Function at 0x140197330
Capabilities:
Check if file exists
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1ea0
call fcn.1401da720
sub rsp, rax
mov qword [rsp + 0x1bd8], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x1e90], rax
mov dword [rsp + 0x1bd4], 0
lea r8, [0x140247d98]
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1978]
call fcn.1400010b0
mov qword [rsp + 0x1be0], rax
mov rcx, qword [rsp + 0x1be0]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x1978]
call fcn.140001490
cmp dword [rsp + 0x40], 0
je 0x140197452
lea rcx, [rsp + 0x1988]
call fcn.140001000
mov qword [rsp + 0x1be8], rax
mov rax, qword [rsp + 0x1be8]
mov qword [rsp + 0x1bf0], rax
mov eax, dword [rsp + 0x1bd4]
or eax, 1
mov dword [rsp + 0x1bd4], eax
lea r8, str.CCBootClientx64
mov rdx, qword [rsp + 0x1bf0]
lea rcx, [rsp + 0x1990]
call fcn.1400010b0
mov qword [rsp + 0x1bf8], rax
mov rax, qword [rsp + 0x1bf8]
mov qword [rsp + 0x1c00], rax
mov eax, dword [rsp + 0x1bd4]
or eax, 2
mov dword [rsp + 0x1bd4], eax
mov rax, qword [rsp + 0x1c00]
mov qword [rsp + 0x1c08], rax
jmp 0x1401974dd
lea rcx, [rsp + 0x1998]
call fcn.140001000
mov qword [rsp + 0x1c10], rax
mov rax, qword [rsp + 0x1c10]
mov qword [rsp + 0x1c18], rax
mov eax, dword [rsp + 0x1bd4]
or eax, 4
mov dword [rsp + 0x1bd4], eax
lea r8, [0x140247de8]
mov rdx, qword [rsp + 0x1c18]
lea rcx, [rsp + 0x19a0]
call fcn.1400010b0
mov qword [rsp + 0x1c20], rax
mov rax, qword [rsp + 0x1c20]
mov qword [rsp + 0x1c28], rax
mov eax, dword [rsp + 0x1bd4]
or eax, 8
mov dword [rsp + 0x1bd4], eax
mov rax, qword [rsp + 0x1c28]
mov qword [rsp + 0x1c08], rax
mov rax, qword [rsp + 0x1c08]
mov qword [rsp + 0x1980], rax
mov rdx, qword [rsp + 0x1980]
lea rcx, [rsp + 0x68]
call fcn.140001430
nop
mov eax, dword [rsp + 0x1bd4]
and eax, 8
test eax, eax
je 0x140197524
and dword [rsp + 0x1bd4], 0xfffffff7
lea rcx, [rsp + 0x19a0]
call fcn.140001490
nop
mov eax, dword [rsp + 0x1bd4]
and eax, 4
test eax, eax
je 0x140197548
and dword [rsp + 0x1bd4], 0xfffffffb
lea rcx, [rsp + 0x1998]
call fcn.140001490
nop
mov eax, dword [rsp + 0x1bd4]
and eax, 2
test eax, eax
je 0x14019756c
and dword [rsp + 0x1bd4], 0xfffffffd
lea rcx, [rsp + 0x1990]
call fcn.140001490
nop
mov eax, dword [rsp + 0x1bd4]
and eax, 1
test eax, eax
je 0x14019758f
and dword [rsp + 0x1bd4], 0xfffffffe
lea rcx, [rsp + 0x1988]
call fcn.140001490
lea rcx, [rsp + 0x68]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401975e6
lea rdx, [0x140247e10]
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0x19a8], 0
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x19a8]
jmp 0x140199952
lea r8, [0x140247e68]
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x19b0]
call fcn.1400010b0
mov qword [rsp + 0x1c30], rax
mov rax, qword [rsp + 0x1c30]
mov qword [rsp + 0x1c38], rax
lea r8, [0x140247814]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x19b8]
call fcn.1400010b0
mov qword [rsp + 0x1c40], rax
mov rcx, qword [rsp + 0x1c38]
call fcn.14000f8f0
mov rdi, rax
mov rcx, qword [rsp + 0x1c40]
call fcn.14000f8f0
mov rdx, rdi
mov rcx, rax
call fcn.14011beb0
test eax, eax
jne 0x140197674
mov dword [rsp + 0x1c48], 1
jmp 0x14019767f
mov dword [rsp + 0x1c48], 0
movzx eax, byte [rsp + 0x1c48]
mov byte [rsp + 0x19ac], al
lea rcx, [rsp + 0x19b8]
call fcn.140001490
nop
lea rcx, [rsp + 0x19b0]
call fcn.140001490
movzx edx, byte [rsp + 0x19ac]
test edx, edx
je 0x1401976f5
lea rdx, str._Error__Copy_client_file_error
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0x19c0], 0
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x19c0]
jmp 0x140199952
lea rcx, [rsp + 0x50]
call fcn.140005560
nop
lea r8, str._SYSTEMSelect
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x19c8]
call fcn.1400010b0
mov qword [rsp + 0x1c50], rax
mov rcx, qword [rsp + 0x1c50]
call fcn.14000f8f0
mov r9d, 0x20019
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
je 0x14019775c
mov dword [rsp + 0x1c58], 1
jmp 0x140197767
mov dword [rsp + 0x1c58], 0
movzx eax, byte [rsp + 0x1c58]
mov byte [rsp + 0x19c4], al
lea rcx, [rsp + 0x19c8]
call fcn.140001490
movzx edx, byte [rsp + 0x19c4]
test edx, edx
je 0x1401977c9
mov dword [rsp + 0x19d0], 0
