Function at 0x14006d9f0
Capabilities:
Accept command line arguments
Acquire debug privileges
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create process on windows
Create thread
Get common file path
Get file attributes
Get system information on windows
Query or enumerate registry value
Set registry value
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6380]
mov eax, 0x6480
call fcn.1400ff8d0
sub rsp, rax
mov rbx, r8
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14006fe88
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
call fcn.14007c6e0
call fcn.1400855e0
mov r13, qword [0x14017ae30]
mov qword [rbp - 0x80], r13
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
call fcn.14011655c
lea rcx, [0x14017ad70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rbp + 0x490], 0x114
lea rcx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rbp + 0x494]
cmp eax, 5
jae 0x14006dae0
mov r9d, InitCommonControls
lea r8, str.Process_Lasso
lea rdx, str.Process_Lasso_is_not_compatible_with_this_version_of_Windows.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rsi, 0xffffffffffffffff
lock xadd dword [rdi - 8], esi
sub esi, 1
jg 0x14006fe5a
mov rax, qword [rdi - 0x18]
mov r8, qword [rax]
lea rdx, [rdi - 0x18]
mov rcx, rax
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x14006fe5a
jne 0x14006daf4
cmp dword [rbp + 0x498], 0
jne 0x14006db00
mov byte [0x14017ac1d], 1
jmp 0x14006db00
cmp eax, 6
jb 0x14006db00
mov byte [0x14017ac1e], 1
lea rcx, [fcn.14006b230]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x14017acf0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
xor r8d, r8d
mov edi, 1
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ad30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017acd0], rax
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14006fe93
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x68], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov rsi, 0xffffffffffffffff
xor r15d, r15d
test eax, eax
js 0x14006dbc1
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [rbp + 0x78], 8
mov dword [rbp + 0x7c], 0xc00d
lea rcx, [rbp + 0x78]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
jne 0x14006dbe3
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
mov rcx, rsi
inc rcx
cmp word [rbx + rcx*2], r15w
jne 0x14006dbe6
inc rcx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400ff0c4
mov r12, rax
mov rdx, rax
sub rdx, rbx
movzx ecx, word [rbx]
mov word [rdx + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x14006dc10
mov rcx, r12
call fcn.140115d38
call fcn.14006b9c0
mov r9, rsi
lea r8, [0x1401454c0]
mov edx, 0x104
lea rcx, [0x140174cdc]
call fcn.140115f0c
lea r14, str.processlasso.exe
mov qword [0x140174ee8], r14
mov rax, qword [0x14017ae30]
mov qword [0x1401746a8], rax
mov dword [0x1401746a4], 6
lea rax, str.SeAssignPrimaryTokenPrivilege
mov qword [rbp + 0x110], rax
lea rax, str.SeDebugPrivilege
mov qword [rbp + 0x118], rax
lea rax, str.SeChangeNotifyPrivilege
mov qword [rbp + 0x120], rax
lea rax, str.SeIncreaseBasePriorityPrivilege
mov qword [rbp + 0x128], rax
lea rax, str.SeIncreaseQuotaPrivilege
mov qword [rbp + 0x130], rax
lea rax, str.SeCreateGlobalPrivilege
mov qword [rbp + 0x138], rax
lea rax, str.SeProfileSingleProcessPrivilege
mov qword [rbp + 0x140], rax
lea rax, str.SeBackupPrivilege
mov qword [rbp + 0x148], rax
lea rax, str.SeRestorePrivilege
mov qword [rbp + 0x150], rax
lea rbx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0xa0]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14006dd5b
lea r8, [rbp + 0xbc]
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rbp + 0xb8], 1
mov dword [rbp + 0xc4], 2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0xb8]
xor edx, edx
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add rbx, 8
lea rax, [rbp + 0x158]
cmp rbx, rax
jne 0x14006dcf3
lea rdx, str.darkmode_disable
lea rcx, [0x14017c600]
call fcn.140073310
cmp byte [rax], r15b
jne 0x14006dd88
call fcn.140072270
call fcn.14007f770
lea rcx, [rbp + 0x1b80]
call fcn.140093ec0
nop
lea rdx, str._resetdefault
mov rcx, r12
call fcn.140100b40
test rax, rax
jne 0x14006fd66
lea rdx, str._restored
mov rcx, r12
call fcn.140100b40
test rax, rax
jne 0x14006fd66
lea rdx, str._oocdefault
mov rcx, r12
call fcn.140100b40
test rax, rax
je 0x14006de38
lea r8, [rbp + 0xcc]
xor edx, edx
lea rcx, [rbp + 0x1b80]
call fcn.14009c730
lea rcx, [rbp + 0x1b80]
call fcn.1400ada80
lea rcx, [rbp + 0x1b80]
call fcn.140095520
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006de33
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14006fe3e
lea rdx, str._trimnow
mov rcx, r12
call fcn.140100b40
test rax, rax
je 0x14006df07
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [rbp + 0x1b80]
call fcn.14009c730
xor r8d, r8d
lea rdx, [rbp + 0x1b80]
lea rcx, [rbp + 0x1c8]
call fcn.1400c68e0
nop
lea r8, str.Global42f2731a_1cc1_4566_868b_428d23a0c644_
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
test rax, rax
je 0x14006deaa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14006deac
mov al, 1
movzx ebx, al
lea rcx, [rbp + 0x1c8]
call fcn.1400c6990
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006dee3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14006df00
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
jmp 0x14006fe5c
lea rdx, str._setactiveprofile
mov rcx, r12
call fcn.140100b40
mov rbx, rax
test rax, rax
je 0x14006e00d
call fcn.140002e00
test rax, rax
je 0x14006fe9e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [rbx + 0x24]
lea rdx, [rsp + 0x70]
call fcn.14007cbf0
mov rbx, qword [rsp + 0x70]
cmp dword [rbx - 0x10], 0
je 0x14006dfb2
mov rdx, rbx
call fcn.1400b3080
test al, al
jne 0x14006dfb2
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006df81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006dfad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14006e8c3
mov rdx, rbx
lea rcx, [rbp + 0x1b80]
call fcn.1400ae2b0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006dfdc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e008
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14006fe3e
lea rdx, str._startwithprofile
mov rcx, r12
call fcn.140100b40
mov rbx, rax
test rax, rax
je 0x14006e0af
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14006fe9e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [rbx + 0x24]
lea rdx, [rsp + 0x70]
call fcn.14007cbf0
lea rcx, [rsp + 0x70]
call fcn.140005330
lea rcx, [rsp + 0x70]
call fcn.140005430
mov rbx, qword [rsp + 0x70]
cmp dword [rbx - 0x10], 0
je 0x14006e081
mov rdx, rbx
call fcn.1400b3080
test al, al
je 0x14006e091
mov rdx, rbx
lea rcx, [rbp + 0x1b80]
call fcn.1400ae2b0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e0aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x68]
lea rcx, [rbp + 0x38]
call fcn.140082660
nop
lea rcx, [rbp + 0x220]
call fcn.14000a930
nop
mov qword [rbp - 0x78], r15
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0xdb2]
call fcn.14012ce40
mov word [rbp + 0xdb0], r15w
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006e5f0
mov dword [rbp - 0x48], 0x200
mov dword [rbp - 0x44], ebx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xdb0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x44]
xor r8d, r8d
lea rdx, str.PendingActivationCode
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x30]
test eax, eax
je 0x14006e160
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006e5f0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0xdb0]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14006e170
lea rdx, [rbp + 0xdb0]
lea rcx, [rsp + 0x58]
call fcn.140005a90
mov rbx, qword [rsp + 0x58]
mov r8, rbx
lea r14, [0x140149510]
mov rdx, r14
lea rcx, [rbp + 0x38]
call fcn.140082920
test eax, eax
je 0x14006e5e9
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
lea rcx, [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, r15w
mov ecx, r15d
movzx r11d, word [0x140149510]
test r11w, r11w
je 0x14006e206
nop dword [rax]
cmp ecx, 0xa
jae 0x14006e206
mov eax, ecx
add dx, word [r14 + rax*2]
inc ecx
cmp word [r14 + rcx*2], 0
jne 0x14006e1f0
movzx r15d, dx
shl r15, 0x30
xor ecx, ecx
mov r14d, ecx
mov r10d, ecx
movzx eax, word [rbx]
test ax, ax
je 0x14006e270
mov r9d, ecx
mov r8d, ecx
lea r13, [0x140149510]
nop dword [rax + rax]
movzx eax, ax
mov edx, eax
shl eax, 0x10
mov ecx, eax
add rcx, rdx
add r14, rcx
imul r14, rdx
cmp r9, 0xa
jae 0x14006e254
movzx eax, word [r8 + r13]
sub r14, rax
jmp 0x14006e258
imul r14, r11
inc r10d
mov r9d, r10d
lea r8, [r10 + r10]
movzx eax, word [r8 + rbx]
test ax, ax
jne 0x14006e230
mov r13, qword [rbp - 0x80]
xor r14, 0x6ad56413
mov rbx, r14
xor rbx, r15
movabs rax, 0x917aa921821c49ab
xor rbx, rax
mov r15d, 1
mov dword [rsp + 0x20], r15d
lea r9, [0x14014aae0]
mov r8, qword [rbp + 0x58]
mov rdx, 0xffffffff80000002
call fcn.140088930
mov dword [rbp - 0x40], r15d
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x38], rax
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006e328
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 4]
xor r8d, r8d
lea rdx, str.ValidCPU
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x38], 1
lea rax, [rbp + 0x9c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x58]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006e3a6
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ValidCPU
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x30], 1
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006e424
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ValidCPU
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x28], 1
lea rax, [rbp + 0x8c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x58]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006e4a2
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ValidCPU
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x20], 1
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006e523
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x140149a44]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x20], r14
lea r9, str.ViewState
mov r8, qword [rbp + 0x58]
mov rdx, 0xffffffff80000002
call fcn.140088f60
test al, al
je 0x14006e57c
mov qword [rsp + 0x20], rbx
lea r9, str.CacheTag
mov r8, qword [rbp + 0x58]
mov rdx, 0xffffffff80000002
call fcn.140088f60
lea r15, [0x140149510]
test al, al
je 0x14006e583
mov r8, r15
lea rcx, [rbp + 0x38]
call fcn.140084a10
test al, al
jne 0x14006e5cf
jmp 0x14006e583
lea r15, [0x140149510]
mov qword [rsp + 0x20], r14
lea r9, str.ViewState
mov r8, qword [rbp + 0x58]
mov rdx, 0xffffffff80000001
call fcn.140088f60
test al, al
je 0x14006e5cf
mov qword [rsp + 0x20], rbx
lea r9, str.CacheTag
mov r8, qword [rbp + 0x58]
mov rdx, 0xffffffff80000001
call fcn.140088f60
test al, al
je 0x14006e5cf
mov r8, r15
lea rcx, [rbp + 0x38]
call fcn.140084a10
lea r9, str.PendingActivationCode
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000002
call fcn.140088840
lea r14, str.processlasso.exe
lea rdx, str._activateonly
mov rcx, r12
call fcn.140100b40
test rax, rax
je 0x14006e647
lea rcx, [rbp + 0x220]
call fcn.14000a9d0
nop
lea rcx, [rbp + 0x38]
call fcn.1400031d0
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e642
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14006fe3e
lea rdx, str._recover_systray
mov rcx, r12
call fcn.140100b40
test rax, rax
je 0x14006e734
lea r9, [rbp - 0x78]
mov rdx, r14
lea rcx, [rbp + 0x220]
call fcn.1400cd870
mov rbx, qword [rbp - 0x78]
test rbx, rbx
jne 0x14006e69f
lea r9, [rbp - 0x78]
lea rdx, str.processlasso.ex
lea rcx, [rbp + 0x220]
call fcn.1400cd870
mov rbx, qword [rbp - 0x78]
test rbx, rbx
je 0x14006e722
mov r15d, dword [rbx + 0x544]
lea r9, str.LocalProsuperExit
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
test rax, rax
je 0x14006e6d6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r15d
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
mov edx, 0xfa0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test r14, r14
je 0x14006e705
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140087b10
mov rcx, rbx
call fcn.140086c50
mov edx, 0x700
mov rcx, rbx
call fcn.1400ff054
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x14017ab01], 1
mov byte [rsp + 0x50], 0
lea rdx, str._updatecheck
mov rcx, r12
call fcn.140100b40
test rax, rax
je 0x14006e7bf
mov r9b, 1
lea r8, [rsp + 0x62]
lea rdx, str.UpdateChecksEnabled
lea rcx, [0x14017c940]
call fcn.1400734c0
cmp byte [rsp + 0x62], 1
jne 0x14006e77c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400719b0
nop
lea rcx, [rbp + 0x220]
call fcn.14000a9d0
nop
lea rcx, [rbp + 0x38]
call fcn.1400031d0
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e7ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14006fe3e
lea rdx, str._configfile
mov rcx, r12
call fcn.140100b40
mov rbx, rax
test rax, rax
je 0x14006e8ed
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.140002e00
test rax, rax
je 0x14006fe7d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea rdx, [rbp]
lea rcx, [rbx + 0x18]
call fcn.14007cbf0
mov rdx, qword [rbp]
lea rcx, [rbp + 0xa8]
call fcn.14007e470
nop
mov rdx, rax
lea rcx, [0x14017c4a0]
call fcn.14003f3d0
nop
mov rdx, qword [rbp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e854
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e880
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x220]
call fcn.14000a9d0
nop
lea rcx, [rbp + 0x38]
call fcn.1400031d0
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e8c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14006f42e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x14006fe5c
lea rdx, str._language
mov rcx, r12
call fcn.140100b40
mov rbx, rax
test rax, rax
je 0x14006e989
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.140002e00
test rax, rax
je 0x14006fe7d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x70], rax
lea rdx, [rbp + 0x70]
lea rcx, [rbx + 0x14]
call fcn.14007cbf0
mov rbx, qword [rbp + 0x70]
mov rcx, rbx
call fcn.140085670
mov ecx, 0x409
test eax, eax
cmove eax, ecx
mov ecx, eax
call fcn.1400858b0
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x50], 1
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006e989
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str._configfolder
mov rcx, r12
call fcn.140100b40
mov rbx, rax
test rax, rax
je 0x14006eab6
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbx + 0x1c]
lea rdx, [0x14017c4a0]
call fcn.14007cbf0
lea rcx, [0x14017c4a0]
call fcn.140005430
lea rcx, [0x14017c4a0]
call fcn.140005330
mov rax, qword [0x14017c4a0]
cmp word [rax], 0x2e
jne 0x14006e9f3
cmp word [rax + 2], 0
jne 0x14006e9f3
xor edx, edx
mov ecx, edx
jmp 0x14006e9fa
sbb ecx, ecx
or ecx, 1
xor edx, edx
test ecx, ecx
je 0x14006ea40
cmp word [rax], 0x2e
jne 0x14006ea16
cmp word [rax + 2], 0x5c
jne 0x14006ea16
cmp word [rax + 4], 0
jne 0x14006ea16
mov ecx, edx
jmp 0x14006ea1b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x14006ea40
cmp word [rax], 0x2e
jne 0x14006ea37
cmp word [rax + 2], 0x2f
jne 0x14006ea37
cmp word [rax + 4], 0
jne 0x14006ea37
mov eax, edx
jmp 0x14006ea3c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14006ea7e
lea rdx, [rbp + 0x5380]
mov ecx, 0x3ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rbp + 0x5380]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14006ea60
lea rdx, [rbp + 0x5380]
lea rcx, [0x14017c4a0]
call fcn.140005a90
lea rcx, [0x14017c4a0]
call fcn.1400759e0
lea rdx, [0x14017c4a0]
lea rcx, [rbp + 0x4c70]
call fcn.14003f3d0
mov byte [rbp + 0x4ca0], 0
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x50], 1
lea rdx, [0x1401498a0]
mov rcx, r12
call fcn.140100b40
test rax, rax
je 0x14006ead3
mov byte [0x140173ca6], 1
jmp 0x14006eaee
lea rdx, str._showwindow
mov rcx, r12
call fcn.140100b40
test rax, rax
je 0x14006eaee
mov byte [0x140173ca6], 0
lea rdx, str._stopafter
mov rcx, r12
call fcn.140100b40
mov rbx, rax
test rax, rax
je 0x14006eb5c
lea rcx, [rsp + 0x58]
call fcn.1400056e0
lea rcx, [rbx + 0x16]
lea rdx, [rsp + 0x58]
call fcn.14007cbf0
mov rcx, qword [rsp + 0x58]
cmp dword [rcx - 8], 1
jle 0x14006eb3a
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140005760
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14006eb5c
cmp dword [rcx - 8], 1
jle 0x14006eb57
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140005760
mov rcx, qword [rsp + 0x58]
call fcn.140115e5c
mov byte [rsp + 0x61], 0
lea rdx, str._logfolder
mov rcx, r12
call fcn.140100b40
mov rbx, rax
test rax, rax
je 0x14006ec7c
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbx + 0x16]
lea rdx, [0x14017c4b8]
call fcn.14007cbf0
lea rcx, [0x14017c4b8]
call fcn.140005430
lea rcx, [0x14017c4b8]
call fcn.140005330
mov rdx, qword [0x14017c4b8]
cmp dword [rdx - 0x10], 0
je 0x14006ed06
cmp word [rdx], 0x2e
jne 0x14006ebd5
cmp word [rdx + 2], 0
jne 0x14006ebd5
xor ecx, ecx
mov eax, ecx
jmp 0x14006ebdc
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
je 0x14006ec22
cmp word [rdx], 0x2e
jne 0x14006ebf8
cmp word [rdx + 2], 0x5c
jne 0x14006ebf8
cmp word [rdx + 4], 0
jne 0x14006ebf8
mov eax, ecx
jmp 0x14006ebfd
sbb eax, eax
or eax, 1
test eax, eax
je 0x14006ec22
cmp word [rdx], 0x2e
jne 0x14006ec19
cmp word [rdx + 2], 0x2f
jne 0x14006ec19
cmp word [rdx + 4], 0
jne 0x14006ec19
mov eax, ecx
jmp 0x14006ec1e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14006ec65
lea rdx, [rbp + 0x5b80]
mov ecx, 0x3ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rbp + 0x5b80]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14006ec40
lea rdx, [rbp + 0x5b80]
lea rcx, [0x14017c4b8]
call fcn.140005a90
mov rdx, qword [0x14017c4b8]
call fcn.14006ad00
mov byte [rsp + 0x61], 1
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
mov byte [0x14017ab01], 0
lea rdx, str._restart
mov rcx, r12
call fcn.140100b40
mov rbx, rax
test rax, rax
je 0x14006edca
lea rcx, [rsp + 0x58]
call fcn.1400056e0
lea rdx, [rsp + 0x58]
lea rcx, [rbx + 0x12]
call fcn.14007cbf0
mov rcx, qword [rsp + 0x58]
cmp dword [rcx - 8], 1
jle 0x14006ecd5
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140005760
mov rcx, qword [rsp + 0x58]
call fcn.140115e5c
mov r8d, eax
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x14006edac
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006edc3
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edi, edi
mov word [rbp + 0x5b0], di
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
mov edx, 0x2ad
mov rcx, r13
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006ed8b
cmp byte [0x1401776f0], dil
je 0x14006ed58
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], dil
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
mov edx, 0x2ad
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006ed8b
mov word [rbp + 0x5b0], di
mov r9d, InitCommonControls
lea r8, str.Process_Lasso
lea rdx, [rbp + 0x5b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14006ec7e
mov edx, 0x3a98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x14017ab01], 1
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
call fcn.140002e00
test rax, rax
je 0x14006fe7d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x70], rax
test rbx, rbx
je 0x14006ee1e
cmp rbx, 0x10000
jae 0x14006ee0e
movzx edx, bx
lea rcx, [rbp - 0x70]
call fcn.1400058a0
jmp 0x14006ee2e
mov r8, rsi
inc r8
cmp word [rbx + r8*2], 0
jne 0x14006ee11
jmp 0x14006ee21
mov r8d, edi
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140005a90
nop
lea rcx, [rbp - 0x70]
call fcn.14003ec10
mov rbx, qword [rbp - 0x70]
cmp dword [rbx - 0x10], 0
jl 0x14006ef63
lea rdx, str._nag
mov rcx, rbx
call fcn.140100b40
test rax, rax
je 0x14006ef63
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14006ef63
mov qword [rsp + 0x20], 0xbb80291
lea r9, [0x1400047d0]
mov r8, qword [0x14017ad28]
mov edx, 0xc3
mov rcx, qword [0x14017ae30]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [rsp + 0x20], 0x1ce
lea r9, [0x1400047d0]
mov r8, qword [0x14017ad28]
mov edx, 0xc3
mov rcx, qword [0x14017ae30]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [rsp + 0x20], rdi
lea r9, [0x140003270]
xor r8d, r8d
mov edx, 0xc9
mov rcx, qword [0x14017ae30]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [rsp + 0x20], rdi
lea r9, [0x140068e80]
xor r8d, r8d
mov edx, 0x13bf
mov rcx, qword [0x14017ae30]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006ef1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x220]
call fcn.14000a9d0
nop
lea rcx, [rbp + 0x38]
call fcn.1400031d0
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006ef5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14006fe3e
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006ef7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea rcx, str.ProcessLasso_Notification_Class
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14006f03e
call fcn.1400bcce0
test al, al
jne 0x14006efa2
call fcn.1400bcfa0
lea rdx, str._no_raise_existing
mov rcx, r12
call fcn.140100b40
test rax, rax
jne 0x14006eff6
lea rdx, str._noraiseexisting
mov rcx, r12
call fcn.140100b40
test rax, rax
jne 0x14006eff6
xor edx, edx
lea rcx, str.ProcessLasso_Notification_Class
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14006eff6
mov r9d, 0x202
xor r8d, r8d
mov edx, 0x401
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
nop
lea rcx, [rbp + 0x220]
call fcn.14000a9d0
nop
lea rcx, [rbp + 0x38]
call fcn.1400031d0
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f039
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14006fe3e
lea rdx, str.nosortpowerprofiles
lea rcx, [0x14017c4f0]
call fcn.140073310
movzx r8d, byte [rax]
lea rdx, str.nosortpowerprofiles
lea rcx, [0x14017c4f0]
call fcn.140073e30
call fcn.140002e00
mov rcx, rax
test rax, rax
je 0x14006fe7d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea r9, [0x1401467a0]
lea r8, [rbp - 0x80]
lea rdx, str.GvrServicePassword
lea rcx, [0x14017c600]
call fcn.140073b00
test al, al
je 0x14006f0d0
lea rdx, str.GvrServiceUser
lea rcx, [0x14017c600]
call fcn.140074480
lea rdx, str.GvrServicePassword
lea rcx, [0x14017c600]
call fcn.140074480
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f0ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.14006afc0
xor r12d, r12d
cmp al, 1
jne 0x14006f1b9
mov word [rbp + 0x1380], r12w
mov r9d, 0x3ff
lea r8, [rbp + 0x1380]
lea edx, [r9 - 0x33]
mov rcx, qword [0x14017ae30]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006f177
cmp byte [0x1401776f0], r12b
je 0x14006f144
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], r12b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rbp + 0x1380]
lea edx, [r9 - 0x33]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006f177
mov word [rbp + 0x1380], r12w
mov r9d, 0x1034
lea r8, str.Process_Lasso
lea rdx, [rbp + 0x1380]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14006f1b9
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.http:__support.microsoft.com_kb_972034
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rbp + 0x3b0]
call fcn.1400c7920
nop
lea rcx, [rbp + 0x3b0]
call fcn.1400c9c20
call fcn.1400c9260
lea rcx, str.Processor
call fcn.1400cfa10
lea r14, [0x140174690]
test al, al
jne 0x14006f202
lea rcx, str.Processor_Information
call fcn.1400cfa10
test al, al
je 0x14006f2af
lea rcx, str.Processor
call fcn.1400cfb10
lea rcx, str.Processor_Information
call fcn.1400cfb10
mov word [rbp + 0x5b0], r12w
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
lea edx, [r9 - 0x59]
mov rcx, r13
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006f28f
cmp byte [0x1401776f0], al
je 0x14006f25c
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], 0
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
lea edx, [r9 - 0x59]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006f28f
mov word [rbp + 0x5b0], r12w
mov qword [rsp + 0x20], r14
mov r9d, 0x2000010
lea r8, str.Process_Lasso
lea rdx, [rbp + 0x5b0]
xor ecx, ecx
call fcn.1400c17c0
mov r15d, 1
mov dword [rbp + 0xd0], r15d
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], 0
xor r8d, r8d
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
lea r9, str.LocalPLGUIExitAllThreads
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14017ad20], rax
mov qword [0x14017ad38], rax
mov r15, qword [rbp + 0x63b0]
mov rcx, r15
call fcn.14006b930
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x14006f438
mov word [rbp + 0x5b0], r12w
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
mov edx, 0xf0
mov rcx, r13
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006f3a4
cmp byte [0x1401776f0], al
je 0x14006f370
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], 0
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
mov edx, 0xf0
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006f3a4
mov word [rbp + 0x5b0], r12w
mov r9d, InitCommonControls
lea r8, str.Process_Lasso
lea rdx, [rbp + 0x5b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
lea rcx, [rbp + 0x3b0]
call fcn.1400c7d00
nop
lea rcx, [rbp + 0x220]
call fcn.14000a9d0
nop
lea rcx, [rbp + 0x38]
call fcn.1400031d0
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006f411
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14006f42e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
jmp 0x14006fe5c
mov edi, 1
mov edx, edi
mov ecx, 0x3ff
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.140004290
mov ebx, eax
call fcn.1400065f0
test al, al
je 0x14006f506
lea rcx, [rbp + 0x38]
call fcn.140084780
test al, al
jne 0x14006f506
cmp ebx, 0xe
jle 0x14006f506
mov qword [rsp + 0x20], r12
lea r9, [0x140003270]
xor r8d, r8d
mov edx, 0xc9
mov rcx, qword [0x14017ae30]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea rcx, [rbp + 0x38]
call fcn.140084780
test al, al
jne 0x14006f4e1
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
lea edx, [r9 - 8]
mov rcx, r13
call fcn.140085d00
mov rdx, rax
mov r9d, 0x10010
lea r8, str.Process_Lasso
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsp + 0x20], edi
lea r9, str.ValidCPU
lea r8, str.SoftwareProcessLasso
mov rdx, 0xffffffff80000001
call fcn.140088930
mov byte [0x14017ab01], dil
xor ecx, ecx
call fcn.140116574
mov rcx, rax
call fcn.14011655c
call fcn.140116530
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
cmp r8d, 0x64
jge 0x14006f57c
lea rdx, [0x140149108]
lea rcx, [0x14017c600]
call fcn.140073310
cmp byte [rax], 0
jne 0x14006f57c
lea rax, [rbp + 0x84]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, qword [0x14017ad38]
lea r8, [0x140081b80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor dil, dil
mov byte [rsp + 0x60], dil
mov dword [rbp - 0x14], r12d
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, str.NoShowOffer
lea rcx, [0x14017c4f0]
call fcn.1400734c0
cmp byte [rsp + 0x60], dil
jne 0x14006f67e
call fcn.14006b820
cmp al, 1
jne 0x14006f67e
cmp ebx, 8
jle 0x14006f67e
mov eax, dword [0x140173e2c]
add eax, 0xfffffbfc
test eax, 0xfffffbff
je 0x14006f67e
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006f64e
mov dword [rbp - 0x18], 4
mov dword [rbp - 0x10], 4
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x14]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x140149a44]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 8]
test eax, eax
je 0x14006fd5b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x20], r12
lea r9, [0x140068e80]
xor r8d, r8d
mov edx, 0x13bf
mov rcx, qword [0x14017ae30]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
movzx edi, dil
test ax, ax
mov eax, 1
cmove edi, eax
call fcn.14006b820
cmp al, 1
jne 0x14006f6af
test dil, dil
jne 0x14006f6af
mov eax, InitCommonControls
cmp ebx, eax
cmovg ebx, eax
imul r9d, ebx, 0x3e8
mov r8d, 0x291
mov rdx, qword [0x14017ad28]
call fcn.140005090
lea r8, [rbp + 0x98]
xor edx, edx
lea rcx, [rbp + 0x1b80]
call fcn.14009c730
mov eax, dword [rbp + 0x4cac]
mov dword [0x140173dac], eax
mov dword [0x140173d2c], eax
call fcn.140004290
test eax, eax
jle 0x14006f7b9
cmp dword [rbp + 0x4c50], 0x50106
je 0x14006f7b9
mov word [rbp + 0x5b0], r12w
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
mov edx, 0x324
mov rcx, r13
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006f76a
cmp byte [0x1401776f0], al
je 0x14006f736
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], 0
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
mov edx, 0x324
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006f76a
mov word [rbp + 0x5b0], r12w
mov qword [rsp + 0x20], r14
mov r9d, 0x1000023
lea r8, str.Process_Lasso
lea rdx, [rbp + 0x5b0]
xor ecx, ecx
call fcn.1400c17c0
movzx ecx, ax
sub ecx, 2
je 0x14006f7a3
cmp ecx, 4
jne 0x14006f7a3
lea rcx, [rbp + 0x1b80]
call fcn.1400ada80
mov dword [rbp + 0x4c50], 0x50106
lea rcx, [rbp + 0x1b80]
call fcn.140095520
mov qword [0x14017acd8], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x6d
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov r15, rax
call fcn.140086190
call fcn.14006d900
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x81
call qword [sym.imp.USER32.dll_LoadIconW]
mov rbx, rax
mov ecx, 0x48b0
call fcn.1400ff088
mov qword [rbp + 0x160], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
mov r9, rbx
lea r8, str.Process_Lasso
mov rdx, qword [0x14017ae30]
mov rcx, rax
call fcn.140025af0
mov rbx, rax
mov qword [0x14017ada0], rax
mov rax, qword [0x14017c4a0]
cmp dword [rax - 0x10], 0
je 0x14006f868
lea rcx, [rbx + 0x3ea0]
lea rdx, [0x14017c4a0]
call fcn.14003f3d0
mov byte [rbx + 0x3ed0], 0
mov rbx, qword [0x14017ada0]
mov rax, qword [0x14017ad68]
mov qword [rbx + 0x730], rax
mov rcx, rbx
call fcn.1400269e0
mov qword [0x14017ad28], rax
mov qword [rbp - 0x68], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp - 0x60], rax
mov rbx, qword [0x14017ad68]
cmp qword [rbp - 0x68], 0
je 0x14006f8db
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x1388
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14006f8d7
mov edx, 1
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbp - 0x68], r12
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x58], 0x416
lea rax, [rbp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x68]
lea r8, [0x140071d60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x14006b8b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
lea rax, [rbp + 0x94]
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x1400867a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14017b668], rax
lea rax, [rbp - 0xc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x1400700f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
cmp byte [0x14017ab01], bl
je 0x14006f9ff
call fcn.1400bcce0
test al, al
je 0x14006f9ff
call fcn.1400351e0
nop word [rax + rax]
lea r8, str.GlobalPLProcessGovernorExists
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
jne 0x14006f9e2
lea r8, str.LocalPLProcessGovernorExists
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x14006f9fd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x14006f9b0
xor ebx, ebx
call fcn.1400bcce0
test al, al
jne 0x14006fa19
cmp byte [rsp + 0x61], al
jne 0x14006fa19
cmp byte [rsp + 0x50], al
jne 0x14006fa19
call fcn.1400bcfa0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x14006a380]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x14006a950]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
call fcn.1400c57a0
test al, al
jne 0x14006faad
lea rdx, str.DisablePostUpdateNotify
lea rcx, [0x14017c600]
call fcn.140073310
cmp byte [rax], 0
jne 0x14006faad
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14006bc70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
lea rcx, [rbp + 0xe8]
call fcn.14000ed10
nop
cmp qword [rbp + 0xf8], 0
je 0x14006faff
lea rcx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 7
cmova rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006faff
xor r9d, r9d
xor r8d, r8d
mov edx, 0x420
mov rcx, qword [0x14017ad68]
call qword [sym.imp.USER32.dll_PostMessageW]
nop
lea rcx, [rbp + 0xe8]
call fcn.1400406b0
call fcn.14006feb0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x168]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14006fb88
nop dword [rax]
cmp eax, 0xffffffff
je 0x14006fb6f
mov rcx, qword [0x14017ad28]
test rcx, rcx
je 0x14006fb55
lea r8, [rbp + 0x168]
mov rdx, r15
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x14006fb6f
lea rcx, [rbp + 0x168]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x168]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x168]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14006fb30
test rbx, rbx
je 0x14006fb96
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14006fba4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017ad20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor edx, edx
mov r8d, 0x3d0
lea rcx, [rbp + 0xfb0]
call fcn.14012ce40
mov dword [rbp + 0xfb0], 0x3d0
mov rax, qword [0x14017ad68]
mov qword [rbp + 0xfb8], rax
mov dword [rbp + 0xfc0], 0x9317
mov dword [rbp + 0xfc8], 0x401
lea rdx, [rbp + 0xfb0]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, str.LocalPLRESEXIT
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x5dc
mov rcx, qword [0x14017b668]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 1
cmp eax, 0x102
jne 0x14006fc58
mov edx, ebx
mov rcx, qword [0x14017b668]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
lea rcx, [0x14017acf0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test r14, r14
je 0x14006fc80
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x14006fc8e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x14006fc9c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017ad20]
test rcx, rcx
je 0x14006fcae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14017acd0]
test rcx, rcx
je 0x14006fcc0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14017ad40]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
cmp qword [rbp - 0x68], 0
je 0x14006fd06
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x1388
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14006fcfe
mov edx, ebx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rbp - 0x68], 0
lea rcx, [rbp + 0x3b0]
call fcn.1400c7d00
nop
lea rcx, [rbp + 0x220]
call fcn.14000a9d0
nop
lea rcx, [rbp + 0x38]
call fcn.1400031d0
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006fd56
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14006fe3e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14006f67e
mov word [rbp + 0x5b0], r15w
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
mov edx, 0x29b
mov rcx, r13
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006fddd
cmp byte [0x1401776f0], al
je 0x14006fda9
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x1401776f0], 0
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r9d, 0x3ff
lea r8, [rbp + 0x5b0]
mov edx, 0x29b
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14006fddd
mov word [rbp + 0x5b0], r15w
lea r14, [0x140174690]
mov qword [rsp + 0x20], r14
mov r9d, 0x24
lea r8, str.Process_Lasso
lea rdx, [rbp + 0x5b0]
xor ecx, ecx
call fcn.1400c17c0
cmp ax, 6
jne 0x14006fe17
lea rcx, [rbp + 0x1b80]
call fcn.1400ad1c0
nop
lea rcx, [rbp + 0x1b80]
call fcn.140094550
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006fe3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14006fe5a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
lea r11, [rsp + 0x6480]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
nop
mov ecx, 0x80004005
call fcn.140002b00
int3