Function at 0x14007c2a0
Capabilities:
Create process on windows
Get hostname

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x478]
sub rsp, 0x578
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov rbx, r9
mov r13d, r8d
mov qword [rsp + 0x40], rdx
mov rsi, rcx
mov rdi, qword [rbp + 0x4e0]
mov r15, qword [rbp + 0x4e8]
cmp dword [rbp + 0x4f0], 0
jne 0x14007d780
cmp r8d, 0x470
jne 0x14007c326
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
mov edx, r13d
call fcn.140072020
mov qword [r15], rax
mov eax, 1
jmp 0x14007d782
cmp r13d, 0x46e
jne 0x14007c366
cmp byte [rcx + 0x581], 0
jne 0x14007c34f
lea edx, [r13 - 0x63]
mov r8d, 0x100
mov rcx, qword [rcx + 0x388]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.14009bfe4
xor r14d, r14d
mov qword [r15], r14
lea eax, [r14 + 1]
jmp 0x14007d782
mov r12d, 1
xor r14d, r14d
cmp r13d, 5
jne 0x14007c3b3
cmp rbx, r12
je 0x14007c382
mov edx, r12d
call fcn.140080f90
cmp qword [rsi + 0x500], r14
je 0x14007c3ab
lea rcx, [rsi + 0x420]
mov rax, rdi
shr rax, 0x10
movsx edx, ax
sub edx, 0xc8
movzx r8d, r12b
call fcn.14007f280
mov qword [r15], r14
jmp 0x14007c45f
cmp r13d, r12d
jne 0x14007c3dd
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
mov edx, r12d
call fcn.1400731e0
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
cmp r13d, 2
jne 0x14007c416
mov dword [rbp + 0x400], r12d
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
mov edx, r13d
call fcn.1400746e0
mov qword [r15], rax
cmp dword [rbp + 0x400], r14d
jne 0x14007c571
jmp 0x14007c45f
cmp r13d, 0x10
jne 0x14007c452
mov eax, dword [rcx + 0x55c]
nop
cmp eax, r12d
jle 0x14007c3ab
mov byte [rcx + 0x580], r12b
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x8033
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
cmp r13d, 0x11f
je 0x14007c56e
mov ecx, dword [0x1401343c0]
mov rax, qword gs:[0x58]
mov edx, 0x14
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140133e08], ecx
jg 0x14007d7cd
cmp r13d, dword [0x140133e04]
jne 0x14007c579
mov rdx, qword [rsi + 0x568]
test byte [rdx + 0x60], 0x40
je 0x14007c4b2
mov qword [rsi + 0x568], r14
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov rdx, qword [rdx + 0x68]
lea rcx, [rsi + 0x570]
test rdx, rdx
jne 0x14007c4c7
mov r9d, r14d
jmp 0x14007c4db
mov r9, 0xffffffffffffffff
nop
inc r9
cmp word [rdx + r9*2], 0
jne 0x14007c4d0
mov r8d, r9d
call fcn.1400068f0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
mov rcx, qword [rsi + 0x130]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14007c55c
cmp byte [rsi + 0x580], 0
jne 0x14007c55c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x420], xmm0
movups xmmword [rbp + 0x430], xmm0
movups xmmword [rbp + 0x440], xmm0
mov qword [rbp + 0x450], rax
mov dword [rbp + 0x420], 8
movsxd r8, dword [rsi + 0x184]
lea r9, [rbp + 0x420]
mov edx, 0x133c
mov rcx, qword [rsi + 0x130]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x450]
jmp 0x14007c55f
mov rcx, r14
xor r8d, r8d
mov rdx, qword [rsi + 0x568]
call fcn.140090750
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov r9d, 0x100
cmp r13d, 0x4e
jne 0x14007c628
cmp dword [rdi + 0x10], 0xfffffd1b
jne 0x14007d494
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
mov rcx, qword [rsi + 0x130]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14007c56e
cmp byte [rsi + 0x580], 0
jne 0x14007c56e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x420], xmm0
movups xmmword [rbp + 0x430], xmm0
movups xmmword [rbp + 0x440], xmm0
mov qword [rbp + 0x450], rax
mov dword [rbp + 0x420], 8
movsxd r8, dword [rsi + 0x184]
lea r9, [rbp + 0x420]
mov edx, 0x133c
mov rcx, qword [rsi + 0x130]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x14007c56e
mov dl, 1
call fcn.140091790
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
cmp r13d, 0x111
jne 0x14007d311
mov eax, 0x8033
cmp ax, bx
jne 0x14007c731
cmp byte [rsi + 0x581], 0
jne 0x14007c56e
lea r9, [0x1400f1b38]
mov edx, 0x40b
lea r8d, [r13 + 4]
mov rcx, qword [rsi + 0x388]
call qword [sym.imp.USER32.dll_SendMessageW]
mov byte [rsi + 0x581], 1
mov rax, qword [rsi + 0x90]
mov rdx, qword [rsi + 0x98]
lea ebx, [r13 - 0x11]
test rdx, rdx
je 0x14007c6db
movzx ecx, word [rax]
mov r8d, 0xffff
cmp cx, r8w
je 0x14007c6db
mov r10d, 0x8033
cmp r10w, cx
je 0x14007c6b9
add rax, 4
add rdx, 0x10
movzx ecx, word [rax]
cmp cx, r8w
jne 0x14007c6a0
jmp 0x14007c6db
movzx ecx, word [rdx]
test bx, cx
jne 0x14007c6cb
or cx, word [rax + 2]
or cx, bx
mov word [rdx], cx
movzx edx, word [rax + 2]
test dx, cx
je 0x14007c6db
or word [rsi + 0xa0], dx
mov cl, 1
call fcn.140029cd0
lea r9, str.Cancelling...
mov r8, rbx
mov edx, 0x40b
mov rcx, qword [rsi + 0x388]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsi + 0x548]
mov rbx, qword [rsi + 0x540]
cmp rbx, rdi
je 0x14007c56e
mov rcx, qword [rbx]
call fcn.140090450
add rbx, 8
cmp rbx, rdi
jne 0x14007c715
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov eax, 0x8037
cmp ax, bx
jne 0x14007c753
mov rcx, qword [rsi + 0x4a0]
call qword [sym.imp.USER32.dll_SetFocus]
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov eax, 0xe124
cmp ax, bx
jne 0x14007c871
cmp qword [rsi + 0x568], 0
jne 0x14007c850
mov ecx, 0x298
call fcn.14009bfa8
mov r10, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14007c820
mov qword [rax + 8], r14
add rax, 0x10
mov qword [rbp + 0x400], rax
mov qword [rax + 0x18], r14
mov qword [r10 + 0x30], r14
mov dword [r10 + 0x38], r14d
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [r10 + 0x40], rax
xorps xmm0, xmm0
movups xmmword [r10 + 0x48], xmm0
movups xmmword [r10 + 0x58], xmm0
movups xmmword [r10 + 0x68], xmm0
movups xmmword [r10 + 0x78], xmm0
movups xmmword [r10 + 0x88], xmm0
lea rax, [r10 + 0x98]
mov word [rax], r14w
lea rcx, [r10 + 0x198]
mov word [rcx], r14w
mov dword [r10 + 0x48], 0x50
mov edx, 0x100
mov dword [r10 + 0x60], edx
lea rdx, [0x14006fa30]
mov qword [r10 + 0x88], rdx
mov qword [r10 + 0x68], rax
mov dword [r10 + 0x78], 0x800080
mov qword [r10 + 0x70], rcx
lea rax, vtable.WTL::CFindReplaceDialog.0
mov qword [r10], rax
jmp 0x14007c823
mov r10, r14
mov qword [rsi + 0x568], r10
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1801
xor r9d, r9d
mov r8, qword [rsi + 0x570]
mov edx, r12d
mov rcx, r10
call fcn.140068400
mov rcx, qword [rsi + 0x568]
mov edx, 0xa
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov eax, 0x803d
cmp ax, bx
jne 0x14007c88e
cmp qword [rsi + 0x568], 0
je 0x14007c56e
jmp 0x14007c4e3
mov eax, 0x8041
cmp ax, bx
jne 0x14007c934
cmp qword [rsi + 0x568], 0
je 0x14007c56e
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
mov rcx, qword [rsi + 0x130]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x14007c929
cmp byte [rsi + 0x580], 0
jne 0x14007c929
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x420], xmm0
movups xmmword [rbp + 0x430], xmm0
movups xmmword [rbp + 0x440], xmm0
mov qword [rbp + 0x450], rax
mov dword [rbp + 0x420], 8
movsxd r8, dword [rsi + 0x184]
lea r9, [rbp + 0x420]
mov edx, 0x133c
mov rcx, qword [rsi + 0x130]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x450]
mov r8b, 1
jmp 0x14007c562
mov rcx, r14
mov r8b, 1
jmp 0x14007c562
mov eax, 0xe803
cmp ax, bx
jne 0x14007c96e
cmp byte [rsi + 0x581], 0
jne 0x14007c56e
mov eax, dword [rsi + 0x55c]
nop
cmp eax, 1
jg 0x14007c56e
mov rcx, rsi
call fcn.14006a5d0
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
lea eax, [r9 + rbx]
mov ecx, 0xfd
cmp ax, cx
ja 0x14007c99c
movzx edx, bx
sub edx, 0xff00
lea rcx, [rsi + 0xe8]
call fcn.14007edf0
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov r8d, 0x8008
cmp r8w, bx
jne 0x14007c9d1
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.1400786d0
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov r8d, 0x8009
cmp r8w, bx
jne 0x14007ca06
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.140078490
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov r8d, 0x800a
cmp r8w, bx
jne 0x14007ca3b
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.140078900
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov eax, 0x802a
cmp ax, bx
jne 0x14007cb56
call fcn.14006e460
mov rbx, rax
mov rcx, rax
call fcn.140067800
mov ecx, r14d
test eax, eax
sete cl
mov dword [rbp + 0x400], ecx
lea rdx, str.AlwaysOnTop
lea rcx, [rbp + 0x420]
call fcn.1400034d0
nop
mov r9d, 3
lea r8, [rbp + 0x400]
lea rdx, [rbp + 0x420]
mov rcx, rbx
call fcn.1400643b0
nop
mov rdx, qword [rbp + 0x438]
cmp rdx, 8
jb 0x14007cade
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cad9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d80a
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp + 0x430], xmm0
mov word [rbp + 0x420], r14w
mov rcx, rbx
call fcn.140067800
mov ebx, eax
mov rdx, r14
test eax, eax
setne dl
add rdx, 0xfffffffffffffffe
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, [rsi + 0x80]
mov r8d, r14d
test ebx, ebx
setne r8b
xor r9d, r9d
mov edx, 0x802a
call fcn.140080630
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov eax, 0x802b
cmp ax, bx
jne 0x14007cc45
call fcn.14006e460
mov rdi, rax
mov rcx, rax
call fcn.14006f4b0
mov ecx, r14d
test eax, eax
sete cl
mov dword [rbp + 0x400], ecx
lea rdx, str.HideEmptyEntries
lea rcx, [rbp + 0x420]
call fcn.1400034d0
nop
mov r9d, 3
lea r8, [rbp + 0x400]
lea rdx, [rbp + 0x420]
mov rcx, rdi
call fcn.1400643b0
nop
mov rdx, qword [rbp + 0x438]
cmp rdx, 8
jb 0x14007cbf9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cbf4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d810
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp + 0x430], xmm0
mov word [rbp + 0x420], r14w
mov rcx, rdi
call fcn.14006f4b0
mov edx, 0x802b
mov r8d, eax
xor r9d, r9d
lea rcx, [rsi + 0x80]
call fcn.140080630
lea rcx, [rsi + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov eax, 0x802d
cmp ax, bx
jne 0x14007cc8b
call fcn.14006e460
mov rdi, rax
mov rcx, rax
call fcn.14006f900
mov ecx, r14d
test eax, eax
sete cl
mov dword [rbp + 0x400], ecx
lea rdx, [rbp + 0x400]
mov rcx, rdi
call fcn.14006f840
mov rcx, rdi
call fcn.14006f900
mov edx, 0x802d
jmp 0x14007cc1e
mov r8d, 0x802c
cmp r8w, bx
jne 0x14007ccc0
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.140075940
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov eax, 0x802e
cmp ax, bx
jne 0x14007cd8d
call fcn.14006e460
mov rdi, rax
mov rcx, rax
call fcn.14006f710
mov ecx, r14d
test eax, eax
sete cl
mov dword [rbp + 0x400], ecx
lea rdx, str.HideVirusTotalCleanEntries
lea rcx, [rbp + 0x420]
call fcn.1400034d0
nop
mov r9d, 3
lea r8, [rbp + 0x400]
lea rdx, [rbp + 0x420]
mov rcx, rdi
call fcn.1400643b0
nop
mov rdx, qword [rbp + 0x438]
cmp rdx, 8
jb 0x14007cd63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cd5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d816
call fcn.14009bfe4
movdqa xmm0, xmmword [0x1400f80d0]
movdqu xmmword [rbp + 0x430], xmm0
mov word [rbp + 0x420], r14w
mov rcx, rdi
call fcn.14006f710
mov edx, 0x802e
jmp 0x14007cc1e
mov r8d, 0x802f
cmp r8w, bx
jne 0x14007cdc2
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.140077e60
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov r8d, 0x8030
cmp r8w, bx
jne 0x14007cdf7
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.140077420
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov eax, 0xe141
cmp ax, bx
jne 0x14007ce20
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov eax, 0x801d
cmp ax, bx
jne 0x14007ce59
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.https:__docs.microsoft.com_en_us_sysinternals_downloads_autoruns
lea rdx, str.open
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov eax, 0xe140
cmp ax, bx
jne 0x14007cf97
mov qword [rbp + 0x428], r14
lea rax, [rbp + 0x430]
mov qword [rsp + 0x40], rax
mov qword [rbp + 0x448], r14
mov qword [rbp + 0x450], r14
mov dword [rbp + 0x458], r14d
lea rax, vtable.CAboutDlg.0
mov qword [rbp + 0x420], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
mov rax, qword [rbp + 0x448]
test rax, rax
jne 0x14007ced1
call fcn.14009a174
mov qword [rbp + 0x448], rax
test rax, rax
jne 0x14007ced1
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14007cf6b
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.14009a2a4
lea rax, [rbp + 0x420]
mov qword [rbp + 0x430], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp + 0x438], eax
lea rdi, [0x14011a898]
mov qword [rbp + 0x400], rdi
mov byte [rbp + 0x408], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rbp + 0x408], 1
mov rax, qword [0x14011a8c0]
mov qword [rbp + 0x440], rax
lea rax, [rbp + 0x430]
mov qword [0x14011a8c0], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rbp + 0x408], 0
mov qword [rsp + 0x20], r14
lea r9, [0x14007f690]
mov r8, rbx
mov edx, 0x64
mov rcx, qword [0x140133ed0]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
nop
lea rax, [rbp + 0x430]
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp + 0x448]
test rcx, rcx
je 0x14007c56e
call fcn.14009a244
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov eax, 0x801f
cmp ax, bx
jne 0x14007cfcc
call fcn.140088de0
movzx ebx, al
test al, al
je 0x14007cfc1
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
mov qword [r15], rbx
mov eax, r12d
jmp 0x14007d782
mov r8d, 0xe103
cmp r8w, bx
jne 0x14007d001
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.1400751f0
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov eax, 0xe101
cmp ax, bx
jne 0x14007d1b2
movups xmm0, xmmword [str.Computer]
movaps xmmword [rbp + 0x420], xmm0
movzx eax, word [0x1400d91f8]
mov word [rbp + 0x430], ax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x432], xmm0
movups xmmword [rbp + 0x442], xmm0
mov qword [rbp + 0x452], rax
mov dword [rbp + 0x45a], eax
mov word [rbp + 0x45e], ax
mov dword [rbp + 0x400], 0x20
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x420]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov rcx, qword [rsi + 8]
mov dword [rbp - 0x18], r12d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x50], 0x98
lea rax, [rbp + 0x1ec]
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], 0x104
lea rax, [0x1400d9270]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x14]
mov qword [rbp - 0x70], rax
mov edx, 0x100
mov dword [rbp - 0x68], edx
mov dword [rbp - 0x50], 0x881000
lea rax, str.Autoruns_files__.arn_
mov qword [rsp + 0x68], rax
mov rax, qword [0x140133ed0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rcx
mov word [rbp + 0x1ec], r14w
mov word [rbp - 0x14], r14w
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x420]
mov edx, 0x104
lea rcx, [rbp + 0x1ec]
call fcn.1400b15ac
test eax, eax
je 0x14007d155
cmp eax, 0xc
je 0x14007d832
cmp eax, 0x16
je 0x14007d827
cmp eax, 0x22
je 0x14007d827
cmp eax, 0x50
jne 0x14007d81c
lea rax, str.Open_Autoruns_Scan
mov qword [rbp - 0x58], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
cmove rcx, rax
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x50]
cmp dword [rbp - 0x18], 0
je 0x14007d18a
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x14007d190
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x14007c56e
lea rdx, [rbp + 0x1ec]
mov rcx, rsi
call fcn.140078ad0
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov r8d, 0x8007
cmp r8w, bx
jne 0x14007d1e7
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.140076ee0
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov r8d, 0x8029
cmp r8w, bx
jne 0x14007d21c
shr rbx, 0x10
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
movzx edx, bx
mov rcx, rsi
call fcn.140074af0
mov qword [r15], rax
mov eax, r12d
jmp 0x14007d782
mov r8d, 0x1388
movzx eax, bx
sub ax, r8w
cmp ax, 0x63
ja 0x14007d494
movzx edx, bx
mov eax, dword [rsi + 0xe0]
add eax, r8d
cmp edx, eax
je 0x14007d2b9
mov eax, dword [rsi + 0x55c]
nop
cmp eax, 1
jle 0x14007d274
mov r9d, 0x30
lea r8d, [r9 + 0x51]
lea rdx, str.Cannot_switch_profiles_while_scanning._Wait_or_cancel_the_scan.
mov rcx, qword [rsi + 8]
call fcn.140055b80
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
add edx, 0xffffec78
mov rcx, rsi
call fcn.14007fc60
test al, al
jne 0x14007d2ab
mov r9d, 0x40
lea r8d, [r9 - 0x30]
lea rdx, str.Error_loading_profile.
mov rcx, qword [rsi + 8]
call fcn.140055b80
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
mov rcx, rsi
call fcn.14006a5d0
mov r8d, 0x1388
mov rcx, qword [rsi + 0xd0]
sub rcx, qword [rsi + 0xc8]
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
mov r9, rdx
sar r9, 4
mov rax, r9
shr rax, 0x3f
add r9, rax
add r9d, 0x1387
mov edx, dword [rsi + 0xe0]
add edx, r8d
lea rcx, [rsi + 0x80]
mov dword [rsp + 0x20], r14d
call fcn.140080730
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
cmp r13d, 0x18
jne 0x14007d494
cmp byte [0x140133dfc], 0
jne 0x14007c56e
mov byte [0x140133dfc], 1
call fcn.14006e460
mov r13, rax
lea rdx, str.MainWindowPlacement
lea rcx, [rbp + 0x400]
call fcn.1400034d0
nop
mov rdi, qword [r13]
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x14007d3a0
nop dword [rax]
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 0x400]
cmp qword [rbp + 0x418], 8
cmovae rdx, qword [rbp + 0x400]
cmp qword [rcx + 0x18], 8
jb 0x14007d385
mov rcx, qword [rcx]
call fcn.1400b0f10
test eax, eax
jns 0x14007d394
mov rbx, qword [rbx + 0x10]
jmp 0x14007d39a
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14007d360
cmp byte [rdi + 0x19], 0
jne 0x14007d3d4
lea rdx, [rdi + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x14007d3b4
mov rdx, qword [rdx]
lea rcx, [rbp + 0x400]
cmp qword [rbp + 0x418], 8
cmovae rcx, qword [rbp + 0x400]
call fcn.1400b0f10
test eax, eax
jns 0x14007d3d8
mov rdi, qword [r13]
mov rdx, qword [rbp + 0x418]
cmp rdx, 8
jb 0x14007d41e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d419
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d7c7
call fcn.14009bfe4
mov qword [rbp + 0x410], r14
mov qword [rbp + 0x418], 7
mov word [rbp + 0x400], r14w
mov rax, qword [rdi + 0x68]
movups xmm2, xmmword [rax]
movups xmmword [rbp + 0x420], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x430], xmm0
movsd xmm1, qword [rax + 0x20]
movsd qword [rbp + 0x440], xmm1
mov eax, dword [rax + 0x28]
mov dword [rbp + 0x448], eax
psrldq xmm2, 8
movd eax, xmm2
test eax, eax
je 0x14007c56e
lea rdx, [rbp + 0x420]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_SetWindowPlacement]
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
cmp r13d, 0x117
jne 0x14007d4dd
mov dword [rbp + 0x400], r12d
lea rax, [rbp + 0x400]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rbx
mov edx, r13d
lea rcx, [rsi + 0x80]
call fcn.140076490
mov qword [r15], rax
cmp dword [rbp + 0x400], 0
je 0x14007d5c6
mov eax, r12d
jmp 0x14007d782
cmp r13d, 0x111
jne 0x14007d553
mov r11d, r14d
cmp byte [rsi + 0xa2], r14b
je 0x14007d543
mov rax, rbx
shr rax, 0x10
cmp ax, 1
jne 0x14007d543
mov rcx, qword [rsi + 0x90]
mov rdx, qword [rsi + 0x98]
test rdx, rdx
je 0x14007d543
movzx eax, word [rcx]
mov r8d, 0xffff
cmp ax, r8w
je 0x14007d543
cmp bx, ax
je 0x14007d539
add rcx, 4
add rdx, 0x10
movzx eax, word [rcx]
cmp ax, r8w
jne 0x14007d521
jmp 0x14007d543
movzx eax, word [rdx]
test r9d, eax
cmovne r11d, r12d
mov qword [r15], r14
test r11d, r11d
je 0x14007d5c6
mov eax, r12d
jmp 0x14007d782
cmp r13d, 5