lea rcx, [rsp + 0x50]
call fcn.140005590
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x19d0]
jmp 0x140199952
mov dword [rsp + 0x44], 1
lea r8, [rsp + 0x44]
lea rdx, [0x140247f00]
lea rcx, [rsp + 0x50]
call fcn.1400057b0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea rcx, [rsp + 0x60]
call fcn.140002de0
nop
mov r9d, dword [rsp + 0x44]
mov r8, qword [rsp + 0x1eb0]
mov r8, qword [r8]
lea rdx, str._s_SYSTEMControlSet_03d
lea rcx, [rsp + 0x60]
call fcn.140002c70
lea r8, str.ControlSession_ManagerPower
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x19d8]
call fcn.1400010b0
mov qword [rsp + 0x1c60], rax
mov rcx, qword [rsp + 0x1c60]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197876
mov dword [rsp + 0x1c68], 1
jmp 0x140197881
mov dword [rsp + 0x1c68], 0
movzx eax, byte [rsp + 0x1c68]
mov byte [rsp + 0x19d4], al
lea rcx, [rsp + 0x19d8]
call fcn.140001490
movzx edx, byte [rsp + 0x19d4]
test edx, edx
je 0x1401978c7
xor r8d, r8d
lea rdx, str.HiberbootEnabled
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str.ServicesWfpLwf
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x19e8]
call fcn.1400010b0
mov qword [rsp + 0x1c70], rax
mov rcx, qword [rsp + 0x1c70]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197920
mov dword [rsp + 0x1c78], 1
jmp 0x14019792b
mov dword [rsp + 0x1c78], 0
movzx eax, byte [rsp + 0x1c78]
mov byte [rsp + 0x19e0], al
lea rcx, [rsp + 0x19e8]
call fcn.140001490
movzx edx, byte [rsp + 0x19e0]
test edx, edx
je 0x140197971
xor r8d, r8d
lea rdx, [0x140247fd8]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x140247fe8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x19f8]
call fcn.1400010b0
mov qword [rsp + 0x1c80], rax
mov rcx, qword [rsp + 0x1c80]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x1401979ca
mov dword [rsp + 0x1c88], 1
jmp 0x1401979d5
mov dword [rsp + 0x1c88], 0
movzx eax, byte [rsp + 0x1c88]
mov byte [rsp + 0x19f0], al
lea rcx, [rsp + 0x19f8]
call fcn.140001490
movzx edx, byte [rsp + 0x19f0]
test edx, edx
je 0x140197a1b
xor r8d, r8d
lea rdx, [0x140248010]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x140248020]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a08]
call fcn.1400010b0
mov qword [rsp + 0x1c90], rax
mov rcx, qword [rsp + 0x1c90]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197a74
mov dword [rsp + 0x1c98], 1
jmp 0x140197a7f
mov dword [rsp + 0x1c98], 0
movzx eax, byte [rsp + 0x1c98]
mov byte [rsp + 0x1a00], al
lea rcx, [rsp + 0x1a08]
call fcn.140001490
movzx edx, byte [rsp + 0x1a00]
test edx, edx
je 0x140197ac5
xor r8d, r8d
lea rdx, [0x140248048]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x140248058]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a18]
call fcn.1400010b0
mov qword [rsp + 0x1ca0], rax
mov rcx, qword [rsp + 0x1ca0]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197b1e
mov dword [rsp + 0x1ca8], 1
jmp 0x140197b29
mov dword [rsp + 0x1ca8], 0
movzx eax, byte [rsp + 0x1ca8]
mov byte [rsp + 0x1a10], al
lea rcx, [rsp + 0x1a18]
call fcn.140001490
movzx edx, byte [rsp + 0x1a10]
test edx, edx
je 0x140197b6f
xor r8d, r8d
lea rdx, [0x140248080]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x140248090]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a28]
call fcn.1400010b0
mov qword [rsp + 0x1cb0], rax
mov rcx, qword [rsp + 0x1cb0]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197bc8
mov dword [rsp + 0x1cb8], 1
jmp 0x140197bd3
mov dword [rsp + 0x1cb8], 0
movzx eax, byte [rsp + 0x1cb8]
mov byte [rsp + 0x1a20], al
lea rcx, [rsp + 0x1a28]
call fcn.140001490
movzx edx, byte [rsp + 0x1a20]
test edx, edx
je 0x140197c19
xor r8d, r8d
lea rdx, [0x1402480b8]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str.Services_ndisrd
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a38]
call fcn.1400010b0
mov qword [rsp + 0x1cc0], rax
mov rcx, qword [rsp + 0x1cc0]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197c72
mov dword [rsp + 0x1cc8], 1
jmp 0x140197c7d
mov dword [rsp + 0x1cc8], 0
movzx eax, byte [rsp + 0x1cc8]
mov byte [rsp + 0x1a30], al
lea rcx, [rsp + 0x1a38]
call fcn.140001490
movzx edx, byte [rsp + 0x1a30]
test edx, edx
je 0x140197cc3
xor r8d, r8d
lea rdx, [0x1402480f0]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str.Serviceshcafed
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a48]
call fcn.1400010b0
mov qword [rsp + 0x1cd0], rax
mov rcx, qword [rsp + 0x1cd0]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197d1c
mov dword [rsp + 0x1cd8], 1
jmp 0x140197d27
mov dword [rsp + 0x1cd8], 0
movzx eax, byte [rsp + 0x1cd8]
mov byte [rsp + 0x1a40], al
lea rcx, [rsp + 0x1a48]
call fcn.140001490
movzx edx, byte [rsp + 0x1a40]
test edx, edx
je 0x140197d6d
xor r8d, r8d
lea rdx, [0x140248128]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x140248138]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a58]
call fcn.1400010b0
mov qword [rsp + 0x1ce0], rax
mov rcx, qword [rsp + 0x1ce0]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197dc6
mov dword [rsp + 0x1ce8], 1
jmp 0x140197dd1
mov dword [rsp + 0x1ce8], 0
movzx eax, byte [rsp + 0x1ce8]
mov byte [rsp + 0x1a50], al
lea rcx, [rsp + 0x1a58]
call fcn.140001490
movzx edx, byte [rsp + 0x1a50]
test edx, edx
je 0x140197e1a
mov r8d, 2
lea rdx, [0x140248158]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str._SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1a68]
call fcn.1400010b0
mov qword [rsp + 0x1cf0], rax
mov rcx, qword [rsp + 0x1cf0]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140197e76
mov dword [rsp + 0x1cf8], 1
jmp 0x140197e81
mov dword [rsp + 0x1cf8], 0
movzx eax, byte [rsp + 0x1cf8]
mov byte [rsp + 0x1a60], al
lea rcx, [rsp + 0x1a68]
call fcn.140001490
movzx edx, byte [rsp + 0x1a60]
test edx, edx
je 0x14019803c
xor eax, eax
mov word [rsp + 0x90], ax
lea rdi, [rsp + 0x92]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0x400
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x90]
lea rdx, [0x1402481e0]
lea rcx, [rsp + 0x50]
call fcn.140005830
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x140198032
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x898]
call fcn.140002100
nop
lea rcx, [rsp + 0x890]
call fcn.140002de0
nop
mov dword [rsp + 0x8a0], 0
cmp dword [rsp + 0x8a0], 0xffffffff
je 0x140197fef
lea r9, [rsp + 0x8a0]
lea r8, [0x140245e54]
lea rdx, [rsp + 0x8a8]
lea rcx, [rsp + 0x898]
call fcn.1400065a0
nop
lea rcx, [rsp + 0x8a8]
call fcn.140006eb0
movzx eax, al
test eax, eax
je 0x140197f89
lea rcx, [rsp + 0x8a8]
call fcn.140001490
jmp 0x140197fef
xor r8d, r8d
lea rdx, str.CCBootClient.exe
lea rcx, [rsp + 0x8a8]
call fcn.140006780
test eax, eax
jl 0x140197fb3
lea rcx, [rsp + 0x8a8]
call fcn.140001490
jmp 0x140197f33
lea rdx, [rsp + 0x8a8]
lea rcx, [rsp + 0x890]
call fcn.1400060a0
lea rdx, [0x140245e8c]
lea rcx, [rsp + 0x890]
call fcn.1400060d0
nop
lea rcx, [rsp + 0x8a8]
call fcn.140001490
jmp 0x140197f33
lea rcx, [rsp + 0x890]
call fcn.14000f8f0
mov r9d, 1
mov r8, rax
lea rdx, str.Userinit
lea rcx, [rsp + 0x50]
call fcn.140005b00
nop
lea rcx, [rsp + 0x890]
call fcn.140001490
nop
lea rcx, [rsp + 0x898]
call fcn.140001490
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str._servicesWinDefend
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a78]
call fcn.1400010b0
mov qword [rsp + 0x1d00], rax
mov rcx, qword [rsp + 0x1d00]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140198095
mov dword [rsp + 0x1d08], 1
jmp 0x1401980a0
mov dword [rsp + 0x1d08], 0
movzx eax, byte [rsp + 0x1d08]
mov byte [rsp + 0x1a70], al
lea rcx, [rsp + 0x1a78]
call fcn.140001490
movzx edx, byte [rsp + 0x1a70]
test edx, edx
je 0x1401980e9
mov r8d, 4
lea rdx, [0x140248260]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x140248270]
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1a88]
call fcn.1400010b0
mov qword [rsp + 0x1d10], rax
mov rcx, qword [rsp + 0x1d10]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140198145
mov dword [rsp + 0x1d18], 1
jmp 0x140198150
mov dword [rsp + 0x1d18], 0
movzx eax, byte [rsp + 0x1d18]
mov byte [rsp + 0x1a80], al
lea rcx, [rsp + 0x1a88]
call fcn.140001490
movzx edx, byte [rsp + 0x1a80]
test edx, edx
je 0x140198199
mov r8d, 1
lea rdx, [0x1402482d0]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str._servicesMpsSvc
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1a98]
call fcn.1400010b0
mov qword [rsp + 0x1d20], rax
mov rcx, qword [rsp + 0x1d20]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x1401981f2
mov dword [rsp + 0x1d28], 1
jmp 0x1401981fd
mov dword [rsp + 0x1d28], 0
movzx eax, byte [rsp + 0x1d28]
mov byte [rsp + 0x1a90], al
lea rcx, [rsp + 0x1a98]
call fcn.140001490
movzx edx, byte [rsp + 0x1a90]
test edx, edx
je 0x1401982dc
xor edx, edx
mov rcx, qword [rsp + 0x1eb0]
call fcn.140006dd0
movzx ecx, ax
call fcn.140196040
mov eax, eax
and rax, 0xffff
movzx eax, ax
and rax, 0xff
movzx eax, al
cmp eax, 6
jne 0x14019828d
xor edx, edx
mov rcx, qword [rsp + 0x1eb0]
call fcn.140006dd0
movzx ecx, ax
call fcn.140196040
mov eax, eax
and rax, 0xffff
movzx eax, ax
shr rax, 8
and rax, 0xff
movzx eax, al
cmp eax, 3
je 0x1401982d2
mov dword [rsp + 0x8b0], 4
lea r8, [rsp + 0x8b0]
lea rdx, [0x140248320]
lea rcx, [rsp + 0x50]
call fcn.1400057b0
cmp dword [rsp + 0x8b0], 4
je 0x1401982d2
mov r8d, 3
lea rdx, [0x140248330]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x140248340]
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1aa8]
call fcn.1400010b0
mov qword [rsp + 0x1d30], rax
mov rcx, qword [rsp + 0x1d30]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140198338
mov dword [rsp + 0x1d38], 1
jmp 0x140198343
mov dword [rsp + 0x1d38], 0
movzx eax, byte [rsp + 0x1d38]
mov byte [rsp + 0x1aa0], al
lea rcx, [rsp + 0x1aa8]
call fcn.140001490
movzx edx, byte [rsp + 0x1aa0]
test edx, edx
je 0x14019838c
mov r8d, 1
lea rdx, [0x1402483a0]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str._SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1ab8]
call fcn.1400010b0
mov qword [rsp + 0x1d40], rax
mov rcx, qword [rsp + 0x1d40]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x1401983e8
mov dword [rsp + 0x1d48], 1
jmp 0x1401983f3
mov dword [rsp + 0x1d48], 0
movzx eax, byte [rsp + 0x1d48]
mov byte [rsp + 0x1ab0], al
lea rcx, [rsp + 0x1ab8]
call fcn.140001490
movzx edx, byte [rsp + 0x1ab0]
test edx, edx
je 0x14019843c
mov r8d, 1
lea rdx, str.HideSCAHealth
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x140248460]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1ac8]
call fcn.1400010b0
mov qword [rsp + 0x1d50], rax
mov rcx, qword [rsp + 0x1d50]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140198495
mov dword [rsp + 0x1d58], 1
jmp 0x1401984a0
mov dword [rsp + 0x1d58], 0
movzx eax, byte [rsp + 0x1d58]
mov byte [rsp + 0x1ac0], al
lea rcx, [rsp + 0x1ac8]
call fcn.140001490
movzx edx, byte [rsp + 0x1ac0]
test edx, edx
je 0x14019857f
xor edx, edx
mov rcx, qword [rsp + 0x1eb0]
call fcn.140006dd0
movzx ecx, ax
call fcn.140196040
mov eax, eax
and rax, 0xffff
movzx eax, ax
and rax, 0xff
movzx eax, al
cmp eax, 6
jne 0x140198530
xor edx, edx
mov rcx, qword [rsp + 0x1eb0]
call fcn.140006dd0
movzx ecx, ax
call fcn.140196040
mov eax, eax
and rax, 0xffff
movzx eax, ax
shr rax, 8
and rax, 0xff
movzx eax, al
cmp eax, 3
je 0x140198575
mov dword [rsp + 0x8b4], 4
lea r8, [rsp + 0x8b4]
lea rdx, [0x140248488]
lea rcx, [rsp + 0x50]
call fcn.1400057b0
cmp dword [rsp + 0x8b4], 4
je 0x140198575
mov r8d, 3
lea rdx, [0x140248498]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, [0x1402484a8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1ad0]
call fcn.1400010b0
mov qword [rsp + 0x1d60], rax
mov rax, qword [rsp + 0x1d60]
mov qword [rsp + 0x1d68], rax
mov rcx, qword [rsp + 0x1d68]
call fcn.14000f8f0
mov rcx, rax
call fcn.14011cf60
nop
lea rcx, [rsp + 0x1ad0]
call fcn.140001490
lea r8, str.ServicesCCache
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1ad8]
call fcn.1400010b0
mov qword [rsp + 0x1d70], rax
mov rax, qword [rsp + 0x1d70]
mov qword [rsp + 0x1d78], rax
mov rcx, qword [rsp + 0x1d78]
call fcn.14000f8f0
mov rcx, rax
call fcn.14011cf60
nop
lea rcx, [rsp + 0x1ad8]
call fcn.140001490
lea r8, str.ControlClass4D36E967_E325_11CE_BFC1_08002BE10318
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1ae8]
call fcn.1400010b0
mov qword [rsp + 0x1d80], rax
mov rcx, qword [rsp + 0x1d80]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140198680
mov dword [rsp + 0x1d88], 1
jmp 0x14019868b
mov dword [rsp + 0x1d88], 0
movzx eax, byte [rsp + 0x1d88]
mov byte [rsp + 0x1ae0], al
lea rcx, [rsp + 0x1ae8]
call fcn.140001490
movzx edx, byte [rsp + 0x1ae0]
test edx, edx
je 0x14019886f
mov dword [rsp + 0x8b8], 0x400
lea r9, [rsp + 0x8b8]
lea r8, [rsp + 0x8c0]
lea rdx, [0x140248570]
lea rcx, [rsp + 0x50]
call fcn.140005940
test eax, eax
jne 0x140198865
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x10c0], rax
lea rcx, [rsp + 0x10c8]
call fcn.140077c20
nop
mov rax, qword [rsp + 0x10c0]
movzx eax, word [rax]
test eax, eax
je 0x14019876d
lea rdx, [0x140248590]
mov rcx, qword [rsp + 0x10c0]
call fcn.1400aa794
test eax, eax
je 0x140198745
mov rdx, qword [rsp + 0x10c0]
lea rcx, [rsp + 0x10c8]
call fcn.14000e2e0
mov rcx, qword [rsp + 0x10c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x10c0]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x10c0], rax
jmp 0x140198709
lea rax, [rsp + 0x8c0]
mov qword [rsp + 0x10c0], rax
mov dword [rsp + 0x10f0], 0
jmp 0x14019879b
mov eax, dword [rsp + 0x10f0]
add eax, 1
mov dword [rsp + 0x10f0], eax
movsxd rdi, dword [rsp + 0x10f0]
lea rcx, [rsp + 0x10c8]
call fcn.140012e60
cmp rdi, rax
jge 0x14019880e
movsxd rdx, dword [rsp + 0x10f0]
lea rcx, [rsp + 0x10c8]
call fcn.14001edf0
mov rcx, rax
call fcn.14000f8f0
mov rdx, rax
mov rcx, qword [rsp + 0x10c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x10c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x10c0]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x10c0], rax
jmp 0x14019878a
xor ecx, ecx
mov rax, qword [rsp + 0x10c0]
mov word [rax], cx
lea r8, [rsp + 0x8c0]
lea rdx, [0x1402485a0]
lea rcx, [rsp + 0x50]
call fcn.140005ba0
lea rcx, [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x140198858
lea rdx, [0x1402485c0]
lea rcx, [rsp + 0x50]
call fcn.1400055b0
nop
lea rcx, [rsp + 0x10c8]
call fcn.140077ee4
lea rcx, [rsp + 0x50]
call fcn.1400055f0
xor eax, eax
cmp eax, 1
je 0x140198ca0
lea rcx, [rsp + 0x1118]
call fcn.140005560
nop
lea r8, str._SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1af8]
call fcn.1400010b0
mov qword [rsp + 0x1d90], rax
mov rcx, qword [rsp + 0x1d90]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x1118]
call fcn.140005720
test eax, eax
jne 0x1401988e7
mov dword [rsp + 0x1d98], 1
jmp 0x1401988f2
mov dword [rsp + 0x1d98], 0
movzx eax, byte [rsp + 0x1d98]
mov byte [rsp + 0x1af0], al
lea rcx, [rsp + 0x1af8]
call fcn.140001490
movzx edx, byte [rsp + 0x1af0]
test edx, edx
je 0x14019893b
lea rdx, str.CCache
lea rcx, [rsp + 0x1118]
call fcn.1400055b0
lea rcx, [rsp + 0x1118]
call fcn.1400055f0
mov dword [rsp + 0x1100], 0
lea rdi, [rsp + 0x1104]
xor eax, eax
mov ecx, reloc.WSOCK32.dll_select
rep stosb byte [rdi], al
lea rcx, [rsp + 0x1b00]
call fcn.140001000
mov qword [rsp + 0x1da0], rax
mov rax, qword [rsp + 0x1da0]
mov qword [rsp + 0x1da8], rax
lea r8, [0x140248650]
mov rdx, qword [rsp + 0x1da8]
lea rcx, [rsp + 0x1b08]
call fcn.1400010b0
mov qword [rsp + 0x1db0], rax
mov rcx, qword [rsp + 0x1db0]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x10f8], rax
lea rcx, [rsp + 0x1b08]
call fcn.140001490
nop
lea rcx, [rsp + 0x1b00]
call fcn.140001490
cmp qword [rsp + 0x10f8], 0
je 0x140198ad5
lea rdx, [0x140248670]
mov rcx, qword [rsp + 0x10f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1128], rax
cmp qword [rsp + 0x1128], 0
je 0x140198ac5
mov dword [rsp + 0x1100], 0x43584358
mov dword [rsp + 0x1104], 1
xor edx, edx
mov rcx, qword [rsp + 0x1eb0]
call fcn.140006dd0
mov word [rsp + 0x1114], ax
lea rcx, [rsp + 0x1100]
call qword [rsp + 0x1128]
mov dword [rsp + 0x1130], eax
cmp dword [rsp + 0x1130], 0
jne 0x140198ac5
lea rdx, [0x140248680]
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0x1b10], 0
lea rcx, [rsp + 0x1118]
call fcn.140005590
nop
lea rcx, [rsp + 0x60]
call fcn.140001490
nop
lea rcx, [rsp + 0x50]
call fcn.140005590
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x1b10]
jmp 0x140199952
mov rcx, qword [rsp + 0x10f8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140198b39
lea rdx, [0x1402486d0]
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0x1b14], 0
lea rcx, [rsp + 0x1118]
call fcn.140005590
nop
lea rcx, [rsp + 0x60]
call fcn.140001490
nop
lea rcx, [rsp + 0x50]
call fcn.140005590
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x1b14]
jmp 0x140199952
lea r8, str._servicesCCacheXParameters
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1b20]
call fcn.1400010b0
mov qword [rsp + 0x1db8], rax
mov rcx, qword [rsp + 0x1db8]
call fcn.14000f8f0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x1118]
call fcn.140005640
test eax, eax
je 0x140198bb4
mov dword [rsp + 0x1dc0], 1
jmp 0x140198bbf
mov dword [rsp + 0x1dc0], 0
movzx eax, byte [rsp + 0x1dc0]
mov byte [rsp + 0x1b18], al
lea rcx, [rsp + 0x1b20]
call fcn.140001490
movzx edx, byte [rsp + 0x1b18]
test edx, edx
je 0x140198c3a
mov dword [rsp + 0x1b28], 0
lea rcx, [rsp + 0x1118]
call fcn.140005590
nop
lea rcx, [rsp + 0x60]
call fcn.140001490
nop
lea rcx, [rsp + 0x50]
call fcn.140005590
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x1b28]
jmp 0x140199952
mov r8d, 1
lea rdx, str.ClientCache
lea rcx, [rsp + 0x1118]
call fcn.140005aa0
mov r8d, 1
lea rdx, str.AutoStart
lea rcx, [rsp + 0x1118]
call fcn.140005aa0
xor r8d, r8d
lea rdx, [0x140248788]
lea rcx, [rsp + 0x1118]
call fcn.140005aa0
lea rcx, [rsp + 0x1118]
call fcn.1400055f0
nop
lea rcx, [rsp + 0x1118]
call fcn.140005590
lea r8, [0x1402487a0]
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1b30]
call fcn.1400010b0
mov qword [rsp + 0x1dc8], rax
mov rcx, qword [rsp + 0x1dc8]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x140198cfc
mov dword [rsp + 0x1dd0], 1
jmp 0x140198d07
mov dword [rsp + 0x1dd0], 0
movzx eax, byte [rsp + 0x1dd0]
mov byte [rsp + 0x1b2c], al
lea rcx, [rsp + 0x1b30]
call fcn.140001490
movzx edx, byte [rsp + 0x1b2c]
test edx, edx
je 0x140198d68
lea rdx, str.CCBootCmd
lea rcx, [rsp + 0x50]
call fcn.1400055b0
mov r9d, 1
lea r8, str._C:CCBootClientCCBootClient.exe___startup
lea rdx, [0x140248878]
lea rcx, [rsp + 0x50]
call fcn.140005b00
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str.ServicesCCBootClient
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1b40]
call fcn.1400010b0
mov qword [rsp + 0x1dd8], rax
mov rcx, qword [rsp + 0x1dd8]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
je 0x140198dc1
mov dword [rsp + 0x1de0], 1
jmp 0x140198dcc
mov dword [rsp + 0x1de0], 0
movzx eax, byte [rsp + 0x1de0]
mov byte [rsp + 0x1b38], al
lea rcx, [rsp + 0x1b40]
call fcn.140001490
movzx edx, byte [rsp + 0x1b38]
test edx, edx
je 0x140198f87
lea r8, str._servicesCCBootClient
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1b50]
call fcn.1400010b0
mov qword [rsp + 0x1de8], rax
mov rcx, qword [rsp + 0x1de8]
call fcn.14000f8f0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005640
test eax, eax
je 0x140198e70
mov dword [rsp + 0x1df0], 1
jmp 0x140198e7b
mov dword [rsp + 0x1df0], 0
movzx eax, byte [rsp + 0x1df0]
mov byte [rsp + 0x1b48], al
lea rcx, [rsp + 0x1b50]
call fcn.140001490
movzx edx, byte [rsp + 0x1b48]
test edx, edx
je 0x140198ee8
mov dword [rsp + 0x1b58], 0
lea rcx, [rsp + 0x60]
call fcn.140001490
nop
lea rcx, [rsp + 0x50]
call fcn.140005590
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x1b58]
jmp 0x140199952
mov r9d, 1
lea r8, str.CCBootClient
lea rdx, str.DisplayName
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r8d, 1
lea rdx, str.ErrorControl
lea rcx, [rsp + 0x50]
call fcn.140005aa0
mov r9d, 2
lea r8, str._C:CCBootClientCCBootClient.exe___service
lea rdx, [0x1402489a8]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x1402489c0]
lea rdx, str.ObjectName
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r8d, 2
lea rdx, [0x1402489f0]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [0x140248a00]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rdx, [0x140248a10]
lea rcx, [rsp + 0x50]
call fcn.1400055b0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str.Servicespnpdrv
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1b60]
call fcn.1400010b0
mov qword [rsp + 0x1df8], rax
mov rax, qword [rsp + 0x1df8]
mov qword [rsp + 0x1e00], rax
mov rcx, qword [rsp + 0x1e00]
call fcn.14000f8f0
mov rcx, rax
call fcn.14011cf60
nop
lea rcx, [rsp + 0x1b60]
call fcn.140001490
lea r8, str.ServicesCCBootPnP
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1b68]
call fcn.1400010b0
mov qword [rsp + 0x1e08], rax
mov rax, qword [rsp + 0x1e08]
mov qword [rsp + 0x1e10], rax
mov rcx, qword [rsp + 0x1e10]
call fcn.14000f8f0
mov rcx, rax
call fcn.14011cf60
nop
lea rcx, [rsp + 0x1b68]
call fcn.140001490
lea rcx, [rsp + 0x1b70]
call fcn.140001000
mov qword [rsp + 0x1e18], rax
mov rax, qword [rsp + 0x1e18]
mov qword [rsp + 0x1e20], rax
lea r8, str.CCBootPNP.dll
mov rdx, qword [rsp + 0x1e20]
lea rcx, [rsp + 0x1b78]
call fcn.1400010b0
mov qword [rsp + 0x1e28], rax
mov rcx, qword [rsp + 0x1e28]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x1b78]
call fcn.140001490
nop
lea rcx, [rsp + 0x1b70]
call fcn.140001490
cmp qword [rsp + 0x70], 0
je 0x140199179
lea rdx, str.CxPnpInstall
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
xor edx, edx
mov rcx, qword [rsp + 0x1eb0]
call fcn.140006dd0
movzx ecx, ax
call qword [rsp + 0x48]
test eax, eax
je 0x140199116
lea rdx, str.Install_PnP_driver_success
xor ecx, ecx
call fcn.1400dcf70
jmp 0x14019916c
lea rdx, [0x140248ae0]
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0x1b80], 0
lea rcx, [rsp + 0x60]
call fcn.140001490
nop
lea rcx, [rsp + 0x50]
call fcn.140005590
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x1b80]
jmp 0x140199952
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1401991cf
lea rdx, str._ERROR__Install_PnP_driver_failed
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0x1b84], 0
lea rcx, [rsp + 0x60]
call fcn.140001490
nop
lea rcx, [rsp + 0x50]
call fcn.140005590
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x1b84]
jmp 0x140199952
lea r8, str.SYSTEMCCBootPnPOptimizeDriver
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1b88]
call fcn.1400010b0
mov qword [rsp + 0x1e30], rax
mov rax, qword [rsp + 0x1e30]
mov qword [rsp + 0x1e38], rax
mov rcx, qword [rsp + 0x1e38]
call fcn.14000f8f0
mov rcx, rax
call fcn.14011cf60
nop
lea rcx, [rsp + 0x1b88]
call fcn.140001490
lea r8, str._SYSTEMCCBootPnPOptimizeDriver
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1b98]
call fcn.1400010b0
mov qword [rsp + 0x1e40], rax
mov rcx, qword [rsp + 0x1e40]
call fcn.14000f8f0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005640
test eax, eax
jne 0x1401992a1
mov dword [rsp + 0x1e48], 1
jmp 0x1401992ac
mov dword [rsp + 0x1e48], 0
movzx eax, byte [rsp + 0x1e48]
mov byte [rsp + 0x1b90], al
lea rcx, [rsp + 0x1b98]
call fcn.140001490
movzx edx, byte [rsp + 0x1b90]
test edx, edx
je 0x14019956f
mov r9d, 1
lea r8, [0x140245ef4]
lea rdx, [0x140248c18]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140245f2c]
lea rdx, str.InterruptModeration
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140246014]
lea rdx, [0x140248c68]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x14024604c]
lea rdx, str.PMARPOffload
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x1402460ec]
lea rdx, [0x140248cb8]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x14024616c]
lea rdx, [0x140248cd8]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x1402461b4]
lea rdx, str.TCPChecksumOffloadIPv6
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x1402461dc]
lea rdx, [0x140248d38]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140246204]
lea rdx, str.UDPChecksumOffloadIPv6
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x1402462a4]
lea rdx, str.Diskless
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140246314]
lea rdx, [0x140248db0]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140246474]
lea rdx, str.EEELinkAdvertisement
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140246534]
lea rdx, str.EnableGreenEthernet
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140246554]
lea rdx, str.EnablePME
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x14024657c]
lea rdx, [0x140248e28]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x14024661c]
lea rdx, str.IPChecksumOffloadIPv4
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140248e70]
lea rdx, [0x140248e78]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x14024664c]
lea rdx, [0x140248e80]
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x14024667c]
lea rdx, str.SpeedDuplex
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x14024675c]
lea rdx, str.TCPChecksumOffloadIPv4
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r9d, 1
lea r8, [0x140246d1c]
lea rdx, str.UDPChecksumOffloadIPv4
lea rcx, [rsp + 0x50]
call fcn.140005b00
mov r8d, pe_nt_image_headers64
lea rdx, str.PnPCapabilities
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str._SYSTEMCCBootPnP
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1ba8]
call fcn.1400010b0
mov qword [rsp + 0x1e50], rax
mov rcx, qword [rsp + 0x1e50]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x1401995cb
mov dword [rsp + 0x1e58], 1
jmp 0x1401995d6
mov dword [rsp + 0x1e58], 0
movzx eax, byte [rsp + 0x1e58]
mov byte [rsp + 0x1ba0], al
lea rcx, [rsp + 0x1ba8]
call fcn.140001490
movzx edx, byte [rsp + 0x1ba0]
test edx, edx
je 0x14019961f
mov r8d, 1
lea rdx, [0x140248f58]
lea rcx, [rsp + 0x50]
call fcn.140005aa0
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str.ServicesCCBootNIC
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1bb0]
call fcn.1400010b0
mov qword [rsp + 0x1e60], rax
mov rax, qword [rsp + 0x1e60]
mov qword [rsp + 0x1e68], rax
mov rcx, qword [rsp + 0x1e68]
call fcn.14000f8f0
mov rcx, rax
call fcn.14011cf60
nop
lea rcx, [rsp + 0x1bb0]
call fcn.140001490
lea r8, [0x140248fb0]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1bc0]
call fcn.1400010b0
mov qword [rsp + 0x1e70], rax
mov rcx, qword [rsp + 0x1e70]
call fcn.14000f8f0
mov r9d, 0x2001f
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140005720
test eax, eax
jne 0x1401996cc
mov dword [rsp + 0x1e78], 1
jmp 0x1401996d7
mov dword [rsp + 0x1e78], 0
movzx eax, byte [rsp + 0x1e78]
mov byte [rsp + 0x1bb8], al
lea rcx, [rsp + 0x1bc0]
call fcn.140001490
movzx edx, byte [rsp + 0x1bb8]
test edx, edx
je 0x1401998bb
mov dword [rsp + 0x1134], 0x400
lea r9, [rsp + 0x1134]
lea r8, [rsp + 0x1140]
lea rdx, [0x140249020]
lea rcx, [rsp + 0x50]
call fcn.140005940
test eax, eax
jne 0x1401998b1
lea rax, [rsp + 0x1140]
mov qword [rsp + 0x1940], rax
lea rcx, [rsp + 0x1948]
call fcn.140077c20
nop
mov rax, qword [rsp + 0x1940]
movzx eax, word [rax]
test eax, eax
je 0x1401997b9
lea rdx, str.CCBootNIC
mov rcx, qword [rsp + 0x1940]
call fcn.1400aa794
test eax, eax
je 0x140199791
mov rdx, qword [rsp + 0x1940]
lea rcx, [rsp + 0x1948]
call fcn.14000e2e0
mov rcx, qword [rsp + 0x1940]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x1940]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x1940], rax
jmp 0x140199755
lea rax, [rsp + 0x1140]
mov qword [rsp + 0x1940], rax
mov dword [rsp + 0x1970], 0
jmp 0x1401997e7
mov eax, dword [rsp + 0x1970]
add eax, 1
mov dword [rsp + 0x1970], eax
movsxd rdi, dword [rsp + 0x1970]
lea rcx, [rsp + 0x1948]
call fcn.140012e60
cmp rdi, rax
jge 0x14019985a
movsxd rdx, dword [rsp + 0x1970]
lea rcx, [rsp + 0x1948]
call fcn.14001edf0
mov rcx, rax
call fcn.14000f8f0
mov rdx, rax
mov rcx, qword [rsp + 0x1940]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x1940]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x1940]
lea rax, [rax + rcx*2 + 2]
mov qword [rsp + 0x1940], rax
jmp 0x1401997d6
xor ecx, ecx
mov rax, qword [rsp + 0x1940]
mov word [rax], cx
lea r8, [rsp + 0x1140]
lea rdx, [0x140249040]
lea rcx, [rsp + 0x50]
call fcn.140005ba0
lea rcx, [rsp + 0x1140]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x1401998a4
lea rdx, str.UpperFilters
lea rcx, [rsp + 0x50]
call fcn.1400055b0
nop
lea rcx, [rsp + 0x1948]
call fcn.140077ee4
lea rcx, [rsp + 0x50]
call fcn.1400055f0
lea r8, str._SYSTEMCurrentControlSet
mov rdx, qword [rsp + 0x1eb0]
lea rcx, [rsp + 0x1bc8]
call fcn.1400010b0
mov qword [rsp + 0x1e80], rax
mov rax, qword [rsp + 0x1e80]
mov qword [rsp + 0x1e88], rax
mov rcx, qword [rsp + 0x1e88]
call fcn.14000f8f0
mov rcx, rax
call fcn.14011cf60
nop
lea rcx, [rsp + 0x1bc8]
call fcn.140001490
mov dword [rsp + 0x1bd0], 1
lea rcx, [rsp + 0x60]
call fcn.140001490
nop
lea rcx, [rsp + 0x50]
call fcn.140005590
nop
lea rcx, [rsp + 0x68]
call fcn.140001490
nop
mov rcx, qword [rsp + 0x1eb0]
call fcn.140001490
mov eax, dword [rsp + 0x1bd0]
mov rcx, qword [rsp + 0x1e90]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x1ea0
pop rdi
ret