Function at 0x14000a700
Capabilities:
Acquire debug privileges
Check if file exists
Check os version
Copy file
Create process on windows
Delete file
Delete registry key
Get file attributes
Get session user name
Get system information on windows
Identify system language via api
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x6508]
mov eax, 0x6608
call fcn.14003f630
sub rsp, rax
lea rcx, [rbp + 0x3d0]
mov r13, r8
call fcn.1400370d0
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov r9, qword [0x140086d28]
mov r8d, 0x409
movzx r10d, ax
mov ecx, dword [r9 + 0x1024]
lea edi, [r8 - 0xa]
test ecx, ecx
je 0x14000a77f
mov edx, r8d
and r10w, di
nop word [rax + rax]
and cx, di
cmp cx, r10w
je 0x14000a804
mov eax, dword [r9 + rdx*4 + 4]
inc rdx
inc r8d
movzx ecx, ax
test eax, eax
jne 0x14000a760
call fcn.140015b90
mov ebx, eax
test eax, eax
je 0x14000a795
mov dword [0x140086d30], eax
call fcn.140015e30
mov dword [0x14007fcb0], ebx
call fcn.140005260
lea rcx, [0x140085aa0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbp + 0xfa0]
mov dword [rbp + 0xfa0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0xfa4], 5
jae 0x14000a80d
mov r9d, InitCommonControls
lea r8, [0x14006d5e8]
lea rdx, str.Process_Lasso_is_not_compatible_with_this_version_of_Windows.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
xor eax, eax
add rsp, 0x6608
pop r13
pop rdi
pop rbx
pop rbp
ret
movsxd rax, r8d
mov ebx, dword [r9 + rax*4]
jmp 0x14000a795
mov qword [rsp + 0x6630], rsi
lea r8, str.ProcessLasso
mov qword [rsp + 0x6638], r12
lea rcx, [0x14008060c]
mov qword [rsp + 0x6640], r14
mov edx, 0x104
mov r14, 0xffffffffffffffff
mov r9, r14
call fcn.14004badc
lea rax, str.installhelper.exe
mov dword [0x14007ffd4], 6
mov qword [0x140080818], rax
lea rbx, [rbp + 0x290]
mov rax, qword [0x1400862e0]
lea esi, [r14 + 2]
mov qword [rbp - 0x78], rax
xor r12d, r12d
mov qword [0x14007ffd8], rax
lea rax, str.SeAssignPrimaryTokenPrivilege
mov qword [rbp + 0x290], rax
lea rax, str.SeDebugPrivilege
mov qword [rbp + 0x298], rax
lea rax, str.SeChangeNotifyPrivilege
mov qword [rbp + 0x2a0], rax
lea rax, str.SeIncreaseBasePriorityPrivilege
mov qword [rbp + 0x2a8], rax
lea rax, str.SeIncreaseQuotaPrivilege
mov qword [rbp + 0x2b0], rax
lea rax, str.SeProfileSingleProcessPrivilege
mov qword [rbp + 0x2b8], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x120]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000a937
mov rdx, qword [rbx]
lea r8, [rbp + 0x13c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp + 0x120]
lea r8, [rbp + 0x138]
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor edx, edx
mov dword [rbp + 0x138], esi
mov dword [rbp + 0x144], 2
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
add rbx, 8
lea rax, [rbp + 0x2c0]
cmp rbx, rax
jne 0x14000a8d3
call fcn.140016d40
call fcn.1400146c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, edi
lea rdx, [rbp + 0x1af0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000a9b5
lea rcx, [rbp + 0x1af0]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14000a980
dec eax
movsxd rcx, eax
test eax, eax
jle 0x14000a9b5
cmp word [rbp + rcx*2 + 0x1af0], 0x5c
je 0x14000a9aa
dec eax
dec rcx
test rcx, rcx
jg 0x14000a993
jmp 0x14000a9b5
cdqe
mov word [rbp + rax*2 + 0x1af0], r12w
mov r9, r14
lea r8, [0x14006dba4]
mov edx, 0x400
lea rcx, [rbp + 0x1af0]
call fcn.14004cedc
mov r9, r14
lea r8, [rbp + 0x1af0]
mov edx, 0x800
lea rcx, [rbp + 0x5500]
call fcn.14004badc
mov r9, r14
lea r8, str.processgovernor.exe
mov edx, 0x800
lea rcx, [rbp + 0x5500]
call fcn.14004cedc
mov r9, r14
lea r8, [rbp + 0x1af0]
mov edx, 0x800
lea rcx, [rbp + 0x4500]
call fcn.14004badc
mov r9, r14
lea r8, str.ProcessLasso.exe
mov edx, 0x800
lea rcx, [rbp + 0x4500]
call fcn.14004cedc
mov r9, r14
lea r8, str.__tray
mov edx, 0x800
lea rcx, [rbp + 0x4500]
call fcn.14004cedc
lea rax, [rbp + 0x80]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000aad4
mov rcx, qword [rbp + 0x80]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x54]
lea rax, [0x14007fcb8]
mov dword [rbp + 0x50], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.GUIStart
mov dword [rbp + 0x54], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x80]
test eax, eax
je 0x14000abff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [reloc.OLEAUT32.dll_SysReAllocString], 2
lea rax, [rbp + 0x88]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ab5b
mov rcx, qword [rbp + 0x88]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x5c]
lea rax, [0x14007fcb4]
mov dword [rbp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CoreStart
mov dword [rbp + 0x5c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x88]
test eax, eax
je 0x14000ac0a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x14007fcb4], 4
mov qword [rsp + 0x6600], r15
call fcn.140001a70
test rax, rax
je 0x14000e9df
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
xor edx, edx
xor ecx, ecx
mov r15, rax
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], r12d
xor r8d, r8d
mov qword [rsp + 0x30], r12
mov edx, r14d
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], 6
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
call fcn.140001a70
test rax, rax
je 0x14000e9df
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
test r13, r13
je 0x14000ac2d
cmp r13, 0x10000
jae 0x14000ac15
movzx edx, r13w
lea rcx, [rsp + 0x58]
call fcn.140002950
jmp 0x14000ac3d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000aade
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000ab65
mov r8, r14
nop dword [rax + rax]
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000ac20
jmp 0x14000ac30
mov r8d, r12d
mov rdx, r13
lea rcx, [rsp + 0x58]
call fcn.140002da0
mov rbx, qword [rsp + 0x58]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x14000e9bc
mov eax, dword [rbx - 0xc]
mov ecx, esi
sub ecx, dword [rbx - 8]
sub eax, edi
or ecx, eax
jge 0x14000ac6d
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140002b00
mov rbx, qword [rsp + 0x58]
lea eax, [rdi + 1]
mov rcx, rbx
movsxd rdx, eax
call fcn.14004b7b4
cmp edi, dword [rbx - 0xc]
jg 0x14000e9bc
lea rsi, [rbx - 0x10]
mov dword [rsi], edi
mov word [rbx + rdi*2], r12w
mov qword [rsp + 0x78], rsi
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._isserveros
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000ad36
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000ad36
call fcn.140006b40
movzx edi, al
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ace2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, 1
jg 0x14000acfb
mov rcx, qword [r15]
mov rdx, r15
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
mov eax, edi
mov r15, qword [rsp + 0x6600]
mov r12, qword [rsp + 0x6638]
mov rsi, qword [rsp + 0x6630]
mov r14, qword [rsp + 0x6640]
add rsp, 0x6608
pop r13
pop rdi
pop rbx
pop rbp
ret
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._migrate
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000ad71
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000ad71
call fcn.140016d40
call fcn.140027370
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._lodctr
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000ada7
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000ada7
call fcn.140014ae0
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, [0x14006e728]
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000add6
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000add6
mov byte [0x140085a9d], 1
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._auto
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000ae05
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000ae05
mov byte [0x140085a9b], 1
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._default
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000ae60
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000ae60
lea r8, [rbp - 0x78]
xor edx, edx
lea rcx, [0x140086e00]
call fcn.1400207a0
lea rcx, [0x140086e00]
call fcn.140018780
lea rcx, [0x140086e00]
call fcn.140019400
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._oocdefault
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000aebc
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000aebc
lea r8, [rsp + 0x78]
xor edx, edx
lea rcx, [0x140086e00]
call fcn.1400207a0
lea rcx, [0x140086e00]
call fcn.14002a170
lea rcx, [0x140086e00]
call fcn.140019400
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._uninstall
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000b255
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000b255
call fcn.14002b1d0
lea rdx, str.Process_Lasso_Update_Check
call fcn.1400365e0
lea rdx, str.Check_for_Process_Lasso_updates
call fcn.1400365e0
lea rdx, str.ProcessLassoRestart
call fcn.1400365e0
call fcn.1400020a0
cmp byte [0x140085acc], r12b
jne 0x14000af41
xor edx, edx
call fcn.140011dd0
mov edx, 2
mov byte [0x140085acb], al
call fcn.140011dd0
mov byte [0x140085acc], 1
cmp byte [0x140085acb], r12b
je 0x14000af56
lea rcx, [rbp + 0x3d0]
call fcn.140039140
call fcn.14002f090
call fcn.14002f090
lea rdx, str.Process_Lasso_Management_Console__GUI_
call fcn.1400365e0
lea rdx, str.Process_Lasso_Core_Engine_Only
call fcn.1400365e0
lea rdx, str.Session_agent_for_Process_Lasso
call fcn.1400365e0
lea rdx, str.SOFTWAREProcessLasso
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor r9d, r9d
lea r8, str.ParkControl
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x1d0]
call fcn.14000ef70
xor r9d, r9d
mov dword [rsp + 0x70], r12d
lea r8, [rsp + 0x70]
lea rdx, str.Installed
lea rcx, [rbp + 0x1d0]
call fcn.14000fb80
test al, al
jne 0x14000b015
lea rdx, str.SOFTWAREParkControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREParkControl
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor r9d, r9d
lea r8, str.CPUBalance
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x170]
call fcn.14000ef70
xor r9d, r9d
mov dword [rsp + 0x70], r12d
lea r8, [rsp + 0x70]
lea rdx, str.Installed
lea rcx, [rbp + 0x170]
call fcn.14000fb80
test al, al
jne 0x14000b07e
lea rdx, str.SOFTWARECPUBalance
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWARECPUBalance
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, str.SOFTWAREBitsum
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov r8, qword [rbp + 0x1b8]
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x1b8]
mov r8, qword [r8 + 8]
call fcn.140004470
mov rcx, qword [rbp + 0x1b8]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x1a8]
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x1a8]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x1a8]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x198]
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x198]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x198]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x188]
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x188]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x188]
mov edx, 0x30
call fcn.14003eed0
mov rdx, qword [rbp + 0x180]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b16f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rbp + 0x218]
lea rdx, [rbp + 0x218]
lea rcx, [rbp + 0x218]
mov r8, qword [r8 + 8]
call fcn.140004470
mov rcx, qword [rbp + 0x218]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x208]
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x208]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x208]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x1f8]
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x1f8]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x1f8]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x1e8]
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x1e8]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x1e8]
mov edx, 0x30
call fcn.14003eed0
mov rdx, qword [rbp + 0x1e0]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e83e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000e83e
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._uninstall_full
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000b376
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000b376
xor r9d, r9d
lea rdx, str.SOFTWAREProcessLassoLanguage
mov r8d, 0x200
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor r9d, r9d
lea rdx, str.SOFTWAREProcessLassoLanguage
mov r8d, 0x100
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor r9d, r9d
lea rdx, str.SOFTWAREProcessLasso
mov r8d, 0x200
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor r9d, r9d
lea rdx, str.SOFTWAREProcessLasso
mov r8d, 0x100
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor r9d, r9d
lea rdx, str.SOFTWAREProcessLassoLanguage
mov r8d, 0x200
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor r9d, r9d
lea rdx, str.SOFTWAREProcessLassoLanguage
mov r8d, 0x100
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor r9d, r9d
lea rdx, str.SOFTWAREProcessLasso
mov r8d, 0x200
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
xor r9d, r9d
lea rdx, str.SOFTWAREProcessLasso
mov r8d, 0x100
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._terminate
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000b8e2
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000b8e2
call fcn.140001a70
test rax, rax
je 0x14000e9f5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdi, str.Globalca662ded_1ba8_4260_8753_2810540ed6dd
mov r8, r14
add rax, 0x18
mov qword [rbp - 0x80], rax
nop
inc r8
cmp word [rdi + r8*2], r12w
jne 0x14000b3d0
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.140002da0
mov rbx, qword [rbp - 0x80]
cmp dword [rbx - 0x10], r12d
jl 0x14000b40e
lea rdx, str.Global_
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000b40e
sub rax, rbx
sar rax, 1
test eax, eax
je 0x14000b425
mov r8, rdi
lea rdx, str.Global_s
lea rcx, [rbp - 0x80]
call fcn.140002f70
mov rbx, qword [rbp - 0x80]
mov rcx, qword [0x14008a820]
test rcx, rcx
je 0x14000b43e
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, 1
jmp 0x14000b4b1
mov esi, 1
lea rcx, [rbp + 0x4c0]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea rcx, [rbp + 0x4c0]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea rax, [rbp + 0x4c0]
mov qword [rbp + 0x148], 0x18
mov r9, rbx
mov qword [rbp + 0x150], rax
mov r8d, esi
mov qword [rbp + 0x158], r12
mov edx, esi
lea rcx, [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14008a820], rax
test rax, rax
je 0x14000b4b1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.140006bc0
call fcn.14002ef30
lea r9, str.LocalProsuperExit
mov byte [0x140085a9c], 1
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x14000b4f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LassoLogViewerExit
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x14000b51e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LassoInsightsExit
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x14000b54c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.GlobalProcessGovernorExitEvent
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x14000b57a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LocalProcessGovernorExitEvent
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x14000b5a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LocalPLRESEXIT
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x14000b5d6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.Globalfb214151_3d6a_4307_9392_e7b89696e558
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LocalProsuperExit
xor r8d, r8d
mov edx, esi
xor ecx, ecx
mov edi, r12d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
je 0x14000b678
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000b666
cmp edi, 5
jg 0x14000b666
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, str.LocalProsuperExit
xor r8d, r8d
mov edx, esi
xor ecx, ecx
inc edi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
jne 0x14000b620
jmp 0x14000b678
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x12d0]
mov r8d, 0x820
call fcn.14005fd20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x40e
lea rdx, [rbp + 0x12d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000b6f5
lea rcx, [rbp + 0x12d0]
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14000b6c0
dec eax
movsxd rcx, eax
test eax, eax
jle 0x14000b6f5
cmp word [rbp + rcx*2 + 0x12d0], 0x5c
je 0x14000b6ea
dec eax
dec rcx
test rcx, rcx
jg 0x14000b6d3
jmp 0x14000b6f5
cdqe
mov word [rbp + rax*2 + 0x12d0], r12w
call fcn.140001a70
test rax, rax
je 0x14000e9f5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rax, [rbp + 0x12d0]
cmp rax, 0x10000
lea rax, [rbp + 0x12d0]
jae 0x14000b73a
movzx edx, ax
lea rcx, [rsp + 0x70]
call fcn.140002950
jmp 0x14000b75b
mov r8, r14
nop dword [rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x14000b740
lea rdx, [rbp + 0x12d0]
lea rcx, [rsp + 0x70]
call fcn.140002da0
mov rax, qword [rsp + 0x70]
mov ebx, dword [rax - 0x10]
test ebx, ebx
je 0x14000b785
lea ecx, [rbx - 1]
test ecx, ecx
js 0x14000e9ea
cmp ecx, ebx
jg 0x14000e9ea
movsxd rcx, ebx
cmp word [rax + rcx*2 - 2], 0x5c
je 0x14000b7c7
lea edi, [rbx + 1]
test edi, edi
js 0x14000e9ea
mov ecx, dword [rax - 0xc]
sub esi, dword [rax - 8]
sub ecx, edi
or esi, ecx
jge 0x14000b7ad
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.140002b00
mov rax, qword [rsp + 0x70]
mov word [rax + rbx*2], 0x5c
cmp edi, dword [rax - 0xc]
jg 0x14000e9ea
movsxd rcx, edi
mov dword [rax - 0x10], edi
mov word [rax + rcx*2], r12w
lea rsi, str.processlasso.exe
mov r8, r14
inc r8
cmp word [rsi + r8*2], r12w
jne 0x14000b7d1
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140002b60
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b85d
mov edi, r12d
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b85d
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r14
jne 0x14000b854
cmp edi, 0x1388
jae 0x14000b85d
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 0xfa
jmp 0x14000b800
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x3e8
mov rcx, rsi
call fcn.1400302c0
mov edx, 0x1f4
lea rcx, str.processgovernor.exe
call fcn.1400302c0
mov edx, 0x1f4
lea rcx, str.bitsumsessionagent.exe
call fcn.1400302c0
mov edx, 0x1f4
lea rcx, str.threadracer.exe
call fcn.1400302c0
mov edx, 0x1f4
lea rcx, str.cpueater.exe
call fcn.1400302c0
mov edx, 0x1f4
lea rcx, str.testlasso.exe
call fcn.1400302c0
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000b8d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x80]
jmp 0x14000b232
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._remove
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000badc
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000badc
mov esi, 1
mov byte [0x140085a9c], 1
mov edx, esi
lea r9, str.LocalProsuperExit
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
je 0x14000b94c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LassoLogViewerExit
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
je 0x14000b97a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LassoInsightsExit
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
je 0x14000b9a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.GlobalProcessGovernorExitEvent
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
je 0x14000b9d6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LocalPLRESEXIT
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
je 0x14000ba04
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.LocalProsuperExit
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
je 0x14000ba7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000ba68
cmp r12d, 5
jg 0x14000ba68
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, str.LocalProsuperExit
xor r8d, r8d
mov edx, esi
xor ecx, ecx
inc r12d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
jne 0x14000ba20
jmp 0x14000ba7a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14002fc90
test al, al
je 0x14000ba88
call fcn.14002f090
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
lea rcx, str.processlasso.ex
call fcn.1400302c0
mov edx, 0x1f4
lea rcx, str.processgovernor.exe
call fcn.1400302c0
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, esi
jg 0x14000bace
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, esi
jmp 0x14000e867
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._install
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000bd3b
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000bd3b
call fcn.14002e3f0
lea rdx, str.Check_for_Process_Lasso_updates
call fcn.1400365e0
call fcn.14002fe60
call fcn.140001a70
test rax, rax
je 0x14000ea00
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rbx, str.InstalledSessionAgent
mov qword [rbp + 0x40], rax
cmp rbx, 0x10000
jae 0x14000bb5f
movzx edx, bx
lea rcx, [rbp + 0x40]
call fcn.140002950
jmp 0x14000bb78
mov r8, r14
inc r8
cmp word [rbx + r8*2], r12w
jne 0x14000bb62
mov rdx, rbx
lea rcx, [rbp + 0x40]
call fcn.140002da0
lea rdx, [rbp + 0x40]
lea rcx, [0x140086d58]
call fcn.140010c20
mov rdx, qword [rbp + 0x40]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000bba6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 1
lea rcx, [0x140086d40]
mov rdx, rbx
call fcn.1400106d0
mov r9d, 0x200
lea r8, str.ProcessLasso
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x230]
call fcn.14000ef70
call fcn.140001a70
test rax, rax
je 0x14000ea00
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea r8, [rbp + 0x108]
lea rdx, str.Install_Dir
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x230]
call fcn.14000fe70
mov rbx, qword [rbp + 0x108]
test al, al
je 0x14000bc54
cmp dword [rbx - 0x10], r12d
je 0x14000bc54
mov r8, rbx
lea rdx, str.Install_Dir
lea rcx, [0x140086d40]
call fcn.140010430
mov r8, rbx
lea rdx, str.Install_Dir
lea rcx, [0x140086da0]
call fcn.140010430
call fcn.140010380
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000bc73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rbp + 0x278]
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x278]
mov r8, qword [r8 + 8]
call fcn.140004470
mov rcx, qword [rbp + 0x278]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x268]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x268]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x268]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x258]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x258]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x258]
mov edx, 0x30
call fcn.14003eed0
mov r8, qword [rbp + 0x248]
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x248]
mov r8, qword [r8 + 8]
call fcn.140004e60
mov rcx, qword [rbp + 0x248]
mov edx, 0x30
call fcn.14003eed0
mov rdx, qword [rbp + 0x240]
jmp 0x14000b232
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._env_path_install
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000be37
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000be37
lea rdi, str.AddedToSystemPath
mov rdx, rdi
lea rcx, [0x140086d40]
call fcn.14000f600
cmp byte [rax], r12b
jne 0x14000beda
call fcn.140001ce0
call fcn.140001a70
test rax, rax
je 0x14000e9df
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x48], rax
cmp rdi, 0x10000
jae 0x14000bdc5
movzx edx, di
lea rcx, [rbp + 0x48]
call fcn.140002950
jmp 0x14000bde6
mov r8, r14
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], r12w
jne 0x14000bdd0
mov rdx, rdi
lea rcx, [rbp + 0x48]
call fcn.140002da0
lea rdx, [rbp + 0x48]
lea rcx, [0x140086d58]
call fcn.140010c20
mov rdx, qword [rbp + 0x48]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000be14
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, 1
lea rcx, [0x140086d40]
mov rdx, rdi
call fcn.1400106d0
mov rbx, qword [rsp + 0x58]
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._firstinstall
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000be72
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000be72
call fcn.140007120
call fcn.140007660
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._initconfig
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000bea8
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000bea8
call fcn.140007610
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._stopgovernorservice
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000bee3
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000bee3
call fcn.14002fc90
test al, al
je 0x14000beda
call fcn.14002ef30
lea rdx, [rbx - 0x18]
jmp 0x14000e847
cmp dword [rsi], r12d
jl 0x14000bf23
lea rdx, str._startgovernorservice
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000bf23
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000bf23
call fcn.14002fc90
test al, al
je 0x14000beda
call fcn.14002ee60
call fcn.14002e7c0
lea rdx, [rbx - 0x18]
jmp 0x14000e847
lea rcx, [rbp + 0x2c0]
call fcn.1400370d0
cmp dword [rsi], r12d
jl 0x14000c089
lea rdx, str._powerinstall
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000bfbe
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000bfbe
cmp byte [0x140085acc], r12b
jne 0x14000bf7e
xor edx, edx
call fcn.140011dd0
mov edx, 2
mov byte [0x140085acb], al
call fcn.140011dd0
mov byte [0x140085acc], 1
cmp byte [0x140085acb], r12b
lea rcx, [rbp + 0x2c0]
jne 0x14000bf9c
call fcn.140037580
lea rdx, [rbx - 0x18]
jmp 0x14000e2db
call fcn.140039810
lea rcx, [rbp + 0x2c0]
test al, al
jne 0x14000c07b
call fcn.140037580
lea rdx, [rbx - 0x18]
jmp 0x14000e2db
cmp dword [rsi], r12d
jl 0x14000c089
lea rdx, str._poweruninstall
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000c089
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000c089
movzx ecx, byte [0x140085acc]
test cl, cl
jne 0x14000c018
xor edx, edx
call fcn.140011dd0
mov edx, 2
mov byte [0x140085acb], al
call fcn.140011dd0
mov cl, 1
mov byte [0x140085acc], cl
movzx eax, byte [0x140085acb]
movzx edx, al
test al, al
jne 0x14000c03b
lea rcx, [rbp + 0x2c0]
call fcn.140037580
lea rdx, [rbx - 0x18]
jmp 0x14000e2db
test cl, cl
jne 0x14000c064
xor edx, edx
call fcn.140011dd0
mov edx, 2
mov byte [0x140085acb], al
call fcn.140011dd0
movzx eax, byte [0x140085acb]
mov byte [0x140085acc], 1
test al, al
je 0x14000c074
lea rcx, [rbp + 0x2c0]
call fcn.140039140
lea rcx, [rbp + 0x2c0]
call fcn.140037580
lea rdx, [rbx - 0x18]
jmp 0x14000e847
call fcn.140001a70
test rax, rax
je 0x14000ead1
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
cmp dword [rsi], r12d
jl 0x14000c61b
lea rdx, str._username
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000c1bc
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000c1bc
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea0b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
test r13, r13
je 0x14000c12d
cmp r13, 0x10000
jae 0x14000c115
movzx edx, r13w
lea rcx, [rbp - 0x80]
call fcn.140002950
jmp 0x14000c13c
mov r8, r14
nop dword [rax + rax]
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000c120
jmp 0x14000c130
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp - 0x80]
call fcn.140002da0
lea r8, [rsp + 0x50]
lea rdx, str._username
lea rcx, [rbp - 0x80]
call fcn.14000a2f0
mov rdx, qword [rsp + 0x50]
mov rdi, qword [0x140086c28]
add rdi, 0xffffffffffffffe8
lea rcx, [rdx - 0x18]
cmp rcx, rdi
je 0x14000c1bc
cmp dword [rdi + 0x10], r12d
jl 0x14000c1ac
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000c1ac
call fcn.140004a00
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14000c19a
mov rcx, qword [rdi]
mov rdx, rdi
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov rbx, qword [rsp + 0x58]
mov qword [0x140086c28], rax
jmp 0x14000c1bc
mov r8d, dword [rdx - 0x10]
lea rcx, [0x140086c28]
call fcn.140002da0
cmp dword [rsi], r12d
jl 0x14000c61b
lea rdx, str._password
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000c2d3
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000c2d3
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea16
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x90], rax
test r13, r13
je 0x14000c23e
cmp r13, 0x10000
jae 0x14000c22e
movzx edx, r13w
lea rcx, [rbp + 0x90]
call fcn.140002950
jmp 0x14000c250
mov r8, r14
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000c231
jmp 0x14000c241
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp + 0x90]
call fcn.140002da0
lea r8, [rsp + 0x50]
lea rdx, str._password
lea rcx, [rbp + 0x90]
call fcn.14000a2f0
mov rdx, qword [rsp + 0x50]
mov rdi, qword [0x140086d98]
add rdi, 0xffffffffffffffe8
lea rcx, [rdx - 0x18]
cmp rcx, rdi
je 0x14000c2d3
cmp dword [rdi + 0x10], r12d
jl 0x14000c2c3
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000c2c3
call fcn.140004a00
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14000c2b1
mov rcx, qword [rdi]
mov rdx, rdi
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov rbx, qword [rsp + 0x58]
mov qword [0x140086d98], rax
jmp 0x14000c2d3
mov r8d, dword [rdx - 0x10]
lea rcx, [0x140086d98]
call fcn.140002da0
cmp dword [rsi], r12d
jl 0x14000c61b
lea rdx, str._keyfile
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000c47c
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000c47c
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea21
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x98], rax
test r13, r13
je 0x14000c35d
cmp r13, 0x10000
jae 0x14000c345
movzx edx, r13w
lea rcx, [rbp + 0x98]
call fcn.140002950
jmp 0x14000c36f
mov r8, r14
nop dword [rax + rax]
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000c350
jmp 0x14000c360
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp + 0x98]
call fcn.140002da0
lea r8, [rsp + 0x50]
lea rdx, str._keyfile
lea rcx, [rbp + 0x98]
call fcn.14000a2f0
test al, al
je 0x14000c61b
lea rcx, [rsp + 0x50]
call fcn.140005e70
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 0x10], r12d
je 0x14000c61b
xor edx, edx
lea rcx, [rbp + 0x22f0]
mov r8d, 0x800
call fcn.14005fd20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x3ff
lea rdx, [rbp + 0x22f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000c425
lea rcx, [rbp + 0x22f0]
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14000c3f0
dec eax
movsxd rcx, eax
test eax, eax
jle 0x14000c425
cmp word [rbp + rcx*2 + 0x22f0], 0x5c
je 0x14000c41a
dec eax
dec rcx
test rcx, rcx
jg 0x14000c403
jmp 0x14000c425
cdqe
mov word [rbp + rax*2 + 0x22f0], r12w
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea2c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea r8, [rbp + 0x22f0]
lea rdx, str._sprolasso.key
mov qword [rbp + 0x110], rax
lea rcx, [rbp + 0x110]
call fcn.140002f70
mov rbx, qword [rbp + 0x110]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x14000c5fc
cmp dword [rsi], r12d
jl 0x14000c61b
lea rdx, str._key
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000c61b
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000c61b
call fcn.140001a70
test rax, rax
je 0x14000ead1
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x38], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea37
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xa0], rax
test r13, r13
je 0x14000c51d
cmp r13, 0x10000
jae 0x14000c50d
movzx edx, r13w
lea rcx, [rbp + 0xa0]
call fcn.140002950
jmp 0x14000c52f
mov r8, r14
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000c510
jmp 0x14000c520
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp + 0xa0]
call fcn.140002da0
lea r8, [rbp + 0x38]
lea rdx, str._key
lea rcx, [rbp + 0xa0]
call fcn.14000a2f0
test al, al
je 0x14000c5f8
lea rcx, [rbp + 0x38]
call fcn.140005e70
mov rbx, qword [rbp + 0x38]
cmp dword [rbx - 0x10], r12d
je 0x14000c5fc
lea rax, [rbp + 0x118]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareProcessLasso
lea rax, [rbp + 0xa8]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000c5fc
mov rax, r14
cmp word [rbx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x14000c5b0
mov rcx, qword [rbp + 0xa8]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.PendingActivationCode
mov r9d, 1
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c5fc
mov rbx, qword [rbp + 0x38]
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000c616
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x101
lea rcx, [rbp + 0x2af0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [rsi], r12d
jl 0x14000ca25
lea rdx, str._gui_start_type
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000c7e7
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000c7e7
lea rcx, [rbx - 0x18]
call fcn.140004a00
add rax, 0x18
lea r8, [rsp + 0x50]
lea rdx, str._gui_start_type
mov qword [rbp + 0x128], rax
lea rcx, [rbp + 0x128]
call fcn.14000a2f0
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 0x10], r12d
jl 0x14000c6ea
lea rdx, [0x14006ec90]
mov rcx, rdi
call fcn.1400407c8
test rax, rax
je 0x14000c6c0
sub rax, rdi
sar rax, 1
cmp eax, r14d
je 0x14000c6c0
mov edi, 2
jmp 0x14000c6ed
cmp dword [rdi - 0x10], r12d
jl 0x14000c6ea
lea rdx, str.current
mov rcx, rdi
call fcn.1400407c8
test rax, rax
je 0x14000c6ea
sub rax, rdi
mov edi, 1
sar rax, 1
cmp eax, r14d
jne 0x14000c6ed
mov edi, r12d
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea42
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rsi, [0x14006cce4]
mov qword [rbp + 0xb0], rax
cmp rsi, 0x10000
jae 0x14000c730
movzx edx, si
lea rcx, [rbp + 0xb0]
call fcn.140002950
jmp 0x14000c74c
mov r8, r14
inc r8
cmp word [rsi + r8*2], r12w
jne 0x14000c733
mov rdx, rsi
lea rcx, [rbp + 0xb0]
call fcn.140002da0
lea rax, [rbp + 0xb0]
mov r9d, edi
mov qword [rsp + 0x20], rax
call fcn.14002f130
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea4d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rcx, [0x14006cce4]
mov qword [rbp + 0xb8], rax
cmp rcx, 0x10000
jae 0x14000c7a3
movzx edx, si
lea rcx, [rbp + 0xb8]
call fcn.140002950
jmp 0x14000c7bf
mov r8, r14
inc r8
cmp word [rcx + r8*2], r12w
jne 0x14000c7a6
mov rdx, rcx
lea rcx, [rbp + 0xb8]
call fcn.140002da0
mov byte [rsp + 0x38], r12b
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x30], r12
mov r9d, r14d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14002f4b0
mov rsi, qword [rsp + 0x78]
cmp dword [rsi], r12d
jl 0x14000ca25
lea rdx, str._governor_start_type
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000ca25
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000ca25
lea rcx, [rbx - 0x18]
call fcn.140004a00
add rax, 0x18
lea r8, [rsp + 0x50]
lea rdx, str._governor_start_type
mov qword [rbp + 0x130], rax
lea rcx, [rbp + 0x130]
call fcn.14000a2f0
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 0x10], r12d
jl 0x14000c8ce
lea rdx, [0x14006ec90]
mov rcx, rdi
call fcn.1400407c8
test rax, rax
je 0x14000c878
sub rax, rdi
sar rax, 1
cmp eax, r14d
je 0x14000c878
mov edi, 2
jmp 0x14000c8d1
cmp dword [rdi - 0x10], r12d
jl 0x14000c8ce
lea rdx, str.current
mov rcx, rdi
call fcn.1400407c8
test rax, rax
je 0x14000c8a4
sub rax, rdi
sar rax, 1
cmp eax, r14d
je 0x14000c8a4
mov edi, 1
jmp 0x14000c8d1
cmp dword [rdi - 0x10], r12d
jl 0x14000c8ce
lea rdx, str.service
mov rcx, rdi
call fcn.1400407c8
test rax, rax
je 0x14000c8ce
sub rax, rdi
mov edi, 4
sar rax, 1
cmp eax, r14d
jne 0x14000c8d1
mov edi, r12d
mov rax, qword [0x140086d98]
mov qword [rsp + 0x60], rax
cmp dword [rax - 8], 1
jle 0x14000c8fe
mov edx, dword [rax - 0x10]
lea rcx, [0x140086d98]
call fcn.140002cd0
mov rax, qword [0x140086d98]
mov qword [rsp + 0x60], rax
mov rsi, qword [0x140086c28]
cmp dword [rsi - 8], 1
jle 0x14000c921
mov edx, dword [rsi - 0x10]
lea rcx, [0x140086c28]
call fcn.140002cd0
mov rsi, qword [0x140086c28]
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea58
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xc0], rax
lea rax, [0x14006cce4]
cmp rax, 0x10000
jae 0x14000c963
movzx edx, ax
lea rcx, [rbp + 0xc0]
call fcn.140002950
jmp 0x14000c97f
mov r8, r14
inc r8
cmp word [rax + r8*2], r12w
jne 0x14000c966
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140002da0
movzx eax, byte [0x140085a9d]
mov r9d, edi
mov byte [rsp + 0x38], al
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.14002f4b0
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea63
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea rcx, [0x14006cce4]
mov qword [rbp + 0xc8], rax
cmp rcx, 0x10000
jae 0x14000c9f0
movzx edx, cx
lea rcx, [rbp + 0xc8]
call fcn.140002950
jmp 0x14000ca0c
mov r8, r14
inc r8
cmp word [rcx + r8*2], r12w
jne 0x14000c9f3
mov rdx, rcx
lea rcx, [rbp + 0xc8]
call fcn.140002da0
lea rax, [rbp + 0xc8]
mov r9d, r14d
mov qword [rsp + 0x20], rax
call fcn.14002f130
mov rsi, qword [rsp + 0x78]
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
mov edx, 2
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], r12d
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x48], r12
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x40], r12
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r12
call fcn.14003e3cc
mov dword [rbp - 0x70], r12d
mov byte [rbp], 1
cmp dword [rsi], r12d
jl 0x14000cbf3
lea rdx, str._logfolder
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000cbf3
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000cbf3
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea6e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xd0], rax
test r13, r13
je 0x14000caed
cmp r13, 0x10000
jae 0x14000cad5
movzx edx, r13w
lea rcx, [rbp + 0xd0]
call fcn.140002950
jmp 0x14000caff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000cae0
jmp 0x14000caf0
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp + 0xd0]
call fcn.140002da0
lea r8, [rsp + 0x50]
lea rdx, str._logfolder
lea rcx, [rbp + 0xd0]
call fcn.14000a2f0
lea rcx, [rbp + 0x4f0]
call fcn.140006400
mov r8, qword [rsp + 0x50]
lea rdx, str.LogFolder
mov rcx, qword [rbp + 0x4f8]
test r8, r8
jne 0x14000cb45
call fcn.1400107a0
jmp 0x14000cbe7
call fcn.140010430
test al, al
jne 0x14000cbe7
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x640]
mov r9d, 0x3ff
mov word [rbp + 0x640], r12w
mov edx, 0x16c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000cbcb
cmp byte [0x14007fca8], r12b
je 0x14000cb97
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], r12b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x3ff
lea r8, [rbp + 0x640]
mov rcx, rax
mov edx, 0x16c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000cbcb
mov word [rbp + 0x640], r12w
mov r9d, 0x1010
lea r8, str.Process_Lasso_Install_Helper
lea rdx, [rbp + 0x640]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp + 0x4f0]
call fcn.140006610
call fcn.140001a70
test rax, rax
je 0x14000ead1
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov rdi, qword [rsp + 0x78]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x60], rsi
cmp dword [rdi], r12d
jl 0x14000d8c9
lea rdx, str._configfolder
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000d1cf
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000d1cf
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea79
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xd8], rax
test r13, r13
je 0x14000cc9d
cmp r13, 0x10000
jae 0x14000cc8a
movzx edx, r13w
lea rcx, [rbp + 0xd8]
call fcn.140002950
jmp 0x14000ccaf
mov r8, r14
nop dword [rax]
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000cc90
jmp 0x14000cca0
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp + 0xd8]
call fcn.140002da0
lea r8, [rsp + 0x50]
lea rdx, str._configfolder
lea rcx, [rbp + 0xd8]
call fcn.14000a2f0
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 8], 1
jle 0x14000cce4
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002cd0
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
call fcn.1400141c0
cmp dword [rdi - 8], 1
jle 0x14000cd04
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002cd0
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000ced1
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x640]
mov r9d, 0x3ff
mov word [rbp + 0x640], r12w
mov edx, 0x30d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000cd8f
cmp byte [0x14007fca8], r12b
je 0x14000cd5b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], r12b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x3ff
lea r8, [rbp + 0x640]
mov rcx, rax
mov edx, 0x30d
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000cd8f
mov word [rbp + 0x640], r12w
mov r8, rdi
lea rdx, [rbp + 0x640]
lea rcx, [rsp + 0x60]
call fcn.140002f70
mov rbx, qword [rsp + 0x60]
lea r8, str.Process_Lasso_Install_Helper
mov rdx, rbx
mov r9d, 0x1010
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000cdda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000ce58
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000ce44
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d9
mov rcx, r8
call fcn.14003eed0
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rsp + 0x50]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ce77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x2c0]
call fcn.140037580
mov rdx, qword [rsp + 0x58]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000cea2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, 1
jg 0x14000cebb
mov rcx, qword [r15]
mov rdx, r15
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
mov eax, 4
jmp 0x14000ad09
test al, 0x10
je 0x14000cf2f
mov eax, dword [rdi - 0x10]
lea ecx, [rax - 1]
test ecx, ecx
js 0x14000ea8f
cmp ecx, eax
jg 0x14000ea8f
mov r8, r14
lea rdx, [0x14006dba4]
inc r8
cmp word [rdx + r8*2], r12w
jne 0x14000cef5
lea rcx, [rsp + 0x50]
call fcn.140002b60
mov r8, r14
lea rax, [0x14006ed20]
inc r8
cmp word [rax + r8*2], r12w
jne 0x14000cf13
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002b60
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 8], 1
jle 0x14000cf47
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002cd0
mov rdi, qword [rsp + 0x50]
mov r8, rdi
mov rdx, 0xffffffff80000002
call fcn.1400279b0
test al, al
jne 0x14000d103
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x640]
mov r9d, 0x3ff
mov word [rbp + 0x640], r12w
mov edx, 0x30e
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000cfd7
cmp byte [0x14007fca8], r12b
je 0x14000cfa3
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], r12b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x3ff
lea r8, [rbp + 0x640]
mov rcx, rax
mov edx, 0x30e
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000cfd7
mov word [rbp + 0x640], r12w
mov r9d, 0x1010
lea r8, str.Process_Lasso_Install_Helper
lea rdx, [rbp + 0x640]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d00d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000d08b
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000d077
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d9
mov rcx, r8
call fcn.14003eed0
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rsp + 0x50]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d0aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x2c0]
call fcn.140037580
mov rdx, qword [rsp + 0x58]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d0d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, 1
jg 0x14000d0ed
mov rcx, qword [r15]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
mov eax, 5
jmp 0x14000ad09
test rdi, rdi
jne 0x14000d119
lea rcx, [0x14008a058]
call fcn.140002ef0
jmp 0x14000d1ca
mov r8, r14
nop dword [rax]
inc r8
cmp word [rdi + r8*2], r12w
jne 0x14000d120
mov rdx, rdi
lea rcx, [0x14008a058]
call fcn.140002da0
mov rcx, qword [0x14008a058]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000d1ca
mov rdi, qword [0x14008a058]
cmp dword [rdi - 8], 1
jle 0x14000d16e
mov edx, dword [rdi - 0x10]
lea rcx, [0x14008a058]
call fcn.140002cd0
mov rdi, qword [0x14008a058]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
jne 0x14000d181
mov r8d, r12d
jmp 0x14000d18e
mov r8, r14
inc r8
cmp word [rdi + r8*2], r12w
jne 0x14000d184
mov rdx, rdi
lea rcx, [0x14008a058]
call fcn.140002da0
lea r8, [rbp + 0x11c]
xor edx, edx
lea rcx, [0x140086e00]
call fcn.1400207a0
lea rcx, [0x140086e00]
call fcn.140018780
lea rcx, [0x140086e00]
call fcn.140019400
mov rdi, qword [rsp + 0x78]
cmp dword [rdi], r12d
jl 0x14000d8c9
lea rdx, str._importconfigfrom
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000d81f
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000d81f
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea84
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe0], rax
test r13, r13
je 0x14000d251
cmp r13, 0x10000
jae 0x14000d241
movzx edx, r13w
lea rcx, [rbp + 0xe0]
call fcn.140002950
jmp 0x14000d263
mov r8, r14
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000d244
jmp 0x14000d254
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp + 0xe0]
call fcn.140002da0
lea r8, [rsp + 0x50]
lea rdx, str._importconfigfrom
lea rcx, [rbp + 0xe0]
call fcn.14000a2f0
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000d35d
cmp dword [rbx - 8], 1
jle 0x14000d2aa
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002cd0
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x640]
mov r9d, 0x3ff
mov word [rbp + 0x640], r12w
mov edx, 0x30a
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000d323
cmp byte [0x14007fca8], r12b
je 0x14000d2ef
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], r12b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x3ff
lea r8, [rbp + 0x640]
mov rcx, rax
mov edx, 0x30a
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000d323
mov word [rbp + 0x640], r12w
mov r8, rbx
lea rdx, [rbp + 0x640]
lea rcx, [rsp + 0x60]
call fcn.140002f70
mov rbx, qword [rsp + 0x60]
lea r8, str.Process_Lasso_Install_Helper
mov rdx, rbx
mov r9d, 0x1010
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbx - 0x18]
jmp 0x14000d4c3
test al, 0x10
je 0x14000d3be
mov eax, dword [rbx - 0x10]
lea ecx, [rax - 1]
test ecx, ecx
js 0x14000ea8f
cmp ecx, eax
jg 0x14000ea8f
mov r8, r14
lea rax, [0x14006dba4]
inc r8
cmp word [rax + r8*2], r12w
jne 0x14000d381
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002b60
mov r8, r14
lea rax, [0x14006ed20]
inc r8
cmp word [rax + r8*2], r12w
jne 0x14000d3a2
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002b60
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000d292
call fcn.140001a70
test rax, rax
je 0x14000ead1
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [rbp + 0x20]
lea rcx, [0x140086e00]
mov qword [rbp + 0x20], rax
call fcn.140026fd0
test al, al
jne 0x14000d5d3
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x640]
mov r9d, 0x3ff
mov word [rbp + 0x640], r12w
mov edx, 0x30b
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000d480
cmp byte [0x14007fca8], r12b
je 0x14000d44c
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], r12b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x3ff
lea r8, [rbp + 0x640]
mov rcx, rax
mov edx, 0x30b
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000d480
mov word [rbp + 0x640], r12w
mov r9d, 0x1010
lea r8, str.Process_Lasso_Install_Helper
lea rdx, [rbp + 0x640]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp + 0x20]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d4ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d4d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000d557
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000d543
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d9
mov rcx, r8
call fcn.14003eed0
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rsp + 0x50]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d576
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x2c0]
call fcn.140037580
mov rdx, qword [rsp + 0x58]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d5a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, 1
jg 0x14000d7e0
mov rcx, qword [r15]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
mov eax, 3
jmp 0x14000ad09
mov rdi, qword [rbp + 0x20]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x14000d7f6
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x640]
mov r9d, 0x3ff
mov word [rbp + 0x640], r12w
mov edx, 0x30c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000d667
cmp byte [0x14007fca8], r12b
je 0x14000d633
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], r12b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x3ff
lea r8, [rbp + 0x640]
mov rcx, rax
mov edx, 0x30c
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000d667
mov word [rbp + 0x640], r12w
cmp dword [rbx - 8], 1
jle 0x14000d67f
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002cd0
mov rbx, qword [rsp + 0x50]
cmp dword [rdi - 8], 1
jle 0x14000d695
mov edx, dword [rdi - 0x10]
lea rcx, [rbp + 0x20]
call fcn.140002cd0
mov rdi, qword [rbp + 0x20]
mov r9, rdi
lea rdx, [rbp + 0x640]
mov r8, rbx
lea rcx, [rsp + 0x60]
call fcn.140002f70
mov rdx, qword [rsp + 0x60]
lea r8, str.Process_Lasso_Install_Helper
mov r9d, 0x1010
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d6e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x60]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d6ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000d77d
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000d769
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d9
mov rcx, r8
call fcn.14003eed0
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rsp + 0x50]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d79c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x2c0]
call fcn.140037580
mov rdx, qword [rsp + 0x58]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d7c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, 1
jg 0x14000d7e0
mov rcx, qword [r15]
mov rdx, r15
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
mov eax, 3
jmp 0x14000ad09
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000d810
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
cmp dword [rdi], r12d
jl 0x14000d8c9
lea rdx, str._initiatinguser
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000d8c9
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000d8c9
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000ea9a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0xe8], rax
test r13, r13
je 0x14000d89d
cmp r13, 0x10000
jae 0x14000d88d
movzx edx, r13w
lea rcx, [rbp + 0xe8]
call fcn.140002950
jmp 0x14000d8af
mov r8, r14
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000d890
jmp 0x14000d8a0
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp + 0xe8]
call fcn.140002da0
lea r8, [0x140086b48]
lea rdx, str._initiatinguser
lea rcx, [rbp + 0xe8]
call fcn.14000a2f0
mov rax, qword [0x140086b48]
cmp dword [rax - 0x10], r12d
jne 0x14000dced
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [0x140085ac9], r12b
jne 0x14000d92c
lea rcx, str.kernel32.dll
mov byte [0x140085ac9], 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14000d92c
lea rdx, str.GetProcessInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetProcessInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
call fcn.140011f10
mov edx, eax
mov esi, eax
call fcn.140011f10
mov dword [rbp + 0x64], eax
call fcn.140001a70
test rax, rax
je 0x14000eabb
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp + 0x30], rdi
call fcn.140001a70
test rax, rax
je 0x14000eabb
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x28], rbx
call fcn.140001a70
test rax, rax
je 0x14000eabb
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x68], rax
call fcn.140001a70
test rax, rax
je 0x14000eabb
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x100], rax
test esi, esi
je 0x14000da4d
lea rcx, [rbp + 0x30]
call fcn.140002ef0
lea rcx, [rbp + 0x68]
call fcn.140002ef0
mov r8d, esi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x14000da08
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14000da49
lea r8, [rbp + 0xf0]
mov qword [rbp + 0xf0], r12
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000da49
mov rdx, qword [rbp + 0xf0]
lea r9, [rbp + 0x68]
lea r8, [rbp + 0x30]
call fcn.140011fe0
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rbp + 0x30]
mov esi, dword [rbp + 0x64]
test esi, esi
je 0x14000dadf
lea rcx, [rbp + 0x28]
call fcn.140002ef0
lea rcx, [rbp + 0x100]
call fcn.140002ef0
mov r8d, esi
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x14000da97
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14000dadb
lea r8, [rbp + 0xf8]
mov qword [rbp + 0xf8], r12
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000dadb
mov rdx, qword [rbp + 0xf8]
lea r9, [rbp + 0x100]
lea r8, [rbp + 0x28]
call fcn.140011fe0
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x28]
xor edx, edx
lea rcx, [rbp + 0x10c0]
mov r8d, 0x202
call fcn.14005fd20
lea rdx, [rbp + 0x78]
mov dword [rbp + 0x78], 0x101
lea rcx, [rbp + 0x10c0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x14000dc09
lea rdx, [rbp + 0x10c0]
mov rcx, rdi
call fcn.14004bd8c
test eax, eax
je 0x14000db8f
mov rbx, qword [0x140086b48]
lea rcx, [rdi - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14000dc68
cmp dword [rbx + 0x10], r12d
jl 0x14000db77
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14000db77
call fcn.140004a00
mov rdi, rax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14000db6e
mov rcx, qword [rbx]
mov rdx, rbx
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
jmp 0x14000dc61
mov r8d, dword [rdi - 0x10]
lea rcx, [0x140086b48]
mov rdx, rdi
call fcn.140002da0
jmp 0x14000dc68
lea rdx, [rbp + 0x10c0]
mov rcx, rbx
call fcn.14004bd8c
test eax, eax
je 0x14000dc68
mov rdi, qword [0x140086b48]
lea rcx, [rbx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000dc68
cmp dword [rdi + 0x10], r12d
jl 0x14000dbf4
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000dbf4
call fcn.140004a00
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
sub ecx, 1
jg 0x14000dbee
mov rcx, qword [rdi]
mov rdx, rdi
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
jmp 0x14000dc61
mov r8d, dword [rbx - 0x10]
lea rcx, [0x140086b48]
mov rdx, rbx
call fcn.140002da0
jmp 0x14000dc68
mov rax, qword [0x140086b48]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], r12d
je 0x14000dc68
cmp dword [rdx + 0x10], r12d
jge 0x14000dc3e
cmp dword [rax - 0xc], r12d
jl 0x14000eaa5
mov dword [rax - 0x10], r12d
mov rax, qword [0x140086b48]
mov word [rax], r12w
jmp 0x14000dc68
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000dc54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140086b48], rax
mov rdx, qword [rbp + 0x100]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000dc89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x68]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000dca7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x28]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000dcc5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x30]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000dce3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x78]
cmp dword [rax], r12d
jl 0x14000ddcb
lea rdx, str._configpw
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000ddcb
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000ddcb
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14000eab0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x70], rax
test r13, r13
je 0x14000dd6e
cmp r13, 0x10000
jae 0x14000dd5e
movzx edx, r13w
lea rcx, [rbp + 0x70]
call fcn.140002950
jmp 0x14000dd7d
mov r8, r14
inc r8
cmp word [r13 + r8*2], r12w
jne 0x14000dd61
jmp 0x14000dd71
mov r8d, r12d
mov rdx, r13
lea rcx, [rbp + 0x70]
call fcn.140002da0
lea r8, [rsp + 0x50]
lea rdx, str._configpw
lea rcx, [rbp + 0x70]
call fcn.14000a2f0
xor edx, edx
lea rcx, [0x140086e00]
call fcn.140026fd0
lea r8, [rbp + 0x160]
xor edx, edx
lea rcx, [0x140086e00]
call fcn.1400207a0
mov rdx, qword [rsp + 0x50]
call fcn.140029e10
lea rcx, [0x140086e00]
call fcn.140019400
mov r13, qword [rsp + 0x78]
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._clearlog
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000dec0
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000dec0
lea rcx, [rbp + 0xe40]
call fcn.140006400
xor r8d, r8d
lea rdx, str.processlasso.log
lea rcx, [rbp + 0xe40]
call fcn.140006700
lea rcx, [rbp + 0xe40]
call fcn.140006610
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000de49
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000e813
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000e7ff
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9c7
jmp 0x14000e7ff
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._clearoldlogs
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000dfa6
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000dfa6
lea rcx, [rbp + 0xef0]
call fcn.140006400
lea rcx, [rbp + 0xef0]
call fcn.1400068e0
lea rcx, [rbp + 0xef0]
call fcn.140006610
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000df2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000e813
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000e7ff
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9cd
jmp 0x14000e7ff
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._enable_update_check
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000dfe7
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000dfe7
mov dl, 1
call fcn.140005020
lea r8, [rsp + 0x68]
call fcn.14000f8d0
cmp byte [rsp + 0x68], r12b
jmp 0x14000e02e
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._disable_update_check
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000e142
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000e142
xor edx, edx
call fcn.140005020
lea r8, [rsp + 0x69]
call fcn.14000f8d0
cmp byte [rsp + 0x69], r12b
mov ebx, r12d
lea rdx, [rsi - 0x18]
setne bl
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e04e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000e0cc
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000e0b8
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d9
mov rcx, r8
call fcn.14003eed0
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rsp + 0x50]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e0eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x2c0]
call fcn.140037580
mov rdx, qword [rsp + 0x58]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e116
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, 1
jg 0x14000e12f
mov rcx, qword [r15]
mov rdx, r15
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
mov eax, ebx
jmp 0x14000ad09
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._disable_core_parking
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000e1a1
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000e1a1
mov dword [rsp + 0x20], 0x64
lea r9, str.MinValue
mov rdx, 0xffffffff80000002
lea r8, str.SYSTEMCurrentControlSetControlPowerPowerSettings54533251_82be_4824_96c1_47b60b740d000cc5b647_c1df_4637_891a_dec35c318583
call fcn.140012330
test al, al
lea rdx, [rsi - 0x18]
mov eax, r14d
je 0x14000e216
jmp 0x14000e782
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._enable_core_parking
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000e1d1
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000e1d1
mov dword [rsp + 0x20], r12d
jmp 0x14000e173
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._notifyagenttolaunchgui
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000e31f
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000e31f
call fcn.140006e80
test al, al
lea rdx, [rsi - 0x18]
mov eax, r14d
jne 0x14000e782
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e229
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000e2a7
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000e293
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d9
mov rcx, r8
call fcn.14003eed0
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rsp + 0x50]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e2c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x2c0]
call fcn.140037580
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e2f1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, 1
jg 0x14000e309
mov rcx, qword [r15]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
mov eax, 1
jmp 0x14000ad09
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._restartpl
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000e64b
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000e64b
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140001a70
test rax, rax
je 0x14000eac6
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x18], rax
call fcn.140001a70
test rax, rax
je 0x14000eac6
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
xor ecx, ecx
lea rbx, [rax + 0x18]
mov qword [rbp + 0x10], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x7fe
lea rdx, [rbp + 0x2d00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000e402
lea rcx, [rbp + 0x2d00]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14000e3c5
dec eax
movsxd rcx, eax
test eax, eax
jle 0x14000e402
nop dword [rax + rax]
cmp word [rbp + rcx*2 + 0x2d00], 0x5c
je 0x14000e3f7
dec eax
dec rcx
test rcx, rcx
jg 0x14000e3e0
jmp 0x14000e402
cdqe
mov word [rbp + rax*2 + 0x2d00], r12w
lea r8, [rbp + 0x2d00]
lea rdx, str.__sprocesslasso.exe_
lea rcx, [rbp + 0x18]
call fcn.140002f70
mov rdi, qword [rbp + 0x18]
lea rsi, [rbx - 0x18]
lea r13, [rdi - 0x18]
cmp r13, rsi
je 0x14000e480
cmp dword [rsi + 0x10], r12d
jl 0x14000e46c
mov rax, qword [rsi]
cmp qword [r13], rax
jne 0x14000e46c
mov rcx, r13
call fcn.140004a00
mov rbx, rax
mov ecx, r14d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x14000e45e
mov rcx, qword [rsi]
mov rdx, rsi
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rdi, qword [rbp + 0x18]
add rbx, 0x18
mov qword [rbp + 0x10], rbx
jmp 0x14000e480
mov r8d, dword [rdi - 0x10]
lea rcx, [rbp + 0x10]
mov rdx, rdi
call fcn.140002da0
mov rbx, qword [rbp + 0x10]
cmp byte [0x140085acc], r12b
jne 0x14000e4a7
xor edx, edx
call fcn.140011dd0
mov edx, 2
mov byte [0x140085acb], al
call fcn.140011dd0
mov byte [0x140085acc], 1
cmp byte [0x140085acb], r12b
jne 0x14000e55c
cmp dword [rbx - 8], 1
jle 0x14000e4ca
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140002cd0
mov rbx, qword [rbp + 0x10]
cmp dword [r13 + 0x10], 1
jle 0x14000e4e2
mov edx, dword [r13 + 8]
lea rcx, [rbp + 0x18]
call fcn.140002cd0
mov rdi, qword [rbp + 0x18]
xor edx, edx
lea rcx, [rbp + 0x3d00]
mov r8d, 0x800
call fcn.14005fd20
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea rax, [rbp + 0x3b0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0x5d0]
mov rdx, rbx
mov qword [rsp + 0x40], rax
mov rcx, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x208
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000e57d
mov rcx, qword [rbp + 0x3b8]
test rcx, rcx
je 0x14000e57d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000e57d
cmp dword [rbx - 8], 1
jle 0x14000e572
mov edx, dword [rbx - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140002cd0
mov rbx, qword [rbp + 0x10]
mov rdx, rbx
mov rcx, rdi
call fcn.140013c10
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e597
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x18]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e5b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x60]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e5d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000e813
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000e7ff
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d3
jmp 0x14000e7ff
cmp dword [r13], r12d
jl 0x14000e888
lea rdx, str._langcheck
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x14000e888
sub rax, rbx
sar rax, 1
cmp eax, r14d
je 0x14000e888
mov r8, qword [0x140086c18]
mov edx, dword [0x14007fcb0]
mov rcx, r8
mov rax, qword [r8 + 8]
cmp byte [rax + 0x19], r12b
jne 0x14000e6ad
cmp dword [rax + 0x1c], edx
jge 0x14000e6a1
mov rax, qword [rax + 0x10]
jmp 0x14000e6a7
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
je 0x14000e696
cmp byte [rcx + 0x19], r12b
jne 0x14000e6b8
cmp edx, dword [rcx + 0x1c]
jge 0x14000e6bb
mov rcx, r8
cmp rcx, r8
je 0x14000e77b
cmp byte [rcx + 0x20], r12b
je 0x14000e77b
cmp byte [0x140085a9d], r12b
jne 0x14000e77b
mov rcx, qword [rbp - 0x78]
lea r8, [rbp + 0x640]
mov r9d, 0x3ff
mov word [rbp + 0x640], r12w
mov edx, 0x10f
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000e754
cmp byte [0x14007fca8], r12b
je 0x14000e720
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [0x14007fca8], r12b
mov rcx, qword [str.pl_rsrc_english.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x3ff
lea r8, [rbp + 0x640]
mov rcx, rax
mov edx, 0x10f
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x14000e754
mov word [rbp + 0x640], r12w
lea rax, [0x14007ffc0]
mov r9d, 0x2040030
lea r8, [0x14006d5e8]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x640]
xor ecx, ecx
call fcn.1400304a0
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e795
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000e813
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000e7ff
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d9
mov rcx, r8
call fcn.14003eed0
xorps xmm0, xmm0
mov qword [rbp - 0x68], r12
movdqa xmmword [rbp - 0x60], xmm0
mov rdx, qword [rsp + 0x50]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e832
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x2c0]
call fcn.140037580
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e85d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [r15 + 0x10], r14d
sub r14d, 1
jg 0x14000e875
mov rcx, qword [r15]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0x3d0]
call fcn.140037580
xor eax, eax
jmp 0x14000ad09
cmp byte [0x140085a9d], r12b
jne 0x14000e91d
cmp byte [0x140085a9b], r12b
jne 0x14000e90b
nop
cmp byte [0x140085a9c], r12b
jne 0x14000e90b
cmp byte [0x140085a98], r12b
jne 0x14000e8d2
mov rcx, qword [0x1400862e0]
lea r9, [0x140009290]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea edx, [r8 + 0x66]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp byte [0x140085a99], r12b
jne 0x14000e914
mov rcx, qword [0x1400862e0]
lea r9, [0x140007740]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov edx, 0xb7
call qword [sym.imp.USER32.dll_DialogBoxParamW]
cmp rax, 2
jne 0x14000e90b
cmp byte [0x140085a9b], r12b
je 0x14000e8a0
cmp byte [0x140085a99], r12b
je 0x14000e91d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400369a0
lea rcx, [0x140085aa0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000e949
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x50]
call fcn.14003e3c8
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000e813
mov rdx, qword [rbp - 0x60]
call fcn.14000ebe0
mov r8, qword [rbp - 0x68]
movabs rax, 0x4924924924924925
mov rcx, qword [rbp - 0x58]
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x38
cmp rdx, 0x1000
jb 0x14000e7ff
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e9d9
jmp 0x14000e7ff
mov ecx, 0x80070057
call fcn.1400018b0
int3
call fcn.14004b3fc
int3
call fcn.14004b3fc
int3
call fcn.14004b3fc
int3
call fcn.14004b3fc
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80070057
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80070057
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80070057
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3
mov ecx, 0x80004005
call fcn.1400018b0
int3