Function at 0x140046644
Capabilities:
Query service status
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, rdx
xor r13d, r13d
mov dword [rbp - 0x70], r13d
test rcx, rcx
je 0x140048f54
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
lea r8, [rdx + 8]
lea rdx, [rcx - 1]
lea r9, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.1400ff24c
mov ebx, eax
test eax, eax
js 0x140048f5f
mov rsi, qword [0x1401765e0]
mov rcx, qword [rsp + 0x40]
mov qword [0x1401765e0], rcx
mov qword [rbp + 0xa8], rsi
mov rbx, qword [rdi]
movzx eax, word [rbx]
sub ax, 0x2d
mov edx, 0xfffd
lea edi, [r13 + 2]
test dx, ax
jne 0x1400466e7
add rbx, rdi
mov rax, qword [rcx]
lea rdx, [0x140126450]
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x140046709
call fcn.140049938
jmp 0x1400468dc
mov dword [rbp - 0x48], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp - 0x48]
xor edx, edx
lea rcx, str.MpCmdRun_Assert
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
test eax, eax
jns 0x140046739
mov eax, r13d
mov dword [rbp - 0x48], eax
jmp 0x14004673c
mov eax, dword [rbp - 0x48]
test eax, eax
je 0x140046746
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov qword [rsp + 0x48], r13
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.MpCmdRunWithTracing
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x140046792
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140046783
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call fcn.140107c30
mov qword [rsp + 0x48], r13
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140069ab0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.RestrictPrivileges
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov r14d, 1
lea r12, str.Reinvoke
test rax, rax
je 0x14004686b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, r12
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
jne 0x14004686b
lea rdx, str.SignaturesUpdateService
mov rcx, rbx
call fcn.1400059ec
test eax, eax
je 0x14004686b
lea rdx, str.SignatureUpdate
mov rcx, rbx
call fcn.1400059ec
test eax, eax
je 0x14004686b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.WaitForCompletion
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov dword [rbp - 0x30], r13d
test rax, rax
je 0x14004682d
lea rdx, [rbp - 0x30]
mov dil, r14b
jmp 0x140046833
mov dil, r13b
mov rdx, r13
movzx ecx, dil
call fcn.1400505e0
test dil, dil
je 0x140046862
test eax, eax
js 0x140048e28
mov eax, dword [rbp - 0x30]
test eax, eax
jle 0x14004685a
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140048e28
jmp 0x1400468c5
test eax, eax
jns 0x1400468c5
mov edi, 2
lea rdx, str.Scan
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046933
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.ReturnHR
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x1400468a6
mov byte [0x140174f2c], r14b
mov rcx, qword [rsp + 0x40]
call fcn.14004c4d8
cmp byte [0x140174f2c], r13b
je 0x1400468c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400468dc
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call fcn.140107c30
nop
mov qword [0x1401765e0], rsi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400468f3
call fcn.140030ba0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140046909
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call fcn.140107c30
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140030b80
mov rbx, qword [rsp + 0x280]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.SignatureUpdate
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046979
call fcn.1400f6724
test al, al
je 0x14004696a
call fcn.1400f66dc
cmp eax, r14d
jne 0x14004696a
lea rcx, str.A_process_other_than_WinDefend_attempted_to_trigger_a_signature_update_during_a_MOCAMP_update__rejecting_attempt_n
call fcn.1400f5500
jmp 0x1400468c5
mov rcx, qword [rsp + 0x40]
call fcn.14004eef0
jmp 0x1400468c5
lea rdx, str.SignatureUpdateAndQuickScan
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046a7e
call fcn.1400f6724
test al, al
je 0x1400469a3
call fcn.1400f66dc
cmp eax, r14d
je 0x140046959
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400469d1
test byte [rcx + 0x1c], 4
je 0x1400469d1
mov edx, 0x23
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
mov rcx, qword [rsp + 0x40]
call fcn.14004eef0
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140046a02
test byte [rcx + 0x1c], 4
je 0x140046a02
mov edx, 0x24
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x48], r13
lea rax, str._ScanType
mov qword [rbp + 0x98], rax
lea rax, [0x1401266b4]
mov qword [rbp + 0xa0], rax
lea r9, [rbp + 0x48]
lea r8, [rbp + 0x98]
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.1400ff24c
mov edi, eax
test eax, eax
js 0x140048f7d
mov rcx, qword [rbp + 0x10]
call fcn.14004c4d8
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140046a60
call fcn.140030ba0
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400468c5
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call fcn.140107c30
jmp 0x1400468c5
lea rdx, [0x1401266b8]
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046ad6
call fcn.1400f6820
test al, al
jne 0x140046acc
mov dword [rbp - 0x2c], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rcx, [rbp - 0x2c]
mov rax, qword [rax + 0x98]
call fcn.140107c30
nop
test eax, eax
js 0x140048fac
cmp dword [rbp - 0x2c], r13d
je 0x140048fac
call fcn.1400f5ca4
call fcn.14007c58c
jmp 0x1400468c5
lea rdx, str.getfiles
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046c43
call fcn.1400f5ca4
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call fcn.140107c30
mov r15, rax
mov rcx, qword [rsp + 0x40]
mov r8, qword [rcx]
mov rdx, r12
mov rax, qword [r8 + 0x18]
call fcn.140107c30
test rax, rax
je 0x140046b22
sub r15, r14
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.SupportLogLocation
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov rdi, rax
mov r8, rax
mov rdx, rax
test rax, rax
setne r12b
test rax, rax
je 0x140046b5b
movzx eax, word [rax]
neg ax
sbb rcx, rcx
and rdi, rcx
cmp r15, r14
ja 0x140048eb6
test rdx, rdx
jne 0x140046b72
test r15, r15
jne 0x140048eb6
test r8, r8
je 0x140046b80
cmp r15, r14
jne 0x140048eb6
call fcn.1400461a8
test al, al
jne 0x140046c31
cmp r15, r14
jne 0x140046c01
mov qword [rbp + 0x18], r13
lea r8, [0x140120ad4]
test rdi, rdi
cmovne r8, rdi
lea rdx, str.GetFiles__SupportLogLocation__ls
lea rcx, [rbp + 0x18]
call fcn.1400fb304
mov edi, eax
test eax, eax
js 0x140048fc3
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x18]
call fcn.14004638c
test eax, eax
js 0x14004900a
mov eax, dword [rbp - 0x70]
test eax, eax
jle 0x140046be4
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x14004900a
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400468c5
call fcn.140030ba0
jmp 0x1400468c5
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.14004638c
test eax, eax
js 0x140048e30
mov eax, dword [rbp - 0x70]
test eax, eax
jle 0x140046c26
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140048e30
jmp 0x1400468c5
mov r8, rdi
mov dl, r12b
xor ecx, ecx
call fcn.14005b8bc
jmp 0x1400468c5
lea rdx, str.getfilesdiagtrack
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046cde
call fcn.1400f5ca4
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call fcn.140107c30
mov rdi, rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x18]
mov rdx, r12
call fcn.140107c30
test rax, rax
je 0x140046c8f
sub rdi, r14
test rdi, rdi
jne 0x140048eb6
call fcn.1400461a8
test al, al
jne 0x140046cd1
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.14004638c
test eax, eax
js 0x140048e38
mov eax, dword [rbp - 0x70]
test eax, eax
jle 0x140046cc6
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x140048e38
jmp 0x1400468c5
xor r8d, r8d
xor edx, edx
mov cl, r14b
jmp 0x140046c39
lea rdx, str.WriteLogsForSvc
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046d40
call fcn.1400f5ca4
mov ecx, r14d
call fcn.1400e848c
test eax, eax
jns 0x1400468c5
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140046d34
test byte [rcx + 0x1c], r14b
je 0x140046d34
mov edx, 0x98
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
lea rcx, str.ERROR:_Dumping_Log_Failed
jmp 0x140046960
lea rdx, str.SpyNetService
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046d64
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.14006a398
jmp 0x1400468c5
lea rdx, str.SpyNetServiceDss
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046d7c
mov dl, r14b
jmp 0x140046d55
lea rdx, str.SampleHeaderService
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046dbc
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.HighPriority
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
setne dl
mov rcx, qword [rsp + 0x40]
call fcn.14007ab6c
jmp 0x1400468c5
lea rdx, str.SignaturesUpdateService
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046dfd
call fcn.1400f6724
test al, al
je 0x140046dee
call fcn.1400f66dc
cmp eax, r14d
jne 0x140046dee
lea rcx, str.A_process_other_than_WinDefend_attempted_to_create_a_signature_update_service_during_a_MOCAMP_update__rejecting_attempt_n
jmp 0x140046960
mov rcx, qword [rsp + 0x40]
call fcn.14006ab2c
jmp 0x1400468c5
lea rdx, str.ClearClipboard
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046e1a
call fcn.14004933c
jmp 0x1400468c5
lea rdx, str.GetLoadLibraryWAddress32
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046e44
mov rcx, qword [rsp + 0x40]
call fcn.14004946c
test eax, eax
js 0x140048e40
jmp 0x1400468c5
lea rdx, str.GetLoadLibraryWAddress
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046e6e
mov rcx, qword [rsp + 0x40]
call fcn.14004946c
test eax, eax
js 0x140048e48
jmp 0x1400468c5
lea rdx, str.RemoveDefinitions
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046e95
call fcn.1400f5ca4
mov rcx, qword [rsp + 0x40]
call fcn.14004e9c0
jmp 0x1400468c5
lea rdx, str.Trace
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046eb9
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.140069ab0
jmp 0x1400468c5
lea rdx, str.CaptureNetworkTrace
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046f70
call fcn.1400f5ca4
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.path
mov rax, qword [rax + 0x18]
call fcn.140107c30
lea rbx, [0x140120ad4]
test rax, rax
cmovne rbx, rax
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpNetworkCapture]
mov edi, eax
test eax, eax
jns 0x140046f2b
mov edx, eax
lea rcx, str.Failed_to_start_network_trace__Error__lx_n
call fcn.1400f5500
mov edx, edi
lea rcx, str.Failed_to_start_network_trace__Error__lx_n
call fcn.14004ac64
jmp 0x1400468c5
cmp edi, r14d
jne 0x140046f4d
lea rcx, str.Successfully_stopped_Network_Capture_n
call fcn.1400f5500
lea rcx, str.Successfully_stopped_Network_Capture_n
call fcn.14004ac64
jmp 0x1400468c5
mov rdx, rbx
lea rcx, str.Successfully_started_Network_Capture__capturing_to__ws_n
call fcn.1400f5500
mov rdx, rbx
lea rcx, str.Successfully_started_Network_Capture__capturing_to__ws_n
call fcn.14004ac64
jmp 0x1400468c5
lea rdx, str.RestoreDefaults
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046f9a
call fcn.1400f5ca4
call fcn.14006a230
test eax, eax
js 0x140048e50
jmp 0x1400468c5
lea rdx, str.UnregisterWSC
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140046fbc
mov rcx, qword [rsp + 0x40]
call fcn.14006c5d0
jmp 0x1400468c5
lea rdx, str.IdleTask
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047007
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
lea rdx, str.TaskName
mov rcx, rbx
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x140049012
or r8d, 0xffffffff
mov rdx, rax
mov rcx, rbx
call fcn.14006f10c
jmp 0x1400468c5
lea rdx, str.BuildSFC
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047029
mov rcx, qword [rsp + 0x40]
call fcn.14006ef50
jmp 0x1400468c5
lea rdx, str.Restore
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047050
call fcn.1400f5ca4
mov rcx, qword [rsp + 0x40]
call fcn.140071584
jmp 0x1400468c5
lea rdx, str.ServiceHardening
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047072
call fcn.1400f5ca4
call fcn.140072d08
jmp 0x1400468c5
lea rdx, str.AddDynamicSignature
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047099
call fcn.1400f5ca4
mov rcx, qword [rsp + 0x40]
call fcn.14004e548
jmp 0x1400468c5
lea rdx, str.RemoveDynamicSignature
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x1400470c0
call fcn.1400f5ca4
mov rcx, qword [rsp + 0x40]
call fcn.14004ed14
jmp 0x1400468c5
lea rdx, str.ListAllDynamicSignatures
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x1400470e2
call fcn.1400f5ca4
call fcn.14004e7c8
jmp 0x1400468c5
lea rdx, str.DisableService
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x14004712a
call fcn.1400f5ca4
call fcn.1400f6724
test al, al
je 0x140047119
call fcn.1400f66dc
cmp eax, r14d
jne 0x140047119
lea rcx, str.A_process_other_than_WinDefend_attempted_to_disable_the_service_during_a_MOCAMP_update__rejecting_attempt_n
jmp 0x140046960
mov edx, 3
xor ecx, ecx
call fcn.14007275c
jmp 0x1400468c5
lea rdx, str.StopService
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047147
call fcn.1400f5ca4
mov edx, r14d
jmp 0x14004711e
lea rdx, str.UninstallServices
mov rcx, rbx
call fcn.1400059ec
test eax, eax
je 0x140048df4
lea rdx, str.MitigateServices
mov rcx, rbx
call fcn.1400059ec
test eax, eax
je 0x140048df4
lea rdx, str.PreloadMpSvc
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x1400471a6
mov byte [0x140174f2c], r14b
call fcn.1400f5ca4
call fcn.140042a78
test eax, eax
js 0x140048e58
jmp 0x1400468c5
lea rdx, str.EnableService
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x1400471ea
call fcn.1400f5ca4
call fcn.1400f6724
test al, al
je 0x1400471dd
call fcn.1400f66dc
cmp eax, r14d
jne 0x1400471dd
lea rcx, str.A_process_other_than_WinDefend_attempted_to_enable_the_service_during_a_MOCAMP_update__rejecting_attempt_n
jmp 0x140046960
mov edx, 3
mov ecx, r14d
jmp 0x140047120
lea rdx, str.RestartService
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047230
call fcn.1400f5ca4
call fcn.1400f6724
test al, al
je 0x140047221
call fcn.1400f66dc
cmp eax, r14d
jne 0x140047221
lea rcx, str.A_process_other_than_WinDefend_attempted_to_restart_the_service_during_a_MOCAMP_update__rejecting_attempt_n
jmp 0x140046960
mov edx, r14d
xor ecx, ecx
call fcn.14007275c
mov edx, r14d
jmp 0x1400471e2
lea rdx, str.ReloadEngine
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x1400472c7
mov dword [rbp + 0xb0], 0xd8b08b2d
mov dword [rbp + 0xb4], 0x4174215a
mov dword [rbp + 0xb8], 0xe83055ab
mov dword [rbp + 0xbc], 0x8781b424
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 4], eax
mov dword [rbp - 8], r13d
mov qword [rbp + 0x50], r13
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 8]
lea r8, [rbp - 4]
mov edx, 4
lea rcx, [rbp + 0xb0]
call fcn.1400e8784
mov ebx, eax
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1400472b3
call qword [sym.imp.mpclient.dll_MpFreeMemory]
test ebx, ebx
js 0x140049057
lea rcx, str.MpReloadEngine_finished._n
jmp 0x140046960
lea rdx, str.EnableSxSMode
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047487
lea rcx, str.EnableSxSMode_n
call fcn.1400f5500
mov qword [rbp - 0x10], r13
lea rcx, [rbp - 0x10]
call fcn.1400c7900
test eax, eax
jns 0x140047322
mov edx, eax
lea rcx, str.ERROR:_MpGetProductServiceName_failed._hr___lx_n
call fcn.1400f5500
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400468c5
call qword [sym.imp.mpclient.dll_MpFreeMemory]
jmp 0x1400468c5
mov r8d, r14d
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
jne 0x140047364
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140047354
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x140047364
mov edx, eax
lea rcx, str.OpenSCManager_failed._hr___lx_n
call fcn.1400f5500
mov r8d, 4
mov rdx, qword [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov qword [rbp + 0x88], rax
test rax, rax
jne 0x1400473aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14004739a
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1400473aa
mov edx, eax
lea rcx, str.OpenService_failed._hr___lx_n
call fcn.1400f5500
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], eax
lea rdx, [rbp + 0x100]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400473fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400473eb
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1400473fb
mov edx, eax
lea rcx, str.QueryServiceStatus_failed._hr___lx_n
call fcn.1400f5500
cmp dword [rbp + 0x104], r14d
jne 0x14004906d
mov qword [rbp + 0x20], r13
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
test eax, eax
jns 0x14004742a
mov edx, eax
lea rcx, str.MpManagerOpen_failed._hr___lx_n
call fcn.1400f5500
mov edx, 4
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.mpclient.dll_MpManagerEnable]
mov r14d, eax
test eax, eax
js 0x140049084
lea rcx, str.Service_was_successfully_enabled_in_side_by_side_passive_mode._n
call fcn.1400f5500
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140047461
call qword [sym.imp.mpclient.dll_MpHandleClose]
nop
test rdi, rdi
je 0x140047470
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
test rbx, rbx
je 0x14004730a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14004730a
lea rdx, str.WDEnable
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047507
lea rcx, str.WDEnable_n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
call fcn.1400eedbc
test eax, eax
jne 0x1400474e8
mov cl, r14b
call fcn.140049840
test al, al
jne 0x1400474e8
mov dl, r14b
xor ecx, ecx
call fcn.14006c088
test eax, eax
jns 0x1400474e0
mov edx, eax
lea rcx, str.ERROR:_RunCommandCollectWscInfo___failed___lx__n
call fcn.1400f5500
jmp 0x1400474e8
mov cl, r14b
call fcn.14004976c
mov ecx, r14d
call qword [sym.imp.mpclient.dll_MpWDEnable]
mov ebx, eax
test eax, eax
js 0x14004909c
lea rcx, str.MpWDEnable_TRUE__finished._n
jmp 0x140046960
lea rdx, str.WDDisable
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x1400475f8
lea rcx, str.WDDisable_n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
mov dword [rbp - 0x50], r13d
lea r8, [rbp - 0x50]
call fcn.1400e8ba4
mov ebx, eax
test eax, eax
jns 0x140047552
mov edx, eax
lea rcx, str.ERROR:_CheckClientIdentity___failed___lx__n
call fcn.1400f5500
mov dword [rbp - 0x44], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea r8, [rbp - 0x44]
xor edx, edx
lea rcx, str.MpCmdRun_DisableIdentityCheck
mov rax, qword [rax + 0xa0]
call fcn.140107c30
nop
test eax, eax
jns 0x140047582
mov eax, r13d
mov dword [rbp - 0x44], eax
jmp 0x140047585
mov eax, dword [rbp - 0x44]
test eax, eax
je 0x14004758e
mov eax, r14d
jmp 0x140047599
test ebx, ebx
js 0x1400490b2
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400490ba
call fcn.1400eedbc
test eax, eax
jne 0x1400475da
xor ecx, ecx
call fcn.140049840
test al, al
jne 0x1400475da
mov dl, r14b
xor ecx, ecx
call fcn.14006c088
test eax, eax
jns 0x1400475d3
mov edx, eax
lea rcx, str.ERROR:_RunCommandCollectWscInfo___failed___lx__n
call fcn.1400f5500
jmp 0x1400475da
xor ecx, ecx
call fcn.14004976c
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpWDEnable]
mov ebx, eax
test eax, eax
js 0x1400490d1
lea rcx, str.MpWDEnable_FALSE__finished._n
jmp 0x140046960
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004761d
mov rax, qword [rcx]
lea rdx, str.Force
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
mov dil, r14b
jne 0x140047620
mov dil, r13b
lea r15, str.ResetPlatform
mov rdx, r15
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x1400476f2
mov rdx, r15
lea rcx, str._ls_n
call fcn.1400f5500
call fcn.140046264
test al, al
je 0x14004767e
test dil, dil
jne 0x140047667
mov rcx, r15
call fcn.140046310
test al, al
je 0x1400468c5
call fcn.140045b44
test eax, eax
jns 0x14004767e
mov edx, eax
lea rcx, str.ERROR:_Failed_to_disable_TS_mode___lx__n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
mov qword [rbp - 0x20], r13
lea rcx, [rbp - 0x20]
call fcn.1400fb890
mov ebx, eax
test eax, eax
js 0x1400490e7
mov rcx, qword [rbp - 0x20]
call fcn.140042db0
mov ebx, eax
test eax, eax
jne 0x1400476d0
lea rcx, str.ResetPlatform_returned_successfully._n
call fcn.14004a5a8
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400468c5
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400468c5
cmp eax, r14d
jne 0x1400476de
lea rcx, str.Already_running_inbox_binaries._n
jmp 0x1400476b2
cmp eax, 0x8000000a
jne 0x1400490e7
lea rcx, str.ResetPlatform_returned_PENDING._Please_reboot_your_machine_to_reset_to_inbox_binaries._n
jmp 0x1400476b2
lea r15, str.RevertPlatform
mov rdx, r15
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x1400477b5
mov rdx, r15
lea rcx, str._ls_n
call fcn.1400f5500
call fcn.140046264
test al, al
je 0x140047750
test dil, dil
jne 0x140047739
mov rcx, r15
call fcn.140046310
test al, al
je 0x1400468c5
call fcn.140045b44
test eax, eax
jns 0x140047750
mov edx, eax
lea rcx, str.ERROR:_Failed_to_disable_TS_mode___lx__n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
lea rcx, [0x140120ad4]
call qword [sym.imp.mpclient.dll_MpUpdatePlatform]
mov ebx, eax
test eax, eax
jne 0x14004777b
lea rcx, str.MpUpdatePlatform_returned_successfully.
call fcn.14004a5a8
jmp 0x1400468c5
cmp ebx, r14d
jne 0x140047789
lea rcx, str.Revert_not_needed._Already_running_inbox_binaries.
jmp 0x140047771
cmp ebx, 0x8000000a
jne 0x14004779a
lea rcx, str.MpUpdatePlatform_returned_PENDING._Please_reboot_your_machine_for_the_revert_to_take_place.
jmp 0x140047771
mov edx, ebx
lea rcx, str.ERROR:_MpUpdatePlatform_failed___lx__n
call fcn.1400f5500
test ebx, ebx
js 0x140048e60
jmp 0x1400468c5
lea r15, str.RollbackPlatform
mov rdx, r15
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047879
mov rdx, r15
lea rcx, str._ls_n
call fcn.1400f5500
call fcn.140046264
test al, al
je 0x140047813
test dil, dil
jne 0x1400477fc
mov rcx, r15
call fcn.140046310
test al, al
je 0x1400468c5
call fcn.140045b44
test eax, eax
jns 0x140047813
mov edx, eax
lea rcx, str.ERROR:_Failed_to_disable_TS_mode___lx__n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
call qword [sym.imp.mpclient.dll_MpRollbackPlatform]
mov ebx, eax
test eax, eax
jne 0x14004783e
lea rcx, str.MpRollbackPlatform_returned_successfully._n
call fcn.14004a5a8
lea rcx, str.MpRollbackPlatform_returned_successfully.
jmp 0x140046960
cmp ebx, 0x8000000a
jne 0x14004785e
lea rcx, str.MpRollbackPlatform_returned_PENDING._Please_reboot_your_machine_to_rollback_to_the_last_known_good_platform._n
call fcn.14004a5a8
lea rcx, str.MpRollbackPlatform_returned_E_PENDING.
jmp 0x140046960
mov edx, ebx
lea rcx, str.ERROR:_MpRollbackPlatform_failed___lx__n
call fcn.1400f5500
test ebx, ebx
js 0x140048e68
jmp 0x1400468c5
lea rdx, str.UnblockPlatform
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x14004794b
lea rcx, str.UnblockPlatform_n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x140127ba0]
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x1400478c8
mov rax, r13
mov ecx, r14d
jmp 0x1400478ea
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x40]
call fcn.1400ff964
test rax, rax
je 0x140047920
mov ecx, r13d
cmp word [rax], r13w
je 0x140047920
mov rdx, rax
call qword [sym.imp.mpclient.dll_MpUnblockPlatform]
mov ebx, eax
test eax, eax
jne 0x140047905
lea rcx, str.MpUnblockPlatform_returned_successfully.
jmp 0x140047771
mov edx, ebx
lea rcx, str.ERROR:_MpUnblockPlatform_failed___lx__n
call fcn.1400f5500
test ebx, ebx
js 0x140048e70
jmp 0x1400468c5
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048eb6
test byte [rcx + 0x1c], r14b
je 0x140048eb6
mov edx, 0x27
jmp 0x140048ea6
lea rdx, str.UnblockEngine
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047a1d
lea rcx, str.UnblockEngine_n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x140127ba0]
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x14004799a
mov rax, r13
mov ecx, r14d
jmp 0x1400479bc
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x40]
call fcn.1400ff964
test rax, rax
je 0x1400479f2
mov ecx, r13d
cmp word [rax], r13w
je 0x1400479f2
mov rdx, rax
call qword [sym.imp.mpclient.dll_MpUnblockEngine]
mov ebx, eax
test eax, eax
jne 0x1400479d7
lea rcx, str.MpUnblockEngine_returned_successfully.
jmp 0x140047771
mov edx, ebx
lea rcx, str.ERROR:_MpUnblockEngine_failed___lx__n
call fcn.1400f5500
test ebx, ebx
js 0x140048e78
jmp 0x1400468c5
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048eb6
test byte [rcx + 0x1c], r14b
je 0x140048eb6
mov edx, 0x28
jmp 0x140048ea6
lea rdx, str.UnblockSignatures
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047acc
lea rcx, str.UnblockSignatures_n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x140127ba0]
mov rax, qword [rax + 0x18]
call fcn.140107c30
test rax, rax
je 0x140047a6c
mov rax, r13
mov ecx, r14d
jmp 0x140047a96
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x40]
call fcn.1400ff964
test rax, rax
je 0x140048e88
mov ecx, r13d
cmp word [rax], r13w
je 0x140048e88
mov rdx, rax
call qword [sym.imp.mpclient.dll_MpUnblockSignatures]
mov ebx, eax
test eax, eax
jne 0x140047ab1
lea rcx, str.MpUnblockSignatures_returned_successfully.
jmp 0x140047771
mov edx, ebx
lea rcx, str.ERROR:_MpUnblockSignatures_failed___lx__n
call fcn.1400f5500
test ebx, ebx
js 0x140048e80
jmp 0x1400468c5
lea rdx, str.ValidateMapsConnection
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047cef
lea rcx, str.ValidateMapsConnection_n
call fcn.1400f5500
mov byte [0x140174f2c], r14b
lea rcx, [0x140126140]
call fcn.1400f5528
mov byte [rsp + 0x68], r13b
lea rcx, [rsp + 0x68]
call fcn.1400c91fc
lea r8, str.true
lea rcx, str.false
cmp byte [rsp + 0x68], r13b
cmove r8, rcx
mov edx, eax
lea rcx, str.MpIsConnectedToInternet__:_hr___lx__fIsConnectToInternet:__ls_n
call fcn.1400f5528
call fcn.1400c950c
mov edx, eax
lea rcx, str.MpIsPaidNetwork__:_hr___lx__0___S_OK__paid__1___S_FALSE__not_paid__other___failure__n
call fcn.1400f5528
lea rcx, [0x140126330]
call fcn.1400f5528
mov qword [rbp + 0x58], r13
lea r8, str.LastMAPSSuccessTime
lea rdx, str.SpyNet
lea rcx, [rbp + 0x58]
call fcn.1400c6894
test eax, eax
js 0x140047c5a
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0xf0], xmm1
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140047c2a
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test eax, eax
je 0x140047c2a
mov qword [rbp + 0x28], r13
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x28]
call fcn.1400c7e18
test eax, eax
js 0x140047be9
mov rdx, qword [rbp + 0x28]
lea rcx, str.Last_Successful_MAPS_connection:___ls__n
call fcn.1400f5528
jmp 0x140047c1a
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140047c1a
test byte [rcx + 0x1c], r14b
je 0x140047c1a
mov edx, 0x2a
mov r9d, eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140047c8b
call fcn.140030ba0
jmp 0x140047c8b
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140047c8b
test byte [rcx + 0x1c], r14b
je 0x140047c8b
mov edx, 0x2b
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
jmp 0x140047c8b
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140047c8b
test byte [rcx + 0x1c], r14b
je 0x140047c8b
mov edx, 0x2c
mov r9d, eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov dword [rbp - 0x40], r13d
mov dword [rbp - 0x28], r13d
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x40]
mov rax, qword [rax + 0x178]
call fcn.140107c30
mov ebx, eax
test eax, eax
js 0x1400490fd
mov edx, dword [rbp - 0x40]
test edx, edx
jne 0x140047ccf
lea rcx, str.ValidateMapsConnection_successfully_established_a_connection_to_MAPS_n
call fcn.1400f5528
jmp 0x1400468c5
mov r8d, dword [rbp - 0x28]
lea rcx, str.ValidateMapsConnection_failed_to_establish_a_connection_to_MAPS__hr_lx_httpcode_ld__n
call fcn.1400f5528
mov ecx, dword [rbp - 0x40]
test ecx, ecx
js 0x140048ec1
jmp 0x1400468c5
lea rdx, str.DownloadOfflineScanner
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047d11
mov rcx, qword [rsp + 0x40]
call fcn.140075300
jmp 0x1400468c5
lea rdx, str.SubmitSamples
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047d33
mov rcx, qword [rsp + 0x40]
call fcn.140075d54
jmp 0x1400468c5
lea rdx, str.GetDeviceTicket
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047d55
mov rcx, qword [rsp + 0x40]
call fcn.140078d8c
jmp 0x1400468c5
lea rdx, str.Roles
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047d72
call fcn.1400748b4
jmp 0x1400468c5
lea rdx, str.RevokeTrustedUsn
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047d94
mov rcx, qword [rsp + 0x40]
call fcn.14007b308
jmp 0x1400468c5
lea rdx, str.CheckExclusion
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047f0d
xor r8d, r8d
lea rdx, str.path
mov rcx, qword [rsp + 0x40]
call fcn.1400ff964
mov rbx, rax
test rax, rax
je 0x140048eb6
mov qword [rbp + 0x38], r13
lea rdx, [rbp + 0x38]
lea rcx, str.Real_Time_Protection
call qword [sym.imp.mpclient.dll_MpConfigOpen]
test eax, eax
js 0x140049113
mov qword [rbp + 0x30], r13
mov ecx, 2
mov dword [rbp + 4], ecx
mov dword [rbp], r13d
mov qword [rsp + 0x28], r13
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
lea r8, [rbp + 4]
lea rdx, str.IncludedLocalDriveLetters
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
test eax, eax
js 0x14004911b
mov rdx, qword [rbp + 0x30]
test rdx, rdx
je 0x140047e42
cmp word [rdx], r13w
je 0x140047e42
lea rcx, str.WARNING:_Drive_letter_inclusion___ls__detected._The_exclusion_check_result_below_is_no_longer_accurate._n
call fcn.1400f5528
mov rdx, rbx
lea rcx, str.Validating_path___ls__..._n
call fcn.1400f5500
mov qword [rbp - 0x18], r13
mov rdx, rbx
lea rcx, [rbp - 0x18]
call fcn.1400c99e0
test eax, eax
js 0x140049123
mov dword [rbp - 0x50], r13d
mov rdx, qword [rbp - 0x18]
lea rcx, str.Calling_into_service_to_check_exclusion_for___ls__..._n
call fcn.1400f5500
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x18]
call fcn.1400e85d4
test eax, eax
js 0x14004912b
mov eax, dword [rbp - 0x50]
test eax, eax
jne 0x140047ea2
mov dword [0x140174f28], r14d
jmp 0x140047ea9
mov r14d, dword [0x140174f28]
lea r9, str.excluded
lea rcx, str.not_excluded
test eax, eax
cmove r9, rcx
mov dword [rsp + 0x20], r14d
mov r8, qword [rbp - 0x18]
mov rdx, rbx
lea rcx, str._ls___ls__is__ls._Exit_code_is__ld._n
call fcn.1400f5528
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140047ee5
call fcn.140030ba0
nop
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140047ef5
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400468c5
call qword [sym.imp.mpclient.dll_MpConfigClose]
jmp 0x1400468c5
lea rdx, str.PerformanceReport
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047f45
mov rcx, qword [rsp + 0x40]
call fcn.14009bbe8
test eax, eax
jns 0x1400468c5
mov edx, eax
lea rcx, str.Call_to_RunCommandMpPerformanceReport_failed_hr___lx_n
call fcn.1400f5500
jmp 0x1400468c5
lea rdx, str.TPState
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047fcf
call fcn.140046264
test al, al
je 0x140049133
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [0x1401284bc]
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov rbx, rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x18]
lea rdx, [0x1401284c8]
call fcn.140107c30
test rbx, rbx
je 0x140047fa8
test rax, rax
jne 0x140048ec7
jmp 0x140047fb8
neg rax
sbb eax, eax
not eax
mov r14d, 2
and r14d, eax
mov ecx, r14d
call fcn.1400a6618
mov ebx, eax
test eax, eax
js 0x140048ede
jmp 0x1400468c5
lea rdx, str.TSMode
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140047ff6
call fcn.140045c74
mov ebx, eax
test eax, eax
js 0x140048ef4
jmp 0x1400468c5
lea rdx, [0x140128640]
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048142
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.default
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov rdi, rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x18]
lea rdx, [0x1401284c8]
call fcn.140107c30
mov rbx, rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x18]
lea rdx, [0x1401284bc]
call fcn.140107c30
test rdi, rdi
je 0x14004806a
test rax, rax
jne 0x140048074
test rbx, rbx
jne 0x140048074
test rax, rax
je 0x140048079
test rbx, rbx
je 0x140048079
mov dl, r14b
jmp 0x14004807c
mov dl, r13b
test rdi, rdi
jne 0x14004808e
test rax, rax
jne 0x14004808e
test rbx, rbx
mov cl, r14b
je 0x140048091
mov cl, r13b
test dl, dl
jne 0x14004914a
test cl, cl
je 0x140048108
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movdqa xmm1, xmmword [0x14014caa0]
movdqu xmmword [rbp + 0xd0], xmm1
mov word [rbp + 0xc0], r13w
lea rcx, [rbp + 0xc0]
call fcn.14007d474
test eax, eax
js 0x140049161
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
lea rcx, [0x1401286c0]
call fcn.1400f5528
nop
lea rcx, [rbp + 0xc0]
call fcn.140045590
jmp 0x1400468c5
test rdi, rdi
je 0x140048112
mov edi, r13d
jmp 0x14004812a
test rax, rax
je 0x14004811c
mov edi, r14d
jmp 0x14004812a
mov edi, r13d
test rbx, rbx
mov ecx, 2
cmovne edi, ecx
mov r8d, edi
call fcn.1400c8188
mov r15d, eax
test eax, eax
js 0x140048f0a
jmp 0x1400468c5
lea rdx, str.OSCA
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x14004815f
call fcn.140059f4c
jmp 0x1400468c5
lea rdx, str.MpCmdRunGetAadToken
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048b1c
mov dword [rbp - 0x3c], r13d
mov qword [rsp + 0x70], r13
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.mpclient.dll_MpManagerOpen]
test eax, eax
js 0x1400481ab
lea rdx, [rbp - 0x3c]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.mpclient.dll_MpGetDevMode]
test eax, eax
jns 0x1400481ab
mov eax, r13d
mov dword [rbp - 0x3c], eax
jmp 0x1400481ae
mov eax, dword [rbp - 0x3c]
test eax, eax
jne 0x1400481e2
call fcn.1400f66dc
cmp eax, r14d
jne 0x1400481e2
lea rcx, str.A_process_other_than_WinDefend_attempted_to_trigger_a_GetAadToken_request__rejecting_attempt_n
call fcn.1400f5500
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400468c5
call qword [sym.imp.mpclient.dll_MpHandleClose]
jmp 0x1400468c5
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, str.UseLastLogonImpersonation
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov r12, rax
xor edx, edx
lea rcx, str..pipeMpCmdRunGetAadToken
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x14004825e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400481c9
test byte [rcx + 0x1c], r14b
je 0x1400481c9
test eax, eax
jle 0x140048241
movzx eax, ax
or eax, 0x80070000
mov edx, 0x2e
mov r9d, eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
jmp 0x1400481c9
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 0xc0000000
lea rdx, str..pipeMpCmdRunGetAadToken
lea rcx, [rsp + 0x58]
call fcn.1400fa44c
mov r15d, eax
test eax, eax
jns 0x1400482ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400482d4
test byte [rcx + 0x1c], r14b
je 0x1400482d4
lea edx, [rdi + 0x30]
mov r9d, r15d
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
nop
mov rcx, qword [rsp + 0x58]
cmp rcx, rdi
je 0x1400481c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400481c9
mov ecx, 2
mov dword [rbp + 8], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 8]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
jne 0x14004834c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400482d4
test byte [rcx + 0x1c], r14b
je 0x1400482d4
test eax, eax
jle 0x14004833f
movzx eax, ax
or eax, 0x80070000
mov edx, 0x30
mov r9d, eax
jmp 0x1400482c3
mov qword [rsp + 0x60], r13
mov ebx, 0x1000
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140044870
test eax, eax
jns 0x1400483bd
mov dword [0x140174f28], 8
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400483a5
test byte [rcx + 0x1c], r14b
je 0x1400483a5
mov edx, 0x31
mov r9d, 0x80070008
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400482d4
call fcn.140030ba0
jmp 0x1400482d4
mov qword [rsp + 0x78], r13
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.1400fa3e8
mov r15d, eax
test eax, eax
jns 0x140048425
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048413
test byte [rcx + 0x1c], r14b
je 0x140048413
mov edx, 0x32
mov r9d, r15d
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400483a5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400483a5
mov qword [rbp + 0x68], r13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x80], rax
mov dword [rbp - 0x80], ebx
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, ebx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
cmp eax, 0x3e5
jne 0x140048540
mov edx, 0x2710
mov rcx, qword [rbp + 0x80]
call fcn.1400faddc
test al, al
je 0x1400484dc
mov eax, 0x5b4
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048413
test byte [rcx + 0x1c], r14b
je 0x140048413
mov edx, 0x33
mov r9d, r15d
mov dword [rsp + 0x20], eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.1400443b4
jmp 0x140048413
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x140048572
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048413
test byte [rcx + 0x1c], r14b
je 0x140048413
mov edx, 0x34
mov r9d, eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
jmp 0x140048413
test r15d, r15d
jne 0x140048572
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048413
test byte [rcx + 0x1c], r14b
je 0x140048413
lea edx, [r15 + 0x35]
xor r9d, r9d
jmp 0x1400484c3
mov qword [rbp - 0x78], r13
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x78]
call fcn.1400f9e10
test eax, eax
jns 0x1400485e1
mov dword [0x140174f28], 8
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400485ca
test byte [rcx + 0x1c], r14b
je 0x1400485ca
mov edx, 0x36
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140048413
call fcn.140030ba0
jmp 0x140048413
mov dword [rbp - 0x80], ebx
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, ebx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
cmp eax, 0x3e5
jne 0x1400486e4
mov edx, 0x2710
mov rcx, qword [rbp + 0x80]
call fcn.1400faddc
test al, al
je 0x140048680
mov eax, 0x5b4
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400485ca
test byte [rcx + 0x1c], r14b
je 0x1400485ca
mov edx, 0x37
mov r9d, r15d
mov dword [rsp + 0x20], eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.1400443b4
jmp 0x1400485ca
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x140048716
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400485ca
test byte [rcx + 0x1c], r14b
je 0x1400485ca
mov edx, 0x38
mov r9d, eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
jmp 0x1400485ca
test r15d, r15d
jne 0x140048716
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400485ca
test byte [rcx + 0x1c], r14b
je 0x1400485ca
lea edx, [r15 + 0x39]
xor r9d, r9d
jmp 0x140048667
mov qword [rbp - 0x60], r13
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400f9e10
test eax, eax
jns 0x140048785
mov dword [0x140174f28], 8
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x14004876e
test byte [rcx + 0x1c], r14b
je 0x14004876e
mov edx, 0x3a
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x60]
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400485ca
call fcn.140030ba0
jmp 0x1400485ca
call fcn.1400c9d20
mov r15d, eax
test eax, eax
jns 0x1400487d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x14004876e
test byte [rcx + 0x1c], r14b
je 0x14004876e
mov edx, 0x3b
mov r9d, r15d
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
jmp 0x14004876e
mov ecx, r14d
mov rax, qword [0x1401768e8]
call fcn.140107c30
mov r15d, r13d
cmp eax, 0x80010106
cmovne r15d, eax
test r15d, r15d
jns 0x140048824
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x14004876e
test byte [rcx + 0x1c], r14b
je 0x14004876e
mov edx, 0x3c
jmp 0x1400487bb
mov qword [rbp - 0x58], r13
lea rbx, [0x14016d280]
test r12, r12
je 0x1400488ba
mov qword [rbp + 0x40], r13
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x40]
call fcn.140100094
test eax, eax
js 0x1400488ab
mov r15, qword [rbp + 0x40]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14004886b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x58], r13
mov r9d, 4
mov rdx, r15
lea rcx, [rbp - 0x58]
call fcn.1401005d8
test eax, eax
jns 0x1400488ab
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400488ab
test byte [rcx + 0x1c], r14b
je 0x1400488ab
mov edx, 0x3d
mov r9d, eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400488ba
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x68], r13
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp + 0x88]
call fcn.1400ca1f8
nop
mov r15, qword [rbp - 0x60]
mov r12, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400488e9
call fcn.140030ba0
mov qword [rbp - 0x68], r13
mov r9, r15
mov rdx, r12
lea rcx, [rbp - 0x68]
call fcn.1400cc580
mov r15d, eax
test eax, eax
jns 0x140048957
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x14004892b
mov eax, 2
test byte [rcx + 0x1c], al
je 0x14004892b
lea edx, [rax + 0x3c]
mov r9d, r15d
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov r15, qword [rbp - 0x60]
mov r12, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140048945
call fcn.140030ba0
mov qword [rbp - 0x68], r13
mov r9, r15
mov rdx, r12
lea rcx, [rbp - 0x68]
call fcn.1400cddb0
mov r15d, eax
cmp byte [rbp + 0x90], r13b
je 0x140048966
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test r15d, r15d
jns 0x1400489a1
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048995
test byte [rcx + 0x1c], r14b
je 0x140048995
mov edx, 0x3f
mov r9d, r15d
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
mov rax, qword [0x1401768e0]
call fcn.140107c30
call fcn.1400ca18c
test r15d, r15d
jns 0x1400489de
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400489c6
call fcn.140030ba0
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14004876e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004876e
mov rdx, qword [rbp - 0x68]
mov r8, rdi
inc r8
cmp word [rdx + r8*2], r13w
jne 0x1400489e5
lea r8d, [r8*2 + 2]
mov dword [rbp - 0x80], r8d
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
cmp eax, 0x3e5
jne 0x140048ae5
mov edx, 0x2710
mov rcx, qword [rbp + 0x80]
call fcn.1400faddc
test al, al
je 0x140048a88
mov eax, 0x5b4
mov dword [0x140174f28], eax
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400489b7
test byte [rcx + 0x1c], r14b
je 0x1400489b7
mov edx, 0x40
mov r9d, r15d
mov dword [rsp + 0x20], eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.1400443b4
jmp 0x1400489b7
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x140048b10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400489b7
test byte [rcx + 0x1c], r14b
je 0x1400489b7
mov edx, 0x41
mov r9d, eax
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
jmp 0x1400489b7
test r15d, r15d
jne 0x140048b10
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x1400489b7
test byte [rcx + 0x1c], r14b
je 0x1400489b7
lea edx, [r15 + 0x42]
xor r9d, r9d
jmp 0x140048a6f
mov dword [0x140174f28], r13d
jmp 0x1400489b7
lea rdx, str.RasConnectionNotification
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048cbd
call fcn.1400f66dc
cmp eax, r14d
jne 0x140048b49
lea rcx, str.A_process_other_than_WinDefend_attempted_to_trigger_a_RasConnectionNotification_setup__rejecting_attempt_n
jmp 0x140046960
mov qword [rbp + 0x60], r13
mov qword [rbp - 0x50], 8
or rdi, 0xffffffffffffffff
mov qword [rbp - 0x38], rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 0x80000000
lea rdx, str..pipeRasConnectionNotification
lea rcx, [rbp - 0x38]
call fcn.1400fa44c
mov r15d, eax
test eax, eax
jns 0x140048bdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048bc5
test byte [rcx + 0x1c], r14b
je 0x140048bc5
lea edx, [rdi + 0x44]
mov r9d, r15d
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov rcx, qword [rbp - 0x38]
cmp rcx, rdi
je 0x1400468c5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400468c5
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x38]
call fcn.1400fabe0
mov r15d, eax
test eax, eax
jns 0x140048c21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x140174f28], eax
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048bc5
test byte [rcx + 0x1c], r14b
je 0x140048bc5
mov edx, 0x44
jmp 0x140048bb2
mov rdx, qword [rbp + 0x60]
test rdx, rdx
jne 0x140048c67
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048c58
test byte [rcx + 0x1c], r14b
je 0x140048c58
mov edx, 0x45
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
mov dword [0x140174f28], 0x57
jmp 0x140048bc5
mov r8d, 3
mov rcx, rdi
call fcn.1400056c0
mov dword [0x140174f28], eax
test eax, eax
jle 0x140048c89
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x140048bc5
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048bc5
test byte [rcx + 0x1c], r14b
je 0x140048bc5
mov edx, 0x46
mov r9d, eax
jmp 0x140048bb5
lea rdx, str.Marker
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048d31
lea r8, str.No_message
lea rdx, str.message
mov rcx, qword [rsp + 0x40]
call fcn.1400ff964
mov rbx, rax
mov rdx, rax
lea rcx, str.Sending_the_message:__ls_n
call fcn.1400f5528
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpServiceLogMessage]
mov ebx, eax
cmp eax, 0x800106cf
jne 0x140048d1d
lea rcx, str.Error__the_message_is_too_long__n
call fcn.1400f5528
jmp 0x140048e20
test ebx, ebx
js 0x140048e12
lea rcx, str.Message_sent_n
jmp 0x140047cc5
lea rdx, str.DeviceControl
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048d62
mov rcx, qword [rsp + 0x40]
call fcn.1400a68ac
test eax, eax
jns 0x1400468c5
mov dword [0x140174f28], r14d
jmp 0x1400468c5
lea rdx, str.TrustCheck
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048d84
mov rcx, qword [rsp + 0x40]
call fcn.14004d7a8
jmp 0x1400468c5
lea rdx, str.AdvertiseToast
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048da1
call fcn.14004916c
jmp 0x1400468c5
lea rdx, str.ListCustomASR
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048dc0
call fcn.1400f5ca4
call fcn.140049544
jmp 0x140048d4e
lea rdx, [0x140128bd4]
mov rcx, rbx
call fcn.1400059ec
test eax, eax
je 0x140048dea
lea rdx, [0x140126450]
mov rcx, rbx
call fcn.1400059ec
test eax, eax
jne 0x140048eb6
call fcn.140049938
jmp 0x1400468c5
mov byte [0x140174f2c], r14b
call fcn.1400f5ca4
call fcn.140041e90
test eax, eax
js 0x140048f4c
jmp 0x1400468c5
mov edx, ebx
lea rcx, str.Failed_to_send_the_message__hr___lx_n
call fcn.1400f5528
mov ecx, ebx
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
int3
mov ecx, ebx
call fcn.1400f9fc4
int3
mov ecx, ebx
call fcn.1400f9fc4
int3
mov ecx, ebx
call fcn.1400f9fc4
int3
mov ecx, ebx
call fcn.1400f9fc4
int3
mov ecx, ebx
call fcn.1400f9fc4
int3
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048eb6
test byte [rcx + 0x1c], r14b
je 0x140048eb6
mov edx, 0x29
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
mov ecx, 0x80070667
call fcn.1400f9fc4
int3
call fcn.1400f9fc4
int3
lea rcx, str.You_cannot_specify_both_on_and_off_options_when_running_TPState_command._n
call fcn.1400f5528
mov ecx, 0x80070057
call fcn.1400f9fc4
int3
mov edx, ebx
lea rcx, str.Call_to_RunTPStateCommand_failed_hr___lx_n
call fcn.1400f5528
mov ecx, ebx
call fcn.1400f9fc4
int3
mov edx, ebx
lea rcx, str.Call_to_DoPrintTSModeCommand_failed_hr___lx_n
call fcn.1400f5528
mov ecx, ebx
call fcn.1400f9fc4
int3
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048f34
test byte [rcx + 0x1c], r14b
je 0x140048f34
mov dword [rsp + 0x28], r15d
mov r9d, edi
mov rcx, qword [rcx + 0x10]
call fcn.14004a3fc
mov edx, r15d
lea rcx, str.Call_to_set_TDT_failed_hr___lx_n
call fcn.1400f5528
mov ecx, r15d
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
nop
mov ecx, 0x80070057
call fcn.1400f9fc4
nop
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140048f75
lea rcx, str.Bad_Command_line____S_n
call fcn.14004a5a8
mov ecx, ebx
call fcn.1400f9fc4
nop
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048fa4
test byte [rcx + 0x1c], r14b
je 0x140048fa4
mov edx, 0x25
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
mov ecx, edi
call fcn.1400f9fc4
nop
lea rcx, str.This_command_is_for_service_use_only._n
call fcn.14004ac64
mov ecx, 0x80070005
call fcn.1400f9fc4
nop
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140048ff4
test byte [rcx + 0x1c], r14b
je 0x140048ff4
mov edx, 0x26
mov r9d, edi
lea r8, [0x140128c40]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400f5500
mov ecx, edi
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
nop
lea rbx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rbx
je 0x140049040
test byte [rcx + 0x1c], r14b
je 0x140049040
mov edx, 0x14
lea r8, [0x14013bbc0]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
lea rcx, str.ERROR:_Task_name_not_specified_n
call fcn.1400f5500
mov ecx, 0x80070667
call fcn.1400f9fc4
int3
mov edx, ebx
lea rcx, str.ERROR:_MpReloadEngine_failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
nop
lea rcx, str.Cannot_put_service_into_SxS_mode._Service_should_be_stopped_n
call fcn.1400f5500
mov ecx, 0x80070032
call fcn.1400f9fc4
nop
mov edx, r14d
lea rcx, str.Service_could_NOT_be_enabled_in_side_by_side_passive_mode._hr___lx._n
call fcn.1400f5500
mov ecx, r14d
call fcn.1400f9fc4
nop
mov edx, ebx
lea rcx, str.ERROR:_MpWDEnable_TRUE__failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
int3
mov ecx, ebx
call fcn.1400f9fc4
int3
lea rcx, str.You_do_not_have_access_to_perform_this_action_n
call fcn.1400f5500
mov ecx, 0x80070005
call fcn.1400f9fc4
int3
mov edx, ebx
lea rcx, str.ERROR:_MpWDEnable_FALSE__failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
nop
mov edx, ebx
lea rcx, str.ERROR:_PlatformPlatform_failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
nop
mov edx, ebx
lea rcx, str.ERROR:_ValidateMapsConnection_failed___lx__n
call fcn.1400f5528
mov ecx, ebx
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
int3
mov ecx, eax
call fcn.1400f9fc4
nop
lea rcx, str.Troubleshooting_mode_is_not_enabled__this_command_is_not_available._n
call fcn.1400f5528
mov ecx, 0x80070057
call fcn.1400f9fc4
int3
lea rcx, str.Error__Two_or_more_flags_are_being_specified._n
call fcn.1400f5528
mov ecx, 0x80070057
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
int3