Function at 0x140005fbc
Capabilities:
Check os version
Get common file path
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20d0]
mov eax, 0x21d0
call fcn.14000b290
sub rsp, rax
mov rax, qword [0x14001a0e8]
xor rax, rsp
mov qword [rbp + 0x20c0], rax
xor r14d, r14d
mov rdi, rdx
mov r15d, ecx
mov dword [rsp + 0x60], r14d
xor edx, edx
mov dword [rsp + 0x48], r14d
mov r8d, 0xe00
mov qword [rsp + 0x68], r14
lea eax, [r14 + 0xb]
mov esi, r14d
lea rcx, [rbp + 0x2c0]
mov word [rsp + 0x50], ax
call sub.msvcrt.dll_memset
lea ebx, [r14 + 1]
mov dword [rbp - 0x6c], r14d
xorps xmm0, xmm0
mov dword [rbp - 0x28], r14d
xor eax, eax
mov dword [rbp - 0x80], ebx
mov edx, ebx
mov dword [rbp + 0x80], eax
xor r9d, r9d
mov dword [rbp - 0x68], r14d
xor r8d, r8d
mov dword [rsp + 0x70], r14d
xor ecx, ecx
mov qword [rbp - 0x58], r14
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp - 0x48], r14
movups xmmword [rbp + 0x70], xmm0
mov dword [rbp - 0x7c], r14d
movdqu xmmword [rbp + 8], xmm0
mov dword [rsp + 0x74], r14d
mov dword [rbp - 0x20], r14d
mov dword [rbp - 0x24], r14d
mov dword [rbp - 0x50], r14d
mov dword [rsp + 0x4c], ebx
mov dword [rbp - 0x34], ebx
mov dword [rbp - 0x30], ebx
mov dword [rbp - 0x38], ebx
mov dword [rbp - 0x2c], ebx
mov dword [rsp + 0x7c], r14d
mov dword [rbp - 0x4c], r14d
mov dword [rbp - 0x78], r14d
mov dword [rbp - 0x74], r14d
mov dword [rsp + 0x78], r14d
mov qword [rbp - 8], r14
mov qword [rbp], r14
mov qword [rbp - 0x10], r14
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
lea rcx, [rbp + 0xb0]
mov dword [rbp + 0xb0], 0x114
call qword [sym.imp.ntdll.dll_RtlGetVersion]
nop dword [rax + rax]
test eax, eax
jne 0x14000612b
mov eax, dword [rbp + 0xb4]
cmp eax, 6
ja 0x1400060fa
jne 0x1400060f5
cmp dword [rbp + 0xb8], ebx
ja 0x1400060fa
mov cl, r14b
jmp 0x1400060fc
mov cl, bl
mov byte [0x14001a6bc], cl
cmp eax, 6
ja 0x140006117
jne 0x140006112
cmp dword [rbp + 0xb8], 2
ja 0x140006117
mov dl, r14b
jmp 0x140006119
mov dl, bl
cmp eax, 0xa
mov byte [0x14001a6c8], dl
setae byte [0x14001a6b1]
jmp 0x140006131
mov cl, byte [0x14001a6bc]
mov qword [0x14001a8f8], r14
test cl, cl
je 0x1400061a1
xor r8d, r8d
lea rcx, str.advapi32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [0x14001a8f0], rax
test rax, rax
jne 0x140006184
xor r8d, r8d
lea rcx, str.api_ms_win_eventing_controller_l1_1_0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [0x14001a8f0], rax
test rax, rax
je 0x1400061a1
lea rdx, str.TraceQueryInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov qword [0x14001a8f8], rax
xor r8d, r8d
mov qword [0x14001a6d8], r14
xor edx, edx
lea rcx, str.api_ms_win_stateseparation_helpers_l1_1_0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [0x14001b158], rax
mov rbx, rax
test rax, rax
je 0x1400061f3
lea rdx, str.GetPersistedRegistryLocationW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
mov rbx, qword [0x14001b158]
mov qword [0x14001a6d8], rax
mov r12d, 0x11c8
mov ecx, r12d
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov qword [rbp - 0x60], rax
mov r13, rax
test rax, rax
jne 0x140006251
mov rcx, qword [0x14001a8f0]
test rcx, rcx
je 0x140006233
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov rbx, qword [0x14001b158]
test rbx, rbx
je 0x140006247
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov eax, 0xe
jmp 0x1400085d2
mov r8, r12
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
mov dword [r13], r12d
lea r8, str.NT_Kernel_Logger
lea r12, [r13 + 0x90]
mov dword [r13 + 0x2c], 0x20000
mov rcx, r12
mov dword [r13 + 0x74], 0x90
mov edx, 0x400
mov dword [r13 + 0x70], 0x890
mov qword [rbp - 0x18], r12
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
dec r15d
mov dword [rsp + 0x40], r15d
test r15d, r15d
lea rbx, [r13 + 0x48]
jle 0x140008299
mov r9d, 0x2d
mov r15d, 0xffdf
lea esi, [r9 - 0x25]
add rdi, rsi
mov qword [rsp + 0x58], rdi
mov r8, qword [rdi]
movzx ecx, word [r8]
call fcn.1400014a4
test al, al
je 0x14000828a
mov word [r8], r9w
lea rax, [rsp + 0x48]
mov r9, r12
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
lea rcx, str._start
call fcn.140005e9c
test al, al
je 0x140006318
lea ebx, [rsi - 7]
mov dword [rsp + 0x50], ebx
jmp 0x14000714d
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._disable
call fcn.140005e9c
test al, al
je 0x14000634d
mov eax, 5
mov dword [rbp - 0x80], r14d
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._disableex
call fcn.140005e9c
test al, al
je 0x14000637b
mov eax, 0xa
jmp 0x140006344
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._enable
call fcn.140005e9c
test al, al
je 0x1400063ac
mov eax, 5
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._enableex
call fcn.140005e9c
test al, al
je 0x1400063dd
mov eax, 0xa
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._capturestate
call fcn.140005e9c
test al, al
je 0x14000640e
mov eax, 0xe
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._stop
call fcn.140005e9c
test al, al
je 0x14000643f
mov eax, 2
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._update
call fcn.140005e9c
test al, al
je 0x140006477
mov r15d, 3
mov word [rsp + 0x50], r15w
jmp 0x14000714d
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._remove
call fcn.140005e9c
test al, al
je 0x1400064a8
mov eax, 9
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._addautologger
call fcn.140005e9c
test al, al
je 0x1400064d9
mov eax, 0xd
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, [0x140014dc0]
call fcn.140005e9c
test al, al
je 0x14000650b
mov word [rsp + 0x50], r14w
jmp 0x14000714d
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._flush
call fcn.140005e9c
test al, al
je 0x14000653c
mov eax, 7
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._incrementfile
call fcn.140005e9c
test al, al
je 0x14000656d
mov eax, 0x11
jmp 0x140007148
mov rdi, qword [rsp + 0x58]
lea rdx, str._enumguid
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000659a
mov word [rsp + 0x50], si
mov ebx, dword [rsp + 0x40]
jmp 0x1400080ba
mov rcx, qword [rdi]
lea rdx, str._enumguidex
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006606
mov ebx, dword [rsp + 0x40]
mov eax, 0xc
mov word [rsp + 0x50], ax
lea esi, [rax - 0xb]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
movzx eax, word [rcx]
cmp ax, 0x23
jne 0x1400065f0
add rcx, 2
lea rdx, [rbp + 0x60]
call fcn.14000164c
mov dword [rsp + 0x60], esi
jmp 0x1400065ff
mov ecx, dword [rsp + 0x7c]
cmp ax, 0x2e
cmove ecx, esi
mov dword [rsp + 0x7c], ecx
sub ebx, esi
jmp 0x1400080ba
mov rcx, qword [rdi]
lea rdx, [0x140014e28]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000666f
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
or rax, 0xffffffffffffffff
mov r8, qword [rdi]
inc rax
cmp word [r8 + rax*2], r14w
jne 0x14000663a
add rax, rsi
mov ecx, 0x400
cmp rax, rcx
ja 0x1400080d2
mov edx, ecx
lea rcx, [r13 + 0x890]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
mov dword [rbp - 0x74], esi
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._append
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006697
mov eax, 4
or dword [r13 + 0x40], eax
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._prealloc
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400066bb
or dword [r13 + 0x40], 0x20
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._delaycreate
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400066e2
or dword [r13 + 0x40], 0x1200
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140014eb8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006707
bts dword [r13 + 0x40], 0xd
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._guid
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400067ef
mov ebx, dword [rsp + 0x40]
lea r12d, [rax + 1]
cmp ebx, r12d
jle 0x1400080ba
lea rsi, [rdi + 8]
mov r9, qword [rsi]
cmp word [r9], 0x23
jne 0x14000676c
lea rcx, [r9 + 2]
lea rdx, [rbp + 0x2c0]
call fcn.14000164c
test al, al
je 0x1400080ef
mov rdi, rsi
mov dword [rsp + 0x60], r12d
sub ebx, r12d
jmp 0x1400080ba
cmp word [r9], 0x2a
jne 0x140006785
lea rcx, [r9 + 2]
lea rdx, [rbp + 0x2c0]
call fcn.14000a4cc
jmp 0x14000675c
movzx ecx, word [r9]
call fcn.1400014a4
test al, al
jne 0x1400080ba
mov r8d, 0x400
lea rcx, [rbp + 0x18c0]
mov rdx, r9
call qword [sym.imp.msvcrt.dll__wfullpath]
nop dword [rax + rax]
lea rdx, [rbp + 0x2c0]
mov rdi, rsi
lea rcx, [rbp + 0x18c0]
dec ebx
call fcn.140004494
mov dword [rsp + 0x60], eax
test eax, eax
js 0x140008110
jne 0x1400080ba
lea rdx, [rbp + 0x18c0]
lea rcx, str.ERROR:__ls_is_invalid._n
jmp 0x1400080fa
cmp byte [0x14001a6c8], r14b
je 0x140006c07
mov rcx, qword [rdi]
lea rdx, str._PidFilter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400068dc
cmp dword [rsp + 0x78], r14d
jne 0x140008129
mov ebx, dword [rsp + 0x40]
cmp ebx, 2
jle 0x1400068d0
add rdi, rsi
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
movzx r9d, ax
dec ebx
mov ecx, 7
mov dword [rsp + 0x78], r9d
lea eax, [r9 - 1]
cmp eax, ecx
ja 0x140008120
lea rax, [rbp + 0x2a0]
mov r15d, r14d
mov qword [rsp + 0x58], rax
lea r13d, [rcx - 6]
mov r12d, ebx
cmp r12d, r13d
jle 0x1400068c3
mov r8, qword [rdi + 8]
movzx ecx, word [r8]
call fcn.1400014a4
test al, al
jne 0x1400068c3
mov rcx, r8
call qword [sym.imp.msvcrt.dll__wtol]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea ebx, [r12 - 1]
mov r9d, dword [rsp + 0x78]
add rdi, rsi
add r15d, r13d
mov r12d, ebx
mov dword [rcx], eax
add rcx, 4
mov qword [rsp + 0x58], rcx
cmp r15d, r9d
jb 0x140006876
mov r13, qword [rbp - 0x60]
cmp r15d, r9d
je 0x1400080ba
lea rcx, str.ERROR:_Invalid_Pid_Filter_arguments._n
jmp 0x1400080d9
cmp byte [0x14001a6c8], r14b
je 0x140006c07
mov rcx, qword [rdi]
lea rdx, str._ExeFilter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000693d
mov ebx, dword [rsp + 0x40]
lea r8d, [rax + 1]
cmp ebx, r8d
jle 0x140008132
add rdi, rsi
mov rax, qword [rdi]
movzx ecx, word [rax]
call fcn.1400014a4
test al, al
jne 0x140008132
sub ebx, r8d
lea rdx, [rbp - 8]
lea r8, [0x140015098]
jmp 0x1400069f7
cmp byte [0x14001a6c8], r14b
je 0x140006c07
mov rcx, qword [rdi]
lea rdx, str._PkgIdFilter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000699b
mov ebx, dword [rsp + 0x40]
lea r8d, [rax + 1]
cmp ebx, r8d
jle 0x14000813b
add rdi, rsi
mov rax, qword [rdi]
movzx ecx, word [rax]
call fcn.1400014a4
test al, al
jne 0x14000813b
sub ebx, r8d
lea rdx, [rbp]
lea r8, str.Package_Id
jmp 0x1400069f7
cmp byte [0x14001a6c8], r14b
je 0x140006c07
mov rcx, qword [rdi]
lea rdx, str._PkgAppIdFilter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006a12
mov ebx, dword [rsp + 0x40]
lea r8d, [rax + 1]
cmp ebx, r8d
jle 0x140008144
add rdi, rsi
mov rax, qword [rdi]
movzx ecx, word [rax]
call fcn.1400014a4
test al, al
jne 0x140008144
sub ebx, r8d
lea rdx, [rbp - 0x10]
lea r8, str.Package_Relative_App_Id
mov rcx, qword [rdi]
call fcn.1400019e0
mov dword [rsp + 0x48], eax
mov esi, eax
test eax, eax
jne 0x140008500
jmp 0x1400080be
cmp byte [0x14001a6c8], r14b
je 0x140006c07
mov rcx, qword [rdi]
lea rdx, str._EventIdFilter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140006a57
mov rcx, qword [rdi]
lea rdx, str._StackWalkFilter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006c07
mov rcx, qword [rdi]
lea rax, str.Event_Id
mov qword [rbp + 0x20], rax
lea rdx, str._EventIdFilter
lea rax, str.Stack_Walk
mov qword [rbp + 0x28], rax
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006a95
mov rax, qword [rbp + 8]
lea rsi, [rbp + 0x20]
lea r12, [rbp + 8]
jmp 0x140006aa1
mov rax, qword [rbp + 0x10]
lea rsi, [rbp + 0x28]
lea r12, [rbp + 0x10]
mov qword [rsp + 0x58], r12
test rax, rax
jne 0x140008189
mov r15d, dword [rsp + 0x40]
mov eax, 3
cmp r15d, eax
jle 0x140006bec
mov ecx, 0x84
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov qword [r12], rax
mov rbx, rax
test rax, rax
je 0x14000817d
mov rcx, qword [rdi + 8]
lea rdx, [0x1400153c8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006b07
lea r12d, [rax + 1]
mov al, r12b
jmp 0x140006b2f
mov rcx, qword [rdi + 8]
lea rdx, str._out
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140008171
mov al, r14b
mov r12d, 1
mov byte [rbx], al
add rdi, 0x10
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov r8d, eax
mov ecx, 0x3f
sub ax, r12w
mov word [rbx + 2], r8w
lea ebx, [r15 - 2]
cmp ax, cx
ja 0x140008165
mov r12d, r14d
cmp r14w, r8w
jae 0x140006bdf
mov ecx, ebx
mov dword [rsp + 0x40], ebx
movzx eax, r8w
mov edx, 1
movzx r8d, ax
cmp ecx, edx
jle 0x140006bdf
mov r9, qword [rdi + 8]
movzx ecx, word [r9]
call fcn.1400014a4
test al, al
jne 0x140006bdf
mov rcx, r9
call qword [sym.imp.msvcrt.dll__wtol]
nop dword [rax + rax]
mov edx, eax
cmp eax, 0xffff
jae 0x14000814d
mov rax, qword [rsp + 0x58]
add rdi, 8
mov ebx, dword [rsp + 0x40]
dec ebx
mov dword [rsp + 0x40], ebx
mov rcx, qword [rax]
mov eax, r12d
inc r12d
mov word [rcx + rax*2 + 4], dx
movzx eax, word [rcx + 2]
mov ecx, ebx
movzx r8d, ax
cmp r12d, eax
jb 0x140006b75
movzx eax, r8w
cmp r12d, eax
je 0x1400080ba
lea rcx, str.ERROR:_Invalid__ls_Filter_arguments._n
mov rdx, qword [rsi]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400080e5
mov rcx, qword [rdi]
lea rdx, str._QpcDelta
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006c80
and qword [rbp + 0x18], 0
lea rdx, [rbp + 0x18]
xor r9d, r9d
lea ecx, [rax + 0x1f]
mov r8d, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jne 0x140008195
cmp dword [rbp + 0x1c], 0x46
jb 0x140006c68
mov eax, 2
mov byte [r13 + 0x78], al
bts dword [r13 + 0x2c], 0x17
or dword [r13 + 0x88], eax
jmp 0x140006591
lea rcx, str.WARNING:_Kernel_version_does_not_support_QPC_Delta_Tracking._n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._LargePageBuffers
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006cdb
and qword [rbp - 0x40], 0
lea rdx, [rbp - 0x40]
xor r9d, r9d
lea ecx, [rax + 0x1f]
mov r8d, esi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jne 0x1400081b3
cmp dword [rbp - 0x3c], 0x50
jb 0x140006cd2
mov byte [r13 + 0x78], 2
mov eax, 4
jmp 0x140006c56
lea rcx, str.WARNING:_Kernel_version_does_not_support_MDL_allocated_trace_buffers._n
jmp 0x140006c6f
mov rcx, qword [rdi]
lea rdx, str._sessionguid
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006d3c
mov ebx, dword [rsp + 0x40]
lea r12d, [rax + 1]
cmp ebx, r12d
jle 0x1400080ba
mov rcx, qword [rdi + 8]
cmp word [rcx], 0x23
jne 0x1400080ba
add rcx, 2
lea rdx, [rbp + 0x88]
call fcn.14000164c
movups xmm0, xmmword [rbp + 0x88]
movdqu xmmword [r13 + 0x18], xmm0
add rdi, rsi
sub ebx, r12d
jmp 0x1400080ba
mov rcx, qword [rdi]
lea rdx, str._secure
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006d61
bts dword [r13 + 0x40], 7
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._UsePerfCounter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006d87
lea ebx, [rax + 1]
mov dword [r13 + 0x28], ebx
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._UseSystemTime
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006dae
mov dword [r13 + 0x28], 2
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._UseCPUCycle
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006dd6
mov eax, 3
mov dword [r13 + 0x28], eax
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._seq
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006e1f
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
or dword [r13 + 0x40], esi
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [r13 + 0x3c], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._newfile
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006e4f
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
or dword [r13 + 0x40], 8
jmp 0x140006e03
mov rcx, qword [rdi]
lea rdx, str._batched
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006e74
bts dword [r13 + 0x40], 0x12
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._cir
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006ea7
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
or dword [r13 + 0x40], 2
jmp 0x140006e03
mov rcx, qword [rdi]
lea rdx, [0x1400157f4]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006f1d
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
cmp byte [0x14001a6bc], r14b
jne 0x140006f14
cmp byte [0x14001a6b3], r14b
je 0x140006f14
lea r15d, [rsi + 2]
cmp eax, r15d
jbe 0x140006f14
lea rcx, str.Kernel_Debugging_has_been_enabled:_Buffer_size_has_been_set_to_3kBytes_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, r15d
mov dword [r13 + 0x30], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._enableproperty
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006f77
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
movzx eax, word [rcx + 2]
sub ax, 0x58
test r15w, ax
je 0x140006f69
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
jmp 0x140006f6e
call fcn.1400015a0
or dword [rsp + 0x70], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._sourceguid
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006fc2
mov ebx, dword [rsp + 0x40]
lea r12d, [rax + 1]
cmp ebx, r12d
jle 0x1400080ba
mov rcx, qword [rdi + 8]
cmp word [rcx], 0x23
jne 0x1400080ba
add rcx, 2
lea rdx, [rbp + 0x60]
call fcn.14000164c
jmp 0x140006d31
mov rcx, qword [rdi]
lea rdx, str._matchanykw
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000701c
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
movzx eax, word [rcx + 2]
sub ax, 0x58
test r15w, ax
je 0x14000700e
