Function at 0x10000a138
Capabilities:
Create thread

Disassembly:
lea rdi, [0x100039960]
mov qword [rsp + 0x58], r12
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x860]
call fcn.100003570
mov r14d, eax
cmp eax, r12d
jge 0x1000140fe
cmp r14d, 0x800705b4
cmove r14d, r12d
lea rcx, [rsp + 0x58]
call fcn.100002f68
cmp r14d, r12d
jge 0x1000034df
mov edi, r12d
mov eax, dword [rsp + 0x50]
cmp edi, eax
jae 0x10000e4d2
mov ecx, edi
imul rcx, rcx, 0x3f8
cmp qword [rsp + rcx + 0x12f0], r12
je 0x100003565
cmp qword [rsp + rcx + 0x12f0], r12
je 0x100003565
mov dword [rsp + rcx + 0x1308], 1
mov rcx, qword [rsp + rcx + 0x12f8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rsp + 0x50]
inc edi
jmp 0x100003523
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x10000e614
mov rbx, rdx
mov r14d, ecx
xor r9d, r9d
xor r8d, r8d
lea r15d, [r9 + 1]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov ecx, r15d
call qword [sym.imp.msvcrt.dll__set_error_mode]
or ecx, 0xffffffff
call sub.IMM32.dll_ImmDisableIME
xor r12d, r12d
cmp dword [0x100039a98], r12d
jne 0x1000139e8
mov dword [0x100039a98], r15d
cmp dword [0x100039a88], r12d
jne 0x1000139dc
mov dword [0x100039a88], r15d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x100039a80], rax
jmp 0x100008ca7
lea rdx, str.WerSetFlags
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x100039a90], rax
jmp 0x100008cc0
cmp rax, r12
je 0x1000139f4
mov ecx, 2
call rax
jmp 0x100008cd2
cmp eax, r12d
jl 0x1000139fe
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x100008ce6
call qword [sym.imp.MSSHooks.dll_LoadMSSearchHooks]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
mov dword [rsp + 0x98], eax
lea rcx, [rsp + 0x88]
call fcn.10000ad70
mov rcx, qword [rsp + 0x88]
cmp rcx, r12
jne 0x100013a0f
call fcn.10000a114
mov dword [rsp + 0x50], r12d
lea rax, [fcn.10000e334]
mov qword [rsp + 0x20], rax
lea r9, [0x10000b0c4]
mov r13d, 0x20
mov r8d, r13d
mov edx, 0x3f8
lea rcx, [rsp + 0x12e0]
call fcn.100009904
nop
mov qword [rsp + 0x3c8], r12
lea rax, [0x100029ae8]
mov qword [rsp + 0x3c0], rax
mov qword [rsp + 0x3d0], r12
mov qword [rsp + 0x3e0], r12
mov dword [rsp + 0x3e8], r15d
mov dword [rsp + 0x3ec], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x3d8], rax
lea rax, [0x100029b18]
mov qword [rsp + 0x3c0], rax
lea rax, [rsp + 0x410]
mov qword [rsp + 0x400], rax
mov dword [rsp + 0x408], 0x21
mov dword [rsp + 0x40c], r12d
mov word [rsp + 0x410], r12w
lea rax, [0x1000297b8]
mov qword [rsp + 0x3f8], rax
lea r9, [0x100039138]
lea r8, [0x100039928]
lea rdx, [0x10000b48c]
lea rcx, [0x10002a2b8]
call fcn.10000b454
cmp dword [0x10003994c], r12d
je 0x100008e3e
mov al, byte [0x100039950]
cmp al, 4
jb 0x100013a33
movabs rdi, 0x8000000000004000
test qword [0x100039938], rdi
jne 0x100013a41
mov ecx, 0x38
call qword [0x100039920]
mov qword [rsp + 0x90], rax
cmp rax, r12
je 0x100013a79
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
mov r9d, 0x11
lea rdx, [0x1000046a0]
mov r8, rdx
mov rcx, rax
call fcn.1000097e0
jmp 0x100008e81
mov qword [0x1000390f8], rax
cmp rax, r12
je 0x100013a81
cmp rbx, r12
je 0x10001424d
cmp r14d, r12d
je 0x10001424d
cmp r14d, 9
jl 0x100014209
lea rdx, str.DownLevelDaemon
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r12d
jne 0x100014209
mov rdx, qword [rbx + 8]
mov qword [rsp + 0x90], rdx
cmp rdx, r12
je 0x1000141c5
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, r15
je 0x1000141c5
lea rax, [0x1000298a0]
mov qword [rsp + 0x640], rax
lea rax, [rsp + 0x658]
mov qword [rsp + 0x648], rax
mov dword [rsp + 0x650], 0x42
or edi, 0xffffffff
mov r8d, edi
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x640]
call fcn.100004990
lea rax, [0x1000298e0]
mov qword [rsp + 0x640], rax
cmp dword [rsp + 0x654], r12d
je 0x100013acb
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x50], eax
cmp eax, r12d
je 0x100014180
cmp eax, r13d
ja 0x100014180
mov ecx, r12d
cmp eax, r15d
seta cl
mov dword [0x100039088], ecx
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.msvcrt.dll__wtoi]
movsxd rdx, eax
mov qword [0x1000390c0], rdx
mov r8, qword [rbx + 0x28]
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0x20], r12
mov r9d, 0x20019
lea rcx, [rsp + 0x7a0]
call fcn.100008a50
nop
mov r9d, 0x20019
lea r8, str.Gathering_Manager
lea rdx, [rsp + 0x7a0]
lea rcx, [rsp + 0x6e0]
call fcn.100008b20
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rsp + 0x790], r12
je 0x100013b15
lea r8, [rsp + 0x58]
lea rdx, str.DebugFilters
lea rcx, [rsp + 0x6e0]
call fcn.100009684
cmp eax, r12d
je 0x100009026
mov eax, dword [0x100039084]
cmp dword [rsp + 0x58], r12d
cmovne eax, r15d
mov dword [0x100039084], eax
lea rax, [0x1000298a0]
mov qword [rsp + 0x5e0], rax
lea rax, [rsp + 0x5f8]
mov qword [rsp + 0x5e8], rax
mov dword [rsp + 0x5f0], 0x21
mov r8d, edi
mov rdx, qword [rbx + 0x30]
lea rcx, [rsp + 0x5e0]
call fcn.100004990
lea rax, [0x1000297b8]
mov qword [rsp + 0x5e0], rax
cmp dword [rsp + 0x5f4], r12d
je 0x100013b25
mov edi, r12d
cmp r14d, 0xa
jge 0x10000d59d
call fcn.10000a9d4
cmp eax, r12d
jl 0x100013bb6
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xc0], r12
lea rcx, [rsp + 0xa0]
call fcn.100009e30
cmp eax, r12d
jl 0x1000090e3
lea rcx, [rsp + 0xa0]
call fcn.10000ab34
mov qword [rsp + 0x88], r12
lea rdx, [rsp + 0x88]
mov ecx, 0x11
call fcn.100009974
cmp eax, r12d
jl 0x100013bfd
lea rdx, [rsp + 0x60]
mov rbx, qword [rsp + 0x88]
mov rcx, rbx
call fcn.100009cc0
cmp eax, r12d
jl 0x100009132
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa0]
call fcn.100009b98
cmp edi, r12d
jne 0x10000d4e6
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, r12d
jl 0x100013c44
lea rdx, [0x100039988]
mov r14, qword [rsp + 0xc8]
mov rcx, r14
call fcn.10000c098
mov rcx, r14
call fcn.10000ba30
cmp eax, r12d
jl 0x100013c8b
lea rdx, [0x100039998]
mov rcx, r14
call fcn.10000c318
cmp eax, r12d
jl 0x100013cdd
cmp dword [0x100039998], r12d
je 0x100013cdd
mov dword [0x100039054], r12d
jmp 0x1000091d0
mov dword [0x10003907c], r15d
lea rax, [0x1000298a0]
mov qword [rsp + 0x580], rax
lea rax, [rsp + 0x598]
mov qword [rsp + 0x588], rax
mov dword [rsp + 0x590], 0x21
or edi, 0xffffffff
mov r8d, edi
mov rdx, qword [rsp + 0x648]
lea rcx, [rsp + 0x580]
call fcn.100004990
lea rax, [0x1000297b8]
mov qword [rsp + 0x580], rax
mov r9d, edi
mov r8d, dword [rsp + 0x594]
lea rdx, [0x10002a010]
lea rcx, [rsp + 0x580]
call qword [fcn.100003a84]
mov r8, qword [rsp + 0x588]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rdi, rax
mov rcx, qword [0x100039168]
cmp rax, rcx
je 0x100009278
cmp rcx, r12
jne 0x100013cf3
mov qword [0x100039168], rdi
cmp rdi, r12
je 0x100013cff
mov dword [0x100039080], 3
lea rdx, [0x100039080]
mov rcx, r14
call fcn.10000c400
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100039078], eax
mov word [rsp + 0x468], r12w
mov word [rsp + 0x46a], r12w
mov qword [rsp + 0x470], r12
mov qword [rsp + 0x478], r12
mov qword [rsp + 0x480], r12
lea rax, [0x1000298d8]
mov qword [rsp + 0x4a8], rax
mov qword [rsp + 0x4b0], r12
mov qword [rsp + 0x4b8], r12
mov qword [rsp + 0x4c0], rax
mov qword [rsp + 0x4c8], r12
mov qword [rsp + 0x4d0], rax
mov qword [rsp + 0x4d8], r12
mov qword [rsp + 0x4e0], rax
mov qword [rsp + 0x4e8], r12
mov qword [rsp + 0x4f0], rax
mov qword [rsp + 0x4f8], r12
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x508], r12
mov eax, 0x2000
mov dword [rsp + 0x510], eax
mov dword [rsp + 0x514], eax
mov dword [rsp + 0x518], 0x1d4c0
lea rax, [rsp + 0x538]
mov qword [rsp + 0x528], rax
mov dword [rsp + 0x530], 0x21
mov dword [rsp + 0x534], r12d
mov word [rsp + 0x538], r12w
lea rax, [0x100029950]
mov qword [rsp + 0x520], rax
lea rax, [0x100029860]
mov qword [rsp + 0x460], rax
mov rdx, qword [rsp + 0x648]
lea rcx, [rsp + 0x460]
call fcn.10000cbd4
cmp eax, r12d
jl 0x100013d5b
mov rax, qword [0x100039168]
mov qword [rsp + 0x470], rax
mov eax, dword [rsp + 0x518]
mov edi, 0x7530
cmp dword [0x100039084], r12d
cmovne eax, edi
mov dword [rsp + 0x518], eax
mov ecx, dword [0x100039078]
mov rax, qword [rsp + 0x4b8]
mov dword [rax], ecx
not ecx
mov rax, qword [rsp + 0x4b8]
mov dword [rax + 4], ecx
lea rcx, [rsp + 0x460]
call fcn.10000cf10
cmp eax, r12d
jl 0x100013da2
mov dword [rsp + 0x518], edi
lea rcx, [rsp + 0x860]
call fcn.100004180
nop
lea rax, [rsp + 0x460]
mov qword [rsp + 0xc88], rax
lea rcx, [rsp + 0x860]
call fcn.10000c5a0
cmp eax, r12d
jl 0x100013de9
or r14d, 0xffffffff
mov dword [rsp + 0x518], r14d
mov dword [rsp + 0x54], r12d
lea rdx, [rsp + 0x54]
mov rcx, qword [0x100039158]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, r12d
je 0x100013e4b
mov rax, qword [0x100039158]
mov qword [rsp + 0x478], rax
lea rdx, [rsp + 0x54]
mov rcx, qword [0x100039178]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, r12d
je 0x100013ea7
lea rdx, [rsp + 0x54]
mov rcx, qword [0x100039188]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
cmp eax, r12d
je 0x100013f03
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [0x1000391a8]
cmp rax, rcx
je 0x1000094ff
cmp rcx, r12
jne 0x100013f5f
mov qword [0x1000391a8], rdi
cmp rdi, r12
je 0x100013f6b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov rcx, qword [0x1000391b8]
cmp rax, rcx
je 0x100009537
cmp rcx, r12
jne 0x100013fc7
mov qword [0x1000391b8], rdi
cmp rdi, r12
je 0x100013fd3
mov r9d, r14d
xor r8d, r8d
mov rdx, qword [rsp + 0x5e8]
lea rcx, [rsp + 0x3f8]
mov rax, qword [rsp + 0x3f8]
call qword [rax + 0x20]
cmp qword [rsp + 0x3d0], r12
jne 0x1000095c2
mov dword [rsp + 0x3e8], r12d
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x3c0]
lea r8, [0x100003354]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x3d0], rax
cmp rax, r12
je 0x10001402f
mov r9d, r12d
cmp r9d, r12d
jl 0x10001404c
call fcn.10000cb4c
cmp eax, r12d
je 0x100014090
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100000
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x64], 0x200000
mov dword [rsp + 0x60], r15d
jmp 0x1000095f3
mov edi, r12d
cmp edi, dword [rsp + 0x50]
jae 0x1000034d8
mov r14d, edi
imul r14, r14, 0x3f8
lea rcx, [rsp + r14 + 0x1638]
mov rax, qword [rcx]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
call qword [rax + 0x20]
lea r14, [rsp + r14 + 0x12e0]
cmp qword [r14 + 0x10], r12
jne 0x100009674
mov dword [r14 + 0x28], r12d
lea rax, [r14 + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, r14
lea r8, [0x10000c4e4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14 + 0x10], rax
cmp rax, r12
je 0x10001409d
mov r9d, r12d
cmp r9d, r12d
jl 0x1000140ba
inc edi
jmp 0x1000095f6
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x9200
call fcn.100003a00
sub rsp, rax
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rsp + 0x9230], rbx
mov qword [rsp + 0x9240], rsi
mov rax, qword [0x1000390b0]
xor rax, rsp
mov qword [rsp + 0x91f0], rax
jmp 0x100008c3a
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
jmp 0x100009171
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.msvcrt.dll__wtoi]
mov edi, eax
cmp eax, r15d
jne 0x10000908e
call fcn.10000d5d8
cmp eax, r12d
jl 0x100013b6f
cmp qword [0x100039108], r12
jne 0x10000908e
jmp 0x100013b6f
cmp r15d, r12d
je 0x10000e4eb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, dword [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
nop
lea rcx, [rsp + 0x860]
call fcn.1000030a0
nop
lea rcx, [rsp + 0x460]
call fcn.10000dd98
nop
lea r14, [0x1000297b8]
mov qword [rsp + 0x580], r14
mov rcx, qword [rsp + 0x588]
cmp rcx, r12
je 0x10000e536
lea rax, [rsp + 0x598]
cmp rcx, rax
je 0x10000e536
call qword [sym.imp.msvcrt.dll_free]
lea rdi, [0x1000298a0]
mov qword [rsp + 0x580], rdi
cmp rbx, r12
je 0x10000e554
mov rcx, rbx
call qword [case.0x10000aeca.0]
nop
mov rcx, qword [rsp + 0xa0]
call qword [case.0x10000aeca.0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.msvcrt.dll_free]
nop
mov qword [rsp + 0x5e0], r14
mov rcx, qword [rsp + 0x5e8]
cmp rcx, r12
je 0x10000e5c3
lea rax, [rsp + 0x5f8]
cmp rcx, rax
je 0x10000e5c3
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsp + 0x5e0], rdi
lea rcx, [rsp + 0x6e0]
call fcn.1000032d0
nop
lea rcx, [rsp + 0x7a0]
call fcn.1000032d0
nop
lea rax, [0x1000298e0]
mov qword [rsp + 0x640], rax
mov rcx, qword [rsp + 0x648]
cmp rcx, r12
je 0x10000e614
lea rax, [rsp + 0x658]
cmp rcx, rax
jne 0x1000084d0
movabs r14, 0x8000000000004000
jmp 0x10000e620
mov eax, dword [rsp + 0x50]
cmp eax, r12d
jbe 0x10000e673
lea rdi, [rsp + 0x12f0]
mov rbx, rax
cmp qword [rdi], r12
je 0x10000e65c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [rdi + 0x20]
je 0x10000e650
or edx, 0xffffffff
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r12
lea rcx, [rdi - 0x10]
mov rax, qword [rcx]
call qword [rax + 0x10]
add rdi, 0x3f8
sub rbx, 1
jne 0x10000e634
cmp qword [rsp + 0x3d0], r12
je 0x10000e6d6
mov dword [rsp + 0x3e8], 1
mov rcx, qword [rsp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [rsp + 0x3d0], r12
je 0x10000e6d6
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [rsp + 0x3f0]
je 0x10000e6c0
or edx, 0xffffffff
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x3d0], r12
lea rcx, [rsp + 0x3c0]
mov rax, qword [rsp + 0x3c0]
call qword [rax + 0x10]
mov rcx, qword [0x1000390c8]
cmp rcx, r12
je 0x10000e702
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1000390c8], r12
mov rcx, qword [0x1000390f8]
cmp rcx, r12
je 0x10000e71f
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [0x1000390f8], r12
mov rcx, qword [0x100039108]
call qword [case.0x10000aeca.0]
mov qword [0x100039108], r12
mov rcx, qword [0x100039110]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [0x100039110], r12
cmp dword [0x10003994c], r12d
je 0x10000e76b
mov al, byte [0x100039950]
cmp al, 4
jb 0x1000142b0
test qword [0x100039938], r14
jne 0x1000142be
lea rcx, [0x100039138]
call fcn.10000db80
nop
lea rcx, [rsp + 0x3c0]
call fcn.10000dbb0
nop
lea r9, [fcn.10000e334]
mov r8d, r13d
mov edx, 0x3f8
lea rcx, [rsp + 0x12e0]
call fcn.10000e7ec
nop
call fcn.10000e240
nop
cmp esi, r12d
jl 0x10000e7b4
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rcx, qword [rsp + 0x91f0]
xor rcx, rsp
call fcn.100001c80
lea r11, [rsp + 0x9200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [0x100039a80]
jmp 0x100008ca7
mov rax, qword [0x100039a90]
jmp 0x100008cc0
mov eax, 0x8007007f
jmp 0x100008cd2
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
nop
jmp 0x100008ce6
lea rdx, str.AccessDebugTracer
call sub.KERNEL32.dll_GetProcAddress
cmp rax, r12
je 0x100008d1d
lea rcx, [0x100039910]
call rax
nop
jmp 0x100008d1d
cmp al, r12b
je 0x100008e27
jmp 0x100008e3e
mov rcx, qword [0x100039940]
mov rax, rcx
and rax, rdi
cmp rax, rcx
jne 0x100008e3e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x10002eb28]
mov rcx, qword [0x100039138]
call fcn.10001f3fc
nop
jmp 0x100008e3e
mov rax, r12
jmp 0x100008e81
mov r9d, 0x8007000e
mov r8d, 0x3d1
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x2d8]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x2d8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100008e91
mov r9d, 0x80070057
mov r8d, 0x3e9
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x238]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x238]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100008f52
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100009026
mov r9d, 0x80070057
mov r8d, 0x40d
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x278]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x278]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100009081
mov r9d, eax
mov r8d, 0x41d
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x118]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x118]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000908e
mov r9d, eax
mov r8d, 0x423
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x2f8]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x2f8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000909c
mov r9d, eax
mov r8d, 0x42b
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x158]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x158]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100009106
mov r9d, eax
mov r8d, 0x43d
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x378]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x378]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000917a
cmp eax, 0x80040d37
je 0x1000091a2
mov r9d, eax
mov r8d, 0x44d
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x198]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x198]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x1000091a2
mov dword [0x100039998], 4
mov dword [0x100039054], r15d
jmp 0x1000091d0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x100009278
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, r12d
cmovle r9d, eax
mov r8d, 0x46d
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x338]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x338]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100009288
mov r9d, eax
mov r8d, 0x482
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x1d8]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x1d8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x1000093cc
mov r9d, eax
mov r8d, 0x495
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x2b8]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x2b8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000942b
cmp eax, 0x800705b4
cmove eax, r12d
cmp eax, r12d
jge 0x100009450
cmp eax, r12d
jge 0x100009466
mov r9d, eax
mov r8d, 0x4aa
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x218]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x218]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100009466
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, r12d
cmovle r9d, eax
mov r8d, 0x4b2
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0xd8]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0xd8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100009492
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, r12d
cmovle r9d, eax
mov r8d, 0x4b9
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x258]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x258]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x1000094bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, r12d
cmovle r9d, eax
mov r8d, 0x4bf
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x318]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x318]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x1000094d7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1000094ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, r12d
cmovle r9d, eax
mov r8d, 0x4c5
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x298]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x298]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000950f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x100009537
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, r12d
cmovle r9d, eax
mov r8d, 0x4cb
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x358]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x358]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100009547
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, r12d
cmovle r9d, eax
jmp 0x1000095b9
mov r8d, 0x4d2
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x398]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x398]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x1000095c2
mov r15d, r12d
mov dword [rsp + 0x60], r12d
jmp 0x1000095f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, r12d
cmovle r9d, eax
jmp 0x10000966b
mov r8d, 0x4dc
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0xf8]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0xf8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x100009674
mov qword [rsp + 0x90], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rdx, qword [rsp + 0x58]
mov rcx, qword [0x1000390f8]
call fcn.1000045dc
mov rax, qword [rax]
cmp rax, r12
je 0x100014168
add rax, 0x268
lea rcx, [rax + 8]
neg rax
sbb rdx, rdx
and rdx, rcx
mov rcx, rdx
cmp rdx, r12
je 0x100014168
cmp rcx, r12
je 0x100014168
mov rcx, qword [rcx]
lea rax, [rdx + 8]
cmp rcx, rax
cmove rcx, r12
cmp rcx, r12
je 0x100014168
mov dword [rcx + 0x9f0], 1
jmp 0x10001413f
cmp rdi, r12
je 0x100003502
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x100003502
mov r9d, 0x80070057
mov r8d, 0x3f1
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x138]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x138]
call sub.msvcrt.dll__CxxThrowException
nop
mov r9d, 0x80070057
mov r8d, 0x3e2
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x178]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x178]
call sub.msvcrt.dll__CxxThrowException
mov r9d, 0x80070057
mov r8d, 0x3db
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x1b8]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x1b8]
call sub.msvcrt.dll__CxxThrowException
mov r9d, 0x80070057
mov r8d, 0x3d6
lea rdx, str.d:win7sp1_gdrendusermssearch2_search_searchgather_fltrdmn_fltrdaemon.cxx
lea rcx, [rsp + 0x68]
call fcn.10001c3e0
lea rcx, [rsp + 0x1f8]
mov rdx, rax
mov r8, r13
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x1f8]
call sub.msvcrt.dll__CxxThrowException
nop
xor r12d, r12d
lea r13d, [r12 + 0x20]
movabs r14, 0x8000000000004000
mov esi, dword [rsp + 0x98]
jmp 0x10000e620
cmp al, r12b
je 0x10000e75e
jmp 0x10000e76b
mov rdx, qword [0x100039940]
mov rax, rdx
and rax, r14
cmp rax, rdx
jne 0x10000e76b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x10002eb38]
mov rcx, qword [0x100039138]
call fcn.10001f3fc
nop
jmp 0x10000e76b