jne 0x14007d56f
cmp rbx, 1
je 0x14007d56a
mov edx, r12d
mov rcx, rsi
call fcn.140080f90
mov qword [r15], r12
jmp 0x14007d5c6
cmp r13d, 0x4e
jne 0x14007d5c6
mov eax, dword [rdi + 0x10]
cmp eax, 0xfffffcbe
jne 0x14007d594
xor edx, edx
mov rcx, rsi
call fcn.140080f90
mov qword [r15], r14
mov eax, r12d
jmp 0x14007d782
cmp eax, 0xfffffcb7
jne 0x14007d5c6
mov dword [rbp + 0x400], r12d
lea r9, [rbp + 0x400]
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.140072990
mov qword [r15], rax
cmp dword [rbp + 0x400], 0
jne 0x14007c571
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8d, r13d
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.14007a530
test eax, eax
jne 0x14007c571
cmp r13d, 0x111
jne 0x14007d65b
mov rcx, qword [rsi + 0xf0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14007d65b
mov edx, dword [rsi + 0x184]
test edx, edx
js 0x14007d65b
lea rcx, [rsi + 0xe8]
call fcn.14006e9c0
mov rcx, qword [rax]
mov r10, qword [rcx]
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8d, r13d
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call r10
test eax, eax
jne 0x14007c571
mov dword [rbp + 0x400], r12d
lea eax, [r13 - 0x2b]
jmp 0x14007d684
mov dword [rbp + 0x400], r12d
cmp r13d, 0x132
ja 0x14007d6fe
je case.0x14007d729.307
lea eax, [r13 - 0x2b]
cmp eax, 0xea
ja case.0x14007d729.309
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x7d860]
mov ecx, dword [rdx + rax*4 + 0x7d840]
add rcx, rdx
jmp rcx
mov rax, rdi
test rdi, rdi
cmove rax, r14
jmp 0x14007d751
mov rax, qword [rdi]
jmp 0x14007d751
test rbx, rbx
je case.0x14007d729.309
mov rax, qword [rdi + 0x18]
jmp 0x14007d751
test rbx, rbx
je case.0x14007d729.309
mov edx, dword [rdi + 4]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x14007d751
test rbx, rbx
je case.0x14007d729.309
mov rax, qword [rdi + 8]
jmp 0x14007d751
test rbx, rbx
je case.0x14007d729.309
mov rax, qword [rdi + 0x10]
jmp 0x14007d751
lea eax, [r13 - 0x133]
cmp eax, 0xdd
ja case.0x14007d729.309
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x7d958]
mov ecx, dword [rdx + rax*4 + 0x7d94c]
add rcx, rdx
jmp rcx
movzx ecx, bx
sub ecx, 1
je case.0x14007d729.307
cmp ecx, 1
je case.0x14007d729.307
mov rax, rbx
shr rax, 0x10
movzx edx, ax
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x14007d751
mov rax, rdi
test rax, rax
je case.0x14007d729.309
lea edx, [r13 + 0x2000]
mov r9, rdi
mov r8, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [r15], rax
test rax, rax
jne 0x14007d7b6
lea eax, [r13 - 0x132]
cmp eax, 6
ja 0x14007d7b6
xor eax, eax
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.14009c570
add rsp, 0x578
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, r14d
mov qword [r15], r12
test eax, eax
setne r14b
mov eax, r14d
jmp 0x14007d782
mov eax, dword [rbp + 0x400]
test eax, eax
setne r14b
mov eax, r14d
jmp 0x14007d782
call fcn.1400a3080
int3
lea rcx, [0x140133e08]
call fcn.14009c3c4
cmp dword [0x140133e08], 0xffffffff
jne 0x14007c486
lea rcx, str.commdlg_FindReplace
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140133e04], eax
lea rcx, [0x140133e08]
call fcn.14009c364
jmp 0x14007c486
call fcn.1400a3080
int3
call fcn.1400a3080
int3
call fcn.1400a3080
int3
mov ecx, 0x80004005
call fcn.140007f00
int3
mov ecx, 0x80070057
call fcn.140007f00
int3
mov ecx, 0x8007000e
call fcn.140007f00
int3