call qword [sym.imp.msvcrt.dll__wtoi64]
nop dword [rax + rax]
jmp 0x140007013
call fcn.1400015a0
or qword [rbp - 0x58], rax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._matchallkw
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007076
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
movzx eax, word [rcx + 2]
sub ax, 0x58
test r15w, ax
je 0x140007068
call qword [sym.imp.msvcrt.dll__wtoi64]
nop dword [rax + rax]
jmp 0x14000706d
call fcn.1400015a0
or qword [rbp - 0x48], rax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._flag
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000806d
mov rcx, qword [rdi]
lea rdx, str._flags
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000806d
mov rcx, qword [rdi]
lea rdx, str._eflag
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140007f22
mov rcx, qword [rdi]
lea rdx, str._eflags
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140007f22
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._systemrundown
call fcn.140005e9c
test al, al
je 0x14000711c
mov eax, 0xf
jmp 0x140007148
lea rax, [rsp + 0x48]
mov r9, r12
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, str._preserve
call fcn.140005e9c
test al, al
je 0x140007167
mov eax, 0x10
mov word [rsp + 0x50], ax
mov esi, dword [rsp + 0x48]
test esi, esi
jne 0x140008500
mov rdi, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x40]
jmp 0x1400080be
mov rdi, qword [rsp + 0x58]
lea rdx, str._systemlogger
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007191
bts dword [r13 + 0x40], 0x19
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._dpcisr
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007202
cmp byte [0x14001a6b0], r14b
je 0x1400071cc
lea rcx, str.Option__dpcisr_cannot_be_used_when_extended_flags_are_already_used._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140006591
xorps xmm0, xmm0
mov qword [0x14001b150], r14
mov ebx, 1
mov dword [0x14001b138], 0x307
movdqu xmmword [0x14001b140], xmm0
mov byte [0x14001a6b0], bl
mov dword [0x14001b13c], 0x4084
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._pids
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400072f3
mov ebx, dword [rsp + 0x40]
cmp ebx, 2
jle 0x1400080ba
add rdi, rsi
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov esi, 1
dec ebx
mov ecx, eax
sub ax, si
cmp ax, si
ja 0x1400081bc
movzx eax, cx
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x58], eax
test eax, eax
je 0x1400072da
mov r15d, ebx
lea r12, [0x14001a6d0]
lea r14d, [rsi + 0x2c]
cmp r15d, esi
jle 0x1400072d3
mov rcx, qword [rdi + 8]
mov edx, 0xfffd
movzx eax, word [rcx]
sub ax, r14w
test dx, ax
je 0x1400072ce
call qword [sym.imp.msvcrt.dll__wtol]
nop dword [rax + rax]
mov dword [r12], eax
mov r13d, 1
mov eax, dword [rsp + 0x40]
lea ebx, [r15 - 1]
add dword [0x14001a6c4], r13d
add eax, r13d
add rdi, 8
mov dword [rsp + 0x40], eax
add r12, 4
mov esi, r13d
mov r15d, ebx
cmp eax, dword [rsp + 0x58]
jb 0x140007272
jmp 0x1400072d3
mov esi, 1
mov r13, qword [rbp - 0x60]
xor r14d, r14d
cmp dword [0x14001a6c4], r14d
jbe 0x1400080ba
mov byte [0x14001a6bd], sil
jmp 0x1400080ba
mov rcx, qword [rdi]
lea rdx, str._StackWalk
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000739d
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x140007385
add rdi, 8
lea rcx, [rbp + 0x18c0]
mov r8d, 0x400
mov rdx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wfullpath]
nop dword [rax + rax]
lea rcx, [rbp + 0x18c0]
call fcn.140005a74
mov dword [0x14001a6b8], eax
test eax, eax
jne 0x14000736f
mov rcx, qword [rdi]
lea r8d, [rsi + 0x3f]
lea rdx, [0x14001a7f0]
call fcn.140001d24
mov dword [0x14001a6b8], eax
test eax, eax
je 0x14000737b
mov byte [0x14001a6bf], sil
jmp 0x1400065ff
mov dword [rsp + 0x4c], r14d
jmp 0x1400065ff
lea rcx, str.ERROR:_No_events_specified_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
jmp 0x1400080ba
mov rcx, qword [rdi]
lea rdx, str._ProfileSource
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140007e47
mov rcx, qword [rdi]
lea rdx, str._ProfileSources
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140007e47
mov rcx, qword [rdi]
lea rdx, str._SetProfInt
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000745f
mov ebx, dword [rsp + 0x40]
mov eax, 1
mov rsi, r14
cmp ebx, eax
jle 0x1400081d1
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov r9d, eax
dec ebx
mov eax, 1
cmp ebx, eax
jle 0x140007442
mov r8, qword [rdi + 8]
movzx ecx, word [r8]
call fcn.1400014a4
test al, al
jne 0x140007442
add rdi, 8
mov rsi, r8
dec ebx
mov edx, r9d
mov rcx, rsi
call fcn.140005cc8
test al, al
je 0x1400081c8
mov dword [rsp + 0x4c], r14d
jmp 0x1400080ba
mov rcx, qword [rdi]
lea rdx, str._Pmc
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400074a6
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
lea rdx, [0x14001a6e0]
mov rcx, qword [rdi]
call fcn.140001e74
mov byte [0x14001a6be], al
jmp 0x1400065ff
cmp byte [0x14001a6b1], r14b
je 0x1400075bc
mov rcx, qword [rdi]
lea rdx, str._Lbr
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007573
mov ebx, dword [rsp + 0x40]
lea r12d, [rax + 1]
cmp ebx, r12d
jle 0x1400080ba
add rdi, rsi
mov qword [rsp + 0x58], r14
lea r8, [rsp + 0x58]
mov r15b, r12b
lea rdx, [0x14000eb4c]
mov rsi, qword [rdi]
mov rcx, rsi
mov dword [0x14001b100], r14d
mov dword [0x14001b114], r14d
call fcn.1400014e4
test rax, rax
jne 0x14000751d
mov r15b, r14b
mov rax, rsi
mov r8d, 4
lea rdx, [0x14001b104]
mov rcx, rax
call fcn.140001d24
mov dword [0x14001b114], eax
test eax, eax
jne 0x140007541
mov al, r14b
jmp 0x140007568
test r15b, r15b
je 0x140007565
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, [0x14000eb4c]
call fcn.1400014e4
mov rcx, rax
call fcn.1400020cc
test al, al
je 0x14000753c
mov rax, r12
mov byte [0x14001a6c1], al
jmp 0x140006d34
cmp byte [0x14001a6b1], r14b
je 0x1400075bc
mov rcx, qword [rdi]
lea rdx, str._Ipt
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400075bc
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call fcn.140002694
mov byte [0x14001a6b2], al
jmp 0x1400065ff
cmp byte [0x14001a6bc], r14b
je 0x140007603
mov rcx, qword [rdi]
lea rdx, str._ObjectTypeFilter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007603
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
lea rcx, [rbp + 0x70]
mov rdx, qword [rdi]
call fcn.1400018fc
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._StackCache
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140007e3b
mov rcx, qword [rdi]
lea rdx, str._StackCaching
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140007e3b
mov rcx, qword [rdi]
lea rdx, str._heap
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000766b
movups xmm0, xmmword [0x1400176e0]
movdqu xmmword [r13 + 0x18], xmm0
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._critsec
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000768e
movups xmm0, xmmword [0x1400176b0]
jmp 0x140007660
mov rcx, qword [rdi]
lea rdx, [0x140015d90]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400076b3
bts dword [r13 + 0x40], 0xf
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140015d98]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400076d8
bts dword [r13 + 0x40], 0xe
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._min
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000771d
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [r13 + 0x34], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._max
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007762
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [r13 + 0x38], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._level
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400077be
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
movzx eax, word [rcx + 2]
sub ax, 0x58
test r15w, ax
je 0x1400077ae
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
jmp 0x1400077b6
call fcn.1400015a0
movzx eax, al
mov dword [rbp - 0x68], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, [0x140015dd0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007825
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
lea rdx, [0x140010204]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
je 0x14000780d
lea eax, [rsi + 0xf]
or dword [r13 + 0x40], eax
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [r13 + 0x44], eax
jmp 0x1400065ff
cmp byte [0x14001a6c8], r14b
je 0x140007873
mov rcx, qword [rdi]
lea rdx, [0x140015dd8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007873
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [r13 + 0x4c], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, [0x140015de0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007898
bts dword [r13 + 0x40], 0xb
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._paged
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400078bd
bts dword [r13 + 0x40], 0x18
jmp 0x140006591
cmp byte [0x14001a6bc], r14b
je 0x1400078eb
mov rcx, qword [rdi]
lea rdx, str._addtotriagedump
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400078eb
bts dword [r13 + 0x40], 0x1f
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._LoggerMode
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140007df9
mov rcx, qword [rdi]
lea rdx, str._LogFileMode
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140007df9
mov rcx, qword [rdi]
lea rdx, [0x140015e58]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000798b
bts dword [r13 + 0x40], 8
lea esi, [rax + 1]
mov ebx, dword [rsp + 0x40]
cmp ebx, esi
jle 0x1400080ba
lea r8, [rdi + 8]
mov rax, qword [r8]
movzx ecx, word [rax]
call fcn.1400014a4
test al, al
jne 0x1400080ba
mov rax, qword [r8]
sub ebx, esi
mov rdi, r8
cmp word [rax], 0x62
jne 0x1400080ba
lea rcx, str.The__rt_b_option_is_no_longer_valid._It_has_been_replaced_by__buffering._n
jmp 0x1400080d9
cmp byte [0x14001a6c8], r14b
je 0x1400079b9
mov rcx, qword [rdi]
lea rdx, str._independent
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400079b9
bts dword [r13 + 0x40], 0x1b
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140015f18]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400079fb
bts dword [r13 + 0x40], 0x13
cmp byte [0x14001a6bc], r14b
jne 0x1400079eb
mov eax, 3
mov dword [r13 + 0x30], eax
mov ebx, 1
mov byte [0x14001a6b3], bl
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._buffering
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007a20
bts dword [r13 + 0x40], 0xa
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._lowcapacity
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007a45
bts dword [r13 + 0x40], 0x1c
jmp 0x140006591
cmp byte [0x14001a6bc], r14b
je 0x140007ac9
mov rcx, qword [rdi]
lea rdx, str._HybridShutdown
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007ac9
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
lea rdx, str.stop
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007aa0
bts dword [r13 + 0x40], 0x16
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str.persist
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x1400065ff
bts dword [r13 + 0x40], 0x17
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._age
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007b0d
mov ebx, dword [rsp + 0x40]
mov eax, 1
cmp ebx, eax
jle 0x140007af5
add rdi, rsi
sub ebx, eax
lea rcx, str.Option__age_has_no_effect_on_this_version_of_Windows__and_has_been_ignored._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400080ba
mov rcx, qword [rdi]
lea rdx, str._timeout
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007b51
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [rbp - 0x24], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._delay
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007b95
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [rbp - 0x20], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, str._filter
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007bd2
mov ebx, dword [rsp + 0x40]
lea esi, [rax + 1]
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call fcn.1400015a0
mov dword [rbp - 0x50], eax
jmp 0x1400065ff
mov rcx, qword [rdi]
lea rdx, [0x140016088]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007bff
mov eax, 4
mov dword [rbp - 0x6c], r14d
mov word [rsp + 0x50], ax
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140016090]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007c2f
mov eax, 4
mov dword [rbp - 0x6c], 1
mov word [rsp + 0x50], ax
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140016098]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007c61
mov eax, 4
mov word [rsp + 0x50], ax
lea ebx, [rax - 3]
mov dword [rbp - 0x6c], ebx
mov dword [rbp - 0x28], ebx
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._noprocess
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007c84
mov dword [rbp - 0x34], r14d
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._nothread
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007ca7
mov dword [rbp - 0x30], r14d
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._nodisk
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007cca
mov dword [rbp - 0x38], r14d
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._nonet
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007ced
mov dword [rbp - 0x2c], r14d
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._fio
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007d10
bts dword [rbx], 9
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140016100]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007d33
bts dword [rbx], 0xc
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140016108]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007d56
bts dword [rbx], 0xd
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, str._img
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007d7c
mov eax, 4
or dword [rbx], eax
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140016120]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007d9f
bts dword [rbx], 0x11
jmp 0x140006591
mov rcx, qword [rdi]
lea rdx, [0x140016128]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007dc5
mov dword [rbp - 0x4c], 1
jmp 0x140006591
mov rax, qword [rdi]
movzx ecx, word [rax + 2]
sub cx, 0x3f
cmp cx, 0x29
ja 0x140007dea
movabs rax, 0x20000000201
bt rax, rcx
jb 0x1400081e6
mov eax, 0xb
mov word [rsp + 0x50], ax
jmp 0x140006591
mov ebx, dword [rsp + 0x40]
mov esi, 1
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
movzx eax, word [rcx + 2]
sub ax, 0x58
test r15w, ax
je 0x140007e2d
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
jmp 0x140007e32
call fcn.1400015a0
or dword [r13 + 0x40], eax
jmp 0x1400065ff
mov dword [rbp - 0x78], 1
jmp 0x140006591
mov ebx, dword [rsp + 0x40]
mov esi, 1
cmp ebx, esi
jle 0x140007f0a
cmp byte [0x14001a6c0], r14b
jne 0x140007e9b
mov rax, qword [0x14001a8f8]
test rax, rax
je 0x1400081f6
lea r9d, [rsi + 3]
mov qword [rsp + 0x20], r14
lea r8, [0x14001a6b4]
xor ecx, ecx
lea edx, [rsi + 0x15]
call qword [0x14000c480]
test eax, eax
jne 0x1400081ed
mov byte [0x14001a6c0], sil
mov ecx, dword [0x14001a6b4]
shl rcx, 2
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x140008243
add rdi, 8
lea r8, [rbp - 0x70]
mov r9b, sil
mov rdx, rax
mov rcx, qword [rdi]
call fcn.140001aac
test al, al
je 0x140008213
mov edx, dword [rbp - 0x70]
test edx, edx
je 0x14000822c
mov rcx, r15
call fcn.140005c18
test al, al
je 0x140008213
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x1400065ff
lea rcx, str.ERROR:_No_profile_source_specified_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
jmp 0x140007455
cmp byte [0x14001a6bc], r14b
je 0x140007f31
bts dword [r13 + 0x40], 0x19
mov ebx, dword [rsp + 0x40]
mov esi, 1
cmp ebx, esi
jle 0x140007f83
lea rsi, [rdi + 8]
mov rax, qword [rsi]
movzx ecx, word [rax]
call qword [sym.imp.msvcrt.dll_iswalpha]
nop dword [rax + rax]
test eax, eax
je 0x140007f7e
mov rcx, qword [rsi]
call fcn.1400037f4
test eax, eax
je 0x1400080e5
mov edi, 1
dec ebx
mov byte [0x14001a6b0], dil
mov rdi, rsi
jmp 0x1400080ba
mov esi, 1
cmp ebx, 2
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
dec ebx
mov edx, 7
mov ecx, eax
sub ax, si
cmp ax, dx
ja 0x140008260
movzx eax, cx
xorps xmm0, xmm0
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x58], eax
movups xmmword [0x14001b138], xmm0
movups xmmword [0x14001b148], xmm0
test eax, eax
je 0x14000803a
mov r15d, ebx
lea r12, [0x14001b138]
lea r13d, [rdx + 0x26]
mov r14d, 0xfffd
cmp r15d, esi
jle 0x140008033
mov rcx, qword [rdi + 8]
movzx eax, word [rcx]
sub ax, r13w
test r14w, ax
je 0x14000802e
call fcn.1400015a0
mov dword [r12], eax
lea ebx, [r15 - 1]
mov eax, dword [rsp + 0x40]
mov esi, 1
add eax, esi
add rdi, 8
add r12, 4
mov dword [rsp + 0x40], eax
mov r15d, ebx
cmp eax, dword [rsp + 0x58]
jb 0x140007fe9
jmp 0x140008033
mov esi, 1
mov r13, qword [rbp - 0x60]
xor r14d, r14d
mov eax, dword [0x14001b13c]
test al, 2
jne 0x14000804a
bt eax, 0xa
jae 0x140008064
xorps xmm0, xmm0
lea rcx, [rbp + 0x30]
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x50], rax
movups xmmword [rbp + 0x40], xmm0
call fcn.140002900
mov byte [0x14001a6b0], sil
jmp 0x1400080ba
mov ebx, dword [rsp + 0x40]
mov esi, 1
cmp ebx, esi
jle 0x1400080ba
add rdi, 8
mov rcx, qword [rdi]
movzx eax, word [rcx + 2]
sub ax, 0x58
test r15w, ax
je 0x14000809f
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
cdqe
jmp 0x1400080a4
call fcn.1400015a0
or rax, qword [rbp - 0x58]
sub ebx, esi
mov qword [rbp - 0x58], rax
test rax, 0xffffffff80000000
jne 0x14000826c
mov esi, dword [rsp + 0x48]
dec ebx
lea r12, [r13 + 0x90]
mov dword [rsp + 0x40], ebx
test ebx, ebx
jmp 0x1400062ab
lea rcx, str.ERROR:_Log_File_Name_too_long._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov esi, 0x57
jmp 0x140008500
mov rdx, qword [rdi + 8]
lea rcx, str.ERROR:__ls_is_an_invalid_guid._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov esi, 0x57
jmp 0x140008506
lea rdx, [rbp + 0x18c0]
lea rcx, str.ERROR:__ls_does_no_exist._n
jmp 0x1400080fa
lea rcx, str.ERROR:_Invalid_number_of_Pids_in_Pid_Filter._n
jmp 0x1400080d9
lea rcx, str.ERROR:_Multiple_Pid_Filters._n
jmp 0x1400080d9
lea rcx, str.ERROR:_Invalid_Exe_Filter_arguments._n
jmp 0x1400080d9
lea rcx, str.ERROR:_Invalid_Package_Id_Filter_arguments._n
jmp 0x1400080d9
lea rcx, str.ERROR:_Invalid_Package_Relative_App_Id_Filter_arguments._n
jmp 0x1400080d9
mov r8, qword [rsi]
lea rcx, str.ERROR:_Invalid_EventId__d_in__ls_Filter._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400080e5
mov rdx, qword [rsi]
lea rcx, str.ERROR:_Invalid_number_of_EventIds_in__ls_Filter._n
jmp 0x1400080fa
lea rcx, str.ERROR:__ls_Filter_requires__in_or__out_argument._n
jmp 0x140006bf3
lea rcx, str.ERROR:_Not_enough_memory_to_allocate__ls_filter_n
jmp 0x140006bf3
lea rcx, str.ERROR:_Multiple__ls_Filters._n
jmp 0x140006bf3
lea rcx, str.Error:_Failed_to_query_whether_kernel_supports__QpcDelta__with_error__x._n
mov edx, eax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov esi, dword [rsp + 0x48]
jmp 0x140008500
lea rcx, str.Error:_Failed_to_query_whether_kernel_supports__LargeMdlPages__with_error__x._n
jmp 0x14000819c
lea rcx, str.ERROR:_Invalid_number_of_Pids._n
jmp 0x1400080d9
lea rcx, str.ERROR:_Failed_to_set_profile_interval_n
jmp 0x1400081d8
lea rcx, str.ERROR:_Profile_Interval_is_not_specified_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
jmp 0x140008209
call fcn.140004948
jmp 0x1400081aa
lea rcx, str.ERROR:_Failed_to_query_the_max_number_of_PMC_counter._n
jmp 0x1400081fd
lea rcx, [0x14000eb50]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, 0x57
jmp 0x1400085d2
lea rcx, str.ERROR:_Unsupported_profile_source_specified_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov r14d, 0x57
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov eax, r14d
jmp 0x1400085d2
lea rcx, str.Failed_to_allocate_space_for_profiling_source_counter._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, 0x7a
jmp 0x1400085d2
lea rcx, str.ERROR:_Invalid_number_of_enable_flags._n
jmp 0x1400080d9
mov r8, rax
lea rcx, str.Invalid_Flags:_0x_0llX__llu_._n
mov rdx, rax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400080e5
mov rdx, r8
lea rcx, str.Invalid_option_given:__ls_n
jmp 0x140006bf6
lea rdx, str.NT_Kernel_Logger
mov rcx, r12
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1400082f9
cmp dword [rbp - 0x34], r14d
je 0x1400082b9
mov eax, 1
or dword [rbx], eax
cmp dword [rbp - 0x30], r14d
je 0x1400082c2
or dword [rbx], 2
cmp dword [rbp - 0x38], r14d
je 0x1400082cc
bts dword [rbx], 8
cmp dword [rbp - 0x2c], r14d
je 0x1400082d6
bts dword [rbx], 0x10
cmp dword [r13 + 0x30], 0x40
movups xmm0, xmmword [0x1400176f0]
movdqu xmmword [r13 + 0x18], xmm0
jae 0x1400082f2
mov dword [r13 + 0x30], 0x40
mov dword [rbp - 0x7c], 1
lea rdx, str.GlobalLogger
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000832d
movups xmm0, xmmword [0x1400176d0]
mov eax, 3
mov r15d, eax
mov dword [rbp - 0x7c], eax
movdqu xmmword [r13 + 0x18], xmm0
jmp 0x140008367
lea rdx, str.WMI_Event_Logger
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
mov eax, 3
jne 0x140008363
movups xmm0, xmmword [0x1400176c0]
lea r15d, [rax - 1]
mov dword [rbp - 0x7c], r15d
movdqu xmmword [r13 + 0x18], xmm0
jmp 0x140008367
mov r15d, dword [rbp - 0x7c]
test dword [r13 + 0x40], 0x500
lea rbx, [r13 + 0x890]
jne 0x1400083f0
cmp r15d, eax
je 0x1400083f0
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r14w
jne 0x140008381
mov edi, dword [rsp + 0x50]
test rax, rax
jne 0x1400083f4
mov eax, 1
cmp di, ax
jne 0x1400083f4
mov rdx, rbx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
cmp eax, 0x400
jae 0x1400083db
mov edx, 0x400
lea r8, str.LogFile.Etl
sub edx, eax
mov eax, eax
lea rcx, [rbx + rax*2]
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
jmp 0x1400083f4
lea rcx, str.Failed_to_get_current_directory_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400083f4
mov edi, dword [rsp + 0x50]
cmp dword [rbp - 0x74], r14d
je 0x140008454
mov ecx, 7
cmp di, cx
jne 0x140008454
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov r8, r13
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140008433
mov rdx, r12
lea rcx, str.Logger_Session__s_not_found
jmp 0x140006bf6
test dword [r13 + 0x40], 0x400
jne 0x140008454
lea rcx, str.The_option__f_is_ignored_as_it_is_not_a_buffering_mode_trace_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov word [rbx], r14w
movzx ecx, di
mov eax, 7
cmp ecx, eax
ja 0x140008ed2
je 0x140008dbb
test ecx, ecx
je 0x140008dbb
sub ecx, 1
je 0x140008a25
sub ecx, 1
je 0x14000889e
sub ecx, 1
je 0x140008dbb
sub ecx, 1
je 0x1400085fd
sub ecx, 1
je 0x14000959e
cmp ecx, 1
jne 0x140008f3c
call fcn.140004948
mov edi, dword [rsp + 0x4c]
mov ebx, 1
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x1400084cb
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
test edi, edi
je 0x140008500
mov eax, dword [rsp + 0x50]
mov ecx, 0xc
cmp ax, cx
ja 0x1400084e7
mov ecx, 0x1950
bt ecx, eax
jb 0x140008500
mov eax, dword [rbp - 0x4c]
mov r9d, ebx
mov edx, dword [rsp + 0x74]
mov r8d, esi
mov rcx, r13
mov dword [rsp + 0x20], eax
call fcn.140003c54
mov r12d, 1
mov edi, 2
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14000852e
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140008543
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140008558
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
lea rbx, [rbp + 8]
cmp qword [rbx], r14
je 0x140008570
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
add rbx, 8
sub rdi, r12
jne 0x14000855c
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [0x14001a8f0]
test rcx, rcx
je 0x1400085a0
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov rcx, qword [0x14001b158]
test rcx, rcx
je 0x1400085b8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
mov rcx, qword [0x14001a6e0]
test rcx, rcx
je 0x1400085d0
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x20c0]
xor rcx, rsp
call fcn.14000ae40
mov rbx, qword [rsp + 0x2220]
add rsp, 0x21d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x41e00
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov qword [rbp - 0x40], rax
mov r15, rax
test rax, rax
jne 0x140008626
mov esi, 0xe
jmp 0x1400084ad
mov r8, rbx
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
mov edx, 0x40
lea r8, [rbp + 0x10c0]
mov rcx, r15
mov r9d, edx
lea r13d, [rdx - 0x3f]
mov dword [rcx], 0x1078
mov dword [rcx + 0x70], 0x878
mov dword [rcx + 0x74], 0x78
mov qword [r8], rcx
lea r8, [r8 + 8]
mov eax, dword [rcx]
add rcx, rax
sub r9, r13
jne 0x140008649
lea r8, [rbp - 0x74]
lea rcx, [rbp + 0x10c0]
call qword [sym.imp.ADVAPI32.dll_QueryAllTracesW]
nop dword [rax + rax]
mov r13, qword [rbp - 0x60]
mov esi, eax
test eax, eax
jne 0x14000888a
mov edi, r14d
cmp dword [rbp - 0x74], r14d
jbe 0x14000888a
mov r13d, dword [rbp - 0x6c]
mov edx, 0x79
mov r15d, dword [rbp - 0x28]
lea r8d, [rdx - 0xb]
mov eax, 0x3f
mov r12d, edi
mov word [rsp + 0x48], ax
movzx ecx, ax
mov dword [rsp + 0x78], r14d
mov rax, qword [rbp + r12*8 + 0x10c0]
mov ebx, dword [rax + 0x74]
add rbx, rax
test r13d, r13d
je 0x140008825
test r15d, r15d
jne 0x14000876a
cmp cx, r8w
je 0x140008772
mov rdx, rbx
lea rcx, str.Do_you_want_to_stop_the___ls__session__Y_or_N__
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x48]
lea rcx, [0x140016c10]
call qword [sym.imp.msvcrt.dll_wscanf_s]
nop dword [rax + rax]
movzx ecx, word [rsp + 0x48]
dec eax
cmp eax, 0xfffffffd
ja 0x14000874c
cmp cx, 0x59
je 0x14000875e
mov r8d, 0x6e
cmp cx, 0x4e
jne 0x140008752
mov ecx, r8d
mov word [rsp + 0x48], cx
jmp 0x140008752
mov r8d, 0x6e
mov edx, 0x79
cmp cx, dx
je 0x14000877b
jmp 0x1400086e6
mov eax, 0x79
mov word [rsp + 0x48], ax
jmp 0x14000877b
movzx ecx, dx
mov word [rsp + 0x48], dx
cmp cx, dx
jne 0x14000880a
mov r8, qword [rbp + r12*8 + 0x10c0]
lea r9, [r8 + 0x18]
mov rax, qword [r9]
cmp rax, qword [0x1400176f0]
jne 0x1400087a0
mov rax, qword [r9 + 8]
cmp rax, qword [0x1400176f8]
je 0x1400087d1
mov rax, qword [r8 + 8]
xor ecx, ecx
mov qword [rsp + 0x68], rax
mov edx, dword [r8 + 0x40]
xor r8d, r8d
and edx, 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_EnableTrace]
nop dword [rax + rax]
mov r8, qword [rbp + r12*8 + 0x10c0]
mov r9d, 1
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
mov rdx, rbx
lea rcx, str.The___ls__session_has_been_stopped_n
mov esi, eax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov dword [rsp + 0x78], 1
jmp 0x140008825
mov rdx, rbx
lea rcx, str.The___ls__session_has_not_been_stopped__current_Status_is_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov dword [rsp + 0x78], r14d
cmp edi, 1
jne 0x14000883d
lea rdx, str.NT_Kernel_Logger
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x14000886e
mov eax, dword [rbp - 0x4c]
mov r8d, esi
mov r9d, dword [rsp + 0x78]
xor edx, edx
mov rcx, qword [rbp + r12*8 + 0x10c0]
mov dword [rsp + 0x20], eax
call fcn.140003c54
lea rcx, [0x14000f488]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, 0x79
inc edi
lea r8d, [rdx - 0xb]
cmp edi, dword [rbp - 0x74]
jb 0x1400086b1
mov r13, qword [rbp - 0x60]
mov r15, qword [rbp - 0x40]
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x1400084ad
mov edi, dword [rsp + 0x60]
mov ebx, 0x800
test dword [r13 + 0x40], ebx
je 0x1400088e0
mov eax, 1
cmp edi, eax
je 0x1400088d3
lea rcx, str.Need_exactly_one_GUID_for_PRIVATE_loggers_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov esi, 0x57
jmp 0x1400084ad
movaps xmm0, xmmword [rbp + 0x2c0]
movdqu xmmword [r13 + 0x18], xmm0
mov eax, 3
cmp r15d, eax
jne 0x140008902
lea rdx, [r13 + 0x28]
mov rcx, r13
lea r9, str.GlobalLogger
lea r8, [rsp + 0x74]
call fcn.140005290
test edi, edi
jle 0x1400089fb
mov rcx, qword [rbp + 0x2c0]
cmp qword [0x1400176e0], rcx
mov rax, qword [rbp + 0x2c8]
jne 0x14000892e
cmp qword [0x1400176e8], rax
je 0x1400089fb
cmp qword [0x1400176b0], rcx
jne 0x140008944
cmp qword [0x1400176b8], rax
je 0x1400089fb
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov r8, r13
mov rdx, r12
test dword [r13 + 0x40], ebx
je 0x140008998
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
jne 0x1400084ad
mov rax, qword [r13 + 8]
lea r9, [rbp + 0x2c0]
xor r8d, r8d
mov qword [rsp + 0x68], rax
mov edx, ebx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_EnableTrace]
nop dword [rax + rax]
jmp 0x1400089fb
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0x1069
je 0x1400084ad
mov rax, qword [r13 + 8]
mov qword [rsp + 0x68], rax
test edi, edi
je 0x1400089fb
lea rbx, [rbp + 0x2c0]
mov r12d, 1
mov rax, qword [rsp + 0x68]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_EnableTrace]
nop dword [rax + rax]
add rbx, 0x1c
sub rdi, r12
jne 0x1400089cb
lea r12, [r13 + 0x90]
mov rcx, qword [rsp + 0x68]
mov ebx, 1
mov r9d, ebx
mov r8, r13
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
mov esi, eax
mov edi, dword [rsp + 0x4c]
jmp 0x1400084b6
test dword [r13 + 0x40], 0x800
je 0x140008a4b
mov eax, 1
cmp dword [rsp + 0x60], eax
jne 0x1400088b6
movaps xmm0, xmmword [rbp + 0x2c0]
movdqu xmmword [r13 + 0x18], xmm0
test byte [r13 + 0x40], 8
je 0x140008ae1
mov esi, 0x25
mov rcx, rbx
mov edx, esi
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov edx, esi
lea rcx, [r13 + 0x890]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
cmp rax, rbx
jne 0x140008aab
lea rbx, [r13 + 0x890]
mov rcx, rbx
lea rdx, [0x140016308]
call qword [sym.imp.msvcrt.dll_wcsstr]
nop dword [rax + rax]
test rax, rax
jne 0x140008ac8
lea rcx, str._n_nNeed_to_have___d_in_file_name_when_NEWFILE_mode_is_used_n_n_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov esi, 0x7b
jmp 0x1400084ad
test byte [r13 + 0x40], 8
je 0x140008ae1
cmp dword [r13 + 0x3c], r14d
jne 0x140008ae1
lea rcx, str.Need_file_size_for_preallocated_log_file_n
jmp 0x1400088bd
mov eax, 3
cmp r15d, eax
jne 0x140008b2a
mov r8d, dword [r13 + 0x28]
lea r9, str.GlobalLogger
mov rdx, r13
lea ecx, [rax - 2]
call fcn.140004a64
mov esi, eax
test eax, eax
jne 0x1400084ad
lea r9, str.GlobalLogger
lea r8, [rsp + 0x74]
mov rcx, r13
lea rdx, [r13 + 0x28]
call fcn.140005290
mov esi, eax
jmp 0x1400084ad
mov rcx, r13
call fcn.140005180
cmp dword [r13 + 0x48], r14d
jge 0x140008b72
mov rcx, qword [rbp + 0x2c0]
cmp qword [0x1400176b0], rcx
mov rax, qword [rbp + 0x2c8]
jne 0x140008b58
cmp qword [0x1400176b8], rax
je 0x140008b6a
cmp qword [0x1400176e0], rcx
jne 0x140008b72
cmp qword [0x1400176e8], rax
jne 0x140008b72
mov qword [r13 + 8], 0x1000001
mov r8, r13
lea rcx, [rsp + 0x68]
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_StartTraceW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140008bd9
mov ecx, eax
call fcn.140003200
mov r9, rax
lea rcx, str.Could_not_start_logger:__ls_nOperation_Status:________uL_n_ls
mov r8d, esi
mov rdx, r12
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp esi, 0x20
jne 0x1400084ad
mov rdx, rbx
lea rcx, str.This_error_is_most_commonly_caused_when_file__lsis_in_use_by_another_logger._n
mov edi, r14d
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400084b1
lea rcx, str.Logger_Started..._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp byte [0x14001a6be], r14b
je 0x140008c19
lea rcx, str.Configuring_PMC_collection..._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
lea rdx, [0x14001a6e0]
call fcn.140001fb4
cmp byte [0x14001a6c1], r14b
je 0x140008c3f
lea rcx, str.Configuring_LBR_Tracing..._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
call fcn.1400022d4
cmp byte [0x14001a6b2], r14b
je 0x140008c65
lea rcx, str.Configuring_IPT_Tracing..._n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
call fcn.14000273c
mov ebx, dword [rbp + 0x70]
test ebx, ebx
je 0x140008d8b
lea rcx, str.ObjectType_filter:
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov edi, r14d
test ebx, ebx
je 0x140008cff
lea r13, [rbp + 0x74]
test edi, edi
je 0x140008ca5
lea rcx, [0x14000e844]
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov eax, dword [r13]
lea r15, [rbp - 0x70]
mov dword [rbp - 0x70], eax
mov r12d, r14d
mov eax, 1
lea ecx, [rax + 3]
cmp byte [r15], r14b
je 0x140008cea
movsx edx, byte [r15]
lea rcx, [0x14000e848]
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov eax, 1
add r12d, eax
add r15, rax
lea ecx, [rax + 3]
cmp r12d, ecx
jb 0x140008cbb
add edi, eax
add r13, rcx
cmp edi, ebx
jb 0x140008c8e
mov r13, qword [rbp - 0x60]
mov r12, qword [rbp - 0x18]
mov r15d, dword [rbp - 0x7c]
lea rcx, [0x1400165fc]
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov eax, 0x11
lea rdx, [rbp + 0x74]
mov dword [rbp + 0x88], eax
lea rcx, [rbp + 0x98]
mov rax, qword [rsp + 0x68]
mov r8, rbx
shl r8, 2
mov qword [rbp + 0x90], rax
call sub.msvcrt.dll_memcpy
lea r8d, [rbx*4 + 0x10]
mov ecx, 0x1f
lea rdx, [rbp + 0x88]
call qword [sym.imp.ntdll.dll_NtSetSystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x140008d87
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.Failed_to_configure_handle_trace_filter_0x_x_n
call qword [sym.imp.msvcrt.dll_printf]
nop dword [rax + rax]
mov edi, dword [rsp + 0x50]
mov ebx, dword [rbp - 0x78]
test ebx, ebx
je 0x1400095a1
lea rcx, [0x140016600]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
call fcn.14000288c
mov ebx, r14d
jmp 0x1400095a1
test dword [r13 + 0x40], 0x800
mov ebx, 1
je 0x140008df8
cmp dword [rsp + 0x60], ebx
je 0x140008deb
lea rcx, str.Need_exactly_one_GUID_for_PRIVATE_loggers_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea esi, [rbx + 0x56]
jmp 0x140008a1c
movaps xmm0, xmmword [rbp + 0x2c0]
movdqu xmmword [r13 + 0x18], xmm0
mov eax, 3
test di, di
jne 0x140008e24
cmp r15d, eax
jne 0x140008e1f
lea rdx, [r13 + 0x28]
mov rcx, r13
lea r9, str.GlobalLogger
lea r8, [rsp + 0x74]
call fcn.140005290
xor r9d, r9d
jmp 0x140008e84
cmp di, ax
jne 0x140008e55
mov rcx, r13
cmp r15d, eax
jne 0x140008e48
lea rdx, [r13 + 0x28]
lea r9, str.GlobalLogger
lea r8, [rsp + 0x74]
call fcn.140005290
jmp 0x140008e4d
call fcn.140005180
mov r9d, 2
jmp 0x140008e84
mov ecx, 7
cmp di, cx
jne 0x140008ea2
cmp r15d, eax
jne 0x140008e81
lea rdx, [r13 + 0x28]
mov rcx, r13
lea r9, str.GlobalLogger
lea r8, [rsp + 0x74]
call fcn.140005290
mov eax, 3
mov r9d, eax
mov rcx, qword [rsp + 0x68]
mov r8, r13
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
mov esi, eax
mov eax, 3
cmp esi, 0x1069
jne 0x140008a1c
cmp r15d, eax
jne 0x140008a1c
lea rcx, str.GlobalLogger_is_not_running_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov esi, r14d
jmp 0x140008a1c
cmp ecx, 8
je 0x140009c00
mov eax, 9
cmp ecx, eax
je 0x140009bdd
cmp ecx, 0xa
je 0x14000959e
mov eax, 0xc
cmp ecx, eax
je 0x140009014
mov eax, 0xd
cmp ecx, eax
je 0x140008f65
jbe 0x140008f3c
mov eax, 0x10
cmp ecx, eax
jbe 0x140009599
mov eax, 0x11
cmp ecx, eax
jne 0x140008f3c
lea r9d, [rax - 0xd]
mov r8, r13
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
jmp 0x140008b23
mov edi, dword [rsp + 0x4c]
test edi, edi
je 0x1400084b1
lea rcx, str.ERROR:_no_action_specified_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
call fcn.140004948
jmp 0x1400084b1
mov r8d, dword [r13 + 0x28]
mov r15d, 1
mov ecx, r15d
mov r9, r12
mov rdx, r13
call fcn.140004a64
mov esi, eax
test eax, eax
jne 0x140009008
mov r9, qword [rbp - 0x48]
lea rdx, [rbp + 0x2c0]
mov eax, dword [rbp - 0x68]
mov rcx, qword [rbp - 0x58]
mov edi, dword [rsp + 0x60]
mov r8d, edi
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r9
mov r9d, dword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov rcx, r12
call fcn.1400056d4
cmp byte [0x14001a6c8], r14b
je 0x140008ff2
cmp edi, r15d
jne 0x140008ff2
mov r9, qword [rbp]
lea rax, [rbp + 8]
mov r8, qword [rbp - 8]
lea rdx, [rbp + 0x2c0]
mov qword [rsp + 0x28], rax
mov rcx, r12
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.140002da0
mov r9, r12
lea r8, [rsp + 0x74]
lea rdx, [r13 + 0x28]
mov rcx, r13
call fcn.140005290
mov esi, eax
mov edi, dword [rsp + 0x4c]
mov rbx, r15
jmp 0x1400084b6
mov ebx, 1
mov dword [rsp + 0x40], r14d
cmp dword [rsp + 0x60], ebx
jne 0x1400093e1
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r15d, [rbx + 0xf]
mov r8d, r15d
mov dword [rsp + 0x20], r14d
lea rdx, [rbp + 0x60]
mov ecx, ebx
call qword [sym.imp.ADVAPI32.dll_EnumerateTraceGuidsEx]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0x7a
jne 0x1400093c7
mov ebx, dword [rsp + 0x40]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov qword [rbp - 0x40], rax
mov rdi, rax
test rax, rax
jne 0x1400090a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, eax
lea rcx, str.TraceLog_Failed_to_allocate_buffer_for_EnumerateTraceGuidsEx__d_n
mov esi, eax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140008500
lea rax, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, r15d
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.ADVAPI32.dll_EnumerateTraceGuidsEx]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140009101
mov edx, eax
lea rcx, str.EnumerateTraceGuidsEx_Failed___d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov r12, rbx
jmp 0x140008506
lea r8, [rbp + 0x60]
mov edx, 0x80
lea rcx, [rbp + 0x10c0]
call fcn.14000183c
mov r8d, dword [rdi]
lea rcx, str.GUID___ls___nInstance_Count___d_n
mov rdx, rax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp dword [rdi], r14d
jbe 0x140009565
lea rcx, [0x14000f488]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r13d, 1
lea rbx, [rdi + 8]
mov r15d, r13d
lea r12, [0x14000f88c]
mov r9d, dword [rbx + 8]
lea rcx, str.Legacy
mov r8, r12
mov edx, r15d
test r9d, r9d
je 0x1400091a6
cmp dword [rbx + 4], r14d
lea rax, str.Not_Enabled
cmova rax, r12
test byte [rbx + 0xc], r13b
mov qword [rsp + 0x20], rax
cmovne r8, rcx
lea rcx, str._Instance___4d:_User_Mode__6ls__Pid____8d__ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400091f1
mov eax, dword [rbx + 0xc]
lea r9, str.Not_Enabled
and eax, r13d
test byte [rbx + 0xc], 2
je 0x1400091d0
cmp dword [rbx + 4], r14d
cmova r9, r12
test eax, eax
cmovne r8, rcx
lea rcx, str._Instance___4d:_Pre_Enabled__6ls_____ls_n
jmp 0x1400091e5
cmp dword [rbx + 4], r14d
cmova r9, r12
test eax, eax
cmovne r8, rcx
lea rcx, str._Instance___4d:_Driver__6ls______ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
add r15d, r13d
mov dword [rsp + 0x58], r15d
cmp dword [rbx + 4], r14d
jbe 0x1400093b4
test byte [rbx + 0xc], r13b
je 0x14000924b
lea rcx, str._______________________Enable_Information__________________n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.ID__Name_________________Level_____________Enable_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.___________________________________________Flags_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.___________________________________________________________n
jmp 0x14000928b
lea rcx, str._______________________Enable_Information________________________________________n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.ID__Name_________________Level__Property___MatchAny___________MatchAll_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.___________________________________________Keyword____________Keyword_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str._________________________________________________________________________________n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp dword [rbx + 4], r14d
jbe 0x1400093a1
lea r15, [rbx + 0x14]
mov edi, r14d
mov r12d, 1
movzx eax, word [r15 + 2]
mov ecx, 0x1078
mov qword [rbp - 0x18], rax
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x1400092f5
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov r8, rax
mov dword [rax], 0x1078
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
test eax, eax
sete al
jmp 0x1400092f8
mov al, r14b
cmp al, r12b
jne 0x140009306
mov r8d, dword [r13 + 0x74]
add r8, r13
jmp 0x14000930d
lea r8, str.Unknown
movzx r9d, byte [r15]
movzx edx, word [r15 + 2]
test byte [rbx + 0xc], r12b
je 0x14000933a
mov rax, qword [r15 + 0xc]
lea rcx, str.__2d____20s__5d_____________0x_08I64X_n
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140009367
mov rax, qword [r15 + 0x14]
lea rcx, str.__2d____20s__5d__0x_08X_0x_016I64X_0x_016I64X_n
mov qword [rsp + 0x30], rax
mov rax, qword [r15 + 0xc]
mov qword [rsp + 0x28], rax
mov eax, dword [r15 + 4]
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
test r13, r13
je 0x14000937b
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
add r15, 0x20
add edi, r12d
cmp edi, dword [rbx + 4]
jb 0x1400092ae
mov rdi, qword [rbp - 0x40]
lea r12, [0x14000f88c]
mov r15d, dword [rsp + 0x58]
mov r13d, 1
lea rcx, [0x14000f488]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp dword [rbx], r14d
je 0x14000955c
mov eax, dword [rbx]
add rbx, rax
jmp 0x14000915f
mov edx, eax
lea rcx, str.EnumerateTraceGuidsEx_Failed___d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400090f9
mov r15d, dword [rsp + 0x7c]
mov edi, 2
mov eax, r15d
neg eax
lea rax, [rsp + 0x40]
sbb ebx, ebx
mov qword [rsp + 0x28], rax
and ebx, edi
mov dword [rsp + 0x20], r14d
mov ecx, ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_EnumerateTraceGuidsEx]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0x7a
jne 0x140009579
mov esi, dword [rsp + 0x40]
mov ecx, esi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x14000907c
lea rax, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], esi
mov ecx, ebx
call qword [sym.imp.ADVAPI32.dll_EnumerateTraceGuidsEx]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140009495
mov edx, eax
lea rcx, str.EnumerateTraceGuidsEx_Failed___d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x140008500
lea rax, str.Registerd_by_this_Process
test r15d, r15d
lea rdx, [0x14000f88c]
mov rbx, rdi
cmovne rdx, rax
lea rcx, str.GUID__ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str._____________________________________________________________n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
test dword [rsp + 0x40], 0xfffffff0
mov r15d, r14d
jbe 0x14000952d
mov r13d, 1
lea r14d, [r13 + 0xf]
mov r8, rbx
lea rcx, [rbp + 0x10c0]
mov edx, 0x80
call fcn.14000183c
mov rdx, rax
lea rcx, str._ls__n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rsp + 0x40]
add rbx, r14
shr eax, 4
add r15d, r13d
cmp r15d, eax
jb 0x1400094ea
mov r13, qword [rbp - 0x60]
xor r14d, r14d
lea rcx, str._____________________________________________________________n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rsp + 0x40]
lea rcx, str._n____ETW_Tracing_Guid_Count___d_____________n
shr edx, 4
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140009560
mov r13, qword [rbp - 0x60]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
jmp 0x140008a1c
mov edx, eax
lea rcx, str.EnumerateTraceGuidsEx_Failed___d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r12d, 1
jmp 0x14000850b
mov ebx, dword [rbp - 0x78]
jmp 0x1400095a6
mov ebx, dword [rbp - 0x78]
mov eax, 0x10
cmp di, ax
ja 0x14000969f
mov ecx, 0x1c420
bt ecx, edi
jae 0x14000969f
test dword [r13 + 0x40], 0x800
je 0x1400095eb
mov eax, 1
cmp dword [rsp + 0x60], eax
je 0x1400095de
lea rcx, str.Need_one_GUID_for_PRIVATE_loggers_n
jmp 0x1400088bd
movaps xmm0, xmmword [rbp + 0x2c0]
movdqu xmmword [r13 + 0x18], xmm0
xor r9d, r9d
mov r8, r13
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x140009663
mov rax, qword [0x1400176e0]
cmp rax, qword [r13 + 0x18]
jne 0x140009622
mov rax, qword [0x1400176e8]
cmp rax, qword [r13 + 0x20]
je 0x140009663
mov rax, qword [0x1400176b0]
cmp rax, qword [r13 + 0x18]
jne 0x14000963c
mov rax, qword [0x1400176b8]
cmp rax, qword [r13 + 0x20]
je 0x140009663
mov ecx, esi
call fcn.140003200
lea rcx, str.ERROR:_Logger_not_started_nOperation_Status:_____uL_n_ls_n
mov edx, esi
mov r8, rax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edi, r14d
jmp 0x1400084b1
mov rax, qword [r13 + 8]
mov ecx, 0x10
mov qword [rsp + 0x68], rax
cmp di, cx
jne 0x1400096a4
lea rdx, [r13 + 0x890]
mov rcx, rax
call fcn.140002bc4
mov esi, eax
test eax, eax
je 0x1400084ad
mov ecx, eax
call fcn.140003200
lea rcx, str.ERROR:_Failed_to_enable_preservation_nOperation_Status:_____uL_n_ls_n
jmp 0x14000964a
mov rax, qword [rsp + 0x68]
mov r12d, dword [rsp + 0x60]
mov edx, 0xf
cmp di, dx
jne 0x1400096d1
test r12d, r12d
jne 0x1400096d4
movups xmm0, xmmword [0x1400176f0]
lea ecx, [rdx - 0xe]
mov r12d, ecx
mov dword [rsp + 0x60], ecx
movdqu xmmword [rbp + 0x2c0], xmm0
test r12d, r12d
jle 0x140009b7e
test r15d, r15d
jne 0x140009b83
lea ecx, [r15 + 0xe]
cmp di, cx
jne 0x14000970a
mov rdx, rax
lea rcx, str.CaptureState_request_for_logger__I64d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r15d, 2
jmp 0x140009738
cmp di, dx
jne 0x14000972d
mov rdx, rax
lea rcx, str.System_Rundown_request_for_logger_0x_I64x_n
mov r15d, 2
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140009738
cmp dword [rbp - 0x80], r14d
mov r15d, r14d
setne r15b
mov ebx, r14d
test r12d, r12d
je 0x1400084ad
lea rdi, str.disable
mov eax, ebx
imul rcx, rax, 0x1c
mov eax, 1
cmp byte [rbp + rcx + 0x2d0], al
jne 0x140009770
mov r12b, byte [rbp + rcx + 0x2d8]
mov esi, dword [rbp + rcx + 0x2d4]
jmp 0x140009778
mov r12b, byte [rbp - 0x68]
mov rsi, qword [rbp - 0x58]
lea rax, [rbp + 0x2c0]
mov edx, 0x80
add rax, rcx
lea rcx, [rbp + 0x10c0]
mov r8, rax
mov qword [rbp - 0x18], rax
call fcn.14000183c
mov edx, dword [rsp + 0x50]
mov r10d, 1
lea eax, [rdx - 0xe]
cmp ax, r10w
jbe 0x140009838
cmp dword [rbp - 0x80], r10d
jne 0x140009813
lea eax, [r10 + 9]
movzx r9d, r12b
cmp dx, ax
mov rax, qword [rsp + 0x68]
lea rdx, [rbp + 0x10c0]
jne 0x1400097f6
mov qword [rsp + 0x28], rax
lea rcx, str.Enabling__ls__MatchAny__0x_I64x_MatchAll__0x_I64x_Level____3d__to_logger__I64d_n
mov dword [rsp + 0x20], r9d
mov r8, rsi
mov r9, qword [rbp - 0x48]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140009832
mov r8d, esi
mov qword [rsp + 0x20], rax
lea rcx, str.Enabling__ls__Flags__0x_.8x_Level____3d__to_logger__I64d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140009832
mov r8, qword [rsp + 0x68]
lea rdx, [rbp + 0x10c0]
lea rcx, str.Disabling__ls_to_logger__I64d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r10d, 1
mov eax, 0xf
mov r9, r14
mov edx, r14d
cmp word [rsp + 0x50], ax
jne 0x140009aef
lea rax, [0x14001b138]
mov dword [rbp + 0x1d8], 0x20
mov qword [rbp + 0x1d0], rax
lea r9, [rbp + 0x1d0]
mov dword [rbp + 0x1dc], 0x80000001
mov edx, r10d
mov r11d, 4
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x1400098bb
mov ecx, edx
lea r8, [rbp + 0x2a0]
add rcx, rcx
shl eax, 2
lea r9, [rbp + 0x1d0]
add edx, r10d
mov dword [rbp + rcx*8 + 0x1dc], 0x80000004
mov qword [rbp + rcx*8 + 0x1d0], r8
mov dword [rbp + rcx*8 + 0x1d8], eax
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140009905
mov r8d, edx
lea r9, [rbp + 0x1d0]
add r8, r8
or rax, 0xffffffffffffffff
mov dword [rbp + r8*8 + 0x1dc], 0x80000008
mov qword [rbp + r8*8 + 0x1d0], rcx
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400098e9
lea eax, [rax*2 + 2]
add edx, r10d
mov dword [rbp + r8*8 + 0x1d8], eax
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000994f
mov r8d, edx
lea r9, [rbp + 0x1d0]
add r8, r8
or rax, 0xffffffffffffffff
mov dword [rbp + r8*8 + 0x1dc], 0x80000010
mov qword [rbp + r8*8 + 0x1d0], rcx
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140009933
lea eax, [rax*2 + 2]
add edx, r10d
mov dword [rbp + r8*8 + 0x1d8], eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140009999
mov r8d, edx
lea r9, [rbp + 0x1d0]
add r8, r8
or rax, 0xffffffffffffffff
mov dword [rbp + r8*8 + 0x1dc], 0x80000020
mov qword [rbp + r8*8 + 0x1d0], rcx
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14000997d
lea eax, [rax*2 + 2]
add edx, r10d
mov dword [rbp + r8*8 + 0x1d8], eax
mov rax, qword [rbp + 8]
test rax, rax
je 0x1400099d6
mov ecx, edx
lea r9, [rbp + 0x1d0]
add rcx, rcx
add edx, r10d
mov qword [rbp + rcx*8 + 0x1d0], rax
mov dword [rbp + rcx*8 + 0x1dc], 0x80000200
movzx eax, word [rax + 2]
lea eax, [rax*2 + 4]
mov dword [rbp + rcx*8 + 0x1d8], eax
mov rax, qword [rbp + 0x10]
test rax, rax
je 0x140009a18
mov ecx, edx
lea r9, [rbp + 0x1d0]
add rcx, rcx
add edx, r10d
or dword [rsp + 0x70], r11d
mov qword [rbp + rcx*8 + 0x1d0], rax
mov dword [rbp + rcx*8 + 0x1dc], 0x80001000
movzx eax, word [rax + 2]
lea eax, [rax*2 + 4]
mov dword [rbp + rcx*8 + 0x1d8], eax
mov r8b, byte [0x14001a6c8]
movups xmm0, xmmword [rbp + 0x60]
mov al, r8b
mov qword [rbp + 0x58], r14
neg al
mov qword [rbp + 0x50], r9
mov eax, dword [rsp + 0x70]
mov r9b, r12b
mov dword [rbp + 0x34], eax
sbb ecx, ecx
neg ecx
mov dword [rbp + 0x4c], r14d
add ecx, r10d
mov dword [rbp + 0x38], r14d
test r8b, r8b
mov dword [rbp + 0x30], ecx
mov rcx, qword [rsp + 0x68]
mov eax, r14d
cmovne eax, edx
mov r8d, r15d
mov rdx, qword [rbp - 0x18]
mov dword [rbp + 0x58], eax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x38], rax
mov eax, dword [rbp - 0x24]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
movdqu xmmword [rbp + 0x3c], xmm0
call qword [sym.imp.ADVAPI32.dll_EnableTraceEx2]
nop dword [rax + rax]
mov r12d, dword [rbp - 0x80]
mov esi, eax
cmp eax, 0x10dd
jne 0x140009ada
lea rax, str.enable
test r12d, r12d
mov rdx, rdi
lea rcx, str.WARNING:_Could_not__ls_some_guids._n
cmovne rdx, rax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.Check_your_Guids_file_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov esi, r14d
test esi, esi
jne 0x140009b20
inc ebx
cmp ebx, dword [rsp + 0x60]
jb 0x14000974b
jmp 0x1400084ad
cmp dword [rbp - 0x50], r14d
je 0x14000987a
lea rax, [rbp - 0x50]
mov r11d, 4
mov qword [rbp + 0x1d0], rax
lea r9, [rbp + 0x1d0]
mov qword [rbp + 0x1d8], r11
mov edx, r10d
jmp 0x140009880
lea rax, str.enable
test r12d, r12d
mov r8d, ebx
lea rcx, str.ERROR:_Failed_to__ls_Guid___d_..._n
cmovne rdi, rax
mov rdx, rdi
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, esi
lea rcx, str.Operation_Status:________uL_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov ecx, esi
call fcn.140003200
mov rdx, rax
lea rcx, str._ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400084ad
test r15d, r15d
je 0x140009b94
test r12d, r12d
jle 0x140009b94
lea rcx, str.ERROR:_System_Logger_does_not_accept_application_guids._n
jmp 0x1400088bd
test ebx, ebx
je 0x140009bba
lea rcx, [0x140016600]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
call fcn.14000288c
jmp 0x1400084ad
test r12d, r12d
jne 0x1400084ad
lea eax, [r12 + 5]
cmp di, ax
jne 0x1400084ad
lea rcx, str.ERROR:_No_guids_were_given_for_enable_disable._n
jmp 0x1400088bd
mov r8d, dword [r13 + 0x28]
mov r9, r12
mov rdx, r13
xor ecx, ecx
call fcn.140004a64
mov esi, eax
test eax, eax
jne 0x1400084ad
mov r9, r12
jmp 0x140008b12
mov ebx, 0x1b8
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x14000861c
mov edi, 0xa
mov r8, rbx
xor edx, edx
mov rcx, r15
call sub.msvcrt.dll_memset
mov r8d, edi
mov ebx, 1
lea rcx, [r15 + r8*8]
test edi, edi
je 0x140009c54
mov rax, r15
mov qword [rax], rcx
add rcx, 0x24
lea rax, [rax + 8]
sub r8, rbx
jne 0x140009c44
lea r8, [rsp + 0x7c]
mov edx, edi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_EnumerateTraceGuids]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0xea
jne 0x140009ca6
mov edi, dword [rsp + 0x7c]
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
imul eax, edi, 0x2c
mov ecx, eax
mov ebx, eax
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x140009c24
jmp 0x14000861c
lea rcx, str.____Guid_____________________Enabled__LoggerId_Level_Flags_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str._____________________________________________________________n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov r12d, r14d
cmp dword [rsp + 0x7c], r14d
jbe 0x140009d41
mov eax, r12d
lea rbx, str.FALSE
mov edx, 0x400
lea rcx, [rbp + 0x10c0]
mov rdi, qword [r15 + rax*8]
lea rax, str.TRUE
mov r8, rdi
cmp byte [rdi + 0x20], r14b
cmovne rbx, rax
call fcn.14000183c
mov r9d, dword [rdi + 0x14]
lea rcx, str._ls______5ls___d_____d_____d_n
mov rdx, rax
mov r8, rbx
mov eax, dword [rdi + 0x1c]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi + 0x18]
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov ebx, 1
add r12d, ebx
cmp r12d, dword [rsp + 0x7c]
jb 0x140009cd6
mov rcx, r15
jmp 0x140009568