Function at 0x14005b8bc
Capabilities:
Check for sandbox username or hostname
Copy file
Create directory
Get session user name
Parse pe header

Disassembly:
mov byte [rsp + 8], cl
mov r11, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x900
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rsp + 0x8f8], rax
mov byte [rsp + 0x60], dl
mov byte [rsp + 0x80], dl
mov qword [rsp + 0xd8], r8
and qword [rsp + 0x58], 0
and qword [r11 - 0x870], 0
and qword [r11 - 0x878], 0
and qword [r11 - 0x848], 0
and dword [rsp + 0x98], 0
lea rcx, [r11 - 0x848]
call fcn.1400ffee4
mov ebx, eax
test eax, eax
js 0x14005e534
and qword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, eax
test eax, eax
js 0x14005e57b
and dword [rsp + 0xa8], 0
and dword [rsp + 0xc8], 0
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xa8]
mov rax, qword [rax + 0x178]
call fcn.140107c30
mov ebx, eax
jmp 0x14005b9ae
test ebx, ebx
jns 0x14005b9f3
lea r14, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005b9e3
test byte [rcx + 0x1c], 1
je 0x14005b9e3
mov edx, 0x42
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_ValidateMapsConnection_failed___lx__n
call fcn.1400f5528
jmp 0x14005ba2f
mov edx, dword [rsp + 0xa8]
test edx, edx
jne 0x14005ba0c
lea rcx, str.ValidateMapsConnection_successfully_established_a_connection_to_MAPS_n
call fcn.1400f5528
jmp 0x14005ba28
mov r8d, dword [rsp + 0xc8]
lea rcx, str.ValidateMapsConnection_failed_to_establish_a_connection_to_MAPS__hr_lx_httpcode_ld__n
call fcn.1400f5528
and dword [rsp + 0xa8], 0
lea r14, [0x14016d280]
call qword [sym.imp.mpclient.dll_MpClientUtilExportFunctions]
lea rcx, [rsp + 0x98]
mov rax, qword [rax + 0x30]
call fcn.140107c30
mov ebx, eax
jmp 0x14005ba65
test ebx, ebx
js 0x14005e5c2
cmp dword [rsp + 0x98], 0
je 0x14005e602
lea rcx, [rsp + 0x58]
call fcn.1400562b0
mov ebx, eax
jmp 0x14005baa4
test ebx, ebx
js 0x14005e644
and qword [rsp + 0x68], 0
and qword [rsp + 0xb8], 0
lea r9, str.....Microsoft_Security_ClientSupport
mov r8, qword [rsp + 0x58]
lea rdx, str._s_s
lea rcx, [rsp + 0x68]
call fcn.1400fb304
mov edi, eax
test eax, eax
jns 0x14005bb1d
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bb08
test byte [rcx + 0x1c], 1
je 0x14005bb08
mov edx, 0xf
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400f5500
mov rbx, qword [rsp + 0x68]
jmp 0x14005bb90
xor edx, edx
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14005bb83
call fcn.1400fb4fc
mov edi, eax
cmp eax, 0x800700b7
je 0x14005bb81
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bb6d
test byte [rcx + 0x1c], 1
je 0x14005bb6d
mov edx, 0x10
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov r8d, edi
mov rdx, rbx
lea rcx, str.ERROR:_CreateDirectoryW__ls__failed___lx__n
call fcn.1400f5500
jmp 0x14005bb90
xor edi, edi
mov rax, rbx
xor ebx, ebx
mov qword [rsp + 0xb8], rax
test rbx, rbx
je 0x14005bb9e
mov rcx, rbx
call fcn.140030ba0
nop
jmp 0x14005bbb8
test edi, edi
jns 0x14005bc0f
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bbe6
test byte [rcx + 0x1c], 2
je 0x14005bbe6
mov edx, 0x46
mov r9d, edi
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.WARNING:_GetAppLayerLogsDir___failed___lx__n
call fcn.1400f5500
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14005bc0f
call fcn.140030ba0
and qword [rsp + 0xb8], 0
and qword [rsp + 0x68], 0
and qword [rsp + 0xa0], 0
and qword [rsp + 0xb0], 0
lea r8, str._windir_Microsoft_AntimalwareSupport
lea rdx, [0x1401286c0]
lea rcx, [rsp + 0x68]
call fcn.1400fb304
mov esi, eax
test eax, eax
jns 0x14005bc87
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bc6f
test byte [rcx + 0x1c], 1
je 0x14005bc6f
mov edx, 0x11
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, esi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400f5500
mov rdi, qword [rsp + 0x68]
jmp 0x14005bd67
mov rdi, qword [rsp + 0x68]
mov rdx, rdi
lea rcx, [rsp + 0xa0]
call fcn.1400fa5dc
mov esi, eax
test eax, eax
jns 0x14005bce4
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bccc
test byte [rcx + 0x1c], 1
je 0x14005bccc
mov edx, 0x12
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, esi
lea rcx, str.ERROR:_UtilExpandEnvironmentStrings___failed___lx__n
call fcn.1400f5500
mov rbx, qword [rsp + 0xa0]
jmp 0x14005bd5a
xor edx, edx
mov rbx, qword [rsp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14005bd4d
call fcn.1400fb4fc
mov esi, eax
cmp eax, 0x800700b7
je 0x14005bd4b
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bd37
test byte [rcx + 0x1c], 4
je 0x14005bd37
mov edx, 0x13
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov r8d, esi
mov rdx, rbx
lea rcx, str.INFO:_CreateDirectoryW__ls__failed___lx_._Likely_that_WDO_was_never_run_on_this_machine._n
call fcn.1400f5500
jmp 0x14005bd5a
xor esi, esi
mov rax, rbx
xor ebx, ebx
mov qword [rsp + 0xb0], rax
test rbx, rbx
je 0x14005bd67
mov rcx, rbx
call fcn.140030ba0
test rdi, rdi
je 0x14005bd75
mov rcx, rdi
call fcn.140030ba0
nop
jmp 0x14005bd8f
test esi, esi
jns 0x14005bde6
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bdbd
test byte [rcx + 0x1c], 4
je 0x14005bdbd
mov edx, 0x47
mov r9d, esi
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, esi
lea rcx, str.GetOfflineScannerSupportDir___failed___lx_._Likely_that_WDO_was_never_run_on_this_machine._n
call fcn.1400f5500
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14005bde6
call fcn.140030ba0
and qword [rsp + 0xb0], 0
xor ecx, ecx
call fcn.1400e848c
nop
jmp 0x14005be04
test eax, eax
jns 0x14005be3b
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005be2f
test byte [rcx + 0x1c], 1
je 0x14005be2f
mov edx, 0x48
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
lea rcx, str.ERROR:_Dumping_Log_Failed
call fcn.1400f5500
cmp dword [rsp + 0x98], 2
jne 0x14005c0ea
lea rcx, str.Collecting_events_from_Operational_Event_Log..._n
call fcn.1400f5528
nop
mov r9, qword [rsp + 0x58]
lea r8, str.OperationalEvents.txt
lea rdx, str.Microsoft_Windows_Windows_Defender_Operational
lea rcx, [rsp + 0x81]
call fcn.14006f630
mov ebx, eax
jmp 0x14005be85
test ebx, ebx
js 0x14005be96
jmp 0x14005bece
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bec0
test byte [rcx + 0x1c], 1
je 0x14005bec0
mov edx, 0x49
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___lx__n
call fcn.1400f5500
lea rcx, str.Collecting_events_from_WHC_Event_Log..._n
call fcn.1400f5528
nop
mov r9, qword [rsp + 0x58]
lea r8, str.WHCEvents.txt
lea rdx, str.Microsoft_Windows_Windows_Defender_WHC
lea rcx, [rsp + 0x81]
call fcn.14006f630
mov ebx, eax
jmp 0x14005bf0a
test ebx, ebx
jns 0x14005bf53
jmp 0x14005bf1b
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005bf45
test byte [rcx + 0x1c], 1
je 0x14005bf45
mov edx, 0x4a
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___lx__n
call fcn.1400f5500
lea rax, str._windir_logscbs
mov qword [rsp + 0x4c0], rax
lea rax, str.cbs.log
mov qword [rsp + 0x4c8], rax
lea rax, str.CBS_Log
mov qword [rsp + 0x4d0], rax
lea rcx, str._windir__system32winevtlogs
mov qword [rsp + 0x4d8], rcx
lea rax, str.application.evtx
mov qword [rsp + 0x4e0], rax
lea rax, str.Application_Event_Log
mov qword [rsp + 0x4e8], rax
mov qword [rsp + 0x4f0], rcx
lea rax, str.system.evtx
mov qword [rsp + 0x4f8], rax
lea rax, str.System_Event_Log
mov qword [rsp + 0x500], rax
lea rax, str._localappdata_packagesMicrosoft.6365217CE6EB4_8wekyb3d8bbweLocalStateLogs
mov qword [rsp + 0x508], rax
lea rax, str.GibraltarTrace.log
mov qword [rsp + 0x510], rax
lea rax, str.User_Security_App_Log
mov qword [rsp + 0x518], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x520], xmm0
and qword [rsp + 0x530], 0
xor ebx, ebx
mov dword [rsp + 0x78], ebx
movsxd rax, ebx
lea rsi, [rax + rax*2]
mov r15, qword [rsp + rsi*8 + 0x4c0]
test r15, r15
je 0x14005c16a
mov rdi, qword [rsp + rsi*8 + 0x4d0]
mov qword [rsp + 0x240], rdi
mov rdx, rdi
lea rcx, str.Getting__ls_..._n
call fcn.1400f5528
nop
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + rsi*8 + 0x4c8]
mov rcx, r15
call fcn.14005570c
mov esi, eax
jmp 0x14005c09f
test esi, esi
jns 0x14005c0e3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c0d1
test byte [rcx + 0x1c], 1
je 0x14005c0d1
mov edx, 0x4b
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov r8d, esi
mov rdx, rdi
lea rcx, str.ERROR:_GetLogFile__ls__failed___lx__n
call fcn.1400f5500
inc ebx
jmp 0x14005c017
cmp dword [rsp + 0x98], 4
je 0x14005c16a
lea rcx, str.Collecting_events_from_System_Event_Log..._n
call fcn.1400f5528
nop
mov rdx, qword [rsp + 0x58]
lea rcx, str.System
call fcn.140061e3c
mov ebx, eax
jmp 0x14005c121
test ebx, ebx
jns 0x14005c16a
jmp 0x14005c132
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c15c
test byte [rcx + 0x1c], 1
je 0x14005c15c
mov edx, 0x4c
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_EventLogToFile___failed___lx__n
call fcn.1400f5500
lea rcx, str.Collecting_configuration_information..._n
call fcn.1400f5528
nop
call fcn.140068134
mov ebx, eax
jmp 0x14005c18b
test ebx, ebx
jns 0x14005c1d4
jmp 0x14005c19c
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c1c6
test byte [rcx + 0x1c], 1
je 0x14005c1c6
mov edx, 0x4d
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandConfigDump___failed__lx_n
call fcn.1400f5500
lea rcx, str.Collecting_effective_configuration_information..._n
call fcn.1400f5528
nop
call fcn.140068568
mov ebx, eax
jmp 0x14005c1f5
test ebx, ebx
jns 0x14005c23e
jmp 0x14005c206
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c230
test byte [rcx + 0x1c], 1
je 0x14005c230
mov edx, 0x4e
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandEffectiveConfigJsonDump___failed__lx_n
call fcn.1400f5500
and qword [rsp + 0x230], 0
lea rax, [rsp + 0x220]
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x220], rax
cmp dword [rsp + 0x98], 4
je 0x14005c3f3
xor edx, edx
mov ecx, 0xa0000
call fcn.1400fda18
test eax, eax
js 0x14005c373
lea rcx, str.Collecting_Windows_Update_logs..._n
call fcn.1400f5528
and qword [rsp + 0x68], 0
lea rdx, str._windir_LogsWindowsUpdate
lea rcx, [rsp + 0x68]
call fcn.1400fa5dc
mov ebx, eax
test eax, eax
js 0x14005c323
lea r9, [rsp + 0x220]
lea r8, str..etl
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
call fcn.140053794
mov ebx, eax
jmp 0x14005c2ec
test ebx, ebx
jns 0x14005c35b
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c31a
test byte [rcx + 0x1c], 1
je 0x14005c31a
mov edx, 0x4f
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
jmp 0x14005c354
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c34d
test byte [rcx + 0x1c], 1
je 0x14005c34d
mov edx, 0x50
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_UtilExpandEnvironmentStrings___failed___lx__n
mov edx, ebx
call fcn.1400f5500
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14005c3f3
call fcn.140030ba0
jmp 0x14005c3f3
lea rcx, str.Getting_Windows_Update_log..._n
call fcn.1400f5528
nop
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rdx, str.WindowsUpdate.log
lea rcx, str._windir_
call fcn.14005570c
mov ebx, eax
jmp 0x14005c3b7
test ebx, ebx
jns 0x14005c3f3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c3e5
test byte [rcx + 0x1c], 1
je 0x14005c3e5
mov edx, 0x51
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_GetLogFile_WINDOWS_UPDATE_LOG_FILENAME__failed___lx__n
call fcn.1400f5500
lea rcx, str.Dumping_cache_filenames_to_log..._n
call fcn.1400f5528
nop
mov dword [rsp + 0x240], 0xf17c75d5
mov dword [rsp + 0x244], 0x455fbe59
mov dword [rsp + 0x248], 0x94bf508d
mov dword [rsp + 0x24c], 0x5888a325
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x50], eax
and dword [rsp + 0x78], 0
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x50]
mov edx, 4
lea rcx, [rsp + 0x240]
call fcn.1400e8784
mov esi, eax
test eax, eax
jns 0x14005c4b0
mov rax, qword [0x14016d280]
cmp rax, r14
je 0x14005c49e
test byte [rax + 0x1c], 1
je 0x14005c49e
mov edx, 0x12
mov r9d, esi
lea r8, [0x140147e98]
mov rcx, qword [rax + 0x10]
call fcn.140044380
mov rax, qword [0x14016d280]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14005c4c9
call qword [sym.imp.mpclient.dll_MpFreeMemory]
jmp 0x14005c4c2
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14005c4c0
call qword [sym.imp.mpclient.dll_MpFreeMemory]
xor esi, esi
mov rax, qword [0x14016d280]
jmp 0x14005c4f1
test esi, esi
jns 0x14005c528
cmp rax, r14
je 0x14005c518
test byte [rax + 0x1c], 1
je 0x14005c518
mov edx, 0x52
mov r9d, esi
lea r8, [0x14012cc20]
mov rcx, qword [rax + 0x10]
call fcn.140044380
mov edx, esi
lea rcx, str.ERROR:_MpDumpCache_failed___lx__n
call fcn.1400f5500
xor esi, esi
and dword [rsp + 0x78], 0
lea r15, str.MOAC_file_dump
movsxd rax, dword [rsp + 0x78]
lea rcx, [rax + rax*4]
lea rbx, [rcx*8]
mov qword [rsp + 0x240], rbx
lea rax, [rbx + r15]
mov qword [rsp + 0x68], rax
mov rdx, qword [rax]
test rdx, rdx
je 0x14005c71b
lea rcx, str.Getting__ls_..._n
call fcn.1400f5528
nop
lea rax, [rbx + 0x20]
add rax, r15
mov qword [rsp + 0x88], rax
mov r9, qword [rax]
lea rax, [rbx + 0x18]
add rax, r15
mov qword [rsp + 0xa0], rax
mov rdx, qword [rax]
lea rax, [rbx + 0x10]
add rax, r15
mov qword [rsp + 0x90], rax
mov r8, qword [rsp + 0x58]
mov rcx, qword [rax]
call fcn.14005570c
test eax, eax
js 0x14005e684
jmp 0x14005c5ef
test esi, esi
jns 0x14005c60c
mov rax, qword [rsp + 0x68]
mov r8d, esi
mov rdx, qword [rax]
lea rcx, str.ERROR:__ls_failed___lx__n
call fcn.1400f5528
xor esi, esi
test byte [rbx + r15 + 8], 1
je 0x14005c712
and qword [rsp + 0xc0], 0
mov rax, qword [rsp + 0xa0]
mov r8, qword [rax]
lea rdx, str._ls.bak
lea rcx, [rsp + 0xc0]
call fcn.1400fb304
test eax, eax
js 0x14005e68c
xor ebx, ebx
mov qword [rsp + 0x240], rbx
mov rax, qword [rsp + 0x88]
mov r8, qword [rax]
test r8, r8
je 0x14005c686
lea rdx, str._ls.bak
lea rcx, [rsp + 0x240]
call fcn.1400fb304
test eax, eax
js 0x14005e694
mov rbx, qword [rsp + 0x240]
mov rax, qword [rsp + 0x90]
mov r9, rbx
mov r8, qword [rsp + 0x58]
mov rdi, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, qword [rax]
call fcn.14005570c
test eax, eax
js 0x14005e69b
test rbx, rbx
je 0x14005c6bf
mov rcx, rbx
call fcn.140030ba0
nop
test rdi, rdi
je 0x14005c6cd
mov rcx, rdi
call fcn.140030ba0
nop
jmp 0x14005c6f5
test esi, esi
jns 0x14005c712
mov r8d, esi
mov rdx, qword [rsp + 0x68]
mov rdx, qword [rdx]
lea rcx, str.ERROR:__ls_failed___lx__n
call fcn.1400f5528
xor esi, esi
inc dword [rsp + 0x78]
jmp 0x14005c534
and qword [rsp + 0x210], 0
lea rax, [rsp + 0x200]
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x200], rax
lea rcx, str.Getting_Dynamic_Signatures..._n
call fcn.1400f5528
nop
and qword [rsp + 0x90], 0
and qword [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rdi, str.Scan
mov rcx, rdi
call qword [sym.imp.mpclient.dll_MpConfigOpen]
mov ebx, eax
test eax, eax
jns 0x14005c7c0
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c7a9
test byte [rcx + 0x1c], 1
je 0x14005c7a9
mov edx, 0x14
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov r8d, ebx
mov rdx, rdi
lea rcx, str.ERROR:_MpConfigOpen__ls__failed___lx__n
call fcn.1400f5500
jmp 0x14005c851
mov dword [rsp + 0x50], 2
and dword [rsp + 0x78], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x50]
lea rsi, str.DynamicSignatureLocation
mov rdx, rsi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
mov ebx, eax
test eax, eax
jns 0x14005c89e
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c83c
test byte [rcx + 0x1c], 1
je 0x14005c83c
mov edx, 0x15
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140061b5c
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
lea rcx, str.ERROR:_MpConfigGetValueString__ls_ls__failed___lx__n
call fcn.1400f5500
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005c861
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov rax, qword [0x14016d280]
cmp rax, r14
je 0x14005c88f
test byte [rax + 0x1c], 1
je 0x14005c88f
mov edx, 0x19
lea r8, [0x14012cc20]
mov rcx, qword [rax + 0x10]
call fcn.140044360
mov rax, qword [0x14016d280]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14005c8eb
jmp 0x14005c8de
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005c8ae
call qword [sym.imp.mpclient.dll_MpConfigClose]
lea r9, [rsp + 0x200]
lea r8, [0x14012cc40]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.140053794
mov ebx, eax
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14005c8e4
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rax, qword [0x14016d280]
jmp 0x14005c913
test ebx, ebx
jns 0x14005c948
cmp rax, r14
je 0x14005c93a
test byte [rax + 0x1c], 1
je 0x14005c93a
mov edx, 0x53
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rax + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_GetFastPathSignatureBlobs_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_product_service_s__registration_information..._n
call fcn.1400f5528
nop
call fcn.14006e000
mov ebx, eax
jmp 0x14005c969
test ebx, ebx
jns 0x14005c9b2
jmp 0x14005c97a
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005c9a4
test byte [rcx + 0x1c], 1
je 0x14005c9a4
mov edx, 0x54
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectServiceInfo__MsMpSvc___failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_filter_manager_information..._n
call fcn.1400f5528
nop
call fcn.140074164
mov ebx, eax
jmp 0x14005c9d3
test ebx, ebx
jns 0x14005ca1c
jmp 0x14005c9e4
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005ca0e
test byte [rcx + 0x1c], 1
je 0x14005ca0e
mov edx, 0x55
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectFltmcInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_device_control_information..._n
call fcn.1400f5528
nop
call fcn.14007dcc0
mov ebx, eax
jmp 0x14005ca4a
test ebx, ebx
jns 0x14005ca86
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005ca78
test byte [rcx + 0x1c], 1
je 0x14005ca78
mov edx, 0x56
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectDeviceControlInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_system_information..._n
call fcn.1400f5528
nop
call fcn.140073430
mov ebx, eax
jmp 0x14005caa7
test ebx, ebx
jns 0x14005caf0
jmp 0x14005cab8
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cae2
test byte [rcx + 0x1c], 1
je 0x14005cae2
mov edx, 0x57
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectSystemInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_Windows_proxy_information..._n
call fcn.1400f5528
nop
call fcn.140073b80
mov ebx, eax
jmp 0x14005cb11
test ebx, ebx
jns 0x14005cb5a
jmp 0x14005cb22
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cb4c
test byte [rcx + 0x1c], 1
je 0x14005cb4c
mov edx, 0x58
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectWindowsProxyInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_ACPI_information..._n
call fcn.1400f5528
nop
call fcn.14007cee8
mov ebx, eax
jmp 0x14005cb7b
test ebx, ebx
jns 0x14005cbc4
jmp 0x14005cb8c
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cbb6
test byte [rcx + 0x1c], 1
je 0x14005cbb6
mov edx, 0x59
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectAcpiInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_TDT_status_information..._n
call fcn.1400f5528
nop
xor ecx, ecx
call fcn.14007d474
mov ebx, eax
jmp 0x14005cbe7
test ebx, ebx
jns 0x14005cc30
jmp 0x14005cbf8
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cc22
test byte [rcx + 0x1c], 1
je 0x14005cc22
mov edx, 0x5a
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectTDTInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_file_list_and_version_information..._n
call fcn.1400f5528
nop
call fcn.140072dd8
mov ebx, eax
jmp 0x14005cc51
test ebx, ebx
jns 0x14005cc9a
jmp 0x14005cc62
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cc8c
test byte [rcx + 0x1c], 1
je 0x14005cc8c
mov edx, 0x5b
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectFileVersions_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_threat_information..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.14005b49c
mov ebx, eax
jmp 0x14005ccc0
test ebx, ebx
jns 0x14005cd09
jmp 0x14005ccd1
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005ccfb
test byte [rcx + 0x1c], 1
je 0x14005ccfb
mov edx, 0x5c
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectStats_failed___lx__n
call fcn.1400f5500
and qword [rsp + 0x90], 0
mov edx, 0x3fab
call fcn.1400fda70
test eax, eax
js 0x14005d14f
mov edx, 0xc8
call fcn.14005977c
mov ebx, eax
jmp 0x14005cd4a
test ebx, ebx
jns 0x14005cd86
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cd78
test byte [rcx + 0x1c], 2
je 0x14005cd78
mov edx, 0x5d
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.Flushing_current_session_logs_for_Windows_Security_Service_failed___lx__n
call fcn.1400f5500
lea rdx, str._programdata_MicrosoftWindows_Security_HealthLogs
lea rcx, [rsp + 0x90]
call fcn.1400fa5dc
mov ebx, eax
test eax, eax
jns 0x14005cdf3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cdca
test byte [rcx + 0x1c], 2
je 0x14005cdca
mov edx, 0x5e
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.Getting_WDSP_log_location_failed___lx_._n
call fcn.1400f5500
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14005cdf3
call fcn.140030ba0
and qword [rsp + 0x90], 0
lea rcx, str.Getting_security_health_service_related_registry_keys..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.140053a04
mov ebx, eax
jmp 0x14005ce26
test ebx, ebx
jns 0x14005ce62
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005ce54
test byte [rcx + 0x1c], 1
je 0x14005ce54
mov edx, 0x5f
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CollectWdspRegistryKeys_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_security_health_service_registration_info..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.140053be8
mov ebx, eax
jmp 0x14005ce95
test ebx, ebx
jns 0x14005ced1
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cec3
test byte [rcx + 0x1c], 1
je 0x14005cec3
mov edx, 0x60
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CollectWdspServiceInfo_failed___lx__n
call fcn.1400f5500
mov edx, 0x5334
call fcn.1400fda70
test eax, eax
js 0x14005cf7a
lea rcx, str.Getting_Windows_Security_App_info..._n
call fcn.1400f5528
nop
lea rdx, str.SecHealthUI
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.1400535c4
lea rdx, str.Microsoft.VCLibs
mov rcx, rbx
call fcn.1400535c4
lea rdx, str.Microsoft.UI.Xaml
mov rcx, rbx
call fcn.1400535c4
mov ebx, eax
jmp 0x14005cf3e
test ebx, ebx
jns 0x14005cf7a
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cf6c
test byte [rcx + 0x1c], 1
je 0x14005cf6c
mov edx, 0x61
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CollectAppxDetails_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_Image_File_Execution_Option_state..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400549c0
mov ebx, eax
jmp 0x14005cfad
test ebx, ebx
jns 0x14005cfea
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005cfdb
test byte [rcx + 0x1c], 1
je 0x14005cfdb
mov edx, 0x62
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_DumpIFEOKeys_failed___lx__n
call fcn.1400f5500
nop
mov rcx, qword [rsp + 0x58]
call fcn.140054b68
mov ebx, eax
jmp 0x14005d010
test ebx, ebx
jns 0x14005d04d
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d03e
test byte [rcx + 0x1c], 2
je 0x14005d03e
mov edx, 0x63
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.Exporting_Exploit_Mitigation_Policies_failed___lx__n
call fcn.1400f5500
nop
and qword [rsp + 0x70], 0
lea rdx, str._SystemRoot_System32WinevtLogsMicrosoft_Windows_Security_Mitigations_4KernelMode.evtx
lea rcx, [rsp + 0x70]
call fcn.1400fa5dc
test eax, eax
js 0x14005d0b7
and qword [rsp + 0x68], 0
lea r9, str.Microsoft_Windows_Security_Mitigations_4KernelMode.evtx
mov r8, qword [rsp + 0x58]
lea rdx, [0x14012d070]
lea rcx, [rsp + 0x68]
call fcn.1400fb304
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
test eax, eax
js 0x14005d0a8
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test rbx, rbx
je 0x14005d0bc
mov rcx, rbx
call fcn.140030ba0
jmp 0x14005d0bc
mov rdi, qword [rsp + 0x70]
and qword [rsp + 0x70], 0
lea rdx, str._SystemRoot_System32WinevtLogsMicrosoft_Windows_Security_Mitigations_4UserMode.evtx
lea rcx, [rsp + 0x70]
call fcn.1400fa5dc
test eax, eax
js 0x14005d126
and qword [rsp + 0x68], 0
lea r9, str.Microsoft_Windows_Security_Mitigations_4UserMode.evtx
mov r8, qword [rsp + 0x58]
lea rdx, [0x14012d070]
lea rcx, [rsp + 0x68]
call fcn.1400fb304
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
test eax, eax
js 0x14005d117
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test rsi, rsi
je 0x14005d12b
mov rcx, rsi
call fcn.140030ba0
jmp 0x14005d12b
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14005d138
mov rcx, rbx
call fcn.140030ba0
test rdi, rdi
je 0x14005d146
mov rcx, rdi
call fcn.140030ba0
nop
jmp 0x14005d14f
lea rcx, str.Getting_WSC_information..._n
call fcn.1400f5528
nop
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.14006c088
mov ebx, eax
jmp 0x14005d184
test ebx, ebx
jns 0x14005d1c0
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d1b2
test byte [rcx + 0x1c], 1
je 0x14005d1b2
mov edx, 0x64
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectWscInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_WSC_related_registry_keys_and_service_registration..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.14006c3f4
mov ebx, eax
jmp 0x14005d1f3
test ebx, ebx
jns 0x14005d22f
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d221
test byte [rcx + 0x1c], 1
je 0x14005d221
mov edx, 0x65
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectWscRegistryKeys_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_Windows_Task_Scheduler_registrations..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400594bc
mov ebx, eax
jmp 0x14005d262
test ebx, ebx
jns 0x14005d29e
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d290
test byte [rcx + 0x1c], 1
je 0x14005d290
mov edx, 0x66
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_GetWinTaskSchedulerEntries_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_the_contents_of_the_internal_task_scheduler..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400554c4
mov ebx, eax
jmp 0x14005d2d1
test ebx, ebx
jns 0x14005d30d
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d2ff
test byte [rcx + 0x1c], 1
je 0x14005d2ff
mov edx, 0x67
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_GetInternalSchedulerEntries_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_Network_Protection_remote_data_n
call fcn.1400f5528
and qword [rsp + 0x1f0], 0
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x1e0], rax
and qword [rsp + 0x68], 0
and qword [rsp + 0x240], 0
mov edx, 0x4268
call fcn.1400fda70
test eax, eax
js 0x14005d379
mov edx, 0x44f5
call fcn.1400fda70
test eax, eax
jns 0x14005d379
lea rdi, str.NetworkService
mov r9, rdi
jmp 0x14005d387
lea r9, str.LocalService
lea rdi, str.NetworkService
lea rax, str.remote
mov qword [rsp + 0x28], rax
lea r15, str.AppDataLocalMicrosoftWindowsSafetyNetwork
mov qword [rsp + 0x20], r15
lea r8, str._windir_ServiceProfiles
lea rdx, str._ls_ls_ls_ls
lea rcx, [rsp + 0x68]
call fcn.1400fb304
mov ebx, eax
test eax, eax
jns 0x14005d3f3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d3e7
test byte [rcx + 0x1c], 2
je 0x14005d3e7
mov edx, 0x68
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.Building_remote_NP_dir_path_failed___lx_._n
jmp 0x14005d4e3
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x240]
call fcn.1400fa5dc
mov esi, eax
test eax, eax
jns 0x14005d455
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d43c
test byte [rcx + 0x1c], 2
je 0x14005d43c
mov edx, 0x69
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov r8d, esi
mov rdx, qword [rsp + 0x68]
lea rcx, str.Expanding__ls_failed___lx_._n
call fcn.1400f5500
jmp 0x14005d4ea
lea r9, [rsp + 0x1e0]
lea r8, [0x14012cc40]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x240]
call fcn.140053794
mov ebx, eax
jmp 0x14005d4ae
test ebx, ebx
jns 0x14005d4ea
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d4dc
test byte [rcx + 0x1c], 1
je 0x14005d4dc
mov edx, 0x6a
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n__Likely_that_Network_Protection_was_not_enabled_on_this_machine
mov edx, ebx
call fcn.1400f5500
lea rcx, str.Getting_Network_Protection_local_data_n
call fcn.1400f5528
and qword [rsp + 0x1d0], 0
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x1c8], rax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x1c0], rax
and qword [rsp + 0xa0], 0
and qword [rsp + 0xc0], 0
mov edx, 0x4268
call fcn.1400fda70
test eax, eax
js 0x14005d54d
mov edx, 0x44f5
call fcn.1400fda70
test eax, eax
js 0x14005d554
lea rdi, str.LocalService
lea rax, str.local
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, rdi
lea r8, str._windir_ServiceProfiles
lea rdx, str._ls_ls_ls_ls
lea rcx, [rsp + 0xa0]
call fcn.1400fb304
mov ebx, eax
test eax, eax
jns 0x14005d5bf
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d5b3
test byte [rcx + 0x1c], 2
je 0x14005d5b3
mov edx, 0x6b
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.Building_local_NP_dir_path_failed___lx_._n
jmp 0x14005d696
mov rbx, qword [rsp + 0xa0]
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.1400fa5dc
mov edi, eax
test eax, eax
jns 0x14005d624
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d60b
test byte [rcx + 0x1c], 2
je 0x14005d60b
mov edx, 0x6c
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov r8d, edi
mov rdx, qword [rsp + 0xa0]
lea rcx, str.Expanding__ls_failed___lx_._n
call fcn.1400f5500
jmp 0x14005d69d
lea r9, [rsp + 0x1c0]
lea r8, [0x14012cc40]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xc0]
call fcn.140053794
mov ebx, eax
jmp 0x14005d661
test ebx, ebx
jns 0x14005d69d
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d68f
test byte [rcx + 0x1c], 1
je 0x14005d68f
mov edx, 0x6d
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n__Likely_that_Network_Protection_was_not_enabled_on_this_machine
mov edx, ebx
call fcn.1400f5500
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140176bf8], eax
jg 0x14005e6a3
cmp byte [0x140176bfc], 0
je 0x14005d735
lea rcx, str.Getting_Firewall_Auto_Resolve_Rules_from_Powershell..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.140054d74
mov ebx, eax
jmp 0x14005d6f9
test ebx, ebx
jns 0x14005d735
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d727
test byte [rcx + 0x1c], 1
je 0x14005d727
mov edx, 0x6e
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_GetAutoResolveRules_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_WfpState_information..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.140059250
mov ebx, eax
jmp 0x14005d768
test ebx, ebx
jns 0x14005d7a4
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d796
test byte [rcx + 0x1c], 1
je 0x14005d796
mov edx, 0x6f
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_GetWfpStateXML_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_Network_Protection_State_information..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.140055934
mov ebx, eax
jmp 0x14005d7d7
test ebx, ebx
jns 0x14005d813
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d805
test byte [rcx + 0x1c], 1
je 0x14005d805
mov edx, 0x70
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_GetNpSupportFile_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_WDATP_information..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.14007b6fc
mov ebx, eax
jmp 0x14005d846
test ebx, ebx
jns 0x14005d882
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d874
test byte [rcx + 0x1c], 1
je 0x14005d874
mov edx, 0x71
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectSenseInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_Printer_information..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.14007b3a4
mov ebx, eax
jmp 0x14005d8b5
test ebx, ebx
jns 0x14005d8f1
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005d8e3
test byte [rcx + 0x1c], 1
je 0x14005d8e3
mov edx, 0x72
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectPrinterInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Collecting_WinRE_logs..._n
call fcn.1400f5528
and qword [rsp + 0x1b0], 0
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x1a0], rax
and qword [rsp + 0x190], 0
lea rax, [rsp + 0x180]
mov qword [rsp + 0x188], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x180], rax
and qword [rsp + 0x170], 0
lea rax, [rsp + 0x160]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x160], rax
and qword [rsp + 0x150], 0
lea rax, [rsp + 0x140]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x140], rax
and qword [rsp + 0x130], 0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x120], rax
and qword [rsp + 0x110], 0
lea rax, [rsp + 0x100]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x100], rax
mov ecx, 0xa0000
call fcn.1400fdb18
test eax, eax
je 0x14005de21
and qword [rsp + 0x88], 0
lea rdx, str._windir_LogsReagent
lea rcx, [rsp + 0x88]
call fcn.1400fa5dc
mov ebx, eax
test eax, eax
jns 0x14005da5e
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005da52
test byte [rcx + 0x1c], 2
je 0x14005da52
mov edx, 0x73
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.Getting_windirLogsReagent_failed___lx_._n
jmp 0x14005db4a
lea r9, [rsp + 0x1a0]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
call fcn.140053794
mov ebx, eax
jmp 0x14005da9b
test ebx, ebx
jns 0x14005dad8
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005dac9
test byte [rcx + 0x1c], 1
je 0x14005dac9
mov edx, 0x74
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
call fcn.1400f5500
nop
lea r9, [rsp + 0x180]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
call fcn.140053794
mov ebx, eax
jmp 0x14005db15
test ebx, ebx
jns 0x14005db51
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005db43
test byte [rcx + 0x1c], 1
je 0x14005db43
mov edx, 0x75
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
mov edx, ebx
call fcn.1400f5500
and qword [rsp + 0x78], 0
lea rdx, str._windir_PantherUnattendGC
lea rcx, [rsp + 0x78]
call fcn.1400fa5dc
mov ebx, eax
test eax, eax
jns 0x14005dbc4
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005db98
test byte [rcx + 0x1c], 2
je 0x14005db98
mov edx, 0x76
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.Getting_windirPantherUnattendGC_failed___lx_._n
call fcn.1400f5500
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14005dcb1
call fcn.140030ba0
and qword [rsp + 0x78], 0
jmp 0x14005dcb1
lea r9, [rsp + 0x160]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
call fcn.140053794
mov ebx, eax
jmp 0x14005dbfe
test ebx, ebx
jns 0x14005dc3b
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005dc2c
test byte [rcx + 0x1c], 1
je 0x14005dc2c
mov edx, 0x77
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
call fcn.1400f5500
nop
lea r9, [rsp + 0x140]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
call fcn.140053794
mov ebx, eax
jmp 0x14005dc75
test ebx, ebx
jns 0x14005dcb1
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005dca3
test byte [rcx + 0x1c], 1
je 0x14005dca3
mov edx, 0x78
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
call fcn.1400f5500
and qword [rsp + 0x70], 0
lea rdx, str._windir_System32_recovery
lea rcx, [rsp + 0x70]
call fcn.1400fa5dc
mov ebx, eax
test eax, eax
jns 0x14005dd04
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005dcf8
test byte [rcx + 0x1c], 2
je 0x14005dcf8
mov edx, 0x79
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.Getting_windir_system32_recovery_failed___lx_._n
jmp 0x14005ddea
lea r9, [rsp + 0x120]
lea r8, str..xml
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
call fcn.140053794
mov ebx, eax
jmp 0x14005dd3e
test ebx, ebx
jns 0x14005dd7b
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005dd6c
test byte [rcx + 0x1c], 1
je 0x14005dd6c
mov edx, 0x7a
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
call fcn.1400f5500
nop
lea r9, [rsp + 0x100]
lea r8, str..log
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
call fcn.140053794
mov ebx, eax
jmp 0x14005ddb5
test ebx, ebx
jns 0x14005ddf1
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005dde3
test byte [rcx + 0x1c], 1
je 0x14005dde3
mov edx, 0x7b
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
lea rcx, str.ERROR:_CollectFilesFromDirectory___failed___lx__n
mov edx, ebx
call fcn.1400f5500
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005de00
call fcn.140030ba0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14005de0f
call fcn.140030ba0
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14005de21
call fcn.140030ba0
lea rcx, str.Dumping_list_of_processes_with_MpDetoursCopyAccelerator_injection..._n
call fcn.1400f5528
mov rcx, qword [rsp + 0x58]
call fcn.140055cf4
mov ebx, eax
test eax, eax
jns 0x14005de75
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005de67
test byte [rcx + 0x1c], 4
je 0x14005de67
mov edx, 0x7c
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.GetProcessesThatHaveCopyAcceleratorDTourAttached___failed___lx_._n
call fcn.1400f5500
lea rcx, str.Getting_fsutil_usn_journal_information..._n
call fcn.1400f5528
nop
mov rcx, qword [rsp + 0x58]
call fcn.1400a6eb8
mov ebx, eax
jmp 0x14005de9b
test ebx, ebx
jns 0x14005dee4
jmp 0x14005deac
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005ded6
test byte [rcx + 0x1c], 1
je 0x14005ded6
mov edx, 0x7d
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_RunCommandCollectFsutilUsnJournalInfo_failed___lx__n
call fcn.1400f5500
lea rcx, str.Getting_snapshot_information..._n
call fcn.1400f5528
call fcn.1400a4a70
mov ebx, eax
test eax, eax
jns 0x14005df33
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005df25
test byte [rcx + 0x1c], 4
je 0x14005df25
mov edx, 0x7e
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.RunCommandCollectSnapshotsInfo___failed___lx_._n
call fcn.1400f5500
call fcn.1400ef408
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.140052628
nop
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x4c0], rax
mov byte [rsp + 0x4c8], 1
xor eax, eax
mov dword [rsp + 0x4c9], eax
mov word [rsp + 0x4cd], ax
mov byte [rsp + 0x4cf], al
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x4d0], rax
mov byte [rsp + 0x4d8], 0
xor eax, eax
mov dword [rsp + 0x4d9], eax
mov word [rsp + 0x4dd], ax
mov byte [rsp + 0x4df], al
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x4e0], rax
mov byte [rsp + 0x4e8], 0
xor eax, eax
mov dword [rsp + 0x4e9], eax
mov word [rsp + 0x4ed], ax
mov byte [rsp + 0x4ef], al
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x4f0], rax
mov byte [rsp + 0x4f8], 0
xor eax, eax
mov dword [rsp + 0x4f9], eax
mov word [rsp + 0x4fd], ax
mov byte [rsp + 0x4ff], al
lea rax, [rsp + 0x250]
cmp qword [rsp + 0x268], 8
cmovae rax, qword [rsp + 0x250]
mov qword [rsp + 0x500], rax
mov byte [rsp + 0x508], 0
xor eax, eax
mov dword [rsp + 0x509], eax
mov word [rsp + 0x50d], ax
mov byte [rsp + 0x50f], al
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe8], xmm0
and qword [rsp + 0xf8], rax
lea ecx, [rax + 0x50]
call fcn.1400411ac
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
lea rbx, [rax + 0x50]
mov qword [rsp + 0xf8], rbx
mov r8d, 0x50
lea rdx, [rsp + 0x4c0]
mov rcx, rax
call fcn.1400333b0
mov qword [rsp + 0xf0], rbx
and qword [rsp + 0x88], 0
lea rcx, [rsp + 0x88]
call fcn.140052b70
nop
lea rcx, str.Creating_CAB_file..._n
call fcn.1400f5528
xor ebx, ebx
mov qword [rsp + 0x88], rbx
cmp byte [rsp + 0x930], bl
je 0x14005e16d
lea r8, str.DiagOutputDir
lea rdx, [rsp + 0x88]
lea rcx, [0x1400fe0c0]
call fcn.1400fe5bc
mov ebx, eax
test eax, eax
js 0x14005e6d9
mov rbx, qword [rsp + 0x88]
mov rcx, rbx
call fcn.1400fa360
mov edi, eax
test eax, eax
js 0x14005e719
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x270]
call fcn.140032e00
lea rdx, [rsp + 0x270]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14005e759
test dword [rsp + 0x270], 0x400
je 0x14005e165
cmp dword [rsp + 0x294], 0xa0000003
je 0x14005e79e
mov rcx, rbx
mov rsi, rbx
jmp 0x14005e174
mov rcx, qword [rsp + 0x58]
xor esi, esi
lea rdx, [rsp + 0xe8]
call fcn.140054288
mov edi, eax
test eax, eax
js 0x14005e7e3
mov rdx, qword [rsp + 0x58]
cmp byte [rsp + 0x930], 0
cmovne rdx, rsi
lea r8, str.SupportFiles.cab
lea rcx, str.Files_successfully_created_in__lsMp_ls_n
call fcn.1400f5528
xor edx, edx
mov r8d, 0x202
lea rcx, [rsp + 0x540]
call fcn.140032e00
mov dword [rsp + 0xcc], 0x101
lea rdx, [rsp + 0xcc]
lea rcx, [rsp + 0x540]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14005e1ee
mov sil, 1
jmp 0x14005e230
xor sil, sil
call fcn.1400fb4fc
mov edi, eax
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e222
test byte [rcx + 0x1c], 1
je 0x14005e222
mov edx, 0x84
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_GetUserNameW___failed___lx__n
call fcn.1400f5500
and qword [rsp + 0xd0], 0
cmp qword [rsp + 0xd8], 0
jne 0x14005e2be
movzx edx, byte [rsp + 0x60]
lea rcx, [rsp + 0xd0]
call fcn.1400564ec
mov edi, eax
test eax, eax
jns 0x14005e2a9
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e286
test byte [rcx + 0x1c], 1
je 0x14005e286
mov edx, 0x85
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_GetSupportLogLocationPathFromConfig___failed___lx__n
call fcn.1400f5500
mov al, byte [rsp + 0x80]
neg al
sbb ecx, ecx
and ecx, edi
jl 0x14005e823
jmp 0x14005e31e
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rax
test rax, rax
je 0x14005e31e
movzx edx, byte [rsp + 0x60]
mov r8, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x58]
call fcn.140053da4
mov edi, eax
test eax, eax
jns 0x14005e31e
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e305
test byte [rcx + 0x1c], 1
je 0x14005e305
mov edx, 0x86
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.Error:_CopySupportLogs_failed___lx__n
call fcn.1400f5500
cmp byte [rsp + 0x60], 0
jne 0x14005e829
mov edx, 0x3fab
call fcn.1400fda70
test eax, eax
js 0x14005e39f
mov edx, 0xc9
call fcn.14005977c
mov edi, eax
jmp 0x14005e362
test edi, edi
jns 0x14005e39f
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e390
test byte [rcx + 0x1c], 2
je 0x14005e390
mov edx, 0x87
mov r9d, edi
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.Purging_logs_for_Windows_Security_Service_failed___lx__n
call fcn.1400f5500
nop
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14005e3b3
call qword [sym.imp.mpclient.dll_MpFreeMemory]
nop
test rbx, rbx
je 0x14005e3c1
mov rcx, rbx
call fcn.140030ba0
nop
lea rcx, [rsp + 0xe8]
call fcn.140052d40
nop
lea rcx, [rsp + 0x250]
call fcn.140045590
nop
lea rcx, [rsp + 0x100]
call fcn.1400529fc
nop
lea rcx, [rsp + 0x120]
call fcn.1400529fc
nop
lea rcx, [rsp + 0x140]
call fcn.1400529fc
nop
lea rcx, [rsp + 0x160]
call fcn.1400529fc
nop
lea rcx, [rsp + 0x180]
call fcn.1400529fc
nop
lea rcx, [rsp + 0x1a0]
call fcn.1400529fc
nop
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14005e444
call fcn.140030ba0
nop
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x14005e45a
mov rcx, rbx
call fcn.140030ba0
nop
lea rcx, [rsp + 0x1c0]
call fcn.1400529fc
nop
mov rcx, qword [rsp + 0x240]
test rcx, rcx
je 0x14005e47b
call fcn.140030ba0
nop
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14005e48e
mov rcx, rbx
call fcn.140030ba0
nop
lea rcx, [rsp + 0x1e0]
call fcn.1400529fc
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14005e4af
call fcn.140030ba0
nop
lea rcx, [rsp + 0x200]
call fcn.1400529fc
nop
lea rcx, [rsp + 0x220]
call fcn.1400529fc
nop
cmp qword [rsp + 0xe0], 0
je 0x14005e4dd
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14005e4f0
call fcn.140030ba0
nop
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14005e503
call fcn.140030ba0
nop
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14005e515
mov rcx, rbx
call fcn.140030ba0
mov rcx, qword [rsp + 0x8f8]
xor rcx, rsp
call fcn.140030b80
add rsp, 0x900
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
lea r14, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e565
test byte [rcx + 0x1c], 1
je 0x14005e565
mov edx, 0x40
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_MpSmartCoInitialize_failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
int3
lea r14, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e5ac
test byte [rcx + 0x1c], 1
je 0x14005e5ac
mov edx, 0x41
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CoInitializeSecurity_failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
int3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e5ec
test byte [rcx + 0x1c], 1
je 0x14005e5ec
mov edx, 0x43
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_MpGetInstalledProductIdentifier_failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
int3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e629
test byte [rcx + 0x1c], 1
je 0x14005e629
mov edx, 0x44
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
mov ebx, 0x80070032
mov edx, ebx
lea rcx, str.ERROR:_MpGetInstalledProductIdentifier_return_unknown_product___lx_._n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
int3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e66e
test byte [rcx + 0x1c], 1
je 0x14005e66e
mov edx, 0x45
mov r9d, ebx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_GetSupportDir___failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
nop
mov ecx, eax
call fcn.1400f9fc4
mov ecx, eax
call fcn.1400f9fc4
nop
lea rcx, [0x140176bf8]
call fcn.140030e50
cmp dword [0x140176bf8], 0xffffffff
jne 0x14005d6bd
call fcn.140100cd0
mov byte [0x140176bfc], al
lea rcx, [0x140176bf8]
call fcn.140030df0
nop
jmp 0x14005d6bd
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e703
test byte [rcx + 0x1c], 1
je 0x14005e703
mov edx, 0x7f
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_CreateCab___failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
int3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e743
test byte [rcx + 0x1c], 1
je 0x14005e743
mov edx, 0x80
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_CreateCab___failed___lx__n
call fcn.1400f5500
mov ecx, edi
call fcn.1400f9fc4
int3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e783
test byte [rcx + 0x1c], 1
je 0x14005e783
mov edx, 0x81
mov r9, rbx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044638
mov ebx, 0x80070002
mov edx, ebx
lea rcx, str.ERROR:_CreateCab___failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
int3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e7c8
test byte [rcx + 0x1c], 1
je 0x14005e7c8
mov edx, 0x82
mov r9, rbx
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044638
mov ebx, 0x80070032
mov edx, ebx
lea rcx, str.Error:_CreateCab___failed___lx__n
call fcn.1400f5500
mov ecx, ebx
call fcn.1400f9fc4
int3
mov rcx, qword [0x14016d280]
cmp rcx, r14
je 0x14005e80d
test byte [rcx + 0x1c], 1
je 0x14005e80d
mov edx, 0x83
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_CreateCab___failed___lx__n
call fcn.1400f5500
mov ecx, edi
call fcn.1400f9fc4
nop
call fcn.1400f9fc4
int3
lea eax, [rdi + 0x7ff8fffb]
cmp eax, 0x3e
ja 0x14005e844
movabs rcx, 0x4001000000000001
bt rcx, rax
jb 0x14005e85c
cmp edi, 0x800700a1
je 0x14005e85c
mov edx, edi
lea rcx, str.Error:_Copy_of_the_Support_Logs_failed___lx__n
call fcn.1400f5528
jmp 0x14005e883
test sil, sil
je 0x14005e877
lea rdx, [rsp + 0x540]
lea rcx, str.Username:__ws_Error:_Support_Log_Location_is_Invalid_or_Not_Accessible__n
call fcn.1400f5528
jmp 0x14005e883
lea rcx, str.Error:_Support_Log_Location_is_Invalid_or_Not_Accessible__n
call fcn.1400f5528
mov ecx, edi
call fcn.1400f9fc4
int3