Function at 0x10000b674
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x24b0
call fcn.100017840
sub rsp, rax
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x24a0], rax
mov rdi, rcx
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0x770]
mov r12d, 1
mov dword [rsp + 0x770], 0x11c
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xf8], r12d
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx edx, byte [0x10001db05]
xor r13d, r13d
mov r14d, 0x104
cmp eax, r13d
mov rax, qword [0x10001c020]
cmovne edx, r12d
mov byte [0x10001db05], dl
mov word [rax], r13w
mov rax, qword [0x10001c830]
mov word [rax], r13w
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea esi, [r12 + 0x1f]
lea ecx, [rsi + 2]
mov rbx, rax
cmp word [rax], cx
jne 0x10000b74c
add rbx, 2
jmp 0x10000b74f
mov cx, si
mov ax, word [rbx]
cmp ax, r13w
je 0x10000b774
cmp ax, cx
je 0x10000b76a
add rbx, 2
mov ax, word [rbx]
cmp ax, r13w
jne 0x10000b758
cmp word [rbx], r13w
je 0x10000b774
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x10001dae0], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x10001e020], rax
cmp rax, 0xffffffffffffffff
je 0x10000b7a1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, r13d
jne 0x10000b7a8
mov qword [0x10001e020], r13
mov edi, 0x7fe
lea rcx, [rsp + 0xca2]
xor edx, edx
mov r8, rdi
mov dword [rsp + 0xac], r13d
mov word [rsp + 0xca0], r13w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x14a2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x14a0], r13w
call sub.msvcrt.dll_memset
lea r11, [rsp + 0xca0]
lea r15, [rsp + 0x14a0]
mov qword [rsp + 0x78], r11
mov dword [rsp + 0x80], r13d
mov dword [0x10001daf8], r13d
cmp word [rbx], si
je 0x10000b81a
cmp word [rbx], 9
jne 0x10000b820
add rbx, 2
jmp 0x10000b80f
cmp word [rbx], 0x2f
je 0x10000b830
cmp word [rbx], 0x2d
jne 0x10000baed
lea rax, [rbx + 2]
cmp rax, r13
je 0x10000baed
movzx eax, word [rax]
or ax, si
cmp ax, 0x60
jne 0x10000baed
add rbx, 4
mov qword [rsp + 0x60], rbx
cmp word [rbx], si
je 0x10000b861
cmp word [rbx], 9
jne 0x10000b867
add rbx, 2
jmp 0x10000b851
lea rax, [rsp + 0xca0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
mov qword [rsp + 0x70], rax
call fcn.10000b2c8
cmp al, r13b
jne 0x10000b8e9
xor edx, edx
xor ecx, ecx
call fcn.100007cfc
cmp dword [rsp + 0x118], r14d
jle 0x10000b8af
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
jle 0x10000b8df
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x667
jmp 0x10000dbfa
mov eax, dword [rsp + 0x118]
lea rdx, [0x100002b50]
mov r9d, 0x20019
add eax, eax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x90], eax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x94], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x10000ba9e
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x94]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x110]
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
jne 0x10000ba06
mov ebx, dword [rsp + 0x90]
shr ebx, 1
cmp ebx, r14d
jle 0x10000b999
mov edx, ebx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000b9a1
lea rdi, [rsp + 0x120]
cmp rdi, r13
je 0x10000ba4c
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000b9c5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x94]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0xca0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x110], rdi
mov dword [rsp + 0x118], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r13d
jne 0x10000ba9e
cmp dword [rsp + 0x94], r12d
jne 0x10000ba9e
mov rbx, qword [rsp + 0x110]
mov rdx, rsi
movzx edi, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, dx
je 0x10000ba46
cmp di, 9
jne 0x10000c13c
add rbx, 2
jmp 0x10000ba2f
cmp dword [rsp + 0x118], r14d
jle 0x10000ba64
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
jle 0x10000ba94
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0xe
jmp 0x10000dbfa
cmp dword [rsp + 0x118], r14d
jle 0x10000bab6
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
jle 0x10000bae6
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x10000dbfa
mov ebp, 0x7fffffff
mov rax, rbx
mov rcx, rbp
cmp word [rax], r13w
je 0x10000bb07
add rax, 2
sub rcx, r12
jne 0x10000baf8
cmp rcx, r13
je 0x10000dbad
mov rsi, rbp
sub rsi, rcx
inc esi
cmp esi, r14d
jle 0x10000bb33
movsxd rdx, esi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x10000bb3b
lea rdi, [rsp + 0x120]
cmp rdi, r13
je 0x10000ba4c
mov rcx, qword [rsp + 0x110]
lea rax, [rsp + 0x120]
cmp rcx, rax
je 0x10000bb5f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [0x100000000]
lea rax, [0x100002bd8]
lea rcx, [rsp + 0xab0]
mov qword [rsp + 0xb00], rax
lea rax, [0x100002be8]
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0xb18], rax
lea rax, [0x100002c10]
mov dword [rsp + 0x118], esi
mov qword [rsp + 0xb38], rax
mov word [rdi], r13w
lea rax, [0x100002c18]
mov qword [rsp + 0xb48], rax
lea rax, [0x100002c24]
lea rdi, [0x100002c00]
mov qword [rsp + 0xb50], rax
lea rax, [0x100002c30]
mov r8d, 0x20
mov qword [rsp + 0xb60], rax
lea rax, [0x100002c40]
mov qword [rsp + 0xb08], r13
mov qword [rsp + 0xb68], rax
lea rax, [0x100002c48]
mov byte [rsp + 0xb10], r13b
mov qword [rsp + 0xb78], rax
lea rax, [0x100002c58]
mov qword [rsp + 0xb20], r13
mov qword [rsp + 0xb80], rax
lea rax, [0x100002c88]
mov byte [rsp + 0xb28], r13b
mov qword [rsp + 0xb90], rax
lea rax, [0x100002ca0]
mov qword [rsp + 0xb30], rdi
mov qword [rsp + 0xb98], rax
lea rax, [0x100002cd0]
mov byte [rsp + 0xb40], r12b
mov qword [rsp + 0xba8], rax
lea rax, [0x100002cf0]
mov byte [rsp + 0xb58], r12b
mov qword [rsp + 0xbb0], rax
lea rax, [0x100002d10]
mov byte [rsp + 0xb70], r12b
mov qword [rsp + 0xbc0], rax
lea rax, [0x100002d30]
mov byte [rsp + 0xb88], r12b
mov qword [rsp + 0xbc8], rax
lea rax, [0x100002d50]
mov byte [rsp + 0xba0], r12b
mov qword [rsp + 0xbd8], rax
lea rax, [0x100002d58]
mov byte [rsp + 0xbb8], r12b
mov qword [rsp + 0xbe0], rax
mov eax, dword [rdx + 0x2d60]
mov byte [rsp + 0xbd0], r12b
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d64]
mov byte [rsp + 0xbe8], r12b
mov word [rcx + 4], ax
mov eax, dword [rdx + 0x2d68]
lea rcx, [rsp + 0xab8]
mov dword [rcx], eax
movzx eax, word [rdx + 0x2d6c]
mov word [rcx + 4], ax
mov rax, qword [rdx + 0x2d70]
lea rcx, [rsp + 0xad0]
mov qword [rcx], rax
mov eax, dword [rdx + 0x2d78]
mov dword [rcx + 8], eax
movzx eax, word [rdx + 0x2d7c]
lea rdx, [0x100002d80]
mov word [rcx + 0xc], ax
lea rcx, [rsp + 0xae0]
call sub.msvcrt.dll_memcpy
mov r11, rbp
mov rax, rdi
cmp word [rax], r13w
je 0x10000bd72
add rax, 2
sub r11, r12
jne 0x10000bd63
cmp r11, r13
je 0x10000dbad
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
sub rbp, r11
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], r13
call fcn.100007a8c
mov rdi, rax
cmp rax, r13
je 0x10000be66
mov rsi, qword [rsp + 0x68]
cmp word [rdi], r13w
je 0x10000be66
cmp word [rdi], 0x2d
je 0x10000bdbe
cmp word [rdi], 0x2f
jne 0x10000be32
lea r12, [rsi - 1]
cmp r12, 1
jne 0x10000bdf8
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x100002da0]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r12d
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf4d
cmp rbp, r12
mov r12d, 1
jne 0x10000be32
lea rax, [0x100002c00]
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
mov edx, r12d
mov ecx, 0x409
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf53
mov rsi, r13
mov qword [rsp + 0x68], r13
cmp qword [rsp + 0x70], r13
je 0x10000be5a
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.100007a8c
mov rsi, qword [rsp + 0x68]
mov rdi, rax
jmp 0x10000be5d
mov rdi, r13
cmp rdi, r13
jne 0x10000bda8
lea rax, [rsp + 0xab8]
mov byte [rsp + 0xb10], r12b
mov byte [rsp + 0xb28], r12b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xab0]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xb20], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], r13
call fcn.100007a8c
mov rbx, rax
cmp rax, r13
je 0x10000c03c
mov rdi, qword [rsp + 0x68]
cmp word [rbx], r13w
je 0x10000c03c
cmp word [rbx], 0x2d
je 0x10000bed6
cmp word [rbx], 0x2f
jne 0x10000bf2a
mov ebp, r13d
mov rsi, r13
lea r12, [rsp + 0xb00]
mov rax, qword [r12]
or dword [rsp + 0x28], 0xffffffff
lea r9d, [rdi - 1]
lea r8, [rbx + 2]
mov edx, 1
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000bf80
inc ebp
inc rsi
add r12, 0x18
cmp ebp, 0xa
jb 0x10000bee4
xor r13d, r13d
mov r14d, 0x104
lea r12d, [r13 + 1]
lea rcx, [rsp + 0x110]
mov r9b, r12b
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x11c], r14d
call fcn.100007b8c
jmp 0x10000bff8
mov r12d, 1
lea rax, [rsp + 0xad0]
mov byte [rsp + 0xb10], r13b
mov byte [rsp + 0xb28], r13b
mov qword [rsp + 0xb08], rax
lea rax, [rsp + 0xae0]
jmp 0x10000be8e
lea rax, [rsi + rsi*2]
xor r13d, r13d
mov r14d, 0x104
mov r10, qword [rsp + rax*8 + 0xb08]
mov r9b, byte [rsp + rax*8 + 0xb10]
mov dword [rsp + 0x11c], r14d
mov r8, r13
cmp r10, r13
je 0x10000bfd4
mov r8d, 0x7fffffff
mov rcx, r10
mov edx, r13d
mov rax, r8
cmp word [rcx], r13w
je 0x10000bfcc
add rcx, 2
sub rax, 1
jne 0x10000bfbc
cmp rax, r13
jne 0x10000c02b
mov r8, r13
mov edx, 0x80070057
cmp edx, r13d
jl 0x10000c092
lea rcx, [rsp + 0x110]
mov rdx, r10
call fcn.100007b8c
mov r12d, 1
mov ebx, eax
cmp eax, r13d
jne 0x10000c097
mov rdi, r13
mov qword [rsp + 0x68], r13
cmp qword [rsp + 0x70], r13
je 0x10000c030
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.100007a8c
mov rdi, qword [rsp + 0x68]
mov rbx, rax
jmp 0x10000c033
sub r8, rax
jmp 0x10000bfd9
mov rbx, r13
cmp rbx, r13
jne 0x10000bec0
mov rbx, qword [rsp + 0x110]
mov rax, r13
cmp rbx, r13
je 0x10000c072
mov r8d, 0x7fffffff
mov rax, rbx
mov edx, r13d
mov rcx, r8
cmp word [rax], r13w
je 0x10000c06a
add rax, 2
sub rcx, r12
jne 0x10000c05b
cmp rcx, r13
jne 0x10000c0e6
mov rax, r13
mov edx, 0x80070057
cmp edx, r13d
jge 0x10000c0ee
cmp dword [rsp + 0x118], r14d
jle 0x10000dbc5
mov rcx, rbx
jmp 0x10000dbbf
mov ebx, 0x65b
cmp dword [rsp + 0x118], r14d
jle 0x10000c0af
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], r14d
cmp dword [rsp + 0xf8], 1
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jle 0x10000c0df
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
jmp 0x10000dbfa
mov rax, r8
sub rax, rcx
jmp 0x10000c077
mov edx, 0x20
cmp rax, r13
jbe 0x10000c12e
lea rcx, [rbx + rax*2 - 2]
cmp word [rcx], dx
je 0x10000c108
cmp word [rcx], 9
jne 0x10000c12e
cmp rcx, rbx
jb 0x10000c12e
mov word [rcx], r13w
mov rbx, qword [rsp + 0x110]
sub rcx, 2
jmp 0x10000c0fd
cmp di, dx
je 0x10000c12a
cmp di, 9
jne 0x10000c13c
add rbx, 2
mov di, word [rbx]
mov qword [rsp + 0x60], rbx
cmp di, r13w
jne 0x10000c11f
mov r12, qword [0x10001e028]
mov eax, 0x45
mov esi, r13d
mov ebp, 0x667
lea r8, [0x100001a30]
lea r9d, [rax + 0xd]
cmp di, r13w
je 0x10000c7e1
cmp di, 0x2f
je 0x10000c2a4
cmp di, 0x2d
je 0x10000c2a4
lea rcx, [rsp + 0x8a0]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x8a0]
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x890], rax
mov dword [rsp + 0x898], r14d
mov dword [rsp + 0x89c], r14d
call fcn.10000b398
cmp eax, r13d
je 0x10000c71d
mov r12, qword [rsp + 0x890]
cmp r12, r13
je 0x10000c251
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x10001db14]
lea edx, [rax + rcx + 2]
lea rcx, [0x10001c020]
mov edi, eax
call fcn.10000f00c
cmp al, r13b
je 0x10000c249
mov rax, qword [0x10001c020]
movsxd rbx, dword [0x10001db14]
mov r8d, 0x20
mov rcx, rbx
inc ebx
mov word [rax + rcx*2], r8w
lea eax, [rdi + 1]
movsxd rcx, ebx
movsxd rdx, eax
mov rax, qword [0x10001c020]
mov r8, r12
lea rcx, [rax + rcx*2]
mov dword [0x10001db14], ebx
call fcn.100004d38
cmp eax, r13d
jl 0x10000c249
add ebx, edi
mov dword [0x10001db14], ebx
mov r12, qword [rsp + 0x890]
mov rbx, qword [rsp + 0x60]
mov edx, 0x20
mov di, word [rbx]
cmp di, dx
je 0x10000c269
cmp di, 9
jne 0x10000c274
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c25b
cmp dword [rsp + 0x898], r14d
jle 0x10000c298
cmp r12, r13
je 0x10000c298
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r12, qword [0x10001e028]
jmp 0x10000c6fc
mov r12, qword [0x10001e028]
jmp 0x10000c701
add rbx, 2
mov qword [rsp + 0x60], rbx
movzx eax, word [rbx]
mov ecx, eax
or ecx, edx
cmp r13w, ax
je 0x10000c2c3
add rbx, 2
mov qword [rsp + 0x60], rbx
mov r13, r8
mov eax, r9d
xor r10d, r10d
movzx eax, ax
or eax, edx
cmp eax, ecx
je 0x10000c2e4
add r13, 2
mov ax, word [r13]
cmp ax, r10w
jne 0x10000c2cc
cmp word [r13], r10w
je 0x10000c74f
cmp word [rbx], dx
je 0x10000c306
cmp word [rbx], r10w
je 0x10000c306
cmp word [rbx], 9
mov r14d, 1
jne 0x10000c309
mov r14d, r10d
cmp word [rbx], dx
je 0x10000c314
cmp word [rbx], 9
jne 0x10000c31f
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c309
cmp word [r13], 0x63
lea rax, [rsp + 0xca0]
mov qword [rsp + 0x70], rax
jne 0x10000c33d
cmp r14d, r10d
jne 0x10000c74f
cmp word [r13], 0x50
jne 0x10000c3df
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [rax + 0xa]
cmp edi, 1
jle 0x10000c370
movsxd rdx, edi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
jmp 0x10000c378
lea r12, [rsp + 0x100]
xor ecx, ecx
cmp r12, rcx
je 0x10000c7c0
mov rcx, qword [rsp + 0xf0]
lea rax, [rsp + 0x100]
cmp rcx, rax
je 0x10000c39e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0xf0], r12
mov dword [rsp + 0xf8], edi
mov qword [rsp + 0xa0], r12
call fcn.10000b2c8
xor r10d, r10d
cmp al, r10b
je 0x10000c762
mov r12, qword [0x10001e028]
jmp 0x10000c415
cmp word [r13], 0x71
je 0x10000c3ef
cmp word [r13], 0x63
jne 0x10000c3f4
cmp r14d, r10d
je 0x10000c41f
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b2c8
xor r10d, r10d
cmp al, r10b
je 0x10000c762
mov rbx, qword [rsp + 0x60]
mov edx, 0x20
mov di, word [rbx]
cmp di, dx
je 0x10000c42d
cmp di, 9
jne 0x10000c438
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c41f
cmp word [r13], 0x46
je 0x10000c458
cmp word [r13], 0x71
je 0x10000c458
cmp word [r13], 0x4a
je 0x10000c458
cmp word [r13], 0x6c
jne 0x10000c4cb
cmp r14d, r10d
je 0x10000c4cb
cmp word [r13], 0x71
lea rax, [rsp + 0x14a0]
lea rdx, [rsp + 0x14a0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
lea r15, [rsp + 0xca0]
je 0x10000c4d0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov r8d, 0x400
call fcn.10000b2c8
xor r10d, r10d
cmp al, r10b
je 0x10000c762
mov rbx, qword [rsp + 0x60]
lea r8d, [r10 + 0x20]
mov di, word [rbx]
cmp di, r8w
je 0x10000c4c0
cmp di, 9
jne 0x10000c4cb
add rbx, 2
mov qword [rsp + 0x60], rbx
jmp 0x10000c4b1
mov rdx, qword [rsp + 0x78]
cmp word [r13], 0x61
jb 0x10000c517
cmp word [r13], 0x7a
ja 0x10000c517
lea rax, [0x100001a30]
lea r14, [0x100000000]
mov rcx, r15
sub r13, rax
sar r13, 1
call qword [r14 + r13*8 + 0x1bf50]
xor r13d, r13d
cmp eax, r13d
jne 0x10000c7c7
mov r12, qword [0x10001e028]
jmp 0x10000c6cf
cmp r12, r10
je 0x10000c61d
cmp word [r13], 0x50
mov eax, 0x41
jne 0x10000c59d
cmp word [r12], ax
jne 0x10000c59d
lea rdx, [rsp + 0x1ca0]
mov ecx, eax
call 0x1000099cc
cmp eax, r10d
jne 0x10000c74f
lea rdx, [rsp + 0xc00]
mov r12, r13
mov qword [0x10001e028], r13
mov ecx, 0x1e
lea rax, [rsp + 0xc00]
sub r15, rdx
cmp rcx, r10
je 0x10000c590
movzx edx, word [rax + r15]
cmp dx, r10w
je 0x10000c58b
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x10000c56e
cmp rcx, r10
jne 0x10000c594
sub rax, 2
mov word [rax], r10w
jmp 0x10000c6cc
cmp word [r12], 0x50
jne 0x10000c74f
cmp word [r13], ax
jne 0x10000c74f
mov ecx, eax
call 0x1000099cc
xor r13d, r13d
cmp eax, r13d
je 0x10000c6cf
xor edx, edx
xor ecx, ecx
call fcn.100007cfc
mov esi, ebp
lea r14, [0x100000000]
call fcn.10000b620
cmp esi, r13d
jne 0x10000c8a1
cmp qword [0x10001e028], r13
jne 0x10000c971
xor edx, edx
xor ecx, ecx
call fcn.100007cfc
mov esi, ebp
mov edi, dword [rsp + 0x80]
cmp esi, r13d
jne 0x10000c8a1
cmp edi, r13d
jne 0x10000c985
jmp 0x10000c978
cmp word [r13], 0x50
mov r12, r13
mov qword [0x10001e028], r13
je 0x10000c67a
lea r8, [rsp + 0x1ca0]
mov ecx, 0x400
lea rax, [rsp + 0x1ca0]
sub rdx, r8
mov qword [rsp + 0x78], rdx
cmp rcx, r10
je 0x10000c672
movzx edx, word [rdx + rax]
cmp dx, r10w
je 0x10000c66d
mov word [rax], dx
mov rdx, qword [rsp + 0x78]
add rax, 2
sub rcx, 1
jne 0x10000c64c
cmp rcx, r10
jne 0x10000c676
sub rax, 2
mov word [rax], r10w
lea rdx, [rsp + 0xc00]
mov ecx, 0x1e
lea rax, [rsp + 0xc00]
sub r15, rdx
cmp rcx, r10
je 0x10000c6b4
movzx edx, word [r15 + rax]
cmp dx, r10w
je 0x10000c6af
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x10000c692
cmp rcx, r10
jne 0x10000c6b8
sub rax, 2
mov word [rax], r10w
mov eax, 0x45
cmp word [r13], ax
je 0x10000c7d7
xor r13d, r13d
lea r11, [rsp + 0xca0]
mov word [rsp + 0xca0], r13w
lea r15, [rsp + 0x14a0]
mov word [rsp + 0x14a0], r13w
mov r14d, 0x104
mov qword [rsp + 0x78], r11
mov edx, 0x20
cmp di, r13w
je 0x10000c7dc
lea r8, [0x100001a30]
mov r9d, 0x52
jmp 0x10000c165
xor edx, edx
xor ecx, ecx
call fcn.100007cfc
cmp dword [rsp + 0x898], r14d
mov esi, ebp
jle 0x10000c745
mov rcx, qword [rsp + 0x890]
cmp rcx, r13
je 0x10000c745
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rbx, qword [rsp + 0x60]
jmp 0x10000c5d2
xor edx, edx
xor ecx, ecx
call fcn.100007cfc
mov esi, ebp
xor r13d, r13d
jmp 0x10000c5d2
xor edx, edx
xor ecx, ecx
call fcn.100007cfc
cmp dword [rsp + 0x118], 0x104
jle 0x10000c786
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], 1
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], 0x104
mov qword [rsp + 0x110], rax
jle 0x10000c7b9
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebp
jmp 0x10000dbfa
mov esi, 0xe
jmp 0x10000c75a
xor edx, edx
xor ecx, ecx
call fcn.100007cfc
mov esi, ebp
jmp 0x10000c5d9
xor r13d, r13d
jmp 0x10000c7e1
mov eax, 0x45
cmp r12, r13
je 0x10000c5d2
mov ebp, 0x59
lea edi, [rbp + 1]
cmp ax, word [r12]
je 0x10000c813
cmp bp, word [r12]
je 0x10000c813
cmp di, word [r12]
je 0x10000c813
call fcn.10000b620
mov r12, qword [0x10001e028]
cmp word [r12], 0x50
lea rax, [0x100001a30]
lea rdx, [rsp + 0x1ca0]
cmove rdx, qword [rsp + 0xf0]
sub r12, rax
lea r14, [0x100000000]
lea rcx, [rsp + 0xc00]
sar r12, 1
call qword [r14 + r12*8 + 0x1bf50]
mov rcx, qword [0x10001e028]
mov esi, eax
cmp word [rcx], bp
je 0x10000c8a1
cmp word [rcx], di
je 0x10000c8a1
cmp eax, r13d
jne 0x10000c890
mov eax, 0x45
cmp word [rcx], ax
jne 0x10000c87f
mov dword [0x10001daf8], 1
jmp 0x10000c5ff
mov edi, 1
mov dword [rsp + 0x80], edi
jmp 0x10000c606
cmp eax, 0x8000
jne 0x10000c8f6
mov dword [0x10001daf8], r13d
mov esi, r13d
cmp dword [rsp + 0x118], 0x104
jle 0x10000c8bc
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], 1
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], 0x104
mov qword [rsp + 0x110], rax
jle 0x10000c8ef
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x10000dbfa
mov eax, 0x52
cmp word [rcx], ax
je 0x10000c965
cmp word [rcx], 0x55
je 0x10000c965
mov eax, 0x4eb
cmp esi, eax
jg 0x10000c939
je 0x10000c5ff
cmp esi, 0xfffffffe
jl 0x10000c965
cmp esi, r13d
jl 0x10000c5ff
cmp esi, 1
jle 0x10000c965
cmp esi, 3
jle 0x10000c932
cmp esi, 0x7b
jne 0x10000c965
mov esi, 0x653
jmp 0x10000c965
cmp esi, 0x642
jl 0x10000c965
cmp esi, 0x644
jle 0x10000c5ff
cmp esi, 0x669
je 0x10000c5ff
cmp esi, 0xbc2
je 0x10000c5ff
mov ecx, esi
call fcn.10000adec
jmp 0x10000c5ff
mov edi, dword [rsp + 0x80]
cmp dword [0x10001daf8], r13d
je 0x10000c8a1
xor ecx, ecx
cmp dword [0x10001daf8], r13d
je 0x10000c99a
xor edx, edx
call qword [0x10001a420]
jmp 0x10000c9ac
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [0x100002da8]
call fcn.100016ac0
cmp edi, r13d
je 0x10000ca0c
cmp dword [0x10001daf8], r13d
jne 0x10000ca19
mov edi, r13d
movsxd rcx, edi
lea r8, [0x1000019a8]
mov r9d, 1
lea rax, [r14 + rcx*4 + 0x1d8a8]
lea rdx, [r14 + rcx*8 + 0x1c008]
shl rcx, 4
add rcx, r8
lea r8d, [r9 + 3]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
cmp eax, r13d
jne 0x10000ca01
inc edi
cmp edi, 1
jl 0x10000c9bd
jmp 0x10000ca0c
mov dword [rsp + 0xac], 1
cmp dword [0x10001daf8], r13d
je 0x10000db50
xor eax, eax
mov r9d, r13d
lea r10d, [rax + 0x30]
lea r11d, [rax + 0x20]
mov qword [rsp + 0xac0], rax
mov qword [rsp + 0xac8], rax
cmp word [rbx], r10w
jb 0x10000ca5a
cmp word [rbx], 0x39
ja 0x10000ca5a
mov eax, r9d
cdq
and eax, 1
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, r10d
jmp 0x10000ca88
mov eax, 0x41
cmp word [rbx], ax
jb 0x10000cb0d
cmp word [rbx], 0x46
ja 0x10000cb0d
mov eax, r9d
cdq
and eax, 1
xor eax, edx
sub eax, edx
neg eax
movzx eax, word [rbx]
sbb r8d, r8d
sub eax, 0x37
and r8d, 0xfffffff1
add r8d, 0x10
imul r8d, eax
cmp r9d, r11d
jge 0x10000cab5
mov eax, r9d
inc r9d
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
or byte [rsp + rcx + 0xac0], r8b
add rbx, 2
jmp 0x10000ca36
cmp dword [rsp + 0x118], 0x104
jle 0x10000cad0
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], 0x104
cmp dword [rsp + 0xf8], 1
lea rax, [rsp + 0x120]
mov qword [rsp + 0x110], rax
jle 0x10000cb03
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x641
jmp 0x10000dbfa
cmp r9d, r11d
jne 0x10000cab5
mov r14b, r13b
mov bpl, r13b
mov r12b, r13b
mov r15b, r13b
cmp word [rbx], r13w
je 0x10000cb28
add rbx, 2
cmp word [rbx], 0x43
jne 0x10000cc03
mov r14b, 1
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x88], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x88]
lea edx, [rbx + 3]
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
cmp eax, r13d
jne 0x10000cb7d
mov qword [rsp + 0x88], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x10000cab5
cmp bpl, r13b
jne 0x10000cb88
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp bpl, r13b
je 0x10000cbb4
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xad0]
lea edx, [rdi + 7]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, r13d
je 0x10000ccfd
cmp byte [0x10001e24a], r13b
jne 0x10000cc8f
lea rcx, [rsp + 0xa0]
call fcn.100005350
mov rbx, qword [rsp + 0xa0]
jmp 0x10000cc99
cmp word [rbx], 0x55
jne 0x10000cc14
mov r14b, 1
mov r12b, r14b
jmp 0x10000cb35
cmp word [rbx], ax
jne 0x10000cc21
mov r15b, 1
jmp 0x10000cb35
cmp word [rbx], 0x4d
je 0x10000cc37
mov eax, 0x45
cmp word [rbx], ax
jne 0x10000cb35
jmp 0x10000cc3a
mov bpl, 1
lea r8, [rbx + 4]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
cmp rax, r13
je 0x10000db37
cmp rax, 0xffffffffffffffff
je 0x10000db37
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, r13d
je 0x10000cb35
mov edx, edi
lea rcx, [0x100002e40]
jmp 0x10000db46
lea rbx, [0x10001e250]
mov eax, r13d
cmp eax, r13d
jne 0x10000cce8
mov rcx, qword [rsp + 0xad0]
lea rax, [rsp + 0xab8]
lea r8, [rsp + 0xc40]
mov r9d, 0x58
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp eax, r13d
je 0x10000cce8
mov rcx, qword [rsp + 0xc40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb edi, edi
and edi, 2
inc edi
mov rcx, qword [rsp + 0xad0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x104
jmp 0x10000cd42
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x892]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x890], r13w
mov ebx, eax
call sub.msvcrt.dll_memset
mov r9d, ebx
mov ebx, 0x104
lea r8, [0x100002eb0]
lea rcx, [rsp + 0x890]
mov rdx, rbx
call fcn.100004f60
cmp r12b, r13b
je 0x10000cd51
cmp edi, 1
jne 0x10000cd67
mov edi, 7
mov r8d, 5
cmp r15b, r13b
je 0x10000cdac
cmp edi, r13d
jne 0x10000cda4
lea edi, [r8 - 1]
jmp 0x10000cdac
cmp edi, r13d
jne 0x10000cd73
mov edi, 6
jmp 0x10000cd51
lea rcx, [0x100002ef0]
xor edx, edx
call fcn.10000a81c
cmp dword [rsp + 0x118], ebx
jle 0x10000cd98
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], ebx
jmp 0x10000cadb
cmp edi, 1
jne 0x10000cd81
mov edi, r8d
mov ebp, 0x100
mov dword [rsp + 0xa8], ebp
cmp edi, r13d
je 0x10000cdd6
cmp edi, 1
je 0x10000cdd6
cmp edi, 4
je 0x10000cdd6
cmp edi, r8d
je 0x10000cdd6
cmp edi, 6
je 0x10000cdd6
cmp edi, 7
jne 0x10000cddc
mov r8d, 4
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xb00]
xor r9d, r9d
call fcn.100005460
mov ebx, eax
cmp eax, r13d
je 0x10000ce3a
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000ce0f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x118], 0x104
jle 0x10000ce2a
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [rsp + 0x118], 0x104
jmp 0x10000c0b7
movsxd rbx, dword [rsp + 0xa8]
cmp ebx, ebp
mov dword [rsp + 0xab0], ebx
mov dword [rsp + 0x94], ebx
mov dword [rsp + 0xb8], ebx
mov dword [rsp + 0xb4], ebx
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0x338], ebx
jle 0x10000ce99
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [rsp + 0x94]
mov qword [rsp + 0x330], rax
cmp rax, r13
jne 0x10000cebb
mov dword [rsp + 0x338], r13d
jmp 0x10000cebb
lea rcx, [rsp + 0x340]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x340]
mov qword [rsp + 0x330], r11
cmp ebx, ebp
mov dword [rsp + 0x558], ebx
jle 0x10000cee8
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x550], rax
cmp rax, r13
jne 0x10000cf0a
mov dword [rsp + 0x558], r13d
jmp 0x10000cf0a
lea rcx, [rsp + 0x560]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x560]
mov qword [rsp + 0x550], r11
movsxd rax, dword [rsp + 0xb8]
cmp eax, ebp
mov dword [rsp + 0x668], eax
jle 0x10000cf3f
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x660], rax
cmp rax, r13
jne 0x10000cf61
mov dword [rsp + 0x668], r13d
jmp 0x10000cf61
lea rcx, [rsp + 0x670]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x670]
mov qword [rsp + 0x660], r11
movsxd rax, dword [rsp + 0xb4]
cmp eax, ebp
mov dword [rsp + 0x448], eax
jle 0x10000cf99
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
mov qword [rsp + 0x440], rax
cmp rax, r13
jne 0x10000cfbb
mov dword [rsp + 0x448], r13d
jmp 0x10000cfbb
lea rcx, [rsp + 0x450]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rsp + 0x450]
mov qword [rsp + 0x440], rbx
movsxd rax, dword [rsp + 0xb0]
cmp eax, ebp
mov dword [rsp + 0x778], eax
jle 0x10000cff8
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, qword [rsp + 0x440]
mov qword [rsp + 0x770], rax
cmp rax, r13
jne 0x10000d01a
mov dword [rsp + 0x778], r13d
jmp 0x10000d01a
lea rcx, [rsp + 0x780]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x780]
mov qword [rsp + 0x770], rax
mov r9, qword [rsp + 0x550]
mov rdx, qword [rsp + 0x330]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x660]
lea r8, [rsp + 0xab0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x94]
lea rcx, [rsp + 0xb00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
cmp eax, r13d
jne 0x10000d149
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x88]
mov ebx, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d0b0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x778], ebp
jle 0x10000d0cc
mov rcx, qword [rsp + 0x770]
cmp rcx, r13
je 0x10000d0cc
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], ebp
jle 0x10000d0e8
mov rcx, qword [rsp + 0x440]
cmp rcx, r13
je 0x10000d0e8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], ebp
jle 0x10000d104
mov rcx, qword [rsp + 0x660]
cmp rcx, r13
je 0x10000d104
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], ebp
jle 0x10000d120
mov rcx, qword [rsp + 0x550]
cmp rcx, r13
je 0x10000d120
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], ebp
jle 0x10000ce0f
mov rcx, qword [rsp + 0x330]
cmp rcx, r13
je 0x10000ce0f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000ce0f
mov rcx, qword [rsp + 0x330]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [0x10001a488]
mov ebx, eax
cmp eax, r13d
je 0x10000d245
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d19e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100002fc0]
mov edx, ebx
call fcn.10000a81c
cmp dword [rsp + 0x778], ebp
jle 0x10000d1c8
mov rcx, qword [rsp + 0x770]
cmp rcx, r13
je 0x10000d1c8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], ebp
jle 0x10000d1e4
mov rcx, qword [rsp + 0x440]
cmp rcx, r13
je 0x10000d1e4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], ebp
jle 0x10000d200
mov rcx, qword [rsp + 0x660]
cmp rcx, r13
je 0x10000d200
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], ebp
jle 0x10000d21c
mov rcx, qword [rsp + 0x550]
cmp rcx, r13
je 0x10000d21c
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], ebp
jle 0x10000cab5
mov rcx, qword [rsp + 0x330]
cmp rcx, r13
je 0x10000cab5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x10000cab5
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
cmp rax, r13
jne 0x10000d27c
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d1ac
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000d1ac
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor ebp, ebp
mov r13, rax
cmp rax, rbp
jne 0x10000d340
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d2ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d2cf
mov rcx, qword [rsp + 0x770]
cmp rcx, rbp
je 0x10000d2cf
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d2eb
mov rcx, qword [rsp + 0x440]
cmp rcx, rbp
je 0x10000d2eb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d307
mov rcx, qword [rsp + 0x660]
cmp rcx, rbp
je 0x10000d307
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d323
mov rcx, qword [rsp + 0x550]
cmp rcx, rbp
je 0x10000d323
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000cab5
mov rcx, qword [rsp + 0x330]
cmp rcx, rbp
jmp 0x10000d234
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rbp
call fcn.10000b540
mov rbx, rax
cmp rax, rbp
jne 0x10000d3a7
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d370
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003020]
xor edx, edx
call fcn.10000a81c
mov rcx, qword [rsp + 0x78]
cmp rcx, rbp
je 0x10000d38e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbp
je 0x10000d2ae
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x10000d2ae
mov rax, qword [0x10001db08]
mov dword [rsp + 0x98], ebp
mov dword [rsp + 0xbc], ebp
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0x60], rbp
cmp rax, rbp
jne 0x10000d3eb
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001db08], rax
cmp rax, rbp
je 0x10000db15
lea rdx, [0x100001cd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x10000db15
lea r8, [rsp + 0x60]
lea rdx, [0x100001988]
lea rcx, [0x1000019e8]
call rax
cmp eax, ebp
jne 0x10000db15
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0xa0]
lea r8, [0x1000019e8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbp, qword [rsp + 0xa0]
xor eax, eax
cmp rbp, rax
je 0x10000db13
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
je 0x10000d46d
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov qword [rsp + 0x68], rax
mov rax, qword [rbp]
lea r8, [rsp + 0x68]
lea rdx, [0x1000019d8]
mov rcx, rbp
call qword [rax]
mov r11, qword [rbp]
mov rcx, rbp
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x78]
xor ebp, ebp
mov dword [rsp + 0x90], edi
cmp rcx, rbp
je 0x10000d4ab
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x78], rbp
mov r10, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
lea r8, [rsp + 0xac0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x98]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov r9d, 0x10
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [r10 + 0x70]
cmp eax, ebp
je 0x10000d533
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d516
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x100003080]
xor edx, edx
call fcn.10000a81c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
jmp 0x10000d37e
mov r8d, dword [rsp + 0x98]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
xor eax, eax
cmp rbp, rax
jne 0x10000d63c
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d56a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a81c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x78]
xor ebx, ebx
cmp rcx, rbx
je 0x10000d59a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
je 0x10000d5aa
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d5cb
mov rcx, qword [rsp + 0x770]
cmp rcx, rbx
je 0x10000d5cb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d5e7
mov rcx, qword [rsp + 0x440]
cmp rcx, rbx
je 0x10000d5e7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d603
mov rcx, qword [rsp + 0x660]
cmp rcx, rbx
je 0x10000d603
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d61f
mov rcx, qword [rsp + 0x550]
cmp rcx, rbx
je 0x10000d61f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000cab5
mov rcx, qword [rsp + 0x330]
cmp rcx, rbx
jmp 0x10000d234
mov rcx, qword [rsp + 0x78]
call qword [0x10001a4c0]
xor ecx, ecx
cmp eax, ecx
jne 0x10000d66f
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d661
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d588
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
lea rdx, [0x1000019f8]
mov rax, qword [rcx]
call qword [rax]
xor eax, eax
mov rdx, rax
cmp edi, dword [rsp + 0x90]
jne 0x10000d69d
cmp edi, 6
je 0x10000d69d
cmp edi, 7
jne 0x10000d6a5
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0xac0]
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rsp + 0x70]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rsp + 0x70]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
mov r10, qword [rcx]
mov edx, dword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xbc]
mov r9b, r15b
mov r8b, r14b
mov dword [rsp + 0x20], eax
call qword [r10 + 0x148]
mov rcx, qword [rsp + 0x88]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x10000d730
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x88], 0xffffffffffffffff
xor r14d, r14d
cmp edi, r14d
je 0x10000d806
lea rcx, [0x100003160]
xor edx, edx
call fcn.10000a81c
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x78]
cmp rcx, r14
je 0x10000d764
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000d774
mov rax, qword [rcx]
call qword [rax + 0x10]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d795
mov rcx, qword [rsp + 0x770]
cmp rcx, r14
je 0x10000d795
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d7b1
mov rcx, qword [rsp + 0x440]
cmp rcx, r14
je 0x10000d7b1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d7cd
mov rcx, qword [rsp + 0x660]
cmp rcx, r14
je 0x10000d7cd
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000d7e9
mov rcx, qword [rsp + 0x550]
cmp rcx, r14
je 0x10000d7e9
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000cab5
mov rcx, qword [rsp + 0x330]
cmp rcx, r14
jmp 0x10000d234
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x138]
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + 0x10]
mov rcx, qword [rsp + 0x78]
cmp rcx, r14
je 0x10000d833
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
cmp rcx, r14
je 0x10000d843
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r15d, 3
mov bl, r14b
or r14d, 0xffffffff
lea rdx, [rsp + 0xae0]
mov edi, 0x4ff
xor r8d, r8d
mov r9d, r14d
mov ecx, r15d
mov dword [0x10001daf0], r15d
mov qword [rsp + 0xae0], rbp
mov qword [rsp + 0xae8], r12
mov qword [rsp + 0xaf0], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor r13d, r13d
cmp eax, r13d
je 0x10000da25
cmp eax, 1
je 0x10000da1c
cmp eax, 2
jne 0x10000d8f2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x60], r13d
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x160]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
cmp rax, r13
je 0x10000d973
mov qword [rsp + 0xae0], rax
jmp 0x10000d953
cmp eax, r15d
jne 0x10000da25
jmp 0x10000d923
cmp dword [rsp + 0xc8], 0x12
je 0x10000d948
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r13d
jne 0x10000d8fd
jmp 0x10000d94a
mov bl, 1
cmp bl, r13b
jne 0x10000da25
lea rdx, [rsp + 0xae0]
mov r9d, r14d
xor r8d, r8d
mov ecx, r15d
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x10000d892
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000d987
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1000030f0]
mov edx, eax
call fcn.10000a81c
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000d9bc
mov rcx, qword [rsp + 0x770]
cmp rcx, r13
je 0x10000d9bc
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000d9d8
mov rcx, qword [rsp + 0x440]
cmp rcx, r13
je 0x10000d9d8
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000d9f4
mov rcx, qword [rsp + 0x660]
cmp rcx, r13
je 0x10000d9f4
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000da10
mov rcx, qword [rsp + 0x550]
cmp rcx, r13
je 0x10000da10
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jmp 0x10000d223
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x100
cmp dword [rsp + 0x778], edi
jle 0x10000da5a
mov rcx, qword [rsp + 0x770]
cmp rcx, r13
je 0x10000da5a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x448], edi
jle 0x10000da76
mov rcx, qword [rsp + 0x440]
cmp rcx, r13
je 0x10000da76
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x668], edi
jle 0x10000da92
mov rcx, qword [rsp + 0x660]
cmp rcx, r13
je 0x10000da92
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x558], edi
jle 0x10000daae
mov rcx, qword [rsp + 0x550]
cmp rcx, r13
je 0x10000daae
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0x338], edi
jle 0x10000daca
mov rcx, qword [rsp + 0x330]
cmp rcx, r13
je 0x10000daca
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [rsp + 0x80]
cmp eax, r13d
je 0x10000daf0
cmp dword [0x10001daf8], r13d
jne 0x10000daf0
mov ecx, dword [0x10001d8a8]
cmp ecx, r13d
je 0x10000daf0
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rsp + 0xac], r13d
je 0x10000c8a1
mov ecx, 0x641
call fcn.10000adec
jmp 0x10000cab5
xor ebp, ebp
mov rcx, qword [rsp + 0x88]
cmp rcx, 0xffffffffffffffff
je 0x10000db29
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
jmp 0x10000d37e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x100002dd0]
mov edx, eax
call fcn.10000a81c
jmp 0x10000cab5
mov dword [0x10001daf0], 1
lea rcx, [rsp + 0xc0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, r13d
jne 0x10000db8f
cmp dword [0x10001db10], r13d
je 0x10000daca
cmp dword [0x10001dae8], r13d
je 0x10000daca
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10000db5a
cmp dword [rsp + 0x118], r14d
jle 0x10000dbc5
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rsp + 0xf8], r12d
lea rax, [rsp + 0x120]
mov dword [rsp + 0x118], r14d
mov qword [rsp + 0x110], rax
jle 0x10000dbf5
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, 0x65b
mov rcx, qword [rsp + 0x24a0]
xor rcx, rsp
call fcn.1000170f0
lea r11, [rsp + 0x24b0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret