Function at 0x140008d1c
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x140030470]
xor rax, rsp
mov qword [rbp + 0x490], rax
xor r12d, r12d
movzx ebx, dx
mov rdi, rdx
mov qword [rbp - 0x68], r12
mov edx, 0x300
mov rsi, rcx
lea r13d, [r12 + 1]
lea r8d, [rdx + 1]
lea r14d, [rdx + 2]
cmp ebx, r8d
ja 0x140009a4e
cmp ebx, edx
jae 0x140009a66
cmp ebx, 0x18
ja 0x1400093bf
je 0x140009373
cmp ebx, 7
ja 0x1400091b2
je 0x1400091a8
mov ecx, ebx
sub ecx, r13d
je 0x140009193
sub ecx, r13d
je 0x14000904d
sub ecx, r13d
je 0x140008eb4
sub ecx, r13d
je 0x140008ef1
sub ecx, r13d
je 0x140008e40
cmp ecx, r13d
jne 0x140009a5e
add word [0x1400314de], r13w
lea rcx, [r12 - 2]
call qword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
nop dword [rax + rax]
xor ecx, ecx
mov rbx, rax
call fcn.14001e98c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
nop dword [rax + rax]
jmp 0x140009c39
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
nop dword [rax + rax]
lea ecx, [rax - 0x1009]
test ecx, 0xfffffffc
jne 0x140008eaa
cmp eax, 0x100a
je 0x140008eaa
call fcn.140007ce8
mov qword [0x140031528], r12
mov qword [0x140031520], r12
lea rcx, [0x140031510]
call fcn.14000c670
test eax, eax
je 0x140008e08
mov ebx, 0x28
lea r8, [0x140031740]
mov edx, ebx
lea rcx, [0x1400316a0]
call fcn.14000173c
lea r8, [0x140031790]
mov edx, ebx
lea rcx, [0x1400316f0]
call fcn.14000173c
cmp word [0x1400316a0], r12w
mov dword [0x140032354], r13d
jne 0x140008e9d
cmp word [0x1400316f0], r12w
mov ecx, r12d
je 0x140008ea0
mov ecx, r13d
call fcn.140020780
jmp 0x140009c39
call fcn.14000bee0
jmp 0x140009c39
add word [0x1400314da], r13w
cmp dword [0x140030678], r12d
mov eax, dword [0x1400315e4]
mov dword [0x1400315e0], eax
jne 0x140008ef1
xor r9d, r9d
lea rdx, [0x1400320e0]
xor r8d, r8d
call fcn.14000e808
test al, al
je 0x140008ef1
call fcn.14000b7fc
jmp 0x140009c39
mov eax, 4
cmp bx, ax
jne 0x140008f03
add word [0x1400314dc], r13w
cmp dword [0x140030678], r12d
lea rbx, [0x140027960]
mov rdx, rbx
mov qword [rbp - 0x70], r12
cmove rdx, qword [0x1400320e0]
lea r9, [rbp - 0x70]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], r12
mov rcx, rsi
mov dil, r12b
call fcn.140008a10
test eax, eax
jns 0x140008f9b
cmp eax, 0x800704c7
je 0x140008f63
cmp dword [0x140030678], r12d
lea rdx, [rsp + 0x50]
cmove rbx, qword [0x1400320e0]
mov rcx, rbx
call fcn.14000880c
mov dil, r13b
test eax, eax
jns 0x140008f9b
cmp eax, 0x8007000e
jne 0x140009014
mov r8, qword [0x140030630]
mov r9d, 0x1010
mov rdx, qword [0x140030640]
mov rcx, qword [0x140032598]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop dword [rax + rax]
jmp 0x140009014
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x1fa
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140008fde
lea rdx, [rbp + 0x290]
call fcn.1400215d8
test eax, eax
js 0x140008fde
cmp word [rbp + 0x290], r12w
je 0x140008fde
lea r9, [rbp + 0x290]
test dil, dil
je 0x140008fe1
mov r9, r12
mov r8b, r13b
lea rdx, [rsp + 0x50]
call fcn.14000e808
test al, al
je 0x14000900a
lea rdx, [rsp + 0x50]
lea rcx, [0x1400320e0]
call fcn.14000c6c8
call fcn.14000b7fc
jmp 0x140009014
mov rcx, qword [rsp + 0x50]
call fcn.14000fddc
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000902a
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140009c39
mov qword [rbp - 0x70], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400270f0]
jmp 0x140009c39
call fcn.140009f9c
test eax, eax
je 0x140009c39
mov r14d, dword [0x1400315e4]
lea rdx, [rsp + 0x58]
mov rcx, rsi
mov qword [rsp + 0x58], r12
call fcn.1400086ac
mov esi, eax
test eax, eax
jns 0x140009094
cmp eax, 0x800704c7
je 0x14000908c
lea rcx, [rsp + 0x58]
call fcn.14000849c
mov esi, eax
test esi, esi
js 0x14000913e
mov rcx, qword [rsp + 0x58]
mov eax, pe_nt_image_headers64
mov r15, qword [0x140031500]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov edx, 0x80000000
mov dword [rsp + 0x28], eax
lea r8d, [rax - 0x7d]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rcx, qword [0x1400320e0]
mov ebx, dword [0x140032378]
mov edi, dword [0x14003236c]
mov qword [0x140031500], rax
call fcn.14000f08c
mov r9d, ebx
lea rcx, [0x1400314d8]
mov r8d, edi
mov edx, eax
call fcn.14002016c
call fcn.14000acd4
mov ecx, eax
call fcn.14002048c
mov edx, dword [0x1400315e4]
lea rcx, [rsp + 0x58]
xor r8d, r8d
call fcn.14000f1ac
test al, al
jne 0x14000913a
mov rcx, qword [rsp + 0x58]
call fcn.14000fddc
mov qword [0x140031500], r15
mov esi, 0x80004005
test esi, esi
jns 0x140009174
mov dword [0x1400315e4], r14d
cmp esi, 0x8007000e
jne 0x140009174
mov r8, qword [0x140030630]
mov r9d, 0x1010
mov rdx, qword [0x140030640]
mov rcx, qword [0x140032598]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140009c39
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
jmp 0x140009c39
add word [0x1400314d8], r13w
mov ecx, r13d
call fcn.14000fc1c
jmp 0x140009c39
mov edx, 0x10
jmp 0x140009c27
mov ecx, ebx
sub ecx, 8
je 0x140009317
sub ecx, 7
je 0x140009c39
sub ecx, r13d
je 0x140009305
sub ecx, 5
je 0x1400094f8
sub ecx, r13d
je 0x1400094d5
cmp ecx, r13d
jne 0x140009a5e
add word [0x1400314ec], r13w
mov rcx, qword [0x140032580]
mov dword [0x14003234c], r13d
test rcx, rcx
je 0x14000921b
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov r8d, dword [0x140032660]
mov dword [0x1400315a8], 0x10001
test r8b, 2
jne 0x14000924d
lea rdx, [rbp - 0x48]
lea rcx, [0x140032660]
call fcn.14000cfdc
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov r8d, ecx
mov r9d, r8d
mov dword [rsp + 0x30], 3
shr r9d, 9
lea rax, [rsp + 0x78]
shr r8d, 8
lea rcx, [0x140032668]
and r9d, r13d
mov dword [rsp + 0x28], r13d
and r8d, r13d
mov dword [rsp + 0x78], r12d
mov edx, 0x10d8158
mov byte [rsp + 0x7c], 3
mov qword [rsp + 0x20], rax
call fcn.14000de34
mov al, byte [0x1400325a1]
neg al
mov al, byte [0x1400325a2]
sbb edx, edx
and edx, 0x100000
add edx, 0x40000
neg al
sbb ecx, ecx
and ecx, 4
or edx, ecx
or dword [0x1400315a8], edx
call fcn.14001ce5c
lea rcx, [0x140032480]
mov dword [0x1400315c0], 0x800080
mov qword [0x1400315b0], rcx
lea rax, [0x140032380]
lea rcx, [0x140031590]
mov qword [0x1400315b8], rax
call qword [sym.imp.COMDLG32.dll_ReplaceTextW]
nop dword [rax + rax]
mov qword [0x140032580], rax
jmp 0x140009c39
add word [0x1400314e0], r13w
mov edx, 0xc7
jmp 0x1400096d6
lea rdx, [rbp - 0x68]
call fcn.14000d438
mov ebx, eax
test eax, eax
jns 0x140009346
mov rcx, qword [rbp + 0x4d8]
lea r8, str.shellosshell_accesory_notepad_notepad.cpp
mov r9d, eax
mov edx, 0x35f
call fcn.1400025fc
jmp 0x140009c3c
mov r8, qword [rbp - 0x68]
lea r9, [0x140027b60]
mov dword [rsp + 0x28], 5
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax + rax]
jmp 0x140009c39
mov r8, qword [0x140032598]
lea r9, [0x14000bfa0]
mov rcx, qword [0x140031670]
mov edx, 0xe
add word [0x1400314ee], r13w
mov qword [rsp + 0x20], r12
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop dword [rax + rax]
test rax, rax
jne 0x140009c39
mov ecx, dword [0x14003166c]
call fcn.140007e98
jmp 0x140009c39
cmp ebx, 0x21
ja 0x140009888
je 0x1400096f4
mov ecx, ebx
sub ecx, 0x19
je 0x1400096b2
sub ecx, r13d
je 0x1400096a6
sub ecx, r13d
je 0x140009616
sub ecx, r13d
je 0x140009ac7
sub ecx, r13d
je 0x1400094d5
cmp ecx, 3
jne 0x140009a5e
mov eax, dword [0x14003236c]
neg eax
sbb ecx, ecx
and ecx, 0x100000
add ecx, 0x50200104
call fcn.14001cf3c
test eax, eax
je 0x140009441
cmp dword [0x14003236c], r12d
mov eax, r12d
mov dword [0x140032358], r13d
sete al
mov dword [0x14003236c], eax
jmp 0x140009468
mov r8, qword [0x140030630]
mov r9d, 0x30
mov rdx, qword [0x1400305f8]
mov rcx, qword [0x140032598]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop dword [rax + rax]
mov r8d, dword [0x140031488]
test r8b, 2
jne 0x140009490
lea rdx, [rbp - 0x40]
lea rcx, [0x140031488]
call fcn.14000ce04
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov r8d, ecx
mov r9d, r8d
mov dword [rsp + 0x30], 3
shr r9d, 9
lea rax, [rbp - 0x80]
shr r8d, 8
lea rcx, [0x140031490]
and r9d, r13d
mov dword [rsp + 0x28], r13d
and r8d, r13d
mov dword [rbp - 0x80], r12d
mov edx, 0x71cda0
mov byte [rbp - 0x7c], 3
mov qword [rsp + 0x20], rax
call fcn.14000de34
jmp 0x140009c39
cmp dword [0x14003234c], r12d
je 0x1400094f8
cmp word [0x140032480], r12w
je 0x1400094f8
cmp ebx, 0x1d
sete dl
call fcn.14001cb84
jmp 0x140009c39
mov dword [0x14003234c], r13d
cmp ebx, 0x15
jne 0x14000950c
add word [0x1400314ea], r13w
mov rcx, qword [0x140032580]
test rcx, rcx
je 0x14000952e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov r8d, dword [0x140032660]
mov dword [0x1400315a8], 0x10000
test r8b, 2
jne 0x140009560
lea rdx, [rbp - 0x38]
lea rcx, [0x140032660]
call fcn.14000cfdc
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov r8d, ecx
mov r9d, r8d
mov dword [rsp + 0x30], 3
shr r9d, 9
lea rax, [rbp - 0x78]
shr r8d, 8
lea rcx, [0x140032668]
and r9d, r13d
mov dword [rsp + 0x28], r13d
and r8d, r13d
mov dword [rbp - 0x78], r12d
mov edx, 0x10d8158
mov byte [rbp - 0x74], 3
mov qword [rsp + 0x20], rax
call fcn.14000de34
cmp byte [0x1400325a0], r12b
mov edx, r12d
mov al, byte [0x1400325a1]
sete dl
neg al
mov al, byte [0x1400325a2]
sbb ecx, ecx
and ecx, 0x100000
add ecx, 0x40000
or edx, ecx
neg al
sbb ecx, ecx
and ecx, 4
or edx, ecx
or dword [0x1400315a8], edx
call fcn.14001ce5c
lea rcx, [0x140032480]
mov qword [0x1400315b8], r12
mov qword [0x1400315b0], rcx
lea rcx, [0x140031590]
mov dword [0x1400315c0], 0x80
call qword [sym.imp.COMDLG32.dll_FindTextW]
nop dword [rax + rax]
jmp 0x1400092f9
mov rcx, qword [0x140032598]
lea rdx, [rbp + 0x40]
call qword [sym.imp.USER32.dll_GetClientRect]
nop dword [rax + rax]
cmp dword [0x140032378], r12d
je 0x140009665
mov rcx, qword [0x140032590]
xor edx, edx
mov dword [0x140032378], r12d
call qword [sym.imp.USER32.dll_ShowWindow]
nop dword [rax + rax]
mov edx, dword [rbp + 0x4c]
mov ecx, dword [rbp + 0x48]
sub edx, dword [rbp + 0x44]
sub ecx, dword [rbp + 0x40]
call fcn.140007df8
jmp 0x14000969a
mov edx, dword [rbp + 0x4c]
mov ecx, dword [rbp + 0x48]
sub edx, dword [rbp + 0x44]
sub ecx, dword [rbp + 0x40]
mov dword [0x140032378], r13d
call fcn.140007df8
call fcn.14000b120
mov rcx, qword [0x140032590]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
nop dword [rax + rax]
mov dword [0x140032358], r13d
jmp 0x140009c39
xor ecx, ecx
call fcn.14000e468
jmp 0x140009c39
mov rcx, qword [0x140032588]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov edx, 0xb7
mov rcx, qword [0x140032588]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
jmp 0x140009c39
add word [0x1400314f0], r13w
lea rcx, [rbp - 0x30]
mov edi, 0x68
xor edx, edx
mov r8d, edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140009c39
mov qword [rbp - 0x28], rsi
lea edx, [rdi - 0xe]
lea rsi, [0x140031610]
mov dword [rbp - 0x30], edi
mov rcx, rax
mov qword [rbp - 0x18], rsi
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
nop dword [rax + rax]
mov ecx, dword [0x14003067c]
mov r14d, 0x2d0
mov r8d, r14d
mov edx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
nop dword [rax + rax]
mov rdx, rbx
mov dword [rbp - 0xc], 0x1010041
neg eax
xor ecx, ecx
mov dword [0x140031610], eax
mov eax, 0x2000
mov word [rbp + 0x28], ax
call qword [sym.imp.USER32.dll_ReleaseDC]
nop dword [rax + rax]
lea rcx, [rdi - 0x6a]
call qword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
nop dword [rax + rax]
lea rcx, [rbp - 0x30]
mov rdi, rax
call qword [sym.imp.COMDLG32.dll_ChooseFontW]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
nop dword [rax + rax]
test ebx, ebx
je 0x140009c39
mov rcx, qword [0x140031680]
call qword [sym.imp.USER32.dll_SetCursor]
nop dword [rax + rax]
mov rcx, qword [0x140032598]
call qword [sym.imp.USER32.dll_GetDpiForWindow]
nop dword [rax + rax]
mov ecx, dword [rbp - 0x10]
mov r8d, r14d
mov edx, eax
call qword [sym.imp.KERNEL32.dll_MulDiv]
nop dword [rax + rax]
neg eax
mov rcx, rsi
mov dword [0x140031610], eax
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140009869
mov rcx, qword [0x140031608]
call qword [sym.imp.GDI32.dll_DeleteObject]
nop dword [rax + rax]
mov rcx, qword [0x140032588]
mov r9, r13
mov r8, rbx
mov qword [0x140031608], rbx
mov edx, 0x30
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov eax, dword [rbp - 0x10]
mov dword [0x14003067c], eax
mov rcx, qword [0x140031688]
call qword [sym.imp.USER32.dll_SetCursor]
nop dword [rax + rax]
mov dword [0x140032350], r13d
jmp 0x140009c39
sub ebx, 0x22
je 0x1400099cf
sub ebx, r13d
je 0x14000997a
sub ebx, r13d
je 0x14000996a
sub ebx, 0x1c
je 0x14000993c
sub ebx, r13d
je 0x1400098ce
cmp ebx, r13d
jne 0x140009a5e
mov dword [rsp + 0x28], r13d
lea r8, str.feedback_hub:___tabid2contextid1010
xor r9d, r9d
jmp 0x140009359
mov rax, qword [0x140031670]
lea rdi, [rbp - 0x58]
mov qword [rbp - 0x58], rax
mov ebx, r12d
mov rax, qword [0x140031678]
mov qword [rbp - 0x50], rax
mov rcx, qword [rdi]
mov edx, 2
call qword [sym.imp.USER32.dll_LoadIconW]
nop dword [rax + rax]
test rax, rax
jne 0x140009913
add ebx, r13d
add rdi, 8
cmp ebx, 2
jb 0x1400098eb
mov rax, r12
mov rdx, qword [0x140030630]
lea r8, [0x140027b60]
mov rcx, qword [0x140032598]
mov r9, rax
call qword [sym.imp.SHELL32.dll_ShellAboutW]
nop dword [rax + rax]
jmp 0x140009c39
mov dword [rsp + 0x28], r13d
lea r8, str.https:__go.microsoft.com_fwlink__LinkId834783
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax + rax]
call fcn.140020700
jmp 0x140009c39
mov eax, 0x64
mov r9d, eax
mov r8d, eax
jmp 0x140009a2c
mov rcx, qword [0x140032588]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x64]
mov edx, 0x4e0
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x1400099ac
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x1400099ba
mov ecx, r13d
mov eax, r13d
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x64], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
mov ecx, 0xa
sub eax, ecx
cmp eax, ecx
cmova ecx, eax
jmp 0x140009a23
mov rcx, qword [0x140032588]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x6c]
mov edx, 0x4e0
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x140009a01
mov ecx, dword [rsp + 0x68]
test ecx, ecx
jne 0x140009a0f
mov ecx, r13d
mov eax, r13d
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x6c], eax
imul eax, eax, 0x64
xor edx, edx
div ecx
mov ecx, 0x1f4
add eax, 0xa
cmp eax, ecx
cmovb ecx, eax
mov r8d, ecx
mov r9d, 0x64
mov rcx, qword [0x140032588]
mov edx, 0x4e1
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
call fcn.14000b620
jmp 0x140009c39
mov ecx, ebx
sub ecx, r14d
je 0x140009adb
cmp ecx, r13d
je 0x140009a66
mov ebx, r12d
jmp 0x140009c3c
cmp bx, dx
jne 0x140009a75
add word [0x1400314e2], r13w
jmp 0x140009a8d
cmp bx, r8w
jne 0x140009a85
add word [0x1400314e4], r13w
jmp 0x140009a8d
add word [0x1400314e8], r13w
mov rcx, qword [0x140032588]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x74]
mov dword [rsp + 0x74], r12d
mov edx, 0xb0
mov dword [rsp + 0x70], r12d
call qword [sym.imp.USER32.dll_SendMessageW]
nop dword [rax + rax]
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x74], eax
je 0x140009c39
mov ecx, 0x1c
mov eax, 0x150f
cmp bx, cx
cmovne rax, rdi
mov rdi, rax
cmp di, r14w
jne 0x140009c03
add word [0x1400314e6], r13w
cmp dword [0x140032348], r12d
jne 0x140009c03
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x1fa
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rbp + 0x90]
call fcn.140021758
test eax, eax
js 0x140009c03
cmp word [rbp + 0x90], r12w
je 0x140009c03
lea rax, [rbp + 0x90]
mov byte [rsp + 0x40], r12b
lea r9, [rbp + 0x68]
mov qword [rbp - 0x60], rax
lea r8, [rbp + 0x50]
mov qword [rsp + 0x48], r12
mov edx, 0x37
mov qword [rbp + 0x68], r12
lea rcx, str.Windows.Security.EnterpriseData.ProtectionPolicyManager
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateStringReference]
nop dword [rax + rax]
test eax, eax
js 0x140009c7e
mov rcx, qword [rbp + 0x68]
lea r8, [rsp + 0x48]
lea rdx, [0x14002a920]
call qword [sym.imp.api_ms_win_core_winrt_l1_1_0.dll_RoGetActivationFactory]
nop dword [rax + rax]
mov qword [rbp + 0x68], r12
test eax, eax
js 0x140009bca
mov rbx, qword [rsp + 0x48]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x70]
call fcn.1400221c4
mov rdx, qword [rbx]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov r9, qword [rdx + 0x38]
mov rdx, qword [rax + 0x18]
mov rax, r9
call qword [0x1400270f0]
mov qword [rbp + 0x88], r12
mov rcx, qword [rsp + 0x48]
movzx ebx, byte [rsp + 0x40]
test rcx, rcx
je 0x140009beb
mov qword [rsp + 0x48], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400270f0]
test ebx, ebx
je 0x140009bfb
lea rcx, [rbp + 0x90]
call fcn.14000c560
add word [0x1400314f6], r13w
call qword [sym.imp.USER32.dll_GetFocus]
nop dword [rax + rax]
mov rcx, qword [0x140032588]
cmp rax, rcx
je 0x140009c24
cmp rax, qword [0x140032598]
jne 0x140009c39
movzx edx, di
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_PostMessageW]
nop dword [rax + rax]
mov ebx, r13d
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140009c51
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.140023ec0
mov rbx, qword [rsp + 0x5f0]
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.140020b18
int3