Function at 0x1400052ec
Capabilities:
Accept command line arguments
Check os version
Compare security identifiers
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2888]
mov eax, 0x2960
call fcn.140009900
sub rsp, rax
mov rax, qword [0x14000f0e0]
xor rax, rsp
mov qword [rbp + 0x2850], rax
mov rdi, rcx
mov dword [rbp + 0xa20], 0x11c
lea rax, [rbp + 0x88]
mov r15d, 1
lea rcx, [rbp + 0xa20]
mov dword [rbp + 0x80], r15d
mov qword [rbp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor r13d, r13d
test eax, eax
je 0x140005370
mov byte [0x1400100da], r15b
mov byte [0x14000fdc4], r15b
mov rax, qword [0x14000e0c0]
mov r14d, 0x104
mov word [rax], r13w
mov rax, qword [0x14000e8d0]
mov word [rax], r13w
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x90], rax
mov dword [rbp + 0x98], r14d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, 0x22
mov rbx, rax
lea r12d, [rcx - 2]
cmp word [rax], cx
jne 0x1400053be
add rbx, 2
jmp 0x1400053c2
movzx ecx, r12w
movzx eax, word [rbx]
test ax, ax
je 0x1400053e5
cmp ax, cx
je 0x1400053db
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x1400053ca
cmp word [rbx], r13w
je 0x1400053e5
add rbx, 2
mov ecx, 0xfffffff5
mov qword [0x1400100f0], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x14000fdd0], rax
cmp rax, 0xffffffffffffffff
je 0x140005412
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x140005419
mov qword [0x14000fdd0], r13
mov edi, 0x800
mov dword [rbp - 0x24], r13d
mov r8d, edi
lea rcx, [rbp + 0xe40]
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, edi
lea rcx, [rbp + 0x1850]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0xe40]
mov dword [rbp - 0x4c], r13d
mov qword [rsp + 0x68], rax
mov edi, 9
lea rax, [rbp + 0x1850]
mov dword [0x14000fc14], r13d
mov qword [rbp - 0x80], rax
cmp word [rbx], r12w
je 0x140005476
cmp word [rbx], di
jne 0x14000547c
add rbx, 2
jmp 0x14000546b
movzx eax, word [rbx]
mov ecx, 0xfffd
sub ax, 0x2d
test cx, ax
jne 0x140005667
lea rax, [rbx + 2]
test rax, rax
je 0x140005667
movzx eax, word [rax]
or ax, r12w
cmp ax, 0x60
jne 0x140005667
add rbx, 4
mov qword [rsp + 0x78], rbx
cmp word [rbx], r12w
je 0x1400054c3
cmp word [rbx], di
jne 0x1400054c9
add rbx, 2
jmp 0x1400054b3
lea rax, [rbp + 0xe40]
mov r8d, 0x400
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
lea rcx, [rsp + 0x78]
call fcn.140004f10
test al, al
jne 0x1400054ff
xor edx, edx
xor ecx, ecx
call fcn.140002c90
mov ebx, 0x667
jmp 0x1400070a9
mov eax, dword [rbp + 0x98]
mov r9d, 0x20019
add eax, eax
mov dword [rbp - 0x5c], r13d
cmp byte [0x1400100da], r13b
mov dword [rbp - 0x60], eax
jne 0x14000552d
cmp byte [0x14000fdc4], r13b
mov eax, 0x20119
cmovne r9d, eax
lea rax, [rbp - 0x18]
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000565f
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x5c]
mov rax, qword [rbp + 0x90]
lea rdx, [rbp + 0xe40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
jne 0x140005611
mov ebx, dword [rbp - 0x60]
shr ebx, 1
cmp ebx, r14d
jle 0x1400055ae
mov edx, ebx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x1400055b5
lea rdi, [rbp + 0xa0]
test rdi, rdi
je 0x14000564b
mov rcx, qword [rbp + 0x90]
lea rax, [rbp + 0xa0]
cmp rcx, rax
je 0x1400055d7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x5c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0xe40]
mov qword [rbp + 0x90], rdi
mov dword [rbp + 0x98], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov edi, 9
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000565f
cmp dword [rbp - 0x5c], r15d
jne 0x14000565f
mov rsi, qword [rbp + 0x90]
movzx r14d, word [rsi]
mov qword [rsp + 0x78], rsi
cmp r14w, r12w
je 0x140005645
cmp r14w, di
jne 0x140005c26
add rsi, 2
jmp 0x14000562c
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0xe
jmp 0x1400070a9
mov ebx, r13d
jmp 0x1400070a9
mov r12d, 0x7fffffff
mov rax, rbx
mov ecx, r12d
cmp word [rax], r13w
je 0x140005682
add rax, 2
sub rcx, r15
jne 0x140005673
test rcx, rcx
je 0x1400070a4
mov rsi, r12
sub rsi, rcx
inc esi
cmp esi, r14d
jle 0x1400056ae
movsxd rdx, esi
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
jmp 0x1400056b5
lea rdi, [rbp + 0xa0]
test rdi, rdi
je 0x140005655
mov rcx, qword [rbp + 0x90]
lea rax, [rbp + 0xa0]
cmp rcx, rax
je 0x1400056d3
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, str.update
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0xb60], rax
lea rcx, str.package
lea rax, str.uninstall
mov dword [rbp + 0x98], esi
mov qword [rbp + 0xb78], rax
lea rax, [0x14000aca0]
mov qword [rbp + 0xb98], rax
lea rax, str.help
mov qword [rbp + 0xba8], rax
lea rax, [0x14000acb4]
mov qword [rbp + 0xbb0], rax
lea rax, str.quiet
mov qword [rbp + 0xbc0], rax
lea rax, [0x14000acd0]
mov word [rdi], r13w
movsd xmm0, qword [str.PATCH]
movups xmm1, xmmword [0x14000ae20]
mov qword [rbp + 0xbc8], rax
lea rax, str.passive
mov qword [rbp + 0xbd8], rax
lea rax, str._qb___REBOOTPROMPTS
mov qword [rbp + 0xbe0], rax
lea rax, str.norestart
mov qword [rbp + 0xbf0], rax
lea rax, str.REBOOTReallySuppress
mov qword [rbp + 0xbf8], rax
lea rax, str.forcerestart
mov qword [rbp + 0xc08], rax
lea rax, str.REBOOTForce
mov qword [rbp + 0xc10], rax
lea rax, str.promptrestart
mov qword [rbp + 0xc20], rax
lea rax, str.REBOOTPROMPT__
mov qword [rbp + 0xc28], rax
lea rax, [0x14000ade0]
mov qword [rbp + 0xc38], rax
lea rax, [0x14000ade8]
mov qword [rbp + 0xc40], rax
mov eax, dword [0x14000adf0]
mov dword [rbp + 0xc58], eax
movzx eax, word [0x14000adf4]
mov word [rbp + 0xc5c], ax
mov eax, dword [0x14000adf8]
mov dword [rbp + 0xc50], eax
movzx eax, word [0x14000adfc]
mov word [rbp + 0xc54], ax
mov eax, dword [0x14000ae08]
mov dword [rbp + 0xc78], eax
movzx eax, word [0x14000ae0c]
movsd qword [rbp + 0xc70], xmm0
movups xmm0, xmmword [str.MSIPATCHREMOVE]
mov word [rbp + 0xc7c], ax
mov rax, r12
mov qword [rbp + 0xb68], r13
mov byte [rbp + 0xb70], r13b
mov qword [rbp + 0xb80], r13
mov byte [rbp + 0xb88], r13b
mov qword [rbp + 0xb90], rcx
mov byte [rbp + 0xba0], r15b
mov byte [rbp + 0xbb8], r15b
mov byte [rbp + 0xbd0], r15b
mov byte [rbp + 0xbe8], r15b
mov byte [rbp + 0xc00], r15b
mov byte [rbp + 0xc18], r15b
mov byte [rbp + 0xc30], r15b
mov byte [rbp + 0xc48], r15b
movups xmmword [rbp + 0xc80], xmm0
movups xmmword [rbp + 0xc90], xmm1
cmp word [rcx], r13w
je 0x1400058c0
add rcx, 2
sub rax, r15
jne 0x1400058b1
test rax, rax
je 0x1400070a4
mov r14, r12
mov qword [rbp - 0x48], rbx
lea rdx, [rbp - 0x78]
mov qword [rbp - 0x78], r13
lea rcx, [rbp - 0x48]
sub r14, rax
call fcn.1400029f8
mov rdi, rax
test rax, rax
je 0x1400059b5
mov rsi, qword [rbp - 0x78]
movzx eax, word [rdi]
test ax, ax
je 0x1400059b5
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
jne 0x140005986
lea r15, [rsi - 1]
mov ecx, 1
cmp r15, rcx
jne 0x14000594b
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x14000ae30]
mov edx, ecx
mov qword [rsp + 0x20], rax
mov ecx, 0x409
lea r9d, [rsi - 1]
lea r8, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140005acb
cmp r14, r15
mov r15d, 1
jne 0x140005986
lea rax, str.package
mov dword [rsp + 0x28], r14d
lea r9d, [rsi - 1]
mov qword [rsp + 0x20], rax
lea r8, [rdi + 2]
mov edx, r15d
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140005ad1
mov rsi, r13
mov qword [rbp - 0x78], r13
cmp qword [rbp - 0x48], r13
je 0x1400059a9
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.1400029f8
mov rsi, qword [rbp - 0x78]
mov rdi, rax
jmp 0x1400059ac
mov rdi, r13
test rdi, rdi
jne 0x1400058f4
lea rax, [rbp + 0xc50]
mov byte [rbp + 0xb70], r15b
mov qword [rbp + 0xb68], rax
lea rax, [rbp + 0xc58]
mov byte [rbp + 0xb88], r15b
lea rdx, [rbp - 0x78]
mov qword [rbp + 0xb80], rax
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x78], r13
call fcn.1400029f8
mov rbx, rax
test rax, rax
je 0x140005b7e
mov rdi, qword [rbp - 0x78]
movzx eax, word [rbx]
test ax, ax
je 0x140005b7e
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
jne 0x140005a78
mov r14d, r13d
lea r15, [rbp + 0xb60]
mov rsi, r13
mov rax, qword [r15]
lea r9d, [rdi - 1]
or dword [rsp + 0x28], 0xffffffff
lea r8, [rbx + 2]
mov edx, 1
mov qword [rsp + 0x20], rax
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x140005af9
mov eax, 1
add r15, 0x18
add r14d, eax
add rsi, rax
movsxd rax, r14d
cmp rax, 0xa
jb 0x140005a2b
xor r13d, r13d
lea r15d, [r13 + 1]
mov r9b, r15b
mov dword [rbp + 0x9c], 0x104
mov r8, rdi
lea rcx, [rbp + 0x90]
mov rdx, rbx
call fcn.140002aec
mov ebx, eax
test eax, eax
jne 0x1400070a9
mov rdi, r13
mov qword [rbp - 0x78], r13
cmp qword [rbp - 0x48], r13
je 0x140005b72
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.1400029f8
mov rdi, qword [rbp - 0x78]
mov rbx, rax
jmp 0x140005b75
mov r15d, 1
lea rax, [rbp + 0xc70]
mov byte [rbp + 0xb70], r13b
mov qword [rbp + 0xb68], rax
lea rax, [rbp + 0xc80]
mov byte [rbp + 0xb88], r13b
jmp 0x1400059d8
lea rax, [rsi + rsi*2]
mov dword [rbp + 0x9c], 0x104
mov r10, qword [rbp + rax*8 + 0xb68]
xor r13d, r13d
mov r9b, byte [rbp + rax*8 + 0xb70]
mov r8d, r13d
test r10, r10
je 0x140005b46
mov r8, r12
mov rax, r12
mov rcx, r10
mov edx, r13d
cmp word [rcx], r13w
je 0x140005b3e
add rcx, 2
sub rax, 1
jne 0x140005b2e
test rax, rax
jne 0x140005b6d
mov r8, r13
mov edx, 0x80070057
test edx, edx
js 0x1400070a4
mov rdx, r10
lea rcx, [rbp + 0x90]
call fcn.140002aec
mov r15d, 1
jmp 0x140005a97
sub r8, rax
jmp 0x140005b4b
mov rbx, r13
test rbx, rbx
jne 0x140005a04
mov rsi, qword [rbp + 0x90]
mov rcx, r13
test rsi, rsi
je 0x140005baf
mov rax, r12
mov edx, r13d
cmp word [rsi], r13w
je 0x140005ba2
add rsi, 2
sub rax, r15
jne 0x140005b93
test rax, rax
je 0x140005baf
mov rcx, r12
sub rcx, rax
jmp 0x140005bb4
mov edx, 0x80070057
test edx, edx
js 0x1400070a4
mov r12d, 0x20
test rcx, rcx
je 0x140005bf9
mov rax, qword [rbp + 0x90]
lea rdx, [rax - 2]
lea rdx, [rdx + rcx*2]
cmp word [rdx], r12w
je 0x140005be6
mov eax, 9
cmp word [rdx], ax
jne 0x140005bf9
cmp rdx, qword [rbp + 0x90]
jb 0x140005bf9
mov word [rdx], r13w
sub rdx, 2
jmp 0x140005bd6
mov rsi, qword [rbp + 0x90]
jmp 0x140005c17
cmp r14w, r12w
je 0x140005c13
mov eax, 9
cmp r14w, ax
jne 0x140005c26
add rsi, 2
movzx r14d, word [rsi]
mov qword [rsp + 0x78], rsi
test r14w, r14w
jne 0x140005c02
mov r15, qword [0x14000fb50]
mov edi, r13d
mov dword [rbp - 0x70], r13d
mov ebx, 0x667
lea rdx, str.RUVEH_IJDqXFAtPYZlgmnc
mov r8d, 0x52
test r14w, r14w
je 0x140006256
cmp r14w, 0x2f
je 0x140005d86
cmp r14w, 0x2d
je 0x140005d86
xor edx, edx
lea rcx, [rbp + 0x810]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x810]
mov esi, 0x104
lea rdx, [rbp + 0x800]
mov qword [rbp + 0x800], rax
lea rcx, [rsp + 0x78]
mov dword [rbp + 0x808], esi
mov dword [rbp + 0x80c], esi
call fcn.140004fe4
test eax, eax
je 0x1400061f8
mov r15, qword [rbp + 0x800]
test r15, r15
je 0x140005d34
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x14000fd20]
lea rcx, [0x14000e0c0]
add edx, 2
mov r14d, eax
add edx, eax
call fcn.140007bdc
test al, al
je 0x140005d2d
mov rax, qword [0x14000e0c0]
mov r8, r15
movsxd rsi, dword [0x14000fd20]
mov rcx, rsi
inc esi
mov dword [0x14000fd20], esi
mov word [rax + rcx*2], r12w
lea eax, [r14 + 1]
movsxd rdx, eax
mov rax, qword [0x14000e0c0]
movsxd rcx, esi
lea rcx, [rax + rcx*2]
call fcn.140001098
test eax, eax
js 0x140005d2d
add esi, r14d
mov dword [0x14000fd20], esi
mov r15, qword [rbp + 0x800]
mov rsi, qword [rsp + 0x78]
mov r13d, 9
movzx r14d, word [rsi]
cmp r14w, r12w
je 0x140005d4f
cmp r14w, r13w
jne 0x140005d5a
add rsi, 2
mov qword [rsp + 0x78], rsi
jmp 0x140005d3f
cmp dword [rbp + 0x808], 0x104
mov r13d, 0
jle 0x140005d7a
test r15, r15
je 0x140005d7a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r15, qword [0x14000fb50]
jmp 0x1400061e0
add rsi, 2
mov qword [rsp + 0x78], rsi
movzx eax, word [rsi]
mov ecx, eax
or ecx, r12d
cmp r13w, ax
je 0x140005da6
add rsi, 2
mov qword [rsp + 0x78], rsi
mov eax, r8d
mov r12, rdx
mov r8d, 0x20
movzx eax, ax
or eax, r8d
cmp eax, ecx
je 0x140005dca
add r12, 2
movzx eax, word [r12]
test ax, ax
jne 0x140005db2
cmp word [r12], r13w
je 0x1400060a1
cmp word [rsi], r8w
ja 0x140005dee
movzx eax, word [rsi]
movabs rcx, 0x100000201
bt rcx, rax
jb 0x140005df4
mov r13d, 1
mov edi, 9
cmp word [rsi], r8w
je 0x140005e04
cmp word [rsi], di
jne 0x140005e0f
add rsi, 2
mov qword [rsp + 0x78], rsi
jmp 0x140005df9
cmp word [r12], 0x63
lea rax, [rbp + 0xe40]
mov edi, dword [rbp - 0x70]
mov qword [rbp - 0x20], rax
jne 0x140005e30
xor edx, edx
test r13d, r13d
jne 0x14000622a
cmp word [r12], 0x50
jne 0x140005ec0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r15d, 1
lea esi, [rax + 0xa]
cmp esi, r15d
jle 0x140005e68
movsxd rdx, esi
lea ecx, [r15 + 0x3f]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
jmp 0x140005e6f
lea r14, [rbp + 0x88]
test r14, r14
je 0x14000623b
mov rcx, qword [rbp + 0x78]
lea rax, [rbp + 0x88]
cmp rcx, rax
je 0x140005e8e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r8d, esi
mov qword [rbp + 0x78], r14
lea rdx, [rbp + 8]
mov dword [rbp + 0x80], esi
lea rcx, [rsp + 0x78]
mov qword [rbp + 8], r14
call fcn.140004f10
xor edx, edx
test al, al
je 0x14000624a
mov r15, qword [0x14000fb50]
jmp 0x140005ef3
cmp word [r12], 0x71
je 0x140005ed0
cmp word [r12], 0x63
jne 0x140005ed5
test r13d, r13d
je 0x140005efe
mov r8d, 0x400
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x78]
call fcn.140004f10
xor edx, edx
test al, al
je 0x14000624a
mov rsi, qword [rsp + 0x78]
mov r8d, 0x20
mov edx, 9
movzx r14d, word [rsi]
cmp r14w, r8w
je 0x140005f13
cmp r14w, dx
jne 0x140005f1e
add rsi, 2
mov qword [rsp + 0x78], rsi
jmp 0x140005f03
movzx eax, word [r12]
sub ax, 0x46
cmp ax, 0x2b
ja 0x140005fb6
movabs rcx, 0x84000000011
bt rcx, rax
jae 0x140005fb6
test r13d, r13d
je 0x140005fb6
cmp word [r12], 0x71
lea rax, [rbp + 0x1850]
lea r10, [rbp + 0xe40]
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x1850]
mov qword [rbp - 0x80], r10
mov qword [rsp + 0x68], rdx
je 0x140005fbf
mov r8d, 0x400
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x78]
call fcn.140004f10
test al, al
je 0x140006248
mov rsi, qword [rsp + 0x78]
mov r8d, 0x20
lea r13d, [r8 - 0x17]
movzx r14d, word [rsi]
cmp r14w, r8w
je 0x140005fab
cmp r14w, r13w
jne 0x140005fb6
add rsi, 2
mov qword [rsp + 0x78], rsi
jmp 0x140005f9b
mov rdx, qword [rsp + 0x68]
mov r10, qword [rbp - 0x80]
movzx eax, word [r12]
xor r13d, r13d
sub ax, 0x61
cmp ax, 0x19
ja 0x14000600a
lea rax, str.RUVEH_IJDqXFAtPYZlgmnc
mov rcx, r10
sub r12, rax
lea rax, [0x140000000]
sar r12, 1
mov rax, qword [rax + r12*8 + 0xa010]
call qword [0x14000a5d8]
test eax, eax
jne 0x1400060a1
mov r15, qword [0x14000fb50]
jmp 0x1400061b3
test r15, r15
je 0x14000610e
cmp word [r12], 0x50
mov eax, 0x41
jne 0x140006084
cmp word [r15], ax
jne 0x140006084
mov ecx, eax
lea rdx, [rbp + 0x2050]
call fcn.1400040ec
test eax, eax
jne 0x1400060a1
lea rdx, [rbp + 0xca0]
mov qword [0x14000fb50], r12
lea ecx, [rax + 0x1e]
sub r10, rdx
mov r15, r12
lea rax, [rbp + 0xca0]
test rcx, rcx
je 0x140006077
movzx edx, word [r10 + rax]
test dx, dx
je 0x140006072
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x140006056
test rcx, rcx
jne 0x14000607b
sub rax, 2
mov word [rax], r13w
jmp 0x1400061b3
cmp word [r15], 0x50
jne 0x1400060a1
cmp word [r12], ax
jne 0x1400060a1
mov ecx, eax
call fcn.1400040ec
test eax, eax
je 0x1400061b3
xor edx, edx
xor ecx, ecx
call fcn.140002c90
mov edi, ebx
mov r15d, 1
call fcn.140005294
test edi, edi
jne 0x1400070af
cmp qword [0x14000fb50], r13
jne 0x1400060db
xor edx, edx
xor ecx, ecx
call fcn.140002c90
mov edi, ebx
test edi, edi
jne 0x1400070af
mov eax, dword [0x14000fc14]
test eax, eax
je 0x1400070af
lea rsi, [0x140000000]
test eax, eax
je 0x14000637b
mov rax, qword [0x14000e038]
xor edx, edx
xor ecx, ecx
call qword [0x14000a5d8]
jmp 0x14000638f
cmp word [r12], 0x50
mov r15, r12
mov qword [0x14000fb50], r12
je 0x140006168
lea r8, [rbp + 0x2050]
mov ecx, 0x400
sub rdx, r8
lea rax, [rbp + 0x2050]
mov qword [rsp + 0x68], rdx
test rcx, rcx
je 0x140006160
movzx edx, word [rdx + rax]
test dx, dx
je 0x14000615b
mov word [rax], dx
add rax, 2
mov rdx, qword [rsp + 0x68]
sub rcx, 1
jne 0x14000613b
test rcx, rcx
jne 0x140006164
sub rax, 2
mov word [rax], r13w
lea rdx, [rbp + 0xca0]
mov ecx, 0x1e
sub r10, rdx
lea rax, [rbp + 0xca0]
test rcx, rcx
je 0x14000619f
movzx edx, word [r10 + rax]
test dx, dx
je 0x14000619a
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x14000617e
test rcx, rcx
jne 0x1400061a3
sub rax, 2
cmp word [r12], 0x45
mov word [rax], r13w
je 0x140006256
lea rax, [rbp + 0xe40]
mov word [rbp + 0xe40], r13w
mov qword [rsp + 0x68], rax
mov r12d, 0x20
lea rax, [rbp + 0x1850]
mov word [rbp + 0x1850], r13w
mov qword [rbp - 0x80], rax
test r14w, r14w
je 0x140006256
lea rdx, str.RUVEH_IJDqXFAtPYZlgmnc
mov r8d, 0x52
jmp 0x140005c50
xor edx, edx
xor ecx, ecx
call fcn.140002c90
mov edi, ebx
cmp dword [rbp + 0x808], esi
jle 0x1400060ac
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x1400060ac
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400060ac
xor ecx, ecx
call fcn.140002c90
xor r13d, r13d
mov edi, ebx
jmp 0x1400060ac
mov edi, 0xe
xor r13d, r13d
jmp 0x1400060b2
xor edx, edx
xor ecx, ecx
call fcn.140002c90
jmp 0x1400070a9
test r15, r15
je 0x1400060ac
movzx eax, word [r15]
cmp ax, 0x45
je 0x140006283
sub ax, 0x59
mov ecx, 1
cmp ax, cx
jbe 0x140006283
call fcn.140005294
mov r15, qword [0x14000fb50]
cmp word [r15], 0x50
lea rax, str.RUVEH_IJDqXFAtPYZlgmnc
lea rdx, [rbp + 0x2050]
cmove rdx, qword [rbp + 0x78]
lea rsi, [0x140000000]
sub r15, rax
lea rcx, [rbp + 0xca0]
sar r15, 1
mov rax, qword [rsi + r15*8 + 0xa010]
call qword [0x14000a5d8]
mov edi, eax
mov r15d, 1
mov rax, qword [0x14000fb50]
movzx ecx, word [rax]
lea eax, [rcx - 0x59]
cmp ax, r15w
jbe 0x1400070ab
test edi, edi
jne 0x140006301
cmp cx, 0x45
jne 0x1400062f2
mov dword [0x14000fc14], r15d
jmp 0x1400060f8
mov eax, dword [0x14000fc14]
mov dword [rbp - 0x4c], r15d
jmp 0x1400060f0
cmp edi, 0x8000
jne 0x140006318
mov dword [0x14000fc14], r13d
mov edi, r13d
jmp 0x1400070af
mov eax, 0x4eb
cmp edi, eax
jg 0x140006348
je 0x1400060d3
cmp edi, 0xfffffffe
jl 0x14000636f
test edi, edi
js 0x1400060d5
lea eax, [rdi - 2]
cmp eax, r15d
jbe 0x140006341
cmp edi, 0x7b
jne 0x14000636f
mov edi, 0x653
jmp 0x14000636f
lea eax, [rdi - 0x642]
cmp eax, 2
jbe 0x1400060d3
cmp edi, 0x669
je 0x1400060d3
cmp edi, 0xbc2
je 0x1400060d3
mov ecx, edi
call fcn.140004a20
jmp 0x1400060d3
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, str.OLEAUT32.dll
call fcn.140008678
cmp dword [rbp - 0x4c], r13d
je 0x1400063ee
cmp dword [0x14000fc14], r13d
jne 0x1400063fb
mov ebx, r13d
movsxd rcx, ebx
lea r8, [0x14000b5b8]
mov r9d, r15d
lea rax, [rcx*4 + 0xf75c]
lea rdx, [rcx*8 + 0xe0b8]
add rax, rsi
shl rcx, 4
add rdx, rsi
add rcx, r8
mov qword [rsp + 0x20], rax
mov r8d, 4
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
test eax, eax
jne 0x1400063ea
add ebx, r15d
cmp ebx, r15d
jl 0x1400063a1
jmp 0x1400063ee
mov dword [rbp - 0x24], r15d
cmp dword [0x14000fc14], r13d
je 0x140007066
mov rax, qword gs:[0x60]
mov edx, r13d
mov r8, qword [rsp + 0x78]
mov rsi, 0xffffffff80000001
mov rcx, qword [rax + 0x20]
bts dword [rcx + 8], 0x13
xor eax, eax
mov qword [rbp + 0xc60], rax
mov qword [rbp + 0xc68], rax
lea r9d, [rax + 0x30]
lea r10d, [rax + 0x41]
lea r11d, [rax + 9]
movzx eax, word [r8]
mov ecx, 5
sub ax, r9w
cmp ax, r11w
ja 0x140006467
mov eax, edx
and eax, esi
jge 0x14000645a
sub eax, r15d
or eax, 0xfffffffe
add eax, r15d
neg eax
movzx eax, word [r8]
sbb ecx, ecx
sub eax, r9d
jmp 0x14000648e
movzx eax, word [r8]
sub ax, r10w
cmp ax, cx
ja 0x1400064c1
mov eax, edx
and eax, esi
jge 0x140006483
sub eax, r15d
or eax, 0xfffffffe
add eax, r15d
neg eax
movzx eax, word [r8]
sbb ecx, ecx
sub eax, 0x37
and ecx, 0xfffffff1
add ecx, 0x10
imul ecx, eax
cmp edx, 0x20
jge 0x1400065aa
mov eax, edx
test edx, edx
jns 0x1400064aa
lea eax, [r15 + rdx]
sar eax, 1
add edx, r15d
cdqe
or byte [rbp + rax + 0xc60], cl
add r8, 2
jmp 0x140006438
cmp edx, 0x20
jne 0x1400065aa
xor ebx, ebx
mov byte [rsp + 0x60], r13b
mov r14b, r13b
mov r15b, bl
mov r12b, bl
mov byte [rsp + 0x70], bl
cmp word [r8], bx
je 0x1400064e8
add r8, 2
cmp word [r8], 0x43
jne 0x1400064f9
mov byte [rsp + 0x60], 1
jmp 0x1400065bb
cmp word [r8], 0x55
jne 0x140006511
mov eax, 1
mov byte [rsp + 0x60], al
mov r15b, al
jmp 0x1400065bb
cmp word [r8], r10w
jne 0x140006528
mov eax, 1
mov r12b, al
mov byte [rsp + 0x70], al
jmp 0x1400065bb
cmp word [r8], 0x4d
je 0x140006554
mov eax, 0x52
cmp word [r8], ax
je 0x140006541
cmp word [r8], 0x45
jne 0x1400065bb
cmp word [r8], ax
mov eax, 1
movzx r13d, r13b
cmove r13d, eax
jmp 0x14000655f
mov eax, 1
mov r13b, al
mov r14b, al
add r8, 4
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140007052
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1400065b4
mov edx, esi
lea rcx, str.ServerMain__CA_:_Wait_on_synchronization_event_failed
call fcn.140004818
mov edi, 0x641
jmp 0x1400070ab
mov rsi, 0xffffffff80000001
or qword [rsp + 0x68], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 2
lea r9, [rsp + 0x68]
mov rcx, rax
lea r8d, [rdx - 1]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x1400065f5
or qword [rsp + 0x68], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x1400065aa
test r14b, r14b
jne 0x140006600
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test r14b, r14b
je 0x140006625
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor r14d, r14d
cmp byte [0x1400100da], r14b
mov esi, r14d
setne sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 8]
lea edx, [r14 + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400066f7
cmp byte [0x14000fb58], r14b
jne 0x14000666d
lea rcx, [rbp + 0x10]
call fcn.140001534
mov rbx, qword [rbp + 0x10]
jmp 0x140006677
lea rbx, [0x140010140]
mov eax, r14d
test eax, eax
jne 0x1400066eb
mov rcx, qword [rbp - 8]
lea rax, [rbp]
mov r9d, 0x58
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xce0]
lea edx, [r9 - 0x57]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400066eb
mov rcx, qword [rbp + 0xce0]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov r9b, byte [0x1400100da]
mov esi, r14d
mov cl, r13b
neg cl
mov cl, r13b
sbb edx, edx
and edx, 0xfffffffe
add edx, 5
neg cl
sbb r8d, r8d
and r8d, 0xfffffffe
add r8d, 4
test r9b, r9b
cmovne r8d, edx
setne sil
test eax, eax
cmovne esi, r8d
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000672e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
lea rcx, [rbp + 0x1640]
mov r8d, 0x208
mov ebx, eax
call sub.msvcrt.dll_memset
mov r9d, ebx
lea r8, str.OpenProcessToken_failed_with__d
mov edx, 0x104
lea rcx, [rbp + 0x1640]
call fcn.1400012e0
test r15b, r15b
mov r15d, 1
je 0x140006742
cmp esi, r15d
jne 0x140006752
lea esi, [r15 + 8]
test r12b, r12b
je 0x140006779
test esi, esi
jne 0x14000676b
mov esi, 6
jmp 0x140006779
test esi, esi
jne 0x14000675d
mov esi, 8
jmp 0x140006742
xor edx, edx
lea rcx, str.ServerMain__CA_:_Error:_icacContext_in_CA_server_should_be_EEUI_but_is_not_any_impersonated_type
jmp 0x1400065a5
cmp esi, r15d
jne 0x1400065aa
mov esi, 7
mov r12d, 0x100
mov r8d, 3
mov dword [rbp - 0x38], r12d
cmp esi, r15d
jbe 0x140006796
lea eax, [rsi - 6]
cmp eax, r8d
ja 0x14000679c
mov r8d, 2
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0xd40]
call fcn.140001634
mov ebx, eax
test eax, eax
je 0x1400067cc
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x1400070ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400070ad
movsxd rbx, dword [rbp - 0x38]
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x58], ebx
mov dword [rbp - 0x2c], ebx
mov dword [rbp - 0x30], ebx
mov dword [rbp - 0x34], ebx
mov dword [rbp + 0x3c8], ebx
cmp ebx, r12d
jle 0x14000680d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [rbp - 0x58]
mov qword [rbp + 0x3c0], rax
test rax, rax
jne 0x14000682c
mov dword [rbp + 0x3c8], r14d
jmp 0x14000682c
mov r8, r12
lea rcx, [rbp + 0x3d0]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x3d0]
mov qword [rbp + 0x3c0], rax
mov dword [rbp + 0x5e8], ebx
cmp ebx, r12d
jle 0x140006857
movsxd rdx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x5e0], rax
test rax, rax
jne 0x140006876
mov dword [rbp + 0x5e8], r14d
jmp 0x140006876
mov r8, r12
lea rcx, [rbp + 0x5f0]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x5f0]
mov qword [rbp + 0x5e0], rax
movsxd rax, dword [rbp - 0x2c]
mov dword [rbp + 0x4d8], eax
cmp eax, r12d
jle 0x1400068a5
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x4d0], rax
test rax, rax
jne 0x1400068c4
mov dword [rbp + 0x4d8], r14d
jmp 0x1400068c4
mov r8, r12
lea rcx, [rbp + 0x4e0]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x4e0]
mov qword [rbp + 0x4d0], rax
movsxd rax, dword [rbp - 0x30]
mov dword [rbp + 0x2b8], eax
cmp eax, r12d
jle 0x1400068f6
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp + 0x2b0], rax
mov rbx, rax
test rax, rax
jne 0x140006915
mov dword [rbp + 0x2b8], r14d
jmp 0x140006915
mov r8, r12
lea rcx, [rbp + 0x2c0]
xor edx, edx
call sub.msvcrt.dll_memset
lea rbx, [rbp + 0x2c0]
mov qword [rbp + 0x2b0], rbx
movsxd rax, dword [rbp - 0x34]
mov dword [rbp + 0x6f8], eax
cmp eax, r12d
jle 0x14000694b
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, qword [rbp + 0x2b0]
mov qword [rbp + 0x6f0], rax
test rax, rax
jne 0x14000696a
mov dword [rbp + 0x6f8], r14d
jmp 0x14000696a
mov r8, r12
lea rcx, [rbp + 0x700]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x700]
mov qword [rbp + 0x6f0], rax
mov r9, qword [rbp + 0x5e0]
lea rcx, [rbp - 0x34]
mov rdx, qword [rbp + 0x3c0]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0xd40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x4d0]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_MakeAbsoluteSD]
test eax, eax
jne 0x1400069e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x68]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140006edb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006edb
mov rcx, qword [rbp + 0x3c0]
xor r9d, r9d
mov rax, qword [0x14000e040]
xor r8d, r8d
mov qword [rsp + 0x40], r14
or edx, 0xffffffff
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 3
call qword [0x14000a5d8]
mov ebx, eax
test eax, eax
je 0x140006a4a
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x140006a3c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
lea rcx, str.ServerMain__CA_:_CoInitializeSecurity_failed
jmp 0x140006ed1
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r15, rax
test rax, rax
je 0x140006a7b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r12, rax
test rax, rax
jne 0x140006a95
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x140006ed6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006ed6
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x40], r14
call fcn.140005178
mov rbx, rax
test rax, rax
jne 0x140006ad2
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x140006abf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, str.ServerMain__CA_:_Connection_to_Service_failed.
call fcn.140004818
jmp 0x140006d16
mov dword [rbp - 0x50], r14d
mov dword [rbp - 0x28], r14d
call fcn.14000250c
mov r14, rax
xor eax, eax
test r14, r14
je 0x140006c0c
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140006b05
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
xor eax, eax
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rax, qword [r14]
lea rdx, [0x14000b5f0]
mov rcx, r14
mov rax, qword [rax]
call qword [0x14000a5d8]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
mov rcx, qword [rbp - 0x40]
xor r14d, r14d
mov dword [rbp - 0x54], esi
test rcx, rcx
je 0x140006b4f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x40], r14
mov rax, qword [rbx]
lea r8, [rbp + 0xc60]
mov qword [rsp + 0x38], rcx
lea rdx, [rbp - 0x54]
lea rcx, [rbp - 0x40]
mov r9d, 0x10
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x50]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [0x14000a5d8]
test eax, eax
je 0x140006bb9
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x140006bad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.ServerMain__CA_:_Process_not_registered_with_service.
jmp 0x140006cff
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x140006bf7
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x140006be3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Could_not_open_synchronization_handle.
jmp 0x140006d01
mov rcx, qword [rbp - 0x40]
mov rax, qword [0x14000e050]
call qword [0x14000a5d8]
test eax, eax
jne 0x140006c26
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x140006d06
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006d06
mov rcx, qword [rbp - 0x80]
lea r8, [rbp - 0x68]
lea rdx, [0x14000b690]
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x14000a5d8]
xor eax, eax
mov edx, eax
cmp esi, dword [rbp - 0x54]
jne 0x140006c54
lea eax, [rsi - 8]
lea ecx, [rdx + 1]
cmp eax, ecx
ja 0x140006c58
lea rdx, [rbp - 0x54]
mov rcx, qword [rbp - 0x68]
lea r8, [rbp + 0xc60]
mov rax, qword [rcx]
mov rax, qword [rax + 0x140]
call qword [0x14000a5d8]
mov rcx, qword [rbp - 0x68]
mov rdx, r15
mov rax, qword [rcx]
mov rax, qword [rax + 0x150]
call qword [0x14000a5d8]
mov rcx, qword [rbp - 0x68]
mov rdx, r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x158]
call qword [0x14000a5d8]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbp - 0x68]
mov r9b, byte [rsp + 0x70]
mov r8b, byte [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov edx, dword [rbp - 0x28]
mov rax, qword [rcx]
mov dword [rsp + 0x28], edx
mov edx, dword [rbp - 0x50]
mov byte [rsp + 0x20], r13b
mov rax, qword [rax + 0x148]
call qword [0x14000a5d8]
mov rcx, qword [rsp + 0x68]
mov esi, eax
cmp rcx, 0xffffffffffffffff
je 0x140006cf1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rsp + 0x68], 0xffffffffffffffff
xor r13d, r13d
test esi, esi
je 0x140006d4b
lea rcx, str.ServerMain__CA_:_Impersonation_token_not_saved.
xor edx, edx
call fcn.140004818
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140006d2c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140006ed6
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
jmp 0x140006ed6
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x138]
call qword [0x14000a5d8]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140006d89
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140006d9f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
xor r8d, r8d
mov qword [rbp + 0xb50], r12
mov r12d, 0x1cff
mov qword [rbp + 0xb40], r14
or r9d, 0xffffffff
mov qword [rbp + 0xb48], r15
lea rdx, [rbp + 0xb40]
mov dword [rsp + 0x20], r12d
lea ecx, [r8 + 3]
mov bl, r13b
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x140006f78
mov esi, 1
cmp eax, esi
je 0x140006f6f
cmp eax, 2
jne 0x140006e3b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], r13d
mov rax, qword [rcx]
mov rax, qword [rax + 0x160]
call qword [0x14000a5d8]
mov r8d, dword [rbp - 0x70]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x140006eb1
mov qword [rbp + 0xb40], rax
jmp 0x140006e87
cmp eax, 3
jne 0x140006f78
jmp 0x140006e60
cmp dword [rbp + 0x20], 0x12
je 0x140006e7c
lea rcx, [rbp + 0x18]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x18]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, [rbp + 0x18]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140006e46
jmp 0x140006e7f
mov bl, sil
test bl, bl
jne 0x140006f78
xor r8d, r8d
mov dword [rsp + 0x20], r12d
or r9d, 0xffffffff
lea rdx, [rbp + 0xb40]
lea ecx, [r8 + 3]
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x140006f78
jmp 0x140006de7
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x140006ec2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Could_not_open_synchronization_handle.
call fcn.140004818
mov edi, 0x641
mov ebx, 0x100
cmp dword [rbp + 0x6f8], ebx
jle 0x140006efa
mov rcx, qword [rbp + 0x6f0]
test rcx, rcx
je 0x140006efa
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0x2b8], ebx
jle 0x140006f14
mov rcx, qword [rbp + 0x2b0]
test rcx, rcx
je 0x140006f14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0x4d8], ebx
jle 0x140006f2e
mov rcx, qword [rbp + 0x4d0]
test rcx, rcx
je 0x140006f2e
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0x5e8], ebx
jle 0x140006f48
mov rcx, qword [rbp + 0x5e0]
test rcx, rcx
je 0x140006f48
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0x3c8], ebx
jle 0x1400070af
mov rcx, qword [rbp + 0x3c0]
test rcx, rcx
je 0x1400070af
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1400070af
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14000a5d8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x100
cmp dword [rbp + 0x6f8], ebx
jle 0x140006fb1
mov rcx, qword [rbp + 0x6f0]
test rcx, rcx
je 0x140006fb1
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0x2b8], ebx
jle 0x140006fcb
mov rcx, qword [rbp + 0x2b0]
test rcx, rcx
je 0x140006fcb
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0x4d8], ebx
jle 0x140006fe5
mov rcx, qword [rbp + 0x4d0]
test rcx, rcx
je 0x140006fe5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0x5e8], ebx
jle 0x140006fff
mov rcx, qword [rbp + 0x5e0]
test rcx, rcx
je 0x140006fff
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp + 0x3c8], ebx
jle 0x140007019
mov rcx, qword [rbp + 0x3c0]
test rcx, rcx
je 0x140007019
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [rbp - 0x4c], r13d
je 0x140007038
cmp dword [0x14000fc14], r13d
jne 0x140007038
mov ecx, dword [0x14000f75c]
test ecx, ecx
je 0x140007038
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rbp - 0x24], r13d
je 0x1400070af
mov edi, 0x641
mov ecx, edi
call fcn.140004a20
jmp 0x1400070af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ServerMain__CA_:_Open_synchronization_event_failed
jmp 0x1400065a5
xor r9d, r9d
lea rcx, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14000708e
cmp dword [0x14000feb0], r13d
je 0x140007019
cmp dword [0x14000fc10], r13d
je 0x140007019
lea rcx, [rbp + 0x48]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x48]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140007066
mov ebx, 0x65b
mov edi, ebx
mov ebx, edi
mov edi, ebx
cmp dword [rbp + 0x98], 0x104
jle 0x1400070c8
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rax, [rbp + 0xa0]
mov dword [rbp + 0x98], 0x104
mov qword [rbp + 0x90], rax
mov eax, 1
cmp dword [rbp + 0x80], eax
jle 0x1400070f7
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
mov rcx, qword [rbp + 0x2850]
xor rcx, rsp
call fcn.140008e00
lea r11, [rsp + 0x2960]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret