Function at 0x140006738
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x4f0
mov qword [rax - 0x468], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1400db348]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rcx, qword [0x1400dbe00]
xor esi, esi
lea rax, [0x1400518d0]
test rcx, rcx
jne 0x1400327d2
mov qword [0x1400dbe00], rax
call fcn.140027cd0
mov r15d, esi
mov dword [rsp + 0x48], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
test eax, eax
js 0x1400327fe
xor r9d, r9d
xor r8d, r8d
lea r14d, [r9 + 1]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
nop dword [rax + rax]
mov rdi, rsi
mov qword [rsp + 0x78], rsi
call fcn.1400079dc
test al, al
je 0x140006984
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 9
lea r8, str.SOFTWAREMicrosoftWindows_SearchGatherWindowsSystemIndexProtocols
mov rdx, 0xffffffff80000002
call fcn.14000a9b8
test eax, eax
jne 0x140006984
mov r12d, 0xff
mov ebx, esi
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xd0]
mov edx, ebx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006972
mov rcx, r12
lea rax, [rsp + 0xd0]
cmp word [rax], si
je 0x140006878
add rax, 2
sub rcx, r14
jne 0x14000686a
test rcx, rcx
je 0x140032808
mov rax, r12
sub rax, rcx
test rcx, rcx
je 0x1400068e2
mov rdx, r12
sub rdx, rax
lea rcx, [rsp + 0xd0]
lea rcx, [rcx + rax*2]
je 0x1400068d4
lea r8, [rax + 0x7ffffeff]
add r8, rdx
lea rax, [0x1400a56e4]
sub rax, rcx
test r8, r8
je 0x1400068d4
movzx r9d, word [rax + rcx]
test r9w, r9w
je 0x1400068d4
mov word [rcx], r9w
add rcx, 2
sub r8, r14
sub rdx, r14
jne 0x1400068b4
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0xd0]
mov rdx, qword [rsp + 0x58]
call fcn.14000a9b8
test eax, eax
jne 0x14000696a
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ProgIdHandler
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006959
lea rcx, [rsp + 0x2d0]
call fcn.140007980
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add ebx, r14d
jmp 0x14000681e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
cmp dword [0x1400dc710], esi
jne 0x140032810
call fcn.140028310
test byte [0x1400dd8c2], 8
jne 0x140006dc6
test byte [0x1400dd8c1], 8
jne 0x140032ffb
call fcn.1400038f4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140002f80]
lea rcx, [0x1400dc308]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
nop dword [rax + rax]
cmp byte [0x1400dbe28], sil
jne 0x140033023
mov byte [rsp + 0x69], r14b
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x60]
call fcn.140027538
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e598
nop
lea rcx, [rsp + 0x58]
call fcn.14001d7f8
nop
lea rcx, [rsp + 0x70]
call fcn.14001d7c4
nop
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
nop dword [rax + rax]
test eax, eax
js 0x14003302e
lea rdx, [rsp + 0x2d0]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
nop dword [rax + rax]
test eax, eax
je 0x1400330a3
lea rcx, [rsp + 0xd0]
call fcn.140026978
mov byte [rsp + 0x40], sil
mov ebx, 0xc0100000
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov edx, r14d
lea rcx, [rsp + 0x60]
call fcn.140026cf0
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov edx, r14d
lea rcx, [rsp + 0x60]
call fcn.140026cf0
mov rbx, qword [rsp + 0x60]
mov r8, rbx
lea rcx, [rsp + 0xd0]
call fcn.14001e60c
mov dword [rsp + 0x80], SafeArrayPutElement
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], esi
mov r12d, esi
cmp r12d, 0xf
jae 0x140006bb3
lea r8, str.SearchServiceMUT
mov edx, r14d
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rdx, rax
lea rcx, [0x1400dc480]
call fcn.14000c808
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r13d, eax
mov rcx, qword [0x1400dc480]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140033115
test eax, eax
jne 0x140033115
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006bcb
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140006be3
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e34c
nop
mov rcx, rbx
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
lea rcx, [rsp + 0x60]
call fcn.140024f30
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400331fb
cmp dword [rsp + 0x60], 2
jne 0x140006c6d
mov ebx, r14d
cmp ebx, dword [rsp + 0x60]
jge 0x140006c6d
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
movzx eax, word [rcx]
sub ax, 0x2d
mov edx, 0xfffd
test dx, ax
jne 0x140033208
add rcx, 2
lea rdx, str.Embedding
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140033215
add ebx, r14d
jmp 0x140006c27
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x50], eax
mov r12d, eax
mov rcx, qword [rsp + 0x508]
test eax, eax
js 0x140033222
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [0x1400a6488]
mov r8d, r14d
xor edx, edx
lea rcx, [0x1400a7ef8]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x508]
test eax, eax
js 0x140033262
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140006d03
mov rax, qword [rcx]
mov r8, r14
mov edx, 5
mov rax, qword [rax + 0x18]
call qword [case.0x140024575.0]
mov rcx, qword [rsp + 0x508]
test eax, eax
js 0x14003327c
call fcn.14001e638
mov r12d, eax
mov rcx, qword [rsp + 0x508]
test eax, eax
js 0x140033296
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140006d32
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024575.0]
test r12d, r12d
js 0x140033236
mov bl, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x8c], xmm0
mov dword [rsp + 0x9c], esi
mov r12d, 3
mov dword [rsp + 0x88], r12d
lea rax, str.AllowWindowsIndexer
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0xc0], xmm1
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.1400196c4
test eax, eax
je 0x140033254
mov dl, bl
call fcn.1400280a0
call fcn.140054d98
mov rcx, qword [rsp + 0x508]
test eax, eax
js 0x1400332b0
jmp 0x1400332c4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x1400a6c30]
lea rcx, [0x1400da440]
call fcn.140029464
jmp 0x1400069a2
cmp rcx, rax
je 0x14000678e
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [rsp + 0xd0]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xd0]
call fcn.14004313c
int3
mov eax, 0x800401f0
jmp 0x1400333c5
mov rax, rsi
jmp 0x140006887
lea r8, [0x1400da8c0]
mov rdx, qword [str.SrchCommon]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da6c8]
mov rdx, qword [str.SrchCIDSO]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da9b0]
mov rdx, qword [str.SrchCollator]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da938]
mov rdx, qword [str.SrchCollatorAdmin]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da950]
mov rdx, qword [str.SrchCollatorCatalogInfo]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da740]
mov rdx, qword [str.SrchCollatorCommand]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da968]
mov rdx, qword [str.SrchCollatorCxnMgr]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da650]
mov rdx, qword [str.SrchCollatorCxn]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daa10]
mov rdx, qword [str.SrchCollatorFetch]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da878]
mov rdx, qword [str.SrchCollatorProperties]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da668]
mov rdx, qword [str.SrchCollatorQuery]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daa40]
mov rdx, qword [str.SrchCollatorRowset]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da6e0]
mov rdx, qword [str.SrchDatasource]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da6f8]
mov rdx, qword [str.SrchDSSQuery]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da800]
mov rdx, qword [str.SrchDSSConnection]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da7b8]
mov rdx, qword [str.SrchDSSLogin]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da728]
mov rdx, qword [str.SrchDSSConnectionManager]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da9f8]
mov rdx, qword [str.SrchDSSAdmin]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da890]
mov rdx, qword [str.SrchDSSManager]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da758]
mov rdx, qword [str.SrchDSSPortManager]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da7e8]
mov rdx, qword [str.SrchPHHttp]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da788]
mov rdx, qword [str.SrchPHOleDb]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da770]
mov rdx, qword [str.SrchPHSts]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daa58]
mov rdx, qword [str.SrchPHMatrix]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da7a0]
mov rdx, qword [str.SrchPropertyDefs]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da8a8]
mov rdx, qword [str.SrchPropertyStore]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da980]
mov rdx, qword [str.SrchFilterDaemon]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daad0]
mov rdx, qword [str.SrchPHFile]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da608]
mov rdx, qword [str.SrchGatherPI]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da680]
mov rdx, qword [str.SrchGatherSvc]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daa70]
mov rdx, qword [str.SrchGatherStatus]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da8f0]
mov rdx, qword [str.SrchGatherDestruction]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da638]
mov rdx, qword [str.SrchGatherDirMon]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da7d0]
mov rdx, qword [str.SrchGatherHistoryHash]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da848]
mov rdx, qword [str.SrchGatherServiceCatalog]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da6b0]
mov rdx, qword [str.SrchSimplePI]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daaa0]
mov rdx, qword [str.SrchSamplePI]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da998]
mov rdx, qword [str.SrchGatherPropMapper]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da9e0]
mov rdx, qword [str.SrchCscorePI]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da920]
mov rdx, qword [str.SrchCIWrapper]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daa88]
mov rdx, qword [str.SrchIndexerQuery]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da620]
mov rdx, qword [str.SrchIndexerProperties]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daab8]
mov rdx, qword [str.SrchIndexerPlugin]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da908]
mov rdx, qword [str.SrchIndexerClient]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daa28]
mov rdx, qword [str.SrchIndexerSchema]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da860]
mov rdx, qword [str.SrchAdmin]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da818]
mov rdx, qword [str.SrchScriptPI]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da8d8]
mov rdx, qword [str.SrchXMLFilter]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da9c8]
mov rdx, qword [str.SrchSTRFilter]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da710]
mov rdx, qword [str.DaemonTest]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400daae8]
mov rdx, qword [str.MSSearch_DAV]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da830]
mov rdx, qword [str.SrchCluster]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
cmp dword [0x1400dc710], esi
je 0x140006990
lea r8, [0x1400da698]
mov rdx, qword [str.SrchServiceObj]
mov rcx, qword [0x1400dc730]
call fcn.14005bd80
nop
jmp 0x140006990
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [0x1400b5748]
lea rcx, [0x1400da440]
call fcn.14004d698
nop
jmp 0x1400069af
call fcn.140051ef8
nop
jmp 0x140006a01
mov rcx, qword [rsp + 0x508]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xfc
call fcn.14004b268
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140033065
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003307d
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e34c
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
jmp 0x1400332f5
mov rcx, qword [rsp + 0x508]
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x106
call fcn.1400522e0
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400330d7
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400330ef
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e34c
nop
mov rcx, qword [rsp + 0x60]
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
jmp 0x1400332f5
xor edx, edx
lea rcx, [0x1400dc480]
call fcn.14000c808
cmp r13d, 0xb7
je 0x140033183
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140033147
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14003315f
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e34c
nop
mov rcx, rbx
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
jmp 0x1400332f5
cmp r12d, 0xe
jne 0x1400331e2
lea r15d, [r12 - 0xc]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400331a6
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400331be
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e34c
nop
mov rcx, rbx
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
jmp 0x1400332f5
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
add r12d, r14d
jmp 0x140006b55
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400332f5
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400332f5
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400332f5
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x171
call fcn.140043650
mov r15d, r12d
mov dword [rsp + 0x48], r12d
test ebx, ebx
js 0x14003324f
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
jmp 0x1400332f5
mov bl, r14b
call fcn.140051e74
nop
jmp 0x140006da5
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x178
call fcn.140043650
nop
jmp 0x140006cd4
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x17b
call fcn.140043650
nop
jmp 0x140006d03
mov r9d, r12d
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x17f
call fcn.140043650
nop
jmp 0x140006d1b
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x196
call fcn.140043650
mov dword [rsp + 0x50], r12d
lea rcx, [rsp + 0x50]
call fcn.14004d9a4
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
jmp 0x1400332f5
call qword [sym.imp.MSSRCH.DLL_public:_static_void___cdecl_CSearchServiceObj::Cleanup_void_]
nop dword [rax + rax]
call fcn.1400079dc
test al, al
je 0x140033324
lea rdx, [0x14004d820]
call fcn.140007a00
mov r8b, r14b
mov edx, dword [0x1400dda40]
call fcn.140051d54
test byte [0x1400dd8c1], 8
je 0x14003334f
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [0x1400b5ac8]
lea rcx, [0x1400da440]
call fcn.14004d698
test byte [0x1400dd8c2], 8
je 0x14003337b
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x1400b56f8]
lea rcx, [0x1400da440]
call fcn.140029464
call fcn.1400560f4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
cmp byte [rsp + 0x69], sil
je 0x1400333ac
mov ecx, dword [0x1400db3b8]
cmp ecx, 0xffffffff
je 0x1400333ac
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x1400333c2
mov rcx, rdi
mov rax, qword [0x14009e368]
call qword [case.0x140024575.0]
nop
mov eax, r15d
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.14002a3c0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret