Function at 0x140108480
Capabilities:
Accept command line arguments
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1c00]
mov eax, 0x1d00
call fcn.1400a5da0
sub rsp, rax
mov rax, qword [0x140191010]
xor rax, rsp
mov qword [rbp + 0x1bf0], rax
mov r14, rcx
xor esi, esi
mov dword [rsp + 0x40], esi
mov byte [rsp + 0x78], sil
lea rax, str.dll_dirs_F67BB3AD_7B5E_4C2D_A22B_747BC163AB78
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140108510
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140108510
mov ecx, 0x1000
call qword [case.0x14006aed5.0]
lea rcx, [rbp + 0x1e0]
call fcn.140058160
mov rbx, rax
cmp byte [rax + 0x20], 0
je 0x14010859f
cmp byte [rsp + 0x78], 0
je 0x140108569
lea rax, [rsp + 0x58]
cmp rax, rbx
je 0x140108603
lea rcx, [rsp + 0x58]
call fcn.140002de0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
jmp 0x140108603
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov byte [rsp + 0x78], 1
jmp 0x140108603
cmp byte [rsp + 0x78], 0
je 0x140108603
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1401085eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401085e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401085e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e50
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
mov byte [rsp + 0x78], 0
cmp byte [rbp + 0x200], 0
je 0x140108619
lea rcx, [rbp + 0x1e0]
call fcn.140002de0
nop
lea rcx, [rbp + 0x148]
call fcn.14005e910
nop
cmp byte [rbp + 0x178], 0
jne 0x1401086de
mov ecx, Ordinal_20
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14010866f
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x148], rsi
mov qword [rbx], rax
movzx eax, word [rbp + 0x150]
mov word [rbx + 8], ax
mov byte [rbp + 0x151], 0
jmp 0x140108672
mov rbx, rsi
mov edi, 8
lea rax, [r14 + 0x598]
lea rcx, [rbp + 0x40]
cmp rax, rcx
je 0x1401086b6
mov r15, qword [rax]
mov qword [rax], rbx
test r15, r15
je 0x1401086e2
cmp byte [r15 + 9], 0
je 0x14010869f
call fcn.14007e2a0
nop
mov rcx, r15
call fcn.14005cbe0
mov edx, Ordinal_20
mov rcx, r15
call fcn.140071e50
jmp 0x1401086e2
test rbx, rbx
je 0x1401086e2
cmp byte [rbx + 9], 0
je 0x1401086c7
call fcn.14007e2a0
nop
mov rcx, rbx
call fcn.14005cbe0
mov edx, Ordinal_20
mov rcx, rbx
call fcn.140071e50
jmp 0x1401086e2
mov edi, dword [rsp + 0x40]
call fcn.140058890
mov rdx, rax
xor al, al
mov byte [rbp + 0xe0], al
cmp byte [rdx + 0x20], al
je 0x14010870b
lea rcx, [rbp + 0xc0]
call fcn.140002b70
mov al, 1
mov byte [rbp + 0xe0], al
test al, al
jne 0x14010871e
mov byte [rbp + 0xb0], al
or edi, 0x10
mov dword [rsp + 0x40], edi
jmp 0x14010874e
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x90]
call fcn.140057a40
or edi, 0x10
mov dword [rsp + 0x40], edi
cmp byte [rbp + 0xe0], 0
je 0x14010874e
lea rcx, [rbp + 0xc0]
call fcn.140002de0
nop
lea rcx, [rbp + 0x90]
call fcn.140058910
mov byte [rbp + 0xb8], al
call fcn.1400057e0
mov qword [rbp + 0x930], rsi
mov qword [rbp + 0x940], rsi
mov qword [rbp + 0x948], 7
mov word [rbp + 0x930], si
mov r8d, 5
lea rdx, str._stop
lea rcx, [rbp + 0x930]
call fcn.140002ed0
nop
xorps xmm0, xmm0
movss dword [rsp + 0x50], xmm0
mov eax, dword [rsp + 0x50]
mov dword [rbp - 0x20], eax
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
lfence
mov ecx, 0x30
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
mov qword [rbp + 0x10], 7
mov qword [rbp + 0x18], 8
movss xmm0, dword [0x140166c40]
movss dword [rbp - 0x20], xmm0
mov r8, rax
mov edx, Ordinal_20
lea rcx, [rbp - 8]
call fcn.140027760
nop
lea r8, [rbp + 0x950]
lea rdx, [rbp + 0x930]
lea rcx, [rbp - 0x20]
call fcn.1400676c0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rsi
lfence
mov ecx, 0x40
call fcn.140002760
mov rbx, rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
lea rdi, [rax + 0x40]
mov qword [rbp - 0x40], rdi
lea rax, [rbp - 0x50]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], rbx
lea rax, [rbp - 0x50]
mov qword [rbp + 0x140], rax
mov qword [rbp - 0x68], rbx
mov eax, dword [rbp - 0x20]
mov dword [rbx], eax
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
lfence
mov ecx, 0x30
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbx + 0x30], rax
mov rax, qword [rbp + 0x18]
mov qword [rbx + 0x38], rax
mov rdx, qword [rbp]
sub rdx, qword [rbp - 8]
sar rdx, 3
mov r8, qword [rbx + 8]
call fcn.140027760
mov rdx, qword [rbp - 0x18]
mov r8, rdx
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.14006bb80
nop
mov qword [rbp - 0x48], rdi
lea r9, [0x14005ba00]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rbp - 0x20]
call fcn.140072518
nop
lea r9, [fcn.140002b20]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x930]
call fcn.140072518
mov dword [rbp - 0x60], esi
lea rax, [0x1401921c0]
mov qword [rbp - 0x58], rax
cmp byte [rbp + 0xb0], 0
je 0x1401089ca
lea r9, str.Desktop
mov r8d, 0xc8
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x90]
call fcn.140057770
or dword [rsp + 0x40], 0x20
cmp byte [rbp + 0x78], 0
je 0x1401089d3
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rdx, qword [rbp + 0x58]
mov qword [rbp + 0x20], 0xffffffff80000002
lea r9, [rbp - 0x60]
lea r8, str.NoRestrictBDAppsOnUpdate
lea rcx, [rbp + 0x20]
call fcn.14002ee80
mov edx, eax
mov rcx, qword [0x1401921c8]
mov rax, qword [rbp - 0x58]
cmp qword [rax + 8], rcx
jne 0x1401089b9
cmp dword [rbp - 0x60], 0
jne 0x1401089b9
test edx, edx
je 0x1401089b9
cmp byte [rbp + 0x78], 0
je 0x140108a2a
lea rcx, [rbp + 0x58]
call fcn.140002de0
jmp 0x140108a2a
cmp byte [rbp + 0x78], 0
je 0x1401089d3
lea rcx, [rbp + 0x58]
call fcn.140002de0
jmp 0x1401089d3
mov byte [rbp + 0x78], 0
or dword [rsp + 0x40], 0x20
mov qword [rbp - 0x38], rsi
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str..DEFAULTSoftwareSetID_bd.update.configure
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140108a2a
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140108a2a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea r8, [rbp - 0x50]
call fcn.140058ac0
test al, al
je 0x14010918a
lea rdx, [r14 + 0x4f8]
mov rcx, r14
call qword [sym.imp.mfc140u.dll_CMFCPrintPreviewToolBar::OnToolHitTest]
cmp byte [r14 + 0x56a], 0
jne 0x14010918a
cmp dword [r14 + 0x540], 0
je 0x140108a68
lea rcx, [r14 + 0x178]
call fcn.14004e1c0
call fcn.140100670
jmp 0x14010918a
mov qword [rbp + 0x240], rsi
lea r8, [rbp + 0x208]
lea rcx, [rbp - 0x70]
call fcn.140059df0
nop
lea rcx, [rsp + 0x48]
call fcn.1400110a0
nop
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140108aa2
call fcn.140011220
test al, al
jne 0x140108b6f
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140108b10
mov rcx, qword [rax]
test rcx, rcx
je 0x140108b10
movzx eax, byte [rcx + 0x28]
test al, al
jne 0x140108b0b
lea r8, [0x140158b80]
mov edx, 4
lea rcx, [rbp + 0x248]
call fcn.140004ea0
nop
cmp byte [rax + 0x80], 0
je 0x140108aed
lea rdx, str.An_instance_is_already_trying_to_start_bdappsrv
mov rcx, rax
call fcn.140005f70
nop
lea rcx, [rbp + 0x2e0]
call fcn.140004c30
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
jmp 0x140109175
mov rbx, qword [rsp + 0x48]
lea r8, [0x140158b00]
mov edx, 4
lea rcx, [rbp + 0x340]
call fcn.140004ea0
nop
cmp byte [rax + 0x80], 0
je 0x140108b42
lea rdx, str.Bdappsrv_down__try_to_start_it
mov rcx, rax
call fcn.140005f70
nop
lea rcx, [rbp + 0x3d8]
call fcn.140004c30
lea rcx, [rbp + 0x3d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rdx, [0x1401316b8]
call fcn.140109460
test al, al
je 0x140109175
lea rcx, [rbp + 0x28]
call fcn.1400110a0
mov rcx, rax
lea rax, [rsp + 0x48]
cmp rax, rcx
je 0x140108bb0
mov rax, qword [rcx]
mov qword [rcx], rsi
mov rdi, rbx
mov rbx, rax
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x140108bb0
mov rcx, rdi
call fcn.14000e620
mov edx, 0x50
mov rcx, rdi
call fcn.140071e50
mov rdi, qword [rbp + 0x28]
test rdi, rdi
je 0x140108bce
mov rcx, rdi
call fcn.14000e620
mov edx, 0x50
mov rcx, rdi
call fcn.140071e50
test rbx, rbx
je 0x140108e53
call fcn.140055a50
test al, al
je 0x140108d9d
mov byte [rbp + 0x34], 0
mov qword [rbp + 0x910], rsi
mov qword [rbp + 0x920], rsi
mov qword [rbp + reloc.mfc140u.dll_AfxRegDeleteKey], Ordinal_21
mov byte [rbp + 0x910], 0
mov r8d, 0x26
lea rdx, str.53049091_A20F_40B2_B25F_1CD4378522FE
lea rcx, [rbp + 0x910]
call fcn.1400077b0
nop
lea rdx, str.bd::process_broker::client::spawn_process_with_current_params
lea rcx, [rbp + 0x13b0]
call fcn.140009070
nop
mov byte [rbp + 0x1d8], 0
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1b8]
lea r8, [rbp + 0x910]
lea rdx, [rbp + 0x180]
call fcn.140054d40
nop
lea rcx, [rbp + 0x13b0]
call fcn.1400091b0
nop
mov rdx, qword [rbp + reloc.mfc140u.dll_AfxRegDeleteKey]
cmp rdx, 0x10
jb 0x140108cb2
inc rdx
mov rcx, qword [rbp + 0x910]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140108cad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140071e50
mov qword [rbp + 0x920], rsi
mov qword [rbp + reloc.mfc140u.dll_AfxRegDeleteKey], Ordinal_21
mov byte [rbp + 0x910], 0
cmp byte [rbp + 0x1b0], 0
jne 0x140108d63
lea rcx, [rbp + 0x180]
call fcn.14002a470
cmp byte [rax + 4], 0
je 0x140108d63
lea r8, [0x140158950]
mov edx, Ordinal_20
lea rcx, [rbp + 0x438]
call fcn.140004ea0
mov rbx, rax
cmp byte [rax + 0x80], 0
je 0x140108d1d
lea rdx, str.spawned_process_with_pid:
mov rcx, rax
call fcn.140006200
lea rcx, [rbp + 0x180]
call fcn.14002a470
cmp byte [rax + 4], 0
je 0x140108d33
mov edx, dword [rax]
jmp 0x140108d35
mov edx, esi
cmp byte [rbx + 0x80], 0
je 0x140108d48
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
nop
lea rcx, [rbp + 0x4d0]
call fcn.140004c30
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
jmp 0x140108d70
lea rdx, [0x1401316b8]
call fcn.140109460
nop
movsx rax, byte [rbp + 0x1b0]
add rax, 1
je 0x140109175
cmp rax, 1
je 0x140109175
lea rcx, [rbp + 0x190]
call fcn.140002de0
jmp 0x140109175
call fcn.140011220
test al, al
jne 0x140108e53
cmp byte [r14 + 0x56c], al
je 0x140108e7c
call fcn.140057fd0
mov edx, Ordinal_20
test al, al
je 0x140108e2a
lea r8, [0x1401588d0]
lea rcx, [rbp + 0x628]
call fcn.140004ea0
nop
lea rdx, str.create_instance_with_removed_privileges
mov rcx, rax
call fcn.1400381f0
nop
lea rcx, [rbp + 0x628]
call fcn.140004e70
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea rcx, [rbp + 0x970]
call fcn.140002b30
nop
lea rcx, [rbp + 0x970]
call fcn.1401108c0
mov esi, eax
lea rcx, [rbp + 0x970]
call fcn.140002de0
jmp 0x140109175
lea r8, [0x140158a30]
lea rcx, [rbp + 0x530]
call fcn.140004ea0
nop
mov rcx, rax
call fcn.14005eb20
nop
lea rcx, [rbp + 0x530]
call fcn.140004e70
lea r8, str.GlobalVSSERV_ONLINE_NOTIFIER_EVENT
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
je 0x140108f02
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140109032
call fcn.140057fd0
test al, al
jne 0x140108e53
lea r8, [0x1401589c0]
mov edx, Ordinal_20
lea rcx, [rbp + 0x720]
call fcn.140004ea0
nop
lea rdx, str.create_elevated_instance_of_seccenter
mov rcx, rax
call fcn.1400381f0
nop
lea rcx, [rbp + 0x720]
call fcn.140004e70
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea rcx, [rbp + 0x950]
call fcn.140002b30
nop
lea rdx, str._no_bdappsrv
lea rcx, [rbp + 0x950]
call fcn.140002b00
lea rcx, [rbp + 0x950]
call fcn.140110e60
mov esi, eax
lea rcx, [rbp + 0x950]
call fcn.140002de0
jmp 0x140109175
mov ecx, dword [0x1401993f8]
mov eax, dword [0x1401993fc]
add ecx, eax
je 0x140108f76
lea rcx, [rbp + 0xf0]
call fcn.1400057b0
nop
mov edi, dword [rsp + 0x40]
or edi, 1
mov dword [rsp + 0x40], edi
mov rcx, rax
call fcn.140005740
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x80], 4
mov dword [rsp + 0x30], eax
lea rax, str.Vsserv_is_down._Close._OpenEvent_res___d
mov qword [rsp + 0x28], rax
lea rax, [0x140158e00]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rbp - 0x80]
movsx edx, si
mov rcx, rbx
call fcn.140004bd0
jmp 0x140108f7a
mov edi, dword [rsp + 0x40]
test dil, 1
je 0x140108f93
and edi, 0xfffffffe
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0xf0]
call fcn.140005770
lea rcx, [rbp - 0x70]
call fcn.14005a280
test al, al
jne 0x140108fda
lea r8, [0x140159140]
mov edx, 4
lea rcx, [rbp + 0x818]
call fcn.140004ea0
nop
lea rdx, str.An_instance_is_already_trying_to_start_vsserv
mov rcx, rax
call fcn.1400381f0
nop
lea rcx, [rbp + 0x818]
call fcn.140004e70
jmp 0x140109175
lea rcx, [rbp + 0xad0]
call fcn.140053250
nop
mov rdx, rax
lea rcx, [rbp + 0x990]
call fcn.14000fdd0
lea rcx, [r14 + 0x478]
mov rdx, rax
call fcn.14000e6a0
lea rcx, [rbp + 0x990]
call fcn.14000e620
nop
lea rcx, [rbp + 0xad0]
call fcn.140010ff0
lea rdx, [0x1401316a8]
call fcn.140109460
test al, al
je 0x140109175
call fcn.140100670
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [0x1401993f8]
mov eax, dword [0x1401993fc]
add ecx, eax
je 0x1401090a6
lea rcx, [rbp + 0x100]
call fcn.1400057b0
nop
mov ebx, dword [rsp + 0x40]
or ebx, 2
mov dword [rsp + 0x40], ebx
mov rcx, rax
call fcn.140005740
mov dword [rbp - 0x7c], 0x20
lea rcx, str._UILOAD__Seccenter_InitInstance
mov qword [rsp + 0x28], rcx
lea rcx, [0x140159040]
mov qword [rsp + 0x20], rcx
lea r9, [0x140000000]
lea r8, [rbp - 0x7c]
movsx edx, si
mov rcx, rax
call fcn.140004bd0
jmp 0x1401090aa
mov ebx, dword [rsp + 0x40]
test bl, 2
je 0x1401090c2
and ebx, 0xfffffffd
mov dword [rsp + 0x40], ebx
lea rcx, [rbp + 0x100]
call fcn.140005770
mov rcx, r14
call qword [sym.imp.mfc140u.dll_COleDispatchImpl::GetTypeInfoCount]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
call fcn.140052470
mov ebx, eax
mov edx, eax
lea rcx, [rbp + 0x38]
call fcn.140106420
nop
mov ecx, ebx
call fcn.14010b9b0
lea rcx, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
nop
lea rdx, [0x140158fa0]
lea rcx, [rbp + 0x80]
call fcn.14002f830
lea r8, [0x140158c00]
lea rdx, str.instance
lea rcx, [rbp + 0xf90]
call fcn.14000ad50
nop
lea r8, [0x1401567f0]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
je 0x1401091f6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0xf90]
call fcn.1400091b0
nop
lea rcx, [rbp + 0x80]
call fcn.14002f940
nop
lea rcx, [rbp + 0x38]
call fcn.14005ba80
nop
lea rcx, [rsp + 0x48]
call fcn.1400138f0
nop
lea rcx, [rbp - 0x70]
call fcn.14005a170
nop
lea rcx, [rbp - 0x50]
call fcn.14005ca60
nop
cmp byte [rbp + 0xb0], 0
je 0x1401091aa
lea rcx, [rbp + 0x90]
call fcn.140057f60
nop
lea rcx, [rbp + 0x148]
call fcn.14005b9b0
nop
cmp byte [rsp + 0x78], 0
je 0x1401091c8
lea rcx, [rsp + 0x58]
call fcn.140002de0
mov eax, esi
mov rcx, qword [rbp + 0x1bf0]
xor rcx, rsp
call fcn.140071e30
lea r11, [rsp + 0x1d00]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140109820
nop
mov rcx, r14
call fcn.14010a5f0
test al, al
jne 0x140109151
call fcn.140109b40
test al, al
jne 0x140109151
lea rcx, [r14 + 0x178]
call fcn.14004e480
test eax, eax
jne 0x140109258
xor edx, edx
lea rcx, str.securitycenter
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140109151
xor r8d, r8d
lea rdx, [r14 + 0x4f8]
mov rcx, rax
call fcn.1400d45e0
jmp 0x140109151
lea rcx, [rbp + 0xf90]
call fcn.1400091b0
call fcn.1400a6960
lea rdx, [0x140127eb0]
mov ecx, AfxFieldText
call fcn.1400725f0
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14010928d
mov rcx, rax
call fcn.1400f2400
jmp 0x140109290
mov rax, rsi
mov qword [r14 + 0x1c0], rax
test rax, rax
jne 0x140109325
mov ecx, dword [0x1401993f8]
mov eax, dword [0x1401993fc]
add ecx, eax
je 0x140109307
lea rcx, [rbp + 0x110]
call fcn.1400057b0
nop
mov ebx, dword [rsp + 0x40]
or ebx, 4
mov dword [rsp + 0x40], ebx
mov rcx, rax
call fcn.140005740
mov dword [rbp - 0x78], 4
lea rcx, str.Out_of_memory__QUIT.
mov qword [rsp + 0x28], rcx
lea rcx, [0x140158d30]
mov qword [rsp + 0x20], rcx
lea r9, [0x140000000]
lea r8, [rbp - 0x78]
movsx edx, si
mov rcx, rax
call fcn.140004bd0
jmp 0x14010930b
mov ebx, dword [rsp + 0x40]
test bl, 4
je 0x14010915e
lea rcx, [rbp + 0x110]
call fcn.140005770
jmp 0x14010915e
cmp qword [r14 + 0x478], 0
jne 0x140109373
lea rcx, [rbp + 0xa30]
call fcn.140053250
nop
mov rdx, rax
lea rcx, [rbp + 0x9e0]
call fcn.14000fdd0
mov rdx, rax
lea rcx, [r14 + 0x478]
call fcn.14000e6a0
lea rcx, [rbp + 0x9e0]
call fcn.14000e620
nop
lea rcx, [rbp + 0xa30]
call fcn.140010ff0
mov qword [rbp - 0x30], r14
lea rax, [0x140107140]
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], esi
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x120], xmm0
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x48]
call fcn.14005eb50
nop
lea r8, [0x140158c60]
lea rdx, str.hook_setup
lea rcx, [rbp + 0x17d0]
call fcn.14000ad50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
xor r8d, r8d
lea rdx, [0x140105040]
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [r14 + 0x590], rax
lea rcx, [rbp + 0x17d0]
call fcn.1400091b0
lea r8, str.CSecurityCenterApp::InitInstance
lea rdx, str.init_services
lea rcx, [rbp + 0xb70]
call fcn.14000ad50
nop
cmp dword [rbp + 0x50], 0
je 0x14010941a
lea rcx, [rbp + 0x48]
call fcn.140005060
movzx eax, byte [r14 + 0x471]
lea rcx, [rbp + 0xb70]
test al, al
jne 0x140109434
call fcn.1400091b0
jmp 0x14010943e
call fcn.1400091b0
mov esi, 1
cmp dword [rbp + 0x50], 0
je 0x14010915e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3