Function at 0x140001ae0
Capabilities:
Manipulate boot configuration
Modify service
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x5b8]
sub rsp, 0x6b8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
mov dword [rsp + 0x74], ecx
lea rdi, [rbp - 0x80]
xor eax, eax
mov ecx, 0x618
rep stosb byte [rdi], al
mov rdi, qword [0x14000dc58]
xor r15d, r15d
mov rcx, rdi
call qword [0x1400092d8]
lea rax, str.bcdedit.exe
mov edx, 0x104
mov qword [rsp + 0x28], rax
lea r9, str._ws_ws
lea rax, [0x14000dc60]
mov r8d, edx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rax
call rdi
lea rbx, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001b6c
add rbx, 2
cmp word [rbx], r15w
jne 0x140001b62
lea rax, [rbp - 0x80]
sub rbx, rax
sar rbx, 1
cmp rbx, 0xc
ja 0x140001b83
xor eax, eax
jmp 0x140002ce7
mov qword [rsp + 0x6e0], rsi
mov rsi, qword [0x14000d8d0]
mov qword [rsp + 0x6e8], r12
mov qword [rsp + 0x6f0], r13
lea r13, str.Patch:_Executing_BCDEDIT_commands
mov qword [rsp + 0x6b0], r14
mov rdi, r13
mov r14d, dword [0x14000d8d8]
nop dword [rax + rax]
add rdi, 2
cmp word [rdi], r15w
jne 0x140001bc0
sub rdi, r13
mov r12d, 0xd
sar rdi, 1
lea rax, [rdi - 1]
cmp rax, 0x40f
ja 0x140001cb0
lea rdi, [rdi*2 + 6]
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov r8, rdi
lea edx, [r12 - 5]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140001cb0
mov rdx, r13
mov rcx, rax
call fcn.140005990
mov rcx, rdi
cmp word [rdi], r15w
je 0x140001c30
add rcx, 2
cmp word [rcx], r15w
jne 0x140001c26
lea rdx, [0x140009904]
movzx eax, r12w
sub rdx, rcx
nop
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, word [rcx + rdx]
test ax, ax
jne 0x140001c40
mov word [rcx], r15w
mov rax, rdi
cmp word [rdi], r15w
je 0x140001c6a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x140001c60
sub rax, rdi
mov qword [rsp + 0x20], r15
sar rax, 1
lea r9, [rsp + 0x78]
mov rdx, rdi
mov rcx, rsi
test r14d, r14d
je 0x140001c90
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x140001c9a
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
add rbx, rbx
cmp rbx, 0x618
jae 0x140002d03
lea rdi, [rbp - 0x80]
add rdi, rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x68], rdi
mov word [rdi], r15w
cmp word [rbp - 0x80], r15w
je 0x140001cea
nop dword [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x140001ce0
mov r12d, 0x2d
lea rdx, str._create
movzx ecx, r12w
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140001d00
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001d2a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140001d20
lea r13, str.71A3C7FC_F751_4982_AEC1_E958357E6813
mov r14d, 0x7b
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140001d50
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001d7a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140001d70
mov esi, 0x20
lea rdx, str.__d__Windows_Fast_Mode___application_OSLOADER
movzx ecx, si
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001d90
mov word [rax], r15w
lea rax, [rsp + rbx + 0x68]
mov rdx, rax
mov qword [rsp + 0x60], rax
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001df0
add rax, 2
cmp word [rax], r15w
jne 0x140001de6
lea rbx, str._set
movzx ecx, r12w
mov rdx, rbx
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001e10
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001e3a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140001e30
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001e50
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001e7a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140001e70
lea rdx, str._device_partition
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001e90
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001eba
nop
add rax, 2
cmp word [rax], r15w
jne 0x140001eb0
movzx ecx, word [0x14000de80]
lea rdi, [0x14000de80]
test cx, cx
je 0x140001ef0
mov rdx, rdi
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001ee0
mov rdx, qword [rsp + 0x60]
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov rax, qword [rsp + 0x68]
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001f3d
add rax, 2
cmp word [rax], r15w
jne 0x140001f33
mov rdx, rbx
movzx ecx, r12w
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001f50
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001f7a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140001f70
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001f90
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001fba
nop
add rax, 2
cmp word [rax], r15w
jne 0x140001fb0
lea rdx, str._osdevice_partition
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001fd0
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140001ffa
nop
add rax, 2
cmp word [rax], r15w
jne 0x140001ff0
movzx ecx, word [0x14000de80]
test cx, cx
je 0x140002020
sub rdi, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdi + rax]
test cx, cx
jne 0x140002010
mov rdx, qword [rsp + 0x60]
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov rdi, qword [rsp + 0x68]
lea rax, [rbp - 0x80]
mov word [rdi], r15w
cmp word [rbp - 0x80], r15w
je 0x14000206d
add rax, 2
cmp word [rax], r15w
jne 0x140002063
mov rdx, rbx
movzx ecx, r12w
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002080
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400020aa
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400020a0
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400020c0
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400020ea
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400020e0
lea rdx, str._systemroot_Windows
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002100
mov rdx, qword [rsp + 0x60]
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000215a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002150
mov rdx, rbx
movzx ecx, r12w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002170
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000219a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002190
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400021b0
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400021da
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400021d0
lea rdx, str._path_Windows_system32_
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400021f0
cmp dword [0x14000d8dc], r15d
mov word [rax], r15w
lea rax, [rbp - 0x80]
je 0x140002252
cmp word [rbp - 0x80], r15w
je 0x14000222a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x140002220
lea rdx, str.osloader.efi
mov ecx, 0x6f
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002240
jmp 0x140002290
cmp word [rbp - 0x80], r15w
je 0x14000226a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x140002260
lea rdx, str.osloader.exe
mov ecx, 0x6f
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002280
mov rdx, qword [rsp + 0x60]
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400022da
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400022d0
mov rdx, rbx
movzx ecx, r12w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400022f0
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000231a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002310
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002330
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000235a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002350
lea rdx, str._kernel
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002370
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000239a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002390
lea rdx, str.ntkrnlmp.exe
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400023b0
mov rdx, qword [rsp + 0x60]
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000240a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002400
mov rdx, rbx
movzx ecx, r12w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002420
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000244a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002440
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002460
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000248a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002480
lea rdx, str._recoveryenabled_0
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400024a0
mov rdx, qword [rsp + 0x60]
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400024fa
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400024f0
mov rdx, rbx
movzx ecx, r12w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002510
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000253a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002530
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002550
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000257a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002570
lea rdx, str._nx_OptIn
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002590
mov rdx, qword [rsp + 0x60]
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400025ea
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400025e0
mov rdx, rbx
movzx ecx, r12w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002600
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000262a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002620
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002640
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000266a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002660
lea rdx, str._nointegritychecks_1
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002680
mov rdx, qword [rsp + 0x60]
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400026da
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400026d0
movzx ecx, r12w
sub rbx, rax
nop dword [rax]
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rbx + rax]
test cx, cx
jne 0x1400026f0
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000271a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002710
mov rdx, r13
movzx ecx, r14w
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002730
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000275a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002750
lea rdx, str._inherit_bootloadersettings
movzx ecx, si
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002770
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400027cb
add rax, 2
cmp word [rax], r15w
jne 0x1400027c1
lea rdx, str._displayorder
movzx ecx, r12w
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400027e0
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000280a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140002800
sub r13, rax
nop dword [rax]
mov word [rax], r14w
lea rax, [rax + 2]
movzx r14d, word [rax + r13]
test r14w, r14w
jne 0x140002810
mov word [rax], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000283c
add rax, 2
cmp word [rax], r15w
jne 0x140002832
lea rcx, str.__addlast
sub rcx, rax
nop word [rax + rax]
mov word [rax], si
lea rax, [rax + 2]
movzx esi, word [rcx + rax]
test si, si
jne 0x140002850
mov rdx, rbx
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x1400028aa
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x1400028a0
lea rdx, str._timeout_0
movzx ecx, r12w
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400028c0
mov rdx, rbx
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x14000291a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x140002910
lea rdx, str._default_71A3C7FC_F751_4982_AEC1_E958357E6813
movzx ecx, r12w
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140002930
mov rdx, rbx
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
cmp dword [rsp + 0x74], 0x1db1
jbe 0x1400029e0
mov word [rdi], r15w
lea rax, [rbp - 0x80]
cmp word [rbp - 0x80], r15w
je 0x140002990
add rax, 2
cmp word [rax], r15w
jne 0x140002986
lea rcx, str._set_bootmenupolicy_legacy
sub rcx, rax
nop word [rax + rax]
mov word [rax], r12w
lea rax, [rax + 2]
movzx r12d, word [rax + rcx]
test r12w, r12w
jne 0x1400029a0
mov rdx, rbx
mov word [rax], r15w
call fcn.140002d10
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.140007cb0
test eax, eax
je 0x140002cc4
cmp dword [rsp + 0x70], r15d
jne 0x140002cc4
mov esi, dword [0x14000d8d8]
lea r14, str.Patch:_Setting_PeAuth_service_to_manual_start
mov rbx, qword [0x14000d8d0]
mov rdi, r14
nop word [rax + rax]
add rdi, 2
cmp word [rdi], r15w
jne 0x140002a00
sub rdi, r14
sar rdi, 1
lea rax, [rdi - 1]
cmp rax, 0x40f
ja 0x140002b00
lea rdi, [rdi*2 + 6]
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov r8, rdi
mov edx, 8
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140002b00
mov rdx, r14
mov rcx, rax
call fcn.140005990
mov rcx, rdi
cmp word [rdi], r15w
je 0x140002a6a
add rcx, 2
cmp word [rcx], r15w
jne 0x140002a60
lea r13, [0x140009904]
mov r12d, 0xd
mov rdx, r13
movzx eax, r12w
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
mov word [rcx], ax
lea rcx, [rcx + 2]
movzx eax, word [rcx + rdx]
test ax, ax
jne 0x140002a90
mov word [rcx], r15w
mov rax, rdi
cmp word [rdi], r15w
je 0x140002aba
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x140002ab0
sub rax, rdi
mov qword [rsp + 0x20], r15
sar rax, 1
lea r9, [rsp + 0x74]
mov rdx, rdi
mov rcx, rbx
test esi, esi
je 0x140002adf
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x140002ae9
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140002b0d
lea r13, [0x140009904]
mov r12d, 0xd
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov esi, r15d
mov r14d, r15d
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140002ba0
mov r8d, 2
lea rdx, str.PEAUTH
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140002b97
mov qword [rsp + 0x50], r15
mov edx, 0xffffffff
mov qword [rsp + 0x48], r15
mov r9d, edx
mov qword [rsp + 0x40], r15
mov r8d, 3
mov qword [rsp + 0x38], r15
mov rcx, rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov r14d, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x140002bc6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.Could_not_set_PeAuth_service_to_manual_start
call fcn.140007010
jmp 0x140002cbe
mov esi, dword [0x14000d8d8]
lea r14, str.Patch:_PeAuth_service_set_to_manual_start
mov rbx, qword [0x14000d8d0]
mov rdi, r14
nop dword [rax]
add rdi, 2
cmp word [rdi], r15w
jne 0x140002be0
sub rdi, r14
sar rdi, 1
lea rax, [rdi - 1]
cmp rax, 0x40f
ja 0x140002cbe
lea rdi, [rdi*2 + 6]
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov r8, rdi
mov edx, 8
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140002cbe
mov rdx, r14
mov rcx, rax
call fcn.140005990
mov rcx, rdi
cmp word [rdi], r15w
je 0x140002c4a
add rcx, 2
cmp word [rcx], r15w
jne 0x140002c40
sub r13, rcx
nop dword [rax]
mov word [rcx], r12w
lea rcx, [rcx + 2]
movzx r12d, word [rcx + r13]
test r12w, r12w
jne 0x140002c50
mov word [rcx], r15w
mov rax, rdi
cmp word [rdi], r15w
je 0x140002c7a
add rax, 2
cmp word [rax], r15w
jne 0x140002c70
sub rax, rdi
mov qword [rsp + 0x20], r15
sar rax, 1
lea r9, [rsp + 0x7c]
mov rdx, rdi
mov rcx, rbx
test esi, esi
je 0x140002c9f
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x140002ca9
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r15d, 1
mov r13, qword [rsp + 0x6f0]
mov eax, r15d
mov r12, qword [rsp + 0x6e8]
mov rsi, qword [rsp + 0x6e0]
mov r14, qword [rsp + 0x6b0]
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.1400081d0
add rsp, 0x6b8
pop r15
pop rdi
pop rbx
pop rbp
ret
call fcn.140008304
int3