je 0x140010c2b
sub ecx, 0x404
je 0x140010c2b
sub ecx, 0x67
je 0x140010c17
sub ecx, 0x97da
je 0x140010bef
sub ecx, 0x3d
je 0x140010b77
sub ecx, r9d
je 0x140010b6a
sub ecx, r9d
je 0x140010aa7
sub ecx, 1
je 0x140010aa7
cmp ecx, 3
jne 0x14001142a
mov r15d, 0x40d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
lea edi, [rax - 1]
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x68], rsi
movsxd rbx, eax
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea r9, [rsp + 0x48]
mov r8, rbx
mov edx, 0x133c
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 0xffffffff
jne 0x140010a5c
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
call qword [sym.imp.USER32.dll_SendMessageW]
lea edi, [rax - 1]
movsxd rbx, edi
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
mov r8, rbx
mov edx, 0x130c
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp + 0x40], 0xfffffdd9
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [rbp + 0x30], rax
lea r9, [rbp + 0x30]
mov edx, 0x4e
mov rcx, r14
jmp 0x14001136d
mov eax, 0x9c89
cmp bx, ax
jne 0x140010ac9
mov eax, dword [0x140051808]
test al, 1
je 0x140010ac0
and eax, 0xfffffffe
jmp 0x140010ac3
or eax, 1
mov dword [0x140051808], eax
cmp byte [0x1400515b7], sil
je 0x14001142a
mov r15d, 0x40d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x68], rsi
movsxd rbx, eax
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea r9, [rsp + 0x48]
mov r8, rbx
mov edx, 0x133c
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rbx, rax
lea edx, [r15 - 0x22]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [0x1400517f0]
call fcn.14000fcd4
jmp 0x140010937
mov rcx, r14
call fcn.1400140a0
jmp 0x14001142a
lea rdx, str.___www.sysinternals.com
lea rcx, [rsp + 0x40]
call fcn.140004974
nop
lea rdx, [0x14003e408]
lea rcx, [rsp + 0x70]
call fcn.140004974
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.14000da50
mov rcx, qword [rax]
test rcx, rcx
je 0x140010bb7
mov rsi, qword [rcx]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rcx, [rbp - 0x80]
call fcn.140005354
nop
lea rcx, [rsp + 0x70]
call fcn.140005354
nop
lea rcx, [rsp + 0x40]
call fcn.140005354
mov edx, 0x8000
mov rcx, r14
jmp 0x14001136a
lea rdx, str.ABOUT
mov r8, r14
lea r9, [0x14000dbac]
mov qword [rsp + 0x20], rsi
mov rcx, qword [0x1400515c0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x14001142a
mov rdx, r14
lea rcx, [0x140051850]
call fcn.140003028
jmp 0x14001142a
mov edx, InitCommonControls
jmp 0x140010be7
mov r15d, 0x40d
mov edx, r15d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x68], rsi
movsxd rbx, eax
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea r9, [rsp + 0x48]
mov r8, rbx
mov edx, 0x133c
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [rdi + 1]
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, eax
cmovne esi, ebx
movsxd rbx, esi
jmp 0x140010a5f
mov ecx, ebx
mov r15d, 0x9c91
sub ecx, r15d
je 0x140010d64
sub ecx, 1
je 0x140010d64
sub ecx, 1
je 0x140010d45
sub ecx, 1
je 0x140010d3b
sub ecx, 1
je 0x140010d31
sub ecx, 1
je 0x140010d24
sub ecx, 1
je 0x140010d0f
cmp ecx, r9d
jne 0x14001142a
lea rdx, str.USAGE
jmp 0x140010bf6
xor r8d, r8d
or rdx, 0xffffffffffffffff
or rcx, rdx
call qword [0x1400518b0]
jmp 0x14001142a
mov r15d, 5
mov dword [rsp + 0x38], r15d
jmp 0x140010d4a
mov dword [rsp + 0x38], 4
jmp 0x140010d4a
mov dword [rsp + 0x38], 3
jmp 0x140010d4a
mov dword [rsp + 0x38], r9d
mov r8d, 4
lea rdx, [rsp + 0x38]
lea ecx, [r8 + 0x4c]
call qword [0x140051840]
jmp 0x14001142a
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x50]
call fcn.14001ea40
mov edi, 0x104
mov dword [rsp + 0x38], edi
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rbp - 0x70], 0x98
xor edx, edx
lea r8d, [rdi - 0x7c]
lea rcx, [rbp - 0x60]
call fcn.14001ea40
lea rax, [rbp + 0x50]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], edi
mov qword [rbp - 0x68], r14
lea rax, str.RamMap_Files__.RMP_
mov qword [rbp - 0x58], rax
lea rax, [0x14003fd40]
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x70]
cmp bx, r15w
jne 0x140010f9b
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x14001142a
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rbx, rax
mov qword [rbp - 0x80], rax
lea rcx, [0x1400518c0]
call fcn.14000e258
lea r8, [rbp + 0x50]
lea rdx, [rsp + 0x30]
lea rcx, [0x1400518c0]
call fcn.140007db8
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140010ed6
cmp qword [rax], rsi
je 0x140010e41
mov rcx, qword [rax]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
jmp 0x140010e43
mov eax, esi
test eax, eax
je 0x140010ed6
lea r8, [rsp + 0x30]
lea rdx, str.Error_importing_file:_r_n
lea rcx, [rsp + 0x70]
call fcn.140005d74
mov rdi, rax
lea rax, [rsp + 0x30]
cmp rax, rdi
je 0x140010e8d
lea rcx, [rsp + 0x30]
call fcn.140005354
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140010e8d
lock inc dword [rax + 0x10]
mov rbx, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
call fcn.140005354
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140010ea4
mov rsi, qword [rax]
mov r9d, InitCommonControls
lea r8, [0x14003e408]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140010f8b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140004974
nop
lea rdx, [0x14003fc78]
lea rcx, [rsp + 0x40]
call fcn.140004974
nop
lea rdx, [0x14003e408]
lea rcx, [rsp + 0x78]
call fcn.140004974
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.14000da50
nop
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14000da50
mov rcx, qword [rax]
test rcx, rcx
je 0x140010f4a
mov rsi, qword [rcx]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rcx, [rsp + 0x70]
call fcn.140005354
nop
lea rcx, [rbp + 0x30]
call fcn.140005354
nop
lea rcx, [rsp + 0x78]
call fcn.140005354
nop
lea rcx, [rsp + 0x40]
call fcn.140005354
nop
lea rcx, [rbp - 0x78]
call fcn.140005354
nop
lea rcx, [rsp + 0x30]
call fcn.140005354
nop
jmp 0x140010937
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x14001142a
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rbx, rax
mov qword [rsp + 0x78], rax
lea rdx, [rbp + 0x50]
lea rcx, [0x1400518c0]
call fcn.1400078bc
test al, al
jne 0x140010ff6
xor r9d, r9d
lea r8, [0x14003e408]
lea rdx, str.Error_exporting
mov rcx, r14
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
jmp 0x140010937
mov ebx, 0x70
mov ecx, ebx
call fcn.14001d370
mov qword [rsp + 0x78], rax
lea edi, [rbx - 0x3e]
lea r12d, [rbx - 0x2d]
test rax, rax
je 0x14001103f
mov qword [rax + 8], rsi
mov dword [rax + 0x30], edi
mov dword [rax + 0x34], r12d
mov qword [rax + 0x60], rsi
mov dword [rax + 0x68], esi
mov byte [rax + 0x38], 1
test r14, r14
je 0x14001103f
mov rdx, r14
mov rcx, rax
call fcn.14000e050
nop
mov rcx, rbx
call fcn.14001d370
mov rbx, rax
mov qword [rsp + 0x78], rax
mov r15d, 0x40d
test rax, rax
je 0x14001108d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [rbx + 8], rsi
mov dword [rbx + 0x30], edi
mov dword [rbx + 0x34], r12d
mov qword [rbx + 0x60], rsi
mov dword [rbx + 0x68], esi
mov byte [rbx + 0x38], 1
test rax, rax
je 0x14001108d
mov rdx, rax
mov rcx, rbx
call fcn.14000e050
nop
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
mov edi, 0xffffffec
mov edx, edi
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
bts rax, 0x10
mov r8, rax
mov edx, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
lea rcx, [0x1400518c0]
call fcn.140005c00
test al, al
jne 0x1400111b7
mov qword [rsp + 0x40], rsi
or dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesFileInfo
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r8, [0x14003e408]
mov rcx, r14
cmp dword [rsp + 0x38], esi
jne 0x14001115b
lea r9d, [rdi + 0x24]
lea rdx, str.Unable_to_connect_to_the_FileInfo_driver._nYou_must_reboot_your_system_in_order_for_the_driver_to_load_and_RamMap_to_connect_to_it.
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400111a4
mov r9d, 0x34
lea rdx, str.Unable_to_connect_to_the_FileInfo_driver._nWould_you_like_RamMap_to_configure_it_to_start_at_the_next_boot_
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x1400111a4
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, esi
lea r13, [0x14003f7b0]
mov r15d, 5
mov qword [rsp + 0x4c], rsi
mov dword [rsp + 0x54], esi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x48], 1
mov rax, qword [r13 - 0x10]
mov qword [rsp + 0x58], rax
movsxd r8, edi
lea r9, [rsp + 0x48]
mov edx, 0x133e
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rbp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetClientRect]
lea r9, [rbp + 0x30]
xor r8d, r8d
mov edx, 0x1328
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r9, qword [r13]
mov r8, rbx
mov rdx, qword [r13 - 8]
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov r12, rax
mov qword [rsp + 0x78], rax
mov rdx, qword [0x1400518a0]
cmp rdx, qword [0x1400518a8]
je 0x140011267
mov qword [rdx], rax
add qword [0x1400518a0], 8
jmp 0x140011278
lea r8, [rsp + 0x78]
lea rcx, [0x140051898]
call fcn.14000afa0
mov eax, dword [rbp + 0x3c]
mov r8d, dword [rbp + 0x34]
sub eax, r8d
mov r9d, dword [rbp + 0x38]
mov edx, dword [rbp + 0x30]
sub r9d, edx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], eax
mov rcx, r12
call qword [sym.imp.USER32.dll_MoveWindow]
mov eax, edi
neg eax
sbb edx, edx
not edx
and edx, r15d
mov rcx, r12
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x68], r12
lea r9, [rsp + 0x48]
movsxd r8, edi
mov edx, 0x133d
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
inc edi
add r13, 0x18
cmp edi, 7
jb 0x1400111c6
lea r8, str.MainDialog
mov rdx, qword [0x1400515b8]
mov rcx, r14
call fcn.140013be8
mov rcx, r14
call qword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [0x1400515b6], sil
jne 0x140011323
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8000
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
jmp 0x14001142c
mov ecx, dword [rdi + 0x10]
lea eax, [rcx + 0x228]
cmp eax, 1
jbe 0x14001137b
cmp ecx, 0xfffffffd
jne 0x14001142a
lea rax, [r8 - 0x8000]
cmp rax, r9
ja 0x14001142a
mov edx, 0x40d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov edx, 0x130b
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14001142a
mov r15d, 0x40d
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x48], 8
mov qword [rsp + 0x68], rsi
movsxd rbx, eax
mov edx, r15d
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea r9, [rsp + 0x48]
mov r8, rbx
mov edx, 0x133c
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15d, 5
cmp dword [rdi + 0x10], 0xfffffdd9
cmove esi, r15d
mov edx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14001142a
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x14001142a
call fcn.1400136cc
lea rcx, [0x1400518c0]
call fcn.14000a6b8
lea r8, str.MainDialog
mov rdx, qword [0x1400515b8]
mov rcx, r14
call fcn.140013de0
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14001d350
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret