Function at 0x160107670
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xdb8]
sub rsp, 0xe80
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0xd70], rax
mov r12, rdx
mov r13, rcx
xor esi, esi
mov r14d, esi
lea rdi, [rcx + 0xe40]
mov qword [rsp + 0x78], rdi
mov rcx, rdi
call fcn.1600455bc
nop
lea r8, [rsp + 0x30]
lea rdx, str.RegVersion
mov rcx, r13
call fcn.16005a9b0
test eax, eax
je 0x160107f12
mov eax, dword [rsp + 0x30]
shr eax, 0x10
mov ecx, 0x402
cmp ax, cx
jne 0x160107f12
mov ebx, 0xf003f
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xb70]
call fcn.16005a5e4
nop
mov r9d, ebx
lea r8, str.Filters
lea rdx, [rbp + 0xb70]
lea rcx, [rbp + 0xc60]
call fcn.1600c96d4
nop
lea rax, [rbp + 0x58]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], 0x21
mov word [rbp + 0x58], si
lea rax, fcn.16003df60
mov qword [rbp + 0x40], rax
mov ebx, esi
lea r15, [0x1601db300]
lea rdi, fcn.16003df60
lea r8, [rbp + 0x40]
mov edx, ebx
lea rcx, [rbp + 0xc60]
call fcn.1600c9b20
test eax, eax
je 0x160107878
mov r9d, 0x20019
mov r8, qword [rbp + 0x48]
lea rdx, [rbp + 0xc60]
lea rcx, [rbp + 0x140]
call fcn.1600c96d4
nop
lea rax, [rbp - 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0x21
mov word [rbp - 8], si
mov qword [rbp - 0x20], rdi
lea r8, [rbp - 0x20]
lea rdx, str.ThreadingModel
lea rcx, [rbp + 0x140]
call fcn.16005a7b0
lea rax, [rbp - 0x68]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], 0x21
mov word [rbp - 0x68], si
mov qword [rbp - 0x80], rdi
lea r8, [rbp - 0x80]
lea rdx, str.Extension
lea rcx, [rbp + 0x140]
call fcn.16005a7b0
lea rdx, str.Apartment
mov rcx, qword [rbp - 0x18]
call fcn.160062ae8
test eax, eax
jne 0x16010784d
mov eax, dword [rbp - 0x6c]
test eax, eax
je 0x16010784d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.1601080f4
mov r14d, eax
mov rcx, qword [rbp + 0xdb8]
test eax, eax
jns 0x16010784d
mov r9d, eax
mov r8, r15
mov edx, 0x414
call fcn.160071f6c
nop
lea rcx, [rbp - 0x80]
call fcn.16003dfc4
nop
lea rcx, [rbp - 0x20]
call fcn.16003dfc4
nop
lea rcx, [rbp + 0x140]
call fcn.16005ab2c
inc ebx
test r14d, r14d
jns 0x16010775f
lea rcx, [rbp + 0x40]
call fcn.16003dfc4
nop
lea rcx, [rbp + 0xc60]
call fcn.16005ab2c
nop
lea rcx, [rbp + 0xb70]
call fcn.16005ab2c
lea rdx, [r13 + 0x2f0]
lea rcx, [rbp + 0xa0]
call fcn.160040ae8
nop
lea rcx, [rbp + 0xa0]
call fcn.16005a594
mov rax, qword [rbp + 0xa0]
or ebx, 0xffffffff
mov r9d, ebx
mov r8d, dword [rbp + 0xb4]
lea rdx, [0x1601d5ea0]
lea rcx, [rbp + 0xa0]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rax, qword [rbp + 0xa0]
mov r9d, ebx
mov r8d, dword [rbp + 0xb4]
lea rdx, [0x160203888]
lea rcx, [rbp + 0xa0]
mov rax, qword [rax + 0x20]
call qword [case.0x16003fc5a.0]
mov rcx, qword [rbp + 0xa8]
call fcn.1600ca834
lea rsi, [r13 + 0xd0]
mov qword [rsp + 0x60], rsi
mov rcx, rsi
call fcn.1600454bc
nop
test r14d, r14d
lea rdi, [r13 + 0xe40]
js 0x160107efb
lea rbx, [r13 + 0xf90]
mov qword [rsp + 0x20], rbx
lea r9, [0x1601fb838]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1601f6788]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov r14d, eax
test eax, eax
jns 0x160107975
mov edx, 0x42a
jmp 0x1601079ce
mov r14, qword [rbx]
lea rbx, [r14 + 0x20]
mov qword [rsp + 0x58], rbx
mov rcx, rbx
call fcn.1600454bc
nop
mov rcx, r14
call fcn.16010b498
mov r14d, eax
mov rcx, rbx
call fcn.160045454
nop
test r14d, r14d
jns 0x1601079ad
mov r9d, r14d
mov edx, 0x42d
jmp 0x1601079d1
mov r9, r12
mov rdx, r13
mov rcx, qword [r13 + 0x170]
call fcn.16011bc84
mov r14d, eax
xor r12d, r12d
test eax, eax
jns 0x1601079e5
mov edx, 0x430
mov r9d, eax
mov rcx, qword [rbp + 0xdb8]
mov r8, r15
call fcn.1600b29f8
jmp 0x160107efb
mov edx, dword [r13 + 0xf24]
mov rcx, qword [r13 + 0xf38]
call fcn.16011810c
mov r14d, eax
mov rcx, qword [rbp + 0xdb8]
test eax, eax
jns 0x160107a13
mov r9d, eax
mov edx, 0x435
jmp 0x160107aa8
mov rcx, qword [r13 + 0xf88]
call fcn.160108050
mov r14d, eax
mov rcx, qword [rbp + 0xdb8]
test eax, eax
jns 0x160107a37
mov r9d, eax
mov edx, 0x43b
jmp 0x160107aa8
mov rax, qword [r13 + 0xf98]
mov rbx, qword [rax + 0x58]
cmp qword [rbx + 0x10], r12
jne 0x160107a91
mov dword [rbx + 0x28], r12d
lea rax, [rbx + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rbx
lea r8, [0x1600f8ef0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x160107a91
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
jle 0x160107a94
movzx r14d, ax
or r14d, 0x80070000
jmp 0x160107a94
mov r14d, r12d
mov rcx, qword [rbp + 0xdb8]
test r14d, r14d
jns 0x160107ab5
mov r9d, r14d
mov edx, 0x441
mov r8, r15
call fcn.160071f6c
jmp 0x160107e95
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rbp + 0xc60]
call sub.msvcrt.dll_memset
mov ebx, 0x44
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
lea r8, [rbp + 0xc60]
xor edx, edx
lea ecx, [rbx - 0x2e]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
jne 0x160107b1c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
jle 0x160107b05
movzx r14d, ax
or r14d, 0x80070000
mov rcx, qword [rbp + 0xdb8]
mov r9d, r14d
mov r8, r15
mov edx, 0x44f
call fcn.1600c1418
mov dword [rsp + 0x30], ebx
test r14d, r14d
js 0x160107b6f
lea r9, [rsp + 0x30]
lea r8, [rbp + 0xca4]
xor edx, edx
lea ecx, [rdx + 0x1a]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
jne 0x160107b6f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
jle 0x160107b58
movzx r14d, ax
or r14d, 0x80070000
mov rcx, qword [rbp + 0xdb8]
mov r9d, r14d
mov r8, r15
mov edx, 0x458
call fcn.1600c1418
mov dword [rsp + 0x30], ebx
test r14d, r14d
js 0x160107bc2
lea r9, [rsp + 0x30]
lea r8, [rbp + 0xce8]
xor edx, edx
lea ecx, [rdx + 0x1d]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
jne 0x160107bc2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
jle 0x160107bab
movzx r14d, ax
or r14d, 0x80070000
mov rcx, qword [rbp + 0xdb8]
mov r9d, r14d
mov r8, r15
mov edx, 0x461
call fcn.1600c1418
mov dword [rsp + 0x30], ebx
test r14d, r14d
js 0x160107c15
lea r9, [rsp + 0x30]
lea r8, [rbp + 0xd2c]
xor edx, edx
lea ecx, [rdx + 0x1b]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CreateWellKnownSid]
test eax, eax
jne 0x160107c15
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
jle 0x160107bfe
movzx r14d, ax
or r14d, 0x80070000
mov rcx, qword [rbp + 0xdb8]
mov r9d, r14d
mov r8, r15
mov edx, 0x46a
call fcn.1600c1418
mov qword [rsp + 0x50], r12
test r14d, r14d
js 0x160107d5e
xor edx, edx
mov r8d, 0xc0
lea rcx, [rbp + 0xb70]
call sub.msvcrt.dll_memset
mov esi, 3
mov dword [rsp + 0x20], esi
xor edx, edx
lea r9d, [rsi - 2]
mov r8d, 0x1f0001
lea rcx, [rbp + 0xb70]
call qword [sym.imp.api_ms_win_security_trustee_l1_1_1.dll_BuildExplicitAccessWithNameW]
mov dword [rbp + 0xb8c], r12d
lea rax, [rbp + 0xc60]
mov qword [rbp + 0xb98], rax
lea rbx, [rbp + 0xbc8]
lea r12, [rbp + 0xca4]
lea rdi, [rbp + 0xba0]
mov dword [rsp + 0x20], 3
xor edx, edx
lea r9d, [rdx + 1]
mov r8d, 0x100001
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_trustee_l1_1_1.dll_BuildExplicitAccessWithNameW]
and dword [rbx - 0xc], 0
mov qword [rbx], r12
add rdi, 0x30
add r12, 0x44
lea rbx, [rbx + 0x30]
sub rsi, 1
jne 0x160107c83
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov byte [rsp + 0x48], 1
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rbp + 0xb70]
lea ecx, [rsi + 4]
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetEntriesInAclW]
mov ebx, eax
cmp byte [rsp + 0x48], r12b
lea rdi, [r13 + 0xe40]
lea rsi, [r13 + 0xd0]
je 0x160107d2c
mov r12, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rcx, qword [rax]
cmp r12, rcx
je 0x160107d29
test rcx, rcx
je 0x160107d26
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rax, qword [rsp + 0x58]
mov qword [rax], r12
xor r12d, r12d
test ebx, ebx
je 0x160107d42
jg 0x160107d37
mov r14d, ebx
jmp 0x160107d42
movzx r14d, bx
or r14d, 0x80070000
mov rcx, qword [rbp + 0xdb8]
test r14d, r14d
jns 0x160107d5e
mov r9d, r14d
mov r8, r15
mov edx, 0x482
call fcn.160071f6c
xor edx, edx
lea r8d, [rdx + 0x28]
lea rcx, [rbp + 0xc30]
call sub.msvcrt.dll_memset
test r14d, r14d
js 0x160107e85
mov edx, 1
lea rcx, [rbp + 0xc30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x160107dc5
xor r9d, r9d
mov r8, qword [rsp + 0x50]
lea edx, [r9 + 1]
lea rcx, [rbp + 0xc30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x160107dc5
mov edx, 0x1000
mov r8d, edx
lea rcx, [rbp + 0xc30]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorControl]
test eax, eax
jne 0x160107df4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
jle 0x160107ddd
movzx r14d, ax
or r14d, 0x80070000
mov rcx, qword [rbp + 0xdb8]
mov r9d, r14d
mov r8, r15
mov edx, 0x48d
call fcn.1600c1418
test r14d, r14d
js 0x160107e85
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], SafeArrayPutElement
mov dword [rsp + 0x48], r12d
lea rax, [rbp + 0xc30]
mov qword [rsp + 0x40], rax
lea rbx, [r13 + 0x1030]
lea r8, str.LocalWindowsSearchService_EfsRegKeysMutex
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rdx, rax
mov rcx, rbx
call fcn.1600161cc
mov rax, qword [rbx]
inc rax
test rax, 0xfffffffffffffffe
jne 0x160107e85
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r14d, eax
test eax, eax
jle 0x160107e6e
movzx r14d, ax
or r14d, 0x80070000
mov rcx, qword [rbp + 0xdb8]
mov r9d, r14d
mov r8, r15
mov edx, 0x49b
call fcn.1600c1418
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x160107e95
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [r13 + 0x1018]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
test r14d, r14d
jns 0x160107eed
mov rdx, qword [r13 + 0x180]
lea rcx, [rbp + 0x200]
call fcn.1600c0044
nop
mov edx, r14d
lea rcx, [rbp + 0x200]
call fcn.1600cd1d8
xor r8d, r8d
mov edx, 0xc0000bd6
lea rcx, [rbp + 0x200]
call fcn.1600c1b70
nop
lea rcx, [rbp + 0x200]
call fcn.1600c0898
jmp 0x160107ef5
mov rcx, r13
call fcn.160100660
call fcn.160101704
nop
mov rcx, rsi
call fcn.160045454
nop
lea rcx, [rbp + 0xa0]
call fcn.160040b2c
jmp 0x160107f88
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rbp + 0xc30]
mov ecx, 0x4020000
call qword [sym.imp.msvcrt.dll__ultow]
mov rdx, qword [r13 + 0x180]
lea rcx, [rbp + 0x200]
call fcn.1600c0044
nop
xor r9d, r9d
lea r8, [rbp + 0xc30]
mov edx, 0xc0000bda
lea rcx, [rbp + 0x200]
call fcn.1600c1b70
mov rcx, qword [rbp + 0xdb8]
mov r14d, 0x8007064d
mov r9d, r14d
lea r8, [0x1601db300]
mov edx, 0x3f7
call fcn.1600c1418
nop
lea rcx, [rbp + 0x200]
call fcn.1600c0898
nop
mov rcx, rdi
call fcn.16004554c
nop
mov eax, r14d
mov rcx, qword [rbp + 0xd70]
xor rcx, rsp
call fcn.16006e590
mov rbx, qword [rsp + 0xed0]
add rsp, 0xe80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret